3.12.43-stable review
Subsystems (2)
PATCH 77/142 crypto: omap-aes - Fix support for unequal lengths
In reply to Jiri SlabyFrom: "Vutla, Lokesh" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6d7e7e02a044025237b6f62a20521170b794537f upstream.
For cases where total length of an input SGs is not same as length of the input data for encryption, omap-aes driver crashes. This happens in the case when IPsec is trying to use omap-aes driver.
To avoid this, we copy all the pages from the input SG list into a contiguous buffer and prepare a single element SG list for this buffer with length as the total bytes to crypt, which is similar thing that is done in case of unaligned lengths.
--- drivers/crypto/omap-aes.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/crypto/omap-aes.c +11 -3
@@ -554,15 +554,23 @@ static int omap_aes_crypt_dma_stop(struct omap_aes_dev *dd)return err; } -int omap_aes_check_aligned (struct scatterlist *sg) +int omap_aes_check_aligned (struct scatterlist *sg,int total) { +int len =0 ; +while (sg) {if (!IS_ALIGNED (sg->offset,4 ))return -1 ;if (!IS_ALIGNED (sg->length,AES_BLOCK_SIZE ))return -1 ; + + len += sg->length; sg =sg_next (sg); } + +if (len != total) +return -1 ; +return 0 ; }
@@ -633,8 +641,8 @@ static int omap_aes_handle_queue(struct omap_aes_dev *dd, dd->in_sg = req->src; dd->out_sg = req->dst; -if (omap_aes_check_aligned (dd->in_sg) || -omap_aes_check_aligned (dd->out_sg)) { +if (omap_aes_check_aligned (dd->in_sg, dd->total) || +omap_aes_check_aligned (dd->out_sg, dd->total)) {if (omap_aes_copy_sgs (dd))pr_err ("Failed to copy SGs for unaligned cases\n" ); dd->sgs_copied =1 ;
Signature · 1 line
2.3.7
cover 3.12.43-stable review
This is the start of the stable review cycle for the 3.12.43 release. There are 142 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed May 20 09:36:47 CEST 2015. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.43-rc1.xz
and the diffstat can be found below.
thanks,
js
===============
Al Viro (2):
RCU pathwalk breakage when running into a symlink overmounting
something
seq_file: always clear m->count when we free m->buf
Alex Deucher (2):
drm/radeon: fix doublescan modes (v2)
drm/radeon: add SI DPM quirk for Sapphire R9 270 Dual-X 2G GDDR5
Alexander Ploumistos (1):
Bluetooth: ath3k: Add support Atheros AR5B195 combo Mini PCIe card
Alexey Khoroshilov (1):
sound/oss: fix deadlock in sequencer_ioctl(SNDCTL_SEQ_OUTOFBAND)
Andrey Ryabinin (1):
ARM: 8320/1: fix integer overflow in ELF_ET_DYN_BASE
Andrzej Pietrasiewicz (1):
usb: gadget: printer: enqueue printer's response for setup request
Anton Blanchard (1):
powerpc/perf: Cap 64bit userspace backtraces to PERF_MAX_STACK_DEPTH
Arun Chandran (1):
arm64: vdso: fix build error when switching from LE to BE
Axel Lin (1):
usb: phy: Find the right match in devm_usb_phy_match
Boris Ostrovsky (1):
xen/console: Update console event channel on resume
Brian Norris (4):
UBI: account for bitflips in both the VID header and data
UBI: fix out of bounds write
UBI: initialize LEB number variable
UBI: fix check for "too many bytes"
Calvin Owens (1):
ksoftirqd: Enable IRQs and call cond_resched() before poking RCU
Charles Keepax (2):
ARM: S3C64XX: Use fixed IRQ bases to avoid conflicts on Cragganmore
ASoC: dapm: Enable autodisable on SOC_DAPM_SINGLE_TLV_AUTODISABLE
Christian König (3):
drm/radeon: disable semaphores for UVD V1 (v2) drm/radeon: make UVD handle checking more strict drm/radeon: more strictly validate the UVD codec
Christoph Hellwig (3):
3w-xxxx: fix command completion race
3w-9xxx: fix command completion race
3w-sas: fix command completion race
Chuanxiao Dong (1):
mmc: card: Don't access RPMB partitions for normal read/write
Dan Carpenter (1):
memstick: mspro_block: add missing curly braces
Dave Olson (1):
powerpc: Fix missing L2 cache size in /sys/devices/system/cpu
David S. Miller (1):
ipv4: Missing sk_nulls_node_init() in ping_unhash().
David Sterba (1):
btrfs: don't accept bare namespace as a valid xattr
Dmitry Torokhov (1):
drm/i915: cope with large i2c transfers
Doug Anderson (1):
pinctrl: Don't just pretend to protect pinctrl_maps, do it for real
Ekaterina Tumanova (1):
KVM: s390: Zero out current VMDB of STSI before including level3 data.
Erez Shitrit (1):
IB/mlx4: Fix WQE LSO segment calculation
Eric Dumazet (4):
tcp: fix possible deadlock in tcp_send_fin()
tcp: avoid looping in tcp_send_fin()
net: do not deplete pfmemalloc reserve
net: fix crash in build_skb()
Eric W. Biederman (1):
mnt: Fix fs_fully_visible to verify the root directory is visible
Ezequiel Garcia (1):
stk1160: Make sure current buffer is released
Fabio Estevam (1):
ARM: dts: imx23-olinuxino: Fix polarity of LED GPIO
Felipe Balbi (14):
usb: gadget: composite: enable BESL support
usb: define a generic USB_RESUME_TIMEOUT macro
usb: host: fusbh200: use new USB_RESUME_TIMEOUT
usb: host: uhci: use new USB_RESUME_TIMEOUT
usb: host: fotg210: use new USB_RESUME_TIMEOUT
usb: host: r8a66597: use new USB_RESUME_TIMEOUT
usb: host: isp116x: use new USB_RESUME_TIMEOUT
usb: host: xhci: use new USB_RESUME_TIMEOUT
usb: host: sl811: use new USB_RESUME_TIMEOUT
usb: dwc2: hcd: use new USB_RESUME_TIMEOUT
usb: core: hub: use new USB_RESUME_TIMEOUT
usb: musb: use new USB_RESUME_TIMEOUT
usb: host: oxu210hp: use new USB_RESUME_TIMEOUT
usb: host: ehci: use new USB_RESUME_TIMEOUT
Filipe Manana (3):
Btrfs: fix log tree corruption when fs mounted with -o discard
Btrfs: fix inode eviction infinite loop after cloning into it
Btrfs: fix inode eviction infinite loop after extent_same ioctl
Geert Uytterhoeven (1):
nosave: consolidate __nosave_{begin,end} in <asm/sections.h>
Gerald Schaefer (1):
mm/hugetlb: use pmd_page() in follow_huge_pmd()
Gregory CLEMENT (2):
gpio: mvebu: Fix mask/unmask managment per irq chip type
ARM: mvebu: armada-xp-openblocks-ax3-4: Disable internal RTC
Grygorii Strashko (1):
mmc: core: add missing pm event in mmc_pm_notify to fix hib restore
Guenter Roeck (1):
drivers: parport: Kconfig: exclude arm64 for PARPORT_PC
Heiko Carstens (3):
s390/hibernate: fix save and restore of kernel text section /proc/stat: convert to single_open_size() fs/seq_file: fallback to vmalloc allocation
Huacai Chen (1):
MIPS: Hibernate: flush TLB entries earlier
Ian Abbott (1):
spi: spidev: fix possible arithmetic overflow for multi-transfer
message
Ilya Dryomov (1):
rbd: end I/O the entire obj_request on error
James Bottomley (1):
mvsas: fix panic on expander attached SATA devices
Jann Horn (1):
fs: take i_mutex during prepare_binprm for set[ug]id executables
Jason Gunthorpe (1):
RDMA/CMA: Canonize IPv4 on IPV6 sockets properly
Johan Hovold (2):
gpio: unregister gpiochip device before removing it
gpio: sysfs: fix memory leaks and device hotplug
Junjie Mao (1):
driver core: bus: Goto appropriate labels on failure in bus_add_device
Junxiao Bi (1):
ocfs2: dlm: fix race between purge and get lock resource
K. Y. Srinivasan (3):
scsi: storvsc: Fix a bug in copy_from_bounce_buffer()
Drivers: hv: vmbus: Fix a bug in the error path in vmbus_open()
Drivers: hv: vmbus: Don't wait after requesting offers
Kirill A. Shutemov (1):
mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support
Konstantin Khlebnikov (2):
mm: prevent endless growth of anon_vma hierarchy
mm: fix corner case in anon_vma endless growing prevention
Krzysztof Kozlowski (3):
compal-laptop: Check return value of power_supply_register
power_supply: twl4030_madc: Check return value of
power_supply_register
power_supply: lp8788-charger: Fix leaked power supply on probe fail
Larry Finger (1):
rtlwifi: rtl8192cu: Add new USB ID
Len Brown (1):
sched/idle/x86: Restore mwait_idle() to fix boot hangs, to improve
power savings and to improve performance
Leon Yu (1):
mm: fix anon_vma->degree underflow in anon_vma endless growing
prevention
Ludovic Desroches (1):
tty/serial: at91: maxburst was missing for dma transfers
Lukas Czerner (2):
ext4: make fsync to sync parent dir in no-journal for real this time
ext4: fix data corruption caused by unwritten and delayed extents
Lukas Wunner (1):
drm/i915: Add missing MacBook Pro models with dual channel LVDS
Lv Zheng (5):
ACPICA: Utilities: split IO address types from data type models.
ACPICA: Tables: Change acpi_find_root_pointer() to use
acpi_physical_address.
ACPICA: Utilities: Cleanup to enforce
ACPI_PHYSADDR_TO_PTR()/ACPI_PTR_TO_PHYSADDR().
ACPICA: Utilities: Cleanup to convert physical address printing
formats.
ACPICA: Utilities: Cleanup to remove useless ACPI_PRINTF/FORMAT_xxx
helpers.
Marek Vasut (2):
rtlwifi: rtl8192cu: Add new device ID
ARM: dts: imx28: Fix AUART4 TX-DMA interrupt name
Mark Brown (1):
i2c: core: Export bus recovery functions
Markus Pargmann (1):
ARM: dts: imx25: Add #pwm-cells to pwm4
Max Filippov (3):
xtensa: xtfpga: fix hardware lockup caused by LCD driver
xtensa: provide __NR_sync_file_range2 instead of __NR_sync_file_range
xtensa: ISS: fix locking in TAP network adapter
Michael Davidson (1):
fs/binfmt_elf.c: fix bug in loading of PIE binaries
Michael Gernoth (1):
ALSA: emu10k1: don't deadlock in proc-functions
Michal Simek (1):
serial: of-serial: Remove device_type = "serial" registration
Naoya Horiguchi (2):
mm/memory-failure: call shake_page() when error hits thp tail page
mm: soft-offline: fix num_poisoned_pages counting on concurrent events
Nicholas Bellinger (1):
target: Fix COMPARE_AND_WRITE with SG_TO_MEM_NOALLOC handling
Nicolas Iooss (1):
wl18xx: show rx_frames_per_rates as an array as it really is
Nishanth Menon (1):
C6x: time: Ensure consistency in __init
Oleg Nesterov (1):
ptrace: fix race between ptrace_resume() and wait_task_stopped()
Oliver Neukum (1):
cdc-wdm: fix endianness bug in debug statements
Peter Zubaj (1):
ALSA: emu10k1: Emu10k2 32 bit DMA mode
Radim Krčmář (1):
KVM: use slowpath for cross page cached accesses
Ryusuke Konishi (1):
nilfs2: fix sanity check of btree level in nilfs_btree_root_broken()
Sabrina Dubroca (1):
e1000: add dummy allocator to fix race condition between mtu change
and netpoll
Sebastian Hesselbarth (1):
ARM: dts: dove: Fix uart[23] reg property
Sebastian Pöhn (1):
ip_forward: Drop frames with attached skb->sk
Stefan Wahren (1):
ARM: dts: imx23-olinuxino: Fix dr_mode of usb0
Steven Rostedt (1):
ring-buffer: Replace this_cpu_*() with __this_cpu_*()
Steven Rostedt (Red Hat) (1):
tools lib traceevent kbuffer: Remove extra update to data pointer in
PADDING
Sudip Mukherjee (1):
staging: panel: fix lcd type
Takashi Iwai (4):
ALSA: emux: Fix mutex deadlock at unloading
ALSA: emux: Fix mutex deadlock in OSS emulation
ALSA: emu10k1: Fix card shortname string buffer overflow
ALSA: hda - Fix mute-LED fixed mode
Takeshi Kihara (1):
mmc: sh_mmcif: Fix timeout value for command request
Tejun Heo (1):
writeback: use |1 instead of +1 to protect against div by zero
Thomas D (1):
tools/power turbostat: Use $(CURDIR) instead of $(PWD) and add support
for O= option in Makefile
Ulf Hansson (3):
ARM: ux500: Move GPIO regulator for SD-card into board DTSs
ARM: ux500: Enable GPIO regulator for SD-card for HREF boards
ARM: ux500: Enable GPIO regulator for SD-card for snowball
Ulrik De Bie (1):
Input: elantech - fix absolute mode setting on some ASUS laptops
Vineet Gupta (1):
ARC: signal handling robustify
Vutla, Lokesh (1):
crypto: omap-aes - Fix support for unequal lengths
Yann Droneaud (2):
IB/core: disallow registering 0-sized memory region IB/core: don't disallow registering region starting at 0x0
hujianyang (1):
UBI: fix soft lockup in ubi_check_volume()
mancha security (1):
lib: memzero_explicit: use barrier instead of OPTIMIZER_HIDE_VAR
.../devicetree/bindings/dma/fsl-mxs-dma.txt | 2 +- arch/arc/kernel/signal.c | 20 +++- arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts | 4 + arch/arm/boot/dts/dove.dtsi | 4 +- arch/arm/boot/dts/imx23-olinuxino.dts | 4 +- arch/arm/boot/dts/imx25.dtsi | 1 + arch/arm/boot/dts/imx28.dtsi | 2 +- arch/arm/boot/dts/ste-dbx5x0.dtsi | 17 ---- arch/arm/boot/dts/ste-href.dtsi | 15 +++ arch/arm/boot/dts/ste-snowball.dts | 13 ++- arch/arm/include/asm/elf.h | 2 +- arch/arm/mach-s3c64xx/crag6410.h | 1 + arch/arm/mach-s3c64xx/mach-crag6410.c | 1 + arch/arm64/kernel/vdso/Makefile | 2 +- arch/c6x/kernel/time.c | 2 +- arch/mips/include/asm/suspend.h | 7 -- arch/mips/power/cpu.c | 2 +- arch/mips/power/hibernate.S | 3 +- arch/powerpc/kernel/cacheinfo.c | 44 +++++++-- arch/powerpc/kernel/suspend.c | 4 +- arch/powerpc/perf/callchain.c | 2 +- arch/s390/kernel/suspend.c | 10 +- arch/s390/kvm/priv.c | 1 + arch/sh/include/asm/sections.h | 1 - arch/sparc/power/hibernate.c | 4 +- arch/unicore32/include/mach/pm.h | 3 - arch/unicore32/kernel/hibernate.c | 1 + arch/x86/kernel/process.c | 49 ++++++++++ arch/x86/power/hibernate_32.c | 4 +- arch/x86/power/hibernate_64.c | 4 +- arch/xtensa/Kconfig | 30 ++++++ arch/xtensa/include/uapi/asm/unistd.h | 2 +- arch/xtensa/platforms/iss/network.c | 31 +++--- arch/xtensa/platforms/xtfpga/Makefile | 3 +- .../platforms/xtfpga/include/platform/hardware.h | 3 - .../xtensa/platforms/xtfpga/include/platform/lcd.h | 15 +++ arch/xtensa/platforms/xtfpga/lcd.c | 55 ++++++----- drivers/acpi/acpica/acmacros.h | 10 +- drivers/acpi/acpica/dsopcode.c | 7 +- drivers/acpi/acpica/evregion.c | 2 +- drivers/acpi/acpica/exdump.c | 4 +- drivers/acpi/acpica/exfldio.c | 10 +- drivers/acpi/acpica/exregion.c | 8 +- drivers/acpi/acpica/hwvalid.c | 16 ++-- drivers/acpi/acpica/nsdump.c | 12 +-- drivers/acpi/acpica/tbinstal.c | 5 +- drivers/acpi/acpica/tbprint.c | 17 ++-- drivers/acpi/acpica/tbutils.c | 4 +- drivers/acpi/acpica/tbxfload.c | 7 +- drivers/acpi/acpica/tbxfroot.c | 7 +- drivers/acpi/acpica/utaddress.c | 24 +++-- drivers/base/bus.c | 4 +- drivers/block/rbd.c | 5 + drivers/bluetooth/ath3k.c | 1 + drivers/bluetooth/btusb.c | 1 + drivers/crypto/omap-aes.c | 14 ++- drivers/gpio/gpio-mvebu.c | 24 +++-- drivers/gpio/gpiolib.c | 24 ++++- drivers/gpu/drm/i915/i915_reg.h | 1 + drivers/gpu/drm/i915/intel_i2c.c | 66 +++++++++++-- drivers/gpu/drm/i915/intel_lvds.c | 18 +++- drivers/gpu/drm/radeon/atombios_crtc.c | 8 +- drivers/gpu/drm/radeon/radeon_asic.c | 2 +- drivers/gpu/drm/radeon/radeon_asic.h | 4 + drivers/gpu/drm/radeon/radeon_uvd.c | 105 +++++++++++++++------ drivers/gpu/drm/radeon/rv770d.h | 3 + drivers/gpu/drm/radeon/si_dpm.c | 1 + drivers/gpu/drm/radeon/uvd_v1_0.c | 11 +-- drivers/gpu/drm/radeon/uvd_v2_2.c | 29 ++++++ drivers/hv/channel.c | 7 +- drivers/hv/channel_mgmt.c | 12 +-- drivers/i2c/i2c-core.c | 3 + drivers/infiniband/core/cma.c | 27 ++++-- drivers/infiniband/core/umem.c | 7 +- drivers/infiniband/hw/mlx4/qp.c | 3 +- drivers/input/mouse/elantech.c | 22 +++++ drivers/input/mouse/elantech.h | 1 + drivers/media/usb/stk1160/stk1160-v4l.c | 17 +++- drivers/memstick/core/mspro_block.c | 3 +- drivers/mmc/card/block.c | 12 +++ drivers/mmc/card/queue.c | 2 +- drivers/mmc/card/queue.h | 2 + drivers/mmc/core/core.c | 1 + drivers/mmc/host/sh_mmcif.c | 2 +- drivers/mtd/ubi/attach.c | 2 +- drivers/mtd/ubi/cdev.c | 2 +- drivers/mtd/ubi/eba.c | 3 +- drivers/mtd/ubi/misc.c | 2 + drivers/mtd/ubi/wl.c | 2 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 10 +- drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 2 + drivers/net/wireless/ti/wl18xx/debugfs.c | 2 +- drivers/net/wireless/ti/wlcore/debugfs.h | 4 +- drivers/parport/Kconfig | 2 +- drivers/pinctrl/core.c | 10 +- drivers/pinctrl/core.h | 2 +- drivers/pinctrl/devicetree.c | 2 +- drivers/platform/x86/compal-laptop.c | 8 +- drivers/power/lp8788-charger.c | 4 +- drivers/power/twl4030_madc_battery.c | 7 +- drivers/scsi/3w-9xxx.c | 57 +++-------- drivers/scsi/3w-9xxx.h | 5 - drivers/scsi/3w-sas.c | 50 ++-------- drivers/scsi/3w-sas.h | 4 - drivers/scsi/3w-xxxx.c | 42 ++------- drivers/scsi/3w-xxxx.h | 5 - drivers/scsi/mvsas/mv_sas.c | 5 +- drivers/scsi/storvsc_drv.c | 15 +-- drivers/spi/spidev.c | 5 +- drivers/staging/dwc2/hcd.c | 2 +- drivers/staging/panel/panel.c | 13 ++- drivers/target/target_core_sbc.c | 15 ++- drivers/target/target_core_transport.c | 37 +++++++- drivers/tty/hvc/hvc_xen.c | 18 +++- drivers/tty/serial/atmel_serial.c | 2 + drivers/tty/serial/of_serial.c | 1 - drivers/usb/class/cdc-wdm.c | 12 ++- drivers/usb/core/hub.c | 4 +- drivers/usb/gadget/composite.c | 2 +- drivers/usb/gadget/printer.c | 9 ++ drivers/usb/host/ehci-hcd.c | 10 +- drivers/usb/host/ehci-hub.c | 9 +- drivers/usb/host/fotg210-hcd.c | 2 +- drivers/usb/host/fusbh200-hcd.c | 3 +- drivers/usb/host/isp116x-hcd.c | 2 +- drivers/usb/host/oxu210hp-hcd.c | 7 +- drivers/usb/host/r8a66597-hcd.c | 2 +- drivers/usb/host/sl811-hcd.c | 2 +- drivers/usb/host/uhci-hub.c | 5 +- drivers/usb/host/xhci-ring.c | 2 +- drivers/usb/musb/musb_core.c | 3 +- drivers/usb/musb/musb_virthub.c | 2 +- drivers/usb/phy/phy.c | 4 +- fs/binfmt_elf.c | 9 +- fs/btrfs/extent-tree.c | 5 +- fs/btrfs/ioctl.c | 8 ++ fs/btrfs/xattr.c | 50 +++++++--- fs/exec.c | 76 +++++++++------ fs/ext4/extents_status.c | 8 ++ fs/ext4/inode.c | 2 + fs/ext4/namei.c | 20 ++-- fs/namei.c | 6 +- fs/namespace.c | 6 ++ fs/nilfs2/btree.c | 2 +- fs/ocfs2/dlm/dlmmaster.c | 13 +++ fs/proc/stat.c | 22 +---- fs/seq_file.c | 33 +++++-- include/acpi/acpixf.h | 2 +- include/acpi/actypes.h | 20 ++++ include/acpi/platform/acenv.h | 1 + include/asm-generic/pgtable.h | 5 +- include/asm-generic/sections.h | 4 + include/linux/nilfs2_fs.h | 2 +- include/linux/rmap.h | 10 ++ include/linux/skbuff.h | 1 + include/linux/usb.h | 26 +++++ include/sound/emu10k1.h | 14 ++- include/sound/soc-dapm.h | 2 +- include/target/target_core_base.h | 2 +- kernel/ptrace.c | 20 ++++ kernel/softirq.c | 6 +- kernel/trace/ring_buffer.c | 11 +-- lib/string.c | 2 +- mm/hugetlb.c | 3 +- mm/memory-failure.c | 16 ++-- mm/mmap.c | 2 +- mm/page-writeback.c | 6 +- mm/rmap.c | 49 +++++++++- net/core/skbuff.c | 30 ++++-- net/ipv4/ip_forward.c | 3 + net/ipv4/ping.c | 1 + net/ipv4/tcp_output.c | 64 +++++++++---- net/netlink/af_netlink.c | 6 +- sound/oss/sequencer.c | 12 +-- sound/pci/emu10k1/emu10k1.c | 6 +- sound/pci/emu10k1/emu10k1_callback.c | 4 +- sound/pci/emu10k1/emu10k1_main.c | 21 +++-- sound/pci/emu10k1/emupcm.c | 2 +- sound/pci/emu10k1/emuproc.c | 12 --- sound/pci/emu10k1/memory.c | 11 ++- sound/pci/hda/hda_codec.c | 21 +++-- sound/synth/emux/emux_oss.c | 11 +-- sound/synth/emux/emux_seq.c | 29 ++++-- tools/lib/traceevent/kbuffer-parse.c | 1 - tools/power/x86/turbostat/Makefile | 6 +- virt/kvm/kvm_main.c | 4 +- 186 files changed, 1344 insertions(+), 727 deletions(-) delete mode 100644 arch/mips/include/asm/suspend.h
Signature · 1 line
2.3.7
PATCH 7/142 btrfs: don't accept bare namespace as a valid xattr
In reply to Jiri SlabyFrom: David Sterba <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3c3b04d10ff1811a27f86684ccd2f5ba6983211d upstream.
Due to insufficient check in btrfs_is_valid_xattr, this unexpectedly works:
$ touch file $ setfattr -n user. -v 1 file $ getfattr -d file user.="1"
ie. the missing attribute name after the namespace.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=94291
--- fs/btrfs/xattr.c | 50 +++++++++++++++++++++++++++++++++++++------------- 1 file changed, 37 insertions(+), 13 deletions(-)
fs/btrfs/xattr.c +37 -13
@@ -322,21 +322,40 @@ const struct xattr_handler *btrfs_xattr_handlers[] = {/* * Check if the attribute is in a supported namespace. * -* This applied after the check for the synthetic attributes in the system +* This is applied after the check for the synthetic attributes in the system * namespace. */ -static bool btrfs_is_valid_xattr (const char *name) +static int btrfs_is_valid_xattr (const char *name) { -return !strncmp (name,XATTR_SECURITY_PREFIX , -XATTR_SECURITY_PREFIX_LEN ) || - !strncmp (name,XATTR_SYSTEM_PREFIX ,XATTR_SYSTEM_PREFIX_LEN ) || - !strncmp (name,XATTR_TRUSTED_PREFIX ,XATTR_TRUSTED_PREFIX_LEN ) || - !strncmp (name,XATTR_USER_PREFIX ,XATTR_USER_PREFIX_LEN ); +int len =strlen (name); +int prefixlen =0 ; + +if (!strncmp (name,XATTR_SECURITY_PREFIX , +XATTR_SECURITY_PREFIX_LEN )) + prefixlen =XATTR_SECURITY_PREFIX_LEN ; +else if (!strncmp (name,XATTR_SYSTEM_PREFIX ,XATTR_SYSTEM_PREFIX_LEN )) + prefixlen =XATTR_SYSTEM_PREFIX_LEN ; +else if (!strncmp (name,XATTR_TRUSTED_PREFIX ,XATTR_TRUSTED_PREFIX_LEN )) + prefixlen =XATTR_TRUSTED_PREFIX_LEN ; +else if (!strncmp (name,XATTR_USER_PREFIX ,XATTR_USER_PREFIX_LEN )) + prefixlen =XATTR_USER_PREFIX_LEN ; +else +return -EOPNOTSUPP ; + +/* +* The name cannot consist of just prefix +*/ +if (len <= prefixlen) +return -EINVAL ; + +return 0 ; }ssize_t btrfs_getxattr (struct dentry *dentry,const char *name,void *buffer,size_t size) { +int ret; +/* * If this is a request for a synthetic attribute in the system.* * namespace use the generic infrastructure to resolve a handler
@@ -345,8 +364,9 @@ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,if (!strncmp (name,XATTR_SYSTEM_PREFIX ,XATTR_SYSTEM_PREFIX_LEN ))return generic_getxattr (dentry, name, buffer, size); -if (!btrfs_is_valid_xattr (name)) -return -EOPNOTSUPP ; + ret =btrfs_is_valid_xattr (name); +if (ret) +return ret;return __btrfs_getxattr (dentry->d_inode, name, buffer, size); }
@@ -354,6 +374,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value, size_t size, int flags) {struct btrfs_root *root =BTRFS_I (dentry->d_inode)->root; +int ret;/* * The permission on security.* and system.* is not checked
@@ -370,8 +391,9 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,if (!strncmp (name,XATTR_SYSTEM_PREFIX ,XATTR_SYSTEM_PREFIX_LEN ))return generic_setxattr (dentry, name, value, size, flags); -if (!btrfs_is_valid_xattr (name)) -return -EOPNOTSUPP ; + ret =btrfs_is_valid_xattr (name); +if (ret) +return ret;if (size ==0 ) value ="" ;/* empty EA, do not remove */
@@ -383,6 +405,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,int btrfs_removexattr (struct dentry *dentry,const char *name) {struct btrfs_root *root =BTRFS_I (dentry->d_inode)->root; +int ret;/* * The permission on security.* and system.* is not checked
@@ -399,8 +422,9 @@ int btrfs_removexattr(struct dentry *dentry, const char *name)if (!strncmp (name,XATTR_SYSTEM_PREFIX ,XATTR_SYSTEM_PREFIX_LEN ))return generic_removexattr (dentry, name); -if (!btrfs_is_valid_xattr (name)) -return -EOPNOTSUPP ; + ret =btrfs_is_valid_xattr (name); +if (ret) +return ret;return __btrfs_setxattr (NULL , dentry->d_inode, name,NULL ,0 ,XATTR_REPLACE );
Signature · 1 line
2.3.7
PATCH 1/142 ip_forward: Drop frames with attached skb->sk
In reply to Jiri SlabyFrom: Sebastian Pöhn <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 2ab957492d13bb819400ac29ae55911d50a82a13 ]
Initial discussion was:
[FYI] xfrm: Don't lookup sk_policy for timewait sockets
Forwarded frames should not have a socket attached. Especially tw sockets will lead to panics later-on in the stack.
This was observed with TPROXY assigning a tw socket and broken policy routing (misconfigured). As a result frame enters forwarding path instead of input. We cannot solve this in TPROXY as it cannot know that policy routing is broken.
v2:
Remove useless comment
--- net/ipv4/ip_forward.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv4/ip_forward.c +3 -0
@@ -126,6 +126,9 @@ int ip_forward(struct sk_buff *skb)struct rtable *rt;/* Route we use */ struct ip_options *opt = &(IPCB (skb)->opt); +if (unlikely (skb->sk)) + goto drop; +if (skb_warn_if_lro (skb)) goto drop;
Signature · 1 line
2.3.7
PATCH 2/142 tcp: fix possible deadlock in tcp_send_fin()
From: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit d83769a580f1132ac26439f50068a29b02be535e ]
Using sk_stream_alloc_skb() in tcp_send_fin() is dangerous in case a huge process is killed by OOM, and tcp_mem[2] is hit.
To be able to free memory we need to make progress, so this patch allows FIN packets to not care about tcp_mem[2], if skb allocation succeeded.
In a follow-up patch, we might abort tcp_send_fin() infinite loop in case TIF_MEMDIE is set on this thread, as memory allocator did its best getting extra memory already.
This patch reverts d22e15371811 ("tcp: fix tcp fin memory accounting")
--- net/ipv4/tcp_output.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
net/ipv4/tcp_output.c +19 -1
@@ -2581,6 +2581,21 @@ begin_fwd: } } +/* We allow to exceed memory limits for FIN packets to expedite +* connection tear down and (memory) recovery. +* Otherwise tcp_send_fin() could loop forever. +*/ +static void sk_forced_wmem_schedule (struct sock *sk,int size) +{ +int amt, status; + +if (size <= sk->sk_forward_alloc) +return ; + amt =sk_mem_pages (size); + sk->sk_forward_alloc += amt *SK_MEM_QUANTUM ; +sk_memory_allocated_add (sk, amt, &status); +} +/* Send a fin. The caller locks the socket for us. This cannot be * allowed to fail queueing a FIN frame under any circumstances. */
@@ -2603,11 +2618,14 @@ void tcp_send_fin(struct sock *sk) }else {/* Socket is locked, keep trying until memory is available. */ for (;;) { - skb =sk_stream_alloc_skb (sk,0 , sk->sk_allocation); + skb =alloc_skb_fclone (MAX_TCP_HEADER , + sk->sk_allocation);if (skb)break ;yield (); } +skb_reserve (skb,MAX_TCP_HEADER ); +sk_forced_wmem_schedule (sk, skb->truesize);/* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */ tcp_init_nondata_skb (skb, tp->write_seq,TCPHDR_ACK |TCPHDR_FIN );
Signature · 1 line
2.3.7
PATCH 3/142 tcp: avoid looping in tcp_send_fin()
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 845704a535e9b3c76448f52af1b70e4422ea03fd ]
Presence of an unbound loop in tcp_send_fin() had always been hard to explain when analyzing crash dumps involving gigantic dying processes with millions of sockets.
Lets try a different strategy :
In case of memory pressure, try to add the FIN flag to last packet in write queue, even if packet was already sent. TCP stack will be able to deliver this FIN after a timeout event. Note that this FIN being delivered by a retransmit, it also carries a Push flag given our current implementation.
By checking sk_under_memory_pressure(), we anticipate that cooking many FIN packets might deplete tcp memory.
In the case we could not allocate a packet, even with __GFP_WAIT allocation, then not sending a FIN seems quite reasonable if it allows to get rid of this socket, free memory, and not block the process from eventually doing other useful work.
--- net/ipv4/tcp_output.c | 50 +++++++++++++++++++++++++++++--------------------- 1 file changed, 29 insertions(+), 21 deletions(-)
net/ipv4/tcp_output.c +29 -21
@@ -2583,7 +2583,8 @@ begin_fwd:/* We allow to exceed memory limits for FIN packets to expedite * connection tear down and (memory) recovery. -* Otherwise tcp_send_fin() could loop forever. +* Otherwise tcp_send_fin() could be tempted to either delay FIN +* or even be forced to close flow without any FIN. */ static void sk_forced_wmem_schedule (struct sock *sk,int size) {
@@ -2596,33 +2597,40 @@ static void sk_forced_wmem_schedule(struct sock *sk, int size)sk_memory_allocated_add (sk, amt, &status); } -/* Send a fin. The caller locks the socket for us. This cannot be -* allowed to fail queueing a FIN frame under any circumstances. +/* Send a FIN. The caller locks the socket for us. +* We should try to send a FIN packet really hard, but eventually give up. */ void tcp_send_fin (struct sock *sk) { +struct sk_buff *skb, *tskb =tcp_write_queue_tail (sk);struct tcp_sock *tp =tcp_sk (sk); -struct sk_buff *skb =tcp_write_queue_tail (sk); -int mss_now; -/* Optimization, tack on the FIN if we have a queue of -* unsent frames. But be careful about outgoing SACKS -* and IP options. +/* Optimization, tack on the FIN if we have one skb in write queue and +* this skb was not yet sent, or we are under memory pressure. +* Note: in the latter case, FIN packet will be sent after a timeout, +* as TCP stack thinks it has already been transmitted. */ - mss_now =tcp_current_mss (sk); - -if (tcp_send_head (sk) !=NULL ) { -TCP_SKB_CB (skb)->tcp_flags |=TCPHDR_FIN ; -TCP_SKB_CB (skb)->end_seq++; +if (tskb && (tcp_send_head (sk) ||sk_under_memory_pressure (sk))) { +coalesce: +TCP_SKB_CB (tskb)->tcp_flags |=TCPHDR_FIN ; +TCP_SKB_CB (tskb)->end_seq++; tp->write_seq++; +if (!tcp_send_head (sk)) { +/* This means tskb was already sent. +* Pretend we included the FIN on previous transmit. +* We need to set tp->snd_nxt to the value it would have +* if FIN had been sent. This is because retransmit path +* does not change tp->snd_nxt. +*/ + tp->snd_nxt++; +return ; + } }else { -/* Socket is locked, keep trying until memory is available. */ -for (;;) { - skb =alloc_skb_fclone (MAX_TCP_HEADER , - sk->sk_allocation); -if (skb) -break ; -yield (); + skb =alloc_skb_fclone (MAX_TCP_HEADER , sk->sk_allocation); +if (unlikely (!skb)) { +if (tskb) + goto coalesce; +return ; }skb_reserve (skb,MAX_TCP_HEADER );sk_forced_wmem_schedule (sk, skb->truesize);
@@ -2631,7 +2639,7 @@ void tcp_send_fin(struct sock *sk) TCPHDR_ACK | TCPHDR_FIN);tcp_queue_skb (sk, skb); } -__tcp_push_pending_frames (sk, mss_now,TCP_NAGLE_OFF ); +__tcp_push_pending_frames (sk,tcp_current_mss (sk),TCP_NAGLE_OFF ); }/* We get here when a process closes a file descriptor (either due to
Signature · 1 line
2.3.7
PATCH 4/142 net: do not deplete pfmemalloc reserve
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 79930f5892e134c6da1254389577fffb8bd72c66 ]
build_skb() should look at the page pfmemalloc status. If set, this means page allocator allocated this page in the expectation it would help to free other pages. Networking stack can do that only if skb->pfmemalloc is also set.
Also, we must refrain using high order pages from the pfmemalloc reserve, so __page_frag_refill() must also use __GFP_NOMEMALLOC for them. Under memory pressure, using order-0 pages is probably the best strategy.
--- net/core/skbuff.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/core/skbuff.c +7 -2
@@ -308,7 +308,11 @@ struct sk_buff *build_skb(void *data, unsigned int frag_size)memset (skb,0 , offsetof(struct sk_buff , tail)); skb->truesize =SKB_TRUESIZE (size); - skb->head_frag = frag_size !=0 ; +if (frag_size) { + skb->head_frag =1 ; +if (virt_to_head_page (data)->pfmemalloc) + skb->pfmemalloc =1 ; + }atomic_set (&skb->users,1 ); skb->head = data; skb->data = data;
@@ -351,7 +355,8 @@ refill:gfp_t gfp = gfp_mask;if (order) - gfp |= __GFP_COMP | __GFP_NOWARN; + gfp |= __GFP_COMP | __GFP_NOWARN | + __GFP_NOMEMALLOC; nc->frag.page =alloc_pages (gfp, order);if (likely (nc->frag.page))break ;
Signature · 1 line
2.3.7
PATCH 16/142 s390/hibernate: fix save and restore of kernel text section
In reply to Jiri SlabyFrom: Heiko Carstens <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d74419495633493c9cd3f2bbeb7f3529d0edded6 upstream.
Sebastian reported a crash caused by a jump label mismatch after resume. This happens because we do not save the kernel text section during suspend and therefore also do not restore it during resume, but use the kernel image that restores the old system.
This means that after a suspend/resume cycle we lost all modifications done to the kernel text section.
The reason for this is the pfn_is_nosave() function, which incorrectly returns that read-only pages don't need to be saved. This is incorrect since we mark the kernel text section read-only.
We still need to make sure to not save and restore pages contained within NSS and DCSS segment.
To fix this add an extra case for the kernel text section and only save those pages if they are not contained within an NSS segment.
Fixes the following crash (and the above bugs as well):
Jump label code mismatch at netif_receive_skb_internal+0x28/0xd0
Found: c0 04 00 00 00 00 Expected: c0 f4 00 00 00 11 New: c0 04 00 00 00 00 Kernel panic - not syncing: Corrupted kernel text CPU: 0 PID: 9 Comm: migration/0 Not tainted 3.19.0-01975-gb1b096e70f23 #4 Call Trace: [<0000000000113972>] show_stack+0x72/0xf0 [<000000000081f15e>] dump_stack+0x6e/0x90 [<000000000081c4e8>] panic+0x108/0x2b0 [<000000000081be64>] jump_label_bug.isra.2+0x104/0x108 [<0000000000112176>] __jump_label_transform+0x9e/0xd0 [<00000000001121e6>] __sm_arch_jump_label_transform+0x3e/0x50 [<00000000001d1136>] multi_cpu_stop+0x12e/0x170 [<00000000001d1472>] cpu_stopper_thread+0xb2/0x168 [<000000000015d2ac>] smpboot_thread_fn+0x134/0x1b0 [<0000000000158baa>] kthread+0x10a/0x110 [<0000000000824a86>] kernel_thread_starter+0x6/0xc
--- arch/s390/kernel/suspend.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/s390/kernel/suspend.c +4 -0
@@ -138,6 +138,8 @@ int pfn_is_nosave(unsigned long pfn) {unsigned long nosave_begin_pfn =PFN_DOWN (__pa (&__nosave_begin));unsigned long nosave_end_pfn =PFN_DOWN (__pa (&__nosave_end)); +unsigned long eshared_pfn =PFN_DOWN (__pa (&_eshared)) -1 ; +unsigned long stext_pfn =PFN_DOWN (__pa (&_stext));/* Always save lowcore pages (LC protection might be enabled). */ if (pfn <=LC_PAGES )
@@ -145,6 +147,8 @@ int pfn_is_nosave(unsigned long pfn)if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn)return 1 ;/* Skip memory holes and read-only pages (NSS, DCSS, ...). */ +if (pfn >= stext_pfn && pfn <= eshared_pfn) +return ipl_info.type ==IPL_TYPE_NSS ?1 :0 ;if (tprot (PFN_PHYS (pfn)))return 1 ;return 0 ;
Signature · 1 line
2.3.7
PATCH 37/142 usb: dwc2: hcd: use new USB_RESUME_TIMEOUT
In reply to Jiri SlabyFrom: Felipe Balbi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 74bd7b69801819707713b88e9d0bc074efa2f5e7 upstream.
Make sure we're using the new macro, so our
resume signaling will always pass certification.
--- drivers/staging/dwc2/hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/dwc2/hcd.c +1 -1
@@ -1462,7 +1462,7 @@ static int dwc2_hcd_hub_control(struct dwc2_hsotg *hsotg, u16 typereq,dev_dbg (hsotg->dev,"ClearPortFeature USB_PORT_FEAT_SUSPEND\n" );writel (0 , hsotg->regs +PCGCTL ); -usleep_range (20000 ,40000 ); +msleep (USB_RESUME_TIMEOUT ); hprt0 =dwc2_read_hprt0 (hsotg); hprt0 |=HPRT0_RES ;
Signature · 1 line
2.3.7
PATCH 85/142 UBI: fix soft lockup in ubi_check_volume()
In reply to Jiri SlabyFrom: hujianyang <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9aa272b492e7551a9ee0e2c83c720ea013698485 upstream.
Running mtd-utils/tests/ubi-tests/io_basic.c could cause soft lockup or watchdog reset. It is because *updatevol* will perform ubi_check_volume() after updating finish and this function will full scan the updated lebs if the volume is initialized as STATIC_VOLUME.
This patch adds *cond_resched()* in the loop of lebs scan to avoid soft lockup.
Helped by Richard Weinberger <[email protected]>
[ 2158.067096] INFO: rcu_sched self-detected stall on CPU { 1} (t=2101 jiffies g=1606 c=1605 q=56)
[ 2158.172867] CPU: 1 PID: 2073 Comm: io_basic Tainted: G O 3.10.53 #21
[ 2158.172898] [<c000f624>] (unwind_backtrace+0x0/0x120) from [<c000c294>] (show_stack+0x10/0x14)
[ 2158.172918] [<c000c294>] (show_stack+0x10/0x14) from [<c008ac3c>] (rcu_check_callbacks+0x1c0/0x660)
[ 2158.172936] [<c008ac3c>] (rcu_check_callbacks+0x1c0/0x660) from [<c002b480>] (update_process_times+0x38/0x64)
[ 2158.172953] [<c002b480>] (update_process_times+0x38/0x64) from [<c005ff38>] (tick_sched_handle+0x54/0x60)
[ 2158.172966] [<c005ff38>] (tick_sched_handle+0x54/0x60) from [<c00601ac>] (tick_sched_timer+0x44/0x74)
[ 2158.172978] [<c00601ac>] (tick_sched_timer+0x44/0x74) from [<c003f348>] (__run_hrtimer+0xc8/0x1b8)
[ 2158.172992] [<c003f348>] (__run_hrtimer+0xc8/0x1b8) from [<c003fd9c>] (hrtimer_interrupt+0x128/0x2a4)
[ 2158.173007] [<c003fd9c>] (hrtimer_interrupt+0x128/0x2a4) from [<c0246f1c>] (arch_timer_handler_virt+0x28/0x30)
[ 2158.173022] [<c0246f1c>] (arch_timer_handler_virt+0x28/0x30) from [<c0086214>] (handle_percpu_devid_irq+0x9c/0x124)
[ 2158.173036] [<c0086214>] (handle_percpu_devid_irq+0x9c/0x124) from [<c0082bd8>] (generic_handle_irq+0x20/0x30)
[ 2158.173049] [<c0082bd8>] (generic_handle_irq+0x20/0x30) from [<c000969c>] (handle_IRQ+0x64/0x8c)
[ 2158.173060] [<c000969c>] (handle_IRQ+0x64/0x8c) from [<c0008544>] (gic_handle_irq+0x3c/0x60)
[ 2158.173074] [<c0008544>] (gic_handle_irq+0x3c/0x60) from [<c02f0f80>] (__irq_svc+0x40/0x50)
[ 2158.173083] Exception stack(0xc4043c98 to 0xc4043ce0)
[ 2158.173092] 3c80: c4043ce4 00000019
[ 2158.173102] 3ca0: 1f8a865f c050ad10 1f8a864c 00000031 c04b5970 0003ebce 00000000 f3550000
[ 2158.173113] 3cc0: bf00bc68 00000800 0003ebce c4043ce0 c0186d14 c0186cb8 80000013 ffffffff
[ 2158.173130] [<c02f0f80>] (__irq_svc+0x40/0x50) from [<c0186cb8>] (read_current_timer+0x4/0x38)
[ 2158.173145] [<c0186cb8>] (read_current_timer+0x4/0x38) from [<1f8a865f>] (0x1f8a865f)
[ 2183.927097] BUG: soft lockup - CPU#1 stuck for 22s! [io_basic:2073]
[ 2184.002229] Modules linked in: nandflash(O) [last unloaded: nandflash]--- drivers/mtd/ubi/misc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mtd/ubi/misc.c +2 -0
@@ -74,6 +74,8 @@ int ubi_check_volume(struct ubi_device *ubi, int vol_id)for (i =0 ; i < vol->used_ebs; i++) {int size; +cond_resched (); +if (i == vol->used_ebs -1 ) size = vol->last_eb_bytes;else
Signature · 1 line
2.3.7
PATCH 6/142 Btrfs: fix log tree corruption when fs mounted with -o discard
In reply to Jiri SlabyFrom: Filipe Manana <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit dcc82f4783ad91d4ab654f89f37ae9291cdc846a upstream.
While committing a transaction we free the log roots before we write the new super block. Freeing the log roots implies marking the disk location of every node/leaf (metadata extent) as pinned before the new super block is written. This is to prevent the disk location of log metadata extents from being reused before the new super block is written, otherwise we would have a corrupted log tree if before the new super block is written a crash/reboot happens and the location of any log tree metadata extent ended up being reused and rewritten.
Even though we pinned the log tree's metadata extents, we were issuing a discard against them if the fs was mounted with the -o discard option, resulting in corruption of the log tree if a crash/reboot happened before writing the new super block - the next time the fs was mounted, during the log replay process we would find nodes/leafs of the log btree with a content full of zeroes, causing the process to fail and require the use of the tool btrfs-zero-log to wipeout the log tree (and all data previously fsynced becoming lost forever).
Fix this by not doing a discard when pinning an extent. The discard will be done later when it's safe (after the new super block is committed) at extent-tree.c:btrfs_finish_extent_commit().
--- fs/btrfs/extent-tree.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
fs/btrfs/extent-tree.c +2 -3
@@ -6613,12 +6613,11 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root,return -ENOSPC ; } -if (btrfs_test_opt (root,DISCARD )) - ret =btrfs_discard_extent (root, start, len,NULL ); -if (pin)pin_down_extent (root, cache, start, len,1 );else { +if (btrfs_test_opt (root,DISCARD )) + ret =btrfs_discard_extent (root, start, len,NULL );btrfs_add_free_space (cache, start, len);btrfs_update_reserved_bytes (cache, len,RESERVE_FREE ); }
Signature · 1 line
2.3.7
PATCH 23/142 power_supply: twl4030_madc: Check return value of power_supply_register
In reply to Jiri SlabyFrom: Krzysztof Kozlowski <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 68c3ed6fa7e0d69529ced772d650ab128916a81d upstream.
The return value of power_supply_register() call was not checked and even on error probe() function returned 0. If registering failed then during unbind the driver tried to unregister power supply which was not actually registered.
This could lead to memory corruption because power_supply_unregister() unconditionally cleans up given power supply.
--- drivers/power/twl4030_madc_battery.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/power/twl4030_madc_battery.c +5 -2
@@ -192,6 +192,7 @@ static int twl4030_madc_battery_probe(struct platform_device *pdev) {struct twl4030_madc_battery *twl4030_madc_bat;struct twl4030_madc_bat_platform_data *pdata = pdev->dev.platform_data; +int ret =0 ; twl4030_madc_bat =kzalloc (sizeof (*twl4030_madc_bat),GFP_KERNEL );if (!twl4030_madc_bat)
@@ -216,9 +217,11 @@ static int twl4030_madc_battery_probe(struct platform_device *pdev) twl4030_madc_bat->pdata = pdata;platform_set_drvdata (pdev, twl4030_madc_bat); -power_supply_register (&pdev->dev, &twl4030_madc_bat->psy); + ret =power_supply_register (&pdev->dev, &twl4030_madc_bat->psy); +if (ret <0 ) +kfree (twl4030_madc_bat); -return 0 ; +return ret; }static int twl4030_madc_battery_remove (struct platform_device *pdev)
Signature · 1 line
2.3.7
PATCH 58/142 ACPICA: Utilities: split IO address types from data type models.
In reply to Jiri SlabyFrom: Lv Zheng <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2b8760100e1de69b6ff004c986328a82947db4ad upstream.
ACPICA commit aacf863cfffd46338e268b7415f7435cae93b451
It is reported that on a physically 64-bit addressed machine, 32-bit kernel can trigger crashes in accessing the memory regions that are beyond the 32-bit boundary. The region field's start address should still be 32-bit compliant, but after a calculation (adding some offsets), it may exceed the 32-bit boundary. This case is rare and buggy, but there are real BIOSes leaked with such issues (see References below).
This patch fixes this gap by always defining IO addresses as 64-bit, and allows OSPMs to optimize it for a real 32-bit machine to reduce the size of the internal objects.
Internal acpi_physical_address usages in the structures that can be fixed by this change include:
1. struct acpi_object_region:
acpi_physical_address address;
2. struct acpi_address_range:
acpi_physical_address start_address;
acpi_physical_address end_address;
3. struct acpi_mem_space_context;
acpi_physical_address address;
4. struct acpi_table_desc
acpi_physical_address address;See known issues 1 for other usages.
Note that acpi_io_address which is used for ACPI_PROCESSOR may also suffer from same problem, so this patch changes it accordingly.
For iasl, it will enforce acpi_physical_address as 32-bit to generate 32-bit OSPM compatible tables on 32-bit platforms, we need to define ACPI_32BIT_PHYSICAL_ADDRESS for it in acenv.h.
Known issues:
1. Cleanup of mapped virtual address
In struct acpi_mem_space_context, acpi_physical_address is used as a virtual address:
acpi_physical_address mapped_physical_address;
It is better to introduce acpi_virtual_address or use acpi_size instead. This patch doesn't make such a change. Because this should be done along with a change to acpi_os_map_memory()/acpi_os_unmap_memory(). There should be no functional problem to leave this unchanged except that only this structure is enlarged unexpectedly.
Reference: https://bugzilla.kernel.org/show_bug.cgi?id=87971
Reference: https://bugzilla.kernel.org/show_bug.cgi?id=79501
--- include/acpi/actypes.h | 20 ++++++++++++++++++++ include/acpi/platform/acenv.h | 1 + 2 files changed, 21 insertions(+)
include/acpi/actypes.h +20 -0
@@ -198,9 +198,29 @@ typedef int INT32;typedef s32 acpi_native_int ;typedef u32 acpi_size ; + +#ifdef ACPI_32BIT_PHYSICAL_ADDRESS + +/* +* OSPMs can define this to shrink the size of the structures for 32-bit +* none PAE environment. ASL compiler may always define this to generate +* 32-bit OSPM compliant tables. +*/ typedef u32 acpi_io_address ;typedef u32 acpi_physical_address ; +#else /* ACPI_32BIT_PHYSICAL_ADDRESS */ + +/* +* It is reported that, after some calculations, the physical addresses can +* wrap over the 32-bit boundary on 32-bit PAE environment. +* https://bugzilla.kernel.org/show_bug.cgi?id=87971 +*/ +typedef u64 acpi_io_address ; +typedef u64 acpi_physical_address ; + +#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */ +#define ACPI_MAX_PTR ACPI_UINT32_MAX#define ACPI_SIZE_MAX ACPI_UINT32_MAX
include/acpi/platform/acenv.h +1 -0
@@ -76,6 +76,7 @@#define ACPI_LARGE_NAMESPACE_NODE #define ACPI_DATA_TABLE_DISASSEMBLY #define ACPI_SINGLE_THREADED +#define ACPI_32BIT_PHYSICAL_ADDRESS #endif /* acpi_exec configuration. Multithreaded with full AML debugger */
Signature · 1 line
2.3.7
PATCH 25/142 ARM: 8320/1: fix integer overflow in ELF_ET_DYN_BASE
In reply to Jiri SlabyFrom: Andrey Ryabinin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8defb3367fcd19d1af64c07792aade0747b54e0f upstream.
Usually ELF_ET_DYN_BASE is 2/3 of TASK_SIZE. With 3G/1G user/kernel split this is not so, because 2*TASK_SIZE overflows 32 bits, so the actual value of ELF_ET_DYN_BASE is:
(2 * TASK_SIZE / 3) = 0x2a000000
When ASLR is disabled PIE binaries will load at ELF_ET_DYN_BASE address. On 32bit platforms AddressSanitzer uses addresses [0x20000000 - 0x40000000] for shadow memory [1]. So ASan doesn't work for PIE binaries when ASLR disabled as it fails to map shadow memory.
Also after Kees's 'split ET_DYN ASLR from mmap ASLR' patchset PIE binaries has a high chance of loading somewhere in between [0x2a000000 - 0x40000000] even if ASLR enabled. This makes ASan with PIE absolutely incompatible.
Fix overflow by dividing TASK_SIZE prior to multiplying. After this patch ELF_ET_DYN_BASE equals to (for CONFIG_VMSPLIT_3G=y):
(TASK_SIZE / 3 * 2) = 0x7f555554
[1] https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm#Mapping
--- arch/arm/include/asm/elf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/include/asm/elf.h +1 -1
@@ -114,7 +114,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);the loader. We need to make sure that it is out of the way of the program that it will "exec", and that there is sufficient room for the brk. */ -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3) +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)/* When the program starts, a1 contains a pointer to a function to be registered with atexit, as per the SVR4 ABI. A value of 0 means we
Signature · 1 line
2.3.7
PATCH 107/142 seq_file: always clear m->count when we free m->buf
In reply to Jiri SlabyFrom: Al Viro <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 801a76050bcf8d4e500eb8d048ff6265f37a61c8 upstream.
Once we'd freed m->buf, m->count should become zero - we have no valid contents reachable via m->buf.
--- fs/seq_file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/seq_file.c +2 -1
@@ -136,6 +136,7 @@ static int traverse(struct seq_file *m, loff_t offset) Eoverflow: m->op->stop (m, p);kfree (m->buf); + m->count =0 ; m->buf =kmalloc (m->size <<=1 ,GFP_KERNEL );return !m->buf ? -ENOMEM : -EAGAIN ; }
@@ -232,10 +233,10 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos) goto Fill; m->op->stop (m, p);kfree (m->buf); + m->count =0 ; m->buf =kmalloc (m->size <<=1 ,GFP_KERNEL );if (!m->buf) goto Enomem; - m->count =0 ; m->version =0 ; pos = m->index; p = m->op->start (m, &pos);
Signature · 1 line
2.3.7
PATCH 22/142 ring-buffer: Replace this_cpu_*() with __this_cpu_*()
In reply to Jiri SlabyFrom: Steven Rostedt <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 80a9b64e2c156b6523e7a01f2ba6e5d86e722814 upstream.
It has come to my attention that this_cpu_read/write are horrible on architectures other than x86. Worse yet, they actually disable preemption or interrupts! This caused some unexpected tracing results on ARM.
101.356868: preempt_count_add <-ring_buffer_lock_reserve 101.356870: preempt_count_sub <-ring_buffer_lock_reserve
The ring_buffer_lock_reserve has recursion protection that requires accessing a per cpu variable. But since preempt_disable() is traced, it too got traced while accessing the variable that is suppose to prevent recursion like this.
The generic version of this_cpu_read() and write() are:
#define this_cpu_generic_read(pcp) \
({ typeof(pcp) ret__; \
preempt_disable(); \
ret__ = *this_cpu_ptr(&(pcp)); \
preempt_enable(); \
ret__; \})
#define this_cpu_generic_to_op(pcp, val, op) \
do { \
unsigned long flags; \
raw_local_irq_save(flags); \
*__this_cpu_ptr(&(pcp)) op val; \
raw_local_irq_restore(flags); \} while (0)
Which is unacceptable for locations that know they are within preempt disabled or interrupt disabled locations.
Paul McKenney stated that __this_cpu_() versions produce much better code on other architectures than this_cpu_() does, if we know that the call is done in a preempt disabled location.
I also changed the recursive_unlock() to use two local variables instead of accessing the per_cpu variable twice.
--- kernel/trace/ring_buffer.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
kernel/trace/ring_buffer.c +5 -6
@@ -2651,7 +2651,7 @@ static DEFINE_PER_CPU(unsigned int, current_context); static __always_inline int trace_recursive_lock(void) { -unsigned int val =this_cpu_read (current_context); +unsigned int val =__this_cpu_read (current_context);int bit;if (in_interrupt ()) {
@@ -2668,18 +2668,17 @@ static __always_inline int trace_recursive_lock(void)return 1 ; val |= (1 << bit); -this_cpu_write (current_context, val); +__this_cpu_write (current_context, val);return 0 ; } static __always_inline void trace_recursive_unlock(void) { -unsigned int val =this_cpu_read (current_context); +unsigned int val =__this_cpu_read (current_context); - val--; - val &=this_cpu_read (current_context); -this_cpu_write (current_context, val); + val &= val & (val -1 ); +__this_cpu_write (current_context, val); }#else
Signature · 1 line
2.3.7
PATCH 35/142 usb: host: xhci: use new USB_RESUME_TIMEOUT
In reply to Jiri SlabyFrom: Felipe Balbi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b9e451885deb6262dbaf5cd14aa77d192d9ac759 upstream.
Make sure we're using the new macro, so our resume signaling will always pass certification.
--- drivers/usb/host/xhci-ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-ring.c +1 -1
@@ -1735,7 +1735,7 @@ static void handle_port_status(struct xhci_hcd *xhci, }else {xhci_dbg (xhci,"resume HS port %d\n" , port_id); bus_state->resume_done[faked_port_index] = jiffies + -msecs_to_jiffies (20 ); +msecs_to_jiffies (USB_RESUME_TIMEOUT );set_bit (faked_port_index, &bus_state->resuming_ports);mod_timer (&hcd->rh_timer, bus_state->resume_done[faked_port_index]);
Signature · 1 line
2.3.7
PATCH 113/142 nilfs2: fix sanity check of btree level in nilfs_btree_root_broken()
In reply to Jiri SlabyFrom: Ryusuke Konishi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d8fd150fe3935e1692bf57c66691e17409ebb9c1 upstream.
The range check for b-tree level parameter in nilfs_btree_root_broken() is wrong; it accepts the case of "level == NILFS_BTREE_LEVEL_MAX" even though the level is limited to values in the range of 0 to (NILFS_BTREE_LEVEL_MAX - 1).
Since the level parameter is read from storage device and used to index nilfs_btree_path array whose element count is NILFS_BTREE_LEVEL_MAX, it can cause memory overrun during btree operations if the boundary value is set to the level parameter on device.
This fixes the broken sanity check and adds a comment to clarify that the upper bound NILFS_BTREE_LEVEL_MAX is exclusive.
--- fs/nilfs2/btree.c | 2 +- include/linux/nilfs2_fs.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
fs/nilfs2/btree.c +1 -1
@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node, nchildren =nilfs_btree_node_get_nchildren (node);if (unlikely (level <NILFS_BTREE_LEVEL_NODE_MIN || - level >NILFS_BTREE_LEVEL_MAX || + level >=NILFS_BTREE_LEVEL_MAX || nchildren <0 || nchildren >NILFS_BTREE_ROOT_NCHILDREN_MAX )) { pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
include/linux/nilfs2_fs.h +1 -1
@@ -458,7 +458,7 @@ struct nilfs_btree_node {/* level */ #define NILFS_BTREE_LEVEL_DATA 0#define NILFS_BTREE_LEVEL_NODE_MIN (NILFS_BTREE_LEVEL_DATA + 1) -#define NILFS_BTREE_LEVEL_MAX 14 +#define NILFS_BTREE_LEVEL_MAX 14/* Max level (exclusive) */ /** * struct nilfs_palloc_group_desc - block group descriptor
Signature · 1 line
2.3.7
PATCH 115/142 gpio: unregister gpiochip device before removing it
In reply to Jiri SlabyFrom: Johan Hovold <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 01cca93a9491ed95992523ff7e79dd9bfcdea8e0 upstream.
Unregister gpiochip device (used to export information through sysfs) before removing it internally. This way removal will reverse addition.
--- drivers/gpio/gpiolib.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/gpio/gpiolib.c +2 -3
@@ -1257,6 +1257,8 @@ int gpiochip_remove(struct gpio_chip *chip)int status =0 ;unsigned id; +gpiochip_unexport (chip); +spin_lock_irqsave (&gpio_lock, flags);gpiochip_remove_pin_ranges (chip);
@@ -1277,9 +1279,6 @@ int gpiochip_remove(struct gpio_chip *chip)spin_unlock_irqrestore (&gpio_lock, flags); -if (status ==0 ) -gpiochip_unexport (chip); -return status; }EXPORT_SYMBOL_GPL (gpiochip_remove);
Signature · 1 line
2.3.7
PATCH 8/142 Btrfs: fix inode eviction infinite loop after cloning into it
In reply to Jiri SlabyFrom: Filipe Manana <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ccccf3d67294714af2d72a6fd6fd7d73b01c9329 upstream.
If we attempt to clone a 0 length region into a file we can end up inserting a range in the inode's extent_io tree with a start offset that is greater then the end offset, which triggers immediately the following warning:
[ 3914.619057] WARNING: CPU: 17 PID: 4199 at fs/btrfs/extent_io.c:435 insert_state+0x4b/0x10b [btrfs]() [ 3914.620886] BTRFS: end < start 4095 4096 (...) [ 3914.638093] Call Trace: [ 3914.638636] [<ffffffff81425fd9>] dump_stack+0x4c/0x65 [ 3914.639620] [<ffffffff81045390>] warn_slowpath_common+0xa1/0xbb [ 3914.640789] [<ffffffffa03ca44f>] ? insert_state+0x4b/0x10b [btrfs] [ 3914.642041] [<ffffffff810453f0>] warn_slowpath_fmt+0x46/0x48 [ 3914.643236] [<ffffffffa03ca44f>] insert_state+0x4b/0x10b [btrfs] [ 3914.644441] [<ffffffffa03ca729>] __set_extent_bit+0x107/0x3f4 [btrfs] [ 3914.645711] [<ffffffffa03cb256>] lock_extent_bits+0x65/0x1bf [btrfs] [ 3914.646914] [<ffffffff8142b2fb>] ? _raw_spin_unlock+0x28/0x33 [ 3914.648058] [<ffffffffa03cbac4>] ? test_range_bit+0xcc/0xde [btrfs] [ 3914.650105] [<ffffffffa03cb3c3>] lock_extent+0x13/0x15 [btrfs] [ 3914.651361] [<ffffffffa03db39e>] lock_extent_range+0x3d/0xcd [btrfs] [ 3914.652761] [<ffffffffa03de1fe>] btrfs_ioctl_clone+0x278/0x388 [btrfs] [ 3914.654128] [<ffffffff811226dd>] ? might_fault+0x58/0xb5 [ 3914.655320] [<ffffffffa03e0909>] btrfs_ioctl+0xb51/0x2195 [btrfs] (...) [ 3914.669271] ---[ end trace 14843d3e2e622fc1 ]---
This later makes the inode eviction handler enter an infinite loop that keeps dumping the following warning over and over:
[ 3915.117629] WARNING: CPU: 22 PID: 4228 at fs/btrfs/extent_io.c:435 insert_state+0x4b/0x10b [btrfs]() [ 3915.119913] BTRFS: end < start 4095 4096 (...) [ 3915.137394] Call Trace: [ 3915.137913] [<ffffffff81425fd9>] dump_stack+0x4c/0x65 [ 3915.139154] [<ffffffff81045390>] warn_slowpath_common+0xa1/0xbb [ 3915.140316] [<ffffffffa03ca44f>] ? insert_state+0x4b/0x10b [btrfs] [ 3915.141505] [<ffffffff810453f0>] warn_slowpath_fmt+0x46/0x48 [ 3915.142709] [<ffffffffa03ca44f>] insert_state+0x4b/0x10b [btrfs] [ 3915.143849] [<ffffffffa03ca729>] __set_extent_bit+0x107/0x3f4 [btrfs] [ 3915.145120] [<ffffffffa038c1e3>] ? btrfs_kill_super+0x17/0x23 [btrfs] [ 3915.146352] [<ffffffff811548f6>] ? deactivate_locked_super+0x3b/0x50 [ 3915.147565] [<ffffffffa03cb256>] lock_extent_bits+0x65/0x1bf [btrfs] [ 3915.148785] [<ffffffff8142b7e2>] ? _raw_write_unlock+0x28/0x33 [ 3915.149931] [<ffffffffa03bc325>] btrfs_evict_inode+0x196/0x482 [btrfs] [ 3915.151154] [<ffffffff81168904>] evict+0xa0/0x148 [ 3915.152094] [<ffffffff811689e5>] dispose_list+0x39/0x43 [ 3915.153081] [<ffffffff81169564>] evict_inodes+0xdc/0xeb [ 3915.154062] [<ffffffff81154418>] generic_shutdown_super+0x49/0xef [ 3915.155193] [<ffffffff811546d1>] kill_anon_super+0x13/0x1e [ 3915.156274] [<ffffffffa038c1e3>] btrfs_kill_super+0x17/0x23 [btrfs] (...) [ 3915.167404] ---[ end trace 14843d3e2e622fc2 ]---
So just bail out of the clone ioctl if the length of the region to clone is zero, without locking any extent range, in order to prevent this issue (same behaviour as a pwrite with a 0 length for example).
This is trivial to reproduce. For example, the steps for the test I just made for fstests:
mkfs.btrfs -f SCRATCH_DEV
mount SCRATCH_DEV $SCRATCH_MNT
touch $SCRATCH_MNT/foo
touch $SCRATCH_MNT/bar
$CLONER_PROG -s 0 -d 4096 -l 0 $SCRATCH_MNT/foo $SCRATCH_MNT/bar umount $SCRATCH_MNT
A test case for fstests follows soon.
--- fs/btrfs/ioctl.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/btrfs/ioctl.c +5 -0
@@ -3211,6 +3211,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,if (off + len == src->i_size) len =ALIGN (src->i_size, bs) - off; +if (len ==0 ) { + ret =0 ; + goto out_unlock; + } +/* verify the end result is block aligned */ if (!IS_ALIGNED (off, bs) || !IS_ALIGNED (off + len, bs) || !IS_ALIGNED (destoff, bs))
Signature · 1 line
2.3.7
PATCH 24/142 power_supply: lp8788-charger: Fix leaked power supply on probe fail
In reply to Jiri SlabyFrom: Krzysztof Kozlowski <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a7117f81e8391e035c49b3440792f7e6cea28173 upstream.
Driver forgot to unregister charger power supply if registering of battery supply failed in probe(). In such case the memory associated with power supply leaked.
--- drivers/power/lp8788-charger.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/power/lp8788-charger.c +3 -1
@@ -417,8 +417,10 @@ static int lp8788_psy_register(struct platform_device *pdev, pchg->battery.num_properties =ARRAY_SIZE (lp8788_battery_prop); pchg->battery.get_property = lp8788_battery_get_property; -if (power_supply_register (&pdev->dev, &pchg->battery)) +if (power_supply_register (&pdev->dev, &pchg->battery)) { +power_supply_unregister (&pchg->charger);return -EPERM ; + }return 0 ; }
Signature · 1 line
2.3.7
PATCH 64/142 mvsas: fix panic on expander attached SATA devices
In reply to Jiri SlabyFrom: James Bottomley <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 56cbd0ccc1b508de19561211d7ab9e1c77e6b384 upstream.
mvsas is giving a General protection fault when it encounters an expander attached ATA device. Analysis of mvs_task_prep_ata() shows that the driver is assuming all ATA devices are locally attached and obtaining the phy mask by indexing the local phy table (in the HBA structure) with the phy id. Since expanders have many more phys than the HBA, this is causing the index into the HBA phy table to overflow and returning rubbish as the pointer.
mvs_task_prep_ssp() instead does the phy mask using the port properties. Mirror this in mvs_task_prep_ata() to fix the panic.
--- drivers/scsi/mvsas/mv_sas.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/scsi/mvsas/mv_sas.c +1 -4
@@ -441,14 +441,11 @@ static u32 mvs_get_ncq_tag(struct sas_task *task, u32 *tag)static int mvs_task_prep_ata (struct mvs_info *mvi,struct mvs_task_exec_info *tei) { -struct sas_ha_struct *sha = mvi->sas;struct sas_task *task = tei->task;struct domain_device *dev = task->dev;struct mvs_device *mvi_dev = dev->lldd_dev;struct mvs_cmd_hdr *hdr = tei->hdr;struct asd_sas_port *sas_port = dev->port; -struct sas_phy *sphy = dev->phy; -struct asd_sas_phy *sas_phy = sha->sas_phy[sphy->number];struct mvs_slot_info *slot;void *buf_prd;u32 tag = tei->tag, hdr_tag;
@@ -468,7 +465,7 @@ static int mvs_task_prep_ata(struct mvs_info *mvi, slot->tx = mvi->tx_prod; del_q =TXQ_MODE_I | tag | (TXQ_CMD_STP <<TXQ_CMD_SHIFT ) | - (MVS_PHY_ID <<TXQ_PHY_SHIFT ) | + ((sas_port->phy_mask &TXQ_PHY_MASK ) <<TXQ_PHY_SHIFT ) | (mvi_dev->taskfileset <<TXQ_SRS_SHIFT ); mvi->tx[mvi->tx_prod] =cpu_to_le32 (del_q);
Signature · 1 line
2.3.7
PATCH 21/142 compal-laptop: Check return value of power_supply_register
In reply to Jiri SlabyFrom: Krzysztof Kozlowski <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1915a718b1872edffcb13e5436a9f7302d3d36f0 upstream.
The return value of power_supply_register() call was not checked and even on error probe() function returned 0. If registering failed then during unbind the driver tried to unregister power supply which was not actually registered.
This could lead to memory corruption because power_supply_unregister() unconditionally cleans up given power supply.
Fix this by checking return status of power_supply_register() call. In case of failure, clean up sysfs entries and fail the probe.
--- drivers/platform/x86/compal-laptop.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/platform/x86/compal-laptop.c +7 -1
@@ -1049,7 +1049,13 @@ static int compal_probe(struct platform_device *pdev)/* Power supply */ initialize_power_supply_data (data); -power_supply_register (&compal_device->dev, &data->psy); + err =power_supply_register (&compal_device->dev, &data->psy); +if (err <0 ) { +hwmon_device_unregister (data->hwmon_dev); +sysfs_remove_group (&pdev->dev.kobj, &compal_attribute_group); +kfree (data); +return err; + }platform_set_drvdata (pdev, data);
Signature · 1 line
2.3.7
PATCH 32/142 usb: host: fotg210: use new USB_RESUME_TIMEOUT
In reply to Jiri SlabyFrom: Felipe Balbi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7e136bb71a08e8b8be3bc492f041d9b0bea3856d upstream.
Make sure we're using the new macro, so our
resume signaling will always pass certification.
--- drivers/usb/host/fotg210-hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/fotg210-hcd.c +1 -1
@@ -1651,7 +1651,7 @@ static int fotg210_hub_control(/* resume signaling for 20 msec */ fotg210_writel (fotg210, temp |PORT_RESUME , status_reg); fotg210->reset_done[wIndex] = jiffies - +msecs_to_jiffies (20 ); + +msecs_to_jiffies (USB_RESUME_TIMEOUT );break ;case USB_PORT_FEAT_C_SUSPEND :clear_bit (wIndex, &fotg210->port_c_suspend);
Signature · 1 line
2.3.7
PATCH 34/142 usb: host: isp116x: use new USB_RESUME_TIMEOUT
In reply to Jiri SlabyFrom: Felipe Balbi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8c0ae6574ccfd3d619876a65829aad74c9d22ba5 upstream.
Make sure we're using the new macro, so our
resume signaling will always pass certification.
--- drivers/usb/host/isp116x-hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/isp116x-hcd.c +1 -1
@@ -1488,7 +1488,7 @@ static int isp116x_bus_resume(struct usb_hcd *hcd)spin_unlock_irq (&isp116x->lock); hcd->state =HC_STATE_RESUMING ; -msleep (20 ); +msleep (USB_RESUME_TIMEOUT );/* Go operational */ spin_lock_irq (&isp116x->lock);
Signature · 1 line
2.3.7
PATCH 5/142 net: fix crash in build_skb()
In reply to Jiri SlabyFrom: Eric Dumazet <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit 2ea2f62c8bda242433809c7f4e9eae1c52c40bbe ]
When I added pfmemalloc support in build_skb(), I forgot netlink was using build_skb() with a vmalloc() area.
In this patch I introduce __build_skb() for netlink use, and build_skb() is a wrapper handling both skb->head_frag and skb->pfmemalloc
This means netlink no longer has to hack skb->head_frag
[ 1567.700067] kernel BUG at arch/x86/mm/physaddr.c:26! [ 1567.700067] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 1567.700067] Dumping ftrace buffer: [ 1567.700067] (ftrace buffer empty) [ 1567.700067] Modules linked in: [ 1567.700067] CPU: 9 PID: 16186 Comm: trinity-c182 Not tainted 4.0.0-next-20150424-sasha-00037-g4796e21 #2167 [ 1567.700067] task: ffff880127efb000 ti: ffff880246770000 task.ti: ffff880246770000 [ 1567.700067] RIP: __phys_addr (arch/x86/mm/physaddr.c:26 (discriminator 3)) [ 1567.700067] RSP: 0018:ffff8802467779d8 EFLAGS: 00010202 [ 1567.700067] RAX: 000041000ed8e000 RBX: ffffc9008ed8e000 RCX: 000000000000002c [ 1567.700067] RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffffffffb3fd6049 [ 1567.700067] RBP: ffff8802467779f8 R08: 0000000000000019 R09: ffff8801d0168000 [ 1567.700067] R10: ffff8801d01680c7 R11: ffffed003a02d019 R12: ffffc9000ed8e000 [ 1567.700067] R13: 0000000000000f40 R14: 0000000000001180 R15: ffffc9000ed8e000 [ 1567.700067] FS: 00007f2a7da3f700(0000) GS:ffff8801d1000000(0000) knlGS:0000000000000000 [ 1567.700067] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1567.700067] CR2: 0000000000738308 CR3: 000000022e329000 CR4: 00000000000007e0 [ 1567.700067] Stack: [ 1567.700067] ffffc9000ed8e000 ffff8801d0168000 ffffc9000ed8e000 ffff8801d0168000 [ 1567.700067] ffff880246777a28 ffffffffad7c0a21 0000000000001080 ffff880246777c08 [ 1567.700067] ffff88060d302e68 ffff880246777b58 ffff880246777b88 ffffffffad9a6821 [ 1567.700067] Call Trace: [ 1567.700067] build_skb (include/linux/mm.h:508 net/core/skbuff.c:316) [ 1567.700067] netlink_sendmsg (net/netlink/af_netlink.c:1633 net/netlink/af_netlink.c:2329) [ 1567.774369] ? sched_clock_cpu (kernel/sched/clock.c:311) [ 1567.774369] ? netlink_unicast (net/netlink/af_netlink.c:2273) [ 1567.774369] ? netlink_unicast (net/netlink/af_netlink.c:2273) [ 1567.774369] sock_sendmsg (net/socket.c:614 net/socket.c:623) [ 1567.774369] sock_write_iter (net/socket.c:823) [ 1567.774369] ? sock_sendmsg (net/socket.c:806) [ 1567.774369] __vfs_write (fs/read_write.c:479 fs/read_write.c:491) [ 1567.774369] ? get_lock_stats (kernel/locking/lockdep.c:249) [ 1567.774369] ? default_llseek (fs/read_write.c:487) [ 1567.774369] ? vtime_account_user (kernel/sched/cputime.c:701) [ 1567.774369] ? rw_verify_area (fs/read_write.c:406 (discriminator 4)) [ 1567.774369] vfs_write (fs/read_write.c:539) [ 1567.774369] SyS_write (fs/read_write.c:586 fs/read_write.c:577) [ 1567.774369] ? SyS_read (fs/read_write.c:577) [ 1567.774369] ? __this_cpu_preempt_check (lib/smp_processor_id.c:63) [ 1567.774369] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2594 kernel/locking/lockdep.c:2636) [ 1567.774369] ? trace_hardirqs_on_thunk (arch/x86/lib/thunk_64.S:42) [ 1567.774369] system_call_fastpath (arch/x86/kernel/entry_64.S:261)
--- include/linux/skbuff.h | 1 + net/core/skbuff.c | 31 ++++++++++++++++++++++--------- net/netlink/af_netlink.c | 6 ++---- 3 files changed, 25 insertions(+), 13 deletions(-)
include/linux/skbuff.h +1 -0
@@ -638,6 +638,7 @@ extern bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,extern struct sk_buff *__alloc_skb (unsigned int size,gfp_t priority,int flags,int node); +struct sk_buff *__build_skb (void *data,unsigned int frag_size);extern struct sk_buff *build_skb (void *data,unsigned int frag_size);static inline struct sk_buff *alloc_skb (unsigned int size,gfp_t priority)
net/core/skbuff.c +22 -9
@@ -277,13 +277,14 @@ nodata:EXPORT_SYMBOL (__alloc_skb);/** -* build_skb - build a network buffer +* __build_skb - build a network buffer * @data: data buffer provided by caller -* @frag_size: size of fragment, or 0 if head was kmalloced +* @frag_size: size of data, or 0 if head was kmalloced * * Allocate a new &sk_buff. Caller provides space holding head and * skb_shared_info. @data must have been allocated by kmalloc() only if -* @frag_size is 0, otherwise data should come from the page allocator. +* @frag_size is 0, otherwise data should come from the page allocator +* or vmalloc() * The return is the new skb buffer. * On a failure the return is %NULL, and @data is not freed. * Notes :
@@ -294,7 +295,7 @@ EXPORT_SYMBOL(__alloc_skb);* before giving packet to stack. * RX rings only contains data buffers, not full skbs. */ -struct sk_buff *build_skb (void *data,unsigned int frag_size) +struct sk_buff *__build_skb (void *data,unsigned int frag_size) {struct skb_shared_info *shinfo;struct sk_buff *skb;
@@ -308,11 +309,6 @@ struct sk_buff *build_skb(void *data, unsigned int frag_size)memset (skb,0 , offsetof(struct sk_buff , tail)); skb->truesize =SKB_TRUESIZE (size); -if (frag_size) { - skb->head_frag =1 ; -if (virt_to_head_page (data)->pfmemalloc) - skb->pfmemalloc =1 ; - }atomic_set (&skb->users,1 ); skb->head = data; skb->data = data;
@@ -329,6 +325,23 @@ struct sk_buff *build_skb(void *data, unsigned int frag_size)return skb; } + +/* build_skb() is wrapper over __build_skb(), that specifically +* takes care of skb->head and skb->pfmemalloc +* This means that if @frag_size is not zero, then @data must be backed +* by a page fragment, not kmalloc() or vmalloc() +*/ +struct sk_buff *build_skb (void *data,unsigned int frag_size) +{ +struct sk_buff *skb =__build_skb (data, frag_size); + +if (skb && frag_size) { + skb->head_frag =1 ; +if (virt_to_head_page (data)->pfmemalloc) + skb->pfmemalloc =1 ; + } +return skb; +}EXPORT_SYMBOL (build_skb);struct netdev_alloc_cache {
net/netlink/af_netlink.c +2 -4
@@ -1616,13 +1616,11 @@ static struct sk_buff *netlink_alloc_large_skb(unsigned int size,if (data ==NULL )return NULL ; - skb =build_skb (data, size); + skb =__build_skb (data, size);if (skb ==NULL )vfree (data); -else { - skb->head_frag =0 ; +else skb->destructor = netlink_skb_destructor; - }return skb; }
Signature · 1 line
2.3.7
PATCH 12/142 drivers: parport: Kconfig: exclude arm64 for PARPORT_PC
In reply to Jiri SlabyFrom: Guenter Roeck <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
Fix build problem seen with arm64:allmodconfig.
drivers/parport/parport_pc.c:67:25: fatal error: asm/parport.h: No such file or directory
arm64 does not support PARPORT_PC.
--- drivers/parport/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/parport/Kconfig +1 -1
@@ -37,7 +37,7 @@ config PARPORT_PC tristate "PC-style hardware" depends on (!SPARC64 || PCI) && !SPARC32 && !M32R && !FRV && !S390 && \ (!M68K || ISA) && !MN10300 && !AVR32 && !BLACKFIN && \ - !XTENSA && !CRIS && !H8300 + !XTENSA && !CRIS && !H8300 && !ARM64 ---help--- You should say Y here if you have a PC-style parallel port. All
Signature · 1 line
2.3.7
PATCH 20/142 spi: spidev: fix possible arithmetic overflow for multi-transfer message
In reply to Jiri SlabyFrom: Ian Abbott <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f20fbaad7620af2df36a1f9d1c9ecf48ead5b747 upstream.
spidev_message() sums the lengths of the individual SPI transfers to determine the overall SPI message length. It restricts the total length, returning an error if too long, but it does not check for arithmetic overflow. For example, if the SPI message consisted of two transfers and the first has a length of 10 and the second has a length of (__u32)(-1), the total length would be seen as 9, even though the second transfer is actually very long. If the second transfer specifies a null rx_buf and a non-null tx_buf, the copy_from_user() could overrun the spidev's pre-allocated tx buffer before it reaches an invalid user memory address. Fix it by checking that neither the total nor the individual transfer lengths exceed the maximum allowed value.
Thanks to Dan Carpenter for reporting the potential integer overflow.
--- drivers/spi/spidev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/spi/spidev.c +4 -1
@@ -243,7 +243,10 @@ static int spidev_message(struct spidev_data *spidev, k_tmp->len = u_tmp->len; total += k_tmp->len; -if (total > bufsiz) { +/* Check total length of transfers. Also check each +* transfer length to avoid arithmetic overflow. +*/ +if (total > bufsiz || k_tmp->len > bufsiz) { status = -EMSGSIZE ; goto done; }
Signature · 1 line
2.3.7
PATCH 33/142 usb: host: r8a66597: use new USB_RESUME_TIMEOUT
In reply to Jiri SlabyFrom: Felipe Balbi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7a606ac29752a3e571b83f9b3fceb1eaa1d37781 upstream.
While this driver was already using a 50ms resume timeout, let's make sure everybody uses the same macro so it's easy to fix later should anything go wrong.
It also gives a more "stable" expectation to Linux users.
--- drivers/usb/host/r8a66597-hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/r8a66597-hcd.c +1 -1
@@ -2301,7 +2301,7 @@ static int r8a66597_bus_resume(struct usb_hcd *hcd) rh->port &= ~USB_PORT_STAT_SUSPEND ; rh->port |=USB_PORT_STAT_C_SUSPEND <<16 ;r8a66597_mdfy (r8a66597,RESUME ,RESUME |UACT , dvstctr_reg); -msleep (50 ); +msleep (USB_RESUME_TIMEOUT );r8a66597_mdfy (r8a66597,UACT ,RESUME |UACT , dvstctr_reg); }
Signature · 1 line
2.3.7
PATCH 47/142 powerpc/perf: Cap 64bit userspace backtraces to PERF_MAX_STACK_DEPTH
In reply to Jiri SlabyFrom: Anton Blanchard <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9a5cbce421a283e6aea3c4007f141735bf9da8c3 upstream.
We cap 32bit userspace backtraces to PERF_MAX_STACK_DEPTH (currently 127), but we forgot to do the same for 64bit backtraces.
--- arch/powerpc/perf/callchain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/perf/callchain.c +1 -1
@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry, sp = regs->gpr[1 ];perf_callchain_store (entry, next_ip); -for (;;) { +while (entry->nr <PERF_MAX_STACK_DEPTH ) { fp = (unsigned long __user *) sp;if (!valid_user_sp (sp,1 ) ||read_user_stack_64 (fp, &next_sp))return ;
Signature · 1 line
2.3.7
PATCH 102/142 usb: host: ehci: use new USB_RESUME_TIMEOUT
In reply to Jiri SlabyFrom: Felipe Balbi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ea16328f80ca8d74434352157f37ef60e2f55ce2 upstream.
Make sure we're using the new macro, so our
resume signaling will always pass certification.
--- drivers/usb/host/ehci-hcd.c | 10 +++++----- drivers/usb/host/ehci-hub.c | 9 ++++++--- 2 files changed, 11 insertions(+), 8 deletions(-)
drivers/usb/host/ehci-hcd.c +5 -5
@@ -791,12 +791,12 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd) ehci->reset_done[i] == 0))continue ; -/* start 20 msec resume signaling from this port, -* and make khubd collect PORT_STAT_C_SUSPEND to -* stop that signaling. Use 5 ms extra for safety, -* like usb_port_resume() does. +/* start USB_RESUME_TIMEOUT msec resume signaling from +* this port, and make hub_wq collect +* PORT_STAT_C_SUSPEND to stop that signaling. */ - ehci->reset_done[i] = jiffies +msecs_to_jiffies (25 ); + ehci->reset_done[i] = jiffies + +msecs_to_jiffies (USB_RESUME_TIMEOUT );set_bit (i, &ehci->resuming_ports);ehci_dbg (ehci,"port %d remote wakeup\n" , i +1 );usb_hcd_start_port_resume (&hcd->self, i);
drivers/usb/host/ehci-hub.c +6 -3
@@ -482,10 +482,13 @@ static int ehci_bus_resume (struct usb_hcd *hcd)ehci_writel (ehci, temp, &ehci->regs->port_status [i]); } -/* msleep for 20ms only if code is trying to resume port */ +/* +* msleep for USB_RESUME_TIMEOUT ms only if code is trying to resume +* port +*/ if (resume_needed) {spin_unlock_irq (&ehci->lock); -msleep (20 ); +msleep (USB_RESUME_TIMEOUT );spin_lock_irq (&ehci->lock);if (ehci->shutdown) goto shutdown;
@@ -953,7 +956,7 @@ static int ehci_hub_control ( temp &= ~PORT_WAKE_BITS ;ehci_writel (ehci, temp |PORT_RESUME , status_reg); ehci->reset_done[wIndex] = jiffies - +msecs_to_jiffies (20 ); + +msecs_to_jiffies (USB_RESUME_TIMEOUT );set_bit (wIndex, &ehci->resuming_ports);usb_hcd_start_port_resume (&hcd->self, wIndex);break ;
Signature · 1 line
2.3.7
PATCH 41/142 fs/binfmt_elf.c: fix bug in loading of PIE binaries
In reply to Jiri SlabyFrom: Michael Davidson <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 upstream.
With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base.
Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.
Since the size of the "gap" on x86_64 is only guaranteed to be 128MB this means that binaries with large data segments > 128MB can end up mapping part of their data segment over their stack resulting in corruption of the stack (and the data segment once the binary starts to run).
Any PIE binary with a data segment > 128MB is vulnerable to this although address randomization means that the actual gap between the stack and the end of the binary is normally greater than 128MB. The larger the data segment of the binary the higher the probability of failure.
Fix this by calculating the total size of the binary in the same way as load_elf_interp().
--- fs/binfmt_elf.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/binfmt_elf.c +8 -1
@@ -754,6 +754,7 @@ static int load_elf_binary(struct linux_binprm *bprm) i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {int elf_prot =0 , elf_flags;unsigned long k, vaddr; +unsigned long total_size =0 ;if (elf_ppnt->p_type !=PT_LOAD )continue ;
@@ -818,10 +819,16 @@ static int load_elf_binary(struct linux_binprm *bprm)#else load_bias =ELF_PAGESTART (ELF_ET_DYN_BASE - vaddr);#endif + total_size =total_mapping_size (elf_phdata, + loc->elf_ex.e_phnum); +if (!total_size) { + error = -EINVAL ; + goto out_free_dentry; + } } error =elf_map (bprm->file, load_bias + vaddr, elf_ppnt, - elf_prot, elf_flags,0 ); + elf_prot, elf_flags, total_size);if (BAD_ADDR (error)) {send_sig (SIGKILL , current,0 ); retval = IS_ERR((void *)error) ?
Signature · 1 line
2.3.7
PATCH 42/142 ptrace: fix race between ptrace_resume() and wait_task_stopped()
In reply to Jiri SlabyFrom: Oleg Nesterov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b72c186999e689cb0b055ab1c7b3cd8fffbeb5ed upstream.
ptrace_resume() is called when the tracee is still __TASK_TRACED. We set tracee->exit_code and then wake_up_state() changes tracee->state. If the tracer's sub-thread does wait() in between, task_stopped_code(ptrace => T) wrongly looks like another report from tracee.
This confuses debugger, and since wait_task_stopped() clears ->exit_code the tracee can miss a signal.
Test-case:
#include <stdio.h>
#include <unistd.h>
#include <sys/wait.h>
#include <sys/ptrace.h>
#include <pthread.h>
#include <assert.h>
int pid;
void *waiter(void *arg)
{
int stat;
for (;;) {
assert(pid == wait(&stat));
assert(WIFSTOPPED(stat));
if (WSTOPSIG(stat) == SIGHUP)
continue;
assert(WSTOPSIG(stat) == SIGCONT);
printf("ERR! extra/wrong report:%x\n", stat);
}
}
int main(void)
{
pthread_t thread;
pid = fork();
if (!pid) {
assert(ptrace(PTRACE_TRACEME, 0,0,0) == 0);
for (;;)
kill(getpid(), SIGHUP);
}
assert(pthread_create(&thread, NULL, waiter, NULL) == 0);
for (;;)
ptrace(PTRACE_CONT, pid, 0, SIGCONT);
return 0;
}Note for stable: the bug is very old, but without 9899d11f6544 "ptrace:
ensure arch_ptrace/ptrace_request can never race with SIGKILL" the fix should use lock_task_sighand(child).
--- kernel/ptrace.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
kernel/ptrace.c +20 -0
@@ -720,6 +720,8 @@ static int ptrace_peek_siginfo(struct task_struct *child,static int ptrace_resume (struct task_struct *child,long request,unsigned long data) { +bool need_siglock; +if (!valid_signal (data))return -EIO ;
@@ -747,8 +749,26 @@ static int ptrace_resume(struct task_struct *child, long request,user_disable_single_step (child); } +/* +* Change ->exit_code and ->state under siglock to avoid the race +* with wait_task_stopped() in between; a non-zero ->exit_code will +* wrongly look like another report from tracee. +* +* Note that we need siglock even if ->exit_code == data and/or this +* status was not reported yet, the new status must not be cleared by +* wait_task_stopped() after resume. +* +* If data == 0 we do not care if wait_task_stopped() reports the old +* status and clears the code too; this can't race with the tracee, it +* takes siglock after resume. +*/ + need_siglock = data && !thread_group_empty (current); +if (need_siglock) +spin_lock_irq (&child->sighand->siglock); child->exit_code = data;wake_up_state (child, __TASK_TRACED); +if (need_siglock) +spin_unlock_irq (&child->sighand->siglock);return 0 ; }
Signature · 1 line
2.3.7
PATCH 62/142 gpio: mvebu: Fix mask/unmask managment per irq chip type
In reply to Jiri SlabyFrom: Gregory CLEMENT <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 61819549f572edd7fce53f228c0d8420cdc85f71 upstream.
Level IRQ handlers and edge IRQ handler are managed by tow different sets of registers. But currently the driver uses the same mask for the both registers. It lead to issues with the following scenario:
First, an IRQ is requested on a GPIO to be triggered on front. After, this an other IRQ is requested for a GPIO of the same bank but triggered on level. Then the first one will be also setup to be triggered on level. It leads to an interrupt storm.
The different kind of handler are already associated with two different irq chip type. With this patch the driver uses a private mask for each one which solves this issue.
It has been tested on an Armada XP based board and on an Armada 375 board. For the both boards, with this patch is applied, there is no such interrupt storm when running the previous scenario.
This bug was already fixed but in a different way in the legacy version of this driver by Evgeniy Dushistov:9ece8839b1277fb9128ff6833411614ab6c88d68 "ARM: orion: Fix for certain sequence of request_irq can cause irq storm". The fact the new version of the gpio drive could be affected had been discussed there:
http://thread.gmane.org/gmane.linux.ports.arm.kernel/344670/focus=364012
--- drivers/gpio/gpio-mvebu.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-)
drivers/gpio/gpio-mvebu.c +16 -8
@@ -304,11 +304,13 @@ static void mvebu_gpio_edge_irq_mask(struct irq_data *d) {struct irq_chip_generic *gc =irq_data_get_irq_chip_data (d);struct mvebu_gpio_chip *mvchip = gc->private; +struct irq_chip_type *ct =irq_data_get_chip_type (d);u32 mask =1 << (d->irq - gc->irq_base);irq_gc_lock (gc); - gc->mask_cache &= ~mask; -writel_relaxed (gc->mask_cache,mvebu_gpioreg_edge_mask (mvchip)); + ct->mask_cache_priv &= ~mask; + +writel_relaxed (ct->mask_cache_priv,mvebu_gpioreg_edge_mask (mvchip));irq_gc_unlock (gc); }
@@ -316,11 +318,13 @@ static void mvebu_gpio_edge_irq_unmask(struct irq_data *d) {struct irq_chip_generic *gc =irq_data_get_irq_chip_data (d);struct mvebu_gpio_chip *mvchip = gc->private; +struct irq_chip_type *ct =irq_data_get_chip_type (d); +u32 mask =1 << (d->irq - gc->irq_base);irq_gc_lock (gc); - gc->mask_cache |= mask; -writel_relaxed (gc->mask_cache,mvebu_gpioreg_edge_mask (mvchip)); + ct->mask_cache_priv |= mask; +writel_relaxed (ct->mask_cache_priv,mvebu_gpioreg_edge_mask (mvchip));irq_gc_unlock (gc); }
@@ -328,11 +332,13 @@ static void mvebu_gpio_level_irq_mask(struct irq_data *d) {struct irq_chip_generic *gc =irq_data_get_irq_chip_data (d);struct mvebu_gpio_chip *mvchip = gc->private; +struct irq_chip_type *ct =irq_data_get_chip_type (d); +u32 mask =1 << (d->irq - gc->irq_base);irq_gc_lock (gc); - gc->mask_cache &= ~mask; -writel_relaxed (gc->mask_cache,mvebu_gpioreg_level_mask (mvchip)); + ct->mask_cache_priv &= ~mask; +writel_relaxed (ct->mask_cache_priv,mvebu_gpioreg_level_mask (mvchip));irq_gc_unlock (gc); }
@@ -340,11 +346,13 @@ static void mvebu_gpio_level_irq_unmask(struct irq_data *d) {struct irq_chip_generic *gc =irq_data_get_irq_chip_data (d);struct mvebu_gpio_chip *mvchip = gc->private; +struct irq_chip_type *ct =irq_data_get_chip_type (d); +u32 mask =1 << (d->irq - gc->irq_base);irq_gc_lock (gc); - gc->mask_cache |= mask; -writel_relaxed (gc->mask_cache,mvebu_gpioreg_level_mask (mvchip)); + ct->mask_cache_priv |= mask; +writel_relaxed (ct->mask_cache_priv,mvebu_gpioreg_level_mask (mvchip));irq_gc_unlock (gc); }
Signature · 1 line
2.3.7
PATCH 81/142 fs: take i_mutex during prepare_binprm for set[ug]id executables
In reply to Jiri SlabyFrom: Jann Horn <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8b01fc86b9f425899f8a3a8fc1c47d73c2c20543 upstream.
This prevents a race between chown() and execve(), where chowning a setuid-user binary to root would momentarily make the binary setuid root.
This patch was mostly written by Linus Torvalds.
--- fs/exec.c | 76 ++++++++++++++++++++++++++++++++++++++++----------------------- 1 file changed, 48 insertions(+), 28 deletions(-)
fs/exec.c +48 -28
@@ -1272,6 +1272,53 @@ static int check_unsafe_exec(struct linux_binprm *bprm)return res; } +static void bprm_fill_uid (struct linux_binprm *bprm) +{ +struct inode *inode; +unsigned int mode; +kuid_t uid; +kgid_t gid; + +/* clear any previous set[ug]id data from a previous binary */ + bprm->cred->euid =current_euid (); + bprm->cred->egid =current_egid (); + +if (bprm->file->f_path.mnt->mnt_flags &MNT_NOSUID ) +return ; + +if (current->no_new_privs) +return ; + + inode =file_inode (bprm->file); + mode =ACCESS_ONCE (inode->i_mode); +if (!(mode & (S_ISUID |S_ISGID ))) +return ; + +/* Be careful if suid/sgid is set */ +mutex_lock (&inode->i_mutex); + +/* reload atomically mode/uid/gid now that lock held */ + mode = inode->i_mode; + uid = inode->i_uid; + gid = inode->i_gid; +mutex_unlock (&inode->i_mutex); + +/* We ignore suid/sgid if there are no mappings for them in the ns */ +if (!kuid_has_mapping (bprm->cred->user_ns, uid) || + !kgid_has_mapping (bprm->cred->user_ns, gid)) +return ; + +if (mode &S_ISUID ) { + bprm->per_clear |=PER_CLEAR_ON_SETID ; + bprm->cred->euid = uid; + } + +if ((mode & (S_ISGID |S_IXGRP )) == (S_ISGID |S_IXGRP )) { + bprm->per_clear |=PER_CLEAR_ON_SETID ; + bprm->cred->egid = gid; + } +} +/* * Fill the binprm structure from the inode. * Check permissions, then read the first 128 (BINPRM_BUF_SIZE) bytes
@@ -1280,39 +1327,12 @@ static int check_unsafe_exec(struct linux_binprm *bprm)*/ int prepare_binprm (struct linux_binprm *bprm) { -umode_t mode; -struct inode * inode =file_inode (bprm->file);int retval; - mode = inode->i_mode;if (bprm->file->f_op ==NULL )return -EACCES ; -/* clear any previous set[ug]id data from a previous binary */ - bprm->cred->euid =current_euid (); - bprm->cred->egid =current_egid (); - -if (!(bprm->file->f_path.mnt->mnt_flags &MNT_NOSUID ) && - !current->no_new_privs && -kuid_has_mapping (bprm->cred->user_ns, inode->i_uid) && -kgid_has_mapping (bprm->cred->user_ns, inode->i_gid)) { -/* Set-uid? */ -if (mode &S_ISUID ) { - bprm->per_clear |=PER_CLEAR_ON_SETID ; - bprm->cred->euid = inode->i_uid; - } - -/* Set-gid? */ -/* -* If setgid is set but no group execute bit then this -* is a candidate for mandatory locking, not a setgid -* executable. -*/ -if ((mode & (S_ISGID |S_IXGRP )) == (S_ISGID |S_IXGRP )) { - bprm->per_clear |=PER_CLEAR_ON_SETID ; - bprm->cred->egid = inode->i_gid; - } - } +bprm_fill_uid (bprm);/* fill in binprm security blob */ retval =security_bprm_set_creds (bprm);
Signature · 1 line
2.3.7
PATCH 94/142 rbd: end I/O the entire obj_request on error
In reply to Jiri SlabyFrom: Ilya Dryomov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 082a75dad84d79d1c15ea9e50f31cb4bb4fa7fd6 upstream.
When we end I/O struct request with error, we need to pass obj_request->length as @nr_bytes so that the entire obj_request worth of bytes is completed. Otherwise block layer ends up confused and we trip on
rbd_assert(more ^ (which == img_request->obj_request_count));
in rbd_img_obj_callback() due to more being true no matter what. We already do it in most cases but we are missing some, in particular those where we don't even get a chance to submit any obj_requests, due to an early -ENOMEM for example.
A number of obj_request->xferred assignments seem to be redundant but I haven't touched any of obj_request->xferred stuff to keep this small and isolated.
--- drivers/block/rbd.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/block/rbd.c +5 -0
@@ -2103,6 +2103,11 @@ static bool rbd_img_obj_end_request(struct rbd_obj_request *obj_request) result, xferred);if (!img_request->result) img_request->result = result; +/* +* Need to end I/O on the entire obj_request worth of +* bytes in case of error. +*/ + xferred = obj_request->length; }/* Image object requests don't own their page array */
Signature · 1 line
2.3.7
PATCH 50/142 UBI: account for bitflips in both the VID header and data
In reply to Jiri SlabyFrom: Brian Norris <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8eef7d70f7c6772c3490f410ee2bceab3b543fa1 upstream.
We are completely discarding the earlier value of 'bitflips', which could reflect a bitflip found in ubi_io_read_vid_hdr(). Let's use the bitwise OR of header and data 'bitflip' statuses instead.
Coverity CID #1226856
--- drivers/mtd/ubi/attach.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/ubi/attach.c +1 -1
@@ -408,7 +408,7 @@ int ubi_compare_lebs(struct ubi_device *ubi, const struct ubi_ainf_peb *aeb, second_is_newer = !second_is_newer; }else {dbg_bld ("PEB %d CRC is OK" , pnum); - bitflips = !!err; + bitflips |= !!err; }mutex_unlock (&ubi->buf_mutex);
Signature · 1 line
2.3.7
PATCH 53/142 UBI: fix check for "too many bytes"
In reply to Jiri SlabyFrom: Brian Norris <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 299d0c5b27346a77a0777c993372bf8777d4f2e5 upstream.
The comparison from the previous line seems to have been erroneously (partially) copied-and-pasted onto the next. The second line should be checking req.bytes, not req.lnum.
Coverity CID #139400
--- drivers/mtd/ubi/cdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/ubi/cdev.c +1 -1
@@ -451,7 +451,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd,/* Validate the request */ err = -EINVAL ;if (req.lnum <0 || req.lnum >= vol->reserved_pebs || - req.bytes <0 || req.lnum >= vol->usable_leb_size) + req.bytes <0 || req.bytes > vol->usable_leb_size)break ; err =get_exclusive (desc);
Signature · 1 line
2.3.7
PATCH 63/142 Drivers: hv: vmbus: Fix a bug in the error path in vmbus_open()
In reply to Jiri SlabyFrom: "K. Y. Srinivasan" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 40384e4bbeb9f2651fe9bffc0062d9f31ef625bf upstream.
Correctly rollback state if the failure occurs after we have handed over the ownership of the buffer to the host.
--- drivers/hv/channel.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/hv/channel.c +5 -2
@@ -178,7 +178,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, GFP_KERNEL);if (!open_info) { err = -ENOMEM ; - goto error0; + goto error_gpadl; }init_completion (&open_info->waitevent);
@@ -194,7 +194,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,if (userdatalen >MAX_USER_DEFINED_BYTES ) { err = -EINVAL ; - goto error0; + goto error_gpadl; }if (userdatalen)
@@ -238,6 +238,9 @@ error1:list_del (&open_info->msglistentry);spin_unlock_irqrestore (&vmbus_connection.channelmsg_lock, flags); +error_gpadl: +vmbus_teardown_gpadl (newchannel, newchannel->ringbuffer_gpadlhandle); + error0:free_pages ((unsigned long )out,get_order (send_ringbuffer_size + recv_ringbuffer_size));
Signature · 1 line
2.3.7
PATCH 59/142 xtensa: xtfpga: fix hardware lockup caused by LCD driver
In reply to Jiri SlabyFrom: Max Filippov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4949009eb8d40a441dcddcd96e101e77d31cf1b2 upstream.
LCD driver is always built for the XTFPGA platform, but its base address is not configurable, and is wrong for ML605/KC705. Its initialization locks up KC705 board hardware.
Make the whole driver optional, and its base address and bus width configurable. Implement 4-bit bus access method.
--- arch/xtensa/Kconfig | 30 ++++++++++++ arch/xtensa/platforms/xtfpga/Makefile | 3 +- .../platforms/xtfpga/include/platform/hardware.h | 3 -- .../xtensa/platforms/xtfpga/include/platform/lcd.h | 15 ++++++ arch/xtensa/platforms/xtfpga/lcd.c | 55 +++++++++++++--------- 5 files changed, 81 insertions(+), 25 deletions(-)
arch/xtensa/Kconfig +30 -0
@@ -289,6 +289,36 @@ menu "Executable file formats" source "fs/Kconfig.binfmt" +config XTFPGA_LCD + bool "Enable XTFPGA LCD driver" + depends on XTENSA_PLATFORM_XTFPGA + default n + help + There's a 2x16 LCD on most of XTFPGA boards, kernel may output + progress messages there during bootup/shutdown. It may be useful + during board bringup. + + If unsure, say N. + +config XTFPGA_LCD_BASE_ADDR + hex "XTFPGA LCD base address" + depends on XTFPGA_LCD + default "0x0d0c0000" + help + Base address of the LCD controller inside KIO region. + Different boards from XTFPGA family have LCD controller at different + addresses. Please consult prototyping user guide for your board for + the correct address. Wrong address here may lead to hardware lockup. + +config XTFPGA_LCD_8BIT_ACCESS + bool "Use 8-bit access to XTFPGA LCD" + depends on XTFPGA_LCD + default n + help + LCD may be connected with 4- or 8-bit interface, 8-bit access may + only be used with 8-bit interface. Please consult prototyping user + guide for your board for the correct interface width. + endmenu source "net/Kconfig"
arch/xtensa/platforms/xtfpga/Makefile +2 -1
@@ -6,4 +6,5 @@ # # Note 2! The CFLAGS definitions are in the main makefile... -obj-y = setup.o lcd.o +obj-y += setup.o +obj-$(CONFIG_XTFPGA_LCD) += lcd.o
arch/xtensa/platforms/xtfpga/include/platform/hardware.h +0 -3
@@ -44,9 +44,6 @@/* UART */ #define DUART16552_PADDR (XCHAL_KIO_PADDR + 0x0D050020) -/* LCD instruction and data addresses. */ -#define LCD_INSTR_ADDR ((char *)IOADDR(0x0D040000)) -#define LCD_DATA_ADDR ((char *)IOADDR(0x0D040004))/* Misc. */ #define XTFPGA_FPGAREGS_VADDR IOADDR(0x0D020000)
arch/xtensa/platforms/xtfpga/include/platform/lcd.h +15 -0
@@ -11,10 +11,25 @@#ifndef __XTENSA_XTAVNET_LCD_H#define __XTENSA_XTAVNET_LCD_H +#ifdef CONFIG_XTFPGA_LCD /* Display string STR at position POS on the LCD. */ void lcd_disp_at_pos (char *str,unsigned char pos);/* Shift the contents of the LCD display left or right. */ void lcd_shiftleft (void );void lcd_shiftright (void ); +#else +static inline void lcd_disp_at_pos (char *str,unsigned char pos) +{ +} + +static inline void lcd_shiftleft (void ) +{ +} + +static inline void lcd_shiftright (void ) +{ +} +#endif +#endif
arch/xtensa/platforms/xtfpga/lcd.c +34 -21
107 lines not on this page · raw message
Signature · 1 line
2.3.7
PATCH 109/142 mm: prevent endless growth of anon_vma hierarchy
In reply to Jiri SlabyFrom: Konstantin Khlebnikov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7a3ef208e662f4b63d43a23f61a64a129c525bbc upstream.
Constantly forking task causes unlimited grow of anon_vma chain. Each next child allocates new level of anon_vmas and links vma to all previous levels because pages might be inherited from any level.
This patch adds heuristic which decides to reuse existing anon_vma instead of forking new one. It adds counter anon_vma->degree which counts linked vmas and directly descending anon_vmas and reuses anon_vma if counter is lower than two. As a result each anon_vma has either vma or at least two descending anon_vmas. In such trees half of nodes are leafs with alive vmas, thus count of anon_vmas is no more than two times bigger than count of vmas.
This heuristic reuses anon_vmas as few as possible because each reuse adds false aliasing among vmas and rmap walker ought to scan more ptes when it searches where page is might be mapped.
--- include/linux/rmap.h | 10 ++++++++++ mm/rmap.c | 42 +++++++++++++++++++++++++++++++++++++++++- 2 files changed, 51 insertions(+), 1 deletion(-)
include/linux/rmap.h +10 -0
@@ -37,6 +37,16 @@ struct anon_vma {atomic_t refcount;/* +* Count of child anon_vmas and VMAs which points to this anon_vma. +* +* This counter is used for making decision about reusing anon_vma +* instead of forking new one. See comments in function anon_vma_clone. +*/ +unsigned degree; + +struct anon_vma *parent;/* Parent of this anon_vma */ + +/* * NOTE: the LSB of the rb_root.rb_node is set by * mm_take_all_locks() _after_ taking the above lock. So the * rb_root must only be read/written after taking the above lock
mm/rmap.c +41 -1
108 lines not on this page · raw message
Signature · 1 line
2.3.7
PATCH 122/142 ARM: dts: imx25: Add #pwm-cells to pwm4
In reply to Jiri SlabyFrom: Markus Pargmann <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f90d3f0d0a11fa77918fd5497cb616dd2faa8431 upstream.
The property '#pwm-cells' is currently missing. It is not possible to use pwm4 without this property.
--- arch/arm/boot/dts/imx25.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/imx25.dtsi +1 -0
@@ -411,6 +411,7 @@ pwm4: pwm@53fc8000 { compatible = "fsl,imx25-pwm", "fsl,imx27-pwm"; + #pwm-cells = <2>; reg = <0x53fc8000 0x4000>; clocks = <&clks 108>, <&clks 52>; clock-names = "ipg", "per";
Signature · 1 line
2.3.7
PATCH 131/142 drm/radeon: disable semaphores for UVD V1 (v2)
In reply to Jiri SlabyFrom: Christian König <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 013ead48a843442e63b9426e3bd5df18ca5d054a upstream.
Hardware doesn't seem to work correctly, just block userspace in this case.
v2: add missing defines
Bugs: https://bugs.freedesktop.org/show_bug.cgi?id=85320
--- drivers/gpu/drm/radeon/radeon_asic.c | 2 +- drivers/gpu/drm/radeon/radeon_asic.h | 4 ++++ drivers/gpu/drm/radeon/rv770d.h | 3 +++ drivers/gpu/drm/radeon/uvd_v1_0.c | 11 +---------- drivers/gpu/drm/radeon/uvd_v2_2.c | 29 +++++++++++++++++++++++++++++ 5 files changed, 38 insertions(+), 11 deletions(-)
drivers/gpu/drm/radeon/radeon_asic.c +1 -1
@@ -1157,7 +1157,7 @@ static struct radeon_asic rs780_asic = {static struct radeon_asic_ring rv770_uvd_ring = { .ib_execute = &uvd_v1_0_ib_execute, .emit_fence = &uvd_v2_2_fence_emit, - .emit_semaphore = &uvd_v1_0_semaphore_emit, + .emit_semaphore = &uvd_v2_2_semaphore_emit, .cs_parse = &radeon_uvd_cs_parse, .ring_test = &uvd_v1_0_ring_test, .ib_test = &uvd_v1_0_ib_test,
drivers/gpu/drm/radeon/radeon_asic.h +4 -0
@@ -812,6 +812,10 @@ void uvd_v1_0_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib);int uvd_v2_2_resume (struct radeon_device *rdev);void uvd_v2_2_fence_emit (struct radeon_device *rdev,struct radeon_fence *fence); +bool uvd_v2_2_semaphore_emit (struct radeon_device *rdev, +struct radeon_ring *ring, +struct radeon_semaphore *semaphore, +bool emit_wait);/* uvd v3.1 */ void uvd_v3_1_semaphore_emit(struct radeon_device *rdev,
drivers/gpu/drm/radeon/rv770d.h +3 -0
@@ -982,6 +982,9 @@ ((n) & 0x3FFF) << 16)/* UVD */ +#define UVD_SEMA_ADDR_LOW 0xef00 +#define UVD_SEMA_ADDR_HIGH 0xef04 +#define UVD_SEMA_CMD 0xef08#define UVD_GPCOM_VCPU_CMD 0xef0c#define UVD_GPCOM_VCPU_DATA0 0xef10#define UVD_GPCOM_VCPU_DATA1 0xef14
drivers/gpu/drm/radeon/uvd_v1_0.c +1 -10
@@ -365,16 +365,7 @@ void uvd_v1_0_semaphore_emit(struct radeon_device *rdev, struct radeon_semaphore *semaphore, bool emit_wait) { - uint64_t addr = semaphore->gpu_addr; - -radeon_ring_write (ring,PACKET0 (UVD_SEMA_ADDR_LOW ,0 )); -radeon_ring_write (ring, (addr >>3 ) &0x000FFFFF ); - -radeon_ring_write (ring,PACKET0 (UVD_SEMA_ADDR_HIGH ,0 )); -radeon_ring_write (ring, (addr >>23 ) &0x000FFFFF ); - -radeon_ring_write (ring,PACKET0 (UVD_SEMA_CMD ,0 )); -radeon_ring_write (ring, emit_wait ?1 :0 ); +/* disable semaphores for UVD V1 hardware */ }/**
drivers/gpu/drm/radeon/uvd_v2_2.c +29 -0
@@ -61,6 +61,35 @@ void uvd_v2_2_fence_emit(struct radeon_device *rdev, }/** +* uvd_v2_2_semaphore_emit - emit semaphore command +* +* @rdev: radeon_device pointer +* @ring: radeon_ring pointer +* @semaphore: semaphore to emit commands for +* @emit_wait: true if we should emit a wait command +* +* Emit a semaphore command (either wait or signal) to the UVD ring. +*/ +bool uvd_v2_2_semaphore_emit (struct radeon_device *rdev, +struct radeon_ring *ring, +struct radeon_semaphore *semaphore, +bool emit_wait) +{ +uint64_t addr = semaphore->gpu_addr; + +radeon_ring_write (ring,PACKET0 (UVD_SEMA_ADDR_LOW ,0 )); +radeon_ring_write (ring, (addr >>3 ) &0x000FFFFF ); + +radeon_ring_write (ring,PACKET0 (UVD_SEMA_ADDR_HIGH ,0 )); +radeon_ring_write (ring, (addr >>23 ) &0x000FFFFF ); + +radeon_ring_write (ring,PACKET0 (UVD_SEMA_CMD ,0 )); +radeon_ring_write (ring, emit_wait ?1 :0 ); + +return true; +} + +/** * uvd_v2_2_resume - memory controller programming * * @rdev: radeon_device pointer
Signature · 1 line
2.3.7
PATCH 29/142 usb: define a generic USB_RESUME_TIMEOUT macro
In reply to Jiri SlabyFrom: Felipe Balbi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 62f0342de1f012f3e90607d39e20fce811391169 upstream.
Every USB Host controller should use this new macro to define for how long resume signalling should be driven on the bus.
Currently, almost every single USB controller is using a 20ms timeout for resume signalling.
That's problematic for two reasons:
a) sometimes that 20ms timer expires a little before 20ms, which makes us fail certification
b) some (many) devices actually need more than 20ms resume signalling.
Sure, in case of (b) we can state that the device is against the USB spec, but the fact is that we have no control over which device the certification lab will use. We also have no control over which host they will use. Most likely they'll be using a Windows PC which, again, we have no control over how that USB stack is written and how long resume signalling they are using.
At the end of the day, we must make sure Linux passes electrical compliance when working as Host or as Device and currently we don't pass compliance as host because we're driving resume signallig for exactly 20ms and that confuses certification test setup resulting in Certification failure.
--- include/linux/usb.h | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
include/linux/usb.h +26 -0
@@ -206,6 +206,32 @@ void usb_put_intf(struct usb_interface *intf);#define USB_MAXINTERFACES 32#define USB_MAXIADS (USB_MAXINTERFACES/2) +/* +* USB Resume Timer: Every Host controller driver should drive the resume +* signalling on the bus for the amount of time defined by this macro. +* +* That way we will have a 'stable' behavior among all HCDs supported by Linux. +* +* Note that the USB Specification states we should drive resume for *at least* +* 20 ms, but it doesn't give an upper bound. This creates two possible +* situations which we want to avoid: +* +* (a) sometimes an msleep(20) might expire slightly before 20 ms, which causes +* us to fail USB Electrical Tests, thus failing Certification +* +* (b) Some (many) devices actually need more than 20 ms of resume signalling, +* and while we can argue that's against the USB Specification, we don't have +* control over which devices a certification laboratory will be using for +* certification. If CertLab uses a device which was tested against Windows and +* that happens to have relaxed resume signalling rules, we might fall into +* situations where we fail interoperability and electrical tests. +* +* In order to avoid both conditions, we're using a 40 ms resume timeout, which +* should cope with both LPJ calibration errors and devices not following every +* detail of the USB Specification. +*/ +#define USB_RESUME_TIMEOUT 40/* ms */ +/** * struct usb_interface_cache - long-term representation of a device interface * @num_altsetting: number of altsettings defined.
Signature · 1 line
2.3.7
PATCH 19/142 cdc-wdm: fix endianness bug in debug statements
In reply to Jiri SlabyFrom: Oliver Neukum <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 323ece54e0761198946ecd0c2091f1d2bfdfcb64 upstream.
Values directly from descriptors given in debug statements must be converted to native endianness.
--- drivers/usb/class/cdc-wdm.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/usb/class/cdc-wdm.c +7 -5
@@ -244,7 +244,7 @@ static void wdm_int_callback(struct urb *urb)case USB_CDC_NOTIFY_RESPONSE_AVAILABLE :dev_dbg (&desc->intf->dev,"NOTIFY_RESPONSE_AVAILABLE received: index %d len %d" , - dr->wIndex, dr->wLength); +le16_to_cpu (dr->wIndex),le16_to_cpu (dr->wLength));break ;case USB_CDC_NOTIFY_NETWORK_CONNECTION :
@@ -257,7 +257,9 @@ static void wdm_int_callback(struct urb *urb)clear_bit (WDM_POLL_RUNNING , &desc->flags);dev_err (&desc->intf->dev,"unknown notification %d received: index %d len %d\n" , - dr->bNotificationType, dr->wIndex, dr->wLength); + dr->bNotificationType, +le16_to_cpu (dr->wIndex), +le16_to_cpu (dr->wLength)); goto exit; }
@@ -403,7 +405,7 @@ static ssize_t wdm_write USB_RECIP_INTERFACE); req->bRequest =USB_CDC_SEND_ENCAPSULATED_COMMAND ; req->wValue =0 ; - req->wIndex = desc->inum; + req->wIndex = desc->inum;/* already converted */ req->wLength =cpu_to_le16 (count);set_bit (WDM_IN_USE , &desc->flags); desc->outbuf = buf;
@@ -417,7 +419,7 @@ static ssize_t wdm_write rv =usb_translate_errors (rv); }else {dev_dbg (&desc->intf->dev,"Tx URB has been submitted index=%d" , - req->wIndex); +le16_to_cpu (req->wIndex)); } out:usb_autopm_put_interface (desc->intf);
@@ -780,7 +782,7 @@ static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor desc->irq->bRequestType = (USB_DIR_IN |USB_TYPE_CLASS |USB_RECIP_INTERFACE ); desc->irq->bRequest =USB_CDC_GET_ENCAPSULATED_RESPONSE ; desc->irq->wValue =0 ; - desc->irq->wIndex = desc->inum; + desc->irq->wIndex = desc->inum;/* already converted */ desc->irq->wLength =cpu_to_le16 (desc->wMaxCommand); usb_fill_control_urb(
Signature · 1 line
2.3.7
PATCH 130/142 drm/i915: Add missing MacBook Pro models with dual channel LVDS
In reply to Jiri SlabyFrom: Lukas Wunner <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3916e3fd81021fb795bfbdb17f375b6b3685bced upstream.
Single channel LVDS maxes out at 112 MHz. The 15" pre-retina models shipped with 1440x900 (106 MHz) by default or 1680x1050 (119 MHz) as a BTO option, both versions used dual channel LVDS even though the smaller one would have fit into a single channel.
Notes:
Bug report showing that the MacBookPro8,2 with 1440x900 uses dual channel LVDS (this lead to it being hardcoded in intel_lvds.c by Daniel Vetter with commit 618563e3945b9d0864154bab3c607865b557cecc):
https://bugzilla.kernel.org/show_bug.cgi?id=42842
If i915.lvds_channel_mode=2 is missing even though the machine needs it, every other vertical line is white and consequently, only the left half of the screen is visible (verified by myself on a MacBookPro9,1).
Forum posting concerning a MacBookPro6,2 with 1440x900, author is using i915.lvds_channel_mode=2 on the kernel command line, proving that the machine uses dual channels:
https://bbs.archlinux.org/viewtopic.php?id=185770
Chi Mei N154C6-L04 with 1440x900 is a replacement panel for all MacBook Pro "A1286" models, and that model number encompasses the MacBookPro6,2 / 8,2 / 9,1. Page 17 of the panel's datasheet shows it's driven with dual channel LVDS:
http://www.ebay.com/itm/-/400690878560 http://www.everymac.com/ultimate-mac-lookup/?search_keywords=A1286 http://www.taopanel.com/chimei/datasheet/N154C6-L04.pdf
Those three 15" models, MacBookPro6,2 / 8,2 / 9,1, are the only ones with i915 graphics and dual channel LVDS, so that list should be complete. And the 8,2 is already in intel_lvds.c.
Possible motivation to use dual channel LVDS even on the 1440x900
models: Reduce the number of different parts, i.e. use identical logic boards and display cabling on both versions and the only differing component is the panel.
--- drivers/gpu/drm/i915/intel_lvds.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/intel_lvds.c +17 -1
@@ -844,12 +844,28 @@ static int intel_dual_link_lvds_callback(const struct dmi_system_id *id)static const struct dmi_system_id intel_dual_link_lvds[] = { { .callback = intel_dual_link_lvds_callback, - .ident ="Apple MacBook Pro (Core i5/i7 Series)" , + .ident ="Apple MacBook Pro 15\" (2010)" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Apple Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"MacBookPro6,2" ), + }, + }, + { + .callback = intel_dual_link_lvds_callback, + .ident ="Apple MacBook Pro 15\" (2011)" , .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Apple Inc." ),DMI_MATCH (DMI_PRODUCT_NAME ,"MacBookPro8,2" ), }, }, + { + .callback = intel_dual_link_lvds_callback, + .ident ="Apple MacBook Pro 15\" (2012)" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Apple Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"MacBookPro9,1" ), + }, + }, { }/* terminating entry */ };
Signature · 1 line
2.3.7
PATCH 31/142 usb: host: uhci: use new USB_RESUME_TIMEOUT
In reply to Jiri SlabyFrom: Felipe Balbi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b8fb6f79f76f478acbbffccc966daa878f172a0a upstream.
Make sure we're using the new macro, so our
resume signaling will always pass certification.
--- drivers/usb/host/uhci-hub.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/host/uhci-hub.c +3 -2
@@ -167,7 +167,7 @@ static void uhci_check_ports(struct uhci_hcd *uhci)/* Port received a wakeup request */ set_bit (port, &uhci->resuming_ports); uhci->ports_timeout = jiffies + -msecs_to_jiffies (25 ); +msecs_to_jiffies (USB_RESUME_TIMEOUT );usb_hcd_start_port_resume ( &uhci_to_hcd (uhci)->self, port);
@@ -337,7 +337,8 @@ static int uhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,uhci_finish_suspend (uhci, port, port_addr);/* USB v2.0 7.1.7.5 */ - uhci->ports_timeout = jiffies +msecs_to_jiffies (50 ); + uhci->ports_timeout = jiffies + +msecs_to_jiffies (USB_RESUME_TIMEOUT );OK (0 );case USB_PORT_FEAT_POWER :/* UHCI has no power switching */
Signature · 1 line
2.3.7
PATCH 40/142 Input: elantech - fix absolute mode setting on some ASUS laptops
In reply to Jiri SlabyFrom: Ulrik De Bie <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit bd884149aca61de269fd9bad83fe2a4232ffab21 upstream.
On ASUS TP500LN and X750JN, the touchpad absolute mode is reset each time set_rate is done.
In order to fix this, we will verify the firmware version, and if it matches the one in those laptops, the set_rate function is overloaded with a function elantech_set_rate_restore_reg_07 that performs the set_rate with the original function, followed by a restore of reg_07 (the register that sets the absolute mode on elantech v4 hardware).
Also the ASUS TP500LN and X750JN firmware version, capabilities, and button constellation is added to elantech.c
--- drivers/input/mouse/elantech.c | 22 ++++++++++++++++++++++ drivers/input/mouse/elantech.h | 1 + 2 files changed, 23 insertions(+)
drivers/input/mouse/elantech.c +22 -0
@@ -814,6 +814,21 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse) }/* +* This writes the reg_07 value again to the hardware at the end of every +* set_rate call because the register loses its value. reg_07 allows setting +* absolute mode on v4 hardware +*/ +static void elantech_set_rate_restore_reg_07 (struct psmouse *psmouse, +unsigned int rate) +{ +struct elantech_data *etd = psmouse->private; + + etd->original_set_rate (psmouse, rate); +if (elantech_write_reg (psmouse,0x07 , etd->reg_07)) +psmouse_err (psmouse,"restoring reg_07 failed\n" ); +} + +/* * Put the touchpad into absolute mode */ static int elantech_set_absolute_mode (struct psmouse *psmouse)
@@ -1015,6 +1030,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,* Asus K53SV 0x450f01 78, 15, 0c 2 hw buttons * Asus G46VW 0x460f02 00, 18, 0c 2 hw buttons * Asus G750JX 0x360f00 00, 16, 0c 2 hw buttons +* Asus TP500LN 0x381f17 10, 14, 0e clickpad +* Asus X750JN 0x381f17 10, 14, 0e clickpad * Asus UX31 0x361f00 20, 15, 0e clickpad * Asus UX32VD 0x361f02 00, 15, 0e clickpad * Avatar AVIU-145A2 0x361f00 ? clickpad
@@ -1523,6 +1540,11 @@ int elantech_init(struct psmouse *psmouse) goto init_fail; } +if (etd->fw_version ==0x381f17 ) { + etd->original_set_rate = psmouse->set_rate; + psmouse->set_rate = elantech_set_rate_restore_reg_07; + } +if (elantech_set_input_params (psmouse)) {psmouse_err (psmouse,"failed to query touchpad range.\n" ); goto init_fail;
drivers/input/mouse/elantech.h +1 -0
@@ -139,6 +139,7 @@ struct elantech_data {struct finger_pos mt[ETP_MAX_FINGERS ];unsigned char parity[256 ];int (*send_cmd)(struct psmouse *psmouse,unsigned char c,unsigned char *param); +void (*original_set_rate)(struct psmouse *psmouse,unsigned int rate); };#ifdef CONFIG_MOUSE_PS2_ELANTECH
Signature · 1 line
2.3.7
PATCH 45/142 arm64: vdso: fix build error when switching from LE to BE
In reply to Jiri SlabyFrom: Arun Chandran <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1915e2ad1cf548217c963121e4076b3d44dd0169 upstream.
Building a kernel with CPU_BIG_ENDIAN fails if there are stale objects from a !CPU_BIG_ENDIAN build. Due to a missing FORCE prerequisite on an if_changed rule in the VDSO Makefile, we attempt to link a stale LE object into the new BE kernel.
According to Documentation/kbuild/makefiles.txt, FORCE is required for if_changed rules and forgetting it is a common mistake, so fix it by 'Forcing' the build of vdso. This patch fixes build errors like these:
arch/arm64/kernel/vdso/note.o: compiled for a little endian system and target is big endian failed to merge target specific data of file arch/arm64/kernel/vdso/note.o
arch/arm64/kernel/vdso/sigreturn.o: compiled for a little endian system and target is big endian failed to merge target specific data of file arch/arm64/kernel/vdso/sigreturn.o
--- arch/arm64/kernel/vdso/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kernel/vdso/Makefile +1 -1
@@ -43,7 +43,7 @@ $(obj)/vdso-offsets.h: $(obj)/vdso.so.dbg FORCE $(call if_changed,vdsosym) # Assembly rules for the .S files -$(obj-vdso): %.o: %.S +$(obj-vdso): %.o: %.S FORCE $(call if_changed_dep,vdsoas) # Actual build commands
Signature · 1 line
2.3.7
PATCH 78/142 C6x: time: Ensure consistency in __init
In reply to Jiri SlabyFrom: Nishanth Menon <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f4831605f2dacd12730fe73961c77253cc2ea425 upstream.
time_init invokes timer64_init (which is __init annotation) since all of these are invoked at init time, lets maintain consistency by ensuring time_init is marked appropriately as well.
This fixes the following warning with CONFIG_DEBUG_SECTION_MISMATCH=y
WARNING: vmlinux.o(.text+0x3bfc): Section mismatch in reference from the function time_init() to the function .init.text:timer64_init() The function time_init() references
the function __init timer64_init().
This is often because time_init lacks a __init
annotation or the annotation of timer64_init is wrong.
--- arch/c6x/kernel/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/c6x/kernel/time.c +1 -1
@@ -49,7 +49,7 @@ u64 sched_clock(void)return (tsc * sched_clock_multiplier) >>SCHED_CLOCK_SHIFT ; } -void time_init (void ) +void __init time_init (void ) {u64 tmp = (u64 )NSEC_PER_SEC <<SCHED_CLOCK_SHIFT ;
Signature · 1 line
2.3.7
PATCH 9/142 Btrfs: fix inode eviction infinite loop after extent_same ioctl
In reply to Jiri SlabyFrom: Filipe Manana <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 113e8283869b9855c8b999796aadd506bbac155f upstream.
If we pass a length of 0 to the extent_same ioctl, we end up locking an extent range with a start offset greater then its end offset (if the destination file's offset is greater than zero). This results in a warning from extent_io.c:insert_state through the following call chain:
btrfs_extent_same()
btrfs_double_lock()
lock_extent_range()
lock_extent(inode->io_tree, offset, offset + len - 1)
lock_extent_bits()
__set_extent_bit()
insert_state()
--> WARN_ON(end < start)This leads to an infinite loop when evicting the inode. This is the same problem that my previous patch titled
"Btrfs: fix inode eviction infinite loop after cloning into it" addressed but for the extent_same ioctl instead of the clone ioctl.
--- fs/btrfs/ioctl.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/ioctl.c +3 -0
@@ -2671,6 +2671,9 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 len,if (src == dst)return -EINVAL ; +if (len ==0 ) +return 0 ; +btrfs_double_lock (src, loff, dst, dst_loff, len); ret =extent_same_check_offsets (src, loff, len);
Signature · 1 line
2.3.7
PATCH 26/142 ARM: S3C64XX: Use fixed IRQ bases to avoid conflicts on Cragganmore
In reply to Jiri SlabyFrom: Charles Keepax <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4e330ae4ab2915444f1e6dca1358a910aa259362 upstream.
There are two PMICs on Cragganmore, currently one dynamically assign its IRQ base and the other uses a fixed base. It is possible for the statically assigned PMIC to fail if its IRQ is taken by the dynamically assigned one. Fix this by statically assigning both the IRQ bases.
--- arch/arm/mach-s3c64xx/crag6410.h | 1 + arch/arm/mach-s3c64xx/mach-crag6410.c | 1 + 2 files changed, 2 insertions(+)
arch/arm/mach-s3c64xx/crag6410.h +1 -0
@@ -14,6 +14,7 @@#include <linux/gpio.h> #define GLENFARCLAS_PMIC_IRQ_BASE IRQ_BOARD_START +#define BANFF_PMIC_IRQ_BASE (IRQ_BOARD_START + 64)#define PCA935X_GPIO_BASE GPIO_BOARD_START#define CODEC_GPIO_BASE (GPIO_BOARD_START + 8)
arch/arm/mach-s3c64xx/mach-crag6410.c +1 -0
@@ -558,6 +558,7 @@ static struct wm831x_touch_pdata touch_pdata = {static struct wm831x_pdata crag_pmic_pdata = { .wm831x_num =1 , + .irq_base =BANFF_PMIC_IRQ_BASE , .gpio_base =BANFF_PMIC_GPIO_BASE , .soft_shutdown = true,
Signature · 1 line
2.3.7
PATCH 36/142 usb: host: sl811: use new USB_RESUME_TIMEOUT
In reply to Jiri SlabyFrom: Felipe Balbi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 08debfb13b199716da6153940c31968c556b195d upstream.
Make sure we're using the new macro, so our
resume signaling will always pass certification.
--- drivers/usb/host/sl811-hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/sl811-hcd.c +1 -1
@@ -1260,7 +1260,7 @@ sl811h_hub_control(sl811_write (sl811,SL11H_CTLREG1 , sl811->ctrl1);mod_timer (&sl811->timer, jiffies - +msecs_to_jiffies (20 )); + +msecs_to_jiffies (USB_RESUME_TIMEOUT ));break ;case USB_PORT_FEAT_POWER :port_power (sl811,0 );
Signature · 1 line
2.3.7
PATCH 80/142 driver core: bus: Goto appropriate labels on failure in bus_add_device
In reply to Jiri SlabyFrom: Junjie Mao <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1c34203a1496d1849ba978021b878b3447d433c8 upstream.
It is not necessary to call device_remove_groups() when device_add_groups() fails.
The group added by device_add_groups() should be removed if sysfs_create_link() fails.
--- drivers/base/bus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/base/bus.c +2 -2
@@ -504,11 +504,11 @@ int bus_add_device(struct device *dev) goto out_put; error =device_add_groups (dev, bus->dev_groups);if (error) - goto out_groups; + goto out_id; error =sysfs_create_link (&bus->p->devices_kset->kobj, &dev->kobj,dev_name (dev));if (error) - goto out_id; + goto out_groups; error =sysfs_create_link (&dev->kobj, &dev->bus->p->subsys.kobj,"subsystem" );if (error)
Signature · 1 line
2.3.7
PATCH 93/142 tty/serial: at91: maxburst was missing for dma transfers
In reply to Jiri SlabyFrom: Ludovic Desroches <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a8d4e01637902311c5643b69a5c80e2805f04054 upstream.
Maxburst was not set when doing the dma slave configuration. This value is checked by the recently introduced xdmac. It causes an error when doing the slave configuration and so prevents from using dma.
--- drivers/tty/serial/atmel_serial.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/serial/atmel_serial.c +2 -0
@@ -756,6 +756,7 @@ static int atmel_prepare_tx_dma(struct uart_port *port) config.direction =DMA_MEM_TO_DEV ; config.dst_addr_width =DMA_SLAVE_BUSWIDTH_1_BYTE ; config.dst_addr = port->mapbase +ATMEL_US_THR ; + config.dst_maxburst =1 ; ret = dmaengine_device_control(atmel_port->chan_tx, DMA_SLAVE_CONFIG,
@@ -920,6 +921,7 @@ static int atmel_prepare_rx_dma(struct uart_port *port) config.direction =DMA_DEV_TO_MEM ; config.src_addr_width =DMA_SLAVE_BUSWIDTH_1_BYTE ; config.src_addr = port->mapbase +ATMEL_US_RHR ; + config.src_maxburst =1 ; ret = dmaengine_device_control(atmel_port->chan_rx, DMA_SLAVE_CONFIG,
Signature · 1 line
2.3.7
PATCH 27/142 ARM: dts: dove: Fix uart[23] reg property
In reply to Jiri SlabyFrom: Sebastian Hesselbarth <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a74cd13b807029397f7232449df929bac11fb228 upstream.
Fix Dove's register addresses of uart2 and uart3 nodes that seem to be broken since ages due to a copy-and-paste error.
--- arch/arm/boot/dts/dove.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/dove.dtsi +2 -2
@@ -106,7 +106,7 @@ uart2: serial@12200 { compatible = "ns16550a"; - reg = <0x12000 0x100>; + reg = <0x12200 0x100>; reg-shift = <2>; interrupts = <9>; clocks = <&core_clk 0>;
@@ -115,7 +115,7 @@ uart3: serial@12300 { compatible = "ns16550a"; - reg = <0x12100 0x100>; + reg = <0x12300 0x100>; reg-shift = <2>; interrupts = <10>; clocks = <&core_clk 0>;
Signature · 1 line
2.3.7
PATCH 76/142 wl18xx: show rx_frames_per_rates as an array as it really is
In reply to Jiri SlabyFrom: Nicolas Iooss <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a3fa71c40f1853d0c27e8f5bc01a722a705d9682 upstream.
In struct wl18xx_acx_rx_rate_stat, rx_frames_per_rates field is an array, not a number. This means WL18XX_DEBUGFS_FWSTATS_FILE can't be used to display this field in debugfs (it would display a pointer, not the actual data). Use WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY instead.
This bug has been found by adding a __printf attribute to wl1271_format_buffer. gcc complained about "format '%u' expects argument of type 'unsigned int', but argument 5 has type 'u32 *'".
--- drivers/net/wireless/ti/wl18xx/debugfs.c | 2 +- drivers/net/wireless/ti/wlcore/debugfs.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/ti/wl18xx/debugfs.c +1 -1
@@ -136,7 +136,7 @@ WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, protection_filter, "%u");WL18XX_DEBUGFS_FWSTATS_FILE (rx_filter, accum_arp_pend_requests,"%u" );WL18XX_DEBUGFS_FWSTATS_FILE (rx_filter, max_arp_queue_dep,"%u" ); -WL18XX_DEBUGFS_FWSTATS_FILE (rx_rate, rx_frames_per_rates,"%u" ); +WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY (rx_rate, rx_frames_per_rates,50 );WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY (aggr_size, tx_agg_vs_rate,AGGR_STATS_TX_AGG *AGGR_STATS_TX_RATE );
drivers/net/wireless/ti/wlcore/debugfs.h +2 -2
@@ -26,8 +26,8 @@#include "wlcore.h" -int wl1271_format_buffer (char __user *userbuf,size_t count, -loff_t *ppos,char *fmt, ...); +__printf(4, 5) int wl1271_format_buffer(char __user *userbuf, size_t count, +loff_t *ppos,char *fmt, ...);int wl1271_debugfs_init (struct wl1271 *wl);void wl1271_debugfs_exit (struct wl1271 *wl);
Signature · 1 line
2.3.7
PATCH 89/142 ALSA: emu10k1: Emu10k2 32 bit DMA mode
In reply to Jiri SlabyFrom: Peter Zubaj <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7241ea558c6715501e777396b5fc312c372e11d9 upstream.
Looks like audigy emu10k2 (probably emu10k1 - sb live too) support two modes for DMA. Second mode is useful for 64 bit os with more then 2 GB of ram (fixes problems with big soundfont loading)
1) 32MB from 2 GB address space using 8192 pages (used now as default)
2) 16MB from 4 GB address space using 4096 pages
Mode is set using HCFG_EXPANDED_MEM flag in HCFG register. Also format of emu10k2 page table is then different.
--- include/sound/emu10k1.h | 14 +++++++++----- sound/pci/emu10k1/emu10k1_callback.c | 4 ++-- sound/pci/emu10k1/emu10k1_main.c | 17 ++++++++++++----- sound/pci/emu10k1/emupcm.c | 2 +- sound/pci/emu10k1/memory.c | 11 ++++++----- 5 files changed, 30 insertions(+), 18 deletions(-)
include/sound/emu10k1.h +9 -5
@@ -41,7 +41,8 @@#define EMUPAGESIZE 4096#define MAXREQVOICES 8 -#define MAXPAGES 8192 +#define MAXPAGES0 4096/* 32 bit mode */ +#define MAXPAGES1 8192/* 31 bit mode */ #define RESERVED 0#define NUM_MIDI 16#define NUM_G 64/* use all channels */
@@ -50,8 +51,7 @@/* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */ #define EMU10K1_DMA_MASK 0x7fffffffUL/* 31bit */ -#define AUDIGY_DMA_MASK 0x7fffffffUL/* 31bit FIXME - 32 should work? */ -/* See ALSA bug #1276 - rlrevell */ +#define AUDIGY_DMA_MASK 0xffffffffUL/* 32bit mode */ #define TMEMSIZE 256*1024#define TMEMSIZEREG 4
@@ -468,8 +468,11 @@#define MAPB 0x0d/* Cache map B */ -#define MAP_PTE_MASK 0xffffe000/* The 19 MSBs of the PTE indexed by the PTI */ -#define MAP_PTI_MASK 0x00001fff/* The 13 bit index to one of the 8192 PTE dwords */ +#define MAP_PTE_MASK0 0xfffff000/* The 20 MSBs of the PTE indexed by the PTI */ +#define MAP_PTI_MASK0 0x00000fff/* The 12 bit index to one of the 4096 PTE dwords */ + +#define MAP_PTE_MASK1 0xffffe000/* The 19 MSBs of the PTE indexed by the PTI */ +#define MAP_PTI_MASK1 0x00001fff/* The 13 bit index to one of the 8192 PTE dwords */ /* 0x0e, 0x0f: Not used */
@@ -1706,6 +1709,7 @@ struct snd_emu10k1 {unsigned short model;/* subsystem id */ unsigned int card_type;/* EMU10K1_CARD_* */ unsigned int ecard_ctrl;/* ecard control bits */ +unsigned int address_mode;/* address mode */ unsigned long dma_mask;/* PCI DMA mask */ unsigned int delay_pcm_irq;/* in samples */ int max_cache_pages;/* max memory size / PAGE_SIZE */
sound/pci/emu10k1/emu10k1_callback.c +2 -2
@@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp)snd_emu10k1_ptr_write (hw,Z2 , ch,0 );/* invalidate maps */ - temp = (hw->silent_page.addr <<1 ) |MAP_PTI_MASK ; + temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ?MAP_PTI_MASK1 :MAP_PTI_MASK0 );snd_emu10k1_ptr_write (hw,MAPA , ch, temp);snd_emu10k1_ptr_write (hw,MAPB , ch, temp);#if 0
@@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp)snd_emu10k1_ptr_write (hw,CDF , ch, sample);/* invalidate maps */ - temp = ((unsigned int )hw->silent_page.addr <<1 ) |MAP_PTI_MASK ; + temp = ((unsigned int )hw->silent_page.addr << hw_address_mode) | (hw->address_mode ?MAP_PTI_MASK1 :MAP_PTI_MASK0 );snd_emu10k1_ptr_write (hw,MAPA , ch, temp);snd_emu10k1_ptr_write (hw,MAPB , ch, temp);
sound/pci/emu10k1/emu10k1_main.c +12 -5
@@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)snd_emu10k1_ptr_write (emu,TCB ,0 ,0 );/* taken from original driver */ snd_emu10k1_ptr_write (emu,TCBS ,0 ,4 );/* taken from original driver */ - silent_page = (emu->silent_page.addr <<1 ) |MAP_PTI_MASK ; + silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ?MAP_PTI_MASK1 :MAP_PTI_MASK0 );for (ch =0 ; ch <NUM_G ; ch++) {snd_emu10k1_ptr_write (emu,MAPA , ch, silent_page);snd_emu10k1_ptr_write (emu,MAPB , ch, silent_page);
@@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)outl (reg |A_IOCFG_GPOUT0 , emu->port +A_IOCFG ); } +if (emu->address_mode ==0 ) { +/* use 16M in 4G */ +outl (inl (emu->port +HCFG ) |HCFG_EXPANDED_MEM , emu->port +HCFG ); + } +return 0 ; }
@@ -1865,8 +1870,10 @@ int snd_emu10k1_create(struct snd_card *card, is_audigy = emu->audigy = c->emu10k2_chip; +/* set addressing mode */ + emu->address_mode = is_audigy ?0 :1 ;/* set the DMA transfer mask */ - emu->dma_mask = is_audigy ?AUDIGY_DMA_MASK :EMU10K1_DMA_MASK ; + emu->dma_mask = emu->address_mode ?EMU10K1_DMA_MASK :AUDIGY_DMA_MASK ;if (pci_set_dma_mask (pci, emu->dma_mask) <0 ||pci_set_consistent_dma_mask (pci, emu->dma_mask) <0 ) {snd_printk (KERN_ERR "architecture does not support PCI busmaster DMA with mask 0x%lx\n" , emu->dma_mask);
@@ -1889,7 +1896,7 @@ int snd_emu10k1_create(struct snd_card *card, emu->max_cache_pages = max_cache_bytes >>PAGE_SHIFT ;if (snd_dma_alloc_pages (SNDRV_DMA_TYPE_DEV ,snd_dma_pci_data (pci), -32 *1024 , &emu->ptb_pages) <0 ) { + (emu->address_mode ?32 :16 ) *1024 , &emu->ptb_pages) <0 ) { err = -ENOMEM ; goto error; }
@@ -1988,8 +1995,8 @@ int snd_emu10k1_create(struct snd_card *card,/* Clear silent pages and set up pointers */ memset (emu->silent_page.area,0 ,PAGE_SIZE ); - silent_page = emu->silent_page.addr <<1 ; -for (idx =0 ; idx <MAXPAGES ; idx++) + silent_page = emu->silent_page.addr << emu->address_mode; +for (idx =0 ; idx < (emu->address_mode ?MAXPAGES1 :MAXPAGES0 ); idx++) ((u32 *)emu->ptb_pages.area)[idx] =cpu_to_le32 (silent_page | idx);/* set up voice indices */
sound/pci/emu10k1/emupcm.c +1 -1
@@ -379,7 +379,7 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu,snd_emu10k1_ptr_write (emu,Z1 , voice,0 );snd_emu10k1_ptr_write (emu,Z2 , voice,0 );/* invalidate maps */ - silent_page = ((unsigned int )emu->silent_page.addr <<1 ) |MAP_PTI_MASK ; + silent_page = ((unsigned int )emu->silent_page.addr << emu->address_mode) | (emu->address_mode ?MAP_PTI_MASK1 :MAP_PTI_MASK0 );snd_emu10k1_ptr_write (emu,MAPA , voice, silent_page);snd_emu10k1_ptr_write (emu,MAPB , voice, silent_page);/* modulation envelope */
sound/pci/emu10k1/memory.c +6 -5
@@ -34,10 +34,11 @@* aligned pages in others */ #define __set_ptb_entry (emu,page,addr) \ - (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page))) + (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page)))#define UNIT_PAGES (PAGE_SIZE / EMUPAGESIZE) -#define MAX_ALIGN_PAGES (MAXPAGES / UNIT_PAGES) +#define MAX_ALIGN_PAGES0 (MAXPAGES0 / UNIT_PAGES) +#define MAX_ALIGN_PAGES1 (MAXPAGES1 / UNIT_PAGES)/* get aligned page from offset address */ #define get_aligned_page (offset) ((offset) >> PAGE_SHIFT)/* get offset address from aligned page */
@@ -124,7 +125,7 @@ static int search_empty_map_area(struct snd_emu10k1 *emu, int npages, struct lis } page = blk->mapped_page + blk->pages; } - size =MAX_ALIGN_PAGES - page; + size = (emu->address_mode ?MAX_ALIGN_PAGES1 :MAX_ALIGN_PAGES0 ) - page;if (size >= max_size) { *nextp = pos;return page;
@@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk) q =get_emu10k1_memblk (p, mapped_link); end_page = q->mapped_page; }else - end_page =MAX_ALIGN_PAGES ; + end_page = (emu->address_mode ?MAX_ALIGN_PAGES1 :MAX_ALIGN_PAGES0 );/* remove links */ list_del (&blk->mapped_link);
@@ -305,7 +306,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *substif (snd_BUG_ON (!emu))return NULL ;if (snd_BUG_ON (runtime->dma_bytes <=0 || - runtime->dma_bytes >=MAXPAGES *EMUPAGESIZE )) + runtime->dma_bytes >= (emu->address_mode ?MAXPAGES1 :MAXPAGES0 ) *EMUPAGESIZE ))return NULL ; hdr = emu->memhdr;if (snd_BUG_ON (!hdr))
Signature · 1 line
2.3.7
PATCH 90/142 ALSA: hda - Fix mute-LED fixed mode
In reply to Jiri SlabyFrom: Takashi Iwai <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ee52e56e7b12834476cd0031c5986254ba1b6317 upstream.
The mute-LED mode control has the fixed on/off states that are supposed to remain on/off regardless of the master switch. However, this doesn't work actually because the vmaster hook is called in the vmaster code itself.
This patch fixes it by calling the hook indirectly after checking the mute LED mode.
--- sound/pci/hda/hda_codec.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
sound/pci/hda/hda_codec.c +12 -9
@@ -2012,6 +2012,16 @@ static void put_vol_mute(struct hda_codec *codec, unsigned int amp_caps,snd_hda_codec_write (codec, nid,0 ,AC_VERB_SET_AMP_GAIN_MUTE , parm); } +/* meta hook to call each driver's vmaster hook */ +static void vmaster_hook (void *private_data,int enabled) +{ +struct hda_vmaster_mute_hook *hook = private_data; + +if (hook->mute_mode !=HDA_VMUTE_FOLLOW_MASTER ) + enabled = hook->mute_mode; + hook->hook (hook->codec, enabled); +} +/** * snd_hda_codec_amp_read - Read AMP value * @codec: HD-audio codec
@@ -2834,9 +2844,9 @@ int snd_hda_add_vmaster_hook(struct hda_codec *codec,if (!hook->hook || !hook->sw_kctl)return 0 ; -snd_ctl_add_vmaster_hook (hook->sw_kctl, hook->hook, codec); hook->codec = codec; hook->mute_mode =HDA_VMUTE_FOLLOW_MASTER ; +snd_ctl_add_vmaster_hook (hook->sw_kctl, vmaster_hook, hook);if (!expose_enum_ctl)return 0 ; kctl =snd_ctl_new1 (&vmaster_mute_mode, hook);
@@ -2859,14 +2869,7 @@ void snd_hda_sync_vmaster_hook(struct hda_vmaster_mute_hook *hook)*/ if (hook->codec->bus->shutdown)return ; -switch (hook->mute_mode) { -case HDA_VMUTE_FOLLOW_MASTER : -snd_ctl_sync_vmaster_hook (hook->sw_kctl); -break ; -default : - hook->hook (hook->codec, hook->mute_mode); -break ; - } +snd_ctl_sync_vmaster_hook (hook->sw_kctl); }EXPORT_SYMBOL_HDA (snd_hda_sync_vmaster_hook);
Signature · 1 line
2.3.7
PATCH 103/142 usb: gadget: printer: enqueue printer's response for setup request
In reply to Jiri SlabyFrom: Andrzej Pietrasiewicz <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit eb132ccbdec5df46e29c9814adf76075ce83576b upstream.
Function-specific setup requests should be handled in such a way, that apart from filling in the data buffer, the requests are also actually
enqueued: if function-specific setup is called from composte_setup(), the "usb_ep_queue()" block of code in composite_setup() is skipped.
The printer function lacks this part and it results in e.g. get device id requests failing: the host expects some response, the device prepares it but does not equeue it for sending to the host, so the host finally asserts timeout.
This patch adds enqueueing the prepared responses.
--- drivers/usb/gadget/printer.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/gadget/printer.c +9 -0
@@ -975,6 +975,15 @@ unknown:break ; }/* host either stalls (value < 0) or reports success */ +if (value >=0 ) { + req->length = value; + req->zero = value < wLength; + value =usb_ep_queue (cdev->gadget->ep0, req,GFP_ATOMIC ); +if (value <0 ) { +ERROR (dev,"%s:%d Error!\n" , __func__, __LINE__); + req->status =0 ; + } + }return value; }
Signature · 1 line
2.3.7
PATCH 51/142 UBI: fix out of bounds write
In reply to Jiri SlabyFrom: Brian Norris <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d74adbdb9abf0d2506a6c4afa534d894f28b763f upstream.
If aeb->len >= vol->reserved_pebs, we should not be writing aeb into the PEB->LEB mapping.
Caught by Coverity, CID #711212.
--- drivers/mtd/ubi/eba.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mtd/ubi/eba.c +2 -1
@@ -1362,7 +1362,8 @@ int ubi_eba_init(struct ubi_device *ubi, struct ubi_attach_info *ai)* during re-size. */ ubi_move_aeb_to_list (av, aeb, &ai->erase); - vol->eba_tbl[aeb->lnum] = aeb->pnum; + else + vol->eba_tbl[aeb->lnum] = aeb->pnum; } }
Signature · 1 line
2.3.7
PATCH 114/142 RDMA/CMA: Canonize IPv4 on IPV6 sockets properly
In reply to Jiri SlabyFrom: Jason Gunthorpe <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 285214409a9e5fceba2215461b4682b6069d8e77 upstream.
When accepting a new IPv4 connect to an IPv6 socket, the CMA tries to canonize the address family to IPv4, but does not properly process the listening sockaddr to get the listening port, and does not properly set the address family of the canonized sockaddr.
--- drivers/infiniband/core/cma.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
drivers/infiniband/core/cma.c +17 -10
@@ -840,19 +840,27 @@ static void cma_save_ib_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_idmemcpy (&ib->sib_addr, &path->dgid,16 ); } +static __be16 ss_get_port (const struct sockaddr_storage *ss) +{ +if (ss->ss_family ==AF_INET ) +return ((struct sockaddr_in *)ss)->sin_port; +else if (ss->ss_family ==AF_INET6 ) +return ((struct sockaddr_in6 *)ss)->sin6_port; +BUG (); +} +static void cma_save_ip4_info (struct rdma_cm_id *id,struct rdma_cm_id *listen_id,struct cma_hdr *hdr) { -struct sockaddr_in *listen4, *ip4; +struct sockaddr_in *ip4; - listen4 = (struct sockaddr_in *) &listen_id->route.addr.src_addr; ip4 = (struct sockaddr_in *) &id->route.addr.src_addr; - ip4->sin_family = listen4->sin_family; + ip4->sin_family =AF_INET ; ip4->sin_addr.s_addr = hdr->dst_addr.ip4.addr; - ip4->sin_port = listen4->sin_port; + ip4->sin_port =ss_get_port (&listen_id->route.addr.src_addr); ip4 = (struct sockaddr_in *) &id->route.addr.dst_addr; - ip4->sin_family = listen4->sin_family; + ip4->sin_family =AF_INET ; ip4->sin_addr.s_addr = hdr->src_addr.ip4.addr; ip4->sin_port = hdr->port; }
@@ -860,16 +868,15 @@ static void cma_save_ip4_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_istatic void cma_save_ip6_info (struct rdma_cm_id *id,struct rdma_cm_id *listen_id,struct cma_hdr *hdr) { -struct sockaddr_in6 *listen6, *ip6; +struct sockaddr_in6 *ip6; - listen6 = (struct sockaddr_in6 *) &listen_id->route.addr.src_addr; ip6 = (struct sockaddr_in6 *) &id->route.addr.src_addr; - ip6->sin6_family = listen6->sin6_family; + ip6->sin6_family =AF_INET6 ; ip6->sin6_addr = hdr->dst_addr.ip6; - ip6->sin6_port = listen6->sin6_port; + ip6->sin6_port =ss_get_port (&listen_id->route.addr.src_addr); ip6 = (struct sockaddr_in6 *) &id->route.addr.dst_addr; - ip6->sin6_family = listen6->sin6_family; + ip6->sin6_family =AF_INET6 ; ip6->sin6_addr = hdr->src_addr.ip6; ip6->sin6_port = hdr->port; }
Signature · 1 line
2.3.7
PATCH 87/142 ALSA: emux: Fix mutex deadlock in OSS emulation
In reply to Jiri SlabyFrom: Takashi Iwai <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1c94e65c668f44d2c69ae7e7fc268ab3268fba3e upstream.
The OSS emulation in synth-emux helper has a potential AB/BA deadlock at the simultaneous closing and opening:
close ->
snd_seq_release() ->
sne_seq_free_client() ->
snd_seq_delete_all_ports(): takes client->ports_mutex ->
port_delete() ->
snd_emux_unuse(): takes emux->register_mutexopen ->
snd_seq_oss_open() ->
snd_emux_open_seq_oss(): takes emux->register_mutex ->
snd_seq_event_port_attach() ->
snd_seq_create_port(): takes client->ports_mutexThis patch addresses the deadlock by reducing the rance taking emux->register_mutex in snd_emux_open_seq_oss(). The lock is needed for the refcount handling, so move it locally. The calls in emux_seq.c are already with the mutex, thus they are replaced with the version without mutex lock/unlock.
--- sound/synth/emux/emux_oss.c | 11 +---------- sound/synth/emux/emux_seq.c | 27 +++++++++++++++++++++------ 2 files changed, 22 insertions(+), 16 deletions(-)
sound/synth/emux/emux_oss.c +1 -10
@@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)if (snd_BUG_ON (!arg || !emu))return -ENXIO ; -mutex_lock (&emu->register_mutex); - -if (!snd_emux_inc_count (emu)) { -mutex_unlock (&emu->register_mutex); +if (!snd_emux_inc_count (emu))return -EFAULT ; - }memset (&callback,0 ,sizeof (callback)); callback.owner =THIS_MODULE ;
@@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)if (p ==NULL ) {snd_printk (KERN_ERR "can't create port\n" );snd_emux_dec_count (emu); -mutex_unlock (&emu->register_mutex);return -ENOMEM ; }
@@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)reset_port_mode (p, arg->seq_mode);snd_emux_reset_port (p); - -mutex_unlock (&emu->register_mutex);return 0 ; }
@@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_oss_arg *arg)if (snd_BUG_ON (!emu))return -ENXIO ; -mutex_lock (&emu->register_mutex);snd_emux_sounds_off_all (p);snd_soundfont_close_check (emu->sflist,SF_CLIENT_NO (p->chset.port));snd_seq_event_port_detach (p->chset.client, p->chset.port);snd_emux_dec_count (emu); -mutex_unlock (&emu->register_mutex);return 0 ; }
sound/synth/emux/emux_seq.c +21 -6
@@ -267,8 +267,8 @@ snd_emux_event_input(struct snd_seq_event *ev, int direct, void *private_data,/* * increment usage count */ -int -snd_emux_inc_count (struct snd_emux *emu) +static int +__snd_emux_inc_count (struct snd_emux *emu) { emu->used++;if (!try_module_get (emu->ops.owner))
@@ -282,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu)return 1 ; } +int snd_emux_inc_count (struct snd_emux *emu) +{ +int ret; + +mutex_lock (&emu->register_mutex); + ret =__snd_emux_inc_count (emu); +mutex_unlock (&emu->register_mutex); +return ret; +}/* * decrease usage count */ -void -snd_emux_dec_count (struct snd_emux *emu) +static void +__snd_emux_dec_count (struct snd_emux *emu) {module_put (emu->card->module); emu->used--;
@@ -296,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu)module_put (emu->ops.owner); } +void snd_emux_dec_count (struct snd_emux *emu) +{ +mutex_lock (&emu->register_mutex); +__snd_emux_dec_count (emu); +mutex_unlock (&emu->register_mutex); +}/* * Routine that is called upon a first use of a particular port
@@ -315,7 +330,7 @@ snd_emux_use(void *private_data, struct snd_seq_port_subscribe *info)mutex_lock (&emu->register_mutex);snd_emux_init_port (p); -snd_emux_inc_count (emu); +__snd_emux_inc_count (emu);mutex_unlock (&emu->register_mutex);return 0 ; }
@@ -338,7 +353,7 @@ snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *info)mutex_lock (&emu->register_mutex);snd_emux_sounds_off_all (p); -snd_emux_dec_count (emu); +__snd_emux_dec_count (emu);mutex_unlock (&emu->register_mutex);return 0 ; }
Signature · 1 line
2.3.7
PATCH 121/142 xen/console: Update console event channel on resume
In reply to Jiri SlabyFrom: Boris Ostrovsky <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b9d934f27c91b878c4b2e64299d6e419a4022f8d upstream.
After a resume the hypervisor/tools may change console event channel number. We should re-query it.
--- drivers/tty/hvc/hvc_xen.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/tty/hvc/hvc_xen.c +17 -1
@@ -299,11 +299,27 @@ static int xen_initial_domain_console_init(void)return 0 ; } +static void xen_console_update_evtchn (struct xencons_info *info) +{ +if (xen_hvm_domain ()) { +uint64_t v; +int err; + + err =hvm_get_parameter (HVM_PARAM_CONSOLE_EVTCHN , &v); +if (!err && v) + info->evtchn = v; + }else + info->evtchn = xen_start_info->console.domU.evtchn; +} +void xen_console_resume (void ) {struct xencons_info *info =vtermno_to_xencons (HVC_COOKIE ); -if (info !=NULL && info->irq) +if (info !=NULL && info->irq) { +if (!xen_initial_domain ()) +xen_console_update_evtchn (info);rebind_evtchn_irq (info->evtchn, info->irq); + } }static void xencons_disconnect_backend (struct xencons_info *info)
Signature · 1 line
2.3.7
PATCH 17/142 KVM: use slowpath for cross page cached accesses
In reply to Jiri SlabyFrom: Radim Krčmář <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ca3f0874723fad81d0c701b63ae3a17a408d5f25 upstream.
kvm_write_guest_cached() does not mark all written pages as dirty and code comments in kvm_gfn_to_hva_cache_init() talk about NULL memslot with cross page accesses. Fix all the easy way.
The check is '<= 1' to have the same result for 'len = 0' cache anywhere in the page. (nr_pages_needed is 0 on page boundary.)
Message-Id: <[email protected]>
--- virt/kvm/kvm_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
virt/kvm/kvm_main.c +2 -2
@@ -1540,8 +1540,8 @@ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc, ghc->generation = slots->generation; ghc->len = len; ghc->memslot =gfn_to_memslot (kvm, start_gfn); - ghc->hva =gfn_to_hva_many (ghc->memslot, start_gfn, &nr_pages_avail); -if (!kvm_is_error_hva (ghc->hva) && nr_pages_avail >= nr_pages_needed) { + ghc->hva =gfn_to_hva_many (ghc->memslot, start_gfn,NULL ); +if (!kvm_is_error_hva (ghc->hva) && nr_pages_needed <=1 ) { ghc->hva += offset; }else {/*
Signature · 1 line
2.3.7
PATCH 30/142 usb: host: fusbh200: use new USB_RESUME_TIMEOUT
In reply to Jiri SlabyFrom: Felipe Balbi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 595227db1f2d98bfc33f02a55842f268e12b247d upstream.
Make sure we're using the new macro, so our
resume signaling will always pass certification.
--- drivers/usb/host/fusbh200-hcd.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/usb/host/fusbh200-hcd.c +1 -2
@@ -1610,10 +1610,9 @@ static int fusbh200_hub_control (if ((temp &PORT_PE ) ==0 ) goto error; -/* resume signaling for 20 msec */ fusbh200_writel (fusbh200, temp |PORT_RESUME , status_reg); fusbh200->reset_done[wIndex] = jiffies - +msecs_to_jiffies (20 ); + +msecs_to_jiffies (USB_RESUME_TIMEOUT );break ;case USB_PORT_FEAT_C_SUSPEND :clear_bit (wIndex, &fusbh200->port_c_suspend);
Signature · 1 line
2.3.7
PATCH 79/142 memstick: mspro_block: add missing curly braces
In reply to Jiri SlabyFrom: Dan Carpenter <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 13f6b191aaa11c7fd718d35a0c565f3c16bc1d99 upstream.
Using the indenting we can see the curly braces were obviously intended. This is a static checker fix, but my guess is that we don't read enough bytes, because we don't calculate "t_len" correctly.
--- drivers/memstick/core/mspro_block.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/memstick/core/mspro_block.c +2 -1
@@ -758,7 +758,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)if (error || (card->current_mrq.tpc ==MSPRO_CMD_STOP )) {if (msb->data_dir ==READ ) { -for (cnt =0 ; cnt < msb->current_seg; cnt++) +for (cnt =0 ; cnt < msb->current_seg; cnt++) { t_len += msb->req_sg[cnt].length / msb->page_size;
@@ -766,6 +766,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error) t_len += msb->current_page -1 ; t_len *= msb->page_size; + } } }else t_len =blk_rq_bytes (msb->block_req);
Signature · 1 line
2.3.7
PATCH 116/142 gpio: sysfs: fix memory leaks and device hotplug
In reply to Jiri SlabyFrom: Johan Hovold <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 483d821108791092798f5d230686868112927044 upstream.
Unregister GPIOs requested through sysfs at chip remove to avoid leaking the associated memory and sysfs entries.
The stale sysfs entries prevented the gpio numbers from being exported when the gpio range was later reused (e.g. at device reconnect).
This also fixes the related module-reference leak.
Note that kernfs makes sure that any on-going sysfs operations finish before the class devices are unregistered and that further accesses fail.
The chip exported flag is used to prevent gpiod exports during removal. This also makes it harder to trigger, but does not fix, the related race between gpiochip_remove and export_store, which is really a race with gpiod_request that needs to be addressed separately.
Also note that this would prevent the crashes (e.g. NULL-dereferences) at reconnect that affects pre-3.18 kernels, as well as use-after-free on operations on open attribute files on pre-3.14 kernels (prior to kernfs).
--- drivers/gpio/gpiolib.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
drivers/gpio/gpiolib.c +19 -0
@@ -747,6 +747,7 @@ static struct class gpio_class = {*/ static int gpiod_export (struct gpio_desc *desc,bool direction_may_change) { +struct gpio_chip *chip;unsigned long flags;int status;const char *ioname =NULL ;
@@ -764,8 +765,16 @@ static int gpiod_export(struct gpio_desc *desc, bool direction_may_change)return -EINVAL ; } + chip = desc->chip; +mutex_lock (&sysfs_lock); +/* check if chip is being removed */ +if (!chip || !chip->exported) { + status = -ENODEV ; + goto fail_unlock; + } +spin_lock_irqsave (&gpio_lock, flags);if (!test_bit (FLAG_REQUESTED , &desc->flags) ||test_bit (FLAG_EXPORT , &desc->flags)) {
@@ -1029,12 +1038,15 @@ static void gpiochip_unexport(struct gpio_chip *chip) {int status;struct device *dev; +struct gpio_desc *desc; +unsigned int i;mutex_lock (&sysfs_lock); dev =class_find_device (&gpio_class,NULL , chip, match_export);if (dev) {put_device (dev);device_unregister (dev); +/* prevent further gpiod exports */ chip->exported =0 ; status =0 ; }else
@@ -1044,6 +1056,13 @@ static void gpiochip_unexport(struct gpio_chip *chip)if (status)pr_debug ("%s: chip %s status %d\n" , __func__, chip->label, status); + +/* unregister gpiod class devices owned by sysfs */ +for (i =0 ; i < chip->ngpio; i++) { + desc = &chip->desc[i]; +if (test_and_clear_bit (FLAG_SYSFS , &desc->flags)) +gpiod_free (desc); + } }static int __init gpiolib_sysfs_init (void )
Signature · 1 line
2.3.7
PATCH 83/142 staging: panel: fix lcd type
In reply to Jiri SlabyFrom: Sudip Mukherjee <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2c20d92dad5db6440cfa88d811b69fd605240ce4 upstream.
the lcd type as defined in the Kconfig is not matching in the code. as a result the rs, rw and en pins were getting interchanged. Kconfig defines the value of PANEL_LCD to be 1 if we select custom configuration but in the code LCD_TYPE_CUSTOM is defined as 5.
my hardware is LCD_TYPE_CUSTOM, but the pins were assigned to it as pins of LCD_TYPE_OLD, and it was not working.
Now values are corrected with referenece to the values defined in Kconfig and it is working.
checked on JHD204A lcd with LCD_TYPE_CUSTOM configuration.
--- drivers/staging/panel/panel.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/staging/panel/panel.c +6 -7
@@ -275,11 +275,11 @@ static unsigned char lcd_bits[LCD_PORTS][LCD_BITS][BIT_STATES];* LCD types */ #define LCD_TYPE_NONE 0 -#define LCD_TYPE_OLD 1 -#define LCD_TYPE_KS0074 2 -#define LCD_TYPE_HANTRONIX 3 -#define LCD_TYPE_NEXCOM 4 -#define LCD_TYPE_CUSTOM 5 +#define LCD_TYPE_CUSTOM 1 +#define LCD_TYPE_OLD 2 +#define LCD_TYPE_KS0074 3 +#define LCD_TYPE_HANTRONIX 4 +#define LCD_TYPE_NEXCOM 5/* * keypad types
@@ -457,8 +457,7 @@ MODULE_PARM_DESC(keypad_enabled, "Deprecated option, use keypad_type instead");static int lcd_type =-1 ;module_param (lcd_type, int,0000 );MODULE_PARM_DESC (lcd_type, -"LCD type: 0=none, 1=old //, 2=serial ks0074, " -"3=hantronix //, 4=nexcom //, 5=compiled-in" ); +"LCD type: 0=none, 1=compiled-in, 2=old, 3=serial ks0074, 4=hantronix, 5=nexcom" );static int lcd_proto =-1 ;module_param (lcd_proto, int,0000 );
Signature · 1 line
2.3.7
PATCH 13/142 usb: gadget: composite: enable BESL support
In reply to Jiri SlabyFrom: Felipe Balbi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a6615937bcd9234e6d6bb817c3701fce44d0a84d upstream.
According to USB 2.0 ECN Errata for Link Power
Management (USB2-LPM-Errata-final.pdf), BESL
must be enabled if LPM is enabled.
This helps with USB30CV TD 9.21 LPM L1
Suspend Resume Test.
--- drivers/usb/gadget/composite.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/composite.c +1 -1
@@ -528,7 +528,7 @@ static int bos_desc(struct usb_composite_dev *cdev) usb_ext->bLength =USB_DT_USB_EXT_CAP_SIZE ; usb_ext->bDescriptorType =USB_DT_DEVICE_CAPABILITY ; usb_ext->bDevCapabilityType =USB_CAP_TYPE_EXT ; - usb_ext->bmAttributes =cpu_to_le32 (USB_LPM_SUPPORT ); + usb_ext->bmAttributes =cpu_to_le32 (USB_LPM_SUPPORT |USB_BESL_SUPPORT );/* * The Superspeed USB Capability descriptor shall be implemented by all
Signature · 1 line
2.3.7
PATCH 91/142 serial: of-serial: Remove device_type = "serial" registration
In reply to Jiri SlabyFrom: Michal Simek <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6befa9d883385c580369a2cc9e53fbf329771f6d upstream.
Do not probe all serial drivers by of_serial.c which are using device_type = "serial"; property. Only drivers which have valid compatible strings listed in the driver should be probed.
When PORT_UNKNOWN is setup probe will fail anyway.
Arnd quotation about driver historical background:
"when I wrote that driver initially, the idea was that it would get used as a stub to hook up all other serial drivers but after that, the common code learned to create platform devices from DT"
This patch fix the problem with on the system with xilinx_uartps and 16550a where of_serial failed to register for xilinx_uartps and because of irq_dispose_mapping() removed irq_desc. Then when xilinx_uartps was asking for irq with request_irq() EINVAL is returned.
--- drivers/tty/serial/of_serial.c | 1 - 1 file changed, 1 deletion(-)
drivers/tty/serial/of_serial.c +0 -1
@@ -262,7 +262,6 @@ static struct of_device_id of_platform_serial_table[] = { { .compatible = "ibm,qpace-nwp-serial", .data = (void *)PORT_NWPSERIAL, }, #endif - { .type = "serial", .data = (void *)PORT_UNKNOWN, }, { /* end of list */ }, };
Signature · 1 line
2.3.7
PATCH 124/142 ARM: dts: imx23-olinuxino: Fix dr_mode of usb0
In reply to Jiri SlabyFrom: Stefan Wahren <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0fdebe1a2f4d3a8fc03754022fabf8ba95e131a3 upstream.
The dr_mode of usb0 on imx233-olinuxino is left to default "otg". Since the green LED (GPIO2_1) on imx233-olinuxino is connected to the same pin as USB_OTG_ID it's possible to disable USB host by LED toggling:
echo 0 > /sys/class/leds/green/brightness
[ 1068.890000] ci_hdrc ci_hdrc.0: remove, state 1 [ 1068.890000] usb usb1: USB disconnect, device number 1 [ 1068.920000] usb 1-1: USB disconnect, device number 2 [ 1068.920000] usb 1-1.1: USB disconnect, device number 3 [ 1069.070000] usb 1-1.2: USB disconnect, device number 4 [ 1069.450000] ci_hdrc ci_hdrc.0: USB bus 1 deregistered [ 1074.460000] ci_hdrc ci_hdrc.0: timeout waiting for 00000800 in 11
This patch fixes the issue by setting dr_mode to "host" in the dts file.
--- arch/arm/boot/dts/imx23-olinuxino.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/imx23-olinuxino.dts +1 -0
@@ -93,6 +93,7 @@ ahb@80080000 { usb0: usb@80080000 { + dr_mode = "host"; vbus-supply = <®_usb0_vbus>; status = "okay"; };
Signature · 1 line
2.3.7
PATCH 140/142 ACPICA: Utilities: Cleanup to enforce ACPI_PHYSADDR_TO_PTR()/ACPI_PTR_TO_PHYSADDR().
In reply to Jiri SlabyFrom: Lv Zheng <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 6d3fd3cc33d50e4c0d0c0bd172de02caaec3127c upstream.
ACPICA commit 154f6d074dd38d6ebc0467ad454454e6c5c9ecdf
There are code pieces converting pointers using "(acpi_physical_address) x" or "ACPI_CAST_PTR (t, x)" formats, this patch cleans up them.
Known issues:
1. Cleanup of "(ACPI_PHYSICAL_ADDRRESS) x" for a table field For the conversions around the table fields, it is better to fix it with alignment also fixed. So this patch doesn't modify such code. There should be no functional problem by leaving them unchanged.
--- drivers/acpi/acpica/dsopcode.c | 3 +-- drivers/acpi/acpica/tbinstal.c | 5 ++--- 2 files changed, 3 insertions(+), 5 deletions(-)
drivers/acpi/acpica/dsopcode.c +1 -2
@@ -539,8 +539,7 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state,return_ACPI_STATUS (AE_NOT_EXIST ); } - obj_desc->region.address = - (acpi_physical_address )ACPI_TO_INTEGER (table); + obj_desc->region.address =ACPI_PTR_TO_PHYSADDR (table); obj_desc->region.length = table->length; ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n",
drivers/acpi/acpica/tbinstal.c +2 -3
@@ -300,8 +300,7 @@ struct acpi_table_header *acpi_tb_table_override(struct acpi_table_headerACPI_EXCEPTION ((AE_INFO ,AE_NO_MEMORY ,"%4.4s %p Attempted physical table override failed" , table_header->signature, -ACPI_CAST_PTR (void, - table_desc->address))); +ACPI_PHYSADDR_TO_PTR (table_desc->address)));return (NULL ); }
@@ -317,7 +316,7 @@ struct acpi_table_header *acpi_tb_table_override(struct acpi_table_headerACPI_INFO ((AE_INFO ,"%4.4s %p %s table override, new table: %p" , table_header->signature, -ACPI_CAST_PTR (void, table_desc->address), +ACPI_PHYSADDR_TO_PTR (table_desc->address), override_type, new_table));/* We can now unmap/delete the original table (if fully mapped) */
Signature · 1 line
2.3.7
PATCH 69/142 i2c: core: Export bus recovery functions
In reply to Jiri SlabyFrom: Mark Brown <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c1c21f4e60ed4523292f1a89ff45a208bddd3849 upstream.
Current -next fails to link an ARM allmodconfig because drivers that use the core recovery functions can be built as modules but those functions are not exported:
ERROR: "i2c_generic_gpio_recovery" [drivers/i2c/busses/i2c-davinci.ko] undefined!
ERROR: "i2c_generic_scl_recovery" [drivers/i2c/busses/i2c-davinci.ko] undefined!
ERROR: "i2c_recover_bus" [drivers/i2c/busses/i2c-davinci.ko] undefined!
Add exports to fix this.
--- drivers/i2c/i2c-core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/i2c/i2c-core.c +3 -0
@@ -212,6 +212,7 @@ int i2c_generic_scl_recovery(struct i2c_adapter *adap) adap->bus_recovery_info->set_scl (adap,1 );return i2c_generic_recovery (adap); } +EXPORT_SYMBOL_GPL (i2c_generic_scl_recovery);int i2c_generic_gpio_recovery (struct i2c_adapter *adap) {
@@ -226,6 +227,7 @@ int i2c_generic_gpio_recovery(struct i2c_adapter *adap)return ret; } +EXPORT_SYMBOL_GPL (i2c_generic_gpio_recovery);int i2c_recover_bus (struct i2c_adapter *adap) {
@@ -235,6 +237,7 @@ int i2c_recover_bus(struct i2c_adapter *adap)dev_dbg (&adap->dev,"Trying i2c bus recovery\n" );return adap->bus_recovery_info->recover_bus (adap); } +EXPORT_SYMBOL_GPL (i2c_recover_bus);static int i2c_device_probe (struct device *dev) {
Signature · 1 line
2.3.7
PATCH 104/142 Drivers: hv: vmbus: Don't wait after requesting offers
In reply to Jiri SlabyFrom: "K. Y. Srinivasan" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 73cffdb65e679b98893f484063462c045adcf212 upstream.
Don't wait after sending request for offers to the host. This wait is unnecessary and simply adds 5 seconds to the boot time.
--- drivers/hv/channel_mgmt.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-)
drivers/hv/channel_mgmt.c +1 -11
@@ -716,7 +716,7 @@ int vmbus_request_offers(void) {struct vmbus_channel_message_header *msg;struct vmbus_channel_msginfo *msginfo; -int ret, t; +int ret; msginfo = kmalloc(sizeof(*msginfo) + sizeof(struct vmbus_channel_message_header),
@@ -724,8 +724,6 @@ int vmbus_request_offers(void)if (!msginfo)return -ENOMEM ; -init_completion (&msginfo->waitevent); - msg = (struct vmbus_channel_message_header *)msginfo->msg; msg->msgtype =CHANNELMSG_REQUESTOFFERS ;
@@ -739,14 +737,6 @@ int vmbus_request_offers(void) goto cleanup; } - t =wait_for_completion_timeout (&msginfo->waitevent,5 *HZ ); -if (t ==0 ) { - ret = -ETIMEDOUT ; - goto cleanup; - } - - - cleanup:kfree (msginfo);
Signature · 1 line
2.3.7
PATCH 38/142 usb: core: hub: use new USB_RESUME_TIMEOUT
In reply to Jiri SlabyFrom: Felipe Balbi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit bbc78c07a51f6fd29c227b1220a9016e585358ba upstream.
Make sure we're using the new macro, so our
resume signaling will always pass certification.
--- drivers/usb/core/hub.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/core/hub.c +2 -2
@@ -3284,10 +3284,10 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)dev_dbg (hub->intfdev,"can't resume port %d, status %d\n" , port1, status); }else { -/* drive resume for at least 20 msec */ +/* drive resume for USB_RESUME_TIMEOUT msec */ dev_dbg (&udev->dev,"usb %sresume\n" , (PMSG_IS_AUTO (msg) ?"auto-" :"" )); -msleep (25 ); +msleep (USB_RESUME_TIMEOUT );/* Virtual root hubs can trigger on GET_PORT_STATUS to * stop resume signaling. Then finish the resume
Signature · 1 line
2.3.7
PATCH 57/142 powerpc: Fix missing L2 cache size in /sys/devices/system/cpu
In reply to Jiri SlabyFrom: Dave Olson <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f7e9e358362557c3aa2c1ec47490f29fe880a09e upstream.
This problem appears to have been introduced in 2.6.29 by commit 93197a36a9c1 "Rewrite sysfs processor cache info code".
This caused lscpu to error out on at least e500v2 devices, eg:
error: cannot open /sys/devices/system/cpu/cpu0/cache/index2/size: No such file or directory
Some embedded powerpc systems use cache-size in DTS for the unified L2 cache size, not d-cache-size, so we need to allow for both DTS names. Added a new CACHE_TYPE_UNIFIED_D cache_type_info structure to handle this.
--- arch/powerpc/kernel/cacheinfo.c | 44 +++++++++++++++++++++++++++++++---------- 1 file changed, 34 insertions(+), 10 deletions(-)
arch/powerpc/kernel/cacheinfo.c +34 -10
@@ -62,12 +62,22 @@ struct cache_type_info { };/* These are used to index the cache_type_info array. */ -#define CACHE_TYPE_UNIFIED 0 -#define CACHE_TYPE_INSTRUCTION 1 -#define CACHE_TYPE_DATA 2 +#define CACHE_TYPE_UNIFIED 0/* cache-size, cache-block-size, etc. */ +#define CACHE_TYPE_UNIFIED_D 1/* d-cache-size, d-cache-block-size, etc */ +#define CACHE_TYPE_INSTRUCTION 2 +#define CACHE_TYPE_DATA 3static const struct cache_type_info cache_type_info[] = { { +/* Embedded systems that use cache-size, cache-block-size, +* etc. for the Unified (typically L2) cache. */ + .name ="Unified" , + .size_prop ="cache-size" , + .line_size_props = {"cache-line-size" , +"cache-block-size" , }, + .nr_sets_prop ="cache-sets" , + }, + {/* PowerPC Processor binding says the [di]-cache-* * must be equal on unified caches, so just use * d-cache properties. */
@@ -294,7 +304,8 @@ static struct cache *cache_find_first_sibling(struct cache *cache) {struct cache *iter; -if (cache->type ==CACHE_TYPE_UNIFIED ) +if (cache->type ==CACHE_TYPE_UNIFIED || + cache->type ==CACHE_TYPE_UNIFIED_D )return cache;list_for_each_entry (iter, &cache_list, list)
@@ -325,16 +336,29 @@ static bool cache_node_is_unified(const struct device_node *np)return of_get_property (np,"cache-unified" ,NULL ); } -static struct cache *cache_do_one_devnode_unified (struct device_node *node, -int level) +/* +* Unified caches can have two different sets of tags. Most embedded +* use cache-size, etc. for the unified cache size, but open firmware systems +* use d-cache-size, etc. Check on initialization for which type we have, and +* return the appropriate structure type. Assume it's embedded if it isn't +* open firmware. If it's yet a 3rd type, then there will be missing entries +* in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need +* to be extended further. +*/ +static int cache_is_unified_d (const struct device_node *np) { -struct cache *cache; +return of_get_property (np, + cache_type_info[CACHE_TYPE_UNIFIED_D ].size_prop,NULL ) ? +CACHE_TYPE_UNIFIED_D :CACHE_TYPE_UNIFIED ; +} +/* +*/ +static struct cache *cache_do_one_devnode_unified (struct device_node *node,int level) +{pr_debug ("creating L%d ucache for %s\n" , level, node->full_name); - cache =new_cache (CACHE_TYPE_UNIFIED , level, node); - -return cache; +return new_cache (cache_is_unified_d (node), level, node); } static struct cache *cache_do_one_devnode_split(struct device_node *node,
Signature · 1 line
2.3.7
PATCH 84/142 ipv4: Missing sk_nulls_node_init() in ping_unhash().
In reply to Jiri SlabyFrom: "David S. Miller" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
[ Upstream commit a134f083e79fb4c3d0a925691e732c56911b4326 ]
If we don't do that, then the poison value is left in the ->pprev backlink.
This can cause crashes if we do a disconnect, followed by a connect().
--- net/ipv4/ping.c | 1 + 1 file changed, 1 insertion(+)
net/ipv4/ping.c +1 -0
@@ -154,6 +154,7 @@ void ping_unhash(struct sock *sk)if (sk_hashed (sk)) {write_lock_bh (&ping_table.lock);hlist_nulls_del (&sk->sk_nulls_node); +sk_nulls_node_init (&sk->sk_nulls_node);sock_put (sk); isk->inet_num =0 ; isk->inet_sport =0 ;
Signature · 1 line
2.3.7
PATCH 112/142 ocfs2: dlm: fix race between purge and get lock resource
In reply to Jiri SlabyFrom: Junxiao Bi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b1432a2a35565f538586774a03bf277c27fc267d upstream.
There is a race window in dlm_get_lock_resource(), which may return a lock resource which has been purged. This will cause the process to hang forever in dlmlock() as the ast msg can't be handled due to its lock resource not existing.
dlm_get_lock_resource {
...
spin_lock(&dlm->spinlock);
tmpres = __dlm_lookup_lockres_full(dlm, lockid, namelen, hash);
if (tmpres) {
spin_unlock(&dlm->spinlock);
>>>>>>>> race window, dlm_run_purge_list() may run and purge
the lock resource
spin_lock(&tmpres->spinlock);
...
spin_unlock(&tmpres->spinlock);
}
}--- fs/ocfs2/dlm/dlmmaster.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
fs/ocfs2/dlm/dlmmaster.c +13 -0
@@ -726,6 +726,19 @@ lookup:if (tmpres) {spin_unlock (&dlm->spinlock);spin_lock (&tmpres->spinlock); + +/* +* Right after dlm spinlock was released, dlm_thread could have +* purged the lockres. Check if lockres got unhashed. If so +* start over. +*/ +if (hlist_unhashed (&tmpres->hash_node)) { +spin_unlock (&tmpres->spinlock); +dlm_lockres_put (tmpres); + tmpres =NULL ; + goto lookup; + } +/* Wait on the thread that is mastering the resource */ if (tmpres->owner ==DLM_LOCK_RES_OWNER_UNKNOWN ) {__dlm_wait_on_lockres (tmpres);
Signature · 1 line
2.3.7
PATCH 43/142 rtlwifi: rtl8192cu: Add new USB ID
In reply to Jiri SlabyFrom: Larry Finger <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2f92b314f4daff2117847ac5343c54d3d041bf78 upstream.
USB ID 2001:330d is used for a D-Link DWA-131.
--- drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +1 -0
@@ -369,6 +369,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = { {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/ {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ + {RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */ {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/ {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/ {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/
Signature · 1 line
2.3.7
PATCH 111/142 mm: fix anon_vma->degree underflow in anon_vma endless growing prevention
In reply to Jiri SlabyFrom: Leon Yu <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3fe89b3e2a7bbf3e97657104b9b33a9d81b950b3 upstream.
I have constantly stumbled upon "kernel BUG at mm/rmap.c:399!" after upgrading to 3.19 and had no luck with 4.0-rc1 neither.
So, after looking into new logic introduced by commit 7a3ef208e662 ("mm:
prevent endless growth of anon_vma hierarchy"), I found chances are that unlink_anon_vmas() is called without incrementing dst->anon_vma->degree in anon_vma_clone() due to allocation failure. If dst->anon_vma is not NULL in error path, its degree will be incorrectly decremented in unlink_anon_vmas() and eventually underflow when exiting as a result of another call to unlink_anon_vmas(). That's how "kernel BUG at mm/rmap.c:399!" is triggered for me.
This patch fixes the underflow by dropping dst->anon_vma when allocation fails. It's safe to do so regardless of original value of dst->anon_vma because dst->anon_vma doesn't have valid meaning if anon_vma_clone() fails. Besides, callers don't care dst->anon_vma in such case neither.
Also suggested by Michal Hocko, we can clean up vma_adjust() a bit as anon_vma_clone() now does the work.
--- mm/mmap.c | 4 +--- mm/rmap.c | 7 +++++++ 2 files changed, 8 insertions(+), 3 deletions(-)
mm/mmap.c +1 -3
@@ -750,10 +750,8 @@ again: remove_next = 1 + (end > next->vm_end); importer->anon_vma = exporter->anon_vma; error =anon_vma_clone (importer, exporter); -if (error) { - importer->anon_vma =NULL ; +if (error)return error; - } } }
mm/rmap.c +7 -0
@@ -287,6 +287,13 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)return 0 ; enomem_failure: +/* +* dst->anon_vma is dropped here otherwise its degree can be incorrectly +* decremented in unlink_anon_vmas(). +* We can safely do this because callers of anon_vma_clone() don't care +* about dst->anon_vma if anon_vma_clone() failed. +*/ + dst->anon_vma =NULL ;unlink_anon_vmas (dst);return -ENOMEM ; }
Signature · 1 line
2.3.7
PATCH 133/142 drm/radeon: more strictly validate the UVD codec
In reply to Jiri SlabyFrom: Christian König <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d52cdfa4a0c6406bbfb33206341eaf1fb1555994 upstream.
MPEG 2/4 are only supported since UVD3.
--- drivers/gpu/drm/radeon/radeon_uvd.c | 33 +++++++++++++++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/radeon_uvd.c +31 -2
@@ -349,6 +349,29 @@ static int radeon_uvd_cs_msg_decode(uint32_t *msg, unsigned buf_sizes[])return 0 ; } +static int radeon_uvd_validate_codec (struct radeon_cs_parser *p, +unsigned stream_type) +{ +switch (stream_type) { +case 0 :/* H264 */ +case 1 :/* VC1 */ +/* always supported */ +return 0 ; + +case 3 :/* MPEG2 */ +case 4 :/* MPEG4 */ +/* only since UVD 3 */ +if (p->rdev->family >=CHIP_PALM ) +return 0 ; + +/* fall through */ +default : +DRM_ERROR ("UVD codec not supported by hardware %d!\n" , + stream_type); +return -EINVAL ; + } +} +static int radeon_uvd_cs_msg (struct radeon_cs_parser *p,struct radeon_bo *bo,unsigned offset,unsigned buf_sizes[]) {
@@ -391,7 +414,11 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,case 0 :/* it's a create msg, calc image size (width * height) */ img_size = msg[7 ] * msg[8 ]; + + r =radeon_uvd_validate_codec (p, msg[4 ]);radeon_bo_kunmap (bo); +if (r) +return r;/* try to alloc a new handle */ for (i =0 ; i <RADEON_MAX_UVD_HANDLES ; ++i) {
@@ -411,8 +438,10 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,return -EINVAL ;case 1 : -/* it's a decode msg, calc buffer sizes */ - r =radeon_uvd_cs_msg_decode (msg, buf_sizes); +/* it's a decode msg, validate codec and calc buffer sizes */ + r =radeon_uvd_validate_codec (p, msg[4 ]); +if (!r) + r =radeon_uvd_cs_msg_decode (msg, buf_sizes);radeon_bo_kunmap (bo);if (r)return r;
Signature · 1 line
2.3.7
PATCH 52/142 UBI: initialize LEB number variable
In reply to Jiri SlabyFrom: Brian Norris <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f16db8071ce18819fbd705ddcc91c6f392fb61f8 upstream.
In some of the 'out_not_moved' error paths, lnum may be used uninitialized. Don't ignore the warning; let's fix it.
This uninitialized variable doesn't have much visible effect in the end, since we just schedule the PEB for erasure, and its LEB number doesn't really matter (it just gets printed in debug messages). But let's get it straight anyway.
Coverity CID #113449
--- drivers/mtd/ubi/wl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/ubi/wl.c +1 -1
@@ -999,7 +999,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, int cancel) {int err, scrubbing =0 , torture =0 , protect =0 , erroneous =0 ; -int vol_id =-1 ,uninitialized_var (lnum ); +int vol_id =-1 , lnum =-1 ;#ifdef CONFIG_MTD_UBI_FASTMAP int anchor = wrk->anchor;#endif
Signature · 1 line
2.3.7
PATCH 56/142 Bluetooth: ath3k: Add support Atheros AR5B195 combo Mini PCIe card
In reply to Jiri SlabyFrom: Alexander Ploumistos <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 2eeff0b4317a02f0e281df891d990194f0737aae upstream.
Add 04f2:aff1 to ath3k.c supported devices list and btusb.c blacklist, so that the device can load the ath3k firmware and re-enumerate itself as an AR3011 device.
T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=04f2 ProdID=aff1 Rev= 0.01 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
--- drivers/bluetooth/ath3k.c | 1 + drivers/bluetooth/btusb.c | 1 + 2 files changed, 2 insertions(+)
drivers/bluetooth/ath3k.c +1 -0
@@ -65,6 +65,7 @@ static struct usb_device_id ath3k_table[] = {/* Atheros AR3011 with sflash firmware*/ { USB_DEVICE(0x0489, 0xE027) }, { USB_DEVICE(0x0489, 0xE03D) }, + { USB_DEVICE(0x04F2, 0xAFF1) }, { USB_DEVICE(0x0930, 0x0215) }, { USB_DEVICE(0x0CF3, 0x3002) }, { USB_DEVICE(0x0CF3, 0xE019) },
drivers/bluetooth/btusb.c +1 -0
@@ -142,6 +142,7 @@ static struct usb_device_id blacklist_table[] = {/* Atheros 3011 with sflash firmware */ { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, + { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE }, { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
Signature · 1 line
2.3.7
PATCH 100/142 usb: musb: use new USB_RESUME_TIMEOUT
In reply to Jiri SlabyFrom: Felipe Balbi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 309be239369609929d5d3833ee043f7c5afc95d1 upstream.
Make sure we're using the new macro, so our resume signaling will always pass certification.
Based on original work by Bin Liu <Bin Liu <[email protected]>>
--- drivers/usb/musb/musb_core.c | 3 ++- drivers/usb/musb/musb_virthub.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)
drivers/usb/musb/musb_core.c +2 -1
@@ -100,6 +100,7 @@#include <linux/platform_device.h> #include <linux/io.h> #include <linux/dma-mapping.h> +#include <linux/usb.h> #include "musb_core.h"
@@ -478,7 +479,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb, (USB_PORT_STAT_C_SUSPEND <<16 ) |MUSB_PORT_STAT_RESUME ; musb->rh_timer = jiffies - +msecs_to_jiffies (20 ); + +msecs_to_jiffies (USB_RESUME_TIMEOUT ); musb->xceiv->state =OTG_STATE_A_HOST ; musb->is_active =1 ;
drivers/usb/musb/musb_virthub.c +1 -1
@@ -105,7 +105,7 @@ static void musb_port_suspend(struct musb *musb, bool do_suspend)/* later, GetPortStatus will stop RESUME signaling */ musb->port1_status |=MUSB_PORT_STAT_RESUME ; - musb->rh_timer = jiffies +msecs_to_jiffies (20 ); + musb->rh_timer = jiffies +msecs_to_jiffies (USB_RESUME_TIMEOUT ); } }
Signature · 1 line
2.3.7
PATCH 110/142 mm: fix corner case in anon_vma endless growing prevention
In reply to Jiri SlabyFrom: Konstantin Khlebnikov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b800c91a0517071156e772d4fb329ad33590da62 upstream.
Fix for BUG_ON(anon_vma->degree) splashes in unlink_anon_vmas() ("kernel BUG at mm/rmap.c:399!") caused by commit 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy")
Anon_vma_clone() is usually called for a copy of source vma in destination argument. If source vma has anon_vma it should be already in dst->anon_vma. NULL in dst->anon_vma is used as a sign that it's called from anon_vma_fork(). In this case anon_vma_clone() finds anon_vma for reusing.
Vma_adjust() calls it differently and this breaks anon_vma reusing
logic: anon_vma_clone() links vma to old anon_vma and updates degree counters but vma_adjust() overrides vma->anon_vma right after that. As a result final unlink_anon_vmas() decrements degree for wrong anon_vma.
This patch assigns ->anon_vma before calling anon_vma_clone().
--- mm/mmap.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
mm/mmap.c +4 -2
@@ -748,10 +748,12 @@ again: remove_next = 1 + (end > next->vm_end);if (exporter && exporter->anon_vma && !importer->anon_vma) {int error; + importer->anon_vma = exporter->anon_vma; error =anon_vma_clone (importer, exporter); -if (error) +if (error) { + importer->anon_vma =NULL ;return error; - importer->anon_vma = exporter->anon_vma; + } } }
Signature · 1 line
2.3.7
PATCH 125/142 ARM: dts: imx23-olinuxino: Fix polarity of LED GPIO
In reply to Jiri SlabyFrom: Fabio Estevam <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit cfe8c59762244251fd9a5e281d48808095ff4090 upstream.
On imx23-olinuxino the LED turns on when level logic high is aplied to GPIO2_1.
Fix the gpios property accordingly.
--- arch/arm/boot/dts/imx23-olinuxino.dts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/boot/dts/imx23-olinuxino.dts +2 -1
@@ -12,6 +12,7 @@ */ /dts-v1/; +#include <dt-bindings/gpio/gpio.h> /include/ "imx23.dtsi" / {
@@ -120,7 +121,7 @@ user { label = "green"; - gpios = <&gpio2 1 1>; + gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>; }; }; };
Signature · 1 line
2.3.7
PATCH 86/142 ALSA: emux: Fix mutex deadlock at unloading
In reply to Jiri SlabyFrom: Takashi Iwai <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 07b0e5d49d227e3950cb13a3e8caf248ef2a310e upstream.
The emux-synth driver has a possible AB/BA mutex deadlock at unloading the emu10k1 driver:
snd_emux_free() ->
snd_emux_detach_seq(): mutex_lock(&emu->register_mutex) ->
snd_seq_delete_kernel_client() ->
snd_seq_free_client(): mutex_lock(®ister_mutex) snd_seq_release() ->
snd_seq_free_client(): mutex_lock(®ister_mutex) ->
snd_seq_delete_all_ports() ->
snd_emux_unuse(): mutex_lock(&emu->register_mutex)Basically snd_emux_detach_seq() doesn't need a protection of emu->register_mutex as it's already being unregistered. So, we can get rid of this for avoiding the deadlock.
--- sound/synth/emux/emux_seq.c | 2 -- 1 file changed, 2 deletions(-)
sound/synth/emux/emux_seq.c +0 -2
@@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu)if (emu->voices)snd_emux_terminate_all (emu); -mutex_lock (&emu->register_mutex);if (emu->client >=0 ) {snd_seq_delete_kernel_client (emu->client); emu->client =-1 ; } -mutex_unlock (&emu->register_mutex); }
Signature · 1 line
2.3.7
PATCH 88/142 ALSA: emu10k1: Fix card shortname string buffer overflow
In reply to Jiri SlabyFrom: Takashi Iwai <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d02260824e2cad626fb2a9d62e27006d34b6dedc upstream.
Some models provide too long string for the shortname that has 32bytes including the terminator, and it results in a non-terminated string exposed to the user-space. This isn't too critical, though, as the string is stopped at the succeeding longname string.
This patch fixes such entries by dropping "SB" prefix (it's enough to fit within 32 bytes, so far). Meanwhile, it also changes strcpy() with strlcpy() to make sure that this kind of problem won't happen in future, too.
--- sound/pci/emu10k1/emu10k1.c | 6 ++++-- sound/pci/emu10k1/emu10k1_main.c | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-)
sound/pci/emu10k1/emu10k1.c +4 -2
@@ -181,8 +181,10 @@ static int snd_card_emu10k1_probe(struct pci_dev *pci, }#endif -strcpy (card->driver, emu->card_capabilities->driver); -strcpy (card->shortname, emu->card_capabilities->name); +strlcpy (card->driver, emu->card_capabilities->driver, +sizeof (card->driver)); +strlcpy (card->shortname, emu->card_capabilities->name, +sizeof (card->shortname));snprintf (card->longname,sizeof (card->longname),"%s (rev.%d, serial:0x%x) at 0x%lx, irq %i" , card->shortname, emu->revision, emu->serial, emu->port, emu->irq);
sound/pci/emu10k1/emu10k1_main.c +2 -2
@@ -1411,7 +1411,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {* */ {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102, - .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]", + .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]", .id = "Audigy2", .emu10k2_chip = 1, .ca0108_chip = 1,
@@ -1561,7 +1561,7 @@ static struct snd_emu_chip_details emu_chip_details[] = { .adc_1361t = 1, /* 24 bit capture instead of 16bit */ .ac97_chip = 1} , {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102, - .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]", + .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]", .id = "Audigy2", .emu10k2_chip = 1, .ca0102_chip = 1,
Signature · 1 line
2.3.7
PATCH 127/142 ARM: ux500: Move GPIO regulator for SD-card into board DTSs
In reply to Jiri SlabyFrom: Ulf Hansson <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 53d2669844263fd5fdc70f0eb6a2eb8a21086d8e upstream.
The GPIO regulator for the SD-card isn't a ux500 SOC configuration, but instead it's specific to the board. Move the definition of it, into the board DTSs.
--- arch/arm/boot/dts/ste-dbx5x0.dtsi | 17 ----------------- arch/arm/boot/dts/ste-href.dtsi | 17 +++++++++++++++++ arch/arm/boot/dts/ste-snowball.dts | 15 ++++++++++++++- 3 files changed, 31 insertions(+), 18 deletions(-)
arch/arm/boot/dts/ste-dbx5x0.dtsi +0 -17
@@ -774,23 +774,6 @@ status = "disabled"; }; - vmmci: regulator-gpio { - compatible = "regulator-gpio"; - - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <2900000>; - regulator-name = "mmci-reg"; - regulator-type = "voltage"; - - startup-delay-us = <100>; - enable-active-high; - - states = <1800000 0x1 - 2900000 0x0>; - - status = "disabled"; - }; - cryp@a03cb000 { compatible = "stericsson,ux500-cryp"; reg = <0xa03cb000 0x1000>;
arch/arm/boot/dts/ste-href.dtsi +17 -0
@@ -106,6 +106,23 @@ }; }; + vmmci: regulator-gpio { + compatible = "regulator-gpio"; + + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <2900000>; + regulator-name = "mmci-reg"; + regulator-type = "voltage"; + + startup-delay-us = <100>; + enable-active-high; + + states = <1800000 0x1 + 2900000 0x0>; + + status = "disabled"; + }; + // External Micro SD slot sdi0_per1@80126000 { arm,primecell-periphid = <0x10480180>;
arch/arm/boot/dts/ste-snowball.dts +14 -1
@@ -121,10 +121,23 @@ }; vmmci: regulator-gpio { + compatible = "regulator-gpio"; + gpios = <&gpio6 25 0x4>; enable-gpio = <&gpio7 4 0x4>; - status = "okay"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <2900000>; + regulator-name = "mmci-reg"; + regulator-type = "voltage"; + + startup-delay-us = <100>; + enable-active-high; + + states = <1800000 0x1 + 2900000 0x0>; + + status = "disabled"; }; // External Micro SD slot
Signature · 1 line
2.3.7
PATCH 136/142 mmc: core: add missing pm event in mmc_pm_notify to fix hib restore
In reply to Jiri SlabyFrom: Grygorii Strashko <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 184af16b09360d6273fd6160e6ff7f8e2482ef23 upstream.
The PM_RESTORE_PREPARE is not handled now in mmc_pm_notify(), as result mmc_rescan() could be scheduled and executed at late hibernation restore stages when MMC device is suspended already - which, in turn, will lead to system crash on TI dra7-evm board:
WARNING: CPU: 0 PID: 3188 at drivers/bus/omap_l3_noc.c:148 l3_interrupt_handler+0x258/0x374()
44000000.ocp:L3 Custom Error: MASTER MPU TARGET L4_PER1_P3 (Idle): Data Access in User mode during Functional access
Hence, add missed PM_RESTORE_PREPARE PM event in mmc_pm_notify().
--- drivers/mmc/core/core.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/core/core.c +1 -0
@@ -2694,6 +2694,7 @@ int mmc_pm_notify(struct notifier_block *notify_block,switch (mode) {case PM_HIBERNATION_PREPARE :case PM_SUSPEND_PREPARE : +case PM_RESTORE_PREPARE :spin_lock_irqsave (&host->lock, flags); host->rescan_disable =1 ;spin_unlock_irqrestore (&host->lock, flags);
Signature · 1 line
2.3.7
PATCH 61/142 xtensa: ISS: fix locking in TAP network adapter
In reply to Jiri SlabyFrom: Max Filippov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 24e94454c8cb6a13634f5a2f5a01da53a546a58d upstream.
- don't lock lp->lock in the iss_net_timer for the call of iss_net_poll, it will lock it itself;
- invert order of lp->lock and opened_lock acquisition in the iss_net_open to make it consistent with iss_net_poll;
- replace spin_lock with spin_lock_bh when acquiring locks used in iss_net_timer from non-atomic context;
- replace spin_lock_irqsave with spin_lock_bh in the iss_net_start_xmit as the driver doesn't use lp->lock in the hard IRQ context;
- replace __SPIN_LOCK_UNLOCKED(lp.lock) with spin_lock_init, otherwise lockdep is unhappy about using non-static key.
--- arch/xtensa/platforms/iss/network.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-)
arch/xtensa/platforms/iss/network.c +16 -15
@@ -395,10 +395,10 @@ static void iss_net_timer(unsigned long priv) {struct iss_net_private * lp = (struct iss_net_private *) priv; -spin_lock (&lp->lock); -iss_net_poll (); +spin_lock (&lp->lock); +mod_timer (&lp->timer, jiffies + lp->timer_val);spin_unlock (&lp->lock);
@@ -411,7 +411,7 @@ static int iss_net_open(struct net_device *dev)char addr[sizeof "255.255.255.255\0" ];int err; -spin_lock (&lp->lock); +spin_lock_bh (&lp->lock);if ((err = lp->tp.open (lp)) <0 ) goto out;
@@ -430,9 +430,11 @@ static int iss_net_open(struct net_device *dev)while ((err =iss_net_rx (dev)) >0 ) ; -spin_lock (&opened_lock); +spin_unlock_bh (&lp->lock); +spin_lock_bh (&opened_lock);list_add (&lp->opened_list, &opened); -spin_unlock (&opened_lock); +spin_unlock_bh (&opened_lock); +spin_lock_bh (&lp->lock);init_timer (&lp->timer); lp->timer_val =ISS_NET_TIMER_VALUE ;
@@ -441,7 +443,7 @@ static int iss_net_open(struct net_device *dev)mod_timer (&lp->timer, jiffies + lp->timer_val); out: -spin_unlock (&lp->lock); +spin_unlock_bh (&lp->lock);return err; }
@@ -450,7 +452,7 @@ static int iss_net_close(struct net_device *dev)struct iss_net_private *lp =netdev_priv (dev);printk ("iss_net_close!\n" );netif_stop_queue (dev); -spin_lock (&lp->lock); +spin_lock_bh (&lp->lock);spin_lock (&opened_lock);list_del (&opened);
@@ -460,18 +462,17 @@ printk("iss_net_close!\n"); lp->tp.close (lp); -spin_unlock (&lp->lock); +spin_unlock_bh (&lp->lock);return 0 ; }static int iss_net_start_xmit (struct sk_buff *skb,struct net_device *dev) {struct iss_net_private *lp =netdev_priv (dev); -unsigned long flags;int len;netif_stop_queue (dev); -spin_lock_irqsave (&lp->lock, flags); +spin_lock_bh (&lp->lock); len = lp->tp.write (lp, &skb);
@@ -493,7 +494,7 @@ static int iss_net_start_xmit(struct sk_buff *skb, struct net_device *dev)printk (KERN_ERR "iss_net_start_xmit: failed(%d)\n" , len); } -spin_unlock_irqrestore (&lp->lock, flags); +spin_unlock_bh (&lp->lock);dev_kfree_skb (skb);return NETDEV_TX_OK ;
@@ -532,9 +533,9 @@ static int iss_net_set_mac(struct net_device *dev, void *addr)struct iss_net_private *lp =netdev_priv (dev);struct sockaddr *hwaddr = addr; -spin_lock (&lp->lock); +spin_lock_bh (&lp->lock);memcpy (dev->dev_addr, hwaddr->sa_data,ETH_ALEN ); -spin_unlock (&lp->lock); +spin_unlock_bh (&lp->lock);#endif return 0 ;
@@ -604,14 +605,14 @@ static int iss_net_configure(int index, char *init) *lp = ((struct iss_net_private ) { .device_list =LIST_HEAD_INIT (lp->device_list), .opened_list =LIST_HEAD_INIT (lp->opened_list), - .lock =__SPIN_LOCK_UNLOCKED (lp.lock), .dev = dev, .index = index,//.fd = -1, .mac = {0xfe ,0xfd ,0x0 ,0x0 ,0x0 ,0x0 }, .have_mac =0 , - }); + }); +spin_lock_init (&lp->lock);/* * Try all transport protocols. * Note: more protocols can be added by adding '&& !X_init(lp, eth)'.
Signature · 1 line
2.3.7
PATCH 120/142 mm: soft-offline: fix num_poisoned_pages counting on concurrent events
In reply to Jiri SlabyFrom: Naoya Horiguchi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 602498f9aa43d4951eece3fd6ad95a6d0a78d537 upstream.
If multiple soft offline events hit one free page/hugepage concurrently, soft_offline_page() can handle the free page/hugepage multiple times, which makes num_poisoned_pages counter increased more than once. This patch fixes this wrong counting by checking TestSetPageHWPoison for normal papes and by checking the return value of dequeue_hwpoisoned_huge_page() for hugepages.
--- mm/memory-failure.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
mm/memory-failure.c +4 -4
@@ -1718,12 +1718,12 @@ int soft_offline_page(struct page *page, int flags) }else {/* for free pages */ if (PageHuge (page)) {set_page_hwpoison_huge_page (hpage); -dequeue_hwpoisoned_huge_page (hpage); -atomic_long_add (1 <<compound_order (hpage), +if (!dequeue_hwpoisoned_huge_page (hpage)) +atomic_long_add (1 <<compound_order (hpage), &num_poisoned_pages); }else { -SetPageHWPoison (page); -atomic_long_inc (&num_poisoned_pages); +if (!TestSetPageHWPoison (page)) +atomic_long_inc (&num_poisoned_pages); } } unset:
Signature · 1 line
2.3.7
PATCH 123/142 ARM: dts: imx28: Fix AUART4 TX-DMA interrupt name
In reply to Jiri SlabyFrom: Marek Vasut <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4ada77e37a773168fea484899201e272ab44ba8b upstream.
Fix a typo in the TX DMA interrupt name for AUART4. This patch makes AUART4 operational again.
--- Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt | 2 +- arch/arm/boot/dts/imx28.dtsi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/dma/fsl-mxs-dma.txt +1 -1
@@ -38,7 +38,7 @@ dma_apbx: dma-apbx@80024000 { 80 81 68 69 70 71 72 73 74 75 76 77>; - interrupt-names = "auart4-rx", "aurat4-tx", "spdif-tx", "empty", + interrupt-names = "auart4-rx", "auart4-tx", "spdif-tx", "empty", "saif0", "saif1", "i2c0", "i2c1", "auart0-rx", "auart0-tx", "auart1-rx", "auart1-tx", "auart2-rx", "auart2-tx", "auart3-rx", "auart3-tx";
arch/arm/boot/dts/imx28.dtsi +1 -1
@@ -761,7 +761,7 @@ 80 81 68 69 70 71 72 73 74 75 76 77>; - interrupt-names = "auart4-rx", "aurat4-tx", "spdif-tx", "empty", + interrupt-names = "auart4-rx", "auart4-tx", "spdif-tx", "empty", "saif0", "saif1", "i2c0", "i2c1", "auart0-rx", "auart0-tx", "auart1-rx", "auart1-tx", "auart2-rx", "auart2-tx", "auart3-rx", "auart3-tx";
Signature · 1 line
2.3.7
PATCH 141/142 ACPICA: Utilities: Cleanup to convert physical address printing formats.
In reply to Jiri SlabyFrom: Lv Zheng <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit cc2080b0e5a7c6c33ef5e9ffccbc2b8f6f861393 upstream.
ACPICA commit 7f06739db43a85083a70371c14141008f20b2198
For physical addresses, since the address may exceed 32-bit address range after calculation, we should use %8.8X%8.8X (see ACPI_FORMAT_UINT64()) to convert the %p formats.
This is a preparation to switch acpi_physical_address to 64-bit on 32-bit kernel builds.
--- drivers/acpi/acpica/exfldio.c | 10 ++++------ drivers/acpi/acpica/hwvalid.c | 16 ++++++++-------- drivers/acpi/acpica/nsdump.c | 7 +++---- drivers/acpi/acpica/tbutils.c | 4 ++-- drivers/acpi/acpica/tbxfload.c | 7 +++---- drivers/acpi/acpica/utaddress.c | 24 +++++++++++------------- 6 files changed, 31 insertions(+), 37 deletions(-)
drivers/acpi/acpica/exfldio.c +4 -6
@@ -269,17 +269,15 @@ acpi_ex_access_region(union acpi_operand_object *obj_desc, }ACPI_DEBUG_PRINT_RAW ((ACPI_DB_BFIELD , -" Region [%s:%X], Width %X, ByteBase %X, Offset %X at %p\n" , +" Region [%s:%X], Width %X, ByteBase %X, Offset %X at %8.8X%8.8X\n" ,acpi_ut_get_region_name (rgn_desc->region. space_id), rgn_desc->region.space_id, obj_desc->common_field.access_byte_width, obj_desc->common_field.base_byte_offset, - field_datum_byte_offset,ACPI_CAST_PTR (void, - (rgn_desc-> - region. - address + - region_offset)))); + field_datum_byte_offset, +ACPI_FORMAT_UINT64 (rgn_desc->region.address + + region_offset)));/* Invoke the appropriate address_space/op_region handler */
drivers/acpi/acpica/hwvalid.c +8 -8
@@ -142,17 +142,17 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width) byte_width =ACPI_DIV_8 (bit_width); last_address = address + byte_width -1 ; -ACPI_DEBUG_PRINT ((ACPI_DB_IO ,"Address %p LastAddress %p Length %X" , -ACPI_CAST_PTR (void, address),ACPI_CAST_PTR (void, - last_address), - byte_width)); +ACPI_DEBUG_PRINT ((ACPI_DB_IO , +"Address %8.8X%8.8X LastAddress %8.8X%8.8X Length %X" , +ACPI_FORMAT_UINT64 (address), +ACPI_FORMAT_UINT64 (last_address), byte_width));/* Maximum 16-bit address in I/O space */ if (last_address >ACPI_UINT16_MAX ) {ACPI_ERROR ((AE_INFO , -"Illegal I/O port address/length above 64K: %p/0x%X" , -ACPI_CAST_PTR (void, address), byte_width)); +"Illegal I/O port address/length above 64K: %8.8X%8.8X/0x%X" , +ACPI_FORMAT_UINT64 (address), byte_width));return_ACPI_STATUS (AE_LIMIT ); }
@@ -181,8 +181,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)if (acpi_gbl_osi_data >= port_info->osi_dependency) {ACPI_DEBUG_PRINT ((ACPI_DB_IO , -"Denied AML access to port 0x%p/%X (%s 0x%.4X-0x%.4X)" , -ACPI_CAST_PTR (void, address), +"Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)" , +ACPI_FORMAT_UINT64 (address), byte_width, port_info->name, port_info->start, port_info->end));
drivers/acpi/acpica/nsdump.c +3 -4
@@ -260,12 +260,11 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,switch (type) {case ACPI_TYPE_PROCESSOR : -acpi_os_printf ("ID %02X Len %02X Addr %p\n" , +acpi_os_printf ("ID %02X Len %02X Addr %8.8X%8.8X\n" , obj_desc->processor.proc_id, obj_desc->processor.length, -ACPI_CAST_PTR (void, - obj_desc->processor. - address)); +ACPI_FORMAT_UINT64 (obj_desc->processor. + address));break ;case ACPI_TYPE_DEVICE :
drivers/acpi/acpica/tbutils.c +2 -2
@@ -285,8 +285,8 @@ acpi_tb_install_table(acpi_physical_address address, table =acpi_os_map_memory (address,sizeof (struct acpi_table_header ));if (!table) {ACPI_ERROR ((AE_INFO , -"Could not map memory for table [%s] at %p" , - signature,ACPI_CAST_PTR (void, address))); +"Could not map memory for table [%s] at %8.8X%8.8X" , + signature,ACPI_FORMAT_UINT64 (address)));return ; }
drivers/acpi/acpica/tbxfload.c +3 -4
@@ -183,11 +183,10 @@ static acpi_status acpi_tb_load_namespace(void)* be useful for debugging ACPI problems on some machines. */ if (acpi_gbl_disable_ssdt_table_load) { -ACPI_INFO ((AE_INFO ,"Ignoring %4.4s at %p" , +ACPI_INFO ((AE_INFO ,"Ignoring %4.4s at %8.8X%8.8X" , acpi_gbl_root_table_list.tables[i].signature. - ascii,ACPI_CAST_PTR (void, - acpi_gbl_root_table_list. - tables[i].address))); + ascii,ACPI_FORMAT_UINT64 (acpi_gbl_root_table_list. + tables[i].address)));continue ; }
drivers/acpi/acpica/utaddress.c +11 -13
@@ -107,10 +107,10 @@ acpi_ut_add_address_range(acpi_adr_space_type space_id, acpi_gbl_address_range_list[space_id] = range_info;ACPI_DEBUG_PRINT ((ACPI_DB_NAMES , -"\nAdded [%4.4s] address range: 0x%p-0x%p\n" , +"\nAdded [%4.4s] address range: 0x%8.8X%8.8X-0x%8.8X%8.8X\n" ,acpi_ut_get_node_name (range_info->region_node), -ACPI_CAST_PTR (void, address), -ACPI_CAST_PTR (void, range_info->end_address))); +ACPI_FORMAT_UINT64 (address), +ACPI_FORMAT_UINT64 (range_info->end_address))); (void )acpi_ut_release_mutex (ACPI_MTX_NAMESPACE );return_ACPI_STATUS (AE_OK );
@@ -160,15 +160,13 @@ acpi_ut_remove_address_range(acpi_adr_space_type space_id, }ACPI_DEBUG_PRINT ((ACPI_DB_NAMES , -"\nRemoved [%4.4s] address range: 0x%p-0x%p\n" , +"\nRemoved [%4.4s] address range: 0x%8.8X%8.8X-0x%8.8X%8.8X\n" ,acpi_ut_get_node_name (range_info-> region_node), -ACPI_CAST_PTR (void, - range_info-> - start_address), -ACPI_CAST_PTR (void, - range_info-> - end_address))); +ACPI_FORMAT_UINT64 (range_info-> + start_address), +ACPI_FORMAT_UINT64 (range_info-> + end_address)));ACPI_FREE (range_info); return_VOID;
@@ -244,9 +242,9 @@ acpi_ut_check_address_range(acpi_adr_space_type space_id, region_node);ACPI_WARNING ((AE_INFO , -"0x%p-0x%p %s conflicts with Region %s %d" , -ACPI_CAST_PTR (void, address), -ACPI_CAST_PTR (void, end_address), +"0x%8.8X%8.8X-0x%8.8X%8.8X %s conflicts with Region %s %d" , +ACPI_FORMAT_UINT64 (address), +ACPI_FORMAT_UINT64 (end_address),acpi_ut_get_region_name (space_id), pathname, overlap_count));ACPI_FREE (pathname);
Signature · 1 line
2.3.7
PATCH 18/142 MIPS: Hibernate: flush TLB entries earlier
In reply to Jiri SlabyFrom: Huacai Chen <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a843d00d038b11267279e3b5388222320f9ddc1d upstream.
We found that TLB mismatch not only happens after kernel resume, but also happens during snapshot restore. So move it to the beginning of swsusp_arch_suspend().
Patchwork: https://patchwork.linux-mips.org/patch/9621/
--- arch/mips/power/hibernate.S | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/mips/power/hibernate.S +2 -1
@@ -30,6 +30,8 @@ LEAF(swsusp_arch_suspend) END(swsusp_arch_suspend) LEAF(swsusp_arch_resume) + /* Avoid TLB mismatch during and after kernel resume */ + jal local_flush_tlb_all PTR_L t0, restore_pblist 0: PTR_L t1, PBE_ADDRESS(t0) /* source */
@@ -43,7 +45,6 @@ LEAF(swsusp_arch_resume) bne t1, t3, 1b PTR_L t0, PBE_NEXT(t0) bnez t0, 0b - jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */ PTR_LA t0, saved_regs PTR_L ra, PT_R31(t0) PTR_L sp, PT_R29(t0)
Signature · 1 line
2.3.7
PATCH 39/142 ALSA: emu10k1: don't deadlock in proc-functions
In reply to Jiri SlabyFrom: Michael Gernoth <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 91bf0c2dcb935a87e5c0795f5047456b965fd143 upstream.
The functions snd_emu10k1_proc_spdif_read and snd_emu1010_fpga_read acquire the emu_lock before accessing the FPGA. The function used to access the FPGA (snd_emu1010_fpga_read) also tries to take the emu_lock which causes a deadlock.
Remove the outer locking in the proc-functions (guarding only the already safe fpga read) to prevent this deadlock.
[removed superfluous flags variables too -- tiwai]
--- sound/pci/emu10k1/emuproc.c | 12 ------------ 1 file changed, 12 deletions(-)
sound/pci/emu10k1/emuproc.c +0 -12
@@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read(struct snd_info_entry *entry,struct snd_emu10k1 *emu = entry->private_data;u32 value;u32 value2; -unsigned long flags;u32 rate;if (emu->card_capabilities->emu_model) { -spin_lock_irqsave (&emu->emu_lock, flags);snd_emu1010_fpga_read (emu,0x38 , &value); -spin_unlock_irqrestore (&emu->emu_lock, flags);if ((value &0x1 ) ==0 ) { -spin_lock_irqsave (&emu->emu_lock, flags);snd_emu1010_fpga_read (emu,0x2a , &value);snd_emu1010_fpga_read (emu,0x2b , &value2); -spin_unlock_irqrestore (&emu->emu_lock, flags); rate =0x1770000 / (((value <<5 ) | value2)+1 );snd_iprintf (buffer,"ADAT Locked : %u\n" , rate); }else {snd_iprintf (buffer,"ADAT Unlocked\n" ); } -spin_lock_irqsave (&emu->emu_lock, flags);snd_emu1010_fpga_read (emu,0x20 , &value); -spin_unlock_irqrestore (&emu->emu_lock, flags);if ((value &0x4 ) ==0 ) { -spin_lock_irqsave (&emu->emu_lock, flags);snd_emu1010_fpga_read (emu,0x28 , &value);snd_emu1010_fpga_read (emu,0x29 , &value2); -spin_unlock_irqrestore (&emu->emu_lock, flags); rate =0x1770000 / (((value <<5 ) | value2)+1 );snd_iprintf (buffer,"SPDIF Locked : %d\n" , rate); }else {
@@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_read(struct snd_info_entry *entry, {struct snd_emu10k1 *emu = entry->private_data;u32 value; -unsigned long flags;int i;snd_iprintf (buffer,"EMU1010 Registers:\n\n" );for (i =0 ; i <0x40 ; i+=1 ) { -spin_lock_irqsave (&emu->emu_lock, flags);snd_emu1010_fpga_read (emu, i, &value); -spin_unlock_irqrestore (&emu->emu_lock, flags);snd_iprintf (buffer,"%02X: %08X, %02X\n" , i, value, (value >>8 ) &0x7f ); } }
Signature · 1 line
2.3.7
PATCH 49/142 tools/power turbostat: Use $(CURDIR) instead of $(PWD) and add support for O= option in Makefile
In reply to Jiri SlabyFrom: Thomas D <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f82263c6989c31ae9b94cecddffb29dcbec38710 upstream.
Since commit ee0778a30153
("tools/power: turbostat: make Makefile a bit more capable") turbostat's Makefile is using
[...] BUILD_OUTPUT := $(PWD) [...]
which obviously causes trouble when building "turbostat" with
make -C /usr/src/linux/tools/power/x86/turbostat ARCH=x86 turbostat
because GNU make does not update nor guarantee that $PWD is set.
This patch changes the Makefile to use $CURDIR instead, which GNU make guarantees to set and update (i.e. when using "make -C ...") and also adds support for the O= option (see "make help" in your root of your kernel source tree for more details).
--- tools/power/x86/turbostat/Makefile | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
tools/power/x86/turbostat/Makefile +5 -1
@@ -1,8 +1,12 @@ CC = $(CROSS_COMPILE)gcc -BUILD_OUTPUT := $(PWD) +BUILD_OUTPUT := $(CURDIR) PREFIX := /usr DESTDIR := +ifeq ("$(origin O)", "command line") + BUILD_OUTPUT := $(O) +endif + turbostat : turbostat.c CFLAGS += -Wall CFLAGS += -DMSRHEADER='"../../../../arch/x86/include/uapi/asm/msr-index.h"'
Signature · 1 line
2.3.7
PATCH 72/142 RCU pathwalk breakage when running into a symlink overmounting something
In reply to Jiri SlabyFrom: Al Viro <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 3cab989afd8d8d1bc3d99fef0e7ed87c31e7b647 upstream.
Calling unlazy_walk() in walk_component() and do_last() when we find a symlink that needs to be followed doesn't acquire a reference to vfsmount. That's fine when the symlink is on the same vfsmount as the parent directory (which is almost always the case), but it's not always true - one _can_ manage to bind a symlink on top of something. And in such cases we end up with excessive mntput().
--- fs/namei.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/namei.c +4 -2
@@ -1557,7 +1557,8 @@ static inline int walk_component(struct nameidata *nd, struct path *path,if (should_follow_link (inode, follow)) {if (nd->flags &LOOKUP_RCU ) { -if (unlikely (unlazy_walk (nd, path->dentry))) { +if (unlikely (nd->path.mnt != path->mnt || +unlazy_walk (nd, path->dentry))) { err = -ECHILD ; goto out_err; }
@@ -3023,7 +3024,8 @@ finish_lookup:if (should_follow_link (inode, !symlink_ok)) {if (nd->flags &LOOKUP_RCU ) { -if (unlikely (unlazy_walk (nd, path->dentry))) { +if (unlikely (nd->path.mnt != path->mnt || +unlazy_walk (nd, path->dentry))) { error = -ECHILD ; goto out; }
Signature · 1 line
2.3.7
PATCH 95/142 ext4: fix data corruption caused by unwritten and delayed extents
In reply to Jiri SlabyFrom: Lukas Czerner <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit d2dc317d564a46dfc683978a2e5a4f91434e9711 upstream.
Currently it is possible to lose whole file system block worth of data when we hit the specific interaction with unwritten and delayed extents in status extent tree.
The problem is that when we insert delayed extent into extent status tree the only way to get rid of it is when we write out delayed buffer. However there is a limitation in the extent status tree implementation so that when inserting unwritten extent should there be even a single delayed block the whole unwritten extent would be marked as delayed.
At this point, there is no way to get rid of the delayed extents, because there are no delayed buffers to write out. So when a we write into said unwritten extent we will convert it to written, but it still remains delayed.
When we try to write into that block later ext4_da_map_blocks() will set the buffer new and delayed and map it to invalid block which causes the rest of the block to be zeroed loosing already written data.
For now we can fix this by simply not allowing to set delayed status on written extent in the extent status tree. Also add WARN_ON() to make sure that we notice if this happens in the future.
This problem can be easily reproduced by running the following xfs_io.
xfs_io -f -c "pwrite -S 0xaa 4096 2048" \
-c "falloc 0 131072" \
-c "pwrite -S 0xbb 65536 2048" \
-c "fsync" /mnt/test/fffecho 3 > /proc/sys/vm/drop_cachesxfs_io -c "pwrite -S 0xdd 67584 2048" /mnt/test/fff
This can be theoretically also reproduced by at random by running fsx, but it's not very reliable, though on machines with bigger page size (like ppc) this can be seen more often (especially xfstest generic/127)
--- fs/ext4/extents_status.c | 8 ++++++++ fs/ext4/inode.c | 2 ++ 2 files changed, 10 insertions(+)
fs/ext4/extents_status.c +8 -0
@@ -656,6 +656,14 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,BUG_ON (end < lblk); +if ((status &EXTENT_STATUS_DELAYED ) && + (status &EXTENT_STATUS_WRITTEN )) { +ext4_warning (inode->i_sb,"Inserting extent [%u/%u] as " +" delayed and written which can potentially " +" cause data loss.\n" , lblk, len); +WARN_ON (1 ); + } + newes.es_lblk = lblk; newes.es_len = len;ext4_es_store_pblock (&newes, pblk);
fs/ext4/inode.c +2 -0
@@ -569,6 +569,7 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode, status = map->m_flags &EXT4_MAP_UNWRITTEN ?EXTENT_STATUS_UNWRITTEN :EXTENT_STATUS_WRITTEN ;if (!(flags &EXT4_GET_BLOCKS_DELALLOC_RESERVE ) && + !(status &EXTENT_STATUS_WRITTEN ) &&ext4_find_delalloc_range (inode, map->m_lblk, map->m_lblk + map->m_len -1 )) status |=EXTENT_STATUS_DELAYED ;
@@ -678,6 +679,7 @@ found: status = map->m_flags &EXT4_MAP_UNWRITTEN ?EXTENT_STATUS_UNWRITTEN :EXTENT_STATUS_WRITTEN ;if (!(flags &EXT4_GET_BLOCKS_DELALLOC_RESERVE ) && + !(status &EXTENT_STATUS_WRITTEN ) &&ext4_find_delalloc_range (inode, map->m_lblk, map->m_lblk + map->m_len -1 )) status |=EXTENT_STATUS_DELAYED ;
Signature · 1 line
2.3.7
PATCH 60/142 xtensa: provide __NR_sync_file_range2 instead of __NR_sync_file_range
In reply to Jiri SlabyFrom: Max Filippov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 01e84c70fe40c8111f960987bcf7f931842e6d07 upstream.
xtensa actually uses sync_file_range2 implementation, so it should define __NR_sync_file_range2 as other architectures that use that function. That fixes userspace interface (that apparently never worked) and avoids special-casing xtensa in libc implementations. See the thread ending at
http://lists.busybox.net/pipermail/uclibc/2015-February/048833.html
for more details.
--- arch/xtensa/include/uapi/asm/unistd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/xtensa/include/uapi/asm/unistd.h +1 -1
@@ -715,7 +715,7 @@ __SYSCALL(323, sys_process_vm_writev, 6) __SYSCALL(324, sys_name_to_handle_at, 5)#define __NR_open_by_handle_at 325 __SYSCALL(325, sys_open_by_handle_at, 3) -#define __NR_sync_file_range 326 +#define __NR_sync_file_range2 326 __SYSCALL(326, sys_sync_file_range2, 6)#define __NR_perf_event_open 327__SYSCALL (327 , sys_perf_event_open,5 )
Signature · 1 line
2.3.7
PATCH 128/142 ARM: ux500: Enable GPIO regulator for SD-card for HREF boards
In reply to Jiri SlabyFrom: Ulf Hansson <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f9a8c3914ba85f19c3360b19612d77c47adb8942 upstream.
--- arch/arm/boot/dts/ste-href.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm/boot/dts/ste-href.dtsi +0 -2
@@ -119,8 +119,6 @@ states = <1800000 0x1 2900000 0x0>; - - status = "disabled"; }; // External Micro SD slot
Signature · 1 line
2.3.7
PATCH 44/142 rtlwifi: rtl8192cu: Add new device ID
In reply to Jiri SlabyFrom: Marek Vasut <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9374e7d2fdcad3c36dafc8d3effd554bc702c4b6 upstream.
Add new ID for ASUS N10 WiFi dongle.
--- drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/rtlwifi/rtl8192cu/sw.c +1 -0
@@ -313,6 +313,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = { {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/ {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/ {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/ + {RTL_USB_DEVICE(0x0b05, 0x17ba, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/ {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/ {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/ {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
Signature · 1 line
2.3.7
PATCH 82/142 mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support
In reply to Jiri SlabyFrom: "Kirill A. Shutemov" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ee53664bda169f519ce3c6a22d378f0b946c8178 upstream.
Sasha Levin found a NULL pointer dereference that is due to a missing page table lock, which in turn is due to the pmd entry in question being a transparent huge-table entry.
The code - introduced in commit 1998cc048901 ("mm: make madvise(MADV_WILLNEED) support swap file prefetch") - correctly checks for this situation using pmd_none_or_trans_huge_or_clear_bad(), but it turns out that that function doesn't work correctly.
pmd_none_or_trans_huge_or_clear_bad() expected that pmd_bad() would trigger if the transparent hugepage bit was set, but it doesn't do that if pmd_numa() is also set. Note that the NUMA bit only gets set on real NUMA machines, so people trying to reproduce this on most normal development systems would never actually trigger this.
Fix it by removing the very subtle (and subtly incorrect) expectation, and instead just checking pmd_trans_huge() explicitly.
[ Additionally remove the now stale test for pmd_trans_huge() inside the
pmd_bad() case - Linus ]
--- include/asm-generic/pgtable.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
include/asm-generic/pgtable.h +2 -3
@@ -599,11 +599,10 @@ static inline int pmd_none_or_trans_huge_or_clear_bad(pmd_t *pmd)#ifdef CONFIG_TRANSPARENT_HUGEPAGE barrier ();#endif -if (pmd_none (pmdval)) +if (pmd_none (pmdval) ||pmd_trans_huge (pmdval))return 1 ;if (unlikely (pmd_bad (pmdval))) { -if (!pmd_trans_huge (pmdval)) -pmd_clear_bad (pmd); +pmd_clear_bad (pmd);return 1 ; }return 0 ;
Signature · 1 line
2.3.7
PATCH 101/142 usb: host: oxu210hp: use new USB_RESUME_TIMEOUT
In reply to Jiri SlabyFrom: Felipe Balbi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 84c0d178eb9f3a3ae4d63dc97a440266cf17f7f5 upstream.
Make sure we're using the new macro, so our
resume signaling will always pass certification.
--- drivers/usb/host/oxu210hp-hcd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/host/oxu210hp-hcd.c +4 -3
@@ -2497,11 +2497,12 @@ static irqreturn_t oxu210_hcd_irq(struct usb_hcd *hcd) || oxu->reset_done[i] != 0)continue ; -/* start 20 msec resume signaling from this port, -* and make khubd collect PORT_STAT_C_SUSPEND to +/* start USB_RESUME_TIMEOUT resume signaling from this +* port, and make hub_wq collect PORT_STAT_C_SUSPEND to * stop that signaling. */ - oxu->reset_done[i] = jiffies +msecs_to_jiffies (20 ); + oxu->reset_done[i] = jiffies + +msecs_to_jiffies (USB_RESUME_TIMEOUT );oxu_dbg (oxu,"port %d remote wakeup\n" , i +1 );mod_timer (&hcd->rh_timer, oxu->reset_done[i]); }
Signature · 1 line
2.3.7
PATCH 138/142 sound/oss: fix deadlock in sequencer_ioctl(SNDCTL_SEQ_OUTOFBAND)
In reply to Jiri SlabyFrom: Alexey Khoroshilov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit bc26d4d06e337ade069f33d3f4377593b24e6e36 upstream.
A deadlock can be initiated by userspace via ioctl(SNDCTL_SEQ_OUTOFBAND) on /dev/sequencer with TMR_ECHO midi event.
In this case the control flow is:sound_ioctl()
-> case SND_DEV_SEQ:
case SND_DEV_SEQ2:
sequencer_ioctl()
-> case SNDCTL_SEQ_OUTOFBAND:
spin_lock_irqsave(&lock,flags);
play_event();
-> case EV_TIMING:
seq_timing_event()
-> case TMR_ECHO:
seq_copy_to_input()
-> spin_lock_irqsave(&lock,flags);It seems that spin_lock_irqsave() around play_event() is not necessary, because the only other call location in seq_startplay() makes the call without acquiring spinlock.
So, the patch just removes spinlocks around play_event(). By the way, it removes unreachable code in seq_timing_event(), since (seq_mode == SEQ_2) case is handled in the beginning.
Compile tested only.
Found by Linux Driver Verification project (linuxtesting.org).
--- sound/oss/sequencer.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-)
sound/oss/sequencer.c +2 -10
@@ -683,13 +683,8 @@ static int seq_timing_event(unsigned char *event_rec)break ;case TMR_ECHO : -if (seq_mode ==SEQ_2 ) -seq_copy_to_input (event_rec,8 ); -else - { - parm = (parm <<8 |SEQ_ECHO ); -seq_copy_to_input ((unsigned char *) &parm,4 ); - } + parm = (parm <<8 |SEQ_ECHO ); +seq_copy_to_input ((unsigned char *) &parm,4 );break ;default :;
@@ -1332,7 +1327,6 @@ int sequencer_ioctl(int dev, struct file *file, unsigned int cmd, void __user *aint mode =translate_mode (file);struct synth_info inf;struct seq_event_rec event_rec; -unsigned long flags;int __user *p = arg; orig_dev = dev = dev >>4 ;
@@ -1487,9 +1481,7 @@ int sequencer_ioctl(int dev, struct file *file, unsigned int cmd, void __user *acase SNDCTL_SEQ_OUTOFBAND :if (copy_from_user (&event_rec, arg,sizeof (event_rec)))return -EFAULT ; -spin_lock_irqsave (&lock,flags);play_event (event_rec.arr); -spin_unlock_irqrestore (&lock,flags);return 0 ;case SNDCTL_MIDI_INFO :
Signature · 1 line
2.3.7
PATCH 55/142 target: Fix COMPARE_AND_WRITE with SG_TO_MEM_NOALLOC handling
In reply to Jiri SlabyFrom: Nicholas Bellinger <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c8e639852ad720499912acedfd6b072325fd2807 upstream.
This patch fixes a bug for COMPARE_AND_WRITE handling with fabrics using SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC.
It adds the missing allocation for cmd->t_bidi_data_sg within transport_generic_new_cmd() that is used by COMPARE_AND_WRITE for the initial READ payload, even if the fabric is already providing a pre-allocated buffer for cmd->t_data_sg.
Also, fix zero-length COMPARE_AND_WRITE handling within the compare_and_write_callback() and target_complete_ok_work() to queue the response, skipping the initial READ.
This fixes COMPARE_AND_WRITE emulation with loopback, vhost, and xen-backend fabric drivers using SG_TO_MEM_NOALLOC.
--- drivers/target/target_core_sbc.c | 15 +++++++++----- drivers/target/target_core_transport.c | 37 ++++++++++++++++++++++++++++++---- include/target/target_core_base.h | 2 +- 3 files changed, 44 insertions(+), 10 deletions(-)
drivers/target/target_core_sbc.c +10 -5
@@ -298,7 +298,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *oreturn 0 ; } -static sense_reason_t xdreadwrite_callback (struct se_cmd *cmd) +static sense_reason_t xdreadwrite_callback (struct se_cmd *cmd,bool success) {unsigned char *buf, *addr;struct scatterlist *sg;
@@ -362,7 +362,7 @@ sbc_execute_rw(struct se_cmd *cmd) cmd->data_direction); } -static sense_reason_t compare_and_write_post (struct se_cmd *cmd) +static sense_reason_t compare_and_write_post (struct se_cmd *cmd,bool success) {struct se_device *dev = cmd->se_dev;
@@ -385,7 +385,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd)return TCM_NO_SENSE ; } -static sense_reason_t compare_and_write_callback (struct se_cmd *cmd) +static sense_reason_t compare_and_write_callback (struct se_cmd *cmd,bool success) {struct se_device *dev = cmd->se_dev;struct scatterlist *write_sg =NULL , *sg;
@@ -400,11 +400,16 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd)/* * Handle early failure in transport_generic_request_failure(), -* which will not have taken ->caw_mutex yet.. +* which will not have taken ->caw_sem yet.. */ -if (!cmd->t_data_sg || !cmd->t_bidi_data_sg) +if (!success && (!cmd->t_data_sg || !cmd->t_bidi_data_sg))return TCM_NO_SENSE ;/* +* Handle special case for zero-length COMPARE_AND_WRITE +*/ +if (!cmd->data_length) + goto out; +/* * Immediately exit + release dev->caw_sem if command has already * been failed with a non-zero SCSI status. */
drivers/target/target_core_transport.c +33 -4
@@ -1589,11 +1589,11 @@ void transport_generic_request_failure(struct se_cmd *cmd,transport_complete_task_attr (cmd);/* * Handle special case for COMPARE_AND_WRITE failure, where the -* callback is expected to drop the per device ->caw_mutex. +* callback is expected to drop the per device ->caw_sem. */ if ((cmd->se_cmd_flags &SCF_COMPARE_AND_WRITE ) && cmd->transport_complete_callback) - cmd->transport_complete_callback (cmd); + cmd->transport_complete_callback (cmd, false);switch (sense_reason) {case TCM_NON_EXISTENT_LUN :
@@ -1942,8 +1942,12 @@ static void target_complete_ok_work(struct work_struct *work)if (cmd->transport_complete_callback) {sense_reason_t rc; - rc = cmd->transport_complete_callback (cmd); + rc = cmd->transport_complete_callback (cmd, true);if (!rc && !(cmd->se_cmd_flags &SCF_COMPARE_AND_WRITE_POST )) { +if ((cmd->se_cmd_flags &SCF_COMPARE_AND_WRITE ) && + !cmd->data_length) + goto queue_rsp; +return ; }else if (rc) { ret = transport_send_check_condition_and_sense(cmd,
@@ -1957,6 +1961,7 @@ static void target_complete_ok_work(struct work_struct *work) } } +queue_rsp:switch (cmd->data_direction) {case DMA_FROM_DEVICE :spin_lock (&cmd->se_lun->lun_sep_lock);
@@ -2045,6 +2050,16 @@ static inline void transport_reset_sgl_orig(struct se_cmd *cmd)static inline void transport_free_pages (struct se_cmd *cmd) {if (cmd->se_cmd_flags &SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC ) { +/* +* Release special case READ buffer payload required for +* SG_TO_MEM_NOALLOC to function with COMPARE_AND_WRITE +*/ +if (cmd->se_cmd_flags &SCF_COMPARE_AND_WRITE ) { +transport_free_sgl (cmd->t_bidi_data_sg, + cmd->t_bidi_data_nents); + cmd->t_bidi_data_sg =NULL ; + cmd->t_bidi_data_nents =0 ; + }transport_reset_sgl_orig (cmd);return ; }
@@ -2193,6 +2208,7 @@ sense_reason_t transport_generic_new_cmd(struct se_cmd *cmd) {int ret =0 ; +bool zero_flag = !(cmd->se_cmd_flags &SCF_SCSI_DATA_CDB );/* * Determine is the TCM fabric module has already allocated physical
@@ -2201,7 +2217,6 @@ transport_generic_new_cmd(struct se_cmd *cmd)*/ if (!(cmd->se_cmd_flags &SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC ) && cmd->data_length) { -bool zero_flag = !(cmd->se_cmd_flags &SCF_SCSI_DATA_CDB );if ((cmd->se_cmd_flags &SCF_BIDI ) || (cmd->se_cmd_flags &SCF_COMPARE_AND_WRITE )) {
@@ -2224,6 +2239,20 @@ transport_generic_new_cmd(struct se_cmd *cmd) cmd->data_length, zero_flag);if (ret <0 )return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE ; + }else if ((cmd->se_cmd_flags &SCF_COMPARE_AND_WRITE ) && + cmd->data_length) { +/* +* Special case for COMPARE_AND_WRITE with fabrics +* using SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC. +*/ +u32 caw_length = cmd->t_task_nolb * + cmd->se_dev->dev_attrib.block_size; + + ret =target_alloc_sgl (&cmd->t_bidi_data_sg, + &cmd->t_bidi_data_nents, + caw_length, zero_flag); +if (ret <0 ) +return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE ; }/* * If this command is not a write we can execute it right here,
include/target/target_core_base.h +1 -1
@@ -457,7 +457,7 @@ struct se_cmd {sense_reason_t (*execute_cmd)(struct se_cmd *);sense_reason_t (*execute_rw)(struct se_cmd *,struct scatterlist *,u32 ,enum dma_data_direction ); -sense_reason_t (*transport_complete_callback)(struct se_cmd *); +sense_reason_t (*transport_complete_callback)(struct se_cmd *,bool );unsigned char *t_task_cdb;unsigned char __t_task_cdb[TCM_MAX_COMMAND_SIZE ];
Signature · 1 line
2.3.7
PATCH 74/142 e1000: add dummy allocator to fix race condition between mtu change and netpoll
In reply to Jiri SlabyFrom: Sabrina Dubroca <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 08e8331654d1d7b2c58045e549005bc356aa7810 upstream.
There is a race condition between e1000_change_mtu's cleanups and netpoll, when we change the MTU across jumbo size:
Changing MTU frees all the rx buffers:
e1000_change_mtu -> e1000_down -> e1000_clean_all_rx_rings ->
e1000_clean_rx_ringThen, close to the end of e1000_change_mtu:
pr_info -> ... -> netpoll_poll_dev -> e1000_clean ->
e1000_clean_rx_irq -> e1000_alloc_rx_buffers -> e1000_alloc_fragAnd when we come back to do the rest of the MTU change:
e1000_up -> e1000_configure -> e1000_configure_rx ->
e1000_alloc_jumbo_rx_buffersalloc_jumbo finds the buffers already != NULL, since data (shared with page in e1000_rx_buffer->rxbuf) has been re-alloc'd, but it's garbage, or at least not what is expected when in jumbo state.
This results in an unusable adapter (packets don't get through), and a NULL pointer dereference on the next call to e1000_clean_rx_ring (other mtu change, link down, shutdown):
BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff81194d6e>] put_compound_page+0x7e/0x330
[...]
Call Trace: [<ffffffff81195445>] put_page+0x55/0x60 [<ffffffff815d9f44>] e1000_clean_rx_ring+0x134/0x200 [<ffffffff815da055>] e1000_clean_all_rx_rings+0x45/0x60 [<ffffffff815df5e0>] e1000_down+0x1c0/0x1d0 [<ffffffff811e2260>] ? deactivate_slab+0x7f0/0x840 [<ffffffff815e21bc>] e1000_change_mtu+0xdc/0x170 [<ffffffff81647050>] dev_set_mtu+0xa0/0x140 [<ffffffff81664218>] do_setlink+0x218/0xac0 [<ffffffff814459e9>] ? nla_parse+0xb9/0x120 [<ffffffff816652d0>] rtnl_newlink+0x6d0/0x890 [<ffffffff8104f000>] ? kvm_clock_read+0x20/0x40 [<ffffffff810a2068>] ? sched_clock_cpu+0xa8/0x100 [<ffffffff81663802>] rtnetlink_rcv_msg+0x92/0x260
By setting the allocator to a dummy version, netpoll can't mess up our rx buffers. The allocator is set back to a sane value in e1000_configure_rx.
--- drivers/net/ethernet/intel/e1000/e1000_main.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/e1000/e1000_main.c +9 -1
@@ -144,6 +144,11 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,static bool e1000_clean_jumbo_rx_irq (struct e1000_adapter *adapter,struct e1000_rx_ring *rx_ring,int *work_done,int work_to_do); +static void e1000_alloc_dummy_rx_buffers (struct e1000_adapter *adapter, +struct e1000_rx_ring *rx_ring, +int cleaned_count) +{ +}static void e1000_alloc_rx_buffers (struct e1000_adapter *adapter,struct e1000_rx_ring *rx_ring,int cleaned_count);
@@ -3566,8 +3571,11 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)msleep (1 );/* e1000_down has a dependency on max_frame_size */ hw->max_frame_size = max_frame; -if (netif_running (netdev)) +if (netif_running (netdev)) { +/* prevent buffers from being reallocated */ + adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers;e1000_down (adapter); + }/* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN * means we reserve 2 more, this pushes us to allocate from the next
Signature · 1 line
2.3.7
PATCH 117/142 mnt: Fix fs_fully_visible to verify the root directory is visible
In reply to Jiri SlabyFrom: "Eric W. Biederman" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7e96c1b0e0f495c5a7450dc4aa7c9a24ba4305bd upstream.
This fixes a dumb bug in fs_fully_visible that allows proc or sys to be mounted if there is a bind mount of part of /proc/ or /sys/ visible.
--- fs/namespace.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/namespace.c +6 -0
@@ -2940,6 +2940,12 @@ bool fs_fully_visible(struct file_system_type *type)if (mnt->mnt.mnt_sb->s_type != type)continue ; +/* This mount is not fully visible if it's root directory +* is not the root directory of the filesystem. +*/ +if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root) +continue ; +/* This mount is not fully visible if there are any child mounts * that cover anything except for empty directories. */
Signature · 1 line
2.3.7
PATCH 129/142 ARM: ux500: Enable GPIO regulator for SD-card for snowball
In reply to Jiri SlabyFrom: Ulf Hansson <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 11133db7a836b0cb411faa048f07a38e994d1382 upstream.
--- arch/arm/boot/dts/ste-snowball.dts | 2 -- 1 file changed, 2 deletions(-)
arch/arm/boot/dts/ste-snowball.dts +0 -2
@@ -136,8 +136,6 @@ states = <1800000 0x1 2900000 0x0>; - - status = "disabled"; }; // External Micro SD slot
Signature · 1 line
2.3.7
PATCH 73/142 ksoftirqd: Enable IRQs and call cond_resched() before poking RCU
In reply to Jiri SlabyFrom: Calvin Owens <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 28423ad283d5348793b0c45cc9b1af058e776fd6 upstream.
While debugging an issue with excessive softirq usage, I encountered the following note in commit 3e339b5dae24a706 ("softirq: Use hotplug thread infrastructure"):
[ paulmck: Call rcu_note_context_switch() with interrupts enabled. ]
...but despite this note, the patch still calls RCU with IRQs disabled.
This seemingly innocuous change caused a significant regression in softirq CPU usage on the sending side of a large TCP transfer (~1 GB/s): when introducing 0.01% packet loss, the softirq usage would jump to around 25%, spiking as high as 50%. Before the change, the usage would never exceed 5%.
Moving the call to rcu_note_context_switch() after the cond_sched() call, as it was originally before the hotplug patch, completely eliminated this problem.
--- kernel/softirq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/softirq.c +5 -1
@@ -772,9 +772,13 @@ static void run_ksoftirqd(unsigned int cpu)local_irq_disable ();if (local_softirq_pending ()) {__do_softirq (); -rcu_note_context_switch (cpu);local_irq_enable ();cond_resched (); + +preempt_disable (); +rcu_note_context_switch (cpu); +preempt_enable (); +return ; }local_irq_enable ();
Signature · 1 line
2.3.7
PATCH 70/142 drm/radeon: fix doublescan modes (v2)
In reply to Jiri SlabyFrom: Alex Deucher <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit fd99a0943ffaa0320ea4f69d09ed188f950c0432 upstream.
Use the correct flags for atom.
v2: handle DRM_MODE_FLAG_DBLCLK
--- drivers/gpu/drm/radeon/atombios_crtc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/atombios_crtc.c +6 -2
@@ -332,8 +332,10 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc, misc |=ATOM_COMPOSITESYNC ;if (mode->flags &DRM_MODE_FLAG_INTERLACE ) misc |=ATOM_INTERLACE ; -if (mode->flags &DRM_MODE_FLAG_DBLSCAN ) +if (mode->flags &DRM_MODE_FLAG_DBLCLK ) misc |=ATOM_DOUBLE_CLOCK_MODE ; +if (mode->flags &DRM_MODE_FLAG_DBLSCAN ) + misc |=ATOM_H_REPLICATIONBY2 |ATOM_V_REPLICATIONBY2 ; args.susModeMiscInfo.usAccess =cpu_to_le16 (misc); args.ucCRTC = radeon_crtc->crtc_id;
@@ -376,8 +378,10 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc, misc |=ATOM_COMPOSITESYNC ;if (mode->flags &DRM_MODE_FLAG_INTERLACE ) misc |=ATOM_INTERLACE ; -if (mode->flags &DRM_MODE_FLAG_DBLSCAN ) +if (mode->flags &DRM_MODE_FLAG_DBLCLK ) misc |=ATOM_DOUBLE_CLOCK_MODE ; +if (mode->flags &DRM_MODE_FLAG_DBLSCAN ) + misc |=ATOM_H_REPLICATIONBY2 |ATOM_V_REPLICATIONBY2 ; args.susModeMiscInfo.usAccess =cpu_to_le16 (misc); args.ucCRTC = radeon_crtc->crtc_id;
Signature · 1 line
2.3.7
PATCH 134/142 pinctrl: Don't just pretend to protect pinctrl_maps, do it for real
In reply to Jiri SlabyFrom: Doug Anderson <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c5272a28566b00cce79127ad382406e0a8650690 upstream.
Way back, when the world was a simpler place and there was no war, no evil, and no kernel bugs, there was just a single pinctrl lock. That was how the world was when (57291ce pinctrl: core device tree mapping table parsing support) was written. In that case, there were instances where the pinctrl mutex was already held when pinctrl_register_map() was called, hence a "locked" parameter was passed to the function to indicate that the mutex was already locked (so we shouldn't lock it again).
A few years ago in (42fed7b pinctrl: move subsystem mutex to pinctrl_dev struct), we switched to a separate pinctrl_maps_mutex. ...but (oops) we forgot to re-think about the whole "locked" parameter for pinctrl_register_map(). Basically the "locked" parameter appears to still refer to whether the bigger pinctrl_dev mutex is locked, but we're using it to skip locks of our (now separate) pinctrl_maps_mutex.
That's kind of a bad thing(TM). Probably nobody noticed because most of the calls to pinctrl_register_map happen at boot time and we've got synchronous device probing. ...and even cases where we're asynchronous don't end up actually hitting the race too often. ...but after banging my head against the wall for a bug that reproduced 1 out of 1000 reboots and lots of looking through kgdb, I finally noticed this.
Anyway, we can now safely remove the "locked" parameter and go back to a war-free, evil-free, and kernel-bug-free world.
--- drivers/pinctrl/core.c | 10 ++++------ drivers/pinctrl/core.h | 2 +- drivers/pinctrl/devicetree.c | 2 +- 3 files changed, 6 insertions(+), 8 deletions(-)
drivers/pinctrl/core.c +4 -6
@@ -1107,7 +1107,7 @@ void devm_pinctrl_put(struct pinctrl *p)EXPORT_SYMBOL_GPL (devm_pinctrl_put);int pinctrl_register_map (struct pinctrl_map const *maps,unsigned num_maps, -bool dup,bool locked) +bool dup) {int i, ret;struct pinctrl_maps *maps_node;
@@ -1175,11 +1175,9 @@ int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps, maps_node->maps = maps; } -if (!locked) -mutex_lock (&pinctrl_maps_mutex); +mutex_lock (&pinctrl_maps_mutex);list_add_tail (&maps_node->node, &pinctrl_maps); -if (!locked) -mutex_unlock (&pinctrl_maps_mutex); +mutex_unlock (&pinctrl_maps_mutex);return 0 ; }
@@ -1194,7 +1192,7 @@ int pinctrl_register_map(struct pinctrl_map const *maps, unsigned num_maps,int pinctrl_register_mappings (struct pinctrl_map const *maps,unsigned num_maps) { -return pinctrl_register_map (maps, num_maps, true, false); +return pinctrl_register_map (maps, num_maps, true); }void pinctrl_unregister_map (struct pinctrl_map const *map)
drivers/pinctrl/core.h +1 -1
@@ -183,7 +183,7 @@ static inline struct pin_desc *pin_desc_get(struct pinctrl_dev *pctldev, }int pinctrl_register_map (struct pinctrl_map const *maps,unsigned num_maps, -bool dup,bool locked); +bool dup);void pinctrl_unregister_map (struct pinctrl_map const *map);extern int pinctrl_force_sleep (struct pinctrl_dev *pctldev);
drivers/pinctrl/devicetree.c +1 -1
@@ -92,7 +92,7 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, dt_map->num_maps = num_maps;list_add_tail (&dt_map->node, &p->dt_maps); -return pinctrl_register_map (map, num_maps, false, true); +return pinctrl_register_map (map, num_maps, false); }struct pinctrl_dev *of_pinctrl_get (struct device_node *np)
Signature · 1 line
2.3.7
PATCH 54/142 scsi: storvsc: Fix a bug in copy_from_bounce_buffer()
In reply to Jiri SlabyFrom: "K. Y. Srinivasan" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8de580742fee8bc34d116f57a20b22b9a5f08403 upstream.
We may exit this function without properly freeing up the maapings we may have acquired. Fix the bug.
--- drivers/scsi/storvsc_drv.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/scsi/storvsc_drv.c +8 -7
@@ -739,21 +739,22 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl,if (bounce_sgl[j].length ==PAGE_SIZE ) {/* full..move to next entry */ sg_kunmap_atomic (bounce_addr); + bounce_addr =0 ; j++; + } -/* if we need to use another bounce buffer */ -if (srclen || i != orig_sgl_count -1 ) - bounce_addr =sg_kmap_atomic (bounce_sgl,j); +/* if we need to use another bounce buffer */ +if (srclen && bounce_addr ==0 ) + bounce_addr =sg_kmap_atomic (bounce_sgl, j); - }else if (srclen ==0 && i == orig_sgl_count -1 ) { -/* unmap the last bounce that is < PAGE_SIZE */ -sg_kunmap_atomic (bounce_addr); - } }sg_kunmap_atomic (src_addr - orig_sgl[i].offset); } +if (bounce_addr) +sg_kunmap_atomic (bounce_addr); +local_irq_restore (flags);return total_copied;
Signature · 1 line
2.3.7
PATCH 119/142 writeback: use |1 instead of +1 to protect against div by zero
In reply to Jiri SlabyFrom: Tejun Heo <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 464d1387acb94dc43ba772b35242345e3d2ead1b upstream.
mm/page-writeback.c has several places where 1 is added to the divisor to prevent division by zero exceptions; however, if the original divisor is equivalent to -1, adding 1 leads to division by zero.
There are three places where +1 is used for this purpose - one in pos_ratio_polynom() and two in bdi_position_ratio(). The second one in bdi_position_ratio() actually triggered div-by-zero oops on a machine running a 3.10 kernel. The divisor is
x_intercept - bdi_setpoint + 1 == span + 1
span is confirmed to be (u32)-1. It isn't clear how it ended up that but it could be from write bandwidth calculation underflow fixed by c72efb658f7c ("writeback: fix possible underflow in write bandwidth calculation").
At any rate, +1 isn't a proper protection against div-by-zero. This patch converts all +1 protections to |1. Note that bdi_update_dirty_ratelimit() was already using |1 before this patch.
--- mm/page-writeback.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
mm/page-writeback.c +3 -3
@@ -601,7 +601,7 @@ static long long pos_ratio_polynom(unsigned long setpoint,long x; x =div64_s64 (((s64 )setpoint - (s64 )dirty) <<RATELIMIT_CALC_SHIFT , - limit - setpoint +1 ); + (limit - setpoint) |1 ); pos_ratio = x; pos_ratio = pos_ratio * x >>RATELIMIT_CALC_SHIFT ; pos_ratio = pos_ratio * x >>RATELIMIT_CALC_SHIFT ;
@@ -828,7 +828,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,* scale global setpoint to bdi's: * bdi_setpoint = setpoint * bdi_thresh / thresh */ - x =div_u64 ((u64 )bdi_thresh <<16 , thresh +1 ); + x =div_u64 ((u64 )bdi_thresh <<16 , thresh |1 ); bdi_setpoint = setpoint * (u64 )x >>16 ;/* * Use span=(8*write_bw) in single bdi case as indicated by
@@ -843,7 +843,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,if (bdi_dirty < x_intercept - span /4 ) { pos_ratio =div64_u64 (pos_ratio * (x_intercept - bdi_dirty), - x_intercept - bdi_setpoint +1 ); + (x_intercept - bdi_setpoint) |1 ); }else pos_ratio /=4 ;
Signature · 1 line
2.3.7
PATCH 48/142 tools lib traceevent kbuffer: Remove extra update to data pointer in PADDING
In reply to Jiri SlabyFrom: "Steven Rostedt (Red Hat)" <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit c5e691928bf166ac03430e957038b60adba3cf6c upstream.
When a event PADDING is hit (a deleted event that is still in the ring buffer), translate_data() sets the length of the padding and also updates the data pointer which is passed back to the caller.
This is unneeded because the caller also updates the data pointer with the passed back length. translate_data() should not update the pointer, only set the length.
--- tools/lib/traceevent/kbuffer-parse.c | 1 - 1 file changed, 1 deletion(-)
tools/lib/traceevent/kbuffer-parse.c +0 -1
@@ -372,7 +372,6 @@ translate_data(struct kbuffer *kbuf, void *data, void **rptr,switch (type_len) {case KBUFFER_TYPE_PADDING : *length =read_4 (kbuf, data); - data += *length;break ;case KBUFFER_TYPE_TIME_EXTEND :
Signature · 1 line
2.3.7
PATCH 68/142 IB/mlx4: Fix WQE LSO segment calculation
In reply to Jiri SlabyFrom: Erez Shitrit <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit ca9b590caa17bcbbea119594992666e96cde9c2f upstream.
The current code decreases from the mss size (which is the gso_size from the kernel skb) the size of the packet headers.
It shouldn't do that because the mss that comes from the stack (e.g IPoIB) includes only the tcp payload without the headers.
The result is indication to the HW that each packet that the HW sends is smaller than what it could be, and too many packets will be sent for big messages.
An easy way to demonstrate one more aspect of the problem is by configuring the ipoib mtu to be less than 2*hlen (2*56) and then run app sending big TCP messages. This will tell the HW to send packets with giant (negative value which under unsigned arithmetics becomes a huge positive one) length and the QP moves to SQE state.
--- drivers/infiniband/hw/mlx4/qp.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/infiniband/hw/mlx4/qp.c +1 -2
@@ -2174,8 +2174,7 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr,memcpy (wqe->header, wr->wr.ud.header, wr->wr.ud.hlen); - *lso_hdr_sz =cpu_to_be32 ((wr->wr.ud.mss - wr->wr.ud.hlen) <<16 | - wr->wr.ud.hlen); + *lso_hdr_sz =cpu_to_be32 (wr->wr.ud.mss <<16 | wr->wr.ud.hlen); *lso_seg_len = halign;return 0 ; }
Signature · 1 line
2.3.7
PATCH 96/142 3w-xxxx: fix command completion race
In reply to Jiri SlabyFrom: Christoph Hellwig <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9cd9554615cba14f0877cc9972a6537ad2bdde61 upstream.
The 3w-xxxx driver needs to tear down the dma mappings before returning the command to the midlayer, as there is no guarantee the sglist and count are valid after that point. Also remove the dma mapping helpers which have another inherent race due to the request_id index.
--- drivers/scsi/3w-xxxx.c | 42 ++++++------------------------------------ drivers/scsi/3w-xxxx.h | 5 ----- 2 files changed, 6 insertions(+), 41 deletions(-)
drivers/scsi/3w-xxxx.c +6 -36
@@ -1284,32 +1284,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev)return 0 ; }/* End tw_initialize_device_extension() */ -static int tw_map_scsi_sg_data (struct pci_dev *pdev,struct scsi_cmnd *cmd) -{ -int use_sg; - -dprintk (KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n" ); - - use_sg =scsi_dma_map (cmd); -if (use_sg <0 ) { -printk (KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n" ); -return 0 ; - } - - cmd->SCp.phase =TW_PHASE_SGLIST ; - cmd->SCp.have_data_in = use_sg; - -return use_sg; -}/* End tw_map_scsi_sg_data() */ - -static void tw_unmap_scsi_data (struct pci_dev *pdev,struct scsi_cmnd *cmd) -{ -dprintk (KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n" ); - -if (cmd->SCp.phase ==TW_PHASE_SGLIST ) -scsi_dma_unmap (cmd); -}/* End tw_unmap_scsi_data() */ -/* This function will reset a device extension */ static int tw_reset_device_extension (TW_Device_Extension *tw_dev) {
@@ -1332,8 +1306,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev) srb = tw_dev->srb[i];if (srb !=NULL ) { srb->result = (DID_RESET <<16 ); - tw_dev->srb[i]->scsi_done (tw_dev->srb[i]); -tw_unmap_scsi_data (tw_dev->tw_pci_dev, tw_dev->srb[i]); +scsi_dma_unmap (srb); + srb->scsi_done (srb); } } }
@@ -1780,8 +1754,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id) command_packet->byte8.io.lba = lba; command_packet->byte6.block_count = num_sectors; - use_sg =tw_map_scsi_sg_data (tw_dev->tw_pci_dev, tw_dev->srb[request_id]); -if (!use_sg) + use_sg =scsi_dma_map (srb); +if (use_sg <=0 )return 1 ;scsi_for_each_sg (tw_dev->srb[request_id], sg, use_sg, i) {
@@ -1968,9 +1942,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c/* Save the scsi command for use by the ISR */ tw_dev->srb[request_id] = SCpnt; -/* Initialize phase to zero */ - SCpnt->SCp.phase =TW_PHASE_INITIAL ; -switch (*command) {case READ_10 :case READ_6 :
@@ -2198,12 +2169,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance)/* Now complete the io */ if ((error !=TW_ISR_DONT_COMPLETE )) { +scsi_dma_unmap (tw_dev->srb[request_id]); + tw_dev->srb[request_id]->scsi_done (tw_dev->srb[request_id]); tw_dev->state[request_id] =TW_S_COMPLETED ;tw_state_request_finish (tw_dev, request_id); tw_dev->posted_request_count--; - tw_dev->srb[request_id]->scsi_done (tw_dev->srb[request_id]); - -tw_unmap_scsi_data (tw_dev->tw_pci_dev, tw_dev->srb[request_id]); } }
drivers/scsi/3w-xxxx.h +0 -5
@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] =#define TW_AEN_SMART_FAIL 0x000F#define TW_AEN_SBUF_FAIL 0x0024 -/* Phase defines */ -#define TW_PHASE_INITIAL 0 -#define TW_PHASE_SINGLE 1 -#define TW_PHASE_SGLIST 2 -/* Misc defines */ #define TW_ALIGNMENT_6000 64/* 64 bytes */ #define TW_ALIGNMENT_7000 4/* 4 bytes */
Signature · 1 line
2.3.7
PATCH 46/142 ext4: make fsync to sync parent dir in no-journal for real this time
In reply to Jiri SlabyFrom: Lukas Czerner <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e12fb97222fc41e8442896934f76d39ef99b590a upstream.
Previously commit 14ece1028b3ed53ffec1b1213ffc6acaf79ad77c added a support for for syncing parent directory of newly created inodes to make sure that the inode is not lost after a power failure in no-journal mode.
However this does not work in majority of cases, namely:
- if the directory has inline data
- if the directory is already indexed
- if the directory already has at least one block and:
- the new entry fits into it
- or we've successfully converted it to indexed
So in those cases we might lose the inode entirely even after fsync in the no-journal mode. This also includes ext2 default mode obviously.
I've noticed this while running xfstest generic/321 and even though the test should fail (we need to run fsck after a crash in no-journal mode) I could not find a newly created entries even when if it was fsynced before.
Fix this by adjusting the ext4_add_entry() successful exit paths to set the inode EXT4_STATE_NEWENTRY so that fsync has the chance to fsync the parent directory as well.
--- fs/ext4/namei.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
fs/ext4/namei.c +11 -9
@@ -1870,7 +1870,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, struct inode *inode) {struct inode *dir = dentry->d_parent->d_inode; -struct buffer_head *bh; +struct buffer_head *bh =NULL ;struct ext4_dir_entry_2 *de;struct ext4_dir_entry_tail *t;struct super_block *sb;
@@ -1894,14 +1894,14 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,return retval;if (retval ==1 ) { retval =0 ; -return retval; + goto out; } }if (is_dx (dir)) { retval =ext4_dx_add_entry (handle, dentry, inode);if (!retval || (retval !=ERR_BAD_DX_DIR )) -return retval; + goto out;ext4_clear_inode_flag (dir,EXT4_INODE_INDEX ); dx_fallback++;ext4_mark_inode_dirty (handle, dir);
@@ -1913,14 +1913,15 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,return PTR_ERR (bh); retval =add_dirent_to_buf (handle, dentry, inode,NULL , bh); -if (retval != -ENOSPC ) { -brelse (bh); -return retval; - } +if (retval != -ENOSPC ) + goto out;if (blocks ==1 && !dx_fallback && -EXT4_HAS_COMPAT_FEATURE (sb,EXT4_FEATURE_COMPAT_DIR_INDEX )) -return make_indexed_dir (handle, dentry, inode, bh); +EXT4_HAS_COMPAT_FEATURE (sb,EXT4_FEATURE_COMPAT_DIR_INDEX )) { + retval =make_indexed_dir (handle, dentry, inode, bh); + bh =NULL ;/* make_indexed_dir releases bh */ + goto out; + }brelse (bh); } bh =ext4_append (handle, dir, &block);
@@ -1936,6 +1937,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry, } retval =add_dirent_to_buf (handle, dentry, inode, de, bh); +out:brelse (bh);if (retval ==0 )ext4_set_inode_state (inode,EXT4_STATE_NEWENTRY );
Signature · 1 line
2.3.7
PATCH 97/142 3w-9xxx: fix command completion race
In reply to Jiri SlabyFrom: Christoph Hellwig <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 118c855b5623f3e2e6204f02623d88c09e0c34de upstream.
The 3w-9xxx driver needs to tear down the dma mappings before returning the command to the midlayer, as there is no guarantee the sglist and count are valid after that point. Also remove the dma mapping helpers which have another inherent race due to the request_id index.
--- drivers/scsi/3w-9xxx.c | 57 ++++++++++++-------------------------------------- drivers/scsi/3w-9xxx.h | 5 ----- 2 files changed, 13 insertions(+), 49 deletions(-)
drivers/scsi/3w-9xxx.c +13 -44
@@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset);static int twa_scsiop_execute_scsi (TW_Device_Extension *tw_dev,int request_id,char *cdb,int use_sg,TW_SG_Entry *sglistarg);static void twa_scsiop_execute_scsi_complete (TW_Device_Extension *tw_dev,int request_id);static char *twa_string_lookup (twa_message_type *table,unsigned int aen_code); -static void twa_unmap_scsi_data (TW_Device_Extension *tw_dev,int request_id);/* Functions */
@@ -1352,11 +1351,11 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance) }/* Now complete the io */ +scsi_dma_unmap (cmd); + cmd->scsi_done (cmd); tw_dev->state[request_id] =TW_S_COMPLETED ;twa_free_request_id (tw_dev, request_id); tw_dev->posted_request_count--; - tw_dev->srb[request_id]->scsi_done (tw_dev->srb[request_id]); -twa_unmap_scsi_data (tw_dev, request_id); }/* Check for valid status after each drain */
@@ -1414,26 +1413,6 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm } }/* End twa_load_sgl() */ -/* This function will perform a pci-dma mapping for a scatter gather list */ -static int twa_map_scsi_sg_data (TW_Device_Extension *tw_dev,int request_id) -{ -int use_sg; -struct scsi_cmnd *cmd = tw_dev->srb[request_id]; - - use_sg =scsi_dma_map (cmd); -if (!use_sg) -return 0 ; -else if (use_sg <0 ) { -TW_PRINTK (tw_dev->host,TW_DRIVER ,0x1c ,"Failed to map scatter gather list" ); -return 0 ; - } - - cmd->SCp.phase =TW_PHASE_SGLIST ; - cmd->SCp.have_data_in = use_sg; - -return use_sg; -}/* End twa_map_scsi_sg_data() */ -/* This function will poll for a response interrupt of a request */ static int twa_poll_response (TW_Device_Extension *tw_dev,int request_id,int seconds) {
@@ -1612,9 +1591,11 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev) (tw_dev->state[i] != TW_S_INITIAL) && (tw_dev->state[i] != TW_S_COMPLETED)) {if (tw_dev->srb[i]) { - tw_dev->srb[i]->result = (DID_RESET <<16 ); - tw_dev->srb[i]->scsi_done (tw_dev->srb[i]); -twa_unmap_scsi_data (tw_dev, i); +struct scsi_cmnd *cmd = tw_dev->srb[i]; + + cmd->result = (DID_RESET <<16 ); +scsi_dma_unmap (cmd); + cmd->scsi_done (cmd); } } }
@@ -1793,21 +1774,18 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_/* Save the scsi command for use by the ISR */ tw_dev->srb[request_id] = SCpnt; -/* Initialize phase to zero */ - SCpnt->SCp.phase =TW_PHASE_INITIAL ; - retval =twa_scsiop_execute_scsi (tw_dev, request_id,NULL ,0 ,NULL );switch (retval) {case SCSI_MLQUEUE_HOST_BUSY : +scsi_dma_unmap (SCpnt);twa_free_request_id (tw_dev, request_id); -twa_unmap_scsi_data (tw_dev, request_id);break ;case 1 : - tw_dev->state[request_id] =TW_S_COMPLETED ; -twa_free_request_id (tw_dev, request_id); -twa_unmap_scsi_data (tw_dev, request_id); SCpnt->result = (DID_ERROR <<16 ); +scsi_dma_unmap (SCpnt);done (SCpnt); + tw_dev->state[request_id] =TW_S_COMPLETED ; +twa_free_request_id (tw_dev, request_id); retval =0 ; } out:
@@ -1875,8 +1853,8 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, command_packet->sg_list[0 ].address =TW_CPU_TO_SGL (tw_dev->generic_buffer_phys[request_id]); command_packet->sg_list[0 ].length =cpu_to_le32 (TW_MIN_SGL_LENGTH ); }else { - sg_count =twa_map_scsi_sg_data (tw_dev, request_id); -if (sg_count ==0 ) + sg_count =scsi_dma_map (srb); +if (sg_count <0 ) goto out;scsi_for_each_sg (srb, sg, sg_count, i) {
@@ -1991,15 +1969,6 @@ static char *twa_string_lookup(twa_message_type *table, unsigned int code)return (table[index].text); }/* End twa_string_lookup() */ -/* This function will perform a pci-dma unmap */ -static void twa_unmap_scsi_data (TW_Device_Extension *tw_dev,int request_id) -{ -struct scsi_cmnd *cmd = tw_dev->srb[request_id]; - -if (cmd->SCp.phase ==TW_PHASE_SGLIST ) -scsi_dma_unmap (cmd); -}/* End twa_unmap_scsi_data() */ -/* This function gets called when a disk is coming on-line */ static int twa_slave_configure (struct scsi_device *sdev) {
drivers/scsi/3w-9xxx.h +0 -5
@@ -324,11 +324,6 @@ static twa_message_type twa_error_table[] = {#define TW_CURRENT_DRIVER_BUILD 0#define TW_CURRENT_DRIVER_BRANCH 0 -/* Phase defines */ -#define TW_PHASE_INITIAL 0 -#define TW_PHASE_SINGLE 1 -#define TW_PHASE_SGLIST 2 -/* Misc defines */ #define TW_9550SX_DRAIN_COMPLETED 0xFFFF#define TW_SECTOR_SIZE 512
Signature · 1 line
2.3.7
PATCH 135/142 mmc: card: Don't access RPMB partitions for normal read/write
In reply to Jiri SlabyFrom: Chuanxiao Dong <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 4e93b9a6abc0d028daf3c8a00cb77b679d8a4df4 upstream.
During kernel boot, it will try to read some logical sectors of each block device node for the possible partition table.
But since RPMB partition is special and can not be accessed
by normal eMMC read / write CMDs, it will cause below error
messages during kernel boot:
...
mmc0: Got data interrupt 0x00000002 even though no data operation was in progress.
mmcblk0rpmb: error -110 transferring data, sector 0, nr 32, cmd response 0x900, card status 0xb00
mmcblk0rpmb: retrying using single block read
mmcblk0rpmb: timed out sending r/w cmd command, card status 0x400900
mmcblk0rpmb: timed out sending r/w cmd command, card status 0x400900
mmcblk0rpmb: timed out sending r/w cmd command, card status 0x400900
mmcblk0rpmb: timed out sending r/w cmd command, card status 0x400900
mmcblk0rpmb: timed out sending r/w cmd command, card status 0x400900
mmcblk0rpmb: timed out sending r/w cmd command, card status 0x400900
end_request: I/O error, dev mmcblk0rpmb, sector 0
Buffer I/O error on device mmcblk0rpmb, logical block 0
end_request: I/O error, dev mmcblk0rpmb, sector 8
Buffer I/O error on device mmcblk0rpmb, logical block 1
end_request: I/O error, dev mmcblk0rpmb, sector 16
Buffer I/O error on device mmcblk0rpmb, logical block 2
end_request: I/O error, dev mmcblk0rpmb, sector 24
Buffer I/O error on device mmcblk0rpmb, logical block 3
...
This patch will discard the access request in eMMC queue if it is RPMB partition access request. By this way, it avoids trigger above error messages.
--- drivers/mmc/card/block.c | 12 ++++++++++++ drivers/mmc/card/queue.c | 2 +- drivers/mmc/card/queue.h | 2 ++ 3 files changed, 15 insertions(+), 1 deletion(-)
drivers/mmc/card/block.c +12 -0
@@ -951,6 +951,18 @@ static inline void mmc_blk_reset_success(struct mmc_blk_data *md, int type) md->reset_done &= ~type; } +int mmc_access_rpmb (struct mmc_queue *mq) +{ +struct mmc_blk_data *md = mq->data; +/* +* If this is a RPMB partition access, return ture +*/ +if (md && md->part_type ==EXT_CSD_PART_CONFIG_ACC_RPMB ) +return true; + +return false; +} +static int mmc_blk_issue_discard_rq (struct mmc_queue *mq,struct request *req) {struct mmc_blk_data *md = mq->data;
drivers/mmc/card/queue.c +1 -1
@@ -37,7 +37,7 @@ static int mmc_prep_request(struct request_queue *q, struct request *req)return BLKPREP_KILL ; } -if (mq &&mmc_card_removed (mq->card)) +if (mq && (mmc_card_removed (mq->card) ||mmc_access_rpmb (mq)))return BLKPREP_KILL ; req->cmd_flags |=REQ_DONTPREP ;
drivers/mmc/card/queue.h +2 -0
@@ -73,4 +73,6 @@ extern void mmc_queue_bounce_post(struct mmc_queue_req *);extern int mmc_packed_init (struct mmc_queue *,struct mmc_card *);extern void mmc_packed_clean (struct mmc_queue *); +extern int mmc_access_rpmb (struct mmc_queue *); +#endif
Signature · 1 line
2.3.7
PATCH 137/142 mmc: sh_mmcif: Fix timeout value for command request
In reply to Jiri SlabyFrom: Takeshi Kihara <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit bad4371d87d1d1ed1aecd9c9cc21c41ac3f289c8 upstream.
f9fd54f22e ("mmc: sh_mmcif: Use msecs_to_jiffies() for host->timeout") changed the timeout value from 1000 jiffies to 1s. In the case where HZ is 1000 the values are the same. However, for smaller HZ values the timeout is now smaller, 1s instead of 10s in the case of HZ=100.
Since the timeout occurs in spite of a normal data transfer a timeout of 10s seems more appropriate. This restores the previous timeout in the case where HZ=100 and results in an increase over the previous timeout for larger values of HZ.
--- drivers/mmc/host/sh_mmcif.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/sh_mmcif.c +1 -1
@@ -1399,7 +1399,7 @@ static int sh_mmcif_probe(struct platform_device *pdev) host =mmc_priv (mmc); host->mmc = mmc; host->addr = reg; - host->timeout =msecs_to_jiffies (1000 ); + host->timeout =msecs_to_jiffies (10000 ); host->ccs_enable = !pd || !pd->ccs_unsupported; host->clk_ctrl2_enable = pd && pd->clk_ctrl2_present;
Signature · 1 line
2.3.7
PATCH 14/142 nosave: consolidate __nosave_{begin,end} in <asm/sections.h>
In reply to Jiri SlabyFrom: Geert Uytterhoeven <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 7f8998c7aef3ac9c5f3f2943e083dfa6302e90d0 upstream.
The different architectures used their own (and different) declarations:
extern __visible const void __nosave_begin, __nosave_end;
extern const void __nosave_begin, __nosave_end;
extern long __nosave_begin, __nosave_end;Consolidate them using the first variant in <asm/sections.h>.
--- arch/mips/include/asm/suspend.h | 7 ------- arch/mips/power/cpu.c | 2 +- arch/powerpc/kernel/suspend.c | 4 +--- arch/s390/kernel/suspend.c | 6 +----- arch/sh/include/asm/sections.h | 1 - arch/sparc/power/hibernate.c | 4 +--- arch/unicore32/include/mach/pm.h | 3 --- arch/unicore32/kernel/hibernate.c | 1 + arch/x86/power/hibernate_32.c | 4 +--- arch/x86/power/hibernate_64.c | 4 +--- include/asm-generic/sections.h | 4 ++++ 11 files changed, 11 insertions(+), 29 deletions(-) delete mode 100644 arch/mips/include/asm/suspend.h
arch/mips/include/asm/suspend.h deleted +0 -7
@@ -1,7 +0,0 @@ -#ifndef __ASM_SUSPEND_H -#define __ASM_SUSPEND_H - -/* References to section boundaries */ -extern const void __nosave_begin, __nosave_end; - -#endif /* __ASM_SUSPEND_H */
arch/mips/power/cpu.c +1 -1
@@ -7,7 +7,7 @@* Author: Hu Hongbing <[email protected]> * Wu Zhangjin <[email protected]> */ -#include <asm/suspend.h> +#include <asm/sections.h> #include <asm/fpu.h> #include <asm/dsp.h>
arch/powerpc/kernel/suspend.c +1 -3
@@ -9,9 +9,7 @@#include <linux/mm.h> #include <asm/page.h> - -/* References to section boundaries */ -extern const void __nosave_begin, __nosave_end; +#include <asm/sections.h> /* * pfn_is_nosave - check if given pfn is in the 'nosave' section
arch/s390/kernel/suspend.c +1 -5
@@ -13,14 +13,10 @@#include <asm/ipl.h> #include <asm/cio.h> #include <asm/pci.h> +#include <asm/sections.h> #include "entry.h" /* -* References to section boundaries -*/ -extern const void __nosave_begin, __nosave_end; - -/* * The restore of the saved pages in an hibernation image will set * the change and referenced bits in the storage key for each page. * Overindication of the referenced bits after an hibernation cycle
arch/sh/include/asm/sections.h +0 -1
@@ -3,7 +3,6 @@#include <asm-generic/sections.h> -extern long __nosave_begin, __nosave_end;extern long __machvec_start, __machvec_end;extern char __uncached_start, __uncached_end;extern char __start_eh_frame[], __stop_eh_frame[];
arch/sparc/power/hibernate.c +1 -3
@@ -9,11 +9,9 @@#include <asm/hibernate.h> #include <asm/visasm.h> #include <asm/page.h> +#include <asm/sections.h> #include <asm/tlb.h> -/* References to section boundaries */ -extern const void __nosave_begin, __nosave_end; -struct saved_context saved_context;/*
arch/unicore32/include/mach/pm.h +0 -3
@@ -36,8 +36,5 @@ extern int puv3_pm_enter(suspend_state_t state);/* Defined in hibernate_asm.S */ extern int restore_image (pgd_t *resume_pg_dir,struct pbe *restore_pblist); -/* References to section boundaries */ -extern const void __nosave_begin, __nosave_end; -extern struct pbe *restore_pblist;#endif
arch/unicore32/kernel/hibernate.c +1 -0
@@ -18,6 +18,7 @@#include <asm/page.h> #include <asm/pgtable.h> #include <asm/pgalloc.h> +#include <asm/sections.h> #include <asm/suspend.h> #include "mach/pm.h"
arch/x86/power/hibernate_32.c +1 -3
@@ -13,13 +13,11 @@#include <asm/page.h> #include <asm/pgtable.h> #include <asm/mmzone.h> +#include <asm/sections.h> /* Defined in hibernate_asm_32.S */ extern int restore_image (void ); -/* References to section boundaries */ -extern const void __nosave_begin, __nosave_end; -/* Pointer to the temporary resume page tables */ pgd_t *resume_pg_dir;
arch/x86/power/hibernate_64.c +1 -3
@@ -17,11 +17,9 @@#include <asm/page.h> #include <asm/pgtable.h> #include <asm/mtrr.h> +#include <asm/sections.h> #include <asm/suspend.h> -/* References to section boundaries */ -extern __visible const void __nosave_begin, __nosave_end; -/* Defined in hibernate_asm_64.S */ extern asmlinkage int restore_image(void);
include/asm-generic/sections.h +4 -0
@@ -3,6 +3,8 @@/* References to section boundaries */ +#include <linux/compiler.h> +/* * Usage guidelines: * _text, _data: architecture specific, don't use them in arch-independent code
@@ -37,6 +39,8 @@ extern char __start_rodata[], __end_rodata[];/* Start and end of .ctors section - used for constructor calls. */ extern char __ctors_start[], __ctors_end[]; +extern __visible const void __nosave_begin, __nosave_end; +/* function descriptor handling (if any). Override * in asm/sections.h */ #ifndef dereference_function_descriptor
Signature · 1 line
2.3.7
PATCH 65/142 stk1160: Make sure current buffer is released
In reply to Jiri SlabyFrom: Ezequiel Garcia <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit aeff09276748b66072f2db2e668cec955cf41959 upstream.
The available (i.e. not used) buffers are returned by stk1160_clear_queue(), on the stop_streaming() path. However, this is insufficient and the current buffer must be released as well. Fix it.
--- drivers/media/usb/stk1160/stk1160-v4l.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/media/usb/stk1160/stk1160-v4l.c +15 -2
@@ -244,6 +244,11 @@ static int stk1160_stop_streaming(struct stk1160 *dev)if (mutex_lock_interruptible (&dev->v4l_lock))return -ERESTARTSYS ; +/* +* Once URBs are cancelled, the URB complete handler +* won't be running. This is required to safely release the +* current buffer (dev->isoc_ctl.buf). +*/ stk1160_cancel_isoc (dev);/*
@@ -624,8 +629,16 @@ void stk1160_clear_queue(struct stk1160 *dev)stk1160_info ("buffer [%p/%d] aborted\n" , buf, buf->vb.v4l2_buf.index); } -/* It's important to clear current buffer */ - dev->isoc_ctl.buf =NULL ; + +/* It's important to release the current buffer */ +if (dev->isoc_ctl.buf) { + buf = dev->isoc_ctl.buf; + dev->isoc_ctl.buf =NULL ; + +vb2_buffer_done (&buf->vb,VB2_BUF_STATE_ERROR ); +stk1160_info ("buffer [%p/%d] aborted\n" , + buf, buf->vb.v4l2_buf.index); + }spin_unlock_irqrestore (&dev->buf_lock, flags); }
Signature · 1 line
2.3.7
PATCH 92/142 ASoC: dapm: Enable autodisable on SOC_DAPM_SINGLE_TLV_AUTODISABLE
In reply to Jiri SlabyFrom: Charles Keepax <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a2d97723cb3a7741af81868427b36bba274b681b upstream.
Correct small copy and paste error where autodisable was not being enabled for the SOC_DAPM_SINGLE_TLV_AUTODISABLE control.
--- include/sound/soc-dapm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/sound/soc-dapm.h +1 -1
@@ -300,7 +300,7 @@ struct device; .access = SNDRV_CTL_ELEM_ACCESS_TLV_READ | SNDRV_CTL_ELEM_ACCESS_READWRITE,\ .tlv.p = (tlv_array), \ .get = snd_soc_dapm_get_volsw, .put = snd_soc_dapm_put_volsw, \ - .private_value = SOC_SINGLE_VALUE(reg, shift, max, invert, 0) } + .private_value = SOC_SINGLE_VALUE(reg, shift, max, invert, 1) }#define SOC_DAPM_ENUM (xname, xenum) \ { .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, \ .info = snd_soc_info_enum_double, \
Signature · 1 line
2.3.7
PATCH 98/142 3w-sas: fix command completion race
In reply to Jiri SlabyFrom: Christoph Hellwig <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 579d69bc1fd56d5af5761969aa529d1d1c188300 upstream.
The 3w-sas driver needs to tear down the dma mappings before returning the command to the midlayer, as there is no guarantee the sglist and count are valid after that point. Also remove the dma mapping helpers which have another inherent race due to the request_id index.
--- drivers/scsi/3w-sas.c | 50 ++++++++++---------------------------------------- drivers/scsi/3w-sas.h | 4 ---- 2 files changed, 10 insertions(+), 44 deletions(-)
drivers/scsi/3w-sas.c +10 -40
@@ -303,26 +303,6 @@ static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id)return 0 ; }/* End twl_post_command_packet() */ -/* This function will perform a pci-dma mapping for a scatter gather list */ -static int twl_map_scsi_sg_data (TW_Device_Extension *tw_dev,int request_id) -{ -int use_sg; -struct scsi_cmnd *cmd = tw_dev->srb[request_id]; - - use_sg =scsi_dma_map (cmd); -if (!use_sg) -return 0 ; -else if (use_sg <0 ) { -TW_PRINTK (tw_dev->host,TW_DRIVER ,0x1 ,"Failed to map scatter gather list" ); -return 0 ; - } - - cmd->SCp.phase =TW_PHASE_SGLIST ; - cmd->SCp.have_data_in = use_sg; - -return use_sg; -}/* End twl_map_scsi_sg_data() */ -/* This function hands scsi cdb's to the firmware */ static int twl_scsiop_execute_scsi (TW_Device_Extension *tw_dev,int request_id,char *cdb,int use_sg,TW_SG_Entry_ISO *sglistarg) {
@@ -370,8 +350,8 @@ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,if (!sglistarg) {/* Map sglist from scsi layer to cmd packet */ if (scsi_sg_count (srb)) { - sg_count =twl_map_scsi_sg_data (tw_dev, request_id); -if (sg_count ==0 ) + sg_count =scsi_dma_map (srb); +if (sg_count <=0 ) goto out;scsi_for_each_sg (srb, sg, sg_count, i) {
@@ -1116,15 +1096,6 @@ out:return retval; }/* End twl_initialize_device_extension() */ -/* This function will perform a pci-dma unmap */ -static void twl_unmap_scsi_data (TW_Device_Extension *tw_dev,int request_id) -{ -struct scsi_cmnd *cmd = tw_dev->srb[request_id]; - -if (cmd->SCp.phase ==TW_PHASE_SGLIST ) -scsi_dma_unmap (cmd); -}/* End twl_unmap_scsi_data() */ -/* This function will handle attention interrupts */ static int twl_handle_attention_interrupt (TW_Device_Extension *tw_dev) {
@@ -1265,11 +1236,11 @@ static irqreturn_t twl_interrupt(int irq, void *dev_instance) }/* Now complete the io */ +scsi_dma_unmap (cmd); + cmd->scsi_done (cmd); tw_dev->state[request_id] =TW_S_COMPLETED ;twl_free_request_id (tw_dev, request_id); tw_dev->posted_request_count--; - tw_dev->srb[request_id]->scsi_done (tw_dev->srb[request_id]); -twl_unmap_scsi_data (tw_dev, request_id); }/* Check for another response interrupt */
@@ -1414,10 +1385,12 @@ static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_resif ((tw_dev->state[i] !=TW_S_FINISHED ) && (tw_dev->state[i] !=TW_S_INITIAL ) && (tw_dev->state[i] !=TW_S_COMPLETED )) { -if (tw_dev->srb[i]) { - tw_dev->srb[i]->result = (DID_RESET <<16 ); - tw_dev->srb[i]->scsi_done (tw_dev->srb[i]); -twl_unmap_scsi_data (tw_dev, i); +struct scsi_cmnd *cmd = tw_dev->srb[i]; + +if (cmd) { + cmd->result = (DID_RESET <<16 ); +scsi_dma_unmap (cmd); + cmd->scsi_done (cmd); } } }
@@ -1521,9 +1494,6 @@ static int twl_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_/* Save the scsi command for use by the ISR */ tw_dev->srb[request_id] = SCpnt; -/* Initialize phase to zero */ - SCpnt->SCp.phase =TW_PHASE_INITIAL ; - retval =twl_scsiop_execute_scsi (tw_dev, request_id,NULL ,0 ,NULL );if (retval) { tw_dev->state[request_id] =TW_S_COMPLETED ;
drivers/scsi/3w-sas.h +0 -4
@@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] =#define TW_CURRENT_DRIVER_BUILD 0#define TW_CURRENT_DRIVER_BRANCH 0 -/* Phase defines */ -#define TW_PHASE_INITIAL 0 -#define TW_PHASE_SGLIST 2 -/* Misc defines */ #define TW_SECTOR_SIZE 512#define TW_MAX_UNITS 32
Signature · 1 line
2.3.7
PATCH 99/142 drm/radeon: add SI DPM quirk for Sapphire R9 270 Dual-X 2G GDDR5
In reply to Jiri SlabyFrom: Alex Deucher <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit cd17e02ff4db58ec32d35cf331c705d295779930 upstream.
Seems to have problems with high mclks.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=76490
--- drivers/gpu/drm/radeon/si_dpm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/radeon/si_dpm.c +1 -0
@@ -2914,6 +2914,7 @@ struct si_dpm_quirk {static struct si_dpm_quirk si_dpm_quirk_list[] = {/* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */ {PCI_VENDOR_ID_ATI ,0x6810 ,0x1462 ,0x3036 ,0 ,120000 }, + {PCI_VENDOR_ID_ATI ,0x6811 ,0x174b ,0xe271 ,0 ,120000 }, {0 ,0 ,0 ,0 }, };
Signature · 1 line
2.3.7
PATCH 105/142 ARC: signal handling robustify
In reply to Jiri SlabyFrom: Vineet Gupta <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit e4140819dadc3624accac8294881bca8a3cba4ed upstream.
A malicious signal handler / restorer can DOS the system by fudging the user regs saved on stack, causing weird things such as sigreturn returning to user mode PC but cpu state still being kernel mode....
Ensure that in sigreturn path status32 always has U bit; any other bogosity (gargbage PC etc) will be taken care of by normal user mode exceptions mechanisms.
Reproducer signal handler:
void handle_sig(int signo, siginfo_t *info, void *context)
{
ucontext_t *uc = context;
struct user_regs_struct *regs = &(uc->uc_mcontext.regs);
regs->scratch.status32 = 0;
}Before the fix, kernel would go off to weeds like below:
--------->8-----------
[ARCLinux]$ ./signal-test
Path: /signal-test
CPU: 0 PID: 61 Comm: signal-test Not tainted 4.0.0-rc5+ #65
task: 8f177880 ti: 5ffe6000 task.ti: 8f15c000
[ECR ]: 0x00220200 => Invalid Write @ 0x00000010 by insn @ 0x00010698
[EFA ]: 0x00000010
[BLINK ]: 0x2007c1ee
[ERET ]: 0x10698
[STAT32]: 0x00000000 : <--------
BTA: 0x00010680 SP: 0x5ffe7e48 FP: 0x00000000
LPS: 0x20003c6c LPE: 0x20003c70 LPC: 0x00000000
...
--------->8-------------- arch/arc/kernel/signal.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
arch/arc/kernel/signal.c +16 -4
@@ -131,6 +131,15 @@ SYSCALL_DEFINE0(rt_sigreturn)/* Don't restart from sigreturn */ syscall_wont_restart (regs); +/* +* Ensure that sigreturn always returns to user mode (in case the +* regs saved on user stack got fudged between save and sigreturn) +* Otherwise it is easy to panic the kernel with a custom +* signal handler and/or restorer which clobberes the status32/ret +* to return to a bogus location in kernel mode. +*/ + regs->status32 |=STATUS_U_MASK ; +return regs->r0; badframe:
@@ -234,8 +243,11 @@ setup_rt_frame(int signo, struct k_sigaction *ka, siginfo_t *info,/* * handler returns using sigreturn stub provided already by userpsace +* If not, nuke the process right away */ -BUG_ON (!(ka->sa.sa_flags &SA_RESTORER )); +if (!(ka->sa.sa_flags &SA_RESTORER )) +return 1 ; + regs->blink = (unsigned long )ka->sa.sa_restorer;/* User Stack for signal handler will be above the frame just carved */
@@ -302,12 +314,12 @@ handle_signal(unsigned long sig, struct k_sigaction *ka, siginfo_t *info, struct pt_regs *regs) {sigset_t *oldset =sigmask_to_save (); -int ret; +int failed;/* Set up the stack frame */ - ret =setup_rt_frame (sig, ka, info, oldset, regs); + failed =setup_rt_frame (sig, ka, info, oldset, regs); -if (ret) +if (failed)force_sigsegv (sig, current);else signal_delivered (sig, info, ka, regs,0 );
Signature · 1 line
2.3.7
PATCH 106/142 /proc/stat: convert to single_open_size()
In reply to Jiri SlabyFrom: Heiko Carstens <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f74373a5cc7a0155d232c4e999648c7a95435bb2 upstream.
These two patches are supposed to "fix" failed order-4 memory allocations which have been observed when reading /proc/stat. The problem has been observed on s390 as well as on x86.
To address the problem change the seq_file memory allocations to fallback to use vmalloc, so that allocations also work if memory is fragmented.
This approach seems to be simpler and less intrusive than changing /proc/stat to use an interator. Also it "fixes" other users as well, which use seq_file's single_open() interface.
This patch (of 2):
Use seq_file's single_open_size() to preallocate a buffer that is large enough to hold the whole output, instead of open coding it. Also calculate the requested size using the number of online cpus instead of possible cpus, since the size of the output only depends on the number of online cpus.
--- fs/proc/stat.c | 22 ++-------------------- 1 file changed, 2 insertions(+), 20 deletions(-)
fs/proc/stat.c +2 -20
@@ -184,29 +184,11 @@ static int show_stat(struct seq_file *p, void *v)static int stat_open (struct inode *inode,struct file *file) { -size_t size =1024 +128 *num_possible_cpus (); -char *buf; -struct seq_file *m; -int res; +size_t size =1024 +128 *num_online_cpus ();/* minimum size to display an interrupt count : 2 bytes */ size +=2 * nr_irqs; - -/* don't ask for more than the kmalloc() max size */ -if (size >KMALLOC_MAX_SIZE ) - size =KMALLOC_MAX_SIZE ; - buf =kmalloc (size,GFP_KERNEL ); -if (!buf) -return -ENOMEM ; - - res =single_open (file, show_stat,NULL ); -if (!res) { - m = file->private_data; - m->buf = buf; - m->size =ksize (buf); - }else -kfree (buf); -return res; +return single_open_size (file, show_stat,NULL , size); }static const struct file_operations proc_stat_operations = {
Signature · 1 line
2.3.7
PATCH 118/142 mm/memory-failure: call shake_page() when error hits thp tail page
In reply to Jiri SlabyFrom: Naoya Horiguchi <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 09789e5de18e4e442870b2d700831f5cb802eb05 upstream.
Currently memory_failure() calls shake_page() to sweep pages out from pcplists only when the victim page is 4kB LRU page or thp head page. But we should do this for a thp tail page too.
Consider that a memory error hits a thp tail page whose head page is on a pcplist when memory_failure() runs. Then, the current kernel skips shake_pages() part, so hwpoison_user_mappings() returns without calling split_huge_page() nor try_to_unmap() because PageLRU of the thp head is still cleared due to the skip of shake_page().
As a result, me_huge_page() runs for the thp, which is broken behavior.
One effect is a leak of the thp. And another is to fail to isolate the memory error, so later access to the error address causes another MCE, which kills the processes which used the thp.
This patch fixes this problem by calling shake_page() for thp tail case.
--- mm/memory-failure.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
mm/memory-failure.c +4 -4
@@ -1149,10 +1149,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags)* The check (unnecessarily) ignores LRU pages being isolated and * walked by the page reclaim code, however that's not a big loss. */ -if (!PageHuge (p) && !PageTransTail (p)) { -if (!PageLRU (p)) -shake_page (p,0 ); -if (!PageLRU (p)) { +if (!PageHuge (p)) { +if (!PageLRU (hpage)) +shake_page (hpage,0 ); +if (!PageLRU (hpage)) {/* * shake_page could have turned it free. */
Signature · 1 line
2.3.7
PATCH 71/142 drm/i915: cope with large i2c transfers
In reply to Jiri SlabyFrom: Dmitry Torokhov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 9535c4757b881e06fae72a857485ad57c422b8d2 upstream.
The hardware, according to the specs, is limited to 256 byte transfers, and current driver has no protections in case users attempt to do larger transfers. The code will just stomp over status register and mayhem ensues.
Let's split larger transfers into digestable chunks. Doing this allows Atmel MXT driver on Pixel 1 function properly (it hasn't since commit 9d8dc3e529a19e427fd379118acd132520935c5d "Input: atmel_mxt_ts - implement T44 message handling" which tries to consume multiple touchscreen/touchpad reports in a single transaction).
--- drivers/gpu/drm/i915/i915_reg.h | 1 + drivers/gpu/drm/i915/intel_i2c.c | 66 ++++++++++++++++++++++++++++++++++------ 2 files changed, 57 insertions(+), 10 deletions(-)
drivers/gpu/drm/i915/i915_reg.h +1 -0
@@ -1105,6 +1105,7 @@#define GMBUS_CYCLE_INDEX (2<<25)#define GMBUS_CYCLE_STOP (4<<25)#define GMBUS_BYTE_COUNT_SHIFT 16 +#define GMBUS_BYTE_COUNT_MAX 256U#define GMBUS_SLAVE_INDEX_SHIFT 8#define GMBUS_SLAVE_ADDR_SHIFT 1#define GMBUS_SLAVE_READ (1<<0)
drivers/gpu/drm/i915/intel_i2c.c +56 -10
99 lines not on this page · raw message
Signature · 1 line
2.3.7
PATCH 75/142 lib: memzero_explicit: use barrier instead of OPTIMIZER_HIDE_VAR
In reply to Jiri SlabyFrom: mancha security <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 0b053c9518292705736329a8fe20ef4686ffc8e9 upstream.
OPTIMIZER_HIDE_VAR(), as defined when using gcc, is insufficient to ensure protection from dead store optimization.
For the random driver and crypto drivers, calls are emitted ...
$ gdb vmlinux
(gdb) disassemble memzero_explicit
Dump of assembler code for function memzero_explicit:
0xffffffff813a18b0 <+0>: push %rbp
0xffffffff813a18b1 <+1>: mov %rsi,%rdx
0xffffffff813a18b4 <+4>: xor %esi,%esi
0xffffffff813a18b6 <+6>: mov %rsp,%rbp
0xffffffff813a18b9 <+9>: callq 0xffffffff813a7120 <memset>
0xffffffff813a18be <+14>: pop %rbp
0xffffffff813a18bf <+15>: retq
End of assembler dump. (gdb) disassemble extract_entropy
[...]
0xffffffff814a5009 <+313>: mov %r12,%rdi
0xffffffff814a500c <+316>: mov $0xa,%esi
0xffffffff814a5011 <+321>: callq 0xffffffff813a18b0 <memzero_explicit>
0xffffffff814a5016 <+326>: mov -0x48(%rbp),%rax[...]
... but in case in future we might use facilities such as LTO, then OPTIMIZER_HIDE_VAR() is not sufficient to protect gcc from a possible eviction of the memset(). We have to use a compiler barrier instead.
Minimal test example when we assume memzero_explicit() would *not* be a call, but would have been *inlined* instead:
static inline void memzero_explicit(void *s, size_t count)
{
memset(s, 0, count);
<foo>
}
int main(void)
{
char buff[20]; snprintf(buff, sizeof(buff) - 1, "test");
printf("%s", buff);
memzero_explicit(buff, sizeof(buff));
return 0;}
With <foo> := OPTIMIZER_HIDE_VAR():
(gdb) disassemble main
Dump of assembler code for function main:
[...]
0x0000000000400464 <+36>: callq 0x400410 <printf@plt> 0x0000000000400469 <+41>: xor %eax,%eax 0x000000000040046b <+43>: add $0x28,%rsp
0x000000000040046f <+47>: retq
End of assembler dump.
With <foo> := barrier():
(gdb) disassemble main
Dump of assembler code for function main:
[...]
0x0000000000400464 <+36>: callq 0x400410 <printf@plt> 0x0000000000400469 <+41>: movq $0x0,(%rsp) 0x0000000000400471 <+49>: movq $0x0,0x8(%rsp) 0x000000000040047a <+58>: movl $0x0,0x10(%rsp) 0x0000000000400482 <+66>: xor %eax,%eax 0x0000000000400484 <+68>: add $0x28,%rsp
0x0000000000400488 <+72>: retq
End of assembler dump.
As can be seen, movq, movq, movl are being emitted inlined via memset().
Reference: http://thread.gmane.org/gmane.linux.kernel.cryptoapi/13764/
--- lib/string.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/string.c +1 -1
@@ -598,7 +598,7 @@ EXPORT_SYMBOL(memset);void memzero_explicit (void *s,size_t count) {memset (s,0 , count); -OPTIMIZER_HIDE_VAR (s); +barrier (); }EXPORT_SYMBOL (memzero_explicit);
Signature · 1 line
2.3.7
PATCH 108/142 fs/seq_file: fallback to vmalloc allocation
In reply to Jiri SlabyFrom: Heiko Carstens <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 058504edd02667eef8fac9be27ab3ea74332e9b4 upstream.
There are a couple of seq_files which use the single_open() interface. This interface requires that the whole output must fit into a single buffer.
E.g. for /proc/stat allocation failures have been observed because an order-4 memory allocation failed due to memory fragmentation. In such situations reading /proc/stat is not possible anymore.
Therefore change the seq_file code to fallback to vmalloc allocations which will usually result in a couple of order-0 allocations and hence also work if memory is fragmented.
For reference a call trace where reading from /proc/stat failed:
sadc: page allocation failure: order:4, mode:0x1040d0
CPU: 1 PID: 192063 Comm: sadc Not tainted 3.10.0-123.el7.s390x #1
[...]
Call Trace:
show_stack+0x6c/0xe8
warn_alloc_failed+0xd6/0x138
__alloc_pages_nodemask+0x9da/0xb68
__get_free_pages+0x2e/0x58
kmalloc_order_trace+0x44/0xc0
stat_open+0x5a/0xd8
proc_reg_open+0x8a/0x140
do_dentry_open+0x1bc/0x2c8
finish_open+0x46/0x60
do_last+0x382/0x10d0
path_openat+0xc8/0x4f8
do_filp_open+0x46/0xa8
do_sys_open+0x114/0x1f0
sysc_tracego+0x14/0x1a--- fs/seq_file.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-)
fs/seq_file.c +21 -9
@@ -8,8 +8,10 @@#include <linux/fs.h> #include <linux/export.h> #include <linux/seq_file.h> +#include <linux/vmalloc.h> #include <linux/slab.h> #include <linux/cred.h> +#include <linux/mm.h> #include <asm/uaccess.h> #include <asm/page.h>
@@ -30,6 +32,16 @@ static void seq_set_overflow(struct seq_file *m) m->count = m->size; } +static void *seq_buf_alloc (unsigned long size) +{ +void *buf; + + buf =kmalloc (size,GFP_KERNEL | __GFP_NOWARN); +if (!buf && size >PAGE_SIZE ) + buf =vmalloc (size); +return buf; +} +/** * seq_open - initialize sequential file * @file: file we initialize
@@ -96,7 +108,7 @@ static int traverse(struct seq_file *m, loff_t offset)return 0 ; }if (!m->buf) { - m->buf =kmalloc (m->size =PAGE_SIZE ,GFP_KERNEL ); + m->buf =seq_buf_alloc (m->size =PAGE_SIZE );if (!m->buf)return -ENOMEM ; }
@@ -135,9 +147,9 @@ static int traverse(struct seq_file *m, loff_t offset) Eoverflow: m->op->stop (m, p); -kfree (m->buf); +kvfree (m->buf); m->count =0 ; - m->buf =kmalloc (m->size <<=1 ,GFP_KERNEL ); + m->buf =seq_buf_alloc (m->size <<=1 );return !m->buf ? -ENOMEM : -EAGAIN ; }
@@ -192,7 +204,7 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)/* grab buffer if we didn't have one */ if (!m->buf) { - m->buf =kmalloc (m->size =PAGE_SIZE ,GFP_KERNEL ); + m->buf =seq_buf_alloc (m->size =PAGE_SIZE );if (!m->buf) goto Enomem; }
@@ -232,9 +244,9 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)if (m->count < m->size) goto Fill; m->op->stop (m, p); -kfree (m->buf); +kvfree (m->buf); m->count =0 ; - m->buf =kmalloc (m->size <<=1 ,GFP_KERNEL ); + m->buf =seq_buf_alloc (m->size <<=1 );if (!m->buf) goto Enomem; m->version =0 ;
@@ -350,7 +362,7 @@ EXPORT_SYMBOL(seq_lseek);int seq_release (struct inode *inode,struct file *file) {struct seq_file *m = file->private_data; -kfree (m->buf); +kvfree (m->buf);kfree (m);return 0 ; }
@@ -605,13 +617,13 @@ EXPORT_SYMBOL(single_open);int single_open_size (struct file *file,int (*show)(struct seq_file *,void *),void *data,size_t size) { -char *buf =kmalloc (size,GFP_KERNEL ); +char *buf =seq_buf_alloc (size);int ret;if (!buf)return -ENOMEM ; ret =single_open (file, show, data);if (ret) { -kfree (buf); +kvfree (buf);return ret; } ((struct seq_file *)file->private_data)->buf = buf;
Signature · 1 line
2.3.7
PATCH 139/142 ACPICA: Tables: Change acpi_find_root_pointer() to use acpi_physical_address.
In reply to Jiri SlabyFrom: Lv Zheng <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f254e3c57b9d952e987502aefa0804c177dd2503 upstream.
ACPICA commit 7d9fd64397d7c38899d3dc497525f6e6b044e0e3
OSPMs like Linux expect an acpi_physical_address returning value fromacpi_find_root_pointer(). This triggers warnings if sizeof (acpi_size) doesn't
equal to sizeof (acpi_physical_address):
drivers/acpi/osl.c:275:3: warning: passing argument 1 of 'acpi_find_root_pointer' from incompatible pointer type [enabled by default] In file included from include/acpi/acpi.h:64:0,
from include/linux/acpi.h:36,
from drivers/acpi/osl.c:41: include/acpi/acpixf.h:433:1: note: expected 'acpi_size *' but argument is of type 'acpi_physical_address *'
This patch corrects acpi_find_root_pointer().
--- drivers/acpi/acpica/tbxfroot.c | 7 ++++--- include/acpi/acpixf.h | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-)
drivers/acpi/acpica/tbxfroot.c +4 -3
@@ -112,7 +112,7 @@ acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp *rsdp)* ******************************************************************************/ -acpi_status acpi_find_root_pointer (acpi_size *table_address) +acpi_status acpi_find_root_pointer (acpi_physical_address * table_address) {u8 *table_ptr;u8 *mem_rover;
@@ -170,7 +170,8 @@ acpi_status acpi_find_root_pointer(acpi_size *table_address) physical_address += (u32 )ACPI_PTR_DIFF (mem_rover, table_ptr); - *table_address = physical_address; + *table_address = + (acpi_physical_address ) physical_address;return_ACPI_STATUS (AE_OK ); } }
@@ -203,7 +204,7 @@ acpi_status acpi_find_root_pointer(acpi_size *table_address) (ACPI_HI_RSDP_WINDOW_BASE +ACPI_PTR_DIFF (mem_rover, table_ptr)); - *table_address = physical_address; + *table_address = (acpi_physical_address ) physical_address;return_ACPI_STATUS (AE_OK ); }
include/acpi/acpixf.h +1 -1
@@ -181,7 +181,7 @@ acpi_status acpi_load_tables(void);*/ acpi_status acpi_reallocate_root_table (void ); -acpi_status acpi_find_root_pointer (acpi_size *rsdp_address); +acpi_status acpi_find_root_pointer (acpi_physical_address * rsdp_address);acpi_status acpi_unload_table_id (acpi_owner_id id);
Signature · 1 line
2.3.7
PATCH 142/142 ACPICA: Utilities: Cleanup to remove useless ACPI_PRINTF/FORMAT_xxx helpers.
In reply to Jiri SlabyFrom: Lv Zheng <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 1d0a0b2f6df2bf2643fadc990eb143361eca6ada upstream.
ACPICA commit b60612373a4ef63b64a57c124576d7ddb6d8efb6
For physical addresses, since the address may exceed 32-bit address range after calculation, we should use 0x%8.8X%8.8X instead of ACPI_PRINTF_UINT and ACPI_FORMAT_UINT64() instead of ACPI_FORMAT_NATIVE_UINT()/ACPI_FORMAT_TO_UINT().
This patch also removes above replaced macros as there are no users.
This is a preparation to switch acpi_physical_address to 64-bit on 32-bit kernel builds.
--- drivers/acpi/acpica/acmacros.h | 10 +++------- drivers/acpi/acpica/dsopcode.c | 4 ++-- drivers/acpi/acpica/evregion.c | 2 +- drivers/acpi/acpica/exdump.c | 4 ++-- drivers/acpi/acpica/exregion.c | 8 +++----- drivers/acpi/acpica/nsdump.c | 5 +++-- drivers/acpi/acpica/tbprint.c | 17 +++++++---------- 7 files changed, 21 insertions(+), 29 deletions(-)
drivers/acpi/acpica/acmacros.h +3 -7
@@ -63,19 +63,15 @@#define ACPI_SET64 (ptr, val) (*ACPI_CAST64 (ptr) = (u64) (val))/* -* printf() format helpers +* printf() format helper. This macros is a workaround for the difficulties +* with emitting 64-bit integers and 64-bit pointers with the same code +* for both 32-bit and 64-bit hosts. */ /* Split 64-bit integer into two 32-bit values. Use with %8.8X%8.8X */ #define ACPI_FORMAT_UINT64 (i) ACPI_HIDWORD(i), ACPI_LODWORD(i) -#if ACPI_MACHINE_WIDTH ==64 -#define ACPI_FORMAT_NATIVE_UINT (i) ACPI_FORMAT_UINT64(i) -#else -#define ACPI_FORMAT_NATIVE_UINT (i) 0, (i) -#endif -/* * Macros for moving data around to/from buffers that are possibly unaligned. * If the hardware supports the transfer of unaligned data, just do the store.
drivers/acpi/acpica/dsopcode.c +2 -2
@@ -446,7 +446,7 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state,ACPI_DEBUG_PRINT ((ACPI_DB_EXEC ,"RgnObj %p Addr %8.8X%8.8X Len %X\n" , obj_desc, -ACPI_FORMAT_NATIVE_UINT (obj_desc->region.address), +ACPI_FORMAT_UINT64 (obj_desc->region.address), obj_desc->region.length));/* Now the address and length are valid for this opregion */
@@ -544,7 +544,7 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state,ACPI_DEBUG_PRINT ((ACPI_DB_EXEC ,"RgnObj %p Addr %8.8X%8.8X Len %X\n" , obj_desc, -ACPI_FORMAT_NATIVE_UINT (obj_desc->region.address), +ACPI_FORMAT_UINT64 (obj_desc->region.address), obj_desc->region.length));/* Now the address and length are valid for this opregion */
drivers/acpi/acpica/evregion.c +1 -1
@@ -277,7 +277,7 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj,ACPI_DEBUG_PRINT ((ACPI_DB_OPREGION ,"Handler %p (@%p) Address %8.8X%8.8X [%s]\n" , ®ion_obj->region.handler->address_space, handler, -ACPI_FORMAT_NATIVE_UINT (address), +ACPI_FORMAT_UINT64 (address),acpi_ut_get_region_name (region_obj->region. space_id)));
drivers/acpi/acpica/exdump.c +2 -2
@@ -622,8 +622,8 @@ void acpi_ex_dump_operand(union acpi_operand_object *obj_desc, u32 depth)acpi_os_printf ("\n" ); }else {acpi_os_printf (" base %8.8X%8.8X Length %X\n" , -ACPI_FORMAT_NATIVE_UINT (obj_desc->region. - address), +ACPI_FORMAT_UINT64 (obj_desc->region. + address), obj_desc->region.length); }break ;
drivers/acpi/acpica/exregion.c +3 -5
@@ -181,7 +181,7 @@ acpi_ex_system_memory_space_handler(u32 function,if (!mem_info->mapped_logical_address) {ACPI_ERROR ((AE_INFO ,"Could not map memory at 0x%8.8X%8.8X, size %u" , -ACPI_FORMAT_NATIVE_UINT (address), +ACPI_FORMAT_UINT64 (address), (u32 ) map_length)); mem_info->mapped_length =0 ;return_ACPI_STATUS (AE_NO_MEMORY );
@@ -202,8 +202,7 @@ acpi_ex_system_memory_space_handler(u32 function,ACPI_DEBUG_PRINT ((ACPI_DB_INFO ,"System-Memory (width %u) R/W %u Address=%8.8X%8.8X\n" , - bit_width, function, -ACPI_FORMAT_NATIVE_UINT (address))); + bit_width, function,ACPI_FORMAT_UINT64 (address)));/* * Perform the memory read or write
@@ -318,8 +317,7 @@ acpi_ex_system_io_space_handler(u32 function,ACPI_DEBUG_PRINT ((ACPI_DB_INFO ,"System-IO (width %u) R/W %u Address=%8.8X%8.8X\n" , - bit_width, function, -ACPI_FORMAT_NATIVE_UINT (address))); + bit_width, function,ACPI_FORMAT_UINT64 (address)));/* Decode the function parameter */
drivers/acpi/acpica/nsdump.c +3 -2
@@ -335,8 +335,9 @@ acpi_ns_dump_one_object(acpi_handle obj_handle, space_id));if (obj_desc->region.flags &AOPOBJ_DATA_VALID ) {acpi_os_printf (" Addr %8.8X%8.8X Len %.4X\n" , -ACPI_FORMAT_NATIVE_UINT - (obj_desc->region.address), +ACPI_FORMAT_UINT64 (obj_desc-> + region. + address), obj_desc->region.length); }else { acpi_os_printf
drivers/acpi/acpica/tbprint.c +7 -10
@@ -127,16 +127,12 @@ acpi_tb_print_table_header(acpi_physical_address address, {struct acpi_table_header local_header; -/* -* The reason that the Address is cast to a void pointer is so that we -* can use %p which will work properly on both 32-bit and 64-bit hosts. -*/ if (ACPI_COMPARE_NAME (header->signature,ACPI_SIG_FACS )) {/* FACS only has signature and length fields */ -ACPI_INFO ((AE_INFO ,"%4.4s %p %05X" , - header->signature,ACPI_CAST_PTR (void, address), +ACPI_INFO ((AE_INFO ,"%-4.4s 0x%8.8X%8.8X %05X" , + header->signature,ACPI_FORMAT_UINT64 (address), header->length)); }else if (ACPI_COMPARE_NAME (header->signature,ACPI_SIG_RSDP )) {
@@ -147,8 +143,8 @@ acpi_tb_print_table_header(acpi_physical_address address, header)->oem_id, ACPI_OEM_ID_SIZE);acpi_tb_fix_string (local_header.oem_id,ACPI_OEM_ID_SIZE ); - ACPI_INFO((AE_INFO, "RSDP %p %05X (v%.2d %6.6s)", - ACPI_CAST_PTR(void, address), + ACPI_INFO((AE_INFO, "RSDP 0x%8.8X%8.8X %05X (v%.2d %-6.6s)", + ACPI_FORMAT_UINT64(address), (ACPI_CAST_PTR(struct acpi_table_rsdp, header)-> revision > 0) ? ACPI_CAST_PTR(struct acpi_table_rsdp,
@@ -162,8 +158,9 @@ acpi_tb_print_table_header(acpi_physical_address address,acpi_tb_cleanup_table_header (&local_header, header); ACPI_INFO((AE_INFO, - "%4.4s %p %05X (v%.2d %6.6s %8.8s %08X %4.4s %08X)", - local_header.signature, ACPI_CAST_PTR(void, address), + "%-4.4s 0x%8.8X%8.8X" + " %05X (v%.2d %-6.6s %-8.8s %08X %-4.4s %08X)", + local_header.signature, ACPI_FORMAT_UINT64(address), local_header.length, local_header.revision, local_header.oem_id, local_header.oem_table_id, local_header.oem_revision,
Signature · 1 line
2.3.7
PATCH 10/142 sched/idle/x86: Restore mwait_idle() to fix boot hangs, to improve power savings and to improve performance
In reply to Jiri SlabyFrom: Len Brown <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b253149b843f89cd300cbdbea27ce1f847506f99 upstream.
In Linux-3.9 we removed the mwait_idle() loop:
69fb3676df33 ("x86 idle: remove mwait_idle() and "idle=mwait" cmdline param")
The reasoning was that modern machines should be sufficiently happy during the boot process using the default_idle() HALT loop, until cpuidle loads and either acpi_idle or intel_idle invoke the newer MWAIT-with-hints idle loop.
But two machines reported problems:
1. Certain Core2-era machines support MWAIT-C1 and HALT only. MWAIT-C1 is preferred for optimal power and performance. But if they support just C1, cpuidle never loads and so they use the boot-time default idle loop forever.
2. Some laptops will boot-hang if HALT is used, but will boot successfully if MWAIT is used. This appears to be a hidden assumption in BIOS SMI, that is presumably valid on the proprietary OS where the BIOS was validated.
https://bugzilla.kernel.org/show_bug.cgi?id=60770
So here we effectively revert the patch above, restoring the mwait_idle() loop. However, we don't bother restoring the idle=mwait cmdline parameter, since it appears to add no value.
Maintainer notes:
For 3.9, simply revert 69fb3676df
for 3.10, patch -F3 applies, fuzz needed due to __cpuinit use in context For 3.11, 3.12, 3.13, this patch applies cleanly
--- arch/x86/kernel/process.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+)
arch/x86/kernel/process.c +49 -0
@@ -398,6 +398,52 @@ static void amd_e400_idle(void)default_idle (); } +/* +* Intel Core2 and older machines prefer MWAIT over HALT for C1. +* We can't rely on cpuidle installing MWAIT, because it will not load +* on systems that support only C1 -- so the boot default must be MWAIT. +* +* Some AMD machines are the opposite, they depend on using HALT. +* +* So for default C1, which is used during boot until cpuidle loads, +* use MWAIT-C1 on Intel HW that has it, else use HALT. +*/ +static int prefer_mwait_c1_over_halt (const struct cpuinfo_x86 *c) +{ +if (c->x86_vendor !=X86_VENDOR_INTEL ) +return 0 ; + +if (!cpu_has (c,X86_FEATURE_MWAIT )) +return 0 ; + +return 1 ; +} + +/* +* MONITOR/MWAIT with no hints, used for default default C1 state. +* This invokes MWAIT with interrutps enabled and no flags, +* which is backwards compatible with the original MWAIT implementation. +*/ + +static void mwait_idle (void ) +{ +if (!current_set_polling_and_test ()) { +if (static_cpu_has (X86_FEATURE_CLFLUSH_MONITOR )) { +mb (); +clflush ((void *)¤t_thread_info ()->flags); +mb (); + } + +__monitor ((void *)¤t_thread_info ()->flags,0 ,0 ); +if (!need_resched ()) +__sti_mwait (0 ,0 ); +else +local_irq_enable (); + }else +local_irq_enable (); +__current_clr_polling (); +} +void select_idle_routine (const struct cpuinfo_x86 *c) {#ifdef CONFIG_SMP
@@ -411,6 +457,9 @@ void select_idle_routine(const struct cpuinfo_x86 *c)/* E400: APIC timer interrupt does not wake up CPU from C1e */ pr_info ("using AMD E400 aware idle routine\n" ); x86_idle = amd_e400_idle; + }else if (prefer_mwait_c1_over_halt (c)) { +pr_info ("using mwait in idle threads\n" ); + x86_idle = mwait_idle; }else x86_idle = default_idle; }
Signature · 1 line
2.3.7
PATCH 11/142 mm/hugetlb: use pmd_page() in follow_huge_pmd()
In reply to Jiri SlabyFrom: Gerald Schaefer <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 97534127012f0e396eddea4691f4c9b170aed74b upstream.
Commit 61f77eda9bbf ("mm/hugetlb: reduce arch dependent code around follow_huge_*") broke follow_huge_pmd() on s390, where pmd and pte layout differ and using pte_page() on a huge pmd will return wrong results. Using pmd_page() instead fixes this.
All architectures that were touched by that commit have pmd_page() defined, so this should not break anything on other architectures.
--- mm/hugetlb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
mm/hugetlb.c +1 -2
@@ -3494,8 +3494,7 @@ retry:if (!pmd_huge (*pmd)) goto out;if (pmd_present (*pmd)) { - page =pte_page (*(pte_t *)pmd) + - ((address & ~PMD_MASK ) >>PAGE_SHIFT ); + page =pmd_page (*pmd) + ((address & ~PMD_MASK ) >>PAGE_SHIFT );if (flags &FOLL_GET )get_page (page); }else {
Signature · 1 line
2.3.7
PATCH 67/142 IB/core: don't disallow registering region starting at 0x0
In reply to Jiri SlabyFrom: Yann Droneaud <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 66578b0b2f69659f00b6169e6fe7377c4b100d18 upstream.
In a call to ib_umem_get(), if address is 0x0 and size is already page aligned, check added in commit 8494057ab5e4 ("IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic") will refuse to register a memory region that could otherwise be valid (provided vm.mmap_min_addr sysctl and mmap_low_allowed SELinux knobs allow userspace to map something at address 0x0).
This patch allows back such registration: ib_umem_get() should probably don't care of the base address provided it can be pinned with get_user_pages().
There's two possible overflows, in (addr + size) and in PAGE_ALIGN(addr + size), this patch keep ensuring none of them happen while allowing to pin memory at address 0x0. Anyway, the case of size equal 0 is no more (partially) handled as 0-length memory region are disallowed by an earlier check.
--- drivers/infiniband/core/umem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/core/umem.c +2 -2
@@ -101,8 +101,8 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,* If the combination of the addr and size requested for this memory * region causes an integer overflow, return error. */ -if ((PAGE_ALIGN (addr + size) <= size) || - (PAGE_ALIGN (addr + size) <= addr)) +if (((addr + size) < addr) || +PAGE_ALIGN (addr + size) < (addr + size))return ERR_PTR (-EINVAL );if (!can_do_mlock ())
Signature · 1 line
2.3.7
PATCH 132/142 drm/radeon: make UVD handle checking more strict
In reply to Jiri SlabyFrom: Christian König <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit a1b403da70e038ca6c6c6fe434d1d873546873a3 upstream.
Invalid messages can crash the hw otherwise.
--- drivers/gpu/drm/radeon/radeon_uvd.c | 72 ++++++++++++++++++++++--------------- 1 file changed, 43 insertions(+), 29 deletions(-)
drivers/gpu/drm/radeon/radeon_uvd.c +43 -29
@@ -387,50 +387,64 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,return -EINVAL ; } -if (msg_type ==1 ) { +switch (msg_type) { +case 0 : +/* it's a create msg, calc image size (width * height) */ + img_size = msg[7 ] * msg[8 ]; +radeon_bo_kunmap (bo); + +/* try to alloc a new handle */ +for (i =0 ; i <RADEON_MAX_UVD_HANDLES ; ++i) { +if (atomic_read (&p->rdev->uvd.handles[i]) == handle) { +DRM_ERROR ("Handle 0x%x already in use!\n" , handle); +return -EINVAL ; + } + +if (!atomic_cmpxchg (&p->rdev->uvd.handles[i],0 , handle)) { + p->rdev->uvd.filp[i] = p->filp; + p->rdev->uvd.img_size[i] = img_size; +return 0 ; + } + } + +DRM_ERROR ("No more free UVD handles!\n" ); +return -EINVAL ; + +case 1 :/* it's a decode msg, calc buffer sizes */ r =radeon_uvd_cs_msg_decode (msg, buf_sizes); -/* calc image size (width * height) */ - img_size = msg[6 ] * msg[7 ];radeon_bo_kunmap (bo);if (r)return r; - }else if (msg_type ==2 ) { +/* validate the handle */ +for (i =0 ; i <RADEON_MAX_UVD_HANDLES ; ++i) { +if (atomic_read (&p->rdev->uvd.handles[i]) == handle) { +if (p->rdev->uvd.filp[i] != p->filp) { +DRM_ERROR ("UVD handle collision detected!\n" ); +return -EINVAL ; + } +return 0 ; + } + } + +DRM_ERROR ("Invalid UVD handle 0x%x!\n" , handle); +return -ENOENT ; + +case 2 :/* it's a destroy msg, free the handle */ for (i =0 ; i <RADEON_MAX_UVD_HANDLES ; ++i)atomic_cmpxchg (&p->rdev->uvd.handles[i], handle,0 );radeon_bo_kunmap (bo);return 0 ; - }else { -/* it's a create msg, calc image size (width * height) */ - img_size = msg[7 ] * msg[8 ]; -radeon_bo_kunmap (bo); -if (msg_type !=0 ) { -DRM_ERROR ("Illegal UVD message type (%d)!\n" , msg_type); -return -EINVAL ; - } - -/* it's a create msg, no special handling needed */ - } - -/* create or decode, validate the handle */ -for (i =0 ; i <RADEON_MAX_UVD_HANDLES ; ++i) { -if (atomic_read (&p->rdev->uvd.handles[i]) == handle) -return 0 ; - } +default : -/* handle not found try to alloc a new one */ -for (i =0 ; i <RADEON_MAX_UVD_HANDLES ; ++i) { -if (!atomic_cmpxchg (&p->rdev->uvd.handles[i],0 , handle)) { - p->rdev->uvd.filp[i] = p->filp; - p->rdev->uvd.img_size[i] = img_size; -return 0 ; - } +DRM_ERROR ("Illegal UVD message type (%d)!\n" , msg_type); +return -EINVAL ; } -DRM_ERROR ("No more free UVD handles!\n" ); +BUG ();return -EINVAL ; }
Signature · 1 line
2.3.7
PATCH 15/142 KVM: s390: Zero out current VMDB of STSI before including level3 data.
In reply to Jiri SlabyFrom: Ekaterina Tumanova <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit b75f4c9afac2604feb971441116c07a24ecca1ec upstream.
s390 documentation requires words 0 and 10-15 to be reserved and stored as zeros. As we fill out all other fields, we can memset the full structure.
--- arch/s390/kvm/priv.c | 1 + 1 file changed, 1 insertion(+)
arch/s390/kvm/priv.c +1 -0
@@ -355,6 +355,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem)for (n = mem->count -1 ; n >0 ; n--)memcpy (&mem->vm[n], &mem->vm[n -1 ],sizeof (mem->vm[0 ])); +memset (&mem->vm[0 ],0 ,sizeof (mem->vm[0 ])); mem->vm[0 ].cpus_total = cpus; mem->vm[0 ].cpus_configured = cpus; mem->vm[0 ].cpus_standby =0 ;
Signature · 1 line
2.3.7
PATCH 66/142 IB/core: disallow registering 0-sized memory region
In reply to Jiri SlabyFrom: Yann Droneaud <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 8abaae62f3fdead8f4ce0ab46b4ab93dee39bab2 upstream.
If ib_umem_get() is called with a size equal to 0 and an non-page aligned address, one page will be pinned and a 0-sized umem will be returned to the caller.
This should not be allowed: it's not expected for a memory region to have a size equal to 0.
This patch adds a check to explicitly refuse to register a 0-sized region.
--- drivers/infiniband/core/umem.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/infiniband/core/umem.c +3 -0
@@ -94,6 +94,9 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,if (dmasync)dma_set_attr (DMA_ATTR_WRITE_BARRIER , &attrs); +if (!size) +return ERR_PTR (-EINVAL ); +/* * If the combination of the addr and size requested for this memory * region causes an integer overflow, return error.
Signature · 1 line
2.3.7
PATCH 28/142 usb: phy: Find the right match in devm_usb_phy_match
In reply to Jiri SlabyFrom: Axel Lin <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 869aee0f31429fa9d94d5aef539602b73ae0cf4b upstream.
The res parameter passed to devm_usb_phy_match() is the location where the pointer to the usb_phy is stored, hence it needs to be dereferenced before comparing to the match data in order to find the correct match.
--- drivers/usb/phy/phy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/phy/phy.c +3 -1
@@ -78,7 +78,9 @@ static void devm_usb_phy_release(struct device *dev, void *res)static int devm_usb_phy_match (struct device *dev,void *res,void *match_data) { -return res == match_data; +struct usb_phy **phy = res; + +return *phy == match_data; }/**
Signature · 1 line
2.3.7
PATCH 126/142 ARM: mvebu: armada-xp-openblocks-ax3-4: Disable internal RTC
In reply to Jiri SlabyFrom: Gregory CLEMENT <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 750e30d4076ae5e02ad13a376e96c95a2627742c upstream.
There is no crystal connected to the internal RTC on the Open Block AX3. So let's disable it in order to prevent the kernel probing the driver uselessly. Eventually this patches removes the following warning message from the boot log:
"rtc-mv d0010300.rtc: internal RTC not ticking"
--- arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts +4 -0
@@ -69,6 +69,10 @@ }; internal-regs { + rtc@10300 { + /* No crystal connected to the internal RTC */ + status = "disabled"; + }; serial@12000 { clock-frequency = <250000000>; status = "okay";
Signature · 1 line
2.3.7
Re: [PATCH 3.12 137/142] mmc: sh_mmcif: Fix timeout value for command request
In reply to Jiri Slaby2015-05-16 4:38 GMT-03:00 Jiri Slaby <[email protected]>:
Quoted 7 lines
commit
bad4371d87d1d1ed1aecd9c9cc21c41ac3f289c8upstream.
f9fd54f22e("mmc:sh_mmcif: Usemsecs_to_jiffies()forhost->timeout") changed the timeout value from 1000 jiffies to 1s. In the case where HZ is 1000 the values are the same. However, for smaller HZ values the timeout is now smaller, 1s instead of 10s in the case of HZ=100.
Quoted 6 lines
Since the timeout occurs in spite of a normal data transfer a timeout of 10s seems more appropriate. This restores the previous timeout in the case where HZ=100 and results in an increase over the previous timeout for larger values of HZ.
Fixes f9fd54f22e ("mmc: sh_mmcif: Use msecs_to_jiffies() for host->timeout")
What is best 1s or 10s ? is 1s. The less time is faster, but HZ=100 not 1000. 10s the longer answer.
True ?
Albino
Re: [PATCH 3.12 137/142] mmc: sh_mmcif: Fix timeout value for command request
Quoted 13 lines · Albino Biasutti Neto
2015-05-16 4:38 GMT-03:00 Jiri Slaby <[email protected]>:
Quoted 12 lines
commit
bad4371d87d1d1ed1aecd9c9cc21c41ac3f289c8upstream.
f9fd54f22e("mmc:sh_mmcif: Usemsecs_to_jiffies()forhost->timeout") changed the timeout value from 1000 jiffies to 1s. In the case where HZ is 1000 the values are the same. However, for smaller HZ values the timeout is now smaller, 1s instead of 10s in the case of HZ=100.Since the timeout occurs in spite of a normal data transfer a timeout of 10s seems more appropriate. This restores the previous timeout in the case where HZ=100 and results in an increase over the previous timeout for larger values of HZ.
Quoted 6 lines
Quoted 1 line
Fixes f9fd54f22e ("mmc: sh_mmcif: Use msecs_to_jiffies() for host->timeout")What is best 1s or 10s ? is 1s. The less time is faster, but HZ=100 not 1000. 10s the longer answer.
True ?
Sorry, what?
Signature · 2 lines
js suse labs
Quoted 8 lines · Jiri Slaby
This is the start of the stable review cycle for the 3.12.43 release. There are 142 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed May 20 09:36:47 CEST 2015. Anything received after that time might be too late.
Hi Jiri,
please consider adding me back to the Cc: list; I might otherwise miss your review cycle annoucements.
Build results:
total: 125 pass: 125 fail: 0 Qemu test results: total: 27 pass: 27 fail: 0
Details are available at http://server.roeck-us.net:8010/builders.
Thanks,
Guenter
Quoted 6 lines · Guenter Roeck
Quoted 5 lines · Jiri Slaby
This is the start of the stable review cycle for the 3.12.43 release. There are 142 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 7 lines
Quoted 3 lines
Responses should be made by Wed May 20 09:36:47 CEST 2015. Anything received after that time might be too late.
Hi Jiri,
please consider adding me back to the Cc: list; I might otherwise miss your review cycle annoucements.
Hi, you are on the list, but I am sitting behind a weird ISP ATM, so maybe the e-mail was dropped to your spam folder, if received at all.
Quoted 6 lines
Build results:
total: 125 pass: 125 fail: 0 Qemu test results: total: 27 pass: 27 fail: 0Details are available at http://server.roeck-us.net:8010/builders.
Even if you missed the announcement, I am monitoring this URL constantly :).
Thanks for the results.
Signature · 2 lines
js suse labs
Re: [PATCH 3.12 137/142] mmc: sh_mmcif: Fix timeout value for command request
In reply to Jiri SlabyQuoted 14 lines · Jiri Slaby
Quoted 13 lines · Albino Biasutti Neto
2015-05-16 4:38 GMT-03:00 Jiri Slaby <[email protected]>:
Quoted 12 lines
commit
bad4371d87d1d1ed1aecd9c9cc21c41ac3f289c8upstream.
f9fd54f22e("mmc:sh_mmcif: Usemsecs_to_jiffies()forhost->timeout") changed the timeout value from 1000 jiffies to 1s. In the case where HZ is 1000 the values are the same. However, for smaller HZ values the timeout is now smaller, 1s instead of 10s in the case of HZ=100.Since the timeout occurs in spite of a normal data transfer a timeout of 10s seems more appropriate. This restores the previous timeout in the case where HZ=100 and results in an increase over the previous timeout for larger values of HZ.
Quoted 8 lines
Quoted 6 lines
Quoted 1 line
Fixes f9fd54f22e ("mmc: sh_mmcif: Use msecs_to_jiffies() for host->timeout")What is best 1s or 10s ? is 1s. The less time is faster, but HZ=100 not 1000. 10s the longer answer.
True ?
Sorry, what?
My understanding is that there is a desire to have a timeout of 10s as 1s has turned out to be too short in practice.
Prior to f9fd54f22e the timeout was 10s for HZ=100, and it is my understanding that on SH mobile HZ=100 is the normal case.
Re: [PATCH 3.12 071/142] drm/i915: cope with large i2c transfers
In reply to Jiri SlabyQuoted 4 lines · Jiri Slaby
From: Dmitry Torokhov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
Ben Hutchings (on CC) just asked about this patch being included on the 3.16 kernel [1]. Is this patch really useful for kernels < 3.17? Should it be reverted from all the other stable kernels (3.10, 3.14 and 3.16), or do you think it's harmless?
[1] http://thread.gmane.org/gmane.linux.kernel.stable/136673
Cheers,
--
Lu�s
Quoted 150 lines
===============
commit
9535c4757b881e06fae72a857485ad57c422b8d2upstream.The hardware, according to the specs, is limited to 256 byte transfers, and current driver has no protections in case users attempt to do larger transfers. The code will just stomp over status register and mayhem ensues.
Let's split larger transfers into digestable chunks. Doing this allows Atmel MXT driver on Pixel 1 function properly (it hasn't since commit
9d8dc3e529a19e427fd379118acd132520935c5d"Input:atmel_mxt_ts- implement T44 message handling" which tries to consume multiple touchscreen/touchpad reports in a single transaction).Reviewed-by Chris Wilson <[email protected]>Signed-off-by Dmitry Torokhov <[email protected]>Signed-off-by Jani Nikula <[email protected]>Signed-off-by Jiri Slaby <[email protected]>--- drivers/gpu/drm/i915/i915_reg.h | 1 + drivers/gpu/drm/i915/intel_i2c.c | 66 ++++++++++++++++++++++++++++++++++------ 2 files changed, 57 insertions(+), 10 deletions(-)drivers/gpu/drm/i915/i915_reg.h +1
-0@@ -1105,6 +1105,7 @@#define GMBUS_CYCLE_INDEX (2<<25)#define GMBUS_CYCLE_STOP (4<<25)#define GMBUS_BYTE_COUNT_SHIFT 16 +#define GMBUS_BYTE_COUNT_MAX 256U#define GMBUS_SLAVE_INDEX_SHIFT 8#define GMBUS_SLAVE_ADDR_SHIFT 1#define GMBUS_SLAVE_READ (1<<0)drivers/gpu/drm/i915/intel_i2c.c +56
-10@@ -276,18 +276,17 @@ gmbus_wait_idle(struct drm_i915_private *dev_priv) }static int -gmbus_xfer_read (struct drm_i915_private *dev_priv,struct i2c_msg *msg, -u32 gmbus1_index) +gmbus_xfer_read_chunk (struct drm_i915_private *dev_priv, +unsigned short addr,u8 *buf,unsigned int len, +u32 gmbus1_index) {int reg_offset = dev_priv->gpio_mmio_base; -u16 len = msg->len; -u8 *buf = msg->buf;I915_WRITE (GMBUS1 + reg_offset, gmbus1_index |GMBUS_CYCLE_WAIT | (len <<GMBUS_BYTE_COUNT_SHIFT ) | - (msg->addr <<GMBUS_SLAVE_ADDR_SHIFT ) | + (addr <<GMBUS_SLAVE_ADDR_SHIFT ) |GMBUS_SLAVE_READ |GMBUS_SW_RDY );while (len) {int ret;@@ -309,11 +308,35 @@ gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg, }static int -gmbus_xfer_write (struct drm_i915_private *dev_priv,struct i2c_msg *msg) +gmbus_xfer_read (struct drm_i915_private *dev_priv,struct i2c_msg *msg, +u32 gmbus1_index) { -int reg_offset = dev_priv->gpio_mmio_base; -u16 len = msg->len;u8 *buf = msg->buf; +unsigned int rx_size = msg->len; +unsigned int len; +int ret; + +do { + len =min (rx_size,GMBUS_BYTE_COUNT_MAX ); + + ret =gmbus_xfer_read_chunk (dev_priv, msg->addr, + buf, len, gmbus1_index); +if (ret) +return ret; + + rx_size -= len; + buf += len; + }while (rx_size !=0 ); + +return 0 ; +} + +static int +gmbus_xfer_write_chunk (struct drm_i915_private *dev_priv, +unsigned short addr,u8 *buf,unsigned int len) +{ +int reg_offset = dev_priv->gpio_mmio_base; +unsigned int chunk_size = len;u32 val, loop; val = loop =0 ;@@ -325,8 +348,8 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)I915_WRITE (GMBUS3 + reg_offset, val);I915_WRITE (GMBUS1 + reg_offset,GMBUS_CYCLE_WAIT | - (msg->len <<GMBUS_BYTE_COUNT_SHIFT ) | - (msg->addr <<GMBUS_SLAVE_ADDR_SHIFT ) | + (chunk_size <<GMBUS_BYTE_COUNT_SHIFT ) | + (addr <<GMBUS_SLAVE_ADDR_SHIFT ) |GMBUS_SLAVE_WRITE |GMBUS_SW_RDY );while (len) {int ret;@@ -343,6 +366,29 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)if (ret)return ret; } + +return 0 ; +} + +static int +gmbus_xfer_write (struct drm_i915_private *dev_priv,struct i2c_msg *msg) +{ +u8 *buf = msg->buf; +unsigned int tx_size = msg->len; +unsigned int len; +int ret; + +do { + len =min (tx_size,GMBUS_BYTE_COUNT_MAX ); + + ret =gmbus_xfer_write_chunk (dev_priv, msg->addr, buf, len); +if (ret) +return ret; + + buf += len; + tx_size -= len; + }while (tx_size !=0 ); +return 0 ; }Signature · 6 lines
2.3.7 -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 3.12 071/142] drm/i915: cope with large i2c transfers
Quoted 10 lines · Luis Henriques
Quoted 4 lines · Jiri Slaby
From: Dmitry Torokhov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
Ben Hutchings (on CC) just asked about this patch being included on the 3.16 kernel [1]. Is this patch really useful for kernels < 3.17? Should it be reverted from all the other stable kernels (3.10, 3.14 and 3.16), or do you think it's harmless?
The bug fixed by Dmitry's patch has been there since the introduction of the gmbus code in v2.6.37 by
commit f899fc64cda8569d0529452aafc0da31c042df2e
Author: Chris Wilson <[email protected]> Date: Tue Jul 20 15:44:45 2010 -0700
drm/i915: use GMBUS to manage i2c links
It's just that nobody noticed before
commit 9d8dc3e529a19e427fd379118acd132520935c5d
Author: Nick Dyer <[email protected]> Date: Wed Jul 23 12:49:04 2014 -0700
Input: atmel_mxt_ts - implement T44 message handling
BR,
Jani.
Quoted 157 lines
[1] http://thread.gmane.org/gmane.linux.kernel.stable/136673
Cheers,
--
LuísQuoted 150 lines
===============
commit
9535c4757b881e06fae72a857485ad57c422b8d2upstream.The hardware, according to the specs, is limited to 256 byte transfers, and current driver has no protections in case users attempt to do larger transfers. The code will just stomp over status register and mayhem ensues.
Let's split larger transfers into digestable chunks. Doing this allows Atmel MXT driver on Pixel 1 function properly (it hasn't since commit
9d8dc3e529a19e427fd379118acd132520935c5d"Input:atmel_mxt_ts- implement T44 message handling" which tries to consume multiple touchscreen/touchpad reports in a single transaction).Reviewed-by Chris Wilson <[email protected]>Signed-off-by Dmitry Torokhov <[email protected]>Signed-off-by Jani Nikula <[email protected]>Signed-off-by Jiri Slaby <[email protected]>--- drivers/gpu/drm/i915/i915_reg.h | 1 + drivers/gpu/drm/i915/intel_i2c.c | 66 ++++++++++++++++++++++++++++++++++------ 2 files changed, 57 insertions(+), 10 deletions(-)drivers/gpu/drm/i915/i915_reg.h +1
-0@@ -1105,6 +1105,7 @@#define GMBUS_CYCLE_INDEX (2<<25)#define GMBUS_CYCLE_STOP (4<<25)#define GMBUS_BYTE_COUNT_SHIFT 16 +#define GMBUS_BYTE_COUNT_MAX 256U#define GMBUS_SLAVE_INDEX_SHIFT 8#define GMBUS_SLAVE_ADDR_SHIFT 1#define GMBUS_SLAVE_READ (1<<0)drivers/gpu/drm/i915/intel_i2c.c +56
-10@@ -276,18 +276,17 @@ gmbus_wait_idle(struct drm_i915_private *dev_priv) }static int -gmbus_xfer_read (struct drm_i915_private *dev_priv,struct i2c_msg *msg, -u32 gmbus1_index) +gmbus_xfer_read_chunk (struct drm_i915_private *dev_priv, +unsigned short addr,u8 *buf,unsigned int len, +u32 gmbus1_index) {int reg_offset = dev_priv->gpio_mmio_base; -u16 len = msg->len; -u8 *buf = msg->buf;I915_WRITE (GMBUS1 + reg_offset, gmbus1_index |GMBUS_CYCLE_WAIT | (len <<GMBUS_BYTE_COUNT_SHIFT ) | - (msg->addr <<GMBUS_SLAVE_ADDR_SHIFT ) | + (addr <<GMBUS_SLAVE_ADDR_SHIFT ) |GMBUS_SLAVE_READ |GMBUS_SW_RDY );while (len) {int ret;@@ -309,11 +308,35 @@ gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg, }static int -gmbus_xfer_write (struct drm_i915_private *dev_priv,struct i2c_msg *msg) +gmbus_xfer_read (struct drm_i915_private *dev_priv,struct i2c_msg *msg, +u32 gmbus1_index) { -int reg_offset = dev_priv->gpio_mmio_base; -u16 len = msg->len;u8 *buf = msg->buf; +unsigned int rx_size = msg->len; +unsigned int len; +int ret; + +do { + len =min (rx_size,GMBUS_BYTE_COUNT_MAX ); + + ret =gmbus_xfer_read_chunk (dev_priv, msg->addr, + buf, len, gmbus1_index); +if (ret) +return ret; + + rx_size -= len; + buf += len; + }while (rx_size !=0 ); + +return 0 ; +} + +static int +gmbus_xfer_write_chunk (struct drm_i915_private *dev_priv, +unsigned short addr,u8 *buf,unsigned int len) +{ +int reg_offset = dev_priv->gpio_mmio_base; +unsigned int chunk_size = len;u32 val, loop; val = loop =0 ;@@ -325,8 +348,8 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)I915_WRITE (GMBUS3 + reg_offset, val);I915_WRITE (GMBUS1 + reg_offset,GMBUS_CYCLE_WAIT | - (msg->len <<GMBUS_BYTE_COUNT_SHIFT ) | - (msg->addr <<GMBUS_SLAVE_ADDR_SHIFT ) | + (chunk_size <<GMBUS_BYTE_COUNT_SHIFT ) | + (addr <<GMBUS_SLAVE_ADDR_SHIFT ) |GMBUS_SLAVE_WRITE |GMBUS_SW_RDY );while (len) {int ret;@@ -343,6 +366,29 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)if (ret)return ret; } + +return 0 ; +} + +static int +gmbus_xfer_write (struct drm_i915_private *dev_priv,struct i2c_msg *msg) +{ +u8 *buf = msg->buf; +unsigned int tx_size = msg->len; +unsigned int len; +int ret; + +do { + len =min (tx_size,GMBUS_BYTE_COUNT_MAX ); + + ret =gmbus_xfer_write_chunk (dev_priv, msg->addr, buf, len); +if (ret) +return ret; + + buf += len; + tx_size -= len; + }while (tx_size !=0 ); +return 0 ; }Signature · 6 lines
2.3.7 -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
Signature · 1 line
Jani Nikula, Intel Open Source Technology Center
Re: [PATCH 3.12 071/142] drm/i915: cope with large i2c transfers
Quoted 21 lines · Jani Nikula
Quoted 10 lines · Luis Henriques
Quoted 4 lines · Jiri Slaby
From: Dmitry Torokhov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
Ben Hutchings (on CC) just asked about this patch being included on the 3.16 kernel [1]. Is this patch really useful for kernels < 3.17? Should it be reverted from all the other stable kernels (3.10, 3.14 and 3.16), or do you think it's harmless?
The bug fixed by Dmitry's patch has been there since the introduction of the gmbus code in v2.6.37 by
commit
f899fc64cda8569d0529452aafc0da31c042df2eAuthor: Chris Wilson <[email protected]> Date: Tue Jul 20 15:44:45 2010 -0700drm/i915: use GMBUS to manage i2c links
Quoted 7 lines
It's just that nobody noticed before
commit
9d8dc3e529a19e427fd379118acd132520935c5dAuthor: Nick Dyer <[email protected]> Date: Wed Jul 23 12:49:04 2014 -0700Input:
atmel_mxt_ts- implement T44 message handling
So to be clear, I think the fix is worth backporting anywhere you can easily backport. I did not check, but I think it may be possible to trigger this from userspace with the i2c interface.
Quoted 166 lines
BR,
Jani.Quoted 157 lines
[1] http://thread.gmane.org/gmane.linux.kernel.stable/136673
Cheers,
--
LuísQuoted 150 lines
===============
commit
9535c4757b881e06fae72a857485ad57c422b8d2upstream.The hardware, according to the specs, is limited to 256 byte transfers, and current driver has no protections in case users attempt to do larger transfers. The code will just stomp over status register and mayhem ensues.
Let's split larger transfers into digestable chunks. Doing this allows Atmel MXT driver on Pixel 1 function properly (it hasn't since commit
9d8dc3e529a19e427fd379118acd132520935c5d"Input:atmel_mxt_ts- implement T44 message handling" which tries to consume multiple touchscreen/touchpad reports in a single transaction).Reviewed-by Chris Wilson <[email protected]>Signed-off-by Dmitry Torokhov <[email protected]>Signed-off-by Jani Nikula <[email protected]>Signed-off-by Jiri Slaby <[email protected]>--- drivers/gpu/drm/i915/i915_reg.h | 1 + drivers/gpu/drm/i915/intel_i2c.c | 66 ++++++++++++++++++++++++++++++++++------ 2 files changed, 57 insertions(+), 10 deletions(-)drivers/gpu/drm/i915/i915_reg.h +1
-0@@ -1105,6 +1105,7 @@#define GMBUS_CYCLE_INDEX (2<<25)#define GMBUS_CYCLE_STOP (4<<25)#define GMBUS_BYTE_COUNT_SHIFT 16 +#define GMBUS_BYTE_COUNT_MAX 256U#define GMBUS_SLAVE_INDEX_SHIFT 8#define GMBUS_SLAVE_ADDR_SHIFT 1#define GMBUS_SLAVE_READ (1<<0)drivers/gpu/drm/i915/intel_i2c.c +56
-10@@ -276,18 +276,17 @@ gmbus_wait_idle(struct drm_i915_private *dev_priv) }static int -gmbus_xfer_read (struct drm_i915_private *dev_priv,struct i2c_msg *msg, -u32 gmbus1_index) +gmbus_xfer_read_chunk (struct drm_i915_private *dev_priv, +unsigned short addr,u8 *buf,unsigned int len, +u32 gmbus1_index) {int reg_offset = dev_priv->gpio_mmio_base; -u16 len = msg->len; -u8 *buf = msg->buf;I915_WRITE (GMBUS1 + reg_offset, gmbus1_index |GMBUS_CYCLE_WAIT | (len <<GMBUS_BYTE_COUNT_SHIFT ) | - (msg->addr <<GMBUS_SLAVE_ADDR_SHIFT ) | + (addr <<GMBUS_SLAVE_ADDR_SHIFT ) |GMBUS_SLAVE_READ |GMBUS_SW_RDY );while (len) {int ret;@@ -309,11 +308,35 @@ gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg, }static int -gmbus_xfer_write (struct drm_i915_private *dev_priv,struct i2c_msg *msg) +gmbus_xfer_read (struct drm_i915_private *dev_priv,struct i2c_msg *msg, +u32 gmbus1_index) { -int reg_offset = dev_priv->gpio_mmio_base; -u16 len = msg->len;u8 *buf = msg->buf; +unsigned int rx_size = msg->len; +unsigned int len; +int ret; + +do { + len =min (rx_size,GMBUS_BYTE_COUNT_MAX ); + + ret =gmbus_xfer_read_chunk (dev_priv, msg->addr, + buf, len, gmbus1_index); +if (ret) +return ret; + + rx_size -= len; + buf += len; + }while (rx_size !=0 ); + +return 0 ; +} + +static int +gmbus_xfer_write_chunk (struct drm_i915_private *dev_priv, +unsigned short addr,u8 *buf,unsigned int len) +{ +int reg_offset = dev_priv->gpio_mmio_base; +unsigned int chunk_size = len;u32 val, loop; val = loop =0 ;@@ -325,8 +348,8 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)I915_WRITE (GMBUS3 + reg_offset, val);I915_WRITE (GMBUS1 + reg_offset,GMBUS_CYCLE_WAIT | - (msg->len <<GMBUS_BYTE_COUNT_SHIFT ) | - (msg->addr <<GMBUS_SLAVE_ADDR_SHIFT ) | + (chunk_size <<GMBUS_BYTE_COUNT_SHIFT ) | + (addr <<GMBUS_SLAVE_ADDR_SHIFT ) |GMBUS_SLAVE_WRITE |GMBUS_SW_RDY );while (len) {int ret;@@ -343,6 +366,29 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)if (ret)return ret; } + +return 0 ; +} + +static int +gmbus_xfer_write (struct drm_i915_private *dev_priv,struct i2c_msg *msg) +{ +u8 *buf = msg->buf; +unsigned int tx_size = msg->len; +unsigned int len; +int ret; + +do { + len =min (tx_size,GMBUS_BYTE_COUNT_MAX ); + + ret =gmbus_xfer_write_chunk (dev_priv, msg->addr, buf, len); +if (ret) +return ret; + + buf += len; + tx_size -= len; + }while (tx_size !=0 ); +return 0 ; }Signature · 6 lines
2.3.7 -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.htmlSignature · 1 line
Jani Nikula, Intel Open Source Technology Center
Signature · 1 line
Jani Nikula, Intel Open Source Technology Center
Re: [PATCH 3.12 071/142] drm/i915: cope with large i2c transfers
Quoted 28 lines · Jani Nikula
Quoted 27 lines · Jani Nikula
Quoted 10 lines · Luis Henriques
Quoted 4 lines · Jiri Slaby
From: Dmitry Torokhov <[email protected]>
3.12-stable review patch. If anyone has any objections, please let me know.
Ben Hutchings (on CC) just asked about this patch being included on the 3.16 kernel [1]. Is this patch really useful for kernels < 3.17? Should it be reverted from all the other stable kernels (3.10, 3.14 and 3.16), or do you think it's harmless?
The bug fixed by Dmitry's patch has been there since the introduction of the gmbus code in v2.6.37 by
commit
f899fc64cda8569d0529452aafc0da31c042df2eAuthor: Chris Wilson <[email protected]> Date: Tue Jul 20 15:44:45 2010 -0700drm/i915: use GMBUS to manage i2c links
It's just that nobody noticed before
commit
9d8dc3e529a19e427fd379118acd132520935c5dAuthor: Nick Dyer <[email protected]> Date: Wed Jul 23 12:49:04 2014 -0700
Quoted 7 lines
Quoted 1 line
Input:
atmel_mxt_ts- implement T44 message handlingSo to be clear, I think the fix is worth backporting anywhere you can easily backport. I did not check, but I think it may be possible to trigger this from userspace with the i2c interface.
Great, so it's definitely worth keeping it in all these stable trees. Thanks a lot for the clarification, Jani.
Cheers,
--
Lu�s
Quoted 169 lines
Quoted 166 lines
BR,
Jani.Quoted 157 lines
[1] http://thread.gmane.org/gmane.linux.kernel.stable/136673
Cheers,
--
Lu�sQuoted 150 lines
===============
commit
9535c4757b881e06fae72a857485ad57c422b8d2upstream.The hardware, according to the specs, is limited to 256 byte transfers, and current driver has no protections in case users attempt to do larger transfers. The code will just stomp over status register and mayhem ensues.
Let's split larger transfers into digestable chunks. Doing this allows Atmel MXT driver on Pixel 1 function properly (it hasn't since commit
9d8dc3e529a19e427fd379118acd132520935c5d"Input:atmel_mxt_ts- implement T44 message handling" which tries to consume multiple touchscreen/touchpad reports in a single transaction).Reviewed-by Chris Wilson <[email protected]>Signed-off-by Dmitry Torokhov <[email protected]>Signed-off-by Jani Nikula <[email protected]>Signed-off-by Jiri Slaby <[email protected]>--- drivers/gpu/drm/i915/i915_reg.h | 1 + drivers/gpu/drm/i915/intel_i2c.c | 66 ++++++++++++++++++++++++++++++++++------ 2 files changed, 57 insertions(+), 10 deletions(-)drivers/gpu/drm/i915/i915_reg.h +1
-0@@ -1105,6 +1105,7 @@#define GMBUS_CYCLE_INDEX (2<<25)#define GMBUS_CYCLE_STOP (4<<25)#define GMBUS_BYTE_COUNT_SHIFT 16 +#define GMBUS_BYTE_COUNT_MAX 256U#define GMBUS_SLAVE_INDEX_SHIFT 8#define GMBUS_SLAVE_ADDR_SHIFT 1#define GMBUS_SLAVE_READ (1<<0)drivers/gpu/drm/i915/intel_i2c.c +56
-10@@ -276,18 +276,17 @@ gmbus_wait_idle(struct drm_i915_private *dev_priv) }static int -gmbus_xfer_read (struct drm_i915_private *dev_priv,struct i2c_msg *msg, -u32 gmbus1_index) +gmbus_xfer_read_chunk (struct drm_i915_private *dev_priv, +unsigned short addr,u8 *buf,unsigned int len, +u32 gmbus1_index) {int reg_offset = dev_priv->gpio_mmio_base; -u16 len = msg->len; -u8 *buf = msg->buf;I915_WRITE (GMBUS1 + reg_offset, gmbus1_index |GMBUS_CYCLE_WAIT | (len <<GMBUS_BYTE_COUNT_SHIFT ) | - (msg->addr <<GMBUS_SLAVE_ADDR_SHIFT ) | + (addr <<GMBUS_SLAVE_ADDR_SHIFT ) |GMBUS_SLAVE_READ |GMBUS_SW_RDY );while (len) {int ret;@@ -309,11 +308,35 @@ gmbus_xfer_read(struct drm_i915_private *dev_priv, struct i2c_msg *msg, }static int -gmbus_xfer_write (struct drm_i915_private *dev_priv,struct i2c_msg *msg) +gmbus_xfer_read (struct drm_i915_private *dev_priv,struct i2c_msg *msg, +u32 gmbus1_index) { -int reg_offset = dev_priv->gpio_mmio_base; -u16 len = msg->len;u8 *buf = msg->buf; +unsigned int rx_size = msg->len; +unsigned int len; +int ret; + +do { + len =min (rx_size,GMBUS_BYTE_COUNT_MAX ); + + ret =gmbus_xfer_read_chunk (dev_priv, msg->addr, + buf, len, gmbus1_index); +if (ret) +return ret; + + rx_size -= len; + buf += len; + }while (rx_size !=0 ); + +return 0 ; +} + +static int +gmbus_xfer_write_chunk (struct drm_i915_private *dev_priv, +unsigned short addr,u8 *buf,unsigned int len) +{ +int reg_offset = dev_priv->gpio_mmio_base; +unsigned int chunk_size = len;u32 val, loop; val = loop =0 ;@@ -325,8 +348,8 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)I915_WRITE (GMBUS3 + reg_offset, val);I915_WRITE (GMBUS1 + reg_offset,GMBUS_CYCLE_WAIT | - (msg->len <<GMBUS_BYTE_COUNT_SHIFT ) | - (msg->addr <<GMBUS_SLAVE_ADDR_SHIFT ) | + (chunk_size <<GMBUS_BYTE_COUNT_SHIFT ) | + (addr <<GMBUS_SLAVE_ADDR_SHIFT ) |GMBUS_SLAVE_WRITE |GMBUS_SW_RDY );while (len) {int ret;@@ -343,6 +366,29 @@ gmbus_xfer_write(struct drm_i915_private *dev_priv, struct i2c_msg *msg)if (ret)return ret; } + +return 0 ; +} + +static int +gmbus_xfer_write (struct drm_i915_private *dev_priv,struct i2c_msg *msg) +{ +u8 *buf = msg->buf; +unsigned int tx_size = msg->len; +unsigned int len; +int ret; + +do { + len =min (tx_size,GMBUS_BYTE_COUNT_MAX ); + + ret =gmbus_xfer_write_chunk (dev_priv, msg->addr, buf, len); +if (ret) +return ret; + + buf += len; + tx_size -= len; + }while (tx_size !=0 ); +return 0 ; }Signature · 6 lines
2.3.7 -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.htmlSignature · 1 line
Jani Nikula, Intel Open Source Technology CenterSignature · 1 line
Jani Nikula, Intel Open Source Technology Center
Re: [PATCH 3.12 137/142] mmc: sh_mmcif: Fix timeout value for command request
In reply to Simon Horman2015-05-17 21:37 GMT-03:00 Simon Horman <[email protected]>:
Quoted 9 lines
Quoted 3 lines
Quoted 1 line
True ?
Sorry, what?
My understanding is that there is a desire to have a timeout of 10s as 1s has turned out to be too short in practice.
Prior to
f9fd54f22ethe timeout was 10s for HZ=100, and it is my understanding that on SH mobile HZ=100 is the normal case.
Understand.
Albino