3.9.5-stable review
Subsystems (87)
Greg Kroah-Hartman
maintainercover 3.9.5-stable review
This is the start of the stable review cycle for the 3.9.5 release. There are 127 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri Jun 7 21:30:02 UTC 2013. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.9.5-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 3.9.5-rc1
Wei Liu <[email protected]>
xen-netback: better names for thresholds
Johannes Berg <[email protected]>
mac80211_hwsim: remove P2P_DEVICE support
Johannes Berg <[email protected]>
iwlwifi: mvm: remove P2P_DEVICE support
Wei Liu <[email protected]>
xen-netfront: reduce gso_max_size to account for max TCP header
Wei Liu <[email protected]>
xen-netback: avoid allocating variable size array on stack
Wei Liu <[email protected]>
xen-netback: remove redundent parameter in netbk_count_requests
Wei Liu <[email protected]>
xen-netback: don't disconnect frontend when seeing oversize packet
Wei Liu <[email protected]>
xen-netback: coalesce slots in TX path and fix regressions
Timo Teräs <[email protected]>
leds: leds-gpio: reserve gpio before using it
Nicholas Bellinger <[email protected]>
target/file: Fix off-by-one READ_CAPACITY bug for !S_ISBLK export
Nicholas Bellinger <[email protected]>
target: Re-instate sess_wait_list for target_wait_for_sess_cmds
Miklos Szeredi <[email protected]>
fuse: fix readdirplus Oops in fuse_dentry_revalidate
Daniel Mack <[email protected]>
ASoC: davinci: fix sample rotation
Or Gerlitz <[email protected]>
IB/iser: Return error to upper layers on EAGAIN registration failures
Jonas Peterson <[email protected]>
net: can: kvaser_usb: fix reception on "USBcan Pro" and "USBcan R" type hardware.
Nithin Sujir <[email protected]>
tg3: Add read dma workaround for 5720
Gabor Juhos <[email protected]>
ath9k: use correct OTP register offsets for AR9550
Johannes Berg <[email protected]>
cfg80211: check wdev->netdev in connection work
Emmanuel Grumbach <[email protected]>
iwlwifi: mvm: tell firmware to let multicast frames in
Emmanuel Grumbach <[email protected]>
iwlwifi: dvm: fix zero LQ CMD sending avoidance
Johannes Berg <[email protected]>
mac80211: close AP_VLAN interfaces before unregistering all
Stanislaw Gruszka <[email protected]>
mac80211: fix direct probe auth
Ben Skeggs <[email protected]>
drm/nvc0/ce: disable ce1 on a number of chipsets
Bastian Triller <[email protected]>
ACPI / video: Add "Asus UL30A" to ACPI video detect blacklist
Rafael J. Wysocki <[email protected]>
ACPI / PM: Allow device power states to be used for CONFIG_PM unset
Joerg Roedel <[email protected]>
iommu/amd: Workaround for ERBT1312
Suravee Suthikulpanit <[email protected]>
iommu/amd: Re-enable IOMMU event log interrupt after handling.
Emmanuel Grumbach <[email protected]>
iwlwifi: mvm: fix aggregation drain flow
Wei Liu <[email protected]>
xen-netback: remove skb in xen_netbk_alloc_page
Dave Kleikamp <[email protected]>
jfs: fix a couple races
Jeff Mahoney <[email protected]>
reiserfs: fix spurious multiple-fill in reiserfs_readdir_dentry
Jeff Mahoney <[email protected]>
reiserfs: fix problems with chowning setuid file w/ xattrs
Jeff Mahoney <[email protected]>
reiserfs: fix deadlock with nfs racing on create/lookup
Srivatsa S. Bhat <[email protected]>
powerpc/pseries: Always enable CONFIG_HOTPLUG_CPU on PSERIES SMP
Kishon Vijay Abraham I <[email protected]>
regulator: palmas: Fix "enable_reg" to point to the correct reg for SMPS10
Paolo Bonzini <[email protected]>
KVM: fix sil/dil/bpl/spl in the mod/rm fields
Paolo Bonzini <[email protected]>
KVM: Emulate multibyte NOP
Trond Myklebust <[email protected]>
NFSv4: Fix a thinko in nfs4_try_open_cached
Nicholas Bellinger <[email protected]>
ib_srpt: Call target_sess_cmd_list_set_waiting during shutdown_session
Kees Cook <[email protected]>
iscsi-target: fix heap buffer overflow on error
Michael Neuling <[email protected]>
powerpc/tm: Move TM abort cause codes to uapi
Michael Neuling <[email protected]>
powerpc/tm: Abort on emulation and alignment faults
Michael Neuling <[email protected]>
powerpc/tm: Fix userspace stack corruption on signal delivery for active transactions
Michael Neuling <[email protected]>
powerpc/tm: Update cause codes documentation
Michael Neuling <[email protected]>
powerpc/tm: Make room for hypervisor in abort cause codes
Priyanka Jain <[email protected]>
powerpc/32bit:Store temporary result in r0 instead of r8
Tejun Heo <[email protected]>
cgroup: fix a subtle bug in descendant pre-order walk
Li Zefan <[email protected]>
cgroup: initialize xattr before calling d_instantiate()
Christian Borntraeger <[email protected]>
s390/pgtable: Fix check for pgste/storage key handling
Finn Thain <[email protected]>
m68k/mac: Fix unexpected interrupt with CONFIG_EARLY_PRINTK
Vincent Pelletier <[email protected]>
libata: make ata_exec_internal_sg honor DMADIR
Chew, Chiau Ee <[email protected]>
ata_piix: add PCI IDs for Intel BayTail
Sergei Shtylyov <[email protected]>
sata_rcar: fix interrupt handling
Sergei Shtylyov <[email protected]>
sata_rcar: clear STOP bit in bmdma_start() method
Jeff Layton <[email protected]>
cifs: fix potential buffer overrun when composing a new options string
Horia Geanta <[email protected]>
crypto: caam - fix inconsistent assoc dma mapping direction
Alex Deucher <[email protected]>
drm/radeon: fix card_posted check for newer asics
Alex Deucher <[email protected]>
drm/radeon: fix typo in cu_per_sh on verde
Rodrigo Vivi <[email protected]>
drm/i915: Adding more reserved PCI IDs for Haswell.
Charles Keepax <[email protected]>
ASoC: wm5110: Correct DSP4R Mixer control name
Nicolas Schichan <[email protected]>
ASoC: cs42l52: fix default value for MASTERA_VOL.
J. Bruce Fields <[email protected]>
svcrpc: fix failures to handle -1 uid's and gid's
Trond Myklebust <[email protected]>
SUNRPC: Prevent an rpc_task wakeup race
Sylwester Nawrocki <[email protected]>
ARM: SAMSUNG: Export MIPI CSIS/DSIM PHY control functions
Mark Rutland <[email protected]>
arm64: don't kill the kernel on a bad esr from el0
Dave Chinner <[email protected]>
xfs: kill suid/sgid through the truncate path.
Rusty Russell <[email protected]>
module: don't unlink the module until we've removed all exposure.
Jan Beulich <[email protected]>
x86, crc32-pclmul: Fix build with older binutils
Yinghai Lu <[email protected]>
x86, range: fix missing merge during add range
Zhang Yanfei <[email protected]>
x86-64, init: Fix a possible wraparound bug in switchover in head_64.S
Pekka Riikonen <[email protected]>
x86: Allow FPU to be used at interrupt time even with eagerfpu
[email protected] <[email protected]>
SCSI: ipr: Need to reset adapter after the 6th EEH error
Aneesh Kumar K.V <[email protected]>
mm/THP: use pmd_populate() to update the pmd with pgtable_t pointer
Cliff Wickman <[email protected]>
mm/pagewalk.c: walk_page_range should avoid VM_PFNMAP areas
Brian Behlendorf <[email protected]>
drivers/block/brd.c: fix brd_lookup_page() race
Johannes Weiner <[email protected]>
mm: memcg: remove incorrect VM_BUG_ON for swap cache pages in uncharge
Xiao Guangrong <[email protected]>
mm: mmu_notifier: re-fix freed page still mapped in secondary MMU
Ryusuke Konishi <[email protected]>
nilfs2: fix issue of nilfs_set_page_dirty() for page at EOF boundary
Imre Deak <[email protected]>
wait: fix false timeouts when using wait_event_timeout()
wang, biao <[email protected]>
klist: del waiter from klist_remove_waiters before wakeup waitting process
Leonid Yegoshin <[email protected]>
mm compaction: fix of improper cache flush in migration code
Alexandre Bounine <[email protected]>
rapidio/tsi721: fix bug in MSI interrupt handling
Christian Gmeiner <[email protected]>
drivers/leds/leds-ot200.c: fix error caused by shifted mask
Martin Michlmayr <[email protected]>
Kirkwood: Enable PCIe port 1 on QNAP TS-11x/TS-21x
Joseph Qi <[email protected]>
ocfs2: goto out_unlock if ocfs2_get_clusters_nocache() failed in ocfs2_fiemap()
Sujith Manoharan <[email protected]>
ath9k_hw: Enable manual peak calibration for AR9485
Sujith Manoharan <[email protected]>
ath9k: Fix crash on module unload
Ben Hutchings <[email protected]>
perf: net_dropmonitor: Fix symbol-relative addresses
Ben Hutchings <[email protected]>
perf: net_dropmonitor: Fix trace parameter order
Michael Chan <[email protected]>
tg3: Fix data corruption on 5725 with TSO
Nithin Sujir <[email protected]>
tg3: Skip powering down function 0 on certain serdes devices
OGAWA Hirofumi <[email protected]>
fat: fix possible overflow for fat_clusters
Jiri Kosina <[email protected]>
random: fix accounting race condition with lockless irq entropy_count update
Jarod Wilson <[email protected]>
drivers/char/random.c: fix priming of last_data
Vineet Gupta <[email protected]>
ARC: copy_(to|from)_user() to honor usermode-access permissions
Jeff Layton <[email protected]>
cifs: only set ops for inodes in I_NEW state
K. Y. Srinivasan <[email protected]>
Drivers: hv: Fix a bug in get_vp_index()
Heiko Abraham <[email protected]>
Input: egalax_ts - ABS_MT_POSITION_Y not reported well
Alan Stern <[email protected]>
USB: UHCI: fix for suspend of virtual HP controller
Alan Stern <[email protected]>
USB: xHCI: override bogus bulk wMaxPacketSize values
Oliver Neukum <[email protected]>
USB: reset resume quirk needed by a hub
Schemmel Hans-Christoph <[email protected]>
USB: Blacklisted Cinterion's PLxx WWAN Interface
Wang YanQing <[email protected]>
TTY: Fix tty miss restart after we turn off flow-control
Dan Carpenter <[email protected]>
USB: cxacru: potential underflow in cxacru_cm_get_array()
Gomella, Andrew (NIH/NHLBI) [F] <[email protected]>
USB: ftdi_sio: Add support for Newport CONEX motor drivers
Dan Williams <[email protected]>
USB: option: add device IDs for Dell 5804 (Novatel E371) WWAN card
Teppo Kotilainen <[email protected]>
usb: option: Add Telewell TW-LTE 4G
David Rientjes <[email protected]>
usb, chipidea: fix link error when USB_EHCI_HCD is a module
Hema Prathaban <[email protected]>
staging: vt6656: use free_netdev instead of kfree
Malcolm Priestley <[email protected]>
staging: vt6656: [bug] Fix missing spin lock in iwctl_siwpower.
Alexander Bondar <[email protected]>
iwlwifi: mvm: Prevent setting assoc flag in MAC_CONTEXT_CMD
Ilan Peer <[email protected]>
iwlwifi: mvm: Always use SCAN_TYPE_FORCED
Johannes Berg <[email protected]>
mac80211: fix AP-mode frame matching
Johannes Berg <[email protected]>
mac80211: use just spin_lock() in ieee80211_get_tkip_p2k()
Johannes Berg <[email protected]>
cfg80211: fix sending WoWLAN TCP wakeup settings
Johannes Berg <[email protected]>
cfg80211: fix wiphy_register error path
Johannes Berg <[email protected]>
cfg80211: fix WoWLAN wakeup tracing
Boris BREZILLON <[email protected]>
ARM: at91/dt: fix macb pinctrl_macb_rmii_mii_alt definition
Jean-Christophe PLAGNIOL-VILLARD <[email protected]>
ARM: at91: rm9200 fix time support
Jean-Christophe PLAGNIOL-VILLARD <[email protected]>
ARM: at91/trivial: fix model name for SAM9X25-EK
Ard Biesheuvel <[email protected]>
ARM: 7723/1: crypto: sha1-armv4-large.S: fix SP handling
Vaibhav Hiremath <[email protected]>
ARM: AM33XX: Add missing .clkdm_name to clkdiv32k_ick clock
jean-philippe francois <[email protected]>
ARM: OMAP: fix __init section mismatch for _enable_preprogram
Gregory CLEMENT <[email protected]>
ARM: plat-orion: Fix num_resources and id for ge10 and ge11
Alan Stern <[email protected]>
USB: fix latency in uhci-hcd and ohci-hcd
Alan Stern <[email protected]>
USB: OHCI: fix logic for scheduling isochronous URBs
Hans-Christian Egtvedt <[email protected]>
avr32: fix relocation check for signed 18-bit offset
-------------
Diffstat:
Documentation/powerpc/transactional_memory.txt | 27 +- Makefile | 4 +- arch/arc/include/asm/pgtable.h | 26 +- arch/arc/include/asm/tlb.h | 2 +- arch/arc/mm/tlbex.S | 6 +- arch/arm/boot/dts/at91sam9260.dtsi | 2 +- arch/arm/boot/dts/at91sam9x25ek.dts | 2 +- arch/arm/crypto/sha1-armv4-large.S | 2 +- arch/arm/mach-at91/at91rm9200_time.c | 7 +- arch/arm/mach-kirkwood/ts219-setup.c | 2 +- arch/arm/mach-omap2/cclock33xx_data.c | 26 +- arch/arm/mach-omap2/omap_hwmod.c | 2 +- arch/arm/plat-orion/common.c | 12 +- arch/arm/plat-samsung/setup-mipiphy.c | 3 + arch/arm64/kernel/traps.c | 12 +- arch/avr32/kernel/module.c | 2 +- arch/m68k/kernel/head.S | 29 +- arch/powerpc/include/asm/processor.h | 13 +- arch/powerpc/include/asm/reg.h | 11 - arch/powerpc/include/asm/signal.h | 3 + arch/powerpc/include/asm/tm.h | 2 + arch/powerpc/include/uapi/asm/Kbuild | 1 + arch/powerpc/include/uapi/asm/tm.h | 18 ++ arch/powerpc/kernel/entry_32.S | 2 +- arch/powerpc/kernel/signal.c | 40 ++- arch/powerpc/kernel/signal.h | 2 +- arch/powerpc/kernel/signal_32.c | 10 +- arch/powerpc/kernel/signal_64.c | 23 +- arch/powerpc/kernel/traps.c | 29 ++ arch/powerpc/platforms/pseries/Kconfig | 2 + arch/s390/include/asm/pgtable.h | 15 +- arch/x86/crypto/crc32-pclmul_asm.S | 2 +- arch/x86/include/asm/inst.h | 74 ++++- arch/x86/kernel/head_64.S | 6 +- arch/x86/kernel/i387.c | 14 +- arch/x86/kvm/emulate.c | 9 +- drivers/acpi/Makefile | 2 +- drivers/acpi/device_pm.c | 126 ++++----- drivers/acpi/video_detect.c | 8 + drivers/ata/ata_piix.c | 15 ++ drivers/ata/libata-core.c | 6 + drivers/ata/sata_rcar.c | 24 +- drivers/block/brd.c | 4 +- drivers/char/random.c | 54 ++-- drivers/crypto/caam/caamalg.c | 4 +- drivers/gpu/drm/i915/i915_drv.c | 46 +++- drivers/gpu/drm/nouveau/core/subdev/device/nvc0.c | 2 - drivers/gpu/drm/radeon/radeon_device.c | 19 +- drivers/gpu/drm/radeon/si.c | 2 +- drivers/hv/channel_mgmt.c | 2 +- drivers/infiniband/ulp/iser/iser_memory.c | 3 +- drivers/infiniband/ulp/srpt/ib_srpt.c | 32 ++- drivers/infiniband/ulp/srpt/ib_srpt.h | 1 + drivers/input/touchscreen/egalax_ts.c | 2 +- drivers/iommu/amd_iommu.c | 31 ++- drivers/iommu/amd_iommu_types.h | 1 + drivers/leds/leds-gpio.c | 9 +- drivers/leds/leds-ot200.c | 14 +- drivers/net/can/usb/kvaser_usb.c | 64 +++-- drivers/net/ethernet/broadcom/tg3.c | 70 ++++- drivers/net/ethernet/broadcom/tg3.h | 5 +- drivers/net/wireless/ath/ath9k/ar9003_calib.c | 2 +- drivers/net/wireless/ath/ath9k/ar9003_eeprom.h | 9 +- drivers/net/wireless/ath/ath9k/ar9485_initvals.h | 2 +- drivers/net/wireless/ath/ath9k/debug.c | 8 + drivers/net/wireless/ath/ath9k/debug.h | 5 + drivers/net/wireless/ath/ath9k/init.c | 10 +- drivers/net/wireless/iwlwifi/dvm/sta.c | 2 +- drivers/net/wireless/iwlwifi/mvm/fw-api.h | 27 ++ drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c | 12 +- drivers/net/wireless/iwlwifi/mvm/mac80211.c | 31 ++- drivers/net/wireless/iwlwifi/mvm/mvm.h | 1 + drivers/net/wireless/iwlwifi/mvm/ops.c | 1 + drivers/net/wireless/iwlwifi/mvm/scan.c | 6 + drivers/net/wireless/iwlwifi/mvm/sta.c | 13 +- drivers/net/wireless/iwlwifi/mvm/sta.h | 2 - drivers/net/wireless/iwlwifi/mvm/tx.c | 48 +++- drivers/net/wireless/mac80211_hwsim.c | 4 +- drivers/net/xen-netback/netback.c | 311 ++++++++++++++++++---- drivers/net/xen-netfront.c | 17 +- drivers/rapidio/devices/tsi721.c | 12 + drivers/regulator/palmas-regulator.c | 2 +- drivers/scsi/ipr.c | 12 +- drivers/staging/vt6656/hostap.c | 2 +- drivers/staging/vt6656/iwctl.c | 6 + drivers/target/iscsi/iscsi_target_parameters.c | 8 +- drivers/target/iscsi/iscsi_target_parameters.h | 4 +- drivers/target/target_core_file.c | 12 +- drivers/target/target_core_transport.c | 18 +- drivers/tty/n_tty.c | 8 + drivers/usb/atm/cxacru.c | 3 +- drivers/usb/chipidea/Kconfig | 2 +- drivers/usb/core/quirks.c | 3 + drivers/usb/host/ohci-hcd.c | 34 +-- drivers/usb/host/uhci-hub.c | 3 +- drivers/usb/host/uhci-q.c | 2 +- drivers/usb/host/xhci-mem.c | 17 +- drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 2 + drivers/usb/serial/option.c | 13 +- fs/cifs/cifs_dfs_ref.c | 4 +- fs/cifs/inode.c | 3 +- fs/fat/inode.c | 15 +- fs/fuse/dir.c | 12 +- fs/fuse/inode.c | 7 +- fs/jfs/inode.c | 2 +- fs/jfs/jfs_logmgr.c | 3 +- fs/nfs/nfs4proc.c | 2 +- fs/nilfs2/inode.c | 27 +- fs/ocfs2/extent_map.c | 2 +- fs/reiserfs/dir.c | 2 + fs/reiserfs/inode.c | 9 +- fs/reiserfs/xattr.c | 14 +- fs/reiserfs/xattr_acl.c | 3 + fs/xfs/xfs_iops.c | 47 ++-- include/acpi/acpi_bus.h | 40 +-- include/linux/cgroup.h | 2 +- include/linux/wait.h | 16 +- include/target/target_core_base.h | 1 + include/xen/interface/io/netif.h | 19 ++ kernel/cgroup.c | 18 +- kernel/module.c | 13 +- kernel/range.c | 8 +- lib/klist.c | 2 +- mm/huge_memory.c | 7 +- mm/memcontrol.c | 14 +- mm/migrate.c | 2 +- mm/mmu_notifier.c | 79 +++--- mm/pagewalk.c | 70 ++--- net/mac80211/iface.c | 9 + net/mac80211/mlme.c | 12 +- net/mac80211/rx.c | 3 + net/mac80211/tkip.c | 4 +- net/sunrpc/sched.c | 8 +- net/sunrpc/svcauth_unix.c | 12 +- net/wireless/core.c | 16 +- net/wireless/nl80211.c | 2 + net/wireless/sme.c | 3 + net/wireless/trace.h | 23 +- sound/soc/codecs/cs42l52.c | 2 +- sound/soc/codecs/wm5110.c | 2 +- sound/soc/davinci/davinci-mcasp.c | 7 +- tools/perf/scripts/python/net_dropmonitor.py | 8 +- 143 files changed, 1545 insertions(+), 673 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/127 avr32: fix relocation check for signed 18-bit offset
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans-Christian Egtvedt <[email protected]>
commit e68c636d88db3fda74e664ecb1a213ae0d50a7d8 upstream.
Caught by static code analysis by David.
--- arch/avr32/kernel/module.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/avr32/kernel/module.c +1 -1
@@ -264,7 +264,7 @@ int apply_relocate_add(Elf32_Shdr *sechdbreak ;case R_AVR32_GOT18SW :if ((relocation &0xfffe0003 ) !=0 - && (relocation &0xfffc0003 ) !=0xffff0000 ) + && (relocation &0xfffc0000 ) !=0xfffc0000 )return reloc_overflow (module,"R_AVR32_GOT18SW" , relocation); relocation >>=2 ;
Greg Kroah-Hartman
maintainerPATCH 2/127 USB: OHCI: fix logic for scheduling isochronous URBs
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 815fa7b917614261748d1ecd9600ff27f99508e5 upstream.
The isochronous scheduling logic in ohci-hcd has a bug. The calculation for skipping TDs that are too late should be carried out only in the !URB_ISO_ASAP case. When URB_ISO_ASAP is set, the URB is pushed back so that none of the TDs are too late, which would cause the calculation to overflow.
The patch also fixes the calculation to avoid overflow in the case where the frame value wraps around.
This should be applied to -stable kernels going back to 3.8.
--- drivers/usb/host/ohci-hcd.c | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-)
drivers/usb/host/ohci-hcd.c +18 -14
@@ -240,7 +240,7 @@ static int ohci_urb_enqueue (if (unlikely (tick_before (frame, next))) {/* USB_ISO_ASAP: Round up to the first available slot */ -if (urb->transfer_flags &URB_ISO_ASAP ) +if (urb->transfer_flags &URB_ISO_ASAP ) { frame += (next - frame + ed->interval -1 ) & -ed->interval;
@@ -248,21 +248,25 @@ static int ohci_urb_enqueue (* Not ASAP: Use the next slot in the stream. If * the entire URB falls before the threshold, fail. */ - else if (tick_before(frame + ed->interval * + }else { +if (tick_before (frame + ed->interval * (urb->number_of_packets -1 ), next)) { - retval = -EXDEV ; -usb_hcd_unlink_urb_from_ep (hcd, urb); - goto fail; - } + retval = -EXDEV ; +usb_hcd_unlink_urb_from_ep (hcd, urb); + goto fail; + } -/* -* Some OHCI hardware doesn't handle late TDs -* correctly. After retiring them it proceeds to -* the next ED instead of the next TD. Therefore -* we have to omit the late TDs entirely. -*/ - urb_priv->td_cnt =DIV_ROUND_UP (next - frame, - ed->interval); +/* +* Some OHCI hardware doesn't handle late TDs +* correctly. After retiring them it proceeds +* to the next ED instead of the next TD. +* Therefore we have to omit the late TDs +* entirely. +*/ + urb_priv->td_cnt =DIV_ROUND_UP ( + (u16) (next - frame), + ed->interval); + } } urb->start_frame = frame; }
Greg Kroah-Hartman
maintainerPATCH 3/127 USB: fix latency in uhci-hcd and ohci-hcd
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit e1944017839d7dfbf7329fac4bdec8b4050edf5e upstream.
Commits c44b225077bb1fb25ed5cd5c4f226897b91bedd4 (UHCI: implement new semantics for URB_ISO_ASAP) and 6a41b4d3fe8cd4cc95181516fc6fba7b1747a27c (OHCI: implement new semantics for URB_ISO_ASAP) increased the latency for isochronous URBs in uhci-hcd and ohci-hcd respectively to 2 milliseconds, in an attempt to avoid underruns. It turns out that not only was this unnecessary -- 1-ms latency works okay -- it also causes problems with certain application loads such as real-time audio.
This patch changes the latency for both drivers back to 1 ms.
This should be applied to -stable kernels going back to 3.8.
--- drivers/usb/host/ohci-hcd.c | 2 +- drivers/usb/host/uhci-q.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/usb/host/ohci-hcd.c +1 -1
@@ -233,7 +233,7 @@ static int ohci_urb_enqueue ( urb->start_frame = frame; } }else if (ed->type ==PIPE_ISOCHRONOUS ) { -u16 next =ohci_frame_no (ohci) +2 ; +u16 next =ohci_frame_no (ohci) +1 ;u16 frame = ed->last_iso + ed->interval;/* Behind the scheduling threshold? */
drivers/usb/host/uhci-q.c +1 -1
@@ -1287,7 +1287,7 @@ static int uhci_submit_isochronous(strucreturn -EINVAL ;/* Can't change the period */ }else { - next = uhci->frame_number +2 ; + next = uhci->frame_number +1 ;/* Find the next unused frame */ if (list_empty (&qh->queue)) {
Greg Kroah-Hartman
maintainerPATCH 4/127 ARM: plat-orion: Fix num_resources and id for ge10 and ge11
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory CLEMENT <[email protected]>
commit 2b8b2797142c7951e635c6eec5d1705ee9bc45c5 upstream.
When platform data were moved from arch/arm/mach-mv78xx0/common.c to arch/arm/plat-orion/common.c with the commit "7e3819d ARM: orion:
Consolidate ethernet platform data", there were few typo made on gigabit Ethernet interface ge10 and ge11. This commit writes back their initial value, which allows to use this interfaces again.
--- arch/arm/plat-orion/common.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm/plat-orion/common.c +6 -6
@@ -373,7 +373,7 @@ static struct resource orion_ge10_sharedstatic struct platform_device orion_ge10_shared = { .name =MV643XX_ETH_SHARED_NAME , - .id =1 , + .id =2 , .dev = { .platform_data = &orion_ge10_shared_data, },
@@ -388,8 +388,8 @@ static struct resource orion_ge10_resourstatic struct platform_device orion_ge10 = { .name =MV643XX_ETH_NAME , - .id =1 , - .num_resources =2 , + .id =2 , + .num_resources =1 , .resource = orion_ge10_resources, .dev = { .coherent_dma_mask =DMA_BIT_MASK (32 ),
@@ -425,7 +425,7 @@ static struct resource orion_ge11_sharedstatic struct platform_device orion_ge11_shared = { .name =MV643XX_ETH_SHARED_NAME , - .id =1 , + .id =3 , .dev = { .platform_data = &orion_ge11_shared_data, },
@@ -440,8 +440,8 @@ static struct resource orion_ge11_resourstatic struct platform_device orion_ge11 = { .name =MV643XX_ETH_NAME , - .id =1 , - .num_resources =2 , + .id =3 , + .num_resources =1 , .resource = orion_ge11_resources, .dev = { .coherent_dma_mask =DMA_BIT_MASK (32 ),
Greg Kroah-Hartman
maintainerPATCH 5/127 ARM: OMAP: fix __init section mismatch for _enable_preprogram
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: jean-philippe francois <[email protected]>
commit 0f497039276fa2ca2ca324236848bb15c8c775dc upstream.
_enable_preprogram is marked as __init, but is called from _enable which is not. Without this patch, the board oopses after init. Tested on custom hardware and on beagle board xM. Otherwise we can get:
Unable to handle kernel paging request at virtual address 000b0012 pgd = cf968000 *pgd=8fb06831, *pte=00000000, *ppte=00000000 PREEMPT ARM Modules linked in: CPU: 0 Not tainted (3.9.0 #2) PC is at _enable_preprogram+0x1c/0x24 LR is at omap_hwmod_enable+0x34/0x60 psr: 80000093
sp : cf95de08 ip : 00002de5 fp : bec33d4c
r10: 00000000 r9 : 00000002 r8 : b6dd2c78
r7 : 00000004 r6 : 00000000 r5 : a0000013 r4 : cf95c000 r3 : 00000000 r2 : b6dd2c7c r1 : 00000000 r0 : 000b0012
Flags: Nzcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
Control: 10c5387d Table: 8f968019 DAC: 00000015 Process otpcmd (pid: 607, stack limit = 0xcf95c230)
Stack: (0xcf95de08 to 0xcf95e000)
de00: 00000001 cf91f840 00000000 c001d6fc 00000002 cf91f840
de20: cf8f7e10 c001de54 cf8f7e10 c001de78 c001de68 c01d5e80 00000000 cf8f7e10
de40: cf8f7e10 c01d5f28 cf8f7e10 c0530d30 00000000 c01d6f28 00000000 c0088664
de60: b6ea1000 cfb05284 cf95c000 00000001 cf95c000 60000013 00000001 cf95dee4
de80: cf870050 c01d7308 cf870010 cf870050 00000001 c0278b14 c0526f28 00000000
dea0: cf870050 ffff8e18 00000001 cf95dee4 00000000 c0274f7c cf870050 00000001
dec0: cf95dee4 cf1d8484 000000e0 c0276464 00000008 cf9c0000 00000007 c0276980
dee0: cf9c0000 00000064 00000008 cf1d8404 cf1d8400 c01cc05c 0000270a cf1d8504
df00: 00000023 cf1d8484 00000007 c01cc670 00000bdd 00000001 00000000 cf449e60
df20: cf1dde70 cf1d8400 bec33d18 cf1d8504 c0246f00 00000003 cf95c000 00000000
df40: bec33d4c c01cd078 00000003 cf1d8504 00000081 c01cbcb8 bec33d18 00000003
df60: bec33d18 c00a9034 00002000 c00a9c68 cf92fe00 00000003 c0246f00 cf92fe00
df80: 00000000 c00a9cb0 00000003 00000000 00008e70 00000000 b6f17000 00000036
dfa0: c000e484 c000e300 00008e70 00000000 00000003 c0246f00 bec33d18 bec33d18
dfc0: 00008e70 00000000 b6f17000 00000036 00000000 00000000 b6f6d000 bec33d4c
dfe0: b6ea1bd0 bec33d0c 00008c9c b6ea1bdc 60000010 00000003 00000000 00000000 (_omap_device_enable_hwmods+0x20/0x34) (omap_device_enable+0x3c/0x50)
(_od_runtime_resume+0x10/0x1c)
(__rpm_callback+0x54/0x98)
(rpm_callback+0x64/0x7c)
(rpm_resume+0x434/0x554)
(__pm_runtime_resume+0x48/0x74)
(omap_i2c_xfer+0x28/0xe8)
(__i2c_transfer+0x3c/0x78)
(i2c_transfer+0x6c/0xc0)
(i2c_master_send+0x38/0x48)
(sha204p_send_command+0x60/0x9c) (sha204c_send_and_receive+0x5c/0x1e0)
(sha204m_read+0x94/0xa0)
(otp_do_read+0x50/0xa4)
(vfs_ioctl+0x24/0x40)
(do_vfs_ioctl+0x1b0/0x1c0)
(sys_ioctl+0x38/0x54)
(ret_fast_syscall+0x0/0x30)
Code: e1a08002 ea000009 e598003c e592c05c (e7904003)
--- arch/arm/mach-omap2/omap_hwmod.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-omap2/omap_hwmod.c +1 -1
@@ -2066,7 +2066,7 @@ static int _omap4_get_context_lost(struc* do so is present in the hwmod data, then call it and pass along the * return value; otherwise, return 0. */ -static int __init _enable_preprogram (struct omap_hwmod *oh) +static int _enable_preprogram (struct omap_hwmod *oh) {if (!oh->class->enable_preprogram)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 6/127 ARM: AM33XX: Add missing .clkdm_name to clkdiv32k_ick clock
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vaibhav Hiremath <[email protected]>
commit a6d25f4c951b8b28f2eaec6f891ff834622532f2 upstream.
It is required to enable respective clock-domain before enabling any clock/module inside that clock-domain.
During common-clock migration, .clkdm_name field got missed for "clkdiv32k_ick" clock, which leaves "clk_24mhz_clkdm" unused; so it will be disabled even if childs of this clock-domain is enabled, which keeps child modules in idle mode.
This fixes the kernel crash observed on AM335xEVM-SK platform, where clkdiv32_ick clock is being used as a gpio debounce clock and since clkdiv32k_ick is in idle mode it leads to below crash -
Crash Log:
==========
[ 2.598347] Unhandled fault: external abort on non-linefetch (0x1028) at 0xfa1ac150 [ 2.606434] Internal error: : 1028 [#1] SMP ARM [ 2.611207] Modules linked in: [ 2.614449] CPU: 0 Not tainted (3.8.4-01382-g1f449cd-dirty #4) [ 2.620973] PC is at _set_gpio_debounce+0x60/0x104 [ 2.626025] LR is at clk_enable+0x30/0x3c
--- arch/arm/mach-omap2/cclock33xx_data.c | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-)
arch/arm/mach-omap2/cclock33xx_data.c +23 -3
@@ -446,9 +446,29 @@ DEFINE_CLK_GATE(cefuse_fck, "sys_clkin_c*/ DEFINE_CLK_FIXED_FACTOR (clkdiv32k_ck,"clk_24mhz" , &clk_24mhz,0x0 ,1 ,732 ); -DEFINE_CLK_GATE (clkdiv32k_ick,"clkdiv32k_ck" , &clkdiv32k_ck,0x0 , -AM33XX_CM_PER_CLKDIV32K_CLKCTRL ,AM33XX_MODULEMODE_SWCTRL_SHIFT , -0x0 ,NULL ); +static struct clk clkdiv32k_ick; + +static const char *clkdiv32k_ick_parent_names[] = { +"clkdiv32k_ck" , +}; + +static const struct clk_ops clkdiv32k_ick_ops = { + .enable = &omap2_dflt_clk_enable, + .disable = &omap2_dflt_clk_disable, + .is_enabled = &omap2_dflt_clk_is_enabled, + .init = &omap2_init_clk_clkdm, +}; + +static struct clk_hw_omap clkdiv32k_ick_hw = { + .hw = { + .clk = &clkdiv32k_ick, + }, + .enable_reg =AM33XX_CM_PER_CLKDIV32K_CLKCTRL , + .enable_bit =AM33XX_MODULEMODE_SWCTRL_SHIFT , + .clkdm_name ="clk_24mhz_clkdm" , +}; + +DEFINE_STRUCT_CLK (clkdiv32k_ick, clkdiv32k_ick_parent_names, clkdiv32k_ick_ops);/* "usbotg_fck" is an additional clock and not really a modulemode */ DEFINE_CLK_GATE(usbotg_fck, "dpll_per_ck", &dpll_per_ck, 0x0,
Greg Kroah-Hartman
maintainerPATCH 7/127 ARM: 7723/1: crypto: sha1-armv4-large.S: fix SP handling
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit 934fc24df10abfd5aff533d0d044a17669d77d79 upstream.
Make the SHA1 asm code ABI conformant by making sure all stack accesses occur above the stack pointer.
Origin:
http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=1a9d60d2
--- arch/arm/crypto/sha1-armv4-large.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/crypto/sha1-armv4-large.S +1 -1
@@ -195,6 +195,7 @@ ENTRY(sha1_block_data_order) add r3,r3,r10 @ E+=F_00_19(B,C,D) cmp r14,sp bne .L_00_15 @ [((11+4)*5+2)*3] + sub sp,sp,#25*4 #if __ARM_ARCH__<7 ldrb r10,[r1,#2] ldrb r9,[r1,#3]
@@ -290,7 +291,6 @@ ENTRY(sha1_block_data_order) add r3,r3,r10 @ E+=F_00_19(B,C,D) ldr r8,.LK_20_39 @ [+15+16*4] - sub sp,sp,#25*4 cmn sp,#0 @ [+3], clear carry to denote 20_39 .L_20_39_or_60_79: ldr r9,[r14,#15*4]
Greg Kroah-Hartman
maintainerPATCH 8/127 ARM: at91/trivial: fix model name for SAM9X25-EK
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Christophe PLAGNIOL-VILLARD <[email protected]>
commit 9349d00fc3ff2b110dc07d9f5d06abfeac300c19 upstream.
--- arch/arm/boot/dts/at91sam9x25ek.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/at91sam9x25ek.dts +1 -1
@@ -11,6 +11,6 @@ /include/ "at91sam9x5ek.dtsi" / { - model = "Atmel AT91SAM9G25-EK"; + model = "Atmel AT91SAM9X25-EK"; compatible = "atmel,at91sam9x25ek", "atmel,at91sam9x5ek", "atmel,at91sam9x5", "atmel,at91sam9"; };
Greg Kroah-Hartman
maintainerPATCH 9/127 ARM: at91: rm9200 fix time support
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Christophe PLAGNIOL-VILLARD <[email protected]>
commit b7a8ca5173ef9aa55fa039d7c216426ff0b25a12 upstream.
since commit 838a2ae80a6ab52139fb1bf0a93ea8c5eff94488
Author: Shawn Guo <[email protected]> Date: Sat Jan 12 11:50:05 2013 +0000
ARM: use clockevents_config_and_register() where possible
The timer is wrongly configured and result in a nice crash so revert it on rm9200 timer.
--- arch/arm/mach-at91/at91rm9200_time.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
arch/arm/mach-at91/at91rm9200_time.c +5 -2
@@ -174,6 +174,7 @@ clkevt32k_next_event(unsigned long deltastatic struct clock_event_device clkevt = { .name ="at91_tick" , .features =CLOCK_EVT_FEAT_PERIODIC |CLOCK_EVT_FEAT_ONESHOT , + .shift =32 , .rating =150 , .set_next_event = clkevt32k_next_event, .set_mode = clkevt32k_mode,
@@ -264,9 +265,11 @@ void __init at91rm9200_timer_init(void)at91_st_write (AT91_ST_RTMR ,1 );/* Setup timer clockevent, with minimum of two ticks (important!!) */ + clkevt.mult =div_sc (AT91_SLOW_CLOCK ,NSEC_PER_SEC , clkevt.shift); + clkevt.max_delta_ns =clockevent_delta2ns (AT91_ST_ALMV , &clkevt); + clkevt.min_delta_ns =clockevent_delta2ns (2 , &clkevt) +1 ; clkevt.cpumask =cpumask_of (0 ); -clockevents_config_and_register (&clkevt,AT91_SLOW_CLOCK , -2 ,AT91_ST_ALMV ); +clockevents_register_device (&clkevt);/* register clocksource */ clocksource_register_hz (&clk32k,AT91_SLOW_CLOCK );
Greg Kroah-Hartman
maintainerPATCH 10/127 ARM: at91/dt: fix macb pinctrl_macb_rmii_mii_alt definition
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris BREZILLON <[email protected]>
commit f6d35d67d0a5c159f767a20f4fcc1d295a7314b1 upstream.
The PA24 pin is wrongly assigned to peripheral B.
In the current config there is 2 ETX3 pins (PA11 and PA24) and no ETXER pin (PA22).
--- arch/arm/boot/dts/at91sam9260.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/at91sam9260.dtsi +1 -1
@@ -264,7 +264,7 @@ atmel,pins = <0 10 0x2 0x0 /* PA10 periph B */ 0 11 0x2 0x0 /* PA11 periph B */ - 0 24 0x2 0x0 /* PA24 periph B */ + 0 22 0x2 0x0 /* PA22 periph B */ 0 25 0x2 0x0 /* PA25 periph B */ 0 26 0x2 0x0 /* PA26 periph B */ 0 27 0x2 0x0 /* PA27 periph B */
Greg Kroah-Hartman
maintainerPATCH 11/127 cfg80211: fix WoWLAN wakeup tracing
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit a92eecbbeaf01ea2267751569dd3301248513915 upstream.
If the device reports a non-wireless wakeup reason, the tracing code crashes trying to dereference a NULL pointer. Fix this by checking the pointer on all accesses and also add a non_wireless tag to the event.
--- net/wireless/trace.h | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-)
net/wireless/trace.h +13 -10
@@ -2386,6 +2386,7 @@ TRACE_EVENT(cfg80211_report_wowlan_wakeuTP_STRUCT__entry ( WIPHY_ENTRY WDEV_ENTRY + __field(bool, non_wireless) __field(bool, disconnect) __field(bool, magic_pkt) __field(bool, gtk_rekey_failure)
@@ -2394,20 +2395,22 @@ TRACE_EVENT(cfg80211_report_wowlan_wakeu __field(bool, rfkill_release) __field(s32, pattern_idx) __field(u32, packet_len) -__dynamic_array (u8, packet, wakeup->packet_present_len) +__dynamic_array (u8, packet, + wakeup ? wakeup->packet_present_len :0 ) ),TP_fast_assign ( WIPHY_ASSIGN;WDEV_ASSIGN ; - __entry->disconnect = wakeup->disconnect; - __entry->magic_pkt = wakeup->magic_pkt; - __entry->gtk_rekey_failure = wakeup->gtk_rekey_failure; - __entry->eap_identity_req = wakeup->eap_identity_req; - __entry->four_way_handshake = wakeup->four_way_handshake; - __entry->rfkill_release = wakeup->rfkill_release; - __entry->pattern_idx = wakeup->pattern_idx; - __entry->packet_len = wakeup->packet_len; -if (wakeup->packet && wakeup->packet_present_len) + __entry->non_wireless = !wakeup; + __entry->disconnect = wakeup ? wakeup->disconnect : false; + __entry->magic_pkt = wakeup ? wakeup->magic_pkt : false; + __entry->gtk_rekey_failure = wakeup ? wakeup->gtk_rekey_failure : false; + __entry->eap_identity_req = wakeup ? wakeup->eap_identity_req : false; + __entry->four_way_handshake = wakeup ? wakeup->four_way_handshake : false; + __entry->rfkill_release = wakeup ? wakeup->rfkill_release : false; + __entry->pattern_idx = wakeup ? wakeup->pattern_idx : false; + __entry->packet_len = wakeup ? wakeup->packet_len : false; +if (wakeup && wakeup->packet && wakeup->packet_present_len)memcpy (__get_dynamic_array (packet), wakeup->packet, wakeup->packet_present_len); ),
Greg Kroah-Hartman
maintainerPATCH 12/127 cfg80211: fix wiphy_register error path
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit 03cd7e4e1ea16cd151c799a33b5ca1fd41a464df upstream.
If rfkill_register() fails in wiphy_register() the struct device is unregistered but everything else isn't (regulatory, debugfs) and we even leave the wiphy instance on all internal lists even though it will likely be freed soon, which is clearly a problem. Fix this by cleaning up properly.
--- net/wireless/core.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
net/wireless/core.c +10 -6
@@ -638,17 +638,21 @@ int wiphy_register(struct wiphy *wiphy)* cfg80211_mutex lock */ res =rfkill_register (rdev->rfkill); -if (res) - goto out_rm_dev; +if (res) { +device_del (&rdev->wiphy.dev); + +mutex_lock (&cfg80211_mutex); +debugfs_remove_recursive (rdev->wiphy.debugfsdir); +list_del_rcu (&rdev->list); +wiphy_regulatory_deregister (wiphy); +mutex_unlock (&cfg80211_mutex); +return res; + }rtnl_lock (); rdev->wiphy.registered = true;rtnl_unlock ();return 0 ; - -out_rm_dev: -device_del (&rdev->wiphy.dev); -return res; }EXPORT_SYMBOL (wiphy_register);
Greg Kroah-Hartman
maintainerPATCH 13/127 cfg80211: fix sending WoWLAN TCP wakeup settings
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit e248ad30204eff6559b4d2d94d49d9d46c08185a upstream.
The code sending the current WoWLAN TCP wakeup settings in nl80211_send_wowlan_tcp() is not closing the nested attribute, thus causing the parser to get confused on the receiver side in userspace (iw). Fix this.
--- net/wireless/nl80211.c | 2 ++ 1 file changed, 2 insertions(+)
net/wireless/nl80211.c +2 -0
@@ -7177,6 +7177,8 @@ static int nl80211_send_wowlan_tcp(struc &tcp->payload_tok))return -ENOBUFS ; +nla_nest_end (msg, nl_tcp); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 14/127 mac80211: use just spin_lock() in ieee80211_get_tkip_p2k()
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit 655914ab863bcc06c84270e4159fd59002d6b529 upstream.
ieee80211_get_tkip_p2k() may be called with interrupts disabled, so spin_unlock_bh() isn't safe and leads to warnings. Since it's always called with BHs disabled already, just use spin_lock().
--- net/mac80211/tkip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mac80211/tkip.c +2 -2
@@ -208,10 +208,10 @@ void ieee80211_get_tkip_p2k(struct ieee8u32 iv32 =get_unaligned_le32 (&data[4 ]);u16 iv16 = data[2 ] | (data[0 ] <<8 ); -spin_lock_bh (&key->u.tkip.txlock); +spin_lock (&key->u.tkip.txlock);ieee80211_compute_tkip_p1k (key, iv32);tkip_mixing_phase2 (tk, ctx, iv16, p2k); -spin_unlock_bh (&key->u.tkip.txlock); +spin_unlock (&key->u.tkip.txlock); }EXPORT_SYMBOL (ieee80211_get_tkip_p2k);
Greg Kroah-Hartman
maintainerPATCH 15/127 mac80211: fix AP-mode frame matching
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit 2b9ccd4e4308272e5aec614b77c5385e7ec2ec90 upstream.
In AP mode, ignore frames with mis-matched BSSID that aren't multicast or sent to the correct destination. This fixes reporting public action frames to userspace multiple times on multiple virtual AP interfaces.
--- net/mac80211/rx.c | 3 +++ 1 file changed, 3 insertions(+)
net/mac80211/rx.c +3 -0
@@ -3032,6 +3032,9 @@ static int prepare_for_handlers(struct i* and location updates. Note that mac80211 * itself never looks at these frames. */ +if (!multicast && + !ether_addr_equal (sdata->vif.addr, hdr->addr1)) +return 0 ;if (ieee80211_is_public_action (hdr, skb->len))return 1 ;if (!ieee80211_is_beacon (hdr->frame_control))
Greg Kroah-Hartman
maintainerPATCH 16/127 iwlwifi: mvm: Always use SCAN_TYPE_FORCED
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilan Peer <[email protected]>
commit f70ed7b330ce769828d402f920fb13da6c13ea63 upstream.
The FW AUX framework does not handle well cases where time events fail to be scheduled (and as a result issues assert 0x3330). Until a proper fix is in place, WA this by always setting the scan type to SCAN_TYPE_FORCED.
--- drivers/net/wireless/iwlwifi/mvm/scan.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/wireless/iwlwifi/mvm/scan.c +6 -0
@@ -298,6 +298,12 @@ int iwl_mvm_scan_request(struct iwl_mvmelse cmd->type =cpu_to_le32 (SCAN_TYPE_FORCED ); +/* +* TODO: This is a WA due to a bug in the FW AUX framework that does not +* properly handle time events that fail to be scheduled +*/ + cmd->type =cpu_to_le32 (SCAN_TYPE_FORCED ); + cmd->repeats =cpu_to_le32 (1 );/*
Greg Kroah-Hartman
maintainerPATCH 17/127 iwlwifi: mvm: Prevent setting assoc flag in MAC_CONTEXT_CMD
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Bondar <[email protected]>
commit ba283927268d45184c17c37ff78d427e59026229 upstream.
In the normal flow first MAC_CONTEXT_CMD for particular interface is never sent while associated. The exception is fw restart flow when resuming from suspend when WoWLAN is enabled. In this case successive "add" and "modify" MAC_CONTEXT_CMD commands may be sent with assoc flag set what cause FW mal functioning. To prevent this never set assoc flag in MAC_CONTEXT_CMD with action "add".
--- drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c +8 -4
@@ -586,10 +586,12 @@ static int iwl_mvm_mac_ctxt_send_cmd(str*/ static void iwl_mvm_mac_ctxt_cmd_fill_sta (struct iwl_mvm *mvm,struct ieee80211_vif *vif, -struct iwl_mac_data_sta *ctxt_sta) +struct iwl_mac_data_sta *ctxt_sta, +bool force_assoc_off) {/* We need the dtim_period to set the MAC as associated */ -if (vif->bss_conf.assoc && vif->bss_conf.dtim_period) { +if (vif->bss_conf.assoc && vif->bss_conf.dtim_period && + !force_assoc_off) {u32 dtim_offs;/*
@@ -652,7 +654,8 @@ static int iwl_mvm_mac_ctxt_cmd_station(iwl_mvm_mac_ctxt_cmd_common (mvm, vif, &cmd, action);/* Fill the data specific for station mode */ -iwl_mvm_mac_ctxt_cmd_fill_sta (mvm, vif, &cmd.sta); +iwl_mvm_mac_ctxt_cmd_fill_sta (mvm, vif, &cmd.sta, + action ==FW_CTXT_ACTION_ADD );return iwl_mvm_mac_ctxt_send_cmd (mvm, &cmd); }
@@ -669,7 +672,8 @@ static int iwl_mvm_mac_ctxt_cmd_p2p_clieiwl_mvm_mac_ctxt_cmd_common (mvm, vif, &cmd, action);/* Fill the data specific for station mode */ -iwl_mvm_mac_ctxt_cmd_fill_sta (mvm, vif, &cmd.p2p_sta.sta); +iwl_mvm_mac_ctxt_cmd_fill_sta (mvm, vif, &cmd.p2p_sta.sta, + action ==FW_CTXT_ACTION_ADD ); cmd.p2p_sta.ctwin =cpu_to_le32 (vif->bss_conf.p2p_ctwindow);
Greg Kroah-Hartman
maintainerPATCH 18/127 staging: vt6656: [bug] Fix missing spin lock in iwctl_siwpower.
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <[email protected]>
commit 91ec61f8f01cf32868e2ed2fa96a299e77964055 upstream.
Fixes occasional dead lock on power up / down.
spin_lock_irq is used because of unlocking with spin_unlock_irq elsewhere in the driver.
Only relevant to kernels 3.8 and later when command was transferred to the iw_handler.
--- drivers/staging/vt6656/iwctl.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/staging/vt6656/iwctl.c +6 -0
@@ -1348,9 +1348,12 @@ int iwctl_siwpower(struct net_device *dereturn rc; } +spin_lock_irq (&pDevice->lock); +if (wrq->disabled) { pDevice->ePSMode =WMAC_POWER_CAM ;PSvDisablePowerSaving (pDevice); +spin_unlock_irq (&pDevice->lock);return rc; }if ((wrq->flags &IW_POWER_TYPE ) ==IW_POWER_TIMEOUT ) {
@@ -1361,6 +1364,9 @@ int iwctl_siwpower(struct net_device *de pDevice->ePSMode =WMAC_POWER_FAST ;PSvEnablePowerSaving ((void *)pDevice, pMgmt->wListenInterval); } + +spin_unlock_irq (&pDevice->lock); +switch (wrq->flags &IW_POWER_MODE ) {case IW_POWER_UNICAST_R :DBG_PRT (MSG_LEVEL_DEBUG ,KERN_INFO " SIOCSIWPOWER: IW_POWER_UNICAST_R \n" );
Greg Kroah-Hartman
maintainerPATCH 19/127 staging: vt6656: use free_netdev instead of kfree
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hema Prathaban <[email protected]>
commit 0a438d5b381e2bdfd5e02d653bf46fcc878356e3 upstream.
use free_netdev() instead of kfree(pDevice->apdev)
--- drivers/staging/vt6656/hostap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/vt6656/hostap.c +1 -1
@@ -133,7 +133,7 @@ static int hostap_disable_hostapd(structDBG_PRT (MSG_LEVEL_DEBUG ,KERN_INFO "%s: Netdevice %s unregistered\n" , pDevice->dev->name, pDevice->apdev->name); } -kfree (pDevice->apdev); +free_netdev (pDevice->apdev); pDevice->apdev =NULL ; pDevice->bEnable8021x = false; pDevice->bEnableHostWEP = false;
Greg Kroah-Hartman
maintainerPATCH 20/127 usb, chipidea: fix link error when USB_EHCI_HCD is a module
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rientjes <[email protected]>
commit 7c8bfed7aaeba690de30835fe89882e1047a55fd upstream.
Fixes link error when USB_EHCI_HCD=m and USB_CHIPIDEA_HOST=y:
drivers/built-in.o: In function `ci_hdrc_host_init':
drivers/usb/chipidea/host.c:104: undefined reference to `ehci_init_driver'
as a result of commit 09f6ffde2ece ("USB: EHCI: fix build error by making ChipIdea host a normal EHCI driver").
--- drivers/usb/chipidea/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/chipidea/Kconfig +1 -1
@@ -20,7 +20,7 @@ config USB_CHIPIDEA_UDC config USB_CHIPIDEA_HOST bool "ChipIdea host controller" depends on USB=y || USB=USB_CHIPIDEA - depends on USB_EHCI_HCD + depends on USB_EHCI_HCD=y select USB_EHCI_ROOT_HUB_TT help Say Y here to enable host controller functionality of the
Greg Kroah-Hartman
maintainerPATCH 21/127 usb: option: Add Telewell TW-LTE 4G
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Teppo Kotilainen <[email protected]>
commit 73c042df6e1bc50544842a04b777b36bbe3630e6 upstream.
Information from driver description files:
diag: VID_19D2&PID_0412&MI_00 nmea: VID_19D2&PID_0412&MI_01 at: VID_19D2&PID_0412&MI_02
modem: VID_19D2&PID_0412&MI_03
net: VID_19D2&PID_0412&MI_04
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -966,6 +966,8 @@ static const struct usb_device_id option .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0330, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0395, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0412, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G */ + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff),
Greg Kroah-Hartman
maintainerPATCH 22/127 USB: option: add device IDs for Dell 5804 (Novatel E371) WWAN card
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit 49c6e370dd6400b84897c4100095089b5c13a061 upstream.
A rebranded Novatel E371 for AT&T's LTE bands.
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -196,6 +196,7 @@ static void option_instat_callback(struc#define DELL_PRODUCT_5800_MINICARD_VZW 0x8195/* Novatel E362 */ #define DELL_PRODUCT_5800_V2_MINICARD_VZW 0x8196/* Novatel E362 */ +#define DELL_PRODUCT_5804_MINICARD_ATT 0x819b/* Novatel E371 */ #define KYOCERA_VENDOR_ID 0x0c88#define KYOCERA_PRODUCT_KPC650 0x17da
@@ -771,6 +772,7 @@ static const struct usb_device_id option { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_VZW) }, /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */ { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_MINICARD_VZW, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_V2_MINICARD_VZW, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5804_MINICARD_ATT, 0xff, 0xff, 0xff) }, { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100, ADU-310 */ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) }, { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
Greg Kroah-Hartman
maintainerPATCH 23/127 USB: ftdi_sio: Add support for Newport CONEX motor drivers
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Gomella, Andrew (NIH/NHLBI) [F]" <[email protected]>
commit 7138143972b7c293267c783fc99a194f0ceff7f2 upstream.
Here are two more devices that use FTDI USB-to-serial chips with new product ID's.
The devices are the Newport Conex-AGP and Conex-CC motor controllers.
(http://www.newport.com/CONEX-AGP-Integrated-Piezo-Motor-Rotation-Stages-/987623/1033/info.aspx)
(http://www.newport.com/CONEX-CC-DC-Servo-Controller-Actuators/934114/1033/info.aspx)
usb-devices command yields:
P: Vendor=104d ProdID=3002 Rev=06.00 S: Manufacturer=Newport S: Product=CONEX-CC
as well as
P: Vendor=104d ProdID=3006 Rev=06.00 S: Manufacturer=Newport S: Product=CONEX-AGP
--- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 2 ++ 2 files changed, 4 insertions(+)
drivers/usb/serial/ftdi_sio.c +2 -0
@@ -191,6 +191,8 @@ static struct usb_device_id id_table_com { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_PID) }, { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_BOOST_PID) }, { USB_DEVICE(NEWPORT_VID, NEWPORT_AGILIS_PID) }, + { USB_DEVICE(NEWPORT_VID, NEWPORT_CONEX_CC_PID) }, + { USB_DEVICE(NEWPORT_VID, NEWPORT_CONEX_AGP_PID) }, { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) }, { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) }, { USB_DEVICE(FTDI_VID, FTDI_SPROG_II) },
drivers/usb/serial/ftdi_sio_ids.h +2 -0
@@ -772,6 +772,8 @@*/ #define NEWPORT_VID 0x104D#define NEWPORT_AGILIS_PID 0x3000 +#define NEWPORT_CONEX_CC_PID 0x3002 +#define NEWPORT_CONEX_AGP_PID 0x3006/* Interbiometrics USB I/O Board */ /* Developed for Interbiometrics by Rudolf Gugler */
Greg Kroah-Hartman
maintainerPATCH 24/127 USB: cxacru: potential underflow in cxacru_cm_get_array()
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 2a0ebf80aa95cc758d4725f74a7016e992606a39 upstream.
The value of "offd" comes off the instance->rcv_buf[] and we used it as the offset into an array. The problem is that we check the upper bound but not for negative values.
--- drivers/usb/atm/cxacru.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/atm/cxacru.c +2 -1
@@ -686,7 +686,8 @@ static int cxacru_cm_get_array(struct cx {int ret, len;__le32 *buf; -int offb, offd; +int offb; +unsigned int offd;const int stride =CMD_PACKET_SIZE / (4 *2 ) -1 ;int buflen = ((size -1 ) / stride +1 + size *2 ) *4 ;
Greg Kroah-Hartman
maintainerPATCH 25/127 TTY: Fix tty miss restart after we turn off flow-control
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang YanQing <[email protected]>
commit dab73b4eb9ef924a2b90dab84e539076d82b256f upstream.
I meet emacs hang in start if I do the operation below:
1: echo 3 > /proc/sys/vm/drop_caches
2: emacs BigFile
3: Press CTRL-S follow 2 immediately
Then emacs hang on, CTRL-Q can't resume, the terminal hang on, you can do nothing with this terminal except close it.
The reason is before emacs takeover control the tty, we use CTRL-S to XOFF it. Then when emacs takeover the control, it may don't use the flow-control, so emacs hang. This patch fix it.
This patch will fix a kind of strange tty relation hang problem, I believe I meet it with vim in ssh, and also see below bug report:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=465823
--- drivers/tty/n_tty.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/tty/n_tty.c +8 -0
@@ -1588,6 +1588,14 @@ static void n_tty_set_termios(struct tty ldata->real_raw =0 ; }n_tty_set_room (tty); +/* +* Fix tty hang when I_IXON(tty) is cleared, but the tty +* been stopped by STOP_CHAR(tty) before it. +*/ +if (!I_IXON (tty) && old && (old->c_iflag &IXON ) && !tty->flow_stopped) { +start_tty (tty); + } +/* The termios change make the tty ready for I/O */ wake_up_interruptible (&tty->write_wait);wake_up_interruptible (&tty->read_wait);
Greg Kroah-Hartman
maintainerPATCH 26/127 USB: Blacklisted Cinterions PLxx WWAN Interface
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Schemmel Hans-Christoph <[email protected]>
commit 8ff10bdb14a52e3f25d4ce09e0582a8684c1a6db upstream.
/drivers/usb/serial/option.c: Blacklisted Cinterion's PLxx WWAN Interface (USB Interface 4), because it will be handled by QMI WWAN driver. Product IDs renamed.
--- drivers/usb/serial/option.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/usb/serial/option.c +5 -4
@@ -342,8 +342,8 @@ static void option_instat_callback(struc#define CINTERION_PRODUCT_EU3_E 0x0051#define CINTERION_PRODUCT_EU3_P 0x0052#define CINTERION_PRODUCT_PH8 0x0053 -#define CINTERION_PRODUCT_AH6 0x0055 -#define CINTERION_PRODUCT_PLS8 0x0060 +#define CINTERION_PRODUCT_AHXX 0x0055 +#define CINTERION_PRODUCT_PLXX 0x0060/* Olivetti products */ #define OLIVETTI_VENDOR_ID 0x0b3c
@@ -1268,8 +1268,9 @@ static const struct usb_device_id option { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) }, - { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AH6) }, - { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLS8) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
Greg Kroah-Hartman
maintainerPATCH 27/127 USB: reset resume quirk needed by a hub
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit bac6b03275184c912ad0818c9a0a736847804dca upstream.
Werner Fink has reported problems with this hub.
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -88,6 +88,9 @@ static const struct usb_device_id usb_qu/* Edirol SD-20 */ { USB_DEVICE(0x0582, 0x0027), .driver_info = USB_QUIRK_RESET_RESUME }, + /* Alcor Micro Corp. Hub */ + { USB_DEVICE(0x058f, 0x9254), .driver_info = USB_QUIRK_RESET_RESUME }, + /* appletouch */ { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
Greg Kroah-Hartman
maintainerPATCH 28/127 USB: xHCI: override bogus bulk wMaxPacketSize values
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit e4f47e3675e6f1f40906b785b934ce963e9f2eb3 upstream.
This patch shortens the logic in xhci_endpoint_init() by moving common calculations involving max_packet and max_burst outside the switch statement, rather than repeating the same code in multiple case-specific statements. It also replaces two usages of max_packet which were clearly intended to be max_burst all along.
More importantly, it compensates for a common bug in high-speed bulk endpoint descriptors. In many devices there is a bulk endpoint having a wMaxPacketSize value smaller than 512, which is forbidden by the USB spec. Some xHCI controllers can't handle this and refuse to accept the endpoint. This patch changes the max_packet value to 512, which allows the controller to use the endpoint properly.
In practice the bogus maxpacket size doesn't matter, because none of the transfers sent via these endpoints are longer than the maxpacket value anyway.
--- drivers/usb/host/xhci-mem.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/usb/host/xhci-mem.c +9 -8
@@ -1423,15 +1423,17 @@ int xhci_endpoint_init(struct xhci_hcd * ep_ctx->ep_info2 |=cpu_to_le32 (xhci_get_endpoint_type (udev, ep));/* Set the max packet size and max burst */ + max_packet =GET_MAX_PACKET (usb_endpoint_maxp (&ep->desc)); + max_burst =0 ;switch (udev->speed) {case USB_SPEED_SUPER : - max_packet =usb_endpoint_maxp (&ep->desc); - ep_ctx->ep_info2 |=cpu_to_le32 (MAX_PACKET (max_packet));/* dig out max burst from ep companion desc */ - max_packet = ep->ss_ep_comp.bMaxBurst; - ep_ctx->ep_info2 |=cpu_to_le32 (MAX_BURST (max_packet)); + max_burst = ep->ss_ep_comp.bMaxBurst;break ;case USB_SPEED_HIGH : +/* Some devices get this wrong */ +if (usb_endpoint_xfer_bulk (&ep->desc)) + max_packet =512 ;/* bits 11:12 specify the number of additional transaction * opportunities per microframe (USB 2.0, section 9.6.6) */
@@ -1439,17 +1441,16 @@ int xhci_endpoint_init(struct xhci_hcd * usb_endpoint_xfer_int(&ep->desc)) { max_burst = (usb_endpoint_maxp (&ep->desc) &0x1800 ) >>11 ; - ep_ctx->ep_info2 |=cpu_to_le32 (MAX_BURST (max_burst)); } -/* Fall through */ +break ;case USB_SPEED_FULL :case USB_SPEED_LOW : - max_packet =GET_MAX_PACKET (usb_endpoint_maxp (&ep->desc)); - ep_ctx->ep_info2 |=cpu_to_le32 (MAX_PACKET (max_packet));break ;default :BUG (); } + ep_ctx->ep_info2 |=cpu_to_le32 (MAX_PACKET (max_packet) | +MAX_BURST (max_burst)); max_esit_payload =xhci_get_max_esit_payload (xhci, udev, ep); ep_ctx->tx_info =cpu_to_le32 (MAX_ESIT_PAYLOAD_FOR_EP (max_esit_payload));
Greg Kroah-Hartman
maintainerPATCH 29/127 USB: UHCI: fix for suspend of virtual HP controller
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 997ff893603c6455da4c5e26ba1d0f81adfecdfc upstream.
HP's virtual UHCI host controller takes a long time to suspend (several hundred microseconds), even when no devices are attached. This provokes a warning message from uhci-hcd in the auto-stop case.
To prevent this from happening, this patch adds a test to avoid performing an auto-stop when the wait_for_hp quirk flag is set. The controller will still suspend through the normal runtime PM mechanism. And since that pathway includes a 1-ms delay, the slowness of the virtual hardware won't matter.
--- drivers/usb/host/uhci-hub.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/host/uhci-hub.c +2 -1
@@ -225,7 +225,8 @@ static int uhci_hub_status_data(struct u/* auto-stop if nothing connected for 1 second */ if (any_ports_active (uhci)) uhci->rh_state =UHCI_RH_RUNNING ; -else if (time_after_eq (jiffies, uhci->auto_stop_time)) +else if (time_after_eq (jiffies, uhci->auto_stop_time) && + !uhci->wait_for_hp)suspend_rh (uhci,UHCI_RH_AUTO_STOPPED );break ;
Greg Kroah-Hartman
maintainerPATCH 30/127 Input: egalax_ts - ABS_MT_POSITION_Y not reported well
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Abraham <[email protected]>
commit 3c9cfa782e075cc2348b949ba139911aac02c7cb upstream.
The egalax_ts touchscreen modul not report ABS_MT_POSITION_Y proper. As result it may be, that upper software levels only receive x coordinates well.
--- drivers/input/touchscreen/egalax_ts.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/touchscreen/egalax_ts.c +1 -1
@@ -216,7 +216,7 @@ static int egalax_ts_probe(struct i2c_clinput_set_abs_params (input_dev,ABS_MT_POSITION_X ,0 ,EGALAX_MAX_X ,0 ,0 );input_set_abs_params (input_dev, -ABS_MT_POSITION_X ,0 ,EGALAX_MAX_Y ,0 ,0 ); +ABS_MT_POSITION_Y ,0 ,EGALAX_MAX_Y ,0 ,0 );input_mt_init_slots (input_dev,MAX_SUPPORT_POINTS ,0 );input_set_drvdata (input_dev, ts);
Greg Kroah-Hartman
maintainerPATCH 31/127 Drivers: hv: Fix a bug in get_vp_index()
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "K. Y. Srinivasan" <[email protected]>
commit d2242a384355773c711a936522bcfae0f35f8c2a upstream.
Linux' notion of cpuid is different from the Host's notion of CPUID. In the call to bind the channel interrupts, we should use the host's notion of CPU Ids. Fix this bug.
--- drivers/hv/channel_mgmt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hv/channel_mgmt.c +1 -1
@@ -318,7 +318,7 @@ static u32 get_vp_index(uuid_le *type_gureturn 0 ; } cur_cpu = (++next_vp % max_cpus); -return cur_cpu; +return hv_context.vp_index[cur_cpu]; }/*
Greg Kroah-Hartman
maintainerPATCH 32/127 cifs: only set ops for inodes in I_NEW state
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
commit c2b93e0699723700f886ce17bb65ffd771195a6d upstream.
It's generally not safe to reset the inode ops once they've been set. In the case where the inode was originally thought to be a directory and then later found to be a DFS referral, this can lead to an oops when we try to trigger an inode op on it after changing the ops to the blank referral operations.
--- fs/cifs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/cifs/inode.c +2 -1
@@ -169,7 +169,8 @@ cifs_fattr_to_inode(struct inode *inode,if (fattr->cf_flags &CIFS_FATTR_DFS_REFERRAL ) inode->i_flags |=S_AUTOMOUNT ; -cifs_set_ops (inode); +if (inode->i_state &I_NEW ) +cifs_set_ops (inode); }void
Greg Kroah-Hartman
maintainerPATCH 33/127 ARC: copy_(to|from)_user() to honor usermode-access permissions
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineet Gupta <[email protected]>
commit a950549c675f2c8c504469dec7d780da8a6433dc upstream.
This manifested as grep failing psuedo-randomly:
-------------->8---------------------
[ARCLinux]$ ip address show lo | grep inet
[ARCLinux]$ ip address show lo | grep inet
[ARCLinux]$ ip address show lo | grep inet
[ARCLinux]$
[ARCLinux]$ ip address show lo | grep inet
inet 127.0.0.1/8 scope host lo-------------->8---------------------
ARC700 MMU provides fully orthogonal permission bits per page:
Ur, Uw, Ux, Kr, Kw, Kx
The user mode page permission templates used to have all Kernel mode access bits enabled.
This caused a tricky race condition observed with uClibc buffered file read and UNIX pipes.
1. Read access to an anon mapped page in libc .bss: write-protected zero_page mapped: TLB Entry installed with Ur + K[rwx]
2. grep calls libc:getc() -> buffered read layer calls read(2) with the internal read buffer in same .bss page.
The read() call is on STDIN which has been redirected to a pipe. read(2) => sys_read() => pipe_read() => copy_to_user()
3. Since page has Kernel-write permission (despite being user-mode write-protected), copy_to_user() suceeds w/o taking a MMU TLB-Miss Exception (page-fault for ARC). core-MM is unaware that kernel erroneously wrote to the reserved read-only zero-page (BUG #1)
4. Control returns to userspace which now does a write to same .bss page Since Linux MM is not aware that page has been modified by kernel, it simply reassigns a new writable zero-init page to mapping, loosing the prior write by kernel - effectively zero'ing out the libc read buffer under the hood - hence grep doesn't see right data (BUG #2)
The fix is to make all kernel-mode access permissions mirror the user-mode ones. Note that the kernel still has full access to pages, when accessed directly (w/o MMU) - this fix ensures that kernel-mode access in copy_to_from() path uses the same faulting access model as for pure user accesses to keep MM fully aware of page state.
The issue is peudo-random because it only shows up if the TLB entry installed in #1 is present at the time of #3. If it is evicted out, due to TLB pressure or some-such, then copy_to_user() does take a TLB Miss Exception, with a routine write-to-anon COW processing installing a fresh page for kernel writes and also usable as it is in userspace.
Further the issue was dormant for so long as it depends on where the libc internal read buffer (in .bss) is mapped at runtime. If it happens to reside in file-backed data mapping of libc (in the page-aligned slack space trailing the file backed data), loader zero padding the slack space, does the early cow page replacement, setting things up at the very beginning itself.
With gcc 4.8 based builds, the libc buffer got pushed out to a real anon mapping which triggers the issue.
--- arch/arc/include/asm/pgtable.h | 26 +++++++++++++++----------- arch/arc/include/asm/tlb.h | 2 +- arch/arc/mm/tlbex.S | 6 +++--- 3 files changed, 19 insertions(+), 15 deletions(-)
arch/arc/include/asm/pgtable.h +15 -11
@@ -57,9 +57,9 @@#define _PAGE_ACCESSED (1<<1)/* Page is accessed (S) */ #define _PAGE_CACHEABLE (1<<2)/* Page is cached (H) */ -#define _PAGE_EXECUTE (1<<3)/* Page has user execute perm (H) */ -#define _PAGE_WRITE (1<<4)/* Page has user write perm (H) */ -#define _PAGE_READ (1<<5)/* Page has user read perm (H) */ +#define _PAGE_U_EXECUTE (1<<3)/* Page has user execute perm (H) */ +#define _PAGE_U_WRITE (1<<4)/* Page has user write perm (H) */ +#define _PAGE_U_READ (1<<5)/* Page has user read perm (H) */ #define _PAGE_K_EXECUTE (1<<6)/* Page has kernel execute perm (H) */ #define _PAGE_K_WRITE (1<<7)/* Page has kernel write perm (H) */ #define _PAGE_K_READ (1<<8)/* Page has kernel perm (H) */
@@ -72,9 +72,9 @@/* PD1 */ #define _PAGE_CACHEABLE (1<<0)/* Page is cached (H) */ -#define _PAGE_EXECUTE (1<<1)/* Page has user execute perm (H) */ -#define _PAGE_WRITE (1<<2)/* Page has user write perm (H) */ -#define _PAGE_READ (1<<3)/* Page has user read perm (H) */ +#define _PAGE_U_EXECUTE (1<<1)/* Page has user execute perm (H) */ +#define _PAGE_U_WRITE (1<<2)/* Page has user write perm (H) */ +#define _PAGE_U_READ (1<<3)/* Page has user read perm (H) */ #define _PAGE_K_EXECUTE (1<<4)/* Page has kernel execute perm (H) */ #define _PAGE_K_WRITE (1<<5)/* Page has kernel write perm (H) */ #define _PAGE_K_READ (1<<6)/* Page has kernel perm (H) */
@@ -93,7 +93,8 @@#endif /* Kernel allowed all permissions for all pages */ -#define _K_PAGE_PERMS (_PAGE_K_EXECUTE | _PAGE_K_WRITE | _PAGE_K_READ) +#define _K_PAGE_PERMS (_PAGE_K_EXECUTE | _PAGE_K_WRITE | _PAGE_K_READ | \ + _PAGE_GLOBAL | _PAGE_PRESENT)#ifdef CONFIG_ARC_CACHE_PAGES #define _PAGE_DEF_CACHEABLE _PAGE_CACHEABLE
@@ -106,7 +107,11 @@* -by default cached, unless config otherwise * -present in memory */ -#define ___DEF (_PAGE_PRESENT | _K_PAGE_PERMS | _PAGE_DEF_CACHEABLE) +#define ___DEF (_PAGE_PRESENT | _PAGE_DEF_CACHEABLE) + +#define _PAGE_READ (_PAGE_U_READ | _PAGE_K_READ) +#define _PAGE_WRITE (_PAGE_U_WRITE | _PAGE_K_WRITE) +#define _PAGE_EXECUTE (_PAGE_U_EXECUTE | _PAGE_K_EXECUTE)/* Set of bits not changed in pte_modify */ #define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_MODIFIED)
@@ -125,11 +130,10 @@* kernel vaddr space - visible in all addr spaces, but kernel mode only * Thus Global, all-kernel-access, no-user-access, cached */ -#define PAGE_KERNEL __pgprot(___DEF | _PAGE_GLOBAL) +#define PAGE_KERNEL __pgprot(_K_PAGE_PERMS | _PAGE_DEF_CACHEABLE)/* ioremap */ -#define PAGE_KERNEL_NO_CACHE __pgprot(_PAGE_PRESENT | _K_PAGE_PERMS | \ - _PAGE_GLOBAL) +#define PAGE_KERNEL_NO_CACHE __pgprot(_K_PAGE_PERMS)/************************************************************************** * Mapping of vm_flags (Generic VM) to PTE flags (arch specific)
arch/arc/include/asm/tlb.h +1 -1
@@ -16,7 +16,7 @@/* Masks for actual TLB "PD"s */ #define PTE_BITS_IN_PD0 (_PAGE_GLOBAL | _PAGE_PRESENT)#define PTE_BITS_IN_PD1 (PAGE_MASK | _PAGE_CACHEABLE | \ - _PAGE_EXECUTE | _PAGE_WRITE | _PAGE_READ | \ + _PAGE_U_EXECUTE | _PAGE_U_WRITE | _PAGE_U_READ | \ _PAGE_K_EXECUTE | _PAGE_K_WRITE | _PAGE_K_READ)#ifndef __ASSEMBLY__
arch/arc/mm/tlbex.S +3 -3
@@ -277,7 +277,7 @@ ARC_ENTRY EV_TLBMissI ;---------------------------------------------------------------- ; VERIFY_PTE: Check if PTE permissions approp for executing code cmp_s r2, VMALLOC_START - mov.lo r2, (_PAGE_PRESENT | _PAGE_READ | _PAGE_EXECUTE) + mov.lo r2, (_PAGE_PRESENT | _PAGE_U_READ | _PAGE_U_EXECUTE) mov.hs r2, (_PAGE_PRESENT | _PAGE_K_READ | _PAGE_K_EXECUTE) and r3, r0, r2 ; Mask out NON Flag bits from PTE
@@ -320,9 +320,9 @@ ARC_ENTRY EV_TLBMissD mov_s r2, 0 lr r3, [ecr] btst_s r3, ECR_C_BIT_DTLB_LD_MISS ; Read Access - or.nz r2, r2, _PAGE_READ ; chk for Read flag in PTE + or.nz r2, r2, _PAGE_U_READ ; chk for Read flag in PTE btst_s r3, ECR_C_BIT_DTLB_ST_MISS ; Write Access - or.nz r2, r2, _PAGE_WRITE ; chk for Write flag in PTE + or.nz r2, r2, _PAGE_U_WRITE ; chk for Write flag in PTE ; Above laddering takes care of XCHG access ; which is both Read and Write
Greg Kroah-Hartman
maintainerPATCH 34/127 drivers/char/random.c: fix priming of last_data
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarod Wilson <[email protected]>
commit 1e7e2e05c179a68aaf8830fe91547a87f4589e53 upstream.
Commit ec8f02da9ea5 ("random: prime last_data value per fips requirements") added priming of last_data per fips requirements.
Unfortuantely, it did so in a way that can lead to multiple threads all incrementing nbytes, but only one actually doing anything with the extra data, which leads to some fun random corruption and panics.
The fix is to simply do everything needed to prime last_data in a single shot, so there's no window for multiple cpus to increment nbytes -- in fact, we won't even increment or decrement nbytes anymore, we'll just extract the needed EXTRACT_SIZE one time per pool and then carry on with the normal routine.
All these changes have been tested across multiple hosts and architectures where panics were previously encoutered. The code changes are are strictly limited to areas only touched when when booted in fips mode.
This change should also go into 3.8-stable, to make the myriads of fips users on 3.8.x happy.
--- drivers/char/random.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-)
drivers/char/random.c +15 -15
@@ -957,10 +957,23 @@ static ssize_t extract_entropy(struct en {ssize_t ret =0 , i;__u8 tmp[EXTRACT_SIZE ]; +unsigned long flags;/* if last_data isn't primed, we need EXTRACT_SIZE extra bytes */ -if (fips_enabled && !r->last_data_init) - nbytes +=EXTRACT_SIZE ; +if (fips_enabled) { +spin_lock_irqsave (&r->lock, flags); +if (!r->last_data_init) { + r->last_data_init = true; +spin_unlock_irqrestore (&r->lock, flags); +trace_extract_entropy (r->name,EXTRACT_SIZE , + r->entropy_count, _RET_IP_); +xfer_secondary_pool (r,EXTRACT_SIZE ); +extract_buf (r, tmp); +spin_lock_irqsave (&r->lock, flags); +memcpy (r->last_data, tmp,EXTRACT_SIZE ); + } +spin_unlock_irqrestore (&r->lock, flags); + }trace_extract_entropy (r->name, nbytes, r->entropy_count, _RET_IP_);xfer_secondary_pool (r, nbytes);
@@ -970,19 +983,6 @@ static ssize_t extract_entropy(struct enextract_buf (r, tmp);if (fips_enabled) { -unsigned long flags; - - -/* prime last_data value if need be, per fips 140-2 */ -if (!r->last_data_init) { -spin_lock_irqsave (&r->lock, flags); -memcpy (r->last_data, tmp,EXTRACT_SIZE ); - r->last_data_init = true; - nbytes -=EXTRACT_SIZE ; -spin_unlock_irqrestore (&r->lock, flags); -extract_buf (r, tmp); - } -spin_lock_irqsave (&r->lock, flags);if (!memcmp (tmp, r->last_data,EXTRACT_SIZE ))panic ("Hardware RNG duplicated output!\n" );
Greg Kroah-Hartman
maintainerPATCH 35/127 random: fix accounting race condition with lockless irq entropy_count update
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
commit 10b3a32d292c21ea5b3ad5ca5975e88bb20b8d68 upstream.
Commit 902c098a3663 ("random: use lockless techniques in the interrupt path") turned IRQ path from being spinlock protected into lockless cmpxchg-retry update.
That commit removed r->lock serialization between crediting entropy bits from IRQ context and accounting when extracting entropy on userspace read path, but didn't turn the r->entropy_count reads/updates in account() to use cmpxchg as well.
It has been observed, that under certain circumstances this leads to read() on /dev/urandom to return 0 (EOF), as r->entropy_count gets corrupted and becomes negative, which in turn results in propagating 0 all the way from account() to the actual read() call.
Convert the accounting code to be the proper lockless counterpart of what has been partially done by 902c098a3663.
--- drivers/char/random.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)
drivers/char/random.c +15 -7
@@ -865,16 +865,24 @@ static size_t account(struct entropy_stoif (r->entropy_count /8 < min + reserved) { nbytes =0 ; }else { +int entropy_count, orig; +retry: + entropy_count = orig =ACCESS_ONCE (r->entropy_count);/* If limited, never pull more than available */ -if (r->limit && nbytes + reserved >= r->entropy_count /8 ) - nbytes = r->entropy_count/8 - reserved; +if (r->limit && nbytes + reserved >= entropy_count /8 ) + nbytes = entropy_count/8 - reserved; -if (r->entropy_count /8 >= nbytes + reserved) - r->entropy_count -= nbytes*8 ; -else - r->entropy_count = reserved; +if (entropy_count /8 >= nbytes + reserved) { + entropy_count -= nbytes*8 ; +if (cmpxchg (&r->entropy_count, orig, entropy_count) != orig) + goto retry; + }else { + entropy_count = reserved; +if (cmpxchg (&r->entropy_count, orig, entropy_count) != orig) + goto retry; + } -if (r->entropy_count < random_write_wakeup_thresh) +if (entropy_count < random_write_wakeup_thresh) wakeup_write =1 ; }
Greg Kroah-Hartman
maintainerPATCH 36/127 fat: fix possible overflow for fat_clusters
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: OGAWA Hirofumi <[email protected]>
commit 7b92d03c3239f43e5b86c9cc9630f026d36ee995 upstream.
Intermediate value of fat_clusters can be overflowed on 32bits arch.
--- fs/fat/inode.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
fs/fat/inode.c +14 -1
@@ -1223,6 +1223,19 @@ static int fat_read_root(struct inode *ireturn 0 ; } +static unsigned long calc_fat_clusters (struct super_block *sb) +{ +struct msdos_sb_info *sbi =MSDOS_SB (sb); + +/* Divide first to avoid overflow */ +if (sbi->fat_bits !=12 ) { +unsigned long ent_per_sec = sb->s_blocksize *8 / sbi->fat_bits; +return ent_per_sec * sbi->fat_length; + } + +return sbi->fat_length * sb->s_blocksize *8 / sbi->fat_bits; +} +/* * Read the super block of an MS-DOS FS. */
@@ -1427,7 +1440,7 @@ int fat_fill_super(struct super_block *s sbi->dirty = b->fat16.state &FAT_STATE_DIRTY ;/* check that FAT table does not overflow */ - fat_clusters = sbi->fat_length * sb->s_blocksize *8 / sbi->fat_bits; + fat_clusters =calc_fat_clusters (sb); total_clusters =min (total_clusters, fat_clusters -FAT_START_ENT );if (total_clusters >MAX_FAT (sb)) {if (!silent)
Greg Kroah-Hartman
maintainerPATCH 37/127 tg3: Skip powering down function 0 on certain serdes devices
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nithin Sujir <[email protected]>
commit 44f3b503c16425c8e9db4bbaa2fc9cd0c9d0ba91 upstream.
On the 5718, 5719 and 5720 serdes devices, powering down function 0 results in all the other ports being powered down. Add code to skip function 0 power down.
v2:
- Modify tg3_phy_power_bug() function to use a switch instead of a complicated if statement. Suggested by Joe Perches.
--- drivers/net/ethernet/broadcom/tg3.c | 32 ++++++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 6 deletions(-)
drivers/net/ethernet/broadcom/tg3.c +26 -6
@@ -2921,6 +2921,31 @@ static int tg3_5700_link_polarity(structreturn 0 ; } +static bool tg3_phy_power_bug (struct tg3 *tp) +{ +switch (tg3_asic_rev (tp)) { +case ASIC_REV_5700 : +case ASIC_REV_5704 : +return true; +case ASIC_REV_5780 : +if (tp->phy_flags &TG3_PHYFLG_MII_SERDES ) +return true; +return false; +case ASIC_REV_5717 : +if (!tp->pci_fn) +return true; +return false; +case ASIC_REV_5719 : +case ASIC_REV_5720 : +if ((tp->phy_flags &TG3_PHYFLG_PHY_SERDES ) && + !tp->pci_fn) +return true; +return false; + } + +return false; +} +static void tg3_power_down_phy (struct tg3 *tp,bool do_low_power) {u32 val;
@@ -2977,12 +3002,7 @@ static void tg3_power_down_phy(struct tg/* The PHY should not be powered down on some chips because * of bugs. */ -if (tg3_asic_rev (tp) ==ASIC_REV_5700 || -tg3_asic_rev (tp) ==ASIC_REV_5704 || - (tg3_asic_rev (tp) ==ASIC_REV_5780 && - (tp->phy_flags &TG3_PHYFLG_MII_SERDES )) || - (tg3_asic_rev (tp) ==ASIC_REV_5717 && - !tp->pci_fn)) +if (tg3_phy_power_bug (tp))return ; if (tg3_chip_rev(tp) == CHIPREV_5784_AX ||
Greg Kroah-Hartman
maintainerPATCH 38/127 tg3: Fix data corruption on 5725 with TSO
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <[email protected]>
commit 0f0d15100a8ac875bdd408324c473e16d73d3557 upstream.
The 5725 family of devices (asic rev 5762), corrupts TSO packets where the buffer is within MSS bytes of a 4G boundary (4G, 8G etc.). Detect this condition and trigger the workaround path.
--- drivers/net/ethernet/broadcom/tg3.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/net/ethernet/broadcom/tg3.c +17 -0
@@ -7078,6 +7078,20 @@ static inline int tg3_4g_overflow_test(dreturn (base >0xffffdcc0 ) && (base + len +8 < base); } +/* Test for TSO DMA buffers that cross into regions which are within MSS bytes +* of any 4GB boundaries: 4G, 8G, etc +*/ +static inline int tg3_4g_tso_overflow_test (struct tg3 *tp,dma_addr_t mapping, +u32 len,u32 mss) +{ +if (tg3_asic_rev (tp) ==ASIC_REV_5762 && mss) { +u32 base = (u32 ) mapping &0xffffffff ; + +return ((base + len + (mss &0x3fff )) < base); + } +return 0 ; +} +/* Test for DMA addresses > 40-bit */ static inline int tg3_40bit_overflow_test (struct tg3 *tp,dma_addr_t mapping,int len)
@@ -7114,6 +7128,9 @@ static bool tg3_tx_frag_set(struct tg3_nif (tg3_4g_overflow_test (map, len)) hwbug = true; +if (tg3_4g_tso_overflow_test (tp, map, len, mss)) + hwbug = true; +if (tg3_40bit_overflow_test (tp, map, len)) hwbug = true;
Greg Kroah-Hartman
maintainerPATCH 39/127 perf: net_dropmonitor: Fix trace parameter order
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
commit 140c3c6a2bcd2c31e2f7f5a8d59689724776c8e5 upstream.
This works much better if we don't treat protocol numbers as addresses.
--- tools/perf/scripts/python/net_dropmonitor.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/scripts/python/net_dropmonitor.py +1 -1
@@ -64,7 +64,7 @@ def trace_end(): # called from perf, when it finds a correspoinding event def skb__kfree_skb(name, context, cpu, sec, nsec, pid, comm, - skbaddr, protocol, location): + skbaddr, location, protocol): slocation = str(location) try: drop_log[slocation] = drop_log[slocation] + 1
Greg Kroah-Hartman
maintainerPATCH 40/127 perf: net_dropmonitor: Fix symbol-relative addresses
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
commit 5a1e99dd2028e00998d42029be86835d8ef4a46e upstream.
The comparison between traced and symbol addresses is backwards: if the traced address doesn't exactly match a symbol (which we don't expect it to), we'll show the next symbol and the offset to it, whereas we should show the previous symbol and the offset from it.
--- tools/perf/scripts/python/net_dropmonitor.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/perf/scripts/python/net_dropmonitor.py +3 -3
@@ -40,9 +40,9 @@ def get_kallsyms_table(): def get_sym(sloc): loc = int(sloc) - for i in kallsyms: - if (i['loc'] >= loc): - return (i['name'], i['loc']-loc) + for i in kallsyms[::-1]: + if loc >= i['loc']: + return (i['name'], loc - i['loc']) return (None, 0) def print_drop_table():
Greg Kroah-Hartman
maintainerPATCH 41/127 ath9k: Fix crash on module unload
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sujith Manoharan <[email protected]>
commit af690092ce91a2a6d807cdfcc0b0b9b71ae54d3e upstream.
Make sure that any open relayfs files are closed before unregistering with mac80211, otherwise this crash is seen:
[ 1331.097846] BUG: unable to handle kernel paging request at 6b6b6b8b [ 1331.098170] IP: [<c063d0d6>] debugfs_remove+0x26/0x80 [ 1331.098170] *pdpt = 000000002f9aa001 *pde = 0000000000000000 [ 1331.098170] Oops: 0000 [#1] PREEMPT SMP [ 1331.098170] Modules linked in: iptable_raw xt_CT nf_conntrack_ipv4 nf_defrag] [ 1331.098170] Pid: 4794, comm: rmmod Tainted: G WC 3.9.1+ #5 To Be Fi. [ 1331.098170] EIP: 0060:[<c063d0d6>] EFLAGS: 00010202 CPU: 0 [ 1331.098170] EIP is at debugfs_remove+0x26/0x80 [ 1331.098170] EAX: f2f3acd0 EBX: f2f3acd0 ECX: 00000006 EDX: f8622348 [ 1331.098170] ESI: 6b6b6b6b EDI: 00000001 EBP: ee251e14 ESP: ee251e0c [ 1331.098170] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [ 1331.098170] CR0: 8005003b CR2: 6b6b6b8b CR3: 2e7b7000 CR4: 000007e0 [ 1331.098170] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 [ 1331.098170] DR6: ffff0ff0 DR7: 00000400 [ 1331.098170] Process rmmod (pid: 4794, ti=ee250000 task=efaa2560 task.ti=ee25) [ 1331.098170] Stack: [ 1331.098170] f241e170 0000000a ee251e1c f861394d ee251e28 c04e3088 f241e170 4 [ 1331.098170] c04e30fe f45482b0 ee251e54 c04e3187 f25e86b0 ee251e54 f8618748 0 [ 1331.098170] 0000000a 00000001 ee251e68 f860065b f2509e20 f25085a0 f5b6e8a4 8 [ 1331.098170] Call Trace: [ 1331.098170] [<f861394d>] remove_buf_file_handler+0xd/0x20 [ath9k] [ 1331.098170] [<c04e3088>] relay_remove_buf+0x18/0x30 [ 1331.098170] [<c04e30fe>] relay_close_buf+0x2e/0x40 [ 1331.098170] [<c04e3187>] relay_close+0x77/0xf0 [ 1331.098170] [<f8618748>] ? dpd_exit+0x38/0x40 [ath9k] [ 1331.098170] [<f860065b>] ath9k_deinit_softc+0x8b/0xa0 [ath9k] [ 1331.098170] [<f86006b8>] ath9k_deinit_device+0x48/0x60 [ath9k] [ 1331.098170] [<f86107f1>] ath_pci_remove+0x31/0x50 [ath9k] [ 1331.098170] [<c06dbff8>] pci_device_remove+0x38/0xc0 [ 1331.098170] [<c079daa4>] __device_release_driver+0x64/0xc0 [ 1331.098170] [<c079db97>] driver_detach+0x97/0xa0 [ 1331.098170] [<c079cacc>] bus_remove_driver+0x6c/0xe0 [ 1331.098170] [<c079c197>] ? bus_put+0x17/0x20 [ 1331.098170] [<c079cae3>] ? bus_remove_driver+0x83/0xe0 [ 1331.098170] [<c079e709>] driver_unregister+0x49/0x80 [ 1331.098170] [<c06dc138>] pci_unregister_driver+0x18/0x80 [ 1331.098170] [<f8610602>] ath_pci_exit+0x12/0x20 [ath9k] [ 1331.098170] [<f8619ce0>] ath9k_exit+0x17/0x337 [ath9k] [ 1331.098170] [<c09e537d>] ? mutex_unlock+0xd/0x10 [ 1331.098170] [<c04bd36c>] sys_delete_module+0x17c/0x250 [ 1331.098170] [<c0540dc4>] ? do_munmap+0x244/0x2d0 [ 1331.098170] [<c0540e96>] ? vm_munmap+0x46/0x60 [ 1331.098170] [<c09e8dc4>] ? restore_all+0xf/0xf [ 1331.098170] [<c09ebf50>] ? __do_page_fault+0x4c0/0x4c0 [ 1331.098170] [<c04b18e4>] ? trace_hardirqs_on_caller+0xf4/0x180 [ 1331.098170] [<c09ef28d>] sysenter_do_call+0x12/0x38 [ 1331.098170] Code: 90 8d 74 26 00 55 89 e5 83 ec 08 89 1c 24 89 74 24 04 3e 82 [ 1331.098170] EIP: [<c063d0d6>] debugfs_remove+0x26/0x80 SS:ESP 0068:ee251e0c [ 1331.098170] CR2: 000000006b6b6b8b [ 1331.727971] ---[ end trace b5bb9f2066cef7f9 ]---
--- drivers/net/wireless/ath/ath9k/debug.c | 8 ++++++++ drivers/net/wireless/ath/ath9k/debug.h | 5 +++++ drivers/net/wireless/ath/ath9k/init.c | 10 ++++------ 3 files changed, 17 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath9k/debug.c +8 -0
@@ -2003,6 +2003,14 @@ void ath9k_get_et_stats(struct ieee80211WARN_ON (i !=ATH9K_SSTATS_LEN ); } +void ath9k_deinit_debug (struct ath_softc *sc) +{ +if (config_enabled (CONFIG_ATH9K_DEBUGFS ) && sc->rfs_chan_spec_scan) { +relay_close (sc->rfs_chan_spec_scan); + sc->rfs_chan_spec_scan =NULL ; + } +} +int ath9k_init_debug (struct ath_hw *ah) {struct ath_common *common =ath9k_hw_common (ah);
drivers/net/wireless/ath/ath9k/debug.h +5 -0
@@ -302,6 +302,7 @@ struct ath9k_debug { };int ath9k_init_debug (struct ath_hw *ah); +void ath9k_deinit_debug (struct ath_softc *sc);void ath_debug_stat_interrupt (struct ath_softc *sc,enum ath9k_int status); void ath_debug_stat_tx(struct ath_softc *sc, struct ath_buf *bf,
@@ -337,6 +338,10 @@ static inline int ath9k_init_debug(strucreturn 0 ; } +static inline void ath9k_deinit_debug (struct ath_softc *sc) +{ +} +static inline void ath_debug_stat_interrupt (struct ath_softc *sc,enum ath9k_int status) {
drivers/net/wireless/ath/ath9k/init.c +4 -6
@@ -885,7 +885,7 @@ int ath9k_init_device(u16 devid, structif (!ath_is_world_regd (reg)) { error =regulatory_hint (hw->wiphy, reg->alpha2);if (error) - goto unregister; + goto debug_cleanup; }ath_init_leds (sc);
@@ -893,6 +893,8 @@ int ath9k_init_device(u16 devid, structreturn 0 ; +debug_cleanup: +ath9k_deinit_debug (sc); unregister:ieee80211_unregister_hw (hw); rx_cleanup:
@@ -921,11 +923,6 @@ static void ath9k_deinit_softc(struct at sc->dfs_detector->exit (sc->dfs_detector);ath9k_eeprom_release (sc); - -if (config_enabled (CONFIG_ATH9K_DEBUGFS ) && sc->rfs_chan_spec_scan) { -relay_close (sc->rfs_chan_spec_scan); - sc->rfs_chan_spec_scan =NULL ; - } }void ath9k_deinit_device (struct ath_softc *sc)
@@ -939,6 +936,7 @@ void ath9k_deinit_device(struct ath_softath9k_ps_restore (sc); +ath9k_deinit_debug (sc);ieee80211_unregister_hw (hw);ath_rx_cleanup (sc);ath9k_deinit_softc (sc);
Greg Kroah-Hartman
maintainerPATCH 42/127 ath9k_hw: Enable manual peak calibration for AR9485
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sujith Manoharan <[email protected]>
commit e99c60b58b595eaa1c279922ae29d5397c787294 upstream.
Manual peak calibration is currently enabled only for AR9462 and AR9565. This is also required for AR9485. The initvals are also modified to disable HW peak calibration.
--- drivers/net/wireless/ath/ath9k/ar9003_calib.c | 2 +- drivers/net/wireless/ath/ath9k/ar9485_initvals.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/ar9003_calib.c +1 -1
@@ -965,7 +965,7 @@ static void ar9003_hw_do_manual_peak_cal {int i; -if (!AR_SREV_9462 (ah) && !AR_SREV_9565 (ah)) +if (!AR_SREV_9462 (ah) && !AR_SREV_9565 (ah) && !AR_SREV_9485 (ah))return ;for (i =0 ; i <AR9300_MAX_CHAINS ; i++) {
drivers/net/wireless/ath/ath9k/ar9485_initvals.h +1 -1
@@ -1020,7 +1020,7 @@ static const u32 ar9485_1_1_baseband_pos {0x0000a284, 0x00000000, 0x00000000, 0x000002a0, 0x000002a0}, {0x0000a288, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, {0x0000a28c, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, - {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18}, + {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00058d18, 0x00058d18}, {0x0000a2d0, 0x00071981, 0x00071981, 0x00071982, 0x00071982}, {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0xf999a83a, 0xf999a83a}, {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
Greg Kroah-Hartman
maintainerPATCH 43/127 ocfs2: goto out_unlock if ocfs2_get_clusters_nocache() failed in ocfs2_fiemap()
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <[email protected]>
commit b4ca2b4b577c3530e34dcfaafccb2cc680ce95d1 upstream.
Last time we found there is lock/unlock bug in ocfs2_file_aio_write, and then we did a thorough search for all lock resources in ocfs2_inode_info, including rw, inode and open lockres and found this bug. My kernel version is 3.0.13, and it is also in the lastest version 3.9. In ocfs2_fiemap, once ocfs2_get_clusters_nocache failed, it should goto out_unlock instead of out, because we need release buffer head, up read alloc sem and unlock inode.
--- fs/ocfs2/extent_map.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ocfs2/extent_map.c +1 -1
@@ -790,7 +790,7 @@ int ocfs2_fiemap(struct inode *inode, st &hole_size, &rec, &is_last);if (ret) {mlog_errno (ret); - goto out; + goto out_unlock; }if (rec.e_blkno ==0ULL ) {
Greg Kroah-Hartman
maintainerPATCH 44/127 Kirkwood: Enable PCIe port 1 on QNAP TS-11x/TS-21x
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Michlmayr <[email protected]>
commit 99e11334dcb846f9b76fb808196c7f47aa83abb3 upstream.
Enable KW_PCIE1 on QNAP TS-11x/TS-21x devices as newer revisions (rev 1.3) have a USB 3.0 chip from Etron on PCIe port 1. Thanks to Marek Vasut for identifying this issue!
--- arch/arm/mach-kirkwood/ts219-setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-kirkwood/ts219-setup.c +1 -1
@@ -124,7 +124,7 @@ static void __init qnap_ts219_init(void)static int __init ts219_pci_init (void ) {if (machine_is_ts219 ()) -kirkwood_pcie_init (KW_PCIE0 ); +kirkwood_pcie_init (KW_PCIE1 |KW_PCIE0 );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 45/127 drivers/leds/leds-ot200.c: fix error caused by shifted mask
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Gmeiner <[email protected]>
commit 4b949b8af12e24b8a48fa5bb775a13b558d9f4da upstream.
During the development of this driver an in-house register documentation was used. The last week some integration tests were done and this problem was found. It turned out that the released register documentation is wrong.
The fix is very simple: shift all masks by one.
--- drivers/leds/leds-ot200.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/leds/leds-ot200.c +7 -7
@@ -47,37 +47,37 @@ static struct ot200_led leds[] = { { .name = "led_1", .port = 0x49, - .mask = BIT(7), + .mask = BIT(6), }, { .name = "led_2", .port = 0x49, - .mask = BIT(6), + .mask = BIT(5), }, { .name = "led_3", .port = 0x49, - .mask = BIT(5), + .mask = BIT(4), }, { .name = "led_4", .port = 0x49, - .mask = BIT(4), + .mask = BIT(3), }, { .name = "led_5", .port = 0x49, - .mask = BIT(3), + .mask = BIT(2), }, { .name = "led_6", .port = 0x49, - .mask = BIT(2), + .mask = BIT(1), }, { .name = "led_7", .port = 0x49, - .mask = BIT(1), + .mask = BIT(0), } };
Greg Kroah-Hartman
maintainerPATCH 46/127 rapidio/tsi721: fix bug in MSI interrupt handling
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Bounine <[email protected]>
commit 1ccc819da6fda9bee10ab8b72e9adbb5ad3e4959 upstream.
Fix bug in MSI interrupt handling which causes loss of event notifications.
Typical indication of lost MSI interrupts are stalled message and doorbell transfers between RapidIO endpoints. To avoid loss of MSI interrupts all interrupts from the device must be disabled on entering the interrupt handler routine and re-enabled when exiting it. Re-enabling device interrupts will trigger new MSI message(s) if Tsi721 registered new events since entering interrupt handler routine.
This patch is applicable to kernel versions starting from v3.2.
--- drivers/rapidio/devices/tsi721.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/rapidio/devices/tsi721.c +12 -0
@@ -471,6 +471,10 @@ static irqreturn_t tsi721_irqhandler(intu32 intval;u32 ch_inte; +/* For MSI mode disable all device-level interrupts */ +if (priv->flags &TSI721_USING_MSI ) +iowrite32 (0 , priv->regs +TSI721_DEV_INTE ); + dev_int =ioread32 (priv->regs +TSI721_DEV_INT );if (!dev_int)return IRQ_NONE ;
@@ -560,6 +564,14 @@ static irqreturn_t tsi721_irqhandler(int } }#endif + +/* For MSI mode re-enable device-level interrupts */ +if (priv->flags &TSI721_USING_MSI ) { + dev_int =TSI721_DEV_INT_SR2PC_CH |TSI721_DEV_INT_SRIO | +TSI721_DEV_INT_SMSG_CH |TSI721_DEV_INT_BDMA_CH ; +iowrite32 (dev_int, priv->regs +TSI721_DEV_INTE ); + } +return IRQ_HANDLED ; }
Greg Kroah-Hartman
maintainerPATCH 47/127 mm compaction: fix of improper cache flush in migration code
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leonid Yegoshin <[email protected]>
commit c2cc499c5bcf9040a738f49e8051b42078205748 upstream.
Page 'new' during MIGRATION can't be flushed with flush_cache_page(). Using flush_cache_page(vma, addr, pfn) is justified only if the page is already placed in process page table, and that is done right after flush_cache_page(). But without it the arch function has no knowledge of process PTE and does nothing.
Besides that, flush_cache_page() flushes an application cache page, but the kernel has a different page virtual address and dirtied it.
Replace it with flush_dcache_page(new) which is the proper usage.
The old page is flushed in try_to_unmap_one() before migration.
This bug takes place in Sead3 board with M14Kc MIPS CPU without cache aliasing (but Harvard arch - separate I and D cache) in tight memory environment (128MB) each 1-3days on SOAK test. It fails in cc1 during kernel build (SIGILL, SIGBUS, SIGSEG) if CONFIG_COMPACTION is switched ON.
--- mm/migrate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/migrate.c +1 -1
@@ -165,7 +165,7 @@ static int remove_migration_pte(struct p pte = arch_make_huge_pte(pte, vma, new, 0); }#endif -flush_cache_page (vma, addr,pte_pfn (pte)); +flush_dcache_page (new);set_pte_at (mm, addr, ptep, pte);if (PageHuge (new)) {
Greg Kroah-Hartman
maintainerPATCH 48/127 klist: del waiter from klist_remove_waiters before wakeup waitting process
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "wang, biao" <[email protected]>
commit ac5a2962b02f57dea76d314ef2521a2170b28ab6 upstream.
There is a race between klist_remove and klist_release. klist_remove uses a local var waiter saved on stack. When klist_release calls wake_up_process(waiter->process) to wake up the waiter, waiter might run immediately and reuse the stack. Then, klist_release calls list_del(&waiter->list) to change previous
wait data and cause prior waiter thread corrupt.
The patch fixes it against kernel 3.9.
--- lib/klist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/klist.c +1 -1
@@ -193,10 +193,10 @@ static void klist_release(struct kref *kif (waiter->node != n)continue ; +list_del (&waiter->list); waiter->woken =1 ;mb ();wake_up_process (waiter->process); -list_del (&waiter->list); }spin_unlock (&klist_remove_lock);knode_set_klist (n,NULL );
Greg Kroah-Hartman
maintainerPATCH 49/127 wait: fix false timeouts when using wait_event_timeout()
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Deak <[email protected]>
commit 4c663cfc523a88d97a8309b04a089c27dc57fd7e upstream.
Many callers of the wait_event_timeout() and wait_event_interruptible_timeout() expect that the return value will be positive if the specified condition becomes true before the timeout elapses. However, at the moment this isn't guaranteed. If the wake-up handler is delayed enough, the time remaining until timeout will be calculated as 0 - and passed back as a return value - even if the condition became true before the timeout has passed.
Fix this by returning at least 1 if the condition becomes true. This semantic is in line with what wait_for_condition_timeout() does; see commit bb10ed09 ("sched: fix wait_for_completion_timeout() spurious failure under heavy load").
Daniel said "We have 3 instances of this bug in drm/i915. One case even where we switch between the interruptible and not interruptible wait_event_timeout variants, foolishly presuming they have the same semantics. I very much like this."
One such bug is reported at
https://bugs.freedesktop.org/show_bug.cgi?id=64133
--- include/linux/wait.h | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
include/linux/wait.h +11 -5
@@ -217,6 +217,8 @@ do { \if (!ret) \break ; \ } \ +if (!ret && (condition)) \ + ret =1 ; \finish_wait (&wq, &__wait); \ }while (0 )
@@ -233,8 +235,9 @@ do { \* wake_up() has to be called after changing any variable that could * change the result of the wait condition. * -* The function returns 0 if the @timeout elapsed, and the remaining -* jiffies if the condition evaluated to true before the timeout elapsed. +* The function returns 0 if the @timeout elapsed, or the remaining +* jiffies (at least 1) if the @condition evaluated to %true before +* the @timeout elapsed. */ #define wait_event_timeout (wq, condition, timeout) \ ({ \
@@ -302,6 +305,8 @@ do { \ ret = -ERESTARTSYS ; \break ; \ } \ +if (!ret && (condition)) \ + ret =1 ; \finish_wait (&wq, &__wait); \ }while (0 )
@@ -318,9 +323,10 @@ do { \* wake_up() has to be called after changing any variable that could * change the result of the wait condition. * -* The function returns 0 if the @timeout elapsed, -ERESTARTSYS if it -* was interrupted by a signal, and the remaining jiffies otherwise -* if the condition evaluated to true before the timeout elapsed. +* Returns: +* 0 if the @timeout elapsed, -%ERESTARTSYS if it was interrupted by +* a signal, or the remaining jiffies (at least 1) if the @condition +* evaluated to %true before the @timeout elapsed. */ #define wait_event_interruptible_timeout (wq, condition, timeout) \ ({ \
Greg Kroah-Hartman
maintainerPATCH 50/127 nilfs2: fix issue of nilfs_set_page_dirty() for page at EOF boundary
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 136e8770cd5d1fe38b3c613100dd6dc4db6d4fa6 upstream.
nilfs2: fix issue of nilfs_set_page_dirty for page at EOF boundary
DESCRIPTION:
There are use-cases when NILFS2 file system (formatted with block size
lesser than 4 KB) can be remounted in RO mode because of encountering of "broken bmap" issue.
The issue was reported by Anthony Doggett <[email protected]>:
"The machine I've been trialling nilfs on is running Debian Testing,
Linux version 3.2.0-4-686-pae ([email protected]) (gcc version 4.6.3 (Debian 4.6.3-14) ) #1 SMP Debian 3.2.35-2), but I've also reproduced it (identically) with Debian Unstable amd64 and Debian Experimental (using the 3.8-trunk kernel). The problematic partitions were formatted with "mkfs.nilfs2 -b 1024 -B 8192"."
SYMPTOMS:
(1) System log contains error messages likewise:
[63102.496756] nilfs_direct_assign: invalid pointer: 0
[63102.496786] NILFS error (device dm-17): nilfs_bmap_assign: broken bmap (inode number=28)
[63102.496798]
[63102.524403] Remounting filesystem read-only(2) The NILFS2 file system is remounted in RO mode.
REPRODUSING PATH:
(1) Create volume group with name "unencrypted" by means of vgcreate utility.
(2) Run script (prepared by Anthony Doggett <[email protected]>):
----------------[BEGIN SCRIPT]--------------------
VG=unencrypted
lvcreate --size 2G --name ntest $VG
mkfs.nilfs2 -b 1024 -B 8192 /dev/mapper/$VG-ntest
mkdir /var/tmp/n
mkdir /var/tmp/n/ntest
mount /dev/mapper/$VG-ntest /var/tmp/n/ntest
mkdir /var/tmp/n/ntest/thedir
cd /var/tmp/n/ntest/thedir
sleep 2
date
darcs init
sleep 2
dmesg|tail -n 5
date
darcs whatsnew || true
date
sleep 2
dmesg|tail -n 5
----------------[END SCRIPT]--------------------
REPRODUCIBILITY: 100%
INVESTIGATION:
As it was discovered, the issue takes place during segment construction after executing such sequence of user-space operations:
open("_darcs/index", O_RDWR|O_CREAT|O_NOCTTY, 0666) = 7 fstat(7, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0 ftruncate(7, 60)
The error message "NILFS error (device dm-17): nilfs_bmap_assign: broken bmap (inode number=28)" takes place because of trying to get block number for third block of the file with logical offset #3072 bytes. As it is possible to see from above output, the file has 60 bytes of the whole size. So, it is enough one block (1 KB in size) allocation for the whole file. Trying to operate with several blocks instead of one takes place because of discovering several dirty buffers for this file in nilfs_segctor_scan_file() method.
The root cause of this issue is in nilfs_set_page_dirty function which is called just before writing to an mmapped page.
When nilfs_page_mkwrite function handles a page at EOF boundary, it fills hole blocks only inside EOF through __block_page_mkwrite().
The __block_page_mkwrite() function calls set_page_dirty() after filling hole blocks, thus nilfs_set_page_dirty function (= a_ops->set_page_dirty) is called. However, the current implementation of nilfs_set_page_dirty() wrongly marks all buffers dirty even for page at EOF boundary.
As a result, buffers outside EOF are inconsistently marked dirty and queued for write even though they are not mapped with nilfs_get_block function.
FIX:
This modifies nilfs_set_page_dirty() not to mark hole blocks dirty.
Thanks to Vyacheslav Dubeyko for his effort on analysis and proposals for this issue.
--- fs/nilfs2/inode.c | 27 +++++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-)
fs/nilfs2/inode.c +23 -4
@@ -202,13 +202,32 @@ static int nilfs_writepage(struct page *static int nilfs_set_page_dirty (struct page *page) { -int ret =__set_page_dirty_buffers (page); +int ret =__set_page_dirty_nobuffers (page); -if (ret) { +if (page_has_buffers (page)) {struct inode *inode = page->mapping->host; -unsigned nr_dirty =1 << (PAGE_SHIFT - inode->i_blkbits); +unsigned nr_dirty =0 ; +struct buffer_head *bh, *head; -nilfs_set_file_dirty (inode, nr_dirty); +/* +* This page is locked by callers, and no other thread +* concurrently marks its buffers dirty since they are +* only dirtied through routines in fs/buffer.c in +* which call sites of mark_buffer_dirty are protected +* by page lock. +*/ + bh = head =page_buffers (page); +do { +/* Do not mark hole blocks dirty */ +if (buffer_dirty (bh) || !buffer_mapped (bh)) +continue ; + +set_buffer_dirty (bh); + nr_dirty++; + }while (bh = bh->b_this_page, bh != head); + +if (nr_dirty) +nilfs_set_file_dirty (inode, nr_dirty); }return ret; }
Greg Kroah-Hartman
maintainerPATCH 51/127 mm: mmu_notifier: re-fix freed page still mapped in secondary MMU
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Guangrong <[email protected]>
commit d34883d4e35c0a994e91dd847a82b4c9e0c31d83 upstream.
Commit 751efd8610d3 ("mmu_notifier_unregister NULL Pointer deref and multiple ->release()") breaks the fix 3ad3d901bbcf ("mm: mmu_notifier:
fix freed page still mapped in secondary MMU").
Since hlist_for_each_entry_rcu() is changed now, we can not revert that patch directly, so this patch reverts the commit and simply fix the bug spotted by that patch
This bug spotted by commit 751efd8610d3 is:
There is a race condition between mmu_notifier_unregister() and __mmu_notifier_release().
Assume two tasks, one calling mmu_notifier_unregister() as a result of a filp_close() ->flush() callout (task A), and the other calling mmu_notifier_release() from an mmput() (task B).
A B
t1 srcu_read_lock()
t2 if (!hlist_unhashed())
t3 srcu_read_unlock()
t4 srcu_read_lock()
t5 hlist_del_init_rcu()
t6 synchronize_srcu()
t7 srcu_read_unlock()
t8 hlist_del_rcu() <--- NULL pointer deref.
This can be fixed by using hlist_del_init_rcu instead of hlist_del_rcu.
The another issue spotted in the commit is "multiple ->release() callouts", we needn't care it too much because it is really rare (e.g, can not happen on kvm since mmu-notify is unregistered after exit_mmap()) and the later call of multiple ->release should be fast since all the pages have already been released by the first call. Anyway, this issue should be fixed in a separate patch.
-stable suggestions: Any version that has commit 751efd8610d3 need to be backported. I find the oldest version has this commit is 3.0-stable.
--- mm/mmu_notifier.c | 79 ++++++++++++++++++++++++++---------------------------- 1 file changed, 39 insertions(+), 40 deletions(-)
mm/mmu_notifier.c +39 -40
@@ -40,48 +40,44 @@ void __mmu_notifier_release(struct mm_stint id;/* -* srcu_read_lock() here will block synchronize_srcu() in -* mmu_notifier_unregister() until all registered -* ->release() callouts this function makes have -* returned. +* SRCU here will block mmu_notifier_unregister until +* ->release returns. */ id =srcu_read_lock (&srcu); +hlist_for_each_entry_rcu (mn, &mm->mmu_notifier_mm->list, hlist) +/* +* If ->release runs before mmu_notifier_unregister it must be +* handled, as it's the only way for the driver to flush all +* existing sptes and stop the driver from establishing any more +* sptes before all the pages in the mm are freed. +*/ +if (mn->ops->release) + mn->ops->release (mn, mm); +srcu_read_unlock (&srcu, id); +spin_lock (&mm->mmu_notifier_mm->lock);while (unlikely (!hlist_empty (&mm->mmu_notifier_mm->list))) { mn =hlist_entry (mm->mmu_notifier_mm->list.first, struct mmu_notifier, hlist); -/* -* Unlink. This will prevent mmu_notifier_unregister() -* from also making the ->release() callout. +* We arrived before mmu_notifier_unregister so +* mmu_notifier_unregister will do nothing other than to wait +* for ->release to finish and for mmu_notifier_unregister to +* return. */ hlist_del_init_rcu (&mn->hlist); -spin_unlock (&mm->mmu_notifier_mm->lock); - -/* -* Clear sptes. (see 'release' description in mmu_notifier.h) -*/ -if (mn->ops->release) - mn->ops->release (mn, mm); - -spin_lock (&mm->mmu_notifier_mm->lock); }spin_unlock (&mm->mmu_notifier_mm->lock);/* -* All callouts to ->release() which we have done are complete. -* Allow synchronize_srcu() in mmu_notifier_unregister() to complete -*/ -srcu_read_unlock (&srcu, id); - -/* -* mmu_notifier_unregister() may have unlinked a notifier and may -* still be calling out to it. Additionally, other notifiers -* may have been active via vmtruncate() et. al. Block here -* to ensure that all notifier callouts for this mm have been -* completed and the sptes are really cleaned up before returning -* to exit_mmap(). +* synchronize_srcu here prevents mmu_notifier_release from returning to +* exit_mmap (which would proceed with freeing all pages in the mm) +* until the ->release method returns, if it was invoked by +* mmu_notifier_unregister. +* +* The mmu_notifier_mm can't go away from under us because one mm_count +* is held by exit_mmap. */ synchronize_srcu (&srcu); }
@@ -292,31 +288,34 @@ void mmu_notifier_unregister(struct mmu_ {BUG_ON (atomic_read (&mm->mm_count) <=0 ); -spin_lock (&mm->mmu_notifier_mm->lock);if (!hlist_unhashed (&mn->hlist)) { +/* +* SRCU here will force exit_mmap to wait for ->release to +* finish before freeing the pages. +*/ int id; + id =srcu_read_lock (&srcu);/* -* Ensure we synchronize up with __mmu_notifier_release(). +* exit_mmap will block in mmu_notifier_release to guarantee +* that ->release is called before freeing the pages. */ - id =srcu_read_lock (&srcu); - -hlist_del_rcu (&mn->hlist); -spin_unlock (&mm->mmu_notifier_mm->lock); -if (mn->ops->release) mn->ops->release (mn, mm); +srcu_read_unlock (&srcu, id); +spin_lock (&mm->mmu_notifier_mm->lock);/* -* Allow __mmu_notifier_release() to complete. +* Can not use list_del_rcu() since __mmu_notifier_release +* can delete it before we hold the lock. */ -srcu_read_unlock (&srcu, id); - }else +hlist_del_init_rcu (&mn->hlist);spin_unlock (&mm->mmu_notifier_mm->lock); + }/* -* Wait for any running method to finish, including ->release() if it -* was run by __mmu_notifier_release() instead of us. +* Wait for any running method to finish, of course including +* ->release if it was run by mmu_notifier_relase instead of us. */ synchronize_srcu (&srcu);
Greg Kroah-Hartman
maintainerPATCH 52/127 mm: memcg: remove incorrect VM_BUG_ON for swap cache pages in uncharge
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Weiner <[email protected]>
commit 28ccddf7952c496df2a51ce5aee4f2a058a98bab upstream.
Commit 0c59b89c81ea ("mm: memcg: push down PageSwapCache check into uncharge entry functions") added a VM_BUG_ON() on PageSwapCache in the uncharge path after checking that page flag once, assuming that the state is stable in all paths, but this is not the case and the condition triggers in user environments. An uncharge after the last page table reference to the page goes away can race with reclaim adding the page to swap cache.
Swap cache pages are usually uncharged when they are freed after swapout, from a path that also handles swap usage accounting and memcg lifetime management. However, since the last page table reference is gone and thus no references to the swap slot left, the swap slot will be freed shortly when reclaim attempts to write the page to disk. The whole swap accounting is not even necessary.
So while the race condition for which this VM_BUG_ON was added is real and actually existed all along, there are no negative effects. Remove the VM_BUG_ON again.
--- mm/memcontrol.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
mm/memcontrol.c +12 -2
@@ -3991,8 +3991,6 @@ __mem_cgroup_uncharge_common(struct pageif (mem_cgroup_disabled ())return NULL ; -VM_BUG_ON (PageSwapCache (page)); -if (PageTransHuge (page)) { nr_pages <<=compound_order (page);VM_BUG_ON (!PageTransHuge (page));
@@ -4088,6 +4086,18 @@ void mem_cgroup_uncharge_page(struct pagif (page_mapped (page))return ;VM_BUG_ON (page->mapping && !PageAnon (page)); +/* +* If the page is in swap cache, uncharge should be deferred +* to the swap path, which also properly accounts swap usage +* and handles memcg lifetime. +* +* Note that this check is not stable and reclaim may add the +* page to swap cache at any time after this. However, if the +* page is not in swap cache by the time page->mapcount hits +* 0, there won't be any page table references to the swap +* slot, and reclaim will free it and not actually write the +* page to disk. +*/ if (PageSwapCache (page))return ;__mem_cgroup_uncharge_common (page,MEM_CGROUP_CHARGE_TYPE_ANON , false);
Greg Kroah-Hartman
maintainerPATCH 53/127 drivers/block/brd.c: fix brd_lookup_page() race
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Behlendorf <[email protected]>
commit dfd20b2b174d3a9b258ea3b7a35ead33576587b1 upstream.
The index on the page must be set before it is inserted in the radix tree. Otherwise there is a small race which can occur during lookup where the page can be found with the incorrect index. This will trigger the BUG_ON() in brd_lookup_page().
--- drivers/block/brd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/block/brd.c +2 -2
@@ -117,13 +117,13 @@ static struct page *brd_insert_page(struspin_lock (&brd->brd_lock); idx = sector >>PAGE_SECTORS_SHIFT ; + page->index = idx;if (radix_tree_insert (&brd->brd_pages, idx, page)) {__free_page (page); page =radix_tree_lookup (&brd->brd_pages, idx);BUG_ON (!page);BUG_ON (page->index != idx); - }else - page->index = idx; + }spin_unlock (&brd->brd_lock);radix_tree_preload_end ();
Greg Kroah-Hartman
maintainerPATCH 54/127 mm/pagewalk.c: walk_page_range should avoid VM_PFNMAP areas
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cliff Wickman <[email protected]>
commit a9ff785e4437c83d2179161e012f5bdfbd6381f0 upstream.
A panic can be caused by simply cat'ing /proc/<pid>/smaps while an application has a VM_PFNMAP range. It happened in-house when a benchmarker was trying to decipher the memory layout of his program.
/proc/<pid>/smaps and similar walks through a user page table should not be looking at VM_PFNMAP areas.
Certain tests in walk_page_range() (specifically split_huge_page_pmd()) assume that all the mapped PFN's are backed with page structures. And this is not usually true for VM_PFNMAP areas. This can result in panics on kernel page faults when attempting to address those page structures.
There are a half dozen callers of walk_page_range() that walk through a task's entire page table (as N. Horiguchi pointed out). So rather than change all of them, this patch changes just walk_page_range() to ignore VM_PFNMAP areas.
The logic of hugetlb_vma() is moved back into walk_page_range(), as we want to test any vma in the range.
VM_PFNMAP areas are used by:
- graphics memory manager gpu/drm/drm_gem.c - global reference unit sgi-gru/grufile.c - sgi special memory char/mspec.c
- and probably several out-of-tree modules
--- mm/pagewalk.c | 70 +++++++++++++++++++++++++++++----------------------------- 1 file changed, 36 insertions(+), 34 deletions(-)
mm/pagewalk.c +36 -34
@@ -127,28 +127,7 @@ static int walk_hugetlb_range(struct vm_ return 0; } -static struct vm_area_struct *hugetlb_vma (unsigned long addr,struct mm_walk *walk) -{ -struct vm_area_struct *vma; - -/* We don't need vma lookup at all. */ -if (!walk->hugetlb_entry) -return NULL ; - -VM_BUG_ON (!rwsem_is_locked (&walk->mm->mmap_sem)); - vma =find_vma (walk->mm, addr); -if (vma && vma->vm_start <= addr &&is_vm_hugetlb_page (vma)) -return vma; - -return NULL ; -} -#else /* CONFIG_HUGETLB_PAGE */ -static struct vm_area_struct *hugetlb_vma (unsigned long addr,struct mm_walk *walk) -{ -return NULL ; -} -static int walk_hugetlb_range (struct vm_area_struct *vma,unsigned long addr,unsigned long end,struct mm_walk *walk)
@@ -198,30 +177,53 @@ int walk_page_range(unsigned long addr,if (!walk->mm)return -EINVAL ; +VM_BUG_ON (!rwsem_is_locked (&walk->mm->mmap_sem)); + pgd =pgd_offset (walk->mm, addr); do { - struct vm_area_struct *vma; + struct vm_area_struct *vma = NULL; next = pgd_addr_end(addr, end); /* - * handle hugetlb vma individually because pagetable walk for - * the hugetlb page is dependent on the architecture and - * we can't handled it in the same manner as non-huge pages. + * This function was not intended to be vma based. + * But there are vma special cases to be handled: + * - hugetlb vma's + * - VM_PFNMAP vma's */ - vma = hugetlb_vma(addr, walk); + vma = find_vma(walk->mm, addr); if (vma) { - if (vma->vm_end < next) + /* + * There are no page structures backing a VM_PFNMAP + * range, so do not allow split_huge_page_pmd(). + */ + if ((vma->vm_start <= addr) && + (vma->vm_flags & VM_PFNMAP)) { next = vma->vm_end; + pgd = pgd_offset(walk->mm, next); + continue; + } /* - * Hugepage is very tightly coupled with vma, so - * walk through hugetlb entries within a given vma. + * Handle hugetlb vma individually because pagetable + * walk for the hugetlb page is dependent on the + * architecture and we can't handled it in the same + * manner as non-huge pages. */ - err = walk_hugetlb_range(vma, addr, next, walk); - if (err) - break; - pgd = pgd_offset(walk->mm, next); - continue; + if (walk->hugetlb_entry && (vma->vm_start <= addr) && + is_vm_hugetlb_page(vma)) { + if (vma->vm_end < next) + next = vma->vm_end; + /* + * Hugepage is very tightly coupled with vma, + * so walk through hugetlb entries within a + * given vma. + */ + err = walk_hugetlb_range(vma, addr, next, walk); + if (err) + break; + pgd = pgd_offset(walk->mm, next); + continue; + } } if (pgd_none_or_clear_bad(pgd)) {
Greg Kroah-Hartman
maintainerPATCH 55/127 mm/THP: use pmd_populate() to update the pmd with pgtable_t pointer
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Aneesh Kumar K.V" <[email protected]>
commit 7c3425123ddfdc5f48e7913ff59d908789712b18 upstream.
We should not use set_pmd_at to update pmd_t with pgtable_t pointer. set_pmd_at is used to set pmd with huge pte entries and architectures like ppc64, clear few flags from the pte when saving a new entry. Without this change we observe bad pte errors like below on ppc64 with THP enabled.
BUG: Bad page map in process ld mm=0xc000001ee39f4780 pte:7fc3f37848000001 pmd:c000001ec0000000
--- mm/huge_memory.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
mm/huge_memory.c +6 -1
@@ -2318,7 +2318,12 @@ static void collapse_huge_page(struct mmpte_unmap (pte);spin_lock (&mm->page_table_lock);BUG_ON (!pmd_none (*pmd)); -set_pmd_at (mm, address, pmd, _pmd); +/* +* We can only use set_pmd_at when establishing +* hugepmds and never for establishing regular pmds that +* points to regular pagetables. Use pmd_populate for that +*/ +pmd_populate (mm, pmd,pmd_pgtable (_pmd));spin_unlock (&mm->page_table_lock);anon_vma_unlock_write (vma->anon_vma); goto out;
Greg Kroah-Hartman
maintainerPATCH 56/127 SCSI: ipr: Need to reset adapter after the 6th EEH error
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "[email protected]" <[email protected]>
commit 96b04db9f2c16e77c31ef0e17e143da1e0cbfd78 upstream.
Add reset adapter after the 6th EEH errors in ipr driver. This triggers the adapter reset via the PCI config space even when the slot is frozen.
--- drivers/scsi/ipr.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/scsi/ipr.c +10 -2
@@ -4777,7 +4777,7 @@ static int ipr_eh_host_reset(struct scsi ioa_cfg = (struct ipr_ioa_cfg *) cmd->device->host->hostdata;spin_lock_irqsave (ioa_cfg->host->host_lock, lock_flags); -if (!ioa_cfg->in_reset_reload) { +if (!ioa_cfg->in_reset_reload && !ioa_cfg->hrrq[IPR_INIT_HRRQ ].ioa_is_dead) {ipr_initiate_ioa_reset (ioa_cfg,IPR_SHUTDOWN_ABBREV );dev_err (&ioa_cfg->pdev->dev,"Adapter being reset as a result of error recovery.\n" );
@@ -6739,6 +6739,7 @@ static int ipr_invalid_adapter(struct ipstatic int ipr_ioa_bringdown_done (struct ipr_cmnd *ipr_cmd) {struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg; +int i;ENTER ;if (!ioa_cfg->hrrq[IPR_INIT_HRRQ ].removing_ioa) {
@@ -6750,6 +6751,13 @@ static int ipr_ioa_bringdown_done(struct ioa_cfg->in_reset_reload =0 ; ioa_cfg->reset_retries =0 ; +for (i =0 ; i < ioa_cfg->hrrq_num; i++) { +spin_lock (&ioa_cfg->hrrq[i]._lock); + ioa_cfg->hrrq[i].ioa_is_dead =1 ; +spin_unlock (&ioa_cfg->hrrq[i]._lock); + } +wmb (); +list_add_tail (&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);wake_up_all (&ioa_cfg->reset_wait_q);LEAVE ;
@@ -8651,7 +8659,7 @@ static void ipr_pci_perm_failure(structspin_lock_irqsave (ioa_cfg->host->host_lock, flags);if (ioa_cfg->sdt_state ==WAIT_FOR_DUMP ) ioa_cfg->sdt_state =ABORT_DUMP ; - ioa_cfg->reset_retries =IPR_NUM_RESET_RELOAD_RETRIES ; + ioa_cfg->reset_retries =IPR_NUM_RESET_RELOAD_RETRIES -1 ; ioa_cfg->in_ioa_bringdown =1 ;for (i =0 ; i < ioa_cfg->hrrq_num; i++) {spin_lock (&ioa_cfg->hrrq[i]._lock);
Greg Kroah-Hartman
maintainerPATCH 57/127 x86: Allow FPU to be used at interrupt time even with eagerfpu
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pekka Riikonen <[email protected]>
commit 5187b28ff08249ab8a162e802209ed04e271ca02 upstream.
With the addition of eagerfpu the irq_fpu_usable() now returns false negatives especially in the case of ksoftirqd and interrupted idle task, two common cases for FPU use for example in networking/crypto. With eagerfpu=off FPU use is possible in those contexts. This is because of the eagerfpu check in interrupted_kernel_fpu_idle():
...
* For now, with eagerfpu we will return interrupted kernel FPU
* state as not-idle. TBD: Ideally we can change the return value
* to something like __thread_has_fpu(current). But we need to
* be careful of doing __thread_clear_has_fpu() before saving
* the FPU etc for supporting nested uses etc. For now, take
* the simple route!
...
if (use_eager_fpu())
return 0;
As eagerfpu is automatically "on" on those CPUs that also have the features like AES-NI this patch changes the eagerfpu check to return 1 in case the kernel_fpu_begin() has not been said yet. Once it has been the __thread_has_fpu() will start returning 0.
Notice that with eagerfpu the __thread_has_fpu is always true initially. FPU use is thus always possible no matter what task is under us, unless the state has already been saved with kernel_fpu_begin().
[ hpa: this is a performance regression, not a correctness regression,
but since it can be quite serious on CPUs which need encryption at interrupt time I am marking this for urgent/stable. ]
--- arch/x86/kernel/i387.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
arch/x86/kernel/i387.c +5 -9
@@ -22,23 +22,19 @@/* * Were we in an interrupt that interrupted kernel mode? * -* For now, with eagerfpu we will return interrupted kernel FPU -* state as not-idle. TBD: Ideally we can change the return value -* to something like __thread_has_fpu(current). But we need to -* be careful of doing __thread_clear_has_fpu() before saving -* the FPU etc for supporting nested uses etc. For now, take -* the simple route! -* * On others, we can do a kernel_fpu_begin/end() pair *ONLY* if that * pair does nothing at all: the thread must not have fpu (so * that we don't try to save the FPU state), and TS must * be set (so that the clts/stts pair does nothing that is * visible in the interrupted kernel thread). +* +* Except for the eagerfpu case when we return 1 unless we've already +* been eager and saved the state in kernel_fpu_begin(). */ static inline bool interrupted_kernel_fpu_idle (void ) {if (use_eager_fpu ()) -return 0 ; +return __thread_has_fpu (current);return !__thread_has_fpu (current) && (read_cr0 () &X86_CR0_TS );
@@ -78,8 +74,8 @@ void __kernel_fpu_begin(void)struct task_struct *me = current;if (__thread_has_fpu (me)) { -__save_init_fpu (me);__thread_clear_has_fpu (me); +__save_init_fpu (me);/* We do 'stts()' in __kernel_fpu_end() */ }else if (!use_eager_fpu ()) {this_cpu_write (fpu_owner_task,NULL );
Greg Kroah-Hartman
maintainerPATCH 58/127 x86-64, init: Fix a possible wraparound bug in switchover in head_64.S
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yanfei <[email protected]>
commit e9d0626ed43a41a3fc526d1df06122b0d4eac174 upstream.
In head_64.S, a switchover has been used to handle kernel crossing 1G, 512G boundaries.
And commit 8170e6bed465b4b0c7687f93e9948aca4358a33b
x86, 64bit: Use a #PF handler to materialize early mappings on demand
said:
During the switchover in head_64.S, before #PF handler is available, we use three pages to handle kernel crossing 1G, 512G boundaries with sharing page by playing games with page aliasing: the same page is mapped twice in the higher-level tables with appropriate wraparound.
But from the switchover code, when we set up the PUD table:
114 addq $4096, %rdx 115 movq %rdi, %rax 116 shrq $PUD_SHIFT, %rax 117 andl $(PTRS_PER_PUD-1), %eax 118 movq %rdx, (4096+0)(%rbx,%rax,8) 119 movq %rdx, (4096+8)(%rbx,%rax,8)
It seems line 119 has a potential bug there. For example, if the kernel is loaded at physical address 511G+1008M, that is
000000000 111111111 111111000 000000000000000000000
and the kernel _end is 512G+2M, that is
000000001 000000000 000000001 000000000000000000000So in this example, when using the 2nd page to setup PUD (line 114~119), rax is 511.
In line 118, we put rdx which is the address of the PMD page (the 3rd page) into entry 511 of the PUD table. But in line 119, the entry we calculate from (4096+8)(%rbx,%rax,8) has exceeded the PUD page. IMO, the entry in line 119 should be wraparound into entry 0 of the PUD table.
The patch fixes the bug.
--- arch/x86/kernel/head_64.S | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/x86/kernel/head_64.S +4 -2
@@ -115,8 +115,10 @@ startup_64: movq %rdi, %rax shrq $PUD_SHIFT, %rax andl $(PTRS_PER_PUD-1), %eax - movq %rdx, (4096+0)(%rbx,%rax,8) - movq %rdx, (4096+8)(%rbx,%rax,8) + movq %rdx, 4096(%rbx,%rax,8) + incl %eax + andl $(PTRS_PER_PUD-1), %eax + movq %rdx, 4096(%rbx,%rax,8) addq $8192, %rbx movq %rdi, %rax
Greg Kroah-Hartman
maintainerPATCH 59/127 x86, range: fix missing merge during add range
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yinghai Lu <[email protected]>
commit fbe06b7bae7c9cf6ab05168fce5ee93b2f4bae7c upstream.
Christian found v3.9 does not work with E350 with EFI is enabled.
[ 1.658832] Trying to unpack rootfs image as initramfs... [ 1.679935] BUG: unable to handle kernel paging request at ffff88006e3fd000 [ 1.686940] IP: [<ffffffff813661df>] memset+0x1f/0xb0 [ 1.692010] PGD 1f77067 PUD 1f7a067 PMD 61420067 PTE 0
but early memtest report all memory could be accessed without problem.
early page table is set in following sequence:
[ 0.000000] init_memory_mapping: [mem 0x00000000-0x000fffff] [ 0.000000] init_memory_mapping: [mem 0x6e600000-0x6e7fffff] [ 0.000000] init_memory_mapping: [mem 0x6c000000-0x6e5fffff] [ 0.000000] init_memory_mapping: [mem 0x00100000-0x6bffffff] [ 0.000000] init_memory_mapping: [mem 0x6e800000-0x6ea07fff] but later efi_enter_virtual_mode try set mapping again wrongly. [ 0.010644] pid_max: default: 32768 minimum: 301 [ 0.015302] init_memory_mapping: [mem 0x640c5000-0x6e3fcfff]
that means it fails with pfn_range_is_mapped.
It turns out that we have a bug in add_range_with_merge and it does not merge range properly when new add one fill the hole between two exsiting ranges. In the case when [mem 0x00100000-0x6bffffff] is the hole between [mem 0x00000000-0x000fffff] and [mem 0x6c000000-0x6e7fffff].
Fix the add_range_with_merge by calling itself recursively.
--- kernel/range.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
kernel/range.c +5 -3
@@ -48,9 +48,11 @@ int add_range_with_merge(struct range *r final_start =min (range[i].start, start); final_end =max (range[i].end, end); - range[i].start = final_start; - range[i].end = final_end; -return nr_range; +/* clear it and add it back for further merge */ + range[i].start =0 ; + range[i].end =0 ; +return add_range_with_merge (range, az, nr_range, + final_start, final_end); }/* Need to add it: */
Greg Kroah-Hartman
maintainerPATCH 60/127 x86, crc32-pclmul: Fix build with older binutils
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <[email protected]>
commit 2baad6121e2b2fa3428ee6cb2298107be11ab23a upstream.
binutils prior to 2.18 (e.g. the ones found on SLE10) don't support assembling PEXTRD, so a macro based approach like the one for PCLMULQDQ in the same file should be used.
This requires making the helper macros capable of recognizing 32-bit general purpose register operands.
[ hpa: tagging for stable as it is a low risk build fix ]
--- arch/x86/crypto/crc32-pclmul_asm.S | 2 - arch/x86/include/asm/inst.h | 74 ++++++++++++++++++++++++++++++++++++- 2 files changed, 73 insertions(+), 3 deletions(-)
arch/x86/crypto/crc32-pclmul_asm.S +1 -1
@@ -241,6 +241,6 @@ fold_64: pand %xmm3, %xmm1 PCLMULQDQ 0x00, CONSTANT, %xmm1 pxor %xmm2, %xmm1 - pextrd $0x01, %xmm1, %eax + PEXTRD 0x01, %xmm1, %eax ret
arch/x86/include/asm/inst.h +72 -2
106 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 61/127 module: dont unlink the module until weve removed all exposure.
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rusty Russell <[email protected]>
commit 944a1fa01266aa9ace607f29551b73c41e9440e9 upstream.
Otherwise we get a race between unload and reload of the same module:
the new module doesn't see the old one in the list, but then fails because it can't register over the still-extant entries in sysfs:
[ 103.981925] ------------[ cut here ]------------ [ 103.986902] WARNING: at fs/sysfs/dir.c:536 sysfs_add_one+0xab/0xd0() [ 103.993606] Hardware name: CrownBay Platform [ 103.998075] sysfs: cannot create duplicate filename '/module/pch_gbe' [ 104.004784] Modules linked in: pch_gbe(+) [last unloaded: pch_gbe] [ 104.011362] Pid: 3021, comm: modprobe Tainted: G W 3.9.0-rc5+ #5 [ 104.018662] Call Trace: [ 104.021286] [<c103599d>] warn_slowpath_common+0x6d/0xa0 [ 104.026933] [<c1168c8b>] ? sysfs_add_one+0xab/0xd0 [ 104.031986] [<c1168c8b>] ? sysfs_add_one+0xab/0xd0 [ 104.037000] [<c1035a4e>] warn_slowpath_fmt+0x2e/0x30 [ 104.042188] [<c1168c8b>] sysfs_add_one+0xab/0xd0 [ 104.046982] [<c1168dbe>] create_dir+0x5e/0xa0 [ 104.051633] [<c1168e78>] sysfs_create_dir+0x78/0xd0 [ 104.056774] [<c1262bc3>] kobject_add_internal+0x83/0x1f0 [ 104.062351] [<c126daf6>] ? kvasprintf+0x46/0x60 [ 104.067231] [<c1262ebd>] kobject_add_varg+0x2d/0x50 [ 104.072450] [<c1262f07>] kobject_init_and_add+0x27/0x30 [ 104.078075] [<c1089240>] mod_sysfs_setup+0x80/0x540 [ 104.083207] [<c1260851>] ? module_bug_finalize+0x51/0xc0 [ 104.088720] [<c108ab29>] load_module+0x1429/0x18b0
We can teardown sysfs first, then to be sure, put the state in MODULE_STATE_UNFORMED so it's ignored while we deconstruct it.
--- kernel/module.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
kernel/module.c +9 -4
@@ -1861,12 +1861,12 @@ static void free_module(struct module *m {trace_module_free (mod); -/* Delete from various lists */ -mutex_lock (&module_mutex); -stop_machine (__unlink_module, mod,NULL ); -mutex_unlock (&module_mutex);mod_sysfs_teardown (mod); +/* We leave it in list to prevent duplicate loads, but make sure +* that noone uses it while it's being deconstructed. */ + mod->state =MODULE_STATE_UNFORMED ; +/* Remove dynamic debug info */ ddebug_remove_module (mod->name);
@@ -1879,6 +1879,11 @@ static void free_module(struct module *m/* Free any allocated parameters. */ destroy_params (mod->kp, mod->num_kp); +/* Now we can delete it from the lists */ +mutex_lock (&module_mutex); +stop_machine (__unlink_module, mod,NULL ); +mutex_unlock (&module_mutex); +/* This may be NULL, but that's OK */ unset_module_init_ro_nx (mod);module_free (mod, mod->module_init);
Greg Kroah-Hartman
maintainerPATCH 62/127 xfs: kill suid/sgid through the truncate path.
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Chinner <[email protected]>
commit 2962f5a5dcc56f69cbf62121a7be67cc15d6940b upstream.
XFS has failed to kill suid/sgid bits correctly when truncating files of non-zero size since commit c4ed4243 ("xfs: split xfs_setattr") introduced in the 3.1 kernel. Fix it.
Fix it.
--- fs/xfs/xfs_iops.c | 47 ++++++++++++++++++++++++++++++++--------------- 1 file changed, 32 insertions(+), 15 deletions(-)
fs/xfs/xfs_iops.c +32 -15
@@ -455,6 +455,28 @@ xfs_vn_getattr(return 0 ; } +static void +xfs_setattr_mode ( +struct xfs_trans *tp, +struct xfs_inode *ip, +struct iattr *iattr) +{ +struct inode *inode =VFS_I (ip); +umode_t mode = iattr->ia_mode; + +ASSERT (tp); +ASSERT (xfs_isilocked (ip,XFS_ILOCK_EXCL )); + +if (!in_group_p (inode->i_gid) && !capable (CAP_FSETID )) + mode &= ~S_ISGID ; + + ip->i_d.di_mode &=S_IFMT ; + ip->i_d.di_mode |= mode & ~S_IFMT ; + + inode->i_mode &=S_IFMT ; + inode->i_mode |= mode & ~S_IFMT ; +} + int xfs_setattr_nonsize( struct xfs_inode *ip,
@@ -606,18 +628,8 @@ xfs_setattr_nonsize(/* * Change file access modes. */ -if (mask &ATTR_MODE ) { -umode_t mode = iattr->ia_mode; - -if (!in_group_p (inode->i_gid) && !capable (CAP_FSETID )) - mode &= ~S_ISGID ; - - ip->i_d.di_mode &=S_IFMT ; - ip->i_d.di_mode |= mode & ~S_IFMT ; - - inode->i_mode &=S_IFMT ; - inode->i_mode |= mode & ~S_IFMT ; - } +if (mask &ATTR_MODE ) +xfs_setattr_mode (tp, ip, iattr);/* * Change file access or modified times.
@@ -714,9 +726,8 @@ xfs_setattr_size(return XFS_ERROR (error);ASSERT (S_ISREG (ip->i_d.di_mode)); -ASSERT ((mask & (ATTR_MODE |ATTR_UID |ATTR_GID |ATTR_ATIME |ATTR_ATIME_SET | -ATTR_MTIME_SET |ATTR_KILL_SUID |ATTR_KILL_SGID | -ATTR_KILL_PRIV |ATTR_TIMES_SET )) ==0 ); +ASSERT ((mask & (ATTR_UID |ATTR_GID |ATTR_ATIME |ATTR_ATIME_SET | +ATTR_MTIME_SET |ATTR_KILL_PRIV |ATTR_TIMES_SET )) ==0 );if (!(flags &XFS_ATTR_NOLOCK )) { lock_flags |=XFS_IOLOCK_EXCL ;
@@ -860,6 +871,12 @@ xfs_setattr_size(xfs_inode_clear_eofblocks_tag (ip); } +/* +* Change file access modes. +*/ +if (mask &ATTR_MODE ) +xfs_setattr_mode (tp, ip, iattr); +if (mask &ATTR_CTIME ) { inode->i_ctime = iattr->ia_ctime; ip->i_d.di_ctime.t_sec = iattr->ia_ctime.tv_sec;
Greg Kroah-Hartman
maintainerPATCH 63/127 arm64: dont kill the kernel on a bad esr from el0
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 9955ac47f4ba1c95ecb6092aeaefb40a22e99268 upstream.
Rather than completely killing the kernel if we receive an esr value we can't deal with in the el0 handlers, send the process a SIGILL and log the esr value in the hope that we can debug it. If we receive a bad esr from el1, we'll die() as before.
--- arch/arm64/kernel/traps.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
arch/arm64/kernel/traps.c +9 -3
@@ -317,14 +317,20 @@ asmlinkage long do_ni_syscall(struct pt_*/ asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr) { +siginfo_t info; +void __user *pc = (void __user *)instruction_pointer (regs);console_verbose ();pr_crit ("Bad mode in %s handler detected, code 0x%08x\n" , handler[reason], esr); +__show_regs (regs); -die ("Oops - bad mode" , regs,0 ); -local_irq_disable (); -panic ("bad mode" ); + info.si_signo =SIGILL ; + info.si_errno =0 ; + info.si_code =ILL_ILLOPC ; + info.si_addr = pc; + +arm64_notify_die ("Oops - bad mode" , regs, &info,0 ); }void __pte_error (const char *file,int line,unsigned long val)
Greg Kroah-Hartman
maintainerPATCH 64/127 ARM: SAMSUNG: Export MIPI CSIS/DSIM PHY control functions
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sylwester Nawrocki <[email protected]>
commit 30da66eafc015cd7e952829eaf8f86d8680f86d9 upstream.
The s5p_csis_phy_enable/s5p_dsim_phy_enable functions are now used directly by corresponding drivers and thus need to be exported so the drivers can be built as modules.
--- arch/arm/plat-samsung/setup-mipiphy.c | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/plat-samsung/setup-mipiphy.c +3 -0
@@ -8,6 +8,7 @@* published by the Free Software Foundation. */ +#include <linux/export.h> #include <linux/kernel.h> #include <linux/platform_device.h> #include <linux/io.h>
@@ -50,8 +51,10 @@ int s5p_csis_phy_enable(int id, bool on) {return __s5p_mipi_phy_control (id, on,S5P_MIPI_DPHY_SRESETN ); } +EXPORT_SYMBOL (s5p_csis_phy_enable);int s5p_dsim_phy_enable (struct platform_device *pdev,bool on) {return __s5p_mipi_phy_control (pdev->id, on,S5P_MIPI_DPHY_MRESETN ); } +EXPORT_SYMBOL (s5p_dsim_phy_enable);
Greg Kroah-Hartman
maintainerPATCH 65/127 SUNRPC: Prevent an rpc_task wakeup race
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit a3c3cac5d31879cd9ae2de7874dc6544ca704aec upstream.
The lockless RPC_IS_QUEUED() test in __rpc_execute means that we need to be careful about ordering the calls to rpc_test_and_set_running(task) and rpc_clear_queued(task). If we get the order wrong, then we may end up testing the RPC_TASK_RUNNING flag after __rpc_execute() has looped and changed the state of the rpc_task.
--- net/sunrpc/sched.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/sunrpc/sched.c +7 -1
@@ -324,11 +324,17 @@ EXPORT_SYMBOL_GPL(__rpc_wait_for_complet* Note: If the task is ASYNC, and is being made runnable after sitting on an * rpc_wait_queue, this must be called with the queue spinlock held to protect * the wait queue operation. +* Note the ordering of rpc_test_and_set_running() and rpc_clear_queued(), +* which is needed to ensure that __rpc_execute() doesn't loop (due to the +* lockless RPC_IS_QUEUED() test) before we've had a chance to test +* the RPC_TASK_RUNNING flag. */ static void rpc_make_runnable (struct rpc_task *task) { +bool need_wakeup = !rpc_test_and_set_running (task); +rpc_clear_queued (task); -if (rpc_test_and_set_running (task)) +if (!need_wakeup)return ;if (RPC_IS_ASYNC (task)) {INIT_WORK (&task->u.tk_work, rpc_async_schedule);
Greg Kroah-Hartman
maintainerPATCH 66/127 svcrpc: fix failures to handle -1 uids and gids
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <[email protected]>
commit afe3c3fd5392b2f0066930abc5dbd3f4b14a0f13 upstream.
As of f025adf191924e3a75ce80e130afcd2485b53bb8 "sunrpc: Properly decode kuids and kgids in RPC_AUTH_UNIX credentials" any rpc containing a -1 (0xffff) uid or gid would fail with a badcred error.
Reported symptoms were xmbc clients failing on upgrade of the NFS server; examination of the network trace showed them sending -1 as the gid.
--- net/sunrpc/svcauth_unix.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/sunrpc/svcauth_unix.c +7 -5
@@ -810,11 +810,15 @@ svcauth_unix_accept(struct svc_rqst *rqs goto badcred; argv->iov_base = (void *)((__be32 *)argv->iov_base + slen);/* skip machname */ argv->iov_len -= slen*4 ; - +/* +* Note: we skip uid_valid()/gid_valid() checks here for +* backwards compatibility with clients that use -1 id's. +* Instead, -1 uid or gid is later mapped to the +* (export-specific) anonymous id by nfsd_setuser. +* Supplementary gid's will be left alone. +*/ cred->cr_uid =make_kuid (&init_user_ns,svc_getnl (argv));/* uid */ cred->cr_gid =make_kgid (&init_user_ns,svc_getnl (argv));/* gid */ -if (!uid_valid (cred->cr_uid) || !gid_valid (cred->cr_gid)) - goto badcred; slen =svc_getnl (argv);/* gids length */ if (slen >16 || (len -= (slen +2 )*4 ) <0 ) goto badcred;
@@ -823,8 +827,6 @@ svcauth_unix_accept(struct svc_rqst *rqsreturn SVC_CLOSE ;for (i =0 ; i < slen; i++) {kgid_t kgid =make_kgid (&init_user_ns,svc_getnl (argv)); -if (!gid_valid (kgid)) - goto badcred;GROUP_AT (cred->cr_group_info, i) = kgid; }if (svc_getu32 (argv) !=htonl (RPC_AUTH_NULL ) ||svc_getu32 (argv) !=0 ) {
Greg Kroah-Hartman
maintainerPATCH 67/127 ASoC: cs42l52: fix default value for MASTERA_VOL.
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Schichan <[email protected]>
commit 04d245b7899c020559402841d2f70ddd740a7704 upstream.
The default register value for MASTERA_VOL is 0x00, the same as MASTERB_VOL.
--- sound/soc/codecs/cs42l52.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/cs42l52.c +1 -1
@@ -86,7 +86,7 @@ static const struct reg_default cs42l52_ { CS42L52_BEEP_VOL, 0x00 }, /* r1D Beep Volume off Time */ { CS42L52_BEEP_TONE_CTL, 0x00 }, /* r1E Beep Tone Cfg. */ { CS42L52_TONE_CTL, 0x00 }, /* r1F Tone Ctl */ - { CS42L52_MASTERA_VOL, 0x88 }, /* r20 Master A Volume */ + { CS42L52_MASTERA_VOL, 0x00 }, /* r20 Master A Volume */ { CS42L52_MASTERB_VOL, 0x00 }, /* r21 Master B Volume */ { CS42L52_HPA_VOL, 0x00 }, /* r22 Headphone A Volume */ { CS42L52_HPB_VOL, 0x00 }, /* r23 Headphone B Volume */
Greg Kroah-Hartman
maintainerPATCH 68/127 ASoC: wm5110: Correct DSP4R Mixer control name
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
commit 39d4ecdb711ba44e0aa0b2f3db74ed5ac97abe21 upstream.
--- sound/soc/codecs/wm5110.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wm5110.c +1 -1
@@ -190,7 +190,7 @@ ARIZONA_MIXER_CONTROLS("DSP2R", ARIZONA_ARIZONA_MIXER_CONTROLS ("DSP3L" ,ARIZONA_DSP3LMIX_INPUT_1_SOURCE ),ARIZONA_MIXER_CONTROLS ("DSP3R" ,ARIZONA_DSP3RMIX_INPUT_1_SOURCE ),ARIZONA_MIXER_CONTROLS ("DSP4L" ,ARIZONA_DSP4LMIX_INPUT_1_SOURCE ), -ARIZONA_MIXER_CONTROLS ("DSP5R" ,ARIZONA_DSP4RMIX_INPUT_1_SOURCE ), +ARIZONA_MIXER_CONTROLS ("DSP4R" ,ARIZONA_DSP4RMIX_INPUT_1_SOURCE ),ARIZONA_MIXER_CONTROLS ("Mic" ,ARIZONA_MICMIX_INPUT_1_SOURCE ), ARIZONA_MIXER_CONTROLS("Noise", ARIZONA_NOISEMIX_INPUT_1_SOURCE),
Greg Kroah-Hartman
maintainerPATCH 69/127 drm/i915: Adding more reserved PCI IDs for Haswell.
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Vivi <[email protected]>
commit 1c98b4871cca4b7ce07e19f92f934d47cf7210b0 upstream.
At DDX commit Chris mentioned the tendency we have of finding out more PCI IDs only when users report. So Let's add all new reserved Haswell IDs.
This patch also fix GT3 names. I'no not sending in separated patche because names are only in few comments and not in variable names.
v2: Fix some mobile ids (by Paulo)
References: http://bugs.freedesktop.org/show_bug.cgi?id=63701
--- drivers/gpu/drm/i915/i915_drv.c | 46 ++++++++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 11 deletions(-)
drivers/gpu/drm/i915/i915_drv.c +35 -11
@@ -359,40 +359,64 @@ static const struct pci_device_id pciidlINTEL_VGA_DEVICE (0x016a , &intel_ivybridge_d_info),/* GT2 server */ INTEL_VGA_DEVICE (0x0402 , &intel_haswell_d_info),/* GT1 desktop */ INTEL_VGA_DEVICE (0x0412 , &intel_haswell_d_info),/* GT2 desktop */ -INTEL_VGA_DEVICE (0x0422 , &intel_haswell_d_info),/* GT2 desktop */ +INTEL_VGA_DEVICE (0x0422 , &intel_haswell_d_info),/* GT3 desktop */ INTEL_VGA_DEVICE (0x040a , &intel_haswell_d_info),/* GT1 server */ INTEL_VGA_DEVICE (0x041a , &intel_haswell_d_info),/* GT2 server */ -INTEL_VGA_DEVICE (0x042a , &intel_haswell_d_info),/* GT2 server */ +INTEL_VGA_DEVICE (0x042a , &intel_haswell_d_info),/* GT3 server */ INTEL_VGA_DEVICE (0x0406 , &intel_haswell_m_info),/* GT1 mobile */ INTEL_VGA_DEVICE (0x0416 , &intel_haswell_m_info),/* GT2 mobile */ INTEL_VGA_DEVICE (0x0426 , &intel_haswell_m_info),/* GT2 mobile */ +INTEL_VGA_DEVICE (0x040B , &intel_haswell_d_info),/* GT1 reserved */ +INTEL_VGA_DEVICE (0x041B , &intel_haswell_d_info),/* GT2 reserved */ +INTEL_VGA_DEVICE (0x042B , &intel_haswell_d_info),/* GT3 reserved */ +INTEL_VGA_DEVICE (0x040E , &intel_haswell_d_info),/* GT1 reserved */ +INTEL_VGA_DEVICE (0x041E , &intel_haswell_d_info),/* GT2 reserved */ +INTEL_VGA_DEVICE (0x042E , &intel_haswell_d_info),/* GT3 reserved */ INTEL_VGA_DEVICE (0x0C02 , &intel_haswell_d_info),/* SDV GT1 desktop */ INTEL_VGA_DEVICE (0x0C12 , &intel_haswell_d_info),/* SDV GT2 desktop */ -INTEL_VGA_DEVICE (0x0C22 , &intel_haswell_d_info),/* SDV GT2 desktop */ +INTEL_VGA_DEVICE (0x0C22 , &intel_haswell_d_info),/* SDV GT3 desktop */ INTEL_VGA_DEVICE (0x0C0A , &intel_haswell_d_info),/* SDV GT1 server */ INTEL_VGA_DEVICE (0x0C1A , &intel_haswell_d_info),/* SDV GT2 server */ -INTEL_VGA_DEVICE (0x0C2A , &intel_haswell_d_info),/* SDV GT2 server */ +INTEL_VGA_DEVICE (0x0C2A , &intel_haswell_d_info),/* SDV GT3 server */ INTEL_VGA_DEVICE (0x0C06 , &intel_haswell_m_info),/* SDV GT1 mobile */ INTEL_VGA_DEVICE (0x0C16 , &intel_haswell_m_info),/* SDV GT2 mobile */ -INTEL_VGA_DEVICE (0x0C26 , &intel_haswell_m_info),/* SDV GT2 mobile */ +INTEL_VGA_DEVICE (0x0C26 , &intel_haswell_m_info),/* SDV GT3 mobile */ +INTEL_VGA_DEVICE (0x0C0B , &intel_haswell_d_info),/* SDV GT1 reserved */ +INTEL_VGA_DEVICE (0x0C1B , &intel_haswell_d_info),/* SDV GT2 reserved */ +INTEL_VGA_DEVICE (0x0C2B , &intel_haswell_d_info),/* SDV GT3 reserved */ +INTEL_VGA_DEVICE (0x0C0E , &intel_haswell_d_info),/* SDV GT1 reserved */ +INTEL_VGA_DEVICE (0x0C1E , &intel_haswell_d_info),/* SDV GT2 reserved */ +INTEL_VGA_DEVICE (0x0C2E , &intel_haswell_d_info),/* SDV GT3 reserved */ INTEL_VGA_DEVICE (0x0A02 , &intel_haswell_d_info),/* ULT GT1 desktop */ INTEL_VGA_DEVICE (0x0A12 , &intel_haswell_d_info),/* ULT GT2 desktop */ -INTEL_VGA_DEVICE (0x0A22 , &intel_haswell_d_info),/* ULT GT2 desktop */ +INTEL_VGA_DEVICE (0x0A22 , &intel_haswell_d_info),/* ULT GT3 desktop */ INTEL_VGA_DEVICE (0x0A0A , &intel_haswell_d_info),/* ULT GT1 server */ INTEL_VGA_DEVICE (0x0A1A , &intel_haswell_d_info),/* ULT GT2 server */ -INTEL_VGA_DEVICE (0x0A2A , &intel_haswell_d_info),/* ULT GT2 server */ +INTEL_VGA_DEVICE (0x0A2A , &intel_haswell_d_info),/* ULT GT3 server */ INTEL_VGA_DEVICE (0x0A06 , &intel_haswell_m_info),/* ULT GT1 mobile */ INTEL_VGA_DEVICE (0x0A16 , &intel_haswell_m_info),/* ULT GT2 mobile */ -INTEL_VGA_DEVICE (0x0A26 , &intel_haswell_m_info),/* ULT GT2 mobile */ +INTEL_VGA_DEVICE (0x0A26 , &intel_haswell_m_info),/* ULT GT3 mobile */ +INTEL_VGA_DEVICE (0x0A0B , &intel_haswell_d_info),/* ULT GT1 reserved */ +INTEL_VGA_DEVICE (0x0A1B , &intel_haswell_d_info),/* ULT GT2 reserved */ +INTEL_VGA_DEVICE (0x0A2B , &intel_haswell_d_info),/* ULT GT3 reserved */ +INTEL_VGA_DEVICE (0x0A0E , &intel_haswell_m_info),/* ULT GT1 reserved */ +INTEL_VGA_DEVICE (0x0A1E , &intel_haswell_m_info),/* ULT GT2 reserved */ +INTEL_VGA_DEVICE (0x0A2E , &intel_haswell_m_info),/* ULT GT3 reserved */ INTEL_VGA_DEVICE (0x0D02 , &intel_haswell_d_info),/* CRW GT1 desktop */ INTEL_VGA_DEVICE (0x0D12 , &intel_haswell_d_info),/* CRW GT2 desktop */ -INTEL_VGA_DEVICE (0x0D22 , &intel_haswell_d_info),/* CRW GT2 desktop */ +INTEL_VGA_DEVICE (0x0D22 , &intel_haswell_d_info),/* CRW GT3 desktop */ INTEL_VGA_DEVICE (0x0D0A , &intel_haswell_d_info),/* CRW GT1 server */ INTEL_VGA_DEVICE (0x0D1A , &intel_haswell_d_info),/* CRW GT2 server */ -INTEL_VGA_DEVICE (0x0D2A , &intel_haswell_d_info),/* CRW GT2 server */ +INTEL_VGA_DEVICE (0x0D2A , &intel_haswell_d_info),/* CRW GT3 server */ INTEL_VGA_DEVICE (0x0D06 , &intel_haswell_m_info),/* CRW GT1 mobile */ INTEL_VGA_DEVICE (0x0D16 , &intel_haswell_m_info),/* CRW GT2 mobile */ -INTEL_VGA_DEVICE (0x0D26 , &intel_haswell_m_info),/* CRW GT2 mobile */ +INTEL_VGA_DEVICE (0x0D26 , &intel_haswell_m_info),/* CRW GT3 mobile */ +INTEL_VGA_DEVICE (0x0D0B , &intel_haswell_d_info),/* CRW GT1 reserved */ +INTEL_VGA_DEVICE (0x0D1B , &intel_haswell_d_info),/* CRW GT2 reserved */ +INTEL_VGA_DEVICE (0x0D2B , &intel_haswell_d_info),/* CRW GT3 reserved */ +INTEL_VGA_DEVICE (0x0D0E , &intel_haswell_d_info),/* CRW GT1 reserved */ +INTEL_VGA_DEVICE (0x0D1E , &intel_haswell_d_info),/* CRW GT2 reserved */ +INTEL_VGA_DEVICE (0x0D2E , &intel_haswell_d_info),/* CRW GT3 reserved */ INTEL_VGA_DEVICE (0x0f30 , &intel_valleyview_m_info),INTEL_VGA_DEVICE (0x0157 , &intel_valleyview_m_info), INTEL_VGA_DEVICE(0x0155, &intel_valleyview_d_info),
Greg Kroah-Hartman
maintainerPATCH 70/127 drm/radeon: fix typo in cu_per_sh on verde
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 468ef1a58c9268ac9709350bf95eaf1c22a69f29 upstream.
Should be 5 rather than 2.
Noticed by sroland and glisse on IRC.
--- drivers/gpu/drm/radeon/si.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/radeon/si.c +1 -1
@@ -1645,7 +1645,7 @@ static void si_gpu_init(struct radeon_dedefault : rdev->config.si.max_shader_engines =1 ; rdev->config.si.max_tile_pipes =4 ; - rdev->config.si.max_cu_per_sh =2 ; + rdev->config.si.max_cu_per_sh =5 ; rdev->config.si.max_sh_per_se =2 ; rdev->config.si.max_backends_per_se =4 ; rdev->config.si.max_texture_channel_caches =4 ;
Greg Kroah-Hartman
maintainerPATCH 71/127 drm/radeon: fix card_posted check for newer asics
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 09fb8bd1a63b0f9f15e655c4fe8d047e5d2bf67a upstream.
Newer asics have variable numbers of crtcs. Use that rather than the asic family to determine which crtcs to check. This avoids checking non-existent crtcs or missing crtcs on certain asics.
--- drivers/gpu/drm/radeon/radeon_device.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/gpu/drm/radeon/radeon_device.c +9 -10
@@ -435,18 +435,17 @@ bool radeon_card_posted(struct radeon_dereturn false;/* first check CRTCs */ -if (ASIC_IS_DCE41 (rdev)) { +if (ASIC_IS_DCE4 (rdev)) { reg =RREG32 (EVERGREEN_CRTC_CONTROL +EVERGREEN_CRTC0_REGISTER_OFFSET ) |RREG32 (EVERGREEN_CRTC_CONTROL +EVERGREEN_CRTC1_REGISTER_OFFSET ); -if (reg &EVERGREEN_CRTC_MASTER_EN ) -return true; - }else if (ASIC_IS_DCE4 (rdev)) { - reg =RREG32 (EVERGREEN_CRTC_CONTROL +EVERGREEN_CRTC0_REGISTER_OFFSET ) | -RREG32 (EVERGREEN_CRTC_CONTROL +EVERGREEN_CRTC1_REGISTER_OFFSET ) | -RREG32 (EVERGREEN_CRTC_CONTROL +EVERGREEN_CRTC2_REGISTER_OFFSET ) | -RREG32 (EVERGREEN_CRTC_CONTROL +EVERGREEN_CRTC3_REGISTER_OFFSET ) | -RREG32 (EVERGREEN_CRTC_CONTROL +EVERGREEN_CRTC4_REGISTER_OFFSET ) | -RREG32 (EVERGREEN_CRTC_CONTROL +EVERGREEN_CRTC5_REGISTER_OFFSET ); +if (rdev->num_crtc >=4 ) { + reg |=RREG32 (EVERGREEN_CRTC_CONTROL +EVERGREEN_CRTC2_REGISTER_OFFSET ) | +RREG32 (EVERGREEN_CRTC_CONTROL +EVERGREEN_CRTC3_REGISTER_OFFSET ); + } +if (rdev->num_crtc >=6 ) { + reg |=RREG32 (EVERGREEN_CRTC_CONTROL +EVERGREEN_CRTC4_REGISTER_OFFSET ) | +RREG32 (EVERGREEN_CRTC_CONTROL +EVERGREEN_CRTC5_REGISTER_OFFSET ); + }if (reg &EVERGREEN_CRTC_MASTER_EN )return true; }else if (ASIC_IS_AVIVO (rdev)) {
Greg Kroah-Hartman
maintainerPATCH 72/127 crypto: caam - fix inconsistent assoc dma mapping direction
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horia Geanta <[email protected]>
commit 286233e604d79f0c7fa04abec2180d5d89a74749 upstream.
req->assoc is dma mapped BIDIRECTIONAL and unmapped TO_DEVICE. Since it is read-only for the device, use TO_DEVICE both for mapping and unmapping.
--- drivers/crypto/caam/caamalg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/crypto/caam/caamalg.c +2 -2
@@ -1154,7 +1154,7 @@ static struct aead_edesc *aead_edesc_all dst_nents =sg_count (req->dst, req->cryptlen, &dst_chained); sgc =dma_map_sg_chained (jrdev, req->assoc, assoc_nents ? :1 , -DMA_BIDIRECTIONAL , assoc_chained); +DMA_TO_DEVICE , assoc_chained);if (likely (req->src == req->dst)) { sgc =dma_map_sg_chained (jrdev, req->src, src_nents ? :1 ,DMA_BIDIRECTIONAL , src_chained);
@@ -1336,7 +1336,7 @@ static struct aead_edesc *aead_giv_edesc dst_nents =sg_count (req->dst, req->cryptlen, &dst_chained); sgc =dma_map_sg_chained (jrdev, req->assoc, assoc_nents ? :1 , -DMA_BIDIRECTIONAL , assoc_chained); +DMA_TO_DEVICE , assoc_chained);if (likely (req->src == req->dst)) { sgc =dma_map_sg_chained (jrdev, req->src, src_nents ? :1 ,DMA_BIDIRECTIONAL , src_chained);
Greg Kroah-Hartman
maintainerPATCH 73/127 cifs: fix potential buffer overrun when composing a new options string
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
commit 166faf21bd14bc5c5295a44874bf7f3930c30b20 upstream.
Consider the case where we have a very short ip= string in the original mount options, and when we chase a referral we end up with a very long IPv6 address. Be sure to allow for that possibility when estimating the size of the string to allocate.
--- fs/cifs/cifs_dfs_ref.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/cifs/cifs_dfs_ref.c +3 -1
@@ -18,6 +18,7 @@#include <linux/slab.h> #include <linux/vfs.h> #include <linux/fs.h> +#include <linux/inet.h> #include "cifsglob.h" #include "cifsproto.h" #include "cifsfs.h"
@@ -150,7 +151,8 @@ char *cifs_compose_mount_options(const c* assuming that we have 'unc=' and 'ip=' in * the original sb_mountdata */ - md_len =strlen (sb_mountdata) + rc +strlen (ref->node_name) +12 ; + md_len =strlen (sb_mountdata) + rc +strlen (ref->node_name) +12 + +INET6_ADDRSTRLEN ; mountdata =kzalloc (md_len+1 ,GFP_KERNEL );if (mountdata ==NULL ) { rc = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 74/127 sata_rcar: clear STOP bit in bmdma_start() method
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit df7e131f6359f20ed8f0a37db039c4f6420a18c2 upstream.
Iff bmdma_setup() has to stop a DMA transfer before starting a new one, then the STOP bit in the ATAPI_CONTROL1 register will remain set (it's only cleared when setting the START bit to 1) and then bmdma_start() method will set both START and STOP bits simultaneously which should abort the transfer being just started. Avoid that by explicitly clearing the STOP bit in bmdma_start() method (in this case it will be ignored on write).
--- drivers/ata/sata_rcar.c | 1 + 1 file changed, 1 insertion(+)
drivers/ata/sata_rcar.c +1 -0
@@ -548,6 +548,7 @@ static void sata_rcar_bmdma_start(struct/* start host DMA transaction */ dmactl =ioread32 (priv->base +ATAPI_CONTROL1_REG ); + dmactl &= ~ATAPI_CONTROL1_STOP ; dmactl |=ATAPI_CONTROL1_START ;iowrite32 (dmactl, priv->base +ATAPI_CONTROL1_REG ); }
Greg Kroah-Hartman
maintainerPATCH 75/127 sata_rcar: fix interrupt handling
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit 52a2a1087b5924de00484f35ef5e2a73f61dbd22 upstream.
The driver's interrupt handling code is too picky in deciding whether it should handle an interrupt or not which causes completely unneeded spurious interrupts. Thus make sata_rcar_{ata|serr}_interrupt() *void*; add ATA status register read to sata_rcar_ata_interrupt() to clear an unexpected ATA interrupt -- it doesn't get cleared by writing to the SATAINTSTAT register in the interrupt mode we use.
Also, in sata_rcar_ata_interrupt() we should check SATAINTSTAT register only for enabled interrupts and we should clear only those interrupts that we have read as active first time around, because else we have a race and risk clearing an interrupt that can occur between read and write of the SATAINTSTAT register and never registering it...
--- drivers/ata/sata_rcar.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-)
drivers/ata/sata_rcar.c +11 -12
@@ -618,17 +618,16 @@ static struct ata_port_operations sata_r .bmdma_status = sata_rcar_bmdma_status, }; -static int sata_rcar_serr_interrupt (struct ata_port *ap) +static void sata_rcar_serr_interrupt (struct ata_port *ap) {struct sata_rcar_priv *priv = ap->host->private_data;struct ata_eh_info *ehi = &ap->link.eh_info;int freeze =0 ; -int handled =0 ;u32 serror; serror =ioread32 (priv->base +SCRSERR_REG );if (!serror) -return 0 ; +return ;DPRINTK ("SError @host_intr: 0x%x\n" , serror);
@@ -641,7 +640,6 @@ static int sata_rcar_serr_interrupt(struata_ehi_push_desc (ehi,"%s" ,"hotplug" ); freeze = serror &SERR_COMM_WAKE ?0 :1 ; - handled =1 ; }/* freeze or abort */
@@ -649,11 +647,9 @@ static int sata_rcar_serr_interrupt(struata_port_freeze (ap); elseata_port_abort (ap ); - -return handled; } -static int sata_rcar_ata_interrupt (struct ata_port *ap) +static void sata_rcar_ata_interrupt (struct ata_port *ap) {struct ata_queued_cmd *qc;int handled =0 ;
@@ -662,7 +658,9 @@ static int sata_rcar_ata_interrupt(strucif (qc) handled |=ata_bmdma_port_intr (ap, qc); -return handled; +/* be sure to clear ATA interrupt */ +if (!handled) +sata_rcar_check_status (ap); }static irqreturn_t sata_rcar_interrupt (int irq,void *dev_instance)
@@ -677,20 +675,21 @@ static irqreturn_t sata_rcar_interrupt(ispin_lock_irqsave (&host->lock, flags); sataintstat =ioread32 (priv->base +SATAINTSTAT_REG ); + sataintstat &=SATA_RCAR_INT_MASK ;if (!sataintstat) goto done;/* ack */ -iowrite32 (sataintstat & ~SATA_RCAR_INT_MASK , - priv->base +SATAINTSTAT_REG ); +iowrite32 (~sataintstat &0x7ff , priv->base +SATAINTSTAT_REG ); ap = host->ports[0 ];if (sataintstat &SATAINTSTAT_ATA ) - handled |=sata_rcar_ata_interrupt (ap); +sata_rcar_ata_interrupt (ap);if (sataintstat &SATAINTSTAT_SERR ) - handled |=sata_rcar_serr_interrupt (ap); +sata_rcar_serr_interrupt (ap); + handled =1 ; done:spin_unlock_irqrestore (&host->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 76/127 ata_piix: add PCI IDs for Intel BayTail
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Chew, Chiau Ee" <[email protected]>
commit fca8c90d519dedd4f4b19901d005c243f7f0bf2e upstream.
Adds IDE-mode SATA Device IDs for the Intel BayTrail platform.
--- drivers/ata/ata_piix.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/ata/ata_piix.c +15 -0
@@ -151,6 +151,7 @@ enum piix_controller_ids { piix_pata_vmw,/* PIIX4 for VMware, spurious DMA_ERR */ ich8_sata_snb, ich8_2port_sata_snb, + ich8_2port_sata_byt, }; struct piix_map_db {
@@ -334,6 +335,9 @@ static const struct pci_device_id piix_p { 0x8086, 0x8d60, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },/* SATA Controller IDE (Wellsburg) */ { 0x8086, 0x8d68, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata }, +/* SATA Controller IDE (BayTrail) */ + { 0x8086, 0x0F20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt }, + { 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt }, { } /* terminate list */ };
@@ -441,6 +445,7 @@ static const struct piix_map_db *piix_ma [tolapai_sata] = &tolapai_map_db, [ich8_sata_snb] = &ich8_map_db, [ich8_2port_sata_snb] = &ich8_2port_map_db, + [ich8_2port_sata_byt] = &ich8_2port_map_db, };static struct pci_bits piix_enable_bits[] = {
@@ -1254,6 +1259,16 @@ static struct ata_port_info piix_port_in .udma_mask = ATA_UDMA6, .port_ops = &piix_sata_ops, }, + + [ich8_2port_sata_byt] = + { + .flags = PIIX_SATA_FLAGS | PIIX_FLAG_SIDPR | PIIX_FLAG_PIO16, + .pio_mask = ATA_PIO4, + .mwdma_mask = ATA_MWDMA2, + .udma_mask = ATA_UDMA6, + .port_ops = &piix_sata_ops, + }, + };#define AHCI_PCI_BAR 5
Greg Kroah-Hartman
maintainerPATCH 77/127 libata: make ata_exec_internal_sg honor DMADIR
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Pelletier <[email protected]>
commit e771451c0a831d96a7c14b0ca8a8ec671d98567b upstream.
libata honors DMADIR for regular commands, but not for internal commands used (among other) during device initialisation.
This makes SATA-host-to-PATA-device bridges based on Silicon Image SiL3611 (such as "Abit Serillel 2") end up disabled when used with an ATAPI device after a few tries.
Log output of the bridge being hot-plugged with an ATAPI drive:
[ 9631.212901] ata1: exception Emask 0x10 SAct 0x0 SErr 0x40c0000 action 0xe frozen
[ 9631.212913] ata1: irq_stat 0x00000040, connection status changed
[ 9631.212923] ata1: SError: { CommWake 10B8B DevExch }
[ 9631.212939] ata1: hard resetting link
[ 9632.104962] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 9632.106393] ata1.00: ATAPI: PIONEER DVD-RW DVR-115, 1.06, max UDMA/33
[ 9632.106407] ata1.00: applying bridge limits
[ 9632.108151] ata1.00: configured for UDMA/33
[ 9637.105303] ata1.00: qc timeout (cmd 0xa0)
[ 9637.105324] ata1.00: failed to clear UNIT ATTENTION (err_mask=0x5)
[ 9637.105335] ata1: hard resetting link
[ 9638.044599] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 9638.047878] ata1.00: configured for UDMA/33
[ 9643.044933] ata1.00: qc timeout (cmd 0xa0)
[ 9643.044953] ata1.00: failed to clear UNIT ATTENTION (err_mask=0x5)
[ 9643.044963] ata1: limiting SATA link speed to 1.5 Gbps
[ 9643.044971] ata1.00: limiting speed to UDMA/33:PIO3
[ 9643.044979] ata1: hard resetting link
[ 9643.984225] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 310)
[ 9643.987471] ata1.00: configured for UDMA/33
[ 9648.984591] ata1.00: qc timeout (cmd 0xa0)
[ 9648.984612] ata1.00: failed to clear UNIT ATTENTION (err_mask=0x5)
[ 9648.984619] ata1.00: disabled
[ 9649.000593] ata1: hard resetting link
[ 9649.939902] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 310)
[ 9649.955864] ata1: EH completeWith this patch, the drive enumerates correctly when libata is loaded with atapi_dmadir=1:
[ 9891.810863] ata1: exception Emask 0x10 SAct 0x0 SErr 0x40c0000 action 0xe frozen
[ 9891.810874] ata1: irq_stat 0x00000040, connection status changed
[ 9891.810884] ata1: SError: { CommWake 10B8B DevExch }
[ 9891.810900] ata1: hard resetting link
[ 9892.762105] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 9892.763544] ata1.00: ATAPI: PIONEER DVD-RW DVR-115, 1.06, max UDMA/33, DMADIR
[ 9892.763558] ata1.00: applying bridge limits
[ 9892.765393] ata1.00: configured for UDMA/33
[ 9892.786063] ata1: EH complete
[ 9892.792062] scsi 0:0:0:0: CD-ROM PIONEER DVD-RW DVR-115 1.06 PQ: 0 ANSI: 5
[ 9892.798455] sr2: scsi3-mmc drive: 12x/12x writer dvd-ram cd/rw xa/form2 cdda tray
[ 9892.798837] sr 0:0:0:0: Attached scsi CD-ROM sr2
[ 9892.799109] sr 0:0:0:0: Attached scsi generic sg6 type 5Based on a patch by Csaba Halász <[email protected]> on linux-ide:
http://marc.info/?l=linux-ide&m=136121147832295&w=2
tj: minor formatting changes.
--- drivers/ata/libata-core.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/ata/libata-core.c +6 -0
@@ -1602,6 +1602,12 @@ unsigned ata_exec_internal_sg(struct ata qc->tf = *tf;if (cdb)memcpy (qc->cdb, cdb,ATAPI_CDB_LEN ); + +/* some SATA bridges need us to indicate data xfer direction */ +if (tf->protocol ==ATAPI_PROT_DMA && (dev->flags &ATA_DFLAG_DMADIR ) && + dma_dir ==DMA_FROM_DEVICE ) + qc->tf.feature |=ATAPI_DMADIR ; + qc->flags |=ATA_QCFLAG_RESULT_TF ; qc->dma_dir = dma_dir;if (dma_dir !=DMA_NONE ) {
Greg Kroah-Hartman
maintainerPATCH 78/127 m68k/mac: Fix unexpected interrupt with CONFIG_EARLY_PRINTK
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
commit df66834a43c461de2565c45d815288ba1c0def37 upstream.
The present code does not wait for the SCC to finish resetting itself before trying to initialise the device. The result is that the SCC interrupt sources become enabled (if they weren't already). This leads to an early boot crash (unexpected interrupt) given CONFIG_EARLY_PRINTK. Fix this by adding a delay. A successful reset disables the interrupt sources.
Also, after the reset for channel A setup, the SCC then gets a second reset for channel B setup which leaves channel A uninitialised again. Fix this by performing the reset only once.
--- arch/m68k/kernel/head.S | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-)
arch/m68k/kernel/head.S +19 -10
@@ -2752,11 +2752,9 @@ func_return get_new_page #ifdef CONFIG_MAC L(scc_initable_mac): - .byte 9,12 /* Reset */ .byte 4,0x44 /* x16, 1 stopbit, no parity */ .byte 3,0xc0 /* receiver: 8 bpc */ .byte 5,0xe2 /* transmitter: 8 bpc, assert dtr/rts */ - .byte 9,0 /* no interrupts */ .byte 10,0 /* NRZ */ .byte 11,0x50 /* use baud rate generator */ .byte 12,1,13,0 /* 38400 baud */
@@ -2899,6 +2897,7 @@ func_start serial_init,%d0/%d1/%a0/%a1 is_not_mac(L(serial_init_not_mac)) #ifdef SERIAL_DEBUG + /* You may define either or both of these. */ #define MAC_USE_SCC_A /* Modem port */ #define MAC_USE_SCC_B /* Printer port */
@@ -2908,9 +2907,21 @@ func_start serial_init,%d0/%d1/%a0/%a1 #define mac_scc_cha_b_data_offset 0x4 #define mac_scc_cha_a_data_offset 0x6 +#if defined(MAC_USE_SCC_A) || defined(MAC_USE_SCC_B) + movel %pc@(L(mac_sccbase)),%a0 + /* Reset SCC device */ + moveb #9,%a0@(mac_scc_cha_a_ctrl_offset) + moveb #0xc0,%a0@(mac_scc_cha_a_ctrl_offset) + /* Wait for 5 PCLK cycles, which is about 68 CPU cycles */ + /* 5 / 3.6864 MHz = approx. 1.36 us = 68 / 50 MHz */ + movel #35,%d0 +5: + subq #1,%d0 + jne 5b +#endif + #ifdef MAC_USE_SCC_A /* Initialize channel A */ - movel %pc@(L(mac_sccbase)),%a0 lea %pc@(L(scc_initable_mac)),%a1 5: moveb %a1@+,%d0 jmi 6f
@@ -2922,9 +2933,6 @@ func_start serial_init,%d0/%d1/%a0/%a1 #ifdef MAC_USE_SCC_B /* Initialize channel B */ -#ifndef MAC_USE_SCC_A /* Load mac_sccbase only if needed */ - movel %pc@(L(mac_sccbase)),%a0 -#endif /* MAC_USE_SCC_A */ lea %pc@(L(scc_initable_mac)),%a1 7: moveb %a1@+,%d0 jmi 8f
@@ -2933,6 +2941,7 @@ func_start serial_init,%d0/%d1/%a0/%a1 jra 7b 8: #endif /* MAC_USE_SCC_B */ + #endif /* SERIAL_DEBUG */ jra L(serial_init_done)
@@ -3006,17 +3015,17 @@ func_start serial_putc,%d0/%d1/%a0/%a1 #ifdef SERIAL_DEBUG -#ifdef MAC_USE_SCC_A +#if defined(MAC_USE_SCC_A) || defined(MAC_USE_SCC_B) movel %pc@(L(mac_sccbase)),%a1 +#endif + +#ifdef MAC_USE_SCC_A 3: btst #2,%a1@(mac_scc_cha_a_ctrl_offset) jeq 3b moveb %d0,%a1@(mac_scc_cha_a_data_offset) #endif /* MAC_USE_SCC_A */ #ifdef MAC_USE_SCC_B -#ifndef MAC_USE_SCC_A /* Load mac_sccbase only if needed */ - movel %pc@(L(mac_sccbase)),%a1 -#endif /* MAC_USE_SCC_A */ 4: btst #2,%a1@(mac_scc_cha_b_ctrl_offset) jeq 4b moveb %d0,%a1@(mac_scc_cha_b_data_offset)
Greg Kroah-Hartman
maintainerPATCH 79/127 s390/pgtable: Fix check for pgste/storage key handling
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <[email protected]>
commit b56433cb782d1cc7e44fc46d2ce3917fa75d2236 upstream.
pte_present might return true on PAGE_TYPE_NONE, even if the invalid bit is on. Modify the existing check of the pgste functions to avoid crashes.
[ Martin Schwidefsky: added ptep_modify_prot_[start|commit] bits ]
--- arch/s390/include/asm/pgtable.h | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
arch/s390/include/asm/pgtable.h +11 -4
@@ -637,7 +637,7 @@ static inline pgste_t pgste_update_all(punsigned long address, bits;unsigned char skey; -if (!pte_present (*ptep)) +if (pte_val (*ptep) & _PAGE_INVALID)return pgste; address =pte_val (*ptep) &PAGE_MASK ; skey =page_get_storage_key (address);
@@ -671,7 +671,7 @@ static inline pgste_t pgste_update_young#ifdef CONFIG_PGSTE int young; -if (!pte_present (*ptep)) +if (pte_val (*ptep) & _PAGE_INVALID)return pgste;/* Get referenced bit from storage key */ young =page_reset_referenced (pte_val (*ptep) &PAGE_MASK );
@@ -697,7 +697,7 @@ static inline void pgste_set_key(pte_t *unsigned long address;unsigned long okey, nkey; -if (!pte_present (entry)) +if (pte_val (entry) & _PAGE_INVALID)return ; address =pte_val (entry) &PAGE_MASK ; okey = nkey =page_get_storage_key (address);
@@ -1072,6 +1072,9 @@ static inline pte_t ptep_modify_prot_sta pte = *ptep;if (!mm_exclusive (mm))__ptep_ipte (address, ptep); + +if (mm_has_pgste (mm)) + pgste =pgste_update_all (&pte, pgste);return pte; }
@@ -1079,9 +1082,13 @@ static inline void ptep_modify_prot_communsigned long address, pte_t *ptep, pte_t pte) { + pgste_t pgste; +if (mm_has_pgste (mm)) { + pgste = *(pgste_t *)(ptep +PTRS_PER_PTE ); +pgste_set_key (ptep, pgste, pte);pgste_set_pte (ptep, pte); -pgste_set_unlock (ptep, *(pgste_t *)(ptep +PTRS_PER_PTE )); +pgste_set_unlock (ptep, pgste); }else *ptep = pte; }
Greg Kroah-Hartman
maintainerPATCH 80/127 cgroup: initialize xattr before calling d_instantiate()
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zefan <[email protected]>
commit d6cbf35dac8a3dadb9103379820c96d7c85df3d9 upstream.
cgroup_create_file() calls d_instantiate(), which may decide to look at the xattrs on the file. Smack always does this and SELinux can be configured to do so.
But cgroup_add_file() didn't initialize xattrs before calling cgroup_create_file(), which finally leads to dereferencing NULL dentry->d_fsdata.
This bug has been there since cgroup xattr was introduced.
--- kernel/cgroup.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
kernel/cgroup.c +5 -4
@@ -2747,13 +2747,14 @@ static int cgroup_add_file(struct cgroup goto out; } + cfe->type = (void *)cft; + cfe->dentry = dentry; + dentry->d_fsdata = cfe; +simple_xattrs_init (&cfe->xattrs); + mode =cgroup_file_mode (cft); error =cgroup_create_file (dentry, mode |S_IFREG , cgrp->root->sb);if (!error) { - cfe->type = (void *)cft; - cfe->dentry = dentry; - dentry->d_fsdata = cfe; -simple_xattrs_init (&cfe->xattrs);list_add_tail (&cfe->node, &parent->files); cfe =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 81/127 cgroup: fix a subtle bug in descendant pre-order walk
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 7805d000db30a3787a4c969bab6ae4d8a5fd8ce6 upstream.
When cgroup_next_descendant_pre() initiates a walk, it checks whether the subtree root doesn't have any children and if not returns NULL. Later code assumes that the subtree isn't empty. This is broken because the subtree may become empty inbetween, which can lead to the traversal escaping the subtree by walking to the sibling of the subtree root.
There's no reason to have the early exit path. Remove it along with the later assumption that the subtree isn't empty. This simplifies the code a bit and fixes the subtle bug.
While at it, fix the comment of cgroup_for_each_descendant_pre() which was incorrectly referring to ->css_offline() instead of ->css_online().
--- include/linux/cgroup.h | 2 +- kernel/cgroup.c | 9 +++------ 2 files changed, 4 insertions(+), 7 deletions(-)
include/linux/cgroup.h +1 -1
@@ -570,7 +570,7 @@ struct cgroup *cgroup_rightmost_descenda* * If a subsystem synchronizes against the parent in its ->css_online() and * before starting iterating, and synchronizes against @pos on each -* iteration, any descendant cgroup which finished ->css_offline() is +* iteration, any descendant cgroup which finished ->css_online() is * guaranteed to be visible in the future iterations. * * In other words, the following guarantees that a descendant can't escape
kernel/cgroup.c +3 -6
@@ -3000,11 +3000,8 @@ struct cgroup *cgroup_next_descendant_prWARN_ON_ONCE (!rcu_read_lock_held ());/* if first iteration, pretend we just visited @cgroup */ -if (!pos) { -if (list_empty (&cgroup->children)) -return NULL ; +if (!pos) pos = cgroup; - }/* visit the first child if exists */ next = list_first_or_null_rcu(&pos->children, struct cgroup, sibling);
@@ -3012,14 +3009,14 @@ struct cgroup *cgroup_next_descendant_prreturn next;/* no child, visit my or the closest ancestor's next sibling */ -do { +while (pos != cgroup) { next = list_entry_rcu(pos->sibling.next, struct cgroup, sibling);if (&next->sibling != &pos->parent->children)return next; pos = pos->parent; - }while (pos != cgroup); + }return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 82/127 powerpc/32bit:Store temporary result in r0 instead of r8
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Priyanka Jain <[email protected]>
commit f7b3367774f92a688d39ed767f0ae9b93af7873a upstream.
Commit a9c4e541ea9b22944da356f2a9258b4eddcc953b "powerpc/kprobe: Complete kprobe and migrate exception frame" introduced a regression:
While returning from exception handling in case of PREEMPT enabled, _TIF_NEED_RESCHED bit is checked in TI_FLAGS (thread_info flag) of current task. Only if this bit is set, it should continue with the process of calling preempt_schedule_irq() to schedule highest priority task if available.
Current code assumes that r8 contains TI_FLAGS and check this for _TIF_NEED_RESCHED, but as r8 is modified in the code which executes before this check, r8 no longer contains the expected TI_FLAGS information.
As a result check for comparison with _TIF_NEED_RESCHED was failing even if NEED_RESCHED bit is set in the current thread_info flag. Due to this, preempt_schedule_irq() and in turn scheduler was not getting called even if highest priority task is ready for execution.
So, store temporary results in r0 instead of r8 to prevent r8 from getting modified as subsequent code is dependent on its value.
--- arch/powerpc/kernel/entry_32.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/entry_32.S +1 -1
@@ -851,7 +851,7 @@ resume_kernel: /* check current_thread_info, _TIF_EMULATE_STACK_STORE */ CURRENT_THREAD_INFO(r9, r1) lwz r8,TI_FLAGS(r9) - andis. r8,r8,_TIF_EMULATE_STACK_STORE@h + andis. r0,r8,_TIF_EMULATE_STACK_STORE@h beq+ 1f addi r8,r1,INT_FRAME_SIZE /* Get the kprobed function entry */
Greg Kroah-Hartman
maintainerPATCH 83/127 powerpc/tm: Make room for hypervisor in abort cause codes
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <[email protected]>
commit 35f7097fcedec63fcba1852dbee96f74a2d90878 upstream.
PAPR carves out 0xff-0xe0 for hypervisor use of transactional memory software abort cause codes. Unfortunately we don't respect this currently.
Below fixes this to move our cause codes to below this region.
--- arch/powerpc/include/asm/reg.h | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
arch/powerpc/include/asm/reg.h +8 -7
@@ -113,14 +113,15 @@/* Reason codes describing kernel causes for transaction aborts. By convention, bit0 is copied to TEXASR[56] (IBM bit 7) which is set if -the failure is persistent. +the failure is persistent. PAPR saves 0xff-0xe0 for the hypervisor. */ -#define TM_CAUSE_RESCHED 0xfe -#define TM_CAUSE_TLBI 0xfc -#define TM_CAUSE_FAC_UNAV 0xfa -#define TM_CAUSE_SYSCALL 0xf9/* Persistent */ -#define TM_CAUSE_MISC 0xf6 -#define TM_CAUSE_SIGNAL 0xf4 +#define TM_CAUSE_PERSISTENT 0x01 +#define TM_CAUSE_RESCHED 0xde +#define TM_CAUSE_TLBI 0xdc +#define TM_CAUSE_FAC_UNAV 0xda +#define TM_CAUSE_SYSCALL 0xd8/* future use */ +#define TM_CAUSE_MISC 0xd6/* future use */ +#define TM_CAUSE_SIGNAL 0xd4#if defined(CONFIG_PPC_BOOK3S_64 )#define MSR_64BIT MSR_SF
Greg Kroah-Hartman
maintainerPATCH 84/127 powerpc/tm: Update cause codes documentation
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <[email protected]>
commit 24b92375dc4ec8a15262e8aaaab60b7404d4b1e7 upstream.
--- Documentation/powerpc/transactional_memory.txt | 1 + 1 file changed, 1 insertion(+)
Documentation/powerpc/transactional_memory.txt +1 -0
@@ -155,6 +155,7 @@ These are defined in <asm/reg.h>, and di kernel aborted a transaction: TM_CAUSE_RESCHED Thread was rescheduled. + TM_CAUSE_TLBI Software TLB invalide. TM_CAUSE_FAC_UNAV FP/VEC/VSX unavailable trap. TM_CAUSE_SYSCALL Currently unused; future syscalls that must abort transactions for consistency will use this.
Greg Kroah-Hartman
maintainerPATCH 85/127 powerpc/tm: Fix userspace stack corruption on signal delivery for active transactions
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <[email protected]>
commit 2b3f8e87cf99a33fb6faf5026d7147748bbd77b6 upstream.
When in an active transaction that takes a signal, we need to be careful with the stack. It's possible that the stack has moved back up after the tbegin. The obvious case here is when the tbegin is called inside a function that returns before a tend. In this case, the stack is part of the checkpointed transactional memory state. If we write over this non transactionally or in suspend, we are in trouble because if we get a tm abort, the program counter and stack pointer will be back at the tbegin but our in memory stack won't be valid anymore.
To avoid this, when taking a signal in an active transaction, we need to use the stack pointer from the checkpointed state, rather than the speculated state. This ensures that the signal context (written tm suspended) will be written below the stack required for the rollback. The transaction is aborted becuase of the treclaim, so any memory written between the tbegin and the signal will be rolled back anyway.
For signals taken in non-TM or suspended mode, we use the normal/non-checkpointed stack pointer.
Tested with 64 and 32 bit signals
--- Documentation/powerpc/transactional_memory.txt | 19 +++++++++++ arch/powerpc/include/asm/processor.h | 13 ++------ arch/powerpc/include/asm/signal.h | 3 + arch/powerpc/kernel/signal.c | 40 +++++++++++++++++++++++-- arch/powerpc/kernel/signal.h | 2 - arch/powerpc/kernel/signal_32.c | 10 +----- arch/powerpc/kernel/signal_64.c | 23 ++++---------- 7 files changed, 74 insertions(+), 36 deletions(-)
Documentation/powerpc/transactional_memory.txt +19 -0
@@ -147,6 +147,25 @@ Example signal handler: fix_the_problem(ucp->dar); } +When in an active transaction that takes a signal, we need to be careful with +the stack. It's possible that the stack has moved back up after the tbegin. +The obvious case here is when the tbegin is called inside a function that +returns before a tend. In this case, the stack is part of the checkpointed +transactional memory state. If we write over this non transactionally or in +suspend, we are in trouble because if we get a tm abort, the program counter and +stack pointer will be back at the tbegin but our in memory stack won't be valid +anymore. + +To avoid this, when taking a signal in an active transaction, we need to use +the stack pointer from the checkpointed state, rather than the speculated +state. This ensures that the signal context (written tm suspended) will be +written below the stack required for the rollback. The transaction is aborted +becuase of the treclaim, so any memory written between the tbegin and the +signal will be rolled back anyway. + +For signals taken in non-TM or suspended mode, we use the +normal/non-checkpointed stack pointer. + Failure cause codes used by kernel ==================================
arch/powerpc/include/asm/processor.h +4 -9
@@ -407,21 +407,16 @@ static inline void prefetchw(const void#endif #ifdef CONFIG_PPC64 -static inline unsigned long get_clean_sp (struct pt_regs *regs,int is_32) +static inline unsigned long get_clean_sp (unsigned long sp,int is_32) { -unsigned long sp; -if (is_32) - sp = regs->gpr[1 ] &0x0ffffffffUL ; -else - sp = regs->gpr[1 ]; - +return sp &0x0ffffffffUL ;return sp; }#else -static inline unsigned long get_clean_sp (struct pt_regs *regs,int is_32) +static inline unsigned long get_clean_sp (unsigned long sp,int is_32) { -return regs->gpr[1 ]; +return sp; }#endif
arch/powerpc/include/asm/signal.h +3 -0
@@ -3,5 +3,8 @@#define __ARCH_HAS_SA_RESTORER#include <uapi/asm/signal.h> +#include <uapi/asm/ptrace.h> + +extern unsigned long get_tm_stackpointer (struct pt_regs *regs);#endif /* _ASM_POWERPC_SIGNAL_H */
arch/powerpc/kernel/signal.c +38 -2
@@ -17,6 +17,7 @@#include <asm/uaccess.h> #include <asm/unistd.h> #include <asm/debug.h> +#include <asm/tm.h> #include "signal.h"
@@ -29,13 +30,13 @@ int show_unhandled_signals = 0;/* * Allocate space for the signal frame */ -void __user *get_sigframe (struct k_sigaction *ka,struct pt_regs *regs, +void __user *get_sigframe (struct k_sigaction *ka,unsigned long sp,size_t frame_size,int is_32) {unsigned long oldsp, newsp;/* Default to using normal stack */ - oldsp =get_clean_sp (regs, is_32); + oldsp =get_clean_sp (sp, is_32);/* Check for alt stack */ if ((ka->sa.sa_flags & SA_ONSTACK) &&
@@ -170,3 +171,38 @@ void do_notify_resume(struct pt_regs *retracehook_notify_resume (regs); } } + +unsigned long get_tm_stackpointer (struct pt_regs *regs) +{ +/* When in an active transaction that takes a signal, we need to be +* careful with the stack. It's possible that the stack has moved back +* up after the tbegin. The obvious case here is when the tbegin is +* called inside a function that returns before a tend. In this case, +* the stack is part of the checkpointed transactional memory state. +* If we write over this non transactionally or in suspend, we are in +* trouble because if we get a tm abort, the program counter and stack +* pointer will be back at the tbegin but our in memory stack won't be +* valid anymore. +* +* To avoid this, when taking a signal in an active transaction, we +* need to use the stack pointer from the checkpointed state, rather +* than the speculated state. This ensures that the signal context +* (written tm suspended) will be written below the stack required for +* the rollback. The transaction is aborted becuase of the treclaim, +* so any memory written between the tbegin and the signal will be +* rolled back anyway. +* +* For signals taken in non-TM or suspended mode, we use the +* normal/non-checkpointed stack pointer. +*/ + +#ifdef CONFIG_PPC_TRANSACTIONAL_MEM +if (MSR_TM_ACTIVE (regs->msr)) { +tm_enable (); +tm_reclaim (¤t->thread, regs->msr,TM_CAUSE_SIGNAL ); +if (MSR_TM_TRANSACTIONAL (regs->msr)) +return current->thread.ckpt_regs.gpr[1 ]; + } +#endif +return regs->gpr[1 ]; +}
arch/powerpc/kernel/signal.h +1 -1
@@ -12,7 +12,7 @@extern void do_notify_resume (struct pt_regs *regs,unsigned long thread_info_flags); -extern void __user *get_sigframe (struct k_sigaction *ka,struct pt_regs *regs, +extern void __user *get_sigframe (struct k_sigaction *ka,unsigned long sp,size_t frame_size,int is_32); extern int handle_signal32(unsigned long sig, struct k_sigaction *ka,
arch/powerpc/kernel/signal_32.c +2 -8
@@ -503,12 +503,6 @@ static int save_tm_user_regs(struct pt_r {unsigned long msr = regs->msr; -/* tm_reclaim rolls back all reg states, updating thread.ckpt_regs, -* thread.transact_fpr[], thread.transact_vr[], etc. -*/ -tm_enable (); -tm_reclaim (¤t->thread, msr,TM_CAUSE_SIGNAL ); -/* Make sure floating point registers are stored in regs */ flush_fp_to_thread (current);
@@ -965,7 +959,7 @@ int handle_rt_signal32(unsigned long sig/* Set up Signal Frame */ /* Put a Real Time Context onto stack */ - rt_sf =get_sigframe (ka, regs,sizeof (*rt_sf),1 ); + rt_sf =get_sigframe (ka,get_tm_stackpointer (regs),sizeof (*rt_sf),1 ); addr = rt_sf;if (unlikely (rt_sf ==NULL )) goto badframe;
@@ -1403,7 +1397,7 @@ int handle_signal32(unsigned long sig, sunsigned long tramp;/* Set up Signal Frame */ - frame =get_sigframe (ka, regs,sizeof (*frame),1 ); + frame =get_sigframe (ka,get_tm_stackpointer (regs),sizeof (*frame),1 );if (unlikely (frame ==NULL )) goto badframe; sc = (struct sigcontext __user *) &frame->sctx;
arch/powerpc/kernel/signal_64.c +7 -16
@@ -154,11 +154,12 @@ static long setup_sigcontext(struct sigc* As above, but Transactional Memory is in use, so deliver sigcontexts * containing checkpointed and transactional register states. * -* To do this, we treclaim to gather both sets of registers and set up the -* 'normal' sigcontext registers with rolled-back register values such that a -* simple signal handler sees a correct checkpointed register state. -* If interested, a TM-aware sighandler can examine the transactional registers -* in the 2nd sigcontext to determine the real origin of the signal. +* To do this, we treclaim (done before entering here) to gather both sets of +* registers and set up the 'normal' sigcontext registers with rolled-back +* register values such that a simple signal handler sees a correct +* checkpointed register state. If interested, a TM-aware sighandler can +* examine the transactional registers in the 2nd sigcontext to determine the +* real origin of the signal. */ static long setup_tm_sigcontexts(struct sigcontext __user *sc, struct sigcontext __user *tm_sc,
@@ -184,16 +185,6 @@ static long setup_tm_sigcontexts(structBUG_ON (!MSR_TM_ACTIVE (regs->msr)); -/* tm_reclaim rolls back all reg states, saving checkpointed (older) -* GPRs to thread.ckpt_regs and (if used) FPRs to (newer) -* thread.transact_fp and/or VRs to (newer) thread.transact_vr. -* THEN we save out FP/VRs, if necessary, to the checkpointed (older) -* thread.fr[]/vr[]s. The transactional (newer) GPRs are on the -* stack, in *regs. -*/ -tm_enable (); -tm_reclaim (¤t->thread, msr,TM_CAUSE_SIGNAL ); -flush_fp_to_thread (current);#ifdef CONFIG_ALTIVEC
@@ -711,7 +702,7 @@ int handle_rt_signal64(int signr, structunsigned long newsp =0 ;long err =0 ; - frame =get_sigframe (ka, regs,sizeof (*frame),0 ); + frame =get_sigframe (ka,get_tm_stackpointer (regs),sizeof (*frame),0 );if (unlikely (frame ==NULL )) goto badframe;
Greg Kroah-Hartman
maintainerPATCH 86/127 powerpc/tm: Abort on emulation and alignment faults
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <[email protected]>
commit 6ce6c629fd8254b3177650de99699682ff7f6707 upstream.
If we are emulating an instruction inside an active user transaction that touches memory, the kernel can't emulate it as it operates in transactional suspend context. We need to abort these transactions and send them back to userspace for the hardware to rollback.
We can service these if the user transaction is in suspend mode, since the kernel will operate in the same suspend context.
This adds a check to all alignment faults and to specific instruction emulations (only string instructions for now). If the user process is in an active (non-suspended) transaction, we abort the transaction go back to userspace allowing the HW to roll back the transaction and tell the user of the failure. This also adds new tm abort cause codes to report the reason of the persistent error to the user.
Crappy test case here http://neuling.org/devel/junkcode/aligntm.c
--- Documentation/powerpc/transactional_memory.txt | 7 ++++-- arch/powerpc/include/asm/reg.h | 2 + arch/powerpc/kernel/traps.c | 29 +++++++++++++++++++++++++ 3 files changed, 36 insertions(+), 2 deletions(-)
Documentation/powerpc/transactional_memory.txt +5 -2
@@ -180,9 +180,12 @@ kernel aborted a transaction: transactions for consistency will use this. TM_CAUSE_SIGNAL Signal delivered. TM_CAUSE_MISC Currently unused. + TM_CAUSE_ALIGNMENT Alignment fault. + TM_CAUSE_EMULATE Emulation that touched memory. -These can be checked by the user program's abort handler as TEXASR[0:7]. - +These can be checked by the user program's abort handler as TEXASR[0:7]. If +bit 7 is set, it indicates that the error is consider persistent. For example +a TM_CAUSE_ALIGNMENT will be persistent while a TM_CAUSE_RESCHED will not.q GDB ===
arch/powerpc/include/asm/reg.h +2 -0
@@ -122,6 +122,8 @@#define TM_CAUSE_SYSCALL 0xd8/* future use */ #define TM_CAUSE_MISC 0xd6/* future use */ #define TM_CAUSE_SIGNAL 0xd4 +#define TM_CAUSE_ALIGNMENT 0xd2 +#define TM_CAUSE_EMULATE 0xd0#if defined(CONFIG_PPC_BOOK3S_64 )#define MSR_64BIT MSR_SF
arch/powerpc/kernel/traps.c +29 -0
@@ -52,6 +52,7 @@#ifdef CONFIG_PPC64 #include <asm/firmware.h> #include <asm/processor.h> +#include <asm/tm.h> #endif #include <asm/kexec.h> #include <asm/ppc-opcode.h>
@@ -913,6 +914,28 @@ static int emulate_isel(struct pt_regs *return 0 ; } +#ifdef CONFIG_PPC_TRANSACTIONAL_MEM +static inline bool tm_abort_check (struct pt_regs *regs,int cause) +{ +/* If we're emulating a load/store in an active transaction, we cannot +* emulate it as the kernel operates in transaction suspended context. +* We need to abort the transaction. This creates a persistent TM +* abort so tell the user what caused it with a new code. +*/ +if (MSR_TM_TRANSACTIONAL (regs->msr)) { +tm_enable (); +tm_abort (cause); +return true; + } +return false; +} +#else +static inline bool tm_abort_check (struct pt_regs *regs,int reason) +{ +return false; +} +#endif +static int emulate_instruction (struct pt_regs *regs) {u32 instword;
@@ -952,6 +975,9 @@ static int emulate_instruction(struct pt/* Emulate load/store string insn. */ if ((instword &PPC_INST_STRING_GEN_MASK ) ==PPC_INST_STRING ) { +if (tm_abort_check (regs, +TM_CAUSE_EMULATE |TM_CAUSE_PERSISTENT )) +return -EINVAL ;PPC_WARN_EMULATED (string, regs);return emulate_string_inst (regs, instword); }
@@ -1124,6 +1150,9 @@ void alignment_exception(struct pt_regsif (!arch_irq_disabled_regs (regs))local_irq_enable (); +if (tm_abort_check (regs,TM_CAUSE_ALIGNMENT |TM_CAUSE_PERSISTENT )) + goto bail; +/* we don't implement logging of alignment exceptions */ if (!(current->thread.align_ctl &PR_UNALIGN_SIGBUS )) fixed =fix_alignment (regs);
Greg Kroah-Hartman
maintainerPATCH 87/127 powerpc/tm: Move TM abort cause codes to uapi
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <[email protected]>
commit b75c100ef24894bd2c8b52e123bcc5f191c5d9fd upstream.
These cause codes are usable by userspace, so let's export to uapi.
--- arch/powerpc/include/asm/reg.h | 14 -------------- arch/powerpc/include/asm/tm.h | 2 ++ arch/powerpc/include/uapi/asm/Kbuild | 1 + arch/powerpc/include/uapi/asm/tm.h | 18 ++++++++++++++++++ 4 files changed, 21 insertions(+), 14 deletions(-)
arch/powerpc/include/asm/reg.h +0 -14
@@ -111,20 +111,6 @@#define MSR_TM_TRANSACTIONAL (x) (((x) & MSR_TS_MASK) == MSR_TS_T)#define MSR_TM_SUSPENDED (x) (((x) & MSR_TS_MASK) == MSR_TS_S) -/* Reason codes describing kernel causes for transaction aborts. By -convention, bit0 is copied to TEXASR[56] (IBM bit 7) which is set if -the failure is persistent. PAPR saves 0xff-0xe0 for the hypervisor. -*/ -#define TM_CAUSE_PERSISTENT 0x01 -#define TM_CAUSE_RESCHED 0xde -#define TM_CAUSE_TLBI 0xdc -#define TM_CAUSE_FAC_UNAV 0xda -#define TM_CAUSE_SYSCALL 0xd8/* future use */ -#define TM_CAUSE_MISC 0xd6/* future use */ -#define TM_CAUSE_SIGNAL 0xd4 -#define TM_CAUSE_ALIGNMENT 0xd2 -#define TM_CAUSE_EMULATE 0xd0 -#if defined(CONFIG_PPC_BOOK3S_64 )#define MSR_64BIT MSR_SF
arch/powerpc/include/asm/tm.h +2 -0
@@ -5,6 +5,8 @@* Copyright 2012 Matt Evans & Michael Neuling, IBM Corporation. */ +#include <uapi/asm/tm.h> +#ifdef CONFIG_PPC_TRANSACTIONAL_MEM extern void do_load_up_transact_fpu (struct thread_struct *thread);extern void do_load_up_transact_altivec (struct thread_struct *thread);
arch/powerpc/include/uapi/asm/Kbuild +1 -0
@@ -40,6 +40,7 @@ header-y += statfs.h header-y += swab.h header-y += termbits.h header-y += termios.h +header-y += tm.h header-y += types.h header-y += ucontext.h header-y += unistd.h
arch/powerpc/include/uapi/asm/tm.h new file +18 -0
@@ -0,0 +1,18 @@ +#ifndef _ASM_POWERPC_TM_H +#define _ASM_POWERPC_TM_H + +/* Reason codes describing kernel causes for transaction aborts. By +* convention, bit0 is copied to TEXASR[56] (IBM bit 7) which is set if +* the failure is persistent. PAPR saves 0xff-0xe0 for the hypervisor. +*/ +#define TM_CAUSE_PERSISTENT 0x01 +#define TM_CAUSE_RESCHED 0xde +#define TM_CAUSE_TLBI 0xdc +#define TM_CAUSE_FAC_UNAV 0xda +#define TM_CAUSE_SYSCALL 0xd8/* future use */ +#define TM_CAUSE_MISC 0xd6/* future use */ +#define TM_CAUSE_SIGNAL 0xd4 +#define TM_CAUSE_ALIGNMENT 0xd2 +#define TM_CAUSE_EMULATE 0xd0 + +#endif
Greg Kroah-Hartman
maintainerPATCH 88/127 iscsi-target: fix heap buffer overflow on error
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit cea4dcfdad926a27a18e188720efe0f2c9403456 upstream.
If a key was larger than 64 bytes, as checked by iscsi_check_key(), the error response packet, generated by iscsi_add_notunderstood_response(), would still attempt to copy the entire key into the packet, overflowing the structure on the heap.
Remote preauthentication kernel memory corruption was possible if a target was configured and listening on the network.
CVE-2013-2850
--- drivers/target/iscsi/iscsi_target_parameters.c | 8 +++----- drivers/target/iscsi/iscsi_target_parameters.h | 4 +++- 2 files changed, 6 insertions(+), 6 deletions(-)
drivers/target/iscsi/iscsi_target_parameters.c +3 -5
@@ -712,9 +712,9 @@ static int iscsi_add_notunderstood_respo }INIT_LIST_HEAD (&extra_response->er_list); -strncpy (extra_response->key, key,strlen (key) +1 ); -strncpy (extra_response->value,NOTUNDERSTOOD , -strlen (NOTUNDERSTOOD ) +1 ); +strlcpy (extra_response->key, key,sizeof (extra_response->key)); +strlcpy (extra_response->value,NOTUNDERSTOOD , +sizeof (extra_response->value));list_add_tail (&extra_response->er_list, ¶m_list->extra_response_list);
@@ -1583,8 +1583,6 @@ int iscsi_decode_text_input(if (phase &PHASE_SECURITY ) {if (iscsi_check_for_auth_key (key) >0 ) { -char *tmpptr = key +strlen (key); - *tmpptr ='=' ;kfree (tmpbuf);return 1 ; }
drivers/target/iscsi/iscsi_target_parameters.h +3 -1
@@ -1,8 +1,10 @@#ifndef ISCSI_PARAMETERS_H #define ISCSI_PARAMETERS_H +#include <scsi/iscsi_proto.h> +struct iscsi_extra_response { -char key[64 ]; +char key[KEY_MAXLEN ];char value[32 ];struct list_head er_list; }____cacheline_aligned ;
Greg Kroah-Hartman
maintainerPATCH 89/127 ib_srpt: Call target_sess_cmd_list_set_waiting during shutdown_session
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 1d19f7800d643b270b28d0a969c5eca455d54397 upstream.
Given that srpt_release_channel_work() calls target_wait_for_sess_cmds() to allow outstanding se_cmd_t->cmd_kref a change to complete, the call to perform target_sess_cmd_list_set_waiting() needs to happen in srpt_shutdown_session()
Also, this patch adds an explicit call to srpt_shutdown_session() within srpt_drain_channel() so that target_sess_cmd_list_set_waiting() will be called in the cases where TFO->shutdown_session() is not triggered directly by TCM.
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 32 ++++++++++++++++++++++++-------- drivers/infiniband/ulp/srpt/ib_srpt.h | 1 + 2 files changed, 25 insertions(+), 8 deletions(-)
drivers/infiniband/ulp/srpt/ib_srpt.c +24 -8
@@ -2227,6 +2227,27 @@ static void srpt_close_ch(struct srpt_rd }/** +* srpt_shutdown_session() - Whether or not a session may be shut down. +*/ +static int srpt_shutdown_session (struct se_session *se_sess) +{ +struct srpt_rdma_ch *ch = se_sess->fabric_sess_ptr; +unsigned long flags; + +spin_lock_irqsave (&ch->spinlock, flags); +if (ch->in_shutdown) { +spin_unlock_irqrestore (&ch->spinlock, flags); +return true; + } + + ch->in_shutdown = true; +target_sess_cmd_list_set_waiting (se_sess); +spin_unlock_irqrestore (&ch->spinlock, flags); + +return true; +} + +/** * srpt_drain_channel() - Drain a channel by resetting the IB queue pair. * @cm_id: Pointer to the CM ID of the channel to be drained. *
@@ -2264,6 +2285,9 @@ static void srpt_drain_channel(struct ibspin_unlock_irq (&sdev->spinlock);if (do_reset) { +if (ch->sess) +srpt_shutdown_session (ch->sess); + ret =srpt_ch_qp_err (ch);if (ret <0 ) printk(KERN_ERR "Setting queue pair in error state"
@@ -3467,14 +3491,6 @@ static void srpt_release_cmd(struct se_c }/** -* srpt_shutdown_session() - Whether or not a session may be shut down. -*/ -static int srpt_shutdown_session (struct se_session *se_sess) -{ -return true; -} - -/** * srpt_close_session() - Forcibly close a session. * * Callback function invoked by the TCM core to clean up sessions associated
drivers/infiniband/ulp/srpt/ib_srpt.h +1 -0
@@ -325,6 +325,7 @@ struct srpt_rdma_ch {u8 sess_name[36 ];struct work_struct release_work;struct completion *release_done; +bool in_shutdown; };/**
Greg Kroah-Hartman
maintainerPATCH 90/127 NFSv4: Fix a thinko in nfs4_try_open_cached
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit f448badd34700ae728a32ba024249626d49c10e1 upstream.
We need to pass the full open mode flags to nfs_may_open() when doing a delegated open.
--- fs/nfs/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/nfs4proc.c +1 -1
@@ -1022,7 +1022,7 @@ static struct nfs4_state *nfs4_try_open_struct nfs4_state *state = opendata->state;struct nfs_inode *nfsi =NFS_I (state->inode);struct nfs_delegation *delegation; -int open_mode = opendata->o_arg.open_flags & (O_EXCL |O_TRUNC ); +int open_mode = opendata->o_arg.open_flags;fmode_t fmode = opendata->o_arg.fmode;nfs4_stateid stateid;int ret = -EAGAIN ;
Greg Kroah-Hartman
maintainerPATCH 91/127 KVM: Emulate multibyte NOP
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit 103f98ea64a1b0a67d8a1b23070b4db3533db2b8 upstream.
This is encountered when booting RHEL5.9 64-bit. There is another bug after this one that is not a simple emulation failure, but this one lets the boot proceed a bit.
--- arch/x86/kvm/emulate.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/kvm/emulate.c +3 -1
@@ -3987,7 +3987,8 @@ static const struct opcode twobyte_tableDI (ImplicitOps | Priv, invd),DI (ImplicitOps | Priv, wbinvd),N ,N ,N ,D (ImplicitOps | ModRM),N ,N ,/* 0x10 - 0x1F */ -N ,N ,N ,N ,N ,N ,N ,N ,D (ImplicitOps | ModRM),N ,N ,N ,N ,N ,N ,N , +N ,N ,N ,N ,N ,N ,N ,N , +D (ImplicitOps | ModRM),N ,N ,N ,N ,N ,N ,D (ImplicitOps | ModRM),/* 0x20 - 0x2F */ DIP (ModRM | DstMem | Priv | Op3264, cr_read, check_cr_read), DIP(ModRM | DstMem | Priv | Op3264, dr_read, check_dr_read),
@@ -4825,6 +4826,7 @@ twobyte_insn:case 0x08 :/* invd */ case 0x0d :/* GrpP (prefetch) */ case 0x18 :/* Grp16 (prefetch/nop) */ +case 0x1f :/* nop */ break ;case 0x20 :/* mov cr, reg */ ctxt->dst.val = ops->get_cr (ctxt, ctxt->modrm_reg);
Greg Kroah-Hartman
maintainerPATCH 92/127 KVM: fix sil/dil/bpl/spl in the mod/rm fields
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit 8acb42070ec4c87a9baab5c7bac626030d5bef28 upstream.
The x86-64 extended low-byte registers were fetched correctly from reg, but not from mod/rm.
This fixes another bug in the boot of RHEL5.9 64-bit, but it is still not enough.
--- arch/x86/kvm/emulate.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/kvm/emulate.c +4 -1
@@ -1239,9 +1239,12 @@ static int decode_modrm(struct x86_emula ctxt->modrm_seg =VCPU_SREG_DS ;if (ctxt->modrm_mod ==3 ) { +int highbyte_regs = ctxt->rex_prefix ==0 ; + op->type =OP_REG ; op->bytes = (ctxt->d & ByteOp) ?1 : ctxt->op_bytes; - op->addr.reg =decode_register (ctxt, ctxt->modrm_rm, ctxt->d & ByteOp); + op->addr.reg =decode_register (ctxt, ctxt->modrm_rm, + highbyte_regs && (ctxt->d & ByteOp));if (ctxt->d & Sse) { op->type =OP_XMM ; op->bytes =16 ;
Greg Kroah-Hartman
maintainerPATCH 93/127 regulator: palmas: Fix "enable_reg" to point to the correct reg for SMPS10
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kishon Vijay Abraham I <[email protected]>
commit f232168df0c7e7414b70ac5d8fed83086d441c0b upstream.
regulator_enable_regmap() uses enable_reg to enable the regulator. But enable_reg for smps10 points to SMPS10_STATUS which is a read-only register. Fixed the same by having enable_reg set to SMPS10_CTRL.
--- drivers/regulator/palmas-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/palmas-regulator.c +1 -1
@@ -677,7 +677,7 @@ static int palmas_probe(struct platform_ pmic->desc[id].vsel_mask =SMPS10_VSEL ; pmic->desc[id].enable_reg =PALMAS_BASE_TO_REG (PALMAS_SMPS_BASE , -PALMAS_SMPS10_STATUS ); +PALMAS_SMPS10_CTRL ); pmic->desc[id].enable_mask =SMPS10_BOOST_EN ; pmic->desc[id].min_uV =3750000 ; pmic->desc[id].uV_step =1250000 ;
Greg Kroah-Hartman
maintainerPATCH 94/127 powerpc/pseries: Always enable CONFIG_HOTPLUG_CPU on PSERIES SMP
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Srivatsa S. Bhat" <[email protected]>
commit f274ef8747d3be649bba8708696fb31cb00fa75a upstream.
Adam Lackorzynski reported the following build failure on !CONFIG_HOTPLUG_CPU configuration:
CC arch/powerpc/kernel/rtas.oarch/powerpc/kernel/rtas.c: In function ‘rtas_cpu_state_change_mask’:arch/powerpc/kernel/rtas.c:843:4: error: implicit declaration of function ‘cpu_down’ [-Werror=implicit-function-declaration]
cc1: all warnings being treated as errors
make[1]: *** [arch/powerpc/kernel/rtas.o] Error 1
make: *** [arch/powerpc/kernel] Error 2
The build fails because cpu_down() is defined only under CONFIG_HOTPLUG_CPU.
Looking further, the mobility code in pseries is one of the call-sites which uses rtas_ibm_suspend_me(), which in turn calls rtas_cpu_state_change_mask(). And the mobility code is unconditionally compiled-in (it does not fall under any Kconfig option). And commit 120496ac (powerpc: Bring all threads online prior to migration/hibernation) which introduced this build regression is critical for the proper functioning of the migration code. So it appears that the only solution to this problem is to enable CONFIG_HOTPLUG_CPU if SMP is enabled on PPC_PSERIES platforms. So make that change in the Kconfig.
--- arch/powerpc/platforms/pseries/Kconfig | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/platforms/pseries/Kconfig +2 -0
@@ -18,6 +18,8 @@ config PPC_PSERIES select PPC_PCI_CHOICE if EXPERT select ZLIB_DEFLATE select PPC_DOORBELL + select HOTPLUG if SMP + select HOTPLUG_CPU if SMP default y config PPC_SPLPAR
Greg Kroah-Hartman
maintainerPATCH 95/127 reiserfs: fix deadlock with nfs racing on create/lookup
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Mahoney <[email protected]>
commit a1457c0ce976bad1356b9b0437f2a5c3ab8a9cfc upstream.
Reiserfs is currently able to be deadlocked by having two NFS clients where one has removed and recreated a file and another is accessing the file with an open file handle.
If one client deletes and recreates a file with timing such that the recreated file obtains the same [dirid, objectid] pair as the original file while another client accesses the file via file handle, the create and lookup can race and deadlock if the lookup manages to create the in-memory inode first.
The create thread, in insert_inode_locked4, will hold the write lock while waiting on the other inode to be unlocked. The lookup thread, anywhere in the iget path, will release and reacquire the write lock while it schedules. If it needs to reacquire the lock while the create thread has it, it will never be able to make forward progress because it needs to reacquire the lock before ultimately unlocking the inode.
This patch drops the write lock across the insert_inode_locked4 call so that the ordering of inode_wait -> write lock is retained. Since this would have been the case before the BKL push-down, this is safe.
--- fs/reiserfs/inode.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
fs/reiserfs/inode.c +7 -2
@@ -1810,11 +1810,16 @@ int reiserfs_new_inode(struct reiserfs_t TYPE_STAT_DATA, SD_SIZE, MAX_US_INT);memcpy (INODE_PKEY (inode), &(ih.ih_key),KEY_SIZE ); args.dirid =le32_to_cpu (ih.ih_key.k_dir_id); -if (insert_inode_locked4 (inode, args.objectid, - reiserfs_find_actor, &args) <0 ) { + +reiserfs_write_unlock (inode->i_sb); + err =insert_inode_locked4 (inode, args.objectid, + reiserfs_find_actor, &args); +reiserfs_write_lock (inode->i_sb); +if (err) { err = -EINVAL ; goto out_bad_inode; } +if (old_format_only (sb))/* not a perfect generation count, as object ids can be reused, but ** this is as good as reiserfs can do right now.
Greg Kroah-Hartman
maintainerPATCH 96/127 reiserfs: fix problems with chowning setuid file w/ xattrs
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Mahoney <[email protected]>
commit 4a8570112b76a63ad21cfcbe2783f98f7fd5ba1b upstream.
reiserfs_chown_xattrs() takes the iattr struct passed into ->setattr and uses it to iterate over all the attrs associated with a file to change ownership of xattrs (and transfer quota associated with the xattr files).
When the setuid bit is cleared during chown, ATTR_MODE and iattr->ia_mode are passed to all the xattrs as well. This means that the xattr directory will have S_IFREG added to its mode bits.
This has been prevented in practice by a missing IS_PRIVATE check in reiserfs_acl_chmod, which caused a double-lock to occur while holding the write lock. Since the file system was completely locked up, the writeout of the corrupted mode never happened.
This patch temporarily clears everything but ATTR_UID|ATTR_GID for the calls to reiserfs_setattr and adds the missing IS_PRIVATE check.
--- fs/reiserfs/xattr.c | 14 +++++++++++++- fs/reiserfs/xattr_acl.c | 3 +++ 2 files changed, 16 insertions(+), 1 deletion(-)
fs/reiserfs/xattr.c +13 -1
@@ -318,7 +318,19 @@ static int delete_one_xattr(struct dentrstatic int chown_one_xattr (struct dentry *dentry,void *data) {struct iattr *attrs = data; -return reiserfs_setattr (dentry, attrs); +int ia_valid = attrs->ia_valid; +int err; + +/* +* We only want the ownership bits. Otherwise, we'll do +* things like change a directory to a regular file if +* ATTR_MODE is set. +*/ + attrs->ia_valid &= (ATTR_UID |ATTR_GID ); + err =reiserfs_setattr (dentry, attrs); + attrs->ia_valid = ia_valid; + +return err; }/* No i_mutex, but the inode is unconnected. */
fs/reiserfs/xattr_acl.c +3 -0
@@ -443,6 +443,9 @@ int reiserfs_acl_chmod(struct inode *inoint depth;int error; +if (IS_PRIVATE (inode)) +return 0 ; +if (S_ISLNK (inode->i_mode))return -EOPNOTSUPP ;
Greg Kroah-Hartman
maintainerPATCH 97/127 reiserfs: fix spurious multiple-fill in reiserfs_readdir_dentry
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Mahoney <[email protected]>
commit 0bdc7acba56a7ca4232f15f37b16f7ec079385ab upstream.
After sleeping for filldir(), we check to see if the file system has changed and research. The next_pos pointer is updated but its value isn't pushed into the key used for the search itself. As a result, the search returns the same item that the last cycle of the loop did and filldir() is called multiple times with the same data.
The end result is that the buffer can contain the same name multiple times. This can be returned to userspace or used internally in the xattr code where it can manifest with the following warning:
jdm-20004 reiserfs_delete_xattrs: Couldn't delete all xattrs (-2)
reiserfs_for_each_xattr uses reiserfs_readdir_dentry to iterate over the xattr names and ends up trying to unlink the same name twice. The second attempt fails with -ENOENT and the error is returned. At some point I'll need to add support into reiserfsck to remove the orphaned directories left behind when this occurs.
The fix is to push the value into the key before researching.
--- fs/reiserfs/dir.c | 2 ++ 1 file changed, 2 insertions(+)
fs/reiserfs/dir.c +2 -0
@@ -204,6 +204,8 @@ int reiserfs_readdir_dentry(struct dentr next_pos =deh_offset (deh) +1 ;if (item_moved (&tmp_ih, &path_to_entry)) { +set_cpu_key_k_offset (&pos_key, + next_pos); goto research; } }/* for */
Greg Kroah-Hartman
maintainerPATCH 98/127 jfs: fix a couple races
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Kleikamp <[email protected]>
commit 73aaa22d5ffb2630456bac2f9a4ed9b81d0d7271 upstream.
This patch fixes races uncovered by xfstests testcase 068.
One race is the result of jfs_sync() trying to write a sync point to the journal after it has been frozen (or possibly in the process). Since freezing sync's the journal, there is no need to write a sync point so we simply want to return.
The second involves jfs_write_inode() being called on a deleted inode. It calls jfs_flush_journal which is held up by the jfs_commit thread doing the final iput on the same deleted inode, which itself is waiting for the I_SYNC flag to be cleared. jfs_write_inode need not do anything when i_nlink is zero, which is the easy fix.
--- fs/jfs/inode.c | 2 +- fs/jfs/jfs_logmgr.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
fs/jfs/inode.c +1 -1
@@ -125,7 +125,7 @@ int jfs_write_inode(struct inode *inode, {int wait = wbc->sync_mode ==WB_SYNC_ALL ; -if (test_cflag (COMMIT_Nolink, inode)) +if (inode->i_nlink ==0 )return 0 ;/* * If COMMIT_DIRTY is not set, the inode isn't really dirty.
fs/jfs/jfs_logmgr.c +2 -1
@@ -1058,7 +1058,8 @@ static int lmLogSync(struct jfs_log * lo*/ void jfs_syncpt (struct jfs_log *log,int hard_sync) {LOG_LOCK (log); -lmLogSync (log, hard_sync); +if (!test_bit (log_QUIESCE, &log->flag)) +lmLogSync (log, hard_sync);LOG_UNLOCK (log); }
Greg Kroah-Hartman
maintainerPATCH 99/127 xen-netback: remove skb in xen_netbk_alloc_page
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Liu <[email protected]>
commit 27f852282ab9a028f57da96d05c26f38c424a315 upstream.
This variable is never used.
--- drivers/net/xen-netback/netback.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/xen-netback/netback.c +2 -3
@@ -942,7 +942,6 @@ static int netbk_count_requests(struct x }static struct page *xen_netbk_alloc_page (struct xen_netbk *netbk, -struct sk_buff *skb,u16 pending_idx) {struct page *page;
@@ -976,7 +975,7 @@ static struct gnttab_copy *xen_netbk_get index =pending_index (netbk->pending_cons++); pending_idx = netbk->pending_ring[index]; - page =xen_netbk_alloc_page (netbk, skb, pending_idx); + page =xen_netbk_alloc_page (netbk, pending_idx);if (!page) goto err;
@@ -1381,7 +1380,7 @@ static unsigned xen_netbk_tx_build_gops( }/* XXX could copy straight to head */ - page =xen_netbk_alloc_page (netbk, skb, pending_idx); + page =xen_netbk_alloc_page (netbk, pending_idx);if (!page) {kfree_skb (skb);netbk_tx_err (vif, &txreq, idx);
Greg Kroah-Hartman
maintainerPATCH 100/127 iwlwifi: mvm: fix aggregation drain flow
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
commit e3d4bc8cc0230e8dc8033484666f03f87392a8c4 upstream.
Move the counter for non-AMPDU frames to mvm. It is needed for the drain flow which happens once the ieee80211_sta has been freed, so keeping it in iwl_mvm_sta which is embed into ieee80211_sta is not a good idea.
Also, since its purpose it to remove the STA in the fw only after all the frames for this station have exited the shared Tx queues, we need to decrement it in the reclaim flow. This flow can happen after ieee80211_sta has been removed, which means that we have no iwl_mvm_sta there. So we can't know what is the vif type. Hence, we know audit these frames for all the vif types.
In order to avoid spawning sta_drained_wk all the time, we now check that we are in a flow in which draining might happen - only when mvmsta is NULL. This is better than previous code that would spawn sta_drained_wk all the time in AP mode.
--- drivers/net/wireless/iwlwifi/mvm/mac80211.c | 2 - drivers/net/wireless/iwlwifi/mvm/mvm.h | 1 drivers/net/wireless/iwlwifi/mvm/sta.c | 13 +++++-- drivers/net/wireless/iwlwifi/mvm/sta.h | 2 - drivers/net/wireless/iwlwifi/mvm/tx.c | 48 +++++++++++++++++++++------- 5 files changed, 48 insertions(+), 18 deletions(-)
drivers/net/wireless/iwlwifi/mvm/mac80211.c +1 -1
@@ -886,7 +886,7 @@ static void iwl_mvm_mac_sta_notify(strucswitch (cmd) {case STA_NOTIFY_SLEEP : -if (atomic_read (&mvmsta->pending_frames) >0 ) +if (atomic_read (&mvm->pending_frames[mvmsta->sta_id]) >0 )ieee80211_sta_block_awake (hw, sta, true);/* * The fw updates the STA to be asleep. Tx packets on the Tx
drivers/net/wireless/iwlwifi/mvm/mvm.h +1 -0
@@ -293,6 +293,7 @@ struct iwl_mvm {struct ieee80211_sta __rcu *fw_id_to_mac_id[IWL_MVM_STATION_COUNT ];struct work_struct sta_drained_wk;unsigned long sta_drained[BITS_TO_LONGS (IWL_MVM_STATION_COUNT )]; +atomic_t pending_frames[IWL_MVM_STATION_COUNT ];/* configured by mac80211 */ u32 rts_threshold;
drivers/net/wireless/iwlwifi/mvm/sta.c +10 -3
@@ -172,7 +172,7 @@ int iwl_mvm_add_sta(struct iwl_mvm *mvm, mvm_sta->max_agg_bufsize =LINK_QUAL_AGG_FRAME_LIMIT_DEF ;/* HW restart, don't assume the memory has been zeroed */ -atomic_set (&mvm_sta->pending_frames,0 ); +atomic_set (&mvm->pending_frames[sta_id],0 ); mvm_sta->tid_disable_agg =0 ; mvm_sta->tfd_queue_msk =0 ;for (i =0 ; i <IEEE80211_NUM_ACS ; i++)
@@ -360,14 +360,21 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm, }/* +* Make sure that the tx response code sees the station as -EBUSY and +* calls the drain worker. +*/ +spin_lock_bh (&mvm_sta->lock); +/* * There are frames pending on the AC queues for this station. * We need to wait until all the frames are drained... */ -if (atomic_read (&mvm_sta->pending_frames)) { - ret =iwl_mvm_drain_sta (mvm, mvm_sta, true); +if (atomic_read (&mvm->pending_frames[mvm_sta->sta_id])) {rcu_assign_pointer (mvm->fw_id_to_mac_id[mvm_sta->sta_id],ERR_PTR (-EBUSY )); +spin_unlock_bh (&mvm_sta->lock); + ret =iwl_mvm_drain_sta (mvm, mvm_sta, true); }else { +spin_unlock_bh (&mvm_sta->lock); ret =iwl_mvm_rm_sta_common (mvm, mvm_sta->sta_id);rcu_assign_pointer (mvm->fw_id_to_mac_id[mvm_sta->sta_id],NULL ); }
drivers/net/wireless/iwlwifi/mvm/sta.h +0 -2
@@ -273,7 +273,6 @@ struct iwl_mvm_tid_data {* @max_agg_bufsize: the maximal size of the AGG buffer for this station * @lock: lock to protect the whole struct. Since %tid_data is access from Tx * and from Tx response flow, it needs a spinlock. -* @pending_frames: number of frames for this STA on the shared Tx queues. * @tid_data: per tid data. Look at %iwl_mvm_tid_data. * * When mac80211 creates a station it reserves some space (hw->sta_data_size)
@@ -288,7 +287,6 @@ struct iwl_mvm_sta {u16 tid_disable_agg;u8 max_agg_bufsize;spinlock_t lock; -atomic_t pending_frames;struct iwl_mvm_tid_data tid_data[IWL_MAX_TID_COUNT ];struct iwl_lq_sta lq_sta;struct ieee80211_vif *vif;
drivers/net/wireless/iwlwifi/mvm/tx.c +36 -12
61 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 101/127 iommu/amd: Re-enable IOMMU event log interrupt after handling.
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suravee Suthikulpanit <[email protected]>
commit 925fe08bce38d1ff052fe2209b9e2b8d5fbb7f98 upstream.
Current driver does not clear the IOMMU event log interrupt bit in the IOMMU status register after processing an interrupt. This causes the IOMMU hardware to generate event log interrupt only once. This has been observed in both IOMMU v1 and V2 hardware.
This patch clears the bit by writing 1 to bit 1 of the IOMMU status register (MMIO Offset 2020h)
--- drivers/iommu/amd_iommu.c | 3 +++ drivers/iommu/amd_iommu_types.h | 1 + 2 files changed, 4 insertions(+)
drivers/iommu/amd_iommu.c +3 -0
@@ -703,6 +703,9 @@ static void iommu_poll_events(struct amdu32 head, tail;unsigned long flags; +/* enable event interrupts again */ +writel (MMIO_STATUS_EVT_INT_MASK , iommu->mmio_base +MMIO_STATUS_OFFSET ); +spin_lock_irqsave (&iommu->lock, flags); head =readl (iommu->mmio_base +MMIO_EVT_HEAD_OFFSET );
drivers/iommu/amd_iommu_types.h +1 -0
@@ -99,6 +99,7 @@#define PASID_MASK 0x000fffff/* MMIO status bits */ +#define MMIO_STATUS_EVT_INT_MASK (1 << 1)#define MMIO_STATUS_COM_WAIT_INT_MASK (1 << 2)#define MMIO_STATUS_PPR_INT_MASK (1 << 6)
Greg Kroah-Hartman
maintainerPATCH 102/127 iommu/amd: Workaround for ERBT1312
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <[email protected]>
commit d3263bc29706e42f74d8800807c2dedf320d77f1 upstream.
Work around an IOMMU hardware bug where clearing the EVT_INT or PPR_INT bit in the status register may race with the hardware trying to set it again. When not handled the bit might not be cleared and we lose all future event or ppr interrupts.
--- drivers/iommu/amd_iommu.c | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-)
drivers/iommu/amd_iommu.c +26 -8
@@ -700,14 +700,23 @@ retry:static void iommu_poll_events (struct amd_iommu *iommu) { -u32 head, tail; +u32 head, tail, status;unsigned long flags; -/* enable event interrupts again */ -writel (MMIO_STATUS_EVT_INT_MASK , iommu->mmio_base +MMIO_STATUS_OFFSET ); -spin_lock_irqsave (&iommu->lock, flags); +/* enable event interrupts again */ +do { +/* +* Workaround for Erratum ERBT1312 +* Clearing the EVT_INT bit may race in the hardware, so read +* it again and make sure it was really cleared +*/ + status =readl (iommu->mmio_base +MMIO_STATUS_OFFSET ); +writel (MMIO_STATUS_EVT_INT_MASK , + iommu->mmio_base +MMIO_STATUS_OFFSET ); + }while (status &MMIO_STATUS_EVT_INT_MASK ); + head =readl (iommu->mmio_base +MMIO_EVT_HEAD_OFFSET ); tail =readl (iommu->mmio_base +MMIO_EVT_TAIL_OFFSET );
@@ -744,16 +753,25 @@ static void iommu_handle_ppr_entry(strucstatic void iommu_poll_ppr_log (struct amd_iommu *iommu) {unsigned long flags; -u32 head, tail; +u32 head, tail, status;if (iommu->ppr_log ==NULL )return ; -/* enable ppr interrupts again */ -writel (MMIO_STATUS_PPR_INT_MASK , iommu->mmio_base +MMIO_STATUS_OFFSET ); -spin_lock_irqsave (&iommu->lock, flags); +/* enable ppr interrupts again */ +do { +/* +* Workaround for Erratum ERBT1312 +* Clearing the PPR_INT bit may race in the hardware, so read +* it again and make sure it was really cleared +*/ + status =readl (iommu->mmio_base +MMIO_STATUS_OFFSET ); +writel (MMIO_STATUS_PPR_INT_MASK , + iommu->mmio_base +MMIO_STATUS_OFFSET ); + }while (status &MMIO_STATUS_PPR_INT_MASK ); + head =readl (iommu->mmio_base +MMIO_PPR_HEAD_OFFSET ); tail =readl (iommu->mmio_base +MMIO_PPR_TAIL_OFFSET );
Greg Kroah-Hartman
maintainerPATCH 103/127 ACPI / PM: Allow device power states to be used for CONFIG_PM unset
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
commit ec4602a9588a196fa1a9af46bfdd37cbf5792db4 upstream.
Currently, drivers/acpi/device_pm.c depends on CONFIG_PM and all of the functions defined in there are replaced with static inline stubs if that option is unset. However, CONFIG_PM means, roughly, "runtime PM or suspend/hibernation support" and some of those functions are useful regardless of that. For example, they are used by the ACPI fan driver for controlling fans and acpi_device_set_power() is called during device removal. Moreover, device initialization may depend on setting device power states properly.
For these reasons, make the routines manipulating ACPI device power states defined in drivers/acpi/device_pm.c available for CONFIG_PM unset too.
--- drivers/acpi/Makefile | 2 drivers/acpi/device_pm.c | 126 +++++++++++++++++++++++------------------------ include/acpi/acpi_bus.h | 40 +------------- 3 files changed, 70 insertions(+), 98 deletions(-)
drivers/acpi/Makefile +1 -1
@@ -24,7 +24,7 @@ acpi-y += nvs.o # Power management related files acpi-y += wakeup.o acpi-y += sleep.o -acpi-$(CONFIG_PM) += device_pm.o +acpi-y += device_pm.o acpi-$(CONFIG_ACPI_SLEEP) += proc.o
drivers/acpi/device_pm.c +64 -62
141 lines not on this page · raw message
include/acpi/acpi_bus.h +5 -35
@@ -352,7 +352,6 @@ acpi_status acpi_bus_get_status_handle(a unsigned long long *sta);int acpi_bus_get_status (struct acpi_device *device); -#ifdef CONFIG_PM int acpi_bus_set_power (acpi_handle handle,int state);const char *acpi_power_state_string (int state);int acpi_device_get_power (struct acpi_device *device,int *state);
@@ -360,41 +359,12 @@ int acpi_device_set_power(struct acpi_deint acpi_bus_init_power (struct acpi_device *device);int acpi_bus_update_power (acpi_handle handle,int *state_p);bool acpi_bus_power_manageable (acpi_handle handle); + +#ifdef CONFIG_PM bool acpi_bus_can_wakeup (acpi_handle handle); -#else /* !CONFIG_PM */ -static inline int acpi_bus_set_power (acpi_handle handle,int state) -{ -return 0 ; -} -static inline const char *acpi_power_state_string (int state) -{ -return "D0" ; -} -static inline int acpi_device_get_power (struct acpi_device *device,int *state) -{ -return 0 ; -} -static inline int acpi_device_set_power (struct acpi_device *device,int state) -{ -return 0 ; -} -static inline int acpi_bus_init_power (struct acpi_device *device) -{ -return 0 ; -} -static inline int acpi_bus_update_power (acpi_handle handle,int *state_p) -{ -return 0 ; -} -static inline bool acpi_bus_power_manageable (acpi_handle handle) -{ -return false; -} -static inline bool acpi_bus_can_wakeup (acpi_handle handle) -{ -return false; -} -#endif /* !CONFIG_PM */ +#else +static inline bool acpi_bus_can_wakeup (acpi_handle handle) {return false; } +#endif #ifdef CONFIG_ACPI_PROC_EVENT int acpi_bus_generate_proc_event (struct acpi_device *device,u8 type,int data);
Greg Kroah-Hartman
maintainerPATCH 104/127 ACPI / video: Add "Asus UL30A" to ACPI video detect blacklist
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bastian Triller <[email protected]>
commit c8f6d8351ba8c89d5cd4c562552ec7ec29274e31 upstream.
Like on UL30VT, the ACPI video driver can't control backlight correctly on Asus UL30A. Vendor driver (asus-laptop) can work. This patch is to add "Asus UL30A" to ACPI video detect blacklist in order to use asus-laptop for video control on the "Asus UL30A" rather than ACPI video driver.
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -164,6 +164,14 @@ static struct dmi_system_id video_detect DMI_MATCH(DMI_PRODUCT_NAME, "UL30VT"), }, }, + { + .callback = video_detect_force_vendor, + .ident = "Asus UL30A", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "UL30A"), + }, + }, { }, };
Greg Kroah-Hartman
maintainerPATCH 105/127 drm/nvc0/ce: disable ce1 on a number of chipsets
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
commit 6d5f83834dc2b064b8c1202ea281820286b675a8 upstream.
The falcon is present, but the rest of the copy engine doesn't appear to be... PUNITS doesn't report disabled (maybe the bits for the copy engines got added later?), so we end up trying to use a non-functional CE1, and bust all sorts of things.. Most notably, suspend/resume..
--- drivers/gpu/drm/nouveau/core/subdev/device/nvc0.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/nouveau/core/subdev/device/nvc0.c +0 -2
@@ -138,7 +138,6 @@ nvc0_identify(struct nouveau_device *dev device->oclass[NVDEV_ENGINE_BSP ] = &nvc0_bsp_oclass; device->oclass[NVDEV_ENGINE_PPP ] = &nvc0_ppp_oclass; device->oclass[NVDEV_ENGINE_COPY0 ] = &nvc0_copy0_oclass; - device->oclass[NVDEV_ENGINE_COPY1 ] = &nvc0_copy1_oclass; device->oclass[NVDEV_ENGINE_DISP ] = &nva3_disp_oclass;break ;case 0xce :
@@ -225,7 +224,6 @@ nvc0_identify(struct nouveau_device *dev device->oclass[NVDEV_ENGINE_BSP ] = &nvc0_bsp_oclass; device->oclass[NVDEV_ENGINE_PPP ] = &nvc0_ppp_oclass; device->oclass[NVDEV_ENGINE_COPY0 ] = &nvc0_copy0_oclass; - device->oclass[NVDEV_ENGINE_COPY1 ] = &nvc0_copy1_oclass; device->oclass[NVDEV_ENGINE_DISP ] = &nva3_disp_oclass;break ;case 0xc8 :
Greg Kroah-Hartman
maintainerPATCH 106/127 mac80211: fix direct probe auth
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <[email protected]>
commit 6211dd12da609bc6893b9c3182630b494737ec4b upstream.
We send direct probe to broadcast address, as some APs do not respond to unicast PROBE frames when unassociated. Broadcast frames are not acked, so we can not use that for trigger MLME state machine, but we need to use old timeout mechanism.
This fixes authentication timed out like below:
[ 1024.671974] wlan6: authenticate with 54:e6:fc:98:63:fe [ 1024.694125] wlan6: direct probe to 54:e6:fc:98:63:fe (try 1/3) [ 1024.695450] wlan6: direct probe to 54:e6:fc:98:63:fe (try 2/3) [ 1024.700586] wlan6: send auth to 54:e6:fc:98:63:fe (try 3/3) [ 1024.701441] wlan6: authentication with 54:e6:fc:98:63:fe timed out
With fix, we have:
[ 4524.198978] wlan6: authenticate with 54:e6:fc:98:63:fe [ 4524.220692] wlan6: direct probe to 54:e6:fc:98:63:fe (try 1/3) [ 4524.421784] wlan6: send auth to 54:e6:fc:98:63:fe (try 2/3) [ 4524.423272] wlan6: authenticated [ 4524.423811] wlan6: associate with 54:e6:fc:98:63:fe (try 1/3) [ 4524.427492] wlan6: RX AssocResp from 54:e6:fc:98:63:fe (capab=0x431 status=0 aid=1)
--- net/mac80211/mlme.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
net/mac80211/mlme.c +6 -6
@@ -3182,10 +3182,6 @@ static int ieee80211_probe_auth(struct iif (WARN_ON_ONCE (!auth_data))return -EINVAL ; -if (local->hw.flags &IEEE80211_HW_REPORTS_TX_ACK_STATUS ) - tx_flags =IEEE80211_TX_CTL_REQ_TX_STATUS | -IEEE80211_TX_INTFL_MLME_CONN_TX ; - auth_data->tries++;if (auth_data->tries >IEEE80211_AUTH_MAX_TRIES ) {
@@ -3219,6 +3215,10 @@ static int ieee80211_probe_auth(struct i auth_data->expected_transaction = trans; } +if (local->hw.flags &IEEE80211_HW_REPORTS_TX_ACK_STATUS ) + tx_flags =IEEE80211_TX_CTL_REQ_TX_STATUS | +IEEE80211_TX_INTFL_MLME_CONN_TX ; + ieee80211_send_auth(sdata, trans, auth_data->algorithm, status, auth_data->data, auth_data->data_len, auth_data->bss->bssid,
@@ -3242,12 +3242,12 @@ static int ieee80211_probe_auth(struct i* will not answer to direct packet in unassociated state. */ ieee80211_send_probe_req (sdata,NULL , ssidie +2 , ssidie[1 ], -NULL ,0 , (u32) -1 , true, tx_flags, +NULL ,0 , (u32) -1 , true,0 , auth_data->bss->channel, false);rcu_read_unlock (); } -if (!(local->hw.flags &IEEE80211_HW_REPORTS_TX_ACK_STATUS )) { +if (tx_flags ==0 ) { auth_data->timeout = jiffies +IEEE80211_AUTH_TIMEOUT ; ifmgd->auth_data->timeout_started = true;run_again (ifmgd, auth_data->timeout);
Greg Kroah-Hartman
maintainerPATCH 107/127 mac80211: close AP_VLAN interfaces before unregistering all
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit c8aa22db0112f640ac6631347f850879c621840b upstream.
Since Eric's commit efe117ab8 ("Speedup ieee80211_remove_interfaces") there's a bug in mac80211 when it unregisters with AP_VLAN interfaces up. If the AP_VLAN interface was registered after the AP it belongs to (which is the typical case) and then we get into this code path, unregister_netdevice_many() will crash because it isn't prepared to deal with interfaces being closed in the middle of it. Exactly this happens though, because we iterate the list, find the AP master this AP_VLAN belongs to and dev_close() the dependent VLANs. After this, unregister_netdevice_many() won't pick up the fact that the AP_VLAN is already down and will do it again, causing a crash.
--- net/mac80211/iface.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/mac80211/iface.c +9 -0
@@ -1649,6 +1649,15 @@ void ieee80211_remove_interfaces(structASSERT_RTNL (); +/* +* Close all AP_VLAN interfaces first, as otherwise they +* might be closed while the AP interface they belong to +* is closed, causing unregister_netdevice_many() to crash. +*/ +list_for_each_entry (sdata, &local->interfaces, list) +if (sdata->vif.type ==NL80211_IFTYPE_AP_VLAN ) +dev_close (sdata->dev); +mutex_lock (&local->iflist_mtx);list_for_each_entry_safe (sdata, tmp, &local->interfaces, list) {list_del (&sdata->list);
Greg Kroah-Hartman
maintainerPATCH 108/127 iwlwifi: dvm: fix zero LQ CMD sending avoidance
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
commit a87783699b23395c46bbeeb5d28f6db24897bf26 upstream.
In 63b77bf489881747c5118476918cc8c29378ee63
iwlwifi: dvm: don't send zeroed LQ cmd
I tried to avoid to send zeroed LQ cmd, but I made a (very) stupid mistake in the memcmp.
Since this patch has been ported to stable, the fix should go to stable too.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=58341
--- drivers/net/wireless/iwlwifi/dvm/sta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/iwlwifi/dvm/sta.c +1 -1
@@ -735,7 +735,7 @@ void iwl_restore_stations(struct iwl_primemcpy (&lq, priv->stations[i].lq,sizeof (struct iwl_link_quality_cmd )); -if (!memcmp (&lq, &zero_lq,sizeof (lq))) +if (memcmp (&lq, &zero_lq,sizeof (lq))) send_lq = true; }spin_unlock_bh (&priv->sta_lock);
Greg Kroah-Hartman
maintainerPATCH 109/127 iwlwifi: mvm: tell firmware to let multicast frames in
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
commit 51b6b9e029e81c857f9d8d17060f499cd25febdb upstream.
Without this command, the firmware will filter out all the multicast frames. Let them all in as for now. Later we will want to optimize this to save power.
--- drivers/net/wireless/iwlwifi/mvm/fw-api.h | 27 +++++++++++++++++++++++++++ drivers/net/wireless/iwlwifi/mvm/mac80211.c | 15 +++++++++++++++ drivers/net/wireless/iwlwifi/mvm/ops.c | 1 + 3 files changed, 43 insertions(+)
drivers/net/wireless/iwlwifi/mvm/fw-api.h +27 -0
@@ -165,6 +165,8 @@ enum {REPLY_DEBUG_CMD =0xf0 ,DEBUG_LOG_MSG =0xf7 , +MCAST_FILTER_CMD =0xd0 , +/* D3 commands/notifications */ D3_CONFIG_CMD =0xd3 , PROT_OFFLOAD_CONFIG_CMD = 0xd4,
@@ -951,4 +953,29 @@ struct iwl_set_calib_default_cmd { u8 data[0]; } __packed;/* PHY_CALIB_OVERRIDE_VALUES_S */ +#define MAX_PORT_ID_NUM 2 + +/** +* struct iwl_mcast_filter_cmd - configure multicast filter. +* @filter_own: Set 1 to filter out multicast packets sent by station itself +* @port_id: Multicast MAC addresses array specifier. This is a strange way +* to identify network interface adopted in host-device IF. +* It is used by FW as index in array of addresses. This array has +* MAX_PORT_ID_NUM members. +* @count: Number of MAC addresses in the array +* @pass_all: Set 1 to pass all multicast packets. +* @bssid: current association BSSID. +* @addr_list: Place holder for array of MAC addresses. +* IMPORTANT: add padding if necessary to ensure DWORD alignment. +*/ +struct iwl_mcast_filter_cmd { +u8 filter_own; +u8 port_id; +u8 count; +u8 pass_all; +u8 bssid[6 ]; +u8 reserved[2 ]; +u8 addr_list[0 ]; +} __packed;/* MCAST_FILTERING_CMD_API_S_VER_1 */ +#endif /* __fw_api_h__ */
drivers/net/wireless/iwlwifi/mvm/mac80211.c +15 -0
@@ -657,6 +657,20 @@ static void iwl_mvm_configure_filter(str *total_flags =0 ; } +static int iwl_mvm_configure_mcast_filter (struct iwl_mvm *mvm, +struct ieee80211_vif *vif) +{ +struct iwl_mcast_filter_cmd mcast_filter_cmd = { + .pass_all =1 , + }; + +memcpy (mcast_filter_cmd.bssid, vif->bss_conf.bssid,ETH_ALEN ); + +return iwl_mvm_send_cmd_pdu (mvm,MCAST_FILTER_CMD ,CMD_SYNC , +sizeof (mcast_filter_cmd), + &mcast_filter_cmd); +} + static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm, struct ieee80211_vif *vif, struct ieee80211_bss_conf *bss_conf,
@@ -677,6 +691,7 @@ static void iwl_mvm_bss_info_changed_staIWL_ERR (mvm,"failed to update quotas\n" );return ; } +iwl_mvm_configure_mcast_filter (mvm, vif); }else if (mvmvif->ap_sta_id !=IWL_MVM_STATION_COUNT ) {/* remove AP station now that the MAC is unassoc */ ret =iwl_mvm_rm_sta_id (mvm, vif, mvmvif->ap_sta_id);
drivers/net/wireless/iwlwifi/mvm/ops.c +1 -0
@@ -293,6 +293,7 @@ static const char *iwl_mvm_cmd_strings[RCMD (NET_DETECT_PROFILES_CMD ),CMD (NET_DETECT_HOTSPOTS_CMD ),CMD (NET_DETECT_HOTSPOTS_QUERY_CMD ), + CMD(MCAST_FILTER_CMD), };#undef CMD
Greg Kroah-Hartman
maintainerPATCH 110/127 cfg80211: check wdev->netdev in connection work
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit c815797663b72e3ac1736f1886538152bc48e4af upstream.
If a P2P-Device is present and another virtual interface triggers the connection work, the system crash because it tries to check if the P2P-Device's netdev (which doesn't exist) is up. Skip any wdevs that have no netdev to fix this.
--- net/wireless/sme.c | 3 +++ 1 file changed, 3 insertions(+)
net/wireless/sme.c +3 -0
@@ -227,6 +227,9 @@ void cfg80211_conn_work(struct work_strumutex_lock (&rdev->sched_scan_mtx);list_for_each_entry (wdev, &rdev->wdev_list, list) { +if (!wdev->netdev) +continue ; +wdev_lock (wdev);if (!netif_running (wdev->netdev)) {wdev_unlock (wdev);
Greg Kroah-Hartman
maintainerPATCH 111/127 ath9k: use correct OTP register offsets for AR9550
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
commit add295a4afbdf5852d004c754c552d692b0fcac8 upstream.
Accessing the OTP memory on AR9950 causes a data bus like this:
Data bus error, epc == 801f7774, ra == 801f7774 Oops[#1]:
CPU: 0 PID: 1 Comm: swapper Not tainted 3.10.0-rc3 #592
task: 87c28000 ti: 87c22000 task.ti: 87c22000
$ 0 : 00000000 00000061 deadc0de 00000000
$ 4 : b8115f18 00015f18 00000007 00000004
$ 8 : 00000001 7c7c3c7c 7c7c7c7c 7c7c7c7c
$12 : 7c7c3c7c 80320a68 00000000 7c7c7c3c
$16 : 87cd8010 00015f18 00000007 00000000
$20 : 00000064 00000004 87c23c7c 8035210c
$24 : 00000000 801f3674
$28 : 87c22000 87c23b48 00000001 801f7774
Hi : 00000000
Lo : 00000064
epc : 801f7774 ath9k_hw_wait+0x58/0xb0
Not tainted
ra : 801f7774 ath9k_hw_wait+0x58/0xb0
Status: 1000cc03 KERNEL EXL IE
Cause : 4080801c
PrId : 00019750 (MIPS 74Kc)
Modules linked in:
Process swapper (pid: 1, threadinfo=87c22000, task=87c28000, ts=00000000)
Stack : 0000000f 00000061 00002710 8006240c 00000001 87cd8010 87c23bb0 87cd8010
00000000 00000004 00000003 80210c7c 000000b3 67fa8000 0000032a 000006fe
000003e8 00000002 00000028 87c23bf0 000003ff 80210d24 803e5630 80210e28
00000000 00000007 87cd8010 00007044 00000004 00000061 000003ff 000001ff
87c26000 87cd8010 00000220 87cd8bb8 80210000 8020fcf4 87c22000 87c23c08
...
Call Trace:
[<801f7774>] ath9k_hw_wait+0x58/0xb0
[<80210c7c>] ar9300_otp_read_word+0x80/0xd4
[<80210d24>] ar9300_read_otp+0x54/0xb0
[<8020fcf4>] ar9300_check_eeprom_header+0x1c/0x40
[<80210fe4>] ath9k_hw_ar9300_fill_eeprom+0x118/0x39c
[<80206650>] ath9k_hw_eeprom_init+0x74/0xb4
[<801f96d0>] ath9k_hw_init+0x7ec/0x96c
[<801e65ec>] ath9k_init_device+0x340/0x758
[<801f35d0>] ath_ahb_probe+0x21c/0x2c0
[<801c041c>] driver_probe_device+0xc0/0x1e4
[<801c05ac>] __driver_attach+0x6c/0xa4
[<801bea08>] bus_for_each_dev+0x64/0xa8
[<801bfa40>] bus_add_driver+0xcc/0x24c
[<801c0954>] driver_register+0xbc/0x17c
[<803f8fc0>] ath9k_init+0x5c/0x88
[<800608fc>] do_one_initcall+0xec/0x1a0
[<803e6a68>] kernel_init_freeable+0x13c/0x200
[<80309cdc>] kernel_init+0x1c/0xe4
[<80062450>] ret_from_kernel_thread+0x10/0x18On the AR9550, the OTP registers are located at the same address as on the AR9340. Use the correct values to avoid the error.
--- drivers/net/wireless/ath/ath9k/ar9003_eeprom.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath9k/ar9003_eeprom.h +6 -3
@@ -68,13 +68,16 @@#define AR9300_BASE_ADDR 0x3ff#define AR9300_BASE_ADDR_512 0x1ff -#define AR9300_OTP_BASE (AR_SREV_9340(ah) ? 0x30000 : 0x14000) -#define AR9300_OTP_STATUS (AR_SREV_9340(ah) ? 0x30018 : 0x15f18) +#define AR9300_OTP_BASE \ + ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x30000 : 0x14000) +#define AR9300_OTP_STATUS \ + ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x30018 : 0x15f18)#define AR9300_OTP_STATUS_TYPE 0x7#define AR9300_OTP_STATUS_VALID 0x4#define AR9300_OTP_STATUS_ACCESS_BUSY 0x2#define AR9300_OTP_STATUS_SM_BUSY 0x1 -#define AR9300_OTP_READ_DATA (AR_SREV_9340(ah) ? 0x3001c : 0x15f1c) +#define AR9300_OTP_READ_DATA \ + ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x3001c : 0x15f1c)enum targetPowerHTRates {HT_TARGET_RATE_0_8_16 ,
Greg Kroah-Hartman
maintainerPATCH 112/127 tg3: Add read dma workaround for 5720
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nithin Sujir <[email protected]>
commit 9bc297ea0622bb2a6b3abfa2fa84f0a3b86ef8c8 upstream.
Commit 091f0ea30074bc43f9250961b3247af713024bc6 "tg3: Add New 5719 Read DMA workaround" added a workaround for TX DMA stall on the 5719. This workaround needs to be applied to the 5720 as well.
--- drivers/net/ethernet/broadcom/tg3.c | 21 +++++++++++++++------ drivers/net/ethernet/broadcom/tg3.h | 5 +++-- 2 files changed, 18 insertions(+), 8 deletions(-)
drivers/net/ethernet/broadcom/tg3.c +15 -6
@@ -9093,6 +9093,14 @@ static void tg3_rss_write_indir_tbl(stru } } +static inline u32 tg3_lso_rd_dma_workaround_bit (struct tg3 *tp) +{ +if (tg3_asic_rev (tp) ==ASIC_REV_5719 ) +return TG3_LSO_RD_DMA_TX_LENGTH_WA_5719 ; +else +return TG3_LSO_RD_DMA_TX_LENGTH_WA_5720 ; +} +/* tp->lock is held. */ static int tg3_reset_hw (struct tg3 *tp,int reset_phy) {
@@ -9772,16 +9780,17 @@ static int tg3_reset_hw(struct tg3 *tp,tw32_f (RDMAC_MODE , rdmac_mode);udelay (40 ); -if (tg3_asic_rev (tp) ==ASIC_REV_5719 ) { +if (tg3_asic_rev (tp) ==ASIC_REV_5719 || +tg3_asic_rev (tp) ==ASIC_REV_5720 ) {for (i =0 ; i <TG3_NUM_RDMA_CHANNELS ; i++) {if (tr32 (TG3_RDMA_LENGTH + (i <<2 )) >TG3_MAX_MTU (tp))break ; }if (i <TG3_NUM_RDMA_CHANNELS ) { val =tr32 (TG3_LSO_RD_DMA_CRPTEN_CTRL ); - val |=TG3_LSO_RD_DMA_TX_LENGTH_WA ; + val |=tg3_lso_rd_dma_workaround_bit (tp);tw32 (TG3_LSO_RD_DMA_CRPTEN_CTRL , val); - tg3_flag_set(tp, 5719_RDMA_BUG); + tg3_flag_set(tp, 5719_5720_RDMA_BUG); } }
@@ -10138,15 +10147,15 @@ static void tg3_periodic_fetch_stats(strTG3_STAT_ADD32 (&sp->tx_ucast_packets,MAC_TX_STATS_UCAST );TG3_STAT_ADD32 (&sp->tx_mcast_packets,MAC_TX_STATS_MCAST );TG3_STAT_ADD32 (&sp->tx_bcast_packets,MAC_TX_STATS_BCAST ); - if (unlikely(tg3_flag(tp, 5719_RDMA_BUG) && + if (unlikely(tg3_flag(tp, 5719_5720_RDMA_BUG) && (sp->tx_ucast_packets.low + sp->tx_mcast_packets.low + sp->tx_bcast_packets.low) >TG3_NUM_RDMA_CHANNELS )) {u32 val; val =tr32 (TG3_LSO_RD_DMA_CRPTEN_CTRL ); - val &= ~TG3_LSO_RD_DMA_TX_LENGTH_WA ; + val &= ~tg3_lso_rd_dma_workaround_bit (tp);tw32 (TG3_LSO_RD_DMA_CRPTEN_CTRL , val); - tg3_flag_clear(tp, 5719_RDMA_BUG); + tg3_flag_clear(tp, 5719_5720_RDMA_BUG); }TG3_STAT_ADD32 (&sp->rx_octets,MAC_RX_STATS_OCTETS );
drivers/net/ethernet/broadcom/tg3.h +3 -2
@@ -1422,7 +1422,8 @@#define TG3_LSO_RD_DMA_CRPTEN_CTRL 0x00004910#define TG3_LSO_RD_DMA_CRPTEN_CTRL_BLEN_BD_4K 0x00030000#define TG3_LSO_RD_DMA_CRPTEN_CTRL_BLEN_LSO_4K 0x000c0000 -#define TG3_LSO_RD_DMA_TX_LENGTH_WA 0x02000000 +#define TG3_LSO_RD_DMA_TX_LENGTH_WA_5719 0x02000000 +#define TG3_LSO_RD_DMA_TX_LENGTH_WA_5720 0x00200000/* 0x4914 --> 0x4be0 unused */ #define TG3_NUM_RDMA_CHANNELS 4
@@ -3043,7 +3044,7 @@ enum TG3_FLAGS {TG3_FLAG_APE_HAS_NCSI ,TG3_FLAG_TX_TSTAMP_EN ,TG3_FLAG_4K_FIFO_LIMIT , -TG3_FLAG_5719_RDMA_BUG , +TG3_FLAG_5719_5720_RDMA_BUG ,TG3_FLAG_RESET_TASK_PENDING ,TG3_FLAG_PTP_CAPABLE , TG3_FLAG_5705_PLUS,
Greg Kroah-Hartman
maintainerPATCH 113/127 net: can: kvaser_usb: fix reception on "USBcan Pro" and "USBcan R" type hardware.
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Peterson <[email protected]>
commit a90f13b24fb40d02d11496cce6a10ae8d4b319b2 upstream.
Unlike Kvaser Leaf light devices, some other Kvaser devices (like USBcan Pro, USBcan R) receive CAN messages in CMD_LOG_MESSAGE frames. This patch adds support for it.
--- drivers/net/can/usb/kvaser_usb.c | 68 +++++++++++++++++++++++++-------------- 1 file changed, 45 insertions(+), 23 deletions(-)
drivers/net/can/usb/kvaser_usb.c +45 -23
@@ -136,6 +136,9 @@#define KVASER_CTRL_MODE_SELFRECEPTION 3#define KVASER_CTRL_MODE_OFF 4 +/* log message */ +#define KVASER_EXTENDED_FRAME BIT(31) +struct kvaser_msg_simple {u8 tid;u8 channel;
@@ -817,8 +820,13 @@ static void kvaser_usb_rx_can_msg(const priv = dev->nets[channel]; stats = &priv->netdev->stats; -if (msg->u.rx_can.flag & (MSG_FLAG_ERROR_FRAME |MSG_FLAG_NERR | -MSG_FLAG_OVERRUN )) { +if ((msg->u.rx_can.flag &MSG_FLAG_ERROR_FRAME ) && + (msg->id ==CMD_LOG_MESSAGE )) { +kvaser_usb_rx_error (dev, msg); +return ; + }else if (msg->u.rx_can.flag & (MSG_FLAG_ERROR_FRAME | +MSG_FLAG_NERR | +MSG_FLAG_OVERRUN )) {kvaser_usb_rx_can_err (priv, msg);return ; }else if (msg->u.rx_can.flag & ~MSG_FLAG_REMOTE_FRAME ) {
@@ -834,22 +842,40 @@ static void kvaser_usb_rx_can_msg(constreturn ; } - cf->can_id = ((msg->u.rx_can.msg[0 ] &0x1f ) <<6 ) | - (msg->u.rx_can.msg[1 ] &0x3f ); - cf->can_dlc =get_can_dlc (msg->u.rx_can.msg[5 ]); - -if (msg->id ==CMD_RX_EXT_MESSAGE ) { - cf->can_id <<=18 ; - cf->can_id |= ((msg->u.rx_can.msg[2 ] &0x0f ) <<14 ) | - ((msg->u.rx_can.msg[3 ] &0xff ) <<6 ) | - (msg->u.rx_can.msg[4 ] &0x3f ); - cf->can_id |=CAN_EFF_FLAG ; - } - -if (msg->u.rx_can.flag &MSG_FLAG_REMOTE_FRAME ) - cf->can_id |=CAN_RTR_FLAG ; -else -memcpy (cf->data, &msg->u.rx_can.msg[6 ], cf->can_dlc); +if (msg->id ==CMD_LOG_MESSAGE ) { + cf->can_id =le32_to_cpu (msg->u.log_message.id); +if (cf->can_id &KVASER_EXTENDED_FRAME ) + cf->can_id &=CAN_EFF_MASK |CAN_EFF_FLAG ; +else + cf->can_id &=CAN_SFF_MASK ; + + cf->can_dlc =get_can_dlc (msg->u.log_message.dlc); + +if (msg->u.log_message.flags &MSG_FLAG_REMOTE_FRAME ) + cf->can_id |=CAN_RTR_FLAG ; +else +memcpy (cf->data, &msg->u.log_message.data, + cf->can_dlc); + }else { + cf->can_id = ((msg->u.rx_can.msg[0 ] &0x1f ) <<6 ) | + (msg->u.rx_can.msg[1 ] &0x3f ); + +if (msg->id ==CMD_RX_EXT_MESSAGE ) { + cf->can_id <<=18 ; + cf->can_id |= ((msg->u.rx_can.msg[2 ] &0x0f ) <<14 ) | + ((msg->u.rx_can.msg[3 ] &0xff ) <<6 ) | + (msg->u.rx_can.msg[4 ] &0x3f ); + cf->can_id |=CAN_EFF_FLAG ; + } + + cf->can_dlc =get_can_dlc (msg->u.rx_can.msg[5 ]); + +if (msg->u.rx_can.flag &MSG_FLAG_REMOTE_FRAME ) + cf->can_id |=CAN_RTR_FLAG ; +else +memcpy (cf->data, &msg->u.rx_can.msg[6 ], + cf->can_dlc); + }netif_rx (skb);
@@ -911,6 +937,7 @@ static void kvaser_usb_handle_message(cocase CMD_RX_STD_MESSAGE :case CMD_RX_EXT_MESSAGE : +case CMD_LOG_MESSAGE :kvaser_usb_rx_can_msg (dev, msg);break ;
@@ -919,11 +946,6 @@ static void kvaser_usb_handle_message(cokvaser_usb_rx_error (dev, msg);break ; -case CMD_LOG_MESSAGE : -if (msg->u.log_message.flags &MSG_FLAG_ERROR_FRAME ) -kvaser_usb_rx_error (dev, msg); -break ; -case CMD_TX_ACKNOWLEDGE :kvaser_usb_tx_acknowledge (dev, msg);break ;
Greg Kroah-Hartman
maintainerPATCH 114/127 IB/iser: Return error to upper layers on EAGAIN registration failures
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Or Gerlitz <[email protected]>
commit 450d1e40d597dd71843457c73d372c4b4f2a83eb upstream.
Commit 819a087316a6 ("IB/iser: Avoid error prints on EAGAIN registration failures") not only eliminated the error print on that case, but rather also modified the code such that it doesn't return any error to upper layers. As a result a wrong mapping was used. Fix this to correctly return the error in that case.
--- drivers/infiniband/ulp/iser/iser_memory.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/ulp/iser/iser_memory.c +2 -1
@@ -416,8 +416,9 @@ int iser_reg_rdma_mem(struct iscsi_iser_for (i=0 ; i<ib_conn->page_vec->length ; i++)iser_err ("page_vec[%d] = 0x%llx\n" , i, (unsigned long long ) ib_conn->page_vec->pages[i]); -return err; } +if (err) +return err; }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 115/127 ASoC: davinci: fix sample rotation
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Mack <[email protected]>
commit 796718925159523919a589ecbd6d1811c22ef55f upstream.
McASP serial audio engine needs different rotation values on TX and RX channels. Commit dde109fb462 ("ASoC: McASP: Fix data rotation for playback. Enables 24bit audio playback") changed the calculation to fix the playback format, but broke the capture stream by doing it for both TXFMT and RXFMT.
--- sound/soc/davinci/davinci-mcasp.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
sound/soc/davinci/davinci-mcasp.c +4 -3
@@ -626,7 +626,8 @@ static int davinci_config_channel_size(s int word_length) {u32 fmt; -u32 rotate = (word_length /4 ) &0x7 ; +u32 tx_rotate = (word_length /4 ) &0x7 ; +u32 rx_rotate = (32 - word_length) /4 ;u32 mask = (1ULL << word_length) -1 ;/*
@@ -647,9 +648,9 @@ static int davinci_config_channel_size(s RXSSZ(fmt), RXSSZ(0x0F));mcasp_mod_bits (dev->base +DAVINCI_MCASP_TXFMT_REG ,TXSSZ (fmt),TXSSZ (0x0F )); -mcasp_mod_bits (dev->base +DAVINCI_MCASP_TXFMT_REG ,TXROT (rotate), +mcasp_mod_bits (dev->base +DAVINCI_MCASP_TXFMT_REG ,TXROT (tx_rotate),TXROT (7 )); -mcasp_mod_bits (dev->base +DAVINCI_MCASP_RXFMT_REG ,RXROT (rotate), +mcasp_mod_bits (dev->base +DAVINCI_MCASP_RXFMT_REG ,RXROT (rx_rotate),RXROT (7 ));mcasp_set_reg (dev->base +DAVINCI_MCASP_TXMASK_REG , mask);mcasp_set_reg (dev->base +DAVINCI_MCASP_RXMASK_REG , mask);
Greg Kroah-Hartman
maintainerPATCH 116/127 fuse: fix readdirplus Oops in fuse_dentry_revalidate
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit 28420dad233520811c0e0860e7fb4975ed863fc4 upstream.
Fix bug introduced by commit 4582a4ab2a "FUSE: Adapt readdirplus to application usage patterns".
We need to check for a positive dentry; negative dentries are not added by readdirplus. Secondly we need to advise the use of readdirplus on the *parent*, otherwise the whole thing is useless. Thirdly all this is only relevant if "readdirplus_auto" mode is selected by the filesystem.
We advise the use of readdirplus only if the dentry was still valid. If we had to redo the lookup then there was no use in doing the -plus version.
--- fs/fuse/dir.c | 12 +++++++++--- fs/fuse/inode.c | 7 ++++--- 2 files changed, 13 insertions(+), 6 deletions(-)
fs/fuse/dir.c +9 -3
@@ -180,6 +180,8 @@ u64 fuse_get_attr_version(struct fuse_costatic int fuse_dentry_revalidate (struct dentry *entry,unsigned int flags) {struct inode *inode; +struct dentry *parent; +struct fuse_conn *fc; inode =ACCESS_ONCE (entry->d_inode);if (inode &&is_bad_inode (inode))
@@ -187,10 +189,8 @@ static int fuse_dentry_revalidate(structelse if (fuse_dentry_time (entry) <get_jiffies_64 ()) {int err;struct fuse_entry_out outarg; -struct fuse_conn *fc;struct fuse_req *req;struct fuse_forget_link *forget; -struct dentry *parent;u64 attr_version;/* For negative dentries, always do a fresh lookup */
@@ -241,8 +241,14 @@ static int fuse_dentry_revalidate(structentry_attr_timeout (&outarg), attr_version);fuse_change_entry_timeout (entry, &outarg); + }else if (inode) { + fc =get_fuse_conn (inode); +if (fc->readdirplus_auto) { + parent =dget_parent (entry); +fuse_advise_use_readdirplus (parent->d_inode); +dput (parent); + } } -fuse_advise_use_readdirplus (inode);return 1 ; }
fs/fuse/inode.c +4 -3
@@ -864,10 +864,11 @@ static void process_init_reply(struct fu fc->dont_mask =1 ;if (arg->flags &FUSE_AUTO_INVAL_DATA ) fc->auto_inval_data =1 ; -if (arg->flags &FUSE_DO_READDIRPLUS ) +if (arg->flags &FUSE_DO_READDIRPLUS ) { fc->do_readdirplus =1 ; -if (arg->flags &FUSE_READDIRPLUS_AUTO ) - fc->readdirplus_auto =1 ; +if (arg->flags &FUSE_READDIRPLUS_AUTO ) + fc->readdirplus_auto =1 ; + } }else { ra_pages = fc->max_read /PAGE_CACHE_SIZE ; fc->no_lock =1 ;
Greg Kroah-Hartman
maintainerPATCH 117/127 target: Re-instate sess_wait_list for target_wait_for_sess_cmds
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 9b31a328e344e62e7cc98ae574edcb7b674719bb upstream.
Switch back to pre commit 1c7b13fe652 list splicing logic for active I/O shutdown with tcm_qla2xxx + ib_srpt fabrics.
The original commit was done under the incorrect assumption that it's safe to walk se_sess->sess_cmd_list unprotected in target_wait_for_sess_cmds() after sess->sess_tearing_down = 1 has been set by target_sess_cmd_list_set_waiting() during session shutdown.
So instead of adding sess->sess_cmd_lock protection around sess->sess_cmd_list during target_wait_for_sess_cmds(), switch back to sess->sess_wait_list to allow wait_for_completion() + TFO->release_cmd() to occur without having to walk ->sess_cmd_list after the list_splice.
Also add a check to exit if target_sess_cmd_list_set_waiting() has already been called, and add a WARN_ON to check for any fabric bug where new se_cmds are added to sess->sess_cmd_list after sess->sess_tearing_down = 1 has already been set.
--- drivers/target/target_core_transport.c | 18 ++++++++++++++---- include/target/target_core_base.h | 1 + 2 files changed, 15 insertions(+), 4 deletions(-)
drivers/target/target_core_transport.c +14 -4
@@ -222,6 +222,7 @@ struct se_session *transport_init_sessioINIT_LIST_HEAD (&se_sess->sess_list);INIT_LIST_HEAD (&se_sess->sess_acl_list);INIT_LIST_HEAD (&se_sess->sess_cmd_list); +INIT_LIST_HEAD (&se_sess->sess_wait_list);spin_lock_init (&se_sess->sess_cmd_lock);kref_init (&se_sess->sess_kref);
@@ -2252,11 +2253,14 @@ void target_sess_cmd_list_set_waiting(stunsigned long flags;spin_lock_irqsave (&se_sess->sess_cmd_lock, flags); - -WARN_ON (se_sess->sess_tearing_down); +if (se_sess->sess_tearing_down) { +spin_unlock_irqrestore (&se_sess->sess_cmd_lock, flags); +return ; + } se_sess->sess_tearing_down =1 ; +list_splice_init (&se_sess->sess_cmd_list, &se_sess->sess_wait_list); -list_for_each_entry (se_cmd, &se_sess->sess_cmd_list, se_cmd_list) +list_for_each_entry (se_cmd, &se_sess->sess_wait_list, se_cmd_list) se_cmd->cmd_wait_set =1 ;spin_unlock_irqrestore (&se_sess->sess_cmd_lock, flags);
@@ -2273,9 +2277,10 @@ void target_wait_for_sess_cmds( {struct se_cmd *se_cmd, *tmp_cmd;bool rc = false; +unsigned long flags;list_for_each_entry_safe (se_cmd, tmp_cmd, - &se_sess->sess_cmd_list, se_cmd_list) { + &se_sess->sess_wait_list, se_cmd_list) {list_del (&se_cmd->se_cmd_list); pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:"
@@ -2303,6 +2308,11 @@ void target_wait_for_sess_cmds( se_cmd->se_tfo->release_cmd (se_cmd); } + +spin_lock_irqsave (&se_sess->sess_cmd_lock, flags); +WARN_ON (!list_empty (&se_sess->sess_cmd_list)); +spin_unlock_irqrestore (&se_sess->sess_cmd_lock, flags); + }EXPORT_SYMBOL (target_wait_for_sess_cmds);
include/target/target_core_base.h +1 -0
@@ -544,6 +544,7 @@ struct se_session {struct list_head sess_list;struct list_head sess_acl_list;struct list_head sess_cmd_list; +struct list_head sess_wait_list;spinlock_t sess_cmd_lock;struct kref sess_kref; };
Greg Kroah-Hartman
maintainerPATCH 118/127 target/file: Fix off-by-one READ_CAPACITY bug for !S_ISBLK export
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 21363ca873334391992f2f424856aa864345bb61 upstream.
This patch fixes a bug where FILEIO was incorrectly reporting the number of logical blocks (+ 1) when using non struct block_device export mode.
It changes fd_get_blocks() to follow all other backend ->get_blocks() cases, and reduces the calculated dev_size by one dev->dev_attrib.block_size number of bytes, and also fixes initial fd_block_size assignment at fd_configure_device() time introduced in commit 0fd97ccf4.
--- drivers/target/target_core_file.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/target/target_core_file.c +7 -5
@@ -150,6 +150,7 @@ static int fd_configure_device(struct seif (S_ISBLK (inode->i_mode)) {unsigned long long dev_size; + fd_dev->fd_block_size =bdev_logical_block_size (inode->i_bdev);/* * Determine the number of bytes from i_size_read() minus * one (1) logical sector from underlying struct block_device
@@ -168,11 +169,11 @@ static int fd_configure_device(struct se " block_device\n"); goto fail; } - } - fd_dev->fd_block_size = dev->dev_attrib.hw_block_size; + fd_dev->fd_block_size =FD_BLOCKSIZE ; + } - dev->dev_attrib.hw_block_size =FD_BLOCKSIZE ; + dev->dev_attrib.hw_block_size = fd_dev->fd_block_size; dev->dev_attrib.hw_max_sectors =FD_MAX_SECTORS ; dev->dev_attrib.hw_queue_depth =FD_MAX_DEVICE_QUEUE_DEPTH ;
@@ -583,11 +584,12 @@ static sector_t fd_get_blocks(struct se_* to handle underlying block_device resize operations. */ if (S_ISBLK (i->i_mode)) - dev_size = (i_size_read (i) - fd_dev->fd_block_size); + dev_size =i_size_read (i);else dev_size = fd_dev->fd_dev_size; -return div_u64 (dev_size, dev->dev_attrib.block_size); +return div_u64 (dev_size - dev->dev_attrib.block_size, + dev->dev_attrib.block_size); }static struct sbc_ops fd_sbc_ops = {
Greg Kroah-Hartman
maintainerPATCH 119/127 leds: leds-gpio: reserve gpio before using it
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timo Teräs <[email protected]>
commit 803d19d57a042e86e9e9b685bbc3f4a0a751040f upstream.
This reverts commit a99d76f (leds: leds-gpio: use gpio_request_one) and commit 2d7c22f (leds: leds-gpio: set devm_gpio_request_one() flags param correctly) which was a fix of the first one.
The conversion to devm_gpio_request in commit e3b1d44c (leds:
leds-gpio: use devm_gpio_request_one) is not reverted.
The problem is that gpio_cansleep() and gpio_get_value_cansleep() calls can crash if the gpio is not first reserved. Incidentally this same bug existed earlier and was fixed similarly in commit d95cbe61 (leds: Fix potential leds-gpio oops). But the OOPS is real. It happens when GPIOs are provided by module which is not yet loaded.
So this fixes the following BUG during my ALIX boot (3.9.2-vanilla):
BUG: unable to handle kernel NULL pointer dereference at 0000004c IP: [<c11287d6>] __gpio_cansleep+0xe/0x1a *pde = 00000000 Oops: 0000 [#1] SMP Modules linked in: leds_gpio(+) via_rhine mii cs5535_mfd mfd_core
geode_rng rng_core geode_aes isofs nls_utf8 nls_cp437 vfat fat ata_generic pata_amd pata_cs5536 pata_acpi libata ehci_pci ehci_hcd ohci_hcd usb_storage usbcore usb_common sd_mod scsi_mod squashfs loop
Pid: 881, comm: modprobe Not tainted 3.9.2 #1-Alpine
EIP: 0060:[<c11287d6>] EFLAGS: 00010282 CPU: 0
EIP is at __gpio_cansleep+0xe/0x1a
EAX: 00000000 EBX: cf364018 ECX: c132b8b9 EDX: 00000000
ESI: c13993a4 EDI: c1399370 EBP: cded9dbc ESP: cded9dbc
DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
CR0: 8005003b CR2: 0000004c CR3: 0f0c4000 CR4: 00000090
DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
DR6: ffff0ff0 DR7: 00000400
Process modprobe (pid: 881, ti=cded8000 task=cf094aa0 task.ti=cded8000)
Stack: cded9de0 d09471cb 00000000 c1399260 cf364014 00000000 c1399260 c1399254 d0949014 cded9df4 c118cd59 c1399260 d0949014 d0949014 cded9e08 c118ba47 c1399260 d0949014 c1399294 cded9e1c c118bb75 cded9e24 d0949014 00000000 Call Trace: [<d09471cb>] gpio_led_probe+0xba/0x203 [leds_gpio] [<c118cd59>] platform_drv_probe+0x26/0x48 [<c118ba47>] driver_probe_device+0x75/0x15c [<c118bb75>] __driver_attach+0x47/0x63 [<c118a727>] bus_for_each_dev+0x3c/0x66 [<c118b6f9>] driver_attach+0x14/0x16 [<c118bb2e>] ? driver_probe_device+0x15c/0x15c [<c118b3d5>] bus_add_driver+0xbd/0x1bc [<d08b4000>] ? 0xd08b3fff [<d08b4000>] ? 0xd08b3fff [<c118bffc>] driver_register+0x74/0xec [<d08b4000>] ? 0xd08b3fff [<c118c8e8>] platform_driver_register+0x38/0x3a [<d08b400d>] gpio_led_driver_init+0xd/0x1000 [leds_gpio] [<c100116c>] do_one_initcall+0x6b/0x10f [<d08b4000>] ? 0xd08b3fff [<c105e918>] load_module+0x1631/0x1907 [<c10975d6>] ? insert_vmalloc_vmlist+0x14/0x43 [<c1098d5b>] ? __vmalloc_node_range+0x13e/0x15f [<c105ec50>] sys_init_module+0x62/0x77 [<c1257888>] syscall_call+0x7/0xb EIP: [<c11287d6>] __gpio_cansleep+0xe/0x1a SS:ESP 0068:cded9dbc CR2: 000000000000004c ---[ end trace 5308fb20d2514822 ]---
--- drivers/leds/leds-gpio.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/leds/leds-gpio.c +5 -4
@@ -107,6 +107,10 @@ static int create_gpio_led(const structreturn 0 ; } + ret =devm_gpio_request (parent, template->gpio, template->name); +if (ret <0 ) +return ret; + led_dat->cdev.name = template->name; led_dat->cdev.default_trigger = template->default_trigger; led_dat->gpio = template->gpio;
@@ -126,10 +130,7 @@ static int create_gpio_led(const structif (!template->retain_state_suspended) led_dat->cdev.flags |=LED_CORE_SUSPENDRESUME ; - ret =devm_gpio_request_one (parent, template->gpio, - (led_dat->active_low ^ state) ? -GPIOF_OUT_INIT_HIGH :GPIOF_OUT_INIT_LOW , - template->name); + ret =gpio_direction_output (led_dat->gpio, led_dat->active_low ^ state);if (ret <0 )return ret;
Greg Kroah-Hartman
maintainerPATCH 120/127 xen-netback: coalesce slots in TX path and fix regressions
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Liu <[email protected]>
commit 2810e5b9a7731ca5fce22bfbe12c96e16ac44b6f upstream.
This patch tries to coalesce tx requests when constructing grant copy structures. It enables netback to deal with situation when frontend's MAX_SKB_FRAGS is larger than backend's MAX_SKB_FRAGS.
With the help of coalescing, this patch tries to address two regressions avoid reopening the security hole in XSA-39.
Regression 1. The reduction of the number of supported ring entries (slots) per packet (from 18 to 17). This regression has been around for some time but remains unnoticed until XSA-39 security fix. This is fixed by coalescing slots.
Regression 2. The XSA-39 security fix turning "too many frags" errors from just dropping the packet to a fatal error and disabling the VIF. This is fixed by coalescing slots (handling 18 slots when backend's MAX_SKB_FRAGS is 17) which rules out false positive (using 18 slots is legit) and dropping packets using 19 to max_skb_slots slots.
To avoid reopening security hole in XSA-39, frontend sending packet using more than max_skb_slots is considered malicious.
The behavior of netback for packet is thus:
1-18 slots: valid
19-max_skb_slots slots: drop and respond with an error
max_skb_slots+ slots: fatal error
max_skb_slots is configurable by admin, default value is 20.
Also change variable name from "frags" to "slots" in netbk_count_requests.
Please note that RX path still has dependency on MAX_SKB_FRAGS. This will be fixed with separate patch.
--- drivers/net/xen-netback/netback.c | 271 +++++++++++++++++++++++++++++++------- include/xen/interface/io/netif.h | 18 ++ 2 files changed, 240 insertions(+), 49 deletions(-)
drivers/net/xen-netback/netback.c +222 -49
@@ -47,11 +47,25 @@#include <asm/xen/hypercall.h> #include <asm/xen/page.h> +/* +* This is the maximum slots a skb can have. If a guest sends a skb +* which exceeds this limit it is considered malicious. +*/ +#define MAX_SKB_SLOTS_DEFAULT 20 +static unsigned int max_skb_slots =MAX_SKB_SLOTS_DEFAULT ; +module_param (max_skb_slots, uint,0444 ); + +typedef unsigned int pending_ring_idx_t ; +#define INVALID_PENDING_RING_IDX (~0U) +struct pending_tx_info { -struct xen_netif_tx_request req; +struct xen_netif_tx_request req;/* coalesced tx request */ struct xenvif *vif; +pending_ring_idx_t head;/* head != INVALID_PENDING_RING_IDX +* if it is head of one or more tx +* reqs +*/ }; -typedef unsigned int pending_ring_idx_t ;struct netbk_rx_meta {int id;
@@ -102,7 +116,11 @@ struct xen_netbk {atomic_t netfront_count;struct pending_tx_info pending_tx_info[MAX_PENDING_REQS ]; -struct gnttab_copy tx_copy_ops[MAX_PENDING_REQS ]; +/* Coalescing tx requests before copying makes number of grant +* copy ops greater or equal to number of slots required. In +* worst case a tx request consumes 2 gnttab_copy. +*/ +struct gnttab_copy tx_copy_ops[2 *MAX_PENDING_REQS ];u16 pending_ring[MAX_PENDING_REQS ];
@@ -118,6 +136,16 @@ struct xen_netbk {static struct xen_netbk *xen_netbk;static int xen_netbk_group_nr; +/* +* If head != INVALID_PENDING_RING_IDX, it means this tx request is head of +* one or more merged tx requests, otherwise it is the continuation of +* previous tx request. +*/ +static inline int pending_tx_is_head (struct xen_netbk *netbk,RING_IDX idx) +{ +return netbk->pending_tx_info[idx].head !=INVALID_PENDING_RING_IDX ; +} +void xen_netbk_add_xenvif (struct xenvif *vif) {int i;
@@ -250,6 +278,7 @@ static int max_required_rx_slots(struct {int max =DIV_ROUND_UP (vif->dev->mtu,PAGE_SIZE ); +/* XXX FIXME: RX path dependent on MAX_SKB_FRAGS */ if (vif->can_sg || vif->gso || vif->gso_prefix) max +=MAX_SKB_FRAGS +1 ;/* extra_info + frags */
@@ -657,6 +686,7 @@ static void xen_netbk_rx_action(struct x__skb_queue_tail (&rxq, skb);/* Filled the batch queue? */ +/* XXX FIXME: RX path dependent on MAX_SKB_FRAGS */ if (count +MAX_SKB_FRAGS >=XEN_NETIF_RX_RING_SIZE )break ; }
@@ -898,47 +928,78 @@ static void netbk_fatal_tx_err(struct xestatic int netbk_count_requests (struct xenvif *vif,struct xen_netif_tx_request *first, +RING_IDX first_idx,struct xen_netif_tx_request *txp,int work_to_do) {RING_IDX cons = vif->tx.req_cons; -int frags =0 ; +int slots =0 ; +int drop_err =0 ;if (!(first->flags & XEN_NETTXF_more_data))return 0 ;do { -if (frags >= work_to_do) { -netdev_err (vif->dev,"Need more frags\n" ); +if (slots >= work_to_do) { +netdev_err (vif->dev, +"Asked for %d slots but exceeds this limit\n" , + work_to_do);netbk_fatal_tx_err (vif);return -ENODATA ; } -if (unlikely (frags >=MAX_SKB_FRAGS )) { -netdev_err (vif->dev,"Too many frags\n" ); +/* This guest is really using too many slots and +* considered malicious. +*/ +if (unlikely (slots >= max_skb_slots)) { +netdev_err (vif->dev, +"Malicious frontend using %d slots, threshold %u\n" , + slots, max_skb_slots);netbk_fatal_tx_err (vif);return -E2BIG ; } -memcpy (txp,RING_GET_REQUEST (&vif->tx, cons + frags), +/* Xen network protocol had implicit dependency on +* MAX_SKB_FRAGS. XEN_NETIF_NR_SLOTS_MIN is set to the +* historical MAX_SKB_FRAGS value 18 to honor the same +* behavior as before. Any packet using more than 18 +* slots but less than max_skb_slots slots is dropped +*/ +if (!drop_err && slots >=XEN_NETIF_NR_SLOTS_MIN ) { +if (net_ratelimit ()) +netdev_dbg (vif->dev, +"Too many slots (%d) exceeding limit (%d), dropping packet\n" , + slots,XEN_NETIF_NR_SLOTS_MIN ); + drop_err = -E2BIG ; + } + +memcpy (txp,RING_GET_REQUEST (&vif->tx, cons + slots),sizeof (*txp));if (txp->size > first->size) { -netdev_err (vif->dev,"Frag is bigger than frame.\n" ); +netdev_err (vif->dev, +"Invalid tx request, slot size %u > remaining size %u\n" , + txp->size, first->size);netbk_fatal_tx_err (vif);return -EIO ; } first->size -= txp->size; - frags++; + slots++;if (unlikely ((txp->offset + txp->size) >PAGE_SIZE )) { -netdev_err (vif->dev,"txp->offset: %x, size: %u\n" , +netdev_err (vif->dev,"Cross page boundary, txp->offset: %x, size: %u\n" , txp->offset, txp->size);netbk_fatal_tx_err (vif);return -EINVAL ; } }while ((txp++)->flags & XEN_NETTXF_more_data); -return frags; + +if (drop_err) { +netbk_tx_err (vif, first, first_idx + slots); +return drop_err; + } + +return slots; } static struct page *xen_netbk_alloc_page(struct xen_netbk *netbk,
@@ -962,48 +1023,114 @@ static struct gnttab_copy *xen_netbk_getstruct skb_shared_info *shinfo =skb_shinfo (skb);skb_frag_t *frags = shinfo->frags;u16 pending_idx = *((u16 *)skb->data); -int i, start; +u16 head_idx =0 ; +int slot, start; +struct page *page; +pending_ring_idx_t index, start_idx =0 ; +uint16_t dst_offset; +unsigned int nr_slots; +struct pending_tx_info *first =NULL ; + +/* At this point shinfo->nr_frags is in fact the number of +* slots, which can be as large as XEN_NETIF_NR_SLOTS_MIN. +*/ + nr_slots = shinfo->nr_frags;/* Skip first skb fragment if it is on same page as header fragment. */ start = (frag_get_pending_idx (&shinfo->frags[0 ]) == pending_idx); -for (i = start; i < shinfo->nr_frags; i++, txp++) { -struct page *page; -pending_ring_idx_t index; +/* Coalesce tx requests, at this point the packet passed in +* should be <= 64K. Any packets larger than 64K have been +* handled in netbk_count_requests(). +*/ +for (shinfo->nr_frags = slot = start; slot < nr_slots; + shinfo->nr_frags++) {struct pending_tx_info *pending_tx_info = netbk->pending_tx_info; - index =pending_index (netbk->pending_cons++); - pending_idx = netbk->pending_ring[index]; - page =xen_netbk_alloc_page (netbk, pending_idx); + page =alloc_page (GFP_KERNEL |__GFP_COLD);if (!page) goto err; - gop->source.u.ref = txp->gref; - gop->source.domid = vif->domid; - gop->source.offset = txp->offset; + dst_offset =0 ; + first =NULL ; +while (dst_offset <PAGE_SIZE && slot < nr_slots) { + gop->flags = GNTCOPY_source_gref; + + gop->source.u.ref = txp->gref; + gop->source.domid = vif->domid; + gop->source.offset = txp->offset; + + gop->dest.domid =DOMID_SELF ; + + gop->dest.offset = dst_offset; + gop->dest.u.gmfn =virt_to_mfn (page_address (page)); + +if (dst_offset + txp->size >PAGE_SIZE ) { +/* This page can only merge a portion +* of tx request. Do not increment any +* pointer / counter here. The txp +* will be dealt with in future +* rounds, eventually hitting the +* `else` branch. +*/ + gop->len =PAGE_SIZE - dst_offset; + txp->offset += gop->len; + txp->size -= gop->len; + dst_offset += gop->len;/* quit loop */ + }else { +/* This tx request can be merged in the page */ + gop->len = txp->size; + dst_offset += gop->len; + + index =pending_index (netbk->pending_cons++); + + pending_idx = netbk->pending_ring[index]; + +memcpy (&pending_tx_info[pending_idx].req, txp, +sizeof (*txp)); +xenvif_get (vif); + + pending_tx_info[pending_idx].vif = vif; + +/* Poison these fields, corresponding +* fields for head tx req will be set +* to correct values after the loop. +*/ + netbk->mmap_pages[pending_idx] = (void *)(~0UL ); + pending_tx_info[pending_idx].head = +INVALID_PENDING_RING_IDX ; + +if (!first) { + first = &pending_tx_info[pending_idx]; + start_idx = index; + head_idx = pending_idx; + } - gop->dest.u.gmfn =virt_to_mfn (page_address (page)); - gop->dest.domid =DOMID_SELF ; - gop->dest.offset = txp->offset; - - gop->len = txp->size; - gop->flags = GNTCOPY_source_gref; + txp++; + slot++; + } - gop++; + gop++; + } -memcpy (&pending_tx_info[pending_idx].req, txp,sizeof (*txp)); -xenvif_get (vif); - pending_tx_info[pending_idx].vif = vif; -frag_set_pending_idx (&frags[i], pending_idx); + first->req.offset =0 ; + first->req.size = dst_offset; + first->head = start_idx; +set_page_ext (page, netbk, head_idx); + netbk->mmap_pages[head_idx] = page; +frag_set_pending_idx (&frags[shinfo->nr_frags], head_idx); } +BUG_ON (shinfo->nr_frags >MAX_SKB_FRAGS ); +return gop; err:/* Unwind, freeing all pages and sending error responses. */ -while (i-- > start) { -xen_netbk_idx_release (netbk,frag_get_pending_idx (&frags[i]), -XEN_NETIF_RSP_ERROR ); +while (shinfo->nr_frags-- > start) { +xen_netbk_idx_release (netbk, +frag_get_pending_idx (&frags[shinfo->nr_frags]), +XEN_NETIF_RSP_ERROR ); }/* The head too, if necessary. */ if (start)
@@ -1019,8 +1146,10 @@ static int xen_netbk_tx_check_gop(structstruct gnttab_copy *gop = *gopp;u16 pending_idx = *((u16 *)skb->data);struct skb_shared_info *shinfo =skb_shinfo (skb); +struct pending_tx_info *tx_info;int nr_frags = shinfo->nr_frags;int i, err, start; +u16 peek;/* peek into next tx request */ /* Check status of header. */ err = gop->status;
@@ -1032,11 +1161,20 @@ static int xen_netbk_tx_check_gop(structfor (i = start; i < nr_frags; i++) {int j, newerr; +pending_ring_idx_t head; pending_idx =frag_get_pending_idx (&shinfo->frags[i]); + tx_info = &netbk->pending_tx_info[pending_idx]; + head = tx_info->head;/* Check error status: if okay then remember grant handle. */ - newerr = (++gop)->status; +do { + newerr = (++gop)->status; +if (newerr) +break ; + peek = netbk->pending_ring[pending_index (++head)]; + }while (!pending_tx_is_head (netbk, peek)); +if (likely (!newerr)) {/* Had a previous error? Invalidate this fragment. */ if (unlikely (err))
@@ -1261,11 +1399,12 @@ static unsigned xen_netbk_tx_build_gops(struct sk_buff *skb;int ret; -while (((nr_pending_reqs (netbk) +MAX_SKB_FRAGS ) <MAX_PENDING_REQS ) && +while ((nr_pending_reqs (netbk) +XEN_NETIF_NR_SLOTS_MIN + <MAX_PENDING_REQS ) && !list_empty (&netbk->net_schedule_list)) {struct xenvif *vif;struct xen_netif_tx_request txreq; -struct xen_netif_tx_request txfrags[MAX_SKB_FRAGS ]; +struct xen_netif_tx_request txfrags[max_skb_slots];struct page *page;struct xen_netif_extra_info extras[XEN_NETIF_EXTRA_TYPE_MAX -1 ];u16 pending_idx;
@@ -1326,7 +1465,8 @@ static unsigned xen_netbk_tx_build_gops(continue ; } - ret =netbk_count_requests (vif, &txreq, txfrags, work_to_do); + ret =netbk_count_requests (vif, &txreq, idx, + txfrags, work_to_do);if (unlikely (ret <0 ))continue ;
@@ -1353,7 +1493,7 @@ static unsigned xen_netbk_tx_build_gops( pending_idx = netbk->pending_ring[index]; data_len = (txreq.size >PKT_PROT_LEN && - ret <MAX_SKB_FRAGS ) ? + ret <XEN_NETIF_NR_SLOTS_MIN ) ?PKT_PROT_LEN : txreq.size; skb = alloc_skb(data_len + NET_SKB_PAD + NET_IP_ALIGN,
@@ -1403,6 +1543,7 @@ static unsigned xen_netbk_tx_build_gops(memcpy (&netbk->pending_tx_info[pending_idx].req, &txreq,sizeof (txreq)); netbk->pending_tx_info[pending_idx].vif = vif; + netbk->pending_tx_info[pending_idx].head = index; *((u16 *)skb->data) = pending_idx;__skb_put (skb, data_len);
@@ -1530,7 +1671,10 @@ static void xen_netbk_idx_release(struct {struct xenvif *vif;struct pending_tx_info *pending_tx_info; -pending_ring_idx_t index; +pending_ring_idx_t head; +u16 peek;/* peek into next tx request */ + +BUG_ON (netbk->mmap_pages[pending_idx] == (void *)(~0UL ));/* Already complete? */ if (netbk->mmap_pages[pending_idx] ==NULL )
@@ -1539,19 +1683,40 @@ static void xen_netbk_idx_release(struct pending_tx_info = &netbk->pending_tx_info[pending_idx]; vif = pending_tx_info->vif; + head = pending_tx_info->head; -make_tx_response (vif, &pending_tx_info->req, status); +BUG_ON (!pending_tx_is_head (netbk, head)); +BUG_ON (netbk->pending_ring[pending_index (head)] != pending_idx); - index =pending_index (netbk->pending_prod++); - netbk->pending_ring[index] = pending_idx; +do { +pending_ring_idx_t index; +pending_ring_idx_t idx =pending_index (head); +u16 info_idx = netbk->pending_ring[idx]; -xenvif_put (vif); + pending_tx_info = &netbk->pending_tx_info[info_idx]; +make_tx_response (vif, &pending_tx_info->req, status); + +/* Setting any number other than +* INVALID_PENDING_RING_IDX indicates this slot is +* starting a new packet / ending a previous packet. +*/ + pending_tx_info->head =0 ; + + index =pending_index (netbk->pending_prod++); + netbk->pending_ring[index] = netbk->pending_ring[info_idx]; + +xenvif_put (vif); + + peek = netbk->pending_ring[pending_index (++head)]; + + }while (!pending_tx_is_head (netbk, peek)); netbk->mmap_pages[pending_idx]->mapping =0 ;put_page (netbk->mmap_pages[pending_idx]); netbk->mmap_pages[pending_idx] =NULL ; } +static void make_tx_response (struct xenvif *vif,struct xen_netif_tx_request *txp,s8 st)
@@ -1604,8 +1769,9 @@ static inline int rx_work_todo(struct xestatic inline int tx_work_todo (struct xen_netbk *netbk) { -if (((nr_pending_reqs (netbk) +MAX_SKB_FRAGS ) <MAX_PENDING_REQS ) && - !list_empty (&netbk->net_schedule_list)) +if ((nr_pending_reqs (netbk) +XEN_NETIF_NR_SLOTS_MIN + <MAX_PENDING_REQS ) && + !list_empty (&netbk->net_schedule_list))return 1 ;return 0 ;
@@ -1688,6 +1854,13 @@ static int __init netback_init(void)if (!xen_domain ())return -ENODEV ; +if (max_skb_slots <XEN_NETIF_NR_SLOTS_MIN ) { +printk (KERN_INFO +"xen-netback: max_skb_slots too small (%d), bump it to XEN_NETIF_NR_SLOTS_MIN (%d)\n" , + max_skb_slots,XEN_NETIF_NR_SLOTS_MIN ); + max_skb_slots =XEN_NETIF_NR_SLOTS_MIN ; + } + xen_netbk_group_nr =num_online_cpus (); xen_netbk =vzalloc (sizeof (struct xen_netbk ) * xen_netbk_group_nr);if (!xen_netbk)
include/xen/interface/io/netif.h +18 -0
@@ -13,6 +13,24 @@#include <xen/interface/grant_table.h> /* +* Older implementation of Xen network frontend / backend has an +* implicit dependency on the MAX_SKB_FRAGS as the maximum number of +* ring slots a skb can use. Netfront / netback may not work as +* expected when frontend and backend have different MAX_SKB_FRAGS. +* +* A better approach is to add mechanism for netfront / netback to +* negotiate this value. However we cannot fix all possible +* frontends, so we need to define a value which states the minimum +* slots backend must support. +* +* The minimum value derives from older Linux kernel's MAX_SKB_FRAGS +* (18), which is proved to work with most frontends. Any new backend +* which doesn't negotiate with frontend should expect frontend to +* send a valid packet using slots up to this value. +*/ +#define XEN_NETIF_NR_SLOTS_MIN 18 + +/* * Notifications after enqueuing any type of message should be conditional on * the appropriate req_event or rsp_event field in the shared ring. * If the client sends notification for rx requests then it should specify
Greg Kroah-Hartman
maintainerPATCH 121/127 xen-netback: dont disconnect frontend when seeing oversize packet
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Liu <[email protected]>
commit 03393fd5cc2b6cdeec32b704ecba64dbb0feae3c upstream.
Some frontend drivers are sending packets > 64 KiB in length. This length overflows the length field in the first slot making the following slots have an invalid length.
Turn this error back into a non-fatal error by dropping the packet. To avoid having the following slots having fatal errors, consume all slots in the packet.
This does not reopen the security hole in XSA-39 as if the packet as an invalid number of slots it will still hit fatal error case.
--- drivers/net/xen-netback/netback.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)
drivers/net/xen-netback/netback.c +16 -6
@@ -975,12 +975,22 @@ static int netbk_count_requests(struct xmemcpy (txp,RING_GET_REQUEST (&vif->tx, cons + slots),sizeof (*txp)); -if (txp->size > first->size) { -netdev_err (vif->dev, -"Invalid tx request, slot size %u > remaining size %u\n" , - txp->size, first->size); -netbk_fatal_tx_err (vif); -return -EIO ; + +/* If the guest submitted a frame >= 64 KiB then +* first->size overflowed and following slots will +* appear to be larger than the frame. +* +* This cannot be fatal error as there are buggy +* frontends that do this. +* +* Consume all slots and drop the packet. +*/ +if (!drop_err && txp->size > first->size) { +if (net_ratelimit ()) +netdev_dbg (vif->dev, +"Invalid tx request, slot size %u > remaining size %u\n" , + txp->size, first->size); + drop_err = -EIO ; } first->size -= txp->size;
Greg Kroah-Hartman
maintainerPATCH 122/127 xen-netback: remove redundent parameter in netbk_count_requests
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Liu <[email protected]>
commit ac69c26e7accb04ae2cb9ab0872068983a42b3c8 upstream.
Tracking down from the caller, first_idx is always equal to vif->tx.req_cons. Remove it to avoid confusion.
--- drivers/net/xen-netback/netback.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/xen-netback/netback.c +2 -4
@@ -928,7 +928,6 @@ static void netbk_fatal_tx_err(struct xestatic int netbk_count_requests (struct xenvif *vif,struct xen_netif_tx_request *first, -RING_IDX first_idx,struct xen_netif_tx_request *txp,int work_to_do) {
@@ -1005,7 +1004,7 @@ static int netbk_count_requests(struct x }while ((txp++)->flags & XEN_NETTXF_more_data);if (drop_err) { -netbk_tx_err (vif, first, first_idx + slots); +netbk_tx_err (vif, first, cons + slots);return drop_err; }
@@ -1475,8 +1474,7 @@ static unsigned xen_netbk_tx_build_gops(continue ; } - ret =netbk_count_requests (vif, &txreq, idx, - txfrags, work_to_do); + ret =netbk_count_requests (vif, &txreq, txfrags, work_to_do);if (unlikely (ret <0 ))continue ;
Greg Kroah-Hartman
maintainerPATCH 123/127 xen-netback: avoid allocating variable size array on stack
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Liu <[email protected]>
commit 59ccb4ebbc35e36a3c143f2d1355deb75c2e628f upstream.
Tune xen_netbk_count_requests to not touch working array beyond limit, so that we can make working array size constant.
--- drivers/net/xen-netback/netback.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/net/xen-netback/netback.c +14 -2
@@ -934,11 +934,14 @@ static int netbk_count_requests(struct xRING_IDX cons = vif->tx.req_cons;int slots =0 ;int drop_err =0 ; +int more_data;if (!(first->flags & XEN_NETTXF_more_data))return 0 ; do { + struct xen_netif_tx_request dropped_tx = { 0 }; + if (slots >= work_to_do) { netdev_err(vif->dev, "Asked for %d slots but exceeds this limit\n",
@@ -972,6 +975,9 @@ static int netbk_count_requests(struct x drop_err = -E2BIG ; } +if (drop_err) + txp = &dropped_tx; +memcpy (txp,RING_GET_REQUEST (&vif->tx, cons + slots),sizeof (*txp));
@@ -1001,7 +1007,13 @@ static int netbk_count_requests(struct xnetbk_fatal_tx_err (vif);return -EINVAL ; } - }while ((txp++)->flags & XEN_NETTXF_more_data); + + more_data = txp->flags & XEN_NETTXF_more_data; + +if (!drop_err) + txp++; + + }while (more_data);if (drop_err) {netbk_tx_err (vif, first, cons + slots);
@@ -1413,7 +1425,7 @@ static unsigned xen_netbk_tx_build_gops( !list_empty(&netbk->net_schedule_list)) {struct xenvif *vif;struct xen_netif_tx_request txreq; -struct xen_netif_tx_request txfrags[max_skb_slots]; +struct xen_netif_tx_request txfrags[XEN_NETIF_NR_SLOTS_MIN ];struct page *page;struct xen_netif_extra_info extras[XEN_NETIF_EXTRA_TYPE_MAX -1 ];u16 pending_idx;
Greg Kroah-Hartman
maintainerPATCH 124/127 xen-netfront: reduce gso_max_size to account for max TCP header
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Liu <[email protected]>
commit 9ecd1a75d977e2e8c48139c7d3efed183f898d94 upstream.
The maximum packet including header that can be handled by netfront / netback wire format is 65535. Reduce gso_max_size accordingly.
Drop skb and print warning when skb->len > 65535. This can 1) save the effort to send malformed packet to netback, 2) help spotting misconfiguration of netfront in the future.
--- drivers/net/xen-netfront.c | 17 +++++++++++++++-- include/xen/interface/io/netif.h | 1 + 2 files changed, 16 insertions(+), 2 deletions(-)
drivers/net/xen-netfront.c +15 -2
@@ -36,7 +36,7 @@#include <linux/skbuff.h> #include <linux/ethtool.h> #include <linux/if_ether.h> -#include <linux/tcp.h> +#include <net/tcp.h> #include <linux/udp.h> #include <linux/moduleparam.h> #include <linux/mm.h>
@@ -548,6 +548,16 @@ static int xennet_start_xmit(struct sk_bunsigned int len =skb_headlen (skb);unsigned long flags; +/* If skb->len is too big for wire format, drop skb and alert +* user about misconfiguration. +*/ +if (unlikely (skb->len >XEN_NETIF_MAX_TX_SIZE )) { +net_alert_ratelimited ( +"xennet: skb->len = %u, too big for wire format\n" , + skb->len); + goto drop; + } + slots =DIV_ROUND_UP (offset + len,PAGE_SIZE ) +xennet_count_skb_frag_slots (skb);if (unlikely (slots >MAX_SKB_FRAGS +1 )) {
@@ -1064,7 +1074,8 @@ err:static int xennet_change_mtu (struct net_device *dev,int mtu) { -int max =xennet_can_sg (dev) ?65535 -ETH_HLEN :ETH_DATA_LEN ; +int max =xennet_can_sg (dev) ? +XEN_NETIF_MAX_TX_SIZE -MAX_TCP_HEADER :ETH_DATA_LEN ;if (mtu > max)return -EINVAL ;
@@ -1368,6 +1379,8 @@ static struct net_device *xennet_create_SET_ETHTOOL_OPS (netdev, &xennet_ethtool_ops);SET_NETDEV_DEV (netdev, &dev->dev); +netif_set_gso_max_size (netdev,XEN_NETIF_MAX_TX_SIZE -MAX_TCP_HEADER ); + np->netdev = netdev;netif_carrier_off (netdev);
include/xen/interface/io/netif.h +1 -0
@@ -65,6 +65,7 @@#define _XEN_NETTXF_extra_info (3)#define XEN_NETTXF_extra_info (1U<<_XEN_NETTXF_extra_info) +#define XEN_NETIF_MAX_TX_SIZE 0xFFFFstruct xen_netif_tx_request {grant_ref_t gref;/* Reference to buffer page */ uint16_t offset;/* Offset within buffer page */
Greg Kroah-Hartman
maintainerPATCH 125/127 iwlwifi: mvm: remove P2P_DEVICE support
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
Unfortunately, advertising P2P_DEVICE support was a little premature, a number of issues came up in testing and have been fixed for 3.10. Rather than try to backport all the different fixes, disable P2P_DEVICE support in the drivers using it. For iwlmvm that implies disabling P2P completely as it can't support P2P operation w/o P2P Device.
--- drivers/net/wireless/iwlwifi/mvm/mac80211.c | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-)
drivers/net/wireless/iwlwifi/mvm/mac80211.c +1 -13
@@ -82,15 +82,6 @@ static const struct ieee80211_iface_limi .types = BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_AP), }, - { - .max = 1, - .types = BIT(NL80211_IFTYPE_P2P_CLIENT) | - BIT(NL80211_IFTYPE_P2P_GO), - }, - { - .max = 1, - .types = BIT(NL80211_IFTYPE_P2P_DEVICE), - }, }; static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
@@ -136,10 +127,7 @@ int iwl_mvm_mac_setup_register(struct iw hw->chanctx_data_size =sizeof (struct iwl_mvm_phy_ctxt ); hw->wiphy->interface_modes =BIT (NL80211_IFTYPE_STATION ) | -BIT (NL80211_IFTYPE_P2P_CLIENT ) | -BIT (NL80211_IFTYPE_AP ) | -BIT (NL80211_IFTYPE_P2P_GO ) | -BIT (NL80211_IFTYPE_P2P_DEVICE ); +BIT (NL80211_IFTYPE_AP ); hw->wiphy->flags |=WIPHY_FLAG_CUSTOM_REGULATORY | WIPHY_FLAG_DISABLE_BEACON_HINTS |
Greg Kroah-Hartman
maintainerPATCH 126/127 mac80211_hwsim: remove P2P_DEVICE support
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
Unfortunately, advertising P2P_DEVICE support was a little premature, a number of issues came up in testing and have been fixed for 3.10. Rather than try to backport all the different fixes, disable P2P_DEVICE support in the drivers using it.
--- drivers/net/wireless/mac80211_hwsim.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/wireless/mac80211_hwsim.c +1 -3
@@ -2118,7 +2118,6 @@ static const struct ieee80211_iface_limi#endif BIT (NL80211_IFTYPE_AP ) | BIT(NL80211_IFTYPE_P2P_GO) }, - { .max = 1, .types = BIT(NL80211_IFTYPE_P2P_DEVICE) }, }; static struct ieee80211_iface_combination hwsim_if_comb = {
@@ -2230,8 +2229,7 @@ static int __init init_mac80211_hwsim(voBIT (NL80211_IFTYPE_P2P_CLIENT ) |BIT (NL80211_IFTYPE_P2P_GO ) |BIT (NL80211_IFTYPE_ADHOC ) | -BIT (NL80211_IFTYPE_MESH_POINT ) | -BIT (NL80211_IFTYPE_P2P_DEVICE ); +BIT (NL80211_IFTYPE_MESH_POINT ); hw->flags =IEEE80211_HW_MFP_CAPABLE | IEEE80211_HW_SIGNAL_DBM |
Greg Kroah-Hartman
maintainerPATCH 127/127 xen-netback: better names for thresholds
In reply to Greg Kroah-Hartman3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Liu <[email protected]>
commit 376414945d15aa636e65f7e773c1e398b7a21cb9 upstream.
This patch only changes some names to avoid confusion.
In this patch we have:
MAX_SKB_SLOTS_DEFAULT -> FATAL_SKB_SLOTS_DEFAULT max_skb_slots -> fatal_skb_slots #define XEN_NETBK_LEGACY_SLOTS_MAX XEN_NETIF_NR_SLOTS_MIN
The fatal_skb_slots is the threshold to determine whether a packet is malicious.
XEN_NETBK_LEGACY_SLOTS_MAX is the maximum slots a valid packet can have at this point. It is defined to be XEN_NETIF_NR_SLOTS_MIN because that's guaranteed to be supported by all backends.
--- drivers/net/xen-netback/netback.c | 49 ++++++++++++++++++++++---------------- 1 file changed, 29 insertions(+), 20 deletions(-)
drivers/net/xen-netback/netback.c +29 -20
@@ -51,9 +51,17 @@* This is the maximum slots a skb can have. If a guest sends a skb * which exceeds this limit it is considered malicious. */ -#define MAX_SKB_SLOTS_DEFAULT 20 -static unsigned int max_skb_slots =MAX_SKB_SLOTS_DEFAULT ; -module_param (max_skb_slots, uint,0444 ); +#define FATAL_SKB_SLOTS_DEFAULT 20 +static unsigned int fatal_skb_slots =FATAL_SKB_SLOTS_DEFAULT ; +module_param (fatal_skb_slots, uint,0444 ); + +/* +* To avoid confusion, we define XEN_NETBK_LEGACY_SLOTS_MAX indicating +* the maximum slots a valid packet can use. Now this value is defined +* to be XEN_NETIF_NR_SLOTS_MIN, which is supposed to be supported by +* all backend. +*/ +#define XEN_NETBK_LEGACY_SLOTS_MAX XEN_NETIF_NR_SLOTS_MINtypedef unsigned int pending_ring_idx_t ;#define INVALID_PENDING_RING_IDX (~0U)
@@ -953,25 +961,26 @@ static int netbk_count_requests(struct x/* This guest is really using too many slots and * considered malicious. */ -if (unlikely (slots >= max_skb_slots)) { +if (unlikely (slots >= fatal_skb_slots)) {netdev_err (vif->dev,"Malicious frontend using %d slots, threshold %u\n" , - slots, max_skb_slots); + slots, fatal_skb_slots);netbk_fatal_tx_err (vif);return -E2BIG ; }/* Xen network protocol had implicit dependency on -* MAX_SKB_FRAGS. XEN_NETIF_NR_SLOTS_MIN is set to the -* historical MAX_SKB_FRAGS value 18 to honor the same -* behavior as before. Any packet using more than 18 -* slots but less than max_skb_slots slots is dropped +* MAX_SKB_FRAGS. XEN_NETBK_LEGACY_SLOTS_MAX is set to +* the historical MAX_SKB_FRAGS value 18 to honor the +* same behavior as before. Any packet using more than +* 18 slots but less than fatal_skb_slots slots is +* dropped */ -if (!drop_err && slots >=XEN_NETIF_NR_SLOTS_MIN ) { +if (!drop_err && slots >=XEN_NETBK_LEGACY_SLOTS_MAX ) {if (net_ratelimit ())netdev_dbg (vif->dev,"Too many slots (%d) exceeding limit (%d), dropping packet\n" , - slots,XEN_NETIF_NR_SLOTS_MIN ); + slots,XEN_NETBK_LEGACY_SLOTS_MAX ); drop_err = -E2BIG ; }
@@ -1053,7 +1062,7 @@ static struct gnttab_copy *xen_netbk_getstruct pending_tx_info *first =NULL ;/* At this point shinfo->nr_frags is in fact the number of -* slots, which can be as large as XEN_NETIF_NR_SLOTS_MIN. +* slots, which can be as large as XEN_NETBK_LEGACY_SLOTS_MAX. */ nr_slots = shinfo->nr_frags;
@@ -1420,12 +1429,12 @@ static unsigned xen_netbk_tx_build_gops(struct sk_buff *skb;int ret; -while ((nr_pending_reqs (netbk) +XEN_NETIF_NR_SLOTS_MIN +while ((nr_pending_reqs (netbk) +XEN_NETBK_LEGACY_SLOTS_MAX <MAX_PENDING_REQS ) && !list_empty (&netbk->net_schedule_list)) {struct xenvif *vif;struct xen_netif_tx_request txreq; -struct xen_netif_tx_request txfrags[XEN_NETIF_NR_SLOTS_MIN ]; +struct xen_netif_tx_request txfrags[XEN_NETBK_LEGACY_SLOTS_MAX ];struct page *page;struct xen_netif_extra_info extras[XEN_NETIF_EXTRA_TYPE_MAX -1 ];u16 pending_idx;
@@ -1513,7 +1522,7 @@ static unsigned xen_netbk_tx_build_gops( pending_idx = netbk->pending_ring[index]; data_len = (txreq.size >PKT_PROT_LEN && - ret <XEN_NETIF_NR_SLOTS_MIN ) ? + ret <XEN_NETBK_LEGACY_SLOTS_MAX ) ?PKT_PROT_LEN : txreq.size; skb = alloc_skb(data_len + NET_SKB_PAD + NET_IP_ALIGN,
@@ -1789,7 +1798,7 @@ static inline int rx_work_todo(struct xestatic inline int tx_work_todo (struct xen_netbk *netbk) { -if ((nr_pending_reqs (netbk) +XEN_NETIF_NR_SLOTS_MIN +if ((nr_pending_reqs (netbk) +XEN_NETBK_LEGACY_SLOTS_MAX <MAX_PENDING_REQS ) && !list_empty (&netbk->net_schedule_list))return 1 ;
@@ -1874,11 +1883,11 @@ static int __init netback_init(void)if (!xen_domain ())return -ENODEV ; -if (max_skb_slots <XEN_NETIF_NR_SLOTS_MIN ) { +if (fatal_skb_slots <XEN_NETBK_LEGACY_SLOTS_MAX ) {printk (KERN_INFO -"xen-netback: max_skb_slots too small (%d), bump it to XEN_NETIF_NR_SLOTS_MIN (%d)\n" , - max_skb_slots,XEN_NETIF_NR_SLOTS_MIN ); - max_skb_slots =XEN_NETIF_NR_SLOTS_MIN ; +"xen-netback: fatal_skb_slots too small (%d), bump it to XEN_NETBK_LEGACY_SLOTS_MAX (%d)\n" , + fatal_skb_slots,XEN_NETBK_LEGACY_SLOTS_MAX ); + fatal_skb_slots =XEN_NETBK_LEGACY_SLOTS_MAX ; } xen_netbk_group_nr =num_online_cpus ();