3.2.9-stable review
Subsystems (61)
Greg KH
maintainercover 3.2.9-stable review
This is the start of the stable review cycle for the 3.2.9 release. There are 72 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Mar 1 00:00.00 UTC 2012. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.2.9-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Makefile | 4 +- arch/arm/common/pl330.c | 3 +- arch/arm/include/asm/assembler.h | 5 + arch/arm/mach-at91/at91rm9200_devices.c | 2 +- arch/arm/mach-at91/at91sam9260_devices.c | 2 +- arch/arm/mach-at91/at91sam9261_devices.c | 2 +- arch/arm/mach-at91/at91sam9263_devices.c | 2 +- arch/arm/mach-omap2/vp.c | 5 + arch/arm/mm/cache-v7.S | 6 + arch/powerpc/kernel/perf_event.c | 8 +- arch/s390/kernel/time.c | 7 +- arch/x86/kernel/cpu/intel_cacheinfo.c | 44 ++++- drivers/base/regmap/regcache.c | 4 +- drivers/cdrom/cdrom.c | 8 +- drivers/gpu/drm/radeon/r100.c | 4 +- drivers/gpu/drm/radeon/rs600.c | 4 +- drivers/hwmon/ads1015.c | 3 +- drivers/hwmon/f75375s.c | 5 +- drivers/hwmon/max6639.c | 22 +- drivers/infiniband/ulp/ipoib/ipoib.h | 6 +- drivers/infiniband/ulp/ipoib/ipoib_main.c | 55 ++---- drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 9 +- drivers/media/rc/imon.c | 26 ++- drivers/media/video/hdpvr/hdpvr-video.c | 3 +- drivers/mmc/card/block.c | 82 ++++---- drivers/net/can/sja1000/sja1000.c | 13 +- drivers/net/ethernet/3com/3c59x.c | 2 +- drivers/net/ethernet/jme.c | 10 +- drivers/net/ethernet/jme.h | 2 +- drivers/net/ethernet/ti/davinci_emac.c | 6 +- drivers/net/ethernet/via/via-velocity.c | 3 - drivers/net/usb/ipheth.c | 5 + drivers/net/veth.c | 4 +- drivers/net/wireless/ath/ath9k/rc.c | 2 +- drivers/pci/probe.c | 5 + drivers/scsi/scsi_pm.c | 16 ++ drivers/scsi/scsi_priv.h | 1 + drivers/scsi/scsi_scan.c | 4 +- drivers/target/target_core_alua.c | 8 +- drivers/target/target_core_cdb.c | 28 ++-- drivers/target/target_core_device.c | 4 +- drivers/target/target_core_pr.c | 38 ++-- drivers/target/target_core_pscsi.c | 4 +- drivers/target/target_core_transport.c | 45 +++- drivers/usb/core/hcd-pci.c | 5 +- drivers/usb/core/hcd.c | 6 +- drivers/usb/core/hub.c | 30 ++-- drivers/usb/host/pci-quirks.c | 11 + drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-mem.c | 32 +++- drivers/usb/host/xhci.c | 5 + drivers/usb/serial/cp210x.c | 2 + drivers/usb/serial/option.c | 143 ++------------ drivers/usb/serial/ti_usb_3410_5052.c | 6 +- drivers/usb/serial/ti_usb_3410_5052.h | 4 + drivers/usb/storage/usb.c | 89 +++----- drivers/usb/storage/usb.h | 7 +- drivers/video/omap2/dss/dpi.c | 5 + fs/ecryptfs/inode.c | 2 + fs/eventpoll.c | 264 +++++++++++++++++++++--- fs/namei.c | 4 +- fs/nfs/nfs4proc.c | 23 ++- fs/nfs/nfs4state.c | 2 + fs/nfs/nfs4xdr.c | 5 +- fs/signalfd.c | 15 ++ include/asm-generic/poll.h | 2 + include/linux/eventpoll.h | 1 + include/linux/fs.h | 1 + include/linux/nfs_xdr.h | 2 +- include/linux/signalfd.h | 5 +- include/linux/usb/ch11.h | 10 +- include/net/flow.h | 10 + include/net/route.h | 4 + include/net/sch_generic.h | 9 +- include/target/target_core_base.h | 1 + include/target/target_core_transport.h | 4 +- kernel/fork.c | 5 +- kernel/irq/autoprobe.c | 4 +- kernel/irq/chip.c | 42 +++- kernel/irq/internals.h | 2 +- kernel/irq/manage.c | 2 +- mm/nommu.c | 7 + net/core/dev.c | 10 +- net/core/netpoll.c | 2 +- net/ipv4/arp.c | 3 +- net/ipv4/ip_options.c | 2 +- net/ipv4/tcp_input.c | 45 +++-- net/ipv4/tcp_ipv4.c | 5 + net/mac80211/main.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 2 +- net/sched/sch_choke.c | 3 +- net/sched/sch_netem.c | 7 +- net/sched/sch_sfb.c | 3 +- scripts/package/builddeb | 12 +- sound/pci/hda/patch_conexant.c | 11 +- sound/pci/hda/patch_realtek.c | 19 ++- sound/soc/codecs/wm8962.c | 2 +- 97 files changed, 890 insertions(+), 534 deletions(-)
Greg KH
maintainerPATCH 1/72 Security: tomoyo: add .gitignore file
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 735e93c70434614bffac4a914ca1da72e37d43c0 upstream.
This adds the .gitignore file for the autogenerated TOMOYO files to keep git from complaining after building things.
--- security/tomoyo/.gitignore | 2 ++ 1 file changed, 2 insertions(+)
security/tomoyo/.gitignore new file +2 -0
@@ -0,0 +1,2 @@ +builtin-policy.h +policy/
Greg KH
maintainerPATCH 2/72 powerpc/perf: power_pmu_start restores incorrect values, breaking frequency events
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit 9a45a9407c69d068500923480884661e2b9cc421 upstream.
perf on POWER stopped working after commit e050e3f0a71b (perf: Fix broken interrupt rate throttling). That patch exposed a bug in the POWER perf_events code.
Since the PMCs count upwards and take an exception when the top bit is set, we want to write 0x80000000 - left in power_pmu_start. We were instead programming in left which effectively disables the counter until we eventually hit 0x80000000. This could take seconds or longer.
With the patch applied I get the expected number of samples:
SAMPLE events: 9948
--- arch/powerpc/kernel/perf_event.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
arch/powerpc/kernel/perf_event.c +7 -1
@@ -865,6 +865,7 @@ static void power_pmu_start(struct perf_ {unsigned long flags;s64 left; +unsigned long val;if (!event->hw.idx || !event->hw.sample_period)return ;
@@ -880,7 +881,12 @@ static void power_pmu_start(struct perf_ event->hw.state =0 ; left =local64_read (&event->hw.period_left); -write_pmc (event->hw.idx, left); + + val =0 ; +if (left <0x80000000L ) + val =0x80000000L - left; + +write_pmc (event->hw.idx, val);perf_event_update_userpage (event);perf_pmu_enable (event->pmu);
Greg KH
maintainerPATCH 3/72 ARM: at91: USB AT91 gadget registration for module
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <[email protected]>
commit e8c9dc93e27d891636defbc269f182a83e6abba8 upstream.
Registration of at91_udc as a module will enable SoC related code.
Fix following an idea from Karel Znamenacek.
--- arch/arm/mach-at91/at91rm9200_devices.c | 2 +- arch/arm/mach-at91/at91sam9260_devices.c | 2 +- arch/arm/mach-at91/at91sam9261_devices.c | 2 +- arch/arm/mach-at91/at91sam9263_devices.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-)
arch/arm/mach-at91/at91rm9200_devices.c +1 -1
@@ -83,7 +83,7 @@ void __init at91_add_device_usbh(struct* USB Device (Gadget) * -------------------------------------------------------------------- */ -#ifdef CONFIG_USB_AT91 +#if defined(CONFIG_USB_AT91 ) || defined(CONFIG_USB_AT91_MODULE )static struct at91_udc_data udc_data; static struct resource udc_resources[] = {
arch/arm/mach-at91/at91sam9260_devices.c +1 -1
@@ -84,7 +84,7 @@ void __init at91_add_device_usbh(struct* USB Device (Gadget) * -------------------------------------------------------------------- */ -#ifdef CONFIG_USB_AT91 +#if defined(CONFIG_USB_AT91 ) || defined(CONFIG_USB_AT91_MODULE )static struct at91_udc_data udc_data; static struct resource udc_resources[] = {
arch/arm/mach-at91/at91sam9261_devices.c +1 -1
@@ -87,7 +87,7 @@ void __init at91_add_device_usbh(struct* USB Device (Gadget) * -------------------------------------------------------------------- */ -#ifdef CONFIG_USB_AT91 +#if defined(CONFIG_USB_AT91 ) || defined(CONFIG_USB_AT91_MODULE )static struct at91_udc_data udc_data; static struct resource udc_resources[] = {
arch/arm/mach-at91/at91sam9263_devices.c +1 -1
@@ -92,7 +92,7 @@ void __init at91_add_device_usbh(struct* USB Device (Gadget) * -------------------------------------------------------------------- */ -#ifdef CONFIG_USB_AT91 +#if defined(CONFIG_USB_AT91 ) || defined(CONFIG_USB_AT91_MODULE )static struct at91_udc_data udc_data; static struct resource udc_resources[] = {
Greg KH
maintainerPATCH 4/72 drm/radeon/kms: fix MSI re-arm on rv370+
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit b7f5b7dec3d539a84734f2bcb7e53fbb1532a40b upstream.
MSI_REARM_EN register is a write only trigger register. There is no need RMW when re-arming.
May fix:
https://bugs.freedesktop.org/show_bug.cgi?id=41668
--- drivers/gpu/drm/radeon/r100.c | 4 +--- drivers/gpu/drm/radeon/rs600.c | 4 +--- 2 files changed, 2 insertions(+), 6 deletions(-)
drivers/gpu/drm/radeon/r100.c +1 -3
@@ -789,9 +789,7 @@ int r100_irq_process(struct radeon_devicWREG32 (RADEON_AIC_CNTL , msi_rearm |RS400_MSI_REARM );break ;default : - msi_rearm =RREG32 (RADEON_MSI_REARM_EN ) & ~RV370_MSI_REARM_EN ; -WREG32 (RADEON_MSI_REARM_EN , msi_rearm); -WREG32 (RADEON_MSI_REARM_EN , msi_rearm |RV370_MSI_REARM_EN ); +WREG32 (RADEON_MSI_REARM_EN ,RV370_MSI_REARM_EN );break ; } }
drivers/gpu/drm/radeon/rs600.c +1 -3
@@ -693,9 +693,7 @@ int rs600_irq_process(struct radeon_deviWREG32 (RADEON_BUS_CNTL , msi_rearm |RS600_MSI_REARM );break ;default : - msi_rearm =RREG32 (RADEON_MSI_REARM_EN ) & ~RV370_MSI_REARM_EN ; -WREG32 (RADEON_MSI_REARM_EN , msi_rearm); -WREG32 (RADEON_MSI_REARM_EN , msi_rearm |RV370_MSI_REARM_EN ); +WREG32 (RADEON_MSI_REARM_EN ,RV370_MSI_REARM_EN );break ; } }
Greg KH
maintainerPATCH 5/72 PCI: workaround hard-wired bus number V2
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yinghai Lu <[email protected]>
commit 71f6bd4a23130cd2f4b036010c5790b1295290b9 upstream.
Fixes PCI device detection on IBM xSeries IBM 3850 M2 / x3950 M2 when using ACPI resources (_CRS).
This is default, a manual workaround (without this patch) would be pci=nocrs boot param.
V2: Add dev_warn if the workaround is hit. This should reveal how common such setups are (via google) and point to possible problems if things are still not working as expected. -> Suggested by Jan Beulich.
--- drivers/pci/probe.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/pci/probe.c +5 -0
@@ -651,6 +651,11 @@ int __devinit pci_scan_bridge(struct pcidev_dbg (&dev->dev,"scanning [bus %02x-%02x] behind bridge, pass %d\n" , secondary, subordinate, pass); +if (!primary && (primary != bus->number) && secondary && subordinate) { +dev_warn (&dev->dev,"Primary bus is hard wired to 0\n" ); + primary = bus->number; + } +/* Check if setup is sensible at all */ if (!pass && (primary != bus->number || secondary <= bus->number)) {
Greg KH
maintainerPATCH 6/72 mac80211: Fix a rwlock bad magic bug
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammed Shafi Shajakhan <[email protected]>
commit b57e6b560fc2a2742910ac5ca0eb2c46e45aeac2 upstream.
read_lock(&tpt_trig->trig.leddev_list_lock) is accessed via the path ieee80211_open (->) ieee80211_do_open (->) ieee80211_mod_tpt_led_trig (->) ieee80211_start_tpt_led_trig (->) tpt_trig_timer before initializing it.
the intilization of this read/write lock happens via the path ieee80211_led_init (->) led_trigger_register, but we are doing 'ieee80211_led_init' after 'ieeee80211_if_add' where we register netdev_ops.
so we access leddev_list_lock before initializing it and causes the following bug in chrome laptops with AR928X cards with the following script
while true
do
sudo modprobe -v ath9k
sleep 3
sudo modprobe -r ath9k
sleep 3
done
BUG: rwlock bad magic on CPU#1, wpa_supplicant/358, f5b9eccc Pid: 358, comm: wpa_supplicant Not tainted 3.0.13 #1 Call Trace: [<8137b9df>] rwlock_bug+0x3d/0x47 [<81179830>] do_raw_read_lock+0x19/0x29 [<8137f063>] _raw_read_lock+0xd/0xf [<f9081957>] tpt_trig_timer+0xc3/0x145 [mac80211] [<f9081f3a>] ieee80211_mod_tpt_led_trig+0x152/0x174 [mac80211] [<f9076a3f>] ieee80211_do_open+0x11e/0x42e [mac80211] [<f9075390>] ? ieee80211_check_concurrent_iface+0x26/0x13c [mac80211] [<f9076d97>] ieee80211_open+0x48/0x4c [mac80211] [<812dbed8>] __dev_open+0x82/0xab [<812dc0c9>] __dev_change_flags+0x9c/0x113 [<812dc1ae>] dev_change_flags+0x18/0x44 [<8132144f>] devinet_ioctl+0x243/0x51a [<81321ba9>] inet_ioctl+0x93/0xac [<812cc951>] sock_ioctl+0x1c6/0x1ea [<812cc78b>] ? might_fault+0x20/0x20 [<810b1ebb>] do_vfs_ioctl+0x46e/0x4a2 [<810a6ebb>] ? fget_light+0x2f/0x70 [<812ce549>] ? sys_recvmsg+0x3e/0x48 [<810b1f35>] sys_ioctl+0x46/0x69 [<8137fa77>] sysenter_do_call+0x12/0x2
--- net/mac80211/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mac80211/main.c +2 -2
@@ -885,6 +885,8 @@ int ieee80211_register_hw(struct ieee802wiphy_debug (local->hw.wiphy,"Failed to initialize wep: %d\n" , result); +ieee80211_led_init (local); +rtnl_lock (); result = ieee80211_init_rate_ctrl_alg(local,
@@ -906,8 +908,6 @@ int ieee80211_register_hw(struct ieee802rtnl_unlock (); -ieee80211_led_init (local); - local->network_latency_notifier.notifier_call = ieee80211_max_network_latency; result = pm_qos_add_notifier(PM_QOS_NETWORK_LATENCY,
Greg KH
maintainerPATCH 7/72 ipheth: Add iPhone 4S
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Gardner <[email protected]>
commit 72ba009b8a159e995e40d3b4e5d7d265acead983 upstream.
--- drivers/net/usb/ipheth.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/usb/ipheth.c +5 -0
@@ -60,6 +60,7 @@#define USB_PRODUCT_IPHONE_3GS 0x1294#define USB_PRODUCT_IPHONE_4 0x1297#define USB_PRODUCT_IPHONE_4_VZW 0x129c +#define USB_PRODUCT_IPHONE_4S 0x12a0#define IPHETH_USBINTF_CLASS 255#define IPHETH_USBINTF_SUBCLASS 253
@@ -103,6 +104,10 @@ static struct usb_device_id ipheth_table USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4_VZW,IPHETH_USBINTF_CLASS ,IPHETH_USBINTF_SUBCLASS , IPHETH_USBINTF_PROTO) }, + { USB_DEVICE_AND_INTERFACE_INFO( +USB_VENDOR_APPLE ,USB_PRODUCT_IPHONE_4S , +IPHETH_USBINTF_CLASS ,IPHETH_USBINTF_SUBCLASS , + IPHETH_USBINTF_PROTO) }, { } };MODULE_DEVICE_TABLE (usb, ipheth_table);
Greg KH
maintainerPATCH 8/72 regmap: Fix cache defaults initialization from raw cache defaults
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <[email protected]>
commit 61cddc57dc14a5dffa0921d9a24fd68edbb374ac upstream.
Currently registers with a value of 0 are ignored when initializing the register defaults from raw defaults. This worked in the past, because registers without a explicit default were assumed to have a default value of 0. This was changed in commit b03622a8 ("regmap: Ensure rbtree syncs registers set to zero properly"). As a result registers, which have a raw default value of 0 are now assumed to have no default. This again can result in unnecessary writes when syncing the cache. It will also result in unnecessary reads for e.g. the first update operation. In the case where readback is not possible this will even let the update operation fail, if the register has not been written to before.
So this patch removes the check. Instead it adds a check to ignore raw defaults for registers which are volatile, since those registers are not cached.
--- drivers/base/regmap/regcache.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/base/regmap/regcache.c +2 -2
@@ -54,7 +54,7 @@ static int regcache_hw_init(struct regmafor (count =0 , i =0 ; i < map->num_reg_defaults_raw; i++) { val =regcache_get_val (map->reg_defaults_raw, i, map->cache_word_size); -if (!val) +if (regmap_volatile (map, i))continue ; count++; }
@@ -69,7 +69,7 @@ static int regcache_hw_init(struct regmafor (i =0 , j =0 ; i < map->num_reg_defaults_raw; i++) { val =regcache_get_val (map->reg_defaults_raw, i, map->cache_word_size); -if (!val) +if (regmap_volatile (map, i))continue ; map->reg_defaults[j].reg = i; map->reg_defaults[j].def = val;
Greg KH
maintainerPATCH 9/72 eCryptfs: Copy up lower inode attrs after setting lower xattr
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyler Hicks <[email protected]>
commit 545d680938be1e86a6c5250701ce9abaf360c495 upstream.
After passing through a ->setxattr() call, eCryptfs needs to copy the inode attributes from the lower inode to the eCryptfs inode, as they may have changed in the lower filesystem's ->setxattr() path.
One example is if an extended attribute containing a POSIX Access Control List is being set. The new ACL may cause the lower filesystem to modify the mode of the lower inode and the eCryptfs inode would need to be updated to reflect the new mode.
https://launchpad.net/bugs/926292
--- fs/ecryptfs/inode.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ecryptfs/inode.c +2 -0
@@ -1104,6 +1104,8 @@ ecryptfs_setxattr(struct dentry *dentry, } rc =vfs_setxattr (lower_dentry, name, value, size, flags); +if (!rc) +fsstack_copy_attr_all (dentry->d_inode, lower_dentry->d_inode); out:return rc; }
Greg KH
maintainerPATCH 10/72 S390: correct ktime to tod clock comparator conversion
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <[email protected]>
commit cf1eb40f8f5ea12c9e569e7282161fc7f194fd62 upstream.
The conversion of the ktime to a value suitable for the clock comparator does not take changes to wall_to_monotonic into account. In fact the conversion just needs the boot clock (sched_clock_base_cc) and the total_sleep_time.
This is applicable to 3.2+ kernels.
--- arch/s390/kernel/time.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
arch/s390/kernel/time.c +5 -2
@@ -113,11 +113,14 @@ static void fixup_clock_comparator(unsigstatic int s390_next_ktime (ktime_t expires,struct clock_event_device *evt) { +struct timespec ts;u64 nsecs; - nsecs =ktime_to_ns (ktime_sub (expires,ktime_get_monotonic_offset ())); + ts.tv_sec = ts.tv_nsec =0 ; +monotonic_to_bootbased (&ts); + nsecs =ktime_to_ns (ktime_add (timespec_to_ktime (ts), expires));do_div (nsecs,125 ); - S390_lowcore.clock_comparator =TOD_UNIX_EPOCH + (nsecs <<9 ); + S390_lowcore.clock_comparator = sched_clock_base_cc + (nsecs <<9 );set_clock_comparator (S390_lowcore.clock_comparator);return 0 ; }
Greg KH
maintainerPATCH 11/72 vfs: fix d_inode_lookup() dentry ref leak
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit e188dc02d3a9c911be56eca5aa114fe7e9822d53 upstream.
d_inode_lookup() leaks a dentry reference on IS_DEADDIR().
--- fs/namei.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/namei.c +3 -1
@@ -1094,8 +1094,10 @@ static struct dentry *d_inode_lookup(strstruct dentry *old;/* Don't create child dentry for a dead directory. */ -if (unlikely (IS_DEADDIR (inode))) +if (unlikely (IS_DEADDIR (inode))) { +dput (dentry);return ERR_PTR (-ENOENT ); + } old = inode->i_op->lookup (inode, dentry, nd);if (unlikely (old)) {
Greg KH
maintainerPATCH 12/72 ARM: 7326/2: PL330: fix null pointer dereference in pl330_chan_ctrl()
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javi Merino <[email protected]>
commit 46e33c606af8e0caeeca374103189663d877c0d6 upstream.
This fixes the thrd->req_running field being accessed before thrd is checked for null. The error was introduced in
abb959f: ARM: 7237/1: PL330: Fix driver freeze
Reference: <[email protected]>
--- arch/arm/common/pl330.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/common/pl330.c +2 -1
@@ -1496,12 +1496,13 @@ int pl330_chan_ctrl(void *ch_id, enum plstruct pl330_thread *thrd = ch_id;struct pl330_dmac *pl330;unsigned long flags; -int ret =0 , active = thrd->req_running; +int ret =0 , active;if (!thrd || thrd->free || thrd->dmac->state ==DYING )return -EINVAL ; pl330 = thrd->dmac; + active = thrd->req_running;spin_lock_irqsave (&pl330->lock, flags);
Re: [ 12/72] ARM: 7326/2: PL330: fix null pointer dereference in pl330_chan_ctrl()
Quoted 5 lines · Greg KH
3.2-stable review patch. �If anyone has any objections, please let me know.
------------------
From: Javi Merino <[email protected]>
I'm pretty sure I wrote that patch...
Signature · 1 line
Mans Rullgard / mru
Re: [ 12/72] ARM: 7326/2: PL330: fix null pointer dereference in pl330_chan_ctrl()
Quoted 8 lines · Mans Rullgard
Quoted 5 lines · Greg KH
3.2-stable review patch. �If anyone has any objections, please let me know.
------------------
From: Javi Merino <[email protected]>
I'm pretty sure I wrote that patch...
But if you don't submit it, or Javi doesn't include a From: line and submits it instead, then this is what happens.
Signature · 3 lines
Russell King Linux kernel 2.6 ARM Linux - http://www.arm.linux.org.uk/ maintainer of:
Re: [ 12/72] ARM: 7326/2: PL330: fix null pointer dereference in pl330_chan_ctrl()
Quoted 9 lines · Russell King
Quoted 8 lines · Mans Rullgard
Quoted 5 lines · Greg KH
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javi Merino <[email protected]>
I'm pretty sure I wrote that patch...
Yes, you are in the Signed-off-by and I asked you to submit it a couple of times.
Quoted 2 lines
But if you don't submit it, or Javi doesn't include a From: line and submits it instead, then this is what happens.
I didn't know I could include a From: line but I thought Single-off-by meant something like authorship.
Sorry for that,
Javi
Re: [ 12/72] ARM: 7326/2: PL330: fix null pointer dereference in pl330_chan_ctrl()
Quoted 7 lines · Javi Merino
Quoted 6 lines · Russell King
Quoted 5 lines · Mans Rullgard
Quoted 4 lines · Greg KH
3.2-stable review patch. �If anyone has any objections, please let me know.
------------------
Quoted 7 lines
Quoted 3 lines
Quoted 3 lines
Quoted 1 line
From: Javi Merino <[email protected]>
I'm pretty sure I wrote that patch...
Yes, you are in the Signed-off-by and I asked you to submit it a couple of times.
I was away (at ELC and elsewhere) without decent net access at the time, so thanks for doing the submission.
Quoted 7 lines
Quoted 2 lines
But if you don't submit it, or Javi doesn't include a From: line and submits it instead, then this is what happens.
I didn't know I could include a From: line but I thought Single-off-by meant something like authorship.
Sorry for that,
Don't worry, it's a trivial patch not worth fretting about.
Signature · 1 line
Mans Rullgard / mru
Greg KH
maintainerPATCH 13/72 ALSA: hda - Fix redundant jack creations for cx5051
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[Note that since the patch isn't applicable (and unnecessary) to 3.3-rc, there is no corresponding upstream fix.]
The cx5051 parser calls snd_hda_input_jack_add() in the init callback to create and initialize the jack detection instances. Since the init callback is called at each time when the device gets woken up after suspend or power-saving mode, the duplicated instances are accumulated at each call. This ends up with the kernel warnings with the too large array size.
The fix is simply to move the calls of snd_hda_input_jack_add() into the parser section instead of the init callback.
The fix is needed only up to 3.2 kernel, since the HD-audio jack layer was redesigned in the 3.3 kernel.
--- sound/pci/hda/patch_conexant.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
sound/pci/hda/patch_conexant.c +10 -1
@@ -1899,6 +1899,10 @@ static void cxt5051_init_mic_port(structsnd_hda_codec_write (codec, nid,0 ,AC_VERB_SET_UNSOLICITED_ENABLE ,AC_USRSP_EN | event); +} + +static void cxt5051_init_mic_jack (struct hda_codec *codec,hda_nid_t nid) +{snd_hda_input_jack_add (codec, nid,SND_JACK_MICROPHONE ,NULL );snd_hda_input_jack_report (codec, nid); }
@@ -1916,7 +1920,6 @@ static int cxt5051_init(struct hda_codecstruct conexant_spec *spec = codec->spec;conexant_init (codec); -conexant_init_jacks (codec);if (spec->auto_mic &AUTO_MIC_PORTB )cxt5051_init_mic_port (codec,0x17 ,CXT5051_PORTB_EVENT );
@@ -2037,6 +2040,12 @@ static int patch_cxt5051(struct hda_codeif (spec->beep_amp)snd_hda_attach_beep_device (codec, spec->beep_amp); +conexant_init_jacks (codec); +if (spec->auto_mic &AUTO_MIC_PORTB ) +cxt5051_init_mic_jack (codec,0x17 ); +if (spec->auto_mic &AUTO_MIC_PORTC ) +cxt5051_init_mic_jack (codec,0x18 ); +return 0 ; }
Greg KH
maintainerPATCH 14/72 mmc: core: check for zero length ioctl data
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Rudholm <[email protected]>
commit 4d6144de8ba263eb3691a737c547e5b2fdc45287 upstream.
If the read or write buffer size associated with the command sent through the mmc_blk_ioctl is zero, do not prepare data buffer.
This enables a ioctl(2) call to for instance send a MMC_SWITCH to set a byte in the ext_csd.
--- drivers/mmc/card/block.c | 82 +++++++++++++++++++++++++---------------------- 1 file changed, 45 insertions(+), 37 deletions(-)
drivers/mmc/card/block.c +45 -37
@@ -266,6 +266,9 @@ static struct mmc_blk_ioc_data *mmc_blk_ goto idata_err; } +if (!idata->buf_bytes) +return idata; + idata->buf =kzalloc (idata->buf_bytes,GFP_KERNEL );if (!idata->buf) { err = -ENOMEM ;
@@ -312,25 +315,6 @@ static int mmc_blk_ioctl_cmd(struct blocif (IS_ERR (idata))return PTR_ERR (idata); - cmd.opcode = idata->ic.opcode; - cmd.arg = idata->ic.arg; - cmd.flags = idata->ic.flags; - - data.sg = &sg; - data.sg_len =1 ; - data.blksz = idata->ic.blksz; - data.blocks = idata->ic.blocks; - -sg_init_one (data.sg, idata->buf, idata->buf_bytes); - -if (idata->ic.write_flag) - data.flags =MMC_DATA_WRITE ; -else - data.flags =MMC_DATA_READ ; - - mrq.cmd = &cmd; - mrq.data = &data; - md =mmc_blk_get (bdev->bd_disk);if (!md) { err = -EINVAL ;
@@ -343,6 +327,48 @@ static int mmc_blk_ioctl_cmd(struct bloc goto cmd_done; } + cmd.opcode = idata->ic.opcode; + cmd.arg = idata->ic.arg; + cmd.flags = idata->ic.flags; + +if (idata->buf_bytes) { + data.sg = &sg; + data.sg_len =1 ; + data.blksz = idata->ic.blksz; + data.blocks = idata->ic.blocks; + +sg_init_one (data.sg, idata->buf, idata->buf_bytes); + +if (idata->ic.write_flag) + data.flags =MMC_DATA_WRITE ; +else + data.flags =MMC_DATA_READ ; + +/* data.flags must already be set before doing this. */ +mmc_set_data_timeout (&data, card); + +/* Allow overriding the timeout_ns for empirical tuning. */ +if (idata->ic.data_timeout_ns) + data.timeout_ns = idata->ic.data_timeout_ns; + +if ((cmd.flags &MMC_RSP_R1B ) ==MMC_RSP_R1B ) { +/* +* Pretend this is a data transfer and rely on the +* host driver to compute timeout. When all host +* drivers support cmd.cmd_timeout for R1B, this +* can be changed to: +* +* mrq.data = NULL; +* cmd.cmd_timeout = idata->ic.cmd_timeout_ms; +*/ + data.timeout_ns = idata->ic.cmd_timeout_ms *1000000 ; + } + + mrq.data = &data; + } + + mrq.cmd = &cmd; +mmc_claim_host (card->host);if (idata->ic.is_acmd) {
@@ -351,24 +377,6 @@ static int mmc_blk_ioctl_cmd(struct bloc goto cmd_rel_host; } -/* data.flags must already be set before doing this. */ -mmc_set_data_timeout (&data, card); -/* Allow overriding the timeout_ns for empirical tuning. */ -if (idata->ic.data_timeout_ns) - data.timeout_ns = idata->ic.data_timeout_ns; - -if ((cmd.flags &MMC_RSP_R1B ) ==MMC_RSP_R1B ) { -/* -* Pretend this is a data transfer and rely on the host driver -* to compute timeout. When all host drivers support -* cmd.cmd_timeout for R1B, this can be changed to: -* -* mrq.data = NULL; -* cmd.cmd_timeout = idata->ic.cmd_timeout_ms; -*/ - data.timeout_ns = idata->ic.cmd_timeout_ms *1000000 ; - } -mmc_wait_for_req (card->host, &mrq);if (cmd.error) {
Greg KH
maintainerPATCH 15/72 NFSv4: Fix an Oops in the NFSv4 getacl code
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit 331818f1c468a24e581aedcbe52af799366a9dfe upstream.
Commit bf118a342f10dafe44b14451a1392c3254629a1f (NFSv4: include bitmap in nfsv4 get acl data) introduces the 'acl_scratch' page for the case where we may need to decode multi-page data. However it fails to take into account the fact that the variable may be NULL (for the case where we're not doing multi-page decode), and it also attaches it to the encoding xdr_stream rather than the decoding one.
The immediate result is an Oops in nfs4_xdr_enc_getacl due to the call to page_address() with a NULL page pointer.
--- fs/nfs/nfs4proc.c | 8 ++++---- fs/nfs/nfs4xdr.c | 5 ++++- include/linux/nfs_xdr.h | 2 +- 3 files changed, 9 insertions(+), 6 deletions(-)
fs/nfs/nfs4proc.c +4 -4
@@ -3568,8 +3568,8 @@ static ssize_t __nfs4_get_acl_uncached(s }if (npages >1 ) {/* for decoding across pages */ - args.acl_scratch =alloc_page (GFP_KERNEL ); -if (!args.acl_scratch) + res.acl_scratch =alloc_page (GFP_KERNEL ); +if (!res.acl_scratch) goto out_free; } args.acl_len = npages *PAGE_SIZE ;
@@ -3605,8 +3605,8 @@ out_free:for (i =0 ; i < npages; i++)if (pages[i])__free_page (pages[i]); -if (args.acl_scratch) -__free_page (args.acl_scratch); +if (res.acl_scratch) +__free_page (res.acl_scratch);return ret; }
fs/nfs/nfs4xdr.c +4 -1
@@ -2522,7 +2522,6 @@ static void nfs4_xdr_enc_getacl(struct rxdr_inline_pages (&req->rq_rcv_buf, replen <<2 , args->acl_pages, args->acl_pgbase, args->acl_len); -xdr_set_scratch_buffer (xdr,page_address (args->acl_scratch),PAGE_SIZE );encode_nops (&hdr); }
@@ -6034,6 +6033,10 @@ nfs4_xdr_dec_getacl(struct rpc_rqst *rqsstruct compound_hdr hdr;int status; +if (res->acl_scratch !=NULL ) { +void *p =page_address (res->acl_scratch); +xdr_set_scratch_buffer (xdr, p,PAGE_SIZE ); + } status =decode_compound_hdr (xdr, &hdr);if (status) goto out;
include/linux/nfs_xdr.h +1 -1
@@ -602,7 +602,6 @@ struct nfs_getaclargs {size_t acl_len;unsigned int acl_pgbase;struct page ** acl_pages; -struct page * acl_scratch;struct nfs4_sequence_args seq_args; };
@@ -612,6 +611,7 @@ struct nfs_getaclres {size_t acl_len;size_t acl_data_offset;int acl_flags; +struct page * acl_scratch;struct nfs4_sequence_res seq_res; };
Greg KH
maintainerPATCH 16/72 NFSv4: Ensure we throw out bad delegation stateids on NFS4ERR_BAD_STATEID
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit b9f9a03150969e4bd9967c20bce67c4de769058f upstream.
To ensure that we don't just reuse the bad delegation when we attempt to recover the nfs4_state that received the bad stateid error.
--- fs/nfs/nfs4state.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfs/nfs4state.c +2 -0
@@ -1071,6 +1071,8 @@ void nfs4_schedule_stateid_recovery(cons {struct nfs_client *clp = server->nfs_client; +if (test_and_clear_bit (NFS_DELEGATED_STATE , &state->flags)) +nfs_async_inode_return_delegation (state->inode, &state->stateid);nfs4_state_mark_reclaim_nograce (clp, state);nfs4_schedule_state_manager (clp); }
Greg KH
maintainerPATCH 17/72 NFSv4: fix server_scope memory leak
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <[email protected]>
commit abe9a6d57b4544ac208401f9c0a4262814db2be4 upstream.
server_scope would never be freed if nfs4_check_cl_exchange_flags() returned non-zero
--- fs/nfs/nfs4proc.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
fs/nfs/nfs4proc.c +9 -6
@@ -4876,8 +4876,10 @@ int nfs4_proc_exchange_id(struct nfs_cli clp->cl_rpcclient->cl_auth->au_flavor); res.server_scope =kzalloc (sizeof (struct server_scope ),GFP_KERNEL ); -if (unlikely (!res.server_scope)) -return -ENOMEM ; +if (unlikely (!res.server_scope)) { + status = -ENOMEM ; + goto out; + } status =rpc_call_sync (clp->cl_rpcclient, &msg,RPC_TASK_TIMEOUT );if (!status)
@@ -4894,12 +4896,13 @@ int nfs4_proc_exchange_id(struct nfs_cli clp->server_scope =NULL ; } -if (!clp->server_scope) +if (!clp->server_scope) { clp->server_scope = res.server_scope; -else -kfree (res.server_scope); + goto out; + } } - +kfree (res.server_scope); +out:dprintk ("<-- %s status= %d\n" , __func__, status);return status; }
Greg KH
maintainerPATCH 18/72 ARM: 7321/1: cache-v7: Disable preemption when reading CCSIDR
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
commit b46c0f74657d1fe1c1b0c1452631cc38a9e6987f upstream.
armv7's flush_cache_all() flushes caches via set/way. To determine the cache attributes (line size, number of sets, etc.) the assembly first writes the CSSELR register to select a cache level and then reads the CCSIDR register. The CSSELR register is banked per-cpu and is used to determine which cache level CCSIDR reads. If the task is migrated between when the CSSELR is written and the CCSIDR is read the CCSIDR value may be for an unexpected cache level (for example L1 instead of L2) and incorrect cache flushing could occur.
Disable interrupts across the write and read so that the correct cache attributes are read and used for the cache flushing routine. We disable interrupts instead of disabling preemption because the critical section is only 3 instructions and we want to call v7_dcache_flush_all from __v7_setup which doesn't have a full kernel stack with a struct thread_info.
This fixes a problem we see in scm_call() when flush_cache_all() is called from preemptible context and sometimes the L2 cache is not properly flushed out.
--- arch/arm/mm/cache-v7.S | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm/mm/cache-v7.S +6 -0
@@ -54,9 +54,15 @@ loop1: and r1, r1, #7 @ mask of the bits for current cache only cmp r1, #2 @ see what cache we have at this level blt skip @ skip if no cache, or just i-cache +#ifdef CONFIG_PREEMPT + save_and_disable_irqs r9 @ make cssr&csidr read atomic +#endif mcr p15, 2, r10, c0, c0, 0 @ select current cache level in cssr isb @ isb to sych the new cssr&csidr mrc p15, 1, r1, c0, c0, 0 @ read the new csidr +#ifdef CONFIG_PREEMPT + restore_irqs_notrace r9 +#endif and r2, r1, #7 @ extract the length of the cache lines add r2, r2, #4 @ add 4 (line length offset) ldr r4, =0x3ff
Greg KH
maintainerPATCH 19/72 ARM: 7325/1: fix v7 boot with lockdep enabled
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rabin Vincent <[email protected]>
commit 8e43a905dd574f54c5715d978318290ceafbe275 upstream.
Bootup with lockdep enabled has been broken on v7 since b46c0f74657d ("ARM: 7321/1: cache-v7: Disable preemption when reading CCSIDR").
This is because v7_setup (which is called very early during boot) calls v7_flush_dcache_all, and the save_and_disable_irqs added by that patch ends up attempting to call into lockdep C code (trace_hardirqs_off()) when we are in no position to execute it (no stack, MMU off).
Fix this by using a notrace variant of save_and_disable_irqs. The code already uses the notrace variant of restore_irqs.
--- arch/arm/include/asm/assembler.h | 5 +++++ arch/arm/mm/cache-v7.S | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)
arch/arm/include/asm/assembler.h +5 -0
@@ -137,6 +137,11 @@ disable_irq .endm + .macro save_and_disable_irqs_notrace, oldcpsr + mrs \oldcpsr, cpsr + disable_irq_notrace + .endm +/* * Restore interrupt state previously stored in a register. We don't * guarantee that this will preserve the flags.
arch/arm/mm/cache-v7.S +1 -1
@@ -55,7 +55,7 @@ loop1: cmp r1, #2 @ see what cache we have at this level blt skip @ skip if no cache, or just i-cache #ifdef CONFIG_PREEMPT - save_and_disable_irqs r9 @ make cssr&csidr read atomic + save_and_disable_irqs_notrace r9 @ make cssr&csidr read atomic #endif mcr p15, 2, r10, c0, c0, 0 @ select current cache level in cssr isb @ isb to sych the new cssr&csidr
Greg KH
maintainerPATCH 20/72 3c59x: shorten timer period for slave devices
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 3013dc0cceb9baaf25d5624034eeaa259bf99004 ]
Jean Delvare reported bonding on top of 3c59x adapters was not detecting network cable removal fast enough.
3c59x indeed uses a 60 seconds timer to check link status if carrier is on, and 5 seconds if carrier is off.
This patch reduces timer period to 5 seconds if device is a bonding slave.
--- drivers/net/ethernet/3com/3c59x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/3com/3c59x.c +1 -1
@@ -1842,7 +1842,7 @@ vortex_timer(unsigned long data) ok =1 ; } -if (!netif_carrier_ok (dev)) +if (dev->flags &IFF_SLAVE || !netif_carrier_ok (dev)) next_tick =5 *HZ ;if (vp->medialock)
Greg KH
maintainerPATCH 21/72 net: Dont proxy arp respond if iif == rt->dst.dev if private VLAN is disabled
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Graf <[email protected]>
[ Upstream commit 70620c46ac2b45c24b0f22002fdf5ddd1f7daf81 ]
Commit 653241 (net: RFC3069, private VLAN proxy arp support) changed the behavior of arp proxy to send arp replies back out on the interface the request came in even if the private VLAN feature is disabled.
Previously we checked rt->dst.dev != skb->dev for in scenarios, when proxy arp is enabled on for the netdevice and also when individual proxy neighbour entries have been added.
This patch adds the check back for the pneigh_lookup() scenario.
--- net/ipv4/arp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv4/arp.c +2 -1
@@ -867,7 +867,8 @@ static int arp_process(struct sk_buff *sif (addr_type ==RTN_UNICAST && (arp_fwd_proxy (in_dev, dev, rt) ||arp_fwd_pvlan (in_dev, dev, rt, sip, tip) || -pneigh_lookup (&arp_tbl, net, &tip, dev,0 ))) { + (rt->dst.dev != dev && +pneigh_lookup (&arp_tbl, net, &tip, dev,0 )))) { n =neigh_event_ns (&arp_tbl, sha, &sip, dev);if (n)neigh_release (n);
Greg KH
maintainerPATCH 22/72 netpoll: netpoll_poll_dev() should access dev->flags
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 58e05f357a039a94aa36475f8c110256f693a239 ]
commit 5a698af53f (bond: service netpoll arp queue on master device) tested IFF_SLAVE flag against dev->priv_flags instead of dev->flags
--- net/core/netpoll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/netpoll.c +1 -1
@@ -194,7 +194,7 @@ static void netpoll_poll_dev(struct net_poll_napi (dev); -if (dev->priv_flags &IFF_SLAVE ) { +if (dev->flags &IFF_SLAVE ) {if (dev->npinfo) {struct net_device *bond_dev = dev->master;struct sk_buff *skb;
Greg KH
maintainerPATCH 23/72 net_sched: Bug in netem reordering
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hagen Paul Pfeifer <[email protected]>
[ Upstream commit eb10192447370f19a215a8c2749332afa1199d46 ]
Not now, but it looks you are correct. q->qdisc is NULL until another additional qdisc is attached (beside tfifo). See 50612537e9ab2969312. The following patch should work.
From: Hagen Paul Pfeifer <[email protected]>
netem: catch NULL pointer by updating the real qdisc statistic
--- net/sched/sch_netem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/sched/sch_netem.c +2 -2
@@ -383,8 +383,8 @@ static int netem_enqueue(struct sk_buff q->counter =0 ;__skb_queue_head (&q->qdisc->q, skb); - q->qdisc->qstats.backlog +=qdisc_pkt_len (skb); - q->qdisc->qstats.requeues++; + sch->qstats.backlog +=qdisc_pkt_len (skb); + sch->qstats.requeues++; ret =NET_XMIT_SUCCESS ; }
Greg KH
maintainerPATCH 24/72 veth: Enforce minimum size of VETH_INFO_PEER
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hagen Paul Pfeifer <[email protected]>
[ Upstream commit 237114384ab22c174ec4641e809f8e6cbcfce774 ]
VETH_INFO_PEER carries struct ifinfomsg plus optional IFLA attributes. A minimal size of sizeof(struct ifinfomsg) must be enforced or we may risk accessing that struct beyond the limits of the netlink message.
--- drivers/net/veth.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/veth.c +3 -1
@@ -423,7 +423,9 @@ static void veth_dellink(struct net_deviunregister_netdevice_queue (peer, head); } -static const struct nla_policy veth_policy[VETH_INFO_MAX +1 ]; +static const struct nla_policy veth_policy[VETH_INFO_MAX +1 ] = { + [VETH_INFO_PEER ] = { .len =sizeof (struct ifinfomsg ) }, +};static struct rtnl_link_ops veth_link_ops = { .kind =DRV_NAME ,
Greg KH
maintainerPATCH 25/72 via-velocity: S3 resume fix.
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lv <[email protected]>
[ Upstream commit b530b1930bbd9d005345133f0ff0c556d2a52b19 ]
Initially diagnosed on Ubuntu 11.04 with kernel 2.6.38.
velocity_close is not called during a suspend / resume cycle in this driver and it has no business playing directly with power states.
--- drivers/net/ethernet/via/via-velocity.c | 3 --- 1 file changed, 3 deletions(-)
drivers/net/ethernet/via/via-velocity.c +0 -3
@@ -2489,9 +2489,6 @@ static int velocity_close(struct net_devif (dev->irq !=0 )free_irq (dev->irq, dev); -/* Power down the chip */ -pci_set_power_state (vptr->pdev, PCI_D3hot); -velocity_free_rings (vptr); vptr->flags &= (~VELOCITY_FLAGS_OPENED );
Greg KH
maintainerPATCH 26/72 ipv4: reset flowi parameters on route connect
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
[ Upstream commit e6b45241c57a83197e5de9166b3b0d32ac562609 ]
Eric Dumazet found that commit 813b3b5db83
(ipv4: Use caller's on-stack flowi as-is in output route lookups.) that comes in 3.0 added a regression. The problem appears to be that resulting flowi4_oif is used incorrectly as input parameter to some routing lookups. The result is that when connecting to local port without listener if the IP address that is used is not on a loopback interface we incorrectly assign RTN_UNICAST to the output route because no route is matched by oif=lo. The RST packet can not be sent immediately by tcp_v4_send_reset because it expects RTN_LOCAL.
So, change ip_route_connect and ip_route_newports to
update the flowi4 fields that are input parameters because we do not want unnecessary binding to oif.
To make it clear what are the input parameters that
can be modified during lookup and to show which fields of floiw4 are reused add a new function to update the flowi4
structure: flowi4_update_output.
Thanks to Yurij M. Plotnikov for providing a bug report including a program to reproduce the problem.
Thanks to Eric Dumazet for tracking the problem down to tcp_v4_send_reset and providing initial fix.
--- include/net/flow.h | 10 ++++++++++ include/net/route.h | 4 ++++ 2 files changed, 14 insertions(+)
include/net/flow.h +10 -0
@@ -90,6 +90,16 @@ static inline void flowi4_init_output(st fl4->fl4_dport = dport; fl4->fl4_sport = sport; } + +/* Reset some input parameters after previous lookup */ +static inline void flowi4_update_output (struct flowi4 *fl4,int oif,__u8 tos, +__be32 daddr,__be32 saddr) +{ + fl4->flowi4_oif = oif; + fl4->flowi4_tos = tos; + fl4->daddr = daddr; + fl4->saddr = saddr; +}struct flowi6 {
include/net/route.h +4 -0
@@ -270,6 +270,7 @@ static inline struct rtable *ip_route_coif (IS_ERR (rt))return rt;ip_rt_put (rt); +flowi4_update_output (fl4, oif, tos, fl4->daddr, fl4->saddr); }security_sk_classify_flow (sk,flowi4_to_flowi (fl4));return ip_route_output_flow (net, fl4, sk);
@@ -284,6 +285,9 @@ static inline struct rtable *ip_route_ne fl4->fl4_dport = dport; fl4->fl4_sport = sport;ip_rt_put (rt); +flowi4_update_output (fl4, sk->sk_bound_dev_if, +RT_CONN_FLAGS (sk), fl4->daddr, + fl4->saddr);security_sk_classify_flow (sk,flowi4_to_flowi (fl4));return ip_route_output_flow (sock_net (sk), fl4, sk); }
Greg KH
maintainerPATCH 27/72 tcp_v4_send_reset: binding oif to iif in no sock case
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lu <[email protected]>
[ Upstream commit e2446eaab5585555a38ea0df4e01ff313dbb4ac9 ]
Binding RST packet outgoing interface to incoming interface for tcp v4 when there is no socket associate with it. when sk is not NULL, using sk->sk_bound_dev_if instead. (suggested by Eric Dumazet).
This has few benefits:
1. tcp_v6_send_reset already did that.
2. This helps tcp connect with SO_BINDTODEVICE set. When connection is lost, we still able to sending out RST using same interface.
3. we are sending reply, it is most likely to be succeed if iif is used
--- net/ipv4/tcp_ipv4.c | 5 +++++ 1 file changed, 5 insertions(+)
net/ipv4/tcp_ipv4.c +5 -0
@@ -650,6 +650,11 @@ static void tcp_v4_send_reset(struct soc arg.iov[0].iov_len, IPPROTO_TCP, 0); arg.csumoffset = offsetof(struct tcphdr , check) /2 ; arg.flags = (sk &&inet_sk (sk)->transparent) ?IP_REPLY_ARG_NOSRCCHECK :0 ; +/* When socket is gone, all binding information is lost. +* routing might fail in this case. using iif for oif to +* make sure we can deliver it +*/ + arg.bound_dev_if = sk ? sk->sk_bound_dev_if :inet_iif (skb); net =dev_net (skb_dst (skb)->dev); arg.tos =ip_hdr (skb)->tos;
Greg KH
maintainerPATCH 28/72 ipv4: Fix wrong order of ip_rt_get_source() and update iph->daddr.
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Wei <[email protected]>
[ Upstream commit 5dc7883f2a7c25f8df40d7479687153558cd531b ]
This patch fix a bug which introduced by commit ac8a4810 (ipv4: Save nexthop address of LSRR/SSRR option to IPCB.).In that patch, we saved the nexthop of SRR in ip_option->nexthop and update iph->daddr until we get to ip_forward_options(), but we need to update it before ip_rt_get_source(), otherwise we may get a wrong src.
--- net/ipv4/ip_options.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/ip_options.c +1 -1
@@ -573,8 +573,8 @@ void ip_forward_options(struct sk_buff * }if (srrptr +3 <= srrspace) { opt->is_changed =1 ; -ip_rt_get_source (&optptr[srrptr-1 ], skb, rt);ip_hdr (skb)->daddr = opt->nexthop; +ip_rt_get_source (&optptr[srrptr-1 ], skb, rt); optptr[2 ] = srrptr+4 ; }else if (net_ratelimit ())printk (KERN_CRIT "ip_forward(): Argh! Destination lost!\n" );
Greg KH
maintainerPATCH 29/72 net: Make qdisc_skb_cb upper size bound explicit.
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "David S. Miller" <[email protected]>
[ Upstream commit 16bda13d90c8d5da243e2cfa1677e62ecce26860 ]
Just like skb->cb[], so that qdisc_skb_cb can be encapsulated inside of other data structures.
This is intended to be used by IPoIB so that it can remember addressing information stored at hard_header_ops->create() time that it can fetch when the packet gets to the transmit routine.
--- include/net/sch_generic.h | 9 ++++++++- net/sched/sch_choke.c | 3 +-- net/sched/sch_netem.c | 3 +-- net/sched/sch_sfb.c | 3 +-- 4 files changed, 11 insertions(+), 7 deletions(-)
include/net/sch_generic.h +8 -1
@@ -220,9 +220,16 @@ struct tcf_proto {struct qdisc_skb_cb {unsigned int pkt_len; -long data[]; +unsigned char data[24 ]; }; +static inline void qdisc_cb_private_validate (const struct sk_buff *skb,int sz) +{ +struct qdisc_skb_cb *qcb; +BUILD_BUG_ON (sizeof (skb->cb) <sizeof (unsigned int ) + sz); +BUILD_BUG_ON (sizeof (qcb->data) < sz); +} +static inline int qdisc_qlen (const struct Qdisc *q) {return q->q.qlen;
net/sched/sch_choke.c +1 -2
@@ -225,8 +225,7 @@ struct choke_skb_cb {static inline struct choke_skb_cb *choke_skb_cb (const struct sk_buff *skb) { -BUILD_BUG_ON (sizeof (skb->cb) < -sizeof (struct qdisc_skb_cb ) +sizeof (struct choke_skb_cb )); +qdisc_cb_private_validate (skb,sizeof (struct choke_skb_cb ));return (struct choke_skb_cb *)qdisc_skb_cb (skb)->data; }
net/sched/sch_netem.c +1 -2
@@ -118,8 +118,7 @@ struct netem_skb_cb {static inline struct netem_skb_cb *netem_skb_cb (struct sk_buff *skb) { -BUILD_BUG_ON (sizeof (skb->cb) < -sizeof (struct qdisc_skb_cb ) +sizeof (struct netem_skb_cb )); +qdisc_cb_private_validate (skb,sizeof (struct netem_skb_cb ));return (struct netem_skb_cb *)qdisc_skb_cb (skb)->data; }
net/sched/sch_sfb.c +1 -2
@@ -93,8 +93,7 @@ struct sfb_skb_cb {static inline struct sfb_skb_cb *sfb_skb_cb (const struct sk_buff *skb) { -BUILD_BUG_ON (sizeof (skb->cb) < -sizeof (struct qdisc_skb_cb ) +sizeof (struct sfb_skb_cb )); +qdisc_cb_private_validate (skb,sizeof (struct sfb_skb_cb ));return (struct sfb_skb_cb *)qdisc_skb_cb (skb)->data; }
Greg KH
maintainerPATCH 30/72 IPoIB: Stop lying about hard_header_len and use skb->cb to stash LL addresses
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roland Dreier <[email protected]>
[ Upstream commit 936d7de3d736e0737542641269436f4b5968e9ef ]
Commit a0417fa3a18a ("net: Make qdisc_skb_cb upper size bound explicit.") made it possible for a netdev driver to use skb->cb between its header_ops.create method and its .ndo_start_xmit method. Use this in ipoib_hard_header() to stash away the LL address (GID + QPN), instead of the "ipoib_pseudoheader" hack. This allows IPoIB to stop lying about its hard_header_len, which will let us fix the L2 check for GRO.
--- drivers/infiniband/ulp/ipoib/ipoib.h | 6 +- drivers/infiniband/ulp/ipoib/ipoib_main.c | 55 ++++++++----------------- drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 9 ---- 3 files changed, 24 insertions(+), 46 deletions(-)
drivers/infiniband/ulp/ipoib/ipoib.h +4 -2
@@ -44,6 +44,7 @@#include <linux/mutex.h> #include <net/neighbour.h> +#include <net/sch_generic.h> #include <linux/atomic.h>
@@ -117,8 +118,9 @@ struct ipoib_header {u16 reserved; }; -struct ipoib_pseudoheader { -u8 hwaddr[INFINIBAND_ALEN ]; +struct ipoib_cb { +struct qdisc_skb_cb qdisc_cb; +u8 hwaddr[INFINIBAND_ALEN ]; };/* Used for all multicast joins (broadcast, IPv4 mcast and IPv6 mcast) */
drivers/infiniband/ulp/ipoib/ipoib_main.c +19 -36
122 lines not on this page · raw message
drivers/infiniband/ulp/ipoib/ipoib_multicast.c +1 -8
@@ -262,21 +262,14 @@ static int ipoib_mcast_join_finish(strucnetif_tx_lock_bh (dev);while (!skb_queue_empty (&mcast->pkt_queue)) {struct sk_buff *skb =skb_dequeue (&mcast->pkt_queue); -struct dst_entry *dst =skb_dst (skb); -struct neighbour *n =NULL ;netif_tx_unlock_bh (dev); skb->dev = dev; -if (dst) - n =dst_get_neighbour_raw (dst); -if (!dst || !n) { -/* put pseudoheader back on for next time */ -skb_push (skb,sizeof (struct ipoib_pseudoheader )); - }if (dev_queue_xmit (skb))ipoib_warn (priv,"dev_queue_xmit failed to requeue packet\n" ); +netif_tx_lock_bh (dev); }netif_tx_unlock_bh (dev);
Greg KH
maintainerPATCH 31/72 gro: more generic L2 header check
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 5ca3b72c5da47d95b83857b768def6172fbc080a ]
Shlomo Pongratz reported GRO L2 header check was suited for Ethernet only, and failed on IB/ipoib traffic.
He provided a patch faking a zeroed header to let GRO aggregates frames.
Roland Dreier, Herbert Xu, and others suggested we change GRO L2 header check to be more generic, ie not assuming L2 header is 14 bytes, but taking into account hard_header_len.
__napi_gro_receive() has special handling for the common case (Ethernet) to avoid a memcmp() call and use an inline optimized function instead.
--- net/core/dev.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
net/core/dev.c +8 -2
@@ -3565,14 +3565,20 @@ static inline gro_result_t __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb) { struct sk_buff *p; +unsigned int maclen = skb->dev->hard_header_len;for (p = napi->gro_list; p; p = p->next) {unsigned long diffs; diffs = (unsigned long )p->dev ^ (unsigned long )skb->dev; diffs |= p->vlan_tci ^ skb->vlan_tci; - diffs |=compare_ether_header (skb_mac_header (p), -skb_gro_mac_header (skb)); +if (maclen ==ETH_HLEN ) + diffs |=compare_ether_header (skb_mac_header (p), +skb_gro_mac_header (skb)); +else if (!diffs) + diffs =memcmp (skb_mac_header (p), +skb_gro_mac_header (skb), + maclen);NAPI_GRO_CB (p)->same_flow = !diffs;NAPI_GRO_CB (p)->flush =0 ; }
Greg KH
maintainerPATCH 32/72 tcp: allow tcp_sacktag_one() to tag ranges not aligned with skbs
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit cc9a672ee522d4805495b98680f4a3db5d0a0af9 ]
This commit allows callers of tcp_sacktag_one() to pass in sequence ranges that do not align with skb boundaries, as tcp_shifted_skb() needs to do in an upcoming fix in this patch series.
In fact, now tcp_sacktag_one() does not need to depend on an input skb at all, which makes its semantics and dependencies more clear.
--- net/ipv4/tcp_input.c | 36 ++++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-)
net/ipv4/tcp_input.c +22 -14
@@ -1310,25 +1310,26 @@ static int tcp_match_skb_to_sack(structreturn in_sack; } -static u8 tcp_sacktag_one (const struct sk_buff *skb,struct sock *sk, -struct tcp_sacktag_state *state, +/* Mark the given newly-SACKed range as such, adjusting counters and hints. */ +static u8 tcp_sacktag_one (struct sock *sk, +struct tcp_sacktag_state *state,u8 sacked, +u32 start_seq,u32 end_seq,int dup_sack,int pcount) {struct tcp_sock *tp =tcp_sk (sk); -u8 sacked =TCP_SKB_CB (skb)->sacked;int fack_count = state->fack_count;/* Account D-SACK for retransmitted packet. */ if (dup_sack && (sacked &TCPCB_RETRANS )) {if (tp->undo_marker && tp->undo_retrans && -after (TCP_SKB_CB (skb)->end_seq, tp->undo_marker)) +after (end_seq, tp->undo_marker)) tp->undo_retrans--;if (sacked &TCPCB_SACKED_ACKED ) state->reord =min (fack_count, state->reord); }/* Nothing to do; acked frame is about to be dropped (was ACKed). */ -if (!after (TCP_SKB_CB (skb)->end_seq, tp->snd_una)) +if (!after (end_seq, tp->snd_una))return sacked;if (!(sacked &TCPCB_SACKED_ACKED )) {
@@ -1347,13 +1348,13 @@ static u8 tcp_sacktag_one(const struct s/* New sack for not retransmitted frame, * which was in hole. It is reordering. */ -if (before (TCP_SKB_CB (skb)->seq, +if (before (start_seq,tcp_highest_sack_seq (tp))) state->reord =min (fack_count, state->reord);/* SACK enhanced F-RTO (RFC4138; Appendix B) */ -if (!after (TCP_SKB_CB (skb)->end_seq, tp->frto_highmark)) +if (!after (end_seq, tp->frto_highmark)) state->flag |=FLAG_ONLY_ORIG_SACKED ; }
@@ -1371,8 +1372,7 @@ static u8 tcp_sacktag_one(const struct s/* Lost marker hint past SACKed? Tweak RFC3517 cnt */ if (!tcp_is_fack (tp) && (tp->lost_skb_hint !=NULL ) && -before (TCP_SKB_CB (skb)->seq, -TCP_SKB_CB (tp->lost_skb_hint)->seq)) +before (start_seq,TCP_SKB_CB (tp->lost_skb_hint)->seq)) tp->lost_cnt_hint += pcount;if (fack_count > tp->fackets_out)
@@ -1428,7 +1428,11 @@ static int tcp_shifted_skb(struct sock * }/* We discard results */ -tcp_sacktag_one (skb, sk, state, dup_sack, pcount); +tcp_sacktag_one (sk, state, +TCP_SKB_CB (skb)->sacked, +TCP_SKB_CB (skb)->seq, +TCP_SKB_CB (skb)->end_seq, + dup_sack, pcount);/* Difference in this won't matter, both ACKed by the same cumul. ACK */ TCP_SKB_CB (prev)->sacked |= (TCP_SKB_CB (skb)->sacked &TCPCB_EVER_RETRANS );
@@ -1667,10 +1671,14 @@ static struct sk_buff *tcp_sacktag_walk(break ;if (in_sack) { -TCP_SKB_CB (skb)->sacked =tcp_sacktag_one (skb, sk, - state, - dup_sack, -tcp_skb_pcount (skb)); +TCP_SKB_CB (skb)->sacked = +tcp_sacktag_one (sk, + state, +TCP_SKB_CB (skb)->sacked, +TCP_SKB_CB (skb)->seq, +TCP_SKB_CB (skb)->end_seq, + dup_sack, +tcp_skb_pcount (skb));if (!before (TCP_SKB_CB (skb)->seq,tcp_highest_sack_seq (tp)))
Greg KH
maintainerPATCH 33/72 tcp: fix range tcp_shifted_skb() passes to tcp_sacktag_one()
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit daef52bab1fd26e24e8e9578f8fb33ba1d0cb412 ]
Fix the newly-SACKed range to be the range of newly-shifted bytes.
Previously - since 832d11c5cd076abc0aa1eaf7be96c81d1a59ce41 - tcp_shifted_skb() incorrectly called tcp_sacktag_one() with the start and end sequence numbers of the skb it passes in set to the range just beyond the range that is newly-SACKed.
This commit also removes a special-case adjustment to lost_cnt_hint in tcp_shifted_skb() since the pre-existing adjustment of lost_cnt_hint in tcp_sacktag_one() now properly handles this things now that the correct start sequence number is passed in.
--- net/ipv4/tcp_input.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
net/ipv4/tcp_input.c +10 -9
@@ -1391,6 +1391,9 @@ static u8 tcp_sacktag_one(struct sock *sreturn sacked; } +/* Shift newly-SACKed bytes from this skb to the immediately previous +* already-SACKed sk_buff. Mark the newly-SACKed bytes as such. +*/ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb, struct tcp_sacktag_state *state, unsigned int pcount, int shifted, int mss,
@@ -1398,12 +1401,11 @@ static int tcp_shifted_skb(struct sock * {struct tcp_sock *tp =tcp_sk (sk);struct sk_buff *prev =tcp_write_queue_prev (sk, skb); +u32 start_seq =TCP_SKB_CB (skb)->seq;/* start of newly-SACKed */ +u32 end_seq = start_seq + shifted;/* end of newly-SACKed */ BUG_ON (!pcount); -if (skb == tp->lost_skb_hint) - tp->lost_cnt_hint += pcount; -TCP_SKB_CB (prev)->end_seq += shifted;TCP_SKB_CB (skb)->seq += shifted;
@@ -1427,12 +1429,11 @@ static int tcp_shifted_skb(struct sock *skb_shinfo (skb)->gso_type =0 ; } -/* We discard results */ -tcp_sacktag_one (sk, state, -TCP_SKB_CB (skb)->sacked, -TCP_SKB_CB (skb)->seq, -TCP_SKB_CB (skb)->end_seq, - dup_sack, pcount); +/* Adjust counters and hints for the newly sacked sequence range but +* discard the return value since prev is already marked. +*/ +tcp_sacktag_one (sk, state,TCP_SKB_CB (skb)->sacked, + start_seq, end_seq, dup_sack, pcount);/* Difference in this won't matter, both ACKed by the same cumul. ACK */ TCP_SKB_CB (prev)->sacked |= (TCP_SKB_CB (skb)->sacked &TCPCB_EVER_RETRANS );
Greg KH
maintainerPATCH 34/72 tcp: fix tcp_shifted_skb() adjustment of lost_cnt_hint for FACK
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit 0af2a0d0576205dda778d25c6c344fc6508fc81d ]
This commit ensures that lost_cnt_hint is correctly updated in tcp_shifted_skb() for FACK TCP senders. The lost_cnt_hint adjustment in tcp_sacktag_one() only applies to non-FACK senders, so FACK senders need their own adjustment.
This applies the spirit of 1e5289e121372a3494402b1b131b41bfe1cf9b7f - except now that the sequence range passed into tcp_sacktag_one() is correct we need only have a special case adjustment for FACK.
--- net/ipv4/tcp_input.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv4/tcp_input.c +4 -0
@@ -1406,6 +1406,10 @@ static int tcp_shifted_skb(struct sock *BUG_ON (!pcount); +/* Adjust hint for FACK. Non-FACK is handled in tcp_sacktag_one(). */ +if (tcp_is_fack (tp) && (skb == tp->lost_skb_hint)) + tp->lost_cnt_hint += pcount; +TCP_SKB_CB (prev)->end_seq += shifted;TCP_SKB_CB (skb)->seq += shifted;
Greg KH
maintainerPATCH 35/72 USB: Added Kamstrup VID/PIDs to cp210x serial driver.
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bruno Thomsen <[email protected]>
commit c6c1e4491dc8d1ed2509fa6aacffa7f34614fc38 upstream.
--- drivers/usb/serial/cp210x.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/cp210x.c +2 -0
@@ -136,6 +136,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */ { USB_DEVICE(0x16DC, 0x0012) }, /* W-IE-NE-R Plein & Baus GmbH MPOD Multi Channel Power Supply */ { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Control, Monitoring and Data Logger */ + { USB_DEVICE(0x17A8, 0x0001) }, /* Kamstrup Optical Eye/3-wire */ + { USB_DEVICE(0x17A8, 0x0005) }, /* Kamstrup M-Bus Master MultiPort 250D */ { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
Greg KH
maintainerPATCH 36/72 USB: option: cleanup zte 3g-dongles pid in option.c
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rui li <[email protected]>
commit b9e44fe5ecda4158c22bc1ea4bffa378a4f83f65 upstream.
1. Remove all old mass-storage ids's pid:
0x0026,0x0053,0x0098,0x0099,0x0149,0x0150,0x0160;
2. As the pid from 0x1401 to 0x1510 which have not surely assigned to use for serial-port or mass-storage port,so i think it should be removed now, and will re-add after it have assigned in future;
3. sort the pid to WCDMA and CDMA.
--- drivers/usb/serial/option.c | 143 ++++---------------------------------------- 1 file changed, 13 insertions(+), 130 deletions(-)
drivers/usb/serial/option.c +13 -130
@@ -788,7 +788,6 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0012, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0013, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0016, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff),
@@ -803,7 +802,6 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0024, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0025, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, -/* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0026, 0xff, 0xff, 0xff) }, */ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0028, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0029, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0030, 0xff, 0xff, 0xff) },
@@ -828,7 +826,6 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0051, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0052, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, -/* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0053, 0xff, 0xff, 0xff) }, */ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0054, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0055, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
@@ -836,7 +833,6 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0057, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0058, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0061, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0062, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0063, 0xff, 0xff, 0xff),
@@ -846,7 +842,6 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0066, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0067, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0069, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0076, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0077, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0078, 0xff, 0xff, 0xff) },
@@ -865,8 +860,6 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0095, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0096, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0097, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0098, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0099, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0105, 0xff, 0xff, 0xff) },
@@ -887,28 +880,18 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0144, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0145, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0146, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0148, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0149, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0150, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0151, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0153, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0164, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
@@ -1083,127 +1066,27 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1401, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1402, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1403, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1404, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1405, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1406, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1407, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1408, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1409, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1410, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1411, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1412, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1413, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1414, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1415, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1416, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1417, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1418, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1419, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1420, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1421, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1422, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1423, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1424, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1425, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1427, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1429, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1430, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1431, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1432, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1433, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1434, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1435, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1436, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1437, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1438, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1439, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1440, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1441, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1442, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1443, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1444, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1445, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1446, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1447, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1448, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1449, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1450, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1451, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1452, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1453, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1454, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1455, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1456, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1457, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1458, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1459, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1460, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1461, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1462, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1463, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1464, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1465, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1466, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1467, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1468, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1469, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1470, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1471, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1472, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1473, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1474, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1475, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1476, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1477, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1478, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1479, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1480, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1482, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1483, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1484, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1485, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1486, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1487, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1488, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1489, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1490, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1491, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1492, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1493, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1494, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1495, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1496, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1497, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1498, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1499, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1500, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1501, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1502, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1503, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1504, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1505, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1506, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1507, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1508, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1509, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1510, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, + 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, - 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
Greg KH
maintainerPATCH 37/72 USB: Serial: ti_usb_3410_5052: Add Abbot Diabetes Care cable id
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <[email protected]>
commit 7fd25702ba616d9ba56e2a625472f29e5aff25ee upstream.
This USB-serial cable with mini stereo jack enumerates as:
Bus 001 Device 004: ID 1a61:3410 Abbott Diabetes Care
It is a TI3410 inside.
--- drivers/usb/serial/ti_usb_3410_5052.c | 6 ++++-- drivers/usb/serial/ti_usb_3410_5052.h | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-)
drivers/usb/serial/ti_usb_3410_5052.c +4 -2
@@ -165,7 +165,7 @@ static unsigned int product_5052_count;/* the array dimension is the number of default entries plus */ /* TI_EXTRA_VID_PID_COUNT user defined entries plus 1 terminating */ /* null entry */ -static struct usb_device_id ti_id_table_3410[13 +TI_EXTRA_VID_PID_COUNT +1 ] = { +static struct usb_device_id ti_id_table_3410[14 +TI_EXTRA_VID_PID_COUNT +1 ] = { {USB_DEVICE (TI_VENDOR_ID ,TI_3410_PRODUCT_ID ) }, {USB_DEVICE (TI_VENDOR_ID ,TI_3410_EZ430_ID ) }, {USB_DEVICE (MTS_VENDOR_ID ,MTS_GSM_NO_FW_PRODUCT_ID ) },
@@ -179,6 +179,7 @@ static struct usb_device_id ti_id_table_ { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) }, { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) }, { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) }, + { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) }, }; static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
@@ -188,7 +189,7 @@ static struct usb_device_id ti_id_table_ { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) }, }; -static struct usb_device_id ti_id_table_combined[17 +2 *TI_EXTRA_VID_PID_COUNT +1 ] = { +static struct usb_device_id ti_id_table_combined[18 +2 *TI_EXTRA_VID_PID_COUNT +1 ] = { {USB_DEVICE (TI_VENDOR_ID ,TI_3410_PRODUCT_ID ) }, {USB_DEVICE (TI_VENDOR_ID ,TI_3410_EZ430_ID ) }, { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
@@ -206,6 +207,7 @@ static struct usb_device_id ti_id_table_ { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) }, { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) }, { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) }, + { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) }, { } };
drivers/usb/serial/ti_usb_3410_5052.h +4 -0
@@ -49,6 +49,10 @@#define MTS_MT9234ZBA_PRODUCT_ID 0xF115#define MTS_MT9234ZBAOLD_PRODUCT_ID 0x0319 +/* Abbott Diabetics vendor and product ids */ +#define ABBOTT_VENDOR_ID 0x1a61 +#define ABBOTT_PRODUCT_ID 0x3410 +/* Commands */ #define TI_GET_VERSION 0x01#define TI_GET_PORT_STATUS 0x02
Greg KH
maintainerPATCH 38/72 USB: Remove duplicate USB 3.0 hub feature #defines.
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Sharp <[email protected]>
commit d9f5343e35d9138432657202afa8e3ddb2ade360 upstream.
Somehow we ended up with duplicate hub feature #defines in ch11.h. Tatyana Brokhman first created the USB 3.0 hub feature macros in 2.6.38 with commit 0eadcc09203349b11ca477ec367079b23d32ab91 "usb: USB3.0 ch11 definitions". In 2.6.39, I modified a patch from John Youn that added similar macros in a different place in the same file, and committed dbe79bbe9dcb22cb3651c46f18943477141ca452 "USB 3.0 Hub Changes".
Some of the #defines used different names for the same values. Others used exactly the same names with the same values, like these gems:
#define USB_PORT_FEAT_BH_PORT_RESET 28
...
#define USB_PORT_FEAT_BH_PORT_RESET 28
According to my very geeky husband (who looked it up in the C99 spec), it is allowed to have object-like macros with duplicate names as long as the replacement list is exactly the same. However, he recalled that some compilers will give warnings when they find duplicate macros. It's probably best to remove the duplicates in the stable tree, so that the code compiles for everyone.
The macros are now fixed to move the feature requests that are specific to USB 3.0 hubs into a new section (out of the USB 2.0 hub feature section), and use the most common macro name.
This patch should be backported to 2.6.39.
--- include/linux/usb/ch11.h | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
include/linux/usb/ch11.h +2 -8
@@ -62,12 +62,6 @@#define USB_PORT_FEAT_TEST 21#define USB_PORT_FEAT_INDICATOR 22#define USB_PORT_FEAT_C_PORT_L1 23 -#define USB_PORT_FEAT_C_PORT_LINK_STATE 25 -#define USB_PORT_FEAT_C_PORT_CONFIG_ERROR 26 -#define USB_PORT_FEAT_PORT_REMOTE_WAKE_MASK 27 -#define USB_PORT_FEAT_BH_PORT_RESET 28 -#define USB_PORT_FEAT_C_BH_PORT_RESET 29 -#define USB_PORT_FEAT_FORCE_LINKPM_ACCEPT 30/* * Port feature selectors added by USB 3.0 spec.
@@ -76,8 +70,8 @@#define USB_PORT_FEAT_LINK_STATE 5#define USB_PORT_FEAT_U1_TIMEOUT 23#define USB_PORT_FEAT_U2_TIMEOUT 24 -#define USB_PORT_FEAT_C_LINK_STATE 25 -#define USB_PORT_FEAT_C_CONFIG_ERR 26 +#define USB_PORT_FEAT_C_PORT_LINK_STATE 25 +#define USB_PORT_FEAT_C_PORT_CONFIG_ERROR 26#define USB_PORT_FEAT_REMOTE_WAKE_MASK 27#define USB_PORT_FEAT_BH_PORT_RESET 28#define USB_PORT_FEAT_C_BH_PORT_RESET 29
Greg KH
maintainerPATCH 39/72 USB: Fix handoff when BIOS disables host PCI device.
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Sharp <[email protected]>
commit cab928ee1f221c9cc48d6615070fefe2e444384a upstream.
On some systems with an Intel Panther Point xHCI host controller, the BIOS disables the xHCI PCI device during boot, and switches the xHCI ports over to EHCI. This allows the BIOS to access USB devices without having xHCI support.
The downside is that the xHCI BIOS handoff mechanism will fail because memory mapped I/O is not enabled for the disabled PCI device. Jesse Barnes says this is expected behavior. The PCI core will enable BARs before quirks run, but it will leave it in an undefined state, and it may not have memory mapped I/O enabled.
Make the generic USB quirk handler call pci_enable_device() to re-enable MMIO, and call pci_disable_device() once the host-specific BIOS handoff is finished. This will balance the ref counts in the PCI core. When the PCI probe function is called, usb_hcd_pci_probe() will call pci_enable_device() again.
This should be back ported to kernels as old as 2.6.31. That was the first kernel with xHCI support, and no one has complained about BIOS handoffs failing due to memory mapped I/O being disabled on other hosts (EHCI, UHCI, or OHCI).
--- drivers/usb/host/pci-quirks.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/usb/host/pci-quirks.c +11 -0
@@ -872,7 +872,17 @@ static void __devinit quirk_usb_early_ha*/ if (pdev->vendor ==0x184e )/* vendor Netlogic */ return ; +if (pdev->class !=PCI_CLASS_SERIAL_USB_UHCI && + pdev->class !=PCI_CLASS_SERIAL_USB_OHCI && + pdev->class !=PCI_CLASS_SERIAL_USB_EHCI && + pdev->class !=PCI_CLASS_SERIAL_USB_XHCI ) +return ; +if (pci_enable_device (pdev) <0 ) { +dev_warn (&pdev->dev,"Can't enable PCI device, " +"BIOS handoff failed.\n" ); +return ; + }if (pdev->class ==PCI_CLASS_SERIAL_USB_UHCI )quirk_usb_handoff_uhci (pdev);else if (pdev->class ==PCI_CLASS_SERIAL_USB_OHCI )
@@ -881,5 +891,6 @@ static void __devinit quirk_usb_early_haquirk_usb_disable_ehci (pdev); else if (pdev->class == PCI_CLASS_SERIAL_USB_XHCI) quirk_usb_handoff_xhci(pdev); +pci_disable_device (pdev ); }DECLARE_PCI_FIXUP_FINAL (PCI_ANY_ID ,PCI_ANY_ID , quirk_usb_early_handoff);
Greg KH
maintainerPATCH 40/72 xhci: Fix oops caused by more USB2 ports than USB3 ports.
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Sharp <[email protected]>
commit 3278a55a1aebe2bbd47fbb5196209e5326a88b56 upstream.
The code to set the device removable bits in the USB 2.0 roothub descriptor was accidentally looking at the USB 3.0 port registers instead of the USB 2.0 registers. This can cause an oops if there are more USB 2.0 registers than USB 3.0 registers.
This should be backported to kernels as old as 2.6.39, that contain the commit 4bbb0ace9a3de8392527e3c87926309d541d3b00 "xhci: Return a USB 3.0 hub descriptor for USB3 roothub."
--- drivers/usb/host/xhci-hub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-hub.c +1 -1
@@ -95,7 +95,7 @@ static void xhci_usb2_hub_descriptor(str*/ memset (port_removable,0 ,sizeof (port_removable));for (i =0 ; i < ports; i++) { - portsc =xhci_readl (xhci, xhci->usb3_ports[i]); + portsc =xhci_readl (xhci, xhci->usb2_ports[i]);/* If a device is removable, PORTSC reports a 0, same as in the * hub descriptor DeviceRemovable bits. */
Greg KH
maintainerPATCH 41/72 xhci: Fix encoding for HS bulk/control NAK rate.
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Sharp <[email protected]>
commit 340a3504fd39dad753ba908fb6f894ee81fc3ae2 upstream.
The xHCI 0.96 spec says that HS bulk and control endpoint NAK rate must be encoded as an exponent of two number of microframes. The endpoint descriptor has the NAK rate encoded in number of microframes. We were just copying the value from the endpoint descriptor into the endpoint context interval field, which was not correct. This lead to the VIA host rejecting the add of a bulk OUT endpoint from any USB 2.0 mass storage device.
The fix is to use the correct encoding. Refactor the code to convert number of frames to an exponential number of microframes, and make sure we convert the number of microframes in HS bulk and control endpoints to an exponent.
This should be back ported to kernels as old as 2.6.31, that contain the commit dfa49c4ad120a784ef1ff0717168aa79f55a483a "USB: xhci - fix math in xhci_get_endpoint_interval"
--- drivers/usb/host/xhci-mem.c | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-)
drivers/usb/host/xhci-mem.c +24 -8
@@ -1140,26 +1140,42 @@ static unsigned int xhci_parse_exponent_ }/* -* Convert bInterval expressed in frames (in 1-255 range) to exponent of +* Convert bInterval expressed in microframes (in 1-255 range) to exponent of * microframes, rounded down to nearest power of 2. */ -static unsigned int xhci_parse_frame_interval (struct usb_device *udev, -struct usb_host_endpoint *ep) +static unsigned int xhci_microframes_to_exponent (struct usb_device *udev, +struct usb_host_endpoint *ep,unsigned int desc_interval, +unsigned int min_exponent,unsigned int max_exponent) {unsigned int interval; - interval =fls (8 * ep->desc.bInterval) -1 ; - interval =clamp_val (interval,3 ,10 ); -if ((1 << interval) !=8 * ep->desc.bInterval) + interval =fls (desc_interval) -1 ; + interval =clamp_val (interval, min_exponent, max_exponent); +if ((1 << interval) != desc_interval)dev_warn (&udev->dev,"ep %#x - rounding interval to %d microframes, ep desc says %d microframes\n" , ep->desc.bEndpointAddress,1 << interval, -8 * ep->desc.bInterval); + desc_interval);return interval; } +static unsigned int xhci_parse_microframe_interval (struct usb_device *udev, +struct usb_host_endpoint *ep) +{ +return xhci_microframes_to_exponent (udev, ep, + ep->desc.bInterval,0 ,15 ); +} + + +static unsigned int xhci_parse_frame_interval (struct usb_device *udev, +struct usb_host_endpoint *ep) +{ +return xhci_microframes_to_exponent (udev, ep, + ep->desc.bInterval *8 ,3 ,10 ); +} +/* Return the polling or NAK interval. * * The polling interval is expressed in "microframes". If xHCI's Interval field
@@ -1178,7 +1194,7 @@ static unsigned int xhci_get_endpoint_in/* Max NAK rate */ if (usb_endpoint_xfer_control (&ep->desc) ||usb_endpoint_xfer_bulk (&ep->desc)) { - interval = ep->desc.bInterval; + interval =xhci_parse_microframe_interval (udev, ep);break ; }/* Fall through - SS and HS isoc/int have same decoding */
Greg KH
maintainerPATCH 42/72 USB: Dont fail USB3 probe on missing legacy PCI IRQ.
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Sharp <[email protected]>
commit 68d07f64b8a11a852d48d1b05b724c3e20c0d94b upstream.
Intel has a PCI USB xhci host controller on a new platform. It doesn't have a line IRQ definition in BIOS. The Linux driver refuses to initialize this controller, but Windows works well because it only depends on MSI.
Actually, Linux also can work for MSI. This patch avoids the line IRQ checking for USB3 HCDs in usb core PCI probe. It allows the xHCI driver to try to enable MSI or MSI-X first. It will fail the probe if MSI enabling failed and there's no legacy PCI IRQ.
This patch should be backported to kernels as old as 2.6.32.
--- drivers/usb/core/hcd-pci.c | 5 ++++- drivers/usb/core/hcd.c | 6 ++++-- drivers/usb/host/xhci.c | 5 +++++ 3 files changed, 13 insertions(+), 3 deletions(-)
drivers/usb/core/hcd-pci.c +4 -1
@@ -187,7 +187,10 @@ int usb_hcd_pci_probe(struct pci_dev *dereturn -ENODEV ; dev->current_state =PCI_D0 ; -if (!dev->irq) { +/* The xHCI driver supports MSI and MSI-X, +* so don't fail if the BIOS doesn't provide a legacy IRQ. +*/ +if (!dev->irq && (driver->flags &HCD_MASK ) !=HCD_USB3 ) {dev_err (&dev->dev,"Found HC with no IRQ. Check BIOS/PCI %s setup!\n" ,pci_name (dev));
drivers/usb/core/hcd.c +4 -2
@@ -2465,8 +2465,10 @@ int usb_add_hcd(struct usb_hcd *hcd, && device_can_wakeup(&hcd->self.root_hub->dev))dev_dbg (hcd->self.controller,"supports USB remote wakeup\n" ); -/* enable irqs just before we start the controller */ -if (usb_hcd_is_primary_hcd (hcd)) { +/* enable irqs just before we start the controller, +* if the BIOS provides legacy PCI irqs. +*/ +if (usb_hcd_is_primary_hcd (hcd) && irqnum) { retval =usb_hcd_request_irqs (hcd, irqnum, irqflags);if (retval) goto err_request_irq;
drivers/usb/host/xhci.c +5 -0
@@ -352,6 +352,11 @@ static int xhci_try_enable_msi(struct us/* hcd->irq is -1, we have MSI */ return 0 ; +if (!pdev->irq) { +xhci_err (xhci,"No msi-x/msi found and no IRQ in BIOS\n" ); +return -EINVAL ; + } +/* fall back to legacy interrupt*/ ret =request_irq (pdev->irq, &usb_hcd_irq,IRQF_SHARED , hcd->irq_descr, hcd);
Greg KH
maintainerPATCH 43/72 USB: Set hub depth after USB3 hub reset
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Elric Fu <[email protected]>
commit a45aa3b30583e7d54e7cf4fbcd0aa699348a6e5c upstream.
The superspeed device attached to a USB 3.0 hub(such as VIA's) doesn't respond the address device command after resume. The root cause is the superspeed hub will miss the Hub Depth value that is used as an offset into the route string to locate the bits it uses to determine the downstream port number after reset, and all packets can't be routed to the device attached to the superspeed hub.
Hub driver sends a Set Hub Depth request to the superspeed hub except for USB 3.0 root hub when the hub is initialized and doesn't send the request again after reset due to the resume process. So moving the code that sends the Set Hub Depth request to the superspeed hub from hub_configure() to hub_activate() is to cover those situations include initialization and reset.
The patch should be backported to kernels as old as 2.6.39.
--- drivers/usb/core/hub.c | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-)
drivers/usb/core/hub.c +17 -13
@@ -705,10 +705,26 @@ static void hub_activate(struct usb_hubif (type ==HUB_INIT3 ) goto init3; -/* After a resume, port power should still be on. +/* The superspeed hub except for root hub has to use Hub Depth +* value as an offset into the route string to locate the bits +* it uses to determine the downstream port number. So hub driver +* should send a set hub depth request to superspeed hub after +* the superspeed hub is set configuration in initialization or +* reset procedure. +* +* After a resume, port power should still be on. * For any other type of activation, turn it on. */ if (type !=HUB_RESUME ) { +if (hdev->parent &&hub_is_superspeed (hdev)) { + ret =usb_control_msg (hdev,usb_sndctrlpipe (hdev,0 ), +HUB_SET_DEPTH ,USB_RT_HUB , + hdev->level -1 ,0 ,NULL ,0 , +USB_CTRL_SET_TIMEOUT ); +if (ret <0 ) +dev_err (hub->intfdev, +"set hub depth failed\n" ); + }/* Speed up system boot by using a delayed_work for the * hub's initial power-up delays. This is pretty awkward
@@ -987,18 +1003,6 @@ static int hub_configure(struct usb_hub goto fail; } -if (hub_is_superspeed (hdev) && (hdev->parent !=NULL )) { - ret =usb_control_msg (hdev,usb_sndctrlpipe (hdev,0 ), -HUB_SET_DEPTH ,USB_RT_HUB , - hdev->level -1 ,0 ,NULL ,0 , -USB_CTRL_SET_TIMEOUT ); - -if (ret <0 ) { - message ="can't set hub depth" ; - goto fail; - } - } -/* Request the entire hub descriptor. * hub->descriptor can handle USB_MAXCHILDREN ports, * but the hub can/will return fewer bytes here.
Greg KH
maintainerPATCH 44/72 usb-storage: fix freezing of the scanning thread
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit bb94a406682770a35305daaa241ccdb7cab399de upstream.
This patch (as1521b) fixes the interaction between usb-storage's scanning thread and the freezer. The current implementation has a
race: If the device is unplugged shortly after being plugged in and just as a system sleep begins, the scanning thread may get frozen before the khubd task. Khubd won't be able to freeze until the disconnect processing is complete, and the disconnect processing can't proceed until the scanning thread finishes, so the sleep transition will fail.
The implementation in the 3.2 kernel suffers from an additional problem. There the scanning thread calls set_freezable_with_signal(), and the signals sent by the freezer will mess up the thread's I/O delays, which are all interruptible.
The solution to both problems is the same: Replace the kernel thread used for scanning with a delayed-work routine on the system freezable work queue. Freezable work queues have the nice property that you can cancel a work item even while the work queue is frozen, and no signals are needed.
The 3.2 version of this patch solves the problem in Bugzilla #42730.
--- drivers/usb/storage/usb.c | 91 ++++++++++++++++------------------------------ drivers/usb/storage/usb.h | 7 ++- 2 files changed, 36 insertions(+), 62 deletions(-)
drivers/usb/storage/usb.c +32 -59
@@ -788,15 +788,19 @@ static void quiesce_and_remove_host(strustruct Scsi_Host *host =us_to_host (us);/* If the device is really gone, cut short reset delays */ -if (us->pusb_dev->state ==USB_STATE_NOTATTACHED ) +if (us->pusb_dev->state ==USB_STATE_NOTATTACHED ) {set_bit (US_FLIDX_DISCONNECTING , &us->dflags); +wake_up (&us->delay_wait); + } -/* Prevent SCSI-scanning (if it hasn't started yet) -* and wait for the SCSI-scanning thread to stop. +/* Prevent SCSI scanning (if it hasn't started yet) +* or wait for the SCSI-scanning routine to stop. */ -set_bit (US_FLIDX_DONT_SCAN , &us->dflags); -wake_up (&us->delay_wait); -wait_for_completion (&us->scanning_done); +cancel_delayed_work_sync (&us->scan_dwork); + +/* Balance autopm calls if scanning was cancelled */ +if (test_bit (US_FLIDX_SCAN_PENDING , &us->dflags)) +usb_autopm_put_interface_no_suspend (us->pusb_intf);/* Removing the host will perform an orderly shutdown: caches * synchronized, disks spun down, etc.
@@ -823,52 +827,28 @@ static void release_everything(struct usscsi_host_put (us_to_host (us)); } -/* Thread to carry out delayed SCSI-device scanning */ -static int usb_stor_scan_thread (void * __us) +/* Delayed-work routine to carry out SCSI-device scanning */ +static void usb_stor_scan_dwork (struct work_struct *work) { -struct us_data *us = (struct us_data *)__us; + struct us_data *us = container_of(work, struct us_data, + scan_dwork.work);struct device *dev = &us->pusb_intf->dev; -dev_dbg (dev,"device found\n" ); - -set_freezable_with_signal (); -/* -* Wait for the timeout to expire or for a disconnect -* -* We can't freeze in this thread or we risk causing khubd to -* fail to freeze, but we can't be non-freezable either. Nor can -* khubd freeze while waiting for scanning to complete as it may -* hold the device lock, causing a hang when suspending devices. -* So we request a fake signal when freezing and use -* interruptible sleep to kick us out of our wait early when -* freezing happens. -*/ -if (delay_use >0 ) { -dev_dbg (dev,"waiting for device to settle " -"before scanning\n" ); -wait_event_interruptible_timeout (us->delay_wait, -test_bit (US_FLIDX_DONT_SCAN , &us->dflags), - delay_use *HZ ); - } - -/* If the device is still connected, perform the scanning */ -if (!test_bit (US_FLIDX_DONT_SCAN , &us->dflags)) { - -/* For bulk-only devices, determine the max LUN value */ -if (us->protocol ==USB_PR_BULK && - !(us->fflags &US_FL_SINGLE_LUN )) { -mutex_lock (&us->dev_mutex); - us->max_lun =usb_stor_Bulk_max_lun (us); -mutex_unlock (&us->dev_mutex); - } -scsi_scan_host (us_to_host (us)); -dev_dbg (dev,"scan complete\n" ); +dev_dbg (dev,"starting scan\n" ); -/* Should we unbind if no devices were detected? */ +/* For bulk-only devices, determine the max LUN value */ +if (us->protocol ==USB_PR_BULK && !(us->fflags &US_FL_SINGLE_LUN )) { +mutex_lock (&us->dev_mutex); + us->max_lun =usb_stor_Bulk_max_lun (us); +mutex_unlock (&us->dev_mutex); } +scsi_scan_host (us_to_host (us)); +dev_dbg (dev,"scan complete\n" ); + +/* Should we unbind if no devices were detected? */ usb_autopm_put_interface (us->pusb_intf); -complete_and_exit (&us->scanning_done,0 ); +clear_bit (US_FLIDX_SCAN_PENDING , &us->dflags); }static unsigned int usb_stor_sg_tablesize (struct usb_interface *intf)
@@ -915,7 +895,7 @@ int usb_stor_probe1(struct us_data **pusinit_completion (&us->cmnd_ready);init_completion (&(us->notify));init_waitqueue_head (&us->delay_wait); -init_completion (&us->scanning_done); +INIT_DELAYED_WORK (&us->scan_dwork, usb_stor_scan_dwork);/* Associate the us_data structure with the USB device */ result =associate_dev (us, intf);
@@ -946,7 +926,6 @@ EXPORT_SYMBOL_GPL(usb_stor_probe1);/* Second part of general USB mass-storage probing */ int usb_stor_probe2 (struct us_data *us) { -struct task_struct *th;int result;struct device *dev = &us->pusb_intf->dev;
@@ -987,20 +966,14 @@ int usb_stor_probe2(struct us_data *us) goto BadDevice; } -/* Start up the thread for delayed SCSI-device scanning */ - th =kthread_create (usb_stor_scan_thread, us,"usb-stor-scan" ); -if (IS_ERR (th)) { -dev_warn (dev, -"Unable to start the device-scanning thread\n" ); -complete (&us->scanning_done); -quiesce_and_remove_host (us); - result =PTR_ERR (th); - goto BadDevice; - } - +/* Submit the delayed_work for SCSI-device scanning */ usb_autopm_get_interface_no_resume (us->pusb_intf); -wake_up_process (th); +set_bit (US_FLIDX_SCAN_PENDING , &us->dflags); +if (delay_use >0 ) +dev_dbg (dev,"waiting for device to settle before scanning\n" ); +queue_delayed_work (system_freezable_wq, &us->scan_dwork, + delay_use *HZ );return 0 ;/* We come here if there are any problems */
drivers/usb/storage/usb.h +4 -3
@@ -47,6 +47,7 @@#include <linux/blkdev.h> #include <linux/completion.h> #include <linux/mutex.h> +#include <linux/workqueue.h> #include <scsi/scsi_host.h> struct us_data ;
@@ -72,7 +73,7 @@ struct us_unusual_dev {#define US_FLIDX_DISCONNECTING 3/* disconnect in progress */ #define US_FLIDX_RESETTING 4/* device reset in progress */ #define US_FLIDX_TIMED_OUT 5/* SCSI midlayer timed out */ -#define US_FLIDX_DONT_SCAN 6/* don't scan (disconnect) */ +#define US_FLIDX_SCAN_PENDING 6/* scanning not yet done */ #define US_FLIDX_REDO_READ10 7/* redo READ(10) command */ #define US_FLIDX_READ10_WORKED 8/* previous READ(10) succeeded */
@@ -147,8 +148,8 @@ struct us_data {/* mutual exclusion and synchronization structures */ struct completion cmnd_ready;/* to sleep thread on */ struct completion notify;/* thread begin/end */ -wait_queue_head_t delay_wait;/* wait during scan, reset */ -struct completion scanning_done;/* wait for scan thread */ +wait_queue_head_t delay_wait;/* wait during reset */ +struct delayed_work scan_dwork;/* for async scanning */ /* subdriver information */ void *extra;/* Any extra data */
Greg KH
maintainerPATCH 45/72 target: Allow control CDBs with data > 1 page
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Grover <[email protected]>
commit 4949314c7283ea4f9ade182ca599583b89f7edd6 upstream.
We need to handle >1 page control cdbs, so extend the code to do a vmap if bigger than 1 page. It seems like kmap() is still preferable if just a page, fewer TLB shootdowns(?), so keep using that when possible.
Rename function pair for their new scope.
--- drivers/target/target_core_alua.c | 8 ++--- drivers/target/target_core_cdb.c | 28 ++++++++++---------- drivers/target/target_core_device.c | 4 +- drivers/target/target_core_pr.c | 38 +++++++++++++-------------- drivers/target/target_core_pscsi.c | 4 +- drivers/target/target_core_transport.c | 45 ++++++++++++++++++++++++--------- include/target/target_core_base.h | 1 include/target/target_core_transport.h | 4 +- 8 files changed, 78 insertions(+), 54 deletions(-)
drivers/target/target_core_alua.c +4 -4
@@ -79,7 +79,7 @@ int target_emulate_report_target_port_grreturn -EINVAL ; } - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd);spin_lock (&su_dev->t10_alua.tg_pt_gps_lock); list_for_each_entry(tg_pt_gp, &su_dev->t10_alua.tg_pt_gps_list,
@@ -164,7 +164,7 @@ int target_emulate_report_target_port_gr buf[2 ] = ((rd_len >>8 ) &0xff ); buf[3 ] = (rd_len &0xff ); -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd); task->task_scsi_status =GOOD ;transport_complete_task (task,1 );
@@ -195,7 +195,7 @@ int target_emulate_set_target_port_group cmd->scsi_sense_reason =TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE ;return -EINVAL ; } - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd);/* * Determine if explict ALUA via SET_TARGET_PORT_GROUPS is allowed
@@ -352,7 +352,7 @@ int target_emulate_set_target_port_group } out: -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd); task->task_scsi_status =GOOD ;transport_complete_task (task,1 );return 0 ;
drivers/target/target_core_cdb.c +14 -14
@@ -82,7 +82,7 @@ target_emulate_inquiry_std(struct se_cmdreturn -EINVAL ; } - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd);if (dev == tpg->tpg_virt_lun0.lun_se_dev) { buf[0 ] =0x3f ;/* Not connected */
@@ -135,7 +135,7 @@ target_emulate_inquiry_std(struct se_cmd buf[4 ] =31 ;/* Set additional length to 31 */ out: -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd);return 0 ; }
@@ -726,7 +726,7 @@ int target_emulate_inquiry(struct se_tasreturn -EINVAL ; } - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd); buf[0 ] = dev->transport->get_device_type (dev);
@@ -743,7 +743,7 @@ int target_emulate_inquiry(struct se_tas ret = -EINVAL ; out_unmap: -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd); out:if (!ret) { task->task_scsi_status =GOOD ;
@@ -765,7 +765,7 @@ int target_emulate_readcapacity(struct selse blocks = (u32 )blocks_long; - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd); buf[0 ] = (blocks >>24 ) &0xff ; buf[1 ] = (blocks >>16 ) &0xff ;
@@ -781,7 +781,7 @@ int target_emulate_readcapacity(struct sif (dev->se_sub_dev->se_dev_attrib.emulate_tpu || dev->se_sub_dev->se_dev_attrib.emulate_tpws)put_unaligned_be32 (0xFFFFFFFF , &buf[0 ]); -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd); task->task_scsi_status =GOOD ;transport_complete_task (task,1 );
@@ -795,7 +795,7 @@ int target_emulate_readcapacity_16(strucunsigned char *buf;unsigned long long blocks = dev->transport->get_blocks (dev); - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd); buf[0 ] = (blocks >>56 ) &0xff ; buf[1 ] = (blocks >>48 ) &0xff ;
@@ -816,7 +816,7 @@ int target_emulate_readcapacity_16(strucif (dev->se_sub_dev->se_dev_attrib.emulate_tpu || dev->se_sub_dev->se_dev_attrib.emulate_tpws) buf[14 ] =0x80 ; -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd); task->task_scsi_status =GOOD ;transport_complete_task (task,1 );
@@ -1029,9 +1029,9 @@ int target_emulate_modesense(struct se_t offset = cmd->data_length; } - rbuf =transport_kmap_first_data_page (cmd); + rbuf =transport_kmap_data_sg (cmd);memcpy (rbuf, buf, offset); -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd); task->task_scsi_status =GOOD ;transport_complete_task (task,1 );
@@ -1053,7 +1053,7 @@ int target_emulate_request_sense(structreturn -ENOSYS ; } - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd);if (!core_scsi3_ua_clear_for_request_sense (cmd, &ua_asc, &ua_ascq)) {/*
@@ -1099,7 +1099,7 @@ int target_emulate_request_sense(struct } end: -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd); task->task_scsi_status =GOOD ;transport_complete_task (task,1 );return 0 ;
@@ -1133,7 +1133,7 @@ int target_emulate_unmap(struct se_task dl =get_unaligned_be16 (&cdb[0 ]); bd_dl =get_unaligned_be16 (&cdb[2 ]); - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd); ptr = &buf[offset]; pr_debug("UNMAP: Sub: %s Using dl: %hu bd_dl: %hu size: %hu"
@@ -1157,7 +1157,7 @@ int target_emulate_unmap(struct se_task } err: -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd);if (!ret) { task->task_scsi_status =GOOD ;transport_complete_task (task,1 );
drivers/target/target_core_device.c +2 -2
@@ -658,7 +658,7 @@ int target_report_luns(struct se_task *sunsigned char *buf;u32 cdb_offset =0 , lun_count =0 , offset =8 , i; - buf =transport_kmap_first_data_page (se_cmd); + buf = (unsigned char *)transport_kmap_data_sg (se_cmd);/* * If no struct se_session pointer is present, this struct se_cmd is
@@ -696,7 +696,7 @@ int target_report_luns(struct se_task *s* See SPC3 r07, page 159. */ done: -transport_kunmap_first_data_page (se_cmd); +transport_kunmap_data_sg (se_cmd); lun_count *=8 ; buf[0 ] = ((lun_count >>24 ) &0xff ); buf[1 ] = ((lun_count >>16 ) &0xff );
drivers/target/target_core_pr.c +19 -19
@@ -1538,7 +1538,7 @@ static int core_scsi3_decode_spec_i_port tidh_new->dest_local_nexus =1 ;list_add_tail (&tidh_new->dest_list, &tid_dest_list); - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd);/* * For a PERSISTENT RESERVE OUT specify initiator ports payload, * first extract TransportID Parameter Data Length, and make sure
@@ -1789,7 +1789,7 @@ static int core_scsi3_decode_spec_i_port } -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd);/* * Go ahead and create a registrations from tid_dest_list for the
@@ -1837,7 +1837,7 @@ static int core_scsi3_decode_spec_i_portreturn 0 ; out: -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd);/* * For the failure case, release everything from tid_dest_list * including *dest_pr_reg and the configfs dependances..
@@ -3429,14 +3429,14 @@ static int core_scsi3_emulate_pro_regist* will be moved to for the TransportID containing SCSI initiator WWN * information. */ - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd); rtpi = (buf[18 ] &0xff ) <<8 ; rtpi |= buf[19 ] &0xff ; tid_len = (buf[20 ] &0xff ) <<24 ; tid_len |= (buf[21 ] &0xff ) <<16 ; tid_len |= (buf[22 ] &0xff ) <<8 ; tid_len |= buf[23 ] &0xff ; -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd); buf =NULL ;if ((tid_len +24 ) != cmd->data_length) {
@@ -3488,7 +3488,7 @@ static int core_scsi3_emulate_pro_registreturn -EINVAL ; } - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd); proto_ident = (buf[24 ] &0x0f );#if 0 pr_debug("SPC-3 PR REGISTER_AND_MOVE: Extracted Protocol Identifier:"
@@ -3522,7 +3522,7 @@ static int core_scsi3_emulate_pro_regist goto out; } -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd); buf =NULL ; pr_debug("SPC-3 PR [%s] Extracted initiator %s identifier: %s"
@@ -3787,13 +3787,13 @@ after_iport_check: " REGISTER_AND_MOVE\n"); } -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd);core_scsi3_put_pr_reg (dest_pr_reg);return 0 ; out:if (buf) -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd);if (dest_se_deve)core_scsi3_lunacl_undepend_item (dest_se_deve);if (dest_node_acl)
@@ -3867,7 +3867,7 @@ int target_scsi3_emulate_pr_out(struct s scope = (cdb[2 ] &0xf0 ); type = (cdb[2 ] &0x0f ); - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd);/* * From PERSISTENT_RESERVE_OUT parameter list (payload) */
@@ -3885,7 +3885,7 @@ int target_scsi3_emulate_pr_out(struct s aptpl = (buf[17 ] &0x01 ); unreg = (buf[17 ] &0x02 ); } -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd); buf =NULL ;/*
@@ -3985,7 +3985,7 @@ static int core_scsi3_pri_read_keys(strureturn -EINVAL ; } - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd); buf[0 ] = ((su_dev->t10_pr.pr_generation >>24 ) &0xff ); buf[1 ] = ((su_dev->t10_pr.pr_generation >>16 ) &0xff ); buf[2 ] = ((su_dev->t10_pr.pr_generation >>8 ) &0xff );
@@ -4019,7 +4019,7 @@ static int core_scsi3_pri_read_keys(stru buf[6 ] = ((add_len >>8 ) &0xff ); buf[7 ] = (add_len &0xff ); -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd);return 0 ; }
@@ -4045,7 +4045,7 @@ static int core_scsi3_pri_read_reservatireturn -EINVAL ; } - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd); buf[0 ] = ((su_dev->t10_pr.pr_generation >>24 ) &0xff ); buf[1 ] = ((su_dev->t10_pr.pr_generation >>16 ) &0xff ); buf[2 ] = ((su_dev->t10_pr.pr_generation >>8 ) &0xff );
@@ -4104,7 +4104,7 @@ static int core_scsi3_pri_read_reservati err:spin_unlock (&se_dev->dev_reservation_lock); -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd);return 0 ; }
@@ -4128,7 +4128,7 @@ static int core_scsi3_pri_report_capabilreturn -EINVAL ; } - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd); buf[0 ] = ((add_len <<8 ) &0xff ); buf[1 ] = (add_len &0xff );
@@ -4160,7 +4160,7 @@ static int core_scsi3_pri_report_capabil buf[4 ] |=0x02 ;/* PR_TYPE_WRITE_EXCLUSIVE */ buf[5 ] |=0x01 ;/* PR_TYPE_EXCLUSIVE_ACCESS_ALLREG */ -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd);return 0 ; }
@@ -4190,7 +4190,7 @@ static int core_scsi3_pri_read_full_statreturn -EINVAL ; } - buf =transport_kmap_first_data_page (cmd); + buf =transport_kmap_data_sg (cmd); buf[0 ] = ((su_dev->t10_pr.pr_generation >>24 ) &0xff ); buf[1 ] = ((su_dev->t10_pr.pr_generation >>16 ) &0xff );
@@ -4311,7 +4311,7 @@ static int core_scsi3_pri_read_full_stat buf[6 ] = ((add_len >>8 ) &0xff ); buf[7 ] = (add_len &0xff ); -transport_kunmap_first_data_page (cmd); +transport_kunmap_data_sg (cmd);return 0 ; }
drivers/target/target_core_pscsi.c +2 -2
@@ -695,7 +695,7 @@ static int pscsi_transport_complete(struif (task->task_se_cmd->se_deve->lun_flags &TRANSPORT_LUNFLAGS_READ_ONLY ) { -unsigned char *buf =transport_kmap_first_data_page (task->task_se_cmd); +unsigned char *buf =transport_kmap_data_sg (task->task_se_cmd);if (cdb[0 ] ==MODE_SENSE_10 ) {if (!(buf[3 ] &0x80 ))
@@ -705,7 +705,7 @@ static int pscsi_transport_complete(stru buf[2 ] |=0x80 ; } -transport_kunmap_first_data_page (task->task_se_cmd); +transport_kunmap_data_sg (task->task_se_cmd); } } after_mode_sense:
drivers/target/target_core_transport.c +34 -11
69 lines not on this page · raw message
include/target/target_core_base.h +1 -0
@@ -486,6 +486,7 @@ struct se_cmd {struct scatterlist *t_data_sg;unsigned int t_data_nents; +void *t_data_vmap;struct scatterlist *t_bidi_data_sg;unsigned int t_bidi_data_nents;
include/target/target_core_transport.h +2 -2
@@ -129,8 +129,8 @@ extern void transport_init_se_cmd(struct struct target_core_fabric_ops *, struct se_session *, u32, int, int, unsigned char *); -void *transport_kmap_first_data_page (struct se_cmd *cmd); -void transport_kunmap_first_data_page (struct se_cmd *cmd); +void *transport_kmap_data_sg (struct se_cmd *); +void transport_kunmap_data_sg (struct se_cmd *);extern int transport_generic_allocate_tasks (struct se_cmd *,unsigned char *);extern int transport_handle_cdb_direct (struct se_cmd *);extern int transport_generic_handle_cdb_map (struct se_cmd *);
Greg KH
maintainerPATCH 46/72 ASoC: wm8962: Fix sidetone enumeration texts
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
commit 31794bc37bf2db84f085da52b72bfba65739b2d2 upstream.
The sidetone enumeration texts have left and right swapped.
--- sound/soc/codecs/wm8962.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wm8962.c +1 -1
@@ -2559,7 +2559,7 @@ static int dsp2_event(struct snd_soc_dapreturn 0 ; } -static const char *st_text[] = {"None" ,"Right" ,"Left" }; +static const char *st_text[] = {"None" ,"Left" ,"Right" };static const struct soc_enum str_enum =SOC_ENUM_SINGLE (WM8962_DAC_DSP_MIXING_1 ,2 ,3 , st_text);
Greg KH
maintainerPATCH 47/72 ALSA: hda/realtek - Fix overflow of vol/sw check bitmap
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit c14c95f62ecb8710af14ae0d48e01991b70bb6f4 upstream.
The bitmap introduced in the commit [527e4d73: ALSA: hda/realtek - Fix missing volume controls with ALC260] is too narrow for some codecs, which may have more NIDs than 0x20, thus it may overflow the bitmap array on them.
Just double the number to cover all and also add a sanity-check code to be safer.
--- sound/pci/hda/patch_realtek.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
sound/pci/hda/patch_realtek.c +8 -3
@@ -79,6 +79,8 @@ enum { ALC_AUTOMUTE_MIXER, /* mute/unmute mixer widget AMP */ }; +#define MAX_VOL_NIDS 0x40 +struct alc_spec {/* codec parameterization */ const struct snd_kcontrol_new *mixers[5 ];/* mixer arrays */
@@ -117,8 +119,8 @@ struct alc_spec {const hda_nid_t *capsrc_nids;hda_nid_t dig_in_nid;/* digital-in NID; optional */ hda_nid_t mixer_nid;/* analog-mixer NID */ -DECLARE_BITMAP (vol_ctls,0x20 <<1 ); -DECLARE_BITMAP (sw_ctls,0x20 <<1 ); +DECLARE_BITMAP (vol_ctls,MAX_VOL_NIDS <<1 ); +DECLARE_BITMAP (sw_ctls,MAX_VOL_NIDS <<1 );/* capture setup for dynamic dual-adc switch */ hda_nid_t cur_adc;
@@ -3068,7 +3070,10 @@ static int alc_auto_fill_dac_nids(structstatic inline unsigned int get_ctl_pos (unsigned int data) {hda_nid_t nid =get_amp_nid_ (data); -unsigned int dir =get_amp_direction_ (data); +unsigned int dir; +if (snd_BUG_ON (nid >=MAX_VOL_NIDS )) +return 0 ; + dir =get_amp_direction_ (data);return (nid <<1 ) | dir; }
Greg KH
maintainerPATCH 48/72 ALSA: hda/realtek - Fix surround output regression on Acer Aspire 5935
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit ef8d60fb79614a86a82720dc2402631dbcafb315 upstream.
The previous fix for the speaker on Acer Aspire 59135 introduced another problem for surround outputs. It changed the connections on the line-in/mic pins for limiting the routes, but it left the modified connections. Thus wrong connection indices were written when set to 4ch or 6ch mode.
This patch fixes it by restoring the right connections just after parsing the tree but before the initialization.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42740
--- sound/pci/hda/patch_realtek.c | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/pci/hda/patch_realtek.c +8 -0
@@ -4229,12 +4229,20 @@ static void alc889_fixup_dac_route(struc const struct alc_fixup *fix, int action) { if (action == ALC_FIXUP_ACT_PRE_PROBE) { +/* fake the connections during parsing the tree */ hda_nid_t conn1[2 ] = {0x0c ,0x0d };hda_nid_t conn2[2 ] = {0x0e ,0x0f };snd_hda_override_conn_list (codec,0x14 ,2 , conn1);snd_hda_override_conn_list (codec,0x15 ,2 , conn1);snd_hda_override_conn_list (codec,0x18 ,2 , conn2);snd_hda_override_conn_list (codec,0x1a ,2 , conn2); + } else if (action == ALC_FIXUP_ACT_PROBE) { +/* restore the connections */ +hda_nid_t conn[5 ] = {0x0c ,0x0d ,0x0e ,0x0f ,0x26 }; +snd_hda_override_conn_list (codec,0x14 ,5 , conn); +snd_hda_override_conn_list (codec,0x15 ,5 , conn); +snd_hda_override_conn_list (codec,0x18 ,5 , conn); +snd_hda_override_conn_list (codec,0x1a ,5 , conn); } }
Greg KH
maintainerPATCH 49/72 NOMMU: Lock i_mmap_mutex for access to the VMA prio list
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
commit 918e556ec214ed2f584e4cac56d7b29e4bb6bf27 upstream.
Lock i_mmap_mutex for access to the VMA prio list to prevent concurrent access. Currently, certain parts of the mmap handling are protected by the region mutex, but not all.
--- mm/nommu.c | 7 +++++++ 1 file changed, 7 insertions(+)
mm/nommu.c +7 -0
@@ -696,9 +696,11 @@ static void add_vma_to_mm(struct mm_struif (vma->vm_file) { mapping = vma->vm_file->f_mapping; +mutex_lock (&mapping->i_mmap_mutex);flush_dcache_mmap_lock (mapping);vma_prio_tree_insert (vma, &mapping->i_mmap);flush_dcache_mmap_unlock (mapping); +mutex_unlock (&mapping->i_mmap_mutex); }/* add the VMA to the tree */
@@ -760,9 +762,11 @@ static void delete_vma_from_mm(struct vmif (vma->vm_file) { mapping = vma->vm_file->f_mapping; +mutex_lock (&mapping->i_mmap_mutex);flush_dcache_mmap_lock (mapping);vma_prio_tree_remove (vma, &mapping->i_mmap);flush_dcache_mmap_unlock (mapping); +mutex_unlock (&mapping->i_mmap_mutex); }/* remove from the MM's tree and list */
@@ -2052,6 +2056,7 @@ int nommu_shrink_inode_mappings(struct i high = (size +PAGE_SIZE -1 ) >>PAGE_SHIFT ;down_write (&nommu_region_sem); +mutex_lock (&inode->i_mapping->i_mmap_mutex);/* search for VMAs that fall within the dead zone */ vma_prio_tree_foreach(vma, &iter, &inode->i_mapping->i_mmap,
@@ -2059,6 +2064,7 @@ int nommu_shrink_inode_mappings(struct i/* found one - only interested if it's shared out of the page * cache */ if (vma->vm_flags &VM_SHARED ) { +mutex_unlock (&inode->i_mapping->i_mmap_mutex);up_write (&nommu_region_sem);return -ETXTBSY ;/* not quite true, but near enough */ }
@@ -2086,6 +2092,7 @@ int nommu_shrink_inode_mappings(struct i } } +mutex_unlock (&inode->i_mapping->i_mmap_mutex);up_write (&nommu_region_sem);return 0 ; }
Greg KH
maintainerPATCH 50/72 hwmon: (max6639) Fix FAN_FROM_REG calculation
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris D Schimp <[email protected]>
commit b63d97a36edb1aecf8c13e5f5783feff4d64c24b upstream.
RPM calculation from tachometer value does not depend on PPR. Also, do not report negative RPM values.
--- drivers/hwmon/max6639.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hwmon/max6639.c +3 -3
@@ -72,8 +72,8 @@ static unsigned short normal_i2c[] = { 0static const int rpm_ranges[] = {2000 ,4000 ,8000 ,16000 }; -#define FAN_FROM_REG (val, div, rpm_range) ((val) == 0 ? -1 : \ - (val) == 255 ? 0 : (rpm_ranges[rpm_range] * 30) / ((div + 1) * (val))) +#define FAN_FROM_REG (val, rpm_range) ((val) == 0 || (val) == 255 ? \ + 0 : (rpm_ranges[rpm_range] * 30) / (val))#define TEMP_LIMIT_TO_REG (val) SENSORS_LIMIT((val) / 1000, 0, 255)/*
@@ -333,7 +333,7 @@ static ssize_t show_fan_input(struct devreturn PTR_ERR (data);return sprintf (buf,"%d\n" ,FAN_FROM_REG (data->fan[attr->index], - data->ppr, data->rpm_range)); + data->rpm_range)); } static ssize_t show_alarm(struct device *dev,
Greg KH
maintainerPATCH 51/72 hwmon: (max6639) Fix PPR register initialization to set both channels
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris D Schimp <[email protected]>
commit 2f2da1ac0ba5b6cc6e1957c4da5ff20e67d8442b upstream.
Initialize PPR register for both channels, and set correct PPR register bits. Also remove unnecessary variable initializations.
--- drivers/hwmon/max6639.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/hwmon/max6639.c +9 -7
@@ -429,9 +429,9 @@ static int max6639_init_client(struct i2struct max6639_data *data =i2c_get_clientdata (client);struct max6639_platform_data *max6639_info = client->dev.platform_data; -int i =0 ; +int i;int rpm_range =1 ;/* default: 4000 RPM */ -int err =0 ; +int err;/* Reset chip to default values, see below for GCONFIG setup */ err = i2c_smbus_write_byte_data(client, MAX6639_REG_GCONFIG,
@@ -446,11 +446,6 @@ static int max6639_init_client(struct i2else data->ppr =2 ; data->ppr -=1 ; - err =i2c_smbus_write_byte_data (client, -MAX6639_REG_FAN_PPR (i), - data->ppr <<5 ); -if (err) - goto exit;if (max6639_info) rpm_range =rpm_range_to_reg (max6639_info->rpm_range);
@@ -458,6 +453,13 @@ static int max6639_init_client(struct i2for (i =0 ; i <2 ; i++) { +/* Set Fan pulse per revolution */ + err =i2c_smbus_write_byte_data (client, +MAX6639_REG_FAN_PPR (i), + data->ppr <<6 ); +if (err) + goto exit; +/* Fans config PWM, RPM */ err = i2c_smbus_write_byte_data(client, MAX6639_REG_FAN_CONFIG1(i),
Greg KH
maintainerPATCH 52/72 hwmon: (ads1015) Fix file leak in probe function
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
commit 363434b5dc352464ac7601547891e5fc9105f124 upstream.
An error while creating sysfs attribute files in the driver's probe function results in an error abort, but already created files are not removed. This patch fixes the problem.
--- drivers/hwmon/ads1015.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/hwmon/ads1015.c +1 -2
@@ -271,7 +271,7 @@ static int ads1015_probe(struct i2c_cliecontinue ; err =device_create_file (&client->dev, &ads1015_in[k].dev_attr);if (err) - goto exit_free; + goto exit_remove; } data->hwmon_dev =hwmon_device_register (&client->dev);
@@ -285,7 +285,6 @@ static int ads1015_probe(struct i2c_clie exit_remove:for (k =0 ; k <ADS1015_CHANNELS ; ++k)device_remove_file (&client->dev, &ads1015_in[k].dev_attr); -exit_free:kfree (data); exit:return err;
Greg KH
maintainerPATCH 53/72 ARM: omap: fix oops in drivers/video/omap2/dss/dpi.c
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <[email protected]>
commit 40410715715178ec196314dd0c19150c06901f80 upstream.
When a PMIC is not found, this driver is unable to obtain its 'vdds_dsi_reg' regulator. Even through its initialization function fails, other code still calls its enable function, which fails to check whether it has this regulator before asking for it to be enabled.
This fixes the oops, however a better fix would be to sort out the upper layers to prevent them calling into a module which failed to initialize.
Unable to handle kernel NULL pointer dereference at virtual address 00000038 pgd = c0004000 [00000038] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT Modules linked in: CPU: 0 Not tainted (3.3.0-rc2+ #228) PC is at regulator_enable+0x10/0x70 LR is at omapdss_dpi_display_enable+0x54/0x15c pc : [<c01b9a08>] lr : [<c01af994>] psr: 60000013
sp : c181fd90 ip : c181fdb0 fp : c181fdac
r10: c042eff0 r9 : 00000060 r8 : c044a164
r7 : c042c0e4 r6 : c042bd60 r5 : 00000000 r4 : c042bd60 r3 : c084de48 r2 : c181e000 r1 : c042bd60 r0 : 00000000
Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
Control: 10c5387d Table: 80004019 DAC: 00000015 Process swapper (pid: 1, stack limit = 0xc181e2e8)
Stack: (0xc181fd90 to 0xc1820000)
fd80: c001754c c042bd60 00000000 c042bd60
fda0: c181fdcc c181fdb0 c01af994 c01b9a04 c0016104 c042bd60 c042bd60 c044a338
fdc0: c181fdec c181fdd0 c01b5ed0 c01af94c c042bd60 c042bd60 c1aa8000 c1aa8a0c
fde0: c181fe04 c181fdf0 c01b5f54 c01b5ea8 c02fc18c c042bd60 c181fe3c c181fe08
fe00: c01b2a18 c01b5f48 c01aed14 c02fc160 c01df8ec 00000002 c042bd60 00000003
fe20: c042bd60 c1aa8000 c1aa8a0c c042eff8 c181fe84 c181fe40 c01b3874 c01b29fc
fe40: c042eff8 00000000 c042f000 c0449db8 c044ed78 00000000 c181fe74 c042eff8
fe60: c042eff8 c0449db8 c0449db8 c044ed78 00000000 00000000 c181fe94 c181fe88
fe80: c01e452c c01b35e8 c181feb4 c181fe98 c01e2fdc c01e4518 c042eff8 c0449db8
fea0: c0449db8 c181fef0 c181fecc c181feb8 c01e3104 c01e2f48 c042eff8 c042f02c
fec0: c181feec c181fed0 c01e3190 c01e30c0 c01e311c 00000000 c01e311c c0449db8
fee0: c181ff14 c181fef0 c01e1998 c01e3128 c18330a8 c1892290 c04165e8 c0449db8
ff00: c0449db8 c1ab60c0 c181ff24 c181ff18 c01e2e28 c01e194c c181ff54 c181ff28
ff20: c01e2218 c01e2e14 c039afed c181ff38 c04165e8 c041660c c0449db8 00000013
ff40: 00000000 c03ffdb8 c181ff7c c181ff58 c01e384c c01e217c c181ff7c c04165e8
ff60: c041660c c003a37c 00000013 00000000 c181ff8c c181ff80 c01e488c c01e3790
ff80: c181ff9c c181ff90 c03ffdcc c01e484c c181ffdc c181ffa0 c0008798 c03ffdc4
ffa0: c181ffc4 c181ffb0 c0056440 c0187810 c003a37c c04165e8 c041660c c003a37c
ffc0: 00000013 00000000 00000000 00000000 c181fff4 c181ffe0 c03ea284 c0008708
ffe0: 00000000 c03ea208 00000000 c181fff8 c003a37c c03ea214 1073cec0 01f7ee08
Backtrace: [<c01b99f8>] (regulator_enable+0x0/0x70) from [<c01af994>] (omapdss_dpi_display_enable+0x54/0x15c) r6:c042bd60 r5:00000000 r4:c042bd60 [<c01af940>] (omapdss_dpi_display_enable+0x0/0x15c) from [<c01b5ed0>] (generic_dpi_panel_power_on+0x34/0x78) r6:c044a338 r5:c042bd60 r4:c042bd60 [<c01b5e9c>] (generic_dpi_panel_power_on+0x0/0x78) from [<c01b5f54>] (generic_dpi_panel_enable+0x18/0x28) r7:c1aa8a0c r6:c1aa8000 r5:c042bd60 r4:c042bd60 [<c01b5f3c>] (generic_dpi_panel_enable+0x0/0x28) from [<c01b2a18>] (omapfb_init_display+0x28/0x150) r4:c042bd60 [<c01b29f0>] (omapfb_init_display+0x0/0x150) from [<c01b3874>] (omapfb_probe+0x298/0x318) r8:c042eff8 r7:c1aa8a0c r6:c1aa8000 r5:c042bd60 r4:00000003 [<c01b35dc>] (omapfb_probe+0x0/0x318) from [<c01e452c>] (platform_drv_probe+0x20/0x24) [<c01e450c>] (platform_drv_probe+0x0/0x24) from [<c01e2fdc>] (really_probe+0xa0/0x178) [<c01e2f3c>] (really_probe+0x0/0x178) from [<c01e3104>] (driver_probe_device+0x50/0x68) r7:c181fef0 r6:c0449db8 r5:c0449db8 r4:c042eff8 [<c01e30b4>] (driver_probe_device+0x0/0x68) from [<c01e3190>] (__driver_attach+0x74/0x98) r5:c042f02c r4:c042eff8 [<c01e311c>] (__driver_attach+0x0/0x98) from [<c01e1998>] (bus_for_each_dev+0x58/0x98) r6:c0449db8 r5:c01e311c r4:00000000 [<c01e1940>] (bus_for_each_dev+0x0/0x98) from [<c01e2e28>] (driver_attach+0x20/0x28) r7:c1ab60c0 r6:c0449db8 r5:c0449db8 r4:c04165e8 [<c01e2e08>] (driver_attach+0x0/0x28) from [<c01e2218>] (bus_add_driver+0xa8/0x22c) [<c01e2170>] (bus_add_driver+0x0/0x22c) from [<c01e384c>] (driver_register+0xc8/0x154) [<c01e3784>] (driver_register+0x0/0x154) from [<c01e488c>] (platform_driver_register+0x4c/0x60) r8:00000000 r7:00000013 r6:c003a37c r5:c041660c r4:c04165e8 [<c01e4840>] (platform_driver_register+0x0/0x60) from [<c03ffdcc>] (omapfb_init+0x14/0x34) [<c03ffdb8>] (omapfb_init+0x0/0x34) from [<c0008798>] (do_one_initcall+0x9c/0x164) [<c00086fc>] (do_one_initcall+0x0/0x164) from [<c03ea284>] (kernel_init+0x7c/0x120) [<c03ea208>] (kernel_init+0x0/0x120) from [<c003a37c>] (do_exit+0x0/0x2d8) r5:c03ea208 r4:00000000 Code: e1a0c00d e92dd870 e24cb004 e24dd004 (e5906038) ---[ end trace 9e2474c2e193b223 ]---
--- drivers/video/omap2/dss/dpi.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/video/omap2/dss/dpi.c +5 -0
@@ -180,6 +180,11 @@ int omapdss_dpi_display_enable(struct om {int r; +if (cpu_is_omap34xx () && !dpi.vdds_dsi_reg) { +DSSERR ("no VDSS_DSI regulator\n" ); +return -ENODEV ; + } +if (dssdev->manager ==NULL ) {DSSERR ("failed to enable display: no manager\n" );return -ENODEV ;
Greg KH
maintainerPATCH 54/72 ARM: omap: fix oops in arch/arm/mach-omap2/vp.c when pmic is not found
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <[email protected]>
commit d980e0f8d858c6963d676013e976ff00ab7acb2b upstream.
When the PMIC is not found, voltdm->pmic will be NULL. vp.c's initialization function tries to dereferences this, which causes an oops:
Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = c0004000 [00000000] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT Modules linked in: CPU: 0 Not tainted (3.3.0-rc2+ #204) PC is at omap_vp_init+0x5c/0x15c LR is at omap_vp_init+0x58/0x15c pc : [<c03db880>] lr : [<c03db87c>] psr: 60000013
sp : c181ff30 ip : c181ff68 fp : c181ff64
r10: c0407808 r9 : c040786c r8 : c0407814
r7 : c0026868 r6 : c00264fc r5 : c040ad6c r4 : 00000000 r3 : 00000040 r2 : 000032c8 r1 : 0000fa00 r0 : 000032c8
Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
Control: 10c5387d Table: 80004019 DAC: 00000015 Process swapper (pid: 1, stack limit = 0xc181e2e8)
Stack: (0xc181ff30 to 0xc1820000)
ff20: c0381d00 c02e9c6d c0383582 c040786c
ff40: c040ad6c c00264fc c0026868 c0407814 00000000 c03d9de4 c181ff8c c181ff68
ff60: c03db448 c03db830 c02e982c c03fdfb8 c03fe004 c0039988 00000013 00000000
ff80: c181ff9c c181ff90 c03d9df8 c03db390 c181ffdc c181ffa0 c0008798 c03d9df0
ffa0: c181ffc4 c181ffb0 c0055a44 c0187050 c0039988 c03fdfb8 c03fe004 c0039988
ffc0: 00000013 00000000 00000000 00000000 c181fff4 c181ffe0 c03d1284 c0008708
ffe0: 00000000 c03d1208 00000000 c181fff8 c0039988 c03d1214 1077ce40 01f7ee08
Backtrace: [<c03db824>] (omap_vp_init+0x0/0x15c) from [<c03db448>] (omap_voltage_late_init+0xc4/0xfc) [<c03db384>] (omap_voltage_late_init+0x0/0xfc) from [<c03d9df8>] (omap2_common_pm_late_init+0x14/0x54) r8:00000000 r7:00000013 r6:c0039988 r5:c03fe004 r4:c03fdfb8 [<c03d9de4>] (omap2_common_pm_late_init+0x0/0x54) from [<c0008798>] (do_one_initcall+0x9c/0x164) [<c00086fc>] (do_one_initcall+0x0/0x164) from [<c03d1284>] (kernel_init+0x7c/0x120) [<c03d1208>] (kernel_init+0x0/0x120) from [<c0039988>] (do_exit+0x0/0x2cc) r5:c03d1208 r4:00000000 Code: e5ca300b e5900034 ebf69027 e5994024 (e5941000) ---[ end trace aed617dddaf32c3d ]--- Kernel panic - not syncing: Attempted to kill init!
--- arch/arm/mach-omap2/vp.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm/mach-omap2/vp.c +5 -0
@@ -41,6 +41,11 @@ void __init omap_vp_init(struct voltagedu32 val, sys_clk_rate, timeout, waittime;u32 vddmin, vddmax, vstepmin, vstepmax; +if (!voltdm->pmic || !voltdm->pmic->uv_to_vsel) { +pr_err ("%s: No PMIC info for vdd_%s\n" , __func__, voltdm->name); +return ; + } +if (!voltdm->read || !voltdm->write) {pr_err ("%s: No read/write API for accessing vdd_%s regs\n" , __func__, voltdm->name);
Greg KH
maintainerPATCH 55/72 x86/amd: Fix L1i and L2 cache sharing information for AMD family 15h processors
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Herrmann <[email protected]>
commit 32c3233885eb10ac9cb9410f2f8cd64b8df2b2a1 upstream.
For L1 instruction cache and L2 cache the shared CPU information is wrong. On current AMD family 15h CPUs those caches are shared between both cores of a compute unit.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=42607
--- arch/x86/kernel/cpu/intel_cacheinfo.c | 44 +++++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 8 deletions(-)
arch/x86/kernel/cpu/intel_cacheinfo.c +36 -8
@@ -326,8 +326,7 @@ static void __cpuinit amd_calc_l3_indice l3->indices = (max (max3 (sc0, sc1, sc2), sc3) <<10 ) -1 ; } -static void __cpuinit amd_init_l3_cache (struct _cpuid4_info_regs *this_leaf, -int index) +static void __cpuinit amd_init_l3_cache (struct _cpuid4_info_regs *this_leaf,int index) {int node;
@@ -725,14 +724,16 @@ static DEFINE_PER_CPU(struct _cpuid4_inf#define CPUID4_INFO_IDX (x, y) (&((per_cpu(ici_cpuid4_info, x))[y]))#ifdef CONFIG_SMP -static void __cpuinit cache_shared_cpu_map_setup (unsigned int cpu,int index) + +static int __cpuinit cache_shared_amd_cpu_map_setup (unsigned int cpu,int index) { -struct _cpuid4_info *this_leaf, *sibling_leaf; -unsigned long num_threads_sharing; -int index_msb, i, sibling; +struct _cpuid4_info *this_leaf; +int ret, i, sibling;struct cpuinfo_x86 *c = &cpu_data (cpu); -if ((index ==3 ) && (c->x86_vendor ==X86_VENDOR_AMD )) { + ret =0 ; +if (index ==3 ) { + ret =1 ;for_each_cpu (i,cpu_llc_shared_mask (cpu)) {if (!per_cpu (ici_cpuid4_info, i))continue ;
@@ -743,8 +744,35 @@ static void __cpuinit cache_shared_cpu_mset_bit (sibling, this_leaf->shared_cpu_map); } } -return ; + }else if ((c->x86 ==0x15 ) && ((index ==1 ) || (index ==2 ))) { + ret =1 ; +for_each_cpu (i,cpu_sibling_mask (cpu)) { +if (!per_cpu (ici_cpuid4_info, i)) +continue ; + this_leaf =CPUID4_INFO_IDX (i, index); +for_each_cpu (sibling,cpu_sibling_mask (cpu)) { +if (!cpu_online (sibling)) +continue ; +set_bit (sibling, this_leaf->shared_cpu_map); + } + } } + +return ret; +} + +static void __cpuinit cache_shared_cpu_map_setup (unsigned int cpu,int index) +{ +struct _cpuid4_info *this_leaf, *sibling_leaf; +unsigned long num_threads_sharing; +int index_msb, i; +struct cpuinfo_x86 *c = &cpu_data (cpu); + +if (c->x86_vendor ==X86_VENDOR_AMD ) { +if (cache_shared_amd_cpu_map_setup (cpu, index)) +return ; + } + this_leaf =CPUID4_INFO_IDX (cpu, index); num_threads_sharing =1 + this_leaf->base.eax.split.num_threads_sharing;
Greg KH
maintainerPATCH 56/72 ath9k: stop on rates with idx -1 in ath9k rate controls .tx_status
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Roskin <[email protected]>
commit 2504a6423b9ab4c36df78227055995644de19edb upstream.
Rate control algorithms are supposed to stop processing when they encounter a rate with the index -1. Checking for rate->count not being zero is not enough.
Allowing a rate with negative index leads to memory corruption in ath_debug_stat_rc().
One consequence of the bug is discussed at
https://bugzilla.redhat.com/show_bug.cgi?id=768639
--- drivers/net/wireless/ath/ath9k/rc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/rc.c +1 -1
@@ -1347,7 +1347,7 @@ static void ath_tx_status(void *priv, st fc = hdr->frame_control;for (i =0 ; i < sc->hw->max_rates; i++) {struct ieee80211_tx_rate *rate = &tx_info->status.rates[i]; -if (!rate->count) +if (rate->idx <0 || !rate->count)break ; final_ts_idx = i;
Greg KH
maintainerPATCH 57/72 genirq: Unmask oneshot irqs when thread was not woken
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit ac5637611150281f398bb7a47e3fcb69a09e7803 upstream.
When the primary handler of an interrupt which is marked IRQ_ONESHOT returns IRQ_HANDLED or IRQ_NONE, then the interrupt thread is not woken and the unmask logic of the interrupt line is never invoked. This keeps the interrupt masked forever.
This was not noticed as most IRQ_ONESHOT users wake the thread unconditionally (usually because they cannot access the underlying device from hard interrupt context). Though this behaviour was nowhere documented and not necessarily intentional. Some drivers can avoid the thread wakeup in certain cases and run into the situation where the interrupt line s kept masked.
Handle it gracefully.
--- kernel/irq/chip.c | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-)
kernel/irq/chip.c +23 -2
@@ -330,6 +330,24 @@ out_unlock: }EXPORT_SYMBOL_GPL (handle_simple_irq); +/* +* Called unconditionally from handle_level_irq() and only for oneshot +* interrupts from handle_fasteoi_irq() +*/ +static void cond_unmask_irq (struct irq_desc *desc) +{ +/* +* We need to unmask in the following cases: +* - Standard level irq (IRQF_ONESHOT is not set) +* - Oneshot irq which did not wake the thread (caused by a +* spurious interrupt or a primary handler handling it +* completely). +*/ +if (!irqd_irq_disabled (&desc->irq_data) && +irqd_irq_masked (&desc->irq_data) && !desc->threads_oneshot) +unmask_irq (desc); +} +/** * handle_level_irq - Level type irq handler * @irq: the interrupt number
@@ -362,8 +380,8 @@ handle_level_irq(unsigned int irq, struchandle_irq_event (desc); -if (!irqd_irq_disabled (&desc->irq_data) && !(desc->istate &IRQS_ONESHOT )) -unmask_irq (desc); +cond_unmask_irq (desc); + out_unlock:raw_spin_unlock (&desc->lock); }
@@ -417,6 +435,9 @@ handle_fasteoi_irq(unsigned int irq, strpreflow_handler (desc);handle_irq_event (desc); +if (desc->istate &IRQS_ONESHOT ) +cond_unmask_irq (desc); + out_eoi: desc->irq_data.chip->irq_eoi (&desc->irq_data); out_unlock:
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Quoted 1 line · Greg KH
3.2-stable review patch. If anyone has any objections, please let me know.
Alas, the commit below broke the WiFi on my laptop, where
"iwlist wlan0 scan" now just reports: " wlan0 No scan results".
This is not specific to 3.2, the same problem exists in 3.0.23 and 3.3-rc6 while previous releases worked.
The laptop is an Acer TravelMate 2490 with a Broadcom chip:
,----
| 06:02.0 Network controller: Broadcom Corporation BCM4318 [AirForce One 54g] 802.11g Wireless LAN Controller (rev 02) | Subsystem: AMBIT Microsystem Corp. TravelMate 2410 | Flags: bus master, fast devsel, latency 64, IRQ 10 | Memory at d0002000 (32-bit, non-prefetchable) [size=8K] | Kernel driver in use: b43-pci-bridge
`----
I'll be happy to give more information when needed.
Cheers,
Sven
Quoted 74 lines
From: Thomas Gleixner <[email protected]>
commit
ac5637611150281f398bb7a47e3fcb69a09e7803upstream.When the primary handler of an interrupt which is marked
IRQ_ONESHOTreturnsIRQ_HANDLEDorIRQ_NONE, then the interrupt thread is not woken and the unmask logic of the interrupt line is never invoked. This keeps the interrupt masked forever.This was not noticed as most
IRQ_ONESHOTusers wake the thread unconditionally (usually because they cannot access the underlying device from hard interrupt context). Though this behaviour was nowhere documented and not necessarily intentional. Some drivers can avoid the thread wakeup in certain cases and run into the situation where the interrupt line s kept masked.Handle it gracefully.
Reported-and-tested-by Lothar Wassmann <[email protected]>Signed-off-by Thomas Gleixner <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- kernel/irq/chip.c | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-)kernel/irq/chip.c +23
-2@@ -330,6 +330,24 @@ out_unlock: }EXPORT_SYMBOL_GPL (handle_simple_irq); +/* +* Called unconditionally from handle_level_irq() and only for oneshot +* interrupts from handle_fasteoi_irq() +*/ +static void cond_unmask_irq (struct irq_desc *desc) +{ +/* +* We need to unmask in the following cases: +* - Standard level irq (IRQF_ONESHOT is not set) +* - Oneshot irq which did not wake the thread (caused by a +* spurious interrupt or a primary handler handling it +* completely). +*/ +if (!irqd_irq_disabled (&desc->irq_data) && +irqd_irq_masked (&desc->irq_data) && !desc->threads_oneshot) +unmask_irq (desc); +} +/** * handle_level_irq - Level type irq handler * @irq: the interrupt number @@ -362,8 +380,8 @@ handle_level_irq(unsigned int irq, struchandle_irq_event (desc); -if (!irqd_irq_disabled (&desc->irq_data) && !(desc->istate &IRQS_ONESHOT )) -unmask_irq (desc); +cond_unmask_irq (desc); + out_unlock:raw_spin_unlock (&desc->lock); }@@ -417,6 +435,9 @@ handle_fasteoi_irq(unsigned int irq, strpreflow_handler (desc);handle_irq_event (desc); +if (desc->istate &IRQS_ONESHOT ) +cond_unmask_irq (desc); + out_eoi: desc->irq_data.chip->irq_eoi (&desc->irq_data); out_unlock:
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Quoted 9 lines · Sven Joachim
The laptop is an Acer TravelMate 2490 with a Broadcom chip:
,----
| 06:02.0 Network controller: Broadcom Corporation BCM4318 [AirForce One 54g] 802.11g Wireless LAN Controller (rev 02) | Subsystem: AMBIT Microsystem Corp. TravelMate 2410 | Flags: bus master, fast devsel, latency 64, IRQ 10 | Memory at d0002000 (32-bit, non-prefetchable) [size=8K] | Kernel driver in use: b43-pci-bridge`----
Odd. Does it use that driver with both working and non-working kernels?
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Quoted 12 lines · Jonathan Nieder
Quoted 9 lines · Sven Joachim
The laptop is an Acer TravelMate 2490 with a Broadcom chip:
,----
| 06:02.0 Network controller: Broadcom Corporation BCM4318 [AirForce One 54g] 802.11g Wireless LAN Controller (rev 02) | Subsystem: AMBIT Microsystem Corp. TravelMate 2410 | Flags: bus master, fast devsel, latency 64, IRQ 10 | Memory at d0002000 (32-bit, non-prefetchable) [size=8K] | Kernel driver in use: b43-pci-bridge`----
Quoted 2 lines
Odd. Does it use that driver with both working and non-working kernels?
Yes, although lsmod just tells me that "b43" is loaded. And "dmesg | grep b43" shows this:
,----
| [ 0.628622] b43-pci-bridge 0000:06:02.0: enabling device (0000 -> 0002) | [ 0.628780] b43-pci-bridge 0000:06:02.0: PCI INT A -> Link[LNKG] -> GSI 10 (level, low) -> IRQ 10 | [ 0.628795] b43-pci-bridge 0000:06:02.0: setting latency timer to 64 | [ 5.648519] b43-phy0: Broadcom 4318 WLAN found (core revision 9) | [ 36.267694] b43-phy0: Loading firmware version 410.2160 (2007-05-26 15:32:10)
`----
The kernel configuration has these b43 related parameters:
CONFIG_B43=mCONFIG_B43_SSB=yCONFIG_B43_PCI_AUTOSELECT=yCONFIG_B43_PCICORE_AUTOSELECT=y
# CONFIG_B43_PCMCIA is not set
# CONFIG_B43_SDIO is not setCONFIG_B43_PIO=y
# CONFIG_B43_PHY_N is not setCONFIG_B43_PHY_LP=y
# CONFIG_B43_PHY_HT is not setCONFIG_B43_HWRNG=y
# CONFIG_B43_DEBUG is not set
# CONFIG_B43LEGACY is not setCONFIG_SSB_B43_PCI_BRIDGE=y
Cheers,
Sven
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
In reply to Sven JoachimHi
Quoted 9 lines · Sven Joachim
Quoted 1 line · Greg KH
3.2-stable review patch. If anyone has any objections, please let me know.
Alas, the commit below broke the WiFi on my laptop, where
"iwlist wlan0 scan" now just reports: " wlan0 No scan results".This is not specific to 3.2, the same problem exists in 3.0.23 and 3.3-rc6 while previous releases worked.
I can confirm this regression on an old PIII based notebook with a 32 bit BCM4306/3 PCMCIA card:
02:00.0 Network controller [0280]: Broadcom Corporation BCM4306 802.11b/g Wireless LAN Controller [14e4:4320] (rev 03)
Subsystem: Linksys WPC54G v1 / WPC54GS v1 802.11g Wireless-G Notebook Adapter [1737:4320]
Flags: bus master, fast devsel, latency 64, IRQ 10
Memory at 20000000 (32-bit, non-prefetchable) [size=8K]
Capabilities: [40] Power Management version 2
Kernel driver in use: b43-pci-bridge
I can observe these differences in the dmesg output (3.2.9 + current stable queue-3.2):
The kernel configuration is identical in both cases, the only difference is "genirq: Unmask oneshot irqs when thread was not woken" being applied or not.
broken renamed from working +17 -18
@@ -125,6 +125,7 @@ Initializing cgroup subsys freezer Initializing cgroup subsys net_cls Initializing cgroup subsys blkio Initializing cgroup subsys perf_event +CPU serial number disabled. mce: CPU supports 5 MCE banks SMP alternatives: switching to UP code Freeing SMP alternatives: 8k freed
@@ -137,9 +138,16 @@ SMP disabled Performance Events: no APIC, boot with the "lapic" boot parameter to force-enable it. no hardware sampling interrupt available. -Broken PMU hardware detected, using software events only. +p6 PMU driver. +... version: 0 +... bit width: 32 +... generic registers: 2 +... value mask: 00000000ffffffff +... max period: 000000007fffffff +... fixed-purpose events: 0 +... event mask: 0000000000000003 Brought up 1 CPUs Total of 1 processors activated (1989.75 BogoMIPS). devtmpfs: initialized PM: Registering ACPI NVS region at eeff000 (4096 bytes) print_constraints: dummy:
@@ -174,12 +182,12 @@ pci 0000:00:00.0: reg 10: [mem 0xec00000 type 1 class 0x000604 pci 0000:00:01.0: supports D1 type 2 class 0x000607 -pci 0000:00:04.0: reg 10: [mem 0x10000000-0x10000fff] +pci 0000:00:04.0: reg 10: [mem 0x00000000-0x00000fff] pci 0000:00:04.0: supports D1 D2 pci 0000:00:04.0: PME# supported from D0 D1 D2 D3hot D3cold pci 0000:00:04.0: PME# disabled type 2 class 0x000607 -pci 0000:00:04.1: reg 10: [mem 0x14000000-0x14000fff] +pci 0000:00:04.1: reg 10: [mem 0x00000000-0x00000fff] pci 0000:00:04.1: supports D1 D2 pci 0000:00:04.1: PME# supported from D0 D1 D2 D3hot D3cold pci 0000:00:04.1: PME# disabled
@@ -299,6 +307,10 @@ pnp: PnP ACPI: found 11 devices ACPI: ACPI bus type pnp unregistered Switching to clocksource acpi_pm PCI: max bus depth: 1 pci_try_num: 2 +pci 0000:00:04.0: BAR 0: assigned [mem 0x10000000-0x10000fff] +(PCI address [0x10000000-0x10000fff]) +pci 0000:00:04.1: BAR 0: assigned [mem 0x14000000-0x14000fff] +(PCI address [0x14000000-0x14000fff]) pci 0000:00:11.0: BAR 6: assigned [mem 0x10020000-0x1003ffff pref] pci 0000:00:04.1: BAR 16: assigned [mem 0x18000000-0x1bffffff] pci 0000:00:04.1: BAR 15: assigned [mem 0x1c000000-0x1fffffff pref]
@@ -326,9 +338,11 @@ pci 0000:00:01.0: setting latency timer enabled at IRQ 10 PCI: setting IRQ 10 as level-triggered -> GSI 10 (level, low) -> IRQ 10 +pci 0000:00:04.0: setting latency timer to 64 enabled at IRQ 11 PCI: setting IRQ 11 as level-triggered -> GSI 11 (level, low) -> IRQ 11 +pci 0000:00:04.1: setting latency timer to 64 pci_bus 0000:00: resource 0 [io 0x0000-0xffff] pci_bus 0000:00: resource 1 [mem 0x00000000-0xffffffff] pci_bus 0000:01: resource 1 [mem 0xe8100000-0xe81fffff]
@@ -562,20 +576,6 @@ b43-phy0: Hardware crypto acceleration n b43-phy0: QoS not supported by firmware ADDRCONF(NETDEV_UP): wlan0: link is not ready NET: Registered protocol family 17 -wlan0: authenticate with [redacted MAC address] (try 1) -wlan0: authenticated -wlan0: associate with [redacted MAC address] (try 1) -wlan0: RX AssocResp from [redacted MAC address] (capab=0x411 status=0 aid=1) -wlan0: associated -ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready -cfg80211: Calling CRDA for country: DE -Intel AES-NI instructions are not detected. -cfg80211: Regulatory domain changed to country: DE -cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) -cfg80211: (2400000 KHz - 2483500 KHz @ 40000 KHz), (N/A, 2000 mBm) -cfg80211: (5150000 KHz - 5250000 KHz @ 40000 KHz), (N/A, 2000 mBm) -cfg80211: (5250000 KHz - 5350000 KHz @ 40000 KHz), (N/A, 2000 mBm) -cfg80211: (5470000 KHz - 5725000 KHz @ 40000 KHz), (N/A, 2698 mBm) lp0: using parport0 (interrupt-driven). lp0: console ready ppdev: user-space parallel port driver
@@ -589,4 +589,3 @@ mtrr: base(0xf2000000) is not aligned on agpgart-via 0000:00:00.0: AGP 2.0 bridge agpgart-via 0000:00:00.0: putting AGP V2 device into 0x mode pci 0000:01:00.0: putting AGP V2 device into 0x mode -wlan0: no IPv6 routers present
While I don't get any revealing error messages, once "genirq: Unmask oneshot irqs when thread was not woken" is applied the wlan card stops working (no scan results, unable to auth).
I cannot reproduce this problem on a different amd64/ 64 bit system with a BCM4318 PCI card, which continues to work fine.
Regards
Stefan Lippers-Hollmann
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Thomas, should we just plan on reverting that commit from mainline? It clearly causes regressions.
Linus
Quoted 132 lines · Stefan Lippers-Hollmann
Hi
Quoted 9 lines · Sven Joachim
Quoted 1 line · Greg KH
3.2-stable review patch. �If anyone has any objections, please let me know.
Alas, the commit below broke the WiFi on my laptop, where "iwlist wlan0 scan" now just reports: " wlan0 � � No scan results".
This is not specific to 3.2, the same problem exists in 3.0.23 and 3.3-rc6 while previous releases worked.
I can confirm this regression on an old PIII based notebook with a 32 bit BCM4306/3 PCMCIA card:
02:00.0 Network controller [0280]: Broadcom Corporation BCM4306 802.11b/g Wireless LAN Controller [14e4:4320] (rev 03) � � � �Subsystem: Linksys WPC54G v1 / WPC54GS v1 802.11g Wireless-G Notebook Adapter [1737:4320] � � � �Flags: bus master, fast devsel, latency 64, IRQ 10
� � � �Memory at 20000000 (32-bit, non-prefetchable) [size=8K]
� � � �Capabilities: [40] Power Management version 2
� � � �Kernel driver in use: b43-pci-bridgeI can observe these differences in the dmesg output (3.2.9 + current stable queue-3.2):
The kernel configuration is identical in both cases, the only difference is "genirq: Unmask oneshot irqs when thread was not woken" being applied or not.
broken � � �<-- 3.2.9 + current stable queue-3.2 renamed from working � � <-- 3.2.9 + current stable queue-3.2, with "genirq: Unmask oneshot irqs when thread was not woken" reverted +0
-0@@ -125,6 +125,7 @@ Initializing cgroup subsys freezer�Initializing cgroup subsys
net_cls
�Initializing cgroup subsys blkio
�Initializing cgroup subsysperf_event
+CPU serial number disabled.
�mce: CPU supports 5 MCE banks
�SMP alternatives: switching to UP code
�Freeing SMP alternatives: 8k freedbroken � � �<-- 3.2.9 + current stable queue-3.2 renamed from working � � <-- 3.2.9 + current stable queue-3.2, with "genirq: Unmask oneshot irqs when thread was not woken" reverted +0
-0@@ -137,9 +138,16 @@ SMP disabled�Performance Events:
�no APIC, boot with the "lapic" boot parameter to force-enable it. �no hardware sampling interrupt available.broken � � �<-- 3.2.9 + current stable queue-3.2 renamed from working � � <-- 3.2.9 + current stable queue-3.2, with "genirq: Unmask oneshot irqs when thread was not woken" reverted +8
-1-Broken PMU hardware detected, using software events only. +p6 PMU driver. +... version: � � � � � � � �0 +... bit width: � � � � � � �32 +... generic registers: � � �2 +... value mask: � � � � � � 00000000ffffffff +... max period: � � � � � � 000000007fffffff +... fixed-purpose events: � 0 +... event mask: � � � � � � 0000000000000003�Brought up 1 CPUs
�Total of 1 processors activated (1989.75 BogoMIPS). �devtmpfs: initialized
�PM: Registering ACPI NVS region at eeff000 (4096 bytes) �print_constraints: dummy:broken � � �<-- 3.2.9 + current stable queue-3.2 renamed from working � � <-- 3.2.9 + current stable queue-3.2, with "genirq: Unmask oneshot irqs when thread was not woken" reverted +0
-0@@ -174,12 +182,12 @@ pci 0000:00:00.0: reg 10: [mem 0xec00000�type 1 class
0x000604
�pci 0000:00:01.0: supports D1
�type 2 class0x000607broken � � �<-- 3.2.9 + current stable queue-3.2 renamed from working � � <-- 3.2.9 + current stable queue-3.2, with "genirq: Unmask oneshot irqs when thread was not woken" reverted +1
-1-pci 0000:00:04.0: reg 10: [mem 0x10000000-0x10000fff] +pci 0000:00:04.0: reg 10: [mem 0x00000000-0x00000fff]�pci 0000:00:04.0: supports D1 D2
�pci 0000:00:04.0: PME# supported from D0 D1 D2 D3hot D3cold �pci 0000:00:04.0: PME# disabled
�type 2 class0x000607broken � � �<-- 3.2.9 + current stable queue-3.2 renamed from working � � <-- 3.2.9 + current stable queue-3.2, with "genirq: Unmask oneshot irqs when thread was not woken" reverted +1
-1-pci 0000:00:04.1: reg 10: [mem 0x14000000-0x14000fff] +pci 0000:00:04.1: reg 10: [mem 0x00000000-0x00000fff]�pci 0000:00:04.1: supports D1 D2
�pci 0000:00:04.1: PME# supported from D0 D1 D2 D3hot D3cold �pci 0000:00:04.1: PME# disabledbroken � � �<-- 3.2.9 + current stable queue-3.2 renamed from working � � <-- 3.2.9 + current stable queue-3.2, with "genirq: Unmask oneshot irqs when thread was not woken" reverted +0
-0@@ -299,6 +307,10 @@ pnp: PnP ACPI: found 11 devices�ACPI: ACPI bus type pnp unregistered
�Switching to clocksourceacpi_pm
�PCI: max bus depth: 1pci_try_num: 2broken � � �<-- 3.2.9 + current stable queue-3.2 renamed from working � � <-- 3.2.9 + current stable queue-3.2, with "genirq: Unmask oneshot irqs when thread was not woken" reverted +4
-0+pci 0000:00:04.0: BAR 0: assigned [mem 0x10000000-0x10000fff] +(PCI address [0x10000000-0x10000fff]) +pci 0000:00:04.1: BAR 0: assigned [mem 0x14000000-0x14000fff] +(PCI address [0x14000000-0x14000fff])�pci 0000:00:11.0: BAR 6: assigned [mem 0x10020000-0x1003ffff pref] �pci 0000:00:04.1: BAR 16: assigned [mem 0x18000000-0x1bffffff] �pci 0000:00:04.1: BAR 15: assigned [mem 0x1c000000-0x1fffffff pref]
broken � � �<-- 3.2.9 + current stable queue-3.2 renamed from working � � <-- 3.2.9 + current stable queue-3.2, with "genirq: Unmask oneshot irqs when thread was not woken" reverted +0
-0@@ -326,9 +338,11 @@ pci 0000:00:01.0: setting latency timer�enabled at IRQ 10
�PCI: setting IRQ 10 as level-triggered
�-> GSI 10 (level, low) -> IRQ 10
+pci 0000:00:04.0: setting latency timer to 64 �enabled at IRQ 11
�PCI: setting IRQ 11 as level-triggered
�-> GSI 11 (level, low) -> IRQ 11
+pci 0000:00:04.1: setting latency timer to 64 �pci_bus 0000:00: resource 0 [io �0x0000-0xffff] �pci_bus 0000:00: resource 1 [mem 0x00000000-0xffffffff] �pci_bus 0000:01: resource 1 [mem 0xe8100000-0xe81fffff]broken � � �<-- 3.2.9 + current stable queue-3.2 renamed from working � � <-- 3.2.9 + current stable queue-3.2, with "genirq: Unmask oneshot irqs when thread was not woken" reverted +0
-0@@ -562,20 +576,6 @@ b43-phy0: Hardware crypto acceleration n�b43-phy0: QoS not supported by firmware
�ADDRCONF(NETDEV_UP): wlan0: link is not ready
�NET: Registered protocol family 17broken � � �<-- 3.2.9 + current stable queue-3.2 renamed from working � � <-- 3.2.9 + current stable queue-3.2, with "genirq: Unmask oneshot irqs when thread was not woken" reverted +0
-14-wlan0: authenticate with [redacted MAC address] (try 1) -wlan0: authenticated -wlan0: associate with [redacted MAC address] (try 1) -wlan0: RX AssocResp from [redacted MAC address] (capab=0x411 status=0 aid=1) -wlan0: associated -ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready -cfg80211: Calling CRDA for country: DE -Intel AES-NI instructions are not detected. -cfg80211: Regulatory domain changed to country: DE -cfg80211: � � (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) -cfg80211: � � (2400000 KHz - 2483500 KHz @ 40000 KHz), (N/A, 2000 mBm) -cfg80211: � � (5150000 KHz - 5250000 KHz @ 40000 KHz), (N/A, 2000 mBm) -cfg80211: � � (5250000 KHz - 5350000 KHz @ 40000 KHz), (N/A, 2000 mBm) -cfg80211: � � (5470000 KHz - 5725000 KHz @ 40000 KHz), (N/A, 2698 mBm)�lp0: using parport0 (interrupt-driven).
�lp0: console ready
�ppdev: user-space parallel port driverbroken � � �<-- 3.2.9 + current stable queue-3.2 renamed from working � � <-- 3.2.9 + current stable queue-3.2, with "genirq: Unmask oneshot irqs when thread was not woken" reverted +0
-0@@ -589,4 +589,3 @@ mtrr: base(0xf2000000) is not aligned on�agpgart-via 0000:00:00.0: AGP 2.0 bridge �agpgart-via 0000:00:00.0: putting AGP V2 device into 0x mode �pci 0000:01:00.0: putting AGP V2 device into 0x mode -wlan0: no IPv6 routers present
While I don't get any revealing error messages, once "genirq: Unmask oneshot irqs when thread was not woken" is applied the wlan card stops working (no scan results, unable to auth).
I cannot reproduce this problem on a different amd64/ 64 bit system with a BCM4318 PCI card, which continues to work fine.
Regards
� � � �Stefan Lippers-Hollmann
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Quoted 2 lines · Linus Torvalds
Thomas, should we just plan on reverting that commit from mainline? It clearly causes regressions.
Give me a day or two to figure out why it breaks stuff. I have no idea why it should wreckage anything.
Thanks,
tglx
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Quoted 7 lines · Thomas Gleixner
Quoted 2 lines · Linus Torvalds
Thomas, should we just plan on reverting that commit from mainline? It clearly causes regressions.
Give me a day or two to figure out why it breaks stuff. I have no idea why it should wreckage anything.
Hmm. This is interesting. The b43 driver has a primary handler which can return IRQ_NONE. So up to that change the interrupt line was kept disabled when that happened. Possibly the driver relies on that behaviour. Digging for a machine with a b43.
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Quoted 7 lines · Thomas Gleixner
Quoted 5 lines · Thomas Gleixner
Quoted 2 lines · Linus Torvalds
Thomas, should we just plan on reverting that commit from mainline? It clearly causes regressions.
Quoted 7 lines
Quoted 2 lines
Give me a day or two to figure out why it breaks stuff. I have no idea why it should wreckage anything.
Hmm. This is interesting. The b43 driver has a primary handler which can return
IRQ_NONE. So up to that change the interrupt line was kept disabled when that happened. Possibly the driver relies on that behaviour. Digging for a machine with a b43.
Does not reproduce. Now I was looking at the driver again, it does not use IRQ_ONESHOT anyway.
So for handle_fasteoi_irq() this patch is actually a NOOP. So the only affected handler would be handle_level_irq(). Still can't see how it changes the !IRQ_ONESHOT behaviour :(
Stephan, Sven: Can you please provide the output of /proc/interrupts ?
Thanks,
tglx
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Am 06.03.2012 um 20:31 schrieb Thomas Gleixner:
Quoted 1 line
Stephan, Sven: Can you please provide the output of
/proc/interrupts?
Here is mine, from a freshly booted 3.3-rc6 kernel.
Cheers,
Sven
CPU0
0: 25050 XT-PIC-XT-PIC timer 1: 101 XT-PIC-XT-PIC i8042 2: 0 XT-PIC-XT-PIC cascade 3: 1 XT-PIC-XT-PIC 4: 1 XT-PIC-XT-PIC 5: 0 XT-PIC-XT-PIC ehci_hcd:usb1, uhci_hcd:usb2 6: 1 XT-PIC-XT-PIC i915, uhci_hcd:usb5, yenta 7: 1 XT-PIC-XT-PIC 8: 0 XT-PIC-XT-PIC rtc0 9: 634 XT-PIC-XT-PIC acpi 10: 341 XT-PIC-XT-PIC uhci_hcd:usb4, snd_hda_intel, b43 11: 0 XT-PIC-XT-PIC uhci_hcd:usb3 12: 144 XT-PIC-XT-PIC i8042 14: 4141 XT-PIC-XT-PIC ata_piix 15: 0 XT-PIC-XT-PIC ata_piix NMI: 0 Non-maskable interrupts MCE: 0 Machine check exceptions MCP: 1 Machine check polls ERR: 0
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Quoted 10 lines · Sven Joachim
Am 06.03.2012 um 20:31 schrieb Thomas Gleixner:
Quoted 1 line
Stephan, Sven: Can you please provide the output of
/proc/interrupts?Here is mine, from a freshly booted 3.3-rc6 kernel.
Cheers,
SvenCPU0
Quoted 11 lines
0: 25050 XT-PIC-XT-PIC timer 1: 101 XT-PIC-XT-PIC i8042 2: 0 XT-PIC-XT-PIC cascade 3: 1 XT-PIC-XT-PIC 4: 1 XT-PIC-XT-PIC 5: 0 XT-PIC-XT-PIC ehci_hcd:usb1, uhci_hcd:usb2 6: 1 XT-PIC-XT-PIC i915, uhci_hcd:usb5, yenta 7: 1 XT-PIC-XT-PIC 8: 0 XT-PIC-XT-PIC rtc0 9: 634 XT-PIC-XT-PIC acpi 10: 341 XT-PIC-XT-PIC uhci_hcd:usb4, snd_hda_intel, b43
Ah, XT-PIC uses handle_level_irq(). /me bangs head against desk.
Does the patch below fix the problem for you ?
Thanks,
tglx
----------------->
Subject: genirq: Clear action->thread_mask if IRQ_ONESHOT is not set
commit ac5637611(genirq: Unmask oneshot irqs when thread was not woken) fails to unmask when a !IRQ_ONESHOT threaded handler is handled by handle_level_irq. This happens because thread_mask is or'ed unconditionally in irq_wake_thread(), but for !IRQ_ONESHOT interrupts never cleared. So the check for !desc->thread_active fails and keeps the interrupt disabled.
Keep the thread_mask zero for !IRQ_ONESHOT interrupts.
---
kernel/irq/manage.c +6 -4
@@ -996,11 +996,13 @@ __setup_irq(unsigned int irq, struct irq* Setup the thread mask for this irqaction. Unlikely to have * 32 resp 64 irqs sharing one line, but who knows. */ -if (new->flags &IRQF_ONESHOT && thread_mask == ~0UL ) { - ret = -EBUSY ; - goto out_mask; +if (new->flags &IRQF_ONESHOT ) { +if (thread_mask == ~0UL ) { + ret = -EBUSY ; + goto out_mask; + } + new->thread_mask = new->flags &IRQF_ONESHOT ; } - new->thread_mask =1 <<ffz (thread_mask);if (!shared) {init_waitqueue_head (&desc->wait_for_threads);
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Quoted 23 lines · Thomas Gleixner
Quoted 10 lines · Sven Joachim
Am 06.03.2012 um 20:31 schrieb Thomas Gleixner:
Quoted 1 line
Stephan, Sven: Can you please provide the output of
/proc/interrupts?Here is mine, from a freshly booted 3.3-rc6 kernel.
Cheers,
SvenCPU0
Quoted 11 lines
0: 25050 XT-PIC-XT-PIC timer 1: 101 XT-PIC-XT-PIC i8042 2: 0 XT-PIC-XT-PIC cascade 3: 1 XT-PIC-XT-PIC 4: 1 XT-PIC-XT-PIC 5: 0 XT-PIC-XT-PIC ehci_hcd:usb1, uhci_hcd:usb2 6: 1 XT-PIC-XT-PIC i915, uhci_hcd:usb5, yenta 7: 1 XT-PIC-XT-PIC 8: 0 XT-PIC-XT-PIC rtc0 9: 634 XT-PIC-XT-PIC acpi 10: 341 XT-PIC-XT-PIC uhci_hcd:usb4, snd_hda_intel, b43
Quoted 1 line
Ah, XT-PIC uses
handle_level_irq(). /me bangs head against desk.
Ha, nosmp on the command line lets me reproduce as well and the patch fixes it. Duh, stupid me.
Thanks,
tglx
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
In reply to Thomas GleixnerAm 06.03.2012 um 21:26 schrieb Thomas Gleixner:
Quoted 23 lines · Sven Joachim
Quoted 10 lines
Am 06.03.2012 um 20:31 schrieb Thomas Gleixner:
Quoted 1 line
Stephan, Sven: Can you please provide the output of
/proc/interrupts?Here is mine, from a freshly booted 3.3-rc6 kernel.
Cheers,
SvenCPU0
Quoted 11 lines
0: 25050 XT-PIC-XT-PIC timer 1: 101 XT-PIC-XT-PIC i8042 2: 0 XT-PIC-XT-PIC cascade 3: 1 XT-PIC-XT-PIC 4: 1 XT-PIC-XT-PIC 5: 0 XT-PIC-XT-PIC ehci_hcd:usb1, uhci_hcd:usb2 6: 1 XT-PIC-XT-PIC i915, uhci_hcd:usb5, yenta 7: 1 XT-PIC-XT-PIC 8: 0 XT-PIC-XT-PIC rtc0 9: 634 XT-PIC-XT-PIC acpi 10: 341 XT-PIC-XT-PIC uhci_hcd:usb4, snd_hda_intel, b43
Quoted 3 lines
Ah, XT-PIC uses
handle_level_irq(). /me bangs head against desk.Does the patch below fix the problem for you ?
Yep, it does. Thanks!
Quoted 39 lines
----------------->
Subject: genirq: Clearaction->thread_maskifIRQ_ONESHOTis not setcommit ac5637611(genirq: Unmask oneshot irqs when thread was not woken) fails to unmask when a !IRQ_ONESHOT threaded handler is handled by
handle_level_irq. This happens becausethread_maskis or'ed unconditionally inirq_wake_thread(), but for !IRQ_ONESHOT interrupts never cleared. So the check for !desc->thread_active fails and keeps the interrupt disabled.Keep the
thread_maskzero for !IRQ_ONESHOT interrupts.Reported-by Sven Joachim <[email protected]>Signed-off-by Thomas Gleixner <[email protected]>---
Index:
linux-2.6/kernel/irq/manage.c
===================================================================kernel/irq/manage.c +6
-4@@ -996,11 +996,13 @@ __setup_irq(unsigned int irq, struct irq* Setup the thread mask for this irqaction. Unlikely to have * 32 resp 64 irqs sharing one line, but who knows. */ -if (new->flags &IRQF_ONESHOT && thread_mask == ~0UL ) { - ret = -EBUSY ; - goto out_mask; +if (new->flags &IRQF_ONESHOT ) { +if (thread_mask == ~0UL ) { + ret = -EBUSY ; + goto out_mask; + } + new->thread_mask = new->flags &IRQF_ONESHOT ; } - new->thread_mask =1 <<ffz (thread_mask);if (!shared) {init_waitqueue_head (&desc->wait_for_threads);
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Linus,
Quoted 25 lines · Sven Joachim
Am 06.03.2012 um 21:26 schrieb Thomas Gleixner:
Quoted 23 lines · Sven Joachim
Quoted 21 lines
Am 06.03.2012 um 20:31 schrieb Thomas Gleixner:
Quoted 1 line
Stephan, Sven: Can you please provide the output of
/proc/interrupts?Here is mine, from a freshly booted 3.3-rc6 kernel.
Cheers,
SvenCPU0
0: 25050 XT-PIC-XT-PIC timer 1: 101 XT-PIC-XT-PIC i8042 2: 0 XT-PIC-XT-PIC cascade 3: 1 XT-PIC-XT-PIC 4: 1 XT-PIC-XT-PIC 5: 0 XT-PIC-XT-PIC ehci_hcd:usb1, uhci_hcd:usb2 6: 1 XT-PIC-XT-PIC i915, uhci_hcd:usb5, yenta 7: 1 XT-PIC-XT-PIC 8: 0 XT-PIC-XT-PIC rtc0 9: 634 XT-PIC-XT-PIC acpi 10: 341 XT-PIC-XT-PIC uhci_hcd:usb4, snd_hda_intel, b43
Quoted 5 lines
Quoted 3 lines
Ah, XT-PIC uses
handle_level_irq(). /me bangs head against desk.Does the patch below fix the problem for you ?
Yep, it does. Thanks!
Can you pick it up directly or want me to send it via tip ?
Thanks,
tglx
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Quoted 2 lines · Thomas Gleixner
Can you pick it up directly or want me to send it via tip ?
I can certainly pick it up directly, but I want the sane version, not the "random monkeys typing" version. Please.
Linus
Stefan Lippers-Hollmann
Tested-byRe: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
In reply to Thomas GleixnerHi
Quoted 12 lines · Thomas Gleixner
Quoted 11 lines · Sven Joachim
Am 06.03.2012 um 20:31 schrieb Thomas Gleixner:
Quoted 1 line
Stephan, Sven: Can you please provide the output of
/proc/interrupts?Here is mine, from a freshly booted 3.3-rc6 kernel.
Cheers,
SvenCPU0
0: 25050 XT-PIC-XT-PIC timer
[…]
Quoted 13 lines
Quoted 1 line
10: 341 XT-PIC-XT-PIC uhci_hcd:usb4,
snd_hda_intel, b43Ah, XT-PIC uses
handle_level_irq(). /me bangs head against desk.Does the patch below fix the problem for you ?
Thanks,
tglx
----------------->
Subject: genirq: Clearaction->thread_maskifIRQ_ONESHOTis not set
Quoted 8 lines
commit ac5637611(genirq: Unmask oneshot irqs when thread was not woken) fails to unmask when a !IRQ_ONESHOT threaded handler is handled by
handle_level_irq. This happens becausethread_maskis or'ed unconditionally inirq_wake_thread(), but for !IRQ_ONESHOT interrupts never cleared. So the check for !desc->thread_active fails and keeps the interrupt disabled.Keep the
thread_maskzero for !IRQ_ONESHOT interrupts.
[…]
I can confirm that this patch, applied to 2.6.9, including "genirq:
Unmask oneshot irqs when thread was not woken", and + the current stable queue-3.2 fixes b43 wlan operations. Feel free to add
if you like.
Thanks a lot
Stefan Lippers-Hollmann
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
In reply to Thomas GleixnerQuoted 2 lines · Thomas Gleixner
Subject: genirq: Clear
action->thread_maskifIRQ_ONESHOTis not set
Umm. Apparently this patch fixes the bug, but the patch itself is just insane.
Quoted 11 lines
- � � � if (
new->flags&IRQF_ONESHOT&&thread_mask== ~0UL) {
- � � � � � � � ret =-EBUSY;
- � � � � � � � gotoout_mask;
+ � � � if (new->flags&IRQF_ONESHOT) {
+ � � � � � � � if (thread_mask== ~0UL) {
+ � � � � � � � � � � � ret =-EBUSY;
+ � � � � � � � � � � � gotoout_mask;
+ � � � � � � � }
+ � � � � � � �new->thread_mask=new->flags&IRQF_ONESHOT; � � � �}
- � � �new->thread_mask= 1 <<ffz(thread_mask);
WHAT?
You just checked that "new->flags & IRQF_ONESHOT" nonzero, and inside that if-statement, you then do
new->thread_mask = new->flags & IRQF_ONESHOT;
which is just crazy. Why don't you just do
new->thread_mask = IRQF_ONESHOT;
if that is what you actually meant?
What is that code actually *supposed* to do?
Also, what was the meaning of that old insane line:
new->thread_mask = 1 << ffz(thread_mask);
which you removed? It was crap, I agree, but what was the thinking behind it? And the reason it was crap is because that's a crazy expression that could be written better ways (*), and it needs a comment on what the heck the point of it was..
So stop with these "random code" snippets, and explain what the f*&^ the code is meant to do, AND THEN WRITE THE CODE IN A SANE MANNER instead of posting these kinds of insane patches.
Because right now it really looks like the "random monkey" approach to programming.
Linus
(*) "1 << ffz(a)" can be written as
a = ~a; /* Turn the zero bits into 1 bits */
a &= -a; /* .. and find the first one. */
without ever doing any insane bit scanning.
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Quoted 7 lines · Linus Torvalds
(*) "1 << ffz(a)" can be written as
� a = ~a; � � � �/* Turn the zero bits into 1 bits */ � a &= -a; � � �/* .. and find the first one. */
without ever doing any insane bit scanning.
Alternatively, wite it directly as "(a+1) &~a", which is the same expression just written differently (due to "-a == ~a+1")
Yeah, I've been playing too much with the bitwise optimizations of the dentry cache name comparisons lately.
Linus
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
In reply to Linus TorvaldsQuoted 2 lines · Linus Torvalds
On Tue, Mar 6, 2012 at 12:26 PM, Thomas Gleixner <[email protected]> wrote:
without ever doing any insane bit scanning.
Duh, yes. That's really insane. I first did
- new->thread_mask = 1 << ffz(thread_mask);
+ new->thread_mask = (new->flags & IRQF_ONESHOT) ? 1 << ffz(thread_mask) : 0;
and then decided to move it into the already existing new->flags & IRQF_ONESHOT check section and deleted the wrong part ....
/me looks for a huge brown paperbag.
Thanks for catching it !
tglx
-------------->
Subject: genirq: Clear action->thread_mask if IRQ_ONESHOT is not set
commit ac5637611(genirq: Unmask oneshot irqs when thread was not woken) fails to unmask when a !IRQ_ONESHOT threaded handler is handled by handle_level_irq. This happens because thread_mask is or'ed unconditionally in irq_wake_thread(), but for !IRQ_ONESHOT interrupts never cleared. So the check for !desc->thread_active fails and keeps the interrupt disabled.
Keep the thread_mask zero for !IRQ_ONESHOT interrupts.
Document the thread_mask magic while at it.
---
kernel/irq/manage.c +38 -6
@@ -985,6 +985,11 @@ __setup_irq(unsigned int irq, struct irq/* add new interrupt at end of irq queue */ do { + /* + * Or all existing action->thread_mask bits, + * so we can find the next zero bit for this + * new action. + */ thread_mask |= old->thread_mask; old_ptr = &old->next; old = *old_ptr;
@@ -993,14 +998,41 @@ __setup_irq(unsigned int irq, struct irq }/* -* Setup the thread mask for this irqaction. Unlikely to have -* 32 resp 64 irqs sharing one line, but who knows. +* Setup the thread mask for this irqaction for ONESHOT. For +* !ONESHOT irqs the thread mask is 0 so we can avoid a +* conditional in irq_wake_thread(). */ -if (new->flags &IRQF_ONESHOT && thread_mask == ~0UL ) { - ret = -EBUSY ; - goto out_mask; +if (new->flags &IRQF_ONESHOT ) { +/* +* Unlikely to have 32 resp 64 irqs sharing one line, +* but who knows. +*/ +if (thread_mask == ~0UL ) { + ret = -EBUSY ; + goto out_mask; + } +/* +* The thread_mask for the action is or'ed to +* desc->thread_active to indicate that the +* IRQF_ONESHOT thread handler has been woken, but not +* yet finished. The bit is cleared when a thread +* completes. When all threads of a shared interrupt +* line have completed desc->threads_active becomes +* zero and the interrupt line is unmasked. See +* handle.c:irq_wake_thread() for further information. +* +* If no thread is woken by primary (hard irq context) +* interrupt handlers, then desc->threads_active is +* also checked for zero to unmask the irq line in the +* affected hard irq flow handlers +* (handle_[fasteoi|level]_irq). +* +* The new action gets the first zero bit of +* thread_mask assigned. See the loop above which or's +* all existing action->thread_mask bits. +*/ + new->thread_mask =1 <<ffz (thread_mask); } - new->thread_mask =1 <<ffz (thread_mask);if (!shared) {init_waitqueue_head (&desc->wait_for_threads);
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Quoted 1 line · Thomas Gleixner
Subject: genirq: Clear
action->thread_maskifIRQ_ONESHOTis not set
Ok, can we get this fixed version tested too by people who saw the problem?
Just to make sure..
Thanks,
Linus
Stefan Lippers-Hollmann
Tested-byRe: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Hi
Quoted 6 lines · Linus Torvalds
Quoted 1 line · Thomas Gleixner
Subject: genirq: Clear
action->thread_maskifIRQ_ONESHOTis not setOk, can we get this fixed version tested too by people who saw the problem?
Just to make sure..
[…]
This variant is also working fine on PIII/ coppermine and bcm4306/3.
Regards
Stefan Lippers-Hollmann
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
In reply to Linus TorvaldsQuoted 4 lines · Linus Torvalds
Quoted 1 line · Thomas Gleixner
Subject: genirq: Clear
action->thread_maskifIRQ_ONESHOTis not setOk, can we get this fixed version tested too by people who saw the problem?
It works for me.
Cheers,
Sven
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
In reply to Thomas GleixnerHi
Quoted 16 lines · Thomas Gleixner
Quoted 7 lines · Thomas Gleixner
Quoted 5 lines · Thomas Gleixner
Quoted 2 lines · Linus Torvalds
Thomas, should we just plan on reverting that commit from mainline? It clearly causes regressions.
Quoted 7 lines
Quoted 2 lines
Give me a day or two to figure out why it breaks stuff. I have no idea why it should wreckage anything.
Hmm. This is interesting. The b43 driver has a primary handler which can return
IRQ_NONE. So up to that change the interrupt line was kept disabled when that happened. Possibly the driver relies on that behaviour. Digging for a machine with a b43.
Quoted 8 lines
Does not reproduce. Now I was looking at the driver again, it does not use
IRQ_ONESHOTanyway.So for
handle_fasteoi_irq()this patch is actually a NOOP. So the only affected handler would behandle_level_irq(). Still can't see how it changes the !IRQ_ONESHOT behaviour :(Stephan, Sven: Can you please provide the output of
/proc/interrupts?
Full /proc/interrupts and gzipped dmesg attached for kernel 3.2.9 + current stable queue-3.2, no difference in the interrupt output between working and broken state. Both outputs taken immediately after a cold reboot.
*.broken is with "genirq: Unmask oneshot irqs when thread was not woken" applied, resulting in empty wlan scan results, no auth).
*.working with only this patch reverted (3 wlan cells visible, immediate auth.
Regards
Stefan Lippers-Hollmann
CPU0
0: 16875 XT-PIC-XT-PIC timer
1: 94 XT-PIC-XT-PIC i8042
2: 0 XT-PIC-XT-PIC cascade
3: 2 XT-PIC-XT-PIC
4: 2 XT-PIC-XT-PIC
5: 3 XT-PIC-XT-PIC firewire_ohci, snd_via82xx
6: 2 XT-PIC-XT-PIC floppy
7: 1 XT-PIC-XT-PIC parport0
8: 0 XT-PIC-XT-PIC rtc0
9: 0 XT-PIC-XT-PIC acpi
10: 3 XT-PIC-XT-PIC yenta, b43
11: 2 XT-PIC-XT-PIC uhci_hcd:usb1, yenta
12: 107 XT-PIC-XT-PIC i8042
14: 6431 XT-PIC-XT-PIC pata_via
15: 80 XT-PIC-XT-PIC pata_via
NMI: 0 Non-maskable interrupts
LOC: 0 Local timer interrupts
SPU: 0 Spurious interrupts
PMI: 0 Performance monitoring interrupts
IWI: 0 IRQ work interrupts
RES: 0 Rescheduling interrupts
CAL: 0 Function call interrupts
TLB: 0 TLB shootdowns
TRM: 0 Thermal event interrupts
THR: 0 Threshold APIC interrupts
MCE: 0 Machine check exceptions
MCP: 1 Machine check polls
ERR: 0
MIS: 0
CPU0
0: 17967 XT-PIC-XT-PIC timer
1: 196 XT-PIC-XT-PIC i8042
2: 0 XT-PIC-XT-PIC cascade
3: 2 XT-PIC-XT-PIC
4: 2 XT-PIC-XT-PIC
5: 3 XT-PIC-XT-PIC firewire_ohci, snd_via82xx
6: 2 XT-PIC-XT-PIC floppy
7: 1 XT-PIC-XT-PIC parport0
8: 0 XT-PIC-XT-PIC rtc0
9: 0 XT-PIC-XT-PIC acpi
10: 527 XT-PIC-XT-PIC yenta, b43
11: 2 XT-PIC-XT-PIC uhci_hcd:usb1, yenta
12: 107 XT-PIC-XT-PIC i8042
14: 6491 XT-PIC-XT-PIC pata_via
15: 80 XT-PIC-XT-PIC pata_via
NMI: 0 Non-maskable interrupts
LOC: 0 Local timer interrupts
SPU: 0 Spurious interrupts
PMI: 0 Performance monitoring interrupts
IWI: 0 IRQ work interrupts
RES: 0 Rescheduling interrupts
CAL: 0 Function call interrupts
TLB: 0 TLB shootdowns
TRM: 0 Thermal event interrupts
THR: 0 Threshold APIC interrupts
MCE: 0 Machine check exceptions
MCP: 1 Machine check polls
ERR: 0
MIS: 0Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
In reply to Stefan Lippers-HollmannQuoted 31 lines · Stefan Lippers-Hollmann
Quoted 9 lines · Sven Joachim
Quoted 1 line · Greg KH
3.2-stable review patch. If anyone has any objections, please let me know.
Alas, the commit below broke the WiFi on my laptop, where
"iwlist wlan0 scan" now just reports: " wlan0 No scan results".This is not specific to 3.2, the same problem exists in 3.0.23 and 3.3-rc6 while previous releases worked.
I can confirm this regression on an old PIII based notebook with a 32 bit BCM4306/3 PCMCIA card:
02:00.0 Network controller [0280]: Broadcom Corporation BCM4306 802.11b/g Wireless LAN Controller [14e4:4320] (rev 03)
Subsystem: Linksys WPC54G v1 / WPC54GS v1 802.11g Wireless-G Notebook Adapter [1737:4320]
Flags: bus master, fast devsel, latency 64, IRQ 10
Memory at 20000000 (32-bit, non-prefetchable) [size=8K]
Capabilities: [40] Power Management version 2
Kernel driver in use: b43-pci-bridgeI can observe these differences in the dmesg output (3.2.9 + current stable queue-3.2):
The kernel configuration is identical in both cases, the only difference is "genirq: Unmask oneshot irqs when thread was not woken" being applied or not.
broken Initializing cgroup subsys freezer · line 128
Quoted 4 lines
broken renamed from working +1
-0@@ -125,6 +125,7 @@ Initializing cgroup subsys freezer Initializing cgroup subsys net_cls Initializing cgroup subsys blkio Initializing cgroup subsys perf_event +CPU serial number disabled.
I can't see why reverting that genirq patch would cause this.
Quoted 6 lines
broken renamed from working +0
-0mce: CPU supports 5 MCE banks SMP alternatives: switching to UP code Freeing SMP alternatives: 8k freed@@ -137,9 +138,16 @@ SMP disabled Performance Events: no APIC, boot with the "lapic" boot parameter to force-enable it.
broken SMP disabled · line 148
Quoted 10 lines
broken renamed from working +8
-1no hardware sampling interrupt available. -Broken PMU hardware detected, using software events only. +p6 PMU driver. +... version: 0 +... bit width: 32 +... generic registers: 2 +... value mask: 00000000ffffffff +... max period: 000000007fffffff +... fixed-purpose events: 0 +... event mask: 0000000000000003
Ditto.
broken pci 0000:00:00.0: reg 10: [mem 0xec00000 · line 185
Quoted 11 lines
broken renamed from working +1
-1Brought up 1 CPUs Total of 1 processors activated (1989.75 BogoMIPS). devtmpfs: initialized PM: Registering ACPI NVS region at eeff000 (4096 bytes) print_constraints: dummy:@@ -174,12 +182,12 @@ pci 0000:00:00.0: reg 10: [mem 0xec00000 type 1 class 0x000604 pci 0000:00:01.0: supports D1 type 2 class 0x000607 -pci 0000:00:04.0: reg 10: [mem 0x10000000-0x10000fff] +pci 0000:00:04.0: reg 10: [mem 0x00000000-0x00000fff]
Even more.
There is something extremly fishy.
Thanks,
tglx
Re: [ 57/72] genirq: Unmask oneshot irqs when thread was not woken
Am 06.03.2012 um 20:45 schrieb Thomas Gleixner:
Quoted 58 lines · Stefan Lippers-Hollmann
Quoted 31 lines · Sven Joachim
Quoted 9 lines · Greg KH
Quoted 2 lines
3.2-stable review patch. If anyone has any objections, please let me know.
Alas, the commit below broke the WiFi on my laptop, where
"iwlist wlan0 scan" now just reports: " wlan0 No scan results".This is not specific to 3.2, the same problem exists in 3.0.23 and 3.3-rc6 while previous releases worked.
I can confirm this regression on an old PIII based notebook with a 32 bit BCM4306/3 PCMCIA card:
02:00.0 Network controller [0280]: Broadcom Corporation BCM4306 802.11b/g Wireless LAN Controller [14e4:4320] (rev 03)
Subsystem: Linksys WPC54G v1 / WPC54GS v1 802.11g Wireless-G Notebook Adapter [1737:4320]
Flags: bus master, fast devsel, latency 64, IRQ 10
Memory at 20000000 (32-bit, non-prefetchable) [size=8K]
Capabilities: [40] Power Management version 2
Kernel driver in use: b43-pci-bridgeI can observe these differences in the dmesg output (3.2.9 + current stable queue-3.2):
The kernel configuration is identical in both cases, the only difference is "genirq: Unmask oneshot irqs when thread was not woken" being applied or not.
broken Initializing cgroup subsys freezer · line 128
Quoted 4 lines
broken renamed from working +1
-0@@ -125,6 +125,7 @@ Initializing cgroup subsys freezer Initializing cgroup subsys net_cls Initializing cgroup subsys blkio Initializing cgroup subsys perf_event +CPU serial number disabled.I can't see why reverting that genirq patch would cause this.
Quoted 6 lines
broken renamed from working +0
-0mce: CPU supports 5 MCE banks SMP alternatives: switching to UP code Freeing SMP alternatives: 8k freed@@ -137,9 +138,16 @@ SMP disabled Performance Events: no APIC, boot with the "lapic" boot parameter to force-enable it.broken SMP disabled · line 148
Quoted 10 lines
broken renamed from working +8
-1no hardware sampling interrupt available. -Broken PMU hardware detected, using software events only. +p6 PMU driver. +... version: 0 +... bit width: 32 +... generic registers: 2 +... value mask: 00000000ffffffff +... max period: 000000007fffffff +... fixed-purpose events: 0 +... event mask: 0000000000000003Ditto.
Quoted 13 lines
broken pci 0000:00:00.0: reg 10: [mem 0xec00000 · line 185
Quoted 11 lines
broken renamed from working +1
-1Brought up 1 CPUs Total of 1 processors activated (1989.75 BogoMIPS). devtmpfs: initialized PM: Registering ACPI NVS region at eeff000 (4096 bytes) print_constraints: dummy:@@ -174,12 +182,12 @@ pci 0000:00:00.0: reg 10: [mem 0xec00000 type 1 class 0x000604 pci 0000:00:01.0: supports D1 type 2 class 0x000607 -pci 0000:00:04.0: reg 10: [mem 0x10000000-0x10000fff] +pci 0000:00:04.0: reg 10: [mem 0x00000000-0x00000fff]Even more.
FWIW, I don't see any such differences on my system (with 3.3-rc6).
Quoted 1 line
There is something extremly fishy.
Cheers,
Sven
Greg KH
maintainerPATCH 58/72 genirq: Handle pending irqs in irq_startup()
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit b4bc724e82e80478cba5fe9825b62e71ddf78757 upstream.
An interrupt might be pending when irq_startup() is called, but the startup code does not invoke the resend logic. In some cases this prevents the device from issuing another interrupt which renders the device non functional.
Call the resend function in irq_startup() to keep things going.
--- kernel/irq/autoprobe.c | 4 ++-- kernel/irq/chip.c | 17 ++++++++++------- kernel/irq/internals.h | 2 +- kernel/irq/manage.c | 2 +- 4 files changed, 14 insertions(+), 11 deletions(-)
kernel/irq/autoprobe.c +2 -2
@@ -53,7 +53,7 @@ unsigned long probe_irq_on(void)if (desc->irq_data.chip->irq_set_type) desc->irq_data.chip->irq_set_type (&desc->irq_data,IRQ_TYPE_PROBE ); -irq_startup (desc); +irq_startup (desc, false); }raw_spin_unlock_irq (&desc->lock); }
@@ -70,7 +70,7 @@ unsigned long probe_irq_on(void)raw_spin_lock_irq (&desc->lock);if (!desc->action &&irq_settings_can_probe (desc)) { desc->istate |=IRQS_AUTODETECT |IRQS_WAITING ; -if (irq_startup (desc)) +if (irq_startup (desc, false)) desc->istate |=IRQS_PENDING ; }raw_spin_unlock_irq (&desc->lock);
kernel/irq/chip.c +10 -7
@@ -157,19 +157,22 @@ static void irq_state_set_masked(structirqd_set (&desc->irq_data,IRQD_IRQ_MASKED ); } -int irq_startup (struct irq_desc *desc) +int irq_startup (struct irq_desc *desc,bool resend) { +int ret =0 ; +irq_state_clr_disabled (desc); desc->depth =0 ;if (desc->irq_data.chip->irq_startup) { -int ret = desc->irq_data.chip->irq_startup (&desc->irq_data); + ret = desc->irq_data.chip->irq_startup (&desc->irq_data);irq_state_clr_masked (desc); -return ret; + }else { +irq_enable (desc); } - -irq_enable (desc); -return 0 ; +if (resend) +check_irq_resend (desc, desc->irq_data.irq); +return ret; }void irq_shutdown (struct irq_desc *desc)
@@ -646,7 +649,7 @@ __irq_set_handler(unsigned int irq, irq_irq_settings_set_noprobe (desc);irq_settings_set_norequest (desc);irq_settings_set_nothread (desc); -irq_startup (desc); +irq_startup (desc, true); } out:irq_put_desc_busunlock (desc, flags);
kernel/irq/internals.h +1 -1
@@ -67,7 +67,7 @@ extern int __irq_set_trigger(struct irq_extern void __disable_irq (struct irq_desc *desc,unsigned int irq,bool susp);extern void __enable_irq (struct irq_desc *desc,unsigned int irq,bool resume); -extern int irq_startup (struct irq_desc *desc); +extern int irq_startup (struct irq_desc *desc,bool resend);extern void irq_shutdown (struct irq_desc *desc);extern void irq_enable (struct irq_desc *desc);extern void irq_disable (struct irq_desc *desc);
kernel/irq/manage.c +1 -1
@@ -1027,7 +1027,7 @@ __setup_irq(unsigned int irq, struct irq desc->istate |=IRQS_ONESHOT ;if (irq_settings_can_autoenable (desc)) -irq_startup (desc); +irq_startup (desc, true);else /* Undo nested disables: */ desc->depth =1 ;
Greg KH
maintainerPATCH 59/72 scsi_scan: Fix Poison overwritten warning caused by using freed shost
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huajun Li <[email protected]>
commit 267a6ad4aefaafbde607804c60945bcf97f91c1b upstream.
In do_scan_async(), calling scsi_autopm_put_host(shost) may reference freed shost, and cause Posison overwitten warning.
Yes, this case can happen, for example, an USB is disconnected just when do_scan_async() thread starts to run, then scsi_host_put() called in scsi_finish_async_scan() will lead to shost be freed(because the refcount of shost->shost_gendev decreases to 1 after USB disconnects), at this point, if references shost again, system will show following warning msg.
To make scsi_autopm_put_host(shost) always reference a valid shost, put it just before scsi_host_put() in function scsi_finish_async_scan().
[ 299.281565] =============================================================================
[ 299.281634] BUG kmalloc-4096 (Tainted: G I ): Poison overwritten
[ 299.281682] -----------------------------------------------------------------------------
[ 299.281684]
[ 299.281752] INFO: 0xffff880056c305d0-0xffff880056c305d0. First byte
0x6a instead of 0x6b
[ 299.281816] INFO: Allocated in scsi_host_alloc+0x4a/0x490 age=1688
cpu=1 pid=2004
[ 299.281870] __slab_alloc+0x617/0x6c1
[ 299.281901] __kmalloc+0x28c/0x2e0
[ 299.281931] scsi_host_alloc+0x4a/0x490
[ 299.281966] usb_stor_probe1+0x5b/0xc40 [usb_storage]
[ 299.282010] storage_probe+0xa4/0xe0 [usb_storage]
[ 299.282062] usb_probe_interface+0x172/0x330 [usbcore]
[ 299.282105] driver_probe_device+0x257/0x3b0
[ 299.282138] __driver_attach+0x103/0x110
[ 299.282171] bus_for_each_dev+0x8e/0xe0
[ 299.282201] driver_attach+0x26/0x30
[ 299.282230] bus_add_driver+0x1c4/0x430
[ 299.282260] driver_register+0xb6/0x230
[ 299.282298] usb_register_driver+0xe5/0x270 [usbcore]
[ 299.282337] 0xffffffffa04ab03d
[ 299.282364] do_one_initcall+0x47/0x230
[ 299.282396] sys_init_module+0xa0f/0x1fe0
[ 299.282429] INFO: Freed in scsi_host_dev_release+0x18a/0x1d0 age=85
cpu=0 pid=2008
[ 299.282482] __slab_free+0x3c/0x2a1
[ 299.282510] kfree+0x296/0x310
[ 299.282536] scsi_host_dev_release+0x18a/0x1d0
[ 299.282574] device_release+0x74/0x100
[ 299.282606] kobject_release+0xc7/0x2a0
[ 299.282637] kobject_put+0x54/0xa0
[ 299.282668] put_device+0x27/0x40
[ 299.282694] scsi_host_put+0x1d/0x30
[ 299.282723] do_scan_async+0x1fc/0x2b0
[ 299.282753] kthread+0xdf/0xf0
[ 299.282782] kernel_thread_helper+0x4/0x10
[ 299.282817] INFO: Slab 0xffffea00015b0c00 objects=7 used=7 fp=0x
(null) flags=0x100000000004080
[ 299.282882] INFO: Object 0xffff880056c30000 @offset=0 fp=0x (null)
[ 299.282884]...
--- drivers/scsi/scsi_scan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/scsi_scan.c +2 -2
@@ -1815,6 +1815,7 @@ static void scsi_finish_async_scan(struc }spin_unlock (&async_scan_lock); +scsi_autopm_put_host (shost);scsi_host_put (shost);kfree (data); }
@@ -1841,7 +1842,6 @@ static int do_scan_async(void *_data)do_scsi_scan_host (shost);scsi_finish_async_scan (data); -scsi_autopm_put_host (shost);return 0 ; }
@@ -1869,7 +1869,7 @@ void scsi_scan_host(struct Scsi_Host *sh p =kthread_run (do_scan_async, data,"scsi_scan_%d" , shost->host_no);if (IS_ERR (p))do_scan_async (data); -/* scsi_autopm_put_host(shost) is called in do_scan_async() */ +/* scsi_autopm_put_host(shost) is called in scsi_finish_async_scan() */ }EXPORT_SYMBOL (scsi_scan_host);
Greg KH
maintainerPATCH 60/72 scsi_pm: Fix bug in the SCSI power management handler
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit fea6d607e154cf96ab22254ccb48addfd43d4cb5 upstream.
This patch (as1520) fixes a bug in the SCSI layer's power management implementation.
LUN scanning can be carried out asynchronously in do_scan_async(), and sd uses an asynchronous thread for the time-consuming parts of disk probing in sd_probe_async(). Currently nothing coordinates these async threads with system sleep transitions; they can and do attempt to continue scanning/probing SCSI devices even after the host adapter has been suspended. As one might expect, the outcome is not ideal.
This is what the "prepare" stage of system suspend was created for. After the prepare callback has been called for a host, target, or device, drivers are not allowed to register any children underneath them. Currently the SCSI prepare callback is not implemented; this patch rectifies that omission.
For SCSI hosts, the prepare routine calls scsi_complete_async_scans() to wait until async scanning is finished. It might be slightly more efficient to wait only until the host in question has been scanned, but there's currently no way to do that. Besides, during a sleep transition we will ultimately have to wait until all the host scanning has finished anyway.
For SCSI devices, the prepare routine calls async_synchronize_full() to wait until sd probing is finished. The routine does nothing for SCSI targets, because asynchronous target scanning is done only as part of host scanning.
--- drivers/scsi/scsi_pm.c | 16 ++++++++++++++++ drivers/scsi/scsi_priv.h | 1 + 2 files changed, 17 insertions(+)
drivers/scsi/scsi_pm.c +16 -0
@@ -7,6 +7,7 @@#include <linux/pm_runtime.h> #include <linux/export.h> +#include <linux/async.h> #include <scsi/scsi.h> #include <scsi/scsi_device.h>
@@ -69,6 +70,19 @@ static int scsi_bus_resume_common(structreturn err; } +static int scsi_bus_prepare (struct device *dev) +{ +if (scsi_is_sdev_device (dev)) { +/* sd probing uses async_schedule. Wait until it finishes. */ +async_synchronize_full (); + + }else if (scsi_is_host_device (dev)) { +/* Wait until async scanning is finished */ +scsi_complete_async_scans (); + } +return 0 ; +} +static int scsi_bus_suspend (struct device *dev) {return scsi_bus_suspend_common (dev,PMSG_SUSPEND );
@@ -87,6 +101,7 @@ static int scsi_bus_poweroff(struct devi#else /* CONFIG_PM_SLEEP */ #define scsi_bus_resume_common NULL +#define scsi_bus_prepare NULL#define scsi_bus_suspend NULL#define scsi_bus_freeze NULL#define scsi_bus_poweroff NULL
@@ -195,6 +210,7 @@ void scsi_autopm_put_host(struct Scsi_Ho#endif /* CONFIG_PM_RUNTIME */ const struct dev_pm_ops scsi_bus_pm_ops = { + .prepare = scsi_bus_prepare, .suspend = scsi_bus_suspend, .resume = scsi_bus_resume_common, .freeze = scsi_bus_freeze,
drivers/scsi/scsi_priv.h +1 -0
@@ -110,6 +110,7 @@ extern void scsi_exit_procfs(void);#endif /* CONFIG_PROC_FS */ /* scsi_scan.c */ +extern int scsi_complete_async_scans (void );extern int scsi_scan_host_selected (struct Scsi_Host *,unsigned int ,unsigned int ,unsigned int ,int );extern void scsi_forget_host (struct Scsi_Host *);
Greg KH
maintainerPATCH 61/72 ipvs: fix matching of fwmark templates during scheduling
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
commit e0aac52e17a3db68fe2ceae281780a70fc69957f upstream.
Commit f11017ec2d1859c661f4e2b12c4a8d250e1f47cf (2.6.37)
moved the fwmark variable in subcontext that is invalidated before reaching the ip_vs_ct_in_get call. As vaddr is provided as pointer in the param structure make sure the fwmark variable is in same context. As the fwmark templates can not be matched, more and more template connections are created and the controlled connections can not go to single real server.
--- net/netfilter/ipvs/ip_vs_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/ipvs/ip_vs_core.c +1 -1
@@ -232,6 +232,7 @@ ip_vs_sched_persist(struct ip_vs_service__be16 dport =0 ;/* destination port to forward */ unsigned int flags;struct ip_vs_conn_param param; +const union nf_inet_addr fwmark = { .ip =htonl (svc->fwmark) };union nf_inet_addr snet;/* source network of the client, after masking */
@@ -267,7 +268,6 @@ ip_vs_sched_persist(struct ip_vs_service {int protocol = iph.protocol;const union nf_inet_addr *vaddr = &iph.daddr; -const union nf_inet_addr fwmark = { .ip =htonl (svc->fwmark) };__be16 vport =0 ;if (dst_port == svc->port) {
Greg KH
maintainerPATCH 62/72 jme: Fix FIFO flush issue
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guo-Fu Tseng <[email protected]>
commit ba9adbe67e288823ac1deb7f11576ab5653f833e upstream.
Set the RX FIFO flush watermark lower. According to Federico and JMicron's reply, setting it to 16QW would be stable on most platforms. Otherwise, user might experience packet drop issue.
--- drivers/net/ethernet/jme.c | 10 +--------- drivers/net/ethernet/jme.h | 2 +- 2 files changed, 2 insertions(+), 10 deletions(-)
drivers/net/ethernet/jme.c +1 -9
@@ -2328,19 +2328,11 @@ jme_change_mtu(struct net_device *netdev ((new_mtu) < IPV6_MIN_MTU))return -EINVAL ; -if (new_mtu >4000 ) { - jme->reg_rxcs &= ~RXCS_FIFOTHNP ; - jme->reg_rxcs |=RXCS_FIFOTHNP_64QW ; -jme_restart_rx_engine (jme); - }else { - jme->reg_rxcs &= ~RXCS_FIFOTHNP ; - jme->reg_rxcs |=RXCS_FIFOTHNP_128QW ; -jme_restart_rx_engine (jme); - } netdev->mtu = new_mtu;netdev_update_features (netdev); +jme_restart_rx_engine (jme);jme_reset_link (jme);return 0 ;
drivers/net/ethernet/jme.h +1 -1
@@ -730,7 +730,7 @@ enum jme_rxcs_values {RXCS_RETRYCNT_60 =0x00000F00 ,RXCS_DEFAULT =RXCS_FIFOTHTP_128T | -RXCS_FIFOTHNP_128QW | +RXCS_FIFOTHNP_16QW |RXCS_DMAREQSZ_128B | RXCS_RETRYGAP_256ns | RXCS_RETRYCNT_32,
Greg KH
maintainerPATCH 63/72 davinci_emac: Do not free all rx dma descriptors during init
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Riesch <[email protected]>
commit 5d69703263d588dbb03f4e57091afd8942d96e6d upstream.
This patch fixes a regression that was introduced by
commit 0a5f38467765ee15478db90d81e40c269c8dda20davinci_emac: Add Carrier Link OK check in Davinci RX Handler
Said commit adds a check whether the carrier link is ok. If the link is not ok, the skb is freed and no new dma descriptor added to the rx dma channel. This causes trouble during initialization when the carrier status has not yet been updated. If a lot of packets are received while netif_carrier_ok returns false, all dma descriptors are freed and the rx dma transfer is stopped.
The bug occurs when the board is connected to a network with lots of traffic and the ifconfig down/up is done, e.g., when reconfiguring the interface with DHCP.
The bug can be reproduced by flood pinging the davinci board while doing ifconfig eth0 down
ifconfig eth0 up
on the board.
After that, the rx path stops working and the overrun value reported by ifconfig is counting up.
This patch reverts commit 0a5f38467765ee15478db90d81e40c269c8dda20 and instead issues warnings only if cpdma_chan_submit returns -ENOMEM.
--- drivers/net/ethernet/ti/davinci_emac.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/ti/davinci_emac.c +4 -2
@@ -1007,7 +1007,7 @@ static void emac_rx_handler(void *token,int ret;/* free and bail if we are shutting down */ -if (unlikely (!netif_running (ndev) || !netif_carrier_ok (ndev))) { +if (unlikely (!netif_running (ndev))) {dev_kfree_skb_any (skb);return ; }
@@ -1036,7 +1036,9 @@ static void emac_rx_handler(void *token, recycle: ret =cpdma_chan_submit (priv->rxchan, skb, skb->data,skb_tailroom (skb),GFP_KERNEL ); -if (WARN_ON (ret <0 )) + +WARN_ON (ret == -ENOMEM ); +if (unlikely (ret <0 ))dev_kfree_skb_any (skb); }
Greg KH
maintainerPATCH 64/72 builddeb: Dont create files in /tmp with predictable names
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
commit 6c635224602d760c1208ada337562f40d8ae93a5 upstream.
The current use of /tmp for file lists is insecure. Put them under $objtree/debian instead.
--- scripts/package/builddeb | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
scripts/package/builddeb +6 -6
@@ -238,14 +238,14 @@ EOF fi # Build header package -(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > /tmp/files$$) -(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> /tmp/files$$) -(cd $objtree; find .config Module.symvers include scripts -type f >> /tmp/objfiles$$) +(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > "$objtree/debian/hdrsrcfiles") +(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> "$objtree/debian/hdrsrcfiles") +(cd $objtree; find .config Module.symvers include scripts -type f >> "$objtree/debian/hdrobjfiles") destdir=$kernel_headers_dir/usr/src/linux-headers-$version mkdir -p "$destdir" -(cd $srctree; tar -c -f - -T /tmp/files$$) | (cd $destdir; tar -xf -) -(cd $objtree; tar -c -f - -T /tmp/objfiles$$) | (cd $destdir; tar -xf -) -rm -f /tmp/files$$ /tmp/objfiles$$ +(cd $srctree; tar -c -f - -T "$objtree/debian/hdrsrcfiles") | (cd $destdir; tar -xf -) +(cd $objtree; tar -c -f - -T "$objtree/debian/hdrobjfiles") | (cd $destdir; tar -xf -) +rm -f "$objtree/debian/hdrsrcfiles" "$objtree/debian/hdrobjfiles" arch=$(dpkg --print-architecture) cat <<EOF >> debian/control
Greg KH
maintainerPATCH 65/72 can: sja1000: fix isr hang when hw is unplugged under load
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit a7762b10c12a70c5dbf2253142764b728ac88c3a upstream.
In the case of hotplug enabled devices (PCMCIA/PCIeC) the removal of the hardware can cause an infinite loop in the common sja1000 isr.
Use the already retrieved status register to indicate a possible hardware removal and double check by reading the mode register in sja1000_is_absent.
--- drivers/net/can/sja1000/sja1000.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/net/can/sja1000/sja1000.c +12 -1
@@ -95,11 +95,16 @@ static void sja1000_write_cmdreg(structspin_unlock_irqrestore (&priv->cmdreg_lock, flags); } +static int sja1000_is_absent (struct sja1000_priv *priv) +{ +return (priv->read_reg (priv,REG_MOD ) ==0xFF ); +} +static int sja1000_probe_chip (struct net_device *dev) {struct sja1000_priv *priv =netdev_priv (dev); -if (priv->reg_base && (priv->read_reg (priv,0 ) ==0xFF )) { +if (priv->reg_base &&sja1000_is_absent (priv)) {printk (KERN_INFO "%s: probing @0x%lX failed\n" ,DRV_NAME , dev->base_addr);return 0 ;
@@ -493,6 +498,9 @@ irqreturn_t sja1000_interrupt(int irq, vwhile ((isrc = priv->read_reg (priv,REG_IR )) && (n <SJA1000_MAX_IRQ )) { n++; status = priv->read_reg (priv,REG_SR ); +/* check for absent controller due to hw unplug */ +if (status ==0xFF &&sja1000_is_absent (priv)) +return IRQ_NONE ;if (isrc &IRQ_WUI )dev_warn (dev->dev.parent,"wakeup interrupt\n" );
@@ -509,6 +517,9 @@ irqreturn_t sja1000_interrupt(int irq, vwhile (status &SR_RBS ) {sja1000_rx (dev); status = priv->read_reg (priv,REG_SR ); +/* check for absent controller */ +if (status ==0xFF &&sja1000_is_absent (priv)) +return IRQ_NONE ; } }if (isrc & (IRQ_DOI |IRQ_EI |IRQ_BEI |IRQ_EPI |IRQ_ALI )) {
Greg KH
maintainerPATCH 66/72 hdpvr: fix race conditon during start of streaming
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janne Grunau <[email protected]>
commit afa159538af61f1a65d48927f4e949fe514fb4fc upstream.
status has to be set to STREAMING before the streaming worker is queued. hdpvr_transmit_buffers() will exit immediately otherwise.
--- drivers/media/video/hdpvr/hdpvr-video.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/media/video/hdpvr/hdpvr-video.c +2 -1
@@ -283,12 +283,13 @@ static int hdpvr_start_streaming(structhdpvr_config_call (dev,CTRL_START_STREAMING_VALUE ,0x00 ); + dev->status =STATUS_STREAMING ; +INIT_WORK (&dev->worker, hdpvr_transmit_buffers);queue_work (dev->workqueue, &dev->worker);v4l2_dbg (MSG_BUFFER , hdpvr_debug, &dev->v4l2_dev,"streaming started\n" ); - dev->status =STATUS_STREAMING ;return 0 ; }
Greg KH
maintainerPATCH 67/72 imon: dont wedge hardware after early callbacks
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarod Wilson <[email protected]>
commit 8791d63af0cf113725ae4cb8cba9492814c59a93 upstream.
This patch is just a minor update to one titled "imon: Input from ffdc device type ignored" from Corinna Vinschen. An earlier patch to prevent an oops when we got early callbacks also has the nasty side-effect of wedging imon hardware, as we don't acknowledge the urb. Rework the check slightly here to bypass processing the packet, as the driver isn't yet fully initialized, but still acknowlege the urb and submit a new rx_urb. Do this for both interfaces -- irrelevant for ffdc hardware, but relevant for newer hardware, though newer hardware doesn't spew the constant stream of data as soon as the hardware is initialized like the older ffdc devices, so they'd be less likely to trigger this anyway...
Tested with both an ffdc device and an 0042 device.
--- drivers/media/rc/imon.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-)
drivers/media/rc/imon.c +22 -4
@@ -47,7 +47,7 @@#define MOD_AUTHOR "Jarod Wilson <[email protected]>"#define MOD_DESC "Driver for SoundGraph iMON MultiMedia IR/Display"#define MOD_NAME "imon" -#define MOD_VERSION "0.9.3" +#define MOD_VERSION "0.9.4"#define DISPLAY_MINOR_BASE 144#define DEVICE_NAME "lcd%d"
@@ -1658,9 +1658,17 @@ static void usb_rx_callback_intf0(structreturn ; ictx = (struct imon_context *)urb->context; -if (!ictx || !ictx->dev_present_intf0) +if (!ictx)return ; +/* +* if we get a callback before we're done configuring the hardware, we +* can't yet process the data, as there's nowhere to send it, but we +* still need to submit a new rx URB to avoid wedging the hardware +*/ +if (!ictx->dev_present_intf0) + goto out; +switch (urb->status) {case -ENOENT :/* usbcore unlink successful! */ return ;
@@ -1678,6 +1686,7 @@ static void usb_rx_callback_intf0(structbreak ; } +out:usb_submit_urb (ictx->rx_urb_intf0,GFP_ATOMIC ); }
@@ -1690,9 +1699,17 @@ static void usb_rx_callback_intf1(structreturn ; ictx = (struct imon_context *)urb->context; -if (!ictx || !ictx->dev_present_intf1) +if (!ictx)return ; +/* +* if we get a callback before we're done configuring the hardware, we +* can't yet process the data, as there's nowhere to send it, but we +* still need to submit a new rx URB to avoid wedging the hardware +*/ +if (!ictx->dev_present_intf1) + goto out; +switch (urb->status) {case -ENOENT :/* usbcore unlink successful! */ return ;
@@ -1710,6 +1727,7 @@ static void usb_rx_callback_intf1(structbreak ; } +out:usb_submit_urb (ictx->rx_urb_intf1,GFP_ATOMIC ); }
@@ -2242,7 +2260,7 @@ find_endpoint_failed:mutex_unlock (&ictx->lock);usb_free_urb (rx_urb); rx_urb_alloc_failed: -dev_err (ictx->dev,"unable to initialize intf0, err %d\n" , ret); +dev_err (ictx->dev,"unable to initialize intf1, err %d\n" , ret);return NULL ; }
Greg KH
maintainerPATCH 68/72 hwmon: (f75375s) Fix register write order when setting fans to full speed
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolaus Schulz <[email protected]>
commit c1c1a3d012fe5e82a9a025fb4b5a4f8ee67a53f6 upstream.
By hwmon sysfs interface convention, setting pwm_enable to zero sets a fan to full speed. In the f75375s driver, this need be done by enabling manual fan control, plus duty mode for the F875387 chip, and then setting the maximum duty cycle. Fix a bug where the two necessary register writes were swapped, effectively discarding the setting to full-speed.
--- drivers/hwmon/f75375s.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/hwmon/f75375s.c +3 -2
@@ -304,8 +304,6 @@ static int set_pwm_enable_direct(structcase 0 :/* Full speed */ fanmode |= (3 <<FAN_CTRL_MODE (nr)); data->pwm[nr] =255 ; -f75375_write8 (client,F75375_REG_FAN_PWM_DUTY (nr), - data->pwm[nr]);break ;case 1 :/* PWM */ fanmode |= (3 <<FAN_CTRL_MODE (nr));
@@ -318,6 +316,9 @@ static int set_pwm_enable_direct(struct }f75375_write8 (client,F75375_REG_FAN_TIMER , fanmode); data->pwm_enable[nr] = val; +if (val ==0 ) +f75375_write8 (client,F75375_REG_FAN_PWM_DUTY (nr), + data->pwm[nr]);return 0 ; }
Greg KH
maintainerPATCH 69/72 epoll: introduce POLLFREE to flush ->signalfd_wqh before kfree()
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit d80e731ecab420ddcb79ee9d0ac427acbc187b4b upstream.
This patch is intentionally incomplete to simplify the review. It ignores ep_unregister_pollwait() which plays with the same wqh. See the next change.
epoll assumes that the EPOLL_CTL_ADD'ed file controls everything f_op->poll() needs. In particular it assumes that the wait queue can't go away until eventpoll_release(). This is not true in case of signalfd, the task which does EPOLL_CTL_ADD uses its ->sighand which is not connected to the file.
This patch adds the special event, POLLFREE, currently only for epoll. It expects that init_poll_funcptr()'ed hook should do the necessary cleanup. Perhaps it should be defined as EPOLLFREE in eventpoll.
__cleanup_sighand() is changed to do wake_up_poll(POLLFREE) if ->signalfd_wqh is not empty, we add the new signalfd_cleanup() helper.
ep_poll_callback(POLLFREE) simply does list_del_init(task_list). This make this poll entry inconsistent, but we don't care. If you share epoll fd which contains our sigfd with another process you should blame yourself. signalfd is "really special". I simply do not know how we can define the "right" semantics if it used with epoll.
The main problem is, epoll calls signalfd_poll() once to establish the connection with the wait queue, after that signalfd_poll(NULL) returns the different/inconsistent results depending on who does EPOLL_CTL_MOD/signalfd_read/etc. IOW: apart from sigmask, signalfd has nothing to do with the file, it works with the current thread.
In short: this patch is the hack which tries to fix the symptoms. It also assumes that nobody can take tasklist_lock under epoll locks, this seems to be true.
Note:
- we do not have wake_up_all_poll() but wake_up_poll() is fine, poll/epoll doesn't use WQ_FLAG_EXCLUSIVE.
- signalfd_cleanup() uses POLLHUP along with POLLFREE, we need a couple of simple changes in eventpoll.c to make sure it can't be "lost".
--- fs/eventpoll.c | 4 ++++ fs/signalfd.c | 11 +++++++++++ include/asm-generic/poll.h | 2 ++ include/linux/signalfd.h | 5 ++++- kernel/fork.c | 5 ++++- 5 files changed, 25 insertions(+), 2 deletions(-)
fs/eventpoll.c +4 -0
@@ -827,6 +827,10 @@ static int ep_poll_callback(wait_queue_tstruct epitem *epi =ep_item_from_wait (wait);struct eventpoll *ep = epi->ep; +/* the caller holds eppoll_entry->whead->lock */ +if ((unsigned long )key &POLLFREE ) +list_del_init (&wait->task_list); +spin_lock_irqsave (&ep->lock, flags);/*
fs/signalfd.c +11 -0
@@ -30,6 +30,17 @@#include <linux/signalfd.h> #include <linux/syscalls.h> +void signalfd_cleanup (struct sighand_struct *sighand) +{ +wait_queue_head_t *wqh = &sighand->signalfd_wqh; + +if (likely (!waitqueue_active (wqh))) +return ; + +/* wait_queue_t->func(POLLFREE) should do remove_wait_queue() */ +wake_up_poll (wqh,POLLHUP |POLLFREE ); +} +struct signalfd_ctx {sigset_t sigmask; };
include/asm-generic/poll.h +2 -0
@@ -28,6 +28,8 @@#define POLLRDHUP 0x2000#endif +#define POLLFREE 0x4000/* currently only for epoll */ +struct pollfd {int fd;short events;
include/linux/signalfd.h +4 -1
@@ -61,13 +61,16 @@ static inline void signalfd_notify(strucwake_up (&tsk->sighand->signalfd_wqh); } +extern void signalfd_cleanup (struct sighand_struct *sighand); +#else /* CONFIG_SIGNALFD */ static inline void signalfd_notify (struct task_struct *tsk,int sig) { } +static inline void signalfd_cleanup (struct sighand_struct *sighand) { } +#endif /* CONFIG_SIGNALFD */ #endif /* __KERNEL__ */ #endif /* _LINUX_SIGNALFD_H */ -
kernel/fork.c +4 -1
@@ -66,6 +66,7 @@#include <linux/user-return-notifier.h> #include <linux/oom.h> #include <linux/khugepaged.h> +#include <linux/signalfd.h> #include <asm/pgtable.h> #include <asm/pgalloc.h>
@@ -910,8 +911,10 @@ static int copy_sighand(unsigned long clvoid __cleanup_sighand (struct sighand_struct *sighand) { -if (atomic_dec_and_test (&sighand->count)) +if (atomic_dec_and_test (&sighand->count)) { +signalfd_cleanup (sighand);kmem_cache_free (sighand_cachep, sighand); + } }
Greg KH
maintainerPATCH 70/72 epoll: ep_unregister_pollwait() can use the freed pwq->whead
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit 971316f0503a5c50633d07b83b6db2f15a3a5b00 upstream.
signalfd_cleanup() ensures that ->signalfd_wqh is not used, but this is not enough. eppoll_entry->whead still points to the memory we are going to free, ep_unregister_pollwait()->remove_wait_queue() is obviously unsafe.
Change ep_poll_callback(POLLFREE) to set eppoll_entry->whead = NULL, change ep_unregister_pollwait() to check pwq->whead != NULL under rcu_read_lock() before remove_wait_queue(). We add the new helper, ep_remove_wait_queue(), for this.
This works because sighand_cachep is SLAB_DESTROY_BY_RCU and because ->signalfd_wqh is initialized in sighand_ctor(), not in copy_sighand. ep_unregister_pollwait()->remove_wait_queue() can play with already freed and potentially reused ->sighand, but this is fine. This memory must have the valid ->signalfd_wqh until rcu_read_unlock().
--- fs/eventpoll.c | 30 +++++++++++++++++++++++++++--- fs/signalfd.c | 6 +++++- 2 files changed, 32 insertions(+), 4 deletions(-)
fs/eventpoll.c +27 -3
@@ -299,6 +299,11 @@ static inline int ep_is_linked(struct lireturn !list_empty (p); } +static inline struct eppoll_entry *ep_pwq_from_wait (wait_queue_t *p) +{ + return container_of(p, struct eppoll_entry, wait); +} +/* Get the "struct epitem" from a wait queue pointer */ static inline struct epitem *ep_item_from_wait (wait_queue_t *p) {
@@ -446,6 +451,18 @@ static void ep_poll_safewake(wait_queue_put_cpu (); } +static void ep_remove_wait_queue (struct eppoll_entry *pwq) +{ +wait_queue_head_t *whead; + +rcu_read_lock (); +/* If it is cleared by POLLFREE, it should be rcu-safe */ + whead =rcu_dereference (pwq->whead); +if (whead) +remove_wait_queue (whead, &pwq->wait); +rcu_read_unlock (); +} +/* * This function unregisters poll callbacks from the associated file * descriptor. Must be called with "mtx" held (or "epmutex" if called from
@@ -460,7 +477,7 @@ static void ep_unregister_pollwait(struc pwq = list_first_entry(lsthead, struct eppoll_entry, llink);list_del (&pwq->llink); -remove_wait_queue (pwq->whead, &pwq->wait); +ep_remove_wait_queue (pwq);kmem_cache_free (pwq_cache, pwq); } }
@@ -827,9 +844,16 @@ static int ep_poll_callback(wait_queue_tstruct epitem *epi =ep_item_from_wait (wait);struct eventpoll *ep = epi->ep; -/* the caller holds eppoll_entry->whead->lock */ -if ((unsigned long )key &POLLFREE ) +if ((unsigned long )key &POLLFREE ) { +ep_pwq_from_wait (wait)->whead =NULL ; +/* +* whead = NULL above can race with ep_remove_wait_queue() +* which can do another remove_wait_queue() after us, so we +* can't use __remove_wait_queue(). whead->lock is held by +* the caller. +*/ list_del_init (&wait->task_list); + }spin_lock_irqsave (&ep->lock, flags);
fs/signalfd.c +5 -1
@@ -33,7 +33,11 @@void signalfd_cleanup (struct sighand_struct *sighand) {wait_queue_head_t *wqh = &sighand->signalfd_wqh; - +/* +* The lockless check can race with remove_wait_queue() in progress, +* but in this case its caller should run under rcu_read_lock() and +* sighand_cachep is SLAB_DESTROY_BY_RCU, we can safely return. +*/ if (likely (!waitqueue_active (wqh)))return ;
Greg KH
maintainerPATCH 71/72 epoll: limit paths
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Baron <[email protected]>
commit 28d82dc1c4edbc352129f97f4ca22624d1fe61de upstream.
The current epoll code can be tickled to run basically indefinitely in both loop detection path check (on ep_insert()), and in the wakeup paths. The programs that tickle this behavior set up deeply linked networks of epoll file descriptors that cause the epoll algorithms to traverse them indefinitely. A couple of these sample programs have been previously posted in this thread: https://lkml.org/lkml/2011/2/25/297.
To fix the loop detection path check algorithms, I simply keep track of the epoll nodes that have been already visited. Thus, the loop detection becomes proportional to the number of epoll file descriptor and links. This dramatically decreases the run-time of the loop check algorithm. In one diabolical case I tried it reduced the run-time from 15 mintues (all in kernel time) to .3 seconds.
Fixing the wakeup paths could be done at wakeup time in a similar manner by keeping track of nodes that have already been visited, but the complexity is harder, since there can be multiple wakeups on different cpus...Thus, I've opted to limit the number of possible wakeup paths when the paths are created.
This is accomplished, by noting that the end file descriptor points that are found during the loop detection pass (from the newly added link), are actually the sources for wakeup events. I keep a list of these file descriptors and limit the number and length of these paths that emanate from these 'source file descriptors'. In the current implemetation I allow 1000 paths of length 1, 500 of length 2, 100 of length 3, 50 of length 4 and 10 of length 5. Note that it is sufficient to check the 'source file descriptors' reachable from the newly added link, since no other 'source file descriptors' will have newly added links. This allows us to check only the wakeup paths that may have gotten too long, and not re-check all possible wakeup paths on the system.
In terms of the path limit selection, I think its first worth noting that the most common case for epoll, is probably the model where you have 1 epoll file descriptor that is monitoring n number of 'source file descriptors'. In this case, each 'source file descriptor' has a 1 path of length 1. Thus, I believe that the limits I'm proposing are quite reasonable and in fact may be too generous. Thus, I'm hoping that the proposed limits will not prevent any workloads that currently work to fail.
In terms of locking, I have extended the use of the 'epmutex' to all epoll_ctl add and remove operations. Currently its only used in a subset of the add paths. I need to hold the epmutex, so that we can correctly traverse a coherent graph, to check the number of paths. I believe that this additional locking is probably ok, since its in the setup/teardown paths, and doesn't affect the running paths, but it certainly is going to add some extra overhead. Also, worth noting is that the epmuex was recently added to the ep_ctl add operations in the initial path loop detection code using the argument that it was not on a critical path.
Another thing to note here, is the length of epoll chains that is allowed. Currently, eventpoll.c defines:
/* Maximum number of nesting allowed inside epoll sets */ #define EP_MAX_NESTS 4
This basically means that I am limited to a graph depth of 5 (EP_MAX_NESTS
+ 1). However, this limit is currently only enforced during the loop check detection code, and only when the epoll file descriptors are added in a certain order. Thus, this limit is currently easily bypassed. The newly added check for wakeup paths, stricly limits the wakeup paths to a length of 5, regardless of the order in which ep's are linked together. Thus, a side-effect of the new code is a more consistent enforcement of the graph depth.
Thus far, I've tested this, using the sample programs previously mentioned, which now either return quickly or return -EINVAL. I've also testing using the piptest.c epoll tester, which showed no difference in performance. I've also created a number of different epoll networks and tested that they behave as expectded.
I believe this solves the original diabolical test cases, while still preserving the sane epoll nesting.
--- fs/eventpoll.c | 234 +++++++++++++++++++++++++++++++++++++++++----- include/linux/eventpoll.h | 1 include/linux/fs.h | 1 3 files changed, 211 insertions(+), 25 deletions(-)
fs/eventpoll.c +209 -25
@@ -197,6 +197,12 @@ struct eventpoll {/* The user that created the eventpoll descriptor */ struct user_struct *user; + +struct file *file; + +/* used to optimize loop detection check */ +int visited; +struct list_head visited_list_link; };/* Wait structure used by the poll hooks */
@@ -255,6 +261,15 @@ static struct kmem_cache *epi_cache __re/* Slab cache used to allocate "struct eppoll_entry" */ static struct kmem_cache *pwq_cache__read_mostly ; +/* Visited nodes during ep_loop_check(), so we can unset them when we finish */ +static LIST_HEAD (visited_list); + +/* +* List of files with newly added links, where we may need to limit the number +* of emanating paths. Protected by the epmutex. +*/ +static LIST_HEAD (tfile_check_list); +#ifdef CONFIG_SYSCTL #include <linux/sysctl.h>
@@ -276,6 +291,12 @@ ctl_table epoll_table[] = { };#endif /* CONFIG_SYSCTL */ +static const struct file_operations eventpoll_fops; + +static inline int is_file_epoll (struct file *f) +{ +return f->f_op == &eventpoll_fops; +}/* Setup the structure that is used as key for the RB tree */ static inline void ep_set_ffd(struct epoll_filefd *ffd,
@@ -728,12 +749,6 @@ static const struct file_operations even .llseek = noop_llseek, }; -/* Fast test to see if the file is an eventpoll file */ -static inline int is_file_epoll (struct file *f) -{ -return f->f_op == &eventpoll_fops; -} -/* * This is called from eventpoll_release() to unlink files from the eventpoll * interface. We need to have this facility to cleanup correctly files that are
@@ -954,6 +969,99 @@ static void ep_rbtree_insert(struct evenrb_insert_color (&epi->rbn, &ep->rbr); } + + +#define PATH_ARR_SIZE 5 +/* +* These are the number paths of length 1 to 5, that we are allowing to emanate +* from a single file of interest. For example, we allow 1000 paths of length +* 1, to emanate from each file of interest. This essentially represents the +* potential wakeup paths, which need to be limited in order to avoid massive +* uncontrolled wakeup storms. The common use case should be a single ep which +* is connected to n file sources. In this case each file source has 1 path +* of length 1. Thus, the numbers below should be more than sufficient. These +* path limits are enforced during an EPOLL_CTL_ADD operation, since a modify +* and delete can't add additional paths. Protected by the epmutex. +*/ +static const int path_limits[PATH_ARR_SIZE ] = {1000 ,500 ,100 ,50 ,10 }; +static int path_count[PATH_ARR_SIZE ]; + +static int path_count_inc (int nests) +{ +if (++path_count[nests] > path_limits[nests]) +return -1 ; +return 0 ; +} + +static void path_count_init (void ) +{ +int i; + +for (i =0 ; i <PATH_ARR_SIZE ; i++) + path_count[i] =0 ; +} + +static int reverse_path_check_proc (void *priv,void *cookie,int call_nests) +{ +int error =0 ; +struct file *file = priv; +struct file *child_file; +struct epitem *epi; + +list_for_each_entry (epi, &file->f_ep_links, fllink) { + child_file = epi->ep->file; +if (is_file_epoll (child_file)) { +if (list_empty (&child_file->f_ep_links)) { +if (path_count_inc (call_nests)) { + error =-1 ; +break ; + } + }else { + error =ep_call_nested (&poll_loop_ncalls, +EP_MAX_NESTS , + reverse_path_check_proc, + child_file, child_file, + current); + } +if (error !=0 ) +break ; + }else { +printk (KERN_ERR "reverse_path_check_proc: " +"file is not an ep!\n" ); + } + } +return error; +} + +/** +* reverse_path_check - The tfile_check_list is list of file *, which have +* links that are proposed to be newly added. We need to +* make sure that those added links don't add too many +* paths such that we will spend all our time waking up +* eventpoll objects. +* +* Returns: Returns zero if the proposed links don't create too many paths, +* -1 otherwise. +*/ +static int reverse_path_check (void ) +{ +int length =0 ; +int error =0 ; +struct file *current_file; + +/* let's call this for all tfiles */ +list_for_each_entry (current_file, &tfile_check_list, f_tfile_llink) { + length++; +path_count_init (); + error =ep_call_nested (&poll_loop_ncalls,EP_MAX_NESTS , + reverse_path_check_proc, current_file, + current_file, current); +if (error) +break ; + } +return error; +} +/* * Must be called with "mtx" held. */
@@ -1015,6 +1123,11 @@ static int ep_insert(struct eventpoll *e*/ ep_rbtree_insert (ep, epi); +/* now check if we've created too many backpaths */ + error = -EINVAL ; +if (reverse_path_check ()) + goto error_remove_epi; +/* We have to drop the new item inside our item list to keep track of it */ spin_lock_irqsave (&ep->lock, flags);
@@ -1039,6 +1152,14 @@ static int ep_insert(struct eventpoll *ereturn 0 ; +error_remove_epi: +spin_lock (&tfile->f_lock); +if (ep_is_linked (&epi->fllink)) +list_del_init (&epi->fllink); +spin_unlock (&tfile->f_lock); + +rb_erase (&epi->rbn, &ep->rbr); + error_unregister:ep_unregister_pollwait (ep, epi);
@@ -1303,18 +1424,36 @@ static int ep_loop_check_proc(void *privint error =0 ;struct file *file = priv;struct eventpoll *ep = file->private_data; +struct eventpoll *ep_tovisit;struct rb_node *rbp;struct epitem *epi;mutex_lock_nested (&ep->mtx, call_nests +1 ); + ep->visited =1 ; +list_add (&ep->visited_list_link, &visited_list);for (rbp =rb_first (&ep->rbr); rbp; rbp =rb_next (rbp)) { epi = rb_entry(rbp, struct epitem, rbn);if (unlikely (is_file_epoll (epi->ffd.file))) { + ep_tovisit = epi->ffd.file->private_data; +if (ep_tovisit->visited) +continue ; error =ep_call_nested (&poll_loop_ncalls,EP_MAX_NESTS , - ep_loop_check_proc, epi->ffd.file, - epi->ffd.file->private_data, current); + ep_loop_check_proc, epi->ffd.file, + ep_tovisit, current);if (error !=0 )break ; + }else { +/* +* If we've reached a file that is not associated with +* an ep, then we need to check if the newly added +* links are going to add too many wakeup paths. We do +* this by adding it to the tfile_check_list, if it's +* not already there, and calling reverse_path_check() +* during ep_insert(). +*/ +if (list_empty (&epi->ffd.file->f_tfile_llink)) +list_add (&epi->ffd.file->f_tfile_llink, + &tfile_check_list); } }mutex_unlock (&ep->mtx);
@@ -1335,8 +1474,31 @@ static int ep_loop_check_proc(void *priv*/ static int ep_loop_check (struct eventpoll *ep,struct file *file) { -return ep_call_nested (&poll_loop_ncalls,EP_MAX_NESTS , +int ret; +struct eventpoll *ep_cur, *ep_next; + + ret =ep_call_nested (&poll_loop_ncalls,EP_MAX_NESTS , ep_loop_check_proc, file, ep, current); +/* clear visited list */ +list_for_each_entry_safe (ep_cur, ep_next, &visited_list, + visited_list_link) { + ep_cur->visited =0 ; +list_del (&ep_cur->visited_list_link); + } +return ret; +} + +static void clear_tfile_check_list (void ) +{ +struct file *file; + +/* first clear the tfile_check_list */ +while (!list_empty (&tfile_check_list)) { + file = list_first_entry(&tfile_check_list, struct file, + f_tfile_llink); +list_del_init (&file->f_tfile_llink); + } +INIT_LIST_HEAD (&tfile_check_list); }/*
@@ -1344,8 +1506,9 @@ static int ep_loop_check(struct eventpol*/ SYSCALL_DEFINE1(epoll_create1, int, flags) { -int error; +int error, fd;struct eventpoll *ep =NULL ; +struct file *file;/* Check the EPOLL_* constant for consistency. */ BUILD_BUG_ON (EPOLL_CLOEXEC !=O_CLOEXEC );
@@ -1362,11 +1525,25 @@ SYSCALL_DEFINE1(epoll_create1, int, flag* Creates all the items needed to setup an eventpoll file. That is, * a file structure and a free file descriptor. */ - error =anon_inode_getfd ("[eventpoll]" , &eventpoll_fops, ep, + fd =get_unused_fd_flags (O_RDWR | (flags &O_CLOEXEC )); +if (fd <0 ) { + error = fd; + goto out_free_ep; + } + file =anon_inode_getfile ("[eventpoll]" , &eventpoll_fops, ep,O_RDWR | (flags &O_CLOEXEC )); -if (error <0 ) -ep_free (ep); - +if (IS_ERR (file)) { + error =PTR_ERR (file); + goto out_free_fd; + } +fd_install (fd, file); + ep->file = file; +return fd; + +out_free_fd: +put_unused_fd (fd); +out_free_ep: +ep_free (ep);return error; }
@@ -1432,21 +1609,27 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, in/* * When we insert an epoll file descriptor, inside another epoll file * descriptor, there is the change of creating closed loops, which are -* better be handled here, than in more critical paths. +* better be handled here, than in more critical paths. While we are +* checking for loops we also determine the list of files reachable +* and hang them on the tfile_check_list, so we can check that we +* haven't created too many possible wakeup paths. * -* We hold epmutex across the loop check and the insert in this case, in -* order to prevent two separate inserts from racing and each doing the -* insert "at the same time" such that ep_loop_check passes on both -* before either one does the insert, thereby creating a cycle. +* We need to hold the epmutex across both ep_insert and ep_remove +* b/c we want to make sure we are looking at a coherent view of +* epoll network. */ -if (unlikely (is_file_epoll (tfile) && op ==EPOLL_CTL_ADD )) { +if (op ==EPOLL_CTL_ADD || op ==EPOLL_CTL_DEL ) {mutex_lock (&epmutex); did_lock_epmutex =1 ; - error = -ELOOP ; -if (ep_loop_check (ep, tfile) !=0 ) - goto error_tgt_fput; } - +if (op ==EPOLL_CTL_ADD ) { +if (is_file_epoll (tfile)) { + error = -ELOOP ; +if (ep_loop_check (ep, tfile) !=0 ) + goto error_tgt_fput; + }else +list_add (&tfile->f_tfile_llink, &tfile_check_list); + }mutex_lock_nested (&ep->mtx,0 );
@@ -1465,6 +1648,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, in error =ep_insert (ep, &epds, tfile, fd); }else error = -EEXIST ; +clear_tfile_check_list ();break ;case EPOLL_CTL_DEL :if (epi)
@@ -1483,7 +1667,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, inmutex_unlock (&ep->mtx); error_tgt_fput: -if (unlikely (did_lock_epmutex)) +if (did_lock_epmutex)mutex_unlock (&epmutex);fput (tfile);
include/linux/eventpoll.h +1 -0
@@ -61,6 +61,7 @@ struct file;static inline void eventpoll_init_file (struct file *file) {INIT_LIST_HEAD (&file->f_ep_links); +INIT_LIST_HEAD (&file->f_tfile_llink); }
include/linux/fs.h +1 -0
@@ -1001,6 +1001,7 @@ struct file {#ifdef CONFIG_EPOLL /* Used by fs/eventpoll.c to link all the hooks to this file */ struct list_head f_ep_links; +struct list_head f_tfile_llink;#endif /* #ifdef CONFIG_EPOLL */ struct address_space *f_mapping;#ifdef CONFIG_DEBUG_WRITECOUNT
Greg KH
maintainerPATCH 72/72 cdrom: use copy_to_user() without the underscores
In reply to Greg KH3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 822bfa51ce44f2c63c300fdb76dc99c4d5a5ca9f upstream.
"nframes" comes from the user and "nframes * CD_FRAMESIZE_RAW" can wrap on 32 bit systems. That would have been ok if we used the same wrapped value for the copy, but we use a shifted value. We should just use the checked version of copy_to_user() because it's not going to make a difference to the speed.
--- drivers/cdrom/cdrom.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/cdrom/cdrom.c +1 -7
@@ -2120,11 +2120,6 @@ static int cdrom_read_cdda_old(struct cdif (!nr)return -ENOMEM ; -if (!access_ok (VERIFY_WRITE , ubuf, nframes *CD_FRAMESIZE_RAW )) { - ret = -EFAULT ; - goto out; - } - cgc.data_direction =CGC_DATA_READ ;while (nframes >0 ) {if (nr > nframes)
@@ -2133,7 +2128,7 @@ static int cdrom_read_cdda_old(struct cd ret =cdrom_read_block (cdi, &cgc, lba, nr,1 ,CD_FRAMESIZE_RAW );if (ret)break ; -if (__copy_to_user (ubuf, cgc.buffer,CD_FRAMESIZE_RAW * nr)) { +if (copy_to_user (ubuf, cgc.buffer,CD_FRAMESIZE_RAW * nr)) { ret = -EFAULT ;break ; }
@@ -2141,7 +2136,6 @@ static int cdrom_read_cdda_old(struct cd nframes -= nr; lba += nr; } -out:kfree (cgc.buffer);return ret; }