3.12.33-stable review
Subsystems (4)
cover 3.12.33-stable review
This is the start of the stable review cycle for the 3.12.33 release. There are 206 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Nov 20 15:08:12 CET 2014. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.33-rc1.xz
and the diffstat can be found below.
thanks,
js
===============
Adel Gadllah (4):
USB: quirks: enable device-qualifier quirk for another Elan
touchscreen
USB: quirks: enable device-qualifier quirk for yet another Elan
touchscreen
HID: usbhid: enable always-poll quirk for Elan Touchscreen 009b
HID: usbhid: enable always-poll quirk for Elan Touchscreen 016f
Al Viro (3):
missing data dependency barrier in prepend_name() kill wbuf_queued/wbuf_dwork_lock
fix misuses of f_count() in ppp and netlink
Alan Stern (1):
usb-storage: handle a skipped data phase
Alex Deucher (2):
drm/radeon/dpm: disable ulv support on SI
drm/radeon: remove invalid pci id
Alexander Stein (1):
spi: fsl-dspi: Fix CTAR selection
Alexey Khoroshilov (1):
dm log userspace: fix memory leak in dm_ulog_tfr_init failure path
Anantha Krishnan (1):
Bluetooth: Add support for Acer [13D3:3432]
Anatol Pomozov (1):
Bluetooth: Fix crash in the Marvell driver initialization codepath
Andy Honig (2):
KVM: x86: Prevent host from panicking on shared MSR writes.
KVM: x86: Improve thread safety in pit
Andy Lutomirski (3):
x86_64, entry: Filter RFLAGS.NT on entry from userspace x86, apic: Handle a bad TSC more gracefully x86_64, entry: Fix out of bounds read on sysenter
Andy Shevchenko (2):
Bluetooth: sort the list of IDs in the source code
Bluetooth: append new supported device to the list [0b05:17d0]
Artem Bityutskiy (3):
UBIFS: remove mst_mutex
UBIFS: fix a race condition
UBIFS: fix free log space calculation
Axel Lin (1):
media: tda7432: Fix setting TDA7432_MUTE bit for TDA7432_RF register
Ben Hutchings (3):
drivers/net, ipv6: Select IPv6 fragment idents for virtio UFO packets drivers/net: macvtap and tun depend on INET
x86: Reject x32 executables if x32 ABI not supported
Ben Skeggs (1):
drm/nouveau/bios: memset dcb struct to zero before parsing
Benjamin Coddington (1):
lockd: Try to reconnect if statd has moved
Benjamin Herrenschmidt (1):
drm/ast: Fix HW cursor image
Benjamin Valentin (1):
Input: xpad - sync device IDs with xboxdrv
Bryan O'Donoghue (1):
x86: Add cpu_detect_cache_sizes to init_intel() add Quark
legacy_cache()
Canek Peláez Valdés (1):
rt2x00: support Ralink 5362.
Cesar Eduardo Barros (1):
crypto: more robust crypto_memneq
Chris Ball (1):
mfd: rtsx_pcr: Fix MSI enable error handling
Chris Mason (1):
Btrfs: fix kfree on list_head in btrfs_lookup_csums_range error
cleanup
Cong Wang (1):
freezer: Do not freeze tasks killed by OOM killer
Cyril Brulebois (1):
wireless: rt2x00: add new rt2800usb device
Dan Carpenter (1):
[media] ttusb-dec: buffer overflow in ioctl
Dan Streetman (1):
powerpc: use device_online/offline() instead of cpu_up/down()
Dan Williams (1):
USB: option: add Haier CE81B CDMA modem
Daniel Borkmann (1):
random: add and use memzero_explicit() for clearing data
Daniel Mack (1):
ASoC: soc-dapm: fix use after free
Daniele Palmas (1):
usb: option: add support for Telit LE910
Darrick J. Wong (4):
jbd2: free bh when descriptor block checksum fails
ext4: check EA value offset when loading
ext4: check s_chksum_driver when looking for bg csum presence
ext4: enable journal checksum when metadata checksum feature enabled
David Cohen (1):
mmc: sdhci-pci: add Intel Merrifield support
David Daney (1):
MIPS: tlbex: Properly fix HUGE TLB Refill exception handler
Derek Browne (1):
mmc: sdhci-pci: SDIO host controller support for Intel Quark X1000
Dexuan Cui (1):
x86, pageattr: Prevent overflow in slow_virt_to_phys() for X86_PAE
Dirk Brandewie (1):
cpufreq: expose scaling_cur_freq sysfs file for set_policy() drivers
Dmitry Eremin-Solenikov (1):
spi: pxa2xx: toggle clocks on suspend if not disabled by runtime PM
Dmitry Kasatkin (1):
evm: check xattr value length and type in evm_inode_setxattr()
Dmitry Monakhov (2):
ext4: grab missed write_count for EXT4_IOC_SWAP_BOOT
ext4: Replace open coded mdata csum feature to helper function
Eric Dumazet (1):
tcp: md5: do not use alloc_percpu()
Eric Ernst (1):
mmc: sdhci-pci: Add SDIO/MMC device ID support for Intel Clovertrail
Eric Rannaud (1):
fs: allow open(dir, O_TMPFILE|..., 0) with mode 0
Eric Sandeen (2):
ext4: fix reservation overflow in ext4_da_write_begin
xfs: avoid false quotacheck after unclean shutdown
Eric W. Biederman (1):
mnt: Prevent pivot_root from creating a loop in the mount tree
Felipe Balbi (3):
usb: dwc3: gadget: fix set_halt() bug with pending transfers
usb: gadget: function: acm: make f_acm pass USB20CV Chapter9
usb: gadget: udc: core: fix kernel oops with soft-connect
Frank Razenberg (1):
Input: xpad - add VID/PID for Razer Sabertooth
Frank Schaefer (1):
media: em28xx-v4l: give back all active video buffers to the vb2 core
properly on streaming stop
Frans Klaver (1):
usb: serial: ftdi_sio: add Awinda Station and Dongle products
Grant Likely (1):
of: Fix overflow bug in string property parsing functions
Guenter Roeck (1):
Revert "percpu: free percpu allocation info for uniprocessor system"
Hans de Goede (4):
Input: i8042 - add noloop quirk for Asus X750LN
Input: i8042 - quirks for Fujitsu Lifebook A544 and Lifebook AH544
usb: Do not allow usb_alloc_streams on unconfigured devices
acer-wmi: Add acpi_backlight=video quirk for the Acer KAV80
Ian Morgan (1):
ax88179_178a: fix bonding failure
Imre Deak (1):
PM / Sleep: fix recovery during resuming from hibernation
J. Bruce Fields (1):
nfsd4: fix crash on unknown operation number
Jack Pham (1):
usb: dwc3: gadget: Properly initialize LINK TRB
Jan Kara (11):
vfs: fix data corruption when blocksize < pagesize for mmaped data
ext4: don't check quota format when there are no quota files
ext4: fix mmap data corruption when blocksize < pagesize
ext4: fix overflow when updating superblock backups after resize
ext4: fix oops when loading block bitmap failed lib/bitmap.c: fix undefined shift in __bitmap_shift_{left|right}()
scsi: Fix error handling in SCSI_IOCTL_SEND_COMMAND
ext3: Don't check quota format when there are no quota files
quota: Properly return errors from dquot_writeback_dquots()
mm: Remove false WARN_ON from pagecache_isize_extended()
rbd: Fix error recovery in rbd_obj_read_sync()
Jani Nikula (1):
drm/i915: provide interface for audio driver to query cdclk
Jason Baron (4):
i82860_edac: Report CE events properly
i3200_edac: Report CE events properly
e7xxx_edac: Report CE events properly
cpc925_edac: Report UE events properly
Jiri Kosina (1):
HID: usbhid: enable NO_INIT_REPORTS quirk for Semico USB Keykoard
Jiri Pirko (1):
ipv4: fix nexthop attlen check in fib_nh_match
Joe Thornber (1):
dm bufio: update last_accessed when relinking a buffer
Joern Engel (1):
qla_target: don't delete changed nacls
Johan Hovold (8):
USB: cdc-acm: add device id for GW Instek AFG-2225
USB: cdc-acm: only raise DTR on transitions from B0
USB: core: add device-qualifier quirk
USB: quirks: enable device-qualifier quirk for Elan Touchscreen
HID: usbhid: add always-poll quirk
HID: usbhid: enable always-poll quirk for Elan Touchscreen
USB: opticon: fix non-atomic allocation in write path
USB: kobil_sct: fix non-atomic allocation in write path
Johannes Weiner (1):
mm: page_alloc: fix zone allocation fairness on UP
John Sung (1):
HID: usbhid: quirk for PM1610 and PM1640 Touchscreen.
Jurgen Kramer (1):
Bluetooth: btusb: Add IMC Networks (Broadcom based)
Karl Beldan (1):
mac80211: fix typo in starting baserate for rts_cts_rate_idx
Krzysztof Kozlowski (1):
regulator: max77693: Fix use of uninitialized regulator config
Lai Jiangshan (1):
drbd: compute the end before rb_insert_augmented()
Lars-Peter Clausen (5):
staging:iio:ad5933: Fix NULL pointer deref when enabling buffer staging:iio:ad5933: Drop "raw" from channel names staging:iio:ade7758: Fix NULL pointer deref when enabling buffer staging:iio:ade7758: Fix check if channels are enabled in prenable staging:iio:ade7758: Remove "raw" from channel name
Li RongQing (4):
vxlan: fix a use after free in vxlan_encap_bypass
vxlan: using pskb_may_pull as early as possible
vxlan: fix a free after use
ipv4: fix a potential use after free in ip_tunnel_core.c
Libin Yang (2):
ALSA: hda - add PCI IDs for Intel Braswell
ALSA: hda - add codec ID for Braswell display audio codec
Lv Zheng (2):
ACPI / EC: Add support to disallow QR_EC to be issued when SCI_EVT
isn't set
ACPI / EC: Fix regression due to conflicting firmware behavior between
Samsung and Acer.
Maciej Matraszek (1):
media: v4l2-common: fix overflow in v4l_bound_align_image()
Marc-André Lureau (1):
qxl: don't create too large primary surface
Marcel Holtmann (5):
Bluetooth: Add support for Intel bootloader devices
Bluetooth: Handle Intel USB bootloader with buggy interrupt
Bluetooth: Ignore isochronous endpoints for Intel USB bootloader
Bluetooth: Fix endian and alignment issue with ath3k version handling
Bluetooth: Add support for Broadcom device of Asus Z97-DELUXE
motherboard
Marco Piazza (1):
Bluetooth: Add support for Toshiba Bluetooth device [0930:0220]
Markos Chandras (1):
MIPS: ftrace: Fix a microMIPS build problem
Mathias Krause (1):
posix-timers: Fix stack info leak in timer_create()
Mengdong Lin (1):
ALSA: hda - restore BCLK M/N value as per CDCLK for HSW/BDW display
HDA controller
Michael S. Tsirkin (2):
virtio_pci: fix virtio spec compliance on restore
kvm: x86: don't kill guest on unknown exit reason
Michal Hocko (1):
OOM, PM: OOM killed task shouldn't escape PM suspend
Mike Snitzer (1):
block: fix alignment_offset math that assumes io_min is a power-of-2
Mikulas Patocka (3):
fs: make cont_expand_zero interruptible
dm bufio: when done scanning return from __scan immediately
framebuffer: fix border color
Nadav Amit (3):
KVM: x86: Check non-canonical addresses upon WRMSR
KVM: x86: Fix wrong masking on relative jump/call
KVM: x86: Emulator fixes for eip canonical checks on near branches
Nathaniel Ting (1):
USB: serial: cp210x: add Silicon Labs 358x VID and PID
Nicholas Bellinger (1):
target: Fix APTPL metadata handling for dynamic MappedLUNs
Olaf Hering (1):
drm/cirrus: bind also to qemu-xen-traditional
Oleg Nesterov (2):
x86, fpu: __restore_xstate_sig()->math_state_restore() needs
preempt_disable()
x86, fpu: shift drop_init_fpu() from save_xstate_sig() to
handle_signal()
Oliver Neukum (2):
Bluetooth: Enable Atheros 0cf3:311e for firmware upload
Bluetooth: Add firmware update for Atheros 0cf3:311f
Ondrej Kozina (1):
crypto: algif - avoid excessive use of socket buffer in skcipher
Ondrej Zary (1):
libata-sff: Fix controllers with no ctl port
Pali Rohár (1):
cpufreq: intel_pstate: Fix setting max_perf_pct in performance policy
Paul Fertser (1):
media: usb: uvc: add a quirk for Dell XPS M1330 webcam
Peng Chen (1):
Bluetooth: Fix endianess issue in the ath3k driver
Perry Hung (1):
usb: serial: ftdi_sio: add "bricked" FTDI device PID
Peter Hurley (2):
serial: Fix divide-by-zero fault in uart_get_divisor()
tty: Fix high cpu load if tty is unreleaseable
Petr Matousek (1):
kvm: vmx: handle invvpid vm exit gracefully
Petr Sebor (1):
Input: xpad - add new USB IDs for Logitech F310 and F710
Prarit Bhargava (1):
modules, lock around setting of MODULE_STATE_UNFORMED
Quentin Casasnovas (2):
regmap: fix kernel hang on regmap_bulk_write with zero val_count.
kvm: fix excessive pages un-pinning in kvm_iommu_map error path.
Quinn Tran (1):
target: Fix queue full status NULL pointer for
SCF_TRANSPORT_TASK_SENSE
Rabin Vincent (1):
tracing/syscalls: Ignore numbers outside NR_syscalls' range
Ray Jui (1):
spi: pl022: Fix incorrect dma_unmap_sg
Reyad Attiyat (1):
HID: usbhid: Use flag HID_DISCONNECTED when a usb device is removed
Richard Genoud (1):
UBI: add missing kmem_cache_free() in process_pool_aeb error path
Richard Leitner (1):
Input: serio - avoid negative serio device numbers
Robin van der Gracht (1):
iio: st_sensors: Fix buffer copy
Roger Pau Monné (1):
xen-blkback: fix leak on grant map error path
Roger Tseng (1):
mmc: rtsx_pci_sdmmc: fix incorrect last byte in R2 response
Roman Dubtsov (1):
rt2x00: rt2800usb: mark D-Link DWA-137 as supported
Scott Carter (1):
pata_serverworks: disable 64-KB DMA transfers on Broadcom OSB4 IDE
Controller
Sergio Gelato (1):
nfsd: fix NFS regression
Sinclair Yeh (1):
When screen objects are enabled, the bpp is assumed to be 32,
otherwise it is set to 16.
Stephen Smalley (1):
selinux: fix inode security list corruption
Sujith Manoharan (2):
Bluetooth: ath3k: Add support for another AR3012 card
Bluetooth: ath3k: Add support for a new AR3012 device
Takashi Iwai (3):
drm/i915, HD-audio: Don't continue probing when nomodeset is given
ALSA: pcm: Zero-clear reserved fields of PCM status ioctl in compat
mode
ALSA: usb-audio: Fix device_del() sysfs warnings at disconnect
Tetsuo Handa (1):
fs: Fix theoretical division by 0 in super_cache_scan().
Theodore Ts'o (1):
ext4: add ext4_iget_normal() which is to be used for dir tree lookups
Thomas Gleixner (1):
usb: musb: cppi41: restart hrtimer only if not yet done
Thomaz de Oliveira dos Reis (1):
Input: xpad - change D-PAD mapping on Razer devices
Thorsten Knabe (1):
um: ubd: Fix for processes stuck in D state forever
Tommi Rantala (1):
Input: xpad - add USB ID for Thrustmaster Ferrari 458 Racing Wheel
Ulrich Eckhardt (1):
media: ds3000: fix LNB supply voltage on Tevii S480 on initialization
Valdis Kletnieks (1):
pstore: Fix duplicate {console,ftrace}-efi entries
Vasily Averin (1):
ipv4: dst_entry leak in ip_send_unicast_reply()
Vincent Zwanenburg (1):
Add a new PID/VID 0227/0930 for AR3012.
Vineet Gupta (2):
ARC: [SMP] General Fixes
ARC: Disable caches in early boot if so configured
Wang Nan (1):
cgroup/kmemleak: add kmemleak_free() for cgroup deallocations.
Wen-chien Jesse Sung (1):
HID: use multi input quirk for 22b9:2968
Wolfram Sang (1):
i2c: at91: don't account as iowait
Xose Vazquez Perez (2):
wireless: rt2x00: rt2800usb: add new devices
wireless: rt2x00: add new rt2800usb devices
Yijing Wang (1):
sysfs: driver core: Fix glue dir race condition by gdp_mutex
Yu Zhao (1):
mm: free compound page with correct order
arch/arc/include/asm/cache.h | 27 +++++ arch/arc/kernel/head.S | 45 +++++++-- arch/arc/mm/cache_arc700.c | 109 +++++--------------- arch/mips/include/asm/ftrace.h | 4 +- arch/mips/mm/tlbex.c | 6 +- arch/powerpc/platforms/pseries/dlpar.c | 4 +- arch/um/drivers/ubd_kern.c | 5 +- arch/x86/ia32/ia32entry.S | 18 +++- arch/x86/include/asm/elf.h | 5 +- arch/x86/include/asm/kvm_host.h | 16 ++- arch/x86/include/uapi/asm/vmx.h | 2 + arch/x86/kernel/apic/apic.c | 4 +- arch/x86/kernel/cpu/common.c | 2 +- arch/x86/kernel/cpu/intel.c | 17 +++- arch/x86/kernel/signal.c | 5 + arch/x86/kernel/tsc.c | 5 +- arch/x86/kernel/xsave.c | 7 +- arch/x86/kvm/emulate.c | 99 +++++++++++++----- arch/x86/kvm/i8254.c | 2 + arch/x86/kvm/svm.c | 8 +- arch/x86/kvm/vmx.c | 24 +++-- arch/x86/kvm/x86.c | 38 ++++++- arch/x86/mm/pageattr.c | 2 +- block/blk-settings.c | 4 +- block/scsi_ioctl.c | 3 +- crypto/algif_skcipher.c | 2 +- drivers/acpi/ec.c | 28 +++++- drivers/ata/libata-sff.c | 20 ++-- drivers/ata/pata_serverworks.c | 13 ++- drivers/base/core.c | 4 +- drivers/base/regmap/regmap.c | 6 +- drivers/block/drbd/drbd_interval.c | 4 + drivers/block/rbd.c | 2 +- drivers/block/xen-blkback/blkback.c | 1 + drivers/bluetooth/ath3k.c | 117 +++++++++++++--------- drivers/bluetooth/btmrvl_main.c | 5 + drivers/bluetooth/btusb.c | 82 ++++++++++----- drivers/char/random.c | 10 +- drivers/cpufreq/cpufreq.c | 23 +++-- drivers/cpufreq/intel_pstate.c | 1 + drivers/edac/cpc925_edac.c | 2 +- drivers/edac/e7xxx_edac.c | 2 +- drivers/edac/i3200_edac.c | 4 +- drivers/edac/i82860_edac.c | 2 +- drivers/gpu/drm/ast/ast_mode.c | 4 +- drivers/gpu/drm/cirrus/cirrus_drv.c | 2 + drivers/gpu/drm/i915/intel_pm.c | 35 +++++-- drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c | 1 + drivers/gpu/drm/qxl/qxl_display.c | 16 +-- drivers/gpu/drm/radeon/si_dpm.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 16 ++- drivers/hid/hid-ids.h | 11 ++ drivers/hid/usbhid/hid-core.c | 32 +++++- drivers/hid/usbhid/hid-quirks.c | 7 ++ drivers/i2c/busses/i2c-at91.c | 2 +- drivers/iio/common/st_sensors/st_sensors_buffer.c | 2 +- drivers/input/joystick/xpad.c | 41 +++++++- drivers/input/serio/i8042-x86ia64io.h | 22 ++++ drivers/input/serio/serio.c | 4 +- drivers/md/dm-bufio.c | 5 +- drivers/md/dm-log-userspace-transfer.c | 2 +- drivers/media/dvb-frontends/ds3000.c | 7 ++ drivers/media/i2c/tda7432.c | 2 +- drivers/media/usb/em28xx/em28xx-video.c | 10 +- drivers/media/usb/ttusb-dec/ttusbdecfe.c | 3 + drivers/media/usb/uvc/uvc_driver.c | 9 ++ drivers/media/v4l2-core/v4l2-common.c | 9 +- drivers/mfd/rtsx_pcr.c | 2 +- drivers/mmc/host/rtsx_pci_sdmmc.c | 7 ++ drivers/mmc/host/sdhci-pci.c | 89 ++++++++++++++++ drivers/mtd/ubi/fastmap.c | 1 + drivers/net/Kconfig | 2 + drivers/net/macvtap.c | 3 + drivers/net/ppp/ppp_generic.c | 2 +- drivers/net/tun.c | 6 +- drivers/net/usb/ax88179_178a.c | 7 +- drivers/net/vxlan.c | 15 +-- drivers/net/wireless/rt2x00/rt2800.h | 4 +- drivers/net/wireless/rt2x00/rt2800lib.c | 6 ++ drivers/net/wireless/rt2x00/rt2800usb.c | 23 ++++- drivers/of/base.c | 88 ++++------------ drivers/of/selftest.c | 66 ++++++++++-- drivers/platform/x86/acer-wmi.c | 11 ++ drivers/regulator/max77693.c | 2 +- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 11 +- drivers/spi/spi-fsl-dspi.c | 4 +- drivers/spi/spi-pl022.c | 2 +- drivers/spi/spi-pxa2xx.c | 7 +- drivers/staging/iio/impedance-analyzer/ad5933.c | 15 ++- drivers/staging/iio/meter/ade7758.h | 1 - drivers/staging/iio/meter/ade7758_core.c | 57 ++--------- drivers/staging/iio/meter/ade7758_ring.c | 5 +- drivers/target/target_core_device.c | 3 +- drivers/target/target_core_pr.c | 6 +- drivers/target/target_core_pr.h | 2 +- drivers/target/target_core_tpg.c | 8 ++ drivers/target/target_core_transport.c | 3 +- drivers/tty/serial/serial_core.c | 2 +- drivers/tty/tty_io.c | 7 +- drivers/usb/class/cdc-acm.c | 6 +- drivers/usb/core/hcd.c | 2 + drivers/usb/core/hub.c | 3 + drivers/usb/core/quirks.c | 10 ++ drivers/usb/dwc3/ep0.c | 4 +- drivers/usb/dwc3/gadget.c | 19 ++-- drivers/usb/dwc3/gadget.h | 2 +- drivers/usb/gadget/f_acm.c | 7 +- drivers/usb/gadget/udc-core.c | 5 + drivers/usb/musb/musb_cppi41.c | 3 +- drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/ftdi_sio.c | 3 + drivers/usb/serial/ftdi_sio_ids.h | 12 ++- drivers/usb/serial/kobil_sct.c | 5 +- drivers/usb/serial/opticon.c | 2 +- drivers/usb/serial/option.c | 10 ++ drivers/usb/storage/transport.c | 26 +++++ drivers/video/console/bitblit.c | 3 +- drivers/video/console/fbcon_ccw.c | 3 +- drivers/video/console/fbcon_cw.c | 3 +- drivers/video/console/fbcon_ud.c | 3 +- drivers/virtio/virtio_pci.c | 33 +++++- fs/btrfs/file-item.c | 2 +- fs/buffer.c | 8 ++ fs/dcache.c | 5 + fs/ext3/super.c | 7 -- fs/ext4/bitmap.c | 12 +-- fs/ext4/ext4.h | 13 ++- fs/ext4/extents.c | 6 +- fs/ext4/ialloc.c | 7 +- fs/ext4/inline.c | 3 +- fs/ext4/inode.c | 39 ++++++-- fs/ext4/ioctl.c | 13 ++- fs/ext4/mmp.c | 6 +- fs/ext4/namei.c | 43 +++----- fs/ext4/resize.c | 5 +- fs/ext4/super.c | 32 +++--- fs/ext4/xattr.c | 38 ++++--- fs/jbd2/recovery.c | 1 + fs/jffs2/jffs2_fs_sb.h | 2 - fs/jffs2/wbuf.c | 17 +--- fs/lockd/mon.c | 6 ++ fs/namei.c | 3 +- fs/namespace.c | 3 + fs/nfsd/nfs4proc.c | 3 +- fs/nfsd/vfs.c | 3 + fs/pstore/inode.c | 4 +- fs/quota/dquot.c | 2 +- fs/super.c | 2 + fs/ubifs/commit.c | 10 +- fs/ubifs/log.c | 19 +++- fs/ubifs/master.c | 7 +- fs/ubifs/super.c | 1 - fs/ubifs/ubifs.h | 2 - fs/xfs/xfs_mount.c | 1 - fs/xfs/xfs_sb.c | 24 ++++- include/drm/drm_pciids.h | 1 - include/drm/i915_powerwell.h | 5 +- include/linux/blkdev.h | 5 +- include/linux/compiler-gcc.h | 3 + include/linux/compiler-intel.h | 7 ++ include/linux/compiler.h | 4 + include/linux/hid.h | 1 + include/linux/mm.h | 1 + include/linux/of.h | 84 +++++++++++++--- include/linux/oom.h | 3 + include/linux/string.h | 5 +- include/linux/usb/quirks.h | 3 + include/net/ipv6.h | 2 + kernel/freezer.c | 3 + kernel/module.c | 2 + kernel/posix-timers.c | 1 + kernel/power/hibernate.c | 8 +- kernel/power/process.c | 40 +++++++- kernel/trace/trace_syscalls.c | 8 +- lib/bitmap.c | 8 +- lib/string.c | 16 +++ mm/huge_memory.c | 4 +- mm/oom_kill.c | 17 ++++ mm/page_alloc.c | 15 ++- mm/page_cgroup.c | 1 + mm/percpu.c | 2 - mm/truncate.c | 56 +++++++++++ net/ipv4/fib_semantics.c | 2 +- net/ipv4/ip_output.c | 12 ++- net/ipv4/ip_tunnel_core.c | 3 +- net/ipv4/tcp.c | 59 ++++------- net/ipv6/output_core.c | 38 +++++++ net/mac80211/rate.c | 2 +- net/netlink/af_netlink.c | 2 +- security/integrity/evm/evm_main.c | 9 +- security/selinux/hooks.c | 2 +- sound/core/pcm_compat.c | 2 + sound/pci/hda/hda_i915.c | 28 ++++-- sound/pci/hda/hda_i915.h | 6 +- sound/pci/hda/hda_intel.c | 69 ++++++++++++- sound/pci/hda/patch_hdmi.c | 2 + sound/soc/soc-dapm.c | 25 +++-- sound/usb/card.c | 9 +- virt/kvm/iommu.c | 8 +- 199 files changed, 1839 insertions(+), 758 deletions(-)
Signature · 1 line
2.1.3
PATCH 1/206 mm: page_alloc: fix zone allocation fairness on UP
From: Johannes Weiner <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit abe5f972912d086c080be4bde67750630b6fb38b upstream.
The zone allocation batches can easily underflow due to higher-order allocations or spills to remote nodes. On SMP that's fine, because underflows are expected from concurrency and dealt with by returning 0. But on UP, zone_page_state will just return a wrapped unsigned long, which will get past the <= 0 check and then consider the zone eligible until its watermarks are hit.
Commit 3a025760fc15 ("mm: page_alloc: spill to remote nodes before waking kswapd") already made the counter-resetting use atomic_long_read() to accomodate underflows from remote spills, but it didn't go all the way with it.
Make it clear that these batches are expected to go negative regardless of concurrency, and use atomic_long_read() everywhere.
--- mm/page_alloc.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
mm/page_alloc.c +3 -4
@@ -1589,7 +1589,7 @@ again: }__mod_zone_page_state (zone,NR_ALLOC_BATCH , -(1 << order)); -if (zone_page_state (zone,NR_ALLOC_BATCH ) ==0 && +if (atomic_long_read (&zone->vm_stat[NR_ALLOC_BATCH ]) <=0 && !zone_is_fair_depleted (zone))zone_set_flag (zone,ZONE_FAIR_DEPLETED );
@@ -5652,9 +5652,8 @@ static void __setup_per_zone_wmarks(void) zone->watermark[WMARK_HIGH ] =min_wmark_pages (zone) + (tmp >>1 );__mod_zone_page_state (zone,NR_ALLOC_BATCH , -high_wmark_pages (zone) - -low_wmark_pages (zone) - -zone_page_state (zone,NR_ALLOC_BATCH )); +high_wmark_pages (zone) -low_wmark_pages (zone) - +atomic_long_read (&zone->vm_stat[NR_ALLOC_BATCH ]));setup_zone_migrate_reserve (zone);spin_unlock_irqrestore (&zone->lock, flags);
Signature · 1 line
2.1.3
PATCH 2/206 ACPI / EC: Add support to disallow QR_EC to be issued when SCI_EVT isn't set
From: Lv Zheng <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3afcf2ece453e1a8c2c6de19cdf06da3772a1b08 upstream.
There is a platform refusing to respond QR_EC when SCI_EVT isn't set (Acer Aspire V5-573G).
Currently, we rely on the behaviour that the EC firmware can respond something (for example, 0x00 to indicate "no outstanding events") to QR_EC even when SCI_EVT is not set, but the reporter has complained about AC/battery pluging/unpluging and video brightness change delay on that platform.
This is because the work item that has issued QR_EC has to wait until timeout in this case, and the _Qxx method evaluation work item queued after QR_EC one is delayed.
It sounds reasonable to fix this issue by:
1. Implementing SCI_EVT sanity check before issuing QR_EC in the EC driver's main state machine.
2. Moving QR_EC issuing out of the work queue used by _Qxx evaluation to a seperate IRQ handling thread.
This patch fixes this issue using solution 1.
By disallowing QR_EC to be issued when SCI_EVT isn't set, we are able to handle such platform in the EC driver's main state machine. This patch enhances the state machine in this way to survive with such malfunctioning EC firmware.
Note that this patch can also fix CLEAR_ON_RESUME quirk which also relies on the assumption that the platforms are able to respond even when SCI_EVT isn't set.
--- drivers/acpi/ec.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
drivers/acpi/ec.c +16 -1
@@ -193,6 +193,8 @@ static bool advance_transaction(struct acpi_ec *ec) t->rdata[t->ri++] =acpi_ec_read_data (ec);if (t->rlen == t->ri) { t->flags |=ACPI_EC_COMMAND_COMPLETE ; +if (t->command ==ACPI_EC_COMMAND_QUERY ) +pr_debug ("hardware QR_EC completion\n" ); wakeup = true; } }else
@@ -204,7 +206,20 @@ static bool advance_transaction(struct acpi_ec *ec) }return wakeup; }else { -if ((status &ACPI_EC_FLAG_IBF ) ==0 ) { +/* +* There is firmware refusing to respond QR_EC when SCI_EVT +* is not set, for which case, we complete the QR_EC +* without issuing it to the firmware. +* https://bugzilla.kernel.org/show_bug.cgi?id=86211 +*/ +if (!(status &ACPI_EC_FLAG_SCI ) && + (t->command ==ACPI_EC_COMMAND_QUERY )) { + t->flags |=ACPI_EC_COMMAND_POLL ; + t->rdata[t->ri++] =0x00 ; + t->flags |=ACPI_EC_COMMAND_COMPLETE ; +pr_debug ("software QR_EC completion\n" ); + wakeup = true; + }else if ((status &ACPI_EC_FLAG_IBF ) ==0 ) {acpi_ec_write_cmd (ec, t->command); t->flags |=ACPI_EC_COMMAND_POLL ; }else
Signature · 1 line
2.1.3
PATCH 3/206 ACPI / EC: Fix regression due to conflicting firmware behavior between Samsung and Acer.
In reply to Jiri SlabyFrom: Lv Zheng <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 79149001105f18bd2285ada109f9229ea24a7571 upstream.
It is reported that Samsung laptops that need to poll events are broken by the following commit:
Commit 3afcf2ece453e1a8c2c6de19cdf06da3772a1b08
Subject: ACPI / EC: Add support to disallow QR_EC to be issued when SCI_EVT isn't set
The behaviors of the 2 vendor firmwares are conflict:
1. Acer: OSPM shouldn't issue QR_EC unless SCI_EVT is set, firmware automatically sets SCI_EVT as long as there is event queued up.
2. Samsung: OSPM should issue QR_EC whatever SCI_EVT is set, firmware returns 0 when there is no event queued up.
This patch is a quick fix to distinguish the behaviors to make Acer behavior only effective for Acer EC firmware so that the breakages on Samsung EC firmware can be avoided.
--- drivers/acpi/ec.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-)
drivers/acpi/ec.c +18 -7
@@ -129,6 +129,7 @@ static int EC_FLAGS_MSI; /* Out-of-spec MSI controller */static int EC_FLAGS_VALIDATE_ECDT ;/* ASUStec ECDTs need to be validated */ static int EC_FLAGS_SKIP_DSDT_SCAN ;/* Not all BIOS survive early DSDT scan */ static int EC_FLAGS_CLEAR_ON_RESUME ;/* Needs acpi_ec_clear() on boot/resume */ +static int EC_FLAGS_QUERY_HANDSHAKE ;/* Needs QR_EC issued when SCI_EVT set */ /* -------------------------------------------------------------------------- Transaction Management
@@ -206,13 +207,8 @@ static bool advance_transaction(struct acpi_ec *ec) }return wakeup; }else { -/* -* There is firmware refusing to respond QR_EC when SCI_EVT -* is not set, for which case, we complete the QR_EC -* without issuing it to the firmware. -* https://bugzilla.kernel.org/show_bug.cgi?id=86211 -*/ -if (!(status &ACPI_EC_FLAG_SCI ) && +if (EC_FLAGS_QUERY_HANDSHAKE && + !(status &ACPI_EC_FLAG_SCI ) && (t->command ==ACPI_EC_COMMAND_QUERY )) { t->flags |=ACPI_EC_COMMAND_POLL ; t->rdata[t->ri++] =0x00 ;
@@ -997,6 +993,18 @@ static int ec_enlarge_storm_threshold(const struct dmi_system_id *id) }/* +* Acer EC firmware refuses to respond QR_EC when SCI_EVT is not set, for +* which case, we complete the QR_EC without issuing it to the firmware. +* https://bugzilla.kernel.org/show_bug.cgi?id=86211 +*/ +static int ec_flag_query_handshake (const struct dmi_system_id *id) +{ +pr_debug ("Detected the EC firmware requiring QR_EC issued when SCI_EVT set\n" ); +EC_FLAGS_QUERY_HANDSHAKE =1 ; +return 0 ; +} + +/* * On some hardware it is necessary to clear events accumulated by the EC during * sleep. These ECs stop reporting GPEs until they are manually polled, if too * many events are accumulated. (e.g. Samsung Series 5/9 notebooks)
@@ -1066,6 +1074,9 @@ static struct dmi_system_id ec_dmi_table[] __initdata = { { ec_clear_on_resume, "Samsung hardware", { DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL}, + { + ec_flag_query_handshake, "Acer hardware", { + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), }, NULL}, {}, };
Signature · 1 line
2.1.3
PATCH 4/206 drm/i915, HD-audio: Don't continue probing when nomodeset is given
In reply to Jiri SlabyFrom: Takashi Iwai <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 74b0c2d75fb4cc89173944e6d8f9eb47aca0c343 upstream.
When a machine is booted with nomodeset option, i915 driver skips the whole initialization. Meanwhile, HD-audio tries to bind wth i915 just by request_symbol() without knowing that the initialization was skipped, and eventually it hits WARN_ON() in i915_request_power_well() and i915_release_power_well() wrongly but still continues probing, even though it doesn't work at all.
In this patch, both functions are changed to return an error in case of uninitialized state instead of WARN_ON(), so that HD-audio driver can give up HDMI controller initialization at the right time.
--- drivers/gpu/drm/i915/intel_pm.c | 15 +++++++++------ include/drm/i915_powerwell.h | 4 ++-- sound/pci/hda/hda_i915.c | 12 ++++++------ sound/pci/hda/hda_i915.h | 4 ++-- sound/pci/hda/hda_intel.c | 6 +++++- 5 files changed, 24 insertions(+), 17 deletions(-)
drivers/gpu/drm/i915/intel_pm.c +9 -6
@@ -5347,24 +5347,26 @@ static void __intel_set_power_well(struct drm_device *dev, bool enable)static struct i915_power_well *hsw_pwr;/* Display audio driver power well request */ -void i915_request_power_well (void ) +int i915_request_power_well (void ) { -if (WARN_ON (!hsw_pwr)) -return ; +if (!hsw_pwr) +return -ENODEV ;spin_lock_irq (&hsw_pwr->lock);if (!hsw_pwr->count++ && !hsw_pwr->i915_request)__intel_set_power_well (hsw_pwr->device, true);spin_unlock_irq (&hsw_pwr->lock); +return 0 ; }EXPORT_SYMBOL_GPL (i915_request_power_well);/* Display audio driver power well release */ -void i915_release_power_well (void ) +int i915_release_power_well (void ) { -if (WARN_ON (!hsw_pwr)) -return ; +if (!hsw_pwr) +return -ENODEV ; +spin_lock_irq (&hsw_pwr->lock);WARN_ON (!hsw_pwr->count);
@@ -5372,6 +5374,7 @@ void i915_release_power_well(void) !hsw_pwr->i915_request)__intel_set_power_well (hsw_pwr->device, false);spin_unlock_irq (&hsw_pwr->lock); +return 0 ; }EXPORT_SYMBOL_GPL (i915_release_power_well);
include/drm/i915_powerwell.h +2 -2
@@ -30,7 +30,7 @@#define _I915_POWERWELL_H_/* For use by hda_i915 driver */ -extern void i915_request_power_well (void ); -extern void i915_release_power_well (void ); +extern int i915_request_power_well (void ); +extern int i915_release_power_well (void );#endif /* _I915_POWERWELL_H_ */
sound/pci/hda/hda_i915.c +6 -6
@@ -22,20 +22,20 @@#include <drm/i915_powerwell.h> #include "hda_i915.h" -static void (*get_power)(void ); -static void (*put_power)(void ); +static int (*get_power)(void ); +static int (*put_power)(void ); -void hda_display_power (bool enable) +int hda_display_power (bool enable) {if (!get_power || !put_power) -return ; +return -ENODEV ;snd_printdd ("HDA display power %s \n" , enable ?"Enable" :"Disable" );if (enable) -get_power (); +return get_power ();else -put_power (); +return put_power (); }int hda_i915_init (void )
sound/pci/hda/hda_i915.h +2 -2
@@ -17,11 +17,11 @@#define __SOUND_HDA_I915_H#ifdef CONFIG_SND_HDA_I915 -void hda_display_power (bool enable); +int hda_display_power (bool enable);int hda_i915_init (void );int hda_i915_exit (void );#else -static inline void hda_display_power (bool enable) {} +static inline int hda_display_power (bool enable) {return 0 ; }static inline int hda_i915_init (void ) {return -ENODEV ;
sound/pci/hda/hda_intel.c +5 -1
@@ -3902,8 +3902,12 @@ static int azx_probe_continue(struct azx *chip) snd_printk(KERN_ERR SFX "Error request power-well from i915\n"); goto out_free; } + err =hda_display_power (true); +if (err <0 ) { + snd_printk(KERN_ERR SFX "Cannot turn on display power on i915\n"); + goto out_free; + }#endif -hda_display_power (true); } err =azx_first_init (chip);
Signature · 1 line
2.1.3
PATCH 5/206 drm/i915: provide interface for audio driver to query cdclk
In reply to Jiri SlabyFrom: Jani Nikula <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c149dcb5c60bfea8871f16dfcc0690255eeb825f upstream.
For Haswell and Broadwell, if the display power well has been disabled, the display audio controller divider values EM4 M VALUE and EM5 N VALUE will have been lost. The CDCLK frequency is required for reprogramming them to generate 24MHz HD-A link BCLK. So provide a private interface for the audio driver to query CDCLK.
This is a stopgap solution until a more generic interface between audio and display drivers has been implemented.
--- drivers/gpu/drm/i915/intel_pm.c | 20 ++++++++++++++++++++ include/drm/i915_powerwell.h | 1 + 2 files changed, 21 insertions(+)
drivers/gpu/drm/i915/intel_pm.c +20 -0
@@ -5378,6 +5378,26 @@ int i915_release_power_well(void) }EXPORT_SYMBOL_GPL (i915_release_power_well); +/* +* Private interface for the audio driver to get CDCLK in kHz. +* +* Caller must request power well using i915_request_power_well() prior to +* making the call. +*/ +int i915_get_cdclk_freq (void ) +{ +struct drm_i915_private *dev_priv; + +if (!hsw_pwr) +return -ENODEV ; + + dev_priv = container_of(hsw_pwr, struct drm_i915_private, + power_well); + +return intel_ddi_get_cdclk_freq (dev_priv); +} +EXPORT_SYMBOL_GPL (i915_get_cdclk_freq); +int i915_init_power_well (struct drm_device *dev) {struct drm_i915_private *dev_priv = dev->dev_private;
include/drm/i915_powerwell.h +1 -0
@@ -32,5 +32,6 @@/* For use by hda_i915 driver */ extern int i915_request_power_well (void );extern int i915_release_power_well (void ); +extern int i915_get_cdclk_freq (void );#endif /* _I915_POWERWELL_H_ */
Signature · 1 line
2.1.3
PATCH 6/206 ALSA: hda - restore BCLK M/N value as per CDCLK for HSW/BDW display HDA controller
In reply to Jiri SlabyFrom: Mengdong Lin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e4d9e513dedb5ac4e166c1053314fa935ddecc8c upstream.
For HSW/BDW display HD-A controller, hda_set_bclk() is defined to set BCLK by programming the M/N values as per the core display clock (CDCLK) queried from i915 display driver.
And the audio driver will also set BCLK in azx_first_init() since the display driver can turn off the shared power in boot phase if only eDP is connected and M/N values will be lost and must be reprogrammed.
--- sound/pci/hda/hda_i915.c | 16 +++++++++++++ sound/pci/hda/hda_i915.h | 2 ++ sound/pci/hda/hda_intel.c | 60 +++++++++++++++++++++++++++++++++++++++++++++-- 3 files changed, 76 insertions(+), 2 deletions(-)
sound/pci/hda/hda_i915.c +16 -0
@@ -24,6 +24,7 @@static int (*get_power)(void );static int (*put_power)(void ); +static int (*get_cdclk)(void );int hda_display_power (bool enable) {
@@ -38,6 +39,13 @@ int hda_display_power(bool enable)return put_power (); } +int haswell_get_cdclk (void ) +{ +if (!get_cdclk) +return -EINVAL ; +return get_cdclk (); +} +int hda_i915_init (void ) {int err =0 ;
@@ -55,6 +63,10 @@ int hda_i915_init(void)return -ENODEV ; } + get_cdclk =symbol_request (i915_get_cdclk_freq); +if (!get_cdclk)/* may have abnormal BCLK and audio playback rate */ +snd_printd ("hda-i915: get_cdclk symbol get fail\n" ); +snd_printd ("HDA driver get symbol successfully from i915 module\n" );return err;
@@ -70,6 +82,10 @@ int hda_i915_exit(void)symbol_put (i915_release_power_well); put_power =NULL ; } +if (get_cdclk) { +symbol_put (i915_get_cdclk_freq); + get_cdclk =NULL ; + }return 0 ; }
sound/pci/hda/hda_i915.h +2 -0
@@ -18,10 +18,12 @@#ifdef CONFIG_SND_HDA_I915 int hda_display_power (bool enable); +int haswell_get_cdclk (void );int hda_i915_init (void );int hda_i915_exit (void );#else static inline int hda_display_power (bool enable) {return 0 ; } +static inline int haswell_get_cdclk (void ) {return -EINVAL ; }static inline int hda_i915_init (void ) {return -ENODEV ;
sound/pci/hda/hda_intel.c +58 -2
86 lines not on this page · raw message
Signature · 1 line
2.1.3
PATCH 7/206 ipv4: fix nexthop attlen check in fib_nh_match
In reply to Jiri SlabyFrom: Jiri Pirko <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit f76936d07c4eeb36d8dbb64ebd30ab46ff85d9f7 ]
fib_nh_match does not match nexthops correctly. Example:
ip route add 172.16.10/24 nexthop via 192.168.122.12 dev eth0 \
nexthop via 192.168.122.13 dev eth0
ip route del 172.16.10/24 nexthop via 192.168.122.14 dev eth0 \
nexthop via 192.168.122.15 dev eth0Del command is successful and route is removed. After this patch applied, the route is correctly matched and result is:
RTNETLINK answers: No such process
Please consider this for stable trees as well.
--- net/ipv4/fib_semantics.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/fib_semantics.c +1 -1
@@ -534,7 +534,7 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi)return 1 ; attrlen =rtnh_attrlen (rtnh); -if (attrlen <0 ) { +if (attrlen >0 ) {struct nlattr *nla, *attrs =rtnh_attrs (rtnh); nla =nla_find (attrs, attrlen,RTA_GATEWAY );
Signature · 1 line
2.1.3
PATCH 8/206 vxlan: fix a use after free in vxlan_encap_bypass
In reply to Jiri SlabyFrom: Li RongQing <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit ce6502a8f9572179f044a4d62667c4645256d6e4 ]
when netif_rx() is done, the netif_rx handled skb maybe be freed, and should not be used.
--- drivers/net/vxlan.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/vxlan.c +5 -3
@@ -1683,6 +1683,8 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,struct pcpu_tstats *rx_stats =this_cpu_ptr (dst_vxlan->dev->tstats);union vxlan_addr loopback;union vxlan_addr *remote_ip = &dst_vxlan->default_dst.remote_ip; +struct net_device *dev = skb->dev; +int len = skb->len; skb->pkt_type =PACKET_HOST ; skb->encapsulation =0 ;
@@ -1704,16 +1706,16 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,u64_stats_update_begin (&tx_stats->syncp); tx_stats->tx_packets++; - tx_stats->tx_bytes += skb->len; + tx_stats->tx_bytes += len;u64_stats_update_end (&tx_stats->syncp);if (netif_rx (skb) ==NET_RX_SUCCESS ) {u64_stats_update_begin (&rx_stats->syncp); rx_stats->rx_packets++; - rx_stats->rx_bytes += skb->len; + rx_stats->rx_bytes += len;u64_stats_update_end (&rx_stats->syncp); }else { - skb->dev->stats.rx_dropped++; + dev->stats.rx_dropped++; } }
Signature · 1 line
2.1.3
PATCH 9/206 vxlan: using pskb_may_pull as early as possible
In reply to Jiri SlabyFrom: Li RongQing <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 91269e390d062b526432f2ef1352b8df82e0e0bc ]
pskb_may_pull should be used to check if skb->data has enough space, skb->len can not ensure that.
--- drivers/net/vxlan.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/vxlan.c +2 -4
@@ -1341,9 +1341,6 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)if (!in6_dev) goto out; -if (!pskb_may_pull (skb, skb->len)) - goto out; - iphdr =ipv6_hdr (skb); saddr = &iphdr->saddr; daddr = &iphdr->daddr;
@@ -1890,7 +1887,8 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)return arp_reduce (dev, skb); #if IS_ENABLED(CONFIG_IPV6) else if (ntohs(eth->h_proto) == ETH_P_IPV6 && - skb->len >= sizeof(struct ipv6hdr) + sizeof(struct nd_msg) && + pskb_may_pull(skb, sizeof(struct ipv6hdr) + + sizeof(struct nd_msg)) && ipv6_hdr(skb)->nexthdr == IPPROTO_ICMPV6) {struct nd_msg *msg;
Signature · 1 line
2.1.3
PATCH 10/206 vxlan: fix a free after use
In reply to Jiri SlabyFrom: Li RongQing <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 7a9f526fc3ee49b6034af2f243676ee0a27dcaa8 ]
pskb_may_pull maybe change skb->data and make eth pointer oboslete, so eth needs to reload
--- drivers/net/vxlan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/vxlan.c +1 -0
@@ -1897,6 +1897,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev) msg->icmph.icmp6_type == NDISC_NEIGHBOUR_SOLICITATION) return neigh_reduce(dev, skb); } + eth =eth_hdr (skb);#endif }
Signature · 1 line
2.1.3
PATCH 11/206 ipv4: fix a potential use after free in ip_tunnel_core.c
In reply to Jiri SlabyFrom: Li RongQing <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 1245dfc8cadb258386fcd27df38215a0eccb1f17 ]
pskb_may_pull() maybe change skb->data and make eth pointer oboslete, so set eth after pskb_may_pull()
--- net/ipv4/ip_tunnel_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv4/ip_tunnel_core.c +2 -1
@@ -91,11 +91,12 @@ int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto)skb_pull_rcsum (skb, hdr_len);if (inner_proto ==htons (ETH_P_TEB )) { -struct ethhdr *eh = (struct ethhdr *)skb->data; +struct ethhdr *eh;if (unlikely (!pskb_may_pull (skb,ETH_HLEN )))return -ENOMEM ; + eh = (struct ethhdr *)skb->data;if (likely (ntohs (eh->h_proto) >=ETH_P_802_3_MIN )) skb->protocol = eh->h_proto;else
Signature · 1 line
2.1.3
PATCH 12/206 ax88179_178a: fix bonding failure
In reply to Jiri SlabyFrom: Ian Morgan <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 95ff88688781db2f64042e69bd499e518bbb36e5 ]
The following patch fixes a bug which causes the ax88179_178a driver to be incapable of being added to a bond.
When I brought up the issue with the bonding maintainers, they indicated that the real problem was with the NIC driver which must return zero for success (of setting the MAC address). I see that several other NIC drivers follow that pattern by either simply always returing zero, or by passing through a negative (error) result while rewriting any positive return code to zero. With that same philisophy applied to the ax88179_178a driver, it allows it to work correctly with the bonding driver.
I believe this is suitable for queuing in -stable, as it's a small, simple, and obvious fix that corrects a defect with no other known workaround.
This patch is against vanilla 3.17(.0).
drivers/net/usb/ax88179_178a.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
--- drivers/net/usb/ax88179_178a.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/usb/ax88179_178a.c +6 -1
@@ -698,6 +698,7 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p) {struct usbnet *dev =netdev_priv (net);struct sockaddr *addr = p; +int ret;if (netif_running (net))return -EBUSY ;
@@ -707,8 +708,12 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p)memcpy (net->dev_addr, addr->sa_data,ETH_ALEN );/* Set the MAC address */ -return ax88179_write_cmd (dev,AX_ACCESS_MAC ,AX_NODE_ID ,ETH_ALEN , + ret =ax88179_write_cmd (dev,AX_ACCESS_MAC ,AX_NODE_ID ,ETH_ALEN ,ETH_ALEN , net->dev_addr); +if (ret <0 ) +return ret; + +return 0 ; }static const struct net_device_ops ax88179_netdev_ops = {
Signature · 1 line
2.1.3
PATCH 13/206 tcp: md5: do not use alloc_percpu()
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 349ce993ac706869d553a1816426d3a4bfda02b1 ]
percpu tcp_md5sig_pool contains memory blobs that ultimately go through sg_set_buf().
-> sg_set_page(sg, virt_to_page(buf), buflen, offset_in_page(buf));
This requires that whole area is in a physically contiguous portion of memory. And that @buf is not backed by vmalloc().
Given that alloc_percpu() can use vmalloc() areas, this does not fit the requirements.
Replace alloc_percpu() by a static DEFINE_PER_CPU() as tcp_md5sig_pool is small anyway, there is no gain to dynamically allocate it.
--- net/ipv4/tcp.c | 59 ++++++++++++++++++++-------------------------------------- 1 file changed, 20 insertions(+), 39 deletions(-)
net/ipv4/tcp.c +20 -39
@@ -2909,61 +2909,42 @@ EXPORT_SYMBOL(compat_tcp_getsockopt);#endif #ifdef CONFIG_TCP_MD5SIG -static struct tcp_md5sig_pool __percpu *tcp_md5sig_pool__read_mostly ; +static DEFINE_PER_CPU(struct tcp_md5sig_pool, tcp_md5sig_pool);static DEFINE_MUTEX (tcp_md5sig_mutex); - -static void __tcp_free_md5sig_pool (struct tcp_md5sig_pool __percpu *pool) -{ -int cpu; - -for_each_possible_cpu (cpu) { -struct tcp_md5sig_pool *p =per_cpu_ptr (pool, cpu); - -if (p->md5_desc.tfm) -crypto_free_hash (p->md5_desc.tfm); - } -free_percpu (pool); -} +static bool tcp_md5sig_pool_populated = false;static void __tcp_alloc_md5sig_pool (void ) {int cpu; -struct tcp_md5sig_pool __percpu *pool; - - pool = alloc_percpu(struct tcp_md5sig_pool); -if (!pool) -return ;for_each_possible_cpu (cpu) { -struct crypto_hash *hash; - - hash =crypto_alloc_hash ("md5" ,0 ,CRYPTO_ALG_ASYNC ); -if (IS_ERR_OR_NULL (hash)) - goto out_free; +if (!per_cpu (tcp_md5sig_pool, cpu).md5_desc.tfm) { +struct crypto_hash *hash; -per_cpu_ptr (pool, cpu)->md5_desc.tfm = hash; + hash =crypto_alloc_hash ("md5" ,0 ,CRYPTO_ALG_ASYNC ); +if (IS_ERR_OR_NULL (hash)) +return ; +per_cpu (tcp_md5sig_pool, cpu).md5_desc.tfm = hash; + } } -/* before setting tcp_md5sig_pool, we must commit all writes -* to memory. See ACCESS_ONCE() in tcp_get_md5sig_pool() +/* before setting tcp_md5sig_pool_populated, we must commit all writes +* to memory. See smp_rmb() in tcp_get_md5sig_pool() */ smp_wmb (); - tcp_md5sig_pool = pool; -return ; -out_free: -__tcp_free_md5sig_pool (pool); + tcp_md5sig_pool_populated = true; }bool tcp_alloc_md5sig_pool (void ) { -if (unlikely (!tcp_md5sig_pool)) { +if (unlikely (!tcp_md5sig_pool_populated)) {mutex_lock (&tcp_md5sig_mutex); -if (!tcp_md5sig_pool) +if (!tcp_md5sig_pool_populated)__tcp_alloc_md5sig_pool ();mutex_unlock (&tcp_md5sig_mutex); } -return tcp_md5sig_pool !=NULL ; +return tcp_md5sig_pool_populated; }EXPORT_SYMBOL (tcp_alloc_md5sig_pool);
@@ -2977,13 +2958,13 @@ EXPORT_SYMBOL(tcp_alloc_md5sig_pool);*/ struct tcp_md5sig_pool *tcp_get_md5sig_pool (void ) { -struct tcp_md5sig_pool __percpu *p; -local_bh_disable (); - p =ACCESS_ONCE (tcp_md5sig_pool); -if (p) -return __this_cpu_ptr (p); +if (tcp_md5sig_pool_populated) { +/* coupled with smp_wmb() in __tcp_alloc_md5sig_pool() */ +smp_rmb (); +return this_cpu_ptr (&tcp_md5sig_pool); + }local_bh_enable ();return NULL ; }
Signature · 1 line
2.1.3
PATCH 14/206 ipv4: dst_entry leak in ip_send_unicast_reply()
In reply to Jiri SlabyFrom: Vasily Averin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 4062090e3e5caaf55bed4523a69f26c3265cc1d2 ]
ip_setup_cork() called inside ip_append_data() steals dst entry from rt to cork and in case errors in __ip_append_data() nobody frees stolen dst entry
--- net/ipv4/ip_output.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
net/ipv4/ip_output.c +9 -3
@@ -1478,6 +1478,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,struct sk_buff *nskb;struct sock *sk;struct inet_sock *inet; +int err;if (ip_options_echo (&replyopts.opt.opt, skb))return ;
@@ -1514,8 +1515,13 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,sock_net_set (sk, net);__skb_queue_head_init (&sk->sk_write_queue); sk->sk_sndbuf = sysctl_wmem_default; -ip_append_data (sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base, len,0 , - &ipc, &rt,MSG_DONTWAIT ); + err =ip_append_data (sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base, + len,0 , &ipc, &rt,MSG_DONTWAIT ); +if (unlikely (err)) { +ip_flush_pending_frames (sk); + goto out; + } + nskb =skb_peek (&sk->sk_write_queue);if (nskb) {if (arg->csumoffset >=0 )
@@ -1527,7 +1533,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,skb_set_queue_mapping (nskb,skb_get_queue_mapping (skb));ip_push_pending_frames (sk, &fl4); } - +out:put_cpu_var (unicast_sock);ip_rt_put (rt);
Signature · 1 line
2.1.3
PATCH 15/206 drivers/net, ipv6: Select IPv6 fragment idents for virtio UFO packets
In reply to Jiri SlabyFrom: Ben Hutchings <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 5188cd44c55db3e92cd9e77a40b5baa7ed4340f7 ]
UFO is now disabled on all drivers that work with virtio net headers, but userland may try to send UFO/IPv6 packets anyway. Instead of sending with ID=0, we should select identifiers on their behalf (as we used to).
--- drivers/net/macvtap.c | 3 +++ drivers/net/tun.c | 6 +++++- include/net/ipv6.h | 2 ++ net/ipv6/output_core.c | 38 ++++++++++++++++++++++++++++++++++++++ 4 files changed, 48 insertions(+), 1 deletion(-)
drivers/net/macvtap.c +3 -0
@@ -17,6 +17,7 @@#include <linux/idr.h> #include <linux/fs.h> +#include <net/ipv6.h> #include <net/net_namespace.h> #include <net/rtnetlink.h> #include <net/sock.h>
@@ -566,6 +567,8 @@ static int macvtap_skb_from_vnet_hdr(struct sk_buff *skb,break ;case VIRTIO_NET_HDR_GSO_UDP : gso_type =SKB_GSO_UDP ; +if (skb->protocol ==htons (ETH_P_IPV6 )) +ipv6_proxy_select_ident (skb);break ;default :return -EINVAL ;
drivers/net/tun.c +5 -1
@@ -65,6 +65,7 @@#include <linux/nsproxy.h> #include <linux/virtio_net.h> #include <linux/rcupdate.h> +#include <net/ipv6.h> #include <net/net_namespace.h> #include <net/netns/generic.h> #include <net/rtnetlink.h>
@@ -1103,6 +1104,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,break ; } +skb_reset_network_header (skb); +if (gso.gso_type !=VIRTIO_NET_HDR_GSO_NONE ) {pr_debug ("GSO!\n" );switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN ) {
@@ -1114,6 +1117,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,break ;case VIRTIO_NET_HDR_GSO_UDP :skb_shinfo (skb)->gso_type =SKB_GSO_UDP ; +if (skb->protocol ==htons (ETH_P_IPV6 )) +ipv6_proxy_select_ident (skb);break ;default : tun->dev->stats.rx_frame_errors++;
@@ -1143,7 +1148,6 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,skb_shinfo (skb)->tx_flags |=SKBTX_SHARED_FRAG ; } -skb_reset_network_header (skb);skb_probe_transport_header (skb,0 ); rxhash =skb_get_rxhash (skb);
include/net/ipv6.h +2 -0
@@ -661,6 +661,8 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_addreturn __ipv6_addr_diff (a1, a2,sizeof (struct in6_addr )); } +extern void ipv6_proxy_select_ident (struct sk_buff *skb); +extern int ip6_dst_hoplimit (struct dst_entry *dst);/*
net/ipv6/output_core.c +38 -0
@@ -3,10 +3,48 @@* not configured or static. These functions are needed by GSO/GRO implementation. */ #include <linux/export.h> +#include <linux/random.h> +#include <net/ip.h> #include <net/ipv6.h> #include <net/ip6_fib.h> #include <net/addrconf.h> +/* This function exists only for tap drivers that must support broken +* clients requesting UFO without specifying an IPv6 fragment ID. +* +* This is similar to ipv6_select_ident() but we use an independent hash +* seed to limit information leakage. +* +* The network header must be set before calling this. +*/ +void ipv6_proxy_select_ident (struct sk_buff *skb) +{ +static u32 ip6_proxy_idents_hashrnd__read_mostly ; +struct in6_addr buf[2 ]; +struct in6_addr *addrs; +static bool done = false; +u32 hash, id; + + addrs =skb_header_pointer (skb, +skb_network_offset (skb) + + offsetof(struct ipv6hdr , saddr), +sizeof (buf), buf); +if (!addrs) +return ; + +if (!done) { +get_random_bytes (&ip6_proxy_idents_hashrnd, +sizeof (ip6_proxy_idents_hashrnd)); + done = true; + } + + hash =__ipv6_addr_jhash (&addrs[1 ], ip6_proxy_idents_hashrnd); + hash =__ipv6_addr_jhash (&addrs[0 ], hash); + + id =ip_idents_reserve (hash,1 ); +skb_shinfo (skb)->ip6_frag_id =htonl (id); +} +EXPORT_SYMBOL_GPL (ipv6_proxy_select_ident);int ip6_find_1stfragopt (struct sk_buff *skb,u8 **nexthdr) {
Signature · 1 line
2.1.3
PATCH 16/206 drivers/net: macvtap and tun depend on INET
In reply to Jiri SlabyFrom: Ben Hutchings <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit de11b0e8c569b96c2cf6a811e3805b7aeef498a3 ]
These drivers now call ipv6_proxy_select_ident(), which is defined only if CONFIG_INET is enabled. However, they have really depended on CONFIG_INET for as long as they have allowed sending GSO packets from userland.
--- drivers/net/Kconfig | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/Kconfig +2 -0
@@ -135,6 +135,7 @@ config MACVLAN config MACVTAP tristate "MAC-VLAN based tap driver" depends on MACVLAN + depends on INET help This adds a specialized tap character device driver that is based on the MAC-VLAN network interface, called macvtap. A macvtap device
@@ -205,6 +206,7 @@ config RIONET_RX_SIZE config TUN tristate "Universal TUN/TAP device driver support" + depends on INET select CRC32 ---help--- TUN/TAP provides packet reception and transmission for user space
Signature · 1 line
2.1.3
PATCH 17/206 nfsd: fix NFS regression
In reply to Jiri SlabyFrom: Sergio Gelato <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
Fix regression introduced in pre-3.14 kernels by cherry-picking aa07c713ecfc0522916f3cd57ac628ea6127c0ec (NFSD: Call ->set_acl with a NULL ACL structure if no entries). This is in v3.12.22 as commit 723ac81c8671b3a095d9eb303974c7bc9964b506.
The affected code was removed in 3.14 by commit 4ac7249ea5a0ceef9f8269f63f33cc873c3fac61 (nfsd: use get_acl and ->set_acl). The ->set_acl methods are already able to cope with a NULL argument. So this is not needed for >= 3.14.
--- fs/nfsd/vfs.c | 3 +++ 1 file changed, 3 insertions(+)
fs/nfsd/vfs.c +3 -0
@@ -509,6 +509,9 @@ set_nfsv4_acl_one(struct dentry *dentry, struct posix_acl *pacl, char *key)char *buf =NULL ;int error =0 ; +if (!pacl) +return vfs_setxattr (dentry, key,NULL ,0 ,0 ); + buflen =posix_acl_xattr_size (pacl->a_count); buf =kmalloc (buflen,GFP_KERNEL ); error = -ENOMEM ;
Signature · 1 line
2.1.3
PATCH 18/206 HID: usbhid: Use flag HID_DISCONNECTED when a usb device is removed
In reply to Jiri SlabyFrom: Reyad Attiyat <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 46df9dedabc1541f9c45f94ecd2c3c7ab0c3bf23 upstream.
Set disconnected flag in struct usbhid when a usb device is removed. Check for disconnected flag before sending urb requests. This prevents a kernel panic when a hid driver calls hid_hw_request() after removing a usb device.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000058 IP: [<ffffffff8161746f>] hid_submit_ctrl+0x7f/0x290 PGD 0 Oops: 0002 [#1] PREEMPT SMP CPU: 2 PID: 39 Comm: khubd Tainted: G IO 3.16.0-rc5+ #112 Hardware name: Microsoft Corporation Surface Pro 2/Surface Pro 2, BIOS 2.03.0250 09/06/2013 task: ffff880118aba6e0 ti: ffff8800daf80000 task.ti: ffff8800daf80000 RIP: 0010:[<ffffffff8161746f>] [<ffffffff8161746f>] hid_submit_ctrl+0x7f/0x290 RSP: 0018:ffff8800daf83750 EFLAGS: 00010086 RAX: 0000000080000300 RBX: ffff88003f60c000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff880117f78000 RBP: ffff8800daf83788 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000000 R12: ffff880117f78000 R13: ffff88003f11a290 R14: 000000000000000c R15: ffff880091cb3ab8 FS: 0000000000000000(0000) GS:ffff88011b000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000058 CR3: 0000000001c11000 CR4: 00000000001407e0 Stack: ffff880117f3dcd0 ffff880117f78000 ffff88003f60c000 ffff880117f78000 ffff880117f78000 ffff88003f11a290 0000000000000000 ffff8800daf837b0 ffffffff81617707 ffff880117f78000 ffff88003f60c000 0000000000000013 Call Trace: [<ffffffff81617707>] usbhid_restart_ctrl_queue+0x87/0x140 [<ffffffff81617a88>] usbhid_submit_report+0x2c8/0x370 [<ffffffff81617b4a>] usbhid_request+0x1a/0x30 [<ffffffffa020edfb>] sensor_hub_set_feature+0x8b/0xd0 [hid_sensor_hub] [<ffffffffa02d9084>] hid_sensor_power_state+0x84/0x110 [hid_sensor_trigger] [<ffffffffa02d9129>] hid_sensor_data_rdy_trigger_set_state+0x19/0x20 [hid_sensor_trigger] [<ffffffffa034d5b7>] iio_triggered_buffer_predisable+0xa7/0xb0 [industrialio] [<ffffffffa034cc4a>] iio_disable_all_buffers+0x3a/0xc0 [industrialio] [<ffffffffa03487d3>] iio_device_unregister+0x53/0x80 [industrialio] [<ffffffffa026c06a>] hid_accel_3d_remove+0x2a/0x50 [hid_sensor_accel_3d] [<ffffffff814f433d>] platform_drv_remove+0x1d/0x40 [<ffffffff814f18bf>] __device_release_driver+0x7f/0xf0 [<ffffffff814f1955>] device_release_driver+0x25/0x40 [<ffffffff814f121c>] bus_remove_device+0x11c/0x1a0 [<ffffffff814ed7d6>] device_del+0x136/0x1e0 [<ffffffff81512190>] ? mfd_cell_disable+0x80/0x80 [<ffffffff814f41d1>] platform_device_del+0x21/0xc0 [<ffffffff814f4282>] platform_device_unregister+0x12/0x30 [<ffffffff815121d3>] mfd_remove_devices_fn+0x43/0x50 [<ffffffff814ed3e3>] device_for_each_child+0x43/0x70 [<ffffffff81512105>] mfd_remove_devices+0x25/0x30 [<ffffffffa020ebd7>] sensor_hub_remove+0x87/0x140 [hid_sensor_hub] [<ffffffff81607c5b>] hid_device_remove+0x6b/0xd0 [<ffffffff814f18bf>] __device_release_driver+0x7f/0xf0 [<ffffffff814f1955>] device_release_driver+0x25/0x40 [<ffffffff814f121c>] bus_remove_device+0x11c/0x1a0 [<ffffffff814ed7d6>] device_del+0x136/0x1e0 [<ffffffff81607d47>] hid_destroy_device+0x27/0x60 [<ffffffff81616972>] usbhid_disconnect+0x22/0x50 [<ffffffff81568597>] usb_unbind_interface+0x77/0x2b0 [<ffffffff814f18bf>] __device_release_driver+0x7f/0xf0 [<ffffffff814f1955>] device_release_driver+0x25/0x40 [<ffffffff814f121c>] bus_remove_device+0x11c/0x1a0 [<ffffffff814ed7d6>] device_del+0x136/0x1e0 [<ffffffff81565cd1>] usb_disable_device+0x91/0x2a0 [<ffffffff8155b046>] usb_disconnect+0x96/0x2e0 [<ffffffff8155d74a>] hub_thread+0xb5a/0x1840
--- drivers/hid/usbhid/hid-core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/hid/usbhid/hid-core.c +5 -1
@@ -536,7 +536,8 @@ static void __usbhid_submit_report(struct hid_device *hid, struct hid_report *reint head;struct usbhid_device *usbhid = hid->driver_data; -if ((hid->quirks &HID_QUIRK_NOGET ) && dir ==USB_DIR_IN ) +if (((hid->quirks &HID_QUIRK_NOGET ) && dir ==USB_DIR_IN ) || +test_bit (HID_DISCONNECTED , &usbhid->iofl))return ;if (usbhid->urbout && dir ==USB_DIR_OUT && report->type ==HID_OUTPUT_REPORT ) {
@@ -1338,6 +1339,9 @@ static void usbhid_disconnect(struct usb_interface *intf)return ; usbhid = hid->driver_data; +spin_lock_irq (&usbhid->lock);/* Sync with error and led handlers */ +set_bit (HID_DISCONNECTED , &usbhid->iofl); +spin_unlock_irq (&usbhid->lock);hid_destroy_device (hid);kfree (usbhid); }
Signature · 1 line
2.1.3
PATCH 19/206 HID: use multi input quirk for 22b9:2968
In reply to Jiri SlabyFrom: Wen-chien Jesse Sung <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d90b1cf0c4cbe6fdcf4c4e0b0c9c97fe32b9f8a1 upstream.
This device generates ABS_Z and ABS_RX events instead of ABS_X and ABS_Y.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/usbhid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -312,6 +312,7 @@#define USB_VENDOR_ID_ETURBOTOUCH 0x22b9#define USB_DEVICE_ID_ETURBOTOUCH 0x0006 +#define USB_DEVICE_ID_ETURBOTOUCH_2968 0x2968#define USB_VENDOR_ID_EZKEY 0x0518#define USB_DEVICE_ID_BTC_8193 0x0002
drivers/hid/usbhid/hid-quirks.c +1 -0
@@ -49,6 +49,7 @@ static const struct hid_blacklist { { USB_VENDOR_ID_EMS, USB_DEVICE_ID_EMS_TRIO_LINKER_PLUS_II, HID_QUIRK_MULTI_INPUT }, { USB_VENDOR_ID_ETURBOTOUCH, USB_DEVICE_ID_ETURBOTOUCH, HID_QUIRK_MULTI_INPUT }, + { USB_VENDOR_ID_ETURBOTOUCH, USB_DEVICE_ID_ETURBOTOUCH_2968, HID_QUIRK_MULTI_INPUT }, { USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD, HID_QUIRK_MULTI_INPUT }, { USB_VENDOR_ID_PANTHERLORD, USB_DEVICE_ID_PANTHERLORD_TWIN_USB_JOYSTICK, HID_QUIRK_MULTI_INPUT | HID_QUIRK_SKIP_OUTPUT_REPORTS }, { USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII, HID_QUIRK_MULTI_INPUT },
Signature · 1 line
2.1.3
PATCH 20/206 HID: usbhid: quirk for PM1610 and PM1640 Touchscreen.
In reply to Jiri SlabyFrom: John Sung <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 66e5482752386786c4346f4f4b214b0998639702 upstream.
These device needs to be added to the quirks list with HID_QUIRK_NOGET, otherwise they will reset upon receiving the get input report requests.
--- drivers/hid/hid-ids.h | 2 ++ drivers/hid/usbhid/hid-quirks.c | 2 ++ 2 files changed, 4 insertions(+)
drivers/hid/hid-ids.h +2 -0
@@ -692,6 +692,8 @@#define USB_VENDOR_ID_PENMOUNT 0x14e1#define USB_DEVICE_ID_PENMOUNT_PCI 0x3500 +#define USB_DEVICE_ID_PENMOUNT_1610 0x1610 +#define USB_DEVICE_ID_PENMOUNT_1640 0x1640#define USB_VENDOR_ID_PETALYNX 0x18b1#define USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE 0x0037
drivers/hid/usbhid/hid-quirks.c +2 -0
@@ -77,6 +77,8 @@ static const struct hid_blacklist { { USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS }, { USB_VENDOR_ID_NEXIO, USB_DEVICE_ID_NEXIO_MULTITOUCH_PTI0750, HID_QUIRK_NO_INIT_REPORTS }, { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_1610, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_1640, HID_QUIRK_NOGET }, { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS }, { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS }, { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2, HID_QUIRK_NO_INIT_REPORTS },
Signature · 1 line
2.1.3
PATCH 21/206 HID: usbhid: enable NO_INIT_REPORTS quirk for Semico USB Keykoard
In reply to Jiri SlabyFrom: Jiri Kosina <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9ea63c439c5dffcb7c46c741929fe74b31b9676b upstream.
The device which identifies itself as a "USB Keykoard" (no typo) with VID:PID 1a2c:0023 does not seem to be handling the reports initialization very well. This results in a "usb_submit_urb(ctrl) failed: -1" message from the kernel when connected, and a delay before its initialization. This patch adds the quirk for this device, which causes the delay to disappear.
--- drivers/hid/hid-ids.h | 3 +++ drivers/hid/usbhid/hid-quirks.c | 1 + 2 files changed, 4 insertions(+)
drivers/hid/hid-ids.h +3 -0
@@ -749,6 +749,9 @@#define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001#define USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE 0x0600 +#define USB_VENDOR_ID_SEMICO 0x1a2c +#define USB_DEVICE_ID_SEMICO_USB_KEYKOARD 0x0023 +#define USB_VENDOR_ID_SENNHEISER 0x1395#define USB_DEVICE_ID_SENNHEISER_BTD500USB 0x002c
drivers/hid/usbhid/hid-quirks.c +1 -0
@@ -118,6 +118,7 @@ static const struct hid_blacklist { { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT }, { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT }, { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD, HID_QUIRK_NO_INIT_REPORTS }, { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, HID_QUIRK_NO_INIT_REPORTS }, { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS }, { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_HD, HID_QUIRK_NO_INIT_REPORTS },
Signature · 1 line
2.1.3
PATCH 22/206 Bluetooth: btusb: Add IMC Networks (Broadcom based)
In reply to Jiri SlabyFrom: Jurgen Kramer <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9113bfd82dc8ece9cbb898df8794f58a78a36e97 upstream.
Add support for IMC Networks (Broadcom based) to btusb driver.
Below the output of /sys/kernel/debug/usb/devices for this device:
T: Bus=01 Lev=02 Prnt=02 Port=04 Cnt=01 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3404 Rev= 1.12 S: Manufacturer=Broadcom Corp S: Product=BCM20702A0 S: SerialNumber=240A649F8246 C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
--- drivers/bluetooth/btusb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/bluetooth/btusb.c +3 -0
@@ -116,6 +116,9 @@ static struct usb_device_id btusb_table[] = {/* Belkin F8065bf - Broadcom based */ { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) }, +/* IMC Networks - Broadcom based */ + { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) }, + { } /* Terminating entry */ };
Signature · 1 line
2.1.3
PATCH 23/206 Bluetooth: Add support for Intel bootloader devices
In reply to Jiri SlabyFrom: Marcel Holtmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 40df783d1ef1989ac454e3dfcda017270b8950e6 upstream.
Intel Bluetooth devices that boot up in bootloader mode can not be used as generic HCI devices, but their HCI transport is still valuable and so bring that up as raw-only devices.
T: Bus=02 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#= 14 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=ff(vend.) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=8087 ProdID=0a5a Rev= 0.00 S: Manufacturer=Intel(R) Corporation S: Product=Intel(R) Wilkins Peak 2x2 S: SerialNumber=001122334455 WP_A0 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
--- drivers/bluetooth/btusb.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/bluetooth/btusb.c +7 -0
@@ -49,6 +49,7 @@ static struct usb_driver btusb_driver;#define BTUSB_WRONG_SCO_MTU 0x40#define BTUSB_ATH3012 0x80#define BTUSB_INTEL 0x100 +#define BTUSB_INTEL_BOOT 0x200static struct usb_device_id btusb_table[] = {/* Generic Bluetooth USB device */
@@ -119,6 +120,9 @@ static struct usb_device_id btusb_table[] = {/* IMC Networks - Broadcom based */ { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) }, + /* Intel Bluetooth USB Bootloader (RAM module) */ + { USB_DEVICE(0x8087, 0x0a5a), .driver_info = BTUSB_INTEL_BOOT }, + { }/* Terminating entry */ };
@@ -1451,6 +1455,9 @@ static int btusb_probe(struct usb_interface *intf,if (id->driver_info &BTUSB_INTEL ) hdev->setup = btusb_setup_intel; +if (id->driver_info &BTUSB_INTEL_BOOT ) +set_bit (HCI_QUIRK_RAW_DEVICE , &hdev->quirks); +/* Interface numbers are hardcoded in the specification */ data->isoc =usb_ifnum_to_if (data->udev,1 );
Signature · 1 line
2.1.3
PATCH 24/206 Bluetooth: Handle Intel USB bootloader with buggy interrupt
In reply to Jiri SlabyFrom: Marcel Holtmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3a5ef20c979c0f33b6fb2582d04957397a6bf51f upstream.
The interrupt interface for the Intel USB bootloader devices is only enabled after receiving SetInterface(0, AltSetting=0). When this USB command is not send, then no HCI events will be received.
--- drivers/bluetooth/btusb.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/bluetooth/btusb.c +12 -0
@@ -1495,6 +1495,18 @@ static int btusb_probe(struct usb_interface *intf, data->isoc =NULL ; } +if (id->driver_info &BTUSB_INTEL_BOOT ) { +/* A bug in the bootloader causes that interrupt interface is +* only enabled after receiving SetInterface(0, AltSetting=0). +*/ + err =usb_set_interface (data->udev,0 ,0 ); +if (err <0 ) { +BT_ERR ("failed to set interface 0, alt 0 %d" , err); +hci_free_dev (hdev); +return err; + } + } +if (data->isoc) { err =usb_driver_claim_interface (&btusb_driver, data->isoc, data);
Signature · 1 line
2.1.3
PATCH 25/206 Bluetooth: Ignore isochronous endpoints for Intel USB bootloader
In reply to Jiri SlabyFrom: Marcel Holtmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d92f2df0565ea04101d6ac04bdc10feeb1d93c94 upstream.
The isochronous endpoints are not valid when the Intel Bluetooth controller boots up in bootloader mode. So just mark these endpoints as broken and then they will not be configured.
--- drivers/bluetooth/btusb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/bluetooth/btusb.c +2 -1
@@ -121,7 +121,8 @@ static struct usb_device_id btusb_table[] = { { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) }, /* Intel Bluetooth USB Bootloader (RAM module) */ - { USB_DEVICE(0x8087, 0x0a5a), .driver_info = BTUSB_INTEL_BOOT }, + { USB_DEVICE(0x8087, 0x0a5a), + .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC }, { } /* Terminating entry */ };
Signature · 1 line
2.1.3
PATCH 26/206 Bluetooth: Fix endianess issue in the ath3k driver
In reply to Jiri SlabyFrom: Peng Chen <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b9e2535acad8f52a17e2aa843d45a6b756b59592 upstream.
The version is always in little endian format. This patch makes the driver work on both little and big endian CPUs.
--- drivers/bluetooth/ath3k.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/bluetooth/ath3k.c +2 -2
@@ -356,7 +356,7 @@ static int ath3k_load_patch(struct usb_device *udev) }snprintf (filename,ATH3K_NAME_LEN ,"ar3k/AthrBT_0x%08x.dfu" , - fw_version.rom_version); +le32_to_cpu (fw_version.rom_version)); ret =request_firmware (&firmware, filename, &udev->dev);if (ret <0 ) {
@@ -418,7 +418,7 @@ static int ath3k_load_syscfg(struct usb_device *udev) }snprintf (filename,ATH3K_NAME_LEN ,"ar3k/ramps_0x%08x_%d%s" , - fw_version.rom_version, clk_value,".dfu" ); +le32_to_cpu (fw_version.rom_version), clk_value,".dfu" ); ret =request_firmware (&firmware, filename, &udev->dev);if (ret <0 ) {
Signature · 1 line
2.1.3
PATCH 27/206 Bluetooth: Fix endian and alignment issue with ath3k version handling
In reply to Jiri SlabyFrom: Marcel Holtmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 72dd2b2a44d82118714e0821fa16c65f9e40eb00 upstream.
The ath3k driver is treating the version information badly when it comes to loading the right firmware version and comparing that it actually matches with the hardware.
Initially this showed up as this:
CHECK drivers/bluetooth/ath3k.cdrivers/bluetooth/ath3k.c:373:17: warning: cast to restricted __le32 drivers/bluetooth/ath3k.c:435:17: warning: cast to restricted __le32
However when fixing this by actually using __packed and __le32 for the ath3_version structure, more issues came up:
CHECK drivers/bluetooth/ath3k.cdrivers/bluetooth/ath3k.c:381:32: warning: incorrect type in assignment (different base types)drivers/bluetooth/ath3k.c:381:32: expected restricted __le32 [usertype] rom_versiondrivers/bluetooth/ath3k.c:381:32: got int [signed] <noident>drivers/bluetooth/ath3k.c:382:34: warning: incorrect type in assignment (different base types)drivers/bluetooth/ath3k.c:382:34: expected restricted __le32 [usertype] build_versiondrivers/bluetooth/ath3k.c:382:34: got int [signed] <noident>drivers/bluetooth/ath3k.c:386:28: warning: restricted __le32 degrades to integer drivers/bluetooth/ath3k.c:386:56: warning: restricted __le32 degrades to integer
This patch fixes every instance of the firmware version handling and makes sure it is endian safe and uses proper unaligned access.
--- drivers/bluetooth/ath3k.c | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-)
drivers/bluetooth/ath3k.c +16 -13
@@ -27,6 +27,7 @@#include <linux/device.h> #include <linux/firmware.h> #include <linux/usb.h> +#include <asm/unaligned.h> #include <net/bluetooth/bluetooth.h> #define VERSION "1.0"
@@ -50,12 +51,12 @@#define ATH3K_NAME_LEN 0xFFstruct ath3k_version { -unsigned int rom_version; -unsigned int build_version; -unsigned int ram_version; -unsigned char ref_clock; -unsigned char reserved[0x07 ]; -}; +__le32 rom_version; +__le32 build_version; +__le32 ram_version; +__u8 ref_clock; +__u8 reserved[7 ]; +} __packed;static struct usb_device_id ath3k_table[] = {/* Atheros AR3011 */
@@ -335,7 +336,8 @@ static int ath3k_load_patch(struct usb_device *udev)unsigned char fw_state;char filename[ATH3K_NAME_LEN ] = {0 };const struct firmware *firmware; -struct ath3k_version fw_version, pt_version; +struct ath3k_version fw_version; +__u32 pt_rom_version, pt_build_version;int ret; ret =ath3k_get_state (udev, &fw_state);
@@ -356,7 +358,7 @@ static int ath3k_load_patch(struct usb_device *udev) }snprintf (filename,ATH3K_NAME_LEN ,"ar3k/AthrBT_0x%08x.dfu" , -le32_to_cpu (fw_version.rom_version)); +le32_to_cpu (fw_version.rom_version)); ret =request_firmware (&firmware, filename, &udev->dev);if (ret <0 ) {
@@ -364,12 +366,13 @@ static int ath3k_load_patch(struct usb_device *udev)return ret; } - pt_version.rom_version = *(int *)(firmware->data + firmware->size -8 ); - pt_version.build_version = *(int *) - (firmware->data + firmware->size -4 ); + pt_rom_version =get_unaligned_le32 (firmware->data + + firmware->size -8 ); + pt_build_version =get_unaligned_le32 (firmware->data + + firmware->size -4 ); -if ((pt_version.rom_version != fw_version.rom_version) || - (pt_version.build_version <= fw_version.build_version)) { +if (pt_rom_version !=le32_to_cpu (fw_version.rom_version) || + pt_build_version <=le32_to_cpu (fw_version.build_version)) {BT_ERR ("Patch file version did not match with firmware" );release_firmware (firmware);return -EINVAL ;
Signature · 1 line
2.1.3
PATCH 28/206 Bluetooth: Add support for Broadcom device of Asus Z97-DELUXE motherboard
In reply to Jiri SlabyFrom: Marcel Holtmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c2aef6e8cbebd60f79555baeb9266e220f135a44 upstream.
The Asus Z97-DELUXE motherboard contains a Broadcom based Bluetooth controller on the USB bus. However vendor and product ID are listed as ASUSTek Computer.
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0b05 ProdID=17cf Rev= 1.12 S: Manufacturer=Broadcom Corp S: Product=BCM20702A0 S: SerialNumber=54271E910064 C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
--- drivers/bluetooth/btusb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/bluetooth/btusb.c +3 -0
@@ -114,6 +114,9 @@ static struct usb_device_id btusb_table[] = {/*Broadcom devices with vendor specific id */ { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) }, +/* ASUSTek Computer - Broadcom based */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01) }, +/* Belkin F8065bf - Broadcom based */ { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
Signature · 1 line
2.1.3
PATCH 29/206 Bluetooth: Fix crash in the Marvell driver initialization codepath
In reply to Jiri SlabyFrom: Anatol Pomozov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8500d791c458ccbbb3e2d3fa9a0320ffd5729069 upstream.
btmrvl_add_card() function calls kthread_run that might return error (e.g. if current thread is killed). If one tries to use the error value as a pointer then invalid memory access oops happens.
Check kthread_run() return value, if it is an error then release resources correctly.
TEST=boot computer with BT modules enabled. I see the error message that BT device initialization failed. Now kernel does not crash. Hint: to enable BT run 'rmmod btmrvl_sdio; modprobe btmrvl_sdio'
--- drivers/bluetooth/btmrvl_main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/bluetooth/btmrvl_main.c +5 -0
@@ -628,12 +628,17 @@ struct btmrvl_private *btmrvl_add_card(void *card)init_waitqueue_head (&priv->main_thread.wait_q); priv->main_thread.task =kthread_run (btmrvl_service_main_thread, &priv->main_thread,"btmrvl_main_service" ); +if (IS_ERR (priv->main_thread.task)) + goto err_thread; priv->btmrvl_dev.card = card; priv->btmrvl_dev.tx_dnld_rdy = true;return priv; +err_thread: +btmrvl_free_adapter (priv); + err_adapter:kfree (priv);
Signature · 1 line
2.1.3
PATCH 30/206 Bluetooth: ath3k: Add support for another AR3012 card
In reply to Jiri SlabyFrom: Sujith Manoharan <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit bd0fca1b2be8c96dfc391a2bc2ee4ce6970ae6af upstream.
T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=04ca ProdID=300b Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -85,6 +85,7 @@ static struct usb_device_id ath3k_table[] = { { USB_DEVICE(0x04CA, 0x3006) }, { USB_DEVICE(0x04CA, 0x3007) }, { USB_DEVICE(0x04CA, 0x3008) }, + { USB_DEVICE(0x04CA, 0x300b) }, { USB_DEVICE(0x13d3, 0x3362) }, { USB_DEVICE(0x0CF3, 0xE004) }, { USB_DEVICE(0x0CF3, 0xE005) },
@@ -128,6 +129,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
drivers/bluetooth/btusb.c +1 -0
@@ -162,6 +162,7 @@ static struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
Signature · 1 line
2.1.3
PATCH 31/206 Bluetooth: ath3k: Add support for a new AR3012 device
In reply to Jiri SlabyFrom: Sujith Manoharan <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 35580d223b6b04d9a570e4fe377c46a102413fe8 upstream.
T: Bus=02 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 9 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e05f Rev= 0.02
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -99,6 +99,7 @@ static struct usb_device_id ath3k_table[] = { { USB_DEVICE(0x13d3, 0x3402) }, { USB_DEVICE(0x0cf3, 0x3121) }, { USB_DEVICE(0x0cf3, 0xe003) }, + { USB_DEVICE(0x0489, 0xe05f) },/* Atheros AR5BBU12 with sflash firmware */ { USB_DEVICE(0x0489, 0xE02C) },
@@ -143,6 +144,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, /* Atheros AR5BBU22 with sflash firmware */ { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
drivers/bluetooth/btusb.c +1 -0
@@ -176,6 +176,7 @@ static struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, /* Atheros AR5BBU12 with sflash firmware */ { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
Signature · 1 line
2.1.3
PATCH 32/206 Bluetooth: Add support for Toshiba Bluetooth device [0930:0220]
In reply to Jiri SlabyFrom: Marco Piazza <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit bd0976dd3379e790b031cef7f477c58b82a65fc2 upstream.
This patch adds support for new Toshiba Bluetooth device.
T: Bus=05 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0930 ProdID=0220 Rev=00.02 C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -90,6 +90,7 @@ static struct usb_device_id ath3k_table[] = { { USB_DEVICE(0x0CF3, 0xE004) }, { USB_DEVICE(0x0CF3, 0xE005) }, { USB_DEVICE(0x0930, 0x0219) }, + { USB_DEVICE(0x0930, 0x0220) }, { USB_DEVICE(0x0489, 0xe057) }, { USB_DEVICE(0x13d3, 0x3393) }, { USB_DEVICE(0x0489, 0xe04e) },
@@ -135,6 +136,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
drivers/bluetooth/btusb.c +1 -0
@@ -167,6 +167,7 @@ static struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
Signature · 1 line
2.1.3
PATCH 33/206 Bluetooth: Enable Atheros 0cf3:311e for firmware upload
In reply to Jiri SlabyFrom: Oliver Neukum <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b131237ca3995edad9efc162d0bc959c3b1dddc2 upstream.
The device will bind to btusb without firmware, but with the original buggy firmware device discovery does not work. No devices are detected.
Device descriptor without firmware:
T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0cf3 ProdID=311e Rev= 0.01 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
with firmware:
T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0cf3 ProdID=311e Rev= 0.02 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -78,6 +78,7 @@ static struct usb_device_id ath3k_table[] = { { USB_DEVICE(0x0CF3, 0x3004) }, { USB_DEVICE(0x0CF3, 0x3008) }, { USB_DEVICE(0x0CF3, 0x311D) }, + { USB_DEVICE(0x0CF3, 0x311E) }, { USB_DEVICE(0x0CF3, 0x817a) }, { USB_DEVICE(0x13d3, 0x3375) }, { USB_DEVICE(0x04CA, 0x3004) },
@@ -124,6 +125,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311E), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
drivers/bluetooth/btusb.c +1 -0
@@ -155,6 +155,7 @@ static struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
Signature · 1 line
2.1.3
PATCH 34/206 Bluetooth: Add firmware update for Atheros 0cf3:311f
In reply to Jiri SlabyFrom: Oliver Neukum <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1e56f1eb2bbeab0ddc3a1e536d2a0065cfe4c131 upstream.
The device is not functional without firmware.
The device without firmware:
T: Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0cf3 ProdID=311f Rev=00.01 C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
The device with firmware:
T: Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 4 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0cf3 ProdID=3007 Rev=00.01 C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -79,6 +79,7 @@ static struct usb_device_id ath3k_table[] = { { USB_DEVICE(0x0CF3, 0x3008) }, { USB_DEVICE(0x0CF3, 0x311D) }, { USB_DEVICE(0x0CF3, 0x311E) }, + { USB_DEVICE(0x0CF3, 0x311F) }, { USB_DEVICE(0x0CF3, 0x817a) }, { USB_DEVICE(0x13d3, 0x3375) }, { USB_DEVICE(0x04CA, 0x3004) },
@@ -126,6 +127,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x311E), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311F), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
drivers/bluetooth/btusb.c +1 -0
@@ -156,6 +156,7 @@ static struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
Signature · 1 line
2.1.3
PATCH 35/206 Bluetooth: sort the list of IDs in the source code
In reply to Jiri SlabyFrom: Andy Shevchenko <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0b8800623d3f12dd40a039aa191d52bfa4eef5b4 upstream.
This will help to manage table of supported IDs.
There is no functional change.
--- drivers/bluetooth/ath3k.c | 82 +++++++++++++++++++++++------------------------ drivers/bluetooth/btusb.c | 54 +++++++++++++++---------------- 2 files changed, 68 insertions(+), 68 deletions(-)
drivers/bluetooth/ath3k.c +41 -41
@@ -63,53 +63,53 @@ static struct usb_device_id ath3k_table[] = { { USB_DEVICE(0x0CF3, 0x3000) },/* Atheros AR3011 with sflash firmware*/ + { USB_DEVICE(0x0489, 0xE027) }, + { USB_DEVICE(0x0489, 0xE03D) }, + { USB_DEVICE(0x0930, 0x0215) }, { USB_DEVICE(0x0CF3, 0x3002) }, { USB_DEVICE(0x0CF3, 0xE019) }, { USB_DEVICE(0x13d3, 0x3304) }, - { USB_DEVICE(0x0930, 0x0215) }, - { USB_DEVICE(0x0489, 0xE03D) }, - { USB_DEVICE(0x0489, 0xE027) },/* Atheros AR9285 Malbec with sflash firmware */ { USB_DEVICE(0x03F0, 0x311D) },/* Atheros AR3012 with sflash firmware*/ + { USB_DEVICE(0x0489, 0xe04d) }, + { USB_DEVICE(0x0489, 0xe04e) }, + { USB_DEVICE(0x0489, 0xe057) }, + { USB_DEVICE(0x0489, 0xe056) }, + { USB_DEVICE(0x0489, 0xe05f) }, + { USB_DEVICE(0x04c5, 0x1330) }, + { USB_DEVICE(0x04CA, 0x3004) }, + { USB_DEVICE(0x04CA, 0x3005) }, + { USB_DEVICE(0x04CA, 0x3006) }, + { USB_DEVICE(0x04CA, 0x3007) }, + { USB_DEVICE(0x04CA, 0x3008) }, + { USB_DEVICE(0x04CA, 0x300b) }, + { USB_DEVICE(0x0930, 0x0219) }, + { USB_DEVICE(0x0930, 0x0220) }, { USB_DEVICE(0x0CF3, 0x0036) }, { USB_DEVICE(0x0CF3, 0x3004) }, { USB_DEVICE(0x0CF3, 0x3008) }, { USB_DEVICE(0x0CF3, 0x311D) }, { USB_DEVICE(0x0CF3, 0x311E) }, { USB_DEVICE(0x0CF3, 0x311F) }, + { USB_DEVICE(0x0cf3, 0x3121) }, { USB_DEVICE(0x0CF3, 0x817a) }, - { USB_DEVICE(0x13d3, 0x3375) }, - { USB_DEVICE(0x04CA, 0x3004) }, - { USB_DEVICE(0x04CA, 0x3005) }, - { USB_DEVICE(0x04CA, 0x3006) }, - { USB_DEVICE(0x04CA, 0x3007) }, - { USB_DEVICE(0x04CA, 0x3008) }, - { USB_DEVICE(0x04CA, 0x300b) }, - { USB_DEVICE(0x13d3, 0x3362) }, + { USB_DEVICE(0x0cf3, 0xe003) }, { USB_DEVICE(0x0CF3, 0xE004) }, { USB_DEVICE(0x0CF3, 0xE005) }, - { USB_DEVICE(0x0930, 0x0219) }, - { USB_DEVICE(0x0930, 0x0220) }, - { USB_DEVICE(0x0489, 0xe057) }, + { USB_DEVICE(0x13d3, 0x3362) }, + { USB_DEVICE(0x13d3, 0x3375) }, { USB_DEVICE(0x13d3, 0x3393) }, - { USB_DEVICE(0x0489, 0xe04e) }, - { USB_DEVICE(0x0489, 0xe056) }, - { USB_DEVICE(0x0489, 0xe04d) }, - { USB_DEVICE(0x04c5, 0x1330) }, { USB_DEVICE(0x13d3, 0x3402) }, - { USB_DEVICE(0x0cf3, 0x3121) }, - { USB_DEVICE(0x0cf3, 0xe003) }, - { USB_DEVICE(0x0489, 0xe05f) },/* Atheros AR5BBU12 with sflash firmware */ { USB_DEVICE(0x0489, 0xE02C) },/* Atheros AR5BBU22 with sflash firmware */ - { USB_DEVICE(0x0489, 0xE03C) }, { USB_DEVICE(0x0489, 0xE036) }, + { USB_DEVICE(0x0489, 0xE03C) }, { } /* Terminating entry */ };
@@ -122,39 +122,39 @@ MODULE_DEVICE_TABLE(usb, ath3k_table);static struct usb_device_id ath3k_blist_tbl[] = {/* Atheros AR3012 with sflash firmware*/ + {USB_DEVICE (0x0489 ,0xe04e ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x0489 ,0xe04d ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x0489 ,0xe056 ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x0489 ,0xe057 ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x0489 ,0xe05f ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x04c5 ,0x1330 ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x04ca ,0x3004 ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x04ca ,0x3005 ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x04ca ,0x3006 ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x04ca ,0x3008 ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x04ca ,0x300b ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x0930 ,0x0219 ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x0930 ,0x0220 ), .driver_info =BTUSB_ATH3012 }, {USB_DEVICE (0x0CF3 ,0x0036 ), .driver_info =BTUSB_ATH3012 }, {USB_DEVICE (0x0cf3 ,0x3004 ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x04ca ,0x3007 ), .driver_info =BTUSB_ATH3012 }, {USB_DEVICE (0x0cf3 ,0x3008 ), .driver_info =BTUSB_ATH3012 }, {USB_DEVICE (0x0cf3 ,0x311D ), .driver_info =BTUSB_ATH3012 }, {USB_DEVICE (0x0cf3 ,0x311E ), .driver_info =BTUSB_ATH3012 }, {USB_DEVICE (0x0cf3 ,0x311F ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x0cf3 ,0x3121 ), .driver_info =BTUSB_ATH3012 }, {USB_DEVICE (0x0CF3 ,0x817a ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x13d3 ,0x3375 ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x04ca ,0x3004 ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x04ca ,0x3005 ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x04ca ,0x3006 ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x04ca ,0x3007 ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x04ca ,0x3008 ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x04ca ,0x300b ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x13d3 ,0x3362 ), .driver_info =BTUSB_ATH3012 }, {USB_DEVICE (0x0cf3 ,0xe004 ), .driver_info =BTUSB_ATH3012 }, {USB_DEVICE (0x0cf3 ,0xe005 ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x0930 ,0x0219 ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x0930 ,0x0220 ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x0489 ,0xe057 ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x0cf3 ,0xe003 ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x13d3 ,0x3362 ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x13d3 ,0x3375 ), .driver_info =BTUSB_ATH3012 }, {USB_DEVICE (0x13d3 ,0x3393 ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x0489 ,0xe04e ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x0489 ,0xe056 ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x0489 ,0xe04d ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x04c5 ,0x1330 ), .driver_info =BTUSB_ATH3012 }, {USB_DEVICE (0x13d3 ,0x3402 ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x0cf3 ,0x3121 ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x0cf3 ,0xe003 ), .driver_info =BTUSB_ATH3012 }, - {USB_DEVICE (0x0489 ,0xe05f ), .driver_info =BTUSB_ATH3012 },/* Atheros AR5BBU22 with sflash firmware */ - {USB_DEVICE (0x0489 ,0xE03C ), .driver_info =BTUSB_ATH3012 }, {USB_DEVICE (0x0489 ,0xE036 ), .driver_info =BTUSB_ATH3012 }, + {USB_DEVICE (0x0489 ,0xE03C ), .driver_info =BTUSB_ATH3012 }, { }/* Terminating entry */ };
drivers/bluetooth/btusb.c +27 -27
101 lines not on this page · raw message
Signature · 1 line
2.1.3
PATCH 36/206 Bluetooth: append new supported device to the list [0b05:17d0]
In reply to Jiri SlabyFrom: Andy Shevchenko <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a735f9e22432899cee188d167966782c29246390 upstream.
The device found on Asus Z87 Expert motherboard requires firmware to work correctly.
T: Bus=03 Lev=01 Prnt=01 Port=03 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0b05 ProdID=17d0 Rev=00.02 C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -88,6 +88,7 @@ static struct usb_device_id ath3k_table[] = { { USB_DEVICE(0x04CA, 0x300b) }, { USB_DEVICE(0x0930, 0x0219) }, { USB_DEVICE(0x0930, 0x0220) }, + { USB_DEVICE(0x0b05, 0x17d0) }, { USB_DEVICE(0x0CF3, 0x0036) }, { USB_DEVICE(0x0CF3, 0x3004) }, { USB_DEVICE(0x0CF3, 0x3008) },
@@ -135,6 +136,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
drivers/bluetooth/btusb.c +1 -0
@@ -165,6 +165,7 @@ static struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
Signature · 1 line
2.1.3
PATCH 37/206 Bluetooth: Add support for Acer [13D3:3432]
In reply to Jiri SlabyFrom: Anantha Krishnan <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit fa2f1394fe9c1a217213f02df77812701de6362f upstream.
Add support for the QCA6174 chip.
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 30 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=13d3 ProdID=3432 Rev=00.02
C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -104,6 +104,7 @@ static struct usb_device_id ath3k_table[] = { { USB_DEVICE(0x13d3, 0x3375) }, { USB_DEVICE(0x13d3, 0x3393) }, { USB_DEVICE(0x13d3, 0x3402) }, + { USB_DEVICE(0x13d3, 0x3432) },/* Atheros AR5BBU12 with sflash firmware */ { USB_DEVICE(0x0489, 0xE02C) },
@@ -153,6 +154,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, /* Atheros AR5BBU22 with sflash firmware */ { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
drivers/bluetooth/btusb.c +1 -0
@@ -181,6 +181,7 @@ static struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, /* Atheros AR5BBU12 with sflash firmware */ { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
Signature · 1 line
2.1.3
PATCH 38/206 Add a new PID/VID 0227/0930 for AR3012.
In reply to Jiri SlabyFrom: Vincent Zwanenburg <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 89d2975fa06e66ea0d3665d91f799fb1ce4b8bad upstream.
usb devices info:
T: Bus=01 Lev=02 Prnt=05 Port=00 Cnt=01 Dev#= 20 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0930 ProdID=0227 Rev= 0.02 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
--- drivers/bluetooth/ath3k.c | 2 ++ drivers/bluetooth/btusb.c | 1 + 2 files changed, 3 insertions(+)
drivers/bluetooth/ath3k.c +2 -0
@@ -88,6 +88,7 @@ static struct usb_device_id ath3k_table[] = { { USB_DEVICE(0x04CA, 0x300b) }, { USB_DEVICE(0x0930, 0x0219) }, { USB_DEVICE(0x0930, 0x0220) }, + { USB_DEVICE(0x0930, 0x0227) }, { USB_DEVICE(0x0b05, 0x17d0) }, { USB_DEVICE(0x0CF3, 0x0036) }, { USB_DEVICE(0x0CF3, 0x3004) },
@@ -137,6 +138,7 @@ static struct usb_device_id ath3k_blist_tbl[] = { { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
drivers/bluetooth/btusb.c +1 -0
@@ -165,6 +165,7 @@ static struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
Signature · 1 line
2.1.3
PATCH 39/206 Input: xpad - change D-PAD mapping on Razer devices
In reply to Jiri SlabyFrom: Thomaz de Oliveira dos Reis <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit dbb48007a016f48f7fc19d8af753bae8b9c15816 upstream.
When using Razer Onza controller the dpad doesn't work in many games because D-PAD was mapped to buttons (useful for dance pads) and not to HAT0X/Y axis.
ers who really want to have it mapped to buttons can restore previous behavior by using 'dpad_to_buttons' module option.
--- drivers/input/joystick/xpad.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/input/joystick/xpad.c +2 -2
@@ -166,8 +166,8 @@ static const struct xpad_device { { 0x1430, 0x4748, "RedOctane Guitar Hero X-plorer", 0, XTYPE_XBOX360 }, { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 }, - { 0x1689, 0xfd00, "Razer Onza Tournament Edition", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x1689, 0xfd01, "Razer Onza Classic Edition", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x1689, 0xfd00, "Razer Onza Tournament Edition", 0, XTYPE_XBOX360 }, + { 0x1689, 0xfd01, "Razer Onza Classic Edition", 0, XTYPE_XBOX360 }, { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 }, { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, { 0x1bad, 0xf016, "Mad Catz Xbox 360 Controller", 0, XTYPE_XBOX360 },
Signature · 1 line
2.1.3
PATCH 40/206 Input: xpad - add new USB IDs for Logitech F310 and F710
In reply to Jiri SlabyFrom: Petr Sebor <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8e2f2325b73f3e5e46ecffd291556f33b8e3f8c9 upstream.
This enables the rumble force feedback on the F710 unit since it is no longer treated as XTYPE_UNKNOWN type.
--- drivers/input/joystick/xpad.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/input/joystick/xpad.c +2 -0
@@ -125,6 +125,8 @@ static const struct xpad_device { { 0x045e, 0x0291, "Xbox 360 Wireless Receiver (XBOX)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, { 0x045e, 0x0719, "Xbox 360 Wireless Receiver", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX }, + { 0x046d, 0xc21d, "Logitech Gamepad F310", 0, XTYPE_XBOX360 }, + { 0x046d, 0xc21f, "Logitech Gamepad F710", 0, XTYPE_XBOX360 }, { 0x046d, 0xc242, "Logitech Chillstream Controller", 0, XTYPE_XBOX360 }, { 0x046d, 0xca84, "Logitech Xbox Cordless Controller", 0, XTYPE_XBOX }, { 0x046d, 0xca88, "Logitech Compact Controller for Xbox", 0, XTYPE_XBOX },
Signature · 1 line
2.1.3
PATCH 41/206 Input: xpad - add VID/PID for Razer Sabertooth
In reply to Jiri SlabyFrom: Frank Razenberg <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a7b447380c5c974c740437af82793e450f47304d upstream.
The xpad driver recognizes Razer Sabertooth controllers as generic xbox controller, while it is really a 360 controller. This patch adds pid/vid mappings for the controller so that it is correctly recognized.
--- drivers/input/joystick/xpad.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/joystick/xpad.c +1 -0
@@ -170,6 +170,7 @@ static const struct xpad_device { { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 }, { 0x1689, 0xfd00, "Razer Onza Tournament Edition", 0, XTYPE_XBOX360 }, { 0x1689, 0xfd01, "Razer Onza Classic Edition", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 }, { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 }, { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, { 0x1bad, 0xf016, "Mad Catz Xbox 360 Controller", 0, XTYPE_XBOX360 },
Signature · 1 line
2.1.3
PATCH 42/206 Input: xpad - sync device IDs with xboxdrv
In reply to Jiri SlabyFrom: Benjamin Valentin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f554f619b7041e388d46395b1e30b151925a7797 upstream.
The userspace xboxdrv driver knows some more device ids than the kernel. This patch adds the missing xbox gamepads from [1] to xpad.c
[1] https://github.com/Grumbel/xboxdrv/blob/master/src/xpad_device.cpp
--- drivers/input/joystick/xpad.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+)
drivers/input/joystick/xpad.c +33 -0
@@ -125,7 +125,9 @@ static const struct xpad_device { { 0x045e, 0x0291, "Xbox 360 Wireless Receiver (XBOX)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, { 0x045e, 0x0719, "Xbox 360 Wireless Receiver", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX }, + { 0x044f, 0xb326, "Thrustmaster Gamepad GP XID", 0, XTYPE_XBOX360 }, { 0x046d, 0xc21d, "Logitech Gamepad F310", 0, XTYPE_XBOX360 }, + { 0x046d, 0xc21e, "Logitech Gamepad F510", 0, XTYPE_XBOX360 }, { 0x046d, 0xc21f, "Logitech Gamepad F710", 0, XTYPE_XBOX360 }, { 0x046d, 0xc242, "Logitech Chillstream Controller", 0, XTYPE_XBOX360 }, { 0x046d, 0xca84, "Logitech Xbox Cordless Controller", 0, XTYPE_XBOX },
@@ -139,10 +141,17 @@ static const struct xpad_device { { 0x0738, 0x4540, "Mad Catz Beat Pad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, { 0x0738, 0x4556, "Mad Catz Lynx Wireless Controller", 0, XTYPE_XBOX }, { 0x0738, 0x4716, "Mad Catz Wired Xbox 360 Controller", 0, XTYPE_XBOX360 }, + { 0x0738, 0x4718, "Mad Catz Street Fighter IV FightStick SE", 0, XTYPE_XBOX360 }, + { 0x0738, 0x4726, "Mad Catz Xbox 360 Controller", 0, XTYPE_XBOX360 }, { 0x0738, 0x4728, "Mad Catz Street Fighter IV FightPad", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x0738, 0x4738, "Mad Catz Wired Xbox 360 Controller (SFIV)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x0738, 0x4740, "Mad Catz Beat Pad", 0, XTYPE_XBOX360 }, { 0x0738, 0x6040, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, + { 0x0738, 0xb726, "Mad Catz Xbox controller - MW2", 0, XTYPE_XBOX360 }, { 0x0738, 0xbeef, "Mad Catz JOYTECH NEO SE Advanced GamePad", XTYPE_XBOX360 }, + { 0x0738, 0xcb02, "Saitek Cyborg Rumble Pad - PC/Xbox 360", 0, XTYPE_XBOX360 }, + { 0x0738, 0xcb03, "Saitek P3200 Rumble Pad - PC/Xbox 360", 0, XTYPE_XBOX360 }, + { 0x0738, 0xf738, "Super SFIV FightStick TE S", 0, XTYPE_XBOX360 }, { 0x0c12, 0x8802, "Zeroplus Xbox Controller", 0, XTYPE_XBOX }, { 0x0c12, 0x8809, "RedOctane Xbox Dance Pad", DANCEPAD_MAP_CONFIG, XTYPE_XBOX }, { 0x0c12, 0x880a, "Pelican Eclipse PL-2023", 0, XTYPE_XBOX },
@@ -155,29 +164,50 @@ static const struct xpad_device { { 0x0e6f, 0x0005, "Eclipse wireless Controller", 0, XTYPE_XBOX }, { 0x0e6f, 0x0006, "Edge wireless Controller", 0, XTYPE_XBOX }, { 0x0e6f, 0x0105, "HSM3 Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x0e6f, 0x0113, "Afterglow AX.1 Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, { 0x0e6f, 0x0201, "Pelican PL-3601 'TSZ' Wired Xbox 360 Controller", 0, XTYPE_XBOX360 }, { 0x0e6f, 0x0213, "Afterglow Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, + { 0x0e6f, 0x021f, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, + { 0x0e6f, 0x0301, "Logic3 Controller", 0, XTYPE_XBOX360 }, + { 0x0e6f, 0x0401, "Logic3 Controller", 0, XTYPE_XBOX360 }, { 0x0e8f, 0x0201, "SmartJoy Frag Xpad/PS2 adaptor", 0, XTYPE_XBOX }, + { 0x0e8f, 0x3008, "Generic xbox control (dealextreme)", 0, XTYPE_XBOX }, + { 0x0f0d, 0x000a, "Hori Co. DOA4 FightStick", 0, XTYPE_XBOX360 }, { 0x0f0d, 0x000d, "Hori Fighting Stick EX2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x0f0d, 0x0016, "Hori Real Arcade Pro.EX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX }, { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX }, { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX }, { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 }, { 0x12ab, 0x8809, "Xbox DDR dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, { 0x1430, 0x4748, "RedOctane Guitar Hero X-plorer", 0, XTYPE_XBOX360 }, { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 }, + { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 }, + { 0x162e, 0xbeef, "Joytech Neo-Se Take2", 0, XTYPE_XBOX360 }, { 0x1689, 0xfd00, "Razer Onza Tournament Edition", 0, XTYPE_XBOX360 }, { 0x1689, 0xfd01, "Razer Onza Classic Edition", 0, XTYPE_XBOX360 }, { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 }, { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 }, { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, { 0x1bad, 0xf016, "Mad Catz Xbox 360 Controller", 0, XTYPE_XBOX360 }, + { 0x1bad, 0xf023, "MLG Pro Circuit Controller (Xbox)", 0, XTYPE_XBOX360 }, { 0x1bad, 0xf028, "Street Fighter IV FightPad", 0, XTYPE_XBOX360 }, + { 0x1bad, 0xf038, "Street Fighter IV FightStick TE", 0, XTYPE_XBOX360 }, + { 0x1bad, 0xf900, "Harmonix Xbox 360 Controller", 0, XTYPE_XBOX360 }, { 0x1bad, 0xf901, "Gamestop Xbox 360 Controller", 0, XTYPE_XBOX360 }, { 0x1bad, 0xf903, "Tron Xbox 360 controller", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5000, "Razer Atrox Arcade Stick", 0, XTYPE_XBOX360 }, { 0x24c6, 0x5300, "PowerA MINI PROEX Controller", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5303, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5500, "Hori XBOX 360 EX 2 with Turbo", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5501, "Hori Real Arcade Pro VX-SA", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5506, "Hori SOULCALIBUR V Stick", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5b02, "Thrustmaster, Inc. GPX Controller", 0, XTYPE_XBOX360 }, { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX }, { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN } };
@@ -261,6 +291,9 @@ static struct usb_device_id xpad_table[] = {XPAD_XBOX360_VENDOR (0x0f0d ),/* Hori Controllers */ XPAD_XBOX360_VENDOR (0x1689 ),/* Razer Onza */ XPAD_XBOX360_VENDOR (0x24c6 ),/* PowerA Controllers */ +XPAD_XBOX360_VENDOR (0x1532 ),/* Razer Sabertooth */ +XPAD_XBOX360_VENDOR (0x15e4 ),/* Numark X-Box 360 controllers */ + XPAD_XBOX360_VENDOR(0x162e), /* Joytech X-Box 360 controllers */ { } };
Signature · 1 line
2.1.3
PATCH 43/206 Input: xpad - add USB ID for Thrustmaster Ferrari 458 Racing Wheel
In reply to Jiri SlabyFrom: Tommi Rantala <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4b54625822eb7a4eae9c5b8c890b6c4dc001b895 upstream.
Add the USB ID for the Xbox 360 Thrustmaster Ferrari 458 Racing Wheel.
--- drivers/input/joystick/xpad.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/joystick/xpad.c +1 -0
@@ -208,6 +208,7 @@ static const struct xpad_device { { 0x24c6, 0x5501, "Hori Real Arcade Pro VX-SA", 0, XTYPE_XBOX360 }, { 0x24c6, 0x5506, "Hori SOULCALIBUR V Stick", 0, XTYPE_XBOX360 }, { 0x24c6, 0x5b02, "Thrustmaster, Inc. GPX Controller", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 }, { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX }, { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN } };
Signature · 1 line
2.1.3
PATCH 44/206 Input: serio - avoid negative serio device numbers
In reply to Jiri SlabyFrom: Richard Leitner <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0224ec9e9f111b1c39ec00a10de4858061b4afea upstream.
Fix the format string for serio device name generation to avoid negative device numbers when the id exceeds the maximum signed integer value.
--- drivers/input/serio/serio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/input/serio/serio.c +2 -2
@@ -506,8 +506,8 @@ static void serio_init_port(struct serio *serio)spin_lock_init (&serio->lock);mutex_init (&serio->drv_mutex);device_initialize (&serio->dev); -dev_set_name (&serio->dev,"serio%ld" , - (long )atomic_inc_return (&serio_no) -1 ); +dev_set_name (&serio->dev,"serio%lu" , + (unsigned long )atomic_inc_return (&serio_no) -1 ); serio->dev.bus = &serio_bus; serio->dev.release = serio_release_port; serio->dev.groups = serio_device_attr_groups;
Signature · 1 line
2.1.3
PATCH 45/206 ttusb-dec: buffer overflow in ioctl
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f2e323ec96077642d397bb1c355def536d489d16 upstream.
We need to add a limit check here so we don't overflow the buffer.
--- drivers/media/usb/ttusb-dec/ttusbdecfe.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/usb/ttusb-dec/ttusbdecfe.c +3 -0
@@ -156,6 +156,9 @@ static int ttusbdecfe_dvbs_diseqc_send_master_cmd(struct dvb_frontend* fe, struc0x00 ,0x00 ,0x00 ,0x00 , 0x00, 0x00 }; +if (cmd->msg_len >sizeof (b) -4 ) +return -EINVAL ; +memcpy (&b[4 ], cmd->msg, cmd->msg_len); state->config->send_command(fe, 0x72,
Signature · 1 line
2.1.3
PATCH 46/206 mmc: sdhci-pci: add Intel Merrifield support
In reply to Jiri SlabyFrom: David Cohen <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8776a165d152d57a3a58895d55204614abe93d7f upstream.
Implement initial SDHCI Intel Merrifield support. This patch is based on previous one from Yunpeng Gao <[email protected]>.
--- drivers/mmc/host/sdhci-pci.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/mmc/host/sdhci-pci.c +30 -0
@@ -37,6 +37,7 @@#define PCI_DEVICE_ID_INTEL_BYT_SDIO 0x0f15#define PCI_DEVICE_ID_INTEL_BYT_SD 0x0f16#define PCI_DEVICE_ID_INTEL_BYT_EMMC2 0x0f50 +#define PCI_DEVICE_ID_INTEL_MRFL_MMC 0x1190/* * PCI registers
@@ -359,6 +360,28 @@ static const struct sdhci_pci_fixes sdhci_intel_byt_sd = { .own_cd_for_runtime_pm = true, }; +/* Define Host controllers for Intel Merrifield platform */ +#define INTEL_MRFL_EMMC_0 0 +#define INTEL_MRFL_EMMC_1 1 + +static int intel_mrfl_mmc_probe_slot (struct sdhci_pci_slot *slot) +{ +if ((PCI_FUNC (slot->chip->pdev->devfn) !=INTEL_MRFL_EMMC_0 ) && + (PCI_FUNC (slot->chip->pdev->devfn) !=INTEL_MRFL_EMMC_1 )) +/* SD support is not ready yet */ +return -ENODEV ; + + slot->host->mmc->caps |=MMC_CAP_8_BIT_DATA |MMC_CAP_NONREMOVABLE | +MMC_CAP_1_8V_DDR ; + +return 0 ; +} + +static const struct sdhci_pci_fixes sdhci_intel_mrfl_mmc = { + .quirks =SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC , + .probe_slot = intel_mrfl_mmc_probe_slot, +}; +/* O2Micro extra registers */ #define O2_SD_LOCK_WP 0xD3#define O2_SD_MULTI_VCC3V 0xEE
@@ -943,6 +966,13 @@ static const struct pci_device_id pci_ids[] = { }, { + .vendor = PCI_VENDOR_ID_INTEL, + .device = PCI_DEVICE_ID_INTEL_MRFL_MMC, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .driver_data = (kernel_ulong_t)&sdhci_intel_mrfl_mmc, + }, + { .vendor = PCI_VENDOR_ID_O2, .device = PCI_DEVICE_ID_O2_8120, .subvendor = PCI_ANY_ID,
Signature · 1 line
2.1.3
PATCH 47/206 mmc: sdhci-pci: Add SDIO/MMC device ID support for Intel Clovertrail
In reply to Jiri SlabyFrom: Eric Ernst <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d052068a0ba43273eb9cfe32460e9445ef75fdc5 upstream.
This patch adds intel_mid clovertrail SDIO and eMMC device IDs to the sdhci-pci driver.
--- drivers/mmc/host/sdhci-pci.c | 46 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+)
drivers/mmc/host/sdhci-pci.c +46 -0
@@ -38,6 +38,11 @@#define PCI_DEVICE_ID_INTEL_BYT_SD 0x0f16#define PCI_DEVICE_ID_INTEL_BYT_EMMC2 0x0f50#define PCI_DEVICE_ID_INTEL_MRFL_MMC 0x1190 +#define PCI_DEVICE_ID_INTEL_CLV_SDIO0 0x08f9 +#define PCI_DEVICE_ID_INTEL_CLV_SDIO1 0x08fa +#define PCI_DEVICE_ID_INTEL_CLV_SDIO2 0x08fb +#define PCI_DEVICE_ID_INTEL_CLV_EMMC0 0x08e5 +#define PCI_DEVICE_ID_INTEL_CLV_EMMC1 0x08e6/* * PCI registers
@@ -965,6 +970,47 @@ static const struct pci_device_id pci_ids[] = { .driver_data = (kernel_ulong_t)&sdhci_intel_byt_emmc, }, + + { + .vendor = PCI_VENDOR_ID_INTEL, + .device = PCI_DEVICE_ID_INTEL_CLV_SDIO0, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .driver_data = (kernel_ulong_t)&sdhci_intel_mfd_sd, + }, + + { + .vendor = PCI_VENDOR_ID_INTEL, + .device = PCI_DEVICE_ID_INTEL_CLV_SDIO1, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .driver_data = (kernel_ulong_t)&sdhci_intel_mfd_sdio, + }, + + { + .vendor = PCI_VENDOR_ID_INTEL, + .device = PCI_DEVICE_ID_INTEL_CLV_SDIO2, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .driver_data = (kernel_ulong_t)&sdhci_intel_mfd_sdio, + }, + + { + .vendor = PCI_VENDOR_ID_INTEL, + .device = PCI_DEVICE_ID_INTEL_CLV_EMMC0, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .driver_data = (kernel_ulong_t)&sdhci_intel_mfd_emmc, + }, + + { + .vendor = PCI_VENDOR_ID_INTEL, + .device = PCI_DEVICE_ID_INTEL_CLV_EMMC1, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .driver_data = (kernel_ulong_t)&sdhci_intel_mfd_emmc, + }, + { .vendor = PCI_VENDOR_ID_INTEL, .device = PCI_DEVICE_ID_INTEL_MRFL_MMC,
Signature · 1 line
2.1.3
PATCH 48/206 wireless: rt2x00: rt2800usb: add new devices
In reply to Jiri SlabyFrom: Xose Vazquez Perez <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 274dede8c52036a1849ea970fab8d185fb0dce2b upstream.
0411,0241 RT5572 BUFFALO WI-U2-300D Wireless LAN Adapter 0789,0170 RT3572 Logitec LAN-W300AN/U2 0846,9013 RT3573 NETGEAR Adaptador USB Inalambrico Movistar 0df6,006e RT3573 Sitecom WiFi USB adapter N900 2001,3c1f RT3573 D-Link DWA-162 Wireless N900 Dual Band Adapter 2001,3c20 RT5372 D-Link DWA-140 Wireless N USB Adapter(rev.D) 2001,3c21 RT5572 D-Link DWA-160 Xtreme N Dual Band USB Adapter(rev.C) 2001,3c22 RT5372 D-Link DWA-132 Wireless N USB Adapter(rev.B) 2001,3c23 RT5372 D-Link GO-USB-N300 Wireless N Easy USB Adapter 2019,ab29 ? Planex GW-USMirco300 20f4,724a RT5572 TRENDnet N600 Wireless Dual Band USB Adapter
--- drivers/net/wireless/rt2x00/rt2800usb.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
drivers/net/wireless/rt2x00/rt2800usb.c +16 -1
@@ -1180,6 +1180,8 @@ static struct usb_device_id rt2800usb_device_table[] = {/* Linksys */ { USB_DEVICE(0x13b1, 0x002f) }, { USB_DEVICE(0x1737, 0x0079) }, +/* Logitec */ + { USB_DEVICE(0x0789, 0x0170) },/* Ralink */ { USB_DEVICE(0x148f, 0x3572) },/* Sitecom */
@@ -1203,6 +1205,8 @@ static struct usb_device_id rt2800usb_device_table[] = { { USB_DEVICE(0x050d, 0x1103) },/* Cameo */ { USB_DEVICE(0x148f, 0xf301) }, +/* D-Link */ + { USB_DEVICE(0x2001, 0x3c1f) },/* Edimax */ { USB_DEVICE(0x7392, 0x7733) },/* Hawking */
@@ -1216,6 +1220,7 @@ static struct usb_device_id rt2800usb_device_table[] = { { USB_DEVICE(0x0789, 0x016b) },/* NETGEAR */ { USB_DEVICE(0x0846, 0x9012) }, + { USB_DEVICE(0x0846, 0x9013) }, { USB_DEVICE(0x0846, 0x9019) },/* Planex */ { USB_DEVICE(0x2019, 0xed19) },
@@ -1224,6 +1229,7 @@ static struct usb_device_id rt2800usb_device_table[] = { /* Sitecom */ { USB_DEVICE(0x0df6, 0x0067) }, { USB_DEVICE(0x0df6, 0x006a) }, + { USB_DEVICE(0x0df6, 0x006e) }, /* ZyXEL */ { USB_DEVICE(0x0586, 0x3421) }, #endif
@@ -1240,6 +1246,9 @@ static struct usb_device_id rt2800usb_device_table[] = { { USB_DEVICE(0x2001, 0x3c1c) }, { USB_DEVICE(0x2001, 0x3c1d) }, { USB_DEVICE(0x2001, 0x3c1e) }, + { USB_DEVICE(0x2001, 0x3c20) }, + { USB_DEVICE(0x2001, 0x3c22) }, + { USB_DEVICE(0x2001, 0x3c23) },/* LG innotek */ { USB_DEVICE(0x043e, 0x7a22) }, { USB_DEVICE(0x043e, 0x7a42) },
@@ -1262,12 +1271,17 @@ static struct usb_device_id rt2800usb_device_table[] = { { USB_DEVICE(0x043e, 0x7a32) }, /* AVM GmbH */ { USB_DEVICE(0x057c, 0x8501) }, - /* D-Link DWA-160-B2 */ + /* Buffalo */ + { USB_DEVICE(0x0411, 0x0241) }, + /* D-Link */ { USB_DEVICE(0x2001, 0x3c1a) }, + { USB_DEVICE(0x2001, 0x3c21) }, /* Proware */ { USB_DEVICE(0x043e, 0x7a13) }, /* Ralink */ { USB_DEVICE(0x148f, 0x5572) }, + /* TRENDnet */ + { USB_DEVICE(0x20f4, 0x724a) }, #endif #ifdef CONFIG_RT2800USB_UNKNOWN /*
@@ -1337,6 +1351,7 @@ static struct usb_device_id rt2800usb_device_table[] = { { USB_DEVICE(0x1d4d, 0x0010) },/* Planex */ { USB_DEVICE(0x2019, 0xab24) }, + { USB_DEVICE(0x2019, 0xab29) },/* Qcom */ { USB_DEVICE(0x18e8, 0x6259) },/* RadioShack */
Signature · 1 line
2.1.3
PATCH 49/206 rt2x00: rt2800usb: mark D-Link DWA-137 as supported
In reply to Jiri SlabyFrom: Roman Dubtsov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7f6d740753ff0d29a330b06eb3efa0dfc791bbba upstream.
--- drivers/net/wireless/rt2x00/rt2800usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/rt2x00/rt2800usb.c +1 -0
@@ -992,6 +992,7 @@ static struct usb_device_id rt2800usb_device_table[] = { { USB_DEVICE(0x07d1, 0x3c15) }, { USB_DEVICE(0x07d1, 0x3c16) }, { USB_DEVICE(0x07d1, 0x3c17) }, + { USB_DEVICE(0x2001, 0x3317) }, { USB_DEVICE(0x2001, 0x3c1b) },/* Draytek */ { USB_DEVICE(0x07fa, 0x7712) },
Signature · 1 line
2.1.3
PATCH 50/206 crypto: more robust crypto_memneq
In reply to Jiri SlabyFrom: Cesar Eduardo Barros <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit fe8c8a126806fea4465c43d62a1f9d273a572bf5 upstream.
[Only use the compiler.h portion of this patch, to get the OPTIMIZER_HIDE_VAR() macro, which we need for other -stable patches
- gregkh]
Disabling compiler optimizations can be fragile, since a new optimization could be added to -O0 or -Os that breaks the assumptions the code is making.
Instead of disabling compiler optimizations, use a dummy inline assembly (based on RELOC_HIDE) to block the problematic kinds of optimization, while still allowing other optimizations to be applied to the code.
The dummy inline assembly is added after every OR, and has the accumulator variable as its input and output. The compiler is forced to assume that the dummy inline assembly could both depend on the accumulator variable and change the accumulator variable, so it is forced to compute the value correctly before the inline assembly, and cannot assume anything about its value after the inline assembly.
This change should be enough to make crypto_memneq work correctly (with data-independent timing) even if it is inlined at its call sites. That can be done later in a followup patch.
Compile-tested on x86_64.
--- include/linux/compiler-gcc.h | 3 +++ include/linux/compiler-intel.h | 7 +++++++ include/linux/compiler.h | 4 ++++ 3 files changed, 14 insertions(+)
include/linux/compiler-gcc.h +3 -0
@@ -37,6 +37,9 @@ __asm__ ("" :"=r" (__ptr) :"0" (ptr)); \ (typeof(ptr)) (__ptr + (off)); }) +/* Make the optimizer believe the variable can be manipulated arbitrarily. */ +#define OPTIMIZER_HIDE_VAR (var) __asm__ ("" : "=r" (var) : "0" (var)) +#ifdef __CHECKER__#define __must_be_array (arr) 0#else
include/linux/compiler-intel.h +7 -0
@@ -15,6 +15,7 @@*/ #undef barrier#undef RELOC_HIDE +#undef OPTIMIZER_HIDE_VAR#define barrier () __memory_barrier()
@@ -23,6 +24,12 @@ __ptr = (unsigned long ) (ptr); \ (typeof(ptr)) (__ptr + (off)); }) +/* This should act as an optimization barrier on var. +* Given that this compiler does not have inline assembly, a compiler barrier +* is the best we can do. +*/ +#define OPTIMIZER_HIDE_VAR (var) barrier() +/* Intel ECC compiler doesn't support __builtin_types_compatible_p() */ #define __must_be_array (a) 0
include/linux/compiler.h +4 -0
@@ -170,6 +170,10 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect); (typeof(ptr)) (__ptr + (off)); })#endif +#ifndef OPTIMIZER_HIDE_VAR +#define OPTIMIZER_HIDE_VAR (var) barrier() +#endif +/* Not-quite-unique ID. */ #ifndef __UNIQUE_ID# define __UNIQUE_ID (prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __LINE__)
Signature · 1 line
2.1.3
PATCH 51/206 regmap: fix kernel hang on regmap_bulk_write with zero val_count.
In reply to Jiri SlabyFrom: Quentin Casasnovas <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
If val_count is zero we return -EINVAL with map->lock_arg locked, which will deadlock the kernel next time we try to acquire this lock.
In 3.12, this was introduced by a0b8d8d906d267987d507138003048c5fdf774 ("regmap: fix possible ZERO_SIZE_PTR pointer dereferencing error.") which improperly back-ported d6b41cb06044a7d895db82bdd54f6e4219970510.
This issue was found during review of Ubuntu Trusty 3.13.0-40.68 kernel to prepare Ksplice rebootless updates.
--- drivers/base/regmap/regmap.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/base/regmap/regmap.c +4 -2
@@ -1403,8 +1403,10 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val,if (val_bytes ==1 ) { wval = (void *)val; }else { -if (!val_count) -return -EINVAL ; +if (!val_count) { + ret = -EINVAL ; + goto out; + } wval =kmemdup (val, val_count * val_bytes,GFP_KERNEL );if (!wval) {
Signature · 1 line
2.1.3
PATCH 52/206 tracing/syscalls: Ignore numbers outside NR_syscalls' range
In reply to Jiri SlabyFrom: Rabin Vincent <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 086ba77a6db00ed858ff07451bedee197df868c9 upstream.
ARM has some private syscalls (for example, set_tls(2)) which lie outside the range of NR_syscalls. If any of these are called while syscall tracing is being performed, out-of-bounds array access will occur in the ftrace and perf sys_{enter,exit} handlers.
# trace-cmd record -e raw_syscalls:* true && trace-cmd report ... true-653 [000] 384.675777: sys_enter: NR 192 (0, 1000, 3, 4000022, ffffffff, 0) true-653 [000] 384.675812: sys_exit: NR 192 = 1995915264 true-653 [000] 384.675971: sys_enter: NR 983045 (76f74480, 76f74000, 76f74b28, 76f74480, 76f76f74, 1) true-653 [000] 384.675988: sys_exit: NR 983045 = 0 ...
# trace-cmd record -e syscalls:* true [ 17.289329] Unable to handle kernel paging request at virtual address aaaaaace [ 17.289590] pgd = 9e71c000 [ 17.289696] [aaaaaace] *pgd=00000000 [ 17.289985] Internal error: Oops: 5 [#1] PREEMPT SMP ARM [ 17.290169] Modules linked in: [ 17.290391] CPU: 0 PID: 704 Comm: true Not tainted 3.18.0-rc2+ #21 [ 17.290585] task: 9f4dab00 ti: 9e710000 task.ti: 9e710000 [ 17.290747] PC is at ftrace_syscall_enter+0x48/0x1f8 [ 17.290866] LR is at syscall_trace_enter+0x124/0x184
Fix this by ignoring out-of-NR_syscalls-bounds syscall numbers.
Commit cd0980fc8add "tracing: Check invalid syscall nr while tracing syscalls" added the check for less than zero, but it should have also checked for greater than NR_syscalls.
--- kernel/trace/trace_syscalls.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/trace/trace_syscalls.c +4 -4
@@ -312,7 +312,7 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)int size; syscall_nr =trace_get_syscall_nr (current, regs); -if (syscall_nr <0 ) +if (syscall_nr <0 || syscall_nr >= NR_syscalls)return ;if (!test_bit (syscall_nr, tr->enabled_enter_syscalls))return ;
@@ -354,7 +354,7 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)int syscall_nr; syscall_nr =trace_get_syscall_nr (current, regs); -if (syscall_nr <0 ) +if (syscall_nr <0 || syscall_nr >= NR_syscalls)return ;if (!test_bit (syscall_nr, tr->enabled_exit_syscalls))return ;
@@ -557,7 +557,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)int size; syscall_nr =trace_get_syscall_nr (current, regs); -if (syscall_nr <0 ) +if (syscall_nr <0 || syscall_nr >= NR_syscalls)return ;if (!test_bit (syscall_nr, enabled_perf_enter_syscalls))return ;
@@ -631,7 +631,7 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)int size; syscall_nr =trace_get_syscall_nr (current, regs); -if (syscall_nr <0 ) +if (syscall_nr <0 || syscall_nr >= NR_syscalls)return ;if (!test_bit (syscall_nr, enabled_perf_exit_syscalls))return ;
Signature · 1 line
2.1.3
PATCH 53/206 lockd: Try to reconnect if statd has moved
In reply to Jiri SlabyFrom: Benjamin Coddington <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 173b3afceebe76fa2205b2c8808682d5b541fe3c upstream.
If rpc.statd is restarted, upcalls to monitor hosts can fail with ECONNREFUSED. In that case force a lookup of statd's new port and retry the upcall.
--- fs/lockd/mon.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/lockd/mon.c +6 -0
@@ -159,6 +159,12 @@ static int nsm_mon_unmon(struct nsm_handle *nsm, u32 proc, struct nsm_res *res, msg.rpc_proc = &clnt->cl_procinfo[proc]; status =rpc_call_sync (clnt, &msg,RPC_TASK_SOFTCONN ); +if (status == -ECONNREFUSED ) { +dprintk ("lockd: NSM upcall RPC failed, status=%d, forcing rebind\n" , + status); +rpc_force_rebind (clnt); + status =rpc_call_sync (clnt, &msg,RPC_TASK_SOFTCONN ); + }if (status <0 )dprintk ("lockd: NSM upcall RPC failed, status=%d\n" , status);
Signature · 1 line
2.1.3
PATCH 54/206 Revert "percpu: free percpu allocation info for uniprocessor system"
In reply to Jiri SlabyFrom: Guenter Roeck <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit bb2e226b3bef596dd56be97df655d857b4603923 upstream.
This reverts commit 3189eddbcafc ("percpu: free percpu allocation info for uniprocessor system").
The commit causes a hang with a crisv32 image. This may be an architecture problem, but at least for now the revert is necessary to be able to boot a crisv32 image.
--- mm/percpu.c | 2 -- 1 file changed, 2 deletions(-)
mm/percpu.c +0 -2
@@ -1910,8 +1910,6 @@ void __init setup_per_cpu_areas(void)if (pcpu_setup_first_chunk (ai, fc) <0 ) panic("Failed to initialize percpu areas."); - - pcpu_free_alloc_info(ai); }#endif /* CONFIG_SMP */
Signature · 1 line
2.1.3
PATCH 55/206 pata_serverworks: disable 64-KB DMA transfers on Broadcom OSB4 IDE Controller
In reply to Jiri SlabyFrom: Scott Carter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 37017ac6849e772e67dd187ba2fbd056c4afa533 upstream.
The Broadcom OSB4 IDE Controller (vendor and device IDs: 1166:0211) does not support 64-KB DMA transfers.
Whenever a 64-KB DMA transfer is attempted,
the transfer fails and messages similar to the following are written to the console log:
[ 2431.851125] sr 0:0:0:0: [sr0] Unhandled sense code [ 2431.851139] sr 0:0:0:0: [sr0] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE [ 2431.851152] sr 0:0:0:0: [sr0] Sense Key : Hardware Error [current] [ 2431.851166] sr 0:0:0:0: [sr0] Add. Sense: Logical unit communication time-out [ 2431.851182] sr 0:0:0:0: [sr0] CDB: Read(10): 28 00 00 00 76 f4 00 00 40 00 [ 2431.851210] end_request: I/O error, dev sr0, sector 121808
When the libata and pata_serverworks modules
are recompiled with ATA_DEBUG and ATA_VERBOSE_DEBUG defined in libata.h, the 64-KB transfer size in the scatter-gather list can be seen in the console log:
[ 2664.897267] sr 9:0:0:0: [sr0] Send: [ 2664.897274] 0xf63d85e0 [ 2664.897283] sr 9:0:0:0: [sr0] CDB: [ 2664.897288] Read(10): 28 00 00 00 7f b4 00 00 40 00 [ 2664.897319] buffer = 0xf6d6fbc0, bufflen = 131072, queuecommand 0xf81b7700 [ 2664.897331] ata_scsi_dump_cdb: CDB (1:0,0,0) 28 00 00 00 7f b4 00 00 40 [ 2664.897338] ata_scsi_translate: ENTER [ 2664.897345] ata_sg_setup: ENTER, ata1 [ 2664.897356] ata_sg_setup: 3 sg elements mapped [ 2664.897364] ata_bmdma_fill_sg: PRD[0] = (0x66FD2000, 0xE000) [ 2664.897371] ata_bmdma_fill_sg: PRD[1] = (0x65000000, 0x10000) ------------------------------------------------------> ======= [ 2664.897378] ata_bmdma_fill_sg: PRD[2] = (0x66A10000, 0x2000) [ 2664.897386] ata1: ata_dev_select: ENTER, device 0, wait 1 [ 2664.897422] ata_sff_tf_load: feat 0x1 nsect 0x0 lba 0x0 0x0 0xFC [ 2664.897428] ata_sff_tf_load: device 0xA0 [ 2664.897448] ata_sff_exec_command: ata1: cmd 0xA0 [ 2664.897457] ata_scsi_translate: EXIT [ 2664.897462] leaving scsi_dispatch_cmnd() [ 2664.897497] Doing sr request, dev = sr0, block = 0 [ 2664.897507] sr0 : reading 64/256 512 byte blocks. [ 2664.897553] ata_sff_hsm_move: ata1: protocol 7 task_state 1 (dev_stat 0x58) [ 2664.897560] atapi_send_cdb: send cdb [ 2666.910058] ata_bmdma_port_intr: ata1: host_stat 0x64 [ 2666.910079] __ata_sff_port_intr: ata1: protocol 7 task_state 3 [ 2666.910093] ata_sff_hsm_move: ata1: protocol 7 task_state 3 (dev_stat 0x51) [ 2666.910101] ata_sff_hsm_move: ata1: protocol 7 task_state 4 (dev_stat 0x51) [ 2666.910129] sr 9:0:0:0: [sr0] Done: [ 2666.910136] 0xf63d85e0 TIMEOUT
lspci shows that the driver used for the Broadcom OSB4 IDE Controller is pata_serverworks:
00:0f.1 IDE interface: Broadcom OSB4 IDE Controller (prog-if 8e [Master SecP SecO PriP])
Flags: bus master, medium devsel, latency 64
[virtual] Memory at 000001f0 (32-bit, non-prefetchable) [size=8]
[virtual] Memory at 000003f0 (type 3, non-prefetchable) [size=1]
I/O ports at 0170 [size=8]
I/O ports at 0374 [size=4]
I/O ports at 1440 [size=16]
Kernel driver in use: pata_serverworksThe pata_serverworks driver supports five distinct device IDs, one being the OSB4 and the other four belonging to the CSB series. The CSB series appears to support 64-KB DMA transfers,
as tests on a machine with an SAI2 motherboard
containing a Broadcom CSB5 IDE Controller (vendor and device IDs: 1166:0212) showed no problems with 64-KB DMA transfers.
This problem was first discovered when attempting to install openSUSE from a DVD on a machine with an STL2 motherboard.
Using the pata_serverworks module,
older releases of openSUSE will not install at all due to the timeouts. Releases of openSUSE prior to 11.3 can be installed by disabling the pata_serverworks module using the brokenmodules boot parameter, which causes the serverworks module to be used instead.
Recent releases of openSUSE (12.2 and later) include better error recovery and will install, though very slowly.
On all openSUSE releases, the problem can be recreated
on a machine containing a Broadcom OSB4 IDE Controller
by mounting an install DVD and running a command similar to the following:
find /mnt -type f -print | xargs cat > /dev/null
The patch below corrects the problem.
Similar to the other ATA drivers that do not support 64-KB DMA transfers, the patch changes the ata_port_operations qc_prep vector to point to a routine that breaks any 64-KB segment into two 32-KB segments and
changes the scsi_host_template sg_tablesize element to reduce by half the number of scatter/gather elements allowed.
These two changes affect only the OSB4.
--- drivers/ata/pata_serverworks.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/ata/pata_serverworks.c +11 -2
@@ -252,12 +252,18 @@ static void serverworks_set_dmamode(struct ata_port *ap, struct ata_device *adevpci_write_config_byte (pdev,0x54 , ultra_cfg); } -static struct scsi_host_template serverworks_sht = { +static struct scsi_host_template serverworks_osb4_sht = { +ATA_BMDMA_SHT (DRV_NAME ), + .sg_tablesize =LIBATA_DUMB_MAX_PRD , +}; + +static struct scsi_host_template serverworks_csb_sht = {ATA_BMDMA_SHT (DRV_NAME ), };static struct ata_port_operations serverworks_osb4_port_ops = { .inherits = &ata_bmdma_port_ops, + .qc_prep = ata_bmdma_dumb_qc_prep, .cable_detect = serverworks_cable_detect, .mode_filter = serverworks_osb4_filter, .set_piomode = serverworks_set_piomode,
@@ -266,6 +272,7 @@ static struct ata_port_operations serverworks_osb4_port_ops = {static struct ata_port_operations serverworks_csb_port_ops = { .inherits = &serverworks_osb4_port_ops, + .qc_prep = ata_bmdma_qc_prep, .mode_filter = serverworks_csb_filter, };
@@ -405,6 +412,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id } };const struct ata_port_info *ppi[] = { &info[id->driver_data],NULL }; +struct scsi_host_template *sht = &serverworks_csb_sht;int rc; rc =pcim_enable_device (pdev);
@@ -418,6 +426,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id/* Select non UDMA capable OSB4 if we can't do fixups */ if (rc <0 ) ppi[0 ] = &info[1 ]; + sht = &serverworks_osb4_sht; }/* setup CSB5/CSB6 : South Bridge and IDE option RAID */ else if ((pdev->device == PCI_DEVICE_ID_SERVERWORKS_CSB5IDE) ||
@@ -434,7 +443,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id ppi[1 ] = &ata_dummy_port_info; } -return ata_pci_bmdma_init_one (pdev, ppi, &serverworks_sht,NULL ,0 ); +return ata_pci_bmdma_init_one (pdev, ppi, sht,NULL ,0 ); }#ifdef CONFIG_PM
Signature · 1 line
2.1.3
PATCH 56/206 libata-sff: Fix controllers with no ctl port
In reply to Jiri SlabyFrom: Ondrej Zary <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6d8ca28fa688a9354bc9fbc935bdaeb3651b6677 upstream.
Currently, ata_sff_softreset is skipped for controllers with no ctl port. But that also skips ata_sff_dev_classify required for device detection. This means that libata is currently broken on controllers with no ctl port.
No device connected:
[ 1.872480] pata_isapnp 01:01.02: activated [ 1.889823] scsi2 : pata_isapnp [ 1.890109] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11 [ 6.888110] ata3.01: qc timeout (cmd 0xec) [ 6.888179] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5) [ 16.888085] ata3.01: qc timeout (cmd 0xec) [ 16.888147] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5) [ 46.888086] ata3.01: qc timeout (cmd 0xec) [ 46.888148] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5) [ 51.888100] ata3.00: qc timeout (cmd 0xec) [ 51.888160] ata3.00: failed to IDENTIFY (I/O error, err_mask=0x5) [ 61.888079] ata3.00: qc timeout (cmd 0xec) [ 61.888141] ata3.00: failed to IDENTIFY (I/O error, err_mask=0x5) [ 91.888089] ata3.00: qc timeout (cmd 0xec) [ 91.888152] ata3.00: failed to IDENTIFY (I/O error, err_mask=0x5)
ATAPI device connected:
[ 1.882061] pata_isapnp 01:01.02: activated [ 1.893430] scsi2 : pata_isapnp [ 1.893719] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11 [ 6.892107] ata3.01: qc timeout (cmd 0xec) [ 6.892171] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5) [ 16.892079] ata3.01: qc timeout (cmd 0xec) [ 16.892138] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5) [ 46.892079] ata3.01: qc timeout (cmd 0xec) [ 46.892138] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5) [ 46.908586] ata3.00: ATAPI: ACER CD-767E/O, V1.5X, max PIO2, CDB intr [ 46.924570] ata3.00: configured for PIO0 (device error ignored) [ 46.926295] scsi 2:0:0:0: CD-ROM ACER CD-767E/O 1.5X PQ: 0 ANSI: 5 [ 46.984519] sr0: scsi3-mmc drive: 6x/6x xa/form2 tray [ 46.984592] cdrom: Uniform CD-ROM driver Revision: 3.20
So don't skip ata_sff_softreset, just skip the reset part of ata_bus_softreset if the ctl port is not available.
This makes IDE port on ES968 behave correctly:
No device connected:
[ 4.670888] pata_isapnp 01:01.02: activated [ 4.673207] scsi host2: pata_isapnp [ 4.673675] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11 [ 7.081840] Adding 2541652k swap on /dev/sda2. Priority:-1 extents:1 across:2541652k
ATAPI device connected:
[ 4.704362] pata_isapnp 01:01.02: activated [ 4.706620] scsi host2: pata_isapnp [ 4.706877] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11 [ 4.872782] ata3.00: ATAPI: ACER CD-767E/O, V1.5X, max PIO2, CDB intr [ 4.888673] ata3.00: configured for PIO0 (device error ignored) [ 4.893984] scsi 2:0:0:0: CD-ROM ACER CD-767E/O 1.5X PQ: 0 ANSI: 5 [ 7.015578] Adding 2541652k swap on /dev/sda2. Priority:-1 extents:1 across:2541652k
--- drivers/ata/libata-sff.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
drivers/ata/libata-sff.c +9 -11
@@ -2008,13 +2008,15 @@ static int ata_bus_softreset(struct ata_port *ap, unsigned int devmask,DPRINTK ("ata%u: bus reset via SRST\n" , ap->print_id); -/* software reset. causes dev0 to be selected */ -iowrite8 (ap->ctl, ioaddr->ctl_addr); -udelay (20 );/* FIXME: flush */ -iowrite8 (ap->ctl |ATA_SRST , ioaddr->ctl_addr); -udelay (20 );/* FIXME: flush */ -iowrite8 (ap->ctl, ioaddr->ctl_addr); - ap->last_ctl = ap->ctl; +if (ap->ioaddr.ctl_addr) { +/* software reset. causes dev0 to be selected */ +iowrite8 (ap->ctl, ioaddr->ctl_addr); +udelay (20 );/* FIXME: flush */ +iowrite8 (ap->ctl |ATA_SRST , ioaddr->ctl_addr); +udelay (20 );/* FIXME: flush */ +iowrite8 (ap->ctl, ioaddr->ctl_addr); + ap->last_ctl = ap->ctl; + }/* wait the port to become ready */ return ata_sff_wait_after_reset (&ap->link, devmask, deadline);
@@ -2215,10 +2217,6 @@ void ata_sff_error_handler(struct ata_port *ap)spin_unlock_irqrestore (ap->lock, flags); -/* ignore ata_sff_softreset if ctl isn't accessible */ -if (softreset == ata_sff_softreset && !ap->ioaddr.ctl_addr) - softreset =NULL ; -/* ignore built-in hardresets if SCR access is not available */ if ((hardreset == sata_std_hardreset || hardreset == sata_sff_hardreset) && !sata_scr_valid (&ap->link))
Signature · 1 line
2.1.3
PATCH 57/206 ASoC: soc-dapm: fix use after free
In reply to Jiri SlabyFrom: Daniel Mack <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e5092c96c9c28f4d12811edcd02ca8eec16e748e upstream.
Coverity spotted the following possible use-after-free condition in dapm_create_or_share_mixmux_kcontrol():
If kcontrol is NULL, and (wname_in_long_name && kcname_in_long_name) validates to true, 'name' will be set to an allocated string, and be freed a few lines later via the 'long_name' alias. 'name', however, is used by dev_err() in case snd_ctl_add() fails.
Fix this by adding a jump label that frees 'long_name' at the end of the function.
--- sound/soc/soc-dapm.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
sound/soc/soc-dapm.c +14 -11
@@ -675,9 +675,9 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w,int shared;struct snd_kcontrol *kcontrol;bool wname_in_long_name, kcname_in_long_name; -char *long_name; +char *long_name =NULL ;const char *name; -int ret; +int ret =0 ;if (dapm->codec) prefix = dapm->codec->name_prefix;
@@ -742,15 +742,17 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w, kcontrol =snd_soc_cnew (&w->kcontrol_news[kci],NULL , name, prefix); -kfree (long_name); -if (!kcontrol) -return -ENOMEM ; +if (!kcontrol) { + ret = -ENOMEM ; + goto exit_free; + } + kcontrol->private_free = dapm_kcontrol_free; ret =dapm_kcontrol_data_alloc (w, kcontrol);if (ret) {snd_ctl_free_one (kcontrol); -return ret; + goto exit_free; } ret =snd_ctl_add (card, kcontrol);
@@ -758,17 +760,18 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w,dev_err (dapm->dev,"ASoC: failed to add widget %s dapm kcontrol %s: %d\n" , w->name, name, ret); -return ret; + goto exit_free; } } ret =dapm_kcontrol_add_widget (kcontrol, w); -if (ret) -return ret; +if (ret ==0 ) + w->kcontrols[kci] = kcontrol; - w->kcontrols[kci] = kcontrol; +exit_free: +kfree (long_name); -return 0 ; +return ret; }/* create new dapm mixer control */
Signature · 1 line
2.1.3
PATCH 58/206 mmc: rtsx_pci_sdmmc: fix incorrect last byte in R2 response
In reply to Jiri SlabyFrom: Roger Tseng <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d1419d50c1bf711e9fd27b516a739c86b23f7cf9 upstream.
Current code erroneously fill the last byte of R2 response with an undefined value. In addition, the controller actually 'offloads' the last byte (CRC7, end bit) while receiving R2 response and thus it's impossible to get the actual value. This could cause mmc stack to obtain inconsistent CID from the same card after resume and misidentify it as a different card.
Fix by assigning dummy CRC and end bit: {7'b0, 1} = 0x1 to the last byte of R2.
--- drivers/mmc/host/rtsx_pci_sdmmc.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/mmc/host/rtsx_pci_sdmmc.c +7 -0
@@ -342,6 +342,13 @@ static void sd_send_cmd_get_rsp(struct realtek_pci_sdmmc *host, }if (rsp_type ==SD_RSP_TYPE_R2 ) { +/* +* The controller offloads the last byte {CRC-7, end bit 1'b1} +* of response type R2. Assign dummy CRC, 0, and end bit to the +* byte(ptr[16], goes into the LSB of resp[3] later). +*/ + ptr[16 ] =1 ; +for (i =0 ; i <4 ; i++) { cmd->resp[i] =get_unaligned_be32 (ptr +1 + i *4 ); dev_dbg(sdmmc_dev(host), "cmd->resp[%d] = 0x%08x\n",
Signature · 1 line
2.1.3
PATCH 59/206 fs: make cont_expand_zero interruptible
In reply to Jiri SlabyFrom: Mikulas Patocka <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c2ca0fcd202863b14bd041a7fece2e789926c225 upstream.
This patch makes it possible to kill a process looping in cont_expand_zero. A process may spend a lot of time in this function, so it is desirable to be able to kill it.
It happened to me that I wanted to copy a piece data from the disk to a file. By mistake, I used the "seek" parameter to dd instead of "skip". Due to the "seek" parameter, dd attempted to extend the file and became stuck doing so - the only possibility was to reset the machine or wait many hours until the filesystem runs out of space and cont_expand_zero fails. We need this patch to be able to terminate the process.
--- fs/buffer.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/buffer.c +5 -0
@@ -2325,6 +2325,11 @@ static int cont_expand_zero(struct file *file, struct address_space *mapping, err =0 ;balance_dirty_pages_ratelimited (mapping); + +if (unlikely (fatal_signal_pending (current))) { + err = -EINTR ; + goto out; + } }/* page covers the boundary, find the boundary offset */
Signature · 1 line
2.1.3
PATCH 60/206 fs: Fix theoretical division by 0 in super_cache_scan().
In reply to Jiri SlabyFrom: Tetsuo Handa <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 475d0db742e3755c6b267f48577ff7cbb7dfda0d upstream.
total_objects could be 0 and is used as a denom.
While total_objects is a "long", total_objects == 0 unlikely happens for 3.12 and later kernels because 32-bit architectures would not be able to hold (1 << 32) objects. However, total_objects == 0 may happen for kernels between 3.1 and 3.11 because total_objects in prune_super() was an "int" and (e.g.) x86_64 architecture might be able to hold (1 << 32) objects.
--- fs/super.c | 2 ++ 1 file changed, 2 insertions(+)
fs/super.c +2 -0
@@ -81,6 +81,8 @@ static unsigned long super_cache_scan(struct shrinker *shrink, inodes =list_lru_count_node (&sb->s_inode_lru, sc->nid); dentries =list_lru_count_node (&sb->s_dentry_lru, sc->nid); total_objects = dentries + inodes + fs_objects +1 ; +if (!total_objects) + total_objects =1 ;/* proportion the scan between the caches */ dentries =mult_frac (sc->nr_to_scan, dentries, total_objects);
Signature · 1 line
2.1.3
PATCH 61/206 fs: allow open(dir, O_TMPFILE|..., 0) with mode 0
In reply to Jiri SlabyFrom: Eric Rannaud <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 69a91c237ab0ebe4e9fdeaf6d0090c85275594ec upstream.
The man page for open(2) indicates that when O_CREAT is specified, the 'mode' argument applies only to future accesses to the file:
Note that this mode applies only to future accesses of the newly created file; the open() call that creates a read-only file may well return a read/write file descriptor.
The man page for open(2) implies that 'mode' is treated identically by O_CREAT and O_TMPFILE.
O_TMPFILE, however, behaves differently:
int fd = open("/tmp", O_TMPFILE | O_RDWR, 0);
assert(fd == -1);
assert(errno == EACCES);
int fd = open("/tmp", O_TMPFILE | O_RDWR, 0600);
assert(fd > 0);For O_CREAT, do_last() sets acc_mode to MAY_OPEN only:
if (*opened & FILE_CREATED) {
/* Don't check for write permission, don't truncate */
open_flag &= ~O_TRUNC;
will_truncate = false;
acc_mode = MAY_OPEN;
path_to_nameidata(path, nd);
goto finish_open_created;
}But for O_TMPFILE, do_tmpfile() passes the full op->acc_mode to may_open().
This patch lines up the behavior of O_TMPFILE with O_CREAT. After the inode is created, may_open() is called with acc_mode = MAY_OPEN, in do_tmpfile().
A different, but related glibc bug revealed the discrepancy:
https://sourceware.org/bugzilla/show_bug.cgi?id=17523
The glibc lazily loads the 'mode' argument of open() and openat() using va_arg() only if O_CREAT is present in 'flags' (to support both the 2 argument and the 3 argument forms of open; same idea for openat()). However, the glibc ignores the 'mode' argument if O_TMPFILE is in 'flags'.
On x86_64, for open(), it magically works anyway, as 'mode' is in RDX when entering open(), and is still in RDX on SYSCALL, which is where the kernel looks for the 3rd argument of a syscall.
But openat() is not quite so lucky: 'mode' is in RCX when entering the glibc wrapper for openat(), while the kernel looks for the 4th argument of a syscall in R10. Indeed, the syscall calling convention differs from the regular calling convention in this respect on x86_64. So the kernel sees mode = 0 when trying to use glibc openat() with O_TMPFILE, and fails with EACCES.
--- fs/namei.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/namei.c +2 -1
@@ -3159,7 +3159,8 @@ static int do_tmpfile(int dfd, struct filename *pathname,if (error) goto out2;audit_inode (pathname, nd->path.dentry,0 ); - error =may_open (&nd->path, op->acc_mode, op->open_flag); +/* Don't check for other permissions, the inode was just created */ + error =may_open (&nd->path,MAY_OPEN , op->open_flag);if (error) goto out2; file->f_path.mnt = nd->path.mnt;
Signature · 1 line
2.1.3
PATCH 62/206 UBIFS: remove mst_mutex
In reply to Jiri SlabyFrom: Artem Bityutskiy <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 07e19dff63e3d5d6500d831e36554ac9b1b0560e upstream.
The 'mst_mutex' is not needed since because 'ubifs_write_master()' is only called on the mount path and commit path. The mount path is sequential and there is no parallelism, and the commit path is also serialized - there is only one commit going on at a time.
--- fs/ubifs/commit.c | 2 -- fs/ubifs/master.c | 7 +++---- fs/ubifs/super.c | 1 - fs/ubifs/ubifs.h | 2 -- 4 files changed, 3 insertions(+), 9 deletions(-)
fs/ubifs/commit.c +0 -2
@@ -174,7 +174,6 @@ static int do_commit(struct ubifs_info *c)if (err) goto out; -mutex_lock (&c->mst_mutex); c->mst_node->cmt_no =cpu_to_le64 (c->cmt_no); c->mst_node->log_lnum =cpu_to_le32 (new_ltail_lnum); c->mst_node->root_lnum =cpu_to_le32 (zroot.lnum);
@@ -204,7 +203,6 @@ static int do_commit(struct ubifs_info *c)else c->mst_node->flags &= ~cpu_to_le32 (UBIFS_MST_NO_ORPHS ); err =ubifs_write_master (c); -mutex_unlock (&c->mst_mutex);if (err) goto out;
fs/ubifs/master.c +3 -4
@@ -352,10 +352,9 @@ int ubifs_read_master(struct ubifs_info *c)* ubifs_write_master - write master node. * @c: UBIFS file-system description object * -* This function writes the master node. The caller has to take the -* @c->mst_mutex lock before calling this function. Returns zero in case of -* success and a negative error code in case of failure. The master node is -* written twice to enable recovery. +* This function writes the master node. Returns zero in case of success and a +* negative error code in case of failure. The master node is written twice to +* enable recovery. */ int ubifs_write_master (struct ubifs_info *c) {
fs/ubifs/super.c +0 -1
@@ -1971,7 +1971,6 @@ static struct ubifs_info *alloc_ubifs_info(struct ubi_volume_desc *ubi)mutex_init (&c->lp_mutex);mutex_init (&c->tnc_mutex);mutex_init (&c->log_mutex); -mutex_init (&c->mst_mutex);mutex_init (&c->umount_mutex);mutex_init (&c->bu_mutex);mutex_init (&c->write_reserve_mutex);
fs/ubifs/ubifs.h +0 -2
@@ -1042,7 +1042,6 @@ struct ubifs_debug_info;* * @mst_node: master node * @mst_offs: offset of valid master node -* @mst_mutex: protects the master node area, @mst_node, and @mst_offs * * @max_bu_buf_len: maximum bulk-read buffer length * @bu_mutex: protects the pre-allocated bulk-read buffer and @c->bu
@@ -1282,7 +1281,6 @@ struct ubifs_info {struct ubifs_mst_node *mst_node;int mst_offs; -struct mutex mst_mutex;int max_bu_buf_len;struct mutex bu_mutex;
Signature · 1 line
2.1.3
PATCH 63/206 UBIFS: fix a race condition
In reply to Jiri SlabyFrom: Artem Bityutskiy <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 052c28073ff26f771d44ef33952a41d18dadd255 upstream.
Hu ([email protected]) discovered a race condition which may lead to a situation when UBIFS is unable to mount the file-system after an unclean reboot. The problem is theoretical, though.
In UBIFS, we have the log, which basically a set of LEBs in a certain area. The log has the tail and the head.
Every time user writes data to the file-system, the UBIFS journal grows, and the log grows as well, because we append new reference nodes to the head of the log. So the head moves forward all the time, while the log tail stays at the same position.
At any time, the UBIFS master node points to the tail of the log. When we mount the file-system, we scan the log, and we always start from its tail, because this is where the master node points to. The only occasion when the tail of the log changes is the commit operation.
The commit operation has 2 phases - "commit start" and "commit end". The former is relatively short, and does not involve much I/O. During this phase we mostly just build various in-memory lists of the things which have to be written to the flash media during "commit end" phase.
During the commit start phase, what we do is we "clean" the log. Indeed, the commit operation will index all the data in the journal, so the entire journal "disappears", and therefore the data in the log become unneeded. So we just move the head of the log to the next LEB, and write the CS node there. This LEB will be the tail of the new log when the commit operation finishes.
When the "commit start" phase finishes, users may write more data to the file-system, in parallel with the ongoing "commit end" operation. At this point the log tail was not changed yet, it is the same as it had been before we started the commit. The log head keeps moving forward, though.
The commit operation now needs to write the new master node, and the new master node should point to the new log tail. After this the LEBs between the old log tail and the new log tail can be unmapped and re-used again.
And here is the possible problem. We do 2 operations: (a) We first update the log tail position in memory (see 'ubifs_log_end_commit()'). (b) And then we write the master node (see the big lock of code in 'do_commit()').
But nothing prevents the log head from moving forward between (a) and (b), and the log head may "wrap" now to the old log tail. And when the "wrap" happens, the contends of the log tail gets erased. Now a power cut happens and we are in trouble. We end up with the old master node pointing to the old tail, which was erased. And replay fails because it expects the master node to point to the correct log tail at all times.
This patch merges the abovementioned (a) and (b) operations by moving the master node change code to the 'ubifs_log_end_commit()' function, so that it runs with the log mutex locked, which will prevent the log from being changed benween operations (a) and (b).
--- fs/ubifs/commit.c | 8 +++----- fs/ubifs/log.c | 11 ++++++++--- 2 files changed, 11 insertions(+), 8 deletions(-)
fs/ubifs/commit.c +3 -5
@@ -166,10 +166,6 @@ static int do_commit(struct ubifs_info *c) err =ubifs_orphan_end_commit (c);if (err) goto out; - old_ltail_lnum = c->ltail_lnum; - err =ubifs_log_end_commit (c, new_ltail_lnum); -if (err) - goto out; err =dbg_check_old_index (c, &zroot);if (err) goto out;
@@ -202,7 +198,9 @@ static int do_commit(struct ubifs_info *c) c->mst_node->flags |=cpu_to_le32 (UBIFS_MST_NO_ORPHS ); else c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_NO_ORPHS); - err =ubifs_write_master (c); + + old_ltail_lnum = c->ltail_lnum; + err =ubifs_log_end_commit (c, new_ltail_lnum);if (err) goto out;
fs/ubifs/log.c +8 -3
@@ -447,9 +447,9 @@ out:* @ltail_lnum: new log tail LEB number * * This function is called on when the commit operation was finished. It -* moves log tail to new position and unmaps LEBs which contain obsolete data. -* Returns zero in case of success and a negative error code in case of -* failure. +* moves log tail to new position and updates the master node so that it stores +* the new log tail LEB number. Returns zero in case of success and a negative +* error code in case of failure. */ int ubifs_log_end_commit (struct ubifs_info *c,int ltail_lnum) {
@@ -477,7 +477,12 @@ int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum)spin_unlock (&c->buds_lock); err =dbg_check_bud_bytes (c); +if (err) + goto out; + err =ubifs_write_master (c); + +out:mutex_unlock (&c->log_mutex);return err; }
Signature · 1 line
2.1.3
PATCH 64/206 UBIFS: fix free log space calculation
In reply to Jiri SlabyFrom: Artem Bityutskiy <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ba29e721eb2df6df8f33c1f248388bb037a47914 upstream.
Hu (hujianyang <[email protected]>) discovered an issue in the 'empty_log_bytes()' function, which calculates how many bytes are left in the log:
"
If 'c->lhead_lnum + 1 == c->ltail_lnum' and 'c->lhead_offs == c->leb_size', 'h' would equalent to 't' and 'empty_log_bytes()' would return 'c->log_bytes' instead of 0.
"
At this point it is not clear what would be the consequences of this, and whether this may lead to any problems, but this patch addresses the issue just in case.
--- fs/ubifs/log.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/ubifs/log.c +6 -2
@@ -106,10 +106,14 @@ static inline long long empty_log_bytes(const struct ubifs_info *c) h = (long long )c->lhead_lnum * c->leb_size + c->lhead_offs; t = (long long )c->ltail_lnum * c->leb_size; -if (h >= t) +if (h > t)return c->log_bytes - h + t; -else +else if (h != t)return t - h; +else if (c->lhead_lnum != c->ltail_lnum) +return 0 ; +else +return c->log_bytes; }/**
Signature · 1 line
2.1.3
PATCH 65/206 vfs: fix data corruption when blocksize < pagesize for mmaped data
In reply to Jiri SlabyFrom: Jan Kara <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 90a8020278c1598fafd071736a0846b38510309c upstream.
->page_mkwrite() is used by filesystems to allocate blocks under a page which is becoming writeably mmapped in some process' address space. This allows a filesystem to return a page fault if there is not enough space available, user exceeds quota or similar problem happens, rather than silently discarding data later when writepage is called.
However VFS fails to call ->page_mkwrite() in all the cases where filesystems need it when blocksize < pagesize. For example when blocksize = 1024, pagesize = 4096 the following is problematic:
ftruncate(fd, 0);
pwrite(fd, buf, 1024, 0);
map = mmap(NULL, 1024, PROT_WRITE, MAP_SHARED, fd, 0);
map[0] = 'a'; ----> page_mkwrite() for index 0 is called
ftruncate(fd, 10000); /* or even pwrite(fd, buf, 1, 10000) */ mremap(map, 1024, 10000, 0);
map[4095] = 'a'; ----> no page_mkwrite() called
At the moment ->page_mkwrite() is called, filesystem can allocate only one block for the page because i_size == 1024. Otherwise it would create blocks beyond i_size which is generally undesirable. But later at ->writepage() time, we also need to store data at offset 4095 but we don't have block allocated for it.
This patch introduces a helper function filesystems can use to have ->page_mkwrite() called at all the necessary moments.
--- fs/buffer.c | 3 +++ include/linux/mm.h | 1 + mm/truncate.c | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 61 insertions(+)
fs/buffer.c +3 -0
@@ -2089,6 +2089,7 @@ int generic_write_end(struct file *file, struct address_space *mapping, struct page *page, void *fsdata) { struct inode *inode = mapping->host; +loff_t old_size = inode->i_size;int i_size_changed =0 ; copied =block_write_end (file, mapping, pos, len, copied, page, fsdata);
@@ -2108,6 +2109,8 @@ int generic_write_end(struct file *file, struct address_space *mapping,unlock_page (page);page_cache_release (page); +if (old_size < pos) +pagecache_isize_extended (inode, old_size, pos);/* * Don't mark the inode dirty under page lock. First, it unnecessarily * makes the holding time of page lock longer. Second, it forces lock
include/linux/mm.h +1 -0
@@ -1009,6 +1009,7 @@ static inline void unmap_shared_mapping_range(struct address_space *mapping,extern void truncate_pagecache (struct inode *inode,loff_t new);extern void truncate_setsize (struct inode *inode,loff_t newsize); +void pagecache_isize_extended (struct inode *inode,loff_t from,loff_t to);void truncate_pagecache_range (struct inode *inode,loff_t offset,loff_t end);int truncate_inode_page (struct address_space *mapping,struct page *page);int generic_error_remove_page (struct address_space *mapping,struct page *page);
mm/truncate.c +57 -0
75 lines not on this page · raw message
Signature · 1 line
2.1.3
PATCH 66/206 x86: Reject x32 executables if x32 ABI not supported
In reply to Jiri SlabyFrom: Ben Hutchings <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0e6d3112a4e95d55cf6dca88f298d5f4b8f29bd1 upstream.
It is currently possible to execve() an x32 executable on an x86_64 kernel that has only ia32 compat enabled. However all its syscalls will fail, even _exit(). This usually causes it to segfault.
Change the ELF compat architecture check so that x32 executables are rejected if we don't support the x32 ABI.
--- arch/x86/include/asm/elf.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/x86/include/asm/elf.h +3 -2
@@ -155,8 +155,9 @@ do { \#define elf_check_arch (x) \ ((x)->e_machine == EM_X86_64) -#define compat_elf_check_arch (x) \ - (elf_check_arch_ia32(x) || (x)->e_machine == EM_X86_64) +#define compat_elf_check_arch (x) \ + (elf_check_arch_ia32(x) || \ + (IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine == EM_X86_64))#if __USER32_DS != __USER_DS# error "The following code assumes __USER32_DS == __USER_DS"
Signature · 1 line
2.1.3
PATCH 67/206 x86, fpu: __restore_xstate_sig()->math_state_restore() needs preempt_disable()
In reply to Jiri SlabyFrom: Oleg Nesterov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit df24fb859a4e200d9324e2974229fbb7adf00aef upstream.
Add preempt_disable() + preempt_enable() around math_state_restore() in __restore_xstate_sig(). Otherwise __switch_to() after __thread_fpu_begin() can overwrite fpu->state we are going to restore.
--- arch/x86/kernel/xsave.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/kernel/xsave.c +4 -1
@@ -399,8 +399,11 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)set_used_math (); } -if (use_eager_fpu ()) +if (use_eager_fpu ()) { +preempt_disable ();math_state_restore (); +preempt_enable (); + }return err; }else {
Signature · 1 line
2.1.3
PATCH 68/206 x86, fpu: shift drop_init_fpu() from save_xstate_sig() to handle_signal()
In reply to Jiri SlabyFrom: Oleg Nesterov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 66463db4fc5605d51c7bb81d009d5bf30a783a2c upstream.
save_xstate_sig()->drop_init_fpu() doesn't look right. setup_rt_frame() can fail after that, in this case the next setup_rt_frame() triggered by SIGSEGV won't save fpu simply because the old state was lost. This obviously mean that fpu won't be restored after sys_rt_sigreturn() from SIGSEGV handler.
Shift drop_init_fpu() into !failed branch in handle_signal().
Test-case (needs -O2):
#include <stdio.h>
#include <signal.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <sys/mman.h>
#include <pthread.h>
#include <assert.h>
volatile double D;
void test(double d)
{
int pid = getpid();
for (D = d; D == d; ) {
/* sys_tkill(pid, SIGHUP); asm to avoid save/reload
* fp regs around "C" call */
asm ("" : : "a"(200), "D"(pid), "S"(1));
asm ("syscall" : : : "ax");
}
printf("ERR!!\n");
}
void sigh(int sig)
{
}
char altstack[4096 * 10] __attribute__((aligned(4096)));
void *tfunc(void *arg)
{
for (;;) {
mprotect(altstack, sizeof(altstack), PROT_READ);
mprotect(altstack, sizeof(altstack), PROT_READ|PROT_WRITE);
}
}
int main(void)
{
stack_t st = {
.ss_sp = altstack,
.ss_size = sizeof(altstack),
.ss_flags = SS_ONSTACK,
};
struct sigaction sa = {
.sa_handler = sigh,
};
pthread_t pt;
sigaction(SIGSEGV, &sa, NULL);
sigaltstack(&st, NULL);
sa.sa_flags = SA_ONSTACK;
sigaction(SIGHUP, &sa, NULL);
pthread_create(&pt, NULL, tfunc, NULL);
test(123.456);
return 0;
}--- arch/x86/kernel/signal.c | 5 +++++ arch/x86/kernel/xsave.c | 2 -- 2 files changed, 5 insertions(+), 2 deletions(-)
arch/x86/kernel/signal.c +5 -0
@@ -673,6 +673,11 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs)* handler too. */ regs->flags &= ~(X86_EFLAGS_DF |X86_EFLAGS_RF |X86_EFLAGS_TF ); +/* +* Ensure the signal handler starts with the new fpu state. +*/ +if (used_math ()) +drop_init_fpu (current); }signal_setup_done (failed, ksig,test_thread_flag (TIF_SINGLESTEP )); }
arch/x86/kernel/xsave.c +0 -2
@@ -268,8 +268,6 @@ int save_xstate_sig(void __user *buf, void __user *buf_fx, int size)if (use_fxsr () &&save_xstate_epilog (buf_fx, ia32_fxstate))return -1 ; -drop_init_fpu (tsk);/* trigger finit */ -return 0 ; }
Signature · 1 line
2.1.3
PATCH 69/206 x86_64, entry: Filter RFLAGS.NT on entry from userspace
In reply to Jiri SlabyFrom: Andy Lutomirski <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8c7aa698baca5e8f1ba9edb68081f1e7a1abf455 upstream.
The NT flag doesn't do anything in long mode other than causing IRET to #GP. Oddly, CPL3 code can still set NT using popf.
Entry via hardware or software interrupt clears NT automatically, so the only relevant entries are fast syscalls.
If user code causes kernel code to run with NT set, then there's at least some (small) chance that it could cause trouble. For example, user code could cause a call to EFI code with NT set, and who knows what would happen? Apparently some games on Wine sometimes do this (!), and, if an IRET return happens, they will segfault. That segfault cannot be handled, because signal delivery fails, too.
This patch programs the CPU to clear NT on entry via SYSCALL (both 32-bit and 64-bit, by my reading of the AMD APM), and it clears NT in software on entry via SYSENTER.
To save a few cycles, this borrows a trick from Jan Beulich in Xen:
it checks whether NT is set before trying to clear it. As a result, it seems to have very little effect on SYSENTER performance on my machine.
There's another minor bug fix in here: it looks like the CFI annotations were wrong if CONFIG_AUDITSYSCALL=n.
Testers beware: on Xen, SYSENTER with NT set turns into a GPF.
I haven't touched anything on 32-bit kernels.
The syscall mask change comes from a variant of this patch by Anish Bhatt.
Note to stable maintainers: there is no known security issue here. A misguided program can set NT and cause the kernel to try and fail to deliver SIGSEGV, crashing the program. This patch fixes Far Cry on Wine: https://bugs.winehq.org/show_bug.cgi?id=33275
--- arch/x86/ia32/ia32entry.S | 18 +++++++++++++++++- arch/x86/kernel/cpu/common.c | 2 +- 2 files changed, 18 insertions(+), 2 deletions(-)
arch/x86/ia32/ia32entry.S +17 -1
@@ -151,6 +151,16 @@ ENTRY(ia32_sysenter_target) 1: movl (%rbp),%ebp _ASM_EXTABLE(1b,ia32_badarg) ASM_CLAC + + /* + * Sysenter doesn't filter flags, so we need to clear NT + * ourselves. To save a few cycles, we can check whether + * NT was set instead of doing an unconditional popfq. + */ + testl $X86_EFLAGS_NT,EFLAGS(%rsp) /* saved EFLAGS match cpu */ + jnz sysenter_fix_flags +sysenter_flags_fixed: + orl $TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET) testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET) CFI_REMEMBER_STATE
@@ -184,6 +194,8 @@ sysexit_from_sys_call: TRACE_IRQS_ON ENABLE_INTERRUPTS_SYSEXIT32 + CFI_RESTORE_STATE + #ifdef CONFIG_AUDITSYSCALL .macro auditsys_entry_common movl %esi,%r9d /* 6th arg: 4th syscall arg */
@@ -226,7 +238,6 @@ sysexit_from_sys_call: .endm sysenter_auditsys: - CFI_RESTORE_STATE auditsys_entry_common movl %ebp,%r9d /* reload 6th syscall arg */ jmp sysenter_dispatch
@@ -235,6 +246,11 @@ sysexit_audit: auditsys_exit sysexit_from_sys_call #endif +sysenter_fix_flags: + pushq_cfi $(X86_EFLAGS_IF|X86_EFLAGS_FIXED) + popfq_cfi + jmp sysenter_flags_fixed + sysenter_tracesys: #ifdef CONFIG_AUDITSYSCALL testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
arch/x86/kernel/cpu/common.c +1 -1
@@ -1135,7 +1135,7 @@ void syscall_init(void)/* Flags to clear on syscall */ wrmsrl (MSR_SYSCALL_MASK ,X86_EFLAGS_TF |X86_EFLAGS_DF |X86_EFLAGS_IF | -X86_EFLAGS_IOPL |X86_EFLAGS_AC ); +X86_EFLAGS_IOPL |X86_EFLAGS_AC |X86_EFLAGS_NT ); }/*
Signature · 1 line
2.1.3
PATCH 70/206 x86, pageattr: Prevent overflow in slow_virt_to_phys() for X86_PAE
In reply to Jiri SlabyFrom: Dexuan Cui <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d1cd1210834649ce1ca6bafe5ac25d2f40331343 upstream.
pte_pfn() returns a PFN of long (32 bits in 32-PAE), so "long << PAGE_SHIFT" will overflow for PFNs above 4GB.
Due to this issue, some Linux 32-PAE distros, running as guests on Hyper-V, with 5GB memory assigned, can't load the netvsc driver successfully and hence the synthetic network device can't work (we can use the kernel parameter mem=3000M to work around the issue).
Cast pte_pfn() to phys_addr_t before shifting.
--- arch/x86/mm/pageattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/mm/pageattr.c +1 -1
@@ -389,7 +389,7 @@ phys_addr_t slow_virt_to_phys(void *__virt_addr) psize =page_level_size (level); pmask =page_level_mask (level); offset = virt_addr & ~pmask; - phys_addr =pte_pfn (*pte) <<PAGE_SHIFT ; + phys_addr = (phys_addr_t )pte_pfn (*pte) <<PAGE_SHIFT ;return (phys_addr | offset); }EXPORT_SYMBOL_GPL (slow_virt_to_phys);
Signature · 7 lines
2.1.3 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
PATCH 71/206 evm: check xattr value length and type in evm_inode_setxattr()
In reply to Jiri SlabyFrom: Dmitry Kasatkin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3b1deef6b1289a99505858a3b212c5b50adf0c2f upstream.
evm_inode_setxattr() can be called with no value. The function does not check the length so that following command can be used to produce the kernel oops: setfattr -n security.evm FOO. This patch fixes it.
Changes in v3:
* there is no reason to return different error codes for EVM_XATTR_HMAC and non EVM_XATTR_HMAC. Remove unnecessary test then.
Changes in v2:
* testing for validity of xattr type
[ 1106.396921] BUG: unable to handle kernel NULL pointer dereference at (null) [ 1106.398192] IP: [<ffffffff812af7b8>] evm_inode_setxattr+0x2a/0x48 [ 1106.399244] PGD 29048067 PUD 290d7067 PMD 0 [ 1106.399953] Oops: 0000 [#1] SMP [ 1106.400020] Modules linked in: bridge stp llc evdev serio_raw i2c_piix4 button fuse [ 1106.400020] CPU: 0 PID: 3635 Comm: setxattr Not tainted 3.16.0-kds+ #2936 [ 1106.400020] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1106.400020] task: ffff8800291a0000 ti: ffff88002917c000 task.ti: ffff88002917c000 [ 1106.400020] RIP: 0010:[<ffffffff812af7b8>] [<ffffffff812af7b8>] evm_inode_setxattr+0x2a/0x48 [ 1106.400020] RSP: 0018:ffff88002917fd50 EFLAGS: 00010246 [ 1106.400020] RAX: 0000000000000000 RBX: ffff88002917fdf8 RCX: 0000000000000000 [ 1106.400020] RDX: 0000000000000000 RSI: ffffffff818136d3 RDI: ffff88002917fdf8 [ 1106.400020] RBP: ffff88002917fd68 R08: 0000000000000000 R09: 00000000003ec1df [ 1106.400020] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800438a0a00 [ 1106.400020] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1106.400020] FS: 00007f7dfa7d7740(0000) GS:ffff88005da00000(0000) knlGS:0000000000000000 [ 1106.400020] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1106.400020] CR2: 0000000000000000 CR3: 000000003763e000 CR4: 00000000000006f0 [ 1106.400020] Stack: [ 1106.400020] ffff8800438a0a00 ffff88002917fdf8 0000000000000000 ffff88002917fd98 [ 1106.400020] ffffffff812a1030 ffff8800438a0a00 ffff88002917fdf8 0000000000000000 [ 1106.400020] 0000000000000000 ffff88002917fde0 ffffffff8116d08a ffff88002917fdc8 [ 1106.400020] Call Trace: [ 1106.400020] [<ffffffff812a1030>] security_inode_setxattr+0x5d/0x6a [ 1106.400020] [<ffffffff8116d08a>] vfs_setxattr+0x6b/0x9f [ 1106.400020] [<ffffffff8116d1e0>] setxattr+0x122/0x16c [ 1106.400020] [<ffffffff811687e8>] ? mnt_want_write+0x21/0x45 [ 1106.400020] [<ffffffff8114d011>] ? __sb_start_write+0x10f/0x143 [ 1106.400020] [<ffffffff811687e8>] ? mnt_want_write+0x21/0x45 [ 1106.400020] [<ffffffff811687c0>] ? __mnt_want_write+0x48/0x4f [ 1106.400020] [<ffffffff8116d3e6>] SyS_setxattr+0x6e/0xb0 [ 1106.400020] [<ffffffff81529da9>] system_call_fastpath+0x16/0x1b [ 1106.400020] Code: c3 0f 1f 44 00 00 55 48 89 e5 41 55 49 89 d5 41 54 49 89 fc 53 48 89 f3 48 c7 c6 d3 36 81 81 48 89 df e8 18 22 04 00 85 c0 75 07 <41> 80 7d 00 02 74 0d 48 89 de 4c 89 e7 e8 5a fe ff ff eb 03 83 [ 1106.400020] RIP [<ffffffff812af7b8>] evm_inode_setxattr+0x2a/0x48 [ 1106.400020] RSP <ffff88002917fd50> [ 1106.400020] CR2: 0000000000000000 [ 1106.428061] ---[ end trace ae08331628ba3050 ]---
--- security/integrity/evm/evm_main.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
security/integrity/evm/evm_main.c +6 -3
@@ -296,9 +296,12 @@ int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, {const struct evm_ima_xattr_data *xattr_data = xattr_value; -if ((strcmp (xattr_name,XATTR_NAME_EVM ) ==0 ) - && (xattr_data->type ==EVM_XATTR_HMAC )) -return -EPERM ; +if (strcmp (xattr_name,XATTR_NAME_EVM ) ==0 ) { +if (!xattr_value_len) +return -EINVAL ; +if (xattr_data->type !=EVM_IMA_XATTR_DIGSIG ) +return -EPERM ; + }return evm_protect_xattr (dentry, xattr_name, xattr_value, xattr_value_len); }
Signature · 1 line
2.1.3
PATCH 72/206 ALSA: pcm: Zero-clear reserved fields of PCM status ioctl in compat mode
In reply to Jiri SlabyFrom: Takashi Iwai <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 317168d0c766defd14b3d0e9c2c4a9a258b803ee upstream.
In compat mode, we copy each field of snd_pcm_status struct but don't touch the reserved fields, and this leaves uninitialized values there. Meanwhile the native ioctl does zero-clear the whole structure, so we should follow the same rule in compat mode, too.
--- sound/core/pcm_compat.c | 2 ++ 1 file changed, 2 insertions(+)
sound/core/pcm_compat.c +2 -0
@@ -206,6 +206,8 @@ static int snd_pcm_status_user_compat(struct snd_pcm_substream *substream,if (err <0 )return err; +if (clear_user (src,sizeof (*src))) +return -EFAULT ; if (put_user(status.state, &src->state) || compat_put_timespec(&status.trigger_tstamp, &src->trigger_tstamp) || compat_put_timespec(&status.tstamp, &src->tstamp) ||
Signature · 1 line
2.1.3
PATCH 73/206 missing data dependency barrier in prepend_name()
In reply to Jiri SlabyFrom: Al Viro <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6d13f69444bd3d4888e43f7756449748f5a98bad upstream.
AFAICS, prepend_name() is broken on SMP alpha. Disclaimer: I don't have SMP alpha boxen to reproduce it on. However, it really looks like the race is real.
CPU1: d_path() on /mnt/ramfs/<255-character>/foo
CPU2: mv /mnt/ramfs/<255-character> /mnt/ramfs/<63-character>
CPU2 does d_alloc(), which allocates an external name, stores the name there including terminating NUL, does smp_wmb() and stores its address in dentry->d_name.name. It proceeds to d_add(dentry, NULL) and d_move() old dentry over to that. ->d_name.name value ends up in that dentry.
In the meanwhile, CPU1 gets to prepend_name() for that dentry. It fetches ->d_name.name and ->d_name.len; the former ends up pointing to new name (64-byte kmalloc'ed array), the latter - 255 (length of the old name). Nothing to force the ordering there, and normally that would be OK, since we'd run into the terminating NUL and stop. Except that it's alpha, and we'd need a data dependency barrier to guarantee that we see that store of NUL __d_alloc() has done. In a similar situation dentry_cmp() would survive; it does explicit smp_read_barrier_depends() after fetching ->d_name.name. prepend_name() doesn't and it risks walking past the end of kmalloc'ed object and possibly oops due to taking a page fault in kernel mode.
--- fs/dcache.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/dcache.c +5 -0
@@ -2736,6 +2736,9 @@ static int prepend(char **buffer, int *buflen, const char *str, int namelen)* the beginning of the name. The sequence number check at the caller will * retry it again when a d_move() does happen. So any garbage in the buffer * due to mismatched pointer and length will be discarded. +* +* Data dependency barrier is needed to make sure that we see that terminating +* NUL. Alpha strikes again, film at 11... */ static int prepend_name (char **buffer,int *buflen,struct qstr *name) {
@@ -2743,6 +2746,8 @@ static int prepend_name(char **buffer, int *buflen, struct qstr *name)u32 dlen =ACCESS_ONCE (name->len);char *p; +smp_read_barrier_depends (); + *buflen -= dlen +1 ;if (*buflen <0 )return -ENAMETOOLONG ;
Signature · 1 line
2.1.3
PATCH 74/206 kill wbuf_queued/wbuf_dwork_lock
In reply to Jiri SlabyFrom: Al Viro <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 99358a1ca53e8e6ce09423500191396f0e6584d2 upstream.
schedule_delayed_work() happening when the work is already pending is a cheap no-op. Don't bother with ->wbuf_queued logics - it's both broken (cancelling ->wbuf_dwork leaves it set, as spotted by Jeff Harris) and pointless. It's cheaper to let schedule_delayed_work() handle that case.
--- fs/jffs2/jffs2_fs_sb.h | 2 -- fs/jffs2/wbuf.c | 17 ++--------------- 2 files changed, 2 insertions(+), 17 deletions(-)
fs/jffs2/jffs2_fs_sb.h +0 -2
@@ -134,8 +134,6 @@ struct jffs2_sb_info {struct rw_semaphore wbuf_sem;/* Protects the write buffer */ struct delayed_work wbuf_dwork;/* write-buffer write-out work */ -int wbuf_queued;/* non-zero delayed work is queued */ -spinlock_t wbuf_dwork_lock;/* protects wbuf_dwork and and wbuf_queued */ unsigned char *oobbuf;int oobavail;/* How many bytes are available for JFFS2 in OOB */
fs/jffs2/wbuf.c +2 -15
@@ -1162,10 +1162,6 @@ static void delayed_wbuf_sync(struct work_struct *work)struct jffs2_sb_info *c =work_to_sb (work);struct super_block *sb =OFNI_BS_2SFFJ (c); -spin_lock (&c->wbuf_dwork_lock); - c->wbuf_queued =0 ; -spin_unlock (&c->wbuf_dwork_lock); -if (!(sb->s_flags &MS_RDONLY )) {jffs2_dbg (1 ,"%s()\n" , __func__);jffs2_flush_wbuf_gc (c,0 );
@@ -1180,14 +1176,9 @@ void jffs2_dirty_trigger(struct jffs2_sb_info *c)if (sb->s_flags &MS_RDONLY )return ; -spin_lock (&c->wbuf_dwork_lock); -if (!c->wbuf_queued) { + delay =msecs_to_jiffies (dirty_writeback_interval *10 ); +if (queue_delayed_work (system_long_wq, &c->wbuf_dwork, delay))jffs2_dbg (1 ,"%s()\n" , __func__); - delay =msecs_to_jiffies (dirty_writeback_interval *10 ); -queue_delayed_work (system_long_wq, &c->wbuf_dwork, delay); - c->wbuf_queued =1 ; - } -spin_unlock (&c->wbuf_dwork_lock); }int jffs2_nand_flash_setup (struct jffs2_sb_info *c)
@@ -1211,7 +1202,6 @@ int jffs2_nand_flash_setup(struct jffs2_sb_info *c)/* Initialise write buffer */ init_rwsem (&c->wbuf_sem); -spin_lock_init (&c->wbuf_dwork_lock);INIT_DELAYED_WORK (&c->wbuf_dwork, delayed_wbuf_sync); c->wbuf_pagesize = c->mtd->writesize; c->wbuf_ofs =0xFFFFFFFF ;
@@ -1251,7 +1241,6 @@ int jffs2_dataflash_setup(struct jffs2_sb_info *c) {/* Initialize write buffer */ init_rwsem (&c->wbuf_sem); -spin_lock_init (&c->wbuf_dwork_lock);INIT_DELAYED_WORK (&c->wbuf_dwork, delayed_wbuf_sync); c->wbuf_pagesize = c->mtd->erasesize;
@@ -1311,7 +1300,6 @@ int jffs2_nor_wbuf_flash_setup(struct jffs2_sb_info *c) {/* Initialize write buffer */ init_rwsem (&c->wbuf_sem); -spin_lock_init (&c->wbuf_dwork_lock);INIT_DELAYED_WORK (&c->wbuf_dwork, delayed_wbuf_sync); c->wbuf_pagesize = c->mtd->writesize;
@@ -1346,7 +1334,6 @@ int jffs2_ubivol_setup(struct jffs2_sb_info *c) {return 0 ;init_rwsem (&c->wbuf_sem); -spin_lock_init (&c->wbuf_dwork_lock);INIT_DELAYED_WORK (&c->wbuf_dwork, delayed_wbuf_sync); c->wbuf_pagesize = c->mtd->writesize;
Signature · 1 line
2.1.3
PATCH 75/206 fix misuses of f_count() in ppp and netlink
In reply to Jiri SlabyFrom: Al Viro <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 24dff96a37a2ca319e75a74d3929b2de22447ca6 upstream.
we used to check for "nobody else could start doing anything with that opened file" by checking that refcount was 2 or less - one for descriptor table and one we'd acquired in fget() on the way to wherever we are. That was race-prone (somebody else might have had a reference to descriptor table and do fget() just as we'd been checking) and it had become flat-out incorrect back when we switched to fget_light() on those codepaths - unlike fget(), it doesn't grab an extra reference unless the descriptor table is shared. The same change allowed a race-free check, though - we are safe exactly when refcount is less than 2.
It was a long time ago; pre-2.6.12 for ioctl() (the codepath leading to ppp one) and 2.6.17 for sendmsg() (netlink one). OTOH, netlink hadn't grown that check until 3.9 and ppp used to live in drivers/net, not drivers/net/ppp until 3.1. The bug existed well before that, though, and the same fix used to apply in old location of file.
--- drivers/net/ppp/ppp_generic.c | 2 +- net/netlink/af_netlink.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/ppp/ppp_generic.c +1 -1
@@ -601,7 +601,7 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)if (file == ppp->owner)ppp_shutdown_interface (ppp); } -if (atomic_long_read (&file->f_count) <=2 ) { +if (atomic_long_read (&file->f_count) <2 ) {ppp_release (NULL , file); err =0 ; }else
net/netlink/af_netlink.c +1 -1
@@ -699,7 +699,7 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,* after validation, the socket and the ring may only be used by a * single process, otherwise we fall back to copying. */ -if (atomic_long_read (&sk->sk_socket->file->f_count) >2 || +if (atomic_long_read (&sk->sk_socket->file->f_count) >1 ||atomic_read (&nlk->mapped) >1 ) excl = false;
Signature · 1 line
2.1.3
PATCH 76/206 um: ubd: Fix for processes stuck in D state forever
In reply to Jiri SlabyFrom: Thorsten Knabe <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2a2361228c5e6d8c1733f00653481de918598e50 upstream.
Starting with Linux 3.12 processes get stuck in D state forever in UserModeLinux under sync heavy workloads. This bug was introduced by commit 805f11a0d5 (um: ubd: Add REQ_FLUSH suppport).
Fix bug by adding a check if FLUSH request was successfully submitted to the I/O thread and keeping the FLUSH request on the request queue on submission failures.
--- arch/um/drivers/ubd_kern.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/um/drivers/ubd_kern.c +3 -2
@@ -1277,7 +1277,7 @@ static void do_ubd_request(struct request_queue *q)while (1 ){struct ubd *dev = q->queuedata; -if (dev->end_sg ==0 ){ +if (dev->request ==NULL ){struct request *req =blk_fetch_request (q);if (req ==NULL )return ;
@@ -1299,7 +1299,8 @@ static void do_ubd_request(struct request_queue *q)return ; }prepare_flush_request (req, io_req); -submit_request (io_req, dev); +if (submit_request (io_req, dev) == false) +return ; }while (dev->start_sg < dev->end_sg){
Signature · 1 line
2.1.3
PATCH 77/206 random: add and use memzero_explicit() for clearing data
In reply to Jiri SlabyFrom: Daniel Borkmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d4c5efdb97773f59a2b711754ca0953f24516739 upstream.
zatimend has reported that in his environment (3.16/gcc4.8.3/corei7) memset() calls which clear out sensitive data in extract_{buf,entropy, entropy_user}() in random driver are being optimized away by gcc.
Add a helper memzero_explicit() (similarly as explicit_bzero() variants) that can be used in such cases where a variable with sensitive data is being cleared out in the end. Other use cases might also be in crypto code. [ I have put this into lib/string.c though, as it's always built-in and doesn't need any dependencies then. ]
Fixes kernel bugzilla: 82041
--- drivers/char/random.c | 10 +++++----- include/linux/string.h | 5 +++-- lib/string.c | 16 ++++++++++++++++ 3 files changed, 24 insertions(+), 7 deletions(-)
drivers/char/random.c +5 -5
@@ -930,8 +930,8 @@ static void extract_buf(struct entropy_store *r, __u8 *out)* pool while mixing, and hash one final time. */ sha_transform (hash.w, extract, workspace); -memset (extract,0 ,sizeof (extract)); -memset (workspace,0 ,sizeof (workspace)); +memzero_explicit (extract,sizeof (extract)); +memzero_explicit (workspace,sizeof (workspace));/* * In case the hash function has some recognizable output
@@ -954,7 +954,7 @@ static void extract_buf(struct entropy_store *r, __u8 *out) }memcpy (out, &hash,EXTRACT_SIZE ); -memset (&hash,0 ,sizeof (hash)); +memzero_explicit (&hash,sizeof (hash)); } static ssize_t extract_entropy(struct entropy_store *r, void *buf,
@@ -1002,7 +1002,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf, }/* Wipe data just returned from memory */ -memset (tmp,0 ,sizeof (tmp)); +memzero_explicit (tmp,sizeof (tmp));return ret; }
@@ -1040,7 +1040,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf, }/* Wipe data just returned from memory */ -memset (tmp,0 ,sizeof (tmp)); +memzero_explicit (tmp,sizeof (tmp));return ret; }
include/linux/string.h +3 -2
@@ -129,7 +129,7 @@ int bprintf(u32 *bin_buf, size_t size, const char *fmt, ...) __printf(3, 4);#endif extern ssize_t memory_read_from_buffer (void *to,size_t count,loff_t *ppos, -const void *from,size_t available); +const void *from,size_t available);/** * strstarts - does @str start with @prefix?
@@ -141,7 +141,8 @@ static inline bool strstarts(const char *str, const char *prefix)return strncmp (str, prefix,strlen (prefix)) ==0 ; } -extern size_t memweight (const void *ptr,size_t bytes); +size_t memweight (const void *ptr,size_t bytes); +void memzero_explicit (void *s,size_t count);/** * kbasename - return the last part of a pathname.
lib/string.c +16 -0
@@ -586,6 +586,22 @@ void *memset(void *s, int c, size_t count)EXPORT_SYMBOL (memset);#endif +/** +* memzero_explicit - Fill a region of memory (e.g. sensitive +* keying data) with 0s. +* @s: Pointer to the start of the area. +* @count: The size of the area. +* +* memzero_explicit() doesn't need an arch-specific version as +* it just invokes the one of memset() implicitly. +*/ +void memzero_explicit (void *s,size_t count) +{ +memset (s,0 , count); +OPTIMIZER_HIDE_VAR (s); +} +EXPORT_SYMBOL (memzero_explicit); +#ifndef __HAVE_ARCH_MEMCPY/** * memcpy - Copy one area of memory to another
Signature · 1 line
2.1.3
PATCH 78/206 UBI: add missing kmem_cache_free() in process_pool_aeb error path
In reply to Jiri SlabyFrom: Richard Genoud <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1bf1890e86869032099b539bc83b098be12fc5a7 upstream.
I ran into this error after a ubiupdatevol, because I forgot to backport e9110361a9a4 UBI: fix the volumes tree sorting criteria.
UBI error: process_pool_aeb: orphaned volume in fastmap pool UBI error: ubi_scan_fastmap: Attach by fastmap failed, doing a full scan! kmem_cache_destroy ubi_ainf_peb_slab: Slab cache still has objects
CPU: 0 PID: 1 Comm: swapper Not tainted 3.14.18-00053-gf05cac8dbf85 #1 [<c000d298>] (unwind_backtrace) from [<c000baa8>] (show_stack+0x10/0x14) [<c000baa8>] (show_stack) from [<c01b7a68>] (destroy_ai+0x230/0x244) [<c01b7a68>] (destroy_ai) from [<c01b8fd4>] (ubi_attach+0x98/0x1ec) [<c01b8fd4>] (ubi_attach) from [<c01ade90>] (ubi_attach_mtd_dev+0x2b8/0x868) [<c01ade90>] (ubi_attach_mtd_dev) from [<c038b510>] (ubi_init+0x1dc/0x2ac) [<c038b510>] (ubi_init) from [<c0008860>] (do_one_initcall+0x94/0x140) [<c0008860>] (do_one_initcall) from [<c037aadc>] (kernel_init_freeable+0xe8/0x1b0) [<c037aadc>] (kernel_init_freeable) from [<c02730ac>] (kernel_init+0x8/0xe4) [<c02730ac>] (kernel_init) from [<c00093f0>] (ret_from_fork+0x14/0x24)
UBI: scanning is finished
Freeing the cache in the error path fixes the Slab error.
Tested on at91sam9g35 (3.14.18+fastmap backports)
--- drivers/mtd/ubi/fastmap.c | 1 + 1 file changed, 1 insertion(+)
drivers/mtd/ubi/fastmap.c +1 -0
@@ -330,6 +330,7 @@ static int process_pool_aeb(struct ubi_device *ubi, struct ubi_attach_info *ai, av = tmp_av; else {ubi_err ("orphaned volume in fastmap pool!" ); +kmem_cache_free (ai->aeb_slab_cache, new_aeb);return UBI_BAD_FASTMAP ; }
Signature · 1 line
2.1.3
PATCH 79/206 mnt: Prevent pivot_root from creating a loop in the mount tree
In reply to Jiri SlabyFrom: "Eric W. Biederman" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0d0826019e529f21c84687521d03f60cd241ca7d upstream.
Andy Lutomirski recently demonstrated that when chroot is used to set the root path below the path for the new ``root'' passed to pivot_root the pivot_root system call succeeds and leaks mounts.
In examining the code I see that starting with a new root that is below the current root in the mount tree will result in a loop in the mount tree after the mounts are detached and then reattached to one another. Resulting in all kinds of ugliness including a leak of that mounts involved in the leak of the mount loop.
Prevent this problem by ensuring that the new mount is reachable from the current root of the mount tree.
[Added stable cc. Fixes CVE-2014-7970. --Andy]
--- fs/namespace.c | 3 +++ 1 file changed, 3 insertions(+)
fs/namespace.c +3 -0
@@ -2747,6 +2747,9 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,/* make sure we can reach put_old from new_root */ if (!is_path_reachable (old_mnt, old.dentry, &new)) goto out4; +/* make certain new is below the root */ +if (!is_path_reachable (new_mnt, new.dentry, &root)) + goto out4; root_mp->m_count++;/* pin it so it won't go away */ br_write_lock (&vfsmount_lock);detach_mnt (new_mnt, &parent_path);
Signature · 1 line
2.1.3
PATCH 80/206 mfd: rtsx_pcr: Fix MSI enable error handling
In reply to Jiri SlabyFrom: Chris Ball <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5152970538a5e16c03bbcb9f1c780489a795ed40 upstream.
pci_enable_msi() can return failure with both positive and negative integers -- it returns 0 for success -- but is only tested here for "if (ret < 0)". This causes us to try to use MSI on the RTS5249 SD reader in the Dell XPS 11 when enabling MSI failed, causing:
[ 1.737110] rtsx_pci: probe of 0000:05:00.0 failed with error -110
--- drivers/mfd/rtsx_pcr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/rtsx_pcr.c +1 -1
@@ -1172,7 +1172,7 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, pcr->msi_en = msi_en;if (pcr->msi_en) { ret =pci_enable_msi (pcidev); -if (ret <0 ) +if (ret) pcr->msi_en = false; }
Signature · 1 line
2.1.3
PATCH 81/206 pstore: Fix duplicate {console,ftrace}-efi entries
In reply to Jiri SlabyFrom: Valdis Kletnieks <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d4bf205da618bbd0b038e404d646f14e76915718 upstream.
The pstore filesystem still creates duplicate filename/inode pairs for some pstore types. Add the id to the filename to prevent that.
Before patch:
[/sys/fs/pstore] ls -li
total 0
1250 -r--r--r--. 1 root root 67 Sep 29 17:09 console-efi 1250 -r--r--r--. 1 root root 67 Sep 29 17:09 console-efi 1250 -r--r--r--. 1 root root 67 Sep 29 17:09 console-efi 1250 -r--r--r--. 1 root root 67 Sep 29 17:09 console-efi 1250 -r--r--r--. 1 root root 67 Sep 29 17:09 console-efi 1250 -r--r--r--. 1 root root 67 Sep 29 17:09 console-efi 1250 -r--r--r--. 1 root root 67 Sep 29 17:09 console-efi 1250 -r--r--r--. 1 root root 67 Sep 29 17:09 console-efi 1250 -r--r--r--. 1 root root 67 Sep 29 17:09 console-efi
After:
[/sys/fs/pstore] ls -li
total 0
1232 -r--r--r--. 1 root root 148 Sep 29 17:09 console-efi-141202499100000 1231 -r--r--r--. 1 root root 67 Sep 29 17:09 console-efi-141202499200000 1230 -r--r--r--. 1 root root 148 Sep 29 17:44 console-efi-141202705400000 1229 -r--r--r--. 1 root root 67 Sep 29 17:44 console-efi-141202705500000 1228 -r--r--r--. 1 root root 67 Sep 29 20:42 console-efi-141203772600000 1227 -r--r--r--. 1 root root 148 Sep 29 23:42 console-efi-141204854900000 1226 -r--r--r--. 1 root root 67 Sep 29 23:42 console-efi-141204855000000 1225 -r--r--r--. 1 root root 148 Sep 29 23:59 console-efi-141204954200000 1224 -r--r--r--. 1 root root 67 Sep 29 23:59 console-efi-141204954400000
--- fs/pstore/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/pstore/inode.c +2 -2
@@ -319,10 +319,10 @@ int pstore_mkfile(enum pstore_type_id type, char *psname, u64 id, int count, compressed ? ".enc.z" : "");break ;case PSTORE_TYPE_CONSOLE : -sprintf (name,"console-%s" , psname); +sprintf (name,"console-%s-%lld" , psname, id);break ;case PSTORE_TYPE_FTRACE : -sprintf (name,"ftrace-%s" , psname); +sprintf (name,"ftrace-%s-%lld" , psname, id);break ;case PSTORE_TYPE_MCE :sprintf (name,"mce-%s-%lld" , psname, id);
Signature · 1 line
2.1.3
PATCH 82/206 selinux: fix inode security list corruption
In reply to Jiri SlabyFrom: Stephen Smalley <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 923190d32de4428afbea5e5773be86bea60a9925 upstream.
sb_finish_set_opts() can race with inode_free_security() when initializing inode security structures for inodes created prior to initial policy load or by the filesystem
during ->mount(). This appears to have always been
a possible race, but commit 3dc91d4 ("SELinux: Fix possible NULL pointer dereference in selinux_inode_permission()") made it more evident by immediately reusing the unioned list/rcu element of the inode security structure for call_rcu() upon an inode_free_security(). But the underlying issue was already present before that commit as a possible use-after-free of isec.
Shivnandan Kumar reported the list corruption and proposed a patch to split the list and rcu elements out of the union as separate fields of the inode_security_struct so that setting the rcu element would not affect the list element. However, this would merely hide the issue and not truly fix the code.
This patch instead moves up the deletion of the list entry prior to dropping the sbsec->isec_lock initially. Then, if the inode is dropped subsequently, there will be no further references to the isec.
--- security/selinux/hooks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/selinux/hooks.c +1 -1
@@ -439,6 +439,7 @@ next_inode:list_entry (sbsec->isec_head.next, struct inode_security_struct, list);struct inode *inode = isec->inode; +list_del_init (&isec->list);spin_unlock (&sbsec->isec_lock); inode =igrab (inode);if (inode) {
@@ -447,7 +448,6 @@ next_inode:iput (inode); }spin_lock (&sbsec->isec_lock); -list_del_init (&isec->list); goto next_inode; }spin_unlock (&sbsec->isec_lock);
Signature · 1 line
2.1.3
PATCH 83/206 virtio_pci: fix virtio spec compliance on restore
In reply to Jiri SlabyFrom: "Michael S. Tsirkin" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6fbc198cf623944ab60a1db6d306a4d55cdd820d upstream.
On restore, virtio pci does the following:
+ set features
+ init vqs etc - device can be used at this point!
+ set ACKNOWLEDGE,DRIVER and DRIVER_OK status bits
This is in violation of the virtio spec, which
requires the following order:
- ACKNOWLEDGE
- DRIVER
- init vqs
- DRIVER_OK
This behaviour will break with hypervisors that assume spec compliant behaviour. It seems like a good idea to have this patch applied to stable branches to reduce the support butden for the hypervisors.
--- drivers/virtio/virtio_pci.c | 33 ++++++++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-)
drivers/virtio/virtio_pci.c +30 -3
@@ -792,6 +792,7 @@ static int virtio_pci_restore(struct device *dev)struct pci_dev *pci_dev =to_pci_dev (dev);struct virtio_pci_device *vp_dev =pci_get_drvdata (pci_dev);struct virtio_driver *drv; +unsigned status =0 ;int ret; drv = container_of(vp_dev->vdev.dev.driver,
@@ -802,14 +803,40 @@ static int virtio_pci_restore(struct device *dev)return ret;pci_set_master (pci_dev); +/* We always start by resetting the device, in case a previous +* driver messed it up. */ +vp_reset (&vp_dev->vdev); + +/* Acknowledge that we've seen the device. */ + status |=VIRTIO_CONFIG_S_ACKNOWLEDGE ; +vp_set_status (&vp_dev->vdev, status); + +/* Maybe driver failed before freeze. +* Restore the failed status, for debugging. */ + status |= vp_dev->saved_status &VIRTIO_CONFIG_S_FAILED ; +vp_set_status (&vp_dev->vdev, status); + +if (!drv) +return 0 ; + +/* We have a driver! */ + status |=VIRTIO_CONFIG_S_DRIVER ; +vp_set_status (&vp_dev->vdev, status); +vp_finalize_features (&vp_dev->vdev); -if (drv && drv->restore) +if (drv->restore) { ret = drv->restore (&vp_dev->vdev); +if (ret) { + status |=VIRTIO_CONFIG_S_FAILED ; +vp_set_status (&vp_dev->vdev, status); +return ret; + } + }/* Finally, tell the device we're all set */ -if (!ret) -vp_set_status (&vp_dev->vdev, vp_dev->saved_status); + status |=VIRTIO_CONFIG_S_DRIVER_OK ; +vp_set_status (&vp_dev->vdev, status);return ret; }
Signature · 1 line
2.1.3
PATCH 84/206 xen-blkback: fix leak on grant map error path
In reply to Jiri SlabyFrom: Roger Pau Monné <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 61cecca865280bef4f8a9748d0a9afa5df351ac2 upstream.
Fix leaking a page when a grant mapping has failed.
--- drivers/block/xen-blkback/blkback.c | 1 + 1 file changed, 1 insertion(+)
drivers/block/xen-blkback/blkback.c +1 -0
@@ -755,6 +755,7 @@ again:BUG_ON (new_map_idx >= segs_to_map);if (unlikely (map[new_map_idx].status !=0 )) {pr_debug (DRV_PFX "invalid buffer -- could not remap it\n" ); +put_free_pages (blkif, &pages[seg_idx]->page,1 ); pages[seg_idx]->handle =BLKBACK_INVALID_HANDLE ; ret |=1 ; goto next;
Signature · 1 line
2.1.3
PATCH 85/206 drm/cirrus: bind also to qemu-xen-traditional
In reply to Jiri SlabyFrom: Olaf Hering <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c0c3e735fa7bae29c6623511127fd021b2d6d849 upstream.
qemu as used by xend/xm toolstack uses a different subvendor id. Bind the drm driver also to this emulated card.
--- drivers/gpu/drm/cirrus/cirrus_drv.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/cirrus/cirrus_drv.c +2 -0
@@ -32,6 +32,8 @@ static struct drm_driver driver;static DEFINE_PCI_DEVICE_TABLE (pciidlist) = { {PCI_VENDOR_ID_CIRRUS ,PCI_DEVICE_ID_CIRRUS_5446 ,0x1af4 ,0x1100 ,0 ,0 ,0 }, + {PCI_VENDOR_ID_CIRRUS ,PCI_DEVICE_ID_CIRRUS_5446 ,PCI_VENDOR_ID_XEN , +0x0001 ,0 ,0 ,0 }, {0 ,} };
Signature · 1 line
2.1.3
PATCH 86/206 dm bufio: update last_accessed when relinking a buffer
In reply to Jiri SlabyFrom: Joe Thornber <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit eb76faf53b1ff7a77ce3f78cc98ad392ac70c2a0 upstream.
The 'last_accessed' member of the dm_buffer structure was only set when the the buffer was created. This led to each buffer being discarded after dm_bufio_max_age time even if it was used recently. In practice this resulted in all thinp metadata being evicted soon after being read -- this is particularly problematic for metadata intensive workloads like multithreaded small random IO.
'last_accessed' is now updated each time the buffer is moved to the head of the LRU list, so the buffer is now properly discarded if it was not used in dm_bufio_max_age time.
--- drivers/md/dm-bufio.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/dm-bufio.c +1 -0
@@ -463,6 +463,7 @@ static void __relink_lru(struct dm_buffer *b, int dirty) c->n_buffers[dirty]++; b->list_mode = dirty;list_move (&b->lru_list, &c->lru[dirty]); + b->last_accessed = jiffies; }/*----------------------------------------------------------------
Signature · 1 line
2.1.3
PATCH 87/206 dm bufio: when done scanning return from __scan immediately
In reply to Jiri SlabyFrom: Mikulas Patocka <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0e825862f3c04cee40e25f55680333728a4ffa9b upstream.
When __scan frees the required number of buffer entries that the shrinker requested (nr_to_scan becomes zero) it must return. Before this fix the __scan code exited only the inner loop and continued in the outer loop -- which could result in reduced performance due to extra buffers being freed (e.g. unnecessarily evicted thinp metadata needing to be synchronously re-read into bufio's cache).
Also, move dm_bufio_cond_resched to __scan's inner loop, so that iterating the bufio client's lru lists doesn't result in scheduling latency.
--- drivers/md/dm-bufio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/dm-bufio.c +2 -2
@@ -1456,9 +1456,9 @@ static long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan,list_for_each_entry_safe_reverse (b, tmp, &c->lru[l], lru_list) { freed +=__cleanup_old_buffer (b, gfp_mask,0 );if (!--nr_to_scan) -break ; +return freed; +dm_bufio_cond_resched (); } -dm_bufio_cond_resched (); }return freed; }
Signature · 1 line
2.1.3
PATCH 88/206 drbd: compute the end before rb_insert_augmented()
In reply to Jiri SlabyFrom: Lai Jiangshan <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 82cfb90bc99d7b7e0ec62d0505b9d4f06805d5db upstream.
Commit 98683650 "Merge branch 'drbd-8.4_ed6' into for-3.8-drivers-drbd-8.4_ed6" switches to the new augment API, but the new API requires that the tree is augmented before rb_insert_augmented() is called, which is missing.
So we add the augment-code to drbd_insert_interval() when it travels the tree up to down before rb_insert_augmented(). See the example in include/linux/interval_tree_generic.h or Documentation/rbtree.txt.
drbd_insert_interval() may cancel the insertion when traveling, in this case, the just added augment-code does nothing before cancel since the @this node is already in the subtrees in this case.
--- drivers/block/drbd/drbd_interval.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/block/drbd/drbd_interval.c +4 -0
@@ -79,6 +79,7 @@ bool drbd_insert_interval(struct rb_root *root, struct drbd_interval *this) { struct rb_node **new = &root->rb_node, *parent = NULL; +sector_t this_end = this->sector + (this->size >>9 );BUG_ON (!IS_ALIGNED (this->size,512 ));
@@ -87,6 +88,8 @@ drbd_insert_interval(struct rb_root *root, struct drbd_interval *this) rb_entry(*new, struct drbd_interval, rb); parent = *new; +if (here->end < this_end) + here->end = this_end;if (this->sector < here->sector) new = &(*new)->rb_left;else if (this->sector > here->sector)
@@ -99,6 +102,7 @@ drbd_insert_interval(struct rb_root *root, struct drbd_interval *this)return false; } + this->end = this_end;rb_link_node (&this->rb, parent, new);rb_insert_augmented (&this->rb, root, &augment_callbacks);return true;
Signature · 1 line
2.1.3
PATCH 89/206 block: fix alignment_offset math that assumes io_min is a power-of-2
In reply to Jiri SlabyFrom: Mike Snitzer <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b8839b8c55f3fdd60dc36abcda7e0266aff7985c upstream.
The math in both blk_stack_limits() and queue_limit_alignment_offset() assume that a block device's io_min (aka minimum_io_size) is always a power-of-2. Fix the math such that it works for non-power-of-2 io_min.
This issue (of alignment_offset != 0) became apparent when testing dm-thinp with a thinp blocksize that matches a RAID6 stripesize of 1280K. Commit fdfb4c8c1 ("dm thin: set minimum_io_size to pool's data block size") unlocked the potential for alignment_offset != 0 due to the dm-thin-pool's io_min possibly being a non-power-of-2.
--- block/blk-settings.c | 4 ++-- include/linux/blkdev.h | 5 ++--- 2 files changed, 4 insertions(+), 5 deletions(-)
block/blk-settings.c +2 -2
@@ -553,7 +553,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, bottom =max (b->physical_block_size, b->io_min) + alignment;/* Verify that top and bottom intervals line up */ -if (max (top, bottom) & (min (top, bottom) -1 )) { +if (max (top, bottom) %min (top, bottom)) { t->misaligned =1 ; ret =-1 ; }
@@ -594,7 +594,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,/* Find lowest common alignment_offset */ t->alignment_offset =lcm (t->alignment_offset, alignment) - & (max (t->physical_block_size, t->io_min) -1 ); + %max (t->physical_block_size, t->io_min);/* Verify that new alignment_offset is on a logical block boundary */ if (t->alignment_offset & (t->logical_block_size -1 )) {
include/linux/blkdev.h +2 -3
@@ -1198,10 +1198,9 @@ static inline int queue_alignment_offset(struct request_queue *q)static inline int queue_limit_alignment_offset (struct queue_limits *lim,sector_t sector) {unsigned int granularity =max (lim->physical_block_size, lim->io_min); -unsigned int alignment = (sector <<9 ) & (granularity -1 ); +unsigned int alignment =sector_div (sector, granularity >>9 ) <<9 ; -return (granularity + lim->alignment_offset - alignment) - & (granularity -1 ); +return (granularity + lim->alignment_offset - alignment) % granularity; }static inline int bdev_alignment_offset (struct block_device *bdev)
Signature · 1 line
2.1.3
PATCH 90/206 dm log userspace: fix memory leak in dm_ulog_tfr_init failure path
In reply to Jiri SlabyFrom: Alexey Khoroshilov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 56ec16cb1e1ce46354de8511eef962a417c32c92 upstream.
If cn_add_callback() fails in dm_ulog_tfr_init(), it does not deallocate prealloced memory but calls cn_del_callback().
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/md/dm-log-userspace-transfer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-log-userspace-transfer.c +1 -1
@@ -272,7 +272,7 @@ int dm_ulog_tfr_init(void) r =cn_add_callback (&ulog_cn_id,"dmlogusr" , cn_ulog_callback);if (r) { -cn_del_callback (&ulog_cn_id); +kfree (prealloced_cn_msg);return r; }
Signature · 1 line
2.1.3
PATCH 91/206 modules, lock around setting of MODULE_STATE_UNFORMED
In reply to Jiri SlabyFrom: Prarit Bhargava <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d3051b489aa81ca9ba62af366149ef42b8dae97c upstream.
A panic was seen in the following sitation.
There are two threads running on the system. The first thread is a system monitoring thread that is reading /proc/modules. The second thread is loading and unloading a module (in this example I'm using my simple dummy-module.ko). Note, in the "real world" this occurred with the qlogic driver module.
When doing this, the following panic occurred:
------------[ cut here ]------------ kernel BUG at kernel/module.c:3739! invalid opcode: 0000 [#1] SMP Modules linked in: binfmt_misc sg nfsv3 rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache intel_powerclamp coretemp kvm_intel kvm crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel lrw igb gf128mul glue_helper iTCO_wdt iTCO_vendor_support ablk_helper ptp sb_edac cryptd pps_core edac_core shpchp i2c_i801 pcspkr wmi lpc_ich ioatdma mfd_core dca ipmi_si nfsd ipmi_msghandler auth_rpcgss nfs_acl lockd sunrpc xfs libcrc32c sr_mod cdrom sd_mod crc_t10dif crct10dif_common mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit drm_kms_helper ttm isci drm libsas ahci libahci scsi_transport_sas libata i2c_core dm_mirror dm_region_hash dm_log dm_mod [last unloaded: dummy_module] CPU: 37 PID: 186343 Comm: cat Tainted: GF O-------------- 3.10.0+ #7 Hardware name: Intel Corporation S2600CP/S2600CP, BIOS RMLSDP.86I.00.29.D696.1311111329 11/11/2013 task: ffff8807fd2d8000 ti: ffff88080fa7c000 task.ti: ffff88080fa7c000 RIP: 0010:[<ffffffff810d64c5>] [<ffffffff810d64c5>] module_flags+0xb5/0xc0 RSP: 0018:ffff88080fa7fe18 EFLAGS: 00010246 RAX: 0000000000000003 RBX: ffffffffa03b5200 RCX: 0000000000000000 RDX: 0000000000001000 RSI: ffff88080fa7fe38 RDI: ffffffffa03b5000 RBP: ffff88080fa7fe28 R08: 0000000000000010 R09: 0000000000000000 R10: 0000000000000000 R11: 000000000000000f R12: ffffffffa03b5000 R13: ffffffffa03b5008 R14: ffffffffa03b5200 R15: ffffffffa03b5000 FS: 00007f6ae57ef740(0000) GS:ffff88101e7a0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000404f70 CR3: 0000000ffed48000 CR4: 00000000001407e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Stack: ffffffffa03b5200 ffff8810101e4800 ffff88080fa7fe70 ffffffff810d666c ffff88081e807300 000000002e0f2fbf 0000000000000000 ffff88100f257b00 ffffffffa03b5008 ffff88080fa7ff48 ffff8810101e4800 ffff88080fa7fee0 Call Trace: [<ffffffff810d666c>] m_show+0x19c/0x1e0 [<ffffffff811e4d7e>] seq_read+0x16e/0x3b0 [<ffffffff812281ed>] proc_reg_read+0x3d/0x80 [<ffffffff811c0f2c>] vfs_read+0x9c/0x170 [<ffffffff811c1a58>] SyS_read+0x58/0xb0 [<ffffffff81605829>] system_call_fastpath+0x16/0x1b Code: 48 63 c2 83 c2 01 c6 04 03 29 48 63 d2 eb d9 0f 1f 80 00 00 00 00 48 63 d2 c6 04 13 2d 41 8b 0c 24 8d 50 02 83 f9 01 75 b2 eb cb <0f> 0b 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 RIP [<ffffffff810d64c5>] module_flags+0xb5/0xc0 RSP <ffff88080fa7fe18>
Consider the two processes running on the system.
CPU 0 (/proc/modules reader)
CPU 1 (loading/unloading module)
CPU 0 opens /proc/modules, and starts displaying data for each module by traversing the modules list via fs/seq_file.c:seq_open() and fs/seq_file.c:seq_read(). For each module in the modules list, seq_read does
op->start() <-- this is a pointer to m_start()
op->show() <- this is a pointer to m_show()
op->stop() <-- this is a pointer to m_stop()
The m_start(), m_show(), and m_stop() module functions are defined in kernel/module.c. The m_start() and m_stop() functions acquire and release the module_mutex respectively.
ie) When reading /proc/modules, the module_mutex is acquired and released for each module.
m_show() is called with the module_mutex held. It accesses the module struct data and attempts to write out module data. It is in this code path that the above BUG_ON() warning is encountered, specifically m_show() calls
static char *module_flags(struct module *mod, char *buf) {
int bx = 0;
BUG_ON(mod->state == MODULE_STATE_UNFORMED);
...
The other thread, CPU 1, in unloading the module calls the syscall delete_module() defined in kernel/module.c. The module_mutex is acquired for a short time, and then released. free_module() is called without the module_mutex. free_module() then sets mod->state = MODULE_STATE_UNFORMED, also without the module_mutex. Some additional code is called and then the module_mutex is reacquired to remove the module from the modules list:
/* Now we can delete it from the lists */
mutex_lock(&module_mutex);
stop_machine(__unlink_module, mod, NULL);
mutex_unlock(&module_mutex);
This is the sequence of events that leads to the panic.
CPU 1 is removing dummy_module via delete_module(). It acquires the module_mutex, and then releases it. CPU 1 has NOT set dummy_module->state to MODULE_STATE_UNFORMED yet.
CPU 0, which is reading the /proc/modules, acquires the module_mutex and acquires a pointer to the dummy_module which is still in the modules list. CPU 0 calls m_show for dummy_module. The check in m_show() for MODULE_STATE_UNFORMED passed for dummy_module even though it is being torn down.
Meanwhile CPU 1, which has been continuing to remove dummy_module without holding the module_mutex, now calls free_module() and sets dummy_module->state to MODULE_STATE_UNFORMED.
CPU 0 now calls module_flags() with dummy_module and ...
static char *module_flags(struct module *mod, char *buf)
{
int bx = 0;
BUG_ON(mod->state == MODULE_STATE_UNFORMED);and BOOM.
Acquire and release the module_mutex lock around the setting of MODULE_STATE_UNFORMED in the teardown path, which should resolve the problem.
Testing: In the unpatched kernel I can panic the system within 1 minute by doing
while (true) do insmod dummy_module.ko; rmmod dummy_module.ko; done
and
while (true) do cat /proc/modules; done
in separate terminals.
In the patched kernel I was able to run just over one hour without seeing any issues. I also verified the output of panic via sysrq-c and the output of /proc/modules looks correct for all three states for the dummy_module.
dummy_module 12661 0 - Unloading 0xffffffffa03a5000 (OE-)
dummy_module 12661 0 - Live 0xffffffffa03bb000 (OE)
dummy_module 14015 1 - Loading 0xffffffffa03a5000 (OE+)--- kernel/module.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/module.c +2 -0
@@ -1882,7 +1882,9 @@ static void free_module(struct module *mod)/* We leave it in list to prevent duplicate loads, but make sure * that noone uses it while it's being deconstructed. */ +mutex_lock (&module_mutex); mod->state =MODULE_STATE_UNFORMED ; +mutex_unlock (&module_mutex);/* Remove dynamic debug info */ ddebug_remove_module (mod->name);
Signature · 1 line
2.1.3
PATCH 92/206 framebuffer: fix border color
In reply to Jiri SlabyFrom: Mikulas Patocka <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f74a289b9480648a654e5afd8458c2263c03a1e1 upstream.
The framebuffer code uses the current background color to fill the border when switching consoles, however, this results in inconsistent behavior. For example:
- start Midnigh Commander
- the border is black
- switch to another console and switch back
- the border is cyan
- type something into the command line in mc
- the border is cyan
- switch to another console and switch back
- the border is black
- press F9 to go to menu
- the border is black
- switch to another console and switch back
- the border is dark blue
When switching to a console with Midnight Commander, the border is random color that was left selected by the slang subsystem.
This patch fixes this inconsistency by always using black as the background color when switching consoles.
--- drivers/video/console/bitblit.c | 3 +-- drivers/video/console/fbcon_ccw.c | 3 +-- drivers/video/console/fbcon_cw.c | 3 +-- drivers/video/console/fbcon_ud.c | 3 +-- 4 files changed, 4 insertions(+), 8 deletions(-)
drivers/video/console/bitblit.c +1 -2
@@ -205,7 +205,6 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,static void bit_clear_margins (struct vc_data *vc,struct fb_info *info,int bottom_only) { -int bgshift = (vc->vc_hi_font_mask) ?13 :12 ;unsigned int cw = vc->vc_font.width;unsigned int ch = vc->vc_font.height;unsigned int rw = info->var.xres - (vc->vc_cols*cw);
@@ -214,7 +213,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,unsigned int bs = info->var.yres - bh;struct fb_fillrect region; - region.color =attr_bgcol_ec (bgshift, vc, info); + region.color =0 ; region.rop =ROP_COPY ;if (rw && !bottom_only) {
drivers/video/console/fbcon_ccw.c +1 -2
@@ -197,9 +197,8 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info,unsigned int bh = info->var.xres - (vc->vc_rows*ch);unsigned int bs = vc->vc_rows*ch;struct fb_fillrect region; -int bgshift = (vc->vc_hi_font_mask) ?13 :12 ; - region.color =attr_bgcol_ec (bgshift,vc,info); + region.color =0 ; region.rop =ROP_COPY ;if (rw && !bottom_only) {
drivers/video/console/fbcon_cw.c +1 -2
@@ -180,9 +180,8 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info,unsigned int bh = info->var.xres - (vc->vc_rows*ch);unsigned int rs = info->var.yres - rw;struct fb_fillrect region; -int bgshift = (vc->vc_hi_font_mask) ?13 :12 ; - region.color =attr_bgcol_ec (bgshift,vc,info); + region.color =0 ; region.rop =ROP_COPY ;if (rw && !bottom_only) {
drivers/video/console/fbcon_ud.c +1 -2
@@ -227,9 +227,8 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info,unsigned int rw = info->var.xres - (vc->vc_cols*cw);unsigned int bh = info->var.yres - (vc->vc_rows*ch);struct fb_fillrect region; -int bgshift = (vc->vc_hi_font_mask) ?13 :12 ; - region.color =attr_bgcol_ec (bgshift,vc,info); + region.color =0 ; region.rop =ROP_COPY ;if (rw && !bottom_only) {
Signature · 1 line
2.1.3
PATCH 93/206 Input: i8042 - add noloop quirk for Asus X750LN
In reply to Jiri SlabyFrom: Hans de Goede <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9ff84a17302aeb8913ff244ecc0d8f9d219fecb5 upstream.
Without this the aux port does not get detected, and consequently the touchpad will not work.
https://bugzilla.redhat.com/show_bug.cgi?id=1110011
--- drivers/input/serio/i8042-x86ia64io.h | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +6 -0
@@ -101,6 +101,12 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = { }, { .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_PRODUCT_NAME, "X750LN"), + }, + }, + { + .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Compaq" ),DMI_MATCH (DMI_PRODUCT_NAME ,"ProLiant" ), DMI_MATCH(DMI_PRODUCT_VERSION, "8500"),
Signature · 1 line
2.1.3
PATCH 94/206 Input: i8042 - quirks for Fujitsu Lifebook A544 and Lifebook AH544
In reply to Jiri SlabyFrom: Hans de Goede <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 993b3a3f80a7842a48cd46c2b41e1b3ef6302468 upstream.
These models need i8042.notimeout, otherwise the touchpad will not work.
--- drivers/input/serio/i8042-x86ia64io.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +16 -0
@@ -622,6 +622,22 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { }, }, { +/* Fujitsu A544 laptop */ +/* https://bugzilla.redhat.com/show_bug.cgi?id=1111138 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK A544"), + }, + }, + { +/* Fujitsu AH544 laptop */ +/* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"), + }, + }, + {/* Fujitsu U574 laptop */ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ .matches = {
Signature · 1 line
2.1.3
PATCH 95/206 drm/ast: Fix HW cursor image
In reply to Jiri SlabyFrom: Benjamin Herrenschmidt <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1e99cfa8de0f0879091e33cd65fd60418d006ad9 upstream.
The translation from the X driver to the KMS one typo'ed a couple of array indices, causing the HW cursor to look weird (blocky with leaking edge colors). This fixes it.
--- drivers/gpu/drm/ast/ast_mode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/ast/ast_mode.c +2 -2
@@ -1012,8 +1012,8 @@ static u32 copy_cursor_image(u8 *src, u8 *dst, int width, int height) srcdata32[1 ].ul = *((u32 *)(srcxor +4 )) &0xf0f0f0f0 ; data32.b[0 ] = srcdata32[0 ].b[1 ] | (srcdata32[0 ].b[0 ] >>4 ); data32.b[1 ] = srcdata32[0 ].b[3 ] | (srcdata32[0 ].b[2 ] >>4 ); - data32.b[2 ] = srcdata32[0 ].b[1 ] | (srcdata32[1 ].b[0 ] >>4 ); - data32.b[3 ] = srcdata32[0 ].b[3 ] | (srcdata32[1 ].b[2 ] >>4 ); + data32.b[2 ] = srcdata32[1 ].b[1 ] | (srcdata32[1 ].b[0 ] >>4 ); + data32.b[3 ] = srcdata32[1 ].b[3 ] | (srcdata32[1 ].b[2 ] >>4 );writel (data32.ul, dstxor); csum += data32.ul;
Signature · 1 line
2.1.3
PATCH 96/206 drm/nouveau/bios: memset dcb struct to zero before parsing
In reply to Jiri SlabyFrom: Ben Skeggs <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 595d373f1e9c9ce0fc946457fdb488e8a58972cd upstream.
Fixes type/mask calculation being based on uninitialised data for VGA outputs.
--- drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c +1 -0
@@ -124,6 +124,7 @@ dcb_outp_parse(struct nouveau_bios *bios, u8 idx, u8 *ver, u8 *len, struct dcb_output *outp) {u16 dcb =dcb_outp (bios, idx, ver, len); +memset (outp,0x00 ,sizeof (*outp));if (dcb) {if (*ver >=0x20 ) {u32 conn =nv_ro32 (bios, dcb +0x00 );
Signature · 1 line
2.1.3
PATCH 97/206 media: v4l2-common: fix overflow in v4l_bound_align_image()
In reply to Jiri SlabyFrom: Maciej Matraszek <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3bacc10cd4a85bc70bc0b6c001d3bf995c7fe04c upstream.
Fix clamp_align() used in v4l_bound_align_image() to prevent overflow when passed large value like UINT32_MAX.
In the current implementation:
clamp_align(UINT32_MAX, 8, 8192, 3)
returns 8, because in line:
x = (x + (1 << (align - 1))) & mask;
x overflows to (-1 + 4) & 0x7 = 3, while expected value is 8192.
v4l_bound_align_image() is heavily used in VIDIOC_S_FMT and VIDIOC_SUBDEV_S_FMT ioctls handlers, and documentation of the latter explicitly states that:
"The modified format should be as close as possible to the original request."
-- http://linuxtv.org/downloads/v4l-dvb-apis/vidioc-subdev-g-fmt.html
Thus one would expect, that passing UINT32_MAX as format width and height will result in setting maximum possible resolution for the device. Particularly, when the driver doesn't support VIDIOC_ENUM_FRAMESIZES ioctl, which is common in the codebase.
Fixes changeset: b0d3159be9a3
--- drivers/media/v4l2-core/v4l2-common.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/media/v4l2-core/v4l2-common.c +3 -6
@@ -431,16 +431,13 @@ static unsigned int clamp_align(unsigned int x, unsigned int min,/* Bits that must be zero to be aligned */ unsigned int mask = ~((1 << align) -1 ); +/* Clamp to aligned min and max */ + x =clamp (x, (min + ~mask) & mask, max & mask); +/* Round to nearest aligned value */ if (align) x = (x + (1 << (align -1 ))) & mask; -/* Clamp to aligned value of min and max */ -if (x < min) - x = (min + ~mask) & mask; -else if (x > max) - x = max & mask; -return x; }
Signature · 1 line
2.1.3
PATCH 98/206 media: usb: uvc: add a quirk for Dell XPS M1330 webcam
In reply to Jiri SlabyFrom: Paul Fertser <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 62ea864f84fed6e04dd033d500d4c9183a83d590 upstream.
As reported on [1], this device needs this quirk to be able to reliably initialise the webcam.
[1] http://ubuntuforums.org/showthread.php?t=2145996
--- drivers/media/usb/uvc/uvc_driver.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/media/usb/uvc/uvc_driver.c +9 -0
@@ -2210,6 +2210,15 @@ static struct usb_device_id uvc_ids[] = { .bInterfaceSubClass = 1, .bInterfaceProtocol = 0, .driver_info = UVC_QUIRK_PROBE_DEF }, +/* Dell XPS M1330 (OmniVision OV7670 webcam) */ + { .match_flags = USB_DEVICE_ID_MATCH_DEVICE + | USB_DEVICE_ID_MATCH_INT_INFO, + .idVendor = 0x05a9, + .idProduct = 0x7670, + .bInterfaceClass = USB_CLASS_VIDEO, + .bInterfaceSubClass = 1, + .bInterfaceProtocol = 0, + .driver_info = UVC_QUIRK_PROBE_DEF }, /* Apple Built-In iSight */ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
Signature · 1 line
2.1.3
PATCH 99/206 media: em28xx-v4l: give back all active video buffers to the vb2 core properly on streaming stop
In reply to Jiri SlabyFrom: Frank Schaefer <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 627530c32a43283474e9dd3e954519410ffa033a upstream.
When a new video frame is started, the driver takes the next video buffer from the list of active buffers and moves it to dev->usb_ctl.vid_buf / dev->usb_ctl.vbi_buf for further processing.
On streaming stop we currently only give back the pending buffers from the list but not the ones which are currently processed.
This causes the following warning from the vb2 core since kernel 3.15:
...
------------[ cut here ]------------ WARNING: CPU: 1 PID: 2284 at drivers/media/v4l2-core/videobuf2-core.c:2115 __vb2_queue_cancel+0xed/0x150 [videobuf2_core]() [...] Call Trace: [<c0769c46>] dump_stack+0x48/0x69 [<c0245b69>] warn_slowpath_common+0x79/0x90 [<f925e4ad>] ? __vb2_queue_cancel+0xed/0x150 [videobuf2_core] [<f925e4ad>] ? __vb2_queue_cancel+0xed/0x150 [videobuf2_core] [<c0245bfd>] warn_slowpath_null+0x1d/0x20 [<f925e4ad>] __vb2_queue_cancel+0xed/0x150 [videobuf2_core] [<f925fa35>] vb2_internal_streamoff+0x35/0x90 [videobuf2_core] [<f925fac5>] vb2_streamoff+0x35/0x60 [videobuf2_core] [<f925fb27>] vb2_ioctl_streamoff+0x37/0x40 [videobuf2_core] [<f8e45895>] v4l_streamoff+0x15/0x20 [videodev] [<f8e4925d>] __video_do_ioctl+0x23d/0x2d0 [videodev] [<f8e49020>] ? video_ioctl2+0x20/0x20 [videodev] [<f8e48c63>] video_usercopy+0x203/0x5a0 [videodev] [<f8e49020>] ? video_ioctl2+0x20/0x20 [videodev] [<c039d0e7>] ? fsnotify+0x1e7/0x2b0 [<f8e49012>] video_ioctl2+0x12/0x20 [videodev] [<f8e49020>] ? video_ioctl2+0x20/0x20 [videodev] [<f8e4461e>] v4l2_ioctl+0xee/0x130 [videodev] [<f8e44530>] ? v4l2_open+0xf0/0xf0 [videodev] [<c0378de2>] do_vfs_ioctl+0x2e2/0x4d0 [<c0368eec>] ? vfs_write+0x13c/0x1c0 [<c0369a8f>] ? vfs_writev+0x2f/0x50 [<c0379028>] SyS_ioctl+0x58/0x80 [<c076fff3>] sysenter_do_call+0x12/0x12 ---[ end trace 5545f934409f13f4 ]---
...
Many thanks to Hans Verkuil, whose recently added check in the vb2 core unveiled this long standing issue and who has investigated it further.
--- drivers/media/usb/em28xx/em28xx-video.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/media/usb/em28xx/em28xx-video.c +8 -2
@@ -695,13 +695,16 @@ static int em28xx_stop_streaming(struct vb2_queue *vq) }spin_lock_irqsave (&dev->slock, flags); +if (dev->usb_ctl.vid_buf !=NULL ) { +vb2_buffer_done (&dev->usb_ctl.vid_buf->vb,VB2_BUF_STATE_ERROR ); + dev->usb_ctl.vid_buf =NULL ; + }while (!list_empty (&vidq->active)) {struct em28xx_buffer *buf; buf = list_entry(vidq->active.next, struct em28xx_buffer, list);list_del (&buf->list);vb2_buffer_done (&buf->vb,VB2_BUF_STATE_ERROR ); } - dev->usb_ctl.vid_buf =NULL ;spin_unlock_irqrestore (&dev->slock, flags);return 0 ;
@@ -723,13 +726,16 @@ int em28xx_stop_vbi_streaming(struct vb2_queue *vq) }spin_lock_irqsave (&dev->slock, flags); +if (dev->usb_ctl.vbi_buf !=NULL ) { +vb2_buffer_done (&dev->usb_ctl.vbi_buf->vb,VB2_BUF_STATE_ERROR ); + dev->usb_ctl.vbi_buf =NULL ; + }while (!list_empty (&vbiq->active)) {struct em28xx_buffer *buf; buf = list_entry(vbiq->active.next, struct em28xx_buffer, list);list_del (&buf->list);vb2_buffer_done (&buf->vb,VB2_BUF_STATE_ERROR ); } - dev->usb_ctl.vbi_buf =NULL ;spin_unlock_irqrestore (&dev->slock, flags);return 0 ;
Signature · 1 line
2.1.3
PATCH 100/206 media: ds3000: fix LNB supply voltage on Tevii S480 on initialization
In reply to Jiri SlabyFrom: Ulrich Eckhardt <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8c5bcded11cb607b1bb5920de3b9c882136d27db upstream.
The Tevii S480 outputs 18V on startup for the LNB supply voltage and does not automatically power down. This blocks other receivers connected to a satellite channel router (EN50494), since the receivers can not send the required DiSEqC sequences when the Tevii card is connected to a the same SCR.
This patch switches off the LNB supply voltage on initialization of the frontend.
[[email protected]: add a comment about why we're explicitly
turning off voltage at device init]
--- drivers/media/dvb-frontends/ds3000.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/media/dvb-frontends/ds3000.c +7 -0
@@ -864,6 +864,13 @@ struct dvb_frontend *ds3000_attach(const struct ds3000_config *config,memcpy (&state->frontend.ops, &ds3000_ops,sizeof (struct dvb_frontend_ops )); state->frontend.demodulator_priv = state; + +/* +* Some devices like T480 starts with voltage on. Be sure +* to turn voltage off during init, as this can otherwise +* interfere with Unicable SCR systems. +*/ +ds3000_set_voltage (&state->frontend,SEC_VOLTAGE_OFF );return &state->frontend; error3:
Signature · 1 line
2.1.3
PATCH 101/206 media: tda7432: Fix setting TDA7432_MUTE bit for TDA7432_RF register
In reply to Jiri SlabyFrom: Axel Lin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 91ba0e59babdb3c7aca836a65f1095b3eaff7b06 upstream.
Fix a copy-paste bug when converting to the control framework.
--- drivers/media/i2c/tda7432.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/tda7432.c +1 -1
@@ -293,7 +293,7 @@ static int tda7432_s_ctrl(struct v4l2_ctrl *ctrl)if (t->mute->val) { lf |=TDA7432_MUTE ; lr |=TDA7432_MUTE ; - lf |=TDA7432_MUTE ; + rf |=TDA7432_MUTE ; rr |=TDA7432_MUTE ; }/* Mute & update balance*/
Signature · 1 line
2.1.3
PATCH 102/206 kvm: fix excessive pages un-pinning in kvm_iommu_map error path.
In reply to Jiri SlabyFrom: Quentin Casasnovas <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3d32e4dbe71374a6780eaf51d719d76f9a9bf22f upstream.
The third parameter of kvm_unpin_pages() when called from kvm_iommu_map_pages() is wrong, it should be the number of pages to un-pin and not the page size.
This error was facilitated with an inconsistent API: kvm_pin_pages() takes a size, but kvn_unpin_pages() takes a number of pages, so fix the problem by matching the two.
This was introduced by commit 350b8bd ("kvm: iommu: fix the third parameter of kvm_iommu_put_pages (CVE-2014-3601)"), which fixes the lack of un-pinning for pages intended to be un-pinned (i.e. memory leak) but unfortunately potentially aggravated the number of pages we un-pin that should have stayed pinned. As far as I understand though, the same practical mitigations apply.
This issue was found during review of Red Hat 6.6 patches to prepare Ksplice rebootless updates.
Thanks to Vegard for his time on a late Friday evening to help me in understanding this code.
--- virt/kvm/iommu.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
virt/kvm/iommu.c +4 -4
@@ -43,13 +43,13 @@ static void kvm_iommu_put_pages(struct kvm *kvm, gfn_t base_gfn, unsigned long npages);static pfn_t kvm_pin_pages (struct kvm_memory_slot *slot,gfn_t gfn, -unsigned long size) +unsigned long npages) {gfn_t end_gfn;pfn_t pfn; pfn =gfn_to_pfn_memslot (slot, gfn); - end_gfn = gfn + (size >>PAGE_SHIFT ); + end_gfn = gfn + npages; gfn +=1 ;if (is_error_noslot_pfn (pfn))
@@ -119,7 +119,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)* Pin all pages we are about to map in memory. This is * important because we unmap and unpin in 4kb steps later. */ - pfn =kvm_pin_pages (slot, gfn, page_size); + pfn =kvm_pin_pages (slot, gfn, page_size >>PAGE_SHIFT );if (is_error_noslot_pfn (pfn)) { gfn +=1 ;continue ;
@@ -131,7 +131,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)if (r) {printk (KERN_ERR "kvm_iommu_map_address:" "iommu failed to map pfn=%llx\n" , pfn); -kvm_unpin_pages (kvm, pfn, page_size); +kvm_unpin_pages (kvm, pfn, page_size >>PAGE_SHIFT ); goto unmap_pages; }
Signature · 1 line
2.1.3
PATCH 103/206 KVM: x86: Prevent host from panicking on shared MSR writes.
In reply to Jiri SlabyFrom: Andy Honig <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8b3c3104c3f4f706e99365c3e0d2aa61b95f969f upstream.
The previous patch blocked invalid writes directly when the MSR is written. As a precaution, prevent future similar mistakes by gracefulling handle GPs caused by writes to shared MSRs.
--- arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/kvm/vmx.c | 7 +++++-- arch/x86/kvm/x86.c | 11 ++++++++--- 3 files changed, 14 insertions(+), 6 deletions(-)
arch/x86/include/asm/kvm_host.h +1 -1
@@ -1032,7 +1032,7 @@ int kvm_cpu_get_interrupt(struct kvm_vcpu *v);void kvm_vcpu_reset (struct kvm_vcpu *vcpu);void kvm_define_shared_msr (unsigned index,u32 msr); -void kvm_set_shared_msr (unsigned index,u64 val,u64 mask); +int kvm_set_shared_msr (unsigned index,u64 val,u64 mask);bool kvm_is_linear_rip (struct kvm_vcpu *vcpu,unsigned long linear_rip);
arch/x86/kvm/vmx.c +5 -2
@@ -2540,12 +2540,15 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)break ; msr =find_msr_entry (vmx, msr_index);if (msr) { +u64 old_msr_data = msr->data; msr->data = data;if (msr - vmx->guest_msrs < vmx->save_nmsrs) {preempt_disable (); -kvm_set_shared_msr (msr->index, msr->data, - msr->mask); + ret =kvm_set_shared_msr (msr->index, msr->data, + msr->mask);preempt_enable (); +if (ret) + msr->data = old_msr_data; }break ; }
arch/x86/kvm/x86.c +8 -3
@@ -225,20 +225,25 @@ static void kvm_shared_msr_cpu_online(void)shared_msr_update (i, shared_msrs_global.msrs[i]); } -void kvm_set_shared_msr (unsigned slot,u64 value,u64 mask) +int kvm_set_shared_msr (unsigned slot,u64 value,u64 mask) {unsigned int cpu =smp_processor_id ();struct kvm_shared_msrs *smsr =per_cpu_ptr (shared_msrs, cpu); +int err;if (((value ^ smsr->values[slot].curr) & mask) ==0 ) -return ; +return 0 ; smsr->values[slot].curr = value; -wrmsrl (shared_msrs_global.msrs[slot], value); + err =wrmsrl_safe (shared_msrs_global.msrs[slot], value); +if (err) +return 1 ; +if (!smsr->registered) { smsr->urn.on_user_return = kvm_on_user_return;user_return_notifier_register (&smsr->urn); smsr->registered = true; } +return 0 ; }EXPORT_SYMBOL_GPL (kvm_set_shared_msr);
Signature · 1 line
2.1.3
PATCH 104/206 KVM: x86: Improve thread safety in pit
In reply to Jiri SlabyFrom: Andy Honig <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2febc839133280d5a5e8e1179c94ea674489dae2 upstream.
There's a race condition in the PIT emulation code in KVM. In __kvm_migrate_pit_timer the pit_timer object is accessed without synchronization. If the race condition occurs at the wrong time this can crash the host kernel.
This fixes CVE-2014-3611.
--- arch/x86/kvm/i8254.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kvm/i8254.c +2 -0
@@ -262,8 +262,10 @@ void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu)return ; timer = &pit->pit_state.timer; +mutex_lock (&pit->pit_state.lock);if (hrtimer_cancel (timer))hrtimer_start_expires (timer,HRTIMER_MODE_ABS ); +mutex_unlock (&pit->pit_state.lock); }static void destroy_pit_timer (struct kvm_pit *pit)
Signature · 1 line
2.1.3
PATCH 105/206 KVM: x86: Check non-canonical addresses upon WRMSR
In reply to Jiri SlabyFrom: Nadav Amit <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 854e8bb1aa06c578c2c9145fa6bfe3680ef63b23 upstream.
Upon WRMSR, the CPU should inject #GP if a non-canonical value (address) is written to certain MSRs. The behavior is "almost" identical for AMD and Intel (ignoring MSRs that are not implemented in either architecture since they would anyhow #GP). However, IA32_SYSENTER_ESP and IA32_SYSENTER_EIP cause #GP if non-canonical address is written on Intel but not on AMD (which ignores the top 32-bits).
Accordingly, this patch injects a #GP on the MSRs which behave identically on Intel and AMD. To eliminate the differences between the architecutres, the value which is written to IA32_SYSENTER_ESP and IA32_SYSENTER_EIP is turned to canonical value before writing instead of injecting a #GP.
Some references from Intel and AMD manuals:
According to Intel SDM description of WRMSR instruction #GP is expected on WRMSR "If the source register contains a non-canonical address and ECX specifies one of the following MSRs: IA32_DS_AREA, IA32_FS_BASE, IA32_GS_BASE, IA32_KERNEL_GS_BASE, IA32_LSTAR, IA32_SYSENTER_EIP, IA32_SYSENTER_ESP."
According to AMD manual instruction manual:
LSTAR/CSTAR (SYSCALL): "The WRMSR instruction loads the target RIP into the LSTAR and CSTAR registers. If an RIP written by WRMSR is not in canonical form, a general-protection exception (#GP) occurs."IA32_GS_BASE and IA32_FS_BASE (WRFSBASE/WRGSBASE): "The address written to the base field must be in canonical form or a #GP fault will occur." IA32_KERNEL_GS_BASE (SWAPGS): "The address stored in the KernelGSbase MSR must be in canonical form."
This patch fixes CVE-2014-3610.
--- arch/x86/include/asm/kvm_host.h | 14 ++++++++++++++ arch/x86/kvm/svm.c | 2 +- arch/x86/kvm/vmx.c | 2 +- arch/x86/kvm/x86.c | 27 ++++++++++++++++++++++++++- 4 files changed, 42 insertions(+), 3 deletions(-)
arch/x86/include/asm/kvm_host.h +14 -0
@@ -974,6 +974,20 @@ static inline void kvm_inject_gp(struct kvm_vcpu *vcpu, u32 error_code)kvm_queue_exception_e (vcpu,GP_VECTOR , error_code); } +static inline u64 get_canonical (u64 la) +{ +return ((int64_t )la <<16 ) >>16 ; +} + +static inline bool is_noncanonical_address (u64 la) +{ +#ifdef CONFIG_X86_64 +return get_canonical (la) != la; +#else +return false; +#endif +} +#define TSS_IOPB_BASE_OFFSET 0x66#define TSS_BASE_SIZE 0x68#define TSS_IOPB_SIZE (65536 / 8)
arch/x86/kvm/svm.c +1 -1
@@ -3204,7 +3204,7 @@ static int wrmsr_interception(struct vcpu_svm *svm) msr.host_initiated = false; svm->next_rip =kvm_rip_read (&svm->vcpu) +2 ; -if (svm_set_msr (&svm->vcpu, &msr)) { +if (kvm_set_msr (&svm->vcpu, &msr)) {trace_kvm_msr_write_ex (ecx, data);kvm_inject_gp (&svm->vcpu,0 ); }else {
arch/x86/kvm/vmx.c +1 -1
@@ -5116,7 +5116,7 @@ static int handle_wrmsr(struct kvm_vcpu *vcpu) msr.data = data; msr.index = ecx; msr.host_initiated = false; -if (vmx_set_msr (vcpu, &msr) !=0 ) { +if (kvm_set_msr (vcpu, &msr) !=0 ) {trace_kvm_msr_write_ex (ecx, data);kvm_inject_gp (vcpu,0 );return 1 ;
arch/x86/kvm/x86.c +26 -1
@@ -915,7 +915,6 @@ void kvm_enable_efer_bits(u64 mask) }EXPORT_SYMBOL_GPL (kvm_enable_efer_bits); -/* * Writes msr value into into the appropriate "register". * Returns 0 on success, non-0 otherwise.
@@ -923,8 +922,34 @@ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits);*/ int kvm_set_msr (struct kvm_vcpu *vcpu,struct msr_data *msr) { +switch (msr->index) { +case MSR_FS_BASE : +case MSR_GS_BASE : +case MSR_KERNEL_GS_BASE : +case MSR_CSTAR : +case MSR_LSTAR : +if (is_noncanonical_address (msr->data)) +return 1 ; +break ; +case MSR_IA32_SYSENTER_EIP : +case MSR_IA32_SYSENTER_ESP : +/* +* IA32_SYSENTER_ESP and IA32_SYSENTER_EIP cause #GP if +* non-canonical address is written on Intel but not on +* AMD (which ignores the top 32-bits, because it does +* not implement 64-bit SYSENTER). +* +* 64-bit code should hence be able to write a non-canonical +* value on AMD. Making the address canonical ensures that +* vmentry does not fail on Intel after writing a non-canonical +* value, and that something deterministic happens if the guest +* invokes 64-bit SYSENTER. +*/ + msr->data =get_canonical (msr->data); + }return kvm_x86_ops->set_msr (vcpu, msr); } +EXPORT_SYMBOL_GPL (kvm_set_msr);/* * Adapt set_msr() to msr_io()'s calling convention
Signature · 1 line
2.1.3
PATCH 106/206 kvm: x86: don't kill guest on unknown exit reason
In reply to Jiri SlabyFrom: "Michael S. Tsirkin" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2bc19dc3754fc066c43799659f0d848631c44cfe upstream.
KVM_EXIT_UNKNOWN is a kvm bug, we don't really know whether it was triggered by a priveledged application. Let's not kill the guest: WARN and inject #UD instead.
--- arch/x86/kvm/svm.c | 6 +++--- arch/x86/kvm/vmx.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-)
arch/x86/kvm/svm.c +3 -3
@@ -3486,9 +3486,9 @@ static int handle_exit(struct kvm_vcpu *vcpu)if (exit_code >=ARRAY_SIZE (svm_exit_handlers) || !svm_exit_handlers[exit_code]) { - kvm_run->exit_reason =KVM_EXIT_UNKNOWN ; - kvm_run->hw.hardware_exit_reason = exit_code; -return 0 ; +WARN_ONCE (1 ,"vmx: unexpected exit reason 0x%x\n" , exit_code); +kvm_queue_exception (vcpu,UD_VECTOR ); +return 1 ; }return svm_exit_handlers[exit_code](svm);
arch/x86/kvm/vmx.c +3 -3
@@ -6815,10 +6815,10 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu) && kvm_vmx_exit_handlers[exit_reason]) return kvm_vmx_exit_handlers[exit_reason](vcpu); else { - vcpu->run->exit_reason =KVM_EXIT_UNKNOWN ; - vcpu->run->hw.hardware_exit_reason = exit_reason; +WARN_ONCE (1 ,"vmx: unexpected exit reason 0x%x\n" , exit_reason); +kvm_queue_exception (vcpu,UD_VECTOR ); +return 1 ; } -return 0 ; }static void update_cr8_intercept (struct kvm_vcpu *vcpu,int tpr,int irr)
Signature · 1 line
2.1.3
PATCH 107/206 KVM: x86: Fix wrong masking on relative jump/call
In reply to Jiri SlabyFrom: Nadav Amit <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 05c83ec9b73c8124555b706f6af777b10adf0862 upstream.
Relative jumps and calls do the masking according to the operand size, and not according to the address size as the KVM emulator does today.
This patch fixes KVM behavior.
--- arch/x86/kvm/emulate.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-)
arch/x86/kvm/emulate.c +22 -5
@@ -498,11 +498,6 @@ static void rsp_increment(struct x86_emulate_ctxt *ctxt, int inc)masked_increment (reg_rmw (ctxt,VCPU_REGS_RSP ),stack_mask (ctxt), inc); } -static inline void jmp_rel (struct x86_emulate_ctxt *ctxt,int rel) -{ -register_address_increment (ctxt, &ctxt->_eip, rel); -} -static u32 desc_limit_scaled (struct desc_struct *desc) {u32 limit =get_desc_limit (desc);
@@ -576,6 +571,28 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt)return emulate_exception (ctxt,NM_VECTOR ,0 , false); } +static inline void assign_eip_near (struct x86_emulate_ctxt *ctxt,ulong dst) +{ +switch (ctxt->op_bytes) { +case 2 : + ctxt->_eip = (u16 )dst; +break ; +case 4 : + ctxt->_eip = (u32 )dst; +break ; +case 8 : + ctxt->_eip = dst; +break ; +default : +WARN (1 ,"unsupported eip assignment size\n" ); + } +} + +static inline void jmp_rel (struct x86_emulate_ctxt *ctxt,int rel) +{ +assign_eip_near (ctxt, ctxt->_eip + rel); +} +static u16 get_segment_selector (struct x86_emulate_ctxt *ctxt,unsigned seg) {u16 selector;
Signature · 1 line
2.1.3
PATCH 108/206 KVM: x86: Emulator fixes for eip canonical checks on near branches
In reply to Jiri SlabyFrom: Nadav Amit <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 234f3ce485d54017f15cf5e0699cff4100121601 upstream.
Before changing rip (during jmp, call, ret, etc.) the target should be asserted to be canonical one, as real CPUs do. During sysret, both target rsp and rip should be canonical. If any of these values is noncanonical, a #GP exception should occur. The exception to this rule are syscall and sysenter instructions in which the assigned rip is checked during the assignment to the relevant MSRs.
This patch fixes the emulator to behave as real CPUs do for near branches. Far branches are handled by the next patch.
This fixes CVE-2014-3647.
--- arch/x86/kvm/emulate.c | 78 ++++++++++++++++++++++++++++++++++---------------- 1 file changed, 54 insertions(+), 24 deletions(-)
arch/x86/kvm/emulate.c +54 -24
@@ -571,7 +571,8 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt)return emulate_exception (ctxt,NM_VECTOR ,0 , false); } -static inline void assign_eip_near (struct x86_emulate_ctxt *ctxt,ulong dst) +static inline int assign_eip_far (struct x86_emulate_ctxt *ctxt,ulong dst, +int cs_l) {switch (ctxt->op_bytes) {case 2 :
@@ -581,16 +582,25 @@ static inline void assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst) ctxt->_eip = (u32 )dst;break ;case 8 : +if ((cs_l &&is_noncanonical_address (dst)) || + (!cs_l && (dst & ~(u32)-1 ))) +return emulate_gp (ctxt,0 ); ctxt->_eip = dst;break ;default :WARN (1 ,"unsupported eip assignment size\n" ); } +return X86EMUL_CONTINUE ; +} + +static inline int assign_eip_near (struct x86_emulate_ctxt *ctxt,ulong dst) +{ +return assign_eip_far (ctxt, dst, ctxt->mode ==X86EMUL_MODE_PROT64 ); } -static inline void jmp_rel (struct x86_emulate_ctxt *ctxt,int rel) +static inline int jmp_rel (struct x86_emulate_ctxt *ctxt,int rel) { -assign_eip_near (ctxt, ctxt->_eip + rel); +return assign_eip_near (ctxt, ctxt->_eip + rel); }static u16 get_segment_selector (struct x86_emulate_ctxt *ctxt,unsigned seg)
@@ -1981,13 +1991,15 @@ static int em_grp45(struct x86_emulate_ctxt *ctxt)case 2 :/* call near abs */ {long int old_eip; old_eip = ctxt->_eip; - ctxt->_eip = ctxt->src.val; + rc =assign_eip_near (ctxt, ctxt->src.val); +if (rc !=X86EMUL_CONTINUE ) +break ; ctxt->src.val = old_eip; rc =em_push (ctxt);break ; }case 4 :/* jmp abs */ - ctxt->_eip = ctxt->src.val; + rc =assign_eip_near (ctxt, ctxt->src.val);break ;case 5 :/* jmp far */ rc =em_jmp_far (ctxt);
@@ -2019,10 +2031,14 @@ static int em_cmpxchg8b(struct x86_emulate_ctxt *ctxt)static int em_ret (struct x86_emulate_ctxt *ctxt) { - ctxt->dst.type =OP_REG ; - ctxt->dst.addr.reg = &ctxt->_eip; - ctxt->dst.bytes = ctxt->op_bytes; -return em_pop (ctxt); +int rc; +unsigned long eip; + + rc =emulate_pop (ctxt, &eip, ctxt->op_bytes); +if (rc !=X86EMUL_CONTINUE ) +return rc; + +return assign_eip_near (ctxt, eip); }static int em_ret_far (struct x86_emulate_ctxt *ctxt)
@@ -2300,7 +2316,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) {const struct x86_emulate_ops *ops = ctxt->ops;struct desc_struct cs, ss; -u64 msr_data; +u64 msr_data, rcx, rdx;int usermode;u16 cs_sel =0 , ss_sel =0 ;
@@ -2316,6 +2332,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)else usermode =X86EMUL_MODE_PROT32 ; + rcx =reg_read (ctxt,VCPU_REGS_RCX ); + rdx =reg_read (ctxt,VCPU_REGS_RDX ); + cs.dpl =3 ; ss.dpl =3 ; ops->get_msr (ctxt,MSR_IA32_SYSENTER_CS , &msr_data);
@@ -2333,6 +2352,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) ss_sel = cs_sel +8 ; cs.d =0 ; cs.l =1 ; +if (is_noncanonical_address (rcx) || +is_noncanonical_address (rdx)) +return emulate_gp (ctxt,0 );break ; } cs_sel |=SELECTOR_RPL_MASK ;
@@ -2341,8 +2363,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) ops->set_segment (ctxt, cs_sel, &cs,0 ,VCPU_SREG_CS ); ops->set_segment (ctxt, ss_sel, &ss,0 ,VCPU_SREG_SS ); - ctxt->_eip =reg_read (ctxt,VCPU_REGS_RDX ); - *reg_write (ctxt,VCPU_REGS_RSP ) =reg_read (ctxt,VCPU_REGS_RCX ); + ctxt->_eip = rdx; + *reg_write (ctxt,VCPU_REGS_RSP ) = rcx;return X86EMUL_CONTINUE ; }
@@ -2881,10 +2903,13 @@ static int em_aad(struct x86_emulate_ctxt *ctxt)static int em_call (struct x86_emulate_ctxt *ctxt) { +int rc;long rel = ctxt->src.val; ctxt->src.val = (unsigned long )ctxt->_eip; -jmp_rel (ctxt, rel); + rc =jmp_rel (ctxt, rel); +if (rc !=X86EMUL_CONTINUE ) +return rc;return em_push (ctxt); }
@@ -2916,11 +2941,12 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt)static int em_ret_near_imm (struct x86_emulate_ctxt *ctxt) {int rc; +unsigned long eip; - ctxt->dst.type =OP_REG ; - ctxt->dst.addr.reg = &ctxt->_eip; - ctxt->dst.bytes = ctxt->op_bytes; - rc =emulate_pop (ctxt, &ctxt->dst.val, ctxt->op_bytes); + rc =emulate_pop (ctxt, &eip, ctxt->op_bytes); +if (rc !=X86EMUL_CONTINUE ) +return rc; + rc =assign_eip_near (ctxt, eip);if (rc !=X86EMUL_CONTINUE )return rc;rsp_increment (ctxt, ctxt->src.val);
@@ -3210,20 +3236,24 @@ static int em_lmsw(struct x86_emulate_ctxt *ctxt)static int em_loop (struct x86_emulate_ctxt *ctxt) { +int rc =X86EMUL_CONTINUE ; +register_address_increment (ctxt,reg_rmw (ctxt,VCPU_REGS_RCX ),-1 );if ((address_mask (ctxt,reg_read (ctxt,VCPU_REGS_RCX )) !=0 ) && (ctxt->b ==0xe2 ||test_cc (ctxt->b ^0x5 , ctxt->eflags))) -jmp_rel (ctxt, ctxt->src.val); + rc =jmp_rel (ctxt, ctxt->src.val); -return X86EMUL_CONTINUE ; +return rc; }static int em_jcxz (struct x86_emulate_ctxt *ctxt) { +int rc =X86EMUL_CONTINUE ; +if (address_mask (ctxt,reg_read (ctxt,VCPU_REGS_RCX )) ==0 ) -jmp_rel (ctxt, ctxt->src.val); + rc =jmp_rel (ctxt, ctxt->src.val); -return X86EMUL_CONTINUE ; +return rc; }static int em_in (struct x86_emulate_ctxt *ctxt)
@@ -4575,7 +4605,7 @@ special_insn:break ; case 0x70 ... 0x7f: /* jcc (short) */if (test_cc (ctxt->b, ctxt->eflags)) -jmp_rel (ctxt, ctxt->src.val); + rc =jmp_rel (ctxt, ctxt->src.val);break ;case 0x8d :/* lea r16/r32, m */ ctxt->dst.val = ctxt->src.addr.mem.ea;
@@ -4604,7 +4634,7 @@ special_insn:break ;case 0xe9 :/* jmp rel */ case 0xeb :/* jmp rel short */ -jmp_rel (ctxt, ctxt->src.val); + rc =jmp_rel (ctxt, ctxt->src.val); ctxt->dst.type =OP_NONE ;/* Disable writeback. */ break ;case 0xf4 :/* hlt */
@@ -4724,7 +4754,7 @@ twobyte_insn:break ; case 0x80 ... 0x8f: /* jnz rel, etc*/if (test_cc (ctxt->b, ctxt->eflags)) -jmp_rel (ctxt, ctxt->src.val); + rc =jmp_rel (ctxt, ctxt->src.val);break ; case 0x90 ... 0x9f: /* setcc r/m8 */ ctxt->dst.val =test_cc (ctxt->b, ctxt->eflags);
Signature · 1 line
2.1.3
PATCH 109/206 kvm: vmx: handle invvpid vm exit gracefully
In reply to Jiri SlabyFrom: Petr Matousek <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a642fc305053cc1c6e47e4f4df327895747ab485 upstream.
On systems with invvpid instruction support (corresponding bit in IA32_VMX_EPT_VPID_CAP MSR is set) guest invocation of invvpid causes vm exit, which is currently not handled and results in propagation of unknown exit to userspace.
Fix this by installing an invvpid vm exit handler.
This is CVE-2014-3646.
--- arch/x86/include/uapi/asm/vmx.h | 2 ++ arch/x86/kvm/vmx.c | 9 ++++++++- 2 files changed, 10 insertions(+), 1 deletion(-)
arch/x86/include/uapi/asm/vmx.h +2 -0
@@ -67,6 +67,7 @@#define EXIT_REASON_EPT_MISCONFIG 49#define EXIT_REASON_INVEPT 50#define EXIT_REASON_PREEMPTION_TIMER 52 +#define EXIT_REASON_INVVPID 53#define EXIT_REASON_WBINVD 54#define EXIT_REASON_XSETBV 55#define EXIT_REASON_APIC_WRITE 56
@@ -114,6 +115,7 @@ { EXIT_REASON_EOI_INDUCED, "EOI_INDUCED" }, \ { EXIT_REASON_INVALID_STATE, "INVALID_STATE" }, \ { EXIT_REASON_INVD, "INVD" }, \ + { EXIT_REASON_INVVPID, "INVVPID" }, \ { EXIT_REASON_INVPCID, "INVPCID" } #endif /* _UAPIVMX_H */
arch/x86/kvm/vmx.c +8 -1
@@ -6388,6 +6388,12 @@ static int handle_invept(struct kvm_vcpu *vcpu)return 1 ; } +static int handle_invvpid (struct kvm_vcpu *vcpu) +{ +kvm_queue_exception (vcpu,UD_VECTOR ); +return 1 ; +} +/* * The exit handlers return 1 if the exit was handled fully and guest execution * may resume. Otherwise they set the kvm_run parameter to indicate what needs
@@ -6433,6 +6439,7 @@ static int (*const kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = { [EXIT_REASON_MWAIT_INSTRUCTION] = handle_invalid_op, [EXIT_REASON_MONITOR_INSTRUCTION] = handle_invalid_op, [EXIT_REASON_INVEPT] = handle_invept, + [EXIT_REASON_INVVPID] = handle_invvpid, }; static const int kvm_vmx_max_exit_handlers =
@@ -6659,7 +6666,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)case EXIT_REASON_VMPTRST :case EXIT_REASON_VMREAD :case EXIT_REASON_VMRESUME :case EXIT_REASON_VMWRITE :case EXIT_REASON_VMOFF :case EXIT_REASON_VMON : -case EXIT_REASON_INVEPT : +case EXIT_REASON_INVEPT :case EXIT_REASON_INVVPID :/* * VMX instructions trap unconditionally. This allows L1 to * emulate them for its L2 guest, i.e., allows 3-level nesting!
Signature · 1 line
2.1.3
PATCH 110/206 ARC: [SMP] General Fixes
In reply to Jiri SlabyFrom: Vineet Gupta <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c3441edd2dea83923421fd6050d2ffdc57696323 upstream.
-Pass the expected arg to non-boot park'ing routine
(It worked so far because existing SMP backends don't use the arg)
-CONFIG_DEBUG_PREEMPT warning
--- arch/arc/kernel/head.S | 7 ++++--- arch/arc/mm/cache_arc700.c | 3 +-- 2 files changed, 5 insertions(+), 5 deletions(-)
arch/arc/kernel/head.S +4 -3
@@ -24,13 +24,13 @@ .globl stext stext: ;------------------------------------------------------------------- - ; Don't clobber r0-r4 yet. It might have bootloader provided info + ; Don't clobber r0-r2 yet. It might have bootloader provided info ;------------------------------------------------------------------- sr @_int_vec_base_lds, [AUX_INTR_VEC_BASE] #ifdef CONFIG_SMP - ; Only Boot (Master) proceeds. Others wait in platform dependent way + ; Ensure Boot (Master) proceeds. Others wait in platform dependent way ; IDENTITY Reg [ 3 2 1 0 ] ; (cpu-id) ^^^ => Zero for UP ARC700 ; => #Core-ID if SMP (Master 0)
@@ -39,7 +39,8 @@ stext: ; need to make sure only boot cpu takes this path. GET_CPU_ID r5 cmp r5, 0 - jnz arc_platform_smp_wait_to_boot + mov.ne r0, r5 + jne arc_platform_smp_wait_to_boot #endif ; Clear BSS before updating any globals ; XXX: use ZOL here
arch/arc/mm/cache_arc700.c +1 -2
@@ -100,10 +100,9 @@#define DC_CTRL_INV_MODE_FLUSH 0x40#define DC_CTRL_FLUSH_STATUS 0x100 -char *arc_cache_mumbojumbo (int cpu_id,char *buf,int len) +char *arc_cache_mumbojumbo (int c,char *buf,int len) {int n =0 ; -unsigned int c =smp_processor_id ();#define PR_CACHE (p, enb, str) \ { \
Signature · 1 line
2.1.3
PATCH 111/206 qla_target: don't delete changed nacls
In reply to Jiri SlabyFrom: Joern Engel <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f4c24db1b7ad0ce84409e15744d26c6f86a96840 upstream.
The code is currently riddled with "drop the hardware_lock to avoid a deadlock" bugs that expose races. One of those races seems to expose a valid warning in tcm_qla2xxx_clear_nacl_from_fcport_map. Add some bandaid to it.
--- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/scsi/qla2xxx/tcm_qla2xxx.c +10 -1
@@ -740,7 +740,16 @@ static void tcm_qla2xxx_clear_nacl_from_fcport_map(struct qla_tgt_sess *sess)pr_debug ("fc_rport domain: port_id 0x%06x\n" , nacl->nport_id); node =btree_remove32 (&lport->lport_fcport_map, nacl->nport_id); -WARN_ON (node && (node != se_nacl)); +if (WARN_ON (node && (node != se_nacl))) { +/* +* The nacl no longer matches what we think it should be. +* Most likely a new dynamic acl has been added while +* someone dropped the hardware lock. It clearly is a +* bug elsewhere, but this bit can't make things worse. +*/ +btree_insert32 (&lport->lport_fcport_map, nacl->nport_id, + node,GFP_ATOMIC ); + }pr_debug ("Removed from fcport_map: %p for WWNN: 0x%016LX, port_id: 0x%06x\n" , se_nacl, nacl->nport_wwnn, nacl->nport_id);
Signature · 1 line
2.1.3
PATCH 112/206 target: Fix queue full status NULL pointer for SCF_TRANSPORT_TASK_SENSE
In reply to Jiri SlabyFrom: Quinn Tran <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 082f58ac4a48d3f5cb4597232cb2ac6823a96f43 upstream.
During temporary resource starvation at lower transport layer, command is placed on queue full retry path, which expose this problem. The TCM queue full handling of SCF_TRANSPORT_TASK_SENSE currently sends the same cmd twice to lower layer. The 1st time led to cmd normal free path. The 2nd time cause Null pointer access.
This regression bug was originally introduced v3.1-rc code in the following commit:
commit e057f53308a5f071556ee80586b99ee755bf07f5
Author: Christoph Hellwig <[email protected]> Date: Mon Oct 17 13:56:41 2011 -0400
target: remove the transport_qf_callback se_cmd callback
--- drivers/target/target_core_transport.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/target/target_core_transport.c +1 -2
@@ -1856,8 +1856,7 @@ static void transport_complete_qf(struct se_cmd *cmd)if (cmd->se_cmd_flags &SCF_TRANSPORT_TASK_SENSE ) {trace_target_cmd_complete (cmd); ret = cmd->se_tfo->queue_status (cmd); -if (ret) - goto out; + goto out; }switch (cmd->data_direction) {
Signature · 1 line
2.1.3
PATCH 113/206 target: Fix APTPL metadata handling for dynamic MappedLUNs
In reply to Jiri SlabyFrom: Nicholas Bellinger <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e24805637d2d270d7975502e9024d473de86afdb upstream.
This patch fixes a bug in handling of SPC-3 PR Activate Persistence across Target Power Loss (APTPL) logic where re-creation of state for MappedLUNs from dynamically generated NodeACLs did not occur during I_T Nexus establishment.
It adds the missing core_scsi3_check_aptpl_registration() call during core_tpg_check_initiator_node_acl() -> core_tpg_add_node_to_devs() in order to replay any pre-loaded APTPL metadata state associated with the newly connected SCSI Initiator Port.
--- drivers/target/target_core_device.c | 3 ++- drivers/target/target_core_pr.c | 6 +++--- drivers/target/target_core_pr.h | 2 +- drivers/target/target_core_tpg.c | 8 ++++++++ 4 files changed, 14 insertions(+), 5 deletions(-)
drivers/target/target_core_device.c +2 -1
@@ -1322,7 +1322,8 @@ int core_dev_add_initiator_node_lun_acl(* Check to see if there are any existing persistent reservation APTPL * pre-registrations that need to be enabled for this LUN ACL.. */ -core_scsi3_check_aptpl_registration (lun->lun_se_dev, tpg, lun, lacl); +core_scsi3_check_aptpl_registration (lun->lun_se_dev, tpg, lun, nacl, + lacl->mapped_lun);return 0 ; }
drivers/target/target_core_pr.c +3 -3
@@ -944,10 +944,10 @@ int core_scsi3_check_aptpl_registration(struct se_device *dev, struct se_portal_group *tpg, struct se_lun *lun, - struct se_lun_acl *lun_acl) + struct se_node_acl *nacl, + u32 mapped_lun) { - struct se_node_acl *nacl = lun_acl->se_lun_nacl; -struct se_dev_entry *deve = nacl->device_list[lun_acl->mapped_lun]; + struct se_dev_entry *deve = nacl->device_list[mapped_lun];if (dev->dev_reservation_flags &DRF_SPC2_RESERVATIONS )return 0 ;
drivers/target/target_core_pr.h +1 -1
@@ -55,7 +55,7 @@ extern int core_scsi3_alloc_aptpl_registration( unsigned char *, u16, u32, int, int, u8);extern int core_scsi3_check_aptpl_registration (struct se_device *,struct se_portal_group *,struct se_lun *, -struct se_lun_acl *); +struct se_node_acl *,u32 );extern void core_scsi3_free_pr_reg_from_nacl (struct se_device *,struct se_node_acl *);extern void core_scsi3_free_all_registrations (struct se_device *);
drivers/target/target_core_tpg.c +8 -0
@@ -40,6 +40,7 @@#include <target/target_core_fabric.h> #include "target_core_internal.h" +#include "target_core_pr.h" extern struct se_device *g_lun0_dev;
@@ -165,6 +166,13 @@ void core_tpg_add_node_to_devs(core_enable_device_list_for_node (lun,NULL , lun->unpacked_lun, lun_access, acl, tpg); +/* +* Check to see if there are any existing persistent reservation +* APTPL pre-registrations that need to be enabled for this dynamic +* LUN ACL now.. +*/ +core_scsi3_check_aptpl_registration (dev, tpg, lun, acl, + lun->unpacked_lun);spin_lock (&tpg->tpg_lun_lock); }spin_unlock (&tpg->tpg_lun_lock);
Signature · 1 line
2.1.3
PATCH 114/206 MIPS: ftrace: Fix a microMIPS build problem
In reply to Jiri SlabyFrom: Markos Chandras <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit aedd153f5bb5b1f1d6d9142014f521ae2ec294cc upstream.
Code before the .fixup section needs to have the .insn directive. This has no side effects on MIPS32/64 but it affects the way microMIPS loads the address for the return label.
Fixes the following build problem:
mips-linux-gnu-ld: arch/mips/built-in.o: .fixup+0x4a0: Unsupported jump between ISA modes; consider recompiling with interlinking enabled.
mips-linux-gnu-ld: final link failed: Bad value
Makefile:819: recipe for target 'vmlinux' failed
The fix is similar to 1658f914ff91c3bf ("MIPS: microMIPS:
Disable LL/SC and fix linker bug.")
Patchwork: https://patchwork.linux-mips.org/patch/8117/
--- arch/mips/include/asm/ftrace.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/mips/include/asm/ftrace.h +2 -2
@@ -24,7 +24,7 @@ do { \ asmvolatile ( \ "1: " load " %[" STR(dst) "], 0(%[" STR(src) "])\n"\ " li %[" STR(error) "], 0\n" \ -"2:\n" \ +"2: .insn\n" \ \".section .fixup, \"ax\"\n" \ "3: li %[" STR(error) "], 1\n" \
@@ -46,7 +46,7 @@ do { \ asmvolatile ( \ "1: " store " %[" STR(src) "], 0(%[" STR(dst) "])\n"\ " li %[" STR(error) "], 0\n" \ -"2:\n" \ +"2: .insn\n" \ \".section .fixup, \"ax\"\n" \ "3: li %[" STR(error) "], 1\n" \
Signature · 1 line
2.1.3
PATCH 115/206 MIPS: tlbex: Properly fix HUGE TLB Refill exception handler
In reply to Jiri SlabyFrom: David Daney <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9e0f162a36914937a937358fcb45e0609ef2bfc4 upstream.
In commit 8393c524a25609 (MIPS: tlbex: Fix a missing statement for HUGETLB), the TLB Refill handler was fixed so that non-OCTEON targets would work properly with huge pages. The change was incorrect in that it broke the OCTEON case.
The problem is shown here:
xxx0: df7a0000 ld k0,0(k1)
.
.
.
xxxc0: df610000 ld at,0(k1)
xxxc4: 335a0ff0 andi k0,k0,0xff0
xxxc8: e825ffcd bbit1 at,0x5,0x0
xxxcc: 003ad82d daddu k1,at,k0
.
.
.In the non-octeon case there is a destructive test for the huge PTE bit, and then at 0, $k0 is reloaded (that is what the 8393c524a25609 patch added).
In the octeon case, we modify k1 in the branch delay slot, but we never need k0 again, so the new load is not needed, but since k1 is modified, if we do the load, we load from a garbage location and then get a nested TLB Refill, which is seen in userspace as either SIGBUS or SIGSEGV (depending on the garbage).
The real fix is to only do this reloading if it is needed, and never where it is harmful.
Patchwork: https://patchwork.linux-mips.org/patch/8151/
--- arch/mips/mm/tlbex.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/mips/mm/tlbex.c +5 -1
@@ -1095,6 +1095,7 @@ static void build_update_entries(u32 **p, unsigned int tmp, unsigned int ptep)struct mips_huge_tlb_info {int huge_pte;int restore_scratch; +bool need_reload_pte; }; static struct mips_huge_tlb_info
@@ -1109,6 +1110,7 @@ build_fast_tlb_refill_handler (u32 **p, struct uasm_label **l, rv.huge_pte = scratch; rv.restore_scratch =0 ; + rv.need_reload_pte = false;if (check_for_high_segbits) {UASM_i_MFC0 (p, tmp,C0_BADVADDR );
@@ -1297,6 +1299,7 @@ static void build_r4000_tlb_refill_handler(void) }else { htlb_info.huge_pte =K0 ; htlb_info.restore_scratch =0 ; + htlb_info.need_reload_pte = true; vmalloc_mode = refill_noscratch;/* * create the plain linear handler
@@ -1333,7 +1336,8 @@ static void build_r4000_tlb_refill_handler(void) }#ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT uasm_l_tlb_huge_update (&l, p); -UASM_i_LW (&p,K0 ,0 ,K1 ); +if (htlb_info.need_reload_pte) +UASM_i_LW (&p, htlb_info.huge_pte,0 ,K1 );build_huge_update_entries (&p, htlb_info.huge_pte,K1 );build_huge_tlb_write_entry (&p, &l, &r,K0 , tlb_random, htlb_info.restore_scratch);
Signature · 1 line
2.1.3
PATCH 116/206 qxl: don't create too large primary surface
In reply to Jiri SlabyFrom: Marc-André Lureau <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c572aaf46f71f63ae5914d4e194a955e0ba1b519 upstream.
Limit primary to qemu vgamem size, to avoid reaching qemu guest bug "requested primary larger than framebuffer" on resizing screen too large to fit.
Remove unneeded and misleading variables.
Related to:
https://bugzilla.redhat.com/show_bug.cgi?id=1127552
--- drivers/gpu/drm/qxl/qxl_display.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/gpu/drm/qxl/qxl_display.c +8 -8
@@ -508,7 +508,6 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,struct qxl_framebuffer *qfb;struct qxl_bo *bo, *old_bo =NULL ;struct qxl_crtc *qcrtc =to_qxl_crtc (crtc); -uint32_t width, height, base_offset;bool recreate_primary = false;int ret;int surf_id;
@@ -538,9 +537,10 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,if (qcrtc->index ==0 ) recreate_primary = true; - width = mode->hdisplay; - height = mode->vdisplay; - base_offset =0 ; +if (bo->surf.stride * bo->surf.height > qdev->vram_size) { +DRM_ERROR ("Mode doesn't fit in vram size (vgamem)" ); +return -EINVAL ; + } ret =qxl_bo_reserve (bo, false);if (ret !=0 )
@@ -554,10 +554,10 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,if (recreate_primary) {qxl_io_destroy_primary (qdev);qxl_io_log (qdev, -"recreate primary: %dx%d (was %dx%d,%d,%d)\n" , - width, height, bo->surf.width, - bo->surf.height, bo->surf.stride, bo->surf.format); -qxl_io_create_primary (qdev, base_offset, bo); +"recreate primary: %dx%d,%d,%d\n" , + bo->surf.width, bo->surf.height, + bo->surf.stride, bo->surf.format); +qxl_io_create_primary (qdev,0 , bo); bo->is_primary = true; surf_id =0 ; }else {
Signature · 1 line
2.1.3
PATCH 117/206 jbd2: free bh when descriptor block checksum fails
In reply to Jiri SlabyFrom: "Darrick J. Wong" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 064d83892e9ba547f7d4eae22cbca066d95210ce upstream.
Free the buffer head if the journal descriptor block fails checksum verification.
This is the jbd2 port of the e2fsprogs patch "e2fsck: free bh on csum verify error in do_one_pass".
--- fs/jbd2/recovery.c | 1 + 1 file changed, 1 insertion(+)
fs/jbd2/recovery.c +1 -0
@@ -525,6 +525,7 @@ static int do_one_pass(journal_t *journal, !jbd2_descr_block_csum_verify(journal, bh->b_data)) { err = -EIO ; +brelse (bh); goto failed; }
Signature · 1 line
2.1.3
PATCH 118/206 ext4: check EA value offset when loading
In reply to Jiri SlabyFrom: "Darrick J. Wong" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a0626e75954078cfacddb00a4545dde821170bc5 upstream.
When loading extended attributes, check each entry's value offset to make sure it doesn't collide with the entries.
Without this check it is easy to crash the kernel by mounting a malicious FS containing a file with an EA wherein e_value_offs = 0 and e_value_size > 0 and then deleting the EA, which corrupts the name list.
(See the f_ea_value_crash test's FS image in e2fsprogs for an example.)
--- fs/ext4/xattr.c | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-)
fs/ext4/xattr.c +24 -8
@@ -189,14 +189,28 @@ ext4_listxattr(struct dentry *dentry, char *buffer, size_t size) }static int -ext4_xattr_check_names (struct ext4_xattr_entry *entry,void *end) +ext4_xattr_check_names (struct ext4_xattr_entry *entry,void *end, +void *value_start) { -while (!IS_LAST_ENTRY (entry)) { -struct ext4_xattr_entry *next =EXT4_XATTR_NEXT (entry); +struct ext4_xattr_entry *e = entry; + +while (!IS_LAST_ENTRY (e)) { +struct ext4_xattr_entry *next =EXT4_XATTR_NEXT (e);if ((void *)next >= end)return -EIO ; - entry = next; + e = next; } + +while (!IS_LAST_ENTRY (entry)) { +if (entry->e_value_size !=0 && + (value_start +le16_to_cpu (entry->e_value_offs) < + (void *)e +sizeof (__u32) || + value_start +le16_to_cpu (entry->e_value_offs) + +le32_to_cpu (entry->e_value_size) > end)) +return -EIO ; + entry =EXT4_XATTR_NEXT (entry); + } +return 0 ; }
@@ -213,7 +227,8 @@ ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh)return -EIO ;if (!ext4_xattr_block_csum_verify (inode, bh->b_blocknr,BHDR (bh)))return -EIO ; - error =ext4_xattr_check_names (BFIRST (bh), bh->b_data + bh->b_size); + error =ext4_xattr_check_names (BFIRST (bh), bh->b_data + bh->b_size, + bh->b_data);if (!error)set_buffer_verified (bh);return error;
@@ -329,7 +344,7 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name, header =IHDR (inode, raw_inode); entry =IFIRST (header); end = (void *)raw_inode +EXT4_SB (inode->i_sb)->s_inode_size; - error =ext4_xattr_check_names (entry, end); + error =ext4_xattr_check_names (entry, end, entry);if (error) goto cleanup; error = ext4_xattr_find_entry(&entry, name_index, name,
@@ -457,7 +472,7 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size) raw_inode =ext4_raw_inode (&iloc); header =IHDR (inode, raw_inode); end = (void *)raw_inode +EXT4_SB (inode->i_sb)->s_inode_size; - error =ext4_xattr_check_names (IFIRST (header), end); + error =ext4_xattr_check_names (IFIRST (header), end,IFIRST (header));if (error) goto cleanup; error = ext4_xattr_list_entries(dentry, IFIRST(header),
@@ -972,7 +987,8 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i, is->s.here = is->s.first; is->s.end = (void *)raw_inode +EXT4_SB (inode->i_sb)->s_inode_size;if (ext4_test_inode_state (inode,EXT4_STATE_XATTR )) { - error =ext4_xattr_check_names (IFIRST (header), is->s.end); + error =ext4_xattr_check_names (IFIRST (header), is->s.end, +IFIRST (header));if (error)return error;/* Find the named attribute. */
Signature · 1 line
2.1.3
PATCH 119/206 ext4: don't check quota format when there are no quota files
In reply to Jiri SlabyFrom: Jan Kara <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 279bf6d390933d5353ab298fcc306c391a961469 upstream.
The check whether quota format is set even though there are no quota files with journalled quota is pointless and it actually makes it impossible to turn off journalled quotas (as there's no way to unset journalled quota format). Just remove the check.
--- fs/ext4/super.c | 7 ------- 1 file changed, 7 deletions(-)
fs/ext4/super.c +0 -7
@@ -1687,13 +1687,6 @@ static int parse_options(char *options, struct super_block *sb, "not specified"); return 0; } - }else { -if (sbi->s_jquota_fmt) { -ext4_msg (sb,KERN_ERR ,"journaled quota format " -"specified with no journaling " -"enabled" ); -return 0 ; - } }#endif if (test_opt (sb,DIOREAD_NOLOCK )) {
Signature · 1 line
2.1.3
PATCH 120/206 ext4: fix mmap data corruption when blocksize < pagesize
In reply to Jiri SlabyFrom: Jan Kara <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d6320cbfc92910a3e5f10c42d98c231c98db4f60 upstream.
Use truncate_isize_extended() when hole is being created in a file so that ->page_mkwrite() will get called for the partial tail page if it is mmaped (see the first patch in the series for details).
--- fs/ext4/inode.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/ext4/inode.c +5 -1
@@ -4655,8 +4655,12 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)ext4_orphan_del (NULL , inode); goto err_out; } - }else + }else { +loff_t oldsize = inode->i_size; +i_size_write (inode, attr->ia_size); +pagecache_isize_extended (inode, oldsize, inode->i_size); + }/* * Blocks are going to be removed from the inode. Wait
Signature · 1 line
2.1.3
PATCH 121/206 ext4: grab missed write_count for EXT4_IOC_SWAP_BOOT
In reply to Jiri SlabyFrom: Dmitry Monakhov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3e67cfad22230ebed85c56cbe413876f33fea82b upstream.
Otherwise this provokes complain like follows:
WARNING: CPU: 12 PID: 5795 at fs/ext4/ext4_jbd2.c:48 ext4_journal_check_start+0x4e/0xa0() Modules linked in: brd iTCO_wdt lpc_ich mfd_core igb ptp dm_mirror dm_region_hash dm_log dm_mod CPU: 12 PID: 5795 Comm: python Not tainted 3.17.0-rc2-00175-gae5344f #158 Hardware name: Intel Corporation W2600CR/W2600CR, BIOS SE5C600.86B.99.99.x028.061320111235 06/13/2011 0000000000000030 ffff8808116cfd28 ffffffff815c7dfc 0000000000000030 0000000000000000 ffff8808116cfd68 ffffffff8106ce8c ffff8808116cfdc8 ffff880813b16000 ffff880806ad6ae8 ffffffff81202008 0000000000000000 Call Trace: [<ffffffff815c7dfc>] dump_stack+0x51/0x6d [<ffffffff8106ce8c>] warn_slowpath_common+0x8c/0xc0 [<ffffffff81202008>] ? ext4_ioctl+0x9e8/0xeb0 [<ffffffff8106ceda>] warn_slowpath_null+0x1a/0x20 [<ffffffff8122867e>] ext4_journal_check_start+0x4e/0xa0 [<ffffffff81228c10>] __ext4_journal_start_sb+0x90/0x110 [<ffffffff81202008>] ext4_ioctl+0x9e8/0xeb0 [<ffffffff8107b0bd>] ? ptrace_stop+0x24d/0x2f0 [<ffffffff81088530>] ? alloc_pid+0x480/0x480 [<ffffffff8107b1f2>] ? ptrace_do_notify+0x92/0xb0 [<ffffffff81186545>] do_vfs_ioctl+0x4e5/0x550 [<ffffffff815cdbcb>] ? _raw_spin_unlock_irq+0x2b/0x40 [<ffffffff81186603>] SyS_ioctl+0x53/0x80 [<ffffffff815ce2ce>] tracesys+0xd0/0xd5
--- fs/ext4/ioctl.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/ext4/ioctl.c +9 -1
@@ -548,9 +548,17 @@ group_add_out: }case EXT4_IOC_SWAP_BOOT : + { +int err;if (!(filp->f_mode &FMODE_WRITE ))return -EBADF ; -return swap_inode_boot_loader (sb, inode); + err =mnt_want_write_file (filp); +if (err) +return err; + err =swap_inode_boot_loader (sb, inode); +mnt_drop_write_file (filp); +return err; + }case EXT4_IOC_RESIZE_FS : {ext4_fsblk_t n_blocks_count;
Signature · 1 line
2.1.3
PATCH 122/206 ext4: add ext4_iget_normal() which is to be used for dir tree lookups
In reply to Jiri SlabyFrom: Theodore Ts'o <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f4bb2981024fc91b23b4d09a8817c415396dbabb upstream.
If there is a corrupted file system which has directory entries that point at reserved, metadata inodes, prohibit them from being used by treating them the same way we treat Boot Loader inodes --- that is, mark them to be bad inodes. This prohibits them from being opened, deleted, or modified via chmod, chown, utimes, etc.
In particular, this prevents a corrupted file system which has a directory entry which points at the journal inode from being deleted and its blocks released, after which point Much Hilarity Ensues.
--- fs/ext4/ext4.h | 1 + fs/ext4/inode.c | 7 +++++++ fs/ext4/namei.c | 4 ++-- fs/ext4/super.c | 2 +- 4 files changed, 11 insertions(+), 3 deletions(-)
fs/ext4/ext4.h +1 -0
@@ -2093,6 +2093,7 @@ int do_journal_get_write_access(handle_t *handle,#define CONVERT_INLINE_DATA 2extern struct inode *ext4_iget (struct super_block *,unsigned long ); +extern struct inode *ext4_iget_normal (struct super_block *,unsigned long );extern int ext4_write_inode (struct inode *,struct writeback_control *);extern int ext4_setattr (struct dentry *,struct iattr *); extern int ext4_getattr(struct vfsmount *mnt, struct dentry *dentry,
fs/ext4/inode.c +7 -0
@@ -4251,6 +4251,13 @@ bad_inode:return ERR_PTR (ret); } +struct inode *ext4_iget_normal (struct super_block *sb,unsigned long ino) +{ +if (ino <EXT4_FIRST_INO (sb) && ino !=EXT4_ROOT_INO ) +return ERR_PTR (-EIO ); +return ext4_iget (sb, ino); +} +static int ext4_inode_blocks_set (handle_t *handle,struct ext4_inode *raw_inode,struct ext4_inode_info *ei)
fs/ext4/namei.c +2 -2
@@ -1430,7 +1430,7 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi dentry->d_name.name);return ERR_PTR (-EIO ); } - inode =ext4_iget (dir->i_sb, ino); + inode =ext4_iget_normal (dir->i_sb, ino);if (inode ==ERR_PTR (-ESTALE )) { EXT4_ERROR_INODE(dir, "deleted inode referenced: %u",
@@ -1461,7 +1461,7 @@ struct dentry *ext4_get_parent(struct dentry *child)return ERR_PTR (-EIO ); } -return d_obtain_alias (ext4_iget (child->d_inode->i_sb, ino)); +return d_obtain_alias (ext4_iget_normal (child->d_inode->i_sb, ino)); }/*
fs/ext4/super.c +1 -1
@@ -977,7 +977,7 @@ static struct inode *ext4_nfs_get_inode(struct super_block *sb,* Currently we don't know the generation for parent directory, so * a generation of 0 means "accept any" */ - inode =ext4_iget (sb, ino); + inode =ext4_iget_normal (sb, ino);if (IS_ERR (inode))return ERR_CAST (inode);if (generation && inode->i_generation != generation) {
Signature · 1 line
2.1.3
PATCH 123/206 ext4: fix reservation overflow in ext4_da_write_begin
In reply to Jiri SlabyFrom: Eric Sandeen <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0ff8947fc5f700172b37cbca811a38eb9cb81e08 upstream.
Delalloc write journal reservations only reserve 1 credit, to update the inode if necessary. However, it may happen once in a filesystem's lifetime that a file will cross the 2G threshold, and require the LARGE_FILE feature to be set in the superblock as well, if it was not set already.
This overruns the transaction reservation, and can be demonstrated simply on any ext4 filesystem without the LARGE_FILE feature already set:
dd if=/dev/zero of=testfile bs=1 seek=2147483646 count=1 \
conv=notrunc of=testfile
sync
dd if=/dev/zero of=testfile bs=1 seek=2147483647 count=1 \
conv=notrunc of=testfile
leads to:
EXT4-fs: ext4_do_update_inode:4296: aborting transaction: error 28 in __ext4_handle_dirty_super EXT4-fs error (device loop0) in ext4_do_update_inode:4301: error 28
EXT4-fs error (device loop0) in ext4_reserve_inode_write:4757: Readonly filesystem EXT4-fs error (device loop0) in ext4_dirty_inode:4876: error 28
EXT4-fs error (device loop0) in ext4_da_write_end:2685: error 28
Adjust the number of credits based on whether the flag is already set, and whether the current write may extend past the LARGE_FILE limit.
--- fs/ext4/inode.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
fs/ext4/inode.c +16 -1
@@ -2629,6 +2629,20 @@ static int ext4_nonda_switch(struct super_block *sb)return 0 ; } +/* We always reserve for an inode update; the superblock could be there too */ +static int ext4_da_write_credits (struct inode *inode,loff_t pos,unsigned len) +{ +if (likely (EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, +EXT4_FEATURE_RO_COMPAT_LARGE_FILE ))) +return 1 ; + +if (pos + len <=0x7fffffffULL ) +return 1 ; + +/* We might need to update the superblock to set LARGE_FILE */ +return 2 ; +} +static int ext4_da_write_begin (struct file *file,struct address_space *mapping,loff_t pos,unsigned len,unsigned flags,struct page **pagep,void **fsdata)
@@ -2679,7 +2693,8 @@ retry_grab:* of file which has an already mapped buffer. */ retry_journal: - handle =ext4_journal_start (inode,EXT4_HT_WRITE_PAGE ,1 ); + handle =ext4_journal_start (inode,EXT4_HT_WRITE_PAGE , +ext4_da_write_credits (inode, pos, len));if (IS_ERR (handle)) {page_cache_release (page);return PTR_ERR (handle);
Signature · 1 line
2.1.3
PATCH 124/206 ext4: Replace open coded mdata csum feature to helper function
In reply to Jiri SlabyFrom: Dmitry Monakhov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9aa5d32ba269bec0e7eaba2697a986a7b0bc8528 upstream.
Besides the fact that this replacement improves code readability it also protects from errors caused direct EXT4_S(sb)->s_es manipulation which may result attempt to use uninitialized csum machinery.
#Testcase_BEGIN
IMG=/dev/ram0
MNT=/mnt
mkfs.ext4 $IMG
mount $IMG $MNT
#Enable feature directly on disk, on mounted fs
tune2fs -O metadata_csum $IMG
# Provoke metadata update, likey result in OOPS
touch $MNT/test
umount $MNT
#Testcase_END
# Replacement script
@@
expression E;
@@
- EXT4_HAS_RO_COMPAT_FEATURE(E, EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)
+ ext4_has_metadata_csum(E)
https://bugzilla.kernel.org/show_bug.cgi?id=82201
--- fs/ext4/bitmap.c | 12 ++++-------- fs/ext4/ext4.h | 8 ++++++++ fs/ext4/extents.c | 6 ++---- fs/ext4/ialloc.c | 3 +-- fs/ext4/inline.c | 3 +-- fs/ext4/inode.c | 9 +++------ fs/ext4/ioctl.c | 3 +-- fs/ext4/mmp.c | 6 ++---- fs/ext4/namei.c | 39 +++++++++++++-------------------------- fs/ext4/resize.c | 3 +-- fs/ext4/super.c | 15 +++++---------- fs/ext4/xattr.c | 6 ++---- 12 files changed, 43 insertions(+), 70 deletions(-)
fs/ext4/bitmap.c +4 -8
@@ -24,8 +24,7 @@ int ext4_inode_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,__u32 provided, calculated;struct ext4_sb_info *sbi =EXT4_SB (sb); -if (!EXT4_HAS_RO_COMPAT_FEATURE (sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (sb))return 1 ; provided =le16_to_cpu (gdp->bg_inode_bitmap_csum_lo);
@@ -46,8 +45,7 @@ void ext4_inode_bitmap_csum_set(struct super_block *sb, ext4_group_t group,__u32 csum;struct ext4_sb_info *sbi =EXT4_SB (sb); -if (!EXT4_HAS_RO_COMPAT_FEATURE (sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (sb))return ; csum =ext4_chksum (sbi, sbi->s_csum_seed, (__u8 *)bh->b_data, sz);
@@ -65,8 +63,7 @@ int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,struct ext4_sb_info *sbi =EXT4_SB (sb);int sz =EXT4_CLUSTERS_PER_GROUP (sb) /8 ; -if (!EXT4_HAS_RO_COMPAT_FEATURE (sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (sb))return 1 ; provided =le16_to_cpu (gdp->bg_block_bitmap_csum_lo);
@@ -91,8 +88,7 @@ void ext4_block_bitmap_csum_set(struct super_block *sb, ext4_group_t group,__u32 csum;struct ext4_sb_info *sbi =EXT4_SB (sb); -if (!EXT4_HAS_RO_COMPAT_FEATURE (sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (sb))return ; csum =ext4_chksum (sbi, sbi->s_csum_seed, (__u8 *)bh->b_data, sz);
fs/ext4/ext4.h +8 -0
@@ -2328,6 +2328,14 @@ static inline int ext4_has_group_desc_csum(struct super_block *sb) EXT4_FEATURE_RO_COMPAT_METADATA_CSUM); } +static inline int ext4_has_metadata_csum (struct super_block *sb) +{ +WARN_ON_ONCE (EXT4_HAS_RO_COMPAT_FEATURE (sb, +EXT4_FEATURE_RO_COMPAT_METADATA_CSUM ) && + !EXT4_SB (sb)->s_chksum_driver); + +return (EXT4_SB (sb)->s_chksum_driver !=NULL ); +}static inline ext4_fsblk_t ext4_blocks_count (struct ext4_super_block *es) { return ((ext4_fsblk_t)le32_to_cpu(es->s_blocks_count_hi) << 32) |
fs/ext4/extents.c +2 -4
@@ -74,8 +74,7 @@ static int ext4_extent_block_csum_verify(struct inode *inode, {struct ext4_extent_tail *et; -if (!EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (inode->i_sb))return 1 ; et =find_ext4_extent_tail (eh);
@@ -89,8 +88,7 @@ static void ext4_extent_block_csum_set(struct inode *inode, {struct ext4_extent_tail *et; -if (!EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (inode->i_sb))return ; et =find_ext4_extent_tail (eh);
fs/ext4/ialloc.c +1 -2
@@ -988,8 +988,7 @@ got:spin_unlock (&sbi->s_next_gen_lock);/* Precompute checksum seed for inode metadata */ -if (EXT4_HAS_RO_COMPAT_FEATURE (sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) { +if (ext4_has_metadata_csum (sb)) {__u32 csum;__le32 inum =cpu_to_le32 (inode->i_ino);__le32 gen =cpu_to_le32 (inode->i_generation);
fs/ext4/inline.c +1 -2
@@ -1126,8 +1126,7 @@ static int ext4_finish_convert_inline_dir(handle_t *handle,memcpy ((void *)de, buf +EXT4_INLINE_DOTDOT_SIZE , inline_size -EXT4_INLINE_DOTDOT_SIZE ); -if (EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (ext4_has_metadata_csum (inode->i_sb)) csum_size =sizeof (struct ext4_dir_entry_tail ); inode->i_size = inode->i_sb->s_blocksize;
fs/ext4/inode.c +3 -6
@@ -83,8 +83,7 @@ static int ext4_inode_csum_verify(struct inode *inode, struct ext4_inode *raw,if (EXT4_SB (inode->i_sb)->s_es->s_creator_os !=cpu_to_le32 (EXT4_OS_LINUX ) || - !EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) + !ext4_has_metadata_csum (inode->i_sb))return 1 ; provided =le16_to_cpu (raw->i_checksum_lo);
@@ -105,8 +104,7 @@ static void ext4_inode_csum_set(struct inode *inode, struct ext4_inode *raw,if (EXT4_SB (inode->i_sb)->s_es->s_creator_os !=cpu_to_le32 (EXT4_OS_LINUX ) || - !EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) + !ext4_has_metadata_csum (inode->i_sb))return ; csum =ext4_inode_csum (inode, raw, ei);
@@ -4077,8 +4075,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) ei->i_extra_isize =0 ;/* Precompute checksum seed for inode metadata */ -if (EXT4_HAS_RO_COMPAT_FEATURE (sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) { +if (ext4_has_metadata_csum (sb)) {struct ext4_sb_info *sbi =EXT4_SB (inode->i_sb);__u32 csum;__le32 inum =cpu_to_le32 (inode->i_ino);
fs/ext4/ioctl.c +1 -2
@@ -347,8 +347,7 @@ flags_out:if (!inode_owner_or_capable (inode))return -EPERM ; -if (EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) { +if (ext4_has_metadata_csum (inode->i_sb)) {ext4_warning (sb,"Setting inode version is not " "supported with metadata_csum enabled." );return -ENOTTY ;
fs/ext4/mmp.c +2 -4
@@ -20,8 +20,7 @@ static __le32 ext4_mmp_csum(struct super_block *sb, struct mmp_struct *mmp)int ext4_mmp_csum_verify (struct super_block *sb,struct mmp_struct *mmp) { -if (!EXT4_HAS_RO_COMPAT_FEATURE (sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (sb))return 1 ;return mmp->mmp_checksum ==ext4_mmp_csum (sb, mmp);
@@ -29,8 +28,7 @@ int ext4_mmp_csum_verify(struct super_block *sb, struct mmp_struct *mmp)void ext4_mmp_csum_set (struct super_block *sb,struct mmp_struct *mmp) { -if (!EXT4_HAS_RO_COMPAT_FEATURE (sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (sb))return ; mmp->mmp_checksum =ext4_mmp_csum (sb, mmp);
fs/ext4/namei.c +13 -26
@@ -123,8 +123,7 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode, "directory leaf block found instead of index block");return ERR_PTR (-EIO ); } -if (!EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM ) || +if (!ext4_has_metadata_csum (inode->i_sb) ||buffer_verified (bh))return bh;
@@ -339,8 +338,7 @@ int ext4_dirent_csum_verify(struct inode *inode, struct ext4_dir_entry *dirent) {struct ext4_dir_entry_tail *t; -if (!EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (inode->i_sb))return 1 ; t =get_dirent_tail (inode, dirent);
@@ -361,8 +359,7 @@ static void ext4_dirent_csum_set(struct inode *inode, {struct ext4_dir_entry_tail *t; -if (!EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (inode->i_sb))return ; t =get_dirent_tail (inode, dirent);
@@ -437,8 +434,7 @@ static int ext4_dx_csum_verify(struct inode *inode,struct dx_tail *t;int count_offset, limit, count; -if (!EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (inode->i_sb))return 1 ; c =get_dx_countlimit (inode, dirent, &count_offset);
@@ -467,8 +463,7 @@ static void ext4_dx_csum_set(struct inode *inode, struct ext4_dir_entry *dirent)struct dx_tail *t;int count_offset, limit, count; -if (!EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (inode->i_sb))return ; c =get_dx_countlimit (inode, dirent, &count_offset);
@@ -556,8 +551,7 @@ static inline unsigned dx_root_limit(struct inode *dir, unsigned infosize)unsigned entry_space = dir->i_sb->s_blocksize -EXT4_DIR_REC_LEN (1 ) -EXT4_DIR_REC_LEN (2 ) - infosize; -if (EXT4_HAS_RO_COMPAT_FEATURE (dir->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (ext4_has_metadata_csum (dir->i_sb)) entry_space -=sizeof (struct dx_tail );return entry_space /sizeof (struct dx_entry ); }
@@ -566,8 +560,7 @@ static inline unsigned dx_node_limit(struct inode *dir) {unsigned entry_space = dir->i_sb->s_blocksize -EXT4_DIR_REC_LEN (0 ); -if (EXT4_HAS_RO_COMPAT_FEATURE (dir->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (ext4_has_metadata_csum (dir->i_sb)) entry_space -=sizeof (struct dx_tail );return entry_space /sizeof (struct dx_entry ); }
@@ -1535,8 +1528,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,int csum_size =0 ;int err =0 , i; -if (EXT4_HAS_RO_COMPAT_FEATURE (dir->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (ext4_has_metadata_csum (dir->i_sb)) csum_size =sizeof (struct ext4_dir_entry_tail ); bh2 =ext4_append (handle, dir, &newblock);
@@ -1705,8 +1697,7 @@ static int add_dirent_to_buf(handle_t *handle, struct dentry *dentry,int csum_size =0 ;int err; -if (EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (ext4_has_metadata_csum (inode->i_sb)) csum_size =sizeof (struct ext4_dir_entry_tail );if (!de) {
@@ -1773,8 +1764,7 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,struct fake_dirent *fde;int csum_size =0 ; -if (EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (ext4_has_metadata_csum (inode->i_sb)) csum_size =sizeof (struct ext4_dir_entry_tail ); blocksize = dir->i_sb->s_blocksize;
@@ -1890,8 +1880,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,ext4_lblk_t block, blocks;int csum_size =0 ; -if (EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (ext4_has_metadata_csum (inode->i_sb)) csum_size =sizeof (struct ext4_dir_entry_tail ); sb = dir->i_sb;
@@ -2153,8 +2142,7 @@ static int ext4_delete_entry(handle_t *handle,return err; } -if (EXT4_HAS_RO_COMPAT_FEATURE (dir->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (ext4_has_metadata_csum (dir->i_sb)) csum_size =sizeof (struct ext4_dir_entry_tail );BUFFER_TRACE (bh,"get_write_access" );
@@ -2373,8 +2361,7 @@ static int ext4_init_new_dir(handle_t *handle, struct inode *dir,int csum_size =0 ;int err; -if (EXT4_HAS_RO_COMPAT_FEATURE (dir->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (ext4_has_metadata_csum (dir->i_sb)) csum_size =sizeof (struct ext4_dir_entry_tail );if (ext4_test_inode_state (inode,EXT4_STATE_MAY_INLINE_DATA )) {
fs/ext4/resize.c +1 -2
@@ -1200,8 +1200,7 @@ static int ext4_set_bitmap_checksums(struct super_block *sb, {struct buffer_head *bh; -if (!EXT4_HAS_RO_COMPAT_FEATURE (sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (sb))return 0 ; bh =ext4_get_bitmap (sb, group_data->inode_bitmap);
fs/ext4/super.c +5 -10
@@ -140,8 +140,7 @@ static __le32 ext4_superblock_csum(struct super_block *sb,int ext4_superblock_csum_verify (struct super_block *sb,struct ext4_super_block *es) { -if (!EXT4_HAS_RO_COMPAT_FEATURE (sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (sb))return 1 ;return es->s_checksum ==ext4_superblock_csum (sb, es);
@@ -151,8 +150,7 @@ void ext4_superblock_csum_set(struct super_block *sb) {struct ext4_super_block *es =EXT4_SB (sb)->s_es; -if (!EXT4_HAS_RO_COMPAT_FEATURE (sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (sb))return ; es->s_checksum =ext4_superblock_csum (sb, es);
@@ -1984,8 +1982,7 @@ static __le16 ext4_group_desc_csum(struct ext4_sb_info *sbi, __u32 block_group,__u16 crc =0 ;__le32 le_group =cpu_to_le32 (block_group); -if ((sbi->s_es->s_feature_ro_compat & -cpu_to_le32 (EXT4_FEATURE_RO_COMPAT_METADATA_CSUM ))) { +if (ext4_has_metadata_csum (sbi->s_sb)) {/* Use new metadata_csum algorithm */ __le16 save_csum;__u32 csum32;
@@ -3132,8 +3129,7 @@ static int set_journal_csum_feature_set(struct super_block *sb)int compat, incompat;struct ext4_sb_info *sbi =EXT4_SB (sb); -if (EXT4_HAS_RO_COMPAT_FEATURE (sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) { +if (ext4_has_metadata_csum (sb)) {/* journal checksum v3 */ compat =0 ; incompat =JBD2_FEATURE_INCOMPAT_CSUM_V3 ;
@@ -3440,8 +3436,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) }/* Precompute checksum seed for all metadata */ -if (EXT4_HAS_RO_COMPAT_FEATURE (sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (ext4_has_metadata_csum (sb)) sbi->s_csum_seed =ext4_chksum (sbi, ~0 , es->s_uuid,sizeof (es->s_uuid));
fs/ext4/xattr.c +2 -4
@@ -141,8 +141,7 @@ static int ext4_xattr_block_csum_verify(struct inode *inode, sector_t block_nr, struct ext4_xattr_header *hdr) { - if (EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb, - EXT4_FEATURE_RO_COMPAT_METADATA_CSUM) && + if (ext4_has_metadata_csum(inode->i_sb) && (hdr->h_checksum != ext4_xattr_block_csum(inode, block_nr, hdr))) return 0;return 1 ;
@@ -152,8 +151,7 @@ static void ext4_xattr_block_csum_set(struct inode *inode, sector_t block_nr, struct ext4_xattr_header *hdr) { -if (!EXT4_HAS_RO_COMPAT_FEATURE (inode->i_sb, -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM )) +if (!ext4_has_metadata_csum (inode->i_sb))return ; hdr->h_checksum =ext4_xattr_block_csum (inode, block_nr, hdr);
Signature · 1 line
2.1.3
PATCH 125/206 ext4: check s_chksum_driver when looking for bg csum presence
In reply to Jiri SlabyFrom: "Darrick J. Wong" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 813d32f91333e4c33d5a19b67167c4bae42dae75 upstream.
Convert the ext4_has_group_desc_csum predicate to look for a checksum driver instead of the metadata_csum flag and change the bg checksum calculation function to look for GDT_CSUM before taking the crc16 path.
Without this patch, if we mount with ^uninit_bg,^metadata_csum and later metadata_csum gets turned on by accident, the block group checksum functions will incorrectly assume that checksumming is enabled (metadata_csum) but that crc16 should be used (!s_chksum_driver). This is totally wrong, so fix the predicate and the checksum formula selection.
(Granted, if the metadata_csum feature bit gets enabled on a live FS then something underhanded is going on, but we could at least avoid writing garbage into the on-disk fields.)
--- fs/ext4/ext4.h | 4 ++-- fs/ext4/super.c | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-)
fs/ext4/ext4.h +2 -2
@@ -2324,8 +2324,8 @@ extern int ext4_register_li_request(struct super_block *sb,static inline int ext4_has_group_desc_csum (struct super_block *sb) {return EXT4_HAS_RO_COMPAT_FEATURE (sb, -EXT4_FEATURE_RO_COMPAT_GDT_CSUM | -EXT4_FEATURE_RO_COMPAT_METADATA_CSUM ); +EXT4_FEATURE_RO_COMPAT_GDT_CSUM ) || + (EXT4_SB (sb)->s_chksum_driver !=NULL ); }static inline int ext4_has_metadata_csum (struct super_block *sb)
fs/ext4/super.c +4 -0
@@ -2000,6 +2000,10 @@ static __le16 ext4_group_desc_csum(struct ext4_sb_info *sbi, __u32 block_group, }/* old crc16 code */ +if (!(sbi->s_es->s_feature_ro_compat & +cpu_to_le32 (EXT4_FEATURE_RO_COMPAT_GDT_CSUM ))) +return 0 ; + offset = offsetof(struct ext4_group_desc , bg_checksum); crc =crc16 (~0 , sbi->s_es->s_uuid,sizeof (sbi->s_es->s_uuid));
Signature · 1 line
2.1.3
PATCH 126/206 ext4: fix overflow when updating superblock backups after resize
In reply to Jiri SlabyFrom: Jan Kara <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9378c6768e4fca48971e7b6a9075bc006eda981d upstream.
When there are no meta block groups update_backups() will compute the backup block in 32-bit arithmetics thus possibly overflowing the block number and corrupting the filesystem. OTOH filesystems without meta block groups larger than 16 TB should be rare. Fix the problem by doing the counting in 64-bit arithmetics.
Coverity-id: 741252
--- fs/ext4/resize.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/resize.c +1 -1
@@ -1071,7 +1071,7 @@ static void update_backups(struct super_block *sb, int blk_off, char *data,break ;if (meta_bg ==0 ) - backup_block = group * bpg + blk_off; + backup_block = ((ext4_fsblk_t )group) * bpg + blk_off;else backup_block = (ext4_group_first_block_no (sb, group) +ext4_bg_has_super (sb, group));
Signature · 1 line
2.1.3
PATCH 127/206 ext4: enable journal checksum when metadata checksum feature enabled
In reply to Jiri SlabyFrom: "Darrick J. Wong" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 98c1a7593fa355fda7f5a5940c8bf5326ca964ba upstream.
If metadata checksumming is turned on for the FS, we need to tell the journal to use checksumming too.
--- fs/ext4/super.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/ext4/super.c +4 -0
@@ -3458,6 +3458,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)#ifdef CONFIG_EXT4_FS_POSIX_ACL set_opt (sb,POSIX_ACL );#endif +/* don't forget to enable journal_csum when metadata_csum is enabled. */ +if (ext4_has_metadata_csum (sb)) +set_opt (sb,JOURNAL_CHECKSUM ); +if ((def_mount_opts &EXT4_DEFM_JMODE ) ==EXT4_DEFM_JMODE_DATA )set_opt (sb,JOURNAL_DATA );else if ((def_mount_opts &EXT4_DEFM_JMODE ) ==EXT4_DEFM_JMODE_ORDERED )
Signature · 1 line
2.1.3
PATCH 128/206 ext4: fix oops when loading block bitmap failed
In reply to Jiri SlabyFrom: Jan Kara <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 599a9b77ab289d85c2d5c8607624efbe1f552b0f upstream.
When we fail to load block bitmap in __ext4_new_inode() we will dereference NULL pointer in ext4_journal_get_write_access(). So check for error from ext4_read_block_bitmap().
Coverity-id: 989065
--- fs/ext4/ialloc.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/ext4/ialloc.c +4 -0
@@ -864,6 +864,10 @@ got:struct buffer_head *block_bitmap_bh; block_bitmap_bh =ext4_read_block_bitmap (sb, group); +if (!block_bitmap_bh) { + err = -EIO ; + goto out; + }BUFFER_TRACE (block_bitmap_bh,"get block bitmap access" ); err =ext4_journal_get_write_access (handle, block_bitmap_bh);if (err) {
Signature · 1 line
2.1.3
PATCH 129/206 cpufreq: expose scaling_cur_freq sysfs file for set_policy() drivers
In reply to Jiri SlabyFrom: Dirk Brandewie <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c034b02e213d271b98c45c4a7b54af8f69aaac1e upstream.
Currently the core does not expose scaling_cur_freq for set_policy() drivers this breaks some userspace monitoring tools.
Change the core to expose this file for all drivers and if the set_policy() driver supports the get() callback use it to retrieve the current frequency.
--- drivers/cpufreq/cpufreq.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
drivers/cpufreq/cpufreq.c +17 -6
@@ -412,7 +412,18 @@ show_one(cpuinfo_max_freq, cpuinfo.max_freq);show_one (cpuinfo_transition_latency, cpuinfo.transition_latency);show_one (scaling_min_freq, min);show_one (scaling_max_freq, max); -show_one (scaling_cur_freq, cur); + +static ssize_t show_scaling_cur_freq ( +struct cpufreq_policy *policy,char *buf) +{ +ssize_t ret; + +if (cpufreq_driver && cpufreq_driver->setpolicy && cpufreq_driver->get) + ret =sprintf (buf,"%u\n" , cpufreq_driver->get (policy->cpu)); +else + ret =sprintf (buf,"%u\n" , policy->cur); +return ret; +}static int __cpufreq_set_policy (struct cpufreq_policy *policy,struct cpufreq_policy *new_policy);
@@ -815,11 +826,11 @@ static int cpufreq_add_dev_interface(struct cpufreq_policy *policy,if (ret) goto err_out_kobj_put; } -if (cpufreq_driver->target) { - ret =sysfs_create_file (&policy->kobj, &scaling_cur_freq.attr); -if (ret) - goto err_out_kobj_put; - } + + ret =sysfs_create_file (&policy->kobj, &scaling_cur_freq.attr); +if (ret) + goto err_out_kobj_put; +if (cpufreq_driver->bios_limit) { ret =sysfs_create_file (&policy->kobj, &bios_limit.attr);if (ret)
Signature · 1 line
2.1.3
PATCH 130/206 cpufreq: intel_pstate: Fix setting max_perf_pct in performance policy
In reply to Jiri SlabyFrom: Pali Rohár <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 36b4bed5cd8f6e17019fa7d380e0836872c7b367 upstream.
Code which changes policy to powersave changes also max_policy_pct based on max_freq. Code which change max_perf_pct has upper limit base on value max_policy_pct. When policy is changing from powersave back to performance then max_policy_pct is not changed. Which means that changing max_perf_pct is not possible to high values if max_freq was too low in powersave policy.
Test case:
$ cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_min_freq 800000 $ cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq 3300000 $ cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor performance $ cat /sys/devices/system/cpu/intel_pstate/max_perf_pct 100
$ echo powersave > /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor $ echo 800000 > /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq $ echo 20 > /sys/devices/system/cpu/intel_pstate/max_perf_pct
$ cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor powersave $ cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq 800000 $ cat /sys/devices/system/cpu/intel_pstate/max_perf_pct 20
$ echo performance > /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor $ echo 3300000 > /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq $ echo 100 > /sys/devices/system/cpu/intel_pstate/max_perf_pct
$ cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor performance $ cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq 3300000 $ cat /sys/devices/system/cpu/intel_pstate/max_perf_pct 24
And now intel_pstate driver allows to set maximal value for max_perf_pct based on max_policy_pct which is 24 for previous powersave max_freq 800000.
This patch will set default value for max_policy_pct when setting policy to performance so it will allow to set also max value for max_perf_pct.
--- drivers/cpufreq/intel_pstate.c | 1 + 1 file changed, 1 insertion(+)
drivers/cpufreq/intel_pstate.c +1 -0
@@ -600,6 +600,7 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)if (policy->policy ==CPUFREQ_POLICY_PERFORMANCE ) { limits.min_perf_pct =100 ; limits.min_perf =int_tofp (1 ); + limits.max_policy_pct =100 ; limits.max_perf_pct =100 ; limits.max_perf =int_tofp (1 ); limits.no_turbo =0 ;
Signature · 1 line
2.1.3
PATCH 131/206 x86: Add cpu_detect_cache_sizes to init_intel() add Quark legacy_cache()
In reply to Jiri SlabyFrom: Bryan O'Donoghue <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit aece118e487a744eafcdd0c77fe32b55ee2092a1 upstream.
Intel processors which don't report cache information via cpuid(2) or cpuid(4) need quirk code in the legacy_cache_size callback to report this data. For Intel that callback is is intel_size_cache().
This patch enables calling of cpu_detect_cache_sizes() inside of init_intel() and hence the calling of the legacy_cache callback in intel_size_cache(). Adding this call will ensure that PIII Tualatin currently in intel_size_cache() and Quark SoC X1000 being added to intel_size_cache() in this patch will report their respective cache sizes.
This model of calling cpu_detect_cache_sizes() is consistent with AMD/Via/Cirix/Transmeta and Centaur.
Also added is a string to idenitfy the Quark as Quark SoC X1000 giving better and more descriptive output via /proc/cpuinfo
Adding cpu_detect_cache_sizes to init_intel() will enable calling of intel_size_cache() on Intel processors which currently no code can reach. Therefore this patch will also re-enable reporting of PIII Tualatin cache size information as well as add Quark SoC X1000 support.
Comment text and cache flow logic suggested by Thomas Gleixner
--- arch/x86/kernel/cpu/intel.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/intel.c +16 -1
@@ -384,6 +384,13 @@ static void init_intel(struct cpuinfo_x86 *c)detect_extended_topology (c); l2 =init_intel_cacheinfo (c); + +/* Detect legacy cache sizes if init_intel_cacheinfo did not */ +if (l2 ==0 ) { +cpu_detect_cache_sizes (c); + l2 = c->x86_cache_size; + } +if (c->cpuid_level >9 ) {unsigned eax =cpuid_eax (10 );/* Check for version and the number of counters */
@@ -498,6 +505,13 @@ static unsigned int intel_size_cache(struct cpuinfo_x86 *c, unsigned int size)*/ if ((c->x86 ==6 ) && (c->x86_model ==11 ) && (size ==0 )) size =256 ; + +/* +* Intel Quark SoC X1000 contains a 4-way set associative +* 16K cache with a 16 byte cache line and 256 lines per tag +*/ +if ((c->x86 ==5 ) && (c->x86_model ==9 )) + size =16 ; return size; }#endif
@@ -703,7 +717,8 @@ static const struct cpu_dev intel_cpu_dev = { [3] = "OverDrive PODP5V83", [4] = "Pentium MMX", [7] = "Mobile Pentium 75 - 200", - [8] = "Mobile Pentium MMX" + [8] = "Mobile Pentium MMX", + [9 ] ="Quark SoC X1000" , } }, { .vendor = X86_VENDOR_INTEL, .family = 6, .model_names =
Signature · 1 line
2.1.3
PATCH 132/206 mmc: sdhci-pci: SDIO host controller support for Intel Quark X1000
In reply to Jiri SlabyFrom: Derek Browne <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 43e968cec79b6334cf7cb3e11184cce720541712 upstream.
This patch is to enable SDIO host controller for Intel Quark X1000.
--- drivers/mmc/host/sdhci-pci.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/mmc/host/sdhci-pci.c +13 -0
@@ -43,6 +43,7 @@#define PCI_DEVICE_ID_INTEL_CLV_SDIO2 0x08fb#define PCI_DEVICE_ID_INTEL_CLV_EMMC0 0x08e5#define PCI_DEVICE_ID_INTEL_CLV_EMMC1 0x08e6 +#define PCI_DEVICE_ID_INTEL_QRK_SD 0x08A7/* * PCI registers
@@ -175,6 +176,10 @@ static const struct sdhci_pci_fixes sdhci_cafe = { SDHCI_QUIRK_BROKEN_TIMEOUT_VAL, }; +static const struct sdhci_pci_fixes sdhci_intel_qrk = { + .quirks =SDHCI_QUIRK_NO_HISPD_BIT , +}; +static int mrst_hc_probe_slot (struct sdhci_pci_slot *slot) { slot->host->mmc->caps |=MMC_CAP_8_BIT_DATA ;
@@ -860,6 +865,14 @@ static const struct pci_device_id pci_ids[] = { { .vendor = PCI_VENDOR_ID_INTEL, + .device = PCI_DEVICE_ID_INTEL_QRK_SD, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .driver_data = (kernel_ulong_t)&sdhci_intel_qrk, + }, + + { + .vendor = PCI_VENDOR_ID_INTEL, .device = PCI_DEVICE_ID_INTEL_MRST_SD0, .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID,
Signature · 1 line
2.1.3
PATCH 133/206 ALSA: hda - add PCI IDs for Intel Braswell
In reply to Jiri SlabyFrom: Libin Yang <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f31b2ffcad2b8c57cee5ffc634928bcbc8c6a558 upstream.
Add HD Audio Device PCI ID for the Intel Braswell platform. It is an HDA Intel PCH controller.
AZX_DCAPS_ALIGN_BUFSIZE is not necessary for this controller.
--- sound/pci/hda/hda_intel.c | 3 +++ 1 file changed, 3 insertions(+)
sound/pci/hda/hda_intel.c +3 -0
@@ -4085,6 +4085,9 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {/* BayTrail */ { PCI_DEVICE(0x8086, 0x0f04), .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM }, + /* Braswell */ + { PCI_DEVICE(0x8086, 0x2284), + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, /* ICH */ { PCI_DEVICE(0x8086, 0x2668), .driver_data = AZX_DRIVER_ICH | AZX_DCAPS_OLD_SSYNC |
Signature · 1 line
2.1.3
PATCH 134/206 ALSA: hda - add codec ID for Braswell display audio codec
In reply to Jiri SlabyFrom: Libin Yang <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d1585c89cecdb513f68045e47ab76976524b5961 upstream.
This patch adds codec ID (0x80862883) and module alias for Braswell display codec.
--- sound/pci/hda/patch_hdmi.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_hdmi.c +2 -0
@@ -2857,6 +2857,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = { { .id = 0x80862808, .name = "Broadwell HDMI", .patch = patch_generic_hdmi }, { .id = 0x80862880, .name = "CedarTrail HDMI", .patch = patch_generic_hdmi }, { .id = 0x80862882, .name = "Valleyview2 HDMI", .patch = patch_generic_hdmi }, +{ .id = 0x80862883, .name = "Braswell HDMI", .patch = patch_generic_hdmi }, { .id = 0x808629fb, .name = "Crestline HDMI", .patch = patch_generic_hdmi }, {}/* terminator */ };
@@ -2913,6 +2914,7 @@ MODULE_ALIAS("snd-hda-codec-id:80862807");MODULE_ALIAS ("snd-hda-codec-id:80862808" );MODULE_ALIAS ("snd-hda-codec-id:80862880" );MODULE_ALIAS ("snd-hda-codec-id:80862882" ); +MODULE_ALIAS ("snd-hda-codec-id:80862883" );MODULE_ALIAS ("snd-hda-codec-id:808629fb" );MODULE_LICENSE ("GPL" );
Signature · 1 line
2.1.3
PATCH 135/206 freezer: Do not freeze tasks killed by OOM killer
In reply to Jiri SlabyFrom: Cong Wang <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 51fae6da640edf9d266c94f36bc806c63c301991 upstream.
Since f660daac474c6f (oom: thaw threads if oom killed thread is frozen before deferring) OOM killer relies on being able to thaw a frozen task to handle OOM situation but a3201227f803 (freezer: make freezing() test freeze conditions in effect instead of TIF_FREEZE) has reorganized the code and stopped clearing freeze flag in __thaw_task. This means that the target task only wakes up and goes into the fridge again because the freezing condition hasn't changed for it. This reintroduces the bug fixed by f660daac474c6f.
Fix the issue by checking for TIF_MEMDIE thread flag in freezing_slow_path and exclude the task from freezing completely. If a task was already frozen it would get woken by __thaw_task from OOM killer and get out of freezer after rechecking freezing().
Changes since v1
- put TIF_MEMDIE check into freezing_slowpath rather than in __refrigerator as per Oleg
- return __thaw_task into oom_scan_process_thread because oom_kill_process will not wake task in the fridge because it is sleeping uninterruptible
--- kernel/freezer.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/freezer.c +3 -0
@@ -42,6 +42,9 @@ bool freezing_slow_path(struct task_struct *p)if (p->flags & (PF_NOFREEZE |PF_SUSPEND_TASK ))return false; +if (test_thread_flag (TIF_MEMDIE )) +return false; +if (pm_nosig_freezing ||cgroup_freezing (p))return true;
Signature · 1 line
2.1.3
PATCH 136/206 OOM, PM: OOM killed task shouldn't escape PM suspend
In reply to Jiri SlabyFrom: Michal Hocko <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5695be142e203167e3cb515ef86a88424f3524eb upstream.
PM freezer relies on having all tasks frozen by the time devices are getting frozen so that no task will touch them while they are getting frozen. But OOM killer is allowed to kill an already frozen task in order to handle OOM situtation. In order to protect from late wake ups OOM killer is disabled after all tasks are frozen. This, however, still keeps a window open when a killed task didn't manage to die by the time freeze_processes finishes.
Reduce the race window by checking all tasks after OOM killer has been disabled. This is still not race free completely unfortunately because oom_killer_disable cannot stop an already ongoing OOM killer so a task might still wake up from the fridge and get killed without freeze_processes noticing. Full synchronization of OOM and freezer is, however, too heavy weight for this highly unlikely case.
Introduce and check oom_kills counter which gets incremented early when the allocator enters __alloc_pages_may_oom path and only check all the tasks if the counter changes during the freezing attempt. The counter is updated so early to reduce the race window since allocator checked oom_killer_disabled which is set by PM-freezing code. A false positive will push the PM-freezer into a slow path but that is not a big deal.
Changes since v1
- push the re-check loop out of freeze_processes into check_frozen_processes and invert the condition to make the code more readable as per Rafael
--- include/linux/oom.h | 3 +++ kernel/power/process.c | 40 +++++++++++++++++++++++++++++++++++++++- mm/oom_kill.c | 17 +++++++++++++++++ mm/page_alloc.c | 8 ++++++++ 4 files changed, 67 insertions(+), 1 deletion(-)
include/linux/oom.h +3 -0
@@ -50,6 +50,9 @@ static inline bool oom_task_origin(const struct task_struct *p)extern unsigned long oom_badness (struct task_struct *p,struct mem_cgroup *memcg,const nodemask_t *nodemask,unsigned long totalpages); + +extern int oom_kills_count (void ); +extern void note_oom_kill (void ); extern void oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order, unsigned int points, unsigned long totalpages, struct mem_cgroup *memcg, nodemask_t *nodemask,
kernel/power/process.c +39 -1
@@ -107,6 +107,28 @@ static int try_to_freeze_tasks(bool user_only)return todo ? -EBUSY :0 ; } +/* +* Returns true if all freezable tasks (except for current) are frozen already +*/ +static bool check_frozen_processes (void ) +{ +struct task_struct *g, *p; +bool ret = true; + +read_lock (&tasklist_lock); +for_each_process_thread (g, p) { +if (p != current && !freezer_should_skip (p) && + !frozen (p)) { + ret = false; + goto done; + } + } +done: +read_unlock (&tasklist_lock); + +return ret; +} +/** * freeze_processes - Signal user space processes to enter the refrigerator. * The current thread will not be frozen. The same process that calls
@@ -117,6 +139,7 @@ static int try_to_freeze_tasks(bool user_only)int freeze_processes (void ) {int error; +int oom_kills_saved; error =__usermodehelper_disable (UMH_FREEZING );if (error)
@@ -130,12 +153,27 @@ int freeze_processes(void)printk ("Freezing user space processes ... " ); pm_freezing = true; + oom_kills_saved =oom_kills_count (); error =try_to_freeze_tasks (true);if (!error) { -printk ("done." );__usermodehelper_set_disable_depth (UMH_DISABLED );oom_killer_disable (); + +/* +* There might have been an OOM kill while we were +* freezing tasks and the killed task might be still +* on the way out so we have to double check for race. +*/ +if (oom_kills_count () != oom_kills_saved && + !check_frozen_processes ()) { +__usermodehelper_set_disable_depth (UMH_ENABLED ); +printk ("OOM in progress." ); + error = -EBUSY ; + goto done; + } +printk ("done." ); } +done:printk ("\n" );BUG_ON (in_atomic ());
mm/oom_kill.c +17 -0
@@ -406,6 +406,23 @@ static void dump_header(struct task_struct *p, gfp_t gfp_mask, int order,dump_tasks (memcg, nodemask); } +/* +* Number of OOM killer invocations (including memcg OOM killer). +* Primarily used by PM freezer to check for potential races with +* OOM killed frozen task. +*/ +static atomic_t oom_kills =ATOMIC_INIT (0 ); + +int oom_kills_count (void ) +{ +return atomic_read (&oom_kills); +} + +void note_oom_kill (void ) +{ +atomic_inc (&oom_kills); +} +#define K (x) ((x) << (PAGE_SHIFT-10))/* * Must be called while holding a reference to p, which will be released upon
mm/page_alloc.c +8 -0
@@ -2250,6 +2250,14 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order, }/* +* PM-freezer should be notified that there might be an OOM killer on +* its way to kill and wake somebody up. This is too early and we might +* end up not killing anything but false positives are acceptable. +* See freeze_processes. +*/ +note_oom_kill (); + +/* * Go through the zonelist yet one more time, keep very high watermark * here, this is only to catch a parallel oom killing, we must fail if * we're still under heavy pressure.
Signature · 1 line
2.1.3
PATCH 137/206 iio: st_sensors: Fix buffer copy
In reply to Jiri SlabyFrom: Robin van der Gracht <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4250c90b30b8bf2a1a21122ba0484f8f351f152d upstream.
Use byte_for_channel as iterator to properly initialize the buffer.
--- drivers/iio/common/st_sensors/st_sensors_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/common/st_sensors/st_sensors_buffer.c +1 -1
@@ -71,7 +71,7 @@ int st_sensors_get_buffer_element(struct iio_dev *indio_dev, u8 *buf) goto st_sensors_free_memory; } -for (i =0 ; i < n * num_data_channels; i++) { +for (i =0 ; i < n * byte_for_channel; i++) {if (i < n) buf[i] = rx_array[i];else
Signature · 1 line
2.1.3
PATCH 138/206 staging:iio:ad5933: Fix NULL pointer deref when enabling buffer
In reply to Jiri SlabyFrom: Lars-Peter Clausen <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 824269c5868d2a7a26417e5ef3841a27d42c6139 upstream.
In older versions of the IIO framework it was possible to pass a completely different set of channels to iio_buffer_register() as the one that is assigned to the IIO device. Commit 959d2952d124 ("staging:iio: make iio_sw_buffer_preenable much more general.") introduced a restriction that requires that the set of channels that is passed to iio_buffer_register() is a subset of the channels assigned to the IIO device as the IIO core will use the list of channels that is assigned to the device to lookup a channel by scan index in iio_compute_scan_bytes(). If it can not find the channel the function will crash. This patch fixes the issue by making sure that the same set of channels is assigned to the IIO device and passed to iio_buffer_register().
Fixes the follow NULL pointer derefernce kernel crash:
Unable to handle kernel NULL pointer dereference at virtual address 00000016 pgd = d53d0000 [00000016] *pgd=1534e831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 1626 Comm: bash Not tainted 3.15.0-19969-g2a180eb-dirty #9545 task: d6c124c0 ti: d539a000 task.ti: d539a000 PC is at iio_compute_scan_bytes+0x34/0xa8 LR is at iio_compute_scan_bytes+0x34/0xa8 pc : [<c03052e4>] lr : [<c03052e4>] psr: 60070013 sp : d539beb8 ip : 00000001 fp : 00000000 r10: 00000002 r9 : 00000000 r8 : 00000001 r7 : 00000000 r6 : d6dc8800 r5 : d7571000 r4 : 00000002 r3 : d7571000 r2 : 00000044 r1 : 00000001 r0 : 00000000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 18c5387d Table: 153d004a DAC: 00000015 Process bash (pid: 1626, stack limit = 0xd539a240) Stack: (0xd539beb8 to 0xd539c000) bea0: c02fc0e4 d7571000 bec0: d76c1640 d6dc8800 d757117c 00000000 d757112c c0305b04 d76c1690 d76c1640 bee0: d7571188 00000002 00000000 d7571000 d539a000 00000000 000dd1c8 c0305d54 bf00: d7571010 0160b868 00000002 c69d3900 d7573278 d7573308 c69d3900 c01ece90 bf20: 00000002 c0103fac c0103f6c d539bf88 00000002 c69d3b00 c69d3b0c c0103468 bf40: 00000000 00000000 d7694a00 00000002 000af408 d539bf88 c000dd84 c00b2f94 bf60: d7694a00 000af408 00000002 d7694a00 d7694a00 00000002 000af408 c000dd84 bf80: 00000000 c00b32d0 00000000 00000000 00000002 b6f1aa78 00000002 000af408 bfa0: 00000004 c000dc00 b6f1aa78 00000002 00000001 000af408 00000002 00000000 bfc0: b6f1aa78 00000002 000af408 00000004 be806a4c 000a6094 00000000 000dd1c8 bfe0: 00000000 be8069cc b6e8ab77 b6ec125c 40070010 00000001 22940489 154a5007 [<c03052e4>] (iio_compute_scan_bytes) from [<c0305b04>] (__iio_update_buffers+0x248/0x438) [<c0305b04>] (__iio_update_buffers) from [<c0305d54>] (iio_buffer_store_enable+0x60/0x7c) [<c0305d54>] (iio_buffer_store_enable) from [<c01ece90>] (dev_attr_store+0x18/0x24) [<c01ece90>] (dev_attr_store) from [<c0103fac>] (sysfs_kf_write+0x40/0x4c) [<c0103fac>] (sysfs_kf_write) from [<c0103468>] (kernfs_fop_write+0x110/0x154) [<c0103468>] (kernfs_fop_write) from [<c00b2f94>] (vfs_write+0xd0/0x160) [<c00b2f94>] (vfs_write) from [<c00b32d0>] (SyS_write+0x40/0x78) [<c00b32d0>] (SyS_write) from [<c000dc00>] (ret_fast_syscall+0x0/0x30) Code: ea00000e e1a01008 e1a00005 ebfff6fc (e5d0a016)
--- drivers/staging/iio/impedance-analyzer/ad5933.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
drivers/staging/iio/impedance-analyzer/ad5933.c +4 -7
@@ -115,6 +115,7 @@ static const struct iio_chan_spec ad5933_channels[] = { .channel = 0, .info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED), .address = AD5933_REG_TEMP_DATA, + .scan_index = -1, .scan_type = { .sign = 's', .realbits = 14,
@@ -125,8 +126,6 @@ static const struct iio_chan_spec ad5933_channels[] = { .indexed = 1, .channel = 0, .extend_name = "real_raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | - BIT(IIO_CHAN_INFO_SCALE), .address = AD5933_REG_REAL_DATA, .scan_index = 0, .scan_type = {
@@ -139,8 +138,6 @@ static const struct iio_chan_spec ad5933_channels[] = { .indexed = 1, .channel = 0, .extend_name = "imag_raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | - BIT(IIO_CHAN_INFO_SCALE), .address = AD5933_REG_IMAG_DATA, .scan_index = 1, .scan_type = {
@@ -746,14 +743,14 @@ static int ad5933_probe(struct i2c_client *client, indio_dev->name = id->name; indio_dev->modes =INDIO_DIRECT_MODE ; indio_dev->channels = ad5933_channels; - indio_dev->num_channels =1 ;/* only register temp0_input */ + indio_dev->num_channels =ARRAY_SIZE (ad5933_channels); ret =ad5933_register_ring_funcs_and_init (indio_dev);if (ret) goto error_disable_reg; -/* skip temp0_input, register in0_(real|imag)_raw */ - ret =iio_buffer_register (indio_dev, &ad5933_channels[1 ],2 ); + ret =iio_buffer_register (indio_dev, ad5933_channels, +ARRAY_SIZE (ad5933_channels));if (ret) goto error_unreg_ring;
Signature · 1 line
2.1.3
PATCH 139/206 staging:iio:ad5933: Drop "raw" from channel names
In reply to Jiri SlabyFrom: Lars-Peter Clausen <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6822ee34ad57b29a3b44df2c2829910f03c34fa4 upstream.
"raw" is the name of a channel property, but should not be part of the channel name itself.
--- drivers/staging/iio/impedance-analyzer/ad5933.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/iio/impedance-analyzer/ad5933.c +2 -2
@@ -125,7 +125,7 @@ static const struct iio_chan_spec ad5933_channels[] = { .type = IIO_VOLTAGE, .indexed = 1, .channel = 0, - .extend_name = "real_raw", + .extend_name = "real", .address = AD5933_REG_REAL_DATA, .scan_index = 0, .scan_type = {
@@ -137,7 +137,7 @@ static const struct iio_chan_spec ad5933_channels[] = { .type = IIO_VOLTAGE, .indexed = 1, .channel = 0, - .extend_name = "imag_raw", + .extend_name = "imag", .address = AD5933_REG_IMAG_DATA, .scan_index = 1, .scan_type = {
Signature · 1 line
2.1.3
PATCH 140/206 staging:iio:ade7758: Fix NULL pointer deref when enabling buffer
In reply to Jiri SlabyFrom: Lars-Peter Clausen <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e10554738cab4224e097c2f9d975ea781a4fcde4 upstream.
In older versions of the IIO framework it was possible to pass a completely different set of channels to iio_buffer_register() as the one that is assigned to the IIO device. Commit 959d2952d124 ("staging:iio: make iio_sw_buffer_preenable much more general.") introduced a restriction that requires that the set of channels that is passed to iio_buffer_register() is a subset of the channels assigned to the IIO device as the IIO core will use the list of channels that is assigned to the device to lookup a channel by scan index in iio_compute_scan_bytes(). If it can not find the channel the function will crash. This patch fixes the issue by making sure that the same set of channels is assigned to the IIO device and passed to iio_buffer_register().
Note that we need to remove the IIO_CHAN_INFO_RAW and IIO_CHAN_INFO_SCALE info attributes from the channels since we don't actually want those to be registered.
Fixes the following crash:
Unable to handle kernel NULL pointer dereference at virtual address 00000016 pgd = d2094000 [00000016] *pgd=16e39831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 1695 Comm: bash Not tainted 3.17.0-06329-g29461ee #9686 task: d7768040 ti: d5bd4000 task.ti: d5bd4000 PC is at iio_compute_scan_bytes+0x38/0xc0 LR is at iio_compute_scan_bytes+0x34/0xc0 pc : [<c0316de8>] lr : [<c0316de4>] psr: 60070013 sp : d5bd5ec0 ip : 00000000 fp : 00000000 r10: d769f934 r9 : 00000000 r8 : 00000001 r7 : 00000000 r6 : c8fc6240 r5 : d769f800 r4 : 00000000 r3 : d769f800 r2 : 00000000 r1 : ffffffff r0 : 00000000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 18c5387d Table: 1209404a DAC: 00000015 Process bash (pid: 1695, stack limit = 0xd5bd4240) Stack: (0xd5bd5ec0 to 0xd5bd6000) 5ec0: d769f800 d7435640 c8fc6240 d769f984 00000000 c03175a4 d7435690 d7435640 5ee0: d769f990 00000002 00000000 d769f800 d5bd4000 00000000 000b43a8 c03177f4 5f00: d769f810 0162b8c8 00000002 c8fc7e00 d77f1d08 d77f1da8 c8fc7e00 c01faf1c 5f20: 00000002 c010694c c010690c d5bd5f88 00000002 c8fc6840 c8fc684c c0105e08 5f40: 00000000 00000000 d20d1580 00000002 000af408 d5bd5f88 c000de84 c00b76d4 5f60: d20d1580 000af408 00000002 d20d1580 d20d1580 00000002 000af408 c000de84 5f80: 00000000 c00b7a44 00000000 00000000 00000002 b6ebea78 00000002 000af408 5fa0: 00000004 c000dd00 b6ebea78 00000002 00000001 000af408 00000002 00000000 5fc0: b6ebea78 00000002 000af408 00000004 bee96a4c 000a6094 00000000 000b43a8 5fe0: 00000000 bee969cc b6e2eb77 b6e6525c 40070010 00000001 00000000 00000000 [<c0316de8>] (iio_compute_scan_bytes) from [<c03175a4>] (__iio_update_buffers+0x248/0x438) [<c03175a4>] (__iio_update_buffers) from [<c03177f4>] (iio_buffer_store_enable+0x60/0x7c) [<c03177f4>] (iio_buffer_store_enable) from [<c01faf1c>] (dev_attr_store+0x18/0x24) [<c01faf1c>] (dev_attr_store) from [<c010694c>] (sysfs_kf_write+0x40/0x4c) [<c010694c>] (sysfs_kf_write) from [<c0105e08>] (kernfs_fop_write+0x110/0x154) [<c0105e08>] (kernfs_fop_write) from [<c00b76d4>] (vfs_write+0xbc/0x170) [<c00b76d4>] (vfs_write) from [<c00b7a44>] (SyS_write+0x40/0x78) [<c00b7a44>] (SyS_write) from [<c000dd00>] (ret_fast_syscall+0x0/0x30)
--- drivers/staging/iio/meter/ade7758.h | 1 - drivers/staging/iio/meter/ade7758_core.c | 33 ++------------------------------ drivers/staging/iio/meter/ade7758_ring.c | 3 +-- 3 files changed, 3 insertions(+), 34 deletions(-)
drivers/staging/iio/meter/ade7758.h +0 -1
@@ -119,7 +119,6 @@ struct ade7758_state {u8 *tx;u8 *rx;struct mutex buf_lock; -const struct iio_chan_spec *ade7758_ring_channels;struct spi_transfer ring_xfer[4 ];struct spi_message ring_msg;/*
drivers/staging/iio/meter/ade7758_core.c +2 -31
@@ -631,8 +631,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 0, .extend_name = "raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_A, AD7758_VOLTAGE), .scan_index = 0, .scan_type = {
@@ -645,8 +643,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 0, .extend_name = "raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_A, AD7758_CURRENT), .scan_index = 1, .scan_type = {
@@ -659,8 +655,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 0, .extend_name = "apparent_raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_A, AD7758_APP_PWR), .scan_index = 2, .scan_type = {
@@ -673,8 +667,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 0, .extend_name = "active_raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_A, AD7758_ACT_PWR), .scan_index = 3, .scan_type = {
@@ -687,8 +679,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 0, .extend_name = "reactive_raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_A, AD7758_REACT_PWR), .scan_index = 4, .scan_type = {
@@ -701,8 +691,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 1, .extend_name = "raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_B, AD7758_VOLTAGE), .scan_index = 5, .scan_type = {
@@ -715,8 +703,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 1, .extend_name = "raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_B, AD7758_CURRENT), .scan_index = 6, .scan_type = {
@@ -729,8 +715,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 1, .extend_name = "apparent_raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_B, AD7758_APP_PWR), .scan_index = 7, .scan_type = {
@@ -743,8 +727,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 1, .extend_name = "active_raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_B, AD7758_ACT_PWR), .scan_index = 8, .scan_type = {
@@ -757,8 +739,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 1, .extend_name = "reactive_raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_B, AD7758_REACT_PWR), .scan_index = 9, .scan_type = {
@@ -771,8 +751,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 2, .extend_name = "raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_C, AD7758_VOLTAGE), .scan_index = 10, .scan_type = {
@@ -785,8 +763,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 2, .extend_name = "raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_C, AD7758_CURRENT), .scan_index = 11, .scan_type = {
@@ -799,8 +775,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 2, .extend_name = "apparent_raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_C, AD7758_APP_PWR), .scan_index = 12, .scan_type = {
@@ -813,8 +787,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 2, .extend_name = "active_raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_C, AD7758_ACT_PWR), .scan_index = 13, .scan_type = {
@@ -827,8 +799,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .indexed = 1, .channel = 2, .extend_name = "reactive_raw", - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), - .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = AD7758_WT(AD7758_PHASE_C, AD7758_REACT_PWR), .scan_index = 14, .scan_type = {
@@ -872,13 +842,14 @@ static int ade7758_probe(struct spi_device *spi) goto error_free_rx; } st->us = spi; - st->ade7758_ring_channels = &ade7758_channels[0 ];mutex_init (&st->buf_lock); indio_dev->name = spi->dev.driver->name; indio_dev->dev.parent = &spi->dev; indio_dev->info = &ade7758_info; indio_dev->modes =INDIO_DIRECT_MODE ; + indio_dev->channels = ade7758_channels; + indio_dev->num_channels =ARRAY_SIZE (ade7758_channels); ret =ade7758_configure_ring (indio_dev);if (ret)
drivers/staging/iio/meter/ade7758_ring.c +1 -2
@@ -89,7 +89,6 @@ static irqreturn_t ade7758_trigger_handler(int irq, void *p)**/ static int ade7758_ring_preenable (struct iio_dev *indio_dev) { -struct ade7758_state *st =iio_priv (indio_dev);unsigned channel;int ret;
@@ -104,7 +103,7 @@ static int ade7758_ring_preenable(struct iio_dev *indio_dev) indio_dev->masklength);ade7758_write_waveform_type (&indio_dev->dev, - st->ade7758_ring_channels[channel].address); + indio_dev->channels[channel].address);return 0 ; }
Signature · 1 line
2.1.3
PATCH 141/206 staging:iio:ade7758: Fix check if channels are enabled in prenable
In reply to Jiri SlabyFrom: Lars-Peter Clausen <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 79fa64eb2ee8ccb4bcad7f54caa2699730b10b22 upstream.
We should check if a channel is enabled, not if no channels are enabled.
--- drivers/staging/iio/meter/ade7758_ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/meter/ade7758_ring.c +1 -1
@@ -92,7 +92,7 @@ static int ade7758_ring_preenable(struct iio_dev *indio_dev)unsigned channel;int ret; -if (!bitmap_empty (indio_dev->active_scan_mask, indio_dev->masklength)) +if (bitmap_empty (indio_dev->active_scan_mask, indio_dev->masklength))return -EINVAL ; ret =iio_sw_buffer_preenable (indio_dev);
Signature · 1 line
2.1.3
PATCH 142/206 staging:iio:ade7758: Remove "raw" from channel name
In reply to Jiri SlabyFrom: Lars-Peter Clausen <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b598aacc29331e7e638cd509108600e916c6331b upstream.
"raw" is a property of a channel, but should not be part of the name of channel.
--- drivers/staging/iio/meter/ade7758_core.c | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-)
drivers/staging/iio/meter/ade7758_core.c +9 -15
@@ -630,7 +630,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_VOLTAGE, .indexed = 1, .channel = 0, - .extend_name = "raw", .address = AD7758_WT(AD7758_PHASE_A, AD7758_VOLTAGE), .scan_index = 0, .scan_type = {
@@ -642,7 +641,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_CURRENT, .indexed = 1, .channel = 0, - .extend_name = "raw", .address = AD7758_WT(AD7758_PHASE_A, AD7758_CURRENT), .scan_index = 1, .scan_type = {
@@ -654,7 +652,7 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_POWER, .indexed = 1, .channel = 0, - .extend_name = "apparent_raw", + .extend_name = "apparent", .address = AD7758_WT(AD7758_PHASE_A, AD7758_APP_PWR), .scan_index = 2, .scan_type = {
@@ -666,7 +664,7 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_POWER, .indexed = 1, .channel = 0, - .extend_name = "active_raw", + .extend_name = "active", .address = AD7758_WT(AD7758_PHASE_A, AD7758_ACT_PWR), .scan_index = 3, .scan_type = {
@@ -678,7 +676,7 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_POWER, .indexed = 1, .channel = 0, - .extend_name = "reactive_raw", + .extend_name = "reactive", .address = AD7758_WT(AD7758_PHASE_A, AD7758_REACT_PWR), .scan_index = 4, .scan_type = {
@@ -690,7 +688,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_VOLTAGE, .indexed = 1, .channel = 1, - .extend_name = "raw", .address = AD7758_WT(AD7758_PHASE_B, AD7758_VOLTAGE), .scan_index = 5, .scan_type = {
@@ -702,7 +699,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_CURRENT, .indexed = 1, .channel = 1, - .extend_name = "raw", .address = AD7758_WT(AD7758_PHASE_B, AD7758_CURRENT), .scan_index = 6, .scan_type = {
@@ -714,7 +710,7 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_POWER, .indexed = 1, .channel = 1, - .extend_name = "apparent_raw", + .extend_name = "apparent", .address = AD7758_WT(AD7758_PHASE_B, AD7758_APP_PWR), .scan_index = 7, .scan_type = {
@@ -726,7 +722,7 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_POWER, .indexed = 1, .channel = 1, - .extend_name = "active_raw", + .extend_name = "active", .address = AD7758_WT(AD7758_PHASE_B, AD7758_ACT_PWR), .scan_index = 8, .scan_type = {
@@ -738,7 +734,7 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_POWER, .indexed = 1, .channel = 1, - .extend_name = "reactive_raw", + .extend_name = "reactive", .address = AD7758_WT(AD7758_PHASE_B, AD7758_REACT_PWR), .scan_index = 9, .scan_type = {
@@ -750,7 +746,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_VOLTAGE, .indexed = 1, .channel = 2, - .extend_name = "raw", .address = AD7758_WT(AD7758_PHASE_C, AD7758_VOLTAGE), .scan_index = 10, .scan_type = {
@@ -762,7 +757,6 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_CURRENT, .indexed = 1, .channel = 2, - .extend_name = "raw", .address = AD7758_WT(AD7758_PHASE_C, AD7758_CURRENT), .scan_index = 11, .scan_type = {
@@ -774,7 +768,7 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_POWER, .indexed = 1, .channel = 2, - .extend_name = "apparent_raw", + .extend_name = "apparent", .address = AD7758_WT(AD7758_PHASE_C, AD7758_APP_PWR), .scan_index = 12, .scan_type = {
@@ -786,7 +780,7 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_POWER, .indexed = 1, .channel = 2, - .extend_name = "active_raw", + .extend_name = "active", .address = AD7758_WT(AD7758_PHASE_C, AD7758_ACT_PWR), .scan_index = 13, .scan_type = {
@@ -798,7 +792,7 @@ static const struct iio_chan_spec ade7758_channels[] = { .type = IIO_POWER, .indexed = 1, .channel = 2, - .extend_name = "reactive_raw", + .extend_name = "reactive", .address = AD7758_WT(AD7758_PHASE_C, AD7758_REACT_PWR), .scan_index = 14, .scan_type = {
Signature · 1 line
2.1.3
PATCH 143/206 serial: Fix divide-by-zero fault in uart_get_divisor()
In reply to Jiri SlabyFrom: Peter Hurley <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 547039ec502076e60034eeb79611df3433a99b7d upstream.
uart_get_baud_rate() will return baud == 0 if the max rate is set to the "magic" 38400 rate and the SPD_* flags are also specified. On the first iteration, if the current baud rate is higher than the max, the baud rate is clamped at the max (which in the degenerate case is 38400). On the second iteration, the now-"magic" 38400 baud rate selects the possibly higher alternate baud rate indicated by the SPD_* flag. Since only two loop iterations are performed, the loop is exited, a kernel WARNING is generated and a baud rate of 0 is returned.
Reproducible with:
setserial /dev/ttyS0 spd_hi base_baud 38400
Only perform the "magic" 38400 -> SPD_* baud transform on the first loop iteration, which prevents the degenerate case from recognizing the clamped baud rate as the "magic" 38400 value.
--- drivers/tty/serial/serial_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/serial_core.c +1 -1
@@ -353,7 +353,7 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios,* The spd_hi, spd_vhi, spd_shi, spd_warp kludge... * Die! Die! Die! */ -if (baud ==38400 ) +if (try ==0 && baud ==38400 ) baud = altbaud;/*
Signature · 1 line
2.1.3
PATCH 144/206 USB: serial: cp210x: add Silicon Labs 358x VID and PID
In reply to Jiri SlabyFrom: Nathaniel Ting <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 35cc83eab097e5720a9cc0ec12bdc3a726f58381 upstream.
Enable Silicon Labs Ember VID chips to enumerate with the cp210x usb serial driver. EM358x devices operating with the Ember Z-Net 5.1.2 stack may now connect to host PCs over a USB serial link.
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -155,6 +155,7 @@ static const struct usb_device_id id_table[] = { { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ + { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */ { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */ { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
Signature · 1 line
2.1.3
PATCH 145/206 usb: serial: ftdi_sio: add Awinda Station and Dongle products
In reply to Jiri SlabyFrom: Frans Klaver <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit edd74ffab1f6909eee400c7de8ce621870aacac9 upstream.
Add new IDs for the Xsens Awinda Station and Awinda Dongle.
While at it, order the definitions by PID and add a logical separation between devices using Xsens' VID and those using FTDI's VID.
--- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 6 +++++- 2 files changed, 7 insertions(+), 1 deletion(-)
drivers/usb/serial/ftdi_sio.c +2 -0
@@ -675,6 +675,8 @@ static struct usb_device_id id_table_combined [] = { { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) }, { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) }, { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) }, + { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
drivers/usb/serial/ftdi_sio_ids.h +5 -1
@@ -143,8 +143,12 @@* Xsens Technologies BV products (http://www.xsens.com). */ #define XSENS_VID 0x2639 -#define XSENS_CONVERTER_PID 0xD00D/* Xsens USB-serial converter */ +#define XSENS_AWINDA_STATION_PID 0x0101 +#define XSENS_AWINDA_DONGLE_PID 0x0102#define XSENS_MTW_PID 0x0200/* Xsens MTw */ +#define XSENS_CONVERTER_PID 0xD00D/* Xsens USB-serial converter */ + +/* Xsens devices using FTDI VID */ #define XSENS_CONVERTER_0_PID 0xD388/* Xsens USB converter */ #define XSENS_CONVERTER_1_PID 0xD389/* Xsens Wireless Receiver */ #define XSENS_CONVERTER_2_PID 0xD38A
Signature · 1 line
2.1.3
PATCH 146/206 usb: serial: ftdi_sio: add "bricked" FTDI device PID
In reply to Jiri SlabyFrom: Perry Hung <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7f2719f0003da1ad13124ef00f48d7514c79e30d upstream.
An official recent Windows driver from FTDI detects counterfeit devices and reprograms the internal EEPROM containing the USB PID to 0, effectively bricking the device.
Add support for this VID/PID pair to correctly bind the driver on these devices.
See:
http://hackaday.com/2014/10/22/watch-that-windows-update-ftdi-drivers-are-killing-fake-chips/
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 7 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -146,6 +146,7 @@ static struct ftdi_sio_quirk ftdi_8u2232c_quirk = {* /sys/bus/usb-serial/drivers/ftdi_sio/new_id and send a patch or report. */ static struct usb_device_id id_table_combined [] = { + {USB_DEVICE (FTDI_VID ,FTDI_BRICK_PID ) }, {USB_DEVICE (FTDI_VID ,FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID ) }, {USB_DEVICE (FTDI_VID ,FTDI_CTI_MINI_PID ) }, {USB_DEVICE (FTDI_VID ,FTDI_CTI_NANO_PID ) },
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -30,6 +30,12 @@/*** third-party PIDs (using FTDI_VID) ***/ +/* +* Certain versions of the official Windows FTDI driver reprogrammed +* counterfeit FTDI devices to PID 0. Support these devices anyway. +*/ +#define FTDI_BRICK_PID 0x0000 +#define FTDI_LUMEL_PD12_PID 0x6002/*
Signature · 1 line
2.1.3
PATCH 147/206 USB: cdc-acm: add device id for GW Instek AFG-2225
In reply to Jiri SlabyFrom: Johan Hovold <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit cf84a691a61606a2e7269907d3727e2d9fa148ee upstream.
Add device-id entry for GW Instek AFG-2225, which has a byte swapped bInterfaceSubClass (0x20).
--- drivers/usb/class/cdc-acm.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/class/cdc-acm.c +1 -0
@@ -1580,6 +1580,7 @@ static const struct usb_device_id acm_ids[] = { { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */ .driver_info =NO_UNION_NORMAL ,/* has no union descriptor */ }, + { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */ { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */ },/* Motorola H24 HSPA module: */
Signature · 1 line
2.1.3
PATCH 148/206 USB: cdc-acm: only raise DTR on transitions from B0
In reply to Jiri SlabyFrom: Johan Hovold <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4473d054ceb572557954f9536731d39b20937b0c upstream.
Make sure to only raise DTR on transitions from B0 in set_termios.
Also allow set_termios to be called from open with a termios_old of NULL. Note that DTR will not be raised prematurely in this case.
--- drivers/usb/class/cdc-acm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/class/cdc-acm.c +3 -2
@@ -875,11 +875,12 @@ static void acm_tty_set_termios(struct tty_struct *tty,/* FIXME: Needs to clear unsupported bits in the termios */ acm->clocal = ((termios->c_cflag &CLOCAL ) !=0 ); -if (!newline.dwDTERate) { +if (C_BAUD (tty) ==B0 ) { newline.dwDTERate = acm->line.dwDTERate; newctrl &= ~ACM_CTRL_DTR ; - }else + }else if (termios_old && (termios_old->c_cflag &CBAUD ) ==B0 ) { newctrl |=ACM_CTRL_DTR ; + }if (newctrl != acm->ctrlout)acm_set_control (acm, acm->ctrlout = newctrl);
Signature · 1 line
2.1.3
PATCH 149/206 usb: option: add support for Telit LE910
In reply to Jiri SlabyFrom: Daniele Palmas <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2d0eb862dd477c3c4f32b201254ca0b40e6f465c upstream.
Add VID/PID for Telit LE910 modem. Interfaces description is almost the same than LE920, except that the qmi interface is number 2 (instead than 5).
--- drivers/usb/serial/option.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/usb/serial/option.c +8 -0
@@ -269,6 +269,7 @@ static void option_instat_callback(struct urb *urb);#define TELIT_PRODUCT_DE910_DUAL 0x1010#define TELIT_PRODUCT_UE910_V2 0x1012#define TELIT_PRODUCT_LE920 0x1200 +#define TELIT_PRODUCT_LE910 0x1201/* ZTE PRODUCTS */ #define ZTE_VENDOR_ID 0x19d2
@@ -588,6 +589,11 @@ static const struct option_blacklist_info zte_1255_blacklist = { .reserved = BIT(3) | BIT(4), }; +static const struct option_blacklist_info telit_le910_blacklist = { + .sendsetup =BIT (0 ), + .reserved =BIT (1 ) |BIT (2 ), +}; +static const struct option_blacklist_info telit_le920_blacklist = { .sendsetup =BIT (0 ), .reserved =BIT (1 ) |BIT (5 ),
@@ -1137,6 +1143,8 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), + .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
Signature · 1 line
2.1.3
PATCH 150/206 USB: option: add Haier CE81B CDMA modem
In reply to Jiri SlabyFrom: Dan Williams <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 012eee1522318b5ccd64d277d50ac32f7e9974fe upstream.
Port layout:
0: QCDM/DIAG
1: NMEA
2: AT
3: AT/PPP
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -362,6 +362,7 @@ static void option_instat_callback(struct urb *urb);/* Haier products */ #define HAIER_VENDOR_ID 0x201e +#define HAIER_PRODUCT_CE81B 0x10f8#define HAIER_PRODUCT_CE100 0x2009/* Cinterion (formerly Siemens) products */
@@ -1620,6 +1621,7 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, + { USB_DEVICE_AND_INTERFACE_INFO(HAIER_VENDOR_ID, HAIER_PRODUCT_CE81B, 0xff, 0xff, 0xff) },/* Pirelli */ { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1, 0xff) }, { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_2, 0xff) },
Signature · 1 line
2.1.3
PATCH 151/206 rt2x00: support Ralink 5362.
In reply to Jiri SlabyFrom: Canek Peláez Valdés <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ac0372abf8524a7572a9cdaac6495eb2eba20457 upstream.
--- drivers/net/wireless/rt2x00/rt2800.h | 4 +++- drivers/net/wireless/rt2x00/rt2800lib.c | 6 ++++++ 2 files changed, 9 insertions(+), 1 deletion(-)
drivers/net/wireless/rt2x00/rt2800.h +3 -1
@@ -54,6 +54,7 @@* RF5592 2.4G/5G 2T2R * RF3070 2.4G 1T1R * RF5360 2.4G 1T1R +* RF5362 2.4G 1T1R * RF5370 2.4G 1T1R * RF5390 2.4G 1T1R */
@@ -74,6 +75,7 @@#define RF3070 0x3070#define RF3290 0x3290#define RF5360 0x5360 +#define RF5362 0x5362#define RF5370 0x5370#define RF5372 0x5372#define RF5390 0x5390
@@ -2147,7 +2149,7 @@ struct mac_iveiv_entry {/* Bits [7-4] for RF3320 (RT3370/RT3390), on other chipsets reserved */ #define RFCSR3_PA1_BIAS_CCK FIELD8(0x70)#define RFCSR3_PA2_CASCODE_BIAS_CCKK FIELD8(0x80) -/* Bits for RF3290/RF5360/RF5370/RF5372/RF5390/RF5392 */ +/* Bits for RF3290/RF5360/RF5362/RF5370/RF5372/RF5390/RF5392 */ #define RFCSR3_VCOCAL_EN FIELD8(0x80)/* Bits for RF3050 */ #define RFCSR3_BIT1 FIELD8(0x02)
drivers/net/wireless/rt2x00/rt2800lib.c +6 -0
@@ -3154,6 +3154,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,break ;case RF3070 :case RF5360 : +case RF5362 :case RF5370 :case RF5372 :case RF5390 :
@@ -3171,6 +3172,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,rt2x00_rf (rt2x00dev,RF3290 ) ||rt2x00_rf (rt2x00dev,RF3322 ) ||rt2x00_rf (rt2x00dev,RF5360 ) || +rt2x00_rf (rt2x00dev,RF5362 ) ||rt2x00_rf (rt2x00dev,RF5370 ) ||rt2x00_rf (rt2x00dev,RF5372 ) || rt2x00_rf(rt2x00dev, RF5390) ||
@@ -4269,6 +4271,7 @@ void rt2800_vco_calibration(struct rt2x00_dev *rt2x00dev)case RF3070 :case RF3290 :case RF5360 : +case RF5362 :case RF5370 :case RF5372 :case RF5390 :
@@ -7032,6 +7035,7 @@ static int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)case RF3320 :case RF3322 :case RF5360 : +case RF5362 :case RF5370 :case RF5372 :case RF5390 :
@@ -7555,6 +7559,7 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)rt2x00_rf (rt2x00dev,RF3320 ) ||rt2x00_rf (rt2x00dev,RF3322 ) ||rt2x00_rf (rt2x00dev,RF5360 ) || +rt2x00_rf (rt2x00dev,RF5362 ) ||rt2x00_rf (rt2x00dev,RF5370 ) ||rt2x00_rf (rt2x00dev,RF5372 ) || rt2x00_rf(rt2x00dev, RF5390) ||
@@ -7682,6 +7687,7 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)case RF3070 :case RF3290 :case RF5360 : +case RF5362 :case RF5370 :case RF5372 :case RF5390 :
Signature · 1 line
2.1.3
PATCH 152/206 wireless: rt2x00: add new rt2800usb devices
In reply to Jiri SlabyFrom: Xose Vazquez Perez <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6a06e554daef86c4e8d290284927b081fedb249e upstream.
0x0b05 0x17e8 RT5372 USB 2.0 bgn 2x2 ASUS USB-N14 0x0411 0x0253 RT5572 USB 2.0 abgn 2x2 BUFFALO WLP-U2-300D 0x0df6 0x0078 RT???? Sitecom N300
--- drivers/net/wireless/rt2x00/rt2800usb.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/rt2x00/rt2800usb.c +4 -0
@@ -1238,6 +1238,8 @@ static struct usb_device_id rt2800usb_device_table[] = {/* Arcadyan */ { USB_DEVICE(0x043e, 0x7a12) }, { USB_DEVICE(0x043e, 0x7a32) }, +/* ASUS */ + { USB_DEVICE(0x0b05, 0x17e8) },/* Azurewave */ { USB_DEVICE(0x13d3, 0x3329) }, { USB_DEVICE(0x13d3, 0x3365) },
@@ -1274,6 +1276,7 @@ static struct usb_device_id rt2800usb_device_table[] = { { USB_DEVICE(0x057c, 0x8501) },/* Buffalo */ { USB_DEVICE(0x0411, 0x0241) }, + { USB_DEVICE(0x0411, 0x0253) },/* D-Link */ { USB_DEVICE(0x2001, 0x3c1a) }, { USB_DEVICE(0x2001, 0x3c21) },
@@ -1364,6 +1367,7 @@ static struct usb_device_id rt2800usb_device_table[] = { { USB_DEVICE(0x0df6, 0x0053) }, { USB_DEVICE(0x0df6, 0x0069) }, { USB_DEVICE(0x0df6, 0x006f) }, + { USB_DEVICE(0x0df6, 0x0078) },/* SMC */ { USB_DEVICE(0x083a, 0xa512) }, { USB_DEVICE(0x083a, 0xc522) },
Signature · 1 line
2.1.3
PATCH 153/206 wireless: rt2x00: add new rt2800usb device
In reply to Jiri SlabyFrom: Cyril Brulebois <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 664d6a792785cc677c2091038ce10322c8d04ae1 upstream.
0x1b75 0xa200 AirLive WN-200USB wireless 11b/g/n dongle
References: https://bugs.debian.org/766802
--- drivers/net/wireless/rt2x00/rt2800usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/rt2x00/rt2800usb.c +1 -0
@@ -1065,6 +1065,7 @@ static struct usb_device_id rt2800usb_device_table[] = {/* Ovislink */ { USB_DEVICE(0x1b75, 0x3071) }, { USB_DEVICE(0x1b75, 0x3072) }, + { USB_DEVICE(0x1b75, 0xa200) },/* Para */ { USB_DEVICE(0x20b8, 0x8888) },/* Pegatron */
Signature · 1 line
2.1.3
PATCH 154/206 usb: dwc3: gadget: Properly initialize LINK TRB
In reply to Jiri SlabyFrom: Jack Pham <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1200a82a59b6aa65758ccc92c3447b98c53cd7a2 upstream.
On ISOC endpoints the last trb_pool entry used as a LINK TRB is not getting zeroed out correctly due to memset being called incorrectly and in the wrong place. If pool allocated from DMA was not zero-initialized to begin with this will result in the size and ctrl values being random garbage. Call memset correctly after assignment of the trb_link pointer.
--- drivers/usb/dwc3/gadget.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/usb/dwc3/gadget.c +1 -2
@@ -532,12 +532,11 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep,if (!usb_endpoint_xfer_isoc (desc))return 0 ; -memset (&trb_link,0 ,sizeof (trb_link)); -/* Link TRB for ISOC. The HWO bit is never reset */ trb_st_hw = &dep->trb_pool[0 ]; trb_link = &dep->trb_pool[DWC3_TRB_NUM -1 ]; +memset (trb_link,0 ,sizeof (*trb_link)); trb_link->bpl =lower_32_bits (dwc3_trb_dma_offset (dep, trb_st_hw)); trb_link->bph =upper_32_bits (dwc3_trb_dma_offset (dep, trb_st_hw));
Signature · 1 line
2.1.3
PATCH 155/206 spi: pl022: Fix incorrect dma_unmap_sg
In reply to Jiri SlabyFrom: Ray Jui <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3ffa6158f002e096d28ede71be4e0ee8ab20baa2 upstream.
When mapped RX DMA entries are unmapped in an error condition when DMA is firstly configured in the driver, the number of TX DMA entries was passed in, which is incorrect
--- drivers/spi/spi-pl022.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-pl022.c +1 -1
@@ -1075,7 +1075,7 @@ err_rxdesc: pl022->sgt_tx.nents, DMA_TO_DEVICE); err_tx_sgmap:dma_unmap_sg (rxchan->device->dev, pl022->sgt_rx.sgl, - pl022->sgt_tx.nents,DMA_FROM_DEVICE ); + pl022->sgt_rx.nents,DMA_FROM_DEVICE ); err_rx_sgmap:sg_free_table (&pl022->sgt_tx); err_alloc_tx_sg:
Signature · 1 line
2.1.3
PATCH 156/206 spi: fsl-dspi: Fix CTAR selection
In reply to Jiri SlabyFrom: Alexander Stein <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5cc7b04740effa5cc0af53f434134b5859d58b73 upstream.
There are only 4 CTAR registers (CTAR0 - CTAR3) so we can only use the lower 2 bits of the chip select to select a CTAR register. SPI_PUSHR_CTAS used the lower 3 bits which would result in wrong bit values if the chip selects 4/5 are used. For those chip selects SPI_CTAR even calculated offsets of non-existing registers.
--- drivers/spi/spi-fsl-dspi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/spi/spi-fsl-dspi.c +2 -2
@@ -45,7 +45,7 @@#define SPI_TCR 0x08 -#define SPI_CTAR (x) (0x0c + (x * 4)) +#define SPI_CTAR (x) (0x0c + (((x) & 0x3) * 4))#define SPI_CTAR_FMSZ (x) (((x) & 0x0000000f) << 27)#define SPI_CTAR_CPOL (x) ((x) << 26)#define SPI_CTAR_CPHA (x) ((x) << 25)
@@ -69,7 +69,7 @@#define SPI_PUSHR 0x34#define SPI_PUSHR_CONT (1 << 31) -#define SPI_PUSHR_CTAS (x) (((x) & 0x00000007) << 28) +#define SPI_PUSHR_CTAS (x) (((x) & 0x00000003) << 28)#define SPI_PUSHR_EOQ (1 << 27)#define SPI_PUSHR_CTCNT (1 << 26)#define SPI_PUSHR_PCS (x) (((1 << x) & 0x0000003f) << 16)
Signature · 1 line
2.1.3