4.1.11-stable review
Subsystems (8)
Greg Kroah-Hartman
maintainercover 4.1.11-stable review
This is the start of the stable review cycle for the 4.1.11 release. There are 202 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Oct 20 01:48:10 UTC 2015. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.1.11-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.1.11-rc1
Christoph Hellwig <[email protected]>
3w-9xxx: don't unmap bounce buffered commands
Guenter Roeck <[email protected]>
MIPS: Fix console output for Fulong2e system
Joonsoo Kim <[email protected]>
mm/slab: fix unexpected index mapping result of kmalloc_size(INDEX_NODE+1)
Prarit Bhargava <[email protected]>
intel_pstate: Fix overflow in busy_scaled due to long delay
Uwe Kleine-König <[email protected]>
serial: atmel: fix error path of probe function
Mans Rullgard <[email protected]>
serial: 8250: add uart_config entry for PORT_RT2880
Jann Horn <[email protected]>
drivers/tty: require read access for controlling terminal
Kosuke Tatsukawa <[email protected]>
tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
[email protected] <[email protected]>
staging: speakup: fix speakup-r regression
Joe Thornber <[email protected]>
dm cache: fix NULL pointer when switching from cleaner policy
Junichi Nomura <[email protected]>
dm: fix AB-BA deadlock in __dm_destroy()
Trond Myklebust <[email protected]>
namei: results of d_is_negative() should be checked after dentry revalidation
Ben Dooks <[email protected]>
clk: ti: fix dual-registration of uart4_ick
Kinglong Mee <[email protected]>
nfs/filelayout: Fix NULL reference caused by double freeing of fh_array
Al Viro <[email protected]>
fix a braino in ovl_d_select_inode()
David Howells <[email protected]>
overlayfs: Make f_path always point to the overlay and f_inode to the underlay
David Howells <[email protected]>
overlay: Call ovl_drop_write() earlier in ovl_dentry_open()
NeilBrown <[email protected]>
md/bitmap: don't pass -1 to bitmap_storage_alloc.
Ben Hutchings <[email protected]>
genirq: Fix race in register_irq_proc()
Stefan Assmann <[email protected]>
igb: do not re-init SR-IOV during probe
Chas Williams <[email protected]>
net/xen-netfront: only napi_synchronize() if running
Andreas Schwab <[email protected]>
m68k: Define asmlinkage_protect
Mark Salyzyn <[email protected]>
arm64: readahead: fault retry breaks mmap file read random detection
Li Bin <[email protected]>
arm64: ftrace: fix function_graph tracer panic
Ard Biesheuvel <[email protected]>
arm64/efi: Fix boot crash by not padding between EFI_MEMORY_RUNTIME regions
Eric W. Biederman <[email protected]>
vfs: Test for and handle paths that are unreachable from their mnt_root
Eric W. Biederman <[email protected]>
dcache: Handle escaped paths in prepend_path
Ulf Hansson <[email protected]>
mmc: core: Don't return an error for CD/WP GPIOs when GPIOLIB is unset
Haibo Chen <[email protected]>
mmc: sdhci: fix dma memory leak in sdhci_pre_req()
shengyong <[email protected]>
UBI: return ENOSPC if no enough space available
Richard Weinberger <[email protected]>
UBI: Validate data_size
Richard Weinberger <[email protected]>
UBIFS: Kill unneeded locking in ubifs_init_security
Eric Dumazet <[email protected]>
inet: fix potential deadlock in reqsk_queue_unlink()
Christian Engelmayer <[email protected]>
rsi: Fix possible leak when loading firmware
Paul Mackerras <[email protected]>
powerpc/MSI: Fix race condition in tearing down MSI interrupts
Kapileshwar Singh <[email protected]>
tools lib traceevent: Fix string handling in heterogeneous arch environments
Linus Lüssing <[email protected]>
batman-adv: Fix potentially broken skb network header access
Linus Lüssing <[email protected]>
batman-adv: Fix potential synchronization issues in mcast tvlv handler
Linus Lüssing <[email protected]>
batman-adv: Make MCAST capability changes atomic
Linus Lüssing <[email protected]>
batman-adv: Make TT capability changes atomic
Linus Lüssing <[email protected]>
batman-adv: Make NC capability changes atomic
James Hogan <[email protected]>
MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
Viresh Kumar <[email protected]>
cpufreq: dt: Tolerance applies on both sides of target voltage
Borislav Petkov <[email protected]>
cpu/cacheinfo: Fix teardown path
Yao-Wen Mao <[email protected]>
USB: Add reset-resume quirk for two Plantronics usb headphones.
Vincent Palatin <[email protected]>
usb: Add device quirk for Logitech PTZ cameras
Alexander Inyukhin <[email protected]>
USB: chaoskey read offset bug
Felipe Balbi <[email protected]>
usb: musb: cppi41: allow it to work again
Roger Quadros <[email protected]>
usb: phy: phy-generic: Fix reset behaviour on legacy boot
Mathias Nyman <[email protected]>
usb: Use the USB_SS_MULT() macro to get the burst multiplier.
Peter Chen <[email protected]>
usb: chipidea: udc: using the correct stall implementation
Bin Liu <[email protected]>
usb: musb: dsps: fix polling in device-only mode
Jann Horn <[email protected]>
security: fix typo in security_task_prctl
Mark Brown <[email protected]>
regmap: debugfs: Don't bother actually printing when calculating max length
Mark Brown <[email protected]>
regmap: debugfs: Ensure we don't underflow when printing access masks
Gabriel Krisman Bertazi <[email protected]>
ipr: Enable SIS pipe commands for SIS-32 devices.
Russell King <[email protected]>
pcmcia: sa11x0: fix missing clk_put() in sa11x0 socket drivers
Michal Kazior <[email protected]>
ath10k: reject 11b tx fragmentation configuration
Andy Shevchenko <[email protected]>
device property: fix potential NULL pointer dereference
Heiko Stuebner <[email protected]>
PM / AVS: rockchip-io: depend on CONFIG_POWER_AVS
Boris BREZILLON <[email protected]>
mtd: nand: sunxi: fix OOB handling in ->write_xxx() functions
Boris BREZILLON <[email protected]>
mtd: nand: sunxi: fix sunxi_nand_chips_cleanup()
Antoine Ténart <[email protected]>
mtd: pxa3xx_nand: add a default chunk size
Mario Carrillo <[email protected]>
docs: update HOWTO for 3.x -> 4.x versioning
Marc Zyngier <[email protected]>
irqchip/gic-v3-its: Add missing cache flushes
Ludovic Desroches <[email protected]>
irqchip/atmel-aic5: Use per chip mask caches in mask/unmask()
Peter Seiderer <[email protected]>
cifs: use server timestamp for ntlmv2 authentication
Li Jun <[email protected]>
usb: chipidea: imx: fix a typo for imx6sx
Dong Aisheng <[email protected]>
dts: imx25: fix sd card gpio polarity specified in device tree
Dong Aisheng <[email protected]>
dts: imx53: fix sd card gpio polarity specified in device tree
Dong Aisheng <[email protected]>
dts: imx51: fix sd card gpio polarity specified in device tree
Dong Aisheng <[email protected]>
mmc: sdhci-esdhc-imx: fix cd regression for dt platform
Fabio Estevam <[email protected]>
mmc: sdhci-esdhc-imx: Do not break platform data boards
Fabio Estevam <[email protected]>
mmc: sdhci-esdhc-imx: Move mmc_of_parse() to the dt probe
Alexey Brodkin <[email protected]>
mmc: dw_mmc: handle data blocks > than 4kB if IDMAC is used
Linus Lüssing <[email protected]>
batman-adv: Make DAT capability changes atomic
Marek Lindner <[email protected]>
batman-adv: protect tt_local_entry from concurrent delete events
Marek Lindner <[email protected]>
batman-adv: fix kernel crash due to missing NULL checks
Linus Walleij <[email protected]>
fbdev: select versatile helpers for the integrator
Julian Anastasov <[email protected]>
ipvs: call skb_sender_cpu_clear
Julian Anastasov <[email protected]>
ipvs: fix crash with sync protocol v0 and FTP
Alex Gartrell <[email protected]>
ipvs: skb_orphan in case of forwarding
Julian Anastasov <[email protected]>
ipvs: fix crash if scheduler is changed
Julian Anastasov <[email protected]>
ipvs: do not use random local source address for tunnels
Dave Martin <[email protected]>
serial/amba-pl011: Disable interrupts around TX softirq
Ben Segall <[email protected]>
sched/fair: Prevent throttling in early pick_next_task_fair()
Linus Torvalds <[email protected]>
Initialize msg/shm IPC objects before doing ipc_addid()
Reyad Attiyat <[email protected]>
usb: xhci: Add support for URB_ZERO_PACKET to bulk/sg transfers
Mathias Nyman <[email protected]>
xhci: init command timeout timer earlier to avoid deleting it uninitialized
Mathias Nyman <[email protected]>
xhci: change xhci 1.0 only restrictions to support xhci 1.1
Roger Quadros <[email protected]>
usb: xhci: exit early in xhci_setup_device() if we're halted or dying
Roger Quadros <[email protected]>
usb: xhci: Clear XHCI_STATE_DYING on start
Roger Quadros <[email protected]>
usb: xhci: lock mutex on xhci_stop
Mathias Nyman <[email protected]>
xhci: give command abortion one more chance before killing xhci
Johan Hovold <[email protected]>
USB: whiteheat: fix potential null-deref at probe
Dave Airlie <[email protected]>
drm/dp/mst: drop cancel work sync in the mstb destroy path (v2)
Michel Dänzer <[email protected]>
drm/radeon: Restore LCD backlight level on resume (>= R5xx)
Daniel Vetter <[email protected]>
drm: Reject DRI1 hw lock ioctl functions for kms drivers
Jani Nikula <[email protected]>
drm/i915/bios: handle MIPI Sequence Block v3+ gracefully
Fabiano Fidêncio <[email protected]>
drm/qxl: recreate the primary surface when the bo is not primary
Dave Airlie <[email protected]>
drm/qxl: only report first monitor as connected if we have no state
Steve French <[email protected]>
Do not fall back to SMBWriteX in set_file_size error cases
Steve French <[email protected]>
disabling oplocks/leases via module parm enable_oplocks broken for SMB3
Steve French <[email protected]>
Fix sec=krb5 on smb3 mounts
Trond Myklebust <[email protected]>
NFS: Fix a write performance regression
Peng Tao <[email protected]>
nfs: fix pg_test page count calculation
Kinglong Mee <[email protected]>
NFS: Do cleanup before resetting pageio read/write to mds
Johan Hedberg <[email protected]>
Bluetooth: Delay check for conn->smp in smp_conn_security()
Florian Westphal <[email protected]>
netfilter: nf_log: don't zap all loggers on unregister
Pablo Neira Ayuso <[email protected]>
netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC
Pablo Neira Ayuso <[email protected]>
netfilter: nf_log: wait for rcu grace after logger unregistration
Eric W. Biederman <[email protected]>
netfilter: nftables: Do not run chains in the wrong network namespace
Eric W. Biederman <[email protected]>
netfilter: nf_qeueue: Drop queue entries on nf_unregister_hook
Pablo Neira Ayuso <[email protected]>
netfilter: ctnetlink: put back references to master ct and expect objects
Joe Stringer <[email protected]>
netfilter: nf_conntrack: Support expectations in different zones
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: Use 32 bit addressing register from nft_type_to_reg()
Pablo Neira Ayuso <[email protected]>
netfilter: nfnetlink: work around wrong endianess in res_id field
Mikulas Patocka <[email protected]>
dm raid: fix round up of default region size
NeilBrown <[email protected]>
md/raid0: apply base queue limits *before* disk_stack_limits
NeilBrown <[email protected]>
md/raid0: update queue parameter in a safer location.
Liu.Zhao <[email protected]>
USB: option: add ZTE PIDs
Shawn Lin <[email protected]>
staging: ion: fix corruption of ion_import_dma_buf
Joe Thornber <[email protected]>
dm btree: add ref counting ops for the leaves of top level btrees
Chuck Lever <[email protected]>
svcrdma: Fix send_reply() scatter/gather set-up
Michal Kazior <[email protected]>
ath10k: fix dma_mapping_error() handling
Mike Snitzer <[email protected]>
dm crypt: constrain crypt device's max_segment_size to PAGE_SIZE
Bjorn Helgaas <[email protected]>
PCI: Clear IORESOURCE_UNSET when clipping a bridge window
Alex Williamson <[email protected]>
PCI: Use function 0 VPD for identical functions, regular VPD for others
Alex Williamson <[email protected]>
PCI: Fix devfn for VPD access through function 0
Filipe Manana <[email protected]>
Btrfs: update fix for read corruption of compressed and shared extents
Filipe Manana <[email protected]>
Btrfs: fix read corruption of compressed and shared extents
Jeff Mahoney <[email protected]>
btrfs: skip waiting on ordered range for special files
Gianluca Renzi <[email protected]>
ASoC: sgtl5000: fix wrong register MIC_BIAS_VOLTAGE setup on probe
Lars-Peter Clausen <[email protected]>
ASoC: db1200: Fix DAI link format for db1300 and db1550
Yitian Bu <[email protected]>
ASoC: dwc: correct irq clear method
Robert Jarzmik <[email protected]>
ASoC: fix broken pxa SoC support
Robert Jarzmik <[email protected]>
ASoC: pxa: pxa2xx-ac97: fix dma requestor lines
Takashi Iwai <[email protected]>
ALSA: hda - Disable power_save_node for IDT 92HD73xx chips
John Flatness <[email protected]>
ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1
Laura Abbott <[email protected]>
ALSA: hda: Add dock support for ThinkPad T550
Takashi Iwai <[email protected]>
ALSA: synth: Fix conflicting OSS device registration on AWE32
Takashi Iwai <[email protected]>
ALSA: hda - Disable power_save_node for Thinkpads
Mel Gorman <[email protected]>
mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault
Joseph Qi <[email protected]>
ocfs2/dlm: fix deadlock when dispatch assert master
Sowmini Varadhan <[email protected]>
lib/iommu-common.c: do not try to deref a null iommu->lazy_flush() pointer when n < pool->hint
Naoya Horiguchi <[email protected]>
mm: migrate: hugetlb: putback destination hugepage to active list
Sudip Mukherjee <[email protected]>
spi: spidev: fix possible NULL dereference
Tan, Jui Nee <[email protected]>
spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled
Max Filippov <[email protected]>
spi: xtensa-xtfpga: fix register endianness
Guenter Roeck <[email protected]>
spi: Fix documentation of spi_alloc_master()
Christian Borntraeger <[email protected]>
s390/boot/decompression: disable floating point in decompressor
Martin Schwidefsky <[email protected]>
s390/compat: correct uc_sigmask of the compat signal frame
Peter Zijlstra <[email protected]>
sched/core: Fix TASK_DEAD race in finish_task_switch()
Ricardo Ribalda Delgado <[email protected]>
leds/led-class: Add missing put_device()
Vitaly Kuznetsov <[email protected]>
x86/xen: Support kexec/kdump in HVM guests by doing a soft reset
Stephen Smalley <[email protected]>
x86/mm: Set NX on gap between __ex_table and rodata
Thomas Gleixner <[email protected]>
x86/process: Add proper bound checks in 64bit get_wchan()
Lee, Chun-Yi <[email protected]>
x86/kexec: Fix kexec crash in syscall kexec_file_load()
Matt Fleming <[email protected]>
x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down
Dirk Müller <[email protected]>
Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS
Andy Lutomirski <[email protected]>
x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code
Andy Lutomirski <[email protected]>
x86/paravirt: Replace the paravirt nop with a bona fide empty function
David Woodhouse <[email protected]>
x86/platform: Fix Geode LX timekeeping in the generic x86 build
Thomas Gleixner <[email protected]>
x86/alternatives: Make optimize_nops() interrupt safe and synced
Shaohua Li <[email protected]>
x86/apic: Serialize LVTT and TSC_DEADLINE writes
Andy Shevchenko <[email protected]>
dmaengine: dw: properly read DWC_PARAMS register
Jeff Moyer <[email protected]>
blockdev: don't set S_DAX for misaligned partitions
Felipe F. Tonello <[email protected]>
ARM: dts: fix usb pin control for imx-rex dts
Chanho Park <[email protected]>
ARM: EXYNOS: reset Little cores when cpu is up
Carl Frederik Werner <[email protected]>
ARM: dts: omap3-beagle: make i2c3, ddc and tfp410 gpio work again
Grazvydas Ignotas <[email protected]>
ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets
Doug Anderson <[email protected]>
ARM: 8425/1: kgdb: Don't try to stop the machine when setting breakpoints
Paul Bolle <[email protected]>
windfarm: decrement client count when unregistering
Ard Biesheuvel <[email protected]>
ARM: 8429/1: disable GCC SRA optimization
Russell King <[email protected]>
ARM: fix Thumb2 signal handling when ARMv6 is enabled
Guenter Roeck <[email protected]>
hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips
Dominik Dingel <[email protected]>
sched: access local runqueue directly in single_task_running
Francesco Lavra <[email protected]>
watchdog: sunxi: fix activation of system reset
Peter Zijlstra <[email protected]>
perf: Fix AUX buffer refcounting
Arnaldo Carvalho de Melo <[email protected]>
perf header: Fixup reading of HEADER_NRCPUS feature
Ben Hutchings <[email protected]>
perf tools: Add empty Build files for architectures lacking them
Kan Liang <[email protected]>
perf stat: Get correct cpu id for print_aggr
Arnaldo Carvalho de Melo <[email protected]>
perf hists: Update the column width for the "srcline" sort key
Adrian Hunter <[email protected]>
perf tools: Fix copying of /proc/kcore
Peter Zijlstra <[email protected]>
perf/x86/intel: Fix constraint access
Azael Avalos <[email protected]>
toshiba_acpi: Fix hotkeys registration on some toshiba models
Nicholas Bellinger <[email protected]>
target: Fix v4.1 UNIT_ATTENTION se_node_acl->device_list[] NULL pointer
Jenny Derzhavetz <[email protected]>
iser-target: Put the reference on commands waiting for unsol data
Jenny Derzhavetz <[email protected]>
iser-target: remove command with state ISTATE_REMOVE
Nicholas Bellinger <[email protected]>
target: Attach EXTENDED_COPY local I/O descriptors to xcopy_pt_sess
Michal Hocko <[email protected]>
scsi: fix scsi_error_handler vs. scsi_host_dev_release race
Andy Grover <[email protected]>
target/iscsi: Fix np_ip bracket issue by removing np_ip
John Stultz <[email protected]>
time: Fix timekeeping_freqadjust()'s incorrect use of abs() instead of abs64()
Gautham R. Shenoy <[email protected]>
KVM: PPC: Book3S HV: Pass the correct trap argument to kvmhv_commence_exit
Thomas Huth <[email protected]>
KVM: PPC: Book3S: Take the kvm->srcu lock in kvmppc_h_logical_ci_load/store()
Marc Zyngier <[email protected]>
arm: KVM: Disable virtual timer even if the guest is not using it
Jason Wang <[email protected]>
kvm: fix double free for fast mmio eventfd
Jason Wang <[email protected]>
kvm: factor out core eventfd assign/deassign logic
Jason Wang <[email protected]>
kvm: fix zero length mmio searching
Jason Wang <[email protected]>
kvm: don't try to register to KVM_FAST_MMIO_BUS for non mmio eventfd
Wanpeng Li <[email protected]>
KVM: vmx: fix VPID is 0000H in non-root operation
Marek Majtyka <[email protected]>
arm: KVM: Fix incorrect device to IPA mapping
-------------
Diffstat:
Documentation/HOWTO | 28 +++--- Makefile | 4 +- arch/arm/Makefile | 8 ++ arch/arm/boot/dts/imx25-pdk.dts | 5 +- arch/arm/boot/dts/imx51-apf51dev.dts | 2 +- arch/arm/boot/dts/imx53-ard.dts | 4 +- arch/arm/boot/dts/imx53-m53evk.dts | 4 +- arch/arm/boot/dts/imx53-qsb-common.dtsi | 4 +- arch/arm/boot/dts/imx53-smd.dts | 4 +- arch/arm/boot/dts/imx53-tqma53.dtsi | 4 +- arch/arm/boot/dts/imx53-tx53.dtsi | 4 +- arch/arm/boot/dts/imx53-voipac-bsb.dts | 4 +- arch/arm/boot/dts/imx6qdl-rex.dtsi | 2 - arch/arm/boot/dts/omap3-beagle.dts | 2 +- arch/arm/boot/dts/omap5-uevm.dts | 4 +- arch/arm/kernel/kgdb.c | 8 +- arch/arm/kernel/signal.c | 15 ++- arch/arm/kvm/interrupts_head.S | 6 +- arch/arm/kvm/mmu.c | 6 +- arch/arm/mach-exynos/mcpm-exynos.c | 27 +++++- arch/arm/mach-exynos/regs-pmu.h | 6 ++ arch/arm64/kernel/efi.c | 3 +- arch/arm64/kernel/entry-ftrace.S | 22 ++++- arch/arm64/mm/fault.c | 1 + arch/m68k/include/asm/linkage.h | 30 ++++++ arch/mips/loongson/common/env.c | 3 + arch/mips/mm/dma-default.c | 2 +- arch/powerpc/kvm/book3s.c | 6 ++ arch/powerpc/kvm/book3s_hv_rmhandlers.S | 1 + arch/powerpc/platforms/powernv/pci.c | 5 +- arch/powerpc/sysdev/fsl_msi.c | 5 +- arch/powerpc/sysdev/mpic_pasemi_msi.c | 6 +- arch/powerpc/sysdev/mpic_u3msi.c | 5 +- arch/powerpc/sysdev/ppc4xx_msi.c | 5 +- arch/s390/boot/compressed/Makefile | 2 +- arch/s390/kernel/compat_signal.c | 27 +++++- arch/x86/kernel/alternative.c | 5 + arch/x86/kernel/apic/apic.c | 7 ++ arch/x86/kernel/cpu/perf_event_intel.c | 5 +- arch/x86/kernel/crash.c | 7 +- arch/x86/kernel/entry_64.S | 16 +++- arch/x86/kernel/paravirt.c | 16 +++- arch/x86/kernel/process_64.c | 52 +++++++++-- arch/x86/kernel/tsc.c | 17 ++-- arch/x86/kvm/svm.c | 2 +- arch/x86/kvm/vmx.c | 2 + arch/x86/mm/init_64.c | 2 +- arch/x86/platform/efi/efi.c | 67 ++++++++++++- arch/x86/xen/enlighten.c | 23 +++++ drivers/base/cacheinfo.c | 10 +- drivers/base/property.c | 5 +- drivers/base/regmap/regmap-debugfs.c | 5 +- drivers/clk/ti/clk-3xxx.c | 2 +- drivers/cpufreq/cpufreq-dt.c | 3 +- drivers/cpufreq/intel_pstate.c | 10 +- drivers/dma/dw/core.c | 4 +- drivers/firmware/efi/libstub/arm-stub.c | 88 +++++++++++++++--- drivers/gpu/drm/drm_dp_mst_topology.c | 5 +- drivers/gpu/drm/drm_lock.c | 6 ++ drivers/gpu/drm/i915/intel_bios.c | 12 ++- drivers/gpu/drm/qxl/qxl_display.c | 14 +-- drivers/gpu/drm/radeon/atombios_encoders.c | 8 +- drivers/hwmon/nct6775.c | 16 ++-- drivers/infiniband/ulp/isert/ib_isert.c | 47 +++++++++- drivers/irqchip/irq-atmel-aic5.c | 24 +++-- drivers/irqchip/irq-gic-v3-its.c | 6 +- drivers/leds/led-class.c | 7 +- drivers/macintosh/windfarm_core.c | 2 +- drivers/md/bitmap.c | 3 +- drivers/md/dm-cache-policy-cleaner.c | 2 +- drivers/md/dm-crypt.c | 17 +++- drivers/md/dm-raid.c | 3 +- drivers/md/dm.c | 6 +- drivers/md/persistent-data/dm-btree-internal.h | 6 ++ drivers/md/persistent-data/dm-btree-remove.c | 12 +-- drivers/md/persistent-data/dm-btree-spine.c | 37 ++++++++ drivers/md/persistent-data/dm-btree.c | 7 +- drivers/md/raid0.c | 75 ++++++++------- drivers/mmc/core/host.c | 4 +- drivers/mmc/host/dw_mmc.c | 109 ++++++++++++++-------- drivers/mmc/host/sdhci-esdhc-imx.c | 50 ++++++++-- drivers/mmc/host/sdhci.c | 67 +++++-------- drivers/mmc/host/sdhci.h | 8 +- drivers/mtd/nand/pxa3xx_nand.c | 3 + drivers/mtd/nand/sunxi_nand.c | 27 ++---- drivers/mtd/ubi/io.c | 5 + drivers/mtd/ubi/vtbl.c | 1 + drivers/mtd/ubi/wl.c | 1 + drivers/net/ethernet/intel/igb/igb_main.c | 2 +- drivers/net/wireless/ath/ath10k/htc.c | 4 +- drivers/net/wireless/ath/ath10k/htt_tx.c | 8 +- drivers/net/wireless/ath/ath10k/mac.c | 16 ++++ drivers/net/wireless/ath/ath10k/pci.c | 8 +- drivers/net/wireless/ath/ath10k/wmi.c | 1 + drivers/net/wireless/rsi/rsi_91x_sdio_ops.c | 8 +- drivers/net/wireless/rsi/rsi_91x_usb_ops.c | 8 +- drivers/net/xen-netfront.c | 3 +- drivers/pci/access.c | 27 +----- drivers/pci/bus.c | 2 + drivers/pci/quirks.c | 20 +++- drivers/pcmcia/sa1100_generic.c | 1 - drivers/pcmcia/sa11xx_base.c | 3 +- drivers/platform/x86/toshiba_acpi.c | 8 +- drivers/power/avs/Kconfig | 2 +- drivers/scsi/3w-9xxx.c | 28 ++++-- drivers/scsi/ipr.c | 2 +- drivers/scsi/scsi_error.c | 11 ++- drivers/spi/spi-pxa2xx.c | 4 + drivers/spi/spi-xtensa-xtfpga.c | 4 +- drivers/spi/spi.c | 3 +- drivers/spi/spidev.c | 3 +- drivers/staging/android/ion/ion.c | 6 +- drivers/staging/speakup/fakekey.c | 1 + drivers/target/iscsi/iscsi_target.c | 33 ++++--- drivers/target/iscsi/iscsi_target.h | 2 +- drivers/target/iscsi/iscsi_target_configfs.c | 14 +-- drivers/target/iscsi/iscsi_target_login.c | 8 +- drivers/target/iscsi/iscsi_target_tpg.c | 15 ++- drivers/target/iscsi/iscsi_target_tpg.h | 2 +- drivers/target/target_core_pr.c | 3 + drivers/target/target_core_ua.c | 8 +- drivers/target/target_core_xcopy.c | 6 +- drivers/tty/n_tty.c | 15 +-- drivers/tty/serial/8250/8250_core.c | 8 ++ drivers/tty/serial/amba-pl011.c | 4 +- drivers/tty/serial/atmel_serial.c | 2 +- drivers/tty/tty_io.c | 31 ++++++- drivers/usb/chipidea/ci_hdrc_imx.c | 2 +- drivers/usb/chipidea/udc.c | 84 +++++++++-------- drivers/usb/core/config.c | 5 +- drivers/usb/core/quirks.c | 13 +++ drivers/usb/host/xhci-mem.c | 17 ++-- drivers/usb/host/xhci-ring.c | 79 ++++++++++++---- drivers/usb/host/xhci.c | 15 ++- drivers/usb/misc/chaoskey.c | 2 +- drivers/usb/musb/musb_cppi41.c | 6 +- drivers/usb/musb/musb_dsps.c | 7 +- drivers/usb/phy/phy-generic.c | 3 +- drivers/usb/serial/option.c | 24 +++++ drivers/usb/serial/whiteheat.c | 31 +++++++ drivers/video/fbdev/Kconfig | 2 +- drivers/watchdog/sunxi_wdt.c | 2 +- fs/block_dev.c | 7 ++ fs/btrfs/extent_io.c | 80 +++++++++++++--- fs/btrfs/inode.c | 3 +- fs/cifs/cifsencrypt.c | 53 ++++++++++- fs/cifs/inode.c | 34 ------- fs/cifs/smb2ops.c | 8 +- fs/cifs/smb2pdu.c | 76 ++++++++++++--- fs/dcache.c | 12 ++- fs/internal.h | 1 + fs/namei.c | 39 +++++++- fs/nfs/filelayout/filelayout.c | 31 +++---- fs/nfs/pagelist.c | 2 +- fs/nfs/read.c | 3 + fs/nfs/write.c | 5 +- fs/ocfs2/dlm/dlmmaster.c | 9 +- fs/ocfs2/dlm/dlmrecovery.c | 8 +- fs/open.c | 49 +++++----- fs/overlayfs/inode.c | 25 ++--- fs/overlayfs/overlayfs.h | 1 + fs/overlayfs/super.c | 1 + fs/ubifs/xattr.c | 3 - include/linux/dcache.h | 2 + include/linux/fs.h | 2 - include/linux/mmc/core.h | 1 + include/linux/security.h | 2 +- include/net/netfilter/nf_queue.h | 2 + include/net/netfilter/nf_tables.h | 2 +- include/target/iscsi/iscsi_target_core.h | 1 - include/xen/interface/sched.h | 8 ++ ipc/msg.c | 14 +-- ipc/shm.c | 13 +-- ipc/util.c | 8 +- kernel/events/core.c | 8 -- kernel/events/internal.h | 10 ++ kernel/events/ring_buffer.c | 27 +++++- kernel/irq/proc.c | 19 +++- kernel/sched/core.c | 25 +++-- kernel/sched/fair.c | 25 ++--- kernel/sched/sched.h | 5 +- kernel/time/timekeeping.c | 2 +- lib/iommu-common.c | 6 +- mm/hugetlb.c | 8 ++ mm/migrate.c | 2 +- mm/slab.c | 13 ++- net/batman-adv/distributed-arp-table.c | 7 +- net/batman-adv/multicast.c | 81 +++++++++++----- net/batman-adv/network-coding.c | 7 +- net/batman-adv/originator.c | 5 + net/batman-adv/soft-interface.c | 10 +- net/batman-adv/translation-table.c | 37 ++++++-- net/batman-adv/types.h | 15 +-- net/bluetooth/smp.c | 12 +-- net/ipv4/inet_connection_sock.c | 2 +- net/netfilter/core.c | 1 + net/netfilter/ipvs/ip_vs_core.c | 16 +++- net/netfilter/ipvs/ip_vs_ctl.c | 78 ++++++++++------ net/netfilter/ipvs/ip_vs_sched.c | 12 +-- net/netfilter/ipvs/ip_vs_sync.c | 2 +- net/netfilter/ipvs/ip_vs_xmit.c | 34 ++++++- net/netfilter/nf_conntrack_expect.c | 3 +- net/netfilter/nf_conntrack_netlink.c | 5 - net/netfilter/nf_internals.h | 1 + net/netfilter/nf_log.c | 9 +- net/netfilter/nf_queue.c | 17 ++++ net/netfilter/nf_tables_core.c | 7 +- net/netfilter/nfnetlink.c | 8 +- net/netfilter/nfnetlink_queue_core.c | 24 ++++- net/netfilter/nft_compat.c | 24 +++-- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 10 +- sound/arm/Kconfig | 15 +-- sound/pci/hda/patch_cirrus.c | 1 + sound/pci/hda/patch_realtek.c | 32 ++++--- sound/pci/hda/patch_sigmatel.c | 6 +- sound/soc/au1x/db1200.c | 4 + sound/soc/codecs/sgtl5000.c | 4 +- sound/soc/dwc/designware_i2s.c | 4 +- sound/soc/pxa/Kconfig | 2 - sound/soc/pxa/pxa2xx-ac97.c | 4 +- sound/synth/emux/emux_oss.c | 3 +- tools/lib/traceevent/event-parse.c | 23 ++++- tools/perf/arch/alpha/Build | 1 + tools/perf/arch/mips/Build | 1 + tools/perf/arch/parisc/Build | 1 + tools/perf/builtin-stat.c | 5 +- tools/perf/util/header.c | 4 +- tools/perf/util/hist.c | 3 + tools/perf/util/symbol-elf.c | 35 +++---- virt/kvm/eventfd.c | 124 +++++++++++++++---------- virt/kvm/kvm_main.c | 19 +++- 231 files changed, 2253 insertions(+), 958 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/202 arm: KVM: Fix incorrect device to IPA mapping
4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Majtyka <[email protected]>
commit ca09f02f122b2ecb0f5ddfc5fd47b29ed657d4fd upstream.
A critical bug has been found in device memory stage1 translation for VMs with more then 4GB of address space. Once vm_pgoff size is smaller then pa (which is true for LPAE case, u32 and u64 respectively) some more significant bits of pa may be lost as a shift operation is performed on u32 and later cast onto u64.
Example: vm_pgoff(u32)=0x00210030, PAGE_SHIFT=12
expected pa(u64): 0x0000002010030000
produced pa(u64): 0x0000000010030000The fix is to change the order of operations (casting first onto phys_addr_t and then shifting).
--- arch/arm/kvm/mmu.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/arm/kvm/mmu.c +4 -2
@@ -1790,8 +1790,10 @@ int kvm_arch_prepare_memory_region(strucif (vma->vm_flags &VM_PFNMAP ) {gpa_t gpa = mem->guest_phys_addr + (vm_start - mem->userspace_addr); -phys_addr_t pa = (vma->vm_pgoff <<PAGE_SHIFT ) + - vm_start - vma->vm_start; +phys_addr_t pa; + + pa = (phys_addr_t )vma->vm_pgoff <<PAGE_SHIFT ; + pa += vm_start - vma->vm_start;/* IO region dirty page logging not allowed */ if (memslot->flags &KVM_MEM_LOG_DIRTY_PAGES )
Greg Kroah-Hartman
maintainerPATCH 3/202 kvm: dont try to register to KVM_FAST_MMIO_BUS for non mmio eventfd
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
commit 8453fecbecae26edb3f278627376caab05d9a88d upstream.
We only want zero length mmio eventfd to be registered on KVM_FAST_MMIO_BUS. So check this explicitly when arg->len is zero to make sure this.
--- virt/kvm/eventfd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
virt/kvm/eventfd.c +2 -2
@@ -846,7 +846,7 @@ kvm_assign_ioeventfd(struct kvm *kvm, st/* When length is ignored, MMIO is also put on a separate bus, for * faster lookups. */ -if (!args->len && !(args->flags &KVM_IOEVENTFD_FLAG_PIO )) { +if (!args->len && bus_idx ==KVM_MMIO_BUS ) { ret =kvm_io_bus_register_dev (kvm,KVM_FAST_MMIO_BUS , p->addr,0 , &p->dev);if (ret <0 )
@@ -901,7 +901,7 @@ kvm_deassign_ioeventfd(struct kvm *kvm,continue ;kvm_io_bus_unregister_dev (kvm, bus_idx, &p->dev); -if (!p->length) { +if (!p->length && p->bus_idx ==KVM_MMIO_BUS ) {kvm_io_bus_unregister_dev (kvm,KVM_FAST_MMIO_BUS , &p->dev); }
Greg Kroah-Hartman
maintainerPATCH 4/202 kvm: fix zero length mmio searching
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
commit 8f4216c7d28976f7ec1b2bcbfa0a9f787133c45e upstream.
Currently, if we had a zero length mmio eventfd assigned on KVM_MMIO_BUS. It will never be found by kvm_io_bus_cmp() since it always compares the kvm_io_range() with the length that guest wrote. This will cause e.g for vhost, kick will be trapped by qemu userspace instead of vhost. Fixing this by using zero length if an iodevice is zero length.
--- virt/kvm/kvm_main.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
virt/kvm/kvm_main.c +17 -2
@@ -2935,10 +2935,25 @@ static void kvm_io_bus_destroy(struct kvstatic inline int kvm_io_bus_cmp (const struct kvm_io_range *r1,const struct kvm_io_range *r2) { -if (r1->addr < r2->addr) +gpa_t addr1 = r1->addr; +gpa_t addr2 = r2->addr; + +if (addr1 < addr2)return -1 ; -if (r1->addr + r1->len > r2->addr + r2->len) + +/* If r2->len == 0, match the exact address. If r2->len != 0, +* accept any overlapping write. Any order is acceptable for +* overlapping ranges, because kvm_io_bus_get_first_dev ensures +* we process all of them. +*/ +if (r2->len) { + addr1 += r1->len; + addr2 += r2->len; + } + +if (addr1 > addr2)return 1 ; +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 5/202 kvm: factor out core eventfd assign/deassign logic
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
commit 85da11ca587c8eb73993a1b503052391a73586f9 upstream.
This patch factors out core eventfd assign/deassign logic and leaves the argument checking and bus index selection to callers.
--- virt/kvm/eventfd.c | 85 +++++++++++++++++++++++++++++++---------------------- 1 file changed, 50 insertions(+), 35 deletions(-)
virt/kvm/eventfd.c +50 -35
@@ -771,40 +771,14 @@ static enum kvm_bus ioeventfd_bus_from_freturn KVM_MMIO_BUS ; } -static int -kvm_assign_ioeventfd (struct kvm *kvm,struct kvm_ioeventfd *args) +static int kvm_assign_ioeventfd_idx (struct kvm *kvm, +enum kvm_bus bus_idx, +struct kvm_ioeventfd *args) { -enum kvm_bus bus_idx; -struct _ioeventfd *p; -struct eventfd_ctx *eventfd; -int ret; - bus_idx =ioeventfd_bus_from_flags (args->flags); -/* must be natural-word sized, or 0 to ignore length */ -switch (args->len) { -case 0 : -case 1 : -case 2 : -case 4 : -case 8 : -break ; -default : -return -EINVAL ; - } - -/* check for range overflow */ -if (args->addr + args->len < args->addr) -return -EINVAL ; - -/* check for extra flags that we don't understand */ -if (args->flags & ~KVM_IOEVENTFD_VALID_FLAG_MASK ) -return -EINVAL ; - -/* ioeventfd with no length can't be combined with DATAMATCH */ -if (!args->len && - args->flags & (KVM_IOEVENTFD_FLAG_PIO | -KVM_IOEVENTFD_FLAG_DATAMATCH )) -return -EINVAL ; +struct eventfd_ctx *eventfd; +struct _ioeventfd *p; +int ret; eventfd =eventfd_ctx_fdget (args->fd);if (IS_ERR (eventfd))
@@ -873,14 +847,13 @@ fail: }static int -kvm_deassign_ioeventfd (struct kvm *kvm,struct kvm_ioeventfd *args) +kvm_deassign_ioeventfd_idx (struct kvm *kvm,enum kvm_bus bus_idx, +struct kvm_ioeventfd *args) { -enum kvm_bus bus_idx;struct _ioeventfd *p, *tmp;struct eventfd_ctx *eventfd;int ret = -ENOENT ; - bus_idx =ioeventfd_bus_from_flags (args->flags); eventfd =eventfd_ctx_fdget (args->fd);if (IS_ERR (eventfd))return PTR_ERR (eventfd);
@@ -918,6 +891,48 @@ kvm_deassign_ioeventfd(struct kvm *kvm,return ret; } +static int kvm_deassign_ioeventfd (struct kvm *kvm,struct kvm_ioeventfd *args) +{ +enum kvm_bus bus_idx =ioeventfd_bus_from_flags (args->flags); + +return kvm_deassign_ioeventfd_idx (kvm, bus_idx, args); +} + +static int +kvm_assign_ioeventfd (struct kvm *kvm,struct kvm_ioeventfd *args) +{ +enum kvm_bus bus_idx; + + bus_idx =ioeventfd_bus_from_flags (args->flags); +/* must be natural-word sized, or 0 to ignore length */ +switch (args->len) { +case 0 : +case 1 : +case 2 : +case 4 : +case 8 : +break ; +default : +return -EINVAL ; + } + +/* check for range overflow */ +if (args->addr + args->len < args->addr) +return -EINVAL ; + +/* check for extra flags that we don't understand */ +if (args->flags & ~KVM_IOEVENTFD_VALID_FLAG_MASK ) +return -EINVAL ; + +/* ioeventfd with no length can't be combined with DATAMATCH */ +if (!args->len && + args->flags & (KVM_IOEVENTFD_FLAG_PIO | +KVM_IOEVENTFD_FLAG_DATAMATCH )) +return -EINVAL ; + +return kvm_assign_ioeventfd_idx (kvm, bus_idx, args); +} +int kvm_ioeventfd (struct kvm *kvm,struct kvm_ioeventfd *args) {
Greg Kroah-Hartman
maintainerPATCH 6/202 kvm: fix double free for fast mmio eventfd
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
commit eefd6b06b17c5478e7c24bea6f64beaa2c431ca6 upstream.
We register wildcard mmio eventfd on two buses, once for KVM_MMIO_BUS and once on KVM_FAST_MMIO_BUS but with a single iodev instance. This will lead to an issue: kvm_io_bus_destroy() knows nothing about the devices on two buses pointing to a single dev. Which will lead to double free[1] during exit. Fix this by allocating two instances of iodevs then registering one on KVM_MMIO_BUS and another on KVM_FAST_MMIO_BUS.
CPU: 1 PID: 2894 Comm: qemu-system-x86 Not tainted 3.19.0-26-generic #28-Ubuntu Hardware name: LENOVO 2356BG6/2356BG6, BIOS G7ET96WW (2.56 ) 09/12/2013 task: ffff88009ae0c4b0 ti: ffff88020e7f0000 task.ti: ffff88020e7f0000 RIP: 0010:[<ffffffffc07e25d8>] [<ffffffffc07e25d8>] ioeventfd_release+0x28/0x60 [kvm] RSP: 0018:ffff88020e7f3bc8 EFLAGS: 00010292 RAX: dead000000200200 RBX: ffff8801ec19c900 RCX: 000000018200016d RDX: ffff8801ec19cf80 RSI: ffffea0008bf1d40 RDI: ffff8801ec19c900 RBP: ffff88020e7f3bd8 R08: 000000002fc75a01 R09: 000000018200016d R10: ffffffffc07df6ae R11: ffff88022fc75a98 R12: ffff88021e7cc000 R13: ffff88021e7cca48 R14: ffff88021e7cca50 R15: ffff8801ec19c880 FS: 00007fc1ee3e6700(0000) GS:ffff88023e240000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8f389d8000 CR3: 000000023dc13000 CR4: 00000000001427e0 Stack: ffff88021e7cc000 0000000000000000 ffff88020e7f3be8 ffffffffc07e2622 ffff88020e7f3c38 ffffffffc07df69a ffff880232524160 ffff88020e792d80 0000000000000000 ffff880219b78c00 0000000000000008 ffff8802321686a8 Call Trace: [<ffffffffc07e2622>] ioeventfd_destructor+0x12/0x20 [kvm] [<ffffffffc07df69a>] kvm_put_kvm+0xca/0x210 [kvm] [<ffffffffc07df818>] kvm_vcpu_release+0x18/0x20 [kvm] [<ffffffff811f69f7>] __fput+0xe7/0x250 [<ffffffff811f6bae>] ____fput+0xe/0x10 [<ffffffff81093f04>] task_work_run+0xd4/0xf0 [<ffffffff81079358>] do_exit+0x368/0xa50 [<ffffffff81082c8f>] ? recalc_sigpending+0x1f/0x60 [<ffffffff81079ad5>] do_group_exit+0x45/0xb0 [<ffffffff81085c71>] get_signal+0x291/0x750 [<ffffffff810144d8>] do_signal+0x28/0xab0 [<ffffffff810f3a3b>] ? do_futex+0xdb/0x5d0 [<ffffffff810b7028>] ? __wake_up_locked_key+0x18/0x20 [<ffffffff810f3fa6>] ? SyS_futex+0x76/0x170 [<ffffffff81014fc9>] do_notify_resume+0x69/0xb0 [<ffffffff817cb9af>] int_signal+0x12/0x17 Code: 5d c3 90 0f 1f 44 00 00 55 48 89 e5 53 48 89 fb 48 83 ec 08 48 8b 7f 20 e8 06 d6 a5 c0 48 8b 43 08 48 8b 13 48 89 df 48 89 42 08 <48> 89 10 48 b8 00 01 10 00 00 RIP [<ffffffffc07e25d8>] ioeventfd_release+0x28/0x60 [kvm] RSP <ffff88020e7f3bc8>
--- virt/kvm/eventfd.c | 43 +++++++++++++++++++++++++------------------ 1 file changed, 25 insertions(+), 18 deletions(-)
virt/kvm/eventfd.c +25 -18
@@ -817,16 +817,6 @@ static int kvm_assign_ioeventfd_idx(struif (ret <0 ) goto unlock_fail; -/* When length is ignored, MMIO is also put on a separate bus, for -* faster lookups. -*/ -if (!args->len && bus_idx ==KVM_MMIO_BUS ) { - ret =kvm_io_bus_register_dev (kvm,KVM_FAST_MMIO_BUS , - p->addr,0 , &p->dev); -if (ret <0 ) - goto register_fail; - } - kvm->buses[bus_idx]->ioeventfd_count++;list_add_tail (&p->list, &kvm->ioeventfds);
@@ -834,8 +824,6 @@ static int kvm_assign_ioeventfd_idx(strureturn 0 ; -register_fail: -kvm_io_bus_unregister_dev (kvm, bus_idx, &p->dev); unlock_fail:mutex_unlock (&kvm->slots_lock);
@@ -874,10 +862,6 @@ kvm_deassign_ioeventfd_idx(struct kvm *kcontinue ;kvm_io_bus_unregister_dev (kvm, bus_idx, &p->dev); -if (!p->length && p->bus_idx ==KVM_MMIO_BUS ) { -kvm_io_bus_unregister_dev (kvm,KVM_FAST_MMIO_BUS , - &p->dev); - } kvm->buses[bus_idx]->ioeventfd_count--;ioeventfd_release (p); ret =0 ;
@@ -894,14 +878,19 @@ kvm_deassign_ioeventfd_idx(struct kvm *kstatic int kvm_deassign_ioeventfd (struct kvm *kvm,struct kvm_ioeventfd *args) {enum kvm_bus bus_idx =ioeventfd_bus_from_flags (args->flags); +int ret =kvm_deassign_ioeventfd_idx (kvm, bus_idx, args); + +if (!args->len && bus_idx ==KVM_MMIO_BUS ) +kvm_deassign_ioeventfd_idx (kvm,KVM_FAST_MMIO_BUS , args); -return kvm_deassign_ioeventfd_idx (kvm, bus_idx, args); +return ret; }static int kvm_assign_ioeventfd (struct kvm *kvm,struct kvm_ioeventfd *args) {enum kvm_bus bus_idx; +int ret; bus_idx =ioeventfd_bus_from_flags (args->flags);/* must be natural-word sized, or 0 to ignore length */
@@ -930,7 +919,25 @@ kvm_assign_ioeventfd(struct kvm *kvm, st KVM_IOEVENTFD_FLAG_DATAMATCH))return -EINVAL ; -return kvm_assign_ioeventfd_idx (kvm, bus_idx, args); + ret =kvm_assign_ioeventfd_idx (kvm, bus_idx, args); +if (ret) + goto fail; + +/* When length is ignored, MMIO is also put on a separate bus, for +* faster lookups. +*/ +if (!args->len && bus_idx ==KVM_MMIO_BUS ) { + ret =kvm_assign_ioeventfd_idx (kvm,KVM_FAST_MMIO_BUS , args); +if (ret <0 ) + goto fast_fail; + } + +return 0 ; + +fast_fail: +kvm_deassign_ioeventfd_idx (kvm, bus_idx, args); +fail: +return ret; }int
Greg Kroah-Hartman
maintainerPATCH 7/202 arm: KVM: Disable virtual timer even if the guest is not using it
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 688bc577ac42ae3d07c889a1f0a72f0b23763d58 upstream.
When running a guest with the architected timer disabled (with QEMU and the kernel_irqchip=off option, for example), it is important to make sure the timer gets turned off. Otherwise, the guest may try to enable it anyway, leading to a screaming HW interrupt.
The fix is to unconditionally turn off the virtual timer on guest exit.
--- arch/arm/kvm/interrupts_head.S | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/arm/kvm/interrupts_head.S +4 -2
@@ -518,8 +518,7 @@ ARM_BE8(rev r6, r6 ) mrc p15, 0, r2, c14, c3, 1 @ CNTV_CTL str r2, [vcpu, #VCPU_TIMER_CNTV_CTL] - bic r2, #1 @ Clear ENABLE - mcr p15, 0, r2, c14, c3, 1 @ CNTV_CTL + isb mrrc p15, 3, rr_lo_hi(r2, r3), c14 @ CNTV_CVAL
@@ -532,6 +531,9 @@ ARM_BE8(rev r6, r6 ) mcrr p15, 4, r2, r2, c14 @ CNTVOFF 1: + mov r2, #0 @ Clear ENABLE + mcr p15, 0, r2, c14, c3, 1 @ CNTV_CTL + @ Allow physical timer/counter access for the host mrc p15, 4, r2, c14, c1, 0 @ CNTHCTL orr r2, r2, #(CNTHCTL_PL1PCEN | CNTHCTL_PL1PCTEN)
Greg Kroah-Hartman
maintainerPATCH 8/202 KVM: PPC: Book3S: Take the kvm->srcu lock in kvmppc_h_logical_ci_load/store()
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Huth <[email protected]>
commit 3eb4ee68254235e4f47bc0410538fcdaede39589 upstream.
Access to the kvm->buses (like with the kvm_io_bus_read() and -write() functions) has to be protected via the kvm->srcu lock.
The kvmppc_h_logical_ci_load() and -store() functions are missing this lock so far, so let's add it there, too.
This fixes the problem that the kernel reports "suspicious RCU usage" when lock debugging is enabled.
--- arch/powerpc/kvm/book3s.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/powerpc/kvm/book3s.c +6 -0
@@ -826,12 +826,15 @@ int kvmppc_h_logical_ci_load(struct kvm_unsigned long size =kvmppc_get_gpr (vcpu,4 );unsigned long addr =kvmppc_get_gpr (vcpu,5 );u64 buf; +int srcu_idx;int ret;if (!is_power_of_2 (size) || (size >sizeof (buf)))return H_TOO_HARD ; + srcu_idx =srcu_read_lock (&vcpu->kvm->srcu); ret =kvm_io_bus_read (vcpu,KVM_MMIO_BUS , addr, size, &buf); +srcu_read_unlock (&vcpu->kvm->srcu, srcu_idx);if (ret !=0 )return H_TOO_HARD ;
@@ -866,6 +869,7 @@ int kvmppc_h_logical_ci_store(struct kvmunsigned long addr =kvmppc_get_gpr (vcpu,5 );unsigned long val =kvmppc_get_gpr (vcpu,6 );u64 buf; +int srcu_idx;int ret;switch (size) {
@@ -889,7 +893,9 @@ int kvmppc_h_logical_ci_store(struct kvmreturn H_TOO_HARD ; } + srcu_idx =srcu_read_lock (&vcpu->kvm->srcu); ret =kvm_io_bus_write (vcpu,KVM_MMIO_BUS , addr, size, &buf); +srcu_read_unlock (&vcpu->kvm->srcu, srcu_idx);if (ret !=0 )return H_TOO_HARD ;
Greg Kroah-Hartman
maintainerPATCH 9/202 KVM: PPC: Book3S HV: Pass the correct trap argument to kvmhv_commence_exit
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Gautham R. Shenoy" <[email protected]>
commit 7e022e717f54897e396504306d0c9b61452adf4e upstream.
In guest_exit_cont we call kvmhv_commence_exit which expects the trap number as the argument. However r3 doesn't contain the trap number at this point and as a result we would be calling the function with a spurious trap number.
Fix this by copying r12 into r3 before calling kvmhv_commence_exit as r12 contains the trap number.
--- arch/powerpc/kvm/book3s_hv_rmhandlers.S | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/kvm/book3s_hv_rmhandlers.S +1 -0
@@ -1171,6 +1171,7 @@ mc_cont: bl kvmhv_accumulate_time #endif + mr r3, r12 /* Increment exit count, poke other threads to exit */ bl kvmhv_commence_exit nop
Greg Kroah-Hartman
maintainerPATCH 11/202 target/iscsi: Fix np_ip bracket issue by removing np_ip
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Grover <[email protected]>
commit 76c28f1fcfeb42b47f798fe498351ee1d60086ae upstream.
Revert commit 1997e6259, which causes double brackets on ipv6 inaddr_any addresses.
Since we have np_sockaddr, if we need a textual representation we can use "%pISc".
Change iscsit_add_network_portal() and iscsit_add_np() signatures to remove *ip_str parameter.
Fix and extend some comments earlier in the function.
Tested to work for :: and ::1 via iscsiadm, previously :: failed, see
https://bugzilla.redhat.com/show_bug.cgi?id=1249107 .
--- drivers/target/iscsi/iscsi_target.c | 33 +++++++++++++-------------- drivers/target/iscsi/iscsi_target.h | 2 - drivers/target/iscsi/iscsi_target_configfs.c | 14 +++++------ drivers/target/iscsi/iscsi_target_login.c | 8 +++--- drivers/target/iscsi/iscsi_target_tpg.c | 15 +++++------- drivers/target/iscsi/iscsi_target_tpg.h | 2 - include/target/iscsi/iscsi_target_core.h | 1 7 files changed, 36 insertions(+), 39 deletions(-)
drivers/target/iscsi/iscsi_target.c +16 -17
@@ -341,7 +341,6 @@ static struct iscsi_np *iscsit_get_np(struct iscsi_np *iscsit_add_np (struct __kernel_sockaddr_storage *sockaddr, -char *ip_str,int network_transport) {struct sockaddr_in *sock_in;
@@ -370,11 +369,9 @@ struct iscsi_np *iscsit_add_np( np->np_flags |=NPF_IP_NETWORK ;if (sockaddr->ss_family ==AF_INET6 ) { sock_in6 = (struct sockaddr_in6 *)sockaddr; -snprintf (np->np_ip,IPV6_ADDRESS_SPACE ,"%s" , ip_str); np->np_port =ntohs (sock_in6->sin6_port); }else { sock_in = (struct sockaddr_in *)sockaddr; -sprintf (np->np_ip,"%s" , ip_str); np->np_port =ntohs (sock_in->sin_port); }
@@ -411,8 +408,8 @@ struct iscsi_np *iscsit_add_np(list_add_tail (&np->np_list, &g_np_list);mutex_unlock (&np_lock); -pr_debug ("CORE[0] - Added Network Portal: %s:%hu on %s\n" , - np->np_ip, np->np_port, np->np_transport->name); +pr_debug ("CORE[0] - Added Network Portal: %pISc:%hu on %s\n" , + &np->np_sockaddr, np->np_port, np->np_transport->name);return np; }
@@ -481,8 +478,8 @@ int iscsit_del_np(struct iscsi_np *np)list_del (&np->np_list);mutex_unlock (&np_lock); -pr_debug ("CORE[0] - Removed Network Portal: %s:%hu on %s\n" , - np->np_ip, np->np_port, np->np_transport->name); +pr_debug ("CORE[0] - Removed Network Portal: %pISc:%hu on %s\n" , + &np->np_sockaddr, np->np_port, np->np_transport->name);iscsit_put_transport (np->np_transport);kfree (np);
@@ -3467,7 +3464,6 @@ iscsit_build_sendtargets_response(struct tpg_np_list) {struct iscsi_np *np = tpg_np->tpg_np;bool inaddr_any =iscsit_check_inaddr_any (np); -char *fmt_str;if (np->np_network_transport != network_transport)continue ;
@@ -3495,15 +3491,18 @@ iscsit_build_sendtargets_response(struct } } -if (np->np_sockaddr.ss_family ==AF_INET6 ) - fmt_str ="TargetAddress=[%s]:%hu,%hu" ; -else - fmt_str ="TargetAddress=%s:%hu,%hu" ; - - len =sprintf (buf, fmt_str, - inaddr_any ? conn->local_ip : np->np_ip, - np->np_port, - tpg->tpgt); +if (inaddr_any) { + len =sprintf (buf,"TargetAddress=" +"%s:%hu,%hu" , + conn->local_ip, + np->np_port, + tpg->tpgt); + }else { + len =sprintf (buf,"TargetAddress=" +"%pISpc,%hu" , + &np->np_sockaddr, + tpg->tpgt); + } len +=1 ;if ((len + payload_len) > buffer_len) {
drivers/target/iscsi/iscsi_target.h +1 -1
@@ -13,7 +13,7 @@ extern int iscsit_deaccess_np(struct iscextern bool iscsit_check_np_match (struct __kernel_sockaddr_storage *,struct iscsi_np *,int );extern struct iscsi_np *iscsit_add_np (struct __kernel_sockaddr_storage *, -char *,int ); +int );extern int iscsit_reset_np_thread (struct iscsi_np *,struct iscsi_tpg_np *,struct iscsi_portal_group *,bool );extern int iscsit_del_np (struct iscsi_np *);
drivers/target/iscsi/iscsi_target_configfs.c +7 -7
@@ -100,7 +100,7 @@ static ssize_t lio_target_np_store_sctp(* Use existing np->np_sockaddr for SCTP network portal reference */ tpg_np_sctp =iscsit_tpg_add_network_portal (tpg, &np->np_sockaddr, - np->np_ip, tpg_np,ISCSI_SCTP_TCP ); + tpg_np,ISCSI_SCTP_TCP );if (!tpg_np_sctp ||IS_ERR (tpg_np_sctp)) goto out; }else {
@@ -178,7 +178,7 @@ static ssize_t lio_target_np_store_iser( } tpg_np_iser =iscsit_tpg_add_network_portal (tpg, &np->np_sockaddr, - np->np_ip, tpg_np,ISCSI_INFINIBAND ); + tpg_np,ISCSI_INFINIBAND );if (IS_ERR (tpg_np_iser)) { rc =PTR_ERR (tpg_np_iser); goto out;
@@ -249,8 +249,8 @@ static struct se_tpg_np *lio_target_callreturn ERR_PTR (-EINVAL ); } str++;/* Skip over leading "[" */ - *str2 ='\0' ;/* Terminate the IPv6 address */ - str2++;/* Skip over the "]" */ + *str2 ='\0' ;/* Terminate the unbracketed IPv6 address */ + str2++;/* Skip over the \0 */ port_str =strstr (str2,":" );if (!port_str) { pr_err("Unable to locate \":port\""
@@ -317,7 +317,7 @@ static struct se_tpg_np *lio_target_call* sys/kernel/config/iscsi/$IQN/$TPG/np/$IP:$PORT/ * */ - tpg_np =iscsit_tpg_add_network_portal (tpg, &sockaddr, str,NULL , + tpg_np =iscsit_tpg_add_network_portal (tpg, &sockaddr,NULL ,ISCSI_TCP );if (IS_ERR (tpg_np)) {iscsit_put_tpg (tpg);
@@ -345,8 +345,8 @@ static void lio_target_call_delnpfromtpg se_tpg = &tpg->tpg_se_tpg;pr_debug ("LIO_Target_ConfigFS: DEREGISTER -> %s TPGT: %hu" -" PORTAL: %s:%hu\n" ,config_item_name (&se_tpg->se_tpg_wwn->wwn_group.cg_item), - tpg->tpgt, tpg_np->tpg_np->np_ip, tpg_np->tpg_np->np_port); +" PORTAL: %pISc:%hu\n" ,config_item_name (&se_tpg->se_tpg_wwn->wwn_group.cg_item), + tpg->tpgt, &tpg_np->tpg_np->np_sockaddr, tpg_np->tpg_np->np_port); ret =iscsit_tpg_del_network_portal (tpg, tpg_np);if (ret <0 )
drivers/target/iscsi/iscsi_target_login.c +4 -4
@@ -879,8 +879,8 @@ static void iscsi_handle_login_thread_tistruct iscsi_np *np = (struct iscsi_np *) data;spin_lock_bh (&np->np_thread_lock); -pr_err ("iSCSI Login timeout on Network Portal %s:%hu\n" , - np->np_ip, np->np_port); +pr_err ("iSCSI Login timeout on Network Portal %pISc:%hu\n" , + &np->np_sockaddr, np->np_port);if (np->np_login_timer_flags &ISCSI_TF_STOP ) {spin_unlock_bh (&np->np_thread_lock);
@@ -1358,8 +1358,8 @@ static int __iscsi_target_login_thread(sspin_lock_bh (&np->np_thread_lock);if (np->np_thread_state !=ISCSI_NP_THREAD_ACTIVE ) {spin_unlock_bh (&np->np_thread_lock); -pr_err ("iSCSI Network Portal on %s:%hu currently not" -" active.\n" , np->np_ip, np->np_port); +pr_err ("iSCSI Network Portal on %pISc:%hu currently not" +" active.\n" , &np->np_sockaddr, np->np_port);iscsit_tx_login_rsp (conn,ISCSI_STATUS_CLS_TARGET_ERR ,ISCSI_LOGIN_STATUS_SVC_UNAVAILABLE ); goto new_sess_out;
drivers/target/iscsi/iscsi_target_tpg.c +7 -8
@@ -460,7 +460,6 @@ static bool iscsit_tpg_check_network_porstruct iscsi_tpg_np *iscsit_tpg_add_network_portal (struct iscsi_portal_group *tpg,struct __kernel_sockaddr_storage *sockaddr, -char *ip_str,struct iscsi_tpg_np *tpg_np_parent,int network_transport) {
@@ -470,8 +469,8 @@ struct iscsi_tpg_np *iscsit_tpg_add_netwif (!tpg_np_parent) {if (iscsit_tpg_check_network_portal (tpg->tpg_tiqn, sockaddr, network_transport)) { -pr_err ("Network Portal: %s already exists on a" -" different TPG on %s\n" , ip_str, +pr_err ("Network Portal: %pISc already exists on a" +" different TPG on %s\n" , sockaddr, tpg->tpg_tiqn->tiqn);return ERR_PTR (-EEXIST ); }
@@ -484,7 +483,7 @@ struct iscsi_tpg_np *iscsit_tpg_add_netwreturn ERR_PTR (-ENOMEM ); } - np =iscsit_add_np (sockaddr, ip_str, network_transport); + np =iscsit_add_np (sockaddr, network_transport);if (IS_ERR (np)) {kfree (tpg_np);return ERR_CAST (np);
@@ -514,8 +513,8 @@ struct iscsi_tpg_np *iscsit_tpg_add_netwspin_unlock (&tpg_np_parent->tpg_np_parent_lock); } -pr_debug ("CORE[%s] - Added Network Portal: %s:%hu,%hu on %s\n" , - tpg->tpg_tiqn->tiqn, np->np_ip, np->np_port, tpg->tpgt, +pr_debug ("CORE[%s] - Added Network Portal: %pISc:%hu,%hu on %s\n" , + tpg->tpg_tiqn->tiqn, &np->np_sockaddr, np->np_port, tpg->tpgt, np->np_transport->name);return tpg_np;
@@ -528,8 +527,8 @@ static int iscsit_tpg_release_np( {iscsit_clear_tpg_np_login_thread (tpg_np, tpg, true); -pr_debug ("CORE[%s] - Removed Network Portal: %s:%hu,%hu on %s\n" , - tpg->tpg_tiqn->tiqn, np->np_ip, np->np_port, tpg->tpgt, +pr_debug ("CORE[%s] - Removed Network Portal: %pISc:%hu,%hu on %s\n" , + tpg->tpg_tiqn->tiqn, &np->np_sockaddr, np->np_port, tpg->tpgt, np->np_transport->name); tpg_np->tpg_np =NULL ;
drivers/target/iscsi/iscsi_target_tpg.h +1 -1
@@ -22,7 +22,7 @@ extern struct iscsi_node_attrib *iscsit_extern void iscsit_tpg_del_external_nps (struct iscsi_tpg_np *);extern struct iscsi_tpg_np *iscsit_tpg_locate_child_np (struct iscsi_tpg_np *,int );extern struct iscsi_tpg_np *iscsit_tpg_add_network_portal (struct iscsi_portal_group *, -struct __kernel_sockaddr_storage *,char *,struct iscsi_tpg_np *, +struct __kernel_sockaddr_storage *,struct iscsi_tpg_np *,int );extern int iscsit_tpg_del_network_portal (struct iscsi_portal_group *,struct iscsi_tpg_np *);
include/target/iscsi/iscsi_target_core.h +0 -1
@@ -787,7 +787,6 @@ struct iscsi_np {enum iscsi_timer_flags_table np_login_timer_flags;u32 np_exports;enum np_flags_table np_flags; -unsigned char np_ip[IPV6_ADDRESS_SPACE ];u16 np_port;spinlock_t np_thread_lock;struct completion np_restart_comp;
Greg Kroah-Hartman
maintainerPATCH 12/202 scsi: fix scsi_error_handler vs. scsi_host_dev_release race
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <[email protected]>
commit 537b604c8b3aa8b96fe35f87dd085816552e294c upstream.
b9d5c6b7ef57 ("[SCSI] cleanup setting task state in scsi_error_handler()") has introduced a race between scsi_error_handler and scsi_host_dev_release resulting in the hang when the device goes away because scsi_error_handler might miss a wake up:
CPU0 CPU1scsi_error_handler scsi_host_dev_release
kthread_stop()
kthread_should_stop()
test_bit(KTHREAD_SHOULD_STOP)
set_bit(KTHREAD_SHOULD_STOP) wake_up_process() wait_for_completion()
set_current_state(TASK_INTERRUPTIBLE)
schedule()
The most straightforward solution seems to be to invert the ordering of the set_current_state and kthread_should_stop.
The issue has been noticed during reboot test on a 3.0 based kernel but the current code seems to be affected in the same way.
--- drivers/scsi/scsi_error.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/scsi/scsi_error.c +10 -1
@@ -2169,8 +2169,17 @@ int scsi_error_handler(void *data)* We never actually get interrupted because kthread_run * disables signal delivery for the created thread. */ -while (!kthread_should_stop ()) { +while (true) { +/* +* The sequence in kthread_stop() sets the stop flag first +* then wakes the process. To avoid missed wakeups, the task +* should always be in a non running state before the stop +* flag is checked +*/ set_current_state (TASK_INTERRUPTIBLE ); +if (kthread_should_stop ()) +break ; +if ((shost->host_failed ==0 && shost->host_eh_scheduled ==0 ) || shost->host_failed !=atomic_read (&shost->host_busy)) { SCSI_LOG_ERROR_RECOVERY(1,
Greg Kroah-Hartman
maintainerPATCH 13/202 target: Attach EXTENDED_COPY local I/O descriptors to xcopy_pt_sess
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 4416f89b8cfcb794d040fc3b68e5fb159b7d8d02 upstream.
This patch is a >= v4.1 regression bug-fix where control CDB emulation logic in commit 38b57f82 now expects a se_cmd->se_sess pointer to exist when determining T10-PI support is to be exposed for initiator host ports.
To address this bug, go ahead and add locally generated se_cmd descriptors for copy-offload block-copy to it's own stand-alone se_session nexus, while the parent EXTENDED_COPY se_cmd descriptor remains associated with it's originating se_cmd->se_sess nexus.
Note a valid se_cmd->se_sess is also required for future support of WRITE_INSERT and READ_STRIP software emulation when submitting backend I/O to se_device that exposes T10-PI suport.
--- drivers/target/target_core_xcopy.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/target/target_core_xcopy.c +4 -2
@@ -465,6 +465,8 @@ int target_xcopy_setup_pt(void)memset (&xcopy_pt_sess,0 ,sizeof (struct se_session ));INIT_LIST_HEAD (&xcopy_pt_sess.sess_list);INIT_LIST_HEAD (&xcopy_pt_sess.sess_acl_list); +INIT_LIST_HEAD (&xcopy_pt_sess.sess_cmd_list); +spin_lock_init (&xcopy_pt_sess.sess_cmd_lock); xcopy_pt_nacl.se_tpg = &xcopy_pt_tpg; xcopy_pt_nacl.nacl_sess = &xcopy_pt_sess;
@@ -666,7 +668,7 @@ static int target_xcopy_read_source(pr_debug ("XCOPY: Built READ_16: LBA: %llu Sectors: %u Length: %u\n" , (unsigned long long )src_lba, src_sectors, length); -transport_init_se_cmd (se_cmd, &xcopy_pt_tfo,NULL , length, +transport_init_se_cmd (se_cmd, &xcopy_pt_tfo, &xcopy_pt_sess, length,DMA_FROM_DEVICE ,0 , &xpt_cmd->sense_buffer[0 ]); xop->src_pt_cmd = xpt_cmd;
@@ -726,7 +728,7 @@ static int target_xcopy_write_destinatiopr_debug ("XCOPY: Built WRITE_16: LBA: %llu Sectors: %u Length: %u\n" , (unsigned long long )dst_lba, dst_sectors, length); -transport_init_se_cmd (se_cmd, &xcopy_pt_tfo,NULL , length, +transport_init_se_cmd (se_cmd, &xcopy_pt_tfo, &xcopy_pt_sess, length,DMA_TO_DEVICE ,0 , &xpt_cmd->sense_buffer[0 ]); xop->dst_pt_cmd = xpt_cmd;
Greg Kroah-Hartman
maintainerPATCH 14/202 iser-target: remove command with state ISTATE_REMOVE
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jenny Derzhavetz <[email protected]>
commit a4c15cd957cbd728f685645de7a150df5912591a upstream.
As documented in iscsit_sequence_cmd:
/*
* Existing callers for iscsit_sequence_cmd() will silently
* ignore commands with CMDSN_LOWER_THAN_EXP, so force this
* return for CMDSN_MAXCMDSN_OVERRUN as well..
*/
We need to silently finish a command when it's in ISTATE_REMOVE. This fixes an teardown hang we were seeing where a mis-behaved initiator (triggered by allocation error injections) sent us a cmdsn which was lower than expected.
--- drivers/infiniband/ulp/isert/ib_isert.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/infiniband/ulp/isert/ib_isert.c +8 -1
@@ -2996,9 +2996,16 @@ isert_get_dataout(struct iscsi_conn *constatic int isert_immediate_queue (struct iscsi_conn *conn,struct iscsi_cmd *cmd,int state) { -int ret; +struct isert_cmd *isert_cmd =iscsit_priv_cmd (cmd); +int ret =0 ;switch (state) { +case ISTATE_REMOVE : +spin_lock_bh (&conn->cmd_lock); +list_del_init (&cmd->i_conn_node); +spin_unlock_bh (&conn->cmd_lock); +isert_put_cmd (isert_cmd, true); +break ;case ISTATE_SEND_NOPIN_WANT_RESPONSE : ret =isert_put_nopin (cmd, conn, false);break ;
Greg Kroah-Hartman
maintainerPATCH 15/202 iser-target: Put the reference on commands waiting for unsol data
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jenny Derzhavetz <[email protected]>
commit 3e03c4b01da3e6a5f3081eb0aa252490fe83e352 upstream.
The iscsi target core teardown sequence calls wait_conn for all active commands to finish gracefully by:
- move the queue-pair to error state
- drain all the completions
- wait for the core to finish handling all session commands
However, when tearing down a session while there are sequenced commands that are still waiting for unsolicited data outs, we can block forever as these are missing an extra reference put.
We basically need the equivalent of iscsit_free_queue_reqs_for_conn() which is called after wait_conn has returned. Address this by an explicit walk on conn_cmd_list and put the extra reference.
--- drivers/infiniband/ulp/isert/ib_isert.c | 38 +++++++++++++++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-)
drivers/infiniband/ulp/isert/ib_isert.c +37 -1
@@ -3370,6 +3370,41 @@ isert_wait4flush(struct isert_conn *iserwait_for_completion (&isert_conn->wait_comp_err); } +/** +* isert_put_unsol_pending_cmds() - Drop commands waiting for +* unsolicitate dataout +* @conn: iscsi connection +* +* We might still have commands that are waiting for unsolicited +* dataouts messages. We must put the extra reference on those +* before blocking on the target_wait_for_session_cmds +*/ +static void +isert_put_unsol_pending_cmds (struct iscsi_conn *conn) +{ +struct iscsi_cmd *cmd, *tmp; +static LIST_HEAD (drop_cmd_list); + +spin_lock_bh (&conn->cmd_lock); +list_for_each_entry_safe (cmd, tmp, &conn->conn_cmd_list, i_conn_node) { +if ((cmd->cmd_flags &ICF_NON_IMMEDIATE_UNSOLICITED_DATA ) && + (cmd->write_data_done < conn->sess->sess_ops->FirstBurstLength) && + (cmd->write_data_done < cmd->se_cmd.data_length)) +list_move_tail (&cmd->i_conn_node, &drop_cmd_list); + } +spin_unlock_bh (&conn->cmd_lock); + +list_for_each_entry_safe (cmd, tmp, &drop_cmd_list, i_conn_node) { +list_del_init (&cmd->i_conn_node); +if (cmd->i_state !=ISTATE_REMOVE ) { +struct isert_cmd *isert_cmd =iscsit_priv_cmd (cmd); + +isert_info ("conn %p dropping cmd %p\n" , conn, cmd); +isert_put_cmd (isert_cmd, true); + } + } +} +static void isert_wait_conn (struct iscsi_conn *conn) {struct isert_conn *isert_conn = conn->context;
@@ -3388,8 +3423,9 @@ static void isert_wait_conn(struct iscsiisert_conn_terminate (isert_conn);mutex_unlock (&isert_conn->mutex); -isert_wait4cmds (conn);isert_wait4flush (isert_conn); +isert_put_unsol_pending_cmds (conn); +isert_wait4cmds (conn);isert_wait4logout (isert_conn);queue_work (isert_release_wq, &isert_conn->release_work);
Greg Kroah-Hartman
maintainerPATCH 16/202 target: Fix v4.1 UNIT_ATTENTION se_node_acl->device_list[] NULL pointer
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
This patch fixes a v4.1 only regression bug as reported by Martin where UNIT_ATTENTION checking for pre v4.2-rc1 RCU conversion code legacy se_node_acl->device_list[] was hitting a NULL pointer dereference in:
[ 1858.639654] CPU: 2 PID: 1293 Comm: kworker/2:1 Tainted: G I 4.1.6-fixxcopy+ #1 [ 1858.639699] Hardware name: Dell Inc. PowerEdge R410/0N83VF, BIOS 1.11.0 07/20/2012 [ 1858.639747] Workqueue: xcopy_wq target_xcopy_do_work [target_core_mod] [ 1858.639782] task: ffff880036f0cbe0 ti: ffff880317940000 task.ti: ffff880317940000 [ 1858.639822] RIP: 0010:[<ffffffffa01d3774>] [<ffffffffa01d3774>] target_scsi3_ua_check+0x24/0x60 [target_core_mod] [ 1858.639884] RSP: 0018:ffff880317943ce0 EFLAGS: 00010282 [ 1858.639913] RAX: 0000000000000000 RBX: ffff880317943dc0 RCX: 0000000000000000 [ 1858.639950] RDX: 0000000000000000 RSI: ffff880317943dd0 RDI: ffff88030eaee408 [ 1858.639987] RBP: ffff88030eaee408 R08: 0000000000000001 R09: 0000000000000001 [ 1858.640025] R10: 0000000000000000 R11: 00000000000706e0 R12: ffff880315e0a000 [ 1858.640062] R13: ffff88030eaee408 R14: 0000000000000001 R15: ffff88030eaee408 [ 1858.640100] FS: 0000000000000000(0000) GS:ffff880322e80000(0000) knlGS:0000000000000000 [ 1858.640143] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 1858.640173] CR2: 0000000000000000 CR3: 000000000180d000 CR4: 00000000000006e0 [ 1858.640210] Stack: [ 1858.640223] ffffffffa01cadfa ffff88030eaee400 ffff880318e7c340 ffff880315e0a000 [ 1858.640267] ffffffffa01d8c25 ffff8800cae809e0 0000000000000400 0000000000000400 [ 1858.640310] ffff880318e7c3d0 0000000006b75800 0000000000080000 ffff88030eaee400 [ 1858.640354] Call Trace: [ 1858.640379] [<ffffffffa01cadfa>] ? target_setup_cmd_from_cdb+0x13a/0x2c0 [target_core_mod] [ 1858.640429] [<ffffffffa01d8c25>] ? target_xcopy_setup_pt_cmd+0x85/0x320 [target_core_mod] [ 1858.640479] [<ffffffffa01d9424>] ? target_xcopy_do_work+0x264/0x700 [target_core_mod] [ 1858.640526] [<ffffffff810ac3a0>] ? pick_next_task_fair+0x720/0x8f0 [ 1858.640562] [<ffffffff8108b3fb>] ? process_one_work+0x14b/0x430 [ 1858.640595] [<ffffffff8108bf5b>] ? worker_thread+0x6b/0x560 [ 1858.640627] [<ffffffff8108bef0>] ? rescuer_thread+0x390/0x390 [ 1858.640661] [<ffffffff810913b3>] ? kthread+0xd3/0xf0 [ 1858.640689] [<ffffffff810912e0>] ? kthread_create_on_node+0x180/0x180
Also, check for the same se_node_acl->device_list[] during EXTENDED_COPY operation as a non-holding persistent reservation port.
--- drivers/target/target_core_pr.c | 3 +++ drivers/target/target_core_ua.c | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-)
drivers/target/target_core_pr.c +3 -0
@@ -328,6 +328,9 @@ static int core_scsi3_pr_seq_non_holder(int legacy =0 ;/* Act like a legacy device and return * RESERVATION CONFLICT on some CDBs */ +if (!se_sess->se_node_acl->device_list) +return ; + se_deve = se_sess->se_node_acl->device_list[cmd->orig_fe_lun];/* * Determine if the registration should be ignored due to
drivers/target/target_core_ua.c +4 -4
@@ -48,7 +48,7 @@ target_scsi3_ua_check(struct se_cmd *cmdreturn 0 ; nacl = sess->se_node_acl; -if (!nacl) +if (!nacl || !nacl->device_list)return 0 ; deve = nacl->device_list[cmd->orig_fe_lun];
@@ -90,7 +90,7 @@ int core_scsi3_ua_allocate(/* * PASSTHROUGH OPS */ -if (!nacl) +if (!nacl || !nacl->device_list)return -EINVAL ; ua =kmem_cache_zalloc (se_ua_cache,GFP_ATOMIC );
@@ -208,7 +208,7 @@ void core_scsi3_ua_for_check_condition(return ; nacl = sess->se_node_acl; -if (!nacl) +if (!nacl || !nacl->device_list)return ;spin_lock_irq (&nacl->device_list_lock);
@@ -276,7 +276,7 @@ int core_scsi3_ua_clear_for_request_sensreturn -EINVAL ; nacl = sess->se_node_acl; -if (!nacl) +if (!nacl || !nacl->device_list)return -EINVAL ;spin_lock_irq (&nacl->device_list_lock);
Greg Kroah-Hartman
maintainerPATCH 17/202 toshiba_acpi: Fix hotkeys registration on some toshiba models
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Azael Avalos <[email protected]>
commit 53147b6cabee5e8d1997b5682fcc0c3b72ddf9c2 upstream.
Commit a2b3471b5b13 ("toshiba_acpi: Use the Hotkey Event Type function for keymap choosing") changed the *setup_keyboard function to query for the Hotkey Event Type to help choose the correct keymap, but turns out that here are certain Toshiba models out there not implementing this feature, and thus, failing to continue the input device registration and leaving such laptops without hotkey support.
This patch changes such check, and instead of returning an error if the Hotkey Event Type is not present, we simply inform userspace about it, changing the message printed from err to notice, making the function responsible for registering the input device to continue.
This issue was found on a Toshiba Portege Z30-B, but there might be some other models out there affected by this regression as well.
--- drivers/platform/x86/toshiba_acpi.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/platform/x86/toshiba_acpi.c +3 -5
@@ -2525,11 +2525,9 @@ static int toshiba_acpi_setup_keyboard(sif (error)return error; - error =toshiba_hotkey_event_type_get (dev, &events_type); -if (error) { -pr_err ("Unable to query Hotkey Event Type\n" ); -return error; - } +if (toshiba_hotkey_event_type_get (dev, &events_type)) +pr_notice ("Unable to query Hotkey Event Type\n" ); + dev->hotkey_event_type = events_type; dev->hotkey_dev =input_allocate_device ();
Greg Kroah-Hartman
maintainerPATCH 18/202 perf/x86/intel: Fix constraint access
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit ebfb4988f0378e2ac3b4a0aa1ea20d724293f392 upstream.
Sasha reported that we can get here with .idx==-1, and cpuc->event_constraints unallocated.
--- arch/x86/kernel/cpu/perf_event_intel.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/perf_event_intel.c +4 -1
@@ -2098,9 +2098,12 @@ static struct event_constraint * intel_get_event_constraints(struct cpu_hw_events *cpuc, int idx, struct perf_event *event) { - struct event_constraint *c1 = cpuc->event_constraint[idx]; + struct event_constraint *c1 = NULL;struct event_constraint *c2; +if (idx >=0 )/* fake does < 0 */ + c1 = cpuc->event_constraint[idx]; +/* * first time only * - static constraint: no change across incremental scheduling calls
Greg Kroah-Hartman
maintainerPATCH 19/202 perf tools: Fix copying of /proc/kcore
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit b5cabbcbd157a4bf5a92dfc85134999a3b55342d upstream.
A copy of /proc/kcore containing the kernel text can be made to the buildid cache. e.g.
perf buildid-cache -v -k /proc/kcore
To workaround objdump limitations, a copy is also made when annotating against /proc/kcore.
The copying process stops working from libelf about v1.62 onwards (the problem was found with v1.63).
The cause is that a call to gelf_getphdr() in kcore__add_phdr() fails because additional validation has been added to gelf_getphdr().
The use of gelf_getphdr() is a misguided attempt to get default initialization of the Gelf_Phdr structure. That should not be necessary because every member of the Gelf_Phdr structure is subsequently assigned. So just remove the call to gelf_getphdr().
Similarly, a call to gelf_getehdr() in gelf_kcore__init() can be removed also.
Committer notes:
Note to [email protected], from Adrian in the cover letter for this patchkit:
The "Fix copying of /proc/kcore" problem goes back to v3.13 if you think it is important enough for stable.
--- tools/perf/util/symbol-elf.c | 33 ++++++++++++--------------------- 1 file changed, 12 insertions(+), 21 deletions(-)
tools/perf/util/symbol-elf.c +12 -21
@@ -1253,8 +1253,6 @@ out_close:static int kcore__init (struct kcore *kcore,char *filename,int elfclass,bool temp) { -GElf_Ehdr *ehdr; - kcore->elfclass = elfclass;if (temp)
@@ -1271,9 +1269,7 @@ static int kcore__init(struct kcore *kcoif (!gelf_newehdr (kcore->elf, elfclass)) goto out_end; - ehdr =gelf_getehdr (kcore->elf, &kcore->ehdr); -if (!ehdr) - goto out_end; +memset (&kcore->ehdr,0 ,sizeof (GElf_Ehdr));return 0 ;
@@ -1330,23 +1326,18 @@ static int kcore__copy_hdr(struct kcorestatic int kcore__add_phdr (struct kcore *kcore,int idx,off_t offset,u64 addr,u64 len) { -GElf_Phdr gphdr; -GElf_Phdr *phdr; - - phdr =gelf_getphdr (kcore->elf, idx, &gphdr); -if (!phdr) -return -1 ; - - phdr->p_type =PT_LOAD ; - phdr->p_flags =PF_R |PF_W |PF_X ; - phdr->p_offset = offset; - phdr->p_vaddr = addr; - phdr->p_paddr =0 ; - phdr->p_filesz = len; - phdr->p_memsz = len; - phdr->p_align = page_size; +GElf_Phdr phdr = { + .p_type =PT_LOAD , + .p_flags =PF_R |PF_W |PF_X , + .p_offset = offset, + .p_vaddr = addr, + .p_paddr =0 , + .p_filesz = len, + .p_memsz = len, + .p_align = page_size, + }; -if (!gelf_update_phdr (kcore->elf, idx, phdr)) +if (!gelf_update_phdr (kcore->elf, idx, &phdr))return -1 ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 20/202 perf hists: Update the column width for the "srcline" sort key
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
commit e8e6d37e73e6b950c891c780745460b87f4755b6 upstream.
When we introduce a new sort key, we need to update the hists__calc_col_len() function accordingly, otherwise the width will be limited to strlen(header).
We can't update it when obtaining a line value for a column (for instance, in sort__srcline_cmp()), because we reset it all when doing a resort (see hists__output_recalc_col_len()), so we need to, from what is in the hist_entry fields, set each of the column widths.
--- tools/perf/util/hist.c | 3 +++ 1 file changed, 3 insertions(+)
tools/perf/util/hist.c +3 -0
@@ -151,6 +151,9 @@ void hists__calc_col_len(struct hists *hhists__new_col_len (hists,HISTC_LOCAL_WEIGHT ,12 );hists__new_col_len (hists,HISTC_GLOBAL_WEIGHT ,12 ); +if (h->srcline) +hists__new_col_len (hists,HISTC_SRCLINE ,strlen (h->srcline)); +if (h->transaction)hists__new_col_len (hists,HISTC_TRANSACTION ,hist_entry__transaction_len ());
Greg Kroah-Hartman
maintainerPATCH 21/202 perf stat: Get correct cpu id for print_aggr
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kan Liang <[email protected]>
commit 601083cffb7cabdcc55b8195d732f0f7028570fa upstream.
print_aggr() fails to print per-core/per-socket statistics after commit 582ec0829b3d ("perf stat: Fix per-socket output bug for uncore events") if events have differnt cpus. Because in print_aggr(), aggr_get_id needs index (not cpu id) to find core/pkg id. Also, evsel cpu maps should be used to get aggregated id.
Here is an example:
Counting events cycles,uncore_imc_0/cas_count_read/. (Uncore event has cpumask 0,18)
$ perf stat -e cycles,uncore_imc_0/cas_count_read/ -C0,18 --per-core sleep 2
Without this patch, it failes to get CPU 18 result.
Performance counter stats for 'CPU(s) 0,18':
S0-C0 1 7526851 cycles S0-C0 1 1.05 MiB uncore_imc_0/cas_count_read/ S1-C0 0 <not counted> cycles S1-C0 0 <not counted> MiB uncore_imc_0/cas_count_read/
With this patch, it can get both CPU0 and CPU18 result.
Performance counter stats for 'CPU(s) 0,18':
S0-C0 1 6327768 cycles S0-C0 1 0.47 MiB uncore_imc_0/cas_count_read/ S1-C0 1 330228 cycles S1-C0 1 0.29 MiB uncore_imc_0/cas_count_read/
--- tools/perf/builtin-stat.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
tools/perf/builtin-stat.c +2 -3
@@ -1227,7 +1227,7 @@ static void abs_printout(int id, int nr,static void print_aggr (char *prefix) {struct perf_evsel *counter; -int cpu, cpu2, s, s2, id, nr; +int cpu, s, s2, id, nr;double uval;u64 ena, run, val;
@@ -1240,8 +1240,7 @@ static void print_aggr(char *prefix) val = ena = run =0 ; nr =0 ;for (cpu =0 ; cpu <perf_evsel__nr_cpus (counter); cpu++) { - cpu2 =perf_evsel__cpus (counter)->map[cpu]; - s2 =aggr_get_id (evsel_list->cpus, cpu2); + s2 =aggr_get_id (perf_evsel__cpus (counter), cpu);if (s2 != id)continue ; val += counter->counts->cpu[cpu].val;
Greg Kroah-Hartman
maintainerPATCH 22/202 perf tools: Add empty Build files for architectures lacking them
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
commit 93df8a1ed6231727c5db94a80b1a6bd5ee67cec3 upstream.
perf currently fails to build on MIPS as there is no tools/perf/arch/mips/Build file. Adding an empty file fixes this as there are no MIPS-specific sources to build.
It looks like the same is needed for Alpha and PA-RISC, though I haven't been able to test those.
--- tools/perf/arch/alpha/Build | 1 + tools/perf/arch/mips/Build | 1 + tools/perf/arch/parisc/Build | 1 + 3 files changed, 3 insertions(+)
tools/perf/arch/alpha/Build new file +1 -0
@@ -0,0 +1 @@ +# empty
tools/perf/arch/mips/Build new file +1 -0
@@ -0,0 +1 @@ +# empty
tools/perf/arch/parisc/Build new file +1 -0
@@ -0,0 +1 @@ +# empty
Greg Kroah-Hartman
maintainerPATCH 23/202 perf header: Fixup reading of HEADER_NRCPUS feature
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
commit caa470475d9b59eeff093ae650800d34612c4379 upstream.
The original patch introducing this header wrote the number of CPUs available and online in one order and then swapped those values when reading, fix it.
Before:
# perf record usleep 1 # perf report --header-only | grep 'nrcpus \(online\|avail\)' # nrcpus online : 4 # nrcpus avail : 4 # echo 0 > /sys/devices/system/cpu/cpu2/online # perf record usleep 1 # perf report --header-only | grep 'nrcpus \(online\|avail\)' # nrcpus online : 4 # nrcpus avail : 3 # echo 0 > /sys/devices/system/cpu/cpu1/online # perf record usleep 1 # perf report --header-only | grep 'nrcpus \(online\|avail\)' # nrcpus online : 4 # nrcpus avail : 2
After the fix, bringing back the CPUs online:
# perf report --header-only | grep 'nrcpus \(online\|avail\)' # nrcpus online : 2 # nrcpus avail : 4 # echo 1 > /sys/devices/system/cpu/cpu2/online # perf record usleep 1 # perf report --header-only | grep 'nrcpus \(online\|avail\)' # nrcpus online : 3 # nrcpus avail : 4 # echo 1 > /sys/devices/system/cpu/cpu1/online # perf record usleep 1 # perf report --header-only | grep 'nrcpus \(online\|avail\)' # nrcpus online : 4 # nrcpus avail : 4
--- tools/perf/util/header.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/header.c +2 -2
@@ -1426,7 +1426,7 @@ static int process_nrcpus(struct perf_fiif (ph->needs_swap) nr =bswap_32 (nr); - ph->env.nr_cpus_online = nr; + ph->env.nr_cpus_avail = nr; ret =readn (fd, &nr,sizeof (nr));if (ret !=sizeof (nr))
@@ -1435,7 +1435,7 @@ static int process_nrcpus(struct perf_fiif (ph->needs_swap) nr =bswap_32 (nr); - ph->env.nr_cpus_avail = nr; + ph->env.nr_cpus_online = nr;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 24/202 perf: Fix AUX buffer refcounting
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 57ffc5ca679f499f4704fd9b6a372916f59930ee upstream.
Its currently possible to drop the last refcount to the aux buffer from NMI context, which results in the expected fireworks.
The refcounting needs a bigger overhaul, but to cure the immediate problem, delay the freeing by using an irq_work.
--- kernel/events/core.c | 8 -------- kernel/events/internal.h | 10 ++++++++++ kernel/events/ring_buffer.c | 27 +++++++++++++++++++++++++-- 3 files changed, 35 insertions(+), 10 deletions(-)
kernel/events/core.c +0 -8
@@ -4411,14 +4411,6 @@ static void ring_buffer_wakeup(struct percu_read_unlock (); } -static void rb_free_rcu (struct rcu_head *rcu_head) -{ -struct ring_buffer *rb; - - rb = container_of(rcu_head, struct ring_buffer, rcu_head); -rb_free (rb); -} -struct ring_buffer *ring_buffer_get (struct perf_event *event) {struct ring_buffer *rb;
kernel/events/internal.h +10 -0
@@ -11,6 +11,7 @@struct ring_buffer {atomic_t refcount;struct rcu_head rcu_head; +struct irq_work irq_work;#ifdef CONFIG_PERF_USE_VMALLOC struct work_struct work;int page_order;/* allocation order */
@@ -55,6 +56,15 @@ struct ring_buffer { };extern void rb_free (struct ring_buffer *rb); + +static inline void rb_free_rcu (struct rcu_head *rcu_head) +{ +struct ring_buffer *rb; + + rb = container_of(rcu_head, struct ring_buffer, rcu_head); +rb_free (rb); +} +extern struct ring_buffer *rb_alloc (int nr_pages,long watermark,int cpu,int flags);extern void perf_event_wakeup (struct perf_event *event);
kernel/events/ring_buffer.c +25 -2
@@ -221,6 +221,8 @@ void perf_output_end(struct perf_output_rcu_read_unlock (); } +static void rb_irq_work (struct irq_work *work); +static void ring_buffer_init (struct ring_buffer *rb,long watermark,int flags) {
@@ -241,6 +243,16 @@ ring_buffer_init(struct ring_buffer *rb,INIT_LIST_HEAD (&rb->event_list);spin_lock_init (&rb->event_lock); +init_irq_work (&rb->irq_work, rb_irq_work); +} + +static void ring_buffer_put_async (struct ring_buffer *rb) +{ +if (!atomic_dec_and_test (&rb->refcount)) +return ; + + rb->rcu_head.next = (void *)rb; +irq_work_queue (&rb->irq_work); }/*
@@ -319,7 +331,7 @@ err_put:rb_free_aux (rb); err: -ring_buffer_put (rb); +ring_buffer_put_async (rb); handle->event =NULL ;return NULL ;
@@ -370,7 +382,7 @@ void perf_aux_output_end(struct perf_outlocal_set (&rb->aux_nest,0 );rb_free_aux (rb); -ring_buffer_put (rb); +ring_buffer_put_async (rb); }/*
@@ -559,7 +571,18 @@ static void __rb_free_aux(struct ring_buvoid rb_free_aux (struct ring_buffer *rb) {if (atomic_dec_and_test (&rb->aux_refcount)) +irq_work_queue (&rb->irq_work); +} + +static void rb_irq_work (struct irq_work *work) +{ + struct ring_buffer *rb = container_of(work, struct ring_buffer, irq_work); + +if (!atomic_read (&rb->aux_refcount))__rb_free_aux (rb); + +if (rb->rcu_head.next == (void *)rb) +call_rcu (&rb->rcu_head, rb_free_rcu); }#ifndef CONFIG_PERF_USE_VMALLOC
Greg Kroah-Hartman
maintainerPATCH 25/202 watchdog: sunxi: fix activation of system reset
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <[email protected]>
commit 0919e4445190da18496d31aac08b90828a47d45f upstream.
Commit f2147de33470 ("watchdog: sunxi: support parameterized compatible strings") introduced a regression in sunxi_wdt_start(), by which the system reset function of the watchdog is not enabled upon starting the watchdog. As a result, the system is not reset when the watchdog expires. Fix it.
--- drivers/watchdog/sunxi_wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/sunxi_wdt.c +1 -1
@@ -184,7 +184,7 @@ static int sunxi_wdt_start(struct watchd/* Set system reset function */ reg =readl (wdt_base + regs->wdt_cfg); reg &= ~(regs->wdt_reset_mask); - reg |= ~(regs->wdt_reset_val); + reg |= regs->wdt_reset_val;writel (reg, wdt_base + regs->wdt_cfg);/* Enable watchdog */
Greg Kroah-Hartman
maintainerPATCH 26/202 sched: access local runqueue directly in single_task_running
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominik Dingel <[email protected]>
commit 00cc1633816de8c95f337608a1ea64e228faf771 upstream.
Commit 2ee507c47293 ("sched: Add function single_task_running to let a task check if it is the only task running on a cpu") referenced the current runqueue with the smp_processor_id. When CONFIG_DEBUG_PREEMPT is enabled, that is only allowed if preemption is disabled or the currrent task is bound to the local cpu (e.g. kernel worker).
With commit f78195129963 ("kvm: add halt_poll_ns module parameter") KVM calls single_task_running. If CONFIG_DEBUG_PREEMPT is enabled that generates a lot of kernel messages.
To avoid adding preemption in that cases, as it would limit the usefulness, we change single_task_running to access directly the cpu local runqueue.
--- kernel/sched/core.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
kernel/sched/core.c +11 -4
@@ -2358,13 +2358,20 @@ unsigned long nr_running(void)/* * Check if only the current task is running on the cpu. +* +* Caution: this function does not check that the caller has disabled +* preemption, thus the result might have a time-of-check-to-time-of-use +* race. The caller is responsible to use it correctly, for example: +* +* - from a non-preemptable section (of course) +* +* - from a thread that is bound to a single CPU +* +* - in a loop with very short iterations (e.g. a polling loop) */ bool single_task_running (void ) { -if (cpu_rq (smp_processor_id ())->nr_running ==1 ) -return true; -else -return false; +return raw_rq ()->nr_running ==1 ; }EXPORT_SYMBOL (single_task_running);
Greg Kroah-Hartman
maintainerPATCH 27/202 hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
commit 728d29400488d54974d3317fe8a232b45fdb42ee upstream.
The STEP_UP_TIME and STEP_DOWN_TIME registers are swapped for all chips but NCT6775.
--- drivers/hwmon/nct6775.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/hwmon/nct6775.c +10 -6
@@ -354,6 +354,10 @@ static const u16 NCT6775_REG_TEMP_CRIT[A/* NCT6776 specific data */ +/* STEP_UP_TIME and STEP_DOWN_TIME regs are swapped for all chips but NCT6775 */ +#define NCT6776_REG_FAN_STEP_UP_TIME NCT6775_REG_FAN_STEP_DOWN_TIME +#define NCT6776_REG_FAN_STEP_DOWN_TIME NCT6775_REG_FAN_STEP_UP_TIME +static const s8 NCT6776_ALARM_BITS [] = {0 ,1 ,2 ,3 ,8 ,21 ,20 ,16 ,/* in0.. in7 */ 17 ,-1 ,-1 ,-1 ,-1 ,-1 ,-1 ,/* in8..in14 */
@@ -3528,8 +3532,8 @@ static int nct6775_probe(struct platform data->REG_FAN_PULSES =NCT6776_REG_FAN_PULSES ; data->FAN_PULSE_SHIFT =NCT6775_FAN_PULSE_SHIFT ; data->REG_FAN_TIME[0 ] =NCT6775_REG_FAN_STOP_TIME ; - data->REG_FAN_TIME[1 ] =NCT6775_REG_FAN_STEP_UP_TIME ; - data->REG_FAN_TIME[2 ] =NCT6775_REG_FAN_STEP_DOWN_TIME ; + data->REG_FAN_TIME[1 ] =NCT6776_REG_FAN_STEP_UP_TIME ; + data->REG_FAN_TIME[2 ] =NCT6776_REG_FAN_STEP_DOWN_TIME ; data->REG_TOLERANCE_H =NCT6776_REG_TOLERANCE_H ; data->REG_PWM[0 ] =NCT6775_REG_PWM ; data->REG_PWM[1 ] =NCT6775_REG_FAN_START_OUTPUT ;
@@ -3600,8 +3604,8 @@ static int nct6775_probe(struct platform data->REG_FAN_PULSES =NCT6779_REG_FAN_PULSES ; data->FAN_PULSE_SHIFT =NCT6775_FAN_PULSE_SHIFT ; data->REG_FAN_TIME[0 ] =NCT6775_REG_FAN_STOP_TIME ; - data->REG_FAN_TIME[1 ] =NCT6775_REG_FAN_STEP_UP_TIME ; - data->REG_FAN_TIME[2 ] =NCT6775_REG_FAN_STEP_DOWN_TIME ; + data->REG_FAN_TIME[1 ] =NCT6776_REG_FAN_STEP_UP_TIME ; + data->REG_FAN_TIME[2 ] =NCT6776_REG_FAN_STEP_DOWN_TIME ; data->REG_TOLERANCE_H =NCT6776_REG_TOLERANCE_H ; data->REG_PWM[0 ] =NCT6775_REG_PWM ; data->REG_PWM[1 ] =NCT6775_REG_FAN_START_OUTPUT ;
@@ -3677,8 +3681,8 @@ static int nct6775_probe(struct platform data->REG_FAN_PULSES =NCT6779_REG_FAN_PULSES ; data->FAN_PULSE_SHIFT =NCT6775_FAN_PULSE_SHIFT ; data->REG_FAN_TIME[0 ] =NCT6775_REG_FAN_STOP_TIME ; - data->REG_FAN_TIME[1 ] =NCT6775_REG_FAN_STEP_UP_TIME ; - data->REG_FAN_TIME[2 ] =NCT6775_REG_FAN_STEP_DOWN_TIME ; + data->REG_FAN_TIME[1 ] =NCT6776_REG_FAN_STEP_UP_TIME ; + data->REG_FAN_TIME[2 ] =NCT6776_REG_FAN_STEP_DOWN_TIME ; data->REG_TOLERANCE_H =NCT6776_REG_TOLERANCE_H ; data->REG_PWM[0 ] =NCT6775_REG_PWM ; data->REG_PWM[1 ] =NCT6775_REG_FAN_START_OUTPUT ;
Greg Kroah-Hartman
maintainerPATCH 28/202 ARM: fix Thumb2 signal handling when ARMv6 is enabled
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <[email protected]>
commit 9b55613f42e8d40d5c9ccb8970bde6af4764b2ab upstream.
When a kernel is built covering ARMv6 to ARMv7, we omit to clear the IT state when entering a signal handler. This can cause the first few instructions to be conditionally executed depending on the parent context.
In any case, the original test for >= ARMv7 is broken - ARMv6 can have Thumb-2 support as well, and an ARMv6T2 specific build would omit this code too.
Relax the test back to ARMv6 or greater. This results in us always clearing the IT state bits in the PSR, even on CPUs where these bits are reserved. However, they're reserved for the IT state, so this should cause no harm.
--- arch/arm/kernel/signal.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
arch/arm/kernel/signal.c +10 -5
@@ -343,12 +343,17 @@ setup_return(struct pt_regs *regs, struc*/ thumb = handler &1 ; -#if __LINUX_ARM_ARCH__ >=7 +#if __LINUX_ARM_ARCH__ >=6 /* -* Clear the If-Then Thumb-2 execution state -* ARM spec requires this to be all 000s in ARM mode -* Snapdragon S4/Krait misbehaves on a Thumb=>ARM -* signal transition without this. +* Clear the If-Then Thumb-2 execution state. ARM spec +* requires this to be all 000s in ARM mode. Snapdragon +* S4/Krait misbehaves on a Thumb=>ARM signal transition +* without this. +* +* We must do this whenever we are running on a Thumb-2 +* capable CPU, which includes ARMv6T2. However, we elect +* to do this whenever we're on an ARMv6 or later CPU for +* simplicity. */ cpsr &= ~PSR_IT_MASK ;#endif
Greg Kroah-Hartman
maintainerPATCH 29/202 ARM: 8429/1: disable GCC SRA optimization
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit a077224fd35b2f7fbc93f14cf67074fc792fbac2 upstream.
While working on the 32-bit ARM port of UEFI, I noticed a strange corruption in the kernel log. The following snprintf() statement (in drivers/firmware/efi/efi.c:efi_md_typeattr_format())
snprintf(pos, size, "|%3s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]",
was producing the following output in the log:
| | | | | |WB|WT|WC|UC] | | | | | |WB|WT|WC|UC] | | | | | |WB|WT|WC|UC] |RUN| | | | |WB|WT|WC|UC]* |RUN| | | | |WB|WT|WC|UC]* | | | | | |WB|WT|WC|UC] |RUN| | | | |WB|WT|WC|UC]* | | | | | |WB|WT|WC|UC] |RUN| | | | | | | |UC] |RUN| | | | | | | |UC]
As it turns out, this is caused by incorrect code being emitted for the string() function in lib/vsprintf.c. The following code
if (!(spec.flags & LEFT)) {
while (len < spec.field_width--) {
if (buf < end)
*buf = ' ';
++buf;
}
}
for (i = 0; i < len; ++i) {
if (buf < end)
*buf = *s;
++buf; ++s;
}
while (len < spec.field_width--) {
if (buf < end)
*buf = ' ';
++buf;
}when called with len == 0, triggers an issue in the GCC SRA optimization pass (Scalar Replacement of Aggregates), which handles promotion of signed struct members incorrectly. This is a known but as yet unresolved issue.
(https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932). In this particular case, it is causing the second while loop to be executed erroneously a single time, causing the additional space characters to be printed.
So disable the optimization by passing -fno-ipa-sra.
--- arch/arm/Makefile | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/arm/Makefile +8 -0
@@ -50,6 +50,14 @@ AS += -EL LD += -EL endif +# +# The Scalar Replacement of Aggregates (SRA) optimization pass in GCC 4.9 and +# later may result in code being generated that handles signed short and signed +# char struct members incorrectly. So disable it. +# (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932) +# +KBUILD_CFLAGS += $(call cc-option,-fno-ipa-sra) + # This selects which instruction set is used. # Note that GCC does not numerically define an architecture version # macro, but instead defines a whole series of macros which makes
Greg Kroah-Hartman
maintainerPATCH 30/202 windfarm: decrement client count when unregistering
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Bolle <[email protected]>
commit fe2b592173ff0274e70dc44d1d28c19bb995aa7c upstream.
wf_unregister_client() increments the client count when a client unregisters. That is obviously incorrect. Decrement that client count instead.
--- drivers/macintosh/windfarm_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/macintosh/windfarm_core.c +1 -1
@@ -435,7 +435,7 @@ int wf_unregister_client(struct notifier {mutex_lock (&wf_lock);blocking_notifier_chain_unregister (&wf_client_list, nb); - wf_client_count++; + wf_client_count--;if (wf_client_count ==0 )wf_stop_thread ();mutex_unlock (&wf_lock);
Greg Kroah-Hartman
maintainerPATCH 31/202 ARM: 8425/1: kgdb: Dont try to stop the machine when setting breakpoints
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doug Anderson <[email protected]>
commit 7ae85dc7687c7e7119053d83d02c560ea217b772 upstream.
In (23a4e40 arm: kgdb: Handle read-only text / modules) we moved to using patch_text() to set breakpoints so that we could handle the case when we had CONFIG_DEBUG_RODATA. That patch used patch_text(). Unfortunately, patch_text() assumes that we're not in atomic context when it runs since it needs to grab a mutex and also wait for other CPUs to stop (which it does with a completion).
This would result in a stack crawl if you had CONFIG_DEBUG_ATOMIC_SLEEP and tried to set a breakpoint in kgdb. The crawl looked something like:
BUG: scheduling while atomic: swapper/0/0/0x00010007 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.2.0-rc7-00133-geb63b34 #1073 Hardware name: Rockchip (Device Tree) (unwind_backtrace) from [<c00133d4>] (show_stack+0x20/0x24) (show_stack) from [<c05400e8>] (dump_stack+0x84/0xb8) (dump_stack) from [<c004913c>] (__schedule_bug+0x54/0x6c) (__schedule_bug) from [<c054065c>] (__schedule+0x80/0x668) (__schedule) from [<c0540cfc>] (schedule+0xb8/0xd4) (schedule) from [<c0543a3c>] (schedule_timeout+0x2c/0x234) (schedule_timeout) from [<c05417c0>] (wait_for_common+0xf4/0x188) (wait_for_common) from [<c0541874>] (wait_for_completion+0x20/0x24) (wait_for_completion) from [<c00a0104>] (__stop_cpus+0x58/0x70) (__stop_cpus) from [<c00a0580>] (stop_cpus+0x3c/0x54) (stop_cpus) from [<c00a06c4>] (__stop_machine+0xcc/0xe8) (__stop_machine) from [<c00a0714>] (stop_machine+0x34/0x44) (stop_machine) from [<c00173e8>] (patch_text+0x28/0x34) (patch_text) from [<c001733c>] (kgdb_arch_set_breakpoint+0x40/0x4c) (kgdb_arch_set_breakpoint) from [<c00a0d68>] (kgdb_validate_break_address+0x2c/0x60) (kgdb_validate_break_address) from [<c00a0e90>] (dbg_set_sw_break+0x1c/0xdc) (dbg_set_sw_break) from [<c00a2e88>] (gdb_serial_stub+0x9c4/0xba4) (gdb_serial_stub) from [<c00a11cc>] (kgdb_cpu_enter+0x1f8/0x60c) (kgdb_cpu_enter) from [<c00a18cc>] (kgdb_handle_exception+0x19c/0x1d0) (kgdb_handle_exception) from [<c0016f7c>] (kgdb_compiled_brk_fn+0x30/0x3c) (kgdb_compiled_brk_fn) from [<c00091a4>] (do_undefinstr+0x1a4/0x20c) (do_undefinstr) from [<c001400c>] (__und_svc_finish+0x0/0x34)
It turns out that when we're in kgdb all the CPUs are stopped anyway so there's no reason we should be calling patch_text(). We can instead directly call __patch_text() which assumes that CPUs have already been stopped.
--- arch/arm/kernel/kgdb.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
arch/arm/kernel/kgdb.c +5 -3
@@ -259,15 +259,17 @@ int kgdb_arch_set_breakpoint(struct kgdbif (err)return err; -patch_text ((void *)bpt->bpt_addr, - *(unsigned int *)arch_kgdb_ops.gdb_bpt_instr); +/* Machine is already stopped, so we can use __patch_text() directly */ +__patch_text ((void *)bpt->bpt_addr, + *(unsigned int *)arch_kgdb_ops.gdb_bpt_instr);return err; }int kgdb_arch_remove_breakpoint (struct kgdb_bkpt *bpt) { -patch_text ((void *)bpt->bpt_addr, *(unsigned int *)bpt->saved_instr); +/* Machine is already stopped, so we can use __patch_text() directly */ +__patch_text ((void *)bpt->bpt_addr, *(unsigned int *)bpt->saved_instr);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 32/202 ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grazvydas Ignotas <[email protected]>
commit 1dbdad75074d16c3e3005180f81a01cdc04a7872 upstream.
The i2c5 pinctrl offsets are wrong. If the bootloader doesn't set the pins up, communication with tca6424a doesn't work (controller timeouts) and it is not possible to enable HDMI.
--- arch/arm/boot/dts/omap5-uevm.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/omap5-uevm.dts +2 -2
@@ -174,8 +174,8 @@ i2c5_pins: pinmux_i2c5_pins { pinctrl-single,pins = < - 0x184 (PIN_INPUT | MUX_MODE0) /* i2c5_scl */ - 0x186 (PIN_INPUT | MUX_MODE0) /* i2c5_sda */ + 0x186 (PIN_INPUT | MUX_MODE0) /* i2c5_scl */ + 0x188 (PIN_INPUT | MUX_MODE0) /* i2c5_sda */ >; };
Greg Kroah-Hartman
maintainerPATCH 33/202 ARM: dts: omap3-beagle: make i2c3, ddc and tfp410 gpio work again
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carl Frederik Werner <[email protected]>
commit 3a2fa775bd1d0579113666c1a2e37654a34018a0 upstream.
Let's fix pinmux address of gpio 170 used by tfp410 powerdown-gpio.
According to the OMAP35x Technical Reference Manual
CONTROL_PADCONF_I2C3_SDA[15:0] 0x480021C4 mode0: i2c3_sda CONTROL_PADCONF_I2C3_SDA[31:16] 0x480021C4 mode4: gpio_170
the pinmux address of gpio 170 must be 0x480021C6.
The former wrong address broke i2c3 (used by hdmi ddc), resulting in kernel message:
omap_i2c 48060000.i2c: controller timed out
--- arch/arm/boot/dts/omap3-beagle.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/omap3-beagle.dts +1 -1
@@ -202,7 +202,7 @@ tfp410_pins: pinmux_tfp410_pins { pinctrl-single,pins = < - 0x194 (PIN_OUTPUT | MUX_MODE4) /* hdq_sio.gpio_170 */ + 0x196 (PIN_OUTPUT | MUX_MODE4) /* hdq_sio.gpio_170 */ >; };
Greg Kroah-Hartman
maintainerPATCH 34/202 ARM: EXYNOS: reset Little cores when cpu is up
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chanho Park <[email protected]>
commit 833b5794e3303cc97a0d2d4ba97f26cc9d9b4b79 upstream.
The cpu booting of exynos5422 has been still broken since we discussed it in last year[1]. This patch is inspired from Odroid XU3
code (Actually, it was from samsung exynos vendor kernel)[2]. This weird reset code was founded exynos5420 octa cores series SoCs and only required for the first boot core is the Little core (Cortex A7). Some of the exynos5420 boards and all of the exynos5422 boards will require this code.
There is two ways to check the little core is the first cpu. One is checking GPG2CON[1] GPIO value and the other is checking the cluster number of the first cpu. I selected the latter because it's more easier than the former.
[1] http://lists.infradead.org/pipermail/linux-arm-kernel/2015-June/350632.html
[2] https://patchwork.kernel.org/patch/6782891/
--- arch/arm/mach-exynos/mcpm-exynos.c | 27 ++++++++++++++++++++++++++- arch/arm/mach-exynos/regs-pmu.h | 6 ++++++ 2 files changed, 32 insertions(+), 1 deletion(-)
arch/arm/mach-exynos/mcpm-exynos.c +26 -1
@@ -20,6 +20,7 @@#include <asm/cputype.h> #include <asm/cp15.h> #include <asm/mcpm.h> +#include <asm/smp_plat.h> #include "regs-pmu.h" #include "common.h"
@@ -70,7 +71,31 @@ static int exynos_cpu_powerup(unsigned i cluster >= EXYNOS5420_NR_CLUSTERS)return -EINVAL ; -exynos_cpu_power_up (cpunr); +if (!exynos_cpu_power_state (cpunr)) { +exynos_cpu_power_up (cpunr); + +/* +* This assumes the cluster number of the big cores(Cortex A15) +* is 0 and the Little cores(Cortex A7) is 1. +* When the system was booted from the Little core, +* they should be reset during power up cpu. +*/ +if (cluster && + cluster ==MPIDR_AFFINITY_LEVEL (cpu_logical_map (0 ),1 )) { +/* +* Before we reset the Little cores, we should wait +* the SPARE2 register is set to 1 because the init +* codes of the iROM will set the register after +* initialization. +*/ +while (!pmu_raw_readl (S5P_PMU_SPARE2 )) +udelay (10 ); + +pmu_raw_writel (EXYNOS5420_KFC_CORE_RESET (cpu), +EXYNOS_SWRESET ); + } + } +return 0 ; }
arch/arm/mach-exynos/regs-pmu.h +6 -0
@@ -513,6 +513,12 @@ static inline unsigned int exynos_pmu_cp#define SPREAD_ENABLE 0xF#define SPREAD_USE_STANDWFI 0xF +#define EXYNOS5420_KFC_CORE_RESET0 BIT(8) +#define EXYNOS5420_KFC_ETM_RESET0 BIT(20) + +#define EXYNOS5420_KFC_CORE_RESET (_nr) \ + ((EXYNOS5420_KFC_CORE_RESET0 | EXYNOS5420_KFC_ETM_RESET0) << (_nr)) +#define EXYNOS5420_BB_CON1 0x0784#define EXYNOS5420_BB_SEL_EN BIT(31)#define EXYNOS5420_BB_PMOS_EN BIT(7)
Greg Kroah-Hartman
maintainerPATCH 35/202 ARM: dts: fix usb pin control for imx-rex dts
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Felipe F. Tonello" <[email protected]>
commit 0af822110871400908d5b6f83a8908c45f881d8f upstream.
This fixes a duplicated pin control causing this error:
imx6q-pinctrl 20e0000.iomuxc: pin MX6Q_PAD_GPIO_1 already requested by regulators:regulator@2; cannot claim for 2184000.usb imx6q-pinctrl 20e0000.iomuxc: pin-137 (2184000.usb) status -22 imx6q-pinctrl 20e0000.iomuxc: could not request pin 137 (MX6Q_PAD_GPIO_1) from group usbotggrp on device 20e0000.iomuxc imx_usb 2184000.usb: Error applying setting, reverse things back
imx6q-pinctrl 20e0000.iomuxc: pin MX6Q_PAD_EIM_D31 already requested by regulators:regulator@1; cannot claim for 2184200.usb imx6q-pinctrl 20e0000.iomuxc: pin-52 (2184200.usb) status -22 imx6q-pinctrl 20e0000.iomuxc: could not request pin 52 (MX6Q_PAD_EIM_D31) from group usbh1grp on device 20e0000.iomuxcimx_usb 2184200.usb: Error applying setting, reverse things back
--- arch/arm/boot/dts/imx6qdl-rex.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm/boot/dts/imx6qdl-rex.dtsi +0 -2
@@ -35,7 +35,6 @@ compatible = "regulator-fixed"; reg = <1>; pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usbh1>; regulator-name = "usbh1_vbus"; regulator-min-microvolt = <5000000>; regulator-max-microvolt = <5000000>;
@@ -47,7 +46,6 @@ compatible = "regulator-fixed"; reg = <2>; pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usbotg>; regulator-name = "usb_otg_vbus"; regulator-min-microvolt = <5000000>; regulator-max-microvolt = <5000000>;
Greg Kroah-Hartman
maintainerPATCH 36/202 blockdev: dont set S_DAX for misaligned partitions
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Moyer <[email protected]>
commit f0b2e563bc419df7c1b3d2f494574c25125f6aed upstream.
The dax code doesn't currently support misaligned partitions, so disable O_DIRECT via dax until such time as that support materializes.
--- fs/block_dev.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/block_dev.c +7 -0
@@ -1234,6 +1234,13 @@ static int __blkdev_get(struct block_dev goto out_clear; }bd_set_size (bdev, (loff_t )bdev->bd_part->nr_sects <<9 ); +/* +* If the partition is not aligned on a page +* boundary, we can't do dax I/O to it. +*/ +if ((bdev->bd_part->start_sect % (PAGE_SIZE /512 )) || + (bdev->bd_part->nr_sects % (PAGE_SIZE /512 ))) + bdev->bd_inode->i_flags &= ~S_DAX ; } }else {if (bdev->bd_contains == bdev) {
Greg Kroah-Hartman
maintainerPATCH 37/202 dmaengine: dw: properly read DWC_PARAMS register
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit 6bea0f6d1c47b07be88dfd93f013ae05fcb3d8bf upstream.
In case we have less than maximum allowed channels (8) and autoconfiguration is enabled the DWC_PARAMS read is wrong because it uses different arithmetic to what is needed for channel priority setup.
Re-do the caclulations properly. This now works on AVR32 board well.
--- drivers/dma/dw/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma/dw/core.c +2 -2
@@ -1591,7 +1591,6 @@ int dw_dma_probe(struct dw_dma_chip *chiINIT_LIST_HEAD (&dw->dma.channels);for (i =0 ; i < nr_channels; i++) {struct dw_dma_chan *dwc = &dw->chan[i]; -int r = nr_channels - i -1 ; dwc->chan.device = &dw->dma;dma_cookie_init (&dwc->chan);
@@ -1603,7 +1602,7 @@ int dw_dma_probe(struct dw_dma_chip *chi/* 7 is highest priority & 0 is lowest. */ if (pdata->chan_priority ==CHAN_PRIORITY_ASCENDING ) - dwc->priority = r; + dwc->priority = nr_channels - i -1 ;else dwc->priority = i;
@@ -1622,6 +1621,7 @@ int dw_dma_probe(struct dw_dma_chip *chi/* Hardware configuration */ if (autocfg) {unsigned int dwc_params; +unsigned int r =DW_DMA_MAX_NR_CHANNELS - i -1 ;void __iomem *addr = chip->regs + r *sizeof (u32); dwc_params =dma_read_byaddr (addr,DWC_PARAMS );
Greg Kroah-Hartman
maintainerPATCH 38/202 x86/apic: Serialize LVTT and TSC_DEADLINE writes
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaohua Li <[email protected]>
commit 5d7c631d926b59aa16f3c56eaeb83f1036c81dc7 upstream.
The APIC LVTT register is MMIO mapped but the TSC_DEADLINE register is an MSR. The write to the TSC_DEADLINE MSR is not serializing, so it's not guaranteed that the write to LVTT has reached the APIC before the TSC_DEADLINE MSR is written. In such a case the write to the MSR is ignored and as a consequence the local timer interrupt never fires.
The SDM decribes this issue for xAPIC and x2APIC modes. The serialization methods recommended by the SDM differ.
xAPIC:
"1. Memory-mapped write to LVT Timer Register, setting bits 18:17 to 10b.
2. WRMSR to the IA32_TSC_DEADLINE MSR a value much larger than current time-stamp counter.
3. If RDMSR of the IA32_TSC_DEADLINE MSR returns zero, go to step 2.
4. WRMSR to the IA32_TSC_DEADLINE MSR the desired deadline."
x2APIC:
"To allow for efficient access to the APIC registers in x2APIC mode,
the serializing semantics of WRMSR are relaxed when writing to the APIC registers. Thus, system software should not use 'WRMSR to APIC registers in x2APIC mode' as a serializing instruction. Read and write accesses to the APIC registers will occur in program order. A WRMSR to an APIC register may complete before all preceding stores are globally visible; software can prevent this by inserting a serializing instruction, an SFENCE, or an MFENCE before the WRMSR."
The xAPIC method is to just wait for the memory mapped write to hit the LVTT by checking whether the MSR write has reached the hardware. There is no reason why a proper MFENCE after the memory mapped write would not do the same. Andi Kleen confirmed that MFENCE is sufficient for the xAPIC case as well.
Issue MFENCE before writing to the TSC_DEADLINE MSR. This can be done unconditionally as all CPUs which have TSC_DEADLINE also have MFENCE support.
[ tglx: Massaged the changelog ]
--- arch/x86/kernel/apic/apic.c | 7 +++++++ 1 file changed, 7 insertions(+)
arch/x86/kernel/apic/apic.c +7 -0
@@ -336,6 +336,13 @@ static void __setup_APIC_LVTT(unsigned iapic_write (APIC_LVTT , lvtt_value);if (lvtt_value &APIC_LVT_TIMER_TSCDEADLINE ) { +/* +* See Intel SDM: TSC-Deadline Mode chapter. In xAPIC mode, +* writing to the APIC LVTT and TSC_DEADLINE MSR isn't serialized. +* According to Intel, MFENCE can do the serialization here. +*/ + asmvolatile ("mfence" : : :"memory" ); +printk_once (KERN_DEBUG "TSC deadline timer enabled\n" );return ; }
Greg Kroah-Hartman
maintainerPATCH 39/202 x86/alternatives: Make optimize_nops() interrupt safe and synced
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit 66c117d7fa2ae429911e60d84bf31a90b2b96189 upstream.
Richard reported the following crash:
[ 0.036000] BUG: unable to handle kernel paging request at 55501e06 [ 0.036000] IP: [<c0aae48b>] common_interrupt+0xb/0x38 [ 0.036000] Call Trace: [ 0.036000] [<c0409c80>] ? add_nops+0x90/0xa0 [ 0.036000] [<c040a054>] apply_alternatives+0x274/0x630
Chuck decoded:
" 0: 8d 90 90 83 04 24 lea 0x24048390(%eax),%edx
6: 80 fc 0f cmp $0xf,%ah
9: a8 0f test $0xf,%al
>> b: a0 06 1e 50 55 mov 0x55501e06,%al
10: 57 push %edi
11: 56 push %esi Interrupt 0x30 occurred while the alternatives code was replacing the initial 0x90,0x90,0x90 NOPs (from the ASM_CLAC macro) with the optimized version, 0x8d,0x76,0x00. Only the first byte has been replaced so far, and it makes a mess out of the insn decoding."
optimize_nops() is buggy in two aspects:
- It's not disabling interrupts across the modification
- It's lacking a sync_core() call
Add both.
--- arch/x86/kernel/alternative.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/x86/kernel/alternative.c +5 -0
@@ -325,10 +325,15 @@ done: static void __init_or_module optimize_nops(struct alt_instr *a, u8 *instr) { +unsigned long flags; +if (instr[0 ] !=0x90 )return ; +local_irq_save (flags);add_nops (instr + (a->instrlen - a->padlen), a->padlen); +sync_core (); +local_irq_restore (flags);DUMP_BYTES (instr, a->instrlen,"%p: [%d:%d) optimized NOPs: " , instr, a->instrlen - a->padlen, a->padlen);
Greg Kroah-Hartman
maintainerPATCH 40/202 x86/platform: Fix Geode LX timekeeping in the generic x86 build
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <[email protected]>
commit 03da3ff1cfcd7774c8780d2547ba0d995f7dc03d upstream.
In 2007, commit 07190a08eef36 ("Mark TSC on GeodeLX reliable") bypassed verification of the TSC on Geode LX. However, this code (now in the check_system_tsc_reliable() function in arch/x86/kernel/tsc.c) was only present if CONFIG_MGEODE_LX was set.
OpenWRT has recently started building its generic Geode target for Geode GX, not LX, to include support for additional platforms. This broke the timekeeping on LX-based devices, because the TSC wasn't marked as reliable:
https://dev.openwrt.org/ticket/20531
By adding a runtime check on is_geode_lx(), we can also include the fix if CONFIG_MGEODEGX1 or CONFIG_X86_GENERIC are set, thus fixing the problem.
--- arch/x86/kernel/tsc.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
arch/x86/kernel/tsc.c +10 -7
@@ -21,6 +21,7 @@#include <asm/hypervisor.h> #include <asm/nmi.h> #include <asm/x86_init.h> +#include <asm/geode.h> unsigned int __read_mostly cpu_khz;/* TSC clocks / usec, not used here */ EXPORT_SYMBOL (cpu_khz);
@@ -1004,15 +1005,17 @@ EXPORT_SYMBOL_GPL(mark_tsc_unstable);static void __init check_system_tsc_reliable (void ) { -#ifdef CONFIG_MGEODE_LX -/* RTSC counts during suspend */ +#if defined(CONFIG_MGEODEGX1 ) || defined(CONFIG_MGEODE_LX ) || defined(CONFIG_X86_GENERIC ) +if (is_geode_lx ()) { +/* RTSC counts during suspend */ #define RTSC_SUSP 0x100 -unsigned long res_low, res_high; +unsigned long res_low, res_high; -rdmsr_safe (MSR_GEODE_BUSCONT_CONF0 , &res_low, &res_high); -/* Geode_LX - the OLPC CPU has a very reliable TSC */ -if (res_low &RTSC_SUSP ) - tsc_clocksource_reliable =1 ; +rdmsr_safe (MSR_GEODE_BUSCONT_CONF0 , &res_low, &res_high); +/* Geode_LX - the OLPC CPU has a very reliable TSC */ +if (res_low &RTSC_SUSP ) + tsc_clocksource_reliable =1 ; + }#endif if (boot_cpu_has (X86_FEATURE_TSC_RELIABLE )) tsc_clocksource_reliable =1 ;
Greg Kroah-Hartman
maintainerPATCH 41/202 x86/paravirt: Replace the paravirt nop with a bona fide empty function
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <[email protected]>
commit fc57a7c68020dcf954428869eafd934c0ab1536f upstream.
PARAVIRT_ADJUST_EXCEPTION_FRAME generates this code (using nmi as an example, trimmed for readability):
ff 15 00 00 00 00 callq *0x0(%rip) # 2796 <nmi+0x6>
2792: R_X86_64_PC32 pv_irq_ops+0x2cThat's a call through a function pointer to regular C function that does nothing on native boots, but that function isn't protected against kprobes, isn't marked notrace, and is certainly not guaranteed to preserve any registers if the compiler is feeling perverse. This is bad news for a CLBR_NONE operation.
Of course, if everything works correctly, once paravirt ops are patched, it gets nopped out, but what if we hit this code before paravirt ops are patched in? This can potentially cause breakage that is very difficult to debug.
A more subtle failure is possible here, too: if _paravirt_nop uses the stack at all (even just to push RBP), it will overwrite the "NMI executing" variable if it's called in the NMI prologue.
The Xen case, perhaps surprisingly, is fine, because it's already written in asm.
Fix all of the cases that default to paravirt_nop (including adjust_exception_frame) with a big hammer: replace paravirt_nop with an asm function that is just a ret instruction.
The Xen case may have other problems, so document them.
This is part of a fix for some random crashes that Sasha saw.
--- arch/x86/kernel/entry_64.S | 11 +++++++++++ arch/x86/kernel/paravirt.c | 16 ++++++++++++---- 2 files changed, 23 insertions(+), 4 deletions(-)
arch/x86/kernel/entry_64.S +11 -0
@@ -1393,7 +1393,18 @@ END(error_exit) /* Runs on exception stack */ ENTRY(nmi) INTR_FRAME + /* + * Fix up the exception frame if we're on Xen. + * PARAVIRT_ADJUST_EXCEPTION_FRAME is guaranteed to push at most + * one value to the stack on native, so it may clobber the rdx + * scratch slot, but it won't clobber any of the important + * slots past it. + * + * Xen is a different story, because the Xen frame itself overlaps + * the "NMI executing" variable. + */ PARAVIRT_ADJUST_EXCEPTION_FRAME + /* * We allow breakpoints in NMIs. If a breakpoint occurs, then * the iretq it performs will take us out of NMI context.
arch/x86/kernel/paravirt.c +12 -4
@@ -41,10 +41,18 @@#include <asm/timer.h> #include <asm/special_insns.h> -/* nop stub */ -void _paravirt_nop (void ) -{ -} +/* +* nop stub, which must not clobber anything *including the stack* to +* avoid confusing the entry prologues. +*/ +extern void _paravirt_nop (void ); +asm (".pushsection .entry.text, \"ax\"\n" +".global _paravirt_nop\n" +"_paravirt_nop:\n\t" +"ret\n\t" +".size _paravirt_nop, . - _paravirt_nop\n\t" +".type _paravirt_nop, @function\n\t" +".popsection" );/* identity function, which can be inlined */ u32 _paravirt_ident_32 (u32 x)
Greg Kroah-Hartman
maintainerPATCH 42/202 x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <[email protected]>
commit 83c133cf11fb0e68a51681447e372489f052d40e upstream.
The NMI entry code that switches to the normal kernel stack needs to be very careful not to clobber any extra stack slots on the NMI stack. The code is fine under the assumption that SWAPGS is just a normal instruction, but that assumption isn't really true. Use SWAPGS_UNSAFE_STACK instead.
This is part of a fix for some random crashes that Sasha saw.
--- arch/x86/kernel/entry_64.S | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/kernel/entry_64.S +4 -1
@@ -1456,9 +1456,12 @@ ENTRY(nmi) * we don't want to enable interrupts, because then we'll end * up in an awkward situation in which IRQs are on but NMIs * are off. + * + * We also must not push anything to the stack before switching + * stacks lest we corrupt the "NMI executing" variable. */ - SWAPGS + SWAPGS_UNSAFE_STACK cld movq %rsp, %rdx movq PER_CPU_VAR(kernel_stack), %rsp
Greg Kroah-Hartman
maintainerPATCH 43/202 Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Dirk=20M=C3=BCller?= <[email protected]>
commit d2922422c48df93f3edff7d872ee4f3191fefb08 upstream.
The cpu feature flags are not ever going to change, so warning everytime can cause a lot of kernel log spam
(in our case more than 10GB/hour).
The warning seems to only occur when nested virtualization is enabled, so it's probably triggered by a KVM bug. This is a sensible and safe change anyway, and the KVM bug fix might not be suitable for stable releases anyway.
--- arch/x86/kvm/svm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/svm.c +1 -1
@@ -512,7 +512,7 @@ static void skip_emulated_instruction(ststruct vcpu_svm *svm =to_svm (vcpu);if (svm->vmcb->control.next_rip !=0 ) { -WARN_ON (!static_cpu_has (X86_FEATURE_NRIPS )); +WARN_ON_ONCE (!static_cpu_has (X86_FEATURE_NRIPS )); svm->next_rip = svm->vmcb->control.next_rip; }
Greg Kroah-Hartman
maintainerPATCH 44/202 x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fleming <[email protected]>
commit a5caa209ba9c29c6421292e7879d2387a2ef39c9 upstream.
Beginning with UEFI v2.5 EFI_PROPERTIES_TABLE was introduced that signals that the firmware PE/COFF loader supports splitting code and data sections of PE/COFF images into separate EFI memory map entries. This allows the kernel to map those regions with strict memory protections, e.g. EFI_MEMORY_RO for code, EFI_MEMORY_XP for data, etc.
Unfortunately, an unwritten requirement of this new feature is that the regions need to be mapped with the same offsets relative to each other as observed in the EFI memory map. If this is not done crashes like this may occur,
BUG: unable to handle kernel paging request at fffffffefe6086dd IP: [<fffffffefe6086dd>] 0xfffffffefe6086dd Call Trace: [<ffffffff8104c90e>] efi_call+0x7e/0x100 [<ffffffff81602091>] ? virt_efi_set_variable+0x61/0x90 [<ffffffff8104c583>] efi_delete_dummy_variable+0x63/0x70 [<ffffffff81f4e4aa>] efi_enter_virtual_mode+0x383/0x392 [<ffffffff81f37e1b>] start_kernel+0x38a/0x417 [<ffffffff81f37495>] x86_64_start_reservations+0x2a/0x2c [<ffffffff81f37582>] x86_64_start_kernel+0xeb/0xef
Here 0xfffffffefe6086dd refers to an address the firmware expects to be mapped but which the OS never claimed was mapped. The issue is that included in these regions are relative addresses to other regions which were emitted by the firmware toolchain before the "splitting" of sections occurred at runtime.
Needless to say, we don't satisfy this unwritten requirement on x86_64 and instead map the EFI memory map entries in reverse order. The above crash is almost certainly triggerable with any kernel newer than v3.13 because that's when we rewrote the EFI runtime region mapping code, in commit d2f7cbe7b26a ("x86/efi:
Runtime services virtual mapping"). For kernel versions before v3.13 things may work by pure luck depending on the fragmentation of the kernel virtual address space at the time we map the EFI regions.
Instead of mapping the EFI memory map entries in reverse order, where entry N has a higher virtual address than entry N+1, map them in the same order as they appear in the EFI memory map to preserve this relative offset between regions.
This patch has been kept as small as possible with the intention that it should be applied aggressively to stable and distribution kernels. It is very much a bugfix rather than support for a new feature, since when EFI_PROPERTIES_TABLE is enabled we must map things as outlined above to even boot - we have no way of asking the firmware not to split the code/data regions.
In fact, this patch doesn't even make use of the more strict memory protections available in UEFI v2.5. That will come later.
--- arch/x86/platform/efi/efi.c | 67 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 66 insertions(+), 1 deletion(-)
arch/x86/platform/efi/efi.c +66 -1
@@ -679,6 +679,70 @@ out: }/* +* Iterate the EFI memory map in reverse order because the regions +* will be mapped top-down. The end result is the same as if we had +* mapped things forward, but doesn't require us to change the +* existing implementation of efi_map_region(). +*/ +static inline void *efi_map_next_entry_reverse (void *entry) +{ +/* Initial call */ +if (!entry) +return memmap.map_end - memmap.desc_size; + + entry -= memmap.desc_size; +if (entry < memmap.map) +return NULL ; + +return entry; +} + +/* +* efi_map_next_entry - Return the next EFI memory map descriptor +* @entry: Previous EFI memory map descriptor +* +* This is a helper function to iterate over the EFI memory map, which +* we do in different orders depending on the current configuration. +* +* To begin traversing the memory map @entry must be %NULL. +* +* Returns %NULL when we reach the end of the memory map. +*/ +static void *efi_map_next_entry (void *entry) +{ +if (!efi_enabled (EFI_OLD_MEMMAP ) &&efi_enabled (EFI_64BIT )) { +/* +* Starting in UEFI v2.5 the EFI_PROPERTIES_TABLE +* config table feature requires us to map all entries +* in the same order as they appear in the EFI memory +* map. That is to say, entry N must have a lower +* virtual address than entry N+1. This is because the +* firmware toolchain leaves relative references in +* the code/data sections, which are split and become +* separate EFI memory regions. Mapping things +* out-of-order leads to the firmware accessing +* unmapped addresses. +* +* Since we need to map things this way whether or not +* the kernel actually makes use of +* EFI_PROPERTIES_TABLE, let's just switch to this +* scheme by default for 64-bit. +*/ +return efi_map_next_entry_reverse (entry); + } + +/* Initial call */ +if (!entry) +return memmap.map; + + entry += memmap.desc_size; +if (entry >= memmap.map_end) +return NULL ; + +return entry; +} + +/* * Map the efi memory ranges of the runtime services and update new_mmap with * virtual addresses. */
@@ -688,7 +752,8 @@ static void * __init efi_map_regions(intunsigned long left =0 ;efi_memory_desc_t *md; -for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { + p =NULL ; +while ((p =efi_map_next_entry (p))) { md = p;if (!(md->attribute &EFI_MEMORY_RUNTIME )) {#ifdef CONFIG_X86_64
Greg Kroah-Hartman
maintainerPATCH 45/202 x86/kexec: Fix kexec crash in syscall kexec_file_load()
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Lee, Chun-Yi" <[email protected]>
commit e3c41e37b0f4b18cbd4dac76cbeece5a7558b909 upstream.
The original bug is a page fault crash that sometimes happens on big machines when preparing ELF headers:
BUG: unable to handle kernel paging request at ffffc90613fc9000
IP: [<ffffffff8103d645>] prepare_elf64_ram_headers_callback+0x165/0x260The bug is caused by us under-counting the number of memory ranges and subsequently not allocating enough ELF header space for them. The bug is typically masked on smaller systems, because the ELF header allocation is rounded up to the next page.
This patch modifies the code in fill_up_crash_elf_data() by using walk_system_ram_res() instead of walk_system_ram_range() to correctly count the max number of crash memory ranges. That's because the walk_system_ram_range() filters out small memory regions that reside in the same page, but walk_system_ram_res() does not.
Here's how I found the bug:
After tracing prepare_elf64_headers() and prepare_elf64_ram_headers_callback(), the code uses walk_system_ram_res() to fill-in crash memory regions information to the program header, so it counts those small memory regions that reside in a page area.
But, when the kernel was using walk_system_ram_range() in fill_up_crash_elf_data() to count the number of crash memory regions, it filters out small regions.
I printed those small memory regions, for example:
kexec: Get nr_ram ranges. vaddr=0xffff880077592258 paddr=0x77592258, sz=0xdc0
Based on the code in walk_system_ram_range(), this memory region will be filtered out:
pfn = (0x77592258 + 0x1000 - 1) >> 12 = 0x77593
end_pfn = (0x77592258 + 0xfc0 -1 + 1) >> 12 = 0x77593 end_pfn - pfn = 0x77593 - 0x77593 = 0 <=== if (end_pfn > pfn) is FALSE
So, the max_nr_ranges that's counted by the kernel doesn't include small memory regions - causing us to under-allocate the required space. That causes the page fault crash that happens in a later code path when preparing ELF headers.
This bug is not easy to reproduce on small machines that have few CPUs, because the allocated page aligned ELF buffer has more free space to cover those small memory regions' PT_LOAD headers.
--- arch/x86/kernel/crash.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
arch/x86/kernel/crash.c +3 -4
@@ -184,10 +184,9 @@ void native_machine_crash_shutdown(struc }#ifdef CONFIG_KEXEC_FILE -static int get_nr_ram_ranges_callback (unsigned long start_pfn, -unsigned long nr_pfn,void *arg) +static int get_nr_ram_ranges_callback (u64 start,u64 end,void *arg) { -int *nr_ranges = arg; +unsigned int *nr_ranges = arg; (*nr_ranges)++;return 0 ;
@@ -213,7 +212,7 @@ static void fill_up_crash_elf_data(struc ced->image = image; -walk_system_ram_range (0 ,-1 , &nr_ranges, +walk_system_ram_res (0 ,-1 , &nr_ranges, get_nr_ram_ranges_callback); ced->max_nr_ranges = nr_ranges;
Greg Kroah-Hartman
maintainerPATCH 46/202 x86/process: Add proper bound checks in 64bit get_wchan()
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit eddd3826a1a0190e5235703d1e666affa4d13b96 upstream.
Dmitry Vyukov reported the following using trinity and the memory error detector AddressSanitizer
(https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel).
[ 124.575597] ERROR: AddressSanitizer: heap-buffer-overflow on address ffff88002e280000 [ 124.576801] ffff88002e280000 is located 131938492886538 bytes to the left of 28857600-byte region [ffffffff81282e0a, ffffffff82e0830a) [ 124.578633] Accessed by thread T10915: [ 124.579295] inlined in describe_heap_address ./arch/x86/mm/asan/report.c:164 [ 124.579295] #0 ffffffff810dd277 in asan_report_error ./arch/x86/mm/asan/report.c:278 [ 124.580137] #1 ffffffff810dc6a0 in asan_check_region ./arch/x86/mm/asan/asan.c:37 [ 124.581050] #2 ffffffff810dd423 in __tsan_read8 ??:0 [ 124.581893] #3 ffffffff8107c093 in get_wchan
./arch/x86/kernel/process_64.c:444
The address checks in the 64bit implementation of get_wchan() are wrong in several ways:
- The lower bound of the stack is not the start of the stack page. It's the start of the stack page plus sizeof (struct thread_info)
- The upper bound must be:
top_of_stack - TOP_OF_KERNEL_STACK_PADDING - 2 * sizeof(unsigned long).
The 2 * sizeof(unsigned long) is required because the stack pointer points at the frame pointer. The layout on the stack is: ... IP FP ... IP FP. So we need to make sure that both IP and FP are in the bounds.
Fix the bound checks and get rid of the mix of numeric constants, u64 and unsigned long. Making all unsigned long allows us to use the same function for 32bit as well.
Use READ_ONCE() when accessing the stack. This does not prevent a concurrent wakeup of the task and the stack changing, but at least it avoids TOCTOU.
Also check task state at the end of the loop. Again that does not prevent concurrent changes, but it avoids walking for nothing.
Add proper comments while at it.
Based-on-patch-from: Wolfram Gloger <[email protected]>
--- arch/x86/kernel/process_64.c | 52 ++++++++++++++++++++++++++++++++++--------- 1 file changed, 42 insertions(+), 10 deletions(-)
arch/x86/kernel/process_64.c +42 -10
@@ -499,27 +499,59 @@ void set_personality_ia32(bool x32) }EXPORT_SYMBOL_GPL (set_personality_ia32); +/* +* Called from fs/proc with a reference on @p to find the function +* which called into schedule(). This needs to be done carefully +* because the task might wake up and we might look at a stack +* changing under us. +*/ unsigned long get_wchan (struct task_struct *p) { -unsigned long stack; -u64 fp, ip; +unsigned long start, bottom, top, sp, fp, ip;int count =0 ;if (!p || p == current || p->state ==TASK_RUNNING )return 0 ; - stack = (unsigned long )task_stack_page (p); -if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE ) + + start = (unsigned long )task_stack_page (p); +if (!start)return 0 ; - fp = *(u64 *)(p->thread.sp); + +/* +* Layout of the stack page: +* +* ----------- topmax = start + THREAD_SIZE - sizeof(unsigned long) +* PADDING +* ----------- top = topmax - TOP_OF_KERNEL_STACK_PADDING +* stack +* ----------- bottom = start + sizeof(thread_info) +* thread_info +* ----------- start +* +* The tasks stack pointer points at the location where the +* framepointer is stored. The data on the stack is: +* ... IP FP ... IP FP +* +* We need to read FP and IP, so we need to adjust the upper +* bound by another unsigned long. +*/ + top = start +THREAD_SIZE -TOP_OF_KERNEL_STACK_PADDING ; + top -=2 *sizeof (unsigned long ); + bottom = start +sizeof (struct thread_info ); + + sp =READ_ONCE (p->thread.sp); +if (sp < bottom || sp > top) +return 0 ; + + fp =READ_ONCE (*(unsigned long *)sp);do { -if (fp < (unsigned long )stack || - fp >= (unsigned long )stack+THREAD_SIZE ) +if (fp < bottom || fp > top)return 0 ; - ip = *(u64 *)(fp+8 ); + ip =READ_ONCE (*(unsigned long *)(fp +sizeof (unsigned long )));if (!in_sched_functions (ip))return ip; - fp = *(u64 *)fp; - }while (count++ <16 ); + fp =READ_ONCE (*(unsigned long *)fp); + }while (count++ <16 && p->state !=TASK_RUNNING );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 47/202 x86/mm: Set NX on gap between __ex_table and rodata
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley <[email protected]>
commit ab76f7b4ab2397ffdd2f1eb07c55697d19991d10 upstream.
Unused space between the end of __ex_table and the start of rodata can be left W+x in the kernel page tables. Extend the setting of the NX bit to cover this gap by starting from text_end rather than rodata_start.
Before:
---[ High Kernel Mapping ]---
0xffffffff80000000-0xffffffff81000000 16M pmd 0xffffffff81000000-0xffffffff81600000 6M ro PSE GLB x pmd 0xffffffff81600000-0xffffffff81754000 1360K ro GLB x pte 0xffffffff81754000-0xffffffff81800000 688K RW GLB x pte 0xffffffff81800000-0xffffffff81a00000 2M ro PSE GLB NX pmd 0xffffffff81a00000-0xffffffff81b3b000 1260K ro GLB NX pte 0xffffffff81b3b000-0xffffffff82000000 4884K RW GLB NX pte 0xffffffff82000000-0xffffffff82200000 2M RW PSE GLB NX pmd
0xffffffff82200000-0xffffffffa0000000 478M pmd
After:
---[ High Kernel Mapping ]---
0xffffffff80000000-0xffffffff81000000 16M pmd 0xffffffff81000000-0xffffffff81600000 6M ro PSE GLB x pmd 0xffffffff81600000-0xffffffff81754000 1360K ro GLB x pte 0xffffffff81754000-0xffffffff81800000 688K RW GLB NX pte 0xffffffff81800000-0xffffffff81a00000 2M ro PSE GLB NX pmd 0xffffffff81a00000-0xffffffff81b3b000 1260K ro GLB NX pte 0xffffffff81b3b000-0xffffffff82000000 4884K RW GLB NX pte 0xffffffff82000000-0xffffffff82200000 2M RW PSE GLB NX pmd
0xffffffff82200000-0xffffffffa0000000 478M pmd
--- arch/x86/mm/init_64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/mm/init_64.c +1 -1
@@ -1132,7 +1132,7 @@ void mark_rodata_ro(void)* has been zapped already via cleanup_highmem(). */ all_end =roundup ((unsigned long )_brk_end,PMD_SIZE ); -set_memory_nx (rodata_start, (all_end - rodata_start) >>PAGE_SHIFT ); +set_memory_nx (text_end, (all_end - text_end) >>PAGE_SHIFT );rodata_test ();
Greg Kroah-Hartman
maintainerPATCH 48/202 x86/xen: Support kexec/kdump in HVM guests by doing a soft reset
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Kuznetsov <[email protected]>
commit 0b34a166f291d255755be46e43ed5497cdd194f2 upstream.
Currently there is a number of issues preventing PVHVM Xen guests from doing successful kexec/kdump:
- Bound event channels.
- Registered vcpu_info.
- PIRQ/emuirq mappings.
- shared_info frame after XENMAPSPACE_shared_info operation.
- Active grant mappings.
Basically, newly booted kernel stumbles upon already set up Xen interfaces and there is no way to reestablish them. In Xen-4.7 a new feature called 'soft reset' is coming. A guest performing kexec/kdump operation is supposed to call SCHEDOP_shutdown hypercall with SHUTDOWN_soft_reset reason before jumping to new kernel. Hypervisor (with some help from toolstack) will do full domain cleanup (but keeping its memory and vCPU contexts intact) returning the guest to the state it had when it was first booted and thus allowing it to start over.
Doing SHUTDOWN_soft_reset on Xen hypervisors which don't support it is probably OK as by default all unknown shutdown reasons cause domain destroy with a message in toolstack log: 'Unknown shutdown reason code
5. Destroying domain.' which gives a clue to what the problem is and eliminates false expectations.
--- arch/x86/xen/enlighten.c | 23 +++++++++++++++++++++++ include/xen/interface/sched.h | 8 ++++++++ 2 files changed, 31 insertions(+)
arch/x86/xen/enlighten.c +23 -0
@@ -33,6 +33,10 @@#include <linux/memblock.h> #include <linux/edd.h> +#ifdef CONFIG_KEXEC_CORE +#include <linux/kexec.h> +#endif +#include <xen/xen.h> #include <xen/events.h> #include <xen/interface/xen.h>
@@ -1798,6 +1802,21 @@ static struct notifier_block xen_hvm_cpu .notifier_call = xen_hvm_cpu_notify, }; +#ifdef CONFIG_KEXEC_CORE +static void xen_hvm_shutdown (void ) +{ +native_machine_shutdown (); +if (kexec_in_progress) +xen_reboot (SHUTDOWN_soft_reset); +} + +static void xen_hvm_crash_shutdown (struct pt_regs *regs) +{ +native_machine_crash_shutdown (regs); +xen_reboot (SHUTDOWN_soft_reset); +} +#endif +static void __init xen_hvm_guest_init (void ) {if (xen_pv_domain ())
@@ -1817,6 +1836,10 @@ static void __init xen_hvm_guest_init(vo x86_init.irqs.intr_init = xen_init_IRQ;xen_hvm_init_time_ops ();xen_hvm_init_mmu_ops (); +#ifdef CONFIG_KEXEC_CORE + machine_ops.shutdown = xen_hvm_shutdown; + machine_ops.crash_shutdown = xen_hvm_crash_shutdown; +#endif }#endif
include/xen/interface/sched.h +8 -0
@@ -107,5 +107,13 @@ struct sched_watchdog {#define SHUTDOWN_suspend 2/* Clean up, save suspend info, kill. */ #define SHUTDOWN_crash 3/* Tell controller we've crashed. */ #define SHUTDOWN_watchdog 4/* Restart because watchdog time expired. */ +/* +* Domain asked to perform 'soft reset' for it. The expected behavior is to +* reset internal Xen state for the domain returning it to the point where it +* was created but leaving the domain's memory contents and vCPU contexts +* intact. This will allow the domain to start over and set up all Xen specific +* interfaces again. +*/ +#define SHUTDOWN_soft_reset 5#endif /* __XEN_PUBLIC_SCHED_H__ */
Greg Kroah-Hartman
maintainerPATCH 49/202 leds/led-class: Add missing put_device()
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda Delgado <[email protected]>
commit e5b5a61fcb3743f1dacf9e20d28f48423cecf0c1 upstream.
Devices found by class_find_device must be freed with put_device(). Otherwise the reference count will not work properly.
--- drivers/leds/led-class.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/leds/led-class.c +5 -2
@@ -223,12 +223,15 @@ static int led_classdev_next_name(const {unsigned int i =0 ;int ret =0 ; +struct device *dev;strlcpy (name, init_name, len); -while (class_find_device (leds_class,NULL , name, match_name) && - (ret < len)) +while ((ret < len) && + (dev =class_find_device (leds_class,NULL , name, match_name))) { +put_device (dev); ret =snprintf (name, len,"%s_%u" , init_name, ++i); + }if (ret >= len)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 50/202 sched/core: Fix TASK_DEAD race in finish_task_switch()
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 95913d97914f44db2b81271c2e2ebd4d2ac2df83 upstream.
So the problem this patch is trying to address is as follows:
CPU0 CPU1
context_switch(A, B)
ttwu(A)
LOCK A->pi_lock
A->on_cpu == 0
finish_task_switch(A)
prev_state = A->state <-.
WMB |
A->on_cpu = 0; |
UNLOCK rq0->lock |
| context_switch(C, A)
`-- A->state = TASK_DEAD
prev_state == TASK_DEAD
put_task_struct(A)
context_switch(A, C)
finish_task_switch(A)
A->state == TASK_DEAD
put_task_struct(A)The argument being that the WMB will allow the load of A->state on CPU0 to cross over and observe CPU1's store of A->state, which will then result in a double-drop and use-after-free.
Now the comment states (and this was true once upon a long time ago) that we need to observe A->state while holding rq->lock because that will order us against the wakeup; however the wakeup will not in fact acquire (that) rq->lock; it takes A->pi_lock these days.
We can obviously fix this by upgrading the WMB to an MB, but that is expensive, so we'd rather avoid that.
The alternative this patch takes is: smp_store_release(&A->on_cpu, 0), which avoids the MB on some archs, but not important ones like ARM.
--- kernel/sched/core.c | 10 +++++----- kernel/sched/sched.h | 5 +++-- 2 files changed, 8 insertions(+), 7 deletions(-)
kernel/sched/core.c +5 -5
@@ -2217,11 +2217,11 @@ static struct rq *finish_task_switch(str* If a task dies, then it sets TASK_DEAD in tsk->state and calls * schedule one last time. The schedule call will never return, and * the scheduled task must drop that reference. -* The test for TASK_DEAD must occur while the runqueue locks are -* still held, otherwise prev could be scheduled on another cpu, die -* there before we look at prev->state, and then the reference would -* be dropped twice. -* Manfred Spraul <[email protected]> +* +* We must observe prev->state before clearing prev->on_cpu (in +* finish_lock_switch), otherwise a concurrent wakeup can get prev +* running on another CPU and we could rave with its RUNNING -> DEAD +* transition, resulting in a double drop. */ prev_state = prev->state;vtime_task_switch (prev);
kernel/sched/sched.h +3 -2
@@ -1068,9 +1068,10 @@ static inline void finish_lock_switch(st* After ->on_cpu is cleared, the task can be moved to a different CPU. * We must ensure this doesn't happen until the switch is completely * finished. +* +* Pairs with the control dependency and rmb in try_to_wake_up(). */ -smp_wmb (); - prev->on_cpu =0 ; +smp_store_release (&prev->on_cpu,0 );#endif #ifdef CONFIG_DEBUG_SPINLOCK /* this is a valid case when another task releases the spinlock */
Greg Kroah-Hartman
maintainerPATCH 51/202 s390/compat: correct uc_sigmask of the compat signal frame
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <[email protected]>
commit 8d4bd0ed0439dfc780aab801a085961925ed6838 upstream.
The uc_sigmask in the ucontext structure is an array of words to keep the 64 signal bits (or 1024 if you ask glibc but the kernel sigset_t only has 64 bits).
For 64 bit the sigset_t contains a single 8 byte word, but for 31 bit there are two 4 byte words. The compat signal handler code uses a simple copy of the 64 bit sigset_t to the 31 bit compat_sigset_t. As s390 is a big-endian architecture this is incorrect, the two words in the 31 bit sigset_t array need to be swapped.
--- arch/s390/kernel/compat_signal.c | 27 +++++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-)
arch/s390/kernel/compat_signal.c +23 -4
@@ -48,6 +48,19 @@ typedef structstruct ucontext32 uc; } rt_sigframe32; +static inline void sigset_to_sigset32 (unsigned long *set64, +compat_sigset_word *set32) +{ + set32[0 ] = (compat_sigset_word ) set64[0 ]; + set32[1 ] = (compat_sigset_word)(set64[0 ] >>32 ); +} + +static inline void sigset32_to_sigset (compat_sigset_word *set32, +unsigned long *set64) +{ + set64[0 ] = (unsigned long ) set32[0 ] | ((unsigned long ) set32[1 ] <<32 ); +} +int copy_siginfo_to_user32 (compat_siginfo_t __user *to,const siginfo_t *from) {int err;
@@ -303,10 +316,12 @@ COMPAT_SYSCALL_DEFINE0(sigreturn) {struct pt_regs *regs =task_pt_regs (current);sigframe32 __user *frame = (sigframe32 __user *)regs->gprs[15 ]; +compat_sigset_t cset;sigset_t set; -if (__copy_from_user (&set.sig, &frame->sc.oldmask, _SIGMASK_COPY_SIZE32)) +if (__copy_from_user (&cset.sig, &frame->sc.oldmask, _SIGMASK_COPY_SIZE32)) goto badframe; +sigset32_to_sigset (cset.sig, set.sig);set_current_blocked (&set);if (restore_sigregs32 (regs, &frame->sregs)) goto badframe;
@@ -323,10 +338,12 @@ COMPAT_SYSCALL_DEFINE0(rt_sigreturn) {struct pt_regs *regs =task_pt_regs (current);rt_sigframe32 __user *frame = (rt_sigframe32 __user *)regs->gprs[15 ]; +compat_sigset_t cset;sigset_t set; -if (__copy_from_user (&set, &frame->uc.uc_sigmask,sizeof (set))) +if (__copy_from_user (&cset, &frame->uc.uc_sigmask,sizeof (cset))) goto badframe; +sigset32_to_sigset (cset.sig, set.sig);set_current_blocked (&set);if (compat_restore_altstack (&frame->uc.uc_stack)) goto badframe;
@@ -397,7 +414,7 @@ static int setup_frame32(struct ksignalreturn -EFAULT ;/* Create struct sigcontext32 on the signal stack */ -memcpy (&sc.oldmask, &set->sig, _SIGMASK_COPY_SIZE32); +sigset_to_sigset32 (set->sig, sc.oldmask); sc.sregs = (__u32 )(unsigned long __force ) &frame->sregs;if (__copy_to_user (&frame->sc, &sc,sizeof (frame->sc)))return -EFAULT ;
@@ -458,6 +475,7 @@ static int setup_frame32(struct ksignalstatic int setup_rt_frame32 (struct ksignal *ksig,sigset_t *set,struct pt_regs *regs) { +compat_sigset_t cset;rt_sigframe32 __user *frame;unsigned long restorer;size_t frame_size;
@@ -505,11 +523,12 @@ static int setup_rt_frame32(struct ksignstore_sigregs ();/* Create ucontext on the signal stack. */ +sigset_to_sigset32 (set->sig, cset.sig);if (__put_user (uc_flags, &frame->uc.uc_flags) ||__put_user (0 , &frame->uc.uc_link) ||__compat_save_altstack (&frame->uc.uc_stack, regs->gprs[15 ]) ||save_sigregs32 (regs, &frame->uc.uc_mcontext) || -__copy_to_user (&frame->uc.uc_sigmask, set,sizeof (*set)) || +__copy_to_user (&frame->uc.uc_sigmask, &cset,sizeof (cset)) ||save_sigregs_ext32 (regs, &frame->uc.uc_mcontext_ext))return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 52/202 s390/boot/decompression: disable floating point in decompressor
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <[email protected]>
commit adc0b7fbf6fe9967505c0254d9535ec7288186ae upstream.
my gcc 5.1 used an ldgr instruction with a register != 0,2,4,6 for spilling/filling into a floating point register in our decompressor.
This will cause an AFP-register data exception as the decompressor did not setup the additional floating point registers via cr0. That causes a program check loop that looked like a hang with one "Uncompressing Linux... " message (directly booted via kvm) or a loop of "Uncompressing Linux... " messages (when booted via zipl boot loader).
The offending code in my build was
48e400: e3 c0 af ff ff 71 lay %r12,-1(%r10) -->48e406: b3 c1 00 1c ldgr %f1,%r12 48e40a: ec 6c 01 22 02 7f clij %r6,2,12,0x48e64e
but gcc could do spilling into an fpr at any function. We can simply disable floating point support at that early stage.
--- arch/s390/boot/compressed/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/boot/compressed/Makefile +1 -1
@@ -10,7 +10,7 @@ targets += misc.o piggy.o sizes.h head.o KBUILD_CFLAGS := -m64 -D__KERNEL__ $(LINUX_INCLUDE) -O2 KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING -KBUILD_CFLAGS += $(cflags-y) -fno-delete-null-pointer-checks +KBUILD_CFLAGS += $(cflags-y) -fno-delete-null-pointer-checks -msoft-float KBUILD_CFLAGS += $(call cc-option,-mpacked-stack) KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
Greg Kroah-Hartman
maintainerPATCH 53/202 spi: Fix documentation of spi_alloc_master()
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
commit a394d635193b641f2c86ead5ada5b115d57c51f8 upstream.
Actually, spi_master_put() after spi_alloc_master() must _not_ be followed by kfree(). The memory is already freed with the call to spi_master_put() through spi_master_class, which registers a release function. Calling both spi_master_put() and kfree() results in often nasty (and delayed) crashes elsewhere in the kernel, often in the networking stack.
This reverts commit eb4af0f5349235df2e4a5057a72fc8962d00308a.
Link to patch and concerns: https://lkml.org/lkml/2012/9/3/269
or
http://lkml.iu.edu/hypermail/linux/kernel/1209.0/00790.html
Alexey Klimov: This revert becomes valid after 94c69f765f1b4a658d96905ec59928e3e3e07e6a when spi-imx.c has been fixed and there is no need to call kfree() so comment for spi_alloc_master() should be fixed.
--- drivers/spi/spi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/spi/spi.c +1 -2
@@ -1427,8 +1427,7 @@ static struct class spi_master_class = {* * The caller is responsible for assigning the bus number and initializing * the master's methods before calling spi_register_master(); and (after errors -* adding the device) calling spi_master_put() and kfree() to prevent a memory -* leak. +* adding the device) calling spi_master_put() to prevent a memory leak. */ struct spi_master *spi_alloc_master (struct device *dev,unsigned size) {
Greg Kroah-Hartman
maintainerPATCH 54/202 spi: xtensa-xtfpga: fix register endianness
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
commit b0b4855099e301c8603ea37da9a0103a96c2e0b1 upstream.
XTFPGA SPI controller has native endian registers.
Fix register acessors so that they work in big-endian configurations.
--- drivers/spi/spi-xtensa-xtfpga.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/spi/spi-xtensa-xtfpga.c +2 -2
@@ -34,13 +34,13 @@ struct xtfpga_spi {static inline void xtfpga_spi_write32 (const struct xtfpga_spi *spi,unsigned addr,u32 val) { -iowrite32 (val, spi->regs + addr); +__raw_writel (val, spi->regs + addr); }static inline unsigned int xtfpga_spi_read32 (const struct xtfpga_spi *spi,unsigned addr) { -return ioread32 (spi->regs + addr); +return __raw_readl (spi->regs + addr); }static inline void xtfpga_spi_wait_busy (struct xtfpga_spi *xspi)
Greg Kroah-Hartman
maintainerPATCH 55/202 spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Tan, Jui Nee" <[email protected]>
commit 02bc933ebb59208f42c2e6305b2c17fd306f695d upstream.
On Intel Baytrail, there is case when interrupt handler get called, no SPI message is captured. The RX FIFO is indeed empty when RX timeout pending interrupt (SSSR_TINT) happens.
Use the BIOS version where both HSUART and SPI are on the same IRQ. Both drivers are using IRQF_SHARED when calling the request_irq function. When running two separate and independent SPI and HSUART application that generate data traffic on both components, user will see messages like below on the console:
pxa2xx-spi pxa2xx-spi.0: bad message state in interrupt handler
This commit will fix this by first checking Receiver Time-out Interrupt, if it is disabled, ignore the request and return without servicing.
--- drivers/spi/spi-pxa2xx.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/spi/spi-pxa2xx.c +4 -0
@@ -624,6 +624,10 @@ static irqreturn_t ssp_int(int irq, voidif (!(sccr1_reg &SSCR1_TIE )) mask &= ~SSSR_TFS ; +/* Ignore RX timeout interrupt if it is disabled */ +if (!(sccr1_reg &SSCR1_TINTE )) + mask &= ~SSSR_TINT ; +if (!(status & mask))return IRQ_NONE ;
Greg Kroah-Hartman
maintainerPATCH 56/202 spi: spidev: fix possible NULL dereference
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudip Mukherjee <[email protected]>
commit dd85ebf681ef0ee1fc985c353dd45e8b53b5dc1e upstream.
During the last close we are freeing spidev if spidev->spi is NULL, but just before checking if spidev->spi is NULL we are dereferencing it. Lets add a check there to avoid the NULL dereference.
--- drivers/spi/spidev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/spi/spidev.c +2 -1
@@ -664,7 +664,8 @@ static int spidev_release(struct inode *kfree (spidev->rx_buffer); spidev->rx_buffer =NULL ; - spidev->speed_hz = spidev->spi->max_speed_hz; +if (spidev->spi) + spidev->speed_hz = spidev->spi->max_speed_hz;/* ... after we unbound from the underlying device? */ spin_lock_irq (&spidev->spi_lock);
Greg Kroah-Hartman
maintainerPATCH 57/202 mm: migrate: hugetlb: putback destination hugepage to active list
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naoya Horiguchi <[email protected]>
commit 3aaa76e125c1dd58c9b599baa8c6021896874c12 upstream.
Since commit bcc54222309c ("mm: hugetlb: introduce page_huge_active") each hugetlb page maintains its active flag to avoid a race condition betwe= en multiple calls of isolate_huge_page(), but current kernel doesn't set the f= lag on a hugepage allocated by migration because the proper putback routine isn= 't called. This means that users could still encounter the race referred to by bcc54222309c in this special case, so this patch fixes it.
--- mm/migrate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/migrate.c +1 -1
@@ -1062,7 +1062,7 @@ out:if (rc !=MIGRATEPAGE_SUCCESS && put_new_page)put_new_page (new_hpage, private);else -put_page (new_hpage); +putback_active_hugepage (new_hpage);if (result) {if (rc)
Greg Kroah-Hartman
maintainerPATCH 58/202 lib/iommu-common.c: do not try to deref a null iommu->lazy_flush() pointer when n < pool->hint
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sowmini Varadhan <[email protected]>
commit d046b770c9fc36ccb19c27afdb8322220108cbc7 upstream.
The check for invoking iommu->lazy_flush() from iommu_tbl_range_alloc() has to be refactored so that we only call ->lazy_flush() if it is non-null.
I had a sparc kernel that was crashing when I was trying to process some very large perf.data files- the crash happens when the scsi driver calls into dma_4v_map_sg and thus the iommu_tbl_range_alloc().
--- lib/iommu-common.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
lib/iommu-common.c +3 -3
@@ -21,8 +21,7 @@ static DEFINE_PER_CPU(unsigned int, iommstatic inline bool need_flush (struct iommu_map_table *iommu) { -return (iommu->lazy_flush !=NULL && - (iommu->flags &IOMMU_NEED_FLUSH ) !=0 ); +return ((iommu->flags &IOMMU_NEED_FLUSH ) !=0 ); }static inline void set_flush (struct iommu_map_table *iommu)
@@ -211,7 +210,8 @@ unsigned long iommu_tbl_range_alloc(stru goto bail; } } -if (n < pool->hint ||need_flush (iommu)) { +if (iommu->lazy_flush && + (n < pool->hint ||need_flush (iommu))) {clear_flush (iommu); iommu->lazy_flush (iommu); }
Greg Kroah-Hartman
maintainerPATCH 59/202 ocfs2/dlm: fix deadlock when dispatch assert master
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <[email protected]>
commit 012572d4fc2e4ddd5c8ec8614d51414ec6cae02a upstream.
The order of the following three spinlocks should be:dlm_domain_lock < dlm_ctxt->spinlock < dlm_lock_resource->spinlock
But dlm_dispatch_assert_master() is called while holding dlm_ctxt->spinlock and dlm_lock_resource->spinlock, and then it calls dlm_grab() which will take dlm_domain_lock.
Once another thread (for example, dlm_query_join_handler) has already taken dlm_domain_lock, and tries to take dlm_ctxt->spinlock deadlock happens.
--- fs/ocfs2/dlm/dlmmaster.c | 9 ++++++--- fs/ocfs2/dlm/dlmrecovery.c | 8 ++++++-- 2 files changed, 12 insertions(+), 5 deletions(-)
fs/ocfs2/dlm/dlmmaster.c +6 -3
@@ -1439,6 +1439,7 @@ int dlm_master_request_handler(struct o2int found, ret;int set_maybe;int dispatch_assert =0 ; +int dispatched =0 ;if (!dlm_grab (dlm))return DLM_MASTER_RESP_NO ;
@@ -1658,15 +1659,18 @@ send_response:mlog (ML_ERROR ,"failed to dispatch assert master work\n" ); response =DLM_MASTER_RESP_ERROR ;dlm_lockres_put (res); - }else + }else { + dispatched =1 ;__dlm_lockres_grab_inflight_worker (dlm, res); + }spin_unlock (&res->spinlock); }else {if (res)dlm_lockres_put (res); } -dlm_put (dlm); +if (!dispatched) +dlm_put (dlm);return response; }
@@ -2090,7 +2094,6 @@ int dlm_dispatch_assert_master(struct dl/* queue up work for dlm_assert_master_worker */ -dlm_grab (dlm);/* get an extra ref for the work item */ dlm_init_work_item (dlm, item, dlm_assert_master_worker,NULL ); item->u.am.lockres = res;/* already have a ref */ /* can optionally ignore node numbers higher than this node */
fs/ocfs2/dlm/dlmrecovery.c +6 -2
@@ -1694,6 +1694,7 @@ int dlm_master_requery_handler(struct o2unsigned int hash;int master =DLM_LOCK_RES_OWNER_UNKNOWN ;u32 flags =DLM_ASSERT_MASTER_REQUERY ; +int dispatched =0 ;if (!dlm_grab (dlm)) {/* since the domain has gone away on this
@@ -1719,8 +1720,10 @@ int dlm_master_requery_handler(struct o2dlm_put (dlm);/* sender will take care of this and retry */ return ret; - }else + }else { + dispatched =1 ;__dlm_lockres_grab_inflight_worker (dlm, res); + }spin_unlock (&res->spinlock); }else {/* put.. incase we are not the master */
@@ -1730,7 +1733,8 @@ int dlm_master_requery_handler(struct o2 }spin_unlock (&dlm->spinlock); -dlm_put (dlm); +if (!dispatched) +dlm_put (dlm);return master; }
Greg Kroah-Hartman
maintainerPATCH 60/202 mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <[email protected]>
commit 2f84a8990ebbe235c59716896e017c6b2ca1200f upstream.
SunDong reported the following on
https://bugzilla.kernel.org/show_bug.cgi?id=103841
I think I find a linux bug, I have the test cases is constructed. I can stable recurring problems in fedora22(4.0.4) kernel version, arch for x86_64. I construct transparent huge page, when the parent and child process with MAP_SHARE, MAP_PRIVATE way to access the same huge page area, it has the opportunity to lead to huge page copy on write failure, and then it will munmap the child corresponding mmap area, but then the child mmap area with VM_MAYSHARE attributes, child process munmap this area can trigger VM_BUG_ON in set_vma_resv_flags functions (vma - > vm_flags & VM_MAYSHARE).
There were a number of problems with the report (e.g. it's hugetlbfs that triggers this, not transparent huge pages) but it was fundamentally correct in that a VM_BUG_ON in set_vma_resv_flags() can be triggered that looks like this
vma ffff8804651fd0d0 start 00007fc474e00000 end 00007fc475e00000 next ffff8804651fd018 prev ffff8804651fd188 mm ffff88046b1b1800 prot 8000000000000027 anon_vma (null) vm_ops ffffffff8182a7a0 pgoff 0 file ffff88106bdb9800 private_data (null) flags: 0x84400fb(read|write|shared|mayread|maywrite|mayexec|mayshare|dontexpand|hugetlb) ------------ kernel BUG at mm/hugetlb.c:462! SMP Modules linked in: xt_pkttype xt_LOG xt_limit [..] CPU: 38 PID: 26839 Comm: map Not tainted 4.0.4-default #1 Hardware name: Dell Inc. PowerEdge R810/0TT6JF, BIOS 2.7.4 04/26/2012 set_vma_resv_flags+0x2d/0x30
The VM_BUG_ON is correct because private and shared mappings have different reservation accounting but the warning clearly shows that the VMA is shared.
When a private COW fails to allocate a new page then only the process that created the VMA gets the page -- all the children unmap the page. If the children access that data in the future then they get killed.
The problem is that the same file is mapped shared and private. During the COW, the allocation fails, the VMAs are traversed to unmap the other private pages but a shared VMA is found and the bug is triggered. This patch identifies such VMAs and skips them.
--- mm/hugetlb.c | 8 ++++++++ 1 file changed, 8 insertions(+)
mm/hugetlb.c +8 -0
@@ -2897,6 +2897,14 @@ static void unmap_ref_private(struct mm_continue ;/* +* Shared VMAs have their own reserves and do not affect +* MAP_PRIVATE accounting but it is possible that a shared +* VMA is using the same page so check and skip such VMAs. +*/ +if (iter_vma->vm_flags &VM_MAYSHARE ) +continue ; + +/* * Unmap the page from other VMAs without their own reserves. * They get marked to be SIGKILLed if they fault in these * areas. This is because a future no-page fault on this VMA
Greg Kroah-Hartman
maintainerPATCH 61/202 ALSA: hda - Disable power_save_node for Thinkpads
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 7f57d803ee03730d570dc59a9e3e4842b58dd5cc upstream.
Lenovo Thinkpads with recent Realtek codecs seem suffering from click noises at power transition since the introduction of widget power saving in 4.1 kernel. Although this might be solved by some delays in appropriate points, as a quick workaround, just disable the power_save_node feature for now. The gain it gives is relatively small, and this makes the situation back to pre 4.1 time.
This patch ended up with a bit more code changes than usual because the existing fixup for Thinkpads is highly chained. Instead of adding yet another chain, combine a few of them into a single fixup entry, as a gratis cleanup.
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=943982
--- sound/pci/hda/patch_realtek.c | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-)
sound/pci/hda/patch_realtek.c +19 -12
@@ -4182,6 +4182,24 @@ static void alc_fixup_disable_aamix(stru } } +/* fixup for Thinkpad docks: add dock pins, avoid HP parser fixup */ +static void alc_fixup_tpt440_dock (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +static const struct hda_pintbl pincfgs[] = { + {0x16 ,0x21211010 },/* dock headphone */ + {0x19 ,0x21a11010 },/* dock mic */ + { } + }; +struct alc_spec *spec = codec->spec; + +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) { + spec->parse_flags =HDA_PINCFG_NO_HP_FIXUP ; + codec->power_save_node =0 ;/* avoid click noises */ +snd_hda_apply_pincfgs (codec, pincfgs); + } +} +static void alc_shutup_dell_xps13 (struct hda_codec *codec) {struct alc_spec *spec = codec->spec;
@@ -4507,7 +4525,6 @@ enum {ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC ,ALC293_FIXUP_DELL1_MIC_NO_PRESENCE ,ALC292_FIXUP_TPT440_DOCK , -ALC292_FIXUP_TPT440_DOCK2 ,ALC283_FIXUP_BXBT2807_MIC ,ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED , ALC282_FIXUP_ASPIRE_V5_PINS,
@@ -4972,17 +4989,7 @@ static const struct hda_fixup alc269_fix }, [ALC292_FIXUP_TPT440_DOCK] = { .type = HDA_FIXUP_FUNC, - .v.func = alc269_fixup_pincfg_no_hp_to_lineout, - .chained = true, - .chain_id =ALC292_FIXUP_TPT440_DOCK2 - }, - [ALC292_FIXUP_TPT440_DOCK2] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl []) { - {0x16 ,0x21211010 },/* dock headphone */ - {0x19 ,0x21a11010 },/* dock mic */ - { } - }, + .v.func = alc_fixup_tpt440_dock, .chained = true, .chain_id =ALC269_FIXUP_LIMIT_INT_MIC_BOOST },
Greg Kroah-Hartman
maintainerPATCH 62/202 ALSA: synth: Fix conflicting OSS device registration on AWE32
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 225db5762dc1a35b26850477ffa06e5cd0097243 upstream.
When OSS emulation is loaded on ISA SB AWE32 chip, we get now kernel warnings like:
WARNING: CPU: 0 PID: 2791 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x51/0x80() sysfs: cannot create duplicate filename '/devices/isa/sbawe.0/sound/card0/seq-oss-0-0'
It's because both emux synth and opl3 drivers try to register their OSS device object with the same static index number 0. This hasn't been a big problem until the recent rewrite of device management code (that exposes sysfs at the same time), but it's been an obvious bug.
This patch works around it just by using a different index number of emux synth object. There can be a more elegant way to fix, but it's enough for now, as this code won't be touched so often, in anyway.
--- sound/synth/emux/emux_oss.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/synth/emux/emux_oss.c +2 -1
@@ -69,7 +69,8 @@ snd_emux_init_seq_oss(struct snd_emux *estruct snd_seq_oss_reg *arg;struct snd_seq_device *dev; -if (snd_seq_device_new (emu->card,0 ,SNDRV_SEQ_DEV_ID_OSS , +/* using device#1 here for avoiding conflicts with OPL3 */ +if (snd_seq_device_new (emu->card,1 ,SNDRV_SEQ_DEV_ID_OSS ,sizeof (struct snd_seq_oss_reg ), &dev) <0 )return ;
Greg Kroah-Hartman
maintainerPATCH 63/202 ALSA: hda: Add dock support for ThinkPad T550
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laura Abbott <[email protected]>
commit d05ea7da0e8f6df3c62cfee75538f347cb3d89ef upstream.
Much like all the other Lenovo laptops, add a quirk to make sound work with docking.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -5233,6 +5233,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x2212 ,"Thinkpad T440" ,ALC292_FIXUP_TPT440_DOCK ),SND_PCI_QUIRK (0x17aa ,0x2214 ,"Thinkpad X240" ,ALC292_FIXUP_TPT440_DOCK ),SND_PCI_QUIRK (0x17aa ,0x2215 ,"Thinkpad" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), +SND_PCI_QUIRK (0x17aa ,0x2223 ,"ThinkPad T550" ,ALC292_FIXUP_TPT440_DOCK ),SND_PCI_QUIRK (0x17aa ,0x2226 ,"ThinkPad X250" ,ALC292_FIXUP_TPT440_DOCK ),SND_PCI_QUIRK (0x17aa ,0x3977 ,"IdeaPad S210" ,ALC283_FIXUP_INT_MIC ), SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
Greg Kroah-Hartman
maintainerPATCH 64/202 ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Flatness <[email protected]>
commit e8ff581f7ac2bc3b8886094b7ca635dcc4d1b0e9 upstream.
The MacBookPro 12,1 has the same setup as the 11 for controlling the status of the optical audio light. Simply apply the existing workaround to the subsystem ID for the 12,1.
[sorted the fixup entry by tiwai]
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=105401
--- sound/pci/hda/patch_cirrus.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_cirrus.c +1 -0
@@ -634,6 +634,7 @@ static const struct snd_pci_quirk cs4208SND_PCI_QUIRK (0x106b ,0x5e00 ,"MacBookPro 11,2" ,CS4208_MBP11 ),SND_PCI_QUIRK (0x106b ,0x7100 ,"MacBookAir 6,1" ,CS4208_MBA6 ),SND_PCI_QUIRK (0x106b ,0x7200 ,"MacBookAir 6,2" ,CS4208_MBA6 ), + SND_PCI_QUIRK(0x106b, 0x7b00, "MacBookPro 12,1", CS4208_MBP11), {} /* terminator */ };
Greg Kroah-Hartman
maintainerPATCH 65/202 ALSA: hda - Disable power_save_node for IDT 92HD73xx chips
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit c7e1008048a97148d3aecae742f66fb2f944644c upstream.
The recent widget power saving introduced some unavoidable click noises on old IDT 92HD73xx chips while it still seems working on the compatible new chips. In the bugzilla, we tried lots of tests and workarounds, but they didn't help much. So, let's disable the feature for these specific chips as the least (but safest) fix.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=104981
--- sound/pci/hda/patch_sigmatel.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/pci/hda/patch_sigmatel.c +5 -1
@@ -4522,7 +4522,11 @@ static int patch_stac92hd73xx(struct hdareturn err; spec = codec->spec; - codec->power_save_node =1 ; +/* enable power_save_node only for new 92HD89xx chips, as it causes +* click noises on old 92HD73xx chips. +*/ +if ((codec->core.vendor_id &0xfffffff0 ) !=0x111d7670 ) + codec->power_save_node =1 ; spec->linear_tone_beep =0 ; spec->gen.mixer_nid =0x1d ; spec->have_spdif_mux =1 ;
Greg Kroah-Hartman
maintainerPATCH 66/202 ASoC: pxa: pxa2xx-ac97: fix dma requestor lines
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Jarzmik <[email protected]>
commit 8811191fdf7ed02ee07cb8469428158572d355a2 upstream.
PCM receive and transmit DMA requestor lines were reverted, breaking the PCM playback interface for PXA platforms using the sound/soc/ variant instead of the sound/arm variant.
The commit below shows the inversion in the requestor lines.
--- sound/soc/pxa/pxa2xx-ac97.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/pxa/pxa2xx-ac97.c +2 -2
@@ -49,7 +49,7 @@ static struct snd_ac97_bus_ops pxa2xx_ac .reset = pxa2xx_ac97_cold_reset, }; -static unsigned long pxa2xx_ac97_pcm_stereo_in_req =12 ; +static unsigned long pxa2xx_ac97_pcm_stereo_in_req =11 ;static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_in = { .addr =__PREG (PCDR ), .addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ,
@@ -57,7 +57,7 @@ static struct snd_dmaengine_dai_dma_data .filter_data = &pxa2xx_ac97_pcm_stereo_in_req, }; -static unsigned long pxa2xx_ac97_pcm_stereo_out_req =11 ; +static unsigned long pxa2xx_ac97_pcm_stereo_out_req =12 ;static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_out = { .addr =__PREG (PCDR ), .addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ,
Greg Kroah-Hartman
maintainerPATCH 67/202 ASoC: fix broken pxa SoC support
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Jarzmik <[email protected]>
commit 3c8f7710c1c44fb650bc29b6ef78ed8b60cfaa28 upstream.
The previous fix of pxa library support, which was introduced to fix the library dependency, broke the previous SoC behavior, where a machine code binding pxa2xx-ac97 with a coded relied on :
- sound/soc/pxa/pxa2xx-ac97.c
- sound/soc/codecs/XXX.c
For example, the mioa701_wm9713.c machine code is currently broken. The "select ARM" statement wrongly selects the soc/arm/pxa2xx-ac97 for compilation, as per an unfortunate fate SND_PXA2XX_AC97 is both declared in sound/arm/Kconfig and sound/soc/pxa/Kconfig.
Fix this by ensuring that SND_PXA2XX_SOC correctly triggers the correct pxa2xx-ac97 compilation.
--- sound/arm/Kconfig | 15 ++++++++------- sound/soc/pxa/Kconfig | 2 -- 2 files changed, 8 insertions(+), 9 deletions(-)
sound/arm/Kconfig +8 -7
@@ -9,6 +9,14 @@ menuconfig SND_ARM Drivers that are implemented on ASoC can be found in "ALSA for SoC audio support" section. +config SND_PXA2XX_LIB + tristate + select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97 + select SND_DMAENGINE_PCM + +config SND_PXA2XX_LIB_AC97 + bool + if SND_ARM config SND_ARMAACI
@@ -21,13 +29,6 @@ config SND_PXA2XX_PCM tristate select SND_PCM -config SND_PXA2XX_LIB - tristate - select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97 - -config SND_PXA2XX_LIB_AC97 - bool - config SND_PXA2XX_AC97 tristate "AC97 driver for the Intel PXA2xx chip" depends on ARCH_PXA
sound/soc/pxa/Kconfig +0 -2
@@ -1,7 +1,6 @@ config SND_PXA2XX_SOC tristate "SoC Audio for the Intel PXA2xx chip" depends on ARCH_PXA - select SND_ARM select SND_PXA2XX_LIB help Say Y or M if you want to add support for codecs attached to
@@ -25,7 +24,6 @@ config SND_PXA2XX_AC97 config SND_PXA2XX_SOC_AC97 tristate select AC97_BUS - select SND_ARM select SND_PXA2XX_LIB_AC97 select SND_SOC_AC97_BUS
Greg Kroah-Hartman
maintainerPATCH 68/202 ASoC: dwc: correct irq clear method
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yitian Bu <[email protected]>
commit 4873867e5f2bd90faad861dd94865099fc3140f3 upstream.
from Designware I2S datasheet, tx/rx XRUN irq is cleared by reading register TOR/ROR, rather than by writing into them.
--- sound/soc/dwc/designware_i2s.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/dwc/designware_i2s.c +2 -2
@@ -131,10 +131,10 @@ static inline void i2s_clear_irqs(structif (stream ==SNDRV_PCM_STREAM_PLAYBACK ) {for (i =0 ; i <4 ; i++) -i2s_write_reg (dev->i2s_base,TOR (i),0 ); +i2s_read_reg (dev->i2s_base,TOR (i)); }else {for (i =0 ; i <4 ; i++) -i2s_write_reg (dev->i2s_base,ROR (i),0 ); +i2s_read_reg (dev->i2s_base,ROR (i)); } }
Greg Kroah-Hartman
maintainerPATCH 69/202 ASoC: db1200: Fix DAI link format for db1300 and db1550
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <[email protected]>
commit e74679b38c9417c1c524081121cdcdb36f82264d upstream.
Commit b4508d0f95fa ("ASoC: db1200: Use static DAI format setup") switched the db1200 driver over to using static DAI format setup instead of a callback function. But the commit only added the dai_fmt field to one of the three DAI links in the driver. This breaks audio on db1300 and db1550.
Add the two missing dai_fmt settings to fix the issue.
--- sound/soc/au1x/db1200.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/au1x/db1200.c +4 -0
@@ -129,6 +129,8 @@ static struct snd_soc_dai_link db1300_i2 .cpu_dai_name = "au1xpsc_i2s.2", .platform_name = "au1xpsc-pcm.2", .codec_name = "wm8731.0-001b", + .dai_fmt = SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_NB_NF | + SND_SOC_DAIFMT_CBM_CFM, .ops = &db1200_i2s_wm8731_ops, };
@@ -146,6 +148,8 @@ static struct snd_soc_dai_link db1550_i2 .cpu_dai_name = "au1xpsc_i2s.3", .platform_name = "au1xpsc-pcm.3", .codec_name = "wm8731.0-001b", + .dai_fmt = SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_NB_NF | + SND_SOC_DAIFMT_CBM_CFM, .ops = &db1200_i2s_wm8731_ops, };
Greg Kroah-Hartman
maintainerPATCH 70/202 ASoC: sgtl5000: fix wrong register MIC_BIAS_VOLTAGE setup on probe
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gianluca Renzi <[email protected]>
commit e256da84a04ea31c3c215997c847609af224e8f4 upstream.
--- sound/soc/codecs/sgtl5000.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/sgtl5000.c +2 -2
@@ -1339,8 +1339,8 @@ static int sgtl5000_probe(struct snd_soc sgtl5000->micbias_resistor << SGTL5000_BIAS_R_SHIFT);snd_soc_update_bits (codec,SGTL5000_CHIP_MIC_CTRL , -SGTL5000_BIAS_R_MASK , - sgtl5000->micbias_voltage <<SGTL5000_BIAS_R_SHIFT ); +SGTL5000_BIAS_VOLT_MASK , + sgtl5000->micbias_voltage <<SGTL5000_BIAS_VOLT_SHIFT );/* * disable DAP * TODO:
Greg Kroah-Hartman
maintainerPATCH 71/202 btrfs: skip waiting on ordered range for special files
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Mahoney <[email protected]>
commit a30e577c96f59b1e1678ea5462432b09bf7d5cbc upstream.
In btrfs_evict_inode, we properly truncate the page cache for evicted inodes but then we call btrfs_wait_ordered_range for every inode as well. It's the right thing to do for regular files but results in incorrect behavior for device inodes for block devices.
filemap_fdatawrite_range gets called with inode->i_mapping which gets resolved to the block device inode before getting passed to wbc_attach_fdatawrite_inode and ultimately to inode_to_bdi. What happens next depends on whether there's an open file handle associated with the inode. If there is, we write to the block device, which is unexpected behavior. If there isn't, we through normally and inode->i_data is used. We can also end up racing against open/close which can result in crashes when i_mapping points to a block device inode that has been closed.
Since there can't be any page cache associated with special file inodes, it's safe to skip the btrfs_wait_ordered_range call entirely and avoid the problem.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=100911
--- fs/btrfs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/btrfs/inode.c +2 -1
@@ -5035,7 +5035,8 @@ void btrfs_evict_inode(struct inode *ino goto no_delete; }/* do we really want it for ->i_nlink > 0 and zero btrfs_root_refs? */ -btrfs_wait_ordered_range (inode,0 , (u64)-1 ); +if (!special_file (inode->i_mode)) +btrfs_wait_ordered_range (inode,0 , (u64)-1 );btrfs_free_io_failure_record (inode,0 , (u64)-1 );
Greg Kroah-Hartman
maintainerPATCH 72/202 Btrfs: fix read corruption of compressed and shared extents
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 005efedf2c7d0a270ffbe28d8997b03844f3e3e7 upstream.
If a file has a range pointing to a compressed extent, followed by another range that points to the same compressed extent and a read operation attempts to read both ranges (either completely or part of them), the pages that correspond to the second range are incorrectly filled with zeroes.
Consider the following example:
File layout
[0 - 8K] [8K - 24K]
| |
| |
points to extent X, points to extent X,
offset 4K, length of 8K offset 0, length 16K[extent X, compressed length = 4K uncompressed length = 16K]
If a readpages() call spans the 2 ranges, a single bio to read the extent is submitted - extent_io.c:submit_extent_page() would only create a new bio to cover the second range pointing to the extent if the extent it points to had a different logical address than the extent associated with the first range. This has a consequence of the compressed read end io handler (compression.c:end_compressed_bio_read()) finish once the extent is decompressed into the pages covering the first range, leaving the remaining pages (belonging to the second range) filled with zeroes (done by compression.c:btrfs_clear_biovec_end()).
So fix this by submitting the current bio whenever we find a range pointing to a compressed extent that was preceded by a range with a different extent map. This is the simplest solution for this corner case. Making the end io callback populate both ranges (or more, if we have multiple pointing to the same extent) is a much more complex solution since each bio is tightly coupled with a single extent map and the extent maps associated to the ranges pointing to the shared extent can have different offsets and lengths.
The following test case for fstests triggers the issue:
seq=basename $0
seqres=$RESULT_DIR/$seq
echo "QA output created by $seq"
tmp=/tmp/$$
status=1 # failure is the default!
trap "_cleanup; exit \$status" 0 1 2 3 15
_cleanup()
{
rm -f $tmp.*
}# get standard environment, filters and checks . ./common/rc . ./common/filter
# real QA test starts here _need_to_be_root _supported_fs btrfs _supported_os Linux _require_scratch _require_cloner
rm -f $seqres.full
test_clone_and_read_compressed_extent()
{
local mount_opts=$1 _scratch_mkfs >>$seqres.full 2>&1
_scratch_mount $mount_opts
# Create a test file with a single extent that is compressed (the # data we write into it is highly compressible no matter which # compression algorithm is used, zlib or lzo).
$XFS_IO_PROG -f -c "pwrite -S 0xaa 0K 4K" \
-c "pwrite -S 0xbb 4K 8K" \
-c "pwrite -S 0xcc 12K 4K" \
$SCRATCH_MNT/foo | _filter_xfs_io
# Now clone our extent into an adjacent offset. $CLONER_PROG -s $((4 * 1024)) -d $((16 * 1024)) -l $((8 * 1024)) \
$SCRATCH_MNT/foo $SCRATCH_MNT/foo
# Same as before but for this file we clone the extent into a lower # file offset.
$XFS_IO_PROG -f -c "pwrite -S 0xaa 8K 4K" \
-c "pwrite -S 0xbb 12K 8K" \
-c "pwrite -S 0xcc 20K 4K" \
$SCRATCH_MNT/bar | _filter_xfs_io
$CLONER_PROG -s $((12 * 1024)) -d 0 -l $((8 * 1024)) \
$SCRATCH_MNT/bar $SCRATCH_MNT/bar
echo "File digests before unmounting filesystem:" md5sum $SCRATCH_MNT/foo | _filter_scratch md5sum $SCRATCH_MNT/bar | _filter_scratch
# Evicting the inode or clearing the page cache before reading # again the file would also trigger the bug - reads were returning # all bytes in the range corresponding to the second reference to # the extent with a value of 0, but the correct data was persisted # (it was a bug exclusively in the read path). The issue happened # only if the same readpages() call targeted pages belonging to the # first and second ranges that point to the same compressed extent. _scratch_remount
echo "File digests after mounting filesystem again:" # Must match the same digests we got before. md5sum $SCRATCH_MNT/foo | _filter_scratch md5sum $SCRATCH_MNT/bar | _filter_scratch
}
echo -e "\nTesting with zlib compression..." test_clone_and_read_compressed_extent "-o compress=zlib"
_scratch_unmount
echo -e "\nTesting with lzo compression..." test_clone_and_read_compressed_extent "-o compress=lzo"
status=0
exit
--- fs/btrfs/extent_io.c | 65 ++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 57 insertions(+), 8 deletions(-)
fs/btrfs/extent_io.c +57 -8
@@ -2795,7 +2795,8 @@ static int submit_extent_page(int rw, stbio_end_io_t end_io_func, int mirror_num, unsigned long prev_bio_flags, - unsigned long bio_flags) + unsigned long bio_flags, + bool force_bio_submit) { int ret = 0;struct bio *bio;
@@ -2813,6 +2814,7 @@ static int submit_extent_page(int rw, st contig =bio_end_sector (bio) == sector;if (prev_bio_flags != bio_flags || !contig || + force_bio_submit ||merge_bio (rw, tree, page, offset, page_size, bio, bio_flags) ||bio_add_page (bio, page, page_size, offset) < page_size) { ret = submit_one_bio(rw, bio, mirror_num,
@@ -2906,7 +2908,8 @@ static int __do_readpage(struct extent_iget_extent_t *get_extent, struct extent_map **em_cached, struct bio **bio, int mirror_num, - unsigned long *bio_flags, int rw) + unsigned long *bio_flags, int rw, + u64 *prev_em_start) { struct inode *inode = page->mapping->host;u64 start =page_offset (page);
@@ -2954,6 +2957,7 @@ static int __do_readpage(struct extent_i }while (cur <= end) {unsigned long pnr = (last_byte >>PAGE_CACHE_SHIFT ) +1 ; +bool force_bio_submit = false;if (cur >= last_byte) {char *userpage;
@@ -3004,6 +3008,49 @@ static int __do_readpage(struct extent_i block_start = em->block_start;if (test_bit (EXTENT_FLAG_PREALLOC , &em->flags)) block_start =EXTENT_MAP_HOLE ; + +/* +* If we have a file range that points to a compressed extent +* and it's followed by a consecutive file range that points to +* to the same compressed extent (possibly with a different +* offset and/or length, so it either points to the whole extent +* or only part of it), we must make sure we do not submit a +* single bio to populate the pages for the 2 ranges because +* this makes the compressed extent read zero out the pages +* belonging to the 2nd range. Imagine the following scenario: +* +* File layout +* [0 - 8K] [8K - 24K] +* | | +* | | +* points to extent X, points to extent X, +* offset 4K, length of 8K offset 0, length 16K +* +* [extent X, compressed length = 4K uncompressed length = 16K] +* +* If the bio to read the compressed extent covers both ranges, +* it will decompress extent X into the pages belonging to the +* first range and then it will stop, zeroing out the remaining +* pages that belong to the other range that points to extent X. +* So here we make sure we submit 2 bios, one for the first +* range and another one for the third range. Both will target +* the same physical extent from disk, but we can't currently +* make the compressed bio endio callback populate the pages +* for both ranges because each compressed bio is tightly +* coupled with a single extent map, and each range can have +* an extent map with a different offset value relative to the +* uncompressed data of our extent and different lengths. This +* is a corner case so we prioritize correctness over +* non-optimal behavior (submitting 2 bios for the same extent). +*/ +if (test_bit (EXTENT_FLAG_COMPRESSED , &em->flags) && + prev_em_start && *prev_em_start != (u64)-1 && + *prev_em_start != em->orig_start) + force_bio_submit = true; + +if (prev_em_start) + *prev_em_start = em->orig_start; +free_extent_map (em); em =NULL ;
@@ -3053,7 +3100,8 @@ static int __do_readpage(struct extent_i bdev, bio, pnr, end_bio_extent_readpage, mirror_num, *bio_flags, - this_bio_flag); + this_bio_flag, + force_bio_submit);if (!ret) { nr++; *bio_flags = this_bio_flag;
@@ -3085,6 +3133,7 @@ static inline void __do_contiguous_readpstruct inode *inode;struct btrfs_ordered_extent *ordered;int index; +u64 prev_em_start = (u64)-1 ; inode = pages[0 ]->mapping->host;while (1 ) {
@@ -3100,7 +3149,7 @@ static inline void __do_contiguous_readpfor (index =0 ; index < nr_pages; index++) {__do_readpage (tree, pages[index], get_extent, em_cached, bio, - mirror_num, bio_flags, rw); + mirror_num, bio_flags, rw, &prev_em_start);page_cache_release (pages[index]); } }
@@ -3168,7 +3217,7 @@ static int __extent_read_full_page(struc } ret =__do_readpage (tree, page, get_extent,NULL , bio, mirror_num, - bio_flags, rw); + bio_flags, rw,NULL );return ret; }
@@ -3194,7 +3243,7 @@ int extent_read_full_page_nolock(structint ret; ret =__do_readpage (tree, page, get_extent,NULL , &bio, mirror_num, - &bio_flags,READ ); + &bio_flags,READ ,NULL );if (bio) ret =submit_one_bio (READ , bio, mirror_num, bio_flags);return ret;
@@ -3447,7 +3496,7 @@ static noinline_for_stack int __extent_w sector, iosize, pg_offset, bdev, &epd->bio, max_nr, end_bio_extent_writepage, - 0, 0, 0); + 0, 0, 0, false);if (ret)SetPageError (page); }
@@ -3749,7 +3798,7 @@ static noinline_for_stack int write_one_ ret =submit_extent_page (rw, tree, p, offset >>9 ,PAGE_CACHE_SIZE ,0 , bdev, &epd->bio,-1 , end_bio_extent_buffer_writepage, -0 , epd->bio_flags, bio_flags); +0 , epd->bio_flags, bio_flags, false); epd->bio_flags = bio_flags;if (ret) {set_btree_ioerr (p);
Greg Kroah-Hartman
maintainerPATCH 73/202 Btrfs: update fix for read corruption of compressed and shared extents
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 808f80b46790f27e145c72112189d6a3be2bc884 upstream.
My previous fix in commit 005efedf2c7d ("Btrfs: fix read corruption of compressed and shared extents") was effective only if the compressed extents cover a file range with a length that is not a multiple of 16 pages. That's because the detection of when we reached a different range of the file that shares the same compressed extent as the previously processed range was done at extent_io.c:__do_contiguous_readpages(), which covers subranges with a length up to 16 pages, because extent_readpages() groups the pages in clusters no larger than 16 pages. So fix this by tracking the start of the previously processed file range's extent map at extent_readpages().
The following test case for fstests reproduces the issue:
seq=basename $0
seqres=$RESULT_DIR/$seq
echo "QA output created by $seq"
tmp=/tmp/$$
status=1 # failure is the default!
trap "_cleanup; exit \$status" 0 1 2 3 15
_cleanup()
{
rm -f $tmp.*
}# get standard environment, filters and checks . ./common/rc . ./common/filter
# real QA test starts here _need_to_be_root _supported_fs btrfs _supported_os Linux _require_scratch _require_cloner
rm -f $seqres.full
test_clone_and_read_compressed_extent()
{
local mount_opts=$1 _scratch_mkfs >>$seqres.full 2>&1
_scratch_mount $mount_opts
# Create our test file with a single extent of 64Kb that is going to # be compressed no matter which compression algo is used (zlib/lzo). $XFS_IO_PROG -f -c "pwrite -S 0xaa 0K 64K" \
$SCRATCH_MNT/foo | _filter_xfs_io
# Now clone the compressed extent into an adjacent file offset. $CLONER_PROG -s 0 -d $((64 * 1024)) -l $((64 * 1024)) \
$SCRATCH_MNT/foo $SCRATCH_MNT/foo
echo "File digest before unmount:"
md5sum $SCRATCH_MNT/foo | _filter_scratch
# Remount the fs or clear the page cache to trigger the bug in # btrfs. Because the extent has an uncompressed length that is a # multiple of 16 pages, all the pages belonging to the second range # of the file (64K to 128K), which points to the same extent as the # first range (0K to 64K), had their contents full of zeroes instead # of the byte 0xaa. This was a bug exclusively in the read path of # compressed extents, the correct data was stored on disk, btrfs # just failed to fill in the pages correctly. _scratch_remount
echo "File digest after remount:"
# Must match the digest we got before.
md5sum $SCRATCH_MNT/foo | _filter_scratch
}
echo -e "\nTesting with zlib compression..." test_clone_and_read_compressed_extent "-o compress=zlib"
_scratch_unmount
echo -e "\nTesting with lzo compression..." test_clone_and_read_compressed_extent "-o compress=lzo"
status=0
exit
--- fs/btrfs/extent_io.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
fs/btrfs/extent_io.c +11 -8
@@ -3128,12 +3128,12 @@ static inline void __do_contiguous_readpget_extent_t *get_extent, struct extent_map **em_cached, struct bio **bio, int mirror_num, - unsigned long *bio_flags, int rw) + unsigned long *bio_flags, int rw, + u64 *prev_em_start) { struct inode *inode;struct btrfs_ordered_extent *ordered;int index; -u64 prev_em_start = (u64)-1 ; inode = pages[0 ]->mapping->host;while (1 ) {
@@ -3149,7 +3149,7 @@ static inline void __do_contiguous_readpfor (index =0 ; index < nr_pages; index++) {__do_readpage (tree, pages[index], get_extent, em_cached, bio, - mirror_num, bio_flags, rw, &prev_em_start); + mirror_num, bio_flags, rw, prev_em_start);page_cache_release (pages[index]); } }
@@ -3159,7 +3159,8 @@ static void __extent_readpages(struct ex int nr_pages, get_extent_t *get_extent, struct extent_map **em_cached, struct bio **bio, int mirror_num, - unsigned long *bio_flags, int rw) + unsigned long *bio_flags, int rw, + u64 *prev_em_start) { u64 start = 0;u64 end =0 ;
@@ -3180,7 +3181,7 @@ static void __extent_readpages(struct ex index - first_index, start, end, get_extent, em_cached, bio, mirror_num, bio_flags, - rw); + rw, prev_em_start); start = page_start; end = start +PAGE_CACHE_SIZE -1 ; first_index = index;
@@ -3191,7 +3192,8 @@ static void __extent_readpages(struct ex__do_contiguous_readpages (tree, &pages[first_index], index - first_index, start, end, get_extent, em_cached, bio, - mirror_num, bio_flags, rw); + mirror_num, bio_flags, rw, + prev_em_start); } static int __extent_read_full_page(struct extent_io_tree *tree,
@@ -4202,6 +4204,7 @@ int extent_readpages(struct extent_io_trstruct page *page;struct extent_map *em_cached =NULL ;int nr =0 ; +u64 prev_em_start = (u64)-1 ;for (page_idx =0 ; page_idx < nr_pages; page_idx++) { page = list_entry(pages->prev, struct page, lru);
@@ -4218,12 +4221,12 @@ int extent_readpages(struct extent_io_trif (nr <ARRAY_SIZE (pagepool))continue ;__extent_readpages (tree, pagepool, nr, get_extent, &em_cached, - &bio,0 , &bio_flags,READ ); + &bio,0 , &bio_flags,READ , &prev_em_start); nr =0 ; }if (nr)__extent_readpages (tree, pagepool, nr, get_extent, &em_cached, - &bio,0 , &bio_flags,READ ); + &bio,0 , &bio_flags,READ , &prev_em_start);if (em_cached)free_extent_map (em_cached);
Greg Kroah-Hartman
maintainerPATCH 74/202 PCI: Fix devfn for VPD access through function 0
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
commit 9d9240756e63dd87d6cbf5da8b98ceb8f8192b55 upstream.
Commit 932c435caba8 ("PCI: Add dev_flags bit to access VPD through function 0") passes PCI_SLOT(devfn) for the devfn parameter of pci_get_slot(). Generally this works because we're fairly well guaranteed that a PCIe device is at slot address 0, but for the general case, including conventional PCI, it's incorrect. We need to get the slot and then convert it back into a devfn.
--- drivers/pci/access.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/pci/access.c +6 -3
@@ -442,7 +442,8 @@ static const struct pci_vpd_ops pci_vpd_static ssize_t pci_vpd_f0_read (struct pci_dev *dev,loff_t pos,size_t count,void *arg) { -struct pci_dev *tdev =pci_get_slot (dev->bus,PCI_SLOT (dev->devfn)); +struct pci_dev *tdev =pci_get_slot (dev->bus, +PCI_DEVFN (PCI_SLOT (dev->devfn),0 ));ssize_t ret;if (!tdev)
@@ -456,7 +457,8 @@ static ssize_t pci_vpd_f0_read(struct pcstatic ssize_t pci_vpd_f0_write (struct pci_dev *dev,loff_t pos,size_t count,const void *arg) { -struct pci_dev *tdev =pci_get_slot (dev->bus,PCI_SLOT (dev->devfn)); +struct pci_dev *tdev =pci_get_slot (dev->bus, +PCI_DEVFN (PCI_SLOT (dev->devfn),0 ));ssize_t ret;if (!tdev)
@@ -475,7 +477,8 @@ static const struct pci_vpd_ops pci_vpd_static int pci_vpd_f0_dev_check (struct pci_dev *dev) { -struct pci_dev *tdev =pci_get_slot (dev->bus,PCI_SLOT (dev->devfn)); +struct pci_dev *tdev =pci_get_slot (dev->bus, +PCI_DEVFN (PCI_SLOT (dev->devfn),0 ));int ret =0 ;if (!tdev)
Greg Kroah-Hartman
maintainerPATCH 75/202 PCI: Use function 0 VPD for identical functions, regular VPD for others
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
commit da2d03ea27f6ed9d2005a67b20dd021ddacf1e4d upstream.
932c435caba8 ("PCI: Add dev_flags bit to access VPD through function 0") added PCI_DEV_FLAGS_VPD_REF_F0. Previously, we set the flag on every non-zero function of quirked devices. If a function turned out to be different from function 0, i.e., it had a different class, vendor ID, or device ID, the flag remained set but we didn't make VPD accessible at all.
Flip this around so we only set PCI_DEV_FLAGS_VPD_REF_F0 for functions that are identical to function 0, and allow regular VPD access for any other functions.
--- drivers/pci/access.c | 22 ---------------------- drivers/pci/quirks.c | 20 ++++++++++++++++++-- 2 files changed, 18 insertions(+), 24 deletions(-)
drivers/pci/access.c +0 -22
@@ -475,23 +475,6 @@ static const struct pci_vpd_ops pci_vpd_ .release = pci_vpd_pci22_release, }; -static int pci_vpd_f0_dev_check (struct pci_dev *dev) -{ -struct pci_dev *tdev =pci_get_slot (dev->bus, -PCI_DEVFN (PCI_SLOT (dev->devfn),0 )); -int ret =0 ; - -if (!tdev) -return -ENODEV ; -if (!tdev->vpd || !tdev->multifunction || - dev->class != tdev->class || dev->vendor != tdev->vendor || - dev->device != tdev->device) - ret = -ENODEV ; - -pci_dev_put (tdev); -return ret; -} -int pci_vpd_pci22_init (struct pci_dev *dev) {struct pci_vpd_pci22 *vpd;
@@ -500,12 +483,7 @@ int pci_vpd_pci22_init(struct pci_dev *d cap =pci_find_capability (dev,PCI_CAP_ID_VPD );if (!cap)return -ENODEV ; -if (dev->dev_flags &PCI_DEV_FLAGS_VPD_REF_F0 ) { -int ret =pci_vpd_f0_dev_check (dev); -if (ret) -return ret; - } vpd =kzalloc (sizeof (*vpd),GFP_ATOMIC );if (!vpd)return -ENOMEM ;
drivers/pci/quirks.c +18 -2
@@ -1915,11 +1915,27 @@ static void quirk_netmos(struct pci_devDECLARE_PCI_FIXUP_CLASS_HEADER (PCI_VENDOR_ID_NETMOS ,PCI_ANY_ID ,PCI_CLASS_COMMUNICATION_SERIAL ,8 , quirk_netmos); +/* +* Quirk non-zero PCI functions to route VPD access through function 0 for +* devices that share VPD resources between functions. The functions are +* expected to be identical devices. +*/ static void quirk_f0_vpd_link (struct pci_dev *dev) { -if (!dev->multifunction || !PCI_FUNC (dev->devfn)) +struct pci_dev *f0; + +if (!PCI_FUNC (dev->devfn)) +return ; + + f0 =pci_get_slot (dev->bus,PCI_DEVFN (PCI_SLOT (dev->devfn),0 )); +if (!f0)return ; - dev->dev_flags |=PCI_DEV_FLAGS_VPD_REF_F0 ; + +if (f0->vpd && dev->class == f0->class && + dev->vendor == f0->vendor && dev->device == f0->device) + dev->dev_flags |=PCI_DEV_FLAGS_VPD_REF_F0 ; + +pci_dev_put (f0); }DECLARE_PCI_FIXUP_CLASS_EARLY (PCI_VENDOR_ID_INTEL ,PCI_ANY_ID ,PCI_CLASS_NETWORK_ETHERNET ,8 , quirk_f0_vpd_link);
Greg Kroah-Hartman
maintainerPATCH 76/202 PCI: Clear IORESOURCE_UNSET when clipping a bridge window
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
commit b838b39e930aa1cfd099ea82ac40ed6d6413af26 upstream.
c770cb4cb505 ("PCI: Mark invalid BARs as unassigned") sets IORESOURCE_UNSET if we fail to claim a resource. If we tried to claim a bridge window, failed, clipped the window, and tried to claim the clipped window, we failed again because of IORESOURCE_UNSET:
pci_bus 0000:00: root bus resource [mem 0xc0000000-0xffffffff window]
pci 0000:00:01.0: can't claim BAR 15 [mem 0xbdf00000-0xddefffff 64bit pref]: no compatible bridge window pci 0000:00:01.0: [mem size 0x20000000 64bit pref] clipped to [mem size 0x1df00000 64bit pref]
pci 0000:00:01.0: bridge window [mem size 0x1df00000 64bit pref]
pci 0000:00:01.0: can't claim BAR 15 [mem size 0x1df00000 64bit pref]: no address assigned
The 00:01.0 window started as [mem 0xbdf00000-0xddefffff 64bit pref]. That starts before the host bridge window [mem 0xc0000000-0xffffffff window], so we clipped the 00:01.0 window to [mem 0xc0000000-0xddefffff 64bit pref]. But we left it marked IORESOURCE_UNSET, so the second claim failed when it should have succeeded.
This means downstream devices will also fail for lack of resources, e.g., in the bugzilla below,
radeon 0000:01:00.0: Fatal error during GPU init
Clear IORESOURCE_UNSET when we clip a bridge window. Also clear IORESOURCE_UNSET in our copy of the unclipped window so we can see exactly what the original window was and how it now fits inside the upstream window.
--- drivers/pci/bus.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/bus.c +2 -0
@@ -256,6 +256,8 @@ bool pci_bus_clip_resource(struct pci_de res->start = start; res->end = end; + res->flags &= ~IORESOURCE_UNSET ; + orig_res.flags &= ~IORESOURCE_UNSET ;dev_printk (KERN_DEBUG , &dev->dev,"%pR clipped to %pR\n" , &orig_res, res);
Greg Kroah-Hartman
maintainerPATCH 77/202 dm crypt: constrain crypt devices max_segment_size to PAGE_SIZE
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit 586b286b110e94eb31840ac5afc0c24e0881fe34 upstream.
Setting the dm-crypt device's max_segment_size to PAGE_SIZE is an unfortunate constraint that is required to avoid the potential for exceeding dm-crypt's underlying device's max_segments limits -- due to crypt_alloc_buffer() possibly allocating pages for the encryption bio that are not as physically contiguous as the original bio.
It is interesting to note that this problem was already fixed back in 2007 via commit 91e106259 ("dm crypt: use bio_add_page"). But Linux 4.0 commit cf2f1abfb ("dm crypt: don't allocate pages for a partial request") regressed dm-crypt back to _not_ using bio_add_page(). But given dm-crypt's cpu parallelization changes all depend on commit cf2f1abfb's abandoning of the more complex io fragments processing that dm-crypt previously had we cannot easily go back to using bio_add_page().
So all said the cleanest way to resolve this issue is to fix dm-crypt to properly constrain the original bios entering dm-crypt so the encryption bios that dm-crypt generates from the original bios are always compatible with the underlying device's max_segments queue limits.
It should be noted that technically Linux 4.3 does _not_ need this fix because of the block core's new late bio-splitting capability. But, it is reasoned, there is little to be gained by having the block core split the encrypted bio that is composed of PAGE_SIZE segments. That said, in the future we may revert this change.
--- drivers/md/dm-crypt.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/md/dm-crypt.c +15 -2
@@ -955,7 +955,8 @@ static void crypt_free_buffer_pages(stru/* * Generate a new unfragmented bio with the given size -* This should never violate the device limitations +* This should never violate the device limitations (but only because +* max_segment_size is being constrained to PAGE_SIZE). * * This function may be called concurrently. If we allocate from the mempool * concurrently, there is a possibility of deadlock. For example, if we have
@@ -2040,9 +2041,20 @@ static int crypt_iterate_devices(structreturn fn (ti, cc->dev, cc->start, ti->len, data); } +static void crypt_io_hints (struct dm_target *ti,struct queue_limits *limits) +{ +/* +* Unfortunate constraint that is required to avoid the potential +* for exceeding underlying device's max_segments limits -- due to +* crypt_alloc_buffer() possibly allocating pages for the encryption +* bio that are not as physically contiguous as the original bio. +*/ + limits->max_segment_size =PAGE_SIZE ; +} +static struct target_type crypt_target = { .name ="crypt" , - .version = {1 ,14 ,0 }, + .version = {1 ,14 ,1 }, .module =THIS_MODULE , .ctr = crypt_ctr, .dtr = crypt_dtr,
@@ -2054,6 +2066,7 @@ static struct target_type crypt_target = .message = crypt_message, .merge = crypt_merge, .iterate_devices = crypt_iterate_devices, + .io_hints = crypt_io_hints, };static int __init dm_crypt_init (void )
Greg Kroah-Hartman
maintainerPATCH 78/202 ath10k: fix dma_mapping_error() handling
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kazior <[email protected]>
commit 5e55e3cbd1042cffa6249f22c10585e63f8a29bf upstream.
The function returns 1 when DMA mapping fails. The driver would return bogus values and could possibly confuse itself if DMA failed.
--- drivers/net/wireless/ath/ath10k/htc.c | 4 +++- drivers/net/wireless/ath/ath10k/htt_tx.c | 8 ++++++-- drivers/net/wireless/ath/ath10k/pci.c | 8 ++++++-- drivers/net/wireless/ath/ath10k/wmi.c | 1 + 4 files changed, 16 insertions(+), 5 deletions(-)
drivers/net/wireless/ath/ath10k/htc.c +3 -1
@@ -163,8 +163,10 @@ int ath10k_htc_send(struct ath10k_htc *h skb_cb->eid = eid; skb_cb->paddr =dma_map_single (dev, skb->data, skb->len,DMA_TO_DEVICE ); ret =dma_mapping_error (dev, skb_cb->paddr); -if (ret) +if (ret) { + ret = -EIO ; goto err_credits; + } sg_item.transfer_id = ep->eid; sg_item.transfer_context = skb;
drivers/net/wireless/ath/ath10k/htt_tx.c +6 -2
@@ -371,8 +371,10 @@ int ath10k_htt_mgmt_tx(struct ath10k_htt skb_cb->paddr =dma_map_single (dev, msdu->data, msdu->len,DMA_TO_DEVICE ); res =dma_mapping_error (dev, skb_cb->paddr); -if (res) +if (res) { + res = -EIO ; goto err_free_txdesc; + }skb_put (txdesc, len); cmd = (struct htt_cmd *)txdesc->data;
@@ -463,8 +465,10 @@ int ath10k_htt_tx(struct ath10k_htt *htt skb_cb->paddr =dma_map_single (dev, msdu->data, msdu->len,DMA_TO_DEVICE ); res =dma_mapping_error (dev, skb_cb->paddr); -if (res) +if (res) { + res = -EIO ; goto err_free_txbuf; + }if (likely (use_frags)) { frags = skb_cb->htt.txbuf->frags;
drivers/net/wireless/ath/ath10k/pci.c +6 -2
@@ -1378,8 +1378,10 @@ static int ath10k_pci_hif_exchange_bmi_m req_paddr =dma_map_single (ar->dev, treq, req_len,DMA_TO_DEVICE ); ret =dma_mapping_error (ar->dev, req_paddr); -if (ret) +if (ret) { + ret = -EIO ; goto err_dma; + }if (resp && resp_len) { tresp =kzalloc (*resp_len,GFP_KERNEL );
@@ -1391,8 +1393,10 @@ static int ath10k_pci_hif_exchange_bmi_m resp_paddr =dma_map_single (ar->dev, tresp, *resp_len,DMA_FROM_DEVICE ); ret =dma_mapping_error (ar->dev, resp_paddr); -if (ret) +if (ret) { + ret =EIO ; goto err_req; + } xfer.wait_for_resp = true; xfer.resp_len =0 ;
drivers/net/wireless/ath/ath10k/wmi.c +1 -0
@@ -2517,6 +2517,7 @@ void ath10k_wmi_event_host_swba(struct aath10k_warn (ar,"failed to map beacon: %d\n" , ret);dev_kfree_skb_any (bcn); + ret = -EIO ; goto skip; }
Greg Kroah-Hartman
maintainerPATCH 79/202 svcrdma: Fix send_reply() scatter/gather set-up
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
commit 9d11b51ce7c150a69e761e30518f294fc73d55ff upstream.
The Linux NFS server returns garbage in the data payload of inline NFS/RDMA READ replies. These are READs of under 1000 bytes or so where the client has not provided either a reply chunk or a write list.
The NFS server delivers the data payload for an NFS READ reply to the transport in an xdr_buf page list. If the NFS client did not provide a reply chunk or a write list, send_reply() is supposed to set up a separate sge for the page containing the READ data, and another sge for XDR padding if needed, then post all of the sges via a single SEND Work Request.
The problem is send_reply() does not advance through the xdr_buf when setting up scatter/gather entries for SEND WR. It always calls dma_map_xdr with xdr_off set to zero. When there's more than one sge, dma_map_xdr() sets up the SEND sge's so they all point to the xdr_buf's head.
The current Linux NFS/RDMA client always provides a reply chunk or a write list when performing an NFS READ over RDMA. Therefore, it does not exercise this particular case. The Linux server has never had to use more than one extra sge for building RPC/RDMA replies with a Linux client.
However, an NFS/RDMA client _is_ allowed to send small NFS READs without setting up a write list or reply chunk. The NFS READ reply fits entirely within the inline reply buffer in this case. This is perhaps a more efficient way of performing NFS READs that the Linux NFS/RDMA client may some day adopt.
--- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
net/sunrpc/xprtrdma/svc_rdma_sendto.c +9 -1
@@ -382,6 +382,7 @@ static int send_reply(struct svcxprt_rdm int byte_count) {struct ib_send_wr send_wr; +u32 xdr_off;int sge_no;int sge_bytes;int page_no;
@@ -416,8 +417,8 @@ static int send_reply(struct svcxprt_rdm ctxt->direction =DMA_TO_DEVICE ;/* Map the payload indicated by 'byte_count' */ + xdr_off =0 ;for (sge_no =1 ; byte_count && sge_no < vec->count; sge_no++) { -int xdr_off =0 ; sge_bytes =min_t (size_t, vec->sge[sge_no].iov_len, byte_count); byte_count -= sge_bytes; ctxt->sge[sge_no].addr =
@@ -455,6 +456,13 @@ static int send_reply(struct svcxprt_rdm } rqstp->rq_next_page = rqstp->rq_respages +1 ; +/* The loop above bumps sc_dma_used for each sge. The +* xdr_buf.tail gets a separate sge, but resides in the +* same page as xdr_buf.head. Don't count it twice. +*/ +if (sge_no > ctxt->count) +atomic_dec (&rdma->sc_dma_used); +if (sge_no > rdma->sc_max_sge) {pr_err ("svcrdma: Too many sges (%d)\n" , sge_no); goto err;
Greg Kroah-Hartman
maintainerPATCH 80/202 dm btree: add ref counting ops for the leaves of top level btrees
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <[email protected]>
commit b0dc3c8bc157c60b1d470163882be8c13e1950af upstream.
When using nested btrees, the top leaves of the top levels contain block addresses for the root of the next tree down. If we shadow a shared leaf node the leaf values (sub tree roots) should be incremented accordingly.
This is only an issue if there is metadata sharing in the top levels. Which only occurs if metadata snapshots are being used (as is possible with dm-thinp). And could result in a block from the thinp metadata snap being reused early, thus corrupting the thinp metadata snap.
--- drivers/md/persistent-data/dm-btree-internal.h | 6 ++++ drivers/md/persistent-data/dm-btree-remove.c | 12 ++------ drivers/md/persistent-data/dm-btree-spine.c | 37 +++++++++++++++++++++++++ drivers/md/persistent-data/dm-btree.c | 7 ---- 4 files changed, 47 insertions(+), 15 deletions(-)
drivers/md/persistent-data/dm-btree-internal.h +6 -0
@@ -138,4 +138,10 @@ int lower_bound(struct btree_node *n, uiextern struct dm_block_validator btree_node_validator; +/* +* Value type for upper levels of multi-level btrees. +*/ +extern void init_le64_type (struct dm_transaction_manager *tm, +struct dm_btree_value_type *vt); +#endif /* DM_BTREE_INTERNAL_H */
drivers/md/persistent-data/dm-btree-remove.c +3 -9
@@ -544,14 +544,6 @@ static int remove_raw(struct shadow_spinreturn r; } -static struct dm_btree_value_type le64_type = { - .context =NULL , - .size =sizeof (__le64), - .inc =NULL , - .dec =NULL , - .equal =NULL -}; -int dm_btree_remove (struct dm_btree_info *info,dm_block_t root,uint64_t *keys,dm_block_t *new_root) {
@@ -559,12 +551,14 @@ int dm_btree_remove(struct dm_btree_infoint index =0 , r =0 ;struct shadow_spine spine;struct btree_node *n; +struct dm_btree_value_type le64_vt; +init_le64_type (info->tm, &le64_vt);init_shadow_spine (&spine, info);for (level =0 ; level < info->levels; level++) { r =remove_raw (&spine, info, (level == last_level ? - &info->value_type : &le64_type), + &info->value_type : &le64_vt), root, keys[level], (unsigned *)&index);if (r <0 )break ;
drivers/md/persistent-data/dm-btree-spine.c +37 -0
@@ -249,3 +249,40 @@ int shadow_root(struct shadow_spine *s) {return s->root; } + +static void le64_inc (void *context,const void *value_le) +{ +struct dm_transaction_manager *tm = context; +__le64 v_le; + +memcpy (&v_le, value_le,sizeof (v_le)); +dm_tm_inc (tm,le64_to_cpu (v_le)); +} + +static void le64_dec (void *context,const void *value_le) +{ +struct dm_transaction_manager *tm = context; +__le64 v_le; + +memcpy (&v_le, value_le,sizeof (v_le)); +dm_tm_dec (tm,le64_to_cpu (v_le)); +} + +static int le64_equal (void *context,const void *value1_le,const void *value2_le) +{ +__le64 v1_le, v2_le; + +memcpy (&v1_le, value1_le,sizeof (v1_le)); +memcpy (&v2_le, value2_le,sizeof (v2_le)); +return v1_le == v2_le; +} + +void init_le64_type (struct dm_transaction_manager *tm, +struct dm_btree_value_type *vt) +{ + vt->context = tm; + vt->size =sizeof (__le64); + vt->inc = le64_inc; + vt->dec = le64_dec; + vt->equal = le64_equal; +}
drivers/md/persistent-data/dm-btree.c +1 -6
@@ -667,12 +667,7 @@ static int insert(struct dm_btree_info *struct btree_node *n;struct dm_btree_value_type le64_type; - le64_type.context =NULL ; - le64_type.size =sizeof (__le64); - le64_type.inc =NULL ; - le64_type.dec =NULL ; - le64_type.equal =NULL ; - +init_le64_type (info->tm, &le64_type);init_shadow_spine (&spine, info);for (level =0 ; level < (info->levels -1 ); level++) {
Greg Kroah-Hartman
maintainerPATCH 81/202 staging: ion: fix corruption of ion_import_dma_buf
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <[email protected]>
commit 6fa92e2bcf6390e64895b12761e851c452d87bd8 upstream.
we found this issue but still exit in lastest kernel. Simply keep ion_handle_create under mutex_lock to avoid this race.
WARNING: CPU: 2 PID: 2648 at drivers/staging/android/ion/ion.c:512 ion_handle_add+0xb4/0xc0() ion_handle_add: buffer already found. Modules linked in: iwlmvm iwlwifi mac80211 cfg80211 compat CPU: 2 PID: 2648 Comm: TimedEventQueue Tainted: G W 3.14.0 #7 00000000 00000000 9a3efd2c 80faf273 9a3efd6c 9a3efd5c 80935dc9 811d7fd3 9a3efd88 00000a58 812208a0 00000200 80e128d4 80e128d4 8d4ae00c a8cd8600 a8cd8094 9a3efd74 80935e0e 00000009 9a3efd6c 811d7fd3 9a3efd88 9a3efd9c Call Trace: [<80faf273>] dump_stack+0x48/0x69 [<80935dc9>] warn_slowpath_common+0x79/0x90 [<80e128d4>] ? ion_handle_add+0xb4/0xc0 [<80e128d4>] ? ion_handle_add+0xb4/0xc0 [<80935e0e>] warn_slowpath_fmt+0x2e/0x30 [<80e128d4>] ion_handle_add+0xb4/0xc0 [<80e144cc>] ion_import_dma_buf+0x8c/0x110 [<80c517c4>] reg_init+0x364/0x7d0 [<80993363>] ? futex_wait+0x123/0x210 [<80992e0e>] ? get_futex_key+0x16e/0x1e0 [<8099308f>] ? futex_wake+0x5f/0x120 [<80c51e19>] vpu_service_ioctl+0x1e9/0x500 [<80994aec>] ? do_futex+0xec/0x8e0 [<80971080>] ? prepare_to_wait_event+0xc0/0xc0 [<80c51c30>] ? reg_init+0x7d0/0x7d0 [<80a22562>] do_vfs_ioctl+0x2d2/0x4c0 [<80b198ad>] ? inode_has_perm.isra.41+0x2d/0x40 [<80b199cf>] ? file_has_perm+0x7f/0x90 [<80b1a5f7>] ? selinux_file_ioctl+0x47/0xf0 [<80a227a8>] SyS_ioctl+0x58/0x80 [<80fb45e8>] syscall_call+0x7/0x7 [<80fb0000>] ? mmc_do_calc_max_discard+0xab/0xe4
--- drivers/staging/android/ion/ion.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/staging/android/ion/ion.c +3 -3
@@ -1179,13 +1179,13 @@ struct ion_handle *ion_import_dma_buf(stmutex_unlock (&client->lock); goto end; } -mutex_unlock (&client->lock); handle =ion_handle_create (client, buffer); -if (IS_ERR (handle)) +if (IS_ERR (handle)) { +mutex_unlock (&client->lock); goto end; + } -mutex_lock (&client->lock); ret =ion_handle_add (client, handle);mutex_unlock (&client->lock);if (ret) {
Greg Kroah-Hartman
maintainerPATCH 82/202 USB: option: add ZTE PIDs
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Liu.Zhao" <[email protected]>
commit 19ab6bc5674a30fdb6a2436b068d19a3c17dc73e upstream.
This is intended to add ZTE device PIDs on kernel.
--- drivers/usb/serial/option.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
drivers/usb/serial/option.c +24 -0
@@ -278,6 +278,10 @@ static void option_instat_callback(struc#define ZTE_PRODUCT_MF622 0x0001#define ZTE_PRODUCT_MF628 0x0015#define ZTE_PRODUCT_MF626 0x0031 +#define ZTE_PRODUCT_ZM8620_X 0x0396 +#define ZTE_PRODUCT_ME3620_MBIM 0x0426 +#define ZTE_PRODUCT_ME3620_X 0x1432 +#define ZTE_PRODUCT_ME3620_L 0x1433#define ZTE_PRODUCT_AC2726 0xfff1#define ZTE_PRODUCT_MG880 0xfffd#define ZTE_PRODUCT_CDMA_TECH 0xfffe
@@ -544,6 +548,18 @@ static const struct option_blacklist_inf .sendsetup = BIT(1) | BIT(2) | BIT(3), }; +static const struct option_blacklist_info zte_me3620_mbim_blacklist = { + .reserved =BIT (2 ) |BIT (3 ) |BIT (4 ), +}; + +static const struct option_blacklist_info zte_me3620_xl_blacklist = { + .reserved =BIT (3 ) |BIT (4 ) |BIT (5 ), +}; + +static const struct option_blacklist_info zte_zm8620_x_blacklist = { + .reserved =BIT (3 ) |BIT (4 ) |BIT (5 ), +}; +static const struct option_blacklist_info huawei_cdc12_blacklist = { .reserved =BIT (1 ) |BIT (2 ), };
@@ -1591,6 +1607,14 @@ static const struct usb_device_id option .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist }, + { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_L), + .driver_info = (kernel_ulong_t)&zte_me3620_xl_blacklist }, + { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_MBIM), + .driver_info = (kernel_ulong_t)&zte_me3620_mbim_blacklist }, + { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_X), + .driver_info = (kernel_ulong_t)&zte_me3620_xl_blacklist }, + { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ZM8620_X), + .driver_info = (kernel_ulong_t)&zte_zm8620_x_blacklist }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
Greg Kroah-Hartman
maintainerPATCH 83/202 md/raid0: update queue parameter in a safer location.
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit 199dc6ed5179251fa6158a461499c24bdd99c836 upstream.
When a (e.g.) RAID5 array is reshaped to RAID0, the updating of queue parameters (e.g. max number of sectors per bio) is done in the wrong place.
It should be part of ->run, but it is actually part of ->takeover. This means it happens before level_store() calls:
blk_set_stacking_limits(&mddev->queue->limits);
and so it ineffective. This can lead to errors from underlying devices.
So move all the relevant settings out of create_stripe_zones() and into raid0_run().
As this can lead to a bug-on it is suitable for any -stable kernel which supports reshape to RAID0. So 2.6.35 or later. As the bug has been present for five years there is no urgency, so no need to rush into -stable.
--- drivers/md/raid0.c | 75 +++++++++++++++++++++++++++-------------------------- 1 file changed, 39 insertions(+), 36 deletions(-)
drivers/md/raid0.c +39 -36
@@ -83,7 +83,7 @@ static int create_strip_zones(struct mddchar b[BDEVNAME_SIZE ];char b2[BDEVNAME_SIZE ];struct r0conf *conf =kzalloc (sizeof (*conf),GFP_KERNEL ); -bool discard_supported = false; +unsigned short blksize =512 ;if (!conf)return -ENOMEM ;
@@ -98,6 +98,9 @@ static int create_strip_zones(struct mddsector_div (sectors, mddev->chunk_sectors); rdev1->sectors = sectors * mddev->chunk_sectors; + blksize =max (blksize,queue_logical_block_size ( + rdev1->bdev->bd_disk->queue)); +rdev_for_each (rdev2, mddev) { pr_debug("md/raid0:%s: comparing %s(%llu)" " with %s(%llu)\n",
@@ -134,6 +137,18 @@ static int create_strip_zones(struct mdd }pr_debug ("md/raid0:%s: FINAL %d zones\n" ,mdname (mddev), conf->nr_strip_zones); +/* +* now since we have the hard sector sizes, we can make sure +* chunk size is a multiple of that sector size +*/ +if ((mddev->chunk_sectors <<9 ) % blksize) { +printk (KERN_ERR "md/raid0:%s: chunk_size of %d not multiple of block size %d\n" , +mdname (mddev), + mddev->chunk_sectors <<9 , blksize); + err = -EINVAL ; + goto abort; + } + err = -ENOMEM ; conf->strip_zone =kzalloc (sizeof (struct strip_zone )* conf->nr_strip_zones,GFP_KERNEL );
@@ -188,19 +203,12 @@ static int create_strip_zones(struct mdd } dev[j] = rdev1; -if (mddev->queue) -disk_stack_limits (mddev->gendisk, rdev1->bdev, - rdev1->data_offset <<9 ); -if (rdev1->bdev->bd_disk->queue->merge_bvec_fn) conf->has_merge_bvec =1 ;if (!smallest || (rdev1->sectors < smallest->sectors)) smallest = rdev1; cnt++; - -if (blk_queue_discard (bdev_get_queue (rdev1->bdev))) - discard_supported = true; }if (cnt != mddev->raid_disks) { printk(KERN_ERR "md/raid0:%s: too few disks (%d of %d) - "
@@ -261,28 +269,6 @@ static int create_strip_zones(struct mdd (unsigned long long)smallest->sectors); } -/* -* now since we have the hard sector sizes, we can make sure -* chunk size is a multiple of that sector size -*/ -if ((mddev->chunk_sectors <<9 ) %queue_logical_block_size (mddev->queue)) { -printk (KERN_ERR "md/raid0:%s: chunk_size of %d not valid\n" , -mdname (mddev), - mddev->chunk_sectors <<9 ); - goto abort; - } - -if (mddev->queue) { -blk_queue_io_min (mddev->queue, mddev->chunk_sectors <<9 ); -blk_queue_io_opt (mddev->queue, - (mddev->chunk_sectors <<9 ) * mddev->raid_disks); - -if (!discard_supported) -queue_flag_clear_unlocked (QUEUE_FLAG_DISCARD , mddev->queue); -else -queue_flag_set_unlocked (QUEUE_FLAG_DISCARD , mddev->queue); - } -pr_debug ("md/raid0:%s: done.\n" ,mdname (mddev)); *private_conf = conf;
@@ -433,12 +419,6 @@ static int raid0_run(struct mddev *mddevif (md_check_no_bitmap (mddev))return -EINVAL ; -if (mddev->queue) { -blk_queue_max_hw_sectors (mddev->queue, mddev->chunk_sectors); -blk_queue_max_write_same_sectors (mddev->queue, mddev->chunk_sectors); -blk_queue_max_discard_sectors (mddev->queue, mddev->chunk_sectors); - } -/* if private is not null, we are here after takeover */ if (mddev->private ==NULL ) { ret =create_strip_zones (mddev, &conf);
@@ -447,6 +427,29 @@ static int raid0_run(struct mddev *mddev mddev->private = conf; } conf = mddev->private; +if (mddev->queue) { +struct md_rdev *rdev; +bool discard_supported = false; + +rdev_for_each (rdev, mddev) { +disk_stack_limits (mddev->gendisk, rdev->bdev, + rdev->data_offset <<9 ); +if (blk_queue_discard (bdev_get_queue (rdev->bdev))) + discard_supported = true; + } +blk_queue_max_hw_sectors (mddev->queue, mddev->chunk_sectors); +blk_queue_max_write_same_sectors (mddev->queue, mddev->chunk_sectors); +blk_queue_max_discard_sectors (mddev->queue, mddev->chunk_sectors); + +blk_queue_io_min (mddev->queue, mddev->chunk_sectors <<9 ); +blk_queue_io_opt (mddev->queue, + (mddev->chunk_sectors <<9 ) * mddev->raid_disks); + +if (!discard_supported) +queue_flag_clear_unlocked (QUEUE_FLAG_DISCARD , mddev->queue); +else +queue_flag_set_unlocked (QUEUE_FLAG_DISCARD , mddev->queue); + }/* calculate array device size */ md_set_array_sectors (mddev,raid0_size (mddev,0 ,0 ));
Greg Kroah-Hartman
maintainerPATCH 84/202 md/raid0: apply base queue limits *before* disk_stack_limits
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit 66eefe5de11db1e0d8f2edc3880d50e7c36a9d43 upstream.
Calling e.g. blk_queue_max_hw_sectors() after calls to disk_stack_limits() discards the settings determined by disk_stack_limits().
So we need to make those calls first.
--- drivers/md/raid0.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/md/raid0.c +6 -6
@@ -431,12 +431,6 @@ static int raid0_run(struct mddev *mddevstruct md_rdev *rdev;bool discard_supported = false; -rdev_for_each (rdev, mddev) { -disk_stack_limits (mddev->gendisk, rdev->bdev, - rdev->data_offset <<9 ); -if (blk_queue_discard (bdev_get_queue (rdev->bdev))) - discard_supported = true; - }blk_queue_max_hw_sectors (mddev->queue, mddev->chunk_sectors);blk_queue_max_write_same_sectors (mddev->queue, mddev->chunk_sectors);blk_queue_max_discard_sectors (mddev->queue, mddev->chunk_sectors);
@@ -445,6 +439,12 @@ static int raid0_run(struct mddev *mddevblk_queue_io_opt (mddev->queue, (mddev->chunk_sectors <<9 ) * mddev->raid_disks); +rdev_for_each (rdev, mddev) { +disk_stack_limits (mddev->gendisk, rdev->bdev, + rdev->data_offset <<9 ); +if (blk_queue_discard (bdev_get_queue (rdev->bdev))) + discard_supported = true; + }if (!discard_supported)queue_flag_clear_unlocked (QUEUE_FLAG_DISCARD , mddev->queue);else
Greg Kroah-Hartman
maintainerPATCH 85/202 dm raid: fix round up of default region size
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 042745ee53a0a7c1f5aff191a4a24213c6dcfb52 upstream.
Commit 3a0f9aaee028 ("dm raid: round region_size to power of two") intended to make sure that the default region size is a power of two. However, the logic in that commit is incorrect and sets the variable region_size to 0 or 1, depending on whether min_region_size is a power of two.
Fix this logic, using roundup_pow_of_two(), so that region_size is properly rounded up to the next power of two.
--- drivers/md/dm-raid.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/md/dm-raid.c +1 -2
@@ -327,8 +327,7 @@ static int validate_region_size(struct r*/ if (min_region_size > (1 <<13 )) {/* If not a power of 2, make it the next power of 2 */ -if (min_region_size & (min_region_size -1 )) - region_size =1 <<fls (region_size); + region_size =roundup_pow_of_two (min_region_size);DMINFO ("Choosing default region size of %lu sectors" , region_size); }else {
Greg Kroah-Hartman
maintainerPATCH 86/202 netfilter: nfnetlink: work around wrong endianess in res_id field
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit a9de9777d613500b089a7416f936bf3ae5f070d2 upstream.
The convention in nfnetlink is to use network byte order in every header field as well as in the attribute payload. The initial version of the batching infrastructure assumes that res_id comes in host byte order though.
The only client of the batching infrastructure is nf_tables, so let's add a workaround to address this inconsistency. We currently have 11 nfnetlink subsystems according to NFNL_SUBSYS_COUNT, so we can assume that the subsystem 2560, ie. htons(10), will not be allocated anytime soon, so it can be an alias of nf_tables from the nfnetlink batching path when interpreting the res_id field.
Based on original patch from Florian Westphal.
--- net/netfilter/nfnetlink.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/netfilter/nfnetlink.c +7 -1
@@ -432,6 +432,7 @@ done:static void nfnetlink_rcv (struct sk_buff *skb) {struct nlmsghdr *nlh =nlmsg_hdr (skb); +u_int16_t res_id;int msglen; if (nlh->nlmsg_len < NLMSG_HDRLEN ||
@@ -456,7 +457,12 @@ static void nfnetlink_rcv(struct sk_buff nfgenmsg =nlmsg_data (nlh);skb_pull (skb, msglen); -nfnetlink_rcv_batch (skb, nlh, nfgenmsg->res_id); +/* Work around old nft using host byte order */ +if (nfgenmsg->res_id ==NFNL_SUBSYS_NFTABLES ) + res_id =NFNL_SUBSYS_NFTABLES ; +else + res_id =ntohs (nfgenmsg->res_id); +nfnetlink_rcv_batch (skb, nlh, res_id); }else {netlink_rcv_skb (skb, &nfnetlink_rcv_msg); }
Greg Kroah-Hartman
maintainerPATCH 87/202 netfilter: nf_tables: Use 32 bit addressing register from nft_type_to_reg()
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit bf798657eb5ba57552096843c315f096fdf9b715 upstream.
nft_type_to_reg() needs to return the register in the new 32 bit addressing, otherwise we hit EINVAL when using mappings.
--- include/net/netfilter/nf_tables.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/netfilter/nf_tables.h +1 -1
@@ -125,7 +125,7 @@ static inline enum nft_data_types nft_drstatic inline enum nft_registers nft_type_to_reg (enum nft_data_types type) { -return type ==NFT_DATA_VERDICT ?NFT_REG_VERDICT :NFT_REG_1 ; +return type ==NFT_DATA_VERDICT ?NFT_REG_VERDICT :NFT_REG_1 *NFT_REG_SIZE /NFT_REG32_SIZE ; }unsigned int nft_parse_register (const struct nlattr *attr);
Greg Kroah-Hartman
maintainerPATCH 88/202 netfilter: nf_conntrack: Support expectations in different zones
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Stringer <[email protected]>
commit 4b31814d20cbe5cd4ccf18089751e77a04afe4f2 upstream.
When zones were originally introduced, the expectation functions were all extended to perform lookup using the zone. However, insertion was not modified to check the zone. This means that two expectations which are intended to apply for different connections that have the same tuple but exist in different zones cannot both be tracked.
--- net/netfilter/nf_conntrack_expect.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/nf_conntrack_expect.c +2 -1
@@ -219,7 +219,8 @@ static inline int expect_clash(const str a->mask.src.u3.all[count] & b->mask.src.u3.all[count]; } -return nf_ct_tuple_mask_cmp (&a->tuple, &b->tuple, &intersect_mask); +return nf_ct_tuple_mask_cmp (&a->tuple, &b->tuple, &intersect_mask) && +nf_ct_zone (a->master) ==nf_ct_zone (b->master); } static inline int expect_matches(const struct nf_conntrack_expect *a,
Greg Kroah-Hartman
maintainerPATCH 89/202 netfilter: ctnetlink: put back references to master ct and expect objects
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 95dd8653de658143770cb0e55a58d2aab97c79d2 upstream.
We have to put back the references to the master conntrack and the expectation that we just created, otherwise we'll leak them.
--- net/netfilter/nf_conntrack_netlink.c | 5 ----- 1 file changed, 5 deletions(-)
net/netfilter/nf_conntrack_netlink.c +0 -5
@@ -2995,11 +2995,6 @@ ctnetlink_create_expect(struct net *net, } err =nf_ct_expect_related_report (exp, portid, report); -if (err <0 ) - goto err_exp; - -return 0 ; -err_exp:nf_ct_expect_put (exp); err_ct:nf_ct_put (ct);
Greg Kroah-Hartman
maintainerPATCH 90/202 netfilter: nf_qeueue: Drop queue entries on nf_unregister_hook
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <[email protected]>
commit 8405a8fff3f8545c888a872d6e3c0c8eecd4d348 upstream.
Add code to nf_unregister_hook to flush the nf_queue when a hook is unregistered. This guarantees that the pointer that the nf_queue code retains into the nf_hook list will remain valid while a packet is queued.
I tested what would happen if we do not flush queued packets and was trivially able to obtain the oops below. All that was required was to stop the nf_queue listening process, to delete all of the nf_tables, and to awaken the nf_queue listening process.
Quoted 35 lines
BUG: unable to handle kernel paging request at 0000000100000001 IP: [<0000000100000001>] 0x100000001 PGD b9c35067 PUD 0 Oops: 0010 [#1] SMP Modules linked in: CPU: 0 PID: 519 Comm: lt-nfqnl_test Not tainted task: ffff8800b9c8c050 ti: ffff8800ba9d8000 task.ti: ffff8800ba9d8000 RIP: 0010:[<0000000100000001>] [<0000000100000001>] 0x100000001 RSP: 0018:ffff8800ba9dba40 EFLAGS: 00010a16 RAX: ffff8800bab48a00 RBX: ffff8800ba9dba90 RCX: ffff8800ba9dba90 RDX: ffff8800b9c10128 RSI: ffff8800ba940900 RDI: ffff8800bab48a00 RBP: ffff8800b9c10128 R08: ffffffff82976660 R09: ffff8800ba9dbb28 R10: dead000000100100 R11: dead000000200200 R12: ffff8800ba940900 R13: ffffffff8313fd50 R14: ffff8800b9c95200 R15: 0000000000000000 FS: 00007fb91fc34700(0000) GS:ffff8800bfa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000100000001 CR3: 00000000babfb000 CR4: 00000000000007f0 Stack: ffffffff8206ab0f ffffffff82982240 ffff8800bab48a00 ffff8800b9c100a8 ffff8800b9c10100 0000000000000001 ffff8800ba940900 ffff8800b9c10128 ffffffff8206bd65 ffff8800bfb0d5e0 ffff8800bab48a00 0000000000014dc0 Call Trace: [<ffffffff8206ab0f>] ? nf_iterate+0x4f/0xa0 [<ffffffff8206bd65>] ? nf_reinject+0x125/0x190 [<ffffffff8206dee5>] ? nfqnl_recv_verdict+0x255/0x360 [<ffffffff81386290>] ? nla_parse+0x80/0xf0 [<ffffffff8206c42c>] ? nfnetlink_rcv_msg+0x13c/0x240 [<ffffffff811b2fec>] ? __memcg_kmem_get_cache+0x4c/0x150 [<ffffffff8206c2f0>] ? nfnl_lock+0x20/0x20 [<ffffffff82068159>] ? netlink_rcv_skb+0xa9/0xc0 [<ffffffff820677bf>] ? netlink_unicast+0x12f/0x1c0 [<ffffffff82067ade>] ? netlink_sendmsg+0x28e/0x650 [<ffffffff81fdd814>] ? sock_sendmsg+0x44/0x50 [<ffffffff81fde07b>] ? ___sys_sendmsg+0x2ab/0x2c0 [<ffffffff810e8f73>] ? __wake_up+0x43/0x70
Quoted 8 lines
[<ffffffff8141a134>] ? tty_write+0x1c4/0x2a0 [<ffffffff81fde9f4>] ? __sys_sendmsg+0x44/0x80 [<ffffffff823ff8d7>] ? system_call_fastpath+0x12/0x6a Code: Bad RIP value. RIP [<0000000100000001>] 0x100000001 RSP <ffff8800ba9dba40> CR2: 0000000100000001 ---[ end trace 08eb65d42362793f ]---
--- include/net/netfilter/nf_queue.h | 2 ++ net/netfilter/core.c | 1 + net/netfilter/nf_internals.h | 1 + net/netfilter/nf_queue.c | 17 +++++++++++++++++ net/netfilter/nfnetlink_queue_core.c | 24 +++++++++++++++++++++++- 5 files changed, 44 insertions(+), 1 deletion(-)
include/net/netfilter/nf_queue.h +2 -0
@@ -24,6 +24,8 @@ struct nf_queue_entry {struct nf_queue_handler {int (*outfn)(struct nf_queue_entry *entry,unsigned int queuenum); +void (*nf_hook_drop)(struct net *net, +struct nf_hook_ops *ops); };void nf_register_queue_handler (const struct nf_queue_handler *qh);
net/netfilter/core.c +1 -0
@@ -89,6 +89,7 @@ void nf_unregister_hook(struct nf_hook_ostatic_key_slow_dec (&nf_hooks_needed[reg->pf][reg->hooknum]);#endif synchronize_net (); +nf_queue_nf_hook_drop (reg); }EXPORT_SYMBOL (nf_unregister_hook);
net/netfilter/nf_internals.h +1 -0
@@ -19,6 +19,7 @@ unsigned int nf_iterate(struct list_head/* nf_queue.c */ int nf_queue (struct sk_buff *skb,struct nf_hook_ops *elem,struct nf_hook_state *state,unsigned int queuenum); +void nf_queue_nf_hook_drop (struct nf_hook_ops *ops);int __init netfilter_queue_init (void );/* nf_log.c */
net/netfilter/nf_queue.c +17 -0
@@ -105,6 +105,23 @@ bool nf_queue_entry_get_refs(struct nf_q }EXPORT_SYMBOL_GPL (nf_queue_entry_get_refs); +void nf_queue_nf_hook_drop (struct nf_hook_ops *ops) +{ +const struct nf_queue_handler *qh; +struct net *net; + +rtnl_lock (); +rcu_read_lock (); + qh =rcu_dereference (queue_handler); +if (qh) { +for_each_net (net) { + qh->nf_hook_drop (net, ops); + } + } +rcu_read_unlock (); +rtnl_unlock (); +} +/* * Any packet that leaves via this function must come back * through nf_reinject().
net/netfilter/nfnetlink_queue_core.c +23 -1
@@ -824,6 +824,27 @@ static struct notifier_block nfqnl_dev_n .notifier_call = nfqnl_rcv_dev_event, }; +static int nf_hook_cmp (struct nf_queue_entry *entry,unsigned long ops_ptr) +{ +return entry->elem == (struct nf_hook_ops *)ops_ptr; +} + +static void nfqnl_nf_hook_drop (struct net *net,struct nf_hook_ops *hook) +{ +struct nfnl_queue_net *q =nfnl_queue_pernet (net); +int i; + +rcu_read_lock (); +for (i =0 ; i <INSTANCE_BUCKETS ; i++) { +struct nfqnl_instance *inst; +struct hlist_head *head = &q->instance_table[i]; + +hlist_for_each_entry_rcu (inst, head, hlist) +nfqnl_flush (inst, nf_hook_cmp, (unsigned long )hook); + } +rcu_read_unlock (); +} +static int nfqnl_rcv_nl_event (struct notifier_block *this,unsigned long event,void *ptr)
@@ -1031,7 +1052,8 @@ static const struct nla_policy nfqa_cfg_ };static const struct nf_queue_handler nfqh = { - .outfn = &nfqnl_enqueue_packet, + .outfn = &nfqnl_enqueue_packet, + .nf_hook_drop = &nfqnl_nf_hook_drop, }; static int
Greg Kroah-Hartman
maintainerPATCH 91/202 netfilter: nftables: Do not run chains in the wrong network namespace
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <[email protected]>
commit fdab6a4cbd8933092155449ca7253eba973ada14 upstream.
Currenlty nf_tables chains added in one network namespace are being run in all network namespace. The issues are myriad with the simplest being an unprivileged user can cause any network packets to be dropped.
Address this by simply not running nf_tables chains in the wrong network namespace.
--- net/netfilter/nf_tables_core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_core.c +6 -1
@@ -114,7 +114,8 @@ unsigned int nft_do_chain(struct nft_pktinfo *pkt, const struct nf_hook_ops *ops) { const struct nft_chain *chain = ops->priv, *basechain = chain; -const struct net *net =read_pnet (&nft_base_chain (basechain)->pnet); +const struct net *chain_net =read_pnet (&nft_base_chain (basechain)->pnet); +const struct net *net =dev_net (pkt->in ? pkt->in : pkt->out);const struct nft_rule *rule;const struct nft_expr *expr, *last;struct nft_regs regs;
@@ -124,6 +125,10 @@ nft_do_chain(struct nft_pktinfo *pkt, coint rulenum;unsigned int gencursor =nft_genmask_cur (net); +/* Ignore chains that are not for the current network namespace */ +if (!net_eq (net, chain_net)) +return NF_ACCEPT ; + do_chain: rulenum =0 ; rule = list_entry(&chain->rules, struct nft_rule, list);
Greg Kroah-Hartman
maintainerPATCH 92/202 netfilter: nf_log: wait for rcu grace after logger unregistration
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit ad5001cc7cdf9aaee5eb213fdee657e4a3c94776 upstream.
The nf_log_unregister() function needs to call synchronize_rcu() to make sure that the objects are not dereferenced anymore on module removal.
--- net/netfilter/nf_log.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/nf_log.c +1 -0
@@ -113,6 +113,7 @@ void nf_log_unregister(struct nf_loggerfor (i =0 ; i <NFPROTO_NUMPROTO ; i++)RCU_INIT_POINTER (loggers[i][logger->type],NULL );mutex_unlock (&nf_log_mutex); +synchronize_rcu (); }EXPORT_SYMBOL (nf_log_unregister);
Greg Kroah-Hartman
maintainerPATCH 93/202 netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit ba378ca9c04a5fc1b2cf0f0274a9d02eb3d1bad9 upstream.
Fix lookup of existing match/target structures in the corresponding list by skipping the family check if NFPROTO_UNSPEC is used.
This is resulting in the allocation and insertion of one match/target structure for each use of them. So this not only bloats memory consumption but also severely affects the time to reload the ruleset from the iptables-compat utility.
After this patch, iptables-compat-restore and iptables-compat take almost the same time to reload large rulesets.
--- net/netfilter/nft_compat.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
net/netfilter/nft_compat.c +18 -6
@@ -617,6 +617,13 @@ struct nft_xt {static struct nft_expr_type nft_match_type; +static bool nft_match_cmp (const struct xt_match *match, +const char *name,u32 rev,u32 family) +{ +return strcmp (match->name, name) ==0 && match->revision == rev && + (match->family ==NFPROTO_UNSPEC || match->family == family); +} +static const struct nft_expr_ops *nft_match_select_ops (const struct nft_ctx *ctx,const struct nlattr *const tb[])
@@ -624,7 +631,7 @@ nft_match_select_ops(const struct nft_ctstruct nft_xt *nft_match;struct xt_match *match;char *mt_name; -__u32 rev, family; +u32 rev, family; if (tb[NFTA_MATCH_NAME] == NULL || tb[NFTA_MATCH_REV] == NULL ||
@@ -639,8 +646,7 @@ nft_match_select_ops(const struct nft_ctlist_for_each_entry (nft_match, &nft_match_list, head) {struct xt_match *match = nft_match->ops.data; -if (strcmp (match->name, mt_name) ==0 && - match->revision == rev && match->family == family) { +if (nft_match_cmp (match, mt_name, rev, family)) {if (!try_module_get (match->me))return ERR_PTR (-ENOENT );
@@ -691,6 +697,13 @@ static LIST_HEAD(nft_target_list);static struct nft_expr_type nft_target_type; +static bool nft_target_cmp (const struct xt_target *tg, +const char *name,u32 rev,u32 family) +{ +return strcmp (tg->name, name) ==0 && tg->revision == rev && + (tg->family ==NFPROTO_UNSPEC || tg->family == family); +} +static const struct nft_expr_ops *nft_target_select_ops (const struct nft_ctx *ctx,const struct nlattr *const tb[])
@@ -698,7 +711,7 @@ nft_target_select_ops(const struct nft_cstruct nft_xt *nft_target;struct xt_target *target;char *tg_name; -__u32 rev, family; +u32 rev, family; if (tb[NFTA_TARGET_NAME] == NULL || tb[NFTA_TARGET_REV] == NULL ||
@@ -713,8 +726,7 @@ nft_target_select_ops(const struct nft_clist_for_each_entry (nft_target, &nft_target_list, head) {struct xt_target *target = nft_target->ops.data; -if (strcmp (target->name, tg_name) ==0 && - target->revision == rev && target->family == family) { +if (nft_target_cmp (target, tg_name, rev, family)) {if (!try_module_get (target->me))return ERR_PTR (-ENOENT );
Greg Kroah-Hartman
maintainerPATCH 94/202 netfilter: nf_log: dont zap all loggers on unregister
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit 205ee117d4dc4a11ac3bd9638bb9b2e839f4de9a upstream.
like nf_log_unset, nf_log_unregister must not reset the list of loggers. Otherwise, a call to nf_log_unregister() will render loggers of other nf protocols unusable:
iptables -A INPUT -j LOG
modprobe nf_log_arp ; rmmod nf_log_arp
iptables -A INPUT -j LOG
iptables: No chain/target/match by that name
--- net/netfilter/nf_log.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/netfilter/nf_log.c +6 -2
@@ -107,11 +107,15 @@ EXPORT_SYMBOL(nf_log_register);void nf_log_unregister (struct nf_logger *logger) { +const struct nf_logger *log;int i;mutex_lock (&nf_log_mutex); -for (i =0 ; i <NFPROTO_NUMPROTO ; i++) -RCU_INIT_POINTER (loggers[i][logger->type],NULL ); +for (i =0 ; i <NFPROTO_NUMPROTO ; i++) { + log =nft_log_dereference (loggers[i][logger->type]); +if (log == logger) +RCU_INIT_POINTER (loggers[i][logger->type],NULL ); + }mutex_unlock (&nf_log_mutex);synchronize_rcu (); }
Greg Kroah-Hartman
maintainerPATCH 95/202 Bluetooth: Delay check for conn->smp in smp_conn_security()
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hedberg <[email protected]>
commit d8949aad3eab5d396f4fefcd581773bf07b9a79e upstream.
There are several actions that smp_conn_security() might make that do not require a valid SMP context (conn->smp pointer). One of these actions is to encrypt the link with an existing LTK. If the SMP context wasn't initialized properly we should still allow the independent actions to be done, i.e. the check for the context should only be done at the last possible moment.
--- net/bluetooth/smp.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
net/bluetooth/smp.c +6 -6
@@ -2294,12 +2294,6 @@ int smp_conn_security(struct hci_conn *hif (!conn)return 1 ; - chan = conn->smp; -if (!chan) { -BT_ERR ("SMP security requested but not available" ); -return 1 ; - } -if (!hci_dev_test_flag (hcon->hdev,HCI_LE_ENABLED ))return 1 ;
@@ -2313,6 +2307,12 @@ int smp_conn_security(struct hci_conn *hif (smp_ltk_encrypt (conn, hcon->pending_sec_level))return 0 ; + chan = conn->smp; +if (!chan) { +BT_ERR ("SMP security requested but not available" ); +return 1 ; + } +l2cap_chan_lock (chan);/* If SMP is already in progress ignore this request */
Greg Kroah-Hartman
maintainerPATCH 96/202 NFS: Do cleanup before resetting pageio read/write to mds
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kinglong Mee <[email protected]>
commit 6f29b9bba7b08c6b1d6f2cc4cf750b342fc1946c upstream.
There is a reference leak of layout segment after resetting pageio read/write to mds.
--- fs/nfs/read.c | 3 +++ fs/nfs/write.c | 3 +++ 2 files changed, 6 insertions(+)
fs/nfs/read.c +3 -0
@@ -72,6 +72,9 @@ void nfs_pageio_reset_read_mds(struct nf {struct nfs_pgio_mirror *mirror; +if (pgio->pg_ops && pgio->pg_ops->pg_cleanup) + pgio->pg_ops->pg_cleanup (pgio); + pgio->pg_ops = &nfs_pgio_rw_ops;/* read path should never have more than one mirror */
fs/nfs/write.c +3 -0
@@ -1331,6 +1331,9 @@ void nfs_pageio_reset_write_mds(struct n {struct nfs_pgio_mirror *mirror; +if (pgio->pg_ops && pgio->pg_ops->pg_cleanup) + pgio->pg_ops->pg_cleanup (pgio); + pgio->pg_ops = &nfs_pgio_rw_ops;nfs_pageio_stop_mirroring (pgio);
Greg Kroah-Hartman
maintainerPATCH 97/202 nfs: fix pg_test page count calculation
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Tao <[email protected]>
commit 048883e0b934d9a5103d40e209cb14b7f33d2933 upstream.
We really want sizeof(struct page *) instead. Otherwise we limit maximum IO size to 64 pages rather than 512 pages on a 64bit system.
Fixes 2e11f829(nfs: cap request size to fit a kmalloced page array).
--- fs/nfs/pagelist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/pagelist.c +1 -1
@@ -508,7 +508,7 @@ size_t nfs_generic_pg_test(struct nfs_pa* for it without upsetting the slab allocator. */ if (((mirror->pg_count + req->wb_bytes) >>PAGE_SHIFT ) * -sizeof (struct page ) >PAGE_SIZE ) +sizeof (struct page *) >PAGE_SIZE )return 0 ;return min (mirror->pg_bsize - mirror->pg_count, (size_t )req->wb_bytes);
Greg Kroah-Hartman
maintainerPATCH 98/202 NFS: Fix a write performance regression
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 8fa4592a14ebb3c22a21d846d1e4f65dab7d1a7c upstream.
If all other conditions in nfs_can_extend_write() are met, and there are no locks, then we should be able to assume close-to-open semantics and the ability to extend our write to cover the whole page.
With this patch, the xfstests generic/074 test completes in 242s instead of >1400s on my test rig.
--- fs/nfs/write.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/write.c +1 -1
@@ -1203,7 +1203,7 @@ static int nfs_can_extend_write(struct freturn 1 ;if (!flctx || (list_empty_careful (&flctx->flc_flock) &&list_empty_careful (&flctx->flc_posix))) -return 0 ; +return 1 ;/* Check to see if there are whole file write locks */ ret =0 ;
Greg Kroah-Hartman
maintainerPATCH 99/202 Fix sec=krb5 on smb3 mounts
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
commit ceb1b0b9b4d1089e9f2731a314689ae17784c861 upstream.
Kerberos, which is very important for security, was only enabled for CIFS not SMB2/SMB3 mounts (e.g. vers=3.0)
Patch based on the information detailed in
http://thread.gmane.org/gmane.linux.kernel.cifs/10081/focus=10307
to enable Kerberized SMB2/SMB3
a) SMB2_negotiate: enable/use decode_negTokenInit in SMB2_negotiate
b) SMB2_sess_setup: handle Kerberos sectype and replicate Kerberos SMB1 processing done in sess_auth_kerberos
--- fs/cifs/smb2pdu.c | 76 +++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 61 insertions(+), 15 deletions(-)
fs/cifs/smb2pdu.c +61 -15
@@ -46,6 +46,7 @@#include "smb2status.h" #include "smb2glob.h" #include "cifspdu.h" +#include "cifs_spnego.h" /* * The following table defines the expected "StructureSize" of SMB2 requests
@@ -427,19 +428,15 @@ SMB2_negotiate(const unsigned int xid, scifs_dbg (FYI ,"missing security blob on negprot\n" ); rc =cifs_enable_signing (server, ses->sign); -#ifdef CONFIG_SMB2_ASN1 /* BB REMOVEME when updated asn1.c ready */ if (rc) goto neg_exit; -if (blob_length) +if (blob_length) { rc =decode_negTokenInit (security_blob, blob_length, server); -if (rc ==1 ) - rc =0 ; -else if (rc ==0 ) { - rc = -EIO ; - goto neg_exit; +if (rc ==1 ) + rc =0 ; +else if (rc ==0 ) + rc = -EIO ; } -#endif - neg_exit:free_rsp_buf (resp_buftype, rsp);return rc;
@@ -533,7 +530,8 @@ SMB2_sess_setup(const unsigned int xid,__le32 phase = NtLmNegotiate;/* NTLMSSP, if needed, is multistage */ struct TCP_Server_Info *server = ses->server;u16 blob_length =0 ; -char *security_blob; +struct key *spnego_key =NULL ; +char *security_blob =NULL ;char *ntlmssp_blob =NULL ;bool use_spnego = false;/* else use raw ntlmssp */
@@ -561,7 +559,8 @@ SMB2_sess_setup(const unsigned int xid, ses->ntlmssp->sesskey_per_smbsess = true;/* FIXME: allow for other auth types besides NTLMSSP (e.g. krb5) */ - ses->sectype = RawNTLMSSP; +if (ses->sectype != Kerberos && ses->sectype != RawNTLMSSP) + ses->sectype = RawNTLMSSP; ssetup_ntlmssp_authenticate:if (phase == NtLmChallenge)
@@ -590,7 +589,48 @@ ssetup_ntlmssp_authenticate: iov[0 ].iov_base = (char *)req;/* 4 for rfc1002 length field and 1 for pad */ iov[0 ].iov_len =get_rfc1002_length (req) +4 -1 ; -if (phase == NtLmNegotiate) { + +if (ses->sectype == Kerberos) { +#ifdef CONFIG_CIFS_UPCALL +struct cifs_spnego_msg *msg; + + spnego_key =cifs_get_spnego_key (ses); +if (IS_ERR (spnego_key)) { + rc =PTR_ERR (spnego_key); + spnego_key =NULL ; + goto ssetup_exit; + } + + msg = spnego_key->payload.data; +/* +* check version field to make sure that cifs.upcall is +* sending us a response in an expected form +*/ +if (msg->version !=CIFS_SPNEGO_UPCALL_VERSION ) { +cifs_dbg (VFS , +"bad cifs.upcall version. Expected %d got %d" , +CIFS_SPNEGO_UPCALL_VERSION , msg->version); + rc = -EKEYREJECTED ; + goto ssetup_exit; + } + ses->auth_key.response =kmemdup (msg->data, msg->sesskey_len, +GFP_KERNEL ); +if (!ses->auth_key.response) { +cifs_dbg (VFS , +"Kerberos can't allocate (%u bytes) memory" , + msg->sesskey_len); + rc = -ENOMEM ; + goto ssetup_exit; + } + ses->auth_key.len = msg->sesskey_len; + blob_length = msg->secblob_len; + iov[1 ].iov_base = msg->data + msg->sesskey_len; + iov[1 ].iov_len = blob_length; +#else + rc = -EOPNOTSUPP ; + goto ssetup_exit; +#endif /* CONFIG_CIFS_UPCALL */ + }else if (phase == NtLmNegotiate) {/* if not krb5 must be ntlmssp */ ntlmssp_blob =kmalloc (sizeof (struct _NEGOTIATE_MESSAGE ),GFP_KERNEL );if (ntlmssp_blob ==NULL ) {
@@ -613,6 +653,8 @@ ssetup_ntlmssp_authenticate:/* with raw NTLMSSP we don't encapsulate in SPNEGO */ security_blob = ntlmssp_blob; } + iov[1 ].iov_base = security_blob; + iov[1 ].iov_len = blob_length; }else if (phase == NtLmAuthenticate) { req->hdr.SessionId = ses->Suid; ntlmssp_blob = kzalloc(sizeof(struct _NEGOTIATE_MESSAGE) + 500,
@@ -640,6 +682,8 @@ ssetup_ntlmssp_authenticate: }else { security_blob = ntlmssp_blob; } + iov[1 ].iov_base = security_blob; + iov[1 ].iov_len = blob_length; }else {cifs_dbg (VFS ,"illegal ntlmssp phase\n" ); rc = -EIO ;
@@ -651,8 +695,6 @@ ssetup_ntlmssp_authenticate:cpu_to_le16 (sizeof (struct smb2_sess_setup_req ) -1 /* pad */ -4 /* rfc1001 len */ ); req->SecurityBufferLength =cpu_to_le16 (blob_length); - iov[1 ].iov_base = security_blob; - iov[1 ].iov_len = blob_length;inc_rfc1001_len (req, blob_length -1 /* pad */ );
@@ -663,6 +705,7 @@ ssetup_ntlmssp_authenticate:kfree (security_blob); rsp = (struct smb2_sess_setup_rsp *)iov[0 ].iov_base; + ses->Suid = rsp->hdr.SessionId;if (resp_buftype !=CIFS_NO_BUFFER && rsp->hdr.Status ==STATUS_MORE_PROCESSING_REQUIRED ) {if (phase != NtLmNegotiate) {
@@ -680,7 +723,6 @@ ssetup_ntlmssp_authenticate:/* NTLMSSP Negotiate sent now processing challenge (response) */ phase = NtLmChallenge;/* process ntlmssp challenge */ rc =0 ;/* MORE_PROCESSING is not an error here but expected */ - ses->Suid = rsp->hdr.SessionId; rc =decode_ntlmssp_challenge (rsp->Buffer,le16_to_cpu (rsp->SecurityBufferLength), ses); }
@@ -737,6 +779,10 @@ keygen_exit:kfree (ses->auth_key.response); ses->auth_key.response =NULL ; } +if (spnego_key) { +key_invalidate (spnego_key); +key_put (spnego_key); + }kfree (ses->ntlmssp);return rc;
Greg Kroah-Hartman
maintainerPATCH 100/202 disabling oplocks/leases via module parm enable_oplocks broken for SMB3
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
commit e0ddde9d44e37fbc21ce893553094ecf1a633ab5 upstream.
leases (oplocks) were always requested for SMB2/SMB3 even when oplocks disabled in the cifs.ko module.
--- fs/cifs/smb2ops.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/cifs/smb2ops.c +6 -2
@@ -50,9 +50,13 @@ change_conf(struct TCP_Server_Info *servbreak ;default : server->echoes = true; - server->oplocks = true; +if (enable_oplocks) { + server->oplocks = true; + server->oplock_credits =1 ; + }else + server->oplocks = false; + server->echo_credits =1 ; - server->oplock_credits =1 ; } server->credits -= server->echo_credits + server->oplock_credits;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 101/202 Do not fall back to SMBWriteX in set_file_size error cases
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
commit 646200a041203f440fb6fcf9cacd9efeda9de74c upstream.
The error paths in set_file_size for cifs and smb3 are incorrect.
In the unlikely event that a server did not support set file info of the file size, the code incorrectly falls back to trying SMBWriteX (note that only the original core SMB Write, used for example by DOS, can set the file size this way - this actually does not work for the more recent SMBWriteX). The idea was since the old DOS SMB Write could set the file size if you write zero bytes at that offset then use that if server rejects the normal set file info call.
Fortunately the SMBWriteX will never be sent on the wire (except when file size is zero) since the length and offset fields were reversed in the two places in this function that call SMBWriteX causing the fall back path to return an error. It is also important to never call an SMB request from an SMB2/sMB3 session (which theoretically would be possible, and can cause a brief session drop, although the client recovers) so this should be fixed. In practice this path does not happen with modern servers but the error fall back to SMBWriteX is clearly wrong.
Removing the calls to SMBWriteX in the error paths in cifs_set_file_size
Pointed out by PaX/grsecurity team
--- fs/cifs/inode.c | 36 +----------------------------------- 1 file changed, 1 insertion(+), 35 deletions(-)
fs/cifs/inode.c +1 -35
@@ -2034,7 +2034,6 @@ cifs_set_file_size(struct inode *inode,struct tcon_link *tlink =NULL ;struct cifs_tcon *tcon =NULL ;struct TCP_Server_Info *server; -struct cifs_io_parms io_parms;/* * To avoid spurious oplock breaks from server, in the case of
@@ -2056,18 +2055,6 @@ cifs_set_file_size(struct inode *inode, rc = -ENOSYS ;cifsFileInfo_put (open_file);cifs_dbg (FYI ,"SetFSize for attrs rc = %d\n" , rc); -if ((rc == -EINVAL ) || (rc == -EOPNOTSUPP )) { -unsigned int bytes_written; - - io_parms.netfid = open_file->fid.netfid; - io_parms.pid = open_file->pid; - io_parms.tcon = tcon; - io_parms.offset =0 ; - io_parms.length = attrs->ia_size; - rc =CIFSSMBWrite (xid, &io_parms, &bytes_written, -NULL ,NULL ,1 ); -cifs_dbg (FYI ,"Wrt seteof rc %d\n" , rc); - } }else rc = -EINVAL ;
@@ -2093,28 +2080,7 @@ cifs_set_file_size(struct inode *inode,else rc = -ENOSYS ;cifs_dbg (FYI ,"SetEOF by path (setattrs) rc = %d\n" , rc); -if ((rc == -EINVAL ) || (rc == -EOPNOTSUPP )) { -__u16 netfid; -int oplock =0 ; - - rc =SMBLegacyOpen (xid, tcon, full_path,FILE_OPEN , -GENERIC_WRITE ,CREATE_NOT_DIR , &netfid, - &oplock,NULL , cifs_sb->local_nls, -cifs_remap (cifs_sb)); -if (rc ==0 ) { -unsigned int bytes_written; - - io_parms.netfid = netfid; - io_parms.pid = current->tgid; - io_parms.tcon = tcon; - io_parms.offset =0 ; - io_parms.length = attrs->ia_size; - rc =CIFSSMBWrite (xid, &io_parms, &bytes_written,NULL , -NULL ,1 ); -cifs_dbg (FYI ,"wrt seteof rc %d\n" , rc); -CIFSSMBClose (xid, tcon, netfid); - } - } +if (tlink)cifs_put_tlink (tlink);
Greg Kroah-Hartman
maintainerPATCH 102/202 drm/qxl: only report first monitor as connected if we have no state
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <[email protected]>
commit 69e5d3f893e19613486f300fd6e631810338aa4b upstream.
If the server isn't new enough to give us state, report the first monitor as always connected, otherwise believe the server side.
--- drivers/gpu/drm/qxl/qxl_display.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/gpu/drm/qxl/qxl_display.c +7 -5
@@ -886,13 +886,15 @@ static enum drm_connector_status qxl_condrm_connector_to_qxl_output (connector);struct drm_device *ddev = connector->dev;struct qxl_device *qdev = ddev->dev_private; -int connected; +bool connected = false;/* The first monitor is always connected */ - connected = (output->index ==0 ) || - (qdev->client_monitors_config && - qdev->client_monitors_config->count > output->index && -qxl_head_enabled (&qdev->client_monitors_config->heads[output->index])); +if (!qdev->client_monitors_config) { +if (output->index ==0 ) + connected = true; + }else + connected = qdev->client_monitors_config->count > output->index && +qxl_head_enabled (&qdev->client_monitors_config->heads[output->index]);DRM_DEBUG ("#%d connected: %d\n" , output->index, connected);if (!connected)
Greg Kroah-Hartman
maintainerPATCH 104/202 drm/i915/bios: handle MIPI Sequence Block v3+ gracefully
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
commit cd67d226ebd909d239d2c6e5a6abd6e2a338d1cd upstream.
The VBT MIPI Sequence Block version 3 has forward incompatible changes:
First, the block size in the header has been specified reserved, and the actual size is a separate 32-bit value within the block. The current find_section() function to will only look at the size in the block header, and, depending on what's in that now reserved size field, continue looking for other sections in the wrong place.
Fix this by taking the new block size field into account. This will ensure that the lookups for other sections will work properly, as long as the new 32-bit size does not go beyond the opregion VBT mailbox size.
Second, the contents of the block have been completely changed. Gracefully refuse parsing the yet unknown data version.
--- drivers/gpu/drm/i915/intel_bios.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/intel_bios.c +11 -1
@@ -41,7 +41,7 @@ find_section(struct bdb_header *bdb, int {u8 *base = (u8 *)bdb;int index =0 ; -u16 total, current_size; +u32 total, current_size;u8 current_id;/* skip to first section */
@@ -56,6 +56,10 @@ find_section(struct bdb_header *bdb, int current_size = *((u16 *)(base + index)); index +=2 ; +/* The MIPI Sequence Block v3+ has a separate size field. */ +if (current_id ==BDB_MIPI_SEQUENCE && *(base + index) >=3 ) + current_size = *((const u32 *)(base + index +1 )); +if (index + current_size > total)return NULL ;
@@ -845,6 +849,12 @@ parse_mipi(struct drm_i915_private *dev_return ; } +/* Fail gracefully for forward incompatible sequence block. */ +if (sequence->version >=3 ) { +DRM_ERROR ("Unable to parse MIPI Sequence Block v3+\n" ); +return ; + } +DRM_DEBUG_DRIVER ("Found MIPI sequence block\n" ); block_size =get_blocksize (sequence);
Greg Kroah-Hartman
maintainerPATCH 105/202 drm: Reject DRI1 hw lock ioctl functions for kms drivers
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <[email protected]>
commit da168d81b44898404d281d5dbe70154ab5f117c1 upstream.
I've done some extensive history digging across libdrm, mesa and xf86-video-{intel,nouveau,ati}. The only potential user of this with kms drivers I could find was ttmtest, which once used drmGetLock still. But that mistake was quickly fixed up. Even the intel xvmc library (which otherwise was really good with using dri1 stuff in kms mode) managed to never take the hw lock for dri2 (and hence kms).
Hence it should be save to unconditionally disallow this.
--- drivers/gpu/drm/drm_lock.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_lock.c +6 -0
@@ -61,6 +61,9 @@ int drm_legacy_lock(struct drm_device *dstruct drm_master *master = file_priv->master;int ret =0 ; +if (drm_core_check_feature (dev,DRIVER_MODESET )) +return -EINVAL ; + ++file_priv->lock_count;if (lock->context ==DRM_KERNEL_CONTEXT ) {
@@ -153,6 +156,9 @@ int drm_legacy_unlock(struct drm_devicestruct drm_lock *lock = data;struct drm_master *master = file_priv->master; +if (drm_core_check_feature (dev,DRIVER_MODESET )) +return -EINVAL ; +if (lock->context ==DRM_KERNEL_CONTEXT ) {DRM_ERROR ("Process %d using kernel context %d\n" ,task_pid_nr (current), lock->context);
Greg Kroah-Hartman
maintainerPATCH 107/202 drm/dp/mst: drop cancel work sync in the mstb destroy path (v2)
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <[email protected]>
commit 274d83524895fe41ca8debae4eec60ede7252bb5 upstream.
Since 9eb1e57f564d4e6e10991402726cc83fe0b9172f drm/dp/mst: make sure mst_primary mstb is valid in work function
we validate the mstb structs in the work function, and doing that takes a reference. So we should never get here with the work function running using the mstb device, only if the work function hasn't run yet or is running for another mstb.
So we don't need to sync the work here, this was causing lockdep spew as below.
[ +0.000160] =============================================
[ +0.000001] [ INFO: possible recursive locking detected ]
[ +0.000002] 3.10.0-320.el7.rhel72.stable.backport.3.x86_64.debug #1 Tainted: G W ------------
[ +0.000001] ---------------------------------------------
[ +0.000001] kworker/4:2/1262 is trying to acquire lock:
[ +0.000001] ((&mgr->work)){+.+.+.}, at: [<ffffffff810b29a5>] flush_work+0x5/0x2e0
[ +0.000007]but task is already holding lock:
[ +0.000001] ((&mgr->work)){+.+.+.}, at: [<ffffffff810b57e4>] process_one_work+0x1b4/0x710 [ +0.000004]
other info that might help us debug this:
[ +0.000001] Possible unsafe locking scenario:
[ +0.000002] CPU0 [ +0.000000] ---- [ +0.000001] lock((&mgr->work)); [ +0.000002] lock((&mgr->work)); [ +0.000001]
*** DEADLOCK ***
[ +0.000001] May be due to missing lock nesting notation
[ +0.000002] 2 locks held by kworker/4:2/1262:
[ +0.000001] #0: (events_long){.+.+.+}, at: [<ffffffff810b57e4>] process_one_work+0x1b4/0x710
[ +0.000004] #1: ((&mgr->work)){+.+.+.}, at: [<ffffffff810b57e4>] process_one_work+0x1b4/0x710
[ +0.000003]
stack backtrace:
[ +0.000003] CPU: 4 PID: 1262 Comm: kworker/4:2 Tainted: G W ------------ 3.10.0-320.el7.rhel72.stable.backport.3.x86_64.debug #1
[ +0.000001] Hardware name: LENOVO 20EGS0R600/20EGS0R600, BIOS GNET71WW (2.19 ) 02/05/2015
[ +0.000008] Workqueue: events_long drm_dp_mst_link_probe_work [drm_kms_helper]
[ +0.000001] ffffffff82c26c90 00000000a527b914 ffff88046399bae8 ffffffff816fe04d
[ +0.000004] ffff88046399bb58 ffffffff8110f47f ffff880461438000 0001009b840fc003
[ +0.000002] ffff880461438a98 0000000000000000 0000000804dc26e1 ffffffff824a2c00
[ +0.000003] Call Trace:
[ +0.000004] [<ffffffff816fe04d>] dump_stack+0x19/0x1b
[ +0.000004] [<ffffffff8110f47f>] __lock_acquire+0x115f/0x1250
[ +0.000002] [<ffffffff8110fd49>] lock_acquire+0x99/0x1e0
[ +0.000002] [<ffffffff810b29a5>] ? flush_work+0x5/0x2e0
[ +0.000002] [<ffffffff810b29ee>] flush_work+0x4e/0x2e0
[ +0.000002] [<ffffffff810b29a5>] ? flush_work+0x5/0x2e0
[ +0.000004] [<ffffffff81025905>] ? native_sched_clock+0x35/0x80
[ +0.000002] [<ffffffff81025959>] ? sched_clock+0x9/0x10
[ +0.000002] [<ffffffff810da1f5>] ? local_clock+0x25/0x30
[ +0.000002] [<ffffffff8110dca9>] ? mark_held_locks+0xb9/0x140
[ +0.000003] [<ffffffff810b4ed5>] ? __cancel_work_timer+0x95/0x160
[ +0.000002] [<ffffffff810b4ee8>] __cancel_work_timer+0xa8/0x160
[ +0.000002] [<ffffffff810b4fb0>] cancel_work_sync+0x10/0x20
[ +0.000007] [<ffffffffa0160d17>] drm_dp_destroy_mst_branch_device+0x27/0x120 [drm_kms_helper]
[ +0.000006] [<ffffffffa0163968>] drm_dp_mst_link_probe_work+0x78/0xa0 [drm_kms_helper]
[ +0.000002] [<ffffffff810b5850>] process_one_work+0x220/0x710
[ +0.000002] [<ffffffff810b57e4>] ? process_one_work+0x1b4/0x710
[ +0.000005] [<ffffffff810b5e5b>] worker_thread+0x11b/0x3a0
[ +0.000003] [<ffffffff810b5d40>] ? process_one_work+0x710/0x710
[ +0.000002] [<ffffffff810beced>] kthread+0xed/0x100
[ +0.000003] [<ffffffff810bec00>] ? insert_kthread_work+0x80/0x80
[ +0.000003] [<ffffffff817121d8>] ret_from_fork+0x58/0x90v2: add flush_work.
--- drivers/gpu/drm/drm_dp_mst_topology.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_dp_mst_topology.c +3 -2
@@ -804,8 +804,6 @@ static void drm_dp_destroy_mst_branch_destruct drm_dp_mst_port *port, *tmp;bool wake_tx = false; -cancel_work_sync (&mstb->mgr->work); -/* * destroy all ports - don't need lock * as there are no more references to the mst branch
@@ -1977,6 +1975,8 @@ void drm_dp_mst_topology_mgr_suspend(strdrm_dp_dpcd_writeb (mgr->aux,DP_MSTM_CTRL ,DP_MST_EN |DP_UPSTREAM_IS_SRC );mutex_unlock (&mgr->lock); +flush_work (&mgr->work); +flush_work (&mgr->destroy_connector_work); }EXPORT_SYMBOL (drm_dp_mst_topology_mgr_suspend);
@@ -2730,6 +2730,7 @@ EXPORT_SYMBOL(drm_dp_mst_topology_mgr_in*/ void drm_dp_mst_topology_mgr_destroy (struct drm_dp_mst_topology_mgr *mgr) { +flush_work (&mgr->work);flush_work (&mgr->destroy_connector_work);mutex_lock (&mgr->payload_lock);kfree (mgr->payloads);
Greg Kroah-Hartman
maintainerPATCH 108/202 USB: whiteheat: fix potential null-deref at probe
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit cbb4be652d374f64661137756b8f357a1827d6a4 upstream.
Fix potential null-pointer dereference at probe by making sure that the required endpoints are present.
The whiteheat driver assumes there are at least five pairs of bulk endpoints, of which the final pair is used for the "command port". An attempt to bind to an interface with fewer bulk endpoints would currently lead to an oops.
Fixes CVE-2015-5257.
--- drivers/usb/serial/whiteheat.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+)
drivers/usb/serial/whiteheat.c +31 -0
@@ -80,6 +80,8 @@ static int whiteheat_firmware_download(static int whiteheat_firmware_attach (struct usb_serial *serial);/* function prototypes for the Connect Tech WhiteHEAT serial converter */ +static int whiteheat_probe (struct usb_serial *serial, +const struct usb_device_id *id);static int whiteheat_attach (struct usb_serial *serial);static void whiteheat_release (struct usb_serial *serial);static int whiteheat_port_probe (struct usb_serial_port *port);
@@ -116,6 +118,7 @@ static struct usb_serial_driver whitehea .description = "Connect Tech - WhiteHEAT", .id_table = id_table_std, .num_ports = 4, + .probe = whiteheat_probe, .attach = whiteheat_attach, .release = whiteheat_release, .port_probe = whiteheat_port_probe,
@@ -217,6 +220,34 @@ static int whiteheat_firmware_attach(str/***************************************************************************** * Connect Tech's White Heat serial driver functions *****************************************************************************/ + +static int whiteheat_probe (struct usb_serial *serial, +const struct usb_device_id *id) +{ +struct usb_host_interface *iface_desc; +struct usb_endpoint_descriptor *endpoint; +size_t num_bulk_in =0 ; +size_t num_bulk_out =0 ; +size_t min_num_bulk; +unsigned int i; + + iface_desc = serial->interface->cur_altsetting; + +for (i =0 ; i < iface_desc->desc.bNumEndpoints; i++) { + endpoint = &iface_desc->endpoint[i].desc; +if (usb_endpoint_is_bulk_in (endpoint)) + ++num_bulk_in; +if (usb_endpoint_is_bulk_out (endpoint)) + ++num_bulk_out; + } + + min_num_bulk =COMMAND_PORT +1 ; +if (num_bulk_in < min_num_bulk || num_bulk_out < min_num_bulk) +return -ENODEV ; + +return 0 ; +} +static int whiteheat_attach (struct usb_serial *serial) {struct usb_serial_port *command_port;
Greg Kroah-Hartman
maintainerPATCH 109/202 xhci: give command abortion one more chance before killing xhci
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit a6809ffd1687b3a8c192960e69add559b9d32649 upstream.
We want to give the command abortion an additional try to stop the command ring before we completely hose xhci.
--- drivers/usb/host/xhci-ring.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/host/xhci-ring.c +9 -0
@@ -302,6 +302,15 @@ static int xhci_abort_cmd_ring(struct xh ret =xhci_handshake (&xhci->op_regs->cmd_ring,CMD_RING_RUNNING ,0 ,5 *1000 *1000 );if (ret <0 ) { +/* we are about to kill xhci, give it one more chance */ +xhci_write_64 (xhci, temp_64 |CMD_RING_ABORT , + &xhci->op_regs->cmd_ring); +udelay (1000 ); + ret =xhci_handshake (&xhci->op_regs->cmd_ring, +CMD_RING_RUNNING ,0 ,3 *1000 *1000 ); +if (ret ==0 ) +return 0 ; +xhci_err (xhci,"Stopped the command ring failed, " "maybe the host is dead\n" ); xhci->xhc_state |=XHCI_STATE_DYING ;
Greg Kroah-Hartman
maintainerPATCH 110/202 usb: xhci: lock mutex on xhci_stop
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <[email protected]>
commit 85ac90f8953a58f6a057b727bc9db97721e3fb8e upstream.
Else it races with xhci_setup_device
--- drivers/usb/host/xhci.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/host/xhci.c +4 -0
@@ -683,8 +683,11 @@ void xhci_stop(struct usb_hcd *hcd)u32 temp;struct xhci_hcd *xhci =hcd_to_xhci (hcd); +mutex_lock (&xhci->mutex); +if (!usb_hcd_is_primary_hcd (hcd)) {xhci_only_stop_hcd (xhci->shared_hcd); +mutex_unlock (&xhci->mutex);return ; }
@@ -723,6 +726,7 @@ void xhci_stop(struct usb_hcd *hcd)xhci_dbg_trace (xhci, trace_xhci_dbg_init,"xhci_stop completed - status = %x" ,readl (&xhci->op_regs->status)); +mutex_unlock (&xhci->mutex); }/*
Greg Kroah-Hartman
maintainerPATCH 111/202 usb: xhci: Clear XHCI_STATE_DYING on start
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <[email protected]>
commit e5bfeab0ad515b4f6df39fe716603e9dc6d3dfd0 upstream.
For whatever reason if XHCI died in the previous instant then it will never recover on the next xhci_start unless we clear the DYING flag.
--- drivers/usb/host/xhci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/host/xhci.c +2 -1
@@ -146,7 +146,8 @@ static int xhci_start(struct xhci_hcd *x"waited %u microseconds.\n" , XHCI_MAX_HALT_USEC);if (!ret) - xhci->xhc_state &= ~XHCI_STATE_HALTED ; + xhci->xhc_state &= ~(XHCI_STATE_HALTED |XHCI_STATE_DYING ); +return ret; }
Greg Kroah-Hartman
maintainerPATCH 112/202 usb: xhci: exit early in xhci_setup_device() if were halted or dying
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <[email protected]>
commit 448116bfa856d3c076fa7178ed96661a008a5d45 upstream.
During quick plug/removal of OTG adapter during dual-role testing it can happen that xhci_alloc_device() is called for the newly detected device after the DRD library has called xhci_stop to remove the HCD.
If that is the case, just fail early to prevent the following warning.
[ 154.732649] hub 4-0:1.0: USB hub found [ 154.742204] hub 4-0:1.0: 1 port detected [ 154.824458] hub 3-0:1.0: state 7 ports 1 chg 0002 evt 0000 [ 154.854609] hub 4-0:1.0: state 7 ports 1 chg 0000 evt 0000 [ 154.944430] usb 3-1: new high-speed USB device number 2 using xhci-hcd [ 154.951009] xhci-hcd xhci-hcd.0.auto: xhci_setup_device [ 155.038191] xhci-hcd xhci-hcd.0.auto: remove, state 4 [ 155.043315] usb usb4: USB disconnect, device number 1 [ 155.055270] xhci-hcd xhci-hcd.0.auto: xhci_stop [ 155.060094] xhci-hcd xhci-hcd.0.auto: USB bus 4 deregistered [ 155.066576] xhci-hcd xhci-hcd.0.auto: remove, state 1 [ 155.071710] usb usb3: USB disconnect, device number 1 [ 155.077124] xhci-hcd xhci-hcd.0.auto: xhci_setup_device [ 155.082389] ------------[ cut here ]------------ [ 155.087690] WARNING: CPU: 0 PID: 72 at drivers/usb/host/xhci.c:3800 xhci_setup_device+0x410/0x484 [xhci_hcd]() [ 155.097861] Modules linked in: sd_mod usb_storage scsi_mod usb_f_ss_lb g_zero libcomposite ipv6 xhci_plat_hcd xhci_hcd usbcore dwc3 udc_core evdev ti_am335x_adc joydev kfifo_buf industrialio snd_soc_simple_cc [ 155.146734] CPU: 0 PID: 72 Comm: kworker/0:3 Tainted: G W 4.1.4-00834-gcd9380b-dirty #50 [ 155.156073] Hardware name: Generic AM43 (Flattened Device Tree) [ 155.162117] Workqueue: usb_hub_wq hub_event [usbcore] [ 155.167249] Backtrace: [ 155.169751] [<c0012af0>] (dump_backtrace) from [<c0012c8c>] (show_stack+0x18/0x1c) [ 155.177390] r6:c089d4a4 r5:ffffffff r4:00000000 r3:ee46c000 [ 155.183137] [<c0012c74>] (show_stack) from [<c05f7c14>] (dump_stack+0x84/0xd0) [ 155.190446] [<c05f7b90>] (dump_stack) from [<c00439ac>] (warn_slowpath_common+0x80/0xbc) [ 155.198605] r7:00000009 r6:00000ed8 r5:bf27eb70 r4:00000000 [ 155.204348] [<c004392c>] (warn_slowpath_common) from [<c0043a0c>] (warn_slowpath_null+0x24/0x2c) [ 155.213202] r8:ee49f000 r7:ee7c0004 r6:00000000 r5:ee7c0158 r4:ee7c0000 [ 155.220051] [<c00439e8>] (warn_slowpath_null) from [<bf27eb70>] (xhci_setup_device+0x410/0x484 [xhci_hcd]) [ 155.229816] [<bf27e760>] (xhci_setup_device [xhci_hcd]) from [<bf27ec10>] (xhci_address_device+0x14/0x18 [xhci_hcd]) [ 155.240415] r10:ee598200 r9:00000001 r8:00000002 r7:00000001 r6:00000003 r5:00000002 [ 155.248363] r4:ee49f000 [ 155.250978] [<bf27ebfc>] (xhci_address_device [xhci_hcd]) from [<bf20cb94>] (hub_port_init+0x1b8/0xa9c [usbcore]) [ 155.261403] [<bf20c9dc>] (hub_port_init [usbcore]) from [<bf2101e0>] (hub_event+0x738/0x1020 [usbcore]) [ 155.270874] r10:ee598200 r9:ee7c0000 r8:ee7c0038 r7:ee518800 r6:ee49f000 r5:00000001 [ 155.278822] r4:00000000 [ 155.281426] [<bf20faa8>] (hub_event [usbcore]) from [<c005754c>] (process_one_work+0x128/0x340) [ 155.290196] r10:00000000 r9:00000003 r8:00000000 r7:fedfa000 r6:eeec5400 r5:ee598314 [ 155.298151] r4:ee434380 [ 155.300718] [<c0057424>] (process_one_work) from [<c00578f8>] (worker_thread+0x158/0x49c) [ 155.308963] r10:ee434380 r9:00000003 r8:eeec5400 r7:00000008 r6:ee434398 r5:eeec5400 [ 155.316913] r4:eeec5414 [ 155.319482] [<c00577a0>] (worker_thread) from [<c005cc40>] (kthread+0xdc/0xf8) [ 155.326765] r10:00000000 r9:00000000 r8:00000000 r7:c00577a0 r6:ee434380 r5:ee4441c0 [ 155.334713] r4:00000000 r3:00000000 [ 155.338341] [<c005cb64>] (kthread) from [<c000fc08>] (ret_from_fork+0x14/0x2c) [ 155.345626] r7:00000000 r6:00000000 r5:c005cb64 r4:ee4441c0 [ 155.356108] ---[ end trace a58d34c223b190e6 ]--- [ 155.360783] xhci-hcd xhci-hcd.0.auto: Virt dev invalid for slot_id 0x1! [ 155.574404] xhci-hcd xhci-hcd.0.auto: xhci_setup_device [ 155.579667] ------------[ cut here ]------------
--- drivers/usb/host/xhci.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/host/xhci.c +3 -0
@@ -3795,6 +3795,9 @@ static int xhci_setup_device(struct usb_mutex_lock (&xhci->mutex); +if (xhci->xhc_state)/* dying or halted */ + goto out; +if (!udev->slot_id) {xhci_dbg_trace (xhci, trace_xhci_dbg_address,"Bad Slot ID %d" , udev->slot_id);
Greg Kroah-Hartman
maintainerPATCH 113/202 xhci: change xhci 1.0 only restrictions to support xhci 1.1
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit dca7794539eff04b786fb6907186989e5eaaa9c2 upstream.
Some changes between xhci 0.96 and xhci 1.0 specifications forced us to check the hci version in code, some of these checks were implemented as hci_version == 1.0, which will not work with new xhci 1.1 controllers.
xhci 1.1 behaves similar to xhci 1.0 in these cases, so change these checks to hci_version >= 1.0
--- drivers/usb/host/xhci-mem.c | 6 +++--- drivers/usb/host/xhci-ring.c | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-)
drivers/usb/host/xhci-mem.c +3 -3
@@ -1498,10 +1498,10 @@ int xhci_endpoint_init(struct xhci_hcd ** use Event Data TRBs, and we don't chain in a link TRB on short * transfers, we're basically dividing by 1. * -* xHCI 1.0 specification indicates that the Average TRB Length should -* be set to 8 for control endpoints. +* xHCI 1.0 and 1.1 specification indicates that the Average TRB Length +* should be set to 8 for control endpoints. */ -if (usb_endpoint_xfer_control (&ep->desc) && xhci->hci_version ==0x100 ) +if (usb_endpoint_xfer_control (&ep->desc) && xhci->hci_version >=0x100 ) ep_ctx->tx_info |=cpu_to_le32 (AVG_TRB_LENGTH_FOR_EP (8 ));else ep_ctx->tx_info |=
drivers/usb/host/xhci-ring.c +2 -2
@@ -3394,8 +3394,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *if (start_cycle ==0 ) field |=0x1 ; -/* xHCI 1.0 6.4.1.2.1: Transfer Type field */ -if (xhci->hci_version ==0x100 ) { +/* xHCI 1.0/1.1 6.4.1.2.1: Transfer Type field */ +if (xhci->hci_version >=0x100 ) {if (urb->transfer_buffer_length >0 ) {if (setup->bRequestType &USB_DIR_IN ) field |=TRB_TX_TYPE (TRB_DATA_IN );
Greg Kroah-Hartman
maintainerPATCH 114/202 xhci: init command timeout timer earlier to avoid deleting it uninitialized
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit cc8e4fc0c3b5e8340bc8358990515d116a3c274c upstream.
Don't check if timer is running with a timer_pending() before deleting it with del_timer_sync(), this defies the whole point of the sync part and can cause a possible race.
Instead we just want to make sure the timer is initialized early enough before we have a chance to delete it.
--- drivers/usb/host/xhci-mem.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/usb/host/xhci-mem.c +5 -6
@@ -1792,8 +1792,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xint size;int i, j, num_ports; -if (timer_pending (&xhci->cmd_timer)) -del_timer_sync (&xhci->cmd_timer); +del_timer_sync (&xhci->cmd_timer);/* Free the Event Ring Segment Table and the actual Event Ring */ size =sizeof (struct xhci_erst_entry )*(xhci->erst.num_entries);
@@ -2321,6 +2320,10 @@ int xhci_mem_init(struct xhci_hcd *xhci,INIT_LIST_HEAD (&xhci->cmd_list); +/* init command timeout timer */ +setup_timer (&xhci->cmd_timer, xhci_handle_command_timeout, + (unsigned long )xhci); + page_size =readl (&xhci->op_regs->page_size);xhci_dbg_trace (xhci, trace_xhci_dbg_init,"Supported page size register = 0x%x" , page_size);
@@ -2505,10 +2508,6 @@ int xhci_mem_init(struct xhci_hcd *xhci, "Wrote ERST address to ir_set 0.");xhci_print_ir_set (xhci,0 ); -/* init command timeout timer */ -setup_timer (&xhci->cmd_timer, xhci_handle_command_timeout, - (unsigned long )xhci); -/* * XXX: Might need to set the Interrupter Moderation Register to * something other than the default (~1ms minimum between interrupts).
Greg Kroah-Hartman
maintainerPATCH 115/202 usb: xhci: Add support for URB_ZERO_PACKET to bulk/sg transfers
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Reyad Attiyat <[email protected]>
commit 4758dcd19a7d9ba9610b38fecb93f65f56f86346 upstream.
This commit checks for the URB_ZERO_PACKET flag and creates an extra zero-length td if the urb transfer length is a multiple of the endpoint's max packet length.
--- drivers/usb/host/xhci-ring.c | 66 +++++++++++++++++++++++++++++++++---------- drivers/usb/host/xhci.c | 5 +++ 2 files changed, 57 insertions(+), 14 deletions(-)
drivers/usb/host/xhci-ring.c +52 -14
@@ -3050,9 +3050,11 @@ static int queue_bulk_sg_tx(struct xhci_struct xhci_td *td;struct scatterlist *sg;int num_sgs; -int trb_buff_len, this_sg_len, running_total; +int trb_buff_len, this_sg_len, running_total, ret;unsigned int total_packet_count; +bool zero_length_needed;bool first_trb; +int last_trb_num;u64 addr;bool more_trbs_coming;
@@ -3068,13 +3070,27 @@ static int queue_bulk_sg_tx(struct xhci_ total_packet_count =DIV_ROUND_UP (urb->transfer_buffer_length,usb_endpoint_maxp (&urb->ep->desc)); - trb_buff_len =prepare_transfer (xhci, xhci->devs[slot_id], + ret =prepare_transfer (xhci, xhci->devs[slot_id], ep_index, urb->stream_id, num_trbs, urb,0 , mem_flags); -if (trb_buff_len <0 ) -return trb_buff_len; +if (ret <0 ) +return ret; urb_priv = urb->hcpriv; + +/* Deal with URB_ZERO_PACKET - need one more td/trb */ + zero_length_needed = urb->transfer_flags &URB_ZERO_PACKET && + urb_priv->length ==2 ; +if (zero_length_needed) { + num_trbs++; +xhci_dbg (xhci,"Creating zero length td.\n" ); + ret =prepare_transfer (xhci, xhci->devs[slot_id], + ep_index, urb->stream_id, +1 , urb,1 , mem_flags); +if (ret <0 ) +return ret; + } + td = urb_priv->td[0 ];/*
@@ -3104,6 +3120,7 @@ static int queue_bulk_sg_tx(struct xhci_ trb_buff_len = urb->transfer_buffer_length; first_trb = true; + last_trb_num = zero_length_needed ?2 :1 ;/* Queue the first TRB, even if it's zero-length */ do { u32 field = 0;
@@ -3121,12 +3138,15 @@ static int queue_bulk_sg_tx(struct xhci_/* Chain all the TRBs together; clear the chain bit in the last * TRB to indicate it's the last TRB in the chain. */ -if (num_trbs >1 ) { +if (num_trbs > last_trb_num) { field |=TRB_CHAIN ; - }else { -/* FIXME - add check for ZERO_PACKET flag before this */ + }else if (num_trbs == last_trb_num) { td->last_trb = ep_ring->enqueue; field |=TRB_IOC ; + }else if (zero_length_needed && num_trbs ==1 ) { + trb_buff_len =0 ; + urb_priv->td[1 ]->last_trb = ep_ring->enqueue; + field |=TRB_IOC ; }/* Only set interrupt on short packet for IN endpoints */
@@ -3188,7 +3208,7 @@ static int queue_bulk_sg_tx(struct xhci_if (running_total + trb_buff_len > urb->transfer_buffer_length) trb_buff_len = urb->transfer_buffer_length - running_total; - }while (running_total < urb->transfer_buffer_length); + }while (num_trbs >0 );check_trb_math (urb, num_trbs, running_total); giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
@@ -3206,7 +3226,9 @@ int xhci_queue_bulk_tx(struct xhci_hcd *int num_trbs;struct xhci_generic_trb *start_trb;bool first_trb; +int last_trb_num;bool more_trbs_coming; +bool zero_length_needed;int start_cycle;u32 field, length_field;
@@ -3237,7 +3259,6 @@ int xhci_queue_bulk_tx(struct xhci_hcd * num_trbs++; running_total +=TRB_MAX_BUFF_SIZE ; } -/* FIXME: this doesn't deal with URB_ZERO_PACKET - need one more */ ret = prepare_transfer(xhci, xhci->devs[slot_id], ep_index, urb->stream_id,
@@ -3246,6 +3267,20 @@ int xhci_queue_bulk_tx(struct xhci_hcd *return ret; urb_priv = urb->hcpriv; + +/* Deal with URB_ZERO_PACKET - need one more td/trb */ + zero_length_needed = urb->transfer_flags &URB_ZERO_PACKET && + urb_priv->length ==2 ; +if (zero_length_needed) { + num_trbs++; +xhci_dbg (xhci,"Creating zero length td.\n" ); + ret =prepare_transfer (xhci, xhci->devs[slot_id], + ep_index, urb->stream_id, +1 , urb,1 , mem_flags); +if (ret <0 ) +return ret; + } + td = urb_priv->td[0 ];/*
@@ -3267,7 +3302,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd * trb_buff_len = urb->transfer_buffer_length; first_trb = true; - + last_trb_num = zero_length_needed ?2 :1 ;/* Queue the first TRB, even if it's zero-length */ do { u32 remainder = 0;
@@ -3284,12 +3319,15 @@ int xhci_queue_bulk_tx(struct xhci_hcd */* Chain all the TRBs together; clear the chain bit in the last * TRB to indicate it's the last TRB in the chain. */ -if (num_trbs >1 ) { +if (num_trbs > last_trb_num) { field |=TRB_CHAIN ; - }else { -/* FIXME - add check for ZERO_PACKET flag before this */ + }else if (num_trbs == last_trb_num) { td->last_trb = ep_ring->enqueue; field |=TRB_IOC ; + }else if (zero_length_needed && num_trbs ==1 ) { + trb_buff_len =0 ; + urb_priv->td[1 ]->last_trb = ep_ring->enqueue; + field |=TRB_IOC ; }/* Only set interrupt on short packet for IN endpoints */
@@ -3327,7 +3365,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd * trb_buff_len = urb->transfer_buffer_length - running_total;if (trb_buff_len >TRB_MAX_BUFF_SIZE ) trb_buff_len =TRB_MAX_BUFF_SIZE ; - }while (running_total < urb->transfer_buffer_length); + }while (num_trbs >0 );check_trb_math (urb, num_trbs, running_total); giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
drivers/usb/host/xhci.c +5 -0
@@ -1345,6 +1345,11 @@ int xhci_urb_enqueue(struct usb_hcd *hcdif (usb_endpoint_xfer_isoc (&urb->ep->desc)) size = urb->number_of_packets; +else if (usb_endpoint_is_bulk_out (&urb->ep->desc) && + urb->transfer_buffer_length >0 && + urb->transfer_flags &URB_ZERO_PACKET && + !(urb->transfer_buffer_length %usb_endpoint_maxp (&urb->ep->desc))) + size =2 ;else size =1 ;
Greg Kroah-Hartman
maintainerPATCH 116/202 Initialize msg/shm IPC objects before doing ipc_addid()
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit b9a532277938798b53178d5a66af6e2915cb27cf upstream.
As reported by Dmitry Vyukov, we really shouldn't do ipc_addid() before having initialized the IPC object state. Yes, we initialize the IPC object in a locked state, but with all the lockless RCU lookup work, that IPC object lock no longer means that the state cannot be seen.
We already did this for the IPC semaphore code (see commit e8577d1f0329:
"ipc/sem.c: fully initialize sem_array before making it visible") but we clearly forgot about msg and shm.
--- ipc/msg.c | 14 +++++++------- ipc/shm.c | 13 +++++++------ ipc/util.c | 8 ++++---- 3 files changed, 18 insertions(+), 17 deletions(-)
ipc/msg.c +7 -7
@@ -137,13 +137,6 @@ static int newque(struct ipc_namespace *return retval; } -/* ipc_addid() locks msq upon success. */ - id =ipc_addid (&msg_ids (ns), &msq->q_perm, ns->msg_ctlmni); -if (id <0 ) { -ipc_rcu_putref (msq, msg_rcu_free); -return id; - } - msq->q_stime = msq->q_rtime =0 ; msq->q_ctime =get_seconds (); msq->q_cbytes = msq->q_qnum =0 ;
@@ -153,6 +146,13 @@ static int newque(struct ipc_namespace *INIT_LIST_HEAD (&msq->q_receivers);INIT_LIST_HEAD (&msq->q_senders); +/* ipc_addid() locks msq upon success. */ + id =ipc_addid (&msg_ids (ns), &msq->q_perm, ns->msg_ctlmni); +if (id <0 ) { +ipc_rcu_putref (msq, msg_rcu_free); +return id; + } +ipc_unlock_object (&msq->q_perm);rcu_read_unlock ();
ipc/shm.c +7 -6
@@ -550,12 +550,6 @@ static int newseg(struct ipc_namespace *if (IS_ERR (file)) goto no_file; - id =ipc_addid (&shm_ids (ns), &shp->shm_perm, ns->shm_ctlmni); -if (id <0 ) { - error = id; - goto no_id; - } - shp->shm_cprid =task_tgid_vnr (current); shp->shm_lprid =0 ; shp->shm_atim = shp->shm_dtim =0 ;
@@ -564,6 +558,13 @@ static int newseg(struct ipc_namespace * shp->shm_nattch =0 ; shp->shm_file = file; shp->shm_creator = current; + + id =ipc_addid (&shm_ids (ns), &shp->shm_perm, ns->shm_ctlmni); +if (id <0 ) { + error = id; + goto no_id; + } +list_add (&shp->shm_clist, ¤t->sysvshm.shm_clist);/*
ipc/util.c +4 -4
@@ -237,6 +237,10 @@ int ipc_addid(struct ipc_ids *ids, strucrcu_read_lock ();spin_lock (&new->lock); +current_euid_egid (&euid, &egid); + new->cuid = new->uid = euid; + new->gid = new->cgid = egid; + id =idr_alloc (&ids->ipcs_idr, new, (next_id <0 ) ?0 :ipcid_to_idx (next_id),0 ,GFP_NOWAIT );
@@ -249,10 +253,6 @@ int ipc_addid(struct ipc_ids *ids, struc ids->in_use++; -current_euid_egid (&euid, &egid); - new->cuid = new->uid = euid; - new->gid = new->cgid = egid; -if (next_id <0 ) { new->seq = ids->seq++;if (ids->seq >IPCID_SEQ_MAX )
Greg Kroah-Hartman
maintainerPATCH 117/202 sched/fair: Prevent throttling in early pick_next_task_fair()
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Segall <[email protected]>
commit 54d27365cae88fbcc853b391dcd561e71acb81fa upstream.
The optimized task selection logic optimistically selects a new task to run without first doing a full put_prev_task(). This is so that we can avoid a put/set on the common ancestors of the old and new task.
Similarly, we should only call check_cfs_rq_runtime() to throttle eligible groups if they're part of the common ancestry, otherwise it is possible to end up with no eligible task in the simple task selection.
Imagine:
/root /prev /next /A /B
If our optimistic selection ends up throttling /next, we goto simple and our put_prev_task() ends up throttling /prev, after which we're going to bug out in set_next_entity() because there aren't any tasks left.
Avoid this scenario by only throttling common ancestors.
--- kernel/sched/fair.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
kernel/sched/fair.c +14 -11
@@ -5126,18 +5126,21 @@ again:* entity, update_curr() will update its vruntime, otherwise * forget we've ever seen it. */ -if (curr && curr->on_rq) -update_curr (cfs_rq); -else - curr =NULL ; +if (curr) { +if (curr->on_rq) +update_curr (cfs_rq); +else + curr =NULL ; -/* -* This call to check_cfs_rq_runtime() will do the throttle and -* dequeue its entity in the parent(s). Therefore the 'simple' -* nr_running test will indeed be correct. -*/ -if (unlikely (check_cfs_rq_runtime (cfs_rq))) - goto simple; +/* +* This call to check_cfs_rq_runtime() will do the +* throttle and dequeue its entity in the parent(s). +* Therefore the 'simple' nr_running test will indeed +* be correct. +*/ +if (unlikely (check_cfs_rq_runtime (cfs_rq))) + goto simple; + } se =pick_next_entity (cfs_rq, curr); cfs_rq =group_cfs_rq (se);
Greg Kroah-Hartman
maintainerPATCH 118/202 serial/amba-pl011: Disable interrupts around TX softirq
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Martin <[email protected]>
pl011_tx_softirq() currently uses spin_{,un}lock(), which are not sufficient to inhibit pl011_int() from being triggered by a local IRQ and trying to re-take the same lock. This can lead to deadlocks.
This patch uses the _irq() locking variants instead to ensure that pl011_int() handling for a given port is deferred until any pl011_tx_softirq() work for that port is complete.
Notes for stable:
This patch fixes an issue that is fixed by the following upstream commit, which is a more substantial rewrite of the affected code, fixing multiple, mostly more minor issues:
1e84d22322ceed4767db1e5342c830dd60c8210f serial/amba-pl011: Refactor and simplify TX FIFO handling
The upstream patch was rejected for stable on the reasonable grounds that it was too big and complex a patch. The original buggy code was merged in v4.1, and the rewrite was merged in v4.2, leaving only v4.1 affected.
This patch replaces the 1e84d22, for 4.1.x only.
--- drivers/tty/serial/amba-pl011.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/serial/amba-pl011.c +2 -2
@@ -1360,9 +1360,9 @@ static void pl011_tx_softirq(struct workstruct uart_amba_port *uap = container_of(dwork, struct uart_amba_port, tx_softirq_work); -spin_lock (&uap->port.lock); +spin_lock_irq (&uap->port.lock);while (pl011_tx_chars (uap)) ; -spin_unlock (&uap->port.lock); +spin_unlock_irq (&uap->port.lock); }static void pl011_tx_irq_seen (struct uart_amba_port *uap)
Greg Kroah-Hartman
maintainerPATCH 119/202 ipvs: do not use random local source address for tunnels
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
commit 4754957f04f5f368792a0eb7dab0ae89fb93dcfd upstream.
Michael Vallaly reports about wrong source address used in rare cases for tunneled traffic. Looks like __ip_vs_get_out_rt in 3.10+ is providing uninitialized dest_dst->dst_saddr.ip because ip_vs_dest_dst_alloc uses kmalloc. While we retry after seeing EINVAL from routing for data that does not look like valid local address, it still succeeded when this memory was previously used from other dests and with different local addresses. As result, we can use valid local address that is not suitable for our real server.
Fix it by providing 0.0.0.0 every time our cache is refreshed. By this way we will get preferred source address from routing.
--- net/netfilter/ipvs/ip_vs_xmit.c | 1 - 1 file changed, 1 deletion(-)
net/netfilter/ipvs/ip_vs_xmit.c +0 -1
@@ -130,7 +130,6 @@ static struct rtable *do_output_route4(smemset (&fl4,0 ,sizeof (fl4)); fl4.daddr = daddr; - fl4.saddr = (rt_mode &IP_VS_RT_MODE_CONNECT ) ? *saddr :0 ; fl4.flowi4_flags = (rt_mode &IP_VS_RT_MODE_KNOWN_NH ) ?FLOWI_FLAG_KNOWN_NH :0 ;
Greg Kroah-Hartman
maintainerPATCH 120/202 ipvs: fix crash if scheduler is changed
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
commit 05f00505a89acd21f5d0d20f5797dfbc4cf85243 upstream.
I overlooked the svc->sched_data usage from schedulers when the services were converted to RCU in 3.10. Now the rare ipvsadm -E command can change the scheduler but due to the reverse order of ip_vs_bind_scheduler and ip_vs_unbind_scheduler we provide new sched_data to the old scheduler resulting in a crash.
To fix it without changing the scheduler methods we have to use synchronize_rcu() only for the editing case. It means all svc->scheduler readers should expect a NULL value. To avoid breakage for the service listing and ipvsadm -R we can use the "none" name to indicate that scheduler is not assigned, a state when we drop new connections.
--- net/netfilter/ipvs/ip_vs_core.c | 16 +++++++- net/netfilter/ipvs/ip_vs_ctl.c | 78 ++++++++++++++++++++++++--------------- net/netfilter/ipvs/ip_vs_sched.c | 12 +++--- 3 files changed, 69 insertions(+), 37 deletions(-)
net/netfilter/ipvs/ip_vs_core.c +14 -2
@@ -319,7 +319,13 @@ ip_vs_sched_persist(struct ip_vs_service* return *ignored=0 i.e. ICMP and NF_DROP */ sched =rcu_dereference (svc->scheduler); - dest = sched->schedule (svc, skb, iph); +if (sched) { +/* read svc->sched_data after svc->scheduler */ +smp_rmb (); + dest = sched->schedule (svc, skb, iph); + }else { + dest =NULL ; + }if (!dest) {IP_VS_DBG (1 ,"p-schedule: no dest found.\n" );kfree (param.pe_data);
@@ -467,7 +473,13 @@ ip_vs_schedule(struct ip_vs_service *svc } sched =rcu_dereference (svc->scheduler); - dest = sched->schedule (svc, skb, iph); +if (sched) { +/* read svc->sched_data after svc->scheduler */ +smp_rmb (); + dest = sched->schedule (svc, skb, iph); + }else { + dest =NULL ; + }if (dest ==NULL ) {IP_VS_DBG (1 ,"Schedule: no dest found.\n" );return NULL ;
net/netfilter/ipvs/ip_vs_ctl.c +49 -29
174 lines not on this page · raw message
net/netfilter/ipvs/ip_vs_sched.c +6 -6
@@ -74,7 +74,7 @@ void ip_vs_unbind_scheduler(struct ip_vsif (sched->done_service) sched->done_service (svc); -/* svc->scheduler can not be set to NULL */ +/* svc->scheduler can be set to NULL only by caller */ }
@@ -147,21 +147,21 @@ void ip_vs_scheduler_put(struct ip_vs_scvoid ip_vs_scheduler_err (struct ip_vs_service *svc,const char *msg) { -struct ip_vs_scheduler *sched; +struct ip_vs_scheduler *sched =rcu_dereference (svc->scheduler); +char *sched_name = sched ? sched->name :"none" ; - sched =rcu_dereference (svc->scheduler);if (svc->fwmark) {IP_VS_ERR_RL ("%s: FWM %u 0x%08X - %s\n" , - sched->name, svc->fwmark, svc->fwmark, msg); + sched_name, svc->fwmark, svc->fwmark, msg); #ifdef CONFIG_IP_VS_IPV6 }else if (svc->af ==AF_INET6 ) {IP_VS_ERR_RL ("%s: %s [%pI6c]:%d - %s\n" , - sched->name,ip_vs_proto_name (svc->protocol), + sched_name,ip_vs_proto_name (svc->protocol), &svc->addr.in6,ntohs (svc->port), msg);#endif }else {IP_VS_ERR_RL ("%s: %s %pI4:%d - %s\n" , - sched->name,ip_vs_proto_name (svc->protocol), + sched_name,ip_vs_proto_name (svc->protocol), &svc->addr.ip,ntohs (svc->port), msg); } }
Greg Kroah-Hartman
maintainerPATCH 121/202 ipvs: skb_orphan in case of forwarding
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Gartrell <[email protected]>
commit 71563f3414e917c62acd8e0fb0edf8ed6af63e4b upstream.
It is possible that we bind against a local socket in early_demux when we are actually going to want to forward it. In this case, the socket serves no purpose and only serves to confuse things (particularly functions which implicitly expect sk_fullsock to be true, like ip_local_out). Additionally, skb_set_owner_w is totally broken for non full-socks.
--- net/netfilter/ipvs/ip_vs_xmit.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
net/netfilter/ipvs/ip_vs_xmit.c +27 -0
@@ -522,6 +522,21 @@ static inline int ip_vs_tunnel_xmit_prepreturn ret; } +/* In the event of a remote destination, it's possible that we would have +* matches against an old socket (particularly a TIME-WAIT socket). This +* causes havoc down the line (ip_local_out et. al. expect regular sockets +* and invalid memory accesses will happen) so simply drop the association +* in this case. +*/ +static inline void ip_vs_drop_early_demux_sk (struct sk_buff *skb) +{ +/* If dev is set, the packet came from the LOCAL_IN callback and +* not from a local TCP socket. +*/ +if (skb->dev) +skb_orphan (skb); +} +/* return NF_STOLEN (sent) or NF_ACCEPT if local=1 (not sent) */ static inline int ip_vs_nat_send_or_cont (int pf,struct sk_buff *skb,struct ip_vs_conn *cp,int local)
@@ -533,12 +548,21 @@ static inline int ip_vs_nat_send_or_contip_vs_notrack (skb); else ip_vs_update_conntrack(skb, cp, 1); + +/* Remove the early_demux association unless it's bound for the +* exact same port and address on this host after translation. +*/ +if (!local || cp->vport != cp->dport || + !ip_vs_addr_equal (cp->af, &cp->vaddr, &cp->daddr)) +ip_vs_drop_early_demux_sk (skb); +if (!local) {skb_forward_csum (skb);NF_HOOK (pf,NF_INET_LOCAL_OUT ,NULL , skb,NULL ,skb_dst (skb)->dev, dst_output_sk); }else ret =NF_ACCEPT ; +return ret; }
@@ -552,6 +576,7 @@ static inline int ip_vs_send_or_cont(intif (likely (!(cp->flags &IP_VS_CONN_F_NFCT )))ip_vs_notrack (skb);if (!local) { +ip_vs_drop_early_demux_sk (skb);skb_forward_csum (skb);NF_HOOK (pf,NF_INET_LOCAL_OUT ,NULL , skb,NULL ,skb_dst (skb)->dev, dst_output_sk);
@@ -840,6 +865,8 @@ ip_vs_prepare_tunneled_skb(struct sk_bufstruct ipv6hdr *old_ipv6h =NULL ;#endif +ip_vs_drop_early_demux_sk (skb); +if (skb_headroom (skb) < max_headroom ||skb_cloned (skb)) { new_skb =skb_realloc_headroom (skb, max_headroom);if (!new_skb)
Greg Kroah-Hartman
maintainerPATCH 122/202 ipvs: fix crash with sync protocol v0 and FTP
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
commit 56184858d1fc95c46723436b455cb7261cd8be6f upstream.
Fix crash in 3.5+ if FTP is used after switchingsync_version to 0.
--- net/netfilter/ipvs/ip_vs_sync.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/ipvs/ip_vs_sync.c +1 -1
@@ -612,7 +612,7 @@ static void ip_vs_sync_conn_v0(struct ne pkts =atomic_add_return (1 , &cp->in_pkts); else pkts =sysctl_sync_threshold (ipvs); -ip_vs_sync_conn (net, cp->control, pkts); +ip_vs_sync_conn (net, cp, pkts); } }
Greg Kroah-Hartman
maintainerPATCH 123/202 ipvs: call skb_sender_cpu_clear
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
commit e3895c0334d0ef46e80f22eaf2a52401ff6d5a67 upstream.
Reset XPS's sender_cpu on forwarding.
--- net/netfilter/ipvs/ip_vs_xmit.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/netfilter/ipvs/ip_vs_xmit.c +6 -0
@@ -518,6 +518,8 @@ static inline int ip_vs_tunnel_xmit_prepif (ret ==NF_ACCEPT ) {nf_reset (skb);skb_forward_csum (skb); +if (!skb->sk) +skb_sender_cpu_clear (skb); }return ret; }
@@ -558,6 +560,8 @@ static inline int ip_vs_nat_send_or_contif (!local) {skb_forward_csum (skb); +if (!skb->sk) +skb_sender_cpu_clear (skb);NF_HOOK (pf,NF_INET_LOCAL_OUT ,NULL , skb,NULL ,skb_dst (skb)->dev, dst_output_sk); }else
@@ -578,6 +582,8 @@ static inline int ip_vs_send_or_cont(intif (!local) {ip_vs_drop_early_demux_sk (skb);skb_forward_csum (skb); +if (!skb->sk) +skb_sender_cpu_clear (skb);NF_HOOK (pf,NF_INET_LOCAL_OUT ,NULL , skb,NULL ,skb_dst (skb)->dev, dst_output_sk); }else
Greg Kroah-Hartman
maintainerPATCH 124/202 fbdev: select versatile helpers for the integrator
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit 2701fa0864ecb9e49d47a4aa1c02f172ab79639a upstream.
Commit 11c32d7b6274cb0f554943d65bd4a126c4a86dcd "video: move Versatile CLCD helpers" missed the fact that the Integrator/CP is also using the helper, and as a result the platform got only stubs and no graphics. Add this as a default selection to Kconfig so we have graphics again.
--- drivers/video/fbdev/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/Kconfig +1 -1
@@ -298,7 +298,7 @@ config FB_ARMCLCD # Helper logic selected only by the ARM Versatile platform family. config PLAT_VERSATILE_CLCD - def_bool ARCH_VERSATILE || ARCH_REALVIEW || ARCH_VEXPRESS + def_bool ARCH_VERSATILE || ARCH_REALVIEW || ARCH_VEXPRESS || ARCH_INTEGRATOR depends on ARM depends on FB_ARMCLCD && FB=y
Greg Kroah-Hartman
maintainerPATCH 125/202 batman-adv: fix kernel crash due to missing NULL checks
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Lindner <[email protected]>
commit 354136bcc3c4f40a2813bba8f57ca5267d812d15 upstream.
batadv_softif_vlan_get() may return NULL which has to be verified by the caller.
--- net/batman-adv/soft-interface.c | 3 +++ net/batman-adv/translation-table.c | 18 ++++++++++++++---- 2 files changed, 17 insertions(+), 4 deletions(-)
net/batman-adv/soft-interface.c +3 -0
@@ -449,6 +449,9 @@ out:*/ void batadv_softif_vlan_free_ref (struct batadv_softif_vlan *vlan) { +if (!vlan) +return ; +if (atomic_dec_and_test (&vlan->refcount)) {spin_lock_bh (&vlan->bat_priv->softif_vlan_list_lock);hlist_del_rcu (&vlan->list);
net/batman-adv/translation-table.c +14 -4
@@ -575,6 +575,9 @@ bool batadv_tt_local_add(struct net_devi/* increase the refcounter of the related vlan */ vlan =batadv_softif_vlan_get (bat_priv, vid); +if (WARN (!vlan,"adding TT local entry %pM to non-existent VLAN %d" , + addr,BATADV_PRINT_VID (vid))) + goto out; batadv_dbg(BATADV_DBG_TT, bat_priv, "Creating new local tt entry: %pM (vid: %d, ttvn: %d)\n",
@@ -1047,6 +1050,9 @@ uint16_t batadv_tt_local_remove(struct b/* decrease the reference held for this vlan */ vlan =batadv_softif_vlan_get (bat_priv, vid); +if (!vlan) + goto out; +batadv_softif_vlan_free_ref (vlan);batadv_softif_vlan_free_ref (vlan);
@@ -1147,8 +1153,10 @@ static void batadv_tt_local_table_free(s/* decrease the reference held for this vlan */ vlan =batadv_softif_vlan_get (bat_priv, tt_common_entry->vid); -batadv_softif_vlan_free_ref (vlan); -batadv_softif_vlan_free_ref (vlan); +if (vlan) { +batadv_softif_vlan_free_ref (vlan); +batadv_softif_vlan_free_ref (vlan); + }batadv_tt_local_entry_free_ref (tt_local); }
@@ -3188,8 +3196,10 @@ static void batadv_tt_local_purge_pendin/* decrease the reference held for this vlan */ vlan =batadv_softif_vlan_get (bat_priv, tt_common->vid); -batadv_softif_vlan_free_ref (vlan); -batadv_softif_vlan_free_ref (vlan); +if (vlan) { +batadv_softif_vlan_free_ref (vlan); +batadv_softif_vlan_free_ref (vlan); + }batadv_tt_local_entry_free_ref (tt_local); }
Greg Kroah-Hartman
maintainerPATCH 126/202 batman-adv: protect tt_local_entry from concurrent delete events
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Lindner <[email protected]>
commit ef72706a0543d0c3a5ab29bd6378fdfb368118d9 upstream.
The tt_local_entry deletion performed in batadv_tt_local_remove() was neither protecting against simultaneous deletes nor checking whether the element was still part of the list before calling hlist_del_rcu().
Replacing the hlist_del_rcu() call with batadv_hash_remove() provides adequate protection via hash spinlocks as well as an is-element-still-in-hash check to avoid 'blind' hash removal.
--- net/batman-adv/translation-table.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
net/batman-adv/translation-table.c +10 -1
@@ -1018,6 +1018,7 @@ uint16_t batadv_tt_local_remove(struct bstruct batadv_tt_local_entry *tt_local_entry;uint16_t flags, curr_flags =BATADV_NO_FLAGS ;struct batadv_softif_vlan *vlan; +void *tt_entry_exists; tt_local_entry =batadv_tt_local_hash_find (bat_priv, addr, vid);if (!tt_local_entry)
@@ -1045,7 +1046,15 @@ uint16_t batadv_tt_local_remove(struct b* immediately purge it */ batadv_tt_local_event (bat_priv, tt_local_entry,BATADV_TT_CLIENT_DEL ); -hlist_del_rcu (&tt_local_entry->common.hash_entry); + + tt_entry_exists =batadv_hash_remove (bat_priv->tt.local_hash, + batadv_compare_tt, + batadv_choose_tt, + &tt_local_entry->common); +if (!tt_entry_exists) + goto out; + +/* extra call to free the local tt entry */ batadv_tt_local_entry_free_ref (tt_local_entry);/* decrease the reference held for this vlan */
Greg Kroah-Hartman
maintainerPATCH 128/202 mmc: dw_mmc: handle data blocks > than 4kB if IDMAC is used
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Brodkin <[email protected]>
commit 5959b32e3636f9bfe3f869d1e440bc4a4d660965 upstream.
As per DW MobileStorage databook "each descriptor can transfer up to 4kB of data in chained mode", moreover buffer size that is put in "des1" is limited to 13 bits, i.e. for example on attempt to IDMAC_SET_BUFFER1_SIZE(desc, 8192) size value that's effectively written will be 0.
On the platform with 8kB PAGE_SIZE I see dw_mmc gets data blocks in SG-list of 8kB size and that leads to unpredictable behavior of the SD/MMC controller.
In particular on write to FAT partition of SD-card the controller will stuck in the middle of DMA transaction.
Solution to the problem is simple - we need to pass large (> 4kB) data buffers to the controller via multiple descriptors. And that's what that change does.
What's interesting I did try original driver on same platform but configured with 4kB PAGE_SIZE and may confirm that data blocks passed in SG-list to dw_mmc never exeed 4kB limit - that explains why nobody ever faced a problem I did.
--- drivers/mmc/host/dw_mmc.c | 109 +++++++++++++++++++++++++++++----------------- 1 file changed, 71 insertions(+), 38 deletions(-)
drivers/mmc/host/dw_mmc.c +71 -38
@@ -99,6 +99,9 @@ struct idmac_desc { __le32 des3; /* buffer 2 physical address */ }; + +/* Each descriptor can transfer up to 4KB of data in chained mode */ +#define DW_MCI_DESC_DATA_LENGTH 0x1000#endif /* CONFIG_MMC_DW_IDMAC */ static bool dw_mci_reset (struct dw_mci *host);
@@ -462,66 +465,96 @@ static void dw_mci_idmac_complete_dma(ststatic void dw_mci_translate_sglist (struct dw_mci *host,struct mmc_data *data,unsigned int sg_len) { +unsigned int desc_len;int i;if (host->dma_64bit_address ==1 ) { -struct idmac_desc_64addr *desc = host->sg_cpu; +struct idmac_desc_64addr *desc_first, *desc_last, *desc; + + desc_first = desc_last = desc = host->sg_cpu; -for (i =0 ; i < sg_len; i++, desc++) { +for (i =0 ; i < sg_len; i++) {unsigned int length =sg_dma_len (&data->sg[i]);u64 mem_addr =sg_dma_address (&data->sg[i]); -/* -* Set the OWN bit and disable interrupts for this -* descriptor -*/ - desc->des0 =IDMAC_DES0_OWN |IDMAC_DES0_DIC | -IDMAC_DES0_CH ; -/* Buffer length */ -IDMAC_64ADDR_SET_BUFFER1_SIZE (desc, length); - -/* Physical address to DMA to/from */ - desc->des4 = mem_addr &0xffffffff ; - desc->des5 = mem_addr >>32 ; +for ( ; length ; desc++) { + desc_len = (length <=DW_MCI_DESC_DATA_LENGTH ) ? + length :DW_MCI_DESC_DATA_LENGTH ; + + length -= desc_len; + +/* +* Set the OWN bit and disable interrupts +* for this descriptor +*/ + desc->des0 =IDMAC_DES0_OWN |IDMAC_DES0_DIC | +IDMAC_DES0_CH ; + +/* Buffer length */ +IDMAC_64ADDR_SET_BUFFER1_SIZE (desc, desc_len); + +/* Physical address to DMA to/from */ + desc->des4 = mem_addr &0xffffffff ; + desc->des5 = mem_addr >>32 ; + +/* Update physical address for the next desc */ + mem_addr += desc_len; + +/* Save pointer to the last descriptor */ + desc_last = desc; + } }/* Set first descriptor */ - desc = host->sg_cpu; - desc->des0 |=IDMAC_DES0_FD ; + desc_first->des0 |=IDMAC_DES0_FD ;/* Set last descriptor */ - desc = host->sg_cpu + (i -1 ) * -sizeof (struct idmac_desc_64addr ); - desc->des0 &= ~(IDMAC_DES0_CH |IDMAC_DES0_DIC ); - desc->des0 |=IDMAC_DES0_LD ; + desc_last->des0 &= ~(IDMAC_DES0_CH |IDMAC_DES0_DIC ); + desc_last->des0 |=IDMAC_DES0_LD ; }else { -struct idmac_desc *desc = host->sg_cpu; +struct idmac_desc *desc_first, *desc_last, *desc; + + desc_first = desc_last = desc = host->sg_cpu; -for (i =0 ; i < sg_len; i++, desc++) { +for (i =0 ; i < sg_len; i++) {unsigned int length =sg_dma_len (&data->sg[i]);u32 mem_addr =sg_dma_address (&data->sg[i]); -/* -* Set the OWN bit and disable interrupts for this -* descriptor -*/ - desc->des0 =cpu_to_le32 (IDMAC_DES0_OWN | -IDMAC_DES0_DIC |IDMAC_DES0_CH ); -/* Buffer length */ -IDMAC_SET_BUFFER1_SIZE (desc, length); +for ( ; length ; desc++) { + desc_len = (length <=DW_MCI_DESC_DATA_LENGTH ) ? + length :DW_MCI_DESC_DATA_LENGTH ; + + length -= desc_len; + +/* +* Set the OWN bit and disable interrupts +* for this descriptor +*/ + desc->des0 =cpu_to_le32 (IDMAC_DES0_OWN | +IDMAC_DES0_DIC | +IDMAC_DES0_CH ); + +/* Buffer length */ +IDMAC_SET_BUFFER1_SIZE (desc, desc_len); -/* Physical address to DMA to/from */ - desc->des2 =cpu_to_le32 (mem_addr); +/* Physical address to DMA to/from */ + desc->des2 =cpu_to_le32 (mem_addr); + +/* Update physical address for the next desc */ + mem_addr += desc_len; + +/* Save pointer to the last descriptor */ + desc_last = desc; + } }/* Set first descriptor */ - desc = host->sg_cpu; - desc->des0 |=cpu_to_le32 (IDMAC_DES0_FD ); + desc_first->des0 |=cpu_to_le32 (IDMAC_DES0_FD );/* Set last descriptor */ - desc = host->sg_cpu + (i -1 ) *sizeof (struct idmac_desc ); - desc->des0 &=cpu_to_le32 (~(IDMAC_DES0_CH |IDMAC_DES0_DIC )); - desc->des0 |=cpu_to_le32 (IDMAC_DES0_LD ); + desc_last->des0 &=cpu_to_le32 (~(IDMAC_DES0_CH | +IDMAC_DES0_DIC )); + desc_last->des0 |=cpu_to_le32 (IDMAC_DES0_LD ); }wmb ();
@@ -2406,7 +2439,7 @@ static int dw_mci_init_slot(struct dw_mc#ifdef CONFIG_MMC_DW_IDMAC mmc->max_segs = host->ring_size; mmc->max_blk_size =65536 ; - mmc->max_seg_size =0x1000 ; + mmc->max_seg_size =DW_MCI_DESC_DATA_LENGTH ; mmc->max_req_size = mmc->max_seg_size * host->ring_size; mmc->max_blk_count = mmc->max_req_size /512 ;#else
Greg Kroah-Hartman
maintainerPATCH 129/202 mmc: sdhci-esdhc-imx: Move mmc_of_parse() to the dt probe
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
commit 15064119273735c115fba381823b0746508bae3a upstream.
mmc_of_parse() should be placed inside sdhci_esdhc_imx_probe_dt() as it suits only for the dt case.
--- drivers/mmc/host/sdhci-esdhc-imx.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/mmc/host/sdhci-esdhc-imx.c +2 -6
@@ -903,7 +903,8 @@ sdhci_esdhc_imx_probe_dt(struct platformmmc_of_parse_voltage (np, &host->ocr_mask); -return 0 ; +/* call to generic mmc_of_parse to support additional capabilities */ +return mmc_of_parse (host->mmc); }#else static inline int
@@ -1048,11 +1049,6 @@ static int sdhci_esdhc_imx_probe(struct host->quirks2 |=SDHCI_QUIRK2_NO_1_8_V ; } -/* call to generic mmc_of_parse to support additional capabilities */ - err =mmc_of_parse (host->mmc); -if (err) - goto disable_clk; - err =sdhci_add_host (host);if (err) goto disable_clk;
Greg Kroah-Hartman
maintainerPATCH 130/202 mmc: sdhci-esdhc-imx: Do not break platform data boards
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
commit 7ccddeb08a632c713eca0a5f13bcbfa7e6e83982 upstream.
The only user of this driver that has not been converted to fully device tree is the i.MX35 SoC.
There is a i.MX35-based board (mach-pcm043.c) that uses platform data to pass wp_gpio and cd_gpio information.
Commit 8d86e4fcccf61ba ("mmc: sdhci-esdhc-imx: Call mmc_of_parse()") broke the platform data case by removing mmc_gpio_request_ro() and mmc_gpio_request_cd(), so restore the functionality for the non-dt case.
Also, restore the check for ESDHC_CD_CONTROLLER so that we can still support the "fsl,cd-controller" property.
--- drivers/mmc/host/sdhci-esdhc-imx.c | 36 +++++++++++++++++++++++++++++++++++- 1 file changed, 35 insertions(+), 1 deletion(-)
drivers/mmc/host/sdhci-esdhc-imx.c +35 -1
@@ -925,6 +925,7 @@ static int sdhci_esdhc_imx_probe(structstruct esdhc_platform_data *boarddata;int err;struct pltfm_imx_data *imx_data; +bool dt = true; host =sdhci_pltfm_init (pdev, &sdhci_esdhc_imx_pdata,0 );if (IS_ERR (host))
@@ -1012,11 +1013,44 @@ static int sdhci_esdhc_imx_probe(struct } imx_data->boarddata = *((struct esdhc_platform_data *) host->mmc->parent->platform_data); + dt = false; + } +/* write_protect */ +if (boarddata->wp_type ==ESDHC_WP_GPIO && !dt) { + err =mmc_gpio_request_ro (host->mmc, boarddata->wp_gpio); +if (err) { +dev_err (mmc_dev (host->mmc), +"failed to request write-protect gpio!\n" ); + goto disable_clk; + } + host->mmc->caps2 |=MMC_CAP2_RO_ACTIVE_HIGH ; }/* card_detect */ -if (boarddata->cd_type ==ESDHC_CD_CONTROLLER ) +switch (boarddata->cd_type) { +case ESDHC_CD_GPIO : +if (dt) +break ; + err =mmc_gpio_request_cd (host->mmc, boarddata->cd_gpio,0 ); +if (err) { +dev_err (mmc_dev (host->mmc), +"failed to request card-detect gpio!\n" ); + goto disable_clk; + } +/* fall through */ + +case ESDHC_CD_CONTROLLER : +/* we have a working card_detect back */ host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION ; +break ; + +case ESDHC_CD_PERMANENT : + host->mmc->caps |=MMC_CAP_NONREMOVABLE ; +break ; + +case ESDHC_CD_NONE : +break ; + }switch (boarddata->max_bus_width) {case 8 :
Greg Kroah-Hartman
maintainerPATCH 131/202 mmc: sdhci-esdhc-imx: fix cd regression for dt platform
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dong Aisheng <[email protected]>
commit 4800e87a2ee886c1972deb73f057d1a6541edb36 upstream.
Current card detect probe process is that when driver finds a valid ESDHC_CD_GPIO, it will clear the quirk SDHCI_QUIRK_BROKEN_CARD_DETECTION which is set by default for all esdhc/usdhc controllers. Then host driver will know there's a valid card detect function.
Commit 8d86e4fcccf6 ("mmc: sdhci-esdhc-imx: Call mmc_of_parse()") breaks GPIO CD function for dt platform that it will return directly when find ESDHC_CD_GPIO for dt platform which result in the later wrongly to keep SDHCI_QUIRK_BROKEN_CARD_DETECTION for all dt platforms. Then MMC_CAP_NEEDS_POLL will be used instead even there's a valid GPIO card detect.
This patch adds back this function and follows the original approach to clear the quirk if find an valid CD GPIO for dt platforms.
--- drivers/mmc/host/sdhci-esdhc-imx.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/mmc/host/sdhci-esdhc-imx.c +9 -1
@@ -868,6 +868,7 @@ sdhci_esdhc_imx_probe_dt(struct platform struct esdhc_platform_data *boarddata) {struct device_node *np = pdev->dev.of_node; +int ret;if (!np)return -ENODEV ;
@@ -904,7 +905,14 @@ sdhci_esdhc_imx_probe_dt(struct platformmmc_of_parse_voltage (np, &host->ocr_mask);/* call to generic mmc_of_parse to support additional capabilities */ -return mmc_of_parse (host->mmc); + ret =mmc_of_parse (host->mmc); +if (ret) +return ret; + +if (!IS_ERR_VALUE (mmc_gpio_get_cd (host->mmc))) + host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION ; + +return 0 ; }#else static inline int
Greg Kroah-Hartman
maintainerPATCH 132/202 dts: imx51: fix sd card gpio polarity specified in device tree
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dong Aisheng <[email protected]>
commit aca45c0e95dad1c4ba4d38da192756b0e10cbbbd upstream.
cd-gpios polarity should be changed to GPIO_ACTIVE_LOW and wp-gpios should be changed to GPIO_ACTIVE_HIGH.
Otherwise, the SD may not work properly due to wrong polarity inversion specified in DT after switch to common parsing function mmc_of_parse().
--- arch/arm/boot/dts/imx51-apf51dev.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx51-apf51dev.dts +1 -1
@@ -98,7 +98,7 @@ &esdhc1 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_esdhc1>; - cd-gpios = <&gpio2 29 GPIO_ACTIVE_HIGH>; + cd-gpios = <&gpio2 29 GPIO_ACTIVE_LOW>; bus-width = <4>; status = "okay"; };
Greg Kroah-Hartman
maintainerPATCH 133/202 dts: imx53: fix sd card gpio polarity specified in device tree
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dong Aisheng <[email protected]>
commit 94d76946859b4bcfa0da373357f14feda2af0622 upstream.
cd-gpios polarity should be changed to GPIO_ACTIVE_LOW and wp-gpios should be changed to GPIO_ACTIVE_HIGH.
Otherwise, the SD may not work properly due to wrong polarity inversion specified in DT after switch to common parsing function mmc_of_parse().
--- arch/arm/boot/dts/imx53-ard.dts | 4 ++-- arch/arm/boot/dts/imx53-m53evk.dts | 4 ++-- arch/arm/boot/dts/imx53-qsb-common.dtsi | 4 ++-- arch/arm/boot/dts/imx53-smd.dts | 4 ++-- arch/arm/boot/dts/imx53-tqma53.dtsi | 4 ++-- arch/arm/boot/dts/imx53-tx53.dtsi | 4 ++-- arch/arm/boot/dts/imx53-voipac-bsb.dts | 4 ++-- 7 files changed, 14 insertions(+), 14 deletions(-)
arch/arm/boot/dts/imx53-ard.dts +2 -2
@@ -103,8 +103,8 @@ &esdhc1 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_esdhc1>; - cd-gpios = <&gpio1 1 0>; - wp-gpios = <&gpio1 9 0>; + cd-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>; + wp-gpios = <&gpio1 9 GPIO_ACTIVE_HIGH>; status = "okay"; };
arch/arm/boot/dts/imx53-m53evk.dts +2 -2
@@ -124,8 +124,8 @@ &esdhc1 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_esdhc1>; - cd-gpios = <&gpio1 1 0>; - wp-gpios = <&gpio1 9 0>; + cd-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>; + wp-gpios = <&gpio1 9 GPIO_ACTIVE_HIGH>; status = "okay"; };
arch/arm/boot/dts/imx53-qsb-common.dtsi +2 -2
@@ -147,8 +147,8 @@ &esdhc3 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_esdhc3>; - cd-gpios = <&gpio3 11 0>; - wp-gpios = <&gpio3 12 0>; + cd-gpios = <&gpio3 11 GPIO_ACTIVE_LOW>; + wp-gpios = <&gpio3 12 GPIO_ACTIVE_HIGH>; bus-width = <8>; status = "okay"; };
arch/arm/boot/dts/imx53-smd.dts +2 -2
@@ -41,8 +41,8 @@ &esdhc1 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_esdhc1>; - cd-gpios = <&gpio3 13 0>; - wp-gpios = <&gpio4 11 0>; + cd-gpios = <&gpio3 13 GPIO_ACTIVE_LOW>; + wp-gpios = <&gpio4 11 GPIO_ACTIVE_HIGH>; status = "okay"; };
arch/arm/boot/dts/imx53-tqma53.dtsi +2 -2
@@ -41,8 +41,8 @@ pinctrl-0 = <&pinctrl_esdhc2>, <&pinctrl_esdhc2_cdwp>; vmmc-supply = <®_3p3v>; - wp-gpios = <&gpio1 2 0>; - cd-gpios = <&gpio1 4 0>; + wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>; + cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>; status = "disabled"; };
arch/arm/boot/dts/imx53-tx53.dtsi +2 -2
@@ -183,7 +183,7 @@ }; &esdhc1 { - cd-gpios = <&gpio3 24 GPIO_ACTIVE_HIGH>; + cd-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>; fsl,wp-controller; pinctrl-names = "default"; pinctrl-0 = <&pinctrl_esdhc1>;
@@ -191,7 +191,7 @@ }; &esdhc2 { - cd-gpios = <&gpio3 25 GPIO_ACTIVE_HIGH>; + cd-gpios = <&gpio3 25 GPIO_ACTIVE_LOW>; fsl,wp-controller; pinctrl-names = "default"; pinctrl-0 = <&pinctrl_esdhc2>;
arch/arm/boot/dts/imx53-voipac-bsb.dts +2 -2
@@ -119,8 +119,8 @@ &esdhc2 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_esdhc2>; - cd-gpios = <&gpio3 25 0>; - wp-gpios = <&gpio2 19 0>; + cd-gpios = <&gpio3 25 GPIO_ACTIVE_LOW>; + wp-gpios = <&gpio2 19 GPIO_ACTIVE_HIGH>; vmmc-supply = <®_3p3v>; status = "okay"; };
Greg Kroah-Hartman
maintainerPATCH 134/202 dts: imx25: fix sd card gpio polarity specified in device tree
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dong Aisheng <[email protected]>
commit cf75eb15be2bdd054a76aeef6458beaa4a6ab770 upstream.
cd-gpios polarity should be changed to GPIO_ACTIVE_LOW and wp-gpios should be changed to GPIO_ACTIVE_HIGH.
Otherwise, the SD may not work properly due to wrong polarity inversion specified in DT after switch to common parsing function mmc_of_parse().
--- arch/arm/boot/dts/imx25-pdk.dts | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/arm/boot/dts/imx25-pdk.dts +3 -2
@@ -10,6 +10,7 @@ */ /dts-v1/; +#include <dt-bindings/gpio/gpio.h> #include <dt-bindings/input/input.h> #include "imx25.dtsi"
@@ -114,8 +115,8 @@ &esdhc1 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_esdhc1>; - cd-gpios = <&gpio2 1 0>; - wp-gpios = <&gpio2 0 0>; + cd-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>; + wp-gpios = <&gpio2 0 GPIO_ACTIVE_HIGH>; status = "okay"; };
Greg Kroah-Hartman
maintainerPATCH 135/202 usb: chipidea: imx: fix a typo for imx6sx
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Jun <[email protected]>
commit 8315b77d72c5f0b18ceb513303d845e73166133c upstream.
Use imx6sx instead of imx6sl's platform flags for imx6sx.
--- drivers/usb/chipidea/ci_hdrc_imx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/chipidea/ci_hdrc_imx.c +1 -1
@@ -56,7 +56,7 @@ static const struct of_device_id ci_hdrc { .compatible = "fsl,imx27-usb", .data = &imx27_usb_data}, { .compatible = "fsl,imx6q-usb", .data = &imx6q_usb_data}, { .compatible = "fsl,imx6sl-usb", .data = &imx6sl_usb_data}, - { .compatible = "fsl,imx6sx-usb", .data = &imx6sl_usb_data}, + { .compatible = "fsl,imx6sx-usb", .data = &imx6sx_usb_data}, {/* sentinel */ } };MODULE_DEVICE_TABLE (of, ci_hdrc_imx_dt_ids);
Greg Kroah-Hartman
maintainerPATCH 136/202 cifs: use server timestamp for ntlmv2 authentication
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Seiderer <[email protected]>
commit 98ce94c8df762d413b3ecb849e2b966b21606d04 upstream.
Linux cifs mount with ntlmssp against an Mac OS X (Yosemite 10.10.5) share fails in case the clocks differ more than +/-2h:
digest-service: digest-request: od failed with 2 proto=ntlmv2
digest-service: digest-request: kdc failed with -1561745592 proto=ntlmv2
Fix this by (re-)using the given server timestamp for the ntlmv2 authentication (as Windows 7 does).
A related problem was also reported earlier by Namjae Jaen (see below):
Windows machine has extended security feature which refuse to allow authentication when there is time difference between server time and client time when ntlmv2 negotiation is used. This problem is prevalent in embedded enviornment where system time is set to default 1970.
Modern servers send the server timestamp in the TargetInfo Av_Pair structure in the challenge message [see MS-NLMP 2.2.2.1]
In [MS-NLMP 3.1.5.1.2] it is explicitly mentioned that the client must use the server provided timestamp if present OR current time if it is not
--- fs/cifs/cifsencrypt.c | 53 ++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 51 insertions(+), 2 deletions(-)
fs/cifs/cifsencrypt.c +51 -2
@@ -444,6 +444,48 @@ find_domain_name(struct cifs_ses *ses, creturn 0 ; } +/* Server has provided av pairs/target info in the type 2 challenge +* packet and we have plucked it and stored within smb session. +* We parse that blob here to find the server given timestamp +* as part of ntlmv2 authentication (or local current time as +* default in case of failure) +*/ +static __le64 +find_timestamp (struct cifs_ses *ses) +{ +unsigned int attrsize; +unsigned int type; +unsigned int onesize =sizeof (struct ntlmssp2_name ); +unsigned char *blobptr; +unsigned char *blobend; +struct ntlmssp2_name *attrptr; + +if (!ses->auth_key.len || !ses->auth_key.response) +return 0 ; + + blobptr = ses->auth_key.response; + blobend = blobptr + ses->auth_key.len; + +while (blobptr + onesize < blobend) { + attrptr = (struct ntlmssp2_name *) blobptr; + type =le16_to_cpu (attrptr->type); +if (type ==NTLMSSP_AV_EOL ) +break ; + blobptr +=2 ;/* advance attr type */ + attrsize =le16_to_cpu (attrptr->length); + blobptr +=2 ;/* advance attr size */ +if (blobptr + attrsize > blobend) +break ; +if (type ==NTLMSSP_AV_TIMESTAMP ) { +if (attrsize ==sizeof (u64)) +return *((__le64 *)blobptr); + } + blobptr += attrsize;/* advance attr value */ + } + +return cpu_to_le64 (cifs_UnixTimeToNT (CURRENT_TIME )); +} +static int calc_ntlmv2_hash (struct cifs_ses *ses,char *ntlmv2_hash,const struct nls_table *nls_cp) {
@@ -641,6 +683,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, cstruct ntlmv2_resp *ntlmv2;char ntlmv2_hash[16 ];unsigned char *tiblob =NULL ;/* target info blob */ +__le64 rsp_timestamp;if (ses->server->negflavor ==CIFS_NEGFLAVOR_EXTENDED ) {if (!ses->domainName) {
@@ -659,6 +702,12 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, c } } +/* Must be within 5 minutes of the server (or in range +/-2h +* in case of Mac OS X), so simply carry over server timestamp +* (as Windows 7 does) +*/ + rsp_timestamp =find_timestamp (ses); + baselen =CIFS_SESS_KEY_SIZE +sizeof (struct ntlmv2_resp ); tilen = ses->auth_key.len; tiblob = ses->auth_key.response;
@@ -675,8 +724,8 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, c (ses->auth_key.response +CIFS_SESS_KEY_SIZE ); ntlmv2->blob_signature =cpu_to_le32 (0x00000101 ); ntlmv2->reserved =0 ; -/* Must be within 5 minutes of the server */ - ntlmv2->time =cpu_to_le64 (cifs_UnixTimeToNT (CURRENT_TIME )); + ntlmv2->time = rsp_timestamp; +get_random_bytes (&ntlmv2->client_chal,sizeof (ntlmv2->client_chal)); ntlmv2->reserved2 =0 ;
Greg Kroah-Hartman
maintainerPATCH 137/202 irqchip/atmel-aic5: Use per chip mask caches in mask/unmask()
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovic Desroches <[email protected]>
commit d32dc9aa10c739363c775baf4499416b2e0dc11f upstream.
When masking/unmasking interrupts, mask_cache is updated and used later for suspend/resume. Unfortunately, it always was the mask_cache associated with the first irq chip which was updated. So when performing resume, only irqs 0-31 could be enabled.
--- drivers/irqchip/irq-atmel-aic5.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-)
drivers/irqchip/irq-atmel-aic5.c +16 -8
@@ -88,28 +88,36 @@ static void aic5_mask(struct irq_data *d {struct irq_domain *domain = d->domain;struct irq_domain_chip_generic *dgc = domain->gc; -struct irq_chip_generic *gc = dgc->gc[0 ]; +struct irq_chip_generic *bgc = dgc->gc[0 ]; +struct irq_chip_generic *gc =irq_data_get_irq_chip_data (d); -/* Disable interrupt on AIC5 */ -irq_gc_lock (gc); +/* +* Disable interrupt on AIC5. We always take the lock of the +* first irq chip as all chips share the same registers. +*/ +irq_gc_lock (bgc);irq_reg_writel (gc, d->hwirq,AT91_AIC5_SSR );irq_reg_writel (gc,1 ,AT91_AIC5_IDCR ); gc->mask_cache &= ~d->mask; -irq_gc_unlock (gc); +irq_gc_unlock (bgc); }static void aic5_unmask (struct irq_data *d) {struct irq_domain *domain = d->domain;struct irq_domain_chip_generic *dgc = domain->gc; -struct irq_chip_generic *gc = dgc->gc[0 ]; +struct irq_chip_generic *bgc = dgc->gc[0 ]; +struct irq_chip_generic *gc =irq_data_get_irq_chip_data (d); -/* Enable interrupt on AIC5 */ -irq_gc_lock (gc); +/* +* Enable interrupt on AIC5. We always take the lock of the +* first irq chip as all chips share the same registers. +*/ +irq_gc_lock (bgc);irq_reg_writel (gc, d->hwirq,AT91_AIC5_SSR );irq_reg_writel (gc,1 ,AT91_AIC5_IECR ); gc->mask_cache |= d->mask; -irq_gc_unlock (gc); +irq_gc_unlock (bgc); }static int aic5_retrigger (struct irq_data *d)
Greg Kroah-Hartman
maintainerPATCH 138/202 irqchip/gic-v3-its: Add missing cache flushes
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 5a9a8915c8888b615521b17d70a4342187eae60b upstream.
When the ITS is configured for non-cacheable transactions, make sure that the allocated, zeroed memory is flushed to the Point of Coherency, allowing the ITS to observe the zeros instead of random garbage (or even get its own data overwritten by zeros being evicted from the cache...).
--- drivers/irqchip/irq-gic-v3-its.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/irqchip/irq-gic-v3-its.c +5 -1
@@ -921,8 +921,10 @@ retry_baser:* non-cacheable as well. */ shr = tmp &GITS_BASER_SHAREABILITY_MASK ; -if (!shr) +if (!shr) { cache = GITS_BASER_nC; +__flush_dcache_area (base, alloc_size); + } goto retry_baser; }
@@ -1163,6 +1165,8 @@ static struct its_device *its_create_devreturn NULL ; } +__flush_dcache_area (itt, sz); + dev->its = its; dev->itt = itt; dev->nr_ites = nr_ites;
Greg Kroah-Hartman
maintainerPATCH 139/202 docs: update HOWTO for 3.x -> 4.x versioning
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Carrillo <[email protected]>
commit e4144fe5d47c91c92d36cdbd5f31ed8d6e3a57ab upstream.
The HOWTO document needed updating for the new kernel versioning.
--- Documentation/HOWTO | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-)
Documentation/HOWTO +14 -14
@@ -218,16 +218,16 @@ The development process Linux kernel development process currently consists of a few different main kernel "branches" and lots of different subsystem-specific kernel branches. These different branches are: - - main 3.x kernel tree - - 3.x.y -stable kernel tree - - 3.x -git kernel patches + - main 4.x kernel tree + - 4.x.y -stable kernel tree + - 4.x -git kernel patches - subsystem specific kernel trees and patches - - the 3.x -next kernel tree for integration tests + - the 4.x -next kernel tree for integration tests -3.x kernel tree +4.x kernel tree ----------------- -3.x kernels are maintained by Linus Torvalds, and can be found on -kernel.org in the pub/linux/kernel/v3.x/ directory. Its development +4.x kernels are maintained by Linus Torvalds, and can be found on +kernel.org in the pub/linux/kernel/v4.x/ directory. Its development process is as follows: - As soon as a new kernel is released a two weeks window is open, during this period of time maintainers can submit big diffs to
@@ -262,20 +262,20 @@ mailing list about kernel releases: released according to perceived bug status, not according to a preconceived timeline." -3.x.y -stable kernel tree +4.x.y -stable kernel tree --------------------------- Kernels with 3-part versions are -stable kernels. They contain relatively small and critical fixes for security problems or significant -regressions discovered in a given 3.x kernel. +regressions discovered in a given 4.x kernel. This is the recommended branch for users who want the most recent stable kernel and are not interested in helping test development/experimental versions. -If no 3.x.y kernel is available, then the highest numbered 3.x +If no 4.x.y kernel is available, then the highest numbered 4.x kernel is the current stable kernel. -3.x.y are maintained by the "stable" team <[email protected]>, and +4.x.y are maintained by the "stable" team <[email protected]>, and are released as needs dictate. The normal release period is approximately two weeks, but it can be longer if there are no pressing problems. A security-related problem, instead, can cause a release to happen almost
@@ -285,7 +285,7 @@ The file Documentation/stable_kernel_rul documents what kinds of changes are acceptable for the -stable tree, and how the release process works. -3.x -git patches +4.x -git patches ------------------ These are daily snapshots of Linus' kernel tree which are managed in a git repository (hence the name.) These patches are usually released
@@ -317,9 +317,9 @@ revisions to it, and maintainers can mar accepted, or rejected. Most of these patchwork sites are listed at http://patchwork.kernel.org/. -3.x -next kernel tree for integration tests +4.x -next kernel tree for integration tests --------------------------------------------- -Before updates from subsystem trees are merged into the mainline 3.x +Before updates from subsystem trees are merged into the mainline 4.x tree, they need to be integration-tested. For this purpose, a special testing repository exists into which virtually all subsystem trees are pulled on an almost daily basis:
Greg Kroah-Hartman
maintainerPATCH 140/202 mtd: pxa3xx_nand: add a default chunk size
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Antoine=20T=C3=A9nart?= <[email protected]>
commit bc3e00f04cc1fe033a289c2fc2e5c73c0168d360 upstream.
When keeping the configuration set by the bootloader (by using the marvell,nand-keep-config property), the pxa3xx_nand_detect_config() function is called and set the chunk size to 512 as a default value if NDCR_PAGE_SZ is not set.
In the other case, when not keeping the bootloader configuration, no chunk size is set. Fix this by adding a default chunk size of 512.
support")
--- drivers/mtd/nand/pxa3xx_nand.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mtd/nand/pxa3xx_nand.c +3 -0
@@ -1475,6 +1475,9 @@ static int pxa3xx_nand_scan(struct mtd_iif (pdata->keep_config && !pxa3xx_nand_detect_config (info)) goto KEEP_CONFIG; +/* Set a default chunk size */ + info->chunk_size =512 ; + ret =pxa3xx_nand_sensing (info);if (ret) { dev_info(&info->pdev->dev, "There is no chip on cs %d!\n",
Greg Kroah-Hartman
maintainerPATCH 141/202 mtd: nand: sunxi: fix sunxi_nand_chips_cleanup()
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris BREZILLON <[email protected]>
commit 8e375ccda31ccc73b087134e263c48d2114534f4 upstream.
The sunxi_nand_chips_cleanup() function is missing a call to list_del() which generates a double free error.
--- drivers/mtd/nand/sunxi_nand.c | 1 + 1 file changed, 1 insertion(+)
drivers/mtd/nand/sunxi_nand.c +1 -0
@@ -1312,6 +1312,7 @@ static void sunxi_nand_chips_cleanup(str node);nand_release (&chip->mtd);sunxi_nand_ecc_cleanup (&chip->nand.ecc); +list_del (&chip->node); } }
Greg Kroah-Hartman
maintainerPATCH 142/202 mtd: nand: sunxi: fix OOB handling in ->write_xxx() functions
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris BREZILLON <[email protected]>
commit 03a0e8a7c5ea29b5c4e72dfd64900b47a8fb6f2d upstream.
The USER_DATA register cannot be accessed using byte accessors on A13 SoCs, thus triggering a bug when using memcpy_toio on this register. Declare an helper macros to convert an OOB buffer into a suitable USER_DATA value and vice-versa.
This patch also fixes an error in the oob_required logic (some OOB data are not written even if the user required it) by removing the oob_required condition, which is perfectly valid since the core already fill ->oob_poi with FFs when oob_required is false.
--- drivers/mtd/nand/sunxi_nand.c | 26 +++++++++----------------- 1 file changed, 9 insertions(+), 17 deletions(-)
drivers/mtd/nand/sunxi_nand.c +9 -17
@@ -138,6 +138,10 @@#define NFC_ECC_MODE GENMASK(15, 12)#define NFC_RANDOM_SEED GENMASK(30, 16) +/* NFC_USER_DATA helper macros */ +#define NFC_BUF_TO_USER_DATA (buf) ((buf)[0] | ((buf)[1] << 8) | \ + ((buf)[2] << 16) | ((buf)[3] << 24)) +#define NFC_DEFAULT_TIMEOUT_MS 1000#define NFC_SRAM_SIZE 1024
@@ -632,15 +636,9 @@ static int sunxi_nfc_hw_ecc_write_page(s offset = layout->eccpos[i * ecc->bytes] -4 + mtd->writesize;/* Fill OOB data in */ -if (oob_required) { - tmp =0xffffffff ; -memcpy_toio (nfc->regs +NFC_REG_USER_DATA_BASE , &tmp, -4 ); - }else { -memcpy_toio (nfc->regs +NFC_REG_USER_DATA_BASE , - chip->oob_poi + offset - mtd->writesize, -4 ); - } +writel (NFC_BUF_TO_USER_DATA (chip->oob_poi + + layout->oobfree[i].offset), + nfc->regs +NFC_REG_USER_DATA_BASE ); chip->cmdfunc (mtd,NAND_CMD_RNDIN , offset,-1 );
@@ -770,14 +768,8 @@ static int sunxi_nfc_hw_syndrome_ecc_wri offset += ecc->size;/* Fill OOB data in */ -if (oob_required) { - tmp =0xffffffff ; -memcpy_toio (nfc->regs +NFC_REG_USER_DATA_BASE , &tmp, -4 ); - }else { -memcpy_toio (nfc->regs +NFC_REG_USER_DATA_BASE , oob, -4 ); - } +writel (NFC_BUF_TO_USER_DATA (oob), + nfc->regs +NFC_REG_USER_DATA_BASE ); tmp =NFC_DATA_TRANS |NFC_DATA_SWAP_METHOD |NFC_ACCESS_DIR | (1 <<30 );
Greg Kroah-Hartman
maintainerPATCH 143/202 PM / AVS: rockchip-io: depend on CONFIG_POWER_AVS
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Stuebner <[email protected]>
commit 28c1f1628ee4b163e615eefe1b6463e3d229a873 upstream.
The rockchip io-domain driver currently only depends on ARCH_ROCKCHIP itself. This makes it possible to select the power-domain driver, but not the POWER_AVS class and results in the iodomain-driver not getting build in this case.
So add the additional dependency, which also results in the driver config option now being placed nicely into the AVS submenu.
--- drivers/power/avs/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/avs/Kconfig +1 -1
@@ -13,7 +13,7 @@ menuconfig POWER_AVS config ROCKCHIP_IODOMAIN tristate "Rockchip IO domain support" - depends on ARCH_ROCKCHIP && OF + depends on POWER_AVS && ARCH_ROCKCHIP && OF help Say y here to enable support io domains on Rockchip SoCs. It is necessary for the io domain setting of the SoC to match the
Greg Kroah-Hartman
maintainerPATCH 144/202 device property: fix potential NULL pointer dereference
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit ecc87eed7beeb50c0be0b73322d62135277ea2b0 upstream.
In device_add_property_set() we check pset parameter for a NULL, but few lines later we do a pointer arithmetic without check that will crash kernel in the set_secondary_fwnode().
Here we check if pset parameter is NULL and return immediately.
--- drivers/base/property.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/base/property.c +3 -2
@@ -26,9 +26,10 @@*/ void device_add_property_set (struct device *dev,struct property_set *pset) { -if (pset) - pset->fwnode.type =FWNODE_PDATA ; +if (!pset) +return ; + pset->fwnode.type =FWNODE_PDATA ;set_secondary_fwnode (dev, &pset->fwnode); }EXPORT_SYMBOL_GPL (device_add_property_set);
Greg Kroah-Hartman
maintainerPATCH 145/202 ath10k: reject 11b tx fragmentation configuration
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kazior <[email protected]>
commit 92092fe528e79c9bd25784ca0ef341d5a1d1b642 upstream.
Even though there's a WMI enum for fragmentation threshold no known firmware actually implements it. Moreover it is not possible to rely frame fragmentation to mac80211 because firmware clears the "more fragments" bit in frame control making it impossible for remote devices to reassemble frames.
Hence implement a dummy callback just to say fragmentation isn't supported. This effectively prevents mac80211 from doing frame fragmentation in software.
This fixes Tx becoming broken after setting fragmentation threshold.
--- drivers/net/wireless/ath/ath10k/mac.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/net/wireless/ath/ath10k/mac.c +16 -0
@@ -4464,6 +4464,21 @@ static int ath10k_set_rts_threshold(strureturn ret; } +static int ath10k_mac_op_set_frag_threshold (struct ieee80211_hw *hw,u32 value) +{ +/* Even though there's a WMI enum for fragmentation threshold no known +* firmware actually implements it. Moreover it is not possible to rely +* frame fragmentation to mac80211 because firmware clears the "more +* fragments" bit in frame control making it impossible for remote +* devices to reassemble frames. +* +* Hence implement a dummy callback just to say fragmentation isn't +* supported. This effectively prevents mac80211 from doing frame +* fragmentation in software. +*/ +return -EOPNOTSUPP ; +} +static void ath10k_flush (struct ieee80211_hw *hw,struct ieee80211_vif *vif,u32 queues,bool drop) {
@@ -5108,6 +5123,7 @@ static const struct ieee80211_ops ath10k .remain_on_channel = ath10k_remain_on_channel, .cancel_remain_on_channel = ath10k_cancel_remain_on_channel, .set_rts_threshold = ath10k_set_rts_threshold, + .set_frag_threshold = ath10k_mac_op_set_frag_threshold, .flush = ath10k_flush, .tx_last_beacon = ath10k_tx_last_beacon, .set_antenna = ath10k_set_antenna,
Greg Kroah-Hartman
maintainerPATCH 146/202 pcmcia: sa11x0: fix missing clk_put() in sa11x0 socket drivers
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <[email protected]>
commit 72010aca55264cfe6516a955066c846d3885b0c6 upstream.
Fix the lack of clk_put() in sa11xx_base.c's error cleanup paths by converting the driver to the devm_* API.
--- drivers/pcmcia/sa1100_generic.c | 1 - drivers/pcmcia/sa11xx_base.c | 3 +-- 2 files changed, 1 insertion(+), 3 deletions(-)
drivers/pcmcia/sa1100_generic.c +0 -1
@@ -93,7 +93,6 @@ static int sa11x0_drv_pcmcia_remove(strufor (i =0 ; i < sinfo->nskt; i++)soc_pcmcia_remove_one (&sinfo->skt[i]); -clk_put (sinfo->clk);kfree (sinfo);return 0 ; }
drivers/pcmcia/sa11xx_base.c +1 -2
@@ -222,7 +222,7 @@ int sa11xx_drv_pcmcia_probe(struct devicint i, ret =0 ;struct clk *clk; - clk =clk_get (dev,NULL ); + clk =devm_clk_get (dev,NULL );if (IS_ERR (clk))return PTR_ERR (clk);
@@ -251,7 +251,6 @@ int sa11xx_drv_pcmcia_probe(struct devicif (ret) {while (--i >=0 )soc_pcmcia_remove_one (&sinfo->skt[i]); -clk_put (clk);kfree (sinfo); }else {dev_set_drvdata (dev, sinfo);
Greg Kroah-Hartman
maintainerPATCH 147/202 ipr: Enable SIS pipe commands for SIS-32 devices.
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Krisman Bertazi <[email protected]>
commit e35d7f27fbd51a09a41a5439e39f22a3d102c00b upstream.
Remove unnecessary check that disabled SIS pipe commands for SIS-32 devices. This change was sufficient to enable raw mode and send SIS pipe commands for a 57B3 device.
--- drivers/scsi/ipr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/ipr.c +1 -1
@@ -4554,7 +4554,7 @@ static ssize_t ipr_store_raw_mode(structspin_lock_irqsave (ioa_cfg->host->host_lock, lock_flags); res = (struct ipr_resource_entry *)sdev->hostdata;if (res) { -if (ioa_cfg->sis64 &&ipr_is_af_dasd_device (res)) { +if (ipr_is_af_dasd_device (res)) { res->raw_mode =simple_strtoul (buf,NULL ,10 ); len =strlen (buf);if (res->sdev)
Greg Kroah-Hartman
maintainerPATCH 148/202 regmap: debugfs: Ensure we dont underflow when printing access masks
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit b763ec17ac762470eec5be8ebcc43e4f8b2c2b82 upstream.
If a read is attempted which is smaller than the line length then we may underflow the subtraction we're doing with the unsigned size_t type so move some of the calculation to be additions on the right hand side instead in order to avoid this.
--- drivers/base/regmap/regmap-debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap-debugfs.c +1 -1
@@ -432,7 +432,7 @@ static ssize_t regmap_access_read_file(s/* If we're in the region the user is trying to read */ if (p >= *ppos) {/* ...but not beyond it */ -if (buf_pos >= count -1 - tot_len) +if (buf_pos + tot_len +1 >= count)break ;/* Format the register */
Greg Kroah-Hartman
maintainerPATCH 149/202 regmap: debugfs: Dont bother actually printing when calculating max length
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit 176fc2d5770a0990eebff903ba680d2edd32e718 upstream.
The in kernel snprintf() will conveniently return the actual length of the printed string even if not given an output beffer at all so just do that rather than relying on the user to pass in a suitable buffer, ensuring that we don't need to worry if the buffer was truncated due to the size of the buffer passed in.
--- drivers/base/regmap/regmap-debugfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/base/regmap/regmap-debugfs.c +1 -2
@@ -32,8 +32,7 @@ static DEFINE_MUTEX(regmap_debugfs_early/* Calculate the length of a fixed format */ static size_t regmap_calc_reg_len (int max_val,char *buf,size_t buf_size) { -snprintf (buf, buf_size,"%x" , max_val); -return strlen (buf); +return snprintf (NULL ,0 ,"%x" , max_val); } static ssize_t regmap_name_read_file(struct file *file,
Greg Kroah-Hartman
maintainerPATCH 150/202 security: fix typo in security_task_prctl
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit b7f76ea2ef6739ee484a165ffbac98deb855d3d3 upstream.
--- include/linux/security.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/security.h +1 -1
@@ -2527,7 +2527,7 @@ static inline int security_task_prctl(inunsigned long arg4, unsigned long arg5) { - return cap_task_prctl(option, arg2, arg3, arg3, arg5); + return cap_task_prctl(option, arg2, arg3, arg4, arg5); }static inline void security_task_to_inode (struct task_struct *p,struct inode *inode)
Greg Kroah-Hartman
maintainerPATCH 151/202 usb: musb: dsps: fix polling in device-only mode
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bin Liu <[email protected]>
commit b8239dcc03afbd0886c1d9b91ba8fee7c6c9a6cb upstream.
Fix the regression caused by commit ad78c918602 ("usb: musb: dsps: just start polling already") which causes polling the ID pin status even in device-only mode.
--- drivers/usb/musb/musb_dsps.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/usb/musb/musb_dsps.c +5 -2
@@ -225,8 +225,11 @@ static void dsps_musb_enable(struct musbdsps_writel (reg_base, wrp->epintr_set, epmask);dsps_writel (reg_base, wrp->coreintr_set, coremask); -/* start polling for ID change. */ -mod_timer (&glue->timer, jiffies +msecs_to_jiffies (wrp->poll_timeout)); +/* start polling for ID change in dual-role idle mode */ +if (musb->xceiv->otg->state ==OTG_STATE_B_IDLE && + musb->port_mode ==MUSB_PORT_MODE_DUAL_ROLE ) +mod_timer (&glue->timer, jiffies + +msecs_to_jiffies (wrp->poll_timeout));dsps_musb_try_idle (musb,0 ); }
Greg Kroah-Hartman
maintainerPATCH 152/202 usb: chipidea: udc: using the correct stall implementation
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chen <[email protected]>
commit 56ffa1d154c7e12af16273f0cdc42690dd05caf5 upstream.
According to spec, there are functional and protocol stalls.
For functional stall, it is for bulk and interrupt endpoints, below are cases for it:
- Host sends SET_FEATURE request for Set-Halt, the udc driver needs to set stall, and return true unconditionally.
- The gadget driver may call usb_ep_set_halt to stall certain endpoints, if there is a transfer in pending, the udc driver should not set stall, and return -EAGAIN accordingly.
These two kinds of stall need to be cleared by host using CLEAR_FEATURE request (Clear-Halt).
For protocol stall, it is for control endpoint, this stall will be set if the control request has failed. This stall will be cleared by next setup request (hardware will do it).
It fixed usbtest (drivers/usb/misc/usbtest.c) Test 13 "set/clear halt" test failure, meanwhile, this change has been verified by USB2 CV Compliance Test and MSC Tests.
--- drivers/usb/chipidea/udc.c | 84 +++++++++++++++++++++++---------------------- 1 file changed, 44 insertions(+), 40 deletions(-)
drivers/usb/chipidea/udc.c +44 -40
@@ -656,6 +656,44 @@ __acquires(hwep->lock)return 0 ; } +static int _ep_set_halt (struct usb_ep *ep,int value,bool check_transfer) +{ + struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep); +int direction, retval =0 ; +unsigned long flags; + +if (ep ==NULL || hwep->ep.desc ==NULL ) +return -EINVAL ; + +if (usb_endpoint_xfer_isoc (hwep->ep.desc)) +return -EOPNOTSUPP ; + +spin_lock_irqsave (hwep->lock, flags); + +if (value && hwep->dir ==TX && check_transfer && + !list_empty (&hwep->qh.queue) && + !usb_endpoint_xfer_control (hwep->ep.desc)) { +spin_unlock_irqrestore (hwep->lock, flags); +return -EAGAIN ; + } + + direction = hwep->dir; +do { + retval |=hw_ep_set_halt (hwep->ci, hwep->num, hwep->dir, value); + +if (!value) + hwep->wedge =0 ; + +if (hwep->type ==USB_ENDPOINT_XFER_CONTROL ) + hwep->dir = (hwep->dir ==TX ) ?RX :TX ; + + }while (hwep->dir != direction); + +spin_unlock_irqrestore (hwep->lock, flags); +return retval; +} + +/** * _gadget_stop_activity: stops all USB activity, flushes & disables all endpts * @gadget: gadget
@@ -1051,7 +1089,7 @@ __acquires(ci->lock) num += ci->hw_ep_max /2 ;spin_unlock (&ci->lock); - err =usb_ep_set_halt (&ci->ci_hw_ep[num].ep); + err =_ep_set_halt (&ci->ci_hw_ep[num].ep,1 , false);spin_lock (&ci->lock);if (!err)isr_setup_status_phase (ci);
@@ -1110,8 +1148,8 @@ delegate:if (err <0 ) {spin_unlock (&ci->lock); -if (usb_ep_set_halt (&hwep->ep)) -dev_err (ci->dev,"error: ep_set_halt\n" ); +if (_ep_set_halt (&hwep->ep,1 , false)) +dev_err (ci->dev,"error: _ep_set_halt\n" );spin_lock (&ci->lock); } }
@@ -1142,9 +1180,9 @@ __acquires(ci->lock) err =isr_setup_status_phase (ci);if (err <0 ) {spin_unlock (&ci->lock); -if (usb_ep_set_halt (&hwep->ep)) +if (_ep_set_halt (&hwep->ep,1 , false))dev_err (ci->dev, -"error: ep_set_halt\n" ); +"error: _ep_set_halt\n" );spin_lock (&ci->lock); } }
@@ -1390,41 +1428,7 @@ static int ep_dequeue(struct usb_ep *ep,*/ static int ep_set_halt (struct usb_ep *ep,int value) { - struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep); -int direction, retval =0 ; -unsigned long flags; - -if (ep ==NULL || hwep->ep.desc ==NULL ) -return -EINVAL ; - -if (usb_endpoint_xfer_isoc (hwep->ep.desc)) -return -EOPNOTSUPP ; - -spin_lock_irqsave (hwep->lock, flags); - -#ifndef STALL_IN -/* g_file_storage MS compliant but g_zero fails chapter 9 compliance */ -if (value && hwep->type ==USB_ENDPOINT_XFER_BULK && hwep->dir ==TX && - !list_empty (&hwep->qh.queue)) { -spin_unlock_irqrestore (hwep->lock, flags); -return -EAGAIN ; - } -#endif - - direction = hwep->dir; -do { - retval |=hw_ep_set_halt (hwep->ci, hwep->num, hwep->dir, value); - -if (!value) - hwep->wedge =0 ; - -if (hwep->type ==USB_ENDPOINT_XFER_CONTROL ) - hwep->dir = (hwep->dir ==TX ) ?RX :TX ; - - }while (hwep->dir != direction); - -spin_unlock_irqrestore (hwep->lock, flags); -return retval; +return _ep_set_halt (ep, value, true); }/**
Greg Kroah-Hartman
maintainerPATCH 153/202 usb: Use the USB_SS_MULT() macro to get the burst multiplier.
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit ff30cbc8da425754e8ab96904db1d295bd034f27 upstream.
Bits 1:0 of the bmAttributes are used for the burst multiplier. The rest of the bits used to be reserved (zero), but USB3.1 takes bit 7 into use.
Use the existing USB_SS_MULT() macro instead to make sure the mult value and hence max packet calculations are correct for USB3.1 devices.
Note that burst multiplier in bmAttributes is zero based and that the USB_SS_MULT() macro adds one.
--- drivers/usb/core/config.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/core/config.c +3 -2
@@ -112,7 +112,7 @@ static void usb_parse_ss_endpoint_compan cfgno, inum, asnum, ep->desc.bEndpointAddress); ep->ss_ep_comp.bmAttributes =16 ; }else if (usb_endpoint_xfer_isoc (&ep->desc) && - desc->bmAttributes >2 ) { +USB_SS_MULT (desc->bmAttributes) >3 ) { dev_warn(ddev, "Isoc endpoint has Mult of %d in " "config %d interface %d altsetting %d ep %d: " "setting to 3\n", desc->bmAttributes + 1,
@@ -121,7 +121,8 @@ static void usb_parse_ss_endpoint_compan }if (usb_endpoint_xfer_isoc (&ep->desc)) - max_tx = (desc->bMaxBurst +1 ) * (desc->bmAttributes +1 ) * + max_tx = (desc->bMaxBurst +1 ) * + (USB_SS_MULT (desc->bmAttributes)) *usb_endpoint_maxp (&ep->desc);else if (usb_endpoint_xfer_int (&ep->desc)) max_tx = usb_endpoint_maxp(&ep->desc) *
Greg Kroah-Hartman
maintainerPATCH 154/202 usb: phy: phy-generic: Fix reset behaviour on legacy boot
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <[email protected]>
commit 762982db33b23029e98c844611e2e8beeb75bc0d upstream.
The gpio-desc migration done in v4.0 caused a regression with legacy boots due to reversed reset logic. e.g. omap3-beagle USB host breaks on legacy boot.
Request the reset GPIO with GPIOF_ACTIVE_LOW flag so that it matches the driver logic and pin behaviour.
--- drivers/usb/phy/phy-generic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/phy/phy-generic.c +2 -1
@@ -230,7 +230,8 @@ int usb_phy_gen_create_phy(struct device clk_rate = pdata->clk_rate; needs_vcc = pdata->needs_vcc;if (gpio_is_valid (pdata->gpio_reset)) { - err =devm_gpio_request_one (dev, pdata->gpio_reset,0 , + err =devm_gpio_request_one (dev, pdata->gpio_reset, +GPIOF_ACTIVE_LOW ,dev_name (dev));if (!err) nop->gpiod_reset =
Greg Kroah-Hartman
maintainerPATCH 155/202 usb: musb: cppi41: allow it to work again
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit b0a688ddcc5015eb26000c63841db7c46cfb380a upstream.
since commit 33c300cb90a6 ("usb: musb: dsps:
don't fake of_node to musb core") we have been preventing CPPI 4.1 from probing due to NULL of_node. We can't revert said commit otherwise a different regression would show up, so the fix is to look for the parent device's (glue layer's) of_node instead, since that's the thing which is actually described in DTS.
--- drivers/usb/musb/musb_cppi41.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/musb/musb_cppi41.c +3 -3
@@ -614,7 +614,7 @@ static int cppi41_dma_controller_start(s {struct musb *musb = controller->musb;struct device *dev = musb->controller; -struct device_node *np = dev->of_node; +struct device_node *np = dev->parent->of_node;struct cppi41_dma_channel *cppi41_channel;int count;int i;
@@ -664,7 +664,7 @@ static int cppi41_dma_controller_start(s musb_dma->status =MUSB_DMA_STATUS_FREE ; musb_dma->max_len =SZ_4M ; - dc =dma_request_slave_channel (dev, str); + dc =dma_request_slave_channel (dev->parent, str);if (!dc) {dev_err (dev,"Failed to request %s.\n" , str); ret = -EPROBE_DEFER ;
@@ -694,7 +694,7 @@ struct dma_controller *dma_controller_crstruct cppi41_dma_controller *controller;int ret =0 ; -if (!musb->controller->of_node) { +if (!musb->controller->parent->of_node) {dev_err (musb->controller,"Need DT for the DMA engine.\n" );return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 156/202 USB: chaoskey read offset bug
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Inyukhin <[email protected]>
commit 1d5c47f555c5ae050fad22e4a99f88856cae5d05 upstream.
Rng reads in chaoskey driver could return the same data under the certain conditions.
--- drivers/usb/misc/chaoskey.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/misc/chaoskey.c +1 -1
@@ -472,7 +472,7 @@ static int chaoskey_rng_read(struct hwrnif (this_time > max) this_time = max; -memcpy (data, dev->buf, this_time); +memcpy (data, dev->buf + dev->used, this_time); dev->used += this_time;
Greg Kroah-Hartman
maintainerPATCH 157/202 usb: Add device quirk for Logitech PTZ cameras
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Palatin <[email protected]>
commit 72194739f54607bbf8cfded159627a2015381557 upstream.
Add a device quirk for the Logitech PTZ Pro Camera and its sibling the ConferenceCam CC3000e Camera.
This fixes the failed camera enumeration on some boot, particularly on machines with fast CPU.
Tested by connecting a Logitech PTZ Pro Camera to a machine with a Haswell Core i7-4600U CPU @ 2.10GHz, and doing thousands of reboot cycles while recording the kernel logs and taking camera picture after each boot. Before the patch, more than 7% of the boots show some enumeration transfer failures and in a few of them, the kernel is giving up before actually enumerating the webcam. After the patch, the enumeration has been correct on every reboot.
--- drivers/usb/core/quirks.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/core/quirks.c +7 -0
@@ -54,6 +54,13 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT }, + /* Logitech ConferenceCam CC3000e */ + { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT }, + { USB_DEVICE(0x046d, 0x0848), .driver_info = USB_QUIRK_DELAY_INIT }, + + /* Logitech PTZ Pro Camera */ + { USB_DEVICE(0x046d, 0x0853), .driver_info = USB_QUIRK_DELAY_INIT }, + /* Logitech Quickcam Fusion */ { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
Greg Kroah-Hartman
maintainerPATCH 158/202 USB: Add reset-resume quirk for two Plantronics usb headphones.
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yao-Wen Mao <[email protected]>
commit 8484bf2981b3d006426ac052a3642c9ce1d8d980 upstream.
These two headphones need a reset-resume quirk to properly resume to original volume level.
--- drivers/usb/core/quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/core/quirks.c +6 -0
@@ -85,6 +85,12 @@ static const struct usb_device_id usb_qu/* Philips PSC805 audio device */ { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME }, + /* Plantronic Audio 655 DSP */ + { USB_DEVICE(0x047f, 0xc008), .driver_info = USB_QUIRK_RESET_RESUME }, + + /* Plantronic Audio 648 USB */ + { USB_DEVICE(0x047f, 0xc013), .driver_info = USB_QUIRK_RESET_RESUME }, + /* Artisman Watchdog Dongle */ { USB_DEVICE(0x04b4, 0x0526), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
Greg Kroah-Hartman
maintainerPATCH 160/202 cpufreq: dt: Tolerance applies on both sides of target voltage
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
commit a2022001cebd0825b96aa0f3345ea3ad44ae79d4 upstream.
Tolerance applies on both sides of the target voltage, i.e. both min and max sides. But while checking if a voltage is supported by the regulator or not, we haven't taken care of tolerance on the lower side. Fix that.
--- drivers/cpufreq/cpufreq-dt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/cpufreq/cpufreq-dt.c +2 -1
@@ -255,7 +255,8 @@ static int cpufreq_init(struct cpufreq_prcu_read_unlock (); tol_uV = opp_uV * priv->voltage_tolerance /100 ; -if (regulator_is_supported_voltage (cpu_reg, opp_uV, +if (regulator_is_supported_voltage (cpu_reg, + opp_uV - tol_uV, opp_uV + tol_uV)) {if (opp_uV < min_uV) min_uV = opp_uV;
Greg Kroah-Hartman
maintainerPATCH 161/202 MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <[email protected]>
commit 53960059d56ecef67d4ddd546731623641a3d2d1 upstream.
If there is a DMA zone (usually 24bit = 16MB I believe), but no DMA32 zone, as is the case for some 32-bit kernels, then massage_gfp_flags() will cause DMA memory allocated for devices with a 32..63-bit coherent_dma_mask to fall back to using __GFP_DMA, even though there may only be 32-bits of physical address available anyway.
Correct that case to compare against a mask the size of phys_addr_t instead of always using a 64-bit mask.
Patchwork: https://patchwork.linux-mips.org/patch/9610/
--- arch/mips/mm/dma-default.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/mm/dma-default.c +1 -1
@@ -100,7 +100,7 @@ static gfp_t massage_gfp_flags(const str else#endif #if defined(CONFIG_ZONE_DMA ) && !defined(CONFIG_ZONE_DMA32 ) -if (dev->coherent_dma_mask <DMA_BIT_MASK (64 )) +if (dev->coherent_dma_mask <DMA_BIT_MASK (sizeof (phys_addr_t) *8 )) dma_flag = __GFP_DMA; else#endif
Greg Kroah-Hartman
maintainerPATCH 167/202 tools lib traceevent: Fix string handling in heterogeneous arch environments
In reply to Greg Kroah-Hartman4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kapileshwar Singh <[email protected]>
commit c2e4b24ff848bb180f9b9cd873a38327cd219ad2 upstream.
When a trace recorded on a 32-bit device is processed with a 64-bit binary, the higher 32-bits of the address need to ignored.
The lack of this results in the output of the 64-bit pointer value to the trace as the 32-bit address lookup fails in find_printk().
Before:
burn-1778 [003] 548.600305: bputs: 0xc0046db2s: 2cec5c058d98c
After:
burn-1778 [003] 548.600305: bputs: 0xc0046db2s: RT throttling activated
The problem occurs in PRINT_FIELD when the field is recognized as a pointer to a string (of the type const char *)
Heterogeneous architectures cases below can arise and should be handled:
* Traces recorded using 32-bit addresses processed on a 64-bit machine
* Traces recorded using 64-bit addresses processed on a 32-bit machine
--- tools/lib/traceevent/event-parse.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-)
tools/lib/traceevent/event-parse.c +20 -3
@@ -3721,7 +3721,7 @@ static void print_str_arg(struct trace_sstruct format_field *field;struct printk_map *printk;long long val, fval; -unsigned long addr; +unsigned long long addr;char *str;unsigned char *hex;int print;
@@ -3754,13 +3754,30 @@ static void print_str_arg(struct trace_s*/ if (!(field->flags &FIELD_IS_ARRAY ) && field->size == pevent->long_size) { - addr = *(unsigned long *)(data + field->offset); + +/* Handle heterogeneous recording and processing +* architectures +* +* CASE I: +* Traces recorded on 32-bit devices (32-bit +* addressing) and processed on 64-bit devices: +* In this case, only 32 bits should be read. +* +* CASE II: +* Traces recorded on 64 bit devices and processed +* on 32-bit devices: +* In this case, 64 bits must be read. +*/ + addr = (pevent->long_size ==8 ) ? + *(unsigned long long *)(data + field->offset) : + (unsigned long long )*(unsigned int *)(data + field->offset); +/* Check if it matches a print format */ printk =find_printk (pevent, addr);if (printk)trace_seq_puts (s, printk->printk);else -trace_seq_printf (s,"%lx" , addr); +trace_seq_printf (s,"%llx" , addr);break ; } str =malloc (len +1 );