* [34-longterm 047/196] gro: Reset dev pointer on reuse
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 048/196] gro: reset skb_iif " Paul Gortmaker
` (148 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Herbert Xu, David S. Miller, Paul Gortmaker
From: Herbert Xu <herbert@gondor.apana.org.au>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 66c46d741e2e60f0e8b625b80edb0ab820c46d7a upstream.
On older kernels the VLAN code may zero skb->dev before dropping
it and causing it to be reused by GRO.
Unfortunately we didn't reset skb->dev in that case which causes
the next GRO user to get a bogus skb->dev pointer.
This particular problem no longer happens with the current upstream
kernel due to changes in VLAN processing.
However, for correctness we should still reset the skb->dev pointer
in the GRO reuse function in case a future user does the same thing.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/core/dev.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/core/dev.c b/net/core/dev.c
index 3095934..19a74f6 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2822,6 +2822,7 @@ void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
{
__skb_pull(skb, skb_headlen(skb));
skb_reserve(skb, NET_IP_ALIGN - skb_headroom(skb));
+ skb->dev = napi->dev;
napi->skb = skb;
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 048/196] gro: reset skb_iif on reuse
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 047/196] gro: Reset dev pointer on reuse Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 049/196] x86, microcode, AMD: Extend ucode size verification Paul Gortmaker
` (147 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Andy Gospodarek, David S. Miller, Paul Gortmaker
From: Andy Gospodarek <andy@greyhouse.net>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 6d152e23ad1a7a5b40fef1f42e017d66e6115159 upstream.
Like Herbert's change from a few days ago:
66c46d741e2e60f0e8b625b80edb0ab820c46d7a gro: Reset dev pointer on reuse
this may not be necessary at this point, but we should still clean up
the skb->skb_iif. If not we may end up with an invalid valid for
skb->skb_iif when the skb is reused and the check is done in
__netif_receive_skb.
Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/core/dev.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/core/dev.c b/net/core/dev.c
index 19a74f6..1bde8b7 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2823,6 +2823,7 @@ void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
__skb_pull(skb, skb_headlen(skb));
skb_reserve(skb, NET_IP_ALIGN - skb_headroom(skb));
skb->dev = napi->dev;
+ skb->skb_iif = 0;
napi->skb = skb;
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 049/196] x86, microcode, AMD: Extend ucode size verification
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 047/196] gro: Reset dev pointer on reuse Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 048/196] gro: reset skb_iif " Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 050/196] Squashfs: handle corruption of directory structure Paul Gortmaker
` (146 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Borislav Petkov, Paul Gortmaker
From: Borislav Petkov <borislav.petkov@amd.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 44d60c0f5c58c2168f31df9a481761451840eb54 upstream.
The different families have a different max size for the ucode patch,
adjust size checking to the family we're running on. Also, do not
vzalloc the max size of the ucode but only the actual size that is
passed on from the firmware loader.
[PG: baseline of 44d60c0f5~1 differs in multiple trivial ways from
the 34's; this commit makes get_next_ucode() look like 44d60c0f5's]
Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/kernel/microcode_amd.c | 74 +++++++++++++++++++++++++--------------
1 file changed, 48 insertions(+), 26 deletions(-)
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
index e1af7c0..ed47400 100644
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/microcode_amd.c
@@ -66,7 +66,6 @@ struct microcode_amd {
unsigned int mpb[0];
};
-#define UCODE_MAX_SIZE 2048
#define UCODE_CONTAINER_SECTION_HDR 8
#define UCODE_CONTAINER_HEADER_SIZE 12
@@ -155,6 +154,37 @@ static int apply_microcode_amd(int cpu)
return 0;
}
+static unsigned int verify_ucode_size(int cpu, const u8 *buf, unsigned int size)
+{
+ struct cpuinfo_x86 *c = &cpu_data(cpu);
+ unsigned int max_size, actual_size;
+
+#define F1XH_MPB_MAX_SIZE 2048
+#define F14H_MPB_MAX_SIZE 1824
+#define F15H_MPB_MAX_SIZE 4096
+
+ switch (c->x86) {
+ case 0x14:
+ max_size = F14H_MPB_MAX_SIZE;
+ break;
+ case 0x15:
+ max_size = F15H_MPB_MAX_SIZE;
+ break;
+ default:
+ max_size = F1XH_MPB_MAX_SIZE;
+ break;
+ }
+
+ actual_size = buf[4] + (buf[5] << 8);
+
+ if (actual_size > size || actual_size > max_size) {
+ pr_err("section size mismatch\n");
+ return 0;
+ }
+
+ return actual_size;
+}
+
static int get_ucode_data(void *to, const u8 *from, size_t n)
{
memcpy(to, from, n);
@@ -162,37 +192,29 @@ static int get_ucode_data(void *to, const u8 *from, size_t n)
}
static void *
-get_next_ucode(const u8 *buf, unsigned int size, unsigned int *mc_size)
+get_next_ucode(int cpu, const u8 *buf, unsigned int size, unsigned int *mc_size)
{
- unsigned int total_size;
- u8 section_hdr[UCODE_CONTAINER_SECTION_HDR];
- void *mc;
+ void *mc = NULL;
+ unsigned int actual_size = 0;
- if (get_ucode_data(section_hdr, buf, UCODE_CONTAINER_SECTION_HDR))
- return NULL;
-
- if (section_hdr[0] != UCODE_UCODE_TYPE) {
+ if (buf[0] != UCODE_UCODE_TYPE) {
pr_err("error: invalid type field in container file section header\n");
- return NULL;
+ goto out;
}
- total_size = (unsigned long) (section_hdr[4] + (section_hdr[5] << 8));
+ actual_size = verify_ucode_size(cpu, buf, size);
+ if (!actual_size)
+ goto out;
- if (total_size > size || total_size > UCODE_MAX_SIZE) {
- pr_err("error: size mismatch\n");
- return NULL;
- }
+ mc = vmalloc(actual_size);
+ if (!mc)
+ goto out;
- mc = vmalloc(UCODE_MAX_SIZE);
- if (mc) {
- memset(mc, 0, UCODE_MAX_SIZE);
- if (get_ucode_data(mc, buf + UCODE_CONTAINER_SECTION_HDR,
- total_size)) {
- vfree(mc);
- mc = NULL;
- } else
- *mc_size = total_size + UCODE_CONTAINER_SECTION_HDR;
- }
+ memset(mc, 0, actual_size);
+ get_ucode_data(mc, buf + UCODE_CONTAINER_SECTION_HDR, actual_size);
+ *mc_size = actual_size + UCODE_CONTAINER_SECTION_HDR;
+
+out:
return mc;
}
@@ -258,7 +280,7 @@ generic_load_microcode(int cpu, const u8 *data, size_t size)
unsigned int uninitialized_var(mc_size);
struct microcode_header_amd *mc_header;
- mc = get_next_ucode(ucode_ptr, leftover, &mc_size);
+ mc = get_next_ucode(cpu, ucode_ptr, leftover, &mc_size);
if (!mc)
break;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 050/196] Squashfs: handle corruption of directory structure
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (2 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 049/196] x86, microcode, AMD: Extend ucode size verification Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 051/196] atm/solos-pci: Don't include frame pseudo-header on transmit hex-dump Paul Gortmaker
` (145 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Phillip Lougher, Paul Gortmaker
From: Phillip Lougher <phillip@lougher.demon.co.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 44cff8a9ee8a974f9e931df910688e7fc1f0b0f9 upstream.
Handle the rare case where a directory metadata block is uncompressed and
corrupted, leading to a kernel oops in directory scanning (memcpy).
Normally corruption is detected at the decompression stage and dealt with
then, however, this will not happen if:
- metadata isn't compressed (users can optionally request no metadata
compression), or
- the compressed metadata block was larger than the original, in which
case the uncompressed version was used, or
- the data was corrupt after decompression
This patch fixes this by adding some sanity checks against known maximum
values.
Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/squashfs/dir.c | 9 +++++++++
fs/squashfs/namei.c | 12 ++++++++++++
2 files changed, 21 insertions(+)
diff --git a/fs/squashfs/dir.c b/fs/squashfs/dir.c
index 12b933a..a37d445 100644
--- a/fs/squashfs/dir.c
+++ b/fs/squashfs/dir.c
@@ -172,6 +172,11 @@ static int squashfs_readdir(struct file *file, void *dirent, filldir_t filldir)
length += sizeof(dirh);
dir_count = le32_to_cpu(dirh.count) + 1;
+
+ /* dir_count should never be larger than 256 */
+ if (dir_count > 256)
+ goto failed_read;
+
while (dir_count--) {
/*
* Read directory entry.
@@ -183,6 +188,10 @@ static int squashfs_readdir(struct file *file, void *dirent, filldir_t filldir)
size = le16_to_cpu(dire->size) + 1;
+ /* size should never be larger than SQUASHFS_NAME_LEN */
+ if (size > SQUASHFS_NAME_LEN)
+ goto failed_read;
+
err = squashfs_read_metadata(inode->i_sb, dire->name,
&block, &offset, size);
if (err < 0)
diff --git a/fs/squashfs/namei.c b/fs/squashfs/namei.c
index 5266bd8..4fa484d 100644
--- a/fs/squashfs/namei.c
+++ b/fs/squashfs/namei.c
@@ -174,6 +174,11 @@ static struct dentry *squashfs_lookup(struct inode *dir, struct dentry *dentry,
length += sizeof(dirh);
dir_count = le32_to_cpu(dirh.count) + 1;
+
+ /* dir_count should never be larger than 256 */
+ if (dir_count > 256)
+ goto data_error;
+
while (dir_count--) {
/*
* Read directory entry.
@@ -185,6 +190,10 @@ static struct dentry *squashfs_lookup(struct inode *dir, struct dentry *dentry,
size = le16_to_cpu(dire->size) + 1;
+ /* size should never be larger than SQUASHFS_NAME_LEN */
+ if (size > SQUASHFS_NAME_LEN)
+ goto data_error;
+
err = squashfs_read_metadata(dir->i_sb, dire->name,
&block, &offset, size);
if (err < 0)
@@ -226,6 +235,9 @@ exit_lookup:
d_add(dentry, inode);
return ERR_PTR(0);
+data_error:
+ err = -EIO;
+
read_failure:
ERROR("Unable to read directory block [%llx:%x]\n",
squashfs_i(dir)->start + msblk->directory_table,
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 051/196] atm/solos-pci: Don't include frame pseudo-header on transmit hex-dump
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (3 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 050/196] Squashfs: handle corruption of directory structure Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 052/196] ext4: fix credits computing for indirect mapped files Paul Gortmaker
` (144 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Philip A. Prindeville, David S. Miller, Paul Gortmaker
From: "Philip A. Prindeville" <philipp@redfish-solutions.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 18b429e74eeafe42e947b1b0f9a760c7153a0b5c upstream.
Omit pkt_hdr preamble when dumping transmitted packet as hex-dump;
we can pull this up because the frame has already been sent, and
dumping it is the last thing we do with it before freeing it.
Also include the size, vpi, and vci in the debug as is done on
receive.
Use "port" consistently instead of "device" intermittently.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/atm/solos-pci.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 3613422..6ba851b 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -695,7 +695,7 @@ void solos_bh(unsigned long card_arg)
size);
}
if (atmdebug) {
- dev_info(&card->dev->dev, "Received: device %d\n", port);
+ dev_info(&card->dev->dev, "Received: port %d\n", port);
dev_info(&card->dev->dev, "size: %d VPI: %d VCI: %d\n",
size, le16_to_cpu(header->vpi),
le16_to_cpu(header->vci));
@@ -1015,8 +1015,15 @@ static uint32_t fpga_tx(struct solos_card *card)
/* Clean up and free oldskb now it's gone */
if (atmdebug) {
+ struct pkt_hdr *header = (void *)oldskb->data;
+ int size = le16_to_cpu(header->size);
+
+ skb_pull(oldskb, sizeof(*header));
dev_info(&card->dev->dev, "Transmitted: port %d\n",
port);
+ dev_info(&card->dev->dev, "size: %d VPI: %d VCI: %d\n",
+ size, le16_to_cpu(header->vpi),
+ le16_to_cpu(header->vci));
print_buffer(oldskb);
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 052/196] ext4: fix credits computing for indirect mapped files
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (4 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 051/196] atm/solos-pci: Don't include frame pseudo-header on transmit hex-dump Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 053/196] nfsd: fix auth_domain reference leak on nlm operations Paul Gortmaker
` (143 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Yongqiang Yang, Theodore Ts'o, Paul Gortmaker
From: Yongqiang Yang <xiaoqiangnk@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5b41395fcc0265fc9f193aef9df39ce49d64677c upstream.
When writing a contiguous set of blocks, two indirect blocks could be
needed depending on how the blocks are aligned, so we need to increase
the number of credits needed by one.
[ Also fixed a another bug which could further underestimate the
number of journal credits needed by 1; the code was using integer
division instead of DIV_ROUND_UP() -- tytso]
Signed-off-by: Yongqiang Yang <xiaoqiangnk@gmail.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/ext4/inode.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 4eced51..904f3e4 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5573,13 +5573,12 @@ static int ext4_indirect_trans_blocks(struct inode *inode, int nrblocks,
/* if nrblocks are contiguous */
if (chunk) {
/*
- * With N contiguous data blocks, it need at most
- * N/EXT4_ADDR_PER_BLOCK(inode->i_sb) indirect blocks
- * 2 dindirect blocks
- * 1 tindirect block
+ * With N contiguous data blocks, we need at most
+ * N/EXT4_ADDR_PER_BLOCK(inode->i_sb) + 1 indirect blocks,
+ * 2 dindirect blocks, and 1 tindirect block
*/
- indirects = nrblocks / EXT4_ADDR_PER_BLOCK(inode->i_sb);
- return indirects + 3;
+ return DIV_ROUND_UP(nrblocks,
+ EXT4_ADDR_PER_BLOCK(inode->i_sb)) + 4;
}
/*
* if nrblocks are not contiguous, worse case, each block touch
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 053/196] nfsd: fix auth_domain reference leak on nlm operations
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (5 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 052/196] ext4: fix credits computing for indirect mapped files Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 054/196] exec: copy-and-paste the fixes into compat_do_execve() paths Paul Gortmaker
` (142 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, J. Bruce Fields, Neil Brown, Paul Gortmaker
From: "J. Bruce Fields" <bfields@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 954032d2527f2fce7355ba70709b5e143d6b686f upstream.
This was noticed by users who performed more than 2^32 lock operations
and hence made this counter overflow (eventually leading to
use-after-free's). Setting rq_client to NULL here means that it won't
later get auth_domain_put() when it should be.
Appears to have been introduced in 2.5.42 by "[PATCH] kNFSd: Move auth
domain lookup into svcauth" which moved most of the rq_client handling
to common svcauth code, but left behind this one line.
Cc: Neil Brown <neilb@suse.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfsd/lockd.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/fs/nfsd/lockd.c b/fs/nfsd/lockd.c
index 0c6d816..7c831a2 100644
--- a/fs/nfsd/lockd.c
+++ b/fs/nfsd/lockd.c
@@ -38,7 +38,6 @@ nlm_fopen(struct svc_rqst *rqstp, struct nfs_fh *f, struct file **filp)
exp_readlock();
nfserr = nfsd_open(rqstp, &fh, S_IFREG, NFSD_MAY_LOCK, filp);
fh_put(&fh);
- rqstp->rq_client = NULL;
exp_readunlock();
/* We return nlm error codes as nlm doesn't know
* about nfsd, but nfsd does know about nlm..
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 054/196] exec: copy-and-paste the fixes into compat_do_execve() paths
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (6 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 053/196] nfsd: fix auth_domain reference leak on nlm operations Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 055/196] cifs: always do is_path_accessible check in cifs_mount Paul Gortmaker
` (141 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Oleg Nesterov, KOSAKI Motohiro, Linus Torvalds,
Paul Gortmaker
From: Oleg Nesterov <oleg@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 114279be2120a916e8a04feeb2ac976a10016f2f upstream.
Note: this patch targets 2.6.37 and tries to be as simple as possible.
That is why it adds more copy-and-paste horror into fs/compat.c and
uglifies fs/exec.c, this will be cleanuped later.
compat_copy_strings() plays with bprm->vma/mm directly and thus has
two problems: it lacks the RLIMIT_STACK check and argv/envp memory
is not visible to oom killer.
Export acct_arg_size() and get_arg_page(), change compat_copy_strings()
to use get_arg_page(), change compat_do_execve() to do acct_arg_size(0)
as do_execve() does.
Add the fatal_signal_pending/cond_resched checks into compat_count() and
compat_copy_strings(), this matches the code in fs/exec.c and certainly
makes sense.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/compat.c | 28 +++++++++++++++-------------
fs/exec.c | 8 ++++----
include/linux/binfmts.h | 4 ++++
3 files changed, 23 insertions(+), 17 deletions(-)
diff --git a/fs/compat.c b/fs/compat.c
index 6490d21..633e63c 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1376,6 +1376,10 @@ static int compat_count(compat_uptr_t __user *argv, int max)
argv++;
if (i++ >= max)
return -E2BIG;
+
+ if (fatal_signal_pending(current))
+ return -ERESTARTNOHAND;
+ cond_resched();
}
}
return i;
@@ -1417,6 +1421,12 @@ static int compat_copy_strings(int argc, compat_uptr_t __user *argv,
while (len > 0) {
int offset, bytes_to_copy;
+ if (fatal_signal_pending(current)) {
+ ret = -ERESTARTNOHAND;
+ goto out;
+ }
+ cond_resched();
+
offset = pos % PAGE_SIZE;
if (offset == 0)
offset = PAGE_SIZE;
@@ -1433,18 +1443,8 @@ static int compat_copy_strings(int argc, compat_uptr_t __user *argv,
if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
struct page *page;
-#ifdef CONFIG_STACK_GROWSUP
- ret = expand_stack_downwards(bprm->vma, pos);
- if (ret < 0) {
- /* We've exceed the stack rlimit. */
- ret = -E2BIG;
- goto out;
- }
-#endif
- ret = get_user_pages(current, bprm->mm, pos,
- 1, 1, 1, &page, NULL);
- if (ret <= 0) {
- /* We've exceed the stack rlimit. */
+ page = get_arg_page(bprm, pos, 1);
+ if (!page) {
ret = -E2BIG;
goto out;
}
@@ -1565,8 +1565,10 @@ int compat_do_execve(char * filename,
return retval;
out:
- if (bprm->mm)
+ if (bprm->mm) {
+ acct_arg_size(bprm, 0);
mmput(bprm->mm);
+ }
out_file:
if (bprm->file) {
diff --git a/fs/exec.c b/fs/exec.c
index b5cf64a..11cfcce 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -158,7 +158,7 @@ out:
#ifdef CONFIG_MMU
-static void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
+void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
{
struct mm_struct *mm = current->mm;
long diff = (long)(pages - bprm->vma_pages);
@@ -173,7 +173,7 @@ static void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
up_write(&mm->mmap_sem);
}
-static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
int write)
{
struct page *page;
@@ -291,11 +291,11 @@ static bool valid_arg_len(struct linux_binprm *bprm, long len)
#else
-static inline void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
+void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
{
}
-static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
int write)
{
struct page *page;
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index 39798c6..074b620 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -60,6 +60,10 @@ struct linux_binprm{
unsigned long loader, exec;
};
+extern void acct_arg_size(struct linux_binprm *bprm, unsigned long pages);
+extern struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+ int write);
+
#define BINPRM_FLAGS_ENFORCE_NONDUMP_BIT 0
#define BINPRM_FLAGS_ENFORCE_NONDUMP (1 << BINPRM_FLAGS_ENFORCE_NONDUMP_BIT)
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 055/196] cifs: always do is_path_accessible check in cifs_mount
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (7 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 054/196] exec: copy-and-paste the fixes into compat_do_execve() paths Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 056/196] video: sn9c102: world-wirtable sysfs files Paul Gortmaker
` (140 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jeff Layton, Steve French, Paul Gortmaker
From: Jeff Layton <jlayton@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 70945643722ffeac779d2529a348f99567fa5c33 upstream.
Currently, we skip doing the is_path_accessible check in cifs_mount if
there is no prefixpath. I have a report of at least one server however
that allows a TREE_CONNECT to a share that has a DFS referral at its
root. The reporter in this case was using a UNC that had no prefixpath,
so the is_path_accessible check was not triggered and the box later hit
a BUG() because we were chasing a DFS referral on the root dentry for
the mount.
This patch fixes this by removing the check for a zero-length
prefixpath. That should make the is_path_accessible check be done in
this situation and should allow the client to chase the DFS referral at
mount time instead.
Reported-and-Tested-by: Yogesh Sharma <ysharma@cymer.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/cifs/connect.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index d9566bf..f6afb59 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2555,7 +2555,7 @@ try_mount_again:
remote_path_check:
/* check if a whole path (including prepath) is not remote */
- if (!rc && cifs_sb->prepathlen && tcon) {
+ if (!rc && tcon) {
/* build_path_to_root works only when we have a valid tcon */
full_path = cifs_build_path_to_root(cifs_sb);
if (full_path == NULL) {
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 056/196] video: sn9c102: world-wirtable sysfs files
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (8 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 055/196] cifs: always do is_path_accessible check in cifs_mount Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 057/196] UBIFS: restrict world-writable debugfs files Paul Gortmaker
` (139 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, Mauro Carvalho Chehab, Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 14ddc3188d50855ae2a419a6aced995e2834e5d4 upstream.
Don't allow everybody to change video settings.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Acked-by: Luca Risolia <luca.risolia@studio.unibo.it>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/media/video/sn9c102/sn9c102_core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/media/video/sn9c102/sn9c102_core.c b/drivers/media/video/sn9c102/sn9c102_core.c
index cbf8087..8e86f20 100644
--- a/drivers/media/video/sn9c102/sn9c102_core.c
+++ b/drivers/media/video/sn9c102/sn9c102_core.c
@@ -1430,9 +1430,9 @@ static DEVICE_ATTR(i2c_reg, S_IRUGO | S_IWUSR,
sn9c102_show_i2c_reg, sn9c102_store_i2c_reg);
static DEVICE_ATTR(i2c_val, S_IRUGO | S_IWUSR,
sn9c102_show_i2c_val, sn9c102_store_i2c_val);
-static DEVICE_ATTR(green, S_IWUGO, NULL, sn9c102_store_green);
-static DEVICE_ATTR(blue, S_IWUGO, NULL, sn9c102_store_blue);
-static DEVICE_ATTR(red, S_IWUGO, NULL, sn9c102_store_red);
+static DEVICE_ATTR(green, S_IWUSR, NULL, sn9c102_store_green);
+static DEVICE_ATTR(blue, S_IWUSR, NULL, sn9c102_store_blue);
+static DEVICE_ATTR(red, S_IWUSR, NULL, sn9c102_store_red);
static DEVICE_ATTR(frame_header, S_IRUGO, sn9c102_show_frame_header, NULL);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 057/196] UBIFS: restrict world-writable debugfs files
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (9 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 056/196] video: sn9c102: world-wirtable sysfs files Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 058/196] NET: cdc-phonet, handle empty phonet header Paul Gortmaker
` (138 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, Artem Bityutskiy, Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 8c559d30b4e59cf6994215ada1fe744928f494bf upstream.
Don't allow everybody to dump sensitive information about filesystems.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/ubifs/debug.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 923d697..a0c09fc 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -2687,19 +2687,19 @@ int dbg_debugfs_init_fs(struct ubifs_info *c)
}
fname = "dump_lprops";
- dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
+ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
if (IS_ERR(dent))
goto out_remove;
d->dfs_dump_lprops = dent;
fname = "dump_budg";
- dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
+ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
if (IS_ERR(dent))
goto out_remove;
d->dfs_dump_budg = dent;
fname = "dump_tnc";
- dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
+ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
if (IS_ERR(dent))
goto out_remove;
d->dfs_dump_tnc = dent;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 058/196] NET: cdc-phonet, handle empty phonet header
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (10 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 057/196] UBIFS: restrict world-writable debugfs files Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 059/196] x86: Fix a bogus unwind annotation in lib/semaphore_32.S Paul Gortmaker
` (137 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jiri Slaby, Rémi Denis-Courmont,
David S. Miller, Paul Gortmaker
From: Jiri Slaby <jslaby@suse.cz>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 468c3f924f043cad7a04f4f4d5224a2c9bc886c1 upstream.
Currently, for N 5800 XM I get:
cdc_phonet: probe of 1-6:1.10 failed with error -22
It's because phonet_header is empty. Extra altsetting looks like
there:
E 05 24 00 01 10 03 24 ab 05 24 06 0a 0b 04 24 fd .$....$..$....$.
E 00 .
I don't see the header used anywhere so just check if the phonet
descriptor is there, not the structure itself.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Cc: David S. Miller <davem@davemloft.net>
Acked-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/usb/cdc-phonet.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
index dc94445..b18cda4 100644
--- a/drivers/net/usb/cdc-phonet.c
+++ b/drivers/net/usb/cdc-phonet.c
@@ -326,13 +326,13 @@ int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *id)
{
static const char ifname[] = "usbpn%d";
const struct usb_cdc_union_desc *union_header = NULL;
- const struct usb_cdc_header_desc *phonet_header = NULL;
const struct usb_host_interface *data_desc;
struct usb_interface *data_intf;
struct usb_device *usbdev = interface_to_usbdev(intf);
struct net_device *dev;
struct usbpn_dev *pnd;
u8 *data;
+ int phonet = 0;
int len, err;
data = intf->altsetting->extra;
@@ -353,10 +353,7 @@ int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *id)
(struct usb_cdc_union_desc *)data;
break;
case 0xAB:
- if (phonet_header || dlen < 5)
- break;
- phonet_header =
- (struct usb_cdc_header_desc *)data;
+ phonet = 1;
break;
}
}
@@ -364,7 +361,7 @@ int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *id)
len -= dlen;
}
- if (!union_header || !phonet_header)
+ if (!union_header || !phonet)
return -EINVAL;
data_intf = usb_ifnum_to_if(usbdev, union_header->bSlaveInterface0);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 059/196] x86: Fix a bogus unwind annotation in lib/semaphore_32.S
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (11 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 058/196] NET: cdc-phonet, handle empty phonet header Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 060/196] tioca: Fix assignment from incompatible pointer warnings Paul Gortmaker
` (136 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jan Beulich, Jan Beulich, Ingo Molnar, Paul Gortmaker
From: Jan Beulich <JBeulich@novell.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit e938c287ea8d977e079f07464ac69923412663ce upstream.
'simple' would have required specifying current frame address
and return address location manually, but that's obviously not
the case (and not necessary) here.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
LKML-Reference: <4D6D1082020000780003454C@vpn.id2.novell.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/lib/semaphore_32.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/lib/semaphore_32.S b/arch/x86/lib/semaphore_32.S
index 648fe47..f35eec7 100644
--- a/arch/x86/lib/semaphore_32.S
+++ b/arch/x86/lib/semaphore_32.S
@@ -36,7 +36,7 @@
*/
#ifdef CONFIG_SMP
ENTRY(__write_lock_failed)
- CFI_STARTPROC simple
+ CFI_STARTPROC
FRAME
2: LOCK_PREFIX
addl $ RW_LOCK_BIAS,(%eax)
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 060/196] tioca: Fix assignment from incompatible pointer warnings
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (12 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 059/196] x86: Fix a bogus unwind annotation in lib/semaphore_32.S Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 061/196] mca.c: Fix cast from integer to pointer warning Paul Gortmaker
` (135 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jeff Mahoney, Tony Luck, Paul Gortmaker
From: Jeff Mahoney <jeffm@suse.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b4a6b3436531f6c5256e6d60d388c3c28ff1a0e9 upstream.
The prototype for sn_pci_provider->{dma_map,dma_map_consistent} expects
an unsigned long instead of a u64.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/ia64/sn/pci/tioca_provider.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/ia64/sn/pci/tioca_provider.c b/arch/ia64/sn/pci/tioca_provider.c
index 4d4536e..9c271be 100644
--- a/arch/ia64/sn/pci/tioca_provider.c
+++ b/arch/ia64/sn/pci/tioca_provider.c
@@ -509,7 +509,7 @@ tioca_dma_unmap(struct pci_dev *pdev, dma_addr_t bus_addr, int dir)
* use the GART mapped mode.
*/
static u64
-tioca_dma_map(struct pci_dev *pdev, u64 paddr, size_t byte_count, int dma_flags)
+tioca_dma_map(struct pci_dev *pdev, unsigned long paddr, size_t byte_count, int dma_flags)
{
u64 mapaddr;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 061/196] mca.c: Fix cast from integer to pointer warning
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (13 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 060/196] tioca: Fix assignment from incompatible pointer warnings Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 062/196] ramfs: fix memleak on no-mmu arch Paul Gortmaker
` (134 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jeff Mahoney, Tony Luck, Paul Gortmaker
From: Jeff Mahoney <jeffm@suse.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit c1d036c4d1cb00b7e8473a2ad0a78f13e13a8183 upstream.
ia64_mca_cpu_init has a void *data local variable that is assigned
the value from either __get_free_pages() or mca_bootmem(). The problem
is that __get_free_pages returns an unsigned long and mca_bootmem, via
alloc_bootmem(), returns a void *. format_mca_init_stack takes the void *,
and it's also used with __pa(), but that casts it to long anyway.
This results in the following build warning:
arch/ia64/kernel/mca.c:1898: warning: assignment makes pointer from
integer without a cast
Cast the return of __get_free_pages to a void * to avoid
the warning.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/ia64/kernel/mca.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c
index a0220dc..6871c1b 100644
--- a/arch/ia64/kernel/mca.c
+++ b/arch/ia64/kernel/mca.c
@@ -1859,7 +1859,8 @@ ia64_mca_cpu_init(void *cpu_data)
data = mca_bootmem();
first_time = 0;
} else
- data = __get_free_pages(GFP_KERNEL, get_order(sz));
+ data = (void *)__get_free_pages(GFP_KERNEL,
+ get_order(sz));
if (!data)
panic("Could not allocate MCA memory for cpu %d\n",
cpu);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 062/196] ramfs: fix memleak on no-mmu arch
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (14 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 061/196] mca.c: Fix cast from integer to pointer warning Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 063/196] MAINTAINERS: update STABLE BRANCH info Paul Gortmaker
` (133 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Bob Liu, David Howells, Andrew Morton,
Linus Torvalds, Paul Gortmaker
From: Bob Liu <lliubbo@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b836aec53e2bce71de1d5415313380688c851477 upstream.
On no-mmu arch, there is a memleak during shmem test. The cause of this
memleak is ramfs_nommu_expand_for_mapping() added page refcount to 2
which makes iput() can't free that pages.
The simple test file is like this:
int main(void)
{
int i;
key_t k = ftok("/etc", 42);
for ( i=0; i<100; ++i) {
int id = shmget(k, 10000, 0644|IPC_CREAT);
if (id == -1) {
printf("shmget error\n");
}
if(shmctl(id, IPC_RMID, NULL ) == -1) {
printf("shm rm error\n");
return -1;
}
}
printf("run ok...\n");
return 0;
}
And the result:
root:/> free
total used free shared buffers
Mem: 60320 17912 42408 0 0
-/+ buffers: 17912 42408
root:/> shmem
run ok...
root:/> free
total used free shared buffers
Mem: 60320 19096 41224 0 0
-/+ buffers: 19096 41224
root:/> shmem
run ok...
root:/> free
total used free shared buffers
Mem: 60320 20296 40024 0 0
-/+ buffers: 20296 40024
...
After this patch the test result is:(no memleak anymore)
root:/> free
total used free shared buffers
Mem: 60320 16668 43652 0 0
-/+ buffers: 16668 43652
root:/> shmem
run ok...
root:/> free
total used free shared buffers
Mem: 60320 16668 43652 0 0
-/+ buffers: 16668 43652
Signed-off-by: Bob Liu <lliubbo@gmail.com>
Acked-by: Hugh Dickins <hughd@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/ramfs/file-nommu.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
index 5ea4ad8..e9f6f9b 100644
--- a/fs/ramfs/file-nommu.c
+++ b/fs/ramfs/file-nommu.c
@@ -112,6 +112,7 @@ int ramfs_nommu_expand_for_mapping(struct inode *inode, size_t newsize)
SetPageDirty(page);
unlock_page(page);
+ put_page(page);
}
return 0;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 063/196] MAINTAINERS: update STABLE BRANCH info
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (15 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 062/196] ramfs: fix memleak on no-mmu arch Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 064/196] UBIFS: fix oops when R/O file-system is fsync'ed Paul Gortmaker
` (132 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Randy Dunlap, Greg KH, Andrew Morton,
Linus Torvalds, Paul Gortmaker
From: Randy Dunlap <randy.dunlap@oracle.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit d00ebeac5f24f290636f7a895dafc124b2930a08 upstream.
Drop Chris Wright from STABLE maintainers. He hasn't done STABLE release
work for quite some time.
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Cc: Greg KH <gregkh@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
MAINTAINERS | 1 -
1 file changed, 1 deletion(-)
diff --git a/MAINTAINERS b/MAINTAINERS
index 502b380..52bec00 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5306,7 +5306,6 @@ F: arch/alpha/kernel/srm_env.c
STABLE BRANCH
M: Greg Kroah-Hartman <greg@kroah.com>
-M: Chris Wright <chrisw@sous-sol.org>
L: stable@kernel.org
S: Maintained
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 064/196] UBIFS: fix oops when R/O file-system is fsync'ed
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (16 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 063/196] MAINTAINERS: update STABLE BRANCH info Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 065/196] x86, cpu: AMD errata checking framework Paul Gortmaker
` (131 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Artem Bityutskiy, Paul Gortmaker
From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 78530bf7f2559b317c04991b52217c1608d5a58d upstream.
This patch fixes severe UBIFS bug: UBIFS oopses when we 'fsync()' an
file on R/O-mounter file-system. We (the UBIFS authors) incorrectly
thought that VFS would not propagate 'fsync()' down to the file-system
if it is read-only, but this is not the case.
It is easy to exploit this bug using the following simple perl script:
use strict;
use File::Sync qw(fsync sync);
die "File path is not specified" if not defined $ARGV[0];
my $path = $ARGV[0];
open FILE, "<", "$path" or die "Cannot open $path: $!";
fsync(\*FILE) or die "cannot fsync $path: $!";
close FILE or die "Cannot close $path: $!";
Thanks to Reuben Dowle <Reuben.Dowle@navico.com> for reporting about this
issue.
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Reported-by: Reuben Dowle <Reuben.Dowle@navico.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/ubifs/file.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index 5692cf7..1a411fd 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -1312,6 +1312,9 @@ int ubifs_fsync(struct file *file, struct dentry *dentry, int datasync)
dbg_gen("syncing inode %lu", inode->i_ino);
+ if (inode->i_sb->s_flags & MS_RDONLY)
+ return 0;
+
/*
* VFS has already synchronized dirty pages for this inode. Synchronize
* the inode unless this is a 'datasync()' call.
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 065/196] x86, cpu: AMD errata checking framework
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (17 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 064/196] UBIFS: fix oops when R/O file-system is fsync'ed Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 066/196] x86, cpu: Clean up AMD erratum 400 workaround Paul Gortmaker
` (130 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Hans Rosenfeld, H. Peter Anvin, Paul Gortmaker
From: Hans Rosenfeld <hans.rosenfeld@amd.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit d78d671db478eb8b14c78501c0cee1cc7baf6967 upstream.
Errata are defined using the AMD_LEGACY_ERRATUM() or AMD_OSVW_ERRATUM()
macros. The latter is intended for newer errata that have an OSVW id
assigned, which it takes as first argument. Both take a variable number
of family-specific model-stepping ranges created by AMD_MODEL_RANGE().
Iff an erratum has an OSVW id, OSVW is available on the CPU, and the
OSVW id is known to the hardware, it is used to determine whether an
erratum is present. Otherwise, the model-stepping ranges are matched
against the current CPU to find out whether the erratum applies.
For certain special errata, the code using this framework might have to
conduct further checks to make sure an erratum is really (not) present.
Signed-off-by: Hans Rosenfeld <hans.rosenfeld@amd.com>
LKML-Reference: <1280336972-865982-1-git-send-email-hans.rosenfeld@amd.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/include/asm/processor.h | 18 ++++++++++++
arch/x86/kernel/cpu/amd.c | 60 ++++++++++++++++++++++++++++++++++++++
2 files changed, 78 insertions(+)
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 6757357..b213059 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -1031,4 +1031,22 @@ unsigned long calc_aperfmperf_ratio(struct aperfmperf *old,
return ratio;
}
+/*
+ * AMD errata checking
+ */
+#ifdef CONFIG_CPU_SUP_AMD
+extern bool cpu_has_amd_erratum(const int *);
+
+#define AMD_LEGACY_ERRATUM(...) { -1, __VA_ARGS__, 0 }
+#define AMD_OSVW_ERRATUM(osvw_id, ...) { osvw_id, __VA_ARGS__, 0 }
+#define AMD_MODEL_RANGE(f, m_start, s_start, m_end, s_end) \
+ ((f << 24) | (m_start << 16) | (s_start << 12) | (m_end << 4) | (s_end))
+#define AMD_MODEL_RANGE_FAMILY(range) (((range) >> 24) & 0xff)
+#define AMD_MODEL_RANGE_START(range) (((range) >> 12) & 0xfff)
+#define AMD_MODEL_RANGE_END(range) ((range) & 0xfff)
+
+#else
+#define cpu_has_amd_erratum(x) (false)
+#endif /* CONFIG_CPU_SUP_AMD */
+
#endif /* _ASM_X86_PROCESSOR_H */
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index e485825..1d0c58e 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -609,3 +609,63 @@ static const struct cpu_dev __cpuinitconst amd_cpu_dev = {
};
cpu_dev_register(amd_cpu_dev);
+
+/*
+ * AMD errata checking
+ *
+ * Errata are defined as arrays of ints using the AMD_LEGACY_ERRATUM() or
+ * AMD_OSVW_ERRATUM() macros. The latter is intended for newer errata that
+ * have an OSVW id assigned, which it takes as first argument. Both take a
+ * variable number of family-specific model-stepping ranges created by
+ * AMD_MODEL_RANGE(). Each erratum also has to be declared as extern const
+ * int[] in arch/x86/include/asm/processor.h.
+ *
+ * Example:
+ *
+ * const int amd_erratum_319[] =
+ * AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0x4, 0x2),
+ * AMD_MODEL_RANGE(0x10, 0x8, 0x0, 0x8, 0x0),
+ * AMD_MODEL_RANGE(0x10, 0x9, 0x0, 0x9, 0x0));
+ */
+
+bool cpu_has_amd_erratum(const int *erratum)
+{
+ struct cpuinfo_x86 *cpu = ¤t_cpu_data;
+ int osvw_id = *erratum++;
+ u32 range;
+ u32 ms;
+
+ /*
+ * If called early enough that current_cpu_data hasn't been initialized
+ * yet, fall back to boot_cpu_data.
+ */
+ if (cpu->x86 == 0)
+ cpu = &boot_cpu_data;
+
+ if (cpu->x86_vendor != X86_VENDOR_AMD)
+ return false;
+
+ if (osvw_id >= 0 && osvw_id < 65536 &&
+ cpu_has(cpu, X86_FEATURE_OSVW)) {
+ u64 osvw_len;
+
+ rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, osvw_len);
+ if (osvw_id < osvw_len) {
+ u64 osvw_bits;
+
+ rdmsrl(MSR_AMD64_OSVW_STATUS + (osvw_id >> 6),
+ osvw_bits);
+ return osvw_bits & (1ULL << (osvw_id & 0x3f));
+ }
+ }
+
+ /* OSVW unavailable or ID unknown, match family-model-stepping range */
+ ms = (cpu->x86_model << 8) | cpu->x86_mask;
+ while ((range = *erratum++))
+ if ((cpu->x86 == AMD_MODEL_RANGE_FAMILY(range)) &&
+ (ms >= AMD_MODEL_RANGE_START(range)) &&
+ (ms <= AMD_MODEL_RANGE_END(range)))
+ return true;
+
+ return false;
+}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 066/196] x86, cpu: Clean up AMD erratum 400 workaround
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (18 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 065/196] x86, cpu: AMD errata checking framework Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 067/196] x86, AMD: Set ARAT feature on AMD processors Paul Gortmaker
` (129 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Hans Rosenfeld, H. Peter Anvin, Paul Gortmaker
From: Hans Rosenfeld <hans.rosenfeld@amd.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 9d8888c2a214aece2494a49e699a097c2ba9498b upstream.
Remove check_c1e_idle() and use the new AMD errata checking framework
instead.
Signed-off-by: Hans Rosenfeld <hans.rosenfeld@amd.com>
LKML-Reference: <1280336972-865982-2-git-send-email-hans.rosenfeld@amd.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/include/asm/processor.h | 1 +
arch/x86/kernel/cpu/amd.c | 5 +++++
arch/x86/kernel/process.c | 39 ++------------------------------------
3 files changed, 8 insertions(+), 37 deletions(-)
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index b213059..7eb1dd7 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -1035,6 +1035,7 @@ unsigned long calc_aperfmperf_ratio(struct aperfmperf *old,
* AMD errata checking
*/
#ifdef CONFIG_CPU_SUP_AMD
+extern const int amd_erratum_400[];
extern bool cpu_has_amd_erratum(const int *);
#define AMD_LEGACY_ERRATUM(...) { -1, __VA_ARGS__, 0 }
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 1d0c58e..08dd1be 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -628,6 +628,11 @@ cpu_dev_register(amd_cpu_dev);
* AMD_MODEL_RANGE(0x10, 0x9, 0x0, 0x9, 0x0));
*/
+const int amd_erratum_400[] =
+ AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0xf, 0x41, 0x2, 0xff, 0xf),
+ AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0xff, 0xf));
+
+
bool cpu_has_amd_erratum(const int *erratum)
{
struct cpuinfo_x86 *cpu = ¤t_cpu_data;
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 0415c3e..efabf8f 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -525,42 +525,6 @@ static int __cpuinit mwait_usable(const struct cpuinfo_x86 *c)
return (edx & MWAIT_EDX_C1);
}
-/*
- * Check for AMD CPUs, where APIC timer interrupt does not wake up CPU from C1e.
- * For more information see
- * - Erratum #400 for NPT family 0xf and family 0x10 CPUs
- * - Erratum #365 for family 0x11 (not affected because C1e not in use)
- */
-static int __cpuinit check_c1e_idle(const struct cpuinfo_x86 *c)
-{
- u64 val;
- if (c->x86_vendor != X86_VENDOR_AMD)
- goto no_c1e_idle;
-
- /* Family 0x0f models < rev F do not have C1E */
- if (c->x86 == 0x0F && c->x86_model >= 0x40)
- return 1;
-
- if (c->x86 == 0x10) {
- /*
- * check OSVW bit for CPUs that are not affected
- * by erratum #400
- */
- if (cpu_has(c, X86_FEATURE_OSVW)) {
- rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, val);
- if (val >= 2) {
- rdmsrl(MSR_AMD64_OSVW_STATUS, val);
- if (!(val & BIT(1)))
- goto no_c1e_idle;
- }
- }
- return 1;
- }
-
-no_c1e_idle:
- return 0;
-}
-
static cpumask_var_t c1e_mask;
static int c1e_detected;
@@ -638,7 +602,8 @@ void __cpuinit select_idle_routine(const struct cpuinfo_x86 *c)
*/
printk(KERN_INFO "using mwait in idle threads.\n");
pm_idle = mwait_idle;
- } else if (check_c1e_idle(c)) {
+ } else if (cpu_has_amd_erratum(amd_erratum_400)) {
+ /* E400: APIC timer interrupt does not wake up CPU from C1e */
printk(KERN_INFO "using C1E aware idle routine\n");
pm_idle = c1e_idle;
} else
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 067/196] x86, AMD: Set ARAT feature on AMD processors
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (19 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 066/196] x86, cpu: Clean up AMD erratum 400 workaround Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 068/196] x86, amd: Disable GartTlbWlkErr when BIOS forgets it Paul Gortmaker
` (128 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Boris Ostrovsky, Ingo Molnar, Paul Gortmaker
From: Boris Ostrovsky <boris.ostrovsky@amd.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b87cf80af3ba4b4c008b4face3c68d604e1715c6 upstream.
Support for Always Running APIC timer (ARAT) was introduced in
commit db954b5898dd3ef3ef93f4144158ea8f97deb058. This feature
allows us to avoid switching timers from LAPIC to something else
(e.g. HPET) and go into timer broadcasts when entering deep
C-states.
AMD processors don't provide a CPUID bit for that feature but
they also keep APIC timers running in deep C-states (except for
cases when the processor is affected by erratum 400). Therefore
we should set ARAT feature bit on AMD CPUs.
Tested-by: Borislav Petkov <borislav.petkov@amd.com>
Acked-by: Andreas Herrmann <andreas.herrmann3@amd.com>
Acked-by: Mark Langsdorf <mark.langsdorf@amd.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@amd.com>
LKML-Reference: <1300205624-4813-1-git-send-email-ostr@amd64.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/kernel/cpu/amd.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 08dd1be..6f834f8 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -565,6 +565,10 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
}
}
#endif
+
+ /* As a rule processors have APIC timer running in deep C states */
+ if (c->x86 >= 0xf && !cpu_has_amd_erratum(amd_erratum_400))
+ set_cpu_cap(c, X86_FEATURE_ARAT);
}
#ifdef CONFIG_X86_32
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 068/196] x86, amd: Disable GartTlbWlkErr when BIOS forgets it
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (20 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 067/196] x86, AMD: Set ARAT feature on AMD processors Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 069/196] USB: ftdi_sio: Added IDs for CTI USB Serial Devices Paul Gortmaker
` (127 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Joerg Roedel, H. Peter Anvin, Paul Gortmaker
From: Joerg Roedel <joerg.roedel@amd.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5bbc097d890409d8eff4e3f1d26f11a9d6b7c07e upstream.
This patch disables GartTlbWlk errors on AMD Fam10h CPUs if
the BIOS forgets to do is (or is just too old). Letting
these errors enabled can cause a sync-flood on the CPU
causing a reboot.
The AMD BKDG recommends disabling GART TLB Wlk Error completely.
This patch is the fix for
https://bugzilla.kernel.org/show_bug.cgi?id=33012
on my machine.
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Link: http://lkml.kernel.org/r/20110415131152.GJ18463@8bytes.org
Tested-by: Alexandre Demers <alexandre.f.demers@gmail.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/include/asm/msr-index.h | 4 ++++
arch/x86/kernel/cpu/amd.c | 19 +++++++++++++++++++
2 files changed, 23 insertions(+)
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 5928fc0..ad6338e 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -82,11 +82,15 @@
#define MSR_IA32_MC0_ADDR 0x00000402
#define MSR_IA32_MC0_MISC 0x00000403
+#define MSR_AMD64_MC0_MASK 0xc0010044
+
#define MSR_IA32_MCx_CTL(x) (MSR_IA32_MC0_CTL + 4*(x))
#define MSR_IA32_MCx_STATUS(x) (MSR_IA32_MC0_STATUS + 4*(x))
#define MSR_IA32_MCx_ADDR(x) (MSR_IA32_MC0_ADDR + 4*(x))
#define MSR_IA32_MCx_MISC(x) (MSR_IA32_MC0_MISC + 4*(x))
+#define MSR_AMD64_MCx_MASK(x) (MSR_AMD64_MC0_MASK + (x))
+
/* These are consecutive and not in the normal 4er MCE bank block */
#define MSR_IA32_MC0_CTL2 0x00000280
#define MSR_IA32_MCx_CTL2(x) (MSR_IA32_MC0_CTL2 + (x))
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 6f834f8..dba9ca2 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -569,6 +569,25 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
/* As a rule processors have APIC timer running in deep C states */
if (c->x86 >= 0xf && !cpu_has_amd_erratum(amd_erratum_400))
set_cpu_cap(c, X86_FEATURE_ARAT);
+
+ /*
+ * Disable GART TLB Walk Errors on Fam10h. We do this here
+ * because this is always needed when GART is enabled, even in a
+ * kernel which has no MCE support built in.
+ */
+ if (c->x86 == 0x10) {
+ /*
+ * BIOS should disable GartTlbWlk Errors themself. If
+ * it doesn't do it here as suggested by the BKDG.
+ *
+ * Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=33012
+ */
+ u64 mask;
+
+ rdmsrl(MSR_AMD64_MCx_MASK(4), mask);
+ mask |= (1 << 10);
+ wrmsrl(MSR_AMD64_MCx_MASK(4), mask);
+ }
}
#ifdef CONFIG_X86_32
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 069/196] USB: ftdi_sio: Added IDs for CTI USB Serial Devices
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (21 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 068/196] x86, amd: Disable GartTlbWlkErr when BIOS forgets it Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 070/196] USB: ftdi_sio: add PID for OCT DK201 docking station Paul Gortmaker
` (126 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Christian Simon, Greg Kroah-Hartman, Paul Gortmaker
From: Christian Simon <simon@swine.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5a9443f08c83c294c5c806a689c1184b27cb26b3 upstream.
I added new ProdutIds for two devices from CTI GmbH Leipzig.
[PG: fix cosmetic whitespace warning coming from git am]
Signed-off-by: Christian Simon <simon@swine.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/ftdi_sio.c | 2 ++
drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++
2 files changed, 10 insertions(+)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 05dcaa0..193a59b 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -155,6 +155,8 @@ static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
* /sys/bus/usb/ftdi_sio/new_id, then send patch/report!
*/
static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 73d8c79..95846c5 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1146,3 +1146,11 @@
*/
#define QIHARDWARE_VID 0x20B7
#define MILKYMISTONE_JTAGSERIAL_PID 0x0713
+
+/*
+ * CTI GmbH RS485 Converter http://www.cti-lean.com/
+ */
+/* USB-485-Mini*/
+#define FTDI_CTI_MINI_PID 0xF608
+/* USB-Nano-485*/
+#define FTDI_CTI_NANO_PID 0xF60B
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 070/196] USB: ftdi_sio: add PID for OCT DK201 docking station
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (22 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 069/196] USB: ftdi_sio: Added IDs for CTI USB Serial Devices Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 071/196] USB: ftdi_sio: add ids for Hameg HO720 and HO730 Paul Gortmaker
` (125 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Johan Hovold, Greg Kroah-Hartman, Paul Gortmaker
From: Johan Hovold <jhovold@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 11a31d84129dc3133417d626643d714c9df5317e upstream.
Add PID 0x0103 for serial port of the OCT DK201 docking station.
Reported-by: Jan Hoogenraad <jan@hoogenraad.net>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 1 +
2 files changed, 2 insertions(+)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 193a59b..ecaad2b 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -531,6 +531,7 @@ static struct usb_device_id id_table_combined [] = {
{ USB_DEVICE(SEALEVEL_VID, SEALEVEL_2803_8_PID) },
{ USB_DEVICE(IDTECH_VID, IDTECH_IDT1221U_PID) },
{ USB_DEVICE(OCT_VID, OCT_US101_PID) },
+ { USB_DEVICE(OCT_VID, OCT_DK201_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_HE_TIRA1_PID),
.driver_info = (kernel_ulong_t)&ftdi_HE_TIRA1_quirk },
{ USB_DEVICE(FTDI_VID, FTDI_USB_UIRT_PID),
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 95846c5..069cc91 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -579,6 +579,7 @@
/* Note: OCT US101 is also rebadged as Dick Smith Electronics (NZ) XH6381 */
/* Also rebadged as Dick Smith Electronics (Aus) XH6451 */
/* Also rebadged as SIIG Inc. model US2308 hardware version 1 */
+#define OCT_DK201_PID 0x0103 /* OCT DK201 USB docking station */
#define OCT_US101_PID 0x0421 /* OCT US101 USB to RS-232 */
/*
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 071/196] USB: ftdi_sio: add ids for Hameg HO720 and HO730
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (23 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 070/196] USB: ftdi_sio: add PID for OCT DK201 docking station Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 072/196] USB: option: Add new ONDA vendor id and product id for ONDA MT825UP Paul Gortmaker
` (124 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Paul Friedrich, Greg Kroah-Hartman, Paul Gortmaker
From: Paul Friedrich <Paul.Friedrich@hameg.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit c53c2fab40cf16e13af66f40bfd27200cda98d2f upstream.
usb serial: ftdi_sio: add two missing USB ID's for Hameg interfaces HO720
and HO730
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/ftdi_sio.c | 2 ++
drivers/usb/serial/ftdi_sio_ids.h | 2 ++
2 files changed, 4 insertions(+)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index ecaad2b..7d0107a 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -793,6 +793,8 @@ static struct usb_device_id id_table_combined [] = {
{ USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
{ USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) },
+ { USB_DEVICE(FTDI_VID, HAMEG_HO720_PID) },
+ { USB_DEVICE(FTDI_VID, HAMEG_HO730_PID) },
{ USB_DEVICE(FTDI_VID, HAMEG_HO870_PID) },
{ USB_DEVICE(FTDI_VID, MJSG_GENERIC_PID) },
{ USB_DEVICE(FTDI_VID, MJSG_SR_RADIO_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 069cc91..aaeb159 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -300,6 +300,8 @@
* Hameg HO820 and HO870 interface (using VID 0x0403)
*/
#define HAMEG_HO820_PID 0xed74
+#define HAMEG_HO730_PID 0xed73
+#define HAMEG_HO720_PID 0xed72
#define HAMEG_HO870_PID 0xed71
/*
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 072/196] USB: option: Add new ONDA vendor id and product id for ONDA MT825UP
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (24 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 071/196] USB: ftdi_sio: add ids for Hameg HO720 and HO730 Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 073/196] USB: option: Added support for Samsung GT-B3730/GT-B3710 LTE USB modem Paul Gortmaker
` (123 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Enrico Mioso, Greg Kroah-Hartman, Paul Gortmaker
From: Enrico Mioso <mrkiko.rs@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit c6991b6fd2b4201174dc4620d0c8c4f5ff27b36f upstream.
This patch, adds to the option driver the Onda Communication
(http://www.ondacommunication.com) vendor id, and the MT825UP modem
device id.
Note that many variants of this same device are being release here in
Italy (at least one or two per telephony operator).
These devices are perfectly equivalent except for some predefined
settings (which can be changed of course).
It should be noted that most ONDA devices are allready supported (they
used other vendor's ids in the past). The patch seems working fine here,
and the rest of the driver seems uninfluenced.
Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/option.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index e8323de..d1baa77 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -402,6 +402,12 @@ static int option_resume(struct usb_serial *serial);
#define CELOT_VENDOR_ID 0x211f
#define CELOT_PRODUCT_CT680M 0x6801
+/* ONDA Communication vendor id */
+#define ONDA_VENDOR_ID 0x1ee8
+
+/* ONDA MT825UP HSDPA 14.2 modem */
+#define ONDA_MT825UP 0x000b
+
/* some devices interfaces need special handling due to a number of reasons */
enum option_blacklist_reason {
OPTION_BLACKLIST_NONE = 0,
@@ -955,6 +961,7 @@ static const struct usb_device_id option_ids[] = {
{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
+ { USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
{ } /* Terminating entry */
};
MODULE_DEVICE_TABLE(usb, option_ids);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 073/196] USB: option: Added support for Samsung GT-B3730/GT-B3710 LTE USB modem.
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (25 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 072/196] USB: option: Add new ONDA vendor id and product id for ONDA MT825UP Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 074/196] USB: EHCI: unlink unused QHs when the controller is stopped Paul Gortmaker
` (122 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Marius B. Kotsbak, Greg Kroah-Hartman, Paul Gortmaker
From: "Marius B. Kotsbak" <marius@kotsbak.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 80f9df3e0093ad9f1eeefd2ff7fd27daaa518d25 upstream.
Bind only modem AT command endpoint to option.
Signed-off-by: Marius B. Kotsbak <marius@kotsbak.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/serial/option.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index d1baa77..335dbed 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -408,6 +408,10 @@ static int option_resume(struct usb_serial *serial);
/* ONDA MT825UP HSDPA 14.2 modem */
#define ONDA_MT825UP 0x000b
+/* Samsung products */
+#define SAMSUNG_VENDOR_ID 0x04e8
+#define SAMSUNG_PRODUCT_GT_B3730 0x6889
+
/* some devices interfaces need special handling due to a number of reasons */
enum option_blacklist_reason {
OPTION_BLACKLIST_NONE = 0,
@@ -962,6 +966,7 @@ static const struct usb_device_id option_ids[] = {
{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
+ { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730/GT-B3710 LTE USB modem.*/
{ } /* Terminating entry */
};
MODULE_DEVICE_TABLE(usb, option_ids);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 074/196] USB: EHCI: unlink unused QHs when the controller is stopped
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (26 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 073/196] USB: option: Added support for Samsung GT-B3730/GT-B3710 LTE USB modem Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 075/196] USB: fix formatting of SuperSpeed endpoints in /proc/bus/usb/devices Paul Gortmaker
` (121 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Alan Stern, Greg Kroah-Hartman, Paul Gortmaker
From: Alan Stern <stern@rowland.harvard.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 94ae4976e253757e9b03a44d27d41b20f1829d80 upstream.
This patch (as1458) fixes a problem affecting ultra-reliable systems:
When hardware failover of an EHCI controller occurs, the data
structures do not get released correctly. This is because the routine
responsible for removing unused QHs from the async schedule assumes
the controller is running properly (the frame counter is used in
determining how long the QH has been idle) -- but when a failover
causes the controller to be electronically disconnected from the PCI
bus, obviously it stops running.
The solution is simple: Allow scan_async() to remove a QH from the
async schedule if it has been idle for long enough _or_ if the
controller is stopped.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-Tested-by: Dan Duval <dan.duval@stratus.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/host/ehci-q.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index d1d4bb1..781c573 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -1246,24 +1246,27 @@ static void start_unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
static void scan_async (struct ehci_hcd *ehci)
{
+ bool stopped;
struct ehci_qh *qh;
enum ehci_timer_action action = TIMER_IO_WATCHDOG;
ehci->stamp = ehci_readl(ehci, &ehci->regs->frame_index);
timer_action_done (ehci, TIMER_ASYNC_SHRINK);
rescan:
+ stopped = !HC_IS_RUNNING(ehci_to_hcd(ehci)->state);
qh = ehci->async->qh_next.qh;
if (likely (qh != NULL)) {
do {
/* clean any finished work for this qh */
- if (!list_empty (&qh->qtd_list)
- && qh->stamp != ehci->stamp) {
+ if (!list_empty(&qh->qtd_list) && (stopped ||
+ qh->stamp != ehci->stamp)) {
int temp;
/* unlinks could happen here; completion
* reporting drops the lock. rescan using
* the latest schedule, but don't rescan
- * qhs we already finished (no looping).
+ * qhs we already finished (no looping)
+ * unless the controller is stopped.
*/
qh = qh_get (qh);
qh->stamp = ehci->stamp;
@@ -1284,9 +1287,9 @@ rescan:
*/
if (list_empty(&qh->qtd_list)
&& qh->qh_state == QH_STATE_LINKED) {
- if (!ehci->reclaim
- && ((ehci->stamp - qh->stamp) & 0x1fff)
- >= (EHCI_SHRINK_FRAMES * 8))
+ if (!ehci->reclaim && (stopped ||
+ ((ehci->stamp - qh->stamp) & 0x1fff)
+ >= EHCI_SHRINK_FRAMES * 8))
start_unlink_async(ehci, qh);
else
action = TIMER_ASYNC_SHRINK;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 075/196] USB: fix formatting of SuperSpeed endpoints in /proc/bus/usb/devices
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (27 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 074/196] USB: EHCI: unlink unused QHs when the controller is stopped Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 076/196] USB: xhci - fix unsafe macro definitions Paul Gortmaker
` (120 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dmitry Torokhov, Greg Kroah-Hartman, Paul Gortmaker
From: Dmitry Torokhov <dtor@vmware.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 2868a2b1ba8f9c7f6c4170519ebb6c62934df70e upstream.
Isochronous and interrupt SuperSpeed endpoints use the same mechanisms
for decoding bInterval values as HighSpeed ones so adjust the code
accordingly.
Also bandwidth reservation for SuperSpeed matches highspeed, not
low/full speed.
Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/core/devices.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
index 19bc03a..7013296 100644
--- a/drivers/usb/core/devices.c
+++ b/drivers/usb/core/devices.c
@@ -219,7 +219,7 @@ static char *usb_dump_endpoint_descriptor(int speed, char *start, char *end,
break;
case USB_ENDPOINT_XFER_INT:
type = "Int.";
- if (speed == USB_SPEED_HIGH)
+ if (speed == USB_SPEED_HIGH || speed == USB_SPEED_SUPER)
interval = 1 << (desc->bInterval - 1);
else
interval = desc->bInterval;
@@ -227,7 +227,8 @@ static char *usb_dump_endpoint_descriptor(int speed, char *start, char *end,
default: /* "can't happen" */
return start;
}
- interval *= (speed == USB_SPEED_HIGH) ? 125 : 1000;
+ interval *= (speed == USB_SPEED_HIGH ||
+ speed == USB_SPEED_SUPER) ? 125 : 1000;
if (interval % 1000)
unit = 'u';
else {
@@ -537,8 +538,9 @@ static ssize_t usb_device_dump(char __user **buffer, size_t *nbytes,
if (level == 0) {
int max;
- /* high speed reserves 80%, full/low reserves 90% */
- if (usbdev->speed == USB_SPEED_HIGH)
+ /* super/high speed reserves 80%, full/low reserves 90% */
+ if (usbdev->speed == USB_SPEED_HIGH ||
+ usbdev->speed == USB_SPEED_SUPER)
max = 800;
else
max = FRAME_TIME_MAX_USECS_ALLOC;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 076/196] USB: xhci - fix unsafe macro definitions
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (28 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 075/196] USB: fix formatting of SuperSpeed endpoints in /proc/bus/usb/devices Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 077/196] USB: xhci - fix math in xhci_get_endpoint_interval() Paul Gortmaker
` (119 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dmitry Torokhov, Sarah Sharp, Paul Gortmaker
From: Dmitry Torokhov <dtor@vmware.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5a6c2f3ff039154872ce597952f8b8900ea0d732 upstream.
Macro arguments used in expressions need to be enclosed in parenthesis
to avoid unpleasant surprises.
This should be queued for kernels back to 2.6.31
Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/host/xhci.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index ea389e9..a51358b 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -232,7 +232,7 @@ struct xhci_op_regs {
* notification type that matches a bit set in this bit field.
*/
#define DEV_NOTE_MASK (0xffff)
-#define ENABLE_DEV_NOTE(x) (1 << x)
+#define ENABLE_DEV_NOTE(x) (1 << (x))
/* Most of the device notification types should only be used for debug.
* SW does need to pay attention to function wake notifications.
*/
@@ -579,11 +579,11 @@ struct xhci_ep_ctx {
#define EP_STATE_STOPPED 3
#define EP_STATE_ERROR 4
/* Mult - Max number of burtst within an interval, in EP companion desc. */
-#define EP_MULT(p) ((p & 0x3) << 8)
+#define EP_MULT(p) (((p) & 0x3) << 8)
/* bits 10:14 are Max Primary Streams */
/* bit 15 is Linear Stream Array */
/* Interval - period between requests to an endpoint - 125u increments. */
-#define EP_INTERVAL(p) ((p & 0xff) << 16)
+#define EP_INTERVAL(p) (((p) & 0xff) << 16)
#define EP_INTERVAL_TO_UFRAMES(p) (1 << (((p) >> 16) & 0xff))
/* ep_info2 bitmasks */
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 077/196] USB: xhci - fix math in xhci_get_endpoint_interval()
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (29 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 076/196] USB: xhci - fix unsafe macro definitions Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 16:20 ` Sarah Sharp
2012-03-13 0:19 ` [34-longterm 078/196] x86, cpu: Fix regression in AMD errata checking code Paul Gortmaker
` (118 subsequent siblings)
149 siblings, 1 reply; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dmitry Torokhov, Sarah Sharp, Paul Gortmaker
From: Dmitry Torokhov <dtor@vmware.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit dfa49c4ad120a784ef1ff0717168aa79f55a483a upstream.
When parsing exponent-expressed intervals we subtract 1 from the
value and then expect it to match with original + 1, which is
highly unlikely, and we end with frequent spew:
usb 3-4: ep 0x83 - rounding interval to 512 microframes
Also, parsing interval for fullspeed isochronous endpoints was
incorrect - according to USB spec they use exponent-based
intervals (but xHCI spec claims frame-based intervals). I trust
USB spec more, especially since USB core agrees with it.
This should be queued for stable kernels back to 2.6.31.
Reviewed-by: Micah Elizabeth Scott <micah@vmware.com>
Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/usb/host/xhci-mem.c | 90 +++++++++++++++++++++++++++++--------------
1 file changed, 62 insertions(+), 28 deletions(-)
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index e560dd4..e1dbcc2 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -520,6 +520,47 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
return 0;
}
+/*
+ * Convert interval expressed as 2^(bInterval - 1) == interval into
+ * straight exponent value 2^n == interval.
+ *
+ */
+static unsigned int xhci_parse_exponent_interval(struct usb_device *udev,
+ struct usb_host_endpoint *ep)
+{
+ unsigned int interval;
+
+ interval = clamp_val(ep->desc.bInterval, 1, 16) - 1;
+ if (interval != ep->desc.bInterval - 1)
+ dev_warn(&udev->dev,
+ "ep %#x - rounding interval to %d microframes\n",
+ ep->desc.bEndpointAddress,
+ 1 << interval);
+
+ return interval;
+}
+
+/*
+ * Convert bInterval expressed in frames (in 1-255 range) to exponent of
+ * microframes, rounded down to nearest power of 2.
+ */
+static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
+ struct usb_host_endpoint *ep)
+{
+ unsigned int interval;
+
+ interval = fls(8 * ep->desc.bInterval) - 1;
+ interval = clamp_val(interval, 3, 10);
+ if ((1 << interval) != 8 * ep->desc.bInterval)
+ dev_warn(&udev->dev,
+ "ep %#x - rounding interval to %d microframes, ep desc says %d microframes\n",
+ ep->desc.bEndpointAddress,
+ 1 << interval,
+ 8 * ep->desc.bInterval);
+
+ return interval;
+}
+
/* Return the polling or NAK interval.
*
* The polling interval is expressed in "microframes". If xHCI's Interval field
@@ -537,45 +578,38 @@ static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
case USB_SPEED_HIGH:
/* Max NAK rate */
if (usb_endpoint_xfer_control(&ep->desc) ||
- usb_endpoint_xfer_bulk(&ep->desc))
+ usb_endpoint_xfer_bulk(&ep->desc)) {
interval = ep->desc.bInterval;
+ break;
+ }
/* Fall through - SS and HS isoc/int have same decoding */
+
case USB_SPEED_SUPER:
if (usb_endpoint_xfer_int(&ep->desc) ||
- usb_endpoint_xfer_isoc(&ep->desc)) {
- if (ep->desc.bInterval == 0)
- interval = 0;
- else
- interval = ep->desc.bInterval - 1;
- if (interval > 15)
- interval = 15;
- if (interval != ep->desc.bInterval + 1)
- dev_warn(&udev->dev, "ep %#x - rounding interval to %d microframes\n",
- ep->desc.bEndpointAddress, 1 << interval);
+ usb_endpoint_xfer_isoc(&ep->desc)) {
+ interval = xhci_parse_exponent_interval(udev, ep);
}
break;
- /* Convert bInterval (in 1-255 frames) to microframes and round down to
- * nearest power of 2.
- */
+
case USB_SPEED_FULL:
+ if (usb_endpoint_xfer_int(&ep->desc)) {
+ interval = xhci_parse_exponent_interval(udev, ep);
+ break;
+ }
+ /*
+ * Fall through for isochronous endpoint interval decoding
+ * since it uses the same rules as low speed interrupt
+ * endpoints.
+ */
+
case USB_SPEED_LOW:
if (usb_endpoint_xfer_int(&ep->desc) ||
- usb_endpoint_xfer_isoc(&ep->desc)) {
- interval = fls(8*ep->desc.bInterval) - 1;
- if (interval > 10)
- interval = 10;
- if (interval < 3)
- interval = 3;
- if ((1 << interval) != 8*ep->desc.bInterval)
- dev_warn(&udev->dev,
- "ep %#x - rounding interval"
- " to %d microframes, "
- "ep desc says %d microframes\n",
- ep->desc.bEndpointAddress,
- 1 << interval,
- 8*ep->desc.bInterval);
+ usb_endpoint_xfer_isoc(&ep->desc)) {
+
+ interval = xhci_parse_frame_interval(udev, ep);
}
break;
+
default:
BUG();
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* Re: [34-longterm 077/196] USB: xhci - fix math in xhci_get_endpoint_interval()
2012-03-13 0:19 ` [34-longterm 077/196] USB: xhci - fix math in xhci_get_endpoint_interval() Paul Gortmaker
@ 2012-03-13 16:20 ` Sarah Sharp
2012-03-13 16:54 ` Paul Gortmaker
0 siblings, 1 reply; 209+ messages in thread
From: Sarah Sharp @ 2012-03-13 16:20 UTC (permalink / raw)
To: Paul Gortmaker; +Cc: stable, linux-kernel, stable-review, Dmitry Torokhov
This commit introduced a bug, so you will need this fix as well:
commit 340a3504fd39dad753ba908fb6f894ee81fc3ae2
Author: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Date: Mon Feb 13 14:42:11 2012 -0800
xhci: Fix encoding for HS bulk/control NAK rate.
The xHCI 0.96 spec says that HS bulk and control endpoint NAK rate must
be encoded as an exponent of two number of microframes. The endpoint
descriptor has the NAK rate encoded in number of microframes. We were
just copying the value from the endpoint descriptor into the endpoint
context interval field, which was not correct. This lead to the VIA
host rejecting the add of a bulk OUT endpoint from any USB 2.0 mass
storage device.
The fix is to use the correct encoding. Refactor the code to convert
number of frames to an exponential number of microframes, and make sure
we convert the number of microframes in HS bulk and control endpoints to
an exponent.
This should be back ported to kernels as old as 2.6.31, that contain the
commit dfa49c4ad120a784ef1ff0717168aa79f55a483a "USB: xhci - fix math
in xhci_get_endpoint_interval"
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Tested-by: Felipe Contreras <felipe.contreras@gmail.com>
Suggested-by: Andiry Xu <andiry.xu@amd.com>
Cc: stable@vger.kernel.org
Why are you hand-picking which of the xHCI commits marked for stable to
apply to this new 2.6.34 stable tree? On top of this patch, you're
probably missing twenty or so other required bug fix patches. I'm very
careful about saying which patches should apply to which stable kernels,
so it should be easy for you to go through the current -rc git log and
grep for changes to the xHCI driver that are marked for stable.
Sarah Sharp
On Mon, Mar 12, 2012 at 08:19:50PM -0400, Paul Gortmaker wrote:
> From: Dmitry Torokhov <dtor@vmware.com>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> If you see a problem with using this for longterm, please comment.
> -------------------
>
> commit dfa49c4ad120a784ef1ff0717168aa79f55a483a upstream.
>
> When parsing exponent-expressed intervals we subtract 1 from the
> value and then expect it to match with original + 1, which is
> highly unlikely, and we end with frequent spew:
>
> usb 3-4: ep 0x83 - rounding interval to 512 microframes
>
> Also, parsing interval for fullspeed isochronous endpoints was
> incorrect - according to USB spec they use exponent-based
> intervals (but xHCI spec claims frame-based intervals). I trust
> USB spec more, especially since USB core agrees with it.
>
> This should be queued for stable kernels back to 2.6.31.
>
> Reviewed-by: Micah Elizabeth Scott <micah@vmware.com>
> Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
> ---
> drivers/usb/host/xhci-mem.c | 90 +++++++++++++++++++++++++++++--------------
> 1 file changed, 62 insertions(+), 28 deletions(-)
>
> diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
> index e560dd4..e1dbcc2 100644
> --- a/drivers/usb/host/xhci-mem.c
> +++ b/drivers/usb/host/xhci-mem.c
> @@ -520,6 +520,47 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
> return 0;
> }
>
> +/*
> + * Convert interval expressed as 2^(bInterval - 1) == interval into
> + * straight exponent value 2^n == interval.
> + *
> + */
> +static unsigned int xhci_parse_exponent_interval(struct usb_device *udev,
> + struct usb_host_endpoint *ep)
> +{
> + unsigned int interval;
> +
> + interval = clamp_val(ep->desc.bInterval, 1, 16) - 1;
> + if (interval != ep->desc.bInterval - 1)
> + dev_warn(&udev->dev,
> + "ep %#x - rounding interval to %d microframes\n",
> + ep->desc.bEndpointAddress,
> + 1 << interval);
> +
> + return interval;
> +}
> +
> +/*
> + * Convert bInterval expressed in frames (in 1-255 range) to exponent of
> + * microframes, rounded down to nearest power of 2.
> + */
> +static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
> + struct usb_host_endpoint *ep)
> +{
> + unsigned int interval;
> +
> + interval = fls(8 * ep->desc.bInterval) - 1;
> + interval = clamp_val(interval, 3, 10);
> + if ((1 << interval) != 8 * ep->desc.bInterval)
> + dev_warn(&udev->dev,
> + "ep %#x - rounding interval to %d microframes, ep desc says %d microframes\n",
> + ep->desc.bEndpointAddress,
> + 1 << interval,
> + 8 * ep->desc.bInterval);
> +
> + return interval;
> +}
> +
> /* Return the polling or NAK interval.
> *
> * The polling interval is expressed in "microframes". If xHCI's Interval field
> @@ -537,45 +578,38 @@ static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
> case USB_SPEED_HIGH:
> /* Max NAK rate */
> if (usb_endpoint_xfer_control(&ep->desc) ||
> - usb_endpoint_xfer_bulk(&ep->desc))
> + usb_endpoint_xfer_bulk(&ep->desc)) {
> interval = ep->desc.bInterval;
> + break;
> + }
> /* Fall through - SS and HS isoc/int have same decoding */
> +
> case USB_SPEED_SUPER:
> if (usb_endpoint_xfer_int(&ep->desc) ||
> - usb_endpoint_xfer_isoc(&ep->desc)) {
> - if (ep->desc.bInterval == 0)
> - interval = 0;
> - else
> - interval = ep->desc.bInterval - 1;
> - if (interval > 15)
> - interval = 15;
> - if (interval != ep->desc.bInterval + 1)
> - dev_warn(&udev->dev, "ep %#x - rounding interval to %d microframes\n",
> - ep->desc.bEndpointAddress, 1 << interval);
> + usb_endpoint_xfer_isoc(&ep->desc)) {
> + interval = xhci_parse_exponent_interval(udev, ep);
> }
> break;
> - /* Convert bInterval (in 1-255 frames) to microframes and round down to
> - * nearest power of 2.
> - */
> +
> case USB_SPEED_FULL:
> + if (usb_endpoint_xfer_int(&ep->desc)) {
> + interval = xhci_parse_exponent_interval(udev, ep);
> + break;
> + }
> + /*
> + * Fall through for isochronous endpoint interval decoding
> + * since it uses the same rules as low speed interrupt
> + * endpoints.
> + */
> +
> case USB_SPEED_LOW:
> if (usb_endpoint_xfer_int(&ep->desc) ||
> - usb_endpoint_xfer_isoc(&ep->desc)) {
> - interval = fls(8*ep->desc.bInterval) - 1;
> - if (interval > 10)
> - interval = 10;
> - if (interval < 3)
> - interval = 3;
> - if ((1 << interval) != 8*ep->desc.bInterval)
> - dev_warn(&udev->dev,
> - "ep %#x - rounding interval"
> - " to %d microframes, "
> - "ep desc says %d microframes\n",
> - ep->desc.bEndpointAddress,
> - 1 << interval,
> - 8*ep->desc.bInterval);
> + usb_endpoint_xfer_isoc(&ep->desc)) {
> +
> + interval = xhci_parse_frame_interval(udev, ep);
> }
> break;
> +
> default:
> BUG();
> }
> --
> 1.7.9.3
>
^ permalink raw reply [flat|nested] 209+ messages in thread* Re: [34-longterm 077/196] USB: xhci - fix math in xhci_get_endpoint_interval()
2012-03-13 16:20 ` Sarah Sharp
@ 2012-03-13 16:54 ` Paul Gortmaker
0 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 16:54 UTC (permalink / raw)
To: Sarah Sharp; +Cc: stable, linux-kernel, Dmitry Torokhov
On 12-03-13 12:20 PM, Sarah Sharp wrote:
> This commit introduced a bug, so you will need this fix as well:
Thanks.
>
> commit 340a3504fd39dad753ba908fb6f894ee81fc3ae2
> Author: Sarah Sharp <sarah.a.sharp@linux.intel.com>
> Date: Mon Feb 13 14:42:11 2012 -0800
>
> xhci: Fix encoding for HS bulk/control NAK rate.
>
> The xHCI 0.96 spec says that HS bulk and control endpoint NAK rate must
> be encoded as an exponent of two number of microframes. The endpoint
> descriptor has the NAK rate encoded in number of microframes. We were
> just copying the value from the endpoint descriptor into the endpoint
> context interval field, which was not correct. This lead to the VIA
> host rejecting the add of a bulk OUT endpoint from any USB 2.0 mass
> storage device.
>
> The fix is to use the correct encoding. Refactor the code to convert
> number of frames to an exponential number of microframes, and make sure
> we convert the number of microframes in HS bulk and control endpoints to
> an exponent.
>
> This should be back ported to kernels as old as 2.6.31, that contain the
> commit dfa49c4ad120a784ef1ff0717168aa79f55a483a "USB: xhci - fix math
> in xhci_get_endpoint_interval"
>
> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
> Tested-by: Felipe Contreras <felipe.contreras@gmail.com>
> Suggested-by: Andiry Xu <andiry.xu@amd.com>
> Cc: stable@vger.kernel.org
>
> Why are you hand-picking which of the xHCI commits marked for stable to
> apply to this new 2.6.34 stable tree? On top of this patch, you're
I've been using the commits applied to 2.6.32.x versions as a reference.
I can't do a release with 1000 commits, so I have to chunkify things
somewhat, and doing roughly parallels of the individual 2.6.32.x releases
is a good starting point. Most times the commits for stable are independent
bugfixes chosen for high value and low risk of regression, so this typically
works fine. If there are dependencies and regressions in the xHCI stable
content that I should be trying to avoid, I'm fine with taking that input.
Paul.
> probably missing twenty or so other required bug fix patches. I'm very
> careful about saying which patches should apply to which stable kernels,
> so it should be easy for you to go through the current -rc git log and
> grep for changes to the xHCI driver that are marked for stable.
>
> Sarah Sharp
>
> On Mon, Mar 12, 2012 at 08:19:50PM -0400, Paul Gortmaker wrote:
>> From: Dmitry Torokhov <dtor@vmware.com>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> If you see a problem with using this for longterm, please comment.
>> -------------------
>>
>> commit dfa49c4ad120a784ef1ff0717168aa79f55a483a upstream.
>>
>> When parsing exponent-expressed intervals we subtract 1 from the
>> value and then expect it to match with original + 1, which is
>> highly unlikely, and we end with frequent spew:
>>
>> usb 3-4: ep 0x83 - rounding interval to 512 microframes
>>
>> Also, parsing interval for fullspeed isochronous endpoints was
>> incorrect - according to USB spec they use exponent-based
>> intervals (but xHCI spec claims frame-based intervals). I trust
>> USB spec more, especially since USB core agrees with it.
>>
>> This should be queued for stable kernels back to 2.6.31.
>>
>> Reviewed-by: Micah Elizabeth Scott <micah@vmware.com>
>> Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
>> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
>> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
>> ---
>> drivers/usb/host/xhci-mem.c | 90 +++++++++++++++++++++++++++++--------------
>> 1 file changed, 62 insertions(+), 28 deletions(-)
>>
>> diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
>> index e560dd4..e1dbcc2 100644
>> --- a/drivers/usb/host/xhci-mem.c
>> +++ b/drivers/usb/host/xhci-mem.c
>> @@ -520,6 +520,47 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
>> return 0;
>> }
>>
>> +/*
>> + * Convert interval expressed as 2^(bInterval - 1) == interval into
>> + * straight exponent value 2^n == interval.
>> + *
>> + */
>> +static unsigned int xhci_parse_exponent_interval(struct usb_device *udev,
>> + struct usb_host_endpoint *ep)
>> +{
>> + unsigned int interval;
>> +
>> + interval = clamp_val(ep->desc.bInterval, 1, 16) - 1;
>> + if (interval != ep->desc.bInterval - 1)
>> + dev_warn(&udev->dev,
>> + "ep %#x - rounding interval to %d microframes\n",
>> + ep->desc.bEndpointAddress,
>> + 1 << interval);
>> +
>> + return interval;
>> +}
>> +
>> +/*
>> + * Convert bInterval expressed in frames (in 1-255 range) to exponent of
>> + * microframes, rounded down to nearest power of 2.
>> + */
>> +static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
>> + struct usb_host_endpoint *ep)
>> +{
>> + unsigned int interval;
>> +
>> + interval = fls(8 * ep->desc.bInterval) - 1;
>> + interval = clamp_val(interval, 3, 10);
>> + if ((1 << interval) != 8 * ep->desc.bInterval)
>> + dev_warn(&udev->dev,
>> + "ep %#x - rounding interval to %d microframes, ep desc says %d microframes\n",
>> + ep->desc.bEndpointAddress,
>> + 1 << interval,
>> + 8 * ep->desc.bInterval);
>> +
>> + return interval;
>> +}
>> +
>> /* Return the polling or NAK interval.
>> *
>> * The polling interval is expressed in "microframes". If xHCI's Interval field
>> @@ -537,45 +578,38 @@ static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
>> case USB_SPEED_HIGH:
>> /* Max NAK rate */
>> if (usb_endpoint_xfer_control(&ep->desc) ||
>> - usb_endpoint_xfer_bulk(&ep->desc))
>> + usb_endpoint_xfer_bulk(&ep->desc)) {
>> interval = ep->desc.bInterval;
>> + break;
>> + }
>> /* Fall through - SS and HS isoc/int have same decoding */
>> +
>> case USB_SPEED_SUPER:
>> if (usb_endpoint_xfer_int(&ep->desc) ||
>> - usb_endpoint_xfer_isoc(&ep->desc)) {
>> - if (ep->desc.bInterval == 0)
>> - interval = 0;
>> - else
>> - interval = ep->desc.bInterval - 1;
>> - if (interval > 15)
>> - interval = 15;
>> - if (interval != ep->desc.bInterval + 1)
>> - dev_warn(&udev->dev, "ep %#x - rounding interval to %d microframes\n",
>> - ep->desc.bEndpointAddress, 1 << interval);
>> + usb_endpoint_xfer_isoc(&ep->desc)) {
>> + interval = xhci_parse_exponent_interval(udev, ep);
>> }
>> break;
>> - /* Convert bInterval (in 1-255 frames) to microframes and round down to
>> - * nearest power of 2.
>> - */
>> +
>> case USB_SPEED_FULL:
>> + if (usb_endpoint_xfer_int(&ep->desc)) {
>> + interval = xhci_parse_exponent_interval(udev, ep);
>> + break;
>> + }
>> + /*
>> + * Fall through for isochronous endpoint interval decoding
>> + * since it uses the same rules as low speed interrupt
>> + * endpoints.
>> + */
>> +
>> case USB_SPEED_LOW:
>> if (usb_endpoint_xfer_int(&ep->desc) ||
>> - usb_endpoint_xfer_isoc(&ep->desc)) {
>> - interval = fls(8*ep->desc.bInterval) - 1;
>> - if (interval > 10)
>> - interval = 10;
>> - if (interval < 3)
>> - interval = 3;
>> - if ((1 << interval) != 8*ep->desc.bInterval)
>> - dev_warn(&udev->dev,
>> - "ep %#x - rounding interval"
>> - " to %d microframes, "
>> - "ep desc says %d microframes\n",
>> - ep->desc.bEndpointAddress,
>> - 1 << interval,
>> - 8*ep->desc.bInterval);
>> + usb_endpoint_xfer_isoc(&ep->desc)) {
>> +
>> + interval = xhci_parse_frame_interval(udev, ep);
>> }
>> break;
>> +
>> default:
>> BUG();
>> }
>> --
>> 1.7.9.3
>>
^ permalink raw reply [flat|nested] 209+ messages in thread
* [34-longterm 078/196] x86, cpu: Fix regression in AMD errata checking code
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (30 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 077/196] USB: xhci - fix math in xhci_get_endpoint_interval() Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 079/196] net: ax25: fix information leak to userland harder Paul Gortmaker
` (117 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Hans Rosenfeld, H. Peter Anvin, Paul Gortmaker
From: Hans Rosenfeld <hans.rosenfeld@amd.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 07a7795ca2e6e66d00b184efb46bd0e23d90d3fe upstream.
A bug in the family-model-stepping matching code caused the presence of
errata to go undetected when OSVW was not used. This causes hangs on
some K8 systems because the E400 workaround is not enabled.
Signed-off-by: Hans Rosenfeld <hans.rosenfeld@amd.com>
LKML-Reference: <1282141190-930137-1-git-send-email-hans.rosenfeld@amd.com>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/kernel/cpu/amd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index dba9ca2..d618dc1 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -688,7 +688,7 @@ bool cpu_has_amd_erratum(const int *erratum)
}
/* OSVW unavailable or ID unknown, match family-model-stepping range */
- ms = (cpu->x86_model << 8) | cpu->x86_mask;
+ ms = (cpu->x86_model << 4) | cpu->x86_mask;
while ((range = *erratum++))
if ((cpu->x86 == AMD_MODEL_RANGE_FAMILY(range)) &&
(ms >= AMD_MODEL_RANGE_START(range)) &&
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 079/196] net: ax25: fix information leak to userland harder
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (31 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 078/196] x86, cpu: Fix regression in AMD errata checking code Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 080/196] next_pidmap: fix overflow condition Paul Gortmaker
` (116 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Kees Cook, David S. Miller, Paul Gortmaker
From: Kees Cook <kees.cook@canonical.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5b919f833d9d60588d026ad82d17f17e8872c7a9 upstream.
Commit fe10ae53384e48c51996941b7720ee16995cbcb7 adds a memset() to clear
the structure being sent back to userspace, but accidentally used the
wrong size.
Reported-by: Brad Spengler <spender@grsecurity.net>
Signed-off-by: Kees Cook <kees.cook@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/ax25/af_ax25.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index eb100ce..12c350c 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1392,7 +1392,7 @@ static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
ax25_cb *ax25;
int err = 0;
- memset(fsa, 0, sizeof(fsa));
+ memset(fsa, 0, sizeof(*fsa));
lock_sock(sk);
ax25 = ax25_sk(sk);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 080/196] next_pidmap: fix overflow condition
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (32 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 079/196] net: ax25: fix information leak to userland harder Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 081/196] proc: do proper range check on readdir offset Paul Gortmaker
` (115 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Linus Torvalds, Eric W. Biederman,
Pavel Emelyanov, Paul Gortmaker
From: Linus Torvalds <torvalds@linux-foundation.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit c78193e9c7bcbf25b8237ad0dec82f805c4ea69b upstream.
next_pidmap() just quietly accepted whatever 'last' pid that was passed
in, which is not all that safe when one of the users is /proc.
Admittedly the proc code should do some sanity checking on the range
(and that will be the next commit), but that doesn't mean that the
helper functions should just do that pidmap pointer arithmetic without
checking the range of its arguments.
So clamp 'last' to PID_MAX_LIMIT. The fact that we then do "last+1"
doesn't really matter, the for-loop does check against the end of the
pidmap array properly (it's only the actual pointer arithmetic overflow
case we need to worry about, and going one bit beyond isn't going to
overflow).
[ Use PID_MAX_LIMIT rather than pid_max as per Eric Biederman ]
Reported-by: Tavis Ormandy <taviso@cmpxchg8b.com>
Analyzed-by: Robert Święcki <robert@swiecki.net>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/linux/pid.h | 2 +-
kernel/pid.c | 5 ++++-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/include/linux/pid.h b/include/linux/pid.h
index 49f1c2f..ec9f2df 100644
--- a/include/linux/pid.h
+++ b/include/linux/pid.h
@@ -117,7 +117,7 @@ extern struct pid *find_vpid(int nr);
*/
extern struct pid *find_get_pid(int nr);
extern struct pid *find_ge_pid(int nr, struct pid_namespace *);
-int next_pidmap(struct pid_namespace *pid_ns, int last);
+int next_pidmap(struct pid_namespace *pid_ns, unsigned int last);
extern struct pid *alloc_pid(struct pid_namespace *ns);
extern void free_pid(struct pid *pid);
diff --git a/kernel/pid.c b/kernel/pid.c
index aebb30d..af8dbf7 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -183,11 +183,14 @@ static int alloc_pidmap(struct pid_namespace *pid_ns)
return -1;
}
-int next_pidmap(struct pid_namespace *pid_ns, int last)
+int next_pidmap(struct pid_namespace *pid_ns, unsigned int last)
{
int offset;
struct pidmap *map, *end;
+ if (last >= PID_MAX_LIMIT)
+ return -1;
+
offset = (last + 1) & BITS_PER_PAGE_MASK;
map = &pid_ns->pidmap[(last + 1)/BITS_PER_PAGE];
end = &pid_ns->pidmap[PIDMAP_ENTRIES];
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 081/196] proc: do proper range check on readdir offset
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (33 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 080/196] next_pidmap: fix overflow condition Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 082/196] can: Add missing socket check in can/bcm release Paul Gortmaker
` (114 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Linus Torvalds, Paul Gortmaker
From: Linus Torvalds <torvalds@linux-foundation.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit d8bdc59f215e62098bc5b4256fd9928bf27053a1 upstream.
Rather than pass in some random truncated offset to the pid-related
functions, check that the offset is in range up-front.
This is just cleanup, the previous commit fixed the real problem.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/proc/base.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 8418fcc..268f00d 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2871,11 +2871,16 @@ static int proc_pid_fill_cache(struct file *filp, void *dirent, filldir_t filldi
/* for the /proc/ directory itself, after non-process stuff has been done */
int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
{
- unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
- struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
+ unsigned int nr;
+ struct task_struct *reaper;
struct tgid_iter iter;
struct pid_namespace *ns;
+ if (filp->f_pos >= PID_MAX_LIMIT + TGID_OFFSET)
+ goto out_no_task;
+ nr = filp->f_pos - FIRST_PROCESS_ENTRY;
+
+ reaper = get_proc_task(filp->f_path.dentry->d_inode);
if (!reaper)
goto out_no_task;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 082/196] can: Add missing socket check in can/bcm release.
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (34 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 081/196] proc: do proper range check on readdir offset Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 083/196] can: add missing socket check in can/raw release Paul Gortmaker
` (113 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dave Jones, David S. Miller, Paul Gortmaker
From: Dave Jones <davej@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit c6914a6f261aca0c9f715f883a353ae7ff51fe83 upstream.
We can get here with a NULL socket argument passed from userspace,
so we need to handle it accordingly.
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/can/bcm.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index dd23fb1..a6445fd 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1426,9 +1426,14 @@ static int bcm_init(struct sock *sk)
static int bcm_release(struct socket *sock)
{
struct sock *sk = sock->sk;
- struct bcm_sock *bo = bcm_sk(sk);
+ struct bcm_sock *bo;
struct bcm_op *op, *next;
+ if (sk == NULL)
+ return 0;
+
+ bo = bcm_sk(sk);
+
/* remove bcm_ops, timer, rx_unregister(), etc. */
unregister_netdevice_notifier(&bo->notifier);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 083/196] can: add missing socket check in can/raw release
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (35 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 082/196] can: Add missing socket check in can/bcm release Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 084/196] nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab (v3) Paul Gortmaker
` (112 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Oliver Hartkopp, David S. Miller, Paul Gortmaker
From: Oliver Hartkopp <socketcan@hartkopp.net>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 10022a6c66e199d8f61d9044543f38785713cbbd upstream.
v2: added space after 'if' according code style.
We can get here with a NULL socket argument passed from userspace,
so we need to handle it accordingly.
Thanks to Dave Jones pointing at this issue in net/can/bcm.c
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/can/raw.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/net/can/raw.c b/net/can/raw.c
index da99cf1..9dd45ea 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -281,7 +281,12 @@ static int raw_init(struct sock *sk)
static int raw_release(struct socket *sock)
{
struct sock *sk = sock->sk;
- struct raw_sock *ro = raw_sk(sk);
+ struct raw_sock *ro;
+
+ if (!sk)
+ return 0;
+
+ ro = raw_sk(sk);
unregister_netdevice_notifier(&ro->notifier);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 084/196] nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab (v3)
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (36 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 083/196] can: add missing socket check in can/raw release Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 085/196] ath: add missing regdomain pair 0x5c mapping Paul Gortmaker
` (111 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Neil Horman, Trond Myklebust, security,
Jeff Layton, Linus Torvalds, Paul Gortmaker
From: Neil Horman <nhorman@tuxdriver.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit e9e3d724e2145f5039b423c290ce2b2c3d8f94bc upstream.
The "bad_page()" page allocator sanity check was reported recently (call
chain as follows):
bad_page+0x69/0x91
free_hot_cold_page+0x81/0x144
skb_release_data+0x5f/0x98
__kfree_skb+0x11/0x1a
tcp_ack+0x6a3/0x1868
tcp_rcv_established+0x7a6/0x8b9
tcp_v4_do_rcv+0x2a/0x2fa
tcp_v4_rcv+0x9a2/0x9f6
do_timer+0x2df/0x52c
ip_local_deliver+0x19d/0x263
ip_rcv+0x539/0x57c
netif_receive_skb+0x470/0x49f
:virtio_net:virtnet_poll+0x46b/0x5c5
net_rx_action+0xac/0x1b3
__do_softirq+0x89/0x133
call_softirq+0x1c/0x28
do_softirq+0x2c/0x7d
do_IRQ+0xec/0xf5
default_idle+0x0/0x50
ret_from_intr+0x0/0xa
default_idle+0x29/0x50
cpu_idle+0x95/0xb8
start_kernel+0x220/0x225
_sinittext+0x22f/0x236
It occurs because an skb with a fraglist was freed from the tcp
retransmit queue when it was acked, but a page on that fraglist had
PG_Slab set (indicating it was allocated from the Slab allocator (which
means the free path above can't safely free it via put_page.
We tracked this back to an nfsv4 setacl operation, in which the nfs code
attempted to fill convert the passed in buffer to an array of pages in
__nfs4_proc_set_acl, which gets used by the skb->frags list in
xs_sendpages. __nfs4_proc_set_acl just converts each page in the buffer
to a page struct via virt_to_page, but the vfs allocates the buffer via
kmalloc, meaning the PG_slab bit is set. We can't create a buffer with
kmalloc and free it later in the tcp ack path with put_page, so we need
to either:
1) ensure that when we create the list of pages, no page struct has
PG_Slab set
or
2) not use a page list to send this data
Given that these buffers can be multiple pages and arbitrarily sized, I
think (1) is the right way to go. I've written the below patch to
allocate a page from the buddy allocator directly and copy the data over
to it. This ensures that we have a put_page free-able page for every
entry that winds up on an skb frag list, so it can be safely freed when
the frame is acked. We do a put page on each entry after the
rpc_call_sync call so as to drop our own reference count to the page,
leaving only the ref count taken by tcp_sendpages. This way the data
will be properly freed when the ack comes in
Successfully tested by myself to solve the above oops.
Note, as this is the result of a setacl operation that exceeded a page
of data, I think this amounts to a local DOS triggerable by an
uprivlidged user, so I'm CCing security on this as well.
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: Trond Myklebust <Trond.Myklebust@netapp.com>
CC: security@kernel.org
CC: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfs/nfs4proc.c | 44 ++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 42 insertions(+), 2 deletions(-)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 071fced..5b33856 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -49,6 +49,7 @@
#include <linux/mount.h>
#include <linux/module.h>
#include <linux/sunrpc/bc_xprt.h>
+#include <linux/mm.h>
#include "nfs4_fs.h"
#include "delegation.h"
@@ -3241,6 +3242,35 @@ static void buf_to_pages(const void *buf, size_t buflen,
}
}
+static int buf_to_pages_noslab(const void *buf, size_t buflen,
+ struct page **pages, unsigned int *pgbase)
+{
+ struct page *newpage, **spages;
+ int rc = 0;
+ size_t len;
+ spages = pages;
+
+ do {
+ len = min(PAGE_CACHE_SIZE, buflen);
+ newpage = alloc_page(GFP_KERNEL);
+
+ if (newpage == NULL)
+ goto unwind;
+ memcpy(page_address(newpage), buf, len);
+ buf += len;
+ buflen -= len;
+ *pages++ = newpage;
+ rc++;
+ } while (buflen != 0);
+
+ return rc;
+
+unwind:
+ for(; rc > 0; rc--)
+ __free_page(spages[rc-1]);
+ return -ENOMEM;
+}
+
struct nfs4_cached_acl {
int cached;
size_t len;
@@ -3407,13 +3437,23 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t bufl
.rpc_argp = &arg,
.rpc_resp = &res,
};
- int ret;
+ int ret, i;
if (!nfs4_server_supports_acls(server))
return -EOPNOTSUPP;
+ i = buf_to_pages_noslab(buf, buflen, arg.acl_pages, &arg.acl_pgbase);
+ if (i < 0)
+ return i;
nfs_inode_return_delegation(inode);
- buf_to_pages(buf, buflen, arg.acl_pages, &arg.acl_pgbase);
ret = nfs4_call_sync(server, &msg, &arg, &res, 1);
+
+ /*
+ * Free each page after tx, so the only ref left is
+ * held by the network stack
+ */
+ for (; i > 0; i--)
+ put_page(pages[i-1]);
+
nfs_access_zap_cache(inode);
nfs_zap_acl_cache(inode);
return ret;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 085/196] ath: add missing regdomain pair 0x5c mapping
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (37 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 084/196] nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab (v3) Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 086/196] block, blk-sysfs: Fix an err return path in blk_register_queue() Paul Gortmaker
` (110 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Christian Lamparter, John W. Linville, Paul Gortmaker
From: Christian Lamparter <chunkeey@googlemail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit bd39a274fb7b43374c797bafdb7f506598f36f77 upstream.
Joe Culler reported a problem with his AR9170 device:
> ath: EEPROM regdomain: 0x5c
> ath: EEPROM indicates we should expect a direct regpair map
> ath: invalid regulatory domain/country code 0x5c
> ath: Invalid EEPROM contents
It turned out that the regdomain 'APL7_FCCA' was not mapped yet.
According to Luis R. Rodriguez [Atheros' engineer] APL7 maps to
FCC_CTL and FCCA maps to FCC_CTL as well, so the attached patch
should be correct.
Reported-by: Joe Culler <joe.culler@gmail.com>
Acked-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/wireless/ath/regd_common.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/regd_common.h b/drivers/net/wireless/ath/regd_common.h
index 248c670..5c2cfe6 100644
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -195,6 +195,7 @@ static struct reg_dmn_pair_mapping regDomainPairs[] = {
{APL9_WORLD, CTL_ETSI, CTL_ETSI},
{APL3_FCCA, CTL_FCC, CTL_FCC},
+ {APL7_FCCA, CTL_FCC, CTL_FCC},
{APL1_ETSIC, CTL_FCC, CTL_ETSI},
{APL2_ETSIC, CTL_FCC, CTL_ETSI},
{APL2_APLD, CTL_FCC, NO_CTL},
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 086/196] block, blk-sysfs: Fix an err return path in blk_register_queue()
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (38 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 085/196] ath: add missing regdomain pair 0x5c mapping Paul Gortmaker
@ 2012-03-13 0:19 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 087/196] p54: Initialize extra_len in p54_tx_80211 Paul Gortmaker
` (109 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:19 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Liu Yuan, Jens Axboe, Paul Gortmaker
From: Liu Yuan <tailai.ly@taobao.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit ed5302d3c25006a9edc7a7fbea97a30483f89ef7 upstream.
We do not call blk_trace_remove_sysfs() in err return path
if kobject_add() fails. This path fixes it.
Signed-off-by: Liu Yuan <tailai.ly@taobao.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
block/blk-sysfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index d246654..3eede79 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -502,8 +502,10 @@ int blk_register_queue(struct gendisk *disk)
return ret;
ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue");
- if (ret < 0)
+ if (ret < 0) {
+ blk_trace_remove_sysfs(dev);
return ret;
+ }
kobject_uevent(&q->kobj, KOBJ_ADD);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 087/196] p54: Initialize extra_len in p54_tx_80211
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (39 preceding siblings ...)
2012-03-13 0:19 ` [34-longterm 086/196] block, blk-sysfs: Fix an err return path in blk_register_queue() Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 088/196] intel-iommu: Unlink domain from iommu Paul Gortmaker
` (108 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jason Conti, John W. Linville, Paul Gortmaker
From: Jason Conti <jason.conti@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit a6756da9eace8b4af73e9dea43f1fc2889224c94 upstream.
This patch fixes a very serious off-by-one bug in
the driver, which could leave the device in an
unresponsive state.
The problem was that the extra_len variable [used to
reserve extra scratch buffer space for the firmware]
was left uninitialized. Because p54_assign_address
later needs the value to reserve additional space,
the resulting frame could be to big for the small
device's memory window and everything would
immediately come to a grinding halt.
Reference: https://bugs.launchpad.net/bugs/722185
Acked-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: Jason Conti <jason.conti@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/wireless/p54/txrx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index db89d65..8db2132 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -703,7 +703,7 @@ int p54_tx_80211(struct ieee80211_hw *dev, struct sk_buff *skb)
struct p54_tx_info *p54info;
struct p54_hdr *hdr;
struct p54_tx_data *txhdr;
- unsigned int padding, len, extra_len;
+ unsigned int padding, len, extra_len = 0;
int i, j, ridx;
u16 hdr_flags = 0, aid = 0;
u8 rate, queue = 0, crypt_offset = 0;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 088/196] intel-iommu: Unlink domain from iommu
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (40 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 087/196] p54: Initialize extra_len in p54_tx_80211 Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 089/196] intel-iommu: Fix get_domain_for_dev() error path Paul Gortmaker
` (107 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Alex Williamson, David Woodhouse, Paul Gortmaker
From: Alex Williamson <alex.williamson@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit a97590e56d0d58e1dd262353f7cbd84e81d8e600 upstream.
When we remove a device, we unlink the iommu from the domain, but
we never do the reverse unlinking of the domain from the iommu.
This means that we never clear iommu->domain_ids, eventually leading
to resource exhaustion if we repeatedly bind and unbind a device
to a driver. Also free empty domains to avoid a resource leak.
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Acked-by: Donald Dutile <ddutile@redhat.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/pci/intel-iommu.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 3507692..62e92e5 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -3261,9 +3261,15 @@ static int device_notifier(struct notifier_block *nb,
if (!domain)
return 0;
- if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through)
+ if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through) {
domain_remove_one_dev_info(domain, pdev);
+ if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
+ !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
+ list_empty(&domain->devices))
+ domain_exit(domain);
+ }
+
return 0;
}
@@ -3412,6 +3418,11 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain,
domain->iommu_count--;
domain_update_iommu_cap(domain);
spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags);
+
+ spin_lock_irqsave(&iommu->lock, tmp_flags);
+ clear_bit(domain->id, iommu->domain_ids);
+ iommu->domains[domain->id] = NULL;
+ spin_unlock_irqrestore(&iommu->lock, tmp_flags);
}
spin_unlock_irqrestore(&device_domain_lock, flags);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 089/196] intel-iommu: Fix get_domain_for_dev() error path
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (41 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 088/196] intel-iommu: Unlink domain from iommu Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 090/196] drm/radeon/kms: fix bad shift in atom iio table parser Paul Gortmaker
` (106 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Alex Williamson, David Woodhouse, Paul Gortmaker
From: Alex Williamson <alex.williamson@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 2fe9723df8e45fd247782adea244a5e653c30bf4 upstream.
If we run out of domain_ids and fail iommu_attach_domain(), we
fall into domain_exit() without having setup enough of the
domain structure for this to do anything useful. In fact, it
typically runs off into the weeds walking the bogus domain->devices
list. Just free the domain.
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Acked-by: Donald Dutile <ddutile@redhat.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/pci/intel-iommu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 62e92e5..2b985b9 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -1848,7 +1848,7 @@ static struct dmar_domain *get_domain_for_dev(struct pci_dev *pdev, int gaw)
ret = iommu_attach_domain(domain, iommu);
if (ret) {
- domain_exit(domain);
+ free_domain_mem(domain);
goto error;
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 090/196] drm/radeon/kms: fix bad shift in atom iio table parser
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (42 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 089/196] intel-iommu: Fix get_domain_for_dev() error path Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 091/196] NFS: nfs_wcc_update_inode() should set nfsi->attr_gencount Paul Gortmaker
` (105 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Alex Deucher, Dave Airlie, Paul Gortmaker
From: Alex Deucher <alexdeucher@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 8e461123f28e6b17456225e70eb834b3b30d28bb upstream.
Noticed by Patrick Lowry.
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/gpu/drm/radeon/atom.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 1d56983..b913bf1 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -131,7 +131,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
case ATOM_IIO_MOVE_INDEX:
temp &=
~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
- CU8(base + 2));
+ CU8(base + 3));
temp |=
((index >> CU8(base + 2)) &
(0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
@@ -141,7 +141,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
case ATOM_IIO_MOVE_DATA:
temp &=
~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
- CU8(base + 2));
+ CU8(base + 3));
temp |=
((data >> CU8(base + 2)) &
(0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
@@ -151,7 +151,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
case ATOM_IIO_MOVE_ATTR:
temp &=
~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
- CU8(base + 2));
+ CU8(base + 3));
temp |=
((ctx->
io_attr >> CU8(base + 2)) & (0xFFFFFFFF >> (32 -
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 091/196] NFS: nfs_wcc_update_inode() should set nfsi->attr_gencount
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (43 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 090/196] drm/radeon/kms: fix bad shift in atom iio table parser Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 092/196] serial/imx: read cts state only after acking cts change irq Paul Gortmaker
` (104 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Trond Myklebust, Paul Gortmaker
From: Trond Myklebust <Trond.Myklebust@netapp.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 27dc1cd3ad9300f81e1219e5fc305d91d85353f8 upstream.
If the call to nfs_wcc_update_inode() results in an attribute update, we
need to ensure that the inode's attr_gencount gets bumped too, otherwise
we are not protected against races with other GETATTR calls.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfs/inode.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 50a56ed..b0299c0 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -793,9 +793,10 @@ out:
return ret;
}
-static void nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
{
struct nfs_inode *nfsi = NFS_I(inode);
+ unsigned long ret = 0;
if ((fattr->valid & NFS_ATTR_FATTR_PRECHANGE)
&& (fattr->valid & NFS_ATTR_FATTR_CHANGE)
@@ -803,25 +804,32 @@ static void nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
nfsi->change_attr = fattr->change_attr;
if (S_ISDIR(inode->i_mode))
nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+ ret |= NFS_INO_INVALID_ATTR;
}
/* If we have atomic WCC data, we may update some attributes */
if ((fattr->valid & NFS_ATTR_FATTR_PRECTIME)
&& (fattr->valid & NFS_ATTR_FATTR_CTIME)
- && timespec_equal(&inode->i_ctime, &fattr->pre_ctime))
- memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
+ && timespec_equal(&inode->i_ctime, &fattr->pre_ctime)) {
+ memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
+ ret |= NFS_INO_INVALID_ATTR;
+ }
if ((fattr->valid & NFS_ATTR_FATTR_PREMTIME)
&& (fattr->valid & NFS_ATTR_FATTR_MTIME)
&& timespec_equal(&inode->i_mtime, &fattr->pre_mtime)) {
- memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
- if (S_ISDIR(inode->i_mode))
- nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+ memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
+ if (S_ISDIR(inode->i_mode))
+ nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+ ret |= NFS_INO_INVALID_ATTR;
}
if ((fattr->valid & NFS_ATTR_FATTR_PRESIZE)
&& (fattr->valid & NFS_ATTR_FATTR_SIZE)
&& i_size_read(inode) == nfs_size_to_loff_t(fattr->pre_size)
- && nfsi->npages == 0)
- i_size_write(inode, nfs_size_to_loff_t(fattr->size));
+ && nfsi->npages == 0) {
+ i_size_write(inode, nfs_size_to_loff_t(fattr->size));
+ ret |= NFS_INO_INVALID_ATTR;
+ }
+ return ret;
}
/**
@@ -1115,7 +1123,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
| NFS_INO_REVAL_PAGECACHE);
/* Do atomic weak cache consistency updates */
- nfs_wcc_update_inode(inode, fattr);
+ invalid |= nfs_wcc_update_inode(inode, fattr);
/* More cache consistency checks */
if (fattr->valid & NFS_ATTR_FATTR_CHANGE) {
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 092/196] serial/imx: read cts state only after acking cts change irq
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (44 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 091/196] NFS: nfs_wcc_update_inode() should set nfsi->attr_gencount Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 093/196] ASoC: Fix output PGA enabling in wm_hubs CODECs Paul Gortmaker
` (103 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Uwe Kleine-König, Greg Kroah-Hartman, Paul Gortmaker
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5680e94148a86e8c31fdc5cb0ea0d5c6810c05b0 upstream.
If cts changes between reading the level at the cts input (USR1_RTSS)
and acking the irq (USR1_RTSD) the last edge doesn't generate an irq and
uart_handle_cts_change is called with a outdated value for cts.
The race was introduced by commit
ceca629 ([ARM] 2971/1: i.MX uart handle rts irq)
[PG: file in drivers/serial not drivers/tty/serial in .34]
Reported-by: Arwed Springer <Arwed.Springer@de.trumpf.com>
Tested-by: Arwed Springer <Arwed.Springer@de.trumpf.com>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/serial/imx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index eacb588..6d2028e 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -383,12 +383,13 @@ static void imx_start_tx(struct uart_port *port)
static irqreturn_t imx_rtsint(int irq, void *dev_id)
{
struct imx_port *sport = dev_id;
- unsigned int val = readl(sport->port.membase + USR1) & USR1_RTSS;
+ unsigned int val;
unsigned long flags;
spin_lock_irqsave(&sport->port.lock, flags);
writel(USR1_RTSD, sport->port.membase + USR1);
+ val = readl(sport->port.membase + USR1) & USR1_RTSS;
uart_handle_cts_change(&sport->port, !!val);
wake_up_interruptible(&sport->port.state->port.delta_msr_wait);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 093/196] ASoC: Fix output PGA enabling in wm_hubs CODECs
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (45 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 092/196] serial/imx: read cts state only after acking cts change irq Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 094/196] kconfig: Avoid buffer underrun in choice input Paul Gortmaker
` (102 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Mark Brown, Paul Gortmaker
From: Mark Brown <broonie@opensource.wolfsonmicro.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 39cca168bdfaef9d0c496ec27f292445d6184946 upstream.
The output PGA was not being powered up in headphone and speaker paths,
removing the ability to offer volume control and mute with the output
PGA.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/soc/codecs/wm_hubs.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
index e1f225a..db6122f 100644
--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -701,12 +701,12 @@ static const struct snd_soc_dapm_route analogue_routes[] = {
{ "SPKL", "Input Switch", "MIXINL" },
{ "SPKL", "IN1LP Switch", "IN1LP" },
- { "SPKL", "Output Switch", "Left Output Mixer" },
+ { "SPKL", "Output Switch", "Left Output PGA" },
{ "SPKL", NULL, "TOCLK" },
{ "SPKR", "Input Switch", "MIXINR" },
{ "SPKR", "IN1RP Switch", "IN1RP" },
- { "SPKR", "Output Switch", "Right Output Mixer" },
+ { "SPKR", "Output Switch", "Right Output PGA" },
{ "SPKR", NULL, "TOCLK" },
{ "SPKL Boost", "Direct Voice Switch", "Direct Voice" },
@@ -728,8 +728,8 @@ static const struct snd_soc_dapm_route analogue_routes[] = {
{ "SPKOUTRP", NULL, "SPKR Driver" },
{ "SPKOUTRN", NULL, "SPKR Driver" },
- { "Left Headphone Mux", "Mixer", "Left Output Mixer" },
- { "Right Headphone Mux", "Mixer", "Right Output Mixer" },
+ { "Left Headphone Mux", "Mixer", "Left Output PGA" },
+ { "Right Headphone Mux", "Mixer", "Right Output PGA" },
{ "Headphone PGA", NULL, "Left Headphone Mux" },
{ "Headphone PGA", NULL, "Right Headphone Mux" },
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 094/196] kconfig: Avoid buffer underrun in choice input
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (46 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 093/196] ASoC: Fix output PGA enabling in wm_hubs CODECs Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 095/196] UBIFS: fix master node recovery Paul Gortmaker
` (101 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Ben Hutchings, Linus Torvalds, Paul Gortmaker
From: Ben Hutchings <ben@decadent.org.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 3ba41621156681afcdbcd624e3191cbc65eb94f4 upstream.
Commit 40aee729b350 ('kconfig: fix default value for choice input')
fixed some cases where kconfig would select the wrong option from a
choice with a single valid option and thus enter an infinite loop.
However, this broke the test for user input of the form 'N?', because
when kconfig selects the single valid option the input is zero-length
and the test will read the byte before the input buffer. If this
happens to contain '?' (as it will in a mips build on Debian unstable
today) then kconfig again enters an infinite loop.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
scripts/kconfig/conf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index 9960d1c..7f97e3f 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -330,7 +330,7 @@ static int conf_choice(struct menu *menu)
}
if (!child)
continue;
- if (line[strlen(line) - 1] == '?') {
+ if (line[0] && line[strlen(line) - 1] == '?') {
print_help(child);
continue;
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 095/196] UBIFS: fix master node recovery
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (47 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 094/196] kconfig: Avoid buffer underrun in choice input Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 096/196] Remove extra struct page member from the buffer info structure Paul Gortmaker
` (100 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Artem Bityutskiy, Paul Gortmaker
From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 6e0d9fd38b750d678bf9fd07db23582f52fafa55 upstream.
This patch fixes the following symptoms:
1. Unmount UBIFS cleanly.
2. Start mounting UBIFS R/W and have a power cut immediately
3. Start mounting UBIFS R/O, this succeeds
4. Try to re-mount UBIFS R/W - this fails immediately or later on,
because UBIFS will write the master node to the flash area
which has been written before.
The analysis of the problem:
1. UBIFS is unmounted cleanly, both copies of the master node are clean.
2. UBIFS is being mounter R/W, starts changing master node copy 1, and
a power cut happens. The copy N1 becomes corrupted.
3. UBIFS is being mounted R/O. It notices the copy N1 is corrupted and
reads copy N2. Copy N2 is clean.
4. Because of R/O mode, UBIFS cannot recover copy 1.
5. The mount code (ubifs_mount()) sees that the master node is clean,
so it decides that no recovery is needed.
6. We are re-mounting R/W. UBIFS believes no recovery is needed and
starts updating the master node, but copy N1 is still corrupted
and was not recovered!
Fix this problem by marking the master node as dirty every time we
recover it and we are in R/O mode. This forces further recovery and
the UBIFS cleans-up the corruptions and recovers the copy N1 when
re-mounting R/W later.
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/ubifs/recovery.c | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c
index 109c6ea..b712ed6 100644
--- a/fs/ubifs/recovery.c
+++ b/fs/ubifs/recovery.c
@@ -300,6 +300,32 @@ int ubifs_recover_master_node(struct ubifs_info *c)
goto out_free;
}
memcpy(c->rcvrd_mst_node, c->mst_node, UBIFS_MST_NODE_SZ);
+
+ /*
+ * We had to recover the master node, which means there was an
+ * unclean reboot. However, it is possible that the master node
+ * is clean at this point, i.e., %UBIFS_MST_DIRTY is not set.
+ * E.g., consider the following chain of events:
+ *
+ * 1. UBIFS was cleanly unmounted, so the master node is clean
+ * 2. UBIFS is being mounted R/W and starts changing the master
+ * node in the first (%UBIFS_MST_LNUM). A power cut happens,
+ * so this LEB ends up with some amount of garbage at the
+ * end.
+ * 3. UBIFS is being mounted R/O. We reach this place and
+ * recover the master node from the second LEB
+ * (%UBIFS_MST_LNUM + 1). But we cannot update the media
+ * because we are being mounted R/O. We have to defer the
+ * operation.
+ * 4. However, this master node (@c->mst_node) is marked as
+ * clean (since the step 1). And if we just return, the
+ * mount code will be confused and won't recover the master
+ * node when it is re-mounter R/W later.
+ *
+ * Thus, to force the recovery by marking the master node as
+ * dirty.
+ */
+ c->mst_node->flags |= cpu_to_le32(UBIFS_MST_DIRTY);
} else {
/* Write the recovered master node */
c->max_sqnum = le64_to_cpu(mst->ch.sqnum) - 1;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 096/196] Remove extra struct page member from the buffer info structure
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (48 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 095/196] UBIFS: fix master node recovery Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 097/196] dasd: correct device table Paul Gortmaker
` (99 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Greg Rose, Jeff Kirsher, Paul Gortmaker
From: Greg Rose <gregory.v.rose@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b1d670f10e8078485884f0cf7e384d890909aeaa upstream.
declaration.
Reported-by: Andi Kleen <andi@firstfloor.org>
Signed-off-by: Greg Rose <gregory.v.rose@intel.com>
Tested-by: Emil Tantilov <emil.s.tantilov@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/igbvf/igbvf.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/igbvf/igbvf.h b/drivers/net/igbvf/igbvf.h
index debeee2..f7ae284 100644
--- a/drivers/net/igbvf/igbvf.h
+++ b/drivers/net/igbvf/igbvf.h
@@ -126,7 +126,6 @@ struct igbvf_buffer {
unsigned int page_offset;
};
};
- struct page *page;
};
union igbvf_desc {
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 097/196] dasd: correct device table
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (49 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 096/196] Remove extra struct page member from the buffer info structure Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 098/196] iwlagn: Support new 5000 microcode Paul Gortmaker
` (98 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Stefan Haberland, Martin Schwidefsky, Paul Gortmaker
From: Stefan Haberland <stefan.haberland@de.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5da24b7627ff821e154a3aaecd5d60e1d8e228a5 upstream.
The 3880 storage control unit supports a 3380 device
type, but not a 3390 device type.
Reported-by: Stephen Powell <zlinuxman@wowway.com>
Signed-off-by: Stefan Haberland <stefan.haberland@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/s390/block/dasd_eckd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 0cb2331..7d05fe5 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -63,7 +63,7 @@ static struct dasd_discipline dasd_eckd_discipline;
static struct ccw_device_id dasd_eckd_ids[] = {
{ CCW_DEVICE_DEVTYPE (0x3990, 0, 0x3390, 0), .driver_info = 0x1},
{ CCW_DEVICE_DEVTYPE (0x2105, 0, 0x3390, 0), .driver_info = 0x2},
- { CCW_DEVICE_DEVTYPE (0x3880, 0, 0x3390, 0), .driver_info = 0x3},
+ { CCW_DEVICE_DEVTYPE (0x3880, 0, 0x3380, 0), .driver_info = 0x3},
{ CCW_DEVICE_DEVTYPE (0x3990, 0, 0x3380, 0), .driver_info = 0x4},
{ CCW_DEVICE_DEVTYPE (0x2105, 0, 0x3380, 0), .driver_info = 0x5},
{ CCW_DEVICE_DEVTYPE (0x9343, 0, 0x9345, 0), .driver_info = 0x6},
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 098/196] iwlagn: Support new 5000 microcode.
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (50 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 097/196] dasd: correct device table Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 16:24 ` Bjørn Mork
2012-03-13 0:20 ` [34-longterm 099/196] slub: fix panic with DISCONTIGMEM Paul Gortmaker
` (97 subsequent siblings)
149 siblings, 1 reply; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Fry, Donald H, Wey-Yi Guy, Paul Gortmaker
From: "Fry, Donald H" <donald.h.fry@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 41504cce240f791f1e16561db95728c5537fbad9 upstream.
New iwlwifi-5000 microcode requires driver support for API version 5.
Signed-off-by: Don Fry <donald.h.fry@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/wireless/iwlwifi/iwl-5000.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index d05fad4..dc191b8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -48,7 +48,7 @@
#include "iwl-6000-hw.h"
/* Highest firmware API version supported */
-#define IWL5000_UCODE_API_MAX 2
+#define IWL5000_UCODE_API_MAX 5
#define IWL5150_UCODE_API_MAX 2
/* Lowest firmware API version supported */
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* Re: [34-longterm 098/196] iwlagn: Support new 5000 microcode.
2012-03-13 0:20 ` [34-longterm 098/196] iwlagn: Support new 5000 microcode Paul Gortmaker
@ 2012-03-13 16:24 ` Bjørn Mork
2012-03-13 16:56 ` Paul Gortmaker
0 siblings, 1 reply; 209+ messages in thread
From: Bjørn Mork @ 2012-03-13 16:24 UTC (permalink / raw)
To: Paul Gortmaker
Cc: stable, linux-kernel, stable-review, Fry, Donald H, Wey-Yi Guy
Paul Gortmaker <paul.gortmaker@windriver.com> writes:
> From: "Fry, Donald H" <donald.h.fry@intel.com>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> If you see a problem with using this for longterm, please comment.
> -------------------
>
> commit 41504cce240f791f1e16561db95728c5537fbad9 upstream.
>
> New iwlwifi-5000 microcode requires driver support for API version 5.
>
> Signed-off-by: Don Fry <donald.h.fry@intel.com>
> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
> ---
> drivers/net/wireless/iwlwifi/iwl-5000.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
> index d05fad4..dc191b8 100644
> --- a/drivers/net/wireless/iwlwifi/iwl-5000.c
> +++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
> @@ -48,7 +48,7 @@
> #include "iwl-6000-hw.h"
>
> /* Highest firmware API version supported */
> -#define IWL5000_UCODE_API_MAX 2
> +#define IWL5000_UCODE_API_MAX 5
> #define IWL5150_UCODE_API_MAX 2
This looks like the patch which broke the driver in stable-2.6.32.y and
was later reverted by:
commit 2a96ae707525ef00a85bf374e56f0219c07eac5a
Author: Greg Kroah-Hartman <gregkh@suse.de>
Date: Wed Jun 15 13:12:35 2011 -0700
Revert "iwlagn: Support new 5000 microcode."
This reverts commit 6f63415fc1b690cb50c2ad48ba6e9e6e88e271b4.
It turns out this is not what we want to have happen for the .32 and
.33-longterm kernels as it does not work properly at all.
This was reported by Gentoo, Arch, and Canonical developers as causing
problems for their users:
https://bugs.archlinux.org/task/24302
http://bugs.gentoo.org/show_bug.cgi?id=359445
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/796336
Cc: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Cc: Gordon Malm <gengor@gentoo.org>
Cc: Don Fry <donald.h.fry@intel.com>
Cc: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Cc: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Bjørn
^ permalink raw reply [flat|nested] 209+ messages in thread* Re: [34-longterm 098/196] iwlagn: Support new 5000 microcode.
2012-03-13 16:24 ` Bjørn Mork
@ 2012-03-13 16:56 ` Paul Gortmaker
0 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 16:56 UTC (permalink / raw)
To: Bjørn Mork; +Cc: stable, linux-kernel, Fry, Donald H, Wey-Yi Guy
On 12-03-13 12:24 PM, Bjørn Mork wrote:
> Paul Gortmaker <paul.gortmaker@windriver.com> writes:
>
>> From: "Fry, Donald H" <donald.h.fry@intel.com>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> If you see a problem with using this for longterm, please comment.
>> -------------------
>>
>> commit 41504cce240f791f1e16561db95728c5537fbad9 upstream.
>>
>> New iwlwifi-5000 microcode requires driver support for API version 5.
>>
>> Signed-off-by: Don Fry <donald.h.fry@intel.com>
>> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
>> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
>> ---
>> drivers/net/wireless/iwlwifi/iwl-5000.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
>> index d05fad4..dc191b8 100644
>> --- a/drivers/net/wireless/iwlwifi/iwl-5000.c
>> +++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
>> @@ -48,7 +48,7 @@
>> #include "iwl-6000-hw.h"
>>
>> /* Highest firmware API version supported */
>> -#define IWL5000_UCODE_API_MAX 2
>> +#define IWL5000_UCODE_API_MAX 5
>> #define IWL5150_UCODE_API_MAX 2
>
> This looks like the patch which broke the driver in stable-2.6.32.y and
> was later reverted by:
Thanks for the heads up. I'll be sure to drop this.
Paul.
--
>
>
> commit 2a96ae707525ef00a85bf374e56f0219c07eac5a
> Author: Greg Kroah-Hartman <gregkh@suse.de>
> Date: Wed Jun 15 13:12:35 2011 -0700
>
> Revert "iwlagn: Support new 5000 microcode."
>
> This reverts commit 6f63415fc1b690cb50c2ad48ba6e9e6e88e271b4.
>
> It turns out this is not what we want to have happen for the .32 and
> .33-longterm kernels as it does not work properly at all.
>
> This was reported by Gentoo, Arch, and Canonical developers as causing
> problems for their users:
> https://bugs.archlinux.org/task/24302
> http://bugs.gentoo.org/show_bug.cgi?id=359445
> https://bugs.launchpad.net/ubuntu/+source/linux/+bug/796336
>
> Cc: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
> Cc: Gordon Malm <gengor@gentoo.org>
> Cc: Don Fry <donald.h.fry@intel.com>
> Cc: Wey-Yi Guy <wey-yi.w.guy@intel.com>
> Cc: Stanislaw Gruszka <sgruszka@redhat.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
>
>
>
>
> Bjørn
^ permalink raw reply [flat|nested] 209+ messages in thread
* [34-longterm 099/196] slub: fix panic with DISCONTIGMEM
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (51 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 098/196] iwlagn: Support new 5000 microcode Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 100/196] set memory ranges in N_NORMAL_MEMORY when onlined Paul Gortmaker
` (96 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, James Bottomley, James Bottomley, Paul Gortmaker
From: James Bottomley <James.Bottomley@HansenPartnership.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 4a5fa3590f09999f6db41bc386bce40848fa9f63 upstream.
Slub makes assumptions about page_to_nid() which are violated by
DISCONTIGMEM and !NUMA. This violation results in a panic because
page_to_nid() can be non-zero for pages in the discontiguous ranges and
this leads to a null return by get_node(). The assertion by the
maintainer is that DISCONTIGMEM should only be allowed when NUMA is also
defined. However, at least six architectures: alpha, ia64, m32r, m68k,
mips, parisc violate this. The panic is a regression against slab, so
just mark slub broken in the problem configuration to prevent users
reporting these panics.
Acked-by: David Rientjes <rientjes@google.com>
Acked-by: Pekka Enberg <penberg@kernel.org>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
init/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/init/Kconfig b/init/Kconfig
index 5fe94b8..04e486cf 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1052,6 +1052,7 @@ config SLAB
per cpu and per node queues.
config SLUB
+ depends on BROKEN || NUMA || !DISCONTIGMEM
bool "SLUB (Unqueued Allocator)"
help
SLUB is a slab allocator that minimizes cache line usage
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 100/196] set memory ranges in N_NORMAL_MEMORY when onlined
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (52 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 099/196] slub: fix panic with DISCONTIGMEM Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 101/196] FLEXCOP-PCI: fix __xlate_proc_name-warning for flexcop-pci Paul Gortmaker
` (95 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, David Rientjes, James Bottomley, Paul Gortmaker
From: David Rientjes <rientjes@google.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit d9b41e0b54fd7e164daf1e9c539c1070398aa02e upstream.
When a DISCONTIGMEM memory range is brought online as a NUMA node, it
also needs to have its bet set in N_NORMAL_MEMORY. This is necessary for
generic kernel code that utilizes N_NORMAL_MEMORY as a subset of N_ONLINE
for memory savings.
These types of hacks can hopefully be removed once DISCONTIGMEM is either
removed or abstracted away from CONFIG_NUMA.
Fixes a panic in the slub code which only initializes structures for
N_NORMAL_MEMORY to save memory:
Backtrace:
[<000000004021c938>] add_partial+0x28/0x98
[<000000004021faa0>] __slab_free+0x1d0/0x1d8
[<000000004021fd04>] kmem_cache_free+0xc4/0x128
[<000000004033bf9c>] ida_get_new_above+0x21c/0x2c0
[<00000000402a8980>] sysfs_new_dirent+0xd0/0x238
[<00000000402a974c>] create_dir+0x5c/0x168
[<00000000402a9ab0>] sysfs_create_dir+0x98/0x128
[<000000004033d6c4>] kobject_add_internal+0x114/0x258
[<000000004033d9ac>] kobject_add_varg+0x7c/0xa0
[<000000004033df20>] kobject_add+0x50/0x90
[<000000004033dfb4>] kobject_create_and_add+0x54/0xc8
[<00000000407862a0>] cgroup_init+0x138/0x1f0
[<000000004077ce50>] start_kernel+0x5a0/0x840
[<000000004011fa3c>] start_parisc+0xa4/0xb8
[<00000000404bb034>] packet_ioctl+0x16c/0x208
[<000000004049ac30>] ip_mroute_setsockopt+0x260/0xf20
Signed-off-by: David Rientjes <rientjes@google.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/parisc/mm/init.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index f4f4d70..7fd8aad 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -266,8 +266,10 @@ static void __init setup_bootmem(void)
}
memset(pfnnid_map, 0xff, sizeof(pfnnid_map));
- for (i = 0; i < npmem_ranges; i++)
+ for (i = 0; i < npmem_ranges; i++) {
+ node_set_state(i, N_NORMAL_MEMORY);
node_set_online(i);
+ }
#endif
/*
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 101/196] FLEXCOP-PCI: fix __xlate_proc_name-warning for flexcop-pci
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (53 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 100/196] set memory ranges in N_NORMAL_MEMORY when onlined Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 102/196] m68k/mm: Set all online nodes in N_NORMAL_MEMORY Paul Gortmaker
` (94 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Patrick Boettcher, Steffen Barszus, Boris Cuber,
Mauro Carvalho Chehab, Paul Gortmaker
From: Patrick Boettcher <pboettcher@kernellabs.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b934c20de1398d4a82d2ecfeb588a214a910f13f upstream.
This patch fixes the warning about bad names for sys-fs and other kernel-things. The flexcop-pci driver was using '/'-characters in it, which is not good.
This has been fixed in several attempts by several people, but obviously never made it into the kernel.
Signed-off-by: Patrick Boettcher <pboettcher@kernellabs.com>
Cc: Steffen Barszus <steffenbpunkt@googlemail.com>
Cc: Boris Cuber <me@boris64.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/media/dvb/b2c2/flexcop-pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/dvb/b2c2/flexcop-pci.c b/drivers/media/dvb/b2c2/flexcop-pci.c
index 227c020..4f3e3ce 100644
--- a/drivers/media/dvb/b2c2/flexcop-pci.c
+++ b/drivers/media/dvb/b2c2/flexcop-pci.c
@@ -38,7 +38,7 @@ MODULE_PARM_DESC(debug,
DEBSTATUS);
#define DRIVER_VERSION "0.1"
-#define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver"
+#define DRIVER_NAME "flexcop-pci"
#define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher@desy.de>"
struct flexcop_pci {
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 102/196] m68k/mm: Set all online nodes in N_NORMAL_MEMORY
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (54 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 101/196] FLEXCOP-PCI: fix __xlate_proc_name-warning for flexcop-pci Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 103/196] nfs: don't lose MS_SYNCHRONOUS on remount of noac mount Paul Gortmaker
` (93 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Michael Schmitz, Michael Schmitz,
Geert Uytterhoeven, Paul Gortmaker
From: Michael Schmitz <schmitzmic@googlemail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 4aac0b4815ba592052758f4b468f253d383dc9d6 upstream.
For m68k, N_NORMAL_MEMORY represents all nodes that have present memory
since it does not support HIGHMEM. This patch sets the bit at the time
node_present_pages has been set by free_area_init_node.
At the time the node is brought online, the node state would have to be
done unconditionally since information about present memory has not yet
been recorded.
If N_NORMAL_MEMORY is not accurate, slub may encounter errors since it
uses this nodemask to setup per-cache kmem_cache_node data structures.
This pach is an alternative to the one proposed by David Rientjes
<rientjes@google.com> attempting to set node state immediately when
bringing the node online.
Signed-off-by: Michael Schmitz <schmitz@debian.org>
Tested-by: Thorsten Glaser <tg@debian.org>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/m68k/mm/motorola.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c
index 02b7a03..8b3db1c 100644
--- a/arch/m68k/mm/motorola.c
+++ b/arch/m68k/mm/motorola.c
@@ -300,6 +300,8 @@ void __init paging_init(void)
zones_size[ZONE_DMA] = m68k_memory[i].size >> PAGE_SHIFT;
free_area_init_node(i, zones_size,
m68k_memory[i].addr >> PAGE_SHIFT, NULL);
+ if (node_present_pages(i))
+ node_set_state(i, N_NORMAL_MEMORY);
}
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 103/196] nfs: don't lose MS_SYNCHRONOUS on remount of noac mount
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (55 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 102/196] m68k/mm: Set all online nodes in N_NORMAL_MEMORY Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 104/196] NFSv4.1: Ensure state manager thread dies on last umount Paul Gortmaker
` (92 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jeff Layton, Trond Myklebust, Paul Gortmaker
From: Jeff Layton <jlayton@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 26c4c170731f00008f4317a2888a0a07ac99d90d upstream.
On a remount, the VFS layer will clear the MS_SYNCHRONOUS bit on the
assumption that the flags on the mount syscall will have it set if the
remounted fs is supposed to keep it.
In the case of "noac" though, MS_SYNCHRONOUS is implied. A remount of
such a mount will lose the MS_SYNCHRONOUS flag since "sync" isn't part
of the mount options.
Reported-by: Max Matveev <makc@redhat.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfs/super.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index ae570b0..85958a1 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1989,6 +1989,15 @@ nfs_remount(struct super_block *sb, int *flags, char *raw_data)
if (error < 0)
goto out;
+ /*
+ * noac is a special case. It implies -o sync, but that's not
+ * necessarily reflected in the mtab options. do_remount_sb
+ * will clear MS_SYNCHRONOUS if -o sync wasn't specified in the
+ * remount options, so we have to explicitly reset it.
+ */
+ if (data->flags & NFS_MOUNT_NOAC)
+ *flags |= MS_SYNCHRONOUS;
+
/* compare new mount options with old ones */
error = nfs_compare_remount_data(nfss, data);
out:
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 104/196] NFSv4.1: Ensure state manager thread dies on last umount
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (56 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 103/196] nfs: don't lose MS_SYNCHRONOUS on remount of noac mount Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 105/196] pmcraid: reject negative request size Paul Gortmaker
` (91 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Trond Myklebust, Paul Gortmaker
From: Trond Myklebust <Trond.Myklebust@netapp.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 47c2199b6eb5fbe38ddb844db7cdbd914d304f9c upstream.
Currently, the state manager may continue to try recovering state forever
even after the last filesystem to reference that nfs_client has umounted.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfs/nfs4state.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 6c5ed51..c03bdcc 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1399,7 +1399,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
int status = 0;
/* Ensure exclusive access to NFSv4 state */
- for(;;) {
+ do {
if (test_and_clear_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state)) {
/* We're going to have to re-establish a clientid */
status = nfs4_reclaim_lease(clp);
@@ -1482,7 +1482,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
break;
if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
break;
- }
+ } while (atomic_read(&clp->cl_count) > 1);
return;
out_error:
printk(KERN_WARNING "Error: state manager failed on NFSv4 server %s"
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 105/196] pmcraid: reject negative request size
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (57 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 104/196] NFSv4.1: Ensure state manager thread dies on last umount Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 106/196] put stricter guards on queue dead checks Paul Gortmaker
` (90 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dan Rosenberg, Anil Ravindranath, James Bottomley,
Paul Gortmaker
From: Dan Rosenberg <drosenberg@vsecurity.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5f6279da3760ce48f478f2856aacebe0c59a39f3 upstream.
There's a code path in pmcraid that can be reached via device ioctl that
causes all sorts of ugliness, including heap corruption or triggering
the OOM killer due to consecutive allocation of large numbers of pages.
Not especially relevant from a security perspective, since users must
have CAP_SYS_ADMIN to open the character device.
First, the user can call pmcraid_chr_ioctl() with a type
PMCRAID_PASSTHROUGH_IOCTL. A pmcraid_passthrough_ioctl_buffer
is copied in, and the request_size variable is set to
buffer->ioarcb.data_transfer_length, which is an arbitrary 32-bit signed
value provided by the user.
If a negative value is provided here, bad things can happen. For
example, pmcraid_build_passthrough_ioadls() is called with this
request_size, which immediately calls pmcraid_alloc_sglist() with a
negative size. The resulting math on allocating a scatter list can
result in an overflow in the kzalloc() call (if num_elem is 0, the
sglist will be smaller than expected), or if num_elem is unexpectedly
large the subsequent loop will call alloc_pages() repeatedly, a high
number of pages will be allocated and the OOM killer might be invoked.
Prevent this value from being negative in pmcraid_ioctl_passthrough().
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: Anil Ravindranath <anil_ravindranath@pmc-sierra.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/pmcraid.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index 53aefff..bdb7259 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -3528,6 +3528,9 @@ static long pmcraid_ioctl_passthrough(
rc = -EFAULT;
goto out_free_buffer;
}
+ } else if (request_size < 0) {
+ rc = -EINVAL;
+ goto out_free_buffer;
}
/* check if we have any additional command parameters */
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 106/196] put stricter guards on queue dead checks
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (58 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 105/196] pmcraid: reject negative request size Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 107/196] mmc: sdhci-pci: Fix error case in sdhci_pci_probe_slot() Paul Gortmaker
` (89 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, James Bottomley, Paul Gortmaker
From: James Bottomley <James.Bottomley@suse.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 86cbfb5607d4b81b1a993ff689bbd2addd5d3a9b upstream.
SCSI uses request_queue->queuedata == NULL as a signal that the queue
is dying. We set this state in the sdev release function. However,
this allows a small window where we release the last reference but
haven't quite got to this stage yet and so something will try to take
a reference in scsi_request_fn and oops. It's very rare, but we had a
report here, so we're pushing this as a bug fix
The actual fix is to set request_queue->queuedata to NULL in
scsi_remove_device() before we drop the reference. This causes
correct automatic rejects from scsi_request_fn as people who hold
additional references try to submit work and prevents anything from
getting a new reference to the sdev that way.
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/scsi_sysfs.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 02be251..ed3b52f 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -319,14 +319,8 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
kfree(evt);
}
- if (sdev->request_queue) {
- sdev->request_queue->queuedata = NULL;
- /* user context needed to free queue */
- scsi_free_queue(sdev->request_queue);
- /* temporary expedient, try to catch use of queue lock
- * after free of sdev */
- sdev->request_queue = NULL;
- }
+ /* NULL queue means the device can't be used */
+ sdev->request_queue = NULL;
scsi_target_reap(scsi_target(sdev));
@@ -964,6 +958,12 @@ void __scsi_remove_device(struct scsi_device *sdev)
if (sdev->host->hostt->slave_destroy)
sdev->host->hostt->slave_destroy(sdev);
transport_destroy_device(dev);
+
+ /* cause the request function to reject all I/O requests */
+ sdev->request_queue->queuedata = NULL;
+
+ /* Freeing the queue signals to block that we're done */
+ scsi_free_queue(sdev->request_queue);
put_device(dev);
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 107/196] mmc: sdhci-pci: Fix error case in sdhci_pci_probe_slot()
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (59 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 106/196] put stricter guards on queue dead checks Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 108/196] mmc: sdhci: Check mrq->cmd in sdhci_tasklet_finish Paul Gortmaker
` (88 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Chris Ball, Paul Gortmaker
From: Chris Ball <cjb@laptop.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 9fdcdbb0d84922e7ccda2f717a04ea62629f7e18 upstream.
If pci_ioremap_bar() fails during probe, we "goto release;" and free the
host, but then we return 0 -- which tells sdhci_pci_probe() that the probe
succeeded. Since we think the probe succeeded, when we unload sdhci we'll
go to sdhci_pci_remove_slot() and it will try to dereference slot->host,
which is now NULL because we freed it in the error path earlier.
The patch simply sets ret appropriately, so that sdhci_pci_probe() will
detect the failure immediately and bail out.
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/mmc/host/sdhci-pci.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index 6701af6..e907447 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -653,6 +653,7 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
host->ioaddr = pci_ioremap_bar(pdev, bar);
if (!host->ioaddr) {
dev_err(&pdev->dev, "failed to remap registers\n");
+ ret = -ENOMEM;
goto release;
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 108/196] mmc: sdhci: Check mrq->cmd in sdhci_tasklet_finish
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (60 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 107/196] mmc: sdhci-pci: Fix error case in sdhci_pci_probe_slot() Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 109/196] mmc: sdhci: Check mrq != NULL " Paul Gortmaker
` (87 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Ben Dooks, Mark Brown, Chris Ball, Paul Gortmaker
From: Ben Dooks <ben-linux@fluff.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b7b4d3426d2b5ecab21578eb20d8e456a1aace8f upstream.
It seems that under certain circumstances that the sdhci_tasklet_finish()
call can be entered with mrq->cmd set to NULL, causing the system to crash
with a NULL pointer de-reference.
Unable to handle kernel NULL pointer dereference at virtual address 00000000
PC is at sdhci_tasklet_finish+0x34/0xe8
LR is at sdhci_tasklet_finish+0x24/0xe8
Seen on S3C6410 system.
Signed-off-by: Ben Dooks <ben-linux@fluff.org>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/mmc/host/sdhci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 9d4fdfa..6441e22 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1279,7 +1279,7 @@ static void sdhci_tasklet_finish(unsigned long param)
* upon error conditions.
*/
if (!(host->flags & SDHCI_DEVICE_DEAD) &&
- (mrq->cmd->error ||
+ ((mrq->cmd && mrq->cmd->error) ||
(mrq->data && (mrq->data->error ||
(mrq->data->stop && mrq->data->stop->error))) ||
(host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST))) {
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 109/196] mmc: sdhci: Check mrq != NULL in sdhci_tasklet_finish
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (61 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 108/196] mmc: sdhci: Check mrq->cmd in sdhci_tasklet_finish Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 110/196] af_unix: Only allow recv on connected seqpacket sockets Paul Gortmaker
` (86 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Chris Ball, Paul Gortmaker
From: Chris Ball <cjb@laptop.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 0c9c99a765321104cc5f9c97f949382a9ba4927e upstream.
It seems that under certain circumstances the sdhci_tasklet_finish()
call can be entered with mrq set to NULL, causing the system to crash
with a NULL pointer de-reference.
Seen on S3C6410 system. Based on a patch by Dimitris Papastamos.
Reported-by: Dimitris Papastamos <dp@opensource.wolfsonmicro.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/mmc/host/sdhci.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 6441e22..be410d7 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1268,6 +1268,13 @@ static void sdhci_tasklet_finish(unsigned long param)
host = (struct sdhci_host*)param;
+ /*
+ * If this tasklet gets rescheduled while running, it will
+ * be run again afterwards but without any active request.
+ */
+ if (!host->mrq)
+ return;
+
spin_lock_irqsave(&host->lock, flags);
del_timer(&host->timer);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 110/196] af_unix: Only allow recv on connected seqpacket sockets.
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (62 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 109/196] mmc: sdhci: Check mrq != NULL " Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 111/196] ARM: 6891/1: prevent heap corruption in OABI semtimedop Paul Gortmaker
` (85 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Eric W. Biederman, David S. Miller, Paul Gortmaker
From: "Eric W. Biederman" <ebiederm@xmission.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit a05d2ad1c1f391c7f514a1d1e09b5417968a7d07 upstream.
This fixes the following oops discovered by Dan Aloni:
> Anyway, the following is the output of the Oops that I got on the
> Ubuntu kernel on which I first detected the problem
> (2.6.37-12-generic). The Oops that followed will be more useful, I
> guess.
>[ 5594.669852] BUG: unable to handle kernel NULL pointer dereference
> at (null)
> [ 5594.681606] IP: [<ffffffff81550b7b>] unix_dgram_recvmsg+0x1fb/0x420
> [ 5594.687576] PGD 2a05d067 PUD 2b951067 PMD 0
> [ 5594.693720] Oops: 0002 [#1] SMP
> [ 5594.699888] last sysfs file:
The bug was that unix domain sockets use a pseduo packet for
connecting and accept uses that psudo packet to get the socket.
In the buggy seqpacket case we were allowing unconnected
sockets to call recvmsg and try to receive the pseudo packet.
That is always wrong and as of commit 7361c36c5 the pseudo
packet had become enough different from a normal packet
that the kernel started oopsing.
Do for seqpacket_recv what was done for seqpacket_send in 2.5
and only allow it on connected seqpacket sockets.
Tested-by: Dan Aloni <dan@aloni.org>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/unix/af_unix.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 207a119..0b7148b 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -503,6 +503,8 @@ static int unix_dgram_connect(struct socket *, struct sockaddr *,
int, int);
static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *,
struct msghdr *, size_t);
+static int unix_seqpacket_recvmsg(struct kiocb *, struct socket *,
+ struct msghdr *, size_t, int);
static const struct proto_ops unix_stream_ops = {
.family = PF_UNIX,
@@ -562,7 +564,7 @@ static const struct proto_ops unix_seqpacket_ops = {
.setsockopt = sock_no_setsockopt,
.getsockopt = sock_no_getsockopt,
.sendmsg = unix_seqpacket_sendmsg,
- .recvmsg = unix_dgram_recvmsg,
+ .recvmsg = unix_seqpacket_recvmsg,
.mmap = sock_no_mmap,
.sendpage = sock_no_sendpage,
};
@@ -1666,6 +1668,18 @@ static int unix_seqpacket_sendmsg(struct kiocb *kiocb, struct socket *sock,
return unix_dgram_sendmsg(kiocb, sock, msg, len);
}
+static int unix_seqpacket_recvmsg(struct kiocb *iocb, struct socket *sock,
+ struct msghdr *msg, size_t size,
+ int flags)
+{
+ struct sock *sk = sock->sk;
+
+ if (sk->sk_state != TCP_ESTABLISHED)
+ return -ENOTCONN;
+
+ return unix_dgram_recvmsg(iocb, sock, msg, size, flags);
+}
+
static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
{
struct unix_sock *u = unix_sk(sk);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 111/196] ARM: 6891/1: prevent heap corruption in OABI semtimedop
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (63 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 110/196] af_unix: Only allow recv on connected seqpacket sockets Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 112/196] i8k: Tell gcc that *regs gets clobbered Paul Gortmaker
` (84 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dan Rosenberg, Russell King, Paul Gortmaker
From: Dan Rosenberg <drosenberg@vsecurity.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 0f22072ab50cac7983f9660d33974b45184da4f9 upstream.
When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not
bound the nsops argument. A sufficiently large value will cause an
integer overflow in allocation size, followed by copying too much data
into the allocated buffer. Fix this by restricting nsops to SEMOPM.
Untested.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/arm/kernel/sys_oabi-compat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
index 33ff678..73bb15c 100644
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -311,7 +311,7 @@ asmlinkage long sys_oabi_semtimedop(int semid,
long err;
int i;
- if (nsops < 1)
+ if (nsops < 1 || nsops > SEMOPM)
return -EINVAL;
sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
if (!sops)
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 112/196] i8k: Tell gcc that *regs gets clobbered
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (64 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 111/196] ARM: 6891/1: prevent heap corruption in OABI semtimedop Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 113/196] Fix gcc 4.5.1 miscompiling drivers/char/i8k.c (again) Paul Gortmaker
` (83 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jim Bos, Andi Kleen, Andreas Schwab,
Linus Torvalds, Paul Gortmaker
From: Jim Bos <jim876@xs4all.nl>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 6b4e81db2552bad04100e7d5ddeed7e848f53b48 upstream.
More recent GCC caused the i8k driver to stop working, on Slackware
compiler was upgraded from gcc-4.4.4 to gcc-4.5.1 after which it didn't
work anymore, meaning the driver didn't load or gave total nonsensical
output.
As it turned out the asm(..) statement forgot to mention it modifies the
*regs variable.
Credits to Andi Kleen and Andreas Schwab for providing the fix.
Signed-off-by: Jim Bos <jim876@xs4all.nl>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Andreas Schwab <schwab@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/i8k.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
index fc8cf7a..828fd24 100644
--- a/drivers/char/i8k.c
+++ b/drivers/char/i8k.c
@@ -141,7 +141,7 @@ static int i8k_smm(struct smm_regs *regs)
"lahf\n\t"
"shrl $8,%%eax\n\t"
"andl $1,%%eax\n"
- :"=a"(rc)
+ :"=a"(rc), "+m" (*regs)
: "a"(regs)
: "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory");
#else
@@ -166,7 +166,8 @@ static int i8k_smm(struct smm_regs *regs)
"movl %%edx,0(%%eax)\n\t"
"lahf\n\t"
"shrl $8,%%eax\n\t"
- "andl $1,%%eax\n":"=a"(rc)
+ "andl $1,%%eax\n"
+ :"=a"(rc), "+m" (*regs)
: "a"(regs)
: "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory");
#endif
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 113/196] Fix gcc 4.5.1 miscompiling drivers/char/i8k.c (again)
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (65 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 112/196] i8k: Tell gcc that *regs gets clobbered Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 114/196] Open with O_CREAT flag set fails to open existing files on non writable directories Paul Gortmaker
` (82 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jim Bos, Andi Kleen, Andreas Schwab,
Linus Torvalds, Paul Gortmaker
From: Jim Bos <jim876@xs4all.nl>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 22d3243de86bc92d874abb7c5b185d5c47aba323 upstream.
The fix in commit 6b4e81db2552 ("i8k: Tell gcc that *regs gets
clobbered") to work around the gcc miscompiling i8k.c to add "+m
(*regs)" caused register pressure problems and a build failure.
Changing the 'asm' statement to 'asm volatile' instead should prevent
that and works around the gcc bug as well, so we can remove the "+m".
[ Background on the gcc bug: a memory clobber fails to mark the function
the asm resides in as non-pure (aka "__attribute__((const))"), so if
the function does nothing else that triggers the non-pure logic, gcc
will think that that function has no side effects at all. As a result,
callers will be mis-compiled.
Adding the "+m" made gcc see that it's not a pure function, and so
does "asm volatile". The problem was never really the need to mark
"*regs" as changed, since the memory clobber did that part - the
problem was just a bug in the gcc "pure" function analysis - Linus ]
Signed-off-by: Jim Bos <jim876@xs4all.nl>
Acked-by: Jakub Jelinek <jakub@redhat.com>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Andreas Schwab <schwab@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/char/i8k.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
index 828fd24..4365717 100644
--- a/drivers/char/i8k.c
+++ b/drivers/char/i8k.c
@@ -119,7 +119,7 @@ static int i8k_smm(struct smm_regs *regs)
int eax = regs->eax;
#if defined(CONFIG_X86_64)
- asm("pushq %%rax\n\t"
+ asm volatile("pushq %%rax\n\t"
"movl 0(%%rax),%%edx\n\t"
"pushq %%rdx\n\t"
"movl 4(%%rax),%%ebx\n\t"
@@ -141,11 +141,11 @@ static int i8k_smm(struct smm_regs *regs)
"lahf\n\t"
"shrl $8,%%eax\n\t"
"andl $1,%%eax\n"
- :"=a"(rc), "+m" (*regs)
+ :"=a"(rc)
: "a"(regs)
: "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory");
#else
- asm("pushl %%eax\n\t"
+ asm volatile("pushl %%eax\n\t"
"movl 0(%%eax),%%edx\n\t"
"push %%edx\n\t"
"movl 4(%%eax),%%ebx\n\t"
@@ -167,7 +167,7 @@ static int i8k_smm(struct smm_regs *regs)
"lahf\n\t"
"shrl $8,%%eax\n\t"
"andl $1,%%eax\n"
- :"=a"(rc), "+m" (*regs)
+ :"=a"(rc)
: "a"(regs)
: "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory");
#endif
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 114/196] Open with O_CREAT flag set fails to open existing files on non writable directories
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (66 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 113/196] Fix gcc 4.5.1 miscompiling drivers/char/i8k.c (again) Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 115/196] Input: elantech - relax signature checks Paul Gortmaker
` (81 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Sachin Prabhu, J. Bruce Fields, Paul Gortmaker
From: Sachin Prabhu <sprabhu@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 1574dff8996ab1ed92c09012f8038b5566fce313 upstream.
An open on a NFS4 share using the O_CREAT flag on an existing file for
which we have permissions to open but contained in a directory with no
write permissions will fail with EACCES.
A tcpdump shows that the client had set the open mode to UNCHECKED which
indicates that the file should be created if it doesn't exist and
encountering an existing flag is not an error. Since in this case the
file exists and can be opened by the user, the NFS server is wrong in
attempting to check create permissions on the parent directory.
The patch adds a conditional statement to check for create permissions
only if the file doesn't exist.
Signed-off-by: Sachin S. Prabhu <sprabhu@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfsd/vfs.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 054b50b..7de2873 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1387,7 +1387,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
goto out;
if (!(iap->ia_valid & ATTR_MODE))
iap->ia_mode = 0;
- err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
+ err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
if (err)
goto out;
@@ -1409,6 +1409,13 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
if (IS_ERR(dchild))
goto out_nfserr;
+ /* If file doesn't exist, check for permissions to create one */
+ if (!dchild->d_inode) {
+ err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
+ if (err)
+ goto out;
+ }
+
err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
if (err)
goto out;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 115/196] Input: elantech - relax signature checks
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (67 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 114/196] Open with O_CREAT flag set fails to open existing files on non writable directories Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 116/196] Input: elantech - discard the first 2 positions on some firmwares Paul Gortmaker
` (80 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dmitry Torokhov, Dmitry Torokhov, Paul Gortmaker
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit a083632eaf6231162b33e40561cfec6a9c156945 upstream.
Apparently there are Elantech touchpads that report non-zero in the 2nd byte
of their signature. Adjust the detection routine so that if 2nd byte is
zero and 3rd byte contains value that is not a valid report rate, we still
assume that signature is valid.
Tested-by: Eric Piel <eric.piel@tremplin-utc.net>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/input/mouse/elantech.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 112b4ee..4400369 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -575,6 +575,24 @@ static struct attribute_group elantech_attr_group = {
.attrs = elantech_attrs,
};
+static bool elantech_is_signature_valid(const unsigned char *param)
+{
+ static const unsigned char rates[] = { 200, 100, 80, 60, 40, 20, 10 };
+ int i;
+
+ if (param[0] == 0)
+ return false;
+
+ if (param[1] == 0)
+ return true;
+
+ for (i = 0; i < ARRAY_SIZE(rates); i++)
+ if (param[2] == rates[i])
+ return false;
+
+ return true;
+}
+
/*
* Use magic knock to detect Elantech touchpad
*/
@@ -618,7 +636,7 @@ int elantech_detect(struct psmouse *psmouse, bool set_properties)
pr_debug("elantech.c: Elantech version query result 0x%02x, 0x%02x, 0x%02x.\n",
param[0], param[1], param[2]);
- if (param[0] == 0 || param[1] != 0) {
+ if (!elantech_is_signature_valid(param)) {
if (!force_elantech) {
pr_debug("elantech.c: Probably not a real Elantech touchpad. Aborting.\n");
return -1;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 116/196] Input: elantech - discard the first 2 positions on some firmwares
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (68 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 115/196] Input: elantech - relax signature checks Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 117/196] Staging: rtl8192su: check for skb == NULL Paul Gortmaker
` (79 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Éric Piel, Éric Piel, Dmitry Torokhov,
Paul Gortmaker
From: Éric Piel <E.A.B.Piel@tudelft.nl>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 7f29f17b57255b6395046805a98bc663ded63fb8 upstream.
According to the Dell/Ubuntu driver, what was previously observed as
"jumpy cursor" corresponds to the hardware sending incorrect data for
the first two reports of a one touch finger. So let's use the same
workaround as in the other driver. Also, detect another firmware
version with the same behaviour, as in the other driver.
Signed-off-by: Éric Piel <eric.piel@tremplin-utc.net>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/input/mouse/elantech.c | 21 ++++++++++-----------
drivers/input/mouse/elantech.h | 7 ++++---
2 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 4400369..a0c19c2 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -183,7 +183,6 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
struct elantech_data *etd = psmouse->private;
unsigned char *packet = psmouse->packet;
int fingers;
- static int old_fingers;
if (etd->fw_version < 0x020000) {
/*
@@ -201,10 +200,13 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
}
if (etd->jumpy_cursor) {
- /* Discard packets that are likely to have bogus coordinates */
- if (fingers > old_fingers) {
+ if (fingers != 1) {
+ etd->single_finger_reports = 0;
+ } else if (etd->single_finger_reports < 2) {
+ /* Discard first 2 reports of one finger, bogus */
+ etd->single_finger_reports++;
elantech_debug("elantech.c: discarding packet\n");
- goto discard_packet_v1;
+ return;
}
}
@@ -236,9 +238,6 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
}
input_sync(dev);
-
- discard_packet_v1:
- old_fingers = fingers;
}
/*
@@ -734,14 +733,14 @@ int elantech_init(struct psmouse *psmouse)
etd->capabilities = param[0];
/*
- * This firmware seems to suffer from misreporting coordinates when
+ * This firmware suffers from misreporting coordinates when
* a touch action starts causing the mouse cursor or scrolled page
* to jump. Enable a workaround.
*/
- if (etd->fw_version == 0x020022) {
- pr_info("elantech.c: firmware version 2.0.34 detected, "
+ if (etd->fw_version == 0x020022 || etd->fw_version == 0x020600) {
+ pr_info("elantech.c: firmware version 2.0.34/2.6.0 detected, "
"enabling jumpy cursor workaround\n");
- etd->jumpy_cursor = 1;
+ etd->jumpy_cursor = true;
}
if (elantech_set_absolute_mode(psmouse)) {
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index ac57bde..aa4aac5 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -100,10 +100,11 @@ struct elantech_data {
unsigned char reg_26;
unsigned char debug;
unsigned char capabilities;
- unsigned char paritycheck;
- unsigned char jumpy_cursor;
+ bool paritycheck;
+ bool jumpy_cursor;
unsigned char hw_version;
- unsigned int fw_version;
+ unsigned int fw_version;
+ unsigned int single_finger_reports;
unsigned char parity[256];
};
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 117/196] Staging: rtl8192su: check for skb == NULL
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (69 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 116/196] Input: elantech - discard the first 2 positions on some firmwares Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 118/196] Staging: rtl8192su: Clean up in case of an error in module initialisation Paul Gortmaker
` (78 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Florian Schilhabel, Greg Kroah-Hartman, Paul Gortmaker
From: Florian Schilhabel <florian.c.schilhabel@googlemail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 199ef62a287b429a8fa3b7dc5ae6b69f607bf324 upstream.
added 2 checks for skb == NULL.
plus cosmetics
Signed-off-by: Florian Schilhabel <florian.c.schilhabel@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/staging/rtl8192su/r8192S_firmware.c | 135 ++++++++++++---------------
drivers/staging/rtl8192su/r8192U_core.c | 2 -
drivers/staging/rtl8192su/r819xU_cmdpkt.c | 6 ++
3 files changed, 68 insertions(+), 75 deletions(-)
diff --git a/drivers/staging/rtl8192su/r8192S_firmware.c b/drivers/staging/rtl8192su/r8192S_firmware.c
index 752a3f1..f7dd7e7 100644
--- a/drivers/staging/rtl8192su/r8192S_firmware.c
+++ b/drivers/staging/rtl8192su/r8192S_firmware.c
@@ -31,44 +31,46 @@
// Code size
// Created by Roger, 2008.04.10.
//
-bool FirmwareDownloadCode(struct net_device *dev, u8 * code_virtual_address,u32 buffer_len)
+bool FirmwareDownloadCode(struct net_device *dev,
+ u8 *code_virtual_address,
+ u32 buffer_len)
{
- struct r8192_priv *priv = ieee80211_priv(dev);
- bool rt_status = true;
- u16 frag_threshold = MAX_FIRMWARE_CODE_SIZE; //Fragmentation might be required in 90/92 but not in 92S
- u16 frag_length, frag_offset = 0;
- struct sk_buff *skb;
- unsigned char *seg_ptr;
- cb_desc *tcb_desc;
- u8 bLastIniPkt = 0;
- u16 ExtraDescOffset = 0;
-
-
- RT_TRACE(COMP_FIRMWARE, "--->FirmwareDownloadCode()\n" );
-
- //MAX_TRANSMIT_BUFFER_SIZE
- if(buffer_len >= MAX_FIRMWARE_CODE_SIZE-USB_HWDESC_HEADER_LEN)
- {
- RT_TRACE(COMP_ERR, "Size over MAX_FIRMWARE_CODE_SIZE! \n");
+ struct r8192_priv *priv = ieee80211_priv(dev);
+ bool rt_status = true;
+ /* Fragmentation might be required in 90/92 but not in 92S */
+ u16 frag_threshold = MAX_FIRMWARE_CODE_SIZE;
+ u16 frag_length, frag_offset = 0;
+ struct sk_buff *skb;
+ unsigned char *seg_ptr;
+ cb_desc *tcb_desc;
+ u8 bLastIniPkt = 0;
+ u16 ExtraDescOffset = 0;
+
+ if (buffer_len >= MAX_FIRMWARE_CODE_SIZE - USB_HWDESC_HEADER_LEN) {
+ RT_TRACE(COMP_ERR, "(%s): Firmware exceeds"
+ " MAX_FIRMWARE_CODE_SIZE\n", __func__);
goto cmdsend_downloadcode_fail;
}
-
ExtraDescOffset = USB_HWDESC_HEADER_LEN;
-
do {
if((buffer_len-frag_offset) > frag_threshold)
- {
frag_length = frag_threshold + ExtraDescOffset;
+ else {
+ frag_length = (u16)(buffer_len -
+ frag_offset + ExtraDescOffset);
+ bLastIniPkt = 1;
}
- else
- {
- frag_length = (u16)(buffer_len - frag_offset + ExtraDescOffset);
- bLastIniPkt = 1;
- }
-
- /* Allocate skb buffer to contain firmware info and tx descriptor info. */
+ /*
+ * Allocate skb buffer to contain firmware info
+ * and tx descriptor info.
+ */
skb = dev_alloc_skb(frag_length);
- memcpy((unsigned char *)(skb->cb),&dev,sizeof(dev));
+ if (skb == NULL) {
+ RT_TRACE(COMP_ERR, "(%s): unable to alloc skb buffer\n",
+ __func__);
+ goto cmdsend_downloadcode_fail;
+ }
+ memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));
tcb_desc = (cb_desc*)(skb->cb + MAX_DEV_ADDR_SIZE);
tcb_desc->queue_index = TXCMD_QUEUE;
@@ -76,73 +78,60 @@ bool FirmwareDownloadCode(struct net_device *dev, u8 * code_virtual_address,u32
tcb_desc->bLastIniPkt = bLastIniPkt;
skb_reserve(skb, ExtraDescOffset);
- seg_ptr = (u8 *)skb_put(skb, (u32)(frag_length-ExtraDescOffset));
- memcpy(seg_ptr, code_virtual_address+frag_offset, (u32)(frag_length-ExtraDescOffset));
- tcb_desc->txbuf_size= frag_length;
+ seg_ptr = (u8 *)skb_put(skb,
+ (u32)(frag_length - ExtraDescOffset));
- if(!priv->ieee80211->check_nic_enough_desc(dev,tcb_desc->queue_index)||
- (!skb_queue_empty(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index]))||\
- (priv->ieee80211->queue_stop) )
- {
+ memcpy(seg_ptr, code_virtual_address + frag_offset,
+ (u32)(frag_length-ExtraDescOffset));
+
+ tcb_desc->txbuf_size = frag_length;
+
+ if (!priv->ieee80211->check_nic_enough_desc(dev, tcb_desc->queue_index) ||
+ (!skb_queue_empty(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index])) ||
+ (priv->ieee80211->queue_stop)) {
RT_TRACE(COMP_FIRMWARE,"=====================================================> tx full!\n");
skb_queue_tail(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index], skb);
- }
- else
- {
- priv->ieee80211->softmac_hard_start_xmit(skb,dev);
- }
+ } else
+ priv->ieee80211->softmac_hard_start_xmit(skb, dev);
frag_offset += (frag_length - ExtraDescOffset);
- }while(frag_offset < buffer_len);
-
+ } while (frag_offset < buffer_len);
return rt_status ;
-
cmdsend_downloadcode_fail:
rt_status = false;
- RT_TRACE(COMP_ERR, "CmdSendDownloadCode fail !!\n");
+ RT_TRACE(COMP_ERR, "(%s): failed\n", __func__);
return rt_status;
-
}
-RT_STATUS
-FirmwareEnableCPU(struct net_device *dev)
+RT_STATUS FirmwareEnableCPU(struct net_device *dev)
{
+ RT_STATUS rtStatus = RT_STATUS_SUCCESS;
+ u8 tmpU1b, CPUStatus = 0;
+ u16 tmpU2b;
+ u32 iCheckTime = 200;
- RT_STATUS rtStatus = RT_STATUS_SUCCESS;
- u8 tmpU1b, CPUStatus = 0;
- u16 tmpU2b;
- u32 iCheckTime = 200;
-
- RT_TRACE(COMP_FIRMWARE, "-->FirmwareEnableCPU()\n" );
- // Enable CPU.
+ /* Enable CPU. */
tmpU1b = read_nic_byte(dev, SYS_CLKR);
- write_nic_byte(dev, SYS_CLKR, (tmpU1b|SYS_CPU_CLKSEL)); //AFE source
-
+ /* AFE source */
+ write_nic_byte(dev, SYS_CLKR, (tmpU1b|SYS_CPU_CLKSEL));
tmpU2b = read_nic_word(dev, SYS_FUNC_EN);
write_nic_word(dev, SYS_FUNC_EN, (tmpU2b|FEN_CPUEN));
-
- //Polling IMEM Ready after CPU has refilled.
- do
- {
+ /* Poll IMEM Ready after CPU has refilled. */
+ do {
CPUStatus = read_nic_byte(dev, TCR);
- if(CPUStatus& IMEM_RDY)
- {
- RT_TRACE(COMP_FIRMWARE, "IMEM Ready after CPU has refilled.\n");
+ if (CPUStatus & IMEM_RDY)
+ /* success */
break;
- }
-
- //usleep(100);
udelay(100);
- }while(iCheckTime--);
-
- if(!(CPUStatus & IMEM_RDY))
- return RT_STATUS_FAILURE;
-
- RT_TRACE(COMP_FIRMWARE, "<--FirmwareEnableCPU(): rtStatus(%#x)\n", rtStatus);
+ } while (iCheckTime--);
+ if (!(CPUStatus & IMEM_RDY)) {
+ RT_TRACE(COMP_ERR, "(%s): failed to enable CPU\n", __func__);
+ rtStatus = RT_STATUS_FAILURE;
+ }
return rtStatus;
}
diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
index 04d9b85..04f8516 100644
--- a/drivers/staging/rtl8192su/r8192U_core.c
+++ b/drivers/staging/rtl8192su/r8192U_core.c
@@ -1278,7 +1278,6 @@ static int rtl8192_rx_initiate(struct net_device*dev)
kfree_skb(skb);
break;
}
-// printk("nomal packet IN request!\n");
usb_fill_bulk_urb(entry, priv->udev,
usb_rcvbulkpipe(priv->udev, 3), skb_tail_pointer(skb),
RX_URB_SIZE, rtl8192_rx_isr, skb);
@@ -1292,7 +1291,6 @@ static int rtl8192_rx_initiate(struct net_device*dev)
/* command packet rx procedure */
while (skb_queue_len(&priv->rx_queue) < MAX_RX_URB + 3) {
-// printk("command packet IN request!\n");
skb = __dev_alloc_skb(RX_URB_SIZE ,GFP_KERNEL);
if (!skb)
break;
diff --git a/drivers/staging/rtl8192su/r819xU_cmdpkt.c b/drivers/staging/rtl8192su/r819xU_cmdpkt.c
index 3ebfe79..e69c3b4 100644
--- a/drivers/staging/rtl8192su/r819xU_cmdpkt.c
+++ b/drivers/staging/rtl8192su/r819xU_cmdpkt.c
@@ -56,6 +56,12 @@ SendTxCommandPacket(
//Get TCB and local buffer from common pool. (It is shared by CmdQ, MgntQ, and USB coalesce DataQ)
skb = dev_alloc_skb(USB_HWDESC_HEADER_LEN + DataLen + 4);
+ if (skb == NULL) {
+ RT_TRACE(COMP_ERR, "(%s): unable to alloc skb buffer\n",
+ __func__);
+ rtStatus = false;
+ return rtStatus;
+ }
memcpy((unsigned char *)(skb->cb),&dev,sizeof(dev));
tcb_desc = (cb_desc*)(skb->cb + MAX_DEV_ADDR_SIZE);
tcb_desc->queue_index = TXCMD_QUEUE;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 118/196] Staging: rtl8192su: Clean up in case of an error in module initialisation
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (70 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 117/196] Staging: rtl8192su: check for skb == NULL Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 119/196] Staging: rtl8192su: Fix procfs code for interfaces not named wlan0 Paul Gortmaker
` (77 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Ben Hutchings, Greg Kroah-Hartman, Paul Gortmaker
From: Ben Hutchings <ben@decadent.org.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 9a3dfa0555130952517b9a9c3918729495aa709a upstream.
Currently various resources may be leaked in case of an error.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/staging/rtl8192su/r8192U_core.c | 43 ++++++++++++++++++++++++++-----
1 file changed, 36 insertions(+), 7 deletions(-)
diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
index 04f8516..9848d08 100644
--- a/drivers/staging/rtl8192su/r8192U_core.c
+++ b/drivers/staging/rtl8192su/r8192U_core.c
@@ -960,10 +960,11 @@ static int proc_get_stats_rx(char *page, char **start,
return len;
}
-void rtl8192_proc_module_init(void)
+int rtl8192_proc_module_init(void)
{
RT_TRACE(COMP_INIT, "Initializing proc filesystem");
rtl8192_proc=create_proc_entry(RTL819xU_MODULE_NAME, S_IFDIR, init_net.proc_net);
+ return rtl8192_proc ? 0 : -ENOMEM;
}
@@ -7526,35 +7527,63 @@ static int __init rtl8192_usb_module_init(void)
ret = ieee80211_crypto_init();
if (ret) {
printk(KERN_ERR "ieee80211_crypto_init() failed %d\n", ret);
- return ret;
+ goto fail_crypto;
}
ret = ieee80211_crypto_tkip_init();
if (ret) {
printk(KERN_ERR "ieee80211_crypto_tkip_init() failed %d\n",
ret);
- return ret;
+ goto fail_crypto_tkip;
}
ret = ieee80211_crypto_ccmp_init();
if (ret) {
printk(KERN_ERR "ieee80211_crypto_ccmp_init() failed %d\n",
ret);
- return ret;
+ goto fail_crypto_ccmp;
}
ret = ieee80211_crypto_wep_init();
if (ret) {
printk(KERN_ERR "ieee80211_crypto_wep_init() failed %d\n", ret);
- return ret;
+ goto fail_crypto_wep;
}
printk(KERN_INFO "\nLinux kernel driver for RTL8192 based WLAN cards\n");
printk(KERN_INFO "Copyright (c) 2007-2008, Realsil Wlan\n");
RT_TRACE(COMP_INIT, "Initializing module");
RT_TRACE(COMP_INIT, "Wireless extensions version %d", WIRELESS_EXT);
- rtl8192_proc_module_init();
- return usb_register(&rtl8192_usb_driver);
+
+ ret = rtl8192_proc_module_init();
+ if (ret) {
+ pr_err("rtl8192_proc_module_init() failed %d\n", ret);
+ goto fail_proc;
+ }
+
+ ret = usb_register(&rtl8192_usb_driver);
+ if (ret) {
+ pr_err("usb_register() failed %d\n", ret);
+ goto fail_usb;
+ }
+
+ return 0;
+
+fail_usb:
+ rtl8192_proc_module_remove();
+fail_proc:
+ ieee80211_crypto_wep_exit();
+fail_crypto_wep:
+ ieee80211_crypto_ccmp_exit();
+fail_crypto_ccmp:
+ ieee80211_crypto_tkip_exit();
+fail_crypto_tkip:
+ ieee80211_crypto_deinit();
+fail_crypto:
+#ifdef CONFIG_IEEE80211_DEBUG
+ ieee80211_debug_exit();
+#endif
+ return ret;
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 119/196] Staging: rtl8192su: Fix procfs code for interfaces not named wlan0
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (71 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 118/196] Staging: rtl8192su: Clean up in case of an error in module initialisation Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 120/196] Staging: rtl8192su: remove device ids Paul Gortmaker
` (76 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Ben Hutchings, Paul Gortmaker
From: Ben Hutchings <ben@decadent.org.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 41a38d9e632f7c9ec5ad8fc627567d97f4302c4a upstream.
The current code creates directories in procfs named after interfaces,
but doesn't handle renaming. This can result in name collisions and
consequent WARNINGs. It also means that the interface name cannot
reliably be used to remove the directory - in fact the current code
doesn't even try, and always uses "wlan0"!
Since the name of a proc_dir_entry is embedded in it, use that when
removing it.
Add a netdev notifier to catch interface renaming, and remove and
re-add the directory at this point.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/staging/rtl8192su/r8192U_core.c | 35 ++++++++++++++++++++++++++++---
1 file changed, 32 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
index 9848d08..7946cf6 100644
--- a/drivers/staging/rtl8192su/r8192U_core.c
+++ b/drivers/staging/rtl8192su/r8192U_core.c
@@ -26,6 +26,7 @@
#include <linux/vmalloc.h>
#include <linux/slab.h>
+#include <linux/notifier.h>
#undef LOOP_TEST
#undef DUMP_RX
@@ -161,6 +162,8 @@ MODULE_PARM_DESC(channels," Channel bitmask for specific locales. NYI");
static int __devinit rtl8192_usb_probe(struct usb_interface *intf,
const struct usb_device_id *id);
static void __devexit rtl8192_usb_disconnect(struct usb_interface *intf);
+static const struct net_device_ops rtl8192_netdev_ops;
+static struct notifier_block proc_netdev_notifier;
static struct usb_driver rtl8192_usb_driver = {
.name = RTL819xU_MODULE_NAME, /* Driver name */
@@ -962,14 +965,22 @@ static int proc_get_stats_rx(char *page, char **start,
int rtl8192_proc_module_init(void)
{
+ int ret;
+
RT_TRACE(COMP_INIT, "Initializing proc filesystem");
rtl8192_proc=create_proc_entry(RTL819xU_MODULE_NAME, S_IFDIR, init_net.proc_net);
- return rtl8192_proc ? 0 : -ENOMEM;
+ if (!rtl8192_proc)
+ return -ENOMEM;
+ ret = register_netdevice_notifier(&proc_netdev_notifier);
+ if (ret)
+ remove_proc_entry(RTL819xU_MODULE_NAME, init_net.proc_net);
+ return ret;
}
void rtl8192_proc_module_remove(void)
{
+ unregister_netdevice_notifier(&proc_netdev_notifier);
remove_proc_entry(RTL819xU_MODULE_NAME, init_net.proc_net);
}
@@ -997,8 +1008,7 @@ void rtl8192_proc_remove_one(struct net_device *dev)
remove_proc_entry("registers-e", priv->dir_dev);
// remove_proc_entry("cck-registers",priv->dir_dev);
// remove_proc_entry("ofdm-registers",priv->dir_dev);
- //remove_proc_entry(dev->name, rtl8192_proc);
- remove_proc_entry("wlan0", rtl8192_proc);
+ remove_proc_entry(priv->dir_dev->name, rtl8192_proc);
priv->dir_dev = NULL;
}
}
@@ -1115,6 +1125,25 @@ void rtl8192_proc_init_one(struct net_device *dev)
dev->name);
}
}
+
+static int proc_netdev_event(struct notifier_block *this,
+ unsigned long event, void *ptr)
+{
+ struct net_device *net_dev = ptr;
+
+ if (net_dev->netdev_ops == &rtl8192_netdev_ops &&
+ event == NETDEV_CHANGENAME) {
+ rtl8192_proc_remove_one(net_dev);
+ rtl8192_proc_init_one(net_dev);
+ }
+
+ return NOTIFY_DONE;
+}
+
+static struct notifier_block proc_netdev_notifier = {
+ .notifier_call = proc_netdev_event,
+};
+
/****************************************************************************
-----------------------------MISC STUFF-------------------------
*****************************************************************************/
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 120/196] Staging: rtl8192su: remove device ids
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (72 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 119/196] Staging: rtl8192su: Fix procfs code for interfaces not named wlan0 Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 121/196] Staging: rtl8192su: add " Paul Gortmaker
` (75 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Florian Schilhabel, Greg Kroah-Hartman, Paul Gortmaker
From: Florian Schilhabel <florian.c.schilhabel@googlemail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 60b42de30ad6fb131dc8e9dbd11a8a9ea0ab394c upstream.
This patch removes some device-ids.
The list of unsupported devices was extracted from realteks driver package.
removed IDs are:
(0x0bda, 0x8192)
(0x0bda, 0x8709)
(0x07aa, 0x0043)
(0x050d, 0x805E)
(0x0df6, 0x0031)
(0x1740, 0x9201)
(0x2001, 0x3301)
(0x5a57, 0x0290)
These devices are _not_ rtl819su based.
Signed-off-by: Florian Schilhabel <florian.c.schilhabel@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/staging/rtl8192su/r8192U_core.c | 14 --------------
1 file changed, 14 deletions(-)
diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
index 7946cf6..f4cc5f0 100644
--- a/drivers/staging/rtl8192su/r8192U_core.c
+++ b/drivers/staging/rtl8192su/r8192U_core.c
@@ -115,22 +115,8 @@ u32 rt_global_debug_component = \
static const struct usb_device_id rtl8192_usb_id_tbl[] = {
/* Realtek */
{USB_DEVICE(0x0bda, 0x8171)},
- {USB_DEVICE(0x0bda, 0x8192)},
- {USB_DEVICE(0x0bda, 0x8709)},
- /* Corega */
- {USB_DEVICE(0x07aa, 0x0043)},
- /* Belkin */
- {USB_DEVICE(0x050d, 0x805E)},
{USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */
- /* Sitecom */
- {USB_DEVICE(0x0df6, 0x0031)},
{USB_DEVICE(0x0df6, 0x004b)}, /* WL-349 */
- /* EnGenius */
- {USB_DEVICE(0x1740, 0x9201)},
- /* Dlink */
- {USB_DEVICE(0x2001, 0x3301)},
- /* Zinwell */
- {USB_DEVICE(0x5a57, 0x0290)},
/* Guillemot */
{USB_DEVICE(0x06f8, 0xe031)},
//92SU
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 121/196] Staging: rtl8192su: add device ids
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (73 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 120/196] Staging: rtl8192su: remove device ids Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 122/196] USB: teach "devices" file about Wireless and SuperSpeed USB Paul Gortmaker
` (74 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Florian Schilhabel, Greg Kroah-Hartman, Paul Gortmaker
From: Florian Schilhabel <florian.c.schilhabel@googlemail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 15d93ed070125d51693f102a0f94045dcaf30d9b upstream.
This patch adds some device ids.
The list of supported devices was extracted from realteks driver package.
(0x050d, 0x815F) and (0x0df6, 0x004b) are not in the official list of
supported devices and may not work correctly.
In case of problems with these, they should probably be removed from the list.
Signed-off-by: Florian Schilhabel <florian.c.schilhabel@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/staging/rtl8192su/r8192U_core.c | 30 +++++++++++++++++++++++-------
1 file changed, 23 insertions(+), 7 deletions(-)
diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
index f4cc5f0..a813a7b 100644
--- a/drivers/staging/rtl8192su/r8192U_core.c
+++ b/drivers/staging/rtl8192su/r8192U_core.c
@@ -113,14 +113,30 @@ u32 rt_global_debug_component = \
#define CAM_CONTENT_COUNT 8
static const struct usb_device_id rtl8192_usb_id_tbl[] = {
- /* Realtek */
- {USB_DEVICE(0x0bda, 0x8171)},
- {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */
- {USB_DEVICE(0x0df6, 0x004b)}, /* WL-349 */
- /* Guillemot */
- {USB_DEVICE(0x06f8, 0xe031)},
- //92SU
+ {USB_DEVICE(0x0bda, 0x8171)}, /* Realtek */
{USB_DEVICE(0x0bda, 0x8172)},
+ {USB_DEVICE(0x0bda, 0x8173)},
+ {USB_DEVICE(0x0bda, 0x8174)},
+ {USB_DEVICE(0x0bda, 0x8712)},
+ {USB_DEVICE(0x0bda, 0x8713)},
+ {USB_DEVICE(0x07aa, 0x0047)},
+ {USB_DEVICE(0x07d1, 0x3303)},
+ {USB_DEVICE(0x07d1, 0x3302)},
+ {USB_DEVICE(0x07d1, 0x3300)},
+ {USB_DEVICE(0x1740, 0x9603)},
+ {USB_DEVICE(0x1740, 0x9605)},
+ {USB_DEVICE(0x050d, 0x815F)},
+ {USB_DEVICE(0x06f8, 0xe031)},
+ {USB_DEVICE(0x7392, 0x7611)},
+ {USB_DEVICE(0x7392, 0x7612)},
+ {USB_DEVICE(0x7392, 0x7622)},
+ {USB_DEVICE(0x0DF6, 0x0045)},
+ {USB_DEVICE(0x0E66, 0x0015)},
+ {USB_DEVICE(0x0E66, 0x0016)},
+ {USB_DEVICE(0x0b05, 0x1786)},
+ /* these are not in the official list */
+ {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */
+ {USB_DEVICE(0x0df6, 0x004b)}, /* WL-349 */
{}
};
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 122/196] USB: teach "devices" file about Wireless and SuperSpeed USB
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (74 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 121/196] Staging: rtl8192su: add " Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 123/196] GFS2: Fix writing to non-page aligned gfs2_quota structures Paul Gortmaker
` (73 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Alan Stern, David Vrabel, Sarah Sharp,
Greg Kroah-Hartman, Paul Gortmaker
From: Alan Stern <stern@rowland.harvard.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 834e2312e7a384877a876b0d34dffc3046c96bcb upstream.
The /sys/kernel/debug/usb/devices file doesn't know about Wireless or
SuperSpeed USB. This patch (as1416b) teaches it, and updates the
Documentation/usb/proc_sub_info.txt file accordingly.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: David Vrabel <david.vrabel@csr.com>
CC: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
Documentation/usb/proc_usb_info.txt | 34 ++++++++++++++++++++++------------
drivers/usb/core/devices.c | 11 +++++++----
2 files changed, 29 insertions(+), 16 deletions(-)
diff --git a/Documentation/usb/proc_usb_info.txt b/Documentation/usb/proc_usb_info.txt
index fafcd47..afe596d 100644
--- a/Documentation/usb/proc_usb_info.txt
+++ b/Documentation/usb/proc_usb_info.txt
@@ -1,12 +1,17 @@
/proc/bus/usb filesystem output
===============================
-(version 2003.05.30)
+(version 2010.09.13)
The usbfs filesystem for USB devices is traditionally mounted at
/proc/bus/usb. It provides the /proc/bus/usb/devices file, as well as
the /proc/bus/usb/BBB/DDD files.
+In many modern systems the usbfs filsystem isn't used at all. Instead
+USB device nodes are created under /dev/usb/ or someplace similar. The
+"devices" file is available in debugfs, typically as
+/sys/kernel/debug/usb/devices.
+
**NOTE**: If /proc/bus/usb appears empty, and a host controller
driver has been linked, then you need to mount the
@@ -106,8 +111,8 @@ Legend:
Topology info:
-T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd
-| | | | | | | | |__MaxChildren
+T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=dddd MxCh=dd
+| | | | | | | | |__MaxChildren
| | | | | | | |__Device Speed in Mbps
| | | | | | |__DeviceNumber
| | | | | |__Count of devices at this level
@@ -120,8 +125,13 @@ T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd
Speed may be:
1.5 Mbit/s for low speed USB
12 Mbit/s for full speed USB
- 480 Mbit/s for high speed USB (added for USB 2.0)
+ 480 Mbit/s for high speed USB (added for USB 2.0);
+ also used for Wireless USB, which has no fixed speed
+ 5000 Mbit/s for SuperSpeed USB (added for USB 3.0)
+ For reasons lost in the mists of time, the Port number is always
+ too low by 1. For example, a device plugged into port 4 will
+ show up with "Port=03".
Bandwidth info:
B: Alloc=ddd/ddd us (xx%), #Int=ddd, #Iso=ddd
@@ -291,7 +301,7 @@ Here's an example, from a system which has a UHCI root hub,
an external hub connected to the root hub, and a mouse and
a serial converter connected to the external hub.
-T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
+T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
B: Alloc= 28/900 us ( 3%), #Int= 2, #Iso= 0
D: Ver= 1.00 Cls=09(hub ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=0000 ProdID=0000 Rev= 0.00
@@ -301,21 +311,21 @@ C:* #Ifs= 1 Cfg#= 1 Atr=40 MxPwr= 0mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
E: Ad=81(I) Atr=03(Int.) MxPS= 8 Ivl=255ms
-T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4
+T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4
D: Ver= 1.00 Cls=09(hub ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=0451 ProdID=1446 Rev= 1.00
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
E: Ad=81(I) Atr=03(Int.) MxPS= 1 Ivl=255ms
-T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0
+T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0
D: Ver= 1.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=04b4 ProdID=0001 Rev= 0.00
C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=01 Prot=02 Driver=mouse
E: Ad=81(I) Atr=03(Int.) MxPS= 3 Ivl= 10ms
-T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
+T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 1.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=0565 ProdID=0001 Rev= 1.08
S: Manufacturer=Peracom Networks, Inc.
@@ -330,12 +340,12 @@ E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl= 8ms
Selecting only the "T:" and "I:" lines from this (for example, by using
"procusb ti"), we have:
-T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
-T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4
+T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
+T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4
I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
-T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0
+T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0
I: If#= 0 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=01 Prot=02 Driver=mouse
-T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
+T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
I: If#= 0 Alt= 0 #EPs= 3 Cls=00(>ifc ) Sub=00 Prot=00 Driver=serial
diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
index 7013296..0ce4230 100644
--- a/drivers/usb/core/devices.c
+++ b/drivers/usb/core/devices.c
@@ -65,8 +65,8 @@
#define ALLOW_SERIAL_NUMBER
static const char *format_topo =
-/* T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd */
-"\nT: Bus=%2.2d Lev=%2.2d Prnt=%2.2d Port=%2.2d Cnt=%2.2d Dev#=%3d Spd=%3s MxCh=%2d\n";
+/* T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=dddd MxCh=dd */
+"\nT: Bus=%2.2d Lev=%2.2d Prnt=%2.2d Port=%2.2d Cnt=%2.2d Dev#=%3d Spd=%-4s MxCh=%2d\n";
static const char *format_string_manufacturer =
/* S: Manufacturer=xxxx */
@@ -518,11 +518,14 @@ static ssize_t usb_device_dump(char __user **buffer, size_t *nbytes,
speed = "1.5"; break;
case USB_SPEED_UNKNOWN: /* usb 1.1 root hub code */
case USB_SPEED_FULL:
- speed = "12 "; break;
+ speed = "12"; break;
+ case USB_SPEED_WIRELESS: /* Wireless has no real fixed speed */
case USB_SPEED_HIGH:
speed = "480"; break;
+ case USB_SPEED_SUPER:
+ speed = "5000"; break;
default:
- speed = "?? ";
+ speed = "??";
}
data_end = pages_start + sprintf(pages_start, format_topo,
bus->busnum, level, parent_devnum,
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 123/196] GFS2: Fix writing to non-page aligned gfs2_quota structures
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (75 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 122/196] USB: teach "devices" file about Wireless and SuperSpeed USB Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 124/196] GFS2: BUG in gfs2_adjust_quota Paul Gortmaker
` (72 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Abhijith Das, Steven Whitehouse, Paul Gortmaker
From: Abhijith Das <adas@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 7e619bc3e6252dc746f64ac3b486e784822e9533 upstream.
This is the upstream fix for this bug. This patch differs
from the RHEL5 fix (Red Hat bz #555754) which simply writes to the 8-byte
value field of the quota. In upstream quota code, we're
required to write the entire quota (88 bytes) which can be split
across a page boundary. We check for such quotas, and read/write
the two parts from/to the corresponding pages holding these parts.
With this patch, I don't see the bug anymore using the reproducer
in Red Hat bz 555754. I successfully ran a couple of simple tests/mounts/
umounts and it doesn't seem like this patch breaks anything else.
[PG: fix cosmetic whitespace warning coming from git am]
Signed-off-by: Abhi Das <adas@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/gfs2/quota.c | 86 +++++++++++++++++++++++++++++++++++++++----------------
1 file changed, 61 insertions(+), 25 deletions(-)
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 6dbcbad..f1c8d79 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -637,15 +637,40 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
unsigned blocksize, iblock, pos;
struct buffer_head *bh, *dibh;
struct page *page;
- void *kaddr;
- struct gfs2_quota *qp;
- s64 value;
- int err = -EIO;
+ void *kaddr, *ptr;
+ struct gfs2_quota q, *qp;
+ int err, nbytes;
u64 size;
if (gfs2_is_stuffed(ip))
gfs2_unstuff_dinode(ip, NULL);
-
+
+ memset(&q, 0, sizeof(struct gfs2_quota));
+ err = gfs2_internal_read(ip, NULL, (char *)&q, &loc, sizeof(q));
+ if (err < 0)
+ return err;
+
+ err = -EIO;
+ qp = &q;
+ qp->qu_value = be64_to_cpu(qp->qu_value);
+ qp->qu_value += change;
+ qp->qu_value = cpu_to_be64(qp->qu_value);
+ qd->qd_qb.qb_value = qp->qu_value;
+ if (fdq) {
+ if (fdq->d_fieldmask & FS_DQ_BSOFT) {
+ qp->qu_warn = cpu_to_be64(fdq->d_blk_softlimit);
+ qd->qd_qb.qb_warn = qp->qu_warn;
+ }
+ if (fdq->d_fieldmask & FS_DQ_BHARD) {
+ qp->qu_limit = cpu_to_be64(fdq->d_blk_hardlimit);
+ qd->qd_qb.qb_limit = qp->qu_limit;
+ }
+ }
+
+ /* Write the quota into the quota file on disk */
+ ptr = qp;
+ nbytes = sizeof(struct gfs2_quota);
+get_a_page:
page = grab_cache_page(mapping, index);
if (!page)
return -ENOMEM;
@@ -667,7 +692,12 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
if (!buffer_mapped(bh)) {
gfs2_block_map(inode, iblock, bh, 1);
if (!buffer_mapped(bh))
- goto unlock;
+ goto unlock_out;
+ /* If it's a newly allocated disk block for quota, zero it */
+ if (buffer_new(bh)) {
+ memset(bh->b_data, 0, bh->b_size);
+ set_buffer_uptodate(bh);
+ }
}
if (PageUptodate(page))
@@ -677,32 +707,34 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
ll_rw_block(READ_META, 1, &bh);
wait_on_buffer(bh);
if (!buffer_uptodate(bh))
- goto unlock;
+ goto unlock_out;
}
gfs2_trans_add_bh(ip->i_gl, bh, 0);
kaddr = kmap_atomic(page, KM_USER0);
- qp = kaddr + offset;
- value = (s64)be64_to_cpu(qp->qu_value) + change;
- qp->qu_value = cpu_to_be64(value);
- qd->qd_qb.qb_value = qp->qu_value;
- if (fdq) {
- if (fdq->d_fieldmask & FS_DQ_BSOFT) {
- qp->qu_warn = cpu_to_be64(fdq->d_blk_softlimit);
- qd->qd_qb.qb_warn = qp->qu_warn;
- }
- if (fdq->d_fieldmask & FS_DQ_BHARD) {
- qp->qu_limit = cpu_to_be64(fdq->d_blk_hardlimit);
- qd->qd_qb.qb_limit = qp->qu_limit;
- }
- }
+ if (offset + sizeof(struct gfs2_quota) > PAGE_CACHE_SIZE)
+ nbytes = PAGE_CACHE_SIZE - offset;
+ memcpy(kaddr + offset, ptr, nbytes);
flush_dcache_page(page);
kunmap_atomic(kaddr, KM_USER0);
+ unlock_page(page);
+ page_cache_release(page);
+
+ /* If quota straddles page boundary, we need to update the rest of the
+ * quota at the beginning of the next page */
+ if (offset != 0) { /* first page, offset is closer to PAGE_CACHE_SIZE */
+ ptr = ptr + nbytes;
+ nbytes = sizeof(struct gfs2_quota) - nbytes;
+ offset = 0;
+ index++;
+ goto get_a_page;
+ }
+ /* Update the disk inode timestamp and size (if extended) */
err = gfs2_meta_inode_buffer(ip, &dibh);
if (err)
- goto unlock;
+ goto out;
size = loc + sizeof(struct gfs2_quota);
if (size > inode->i_size) {
@@ -715,7 +747,9 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
brelse(dibh);
mark_inode_dirty(inode);
-unlock:
+out:
+ return err;
+unlock_out:
unlock_page(page);
page_cache_release(page);
return err;
@@ -779,8 +813,10 @@ static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda)
* rgrp since it won't be allocated during the transaction
*/
al->al_requested = 1;
- /* +1 in the end for block requested above for unstuffing */
- blocks = num_qd * data_blocks + RES_DINODE + num_qd + 1;
+ /* +3 in the end for unstuffing block, inode size update block
+ * and another block in case quota straddles page boundary and
+ * two blocks need to be updated instead of 1 */
+ blocks = num_qd * data_blocks + RES_DINODE + num_qd + 3;
if (nalloc)
al->al_requested += nalloc * (data_blocks + ind_blocks);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 124/196] GFS2: BUG in gfs2_adjust_quota
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (76 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 123/196] GFS2: Fix writing to non-page aligned gfs2_quota structures Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 125/196] SUNRPC: fix NFS client over TCP hangs due to packet loss (Bug 16494) Paul Gortmaker
` (71 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Abhijith Das, Steven Whitehouse, Paul Gortmaker
From: Abhijith Das <adas@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 8b4216018bdbfbb1b76150d202b15ee68c38e991 upstream.
HighMem pages on i686 do not get mapped to the buffer_heads and this was
causing a NULL pointer dereference when we were trying to memset page buffers
to zero.
We now use zero_user() that kmaps the page and directly manipulates page data.
This patch also fixes a boundary condition that was incorrect.
Signed-off-by: Abhi Das <adas@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/gfs2/quota.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index f1c8d79..f9358a2 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -694,10 +694,8 @@ get_a_page:
if (!buffer_mapped(bh))
goto unlock_out;
/* If it's a newly allocated disk block for quota, zero it */
- if (buffer_new(bh)) {
- memset(bh->b_data, 0, bh->b_size);
- set_buffer_uptodate(bh);
- }
+ if (buffer_new(bh))
+ zero_user(page, pos - blocksize, bh->b_size);
}
if (PageUptodate(page))
@@ -723,7 +721,7 @@ get_a_page:
/* If quota straddles page boundary, we need to update the rest of the
* quota at the beginning of the next page */
- if (offset != 0) { /* first page, offset is closer to PAGE_CACHE_SIZE */
+ if ((offset + sizeof(struct gfs2_quota)) > PAGE_CACHE_SIZE) {
ptr = ptr + nbytes;
nbytes = sizeof(struct gfs2_quota) - nbytes;
offset = 0;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 125/196] SUNRPC: fix NFS client over TCP hangs due to packet loss (Bug 16494)
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (77 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 124/196] GFS2: BUG in gfs2_adjust_quota Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 126/196] nfs: fix compilation warning Paul Gortmaker
` (70 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Andy Chittenden, Trond Myklebust, Paul Gortmaker
From: Andy Chittenden <andyc.bluearc@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 669502ff31d7dba1849aec7ee2450a3c61f57d39 upstream.
When reusing a TCP connection, ensure that it's aborted if a previous
shutdown attempt has been made on that connection so that the RPC over
TCP recovery mechanism succeeds.
Signed-off-by: Andy Chittenden <andyc.bluearc@gmail.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/sunrpc/xprtsock.c | 28 ++++++++++++++++++++++------
1 file changed, 22 insertions(+), 6 deletions(-)
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index b613cb7..9bfb685 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1324,10 +1324,11 @@ static void xs_tcp_state_change(struct sock *sk)
if (!(xprt = xprt_from_sock(sk)))
goto out;
dprintk("RPC: xs_tcp_state_change client %p...\n", xprt);
- dprintk("RPC: state %x conn %d dead %d zapped %d\n",
+ dprintk("RPC: state %x conn %d dead %d zapped %d sk_shutdown %d\n",
sk->sk_state, xprt_connected(xprt),
sock_flag(sk, SOCK_DEAD),
- sock_flag(sk, SOCK_ZAPPED));
+ sock_flag(sk, SOCK_ZAPPED),
+ sk->sk_shutdown);
switch (sk->sk_state) {
case TCP_ESTABLISHED:
@@ -1798,10 +1799,25 @@ static void xs_tcp_reuse_connection(struct rpc_xprt *xprt, struct sock_xprt *tra
{
unsigned int state = transport->inet->sk_state;
- if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED)
- return;
- if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT))
- return;
+ if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED) {
+ /* we don't need to abort the connection if the socket
+ * hasn't undergone a shutdown
+ */
+ if (transport->inet->sk_shutdown == 0)
+ return;
+ dprintk("RPC: %s: TCP_CLOSEd and sk_shutdown set to %d\n",
+ __func__, transport->inet->sk_shutdown);
+ }
+ if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT)) {
+ /* we don't need to abort the connection if the socket
+ * hasn't undergone a shutdown
+ */
+ if (transport->inet->sk_shutdown == 0)
+ return;
+ dprintk("RPC: %s: ESTABLISHED/SYN_SENT "
+ "sk_shutdown set to %d\n",
+ __func__, transport->inet->sk_shutdown);
+ }
xs_abort_connection(xprt, transport);
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 126/196] nfs: fix compilation warning
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (78 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 125/196] SUNRPC: fix NFS client over TCP hangs due to packet loss (Bug 16494) Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 127/196] Fix corrupted OSF partition table parsing Paul Gortmaker
` (69 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jovi Zhang, Trond Myklebust, Paul Gortmaker
From: Jovi Zhang <bookjovi@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 43b7c3f051dea504afccc39bcb56d8e26c2e0b77 upstream.
this commit fix compilation warning as following:
linux-2.6/fs/nfs/nfs4proc.c:3265: warning: comparison of distinct pointer types lacks a cast
Signed-off-by: Jovi Zhang <bookjovi@gmail.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfs/nfs4proc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 5b33856..8dd3309 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3251,7 +3251,7 @@ static int buf_to_pages_noslab(const void *buf, size_t buflen,
spages = pages;
do {
- len = min(PAGE_CACHE_SIZE, buflen);
+ len = min_t(size_t, PAGE_CACHE_SIZE, buflen);
newpage = alloc_page(GFP_KERNEL);
if (newpage == NULL)
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 127/196] Fix corrupted OSF partition table parsing
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (79 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 126/196] nfs: fix compilation warning Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 128/196] Increase OSF partition limit from 8 to 18 Paul Gortmaker
` (68 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Timo Warns, Timo Warns, Linus Torvalds, Paul Gortmaker
From: Timo Warns <Warns@pre-sense.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 1eafbfeb7bdf59cfe173304c76188f3fd5f1fd05 upstream.
The kernel automatically evaluates partition tables of storage devices.
The code for evaluating OSF partitions contains a bug that leaks data
from kernel heap memory to userspace for certain corrupted OSF
partitions.
In more detail:
for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) {
iterates from 0 to d_npartitions - 1, where d_npartitions is read from
the partition table without validation and partition is a pointer to an
array of at most 8 d_partitions.
Add the proper and obvious validation.
Signed-off-by: Timo Warns <warns@pre-sense.de>
[ Changed the patch trivially to not repeat the whole le16_to_cpu()
thing, and to use an explicit constant for the magic value '8' ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/partitions/osf.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/fs/partitions/osf.c b/fs/partitions/osf.c
index c05c17bc..6e0825e 100644
--- a/fs/partitions/osf.c
+++ b/fs/partitions/osf.c
@@ -10,10 +10,13 @@
#include "check.h"
#include "osf.h"
+#define MAX_OSF_PARTITIONS 8
+
int osf_partition(struct parsed_partitions *state, struct block_device *bdev)
{
int i;
int slot = 1;
+ unsigned int npartitions;
Sector sect;
unsigned char *data;
struct disklabel {
@@ -45,7 +48,7 @@ int osf_partition(struct parsed_partitions *state, struct block_device *bdev)
u8 p_fstype;
u8 p_frag;
__le16 p_cpg;
- } d_partitions[8];
+ } d_partitions[MAX_OSF_PARTITIONS];
} * label;
struct d_partition * partition;
@@ -63,7 +66,12 @@ int osf_partition(struct parsed_partitions *state, struct block_device *bdev)
put_dev_sector(sect);
return 0;
}
- for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) {
+ npartitions = le16_to_cpu(label->d_npartitions);
+ if (npartitions > MAX_OSF_PARTITIONS) {
+ put_dev_sector(sect);
+ return 0;
+ }
+ for (i = 0 ; i < npartitions; i++, partition++) {
if (slot == state->limit)
break;
if (le32_to_cpu(partition->p_size))
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 128/196] Increase OSF partition limit from 8 to 18
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (80 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 127/196] Fix corrupted OSF partition table parsing Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 129/196] hwmon: (applesmc) Add support for MacBook Pro 5,3 and 5,4 Paul Gortmaker
` (67 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Linus Torvalds, Paul Gortmaker
From: Linus Torvalds <torvalds@linux-foundation.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 34d211a2d5df4984a35b18d8ccacbe1d10abb067 upstream.
It turns out that while a maximum of 8 partitions may be what people
"should" have had, you can actually fit up to 18 entries(*) in a sector.
And some people clearly were taking advantage of that, like Michael
Cree, who had ten partitions on one of his OSF disks.
(*) The OSF partition data starts at byte offset 64 in the first sector,
and the array of 16-byte partition entries start at offset 148 in
the on-disk partition structure.
Reported-by: Michael Cree <mcree@orcon.net.nz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/partitions/osf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/partitions/osf.c b/fs/partitions/osf.c
index 6e0825e..9ddca58 100644
--- a/fs/partitions/osf.c
+++ b/fs/partitions/osf.c
@@ -10,7 +10,7 @@
#include "check.h"
#include "osf.h"
-#define MAX_OSF_PARTITIONS 8
+#define MAX_OSF_PARTITIONS 18
int osf_partition(struct parsed_partitions *state, struct block_device *bdev)
{
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 129/196] hwmon: (applesmc) Add support for MacBook Pro 5,3 and 5,4
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (81 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 128/196] Increase OSF partition limit from 8 to 18 Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 130/196] hwmon: (applesmc) Add generic support for MacBook Pro 6 Paul Gortmaker
` (66 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Henrik Rydberg, Jean Delvare, Paul Gortmaker
From: Henrik Rydberg <rydberg@euromail.se>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 4e4a99d32721800c061191027f18f780dcbd9e0b upstream.
The MacBookPro 5,3 model has two fans, whereas the 5,4 model has
only one. This patch adds explicit support for the 5,3 and 5,4 models.
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/hwmon/applesmc.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index f085c18..be33094 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -148,6 +148,13 @@ static const char *temperature_sensors_sets[][41] = {
/* Set 18: MacBook Pro 2,2 */
{ "TB0T", "TC0D", "TC0P", "TG0H", "TG0P", "TG0T", "TM0P", "TTF0",
"Th0H", "Th1H", "Tm0P", "Ts0P", NULL },
+/* Set 19: Macbook Pro 5,3 */
+ { "TB0T", "TB1T", "TB2T", "TB3T", "TC0D", "TC0F", "TC0P", "TG0D",
+ "TG0F", "TG0H", "TG0P", "TG0T", "TN0D", "TN0P", "TTF0", "Th2H",
+ "Tm0P", "Ts0P", "Ts0S", NULL },
+/* Set 20: MacBook Pro 5,4 */
+ { "TB0T", "TB1T", "TB2T", "TB3T", "TC0D", "TC0F", "TC0P", "TN0D",
+ "TN0P", "TTF0", "Th2H", "Ts0P", "Ts0S", NULL },
};
/* List of keys used to read/write fan speeds */
@@ -1363,6 +1370,10 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = {
{ .accelerometer = 0, .light = 0, .temperature_set = 17 },
/* MacBook Pro 2,2: accelerometer, backlight and temperature set 18 */
{ .accelerometer = 1, .light = 1, .temperature_set = 18 },
+/* MacBook Pro 5,3: accelerometer, backlight and temperature set 19 */
+ { .accelerometer = 1, .light = 1, .temperature_set = 19 },
+/* MacBook Pro 5,4: accelerometer, backlight and temperature set 20 */
+ { .accelerometer = 1, .light = 1, .temperature_set = 20 },
};
/* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1".
@@ -1376,6 +1387,14 @@ static __initdata struct dmi_system_id applesmc_whitelist[] = {
DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir") },
&applesmc_dmi_data[7]},
+ { applesmc_dmi_match, "Apple MacBook Pro 5,4", {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,4") },
+ &applesmc_dmi_data[20]},
+ { applesmc_dmi_match, "Apple MacBook Pro 5,3", {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,3") },
+ &applesmc_dmi_data[19]},
{ applesmc_dmi_match, "Apple MacBook Pro 5", {
DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5") },
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 130/196] hwmon: (applesmc) Add generic support for MacBook Pro 6
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (82 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 129/196] hwmon: (applesmc) Add support for MacBook Pro 5,3 and 5,4 Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 131/196] hwmon: (applesmc) Add generic support for MacBook Pro 7 Paul Gortmaker
` (65 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Bernhard Froemel, Henrik Rydberg, Jean Delvare,
Paul Gortmaker
From: Bernhard Froemel <froemel@vmars.tuwien.ac.at>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 872bad55e2d3fcc13e1e8770a3b200f0c6ca5126 upstream.
This patch adds generic support for the MacBook Pro 6 family
based on the 6,2 model.
[rydberg@euromail.se: patch cleanup]
Signed-off-by: Bernhard Froemel <froemel@vmars.tuwien.ac.at>
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/hwmon/applesmc.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index be33094..ce41a43 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -155,6 +155,10 @@ static const char *temperature_sensors_sets[][41] = {
/* Set 20: MacBook Pro 5,4 */
{ "TB0T", "TB1T", "TB2T", "TB3T", "TC0D", "TC0F", "TC0P", "TN0D",
"TN0P", "TTF0", "Th2H", "Ts0P", "Ts0S", NULL },
+/* Set 21: MacBook Pro 6,2 */
+ { "TB0T", "TB1T", "TB2T", "TC0C", "TC0D", "TC0P", "TC1C", "TG0D",
+ "TG0P", "TG0T", "TMCD", "TP0P", "TPCD", "Th1H", "Th2H", "Tm0P",
+ "Ts0P", "Ts0S", NULL },
};
/* List of keys used to read/write fan speeds */
@@ -1374,6 +1378,8 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = {
{ .accelerometer = 1, .light = 1, .temperature_set = 19 },
/* MacBook Pro 5,4: accelerometer, backlight and temperature set 20 */
{ .accelerometer = 1, .light = 1, .temperature_set = 20 },
+/* MacBook Pro 6,2: accelerometer, backlight and temperature set 21 */
+ { .accelerometer = 1, .light = 1, .temperature_set = 21 },
};
/* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1".
@@ -1395,6 +1401,10 @@ static __initdata struct dmi_system_id applesmc_whitelist[] = {
DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,3") },
&applesmc_dmi_data[19]},
+ { applesmc_dmi_match, "Apple MacBook Pro 6", {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro6") },
+ &applesmc_dmi_data[21]},
{ applesmc_dmi_match, "Apple MacBook Pro 5", {
DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5") },
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 131/196] hwmon: (applesmc) Add generic support for MacBook Pro 7
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (83 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 130/196] hwmon: (applesmc) Add generic support for MacBook Pro 6 Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 132/196] hwmon: (applesmc) Add MacBookAir3,1(3,2) support Paul Gortmaker
` (64 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Henrik Rydberg, Jean Delvare, Paul Gortmaker
From: Henrik Rydberg <rydberg@euromail.se>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 405eaa1c1d045cdd872802fc515f638573984880 upstream.
This patch adds generic support for the MacBook Pro 7 family
based on the 7,1 model.
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/hwmon/applesmc.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index ce41a43..57c0331 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -159,6 +159,9 @@ static const char *temperature_sensors_sets[][41] = {
{ "TB0T", "TB1T", "TB2T", "TC0C", "TC0D", "TC0P", "TC1C", "TG0D",
"TG0P", "TG0T", "TMCD", "TP0P", "TPCD", "Th1H", "Th2H", "Tm0P",
"Ts0P", "Ts0S", NULL },
+/* Set 22: MacBook Pro 7,1 */
+ { "TB0T", "TB1T", "TB2T", "TC0D", "TC0P", "TN0D", "TN0P", "TN0S",
+ "TN1D", "TN1F", "TN1G", "TN1S", "Th1H", "Ts0P", "Ts0S", NULL },
};
/* List of keys used to read/write fan speeds */
@@ -1380,6 +1383,8 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = {
{ .accelerometer = 1, .light = 1, .temperature_set = 20 },
/* MacBook Pro 6,2: accelerometer, backlight and temperature set 21 */
{ .accelerometer = 1, .light = 1, .temperature_set = 21 },
+/* MacBook Pro 7,1: accelerometer, backlight and temperature set 22 */
+ { .accelerometer = 1, .light = 1, .temperature_set = 22 },
};
/* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1".
@@ -1393,6 +1398,10 @@ static __initdata struct dmi_system_id applesmc_whitelist[] = {
DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir") },
&applesmc_dmi_data[7]},
+ { applesmc_dmi_match, "Apple MacBook Pro 7", {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro7") },
+ &applesmc_dmi_data[22]},
{ applesmc_dmi_match, "Apple MacBook Pro 5,4", {
DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,4") },
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 132/196] hwmon: (applesmc) Add MacBookAir3,1(3,2) support
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (84 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 131/196] hwmon: (applesmc) Add generic support for MacBook Pro 7 Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 133/196] ALSA: emux: Add trivial compat ioctl handler Paul Gortmaker
` (63 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Edgar Hucek, Henrik Rydberg, Guenter Roeck,
Paul Gortmaker
From: Edgar Hucek <gimli@dark-green.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 132af03233b493101a53010383b5abb5b9ff1e51 upstream.
This patch add support for the MacBookAir3,1 and MacBookAir3,2 to the
applesmc driver.
[rydberg@euromail.se: minor cleanup]
Signed-off-by: Edgar Hucek <gimli@dark-green.com>
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/hwmon/applesmc.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 57c0331..7765a6b 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -162,6 +162,10 @@ static const char *temperature_sensors_sets[][41] = {
/* Set 22: MacBook Pro 7,1 */
{ "TB0T", "TB1T", "TB2T", "TC0D", "TC0P", "TN0D", "TN0P", "TN0S",
"TN1D", "TN1F", "TN1G", "TN1S", "Th1H", "Ts0P", "Ts0S", NULL },
+/* Set 23: MacBook Air 3,1 */
+ { "TB0T", "TB1T", "TB2T", "TC0D", "TC0E", "TC0P", "TC1E", "TCZ3",
+ "TCZ4", "TCZ5", "TG0E", "TG1E", "TG2E", "TGZ3", "TGZ4", "TGZ5",
+ "TH0F", "TH0O", "TM0P" },
};
/* List of keys used to read/write fan speeds */
@@ -1385,11 +1389,17 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = {
{ .accelerometer = 1, .light = 1, .temperature_set = 21 },
/* MacBook Pro 7,1: accelerometer, backlight and temperature set 22 */
{ .accelerometer = 1, .light = 1, .temperature_set = 22 },
+/* MacBook Air 3,1: accelerometer, backlight and temperature set 23 */
+ { .accelerometer = 0, .light = 0, .temperature_set = 23 },
};
/* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1".
* So we need to put "Apple MacBook Pro" before "Apple MacBook". */
static __initdata struct dmi_system_id applesmc_whitelist[] = {
+ { applesmc_dmi_match, "Apple MacBook Air 3", {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3") },
+ &applesmc_dmi_data[23]},
{ applesmc_dmi_match, "Apple MacBook Air 2", {
DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir2") },
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 133/196] ALSA: emux: Add trivial compat ioctl handler
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (85 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 132/196] hwmon: (applesmc) Add MacBookAir3,1(3,2) support Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 134/196] ALSA: powermac - Reverse HP detection on G4 DA Paul Gortmaker
` (62 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Ben Hutchings, Takashi Iwai, Paul Gortmaker
From: Ben Hutchings <ben@decadent.org.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit a254dba37c5a372fc8b44ba29509ba052d4e859d upstream.
Reported-by: Carmen Cru <carmen.cru@belgacom.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/synth/emux/emux_hwdep.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/sound/synth/emux/emux_hwdep.c b/sound/synth/emux/emux_hwdep.c
index ff0b2a8..5ae1eae 100644
--- a/sound/synth/emux/emux_hwdep.c
+++ b/sound/synth/emux/emux_hwdep.c
@@ -128,6 +128,9 @@ snd_emux_init_hwdep(struct snd_emux *emu)
strcpy(hw->name, SNDRV_EMUX_HWDEP_NAME);
hw->iface = SNDRV_HWDEP_IFACE_EMUX_WAVETABLE;
hw->ops.ioctl = snd_emux_hwdep_ioctl;
+ /* The ioctl parameter types are compatible between 32- and
+ * 64-bit architectures, so use the same function. */
+ hw->ops.ioctl_compat = snd_emux_hwdep_ioctl;
hw->exclusive = 1;
hw->private_data = emu;
if ((err = snd_card_register(emu->card)) < 0)
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 134/196] ALSA: powermac - Reverse HP detection on G4 DA
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (86 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 133/196] ALSA: emux: Add trivial compat ioctl handler Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 135/196] ALSA: powermac - Lineout " Paul Gortmaker
` (61 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Risto Suominen, Takashi Iwai, Paul Gortmaker
From: Risto Suominen <Risto.Suominen@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 819ef70b135ba66cd1659c913255686bf931e3d4 upstream.
Reverse headphone detection bit on PowerMac G4 Digital Audio (Tumbler).
Signed-off-by: Risto Suominen <Risto.Suominen@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/ppc/tumbler.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/sound/ppc/tumbler.c b/sound/ppc/tumbler.c
index 789f44f..3b7471c 100644
--- a/sound/ppc/tumbler.c
+++ b/sound/ppc/tumbler.c
@@ -30,6 +30,7 @@
#include <linux/kmod.h>
#include <linux/slab.h>
#include <linux/interrupt.h>
+#include <linux/string.h>
#include <sound/core.h>
#include <asm/io.h>
#include <asm/irq.h>
@@ -46,6 +47,8 @@
#define DBG(fmt...)
#endif
+#define IS_G4DA (machine_is_compatible("PowerMac3,4"))
+
/* i2c address for tumbler */
#define TAS_I2C_ADDR 0x34
@@ -1134,7 +1137,7 @@ static long tumbler_find_device(const char *device, const char *platform,
gp->inactive_val = (*base) ? 0x4 : 0x5;
} else {
const u32 *prop = NULL;
- gp->active_state = 0;
+ gp->active_state = IS_G4DA && !strcmp(device, "keywest-gpio15");
gp->active_val = 0x4;
gp->inactive_val = 0x5;
/* Here are some crude hacks to extract the GPIO polarity and
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 135/196] ALSA: powermac - Lineout detection on G4 DA
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (87 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 134/196] ALSA: powermac - Reverse HP detection on G4 DA Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 136/196] ALSA: powermac - Fix obsoleted machine_is_compatible() Paul Gortmaker
` (60 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Risto Suominen, Takashi Iwai, Paul Gortmaker
From: Risto Suominen <Risto.Suominen@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b6d7335001f331f2d295ff15d67e385615ceff81 upstream.
Lineout (Pro Speaker) detection on PowerMac G4 Digital Audio (Tumbler).
Signed-off-by: Risto Suominen <Risto.Suominen@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/ppc/tumbler.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/sound/ppc/tumbler.c b/sound/ppc/tumbler.c
index 3b7471c..696280c 100644
--- a/sound/ppc/tumbler.c
+++ b/sound/ppc/tumbler.c
@@ -1137,7 +1137,8 @@ static long tumbler_find_device(const char *device, const char *platform,
gp->inactive_val = (*base) ? 0x4 : 0x5;
} else {
const u32 *prop = NULL;
- gp->active_state = IS_G4DA && !strcmp(device, "keywest-gpio15");
+ gp->active_state = IS_G4DA
+ && !strncmp(device, "keywest-gpio1", 13);
gp->active_val = 0x4;
gp->inactive_val = 0x5;
/* Here are some crude hacks to extract the GPIO polarity and
@@ -1315,6 +1316,9 @@ static int __devinit tumbler_init(struct snd_pmac *chip)
if (irq <= NO_IRQ)
irq = tumbler_find_device("line-output-detect",
NULL, &mix->line_detect, 1);
+ if (IS_G4DA && irq <= NO_IRQ)
+ irq = tumbler_find_device("keywest-gpio16",
+ NULL, &mix->line_detect, 1);
mix->lineout_irq = irq;
tumbler_reset_audio(chip);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 136/196] ALSA: powermac - Fix obsoleted machine_is_compatible()
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (88 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 135/196] ALSA: powermac - Lineout " Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 137/196] ALSA: hda - MacBookPro 5,3 line-in support Paul Gortmaker
` (59 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Takashi Iwai, Paul Gortmaker
From: Takashi Iwai <tiwai@suse.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 68c7ccb8f85801655aa681391dc0ee037a2b66d4 upstream.
machine_is_compatible() was renamed to of_machine_is_compatible().
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/ppc/tumbler.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/ppc/tumbler.c b/sound/ppc/tumbler.c
index 696280c..31efa21 100644
--- a/sound/ppc/tumbler.c
+++ b/sound/ppc/tumbler.c
@@ -47,7 +47,7 @@
#define DBG(fmt...)
#endif
-#define IS_G4DA (machine_is_compatible("PowerMac3,4"))
+#define IS_G4DA (of_machine_is_compatible("PowerMac3,4"))
/* i2c address for tumbler */
#define TAS_I2C_ADDR 0x34
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 137/196] ALSA: hda - MacBookPro 5,3 line-in support
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (89 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 136/196] ALSA: powermac - Fix obsoleted machine_is_compatible() Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 138/196] ALSA: hda - Add model=mbp55 entry for MacBookPro 7,1 Paul Gortmaker
` (58 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vince Weaver, Takashi Iwai, Paul Gortmaker
From: Vince Weaver <vweaver1@eecs.utk.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 4e7d7c6018567fa03f387d06602d4145c75ebbe0 upstream.
I've found the following patch is necessary to enable line-in on
my MacBookPro 5,3 machine. With the patch applied I've successfully
recorded audio from the line-in jack. This is based on the existing
5,5 support.
Signed-off-by: Vince Weaver <vweaver1@eecs.utk.edu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/pci/hda/patch_cirrus.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 350ee8a..1c6d1c3 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -65,6 +65,7 @@ struct cs_spec {
/* available models */
enum {
+ CS420X_MBP53,
CS420X_MBP55,
CS420X_IMAC27,
CS420X_AUTO,
@@ -838,7 +839,8 @@ static void cs_automute(struct hda_codec *codec)
AC_VERB_SET_PIN_WIDGET_CONTROL,
hp_present ? 0 : PIN_OUT);
}
- if (spec->board_config == CS420X_MBP55 ||
+ if (spec->board_config == CS420X_MBP53 ||
+ spec->board_config == CS420X_MBP55 ||
spec->board_config == CS420X_IMAC27) {
unsigned int gpio = hp_present ? 0x02 : 0x08;
snd_hda_codec_write(codec, 0x01, 0,
@@ -1080,6 +1082,7 @@ static int cs_parse_auto_config(struct hda_codec *codec)
}
static const char *cs420x_models[CS420X_MODELS] = {
+ [CS420X_MBP53] = "mbp53",
[CS420X_MBP55] = "mbp55",
[CS420X_IMAC27] = "imac27",
[CS420X_AUTO] = "auto",
@@ -1087,6 +1090,7 @@ static const char *cs420x_models[CS420X_MODELS] = {
static struct snd_pci_quirk cs420x_cfg_tbl[] = {
+ SND_PCI_QUIRK(0x10de, 0x0ac0, "MacBookPro 5,3", CS420X_MBP53),
SND_PCI_QUIRK(0x10de, 0xcb79, "MacBookPro 5,5", CS420X_MBP55),
SND_PCI_QUIRK(0x8086, 0x7270, "IMac 27 Inch", CS420X_IMAC27),
{} /* terminator */
@@ -1097,6 +1101,20 @@ struct cs_pincfg {
u32 val;
};
+static struct cs_pincfg mbp53_pincfgs[] = {
+ { 0x09, 0x012b4050 },
+ { 0x0a, 0x90100141 },
+ { 0x0b, 0x90100140 },
+ { 0x0c, 0x018b3020 },
+ { 0x0d, 0x90a00110 },
+ { 0x0e, 0x400000f0 },
+ { 0x0f, 0x01cbe030 },
+ { 0x10, 0x014be060 },
+ { 0x12, 0x400000f0 },
+ { 0x15, 0x400000f0 },
+ {} /* terminator */
+};
+
static struct cs_pincfg mbp55_pincfgs[] = {
{ 0x09, 0x012b4030 },
{ 0x0a, 0x90100121 },
@@ -1126,6 +1144,7 @@ static struct cs_pincfg imac27_pincfgs[] = {
};
static struct cs_pincfg *cs_pincfgs[CS420X_MODELS] = {
+ [CS420X_MBP53] = mbp53_pincfgs,
[CS420X_MBP55] = mbp55_pincfgs,
[CS420X_IMAC27] = imac27_pincfgs,
};
@@ -1158,6 +1177,7 @@ static int patch_cs420x(struct hda_codec *codec)
switch (spec->board_config) {
case CS420X_IMAC27:
+ case CS420X_MBP53:
case CS420X_MBP55:
/* GPIO1 = headphones */
/* GPIO3 = speakers */
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 138/196] ALSA: hda - Add model=mbp55 entry for MacBookPro 7,1
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (90 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 137/196] ALSA: hda - MacBookPro 5,3 line-in support Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 139/196] ALSA: hda - MacBookAir3,1(3,2) alsa support Paul Gortmaker
` (57 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, Takashi Iwai, Paul Gortmaker
From: Takashi Iwai <tiwai@suse.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit f46119b73425df9d1e05c5d5e909a993d95b0218 upstream.
Reference: Novell bnc#645066
https://bugzilla.novell.com/show_bug.cgi?id=645066
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/pci/hda/patch_cirrus.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 1c6d1c3..6ba2557 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -1092,6 +1092,7 @@ static const char *cs420x_models[CS420X_MODELS] = {
static struct snd_pci_quirk cs420x_cfg_tbl[] = {
SND_PCI_QUIRK(0x10de, 0x0ac0, "MacBookPro 5,3", CS420X_MBP53),
SND_PCI_QUIRK(0x10de, 0xcb79, "MacBookPro 5,5", CS420X_MBP55),
+ SND_PCI_QUIRK(0x10de, 0xcb89, "MacBookPro 7,1", CS420X_MBP55),
SND_PCI_QUIRK(0x8086, 0x7270, "IMac 27 Inch", CS420X_IMAC27),
{} /* terminator */
};
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 139/196] ALSA: hda - MacBookAir3,1(3,2) alsa support
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (91 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 138/196] ALSA: hda - Add model=mbp55 entry for MacBookPro 7,1 Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 140/196] virtio_net: Add schedule check to napi_enable call Paul Gortmaker
` (56 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Edgar (gimli) Hucek, Takashi Iwai, Paul Gortmaker
From: "Edgar (gimli) Hucek" <gimli@dark-green.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 87232dd49aeb6b7d1af291edca8bd129a82ef4b5 upstream.
This patch add support for the MacBookAir3,1 and MacBookAir3,2 to the alsa
sound system.
Signed-off-by: Edgar (gimli) Hucek <gimli@dark-green.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
sound/pci/hda/patch_cirrus.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 6ba2557..5f08464 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -1091,6 +1091,7 @@ static const char *cs420x_models[CS420X_MODELS] = {
static struct snd_pci_quirk cs420x_cfg_tbl[] = {
SND_PCI_QUIRK(0x10de, 0x0ac0, "MacBookPro 5,3", CS420X_MBP53),
+ SND_PCI_QUIRK(0x10de, 0x0d94, "MacBookAir 3,1(2)", CS420X_MBP55),
SND_PCI_QUIRK(0x10de, 0xcb79, "MacBookPro 5,5", CS420X_MBP55),
SND_PCI_QUIRK(0x10de, 0xcb89, "MacBookPro 7,1", CS420X_MBP55),
SND_PCI_QUIRK(0x8086, 0x7270, "IMac 27 Inch", CS420X_IMAC27),
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 140/196] virtio_net: Add schedule check to napi_enable call
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (92 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 139/196] ALSA: hda - MacBookAir3,1(3,2) alsa support Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 141/196] Bluetooth: Add support Bluetooth controller of MacbookPro 6,2 Paul Gortmaker
` (55 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Bruce Rogers, Olaf Kirch, Rusty Russell,
David S. Miller, Paul Gortmaker
From: Bruce Rogers <brogers@novell.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 3e9d08ec0a68f6faf718d5a7e050fe5ca0ba004f upstream.
Under harsh testing conditions, including low memory, the guest would
stop receiving packets. With this patch applied we no longer see any
problems in the driver while performing these tests for extended periods
of time.
Make sure napi is scheduled subsequent to each napi_enable.
[PG: in 34, virtqueue_disable_cb is vi->rvq->vq_ops->disable_cb]
Signed-off-by: Bruce Rogers <brogers@novell.com>
Signed-off-by: Olaf Kirch <okir@suse.de>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/virtio_net.c | 27 ++++++++++++++++-----------
1 file changed, 16 insertions(+), 11 deletions(-)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index f5b5d74..2cc49dd 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -448,6 +448,20 @@ static void skb_recv_done(struct virtqueue *rvq)
}
}
+static void virtnet_napi_enable(struct virtnet_info *vi)
+{
+ napi_enable(&vi->napi);
+
+ /* If all buffers were filled by other side before we napi_enabled, we
+ * won't get another interrupt, so process any outstanding packets
+ * now. virtnet_poll wants re-enable the queue, so we disable here.
+ * We synchronize against interrupts via NAPI_STATE_SCHED */
+ if (napi_schedule_prep(&vi->napi)) {
+ vi->rvq->vq_ops->disable_cb(vi->rvq);
+ __napi_schedule(&vi->napi);
+ }
+}
+
static void refill_work(struct work_struct *work)
{
struct virtnet_info *vi;
@@ -456,7 +470,7 @@ static void refill_work(struct work_struct *work)
vi = container_of(work, struct virtnet_info, refill.work);
napi_disable(&vi->napi);
still_empty = !try_fill_recv(vi, GFP_KERNEL);
- napi_enable(&vi->napi);
+ virtnet_napi_enable(vi);
/* In theory, this can happen: if we don't get any buffers in
* we will *never* try to fill again. */
@@ -642,16 +656,7 @@ static int virtnet_open(struct net_device *dev)
{
struct virtnet_info *vi = netdev_priv(dev);
- napi_enable(&vi->napi);
-
- /* If all buffers were filled by other side before we napi_enabled, we
- * won't get another interrupt, so process any outstanding packets
- * now. virtnet_poll wants re-enable the queue, so we disable here.
- * We synchronize against interrupts via NAPI_STATE_SCHED */
- if (napi_schedule_prep(&vi->napi)) {
- vi->rvq->vq_ops->disable_cb(vi->rvq);
- __napi_schedule(&vi->napi);
- }
+ virtnet_napi_enable(vi);
return 0;
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 141/196] Bluetooth: Add support Bluetooth controller of MacbookPro 6,2
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (93 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 140/196] virtio_net: Add schedule check to napi_enable call Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 142/196] Bluetooth: Add support Bluetooth controller of MacbookPro 7,1 Paul Gortmaker
` (54 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Nobuhiro Iwamatsu, Gustavo F. Padovan, Paul Gortmaker
From: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 9c047157a20521cd525527947b13b950d168d2e6 upstream.
Bluetooth controller of MacbookPro 6,2 does not work.
Because Device Class of these controllers was set 255 (Vendor Sepecific Class).
T: Bus=01 Lev=03 Prnt=03 Port=02 Cnt=03 Dev#= 8 Spd=12 MxCh= 0
D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=05ac ProdID=8218 Rev=00.22
S: Manufacturer=Apple Inc.
S: Product=Bluetooth USB Host Controller
C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
Signed-off-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/bluetooth/btusb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index c9e2dc8..f55332d 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -65,6 +65,9 @@ static struct usb_device_id btusb_table[] = {
/* Apple MacBookPro8,2 */
{ USB_DEVICE(0x05ac, 0x821a) },
+ /* Apple MacBookPro6,2 */
+ { USB_DEVICE(0x05ac, 0x8218) },
+
/* AVM BlueFRITZ! USB v2.0 */
{ USB_DEVICE(0x057c, 0x3800) },
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 142/196] Bluetooth: Add support Bluetooth controller of MacbookPro 7,1
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (94 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 141/196] Bluetooth: Add support Bluetooth controller of MacbookPro 6,2 Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 143/196] Bluetooth: Add MacBookAir3,1(2) support Paul Gortmaker
` (53 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Nobuhiro Iwamatsu, Gustavo F. Padovan, Paul Gortmaker
From: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 3cd01976e702ccaffb907727caff4f8789353599 upstream.
Bluetooth controller of MacbookPro 7,1 does not work.
Because Device Class of these controllers was set 255 (Vendor Sepecific Class).
T: Bus=04 Lev=02 Prnt=04 Port=00 Cnt=01 Dev#= 5 Spd=12 MxCh= 0
D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=05ac ProdID=8213 Rev=01.86
S: Manufacturer=Apple Inc.
S: Product=Bluetooth USB Host Controller
S: SerialNumber=5C5948C81B99
C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=00 Driver=(none)
Signed-off-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/bluetooth/btusb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f55332d..7225e11 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -59,6 +59,9 @@ static struct usb_device_id btusb_table[] = {
/* Generic Bluetooth USB device */
{ USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
+ /* Apple MacBookPro 7,1 */
+ { USB_DEVICE(0x05ac, 0x8213) },
+
/* Apple iMac11,1 */
{ USB_DEVICE(0x05ac, 0x8215) },
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 143/196] Bluetooth: Add MacBookAir3,1(2) support
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (95 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 142/196] Bluetooth: Add support Bluetooth controller of MacbookPro 7,1 Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 144/196] perf symbols: allow forcing use of cplus_demangle Paul Gortmaker
` (52 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Edgar (gimli) Hucek, Gustavo F. Padovan, Paul Gortmaker
From: "Edgar (gimli) Hucek" <gimli@dark-green.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 3e3ede7dda2d77d2cbec608e663b6a6ace501bfc upstream.
Adding the new MacBookAir3,1(2) to btusb.
Output without the patch and btusb loaded :
T: Bus=03 Lev=02 Prnt=03 Port=02 Cnt=01 Dev#= 6 Spd=12 MxCh= 0
D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=05ac ProdID=821b Rev= 0.34
S: Manufacturer=Apple Inc.
S: Product=Bluetooth USB Host Controller
C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 32 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 32 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 64 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 64 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 64 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 64 Ivl=1ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
Output with the patch and btusb loaded :
T: Bus=03 Lev=02 Prnt=03 Port=02 Cnt=01 Dev#= 6 Spd=12 MxCh= 0
D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=05ac ProdID=821b Rev= 0.34
S: Manufacturer=Apple Inc.
S: Product=Bluetooth USB Host Controller
C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 32 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 32 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 64 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 64 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 64 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 64 Ivl=1ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
Signed-off-by: Edgar (gimli) Hucek <gimli@dark-green.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/bluetooth/btusb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 7225e11..0eb6d1b 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -71,6 +71,9 @@ static struct usb_device_id btusb_table[] = {
/* Apple MacBookPro6,2 */
{ USB_DEVICE(0x05ac, 0x8218) },
+ /* Apple MacBookAir3,1, MacBookAir3,2 */
+ { USB_DEVICE(0x05ac, 0x821b) },
+
/* AVM BlueFRITZ! USB v2.0 */
{ USB_DEVICE(0x057c, 0x3800) },
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 144/196] perf symbols: allow forcing use of cplus_demangle
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (96 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 143/196] Bluetooth: Add MacBookAir3,1(2) support Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` [34-longterm 145/196] V4L/DVB: Add Elgato EyeTV Diversity to dibcom driver Paul Gortmaker
` (51 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Kyle McMartin, Ingo Molnar, Kyle McMartin,
Arnaldo Carvalho de Melo, Paul Gortmaker
From: Kyle McMartin <kyle@mcmartin.ca>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit d11c7addfe0fa501cb54c824c0fac3481d527433 upstream.
For Fedora, I want to force perf to link against libiberty.a for
cplus_demangle, rather than libbfd.a for bfd_demangle due to licensing insanity
on binutils. (libiberty is LGPL2, libbfd is GPL3.)
If we just rely on autodetection, we'll end up with libbfd linked against us,
since they're both in binutils-static in the buildroot.
Cc: Ingo Molnar <mingo@elte.hu>
LKML-Reference: <20100510204335.GA7565@bombadil.infradead.org>
Signed-off-by: Kyle McMartin <kyle@redhat.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
tools/perf/Makefile | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index bc0f670..429bace 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -541,6 +541,9 @@ endif
ifdef NO_DEMANGLE
BASIC_CFLAGS += -DNO_DEMANGLE
+else ifdef HAVE_CPLUS_DEMANGLE
+ EXTLIBS += -liberty
+ BASIC_CFLAGS += -DHAVE_CPLUS_DEMANGLE
else
has_bfd := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o $(BITBUCKET) $(ALL_LDFLAGS) $(EXTLIBS) -lbfd "$(QUIET_STDERR)" && echo y")
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 145/196] V4L/DVB: Add Elgato EyeTV Diversity to dibcom driver
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (97 preceding siblings ...)
2012-03-13 0:20 ` [34-longterm 144/196] perf symbols: allow forcing use of cplus_demangle Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:20 ` Paul Gortmaker
` (50 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, michael, Michael Müller, Wolfram Sang,
Patrick Boettcher, Mauro Carvalho Chehab, Paul Gortmaker
From: "michael@alice-dsl.net" <michael@alice-dsl.net>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 84e2f037ce9672d0fb118e3e82cecfe6122ace3f upstream.
This patch introduces support for DVB-T for the following dibcom
based card: Elgato EyeTV Diversity (USB-ID: 0fd9:0011)
Support for the Elgato silver IR remote is added too (set parameter
dvb_usb_dib0700_ir_proto=0)
[w.sang@pengutronix.de: rebased to current linuxtv-master]
Signed-off-by: Michael Müller <mueller_michael@alice-dsl.net>
Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
Signed-off-by: Patrick Boettcher <pboettcher@kernellabs.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/media/dvb/dvb-usb/dib0700_devices.c | 46 +++++++++++++++++++++++++--
drivers/media/dvb/dvb-usb/dvb-usb-ids.h | 1 +
2 files changed, 45 insertions(+), 2 deletions(-)
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index 34eab05..f9052be 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -794,6 +794,43 @@ static struct dvb_usb_rc_key dib0700_rc_keys[] = {
{ 0x7a13, KEY_VOLUMEDOWN },
{ 0x7a40, KEY_POWER },
{ 0x7a41, KEY_MUTE },
+
+ /* Key codes for the Elgato EyeTV Diversity silver remote,
+ set dvb_usb_dib0700_ir_proto=0 */
+ { 0x4501, KEY_POWER },
+ { 0x4502, KEY_MUTE },
+ { 0x4503, KEY_1 },
+ { 0x4504, KEY_2 },
+ { 0x4505, KEY_3 },
+ { 0x4506, KEY_4 },
+ { 0x4507, KEY_5 },
+ { 0x4508, KEY_6 },
+ { 0x4509, KEY_7 },
+ { 0x450a, KEY_8 },
+ { 0x450b, KEY_9 },
+ { 0x450c, KEY_LAST },
+ { 0x450d, KEY_0 },
+ { 0x450e, KEY_ENTER },
+ { 0x450f, KEY_RED },
+ { 0x4510, KEY_CHANNELUP },
+ { 0x4511, KEY_GREEN },
+ { 0x4512, KEY_VOLUMEDOWN },
+ { 0x4513, KEY_OK },
+ { 0x4514, KEY_VOLUMEUP },
+ { 0x4515, KEY_YELLOW },
+ { 0x4516, KEY_CHANNELDOWN },
+ { 0x4517, KEY_BLUE },
+ { 0x4518, KEY_LEFT }, /* Skip backwards */
+ { 0x4519, KEY_PLAYPAUSE },
+ { 0x451a, KEY_RIGHT }, /* Skip forward */
+ { 0x451b, KEY_REWIND },
+ { 0x451c, KEY_L }, /* Live */
+ { 0x451d, KEY_FASTFORWARD },
+ { 0x451e, KEY_STOP }, /* 'Reveal' for Teletext */
+ { 0x451f, KEY_MENU }, /* KEY_TEXT for Teletext */
+ { 0x4540, KEY_RECORD }, /* Font 'Size' for Teletext */
+ { 0x4541, KEY_SCREEN }, /* Full screen toggle, 'Hold' for Teletext */
+ { 0x4542, KEY_SELECT }, /* Select video input, 'Select' for Teletext */
};
/* STK7700P: Hauppauge Nova-T Stick, AVerMedia Volar */
@@ -2049,6 +2086,7 @@ struct usb_device_id dib0700_usb_id_table[] = {
/* 65 */{ USB_DEVICE(USB_VID_PINNACLE, USB_PID_PINNACLE_PCTV73ESE) },
{ USB_DEVICE(USB_VID_PINNACLE, USB_PID_PINNACLE_PCTV282E) },
{ USB_DEVICE(USB_VID_DIBCOM, USB_PID_DIBCOM_STK8096GP) },
+ { USB_DEVICE(USB_VID_ELGATO, USB_PID_ELGATO_EYETV_DIVERSITY) },
{ 0 } /* Terminating entry */
};
MODULE_DEVICE_TABLE(usb, dib0700_usb_id_table);
@@ -2393,7 +2431,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
}
},
- .num_device_descs = 6,
+ .num_device_descs = 7,
.devices = {
{ "DiBcom STK7070PD reference design",
{ &dib0700_usb_id_table[17], NULL },
@@ -2419,7 +2457,11 @@ struct dvb_usb_device_properties dib0700_devices[] = {
{ "Sony PlayTV",
{ &dib0700_usb_id_table[44], NULL },
{ NULL },
- }
+ },
+ { "Elgato EyeTV Diversity",
+ { &dib0700_usb_id_table[68], NULL },
+ { NULL },
+ },
},
.rc_interval = DEFAULT_RC_INTERVAL,
.rc_key_map = dib0700_rc_keys,
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
index ae8b57a..71dfc7c 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
@@ -288,6 +288,7 @@
#define USB_PID_MSI_DIGI_VOX_MINI_III 0x8807
#define USB_PID_SONY_PLAYTV 0x0003
#define USB_PID_MYGICA_D689 0xd811
+#define USB_PID_ELGATO_EYETV_DIVERSITY 0x0011
#define USB_PID_ELGATO_EYETV_DTT 0x0021
#define USB_PID_ELGATO_EYETV_DTT_Dlx 0x0020
#define USB_PID_DVB_T_USB_STICK_HIGH_SPEED_COLD 0x5000
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 146/196] mmc: fix all hangs related to mmc/sd card insert/removal during suspend/resume
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
@ 2012-03-13 0:20 ` Paul Gortmaker
2012-03-13 0:19 ` [34-longterm 048/196] gro: reset skb_iif " Paul Gortmaker
` (148 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Maxim Levitsky, David Brownell, Alan Stern,
linux-mmc, Andrew Morton, Linus Torvalds, Paul Gortmaker
From: Maxim Levitsky <maximlevitsky@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 4c2ef25fe0b847d2ae818f74758ddb0be1c27d8e upstream.
If you don't use CONFIG_MMC_UNSAFE_RESUME, as soon as you attempt to
suspend, the card will be removed, therefore this patch doesn't change the
behavior of this option.
However the removal will be done by pm notifier, which runs while
userspace is still not frozen and thus can freely use del_gendisk, without
the risk of deadlock which would happen otherwise.
Card detect workqueue is now disabled while userspace is frozen, Therefore
if you do use CONFIG_MMC_UNSAFE_RESUME, and remove the card during
suspend, the removal will be detected as soon as userspace is unfrozen,
again at the moment it is safe to call del_gendisk.
Tested with and without CONFIG_MMC_UNSAFE_RESUME with suspend and hibernate.
[akpm@linux-foundation.org: clean up function prototype]
[akpm@linux-foundation.org: fix CONFIG_PM-n linkage, small cleanups]
[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com>
Cc: David Brownell <david-b@pacbell.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: <linux-mmc@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/mmc/core/core.c | 83 +++++++++++++++++++++++++++++++---------------
drivers/mmc/core/host.c | 4 +++
include/linux/mmc/host.h | 3 ++
3 files changed, 64 insertions(+), 26 deletions(-)
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 3168ebd..3e22f98 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1057,6 +1057,17 @@ void mmc_rescan(struct work_struct *work)
container_of(work, struct mmc_host, detect.work);
u32 ocr;
int err;
+ unsigned long flags;
+
+ spin_lock_irqsave(&host->lock, flags);
+
+ if (host->rescan_disable) {
+ spin_unlock_irqrestore(&host->lock, flags);
+ return;
+ }
+
+ spin_unlock_irqrestore(&host->lock, flags);
+
mmc_bus_get(host);
@@ -1267,19 +1278,6 @@ int mmc_suspend_host(struct mmc_host *host, pm_message_t state)
if (host->bus_ops && !host->bus_dead) {
if (host->bus_ops->suspend)
err = host->bus_ops->suspend(host);
- if (err == -ENOSYS || !host->bus_ops->resume) {
- /*
- * We simply "remove" the card in this case.
- * It will be redetected on resume.
- */
- if (host->bus_ops->remove)
- host->bus_ops->remove(host);
- mmc_claim_host(host);
- mmc_detach_bus(host);
- mmc_release_host(host);
- host->pm_flags = 0;
- err = 0;
- }
}
mmc_bus_put(host);
@@ -1311,28 +1309,61 @@ int mmc_resume_host(struct mmc_host *host)
printk(KERN_WARNING "%s: error %d during resume "
"(card was removed?)\n",
mmc_hostname(host), err);
- if (host->bus_ops->remove)
- host->bus_ops->remove(host);
- mmc_claim_host(host);
- mmc_detach_bus(host);
- mmc_release_host(host);
- /* no need to bother upper layers */
err = 0;
}
}
mmc_bus_put(host);
- /*
- * We add a slight delay here so that resume can progress
- * in parallel.
- */
- mmc_detect_change(host, 1);
-
return err;
}
-
EXPORT_SYMBOL(mmc_resume_host);
+/* Do the card removal on suspend if card is assumed removeable
+ * Do that in pm notifier while userspace isn't yet frozen, so we will be able
+ to sync the card.
+*/
+int mmc_pm_notify(struct notifier_block *notify_block,
+ unsigned long mode, void *unused)
+{
+ struct mmc_host *host = container_of(
+ notify_block, struct mmc_host, pm_notify);
+ unsigned long flags;
+
+
+ switch (mode) {
+ case PM_HIBERNATION_PREPARE:
+ case PM_SUSPEND_PREPARE:
+
+ spin_lock_irqsave(&host->lock, flags);
+ host->rescan_disable = 1;
+ spin_unlock_irqrestore(&host->lock, flags);
+ cancel_delayed_work_sync(&host->detect);
+
+ if (!host->bus_ops || host->bus_ops->suspend)
+ break;
+
+ mmc_claim_host(host);
+
+ if (host->bus_ops->remove)
+ host->bus_ops->remove(host);
+
+ mmc_detach_bus(host);
+ mmc_release_host(host);
+ host->pm_flags = 0;
+ break;
+
+ case PM_POST_SUSPEND:
+ case PM_POST_HIBERNATION:
+
+ spin_lock_irqsave(&host->lock, flags);
+ host->rescan_disable = 0;
+ spin_unlock_irqrestore(&host->lock, flags);
+ mmc_detect_change(host, 0);
+
+ }
+
+ return 0;
+}
#endif
static int __init mmc_init(void)
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 4735390..0efe631 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -17,6 +17,7 @@
#include <linux/pagemap.h>
#include <linux/leds.h>
#include <linux/slab.h>
+#include <linux/suspend.h>
#include <linux/mmc/host.h>
@@ -85,6 +86,7 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
init_waitqueue_head(&host->wq);
INIT_DELAYED_WORK(&host->detect, mmc_rescan);
INIT_DELAYED_WORK_DEFERRABLE(&host->disable, mmc_host_deeper_disable);
+ host->pm_notify.notifier_call = mmc_pm_notify;
/*
* By default, hosts do not support SGIO or large requests.
@@ -133,6 +135,7 @@ int mmc_add_host(struct mmc_host *host)
#endif
mmc_start_host(host);
+ register_pm_notifier(&host->pm_notify);
return 0;
}
@@ -149,6 +152,7 @@ EXPORT_SYMBOL(mmc_add_host);
*/
void mmc_remove_host(struct mmc_host *host)
{
+ unregister_pm_notifier(&host->pm_notify);
mmc_stop_host(host);
#ifdef CONFIG_DEBUG_FS
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index 43eaf5c..18d9eb3 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -121,6 +121,7 @@ struct mmc_host {
unsigned int f_min;
unsigned int f_max;
u32 ocr_avail;
+ struct notifier_block pm_notify;
#define MMC_VDD_165_195 0x00000080 /* VDD voltage 1.65 - 1.95 */
#define MMC_VDD_20_21 0x00000100 /* VDD voltage 2.0 ~ 2.1 */
@@ -180,6 +181,7 @@ struct mmc_host {
/* Only used with MMC_CAP_DISABLE */
int enabled; /* host is enabled */
+ int rescan_disable; /* disable card detection */
int nesting_cnt; /* "enable" nesting count */
int en_dis_recurs; /* detect recursion */
unsigned int disable_delay; /* disable delay in msecs */
@@ -254,6 +256,7 @@ int mmc_card_can_sleep(struct mmc_host *host);
int mmc_host_enable(struct mmc_host *host);
int mmc_host_disable(struct mmc_host *host);
int mmc_host_lazy_disable(struct mmc_host *host);
+int mmc_pm_notify(struct notifier_block *notify_block, unsigned long, void *);
static inline void mmc_set_disable_delay(struct mmc_host *host,
unsigned int disable_delay)
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 146/196] mmc: fix all hangs related to mmc/sd card insert/removal during suspend/resume
@ 2012-03-13 0:20 ` Paul Gortmaker
0 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:20 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Maxim Levitsky, David Brownell, Alan Stern,
linux-mmc, Andrew Morton, Linus Torvalds, Paul Gortmaker
From: Maxim Levitsky <maximlevitsky@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 4c2ef25fe0b847d2ae818f74758ddb0be1c27d8e upstream.
If you don't use CONFIG_MMC_UNSAFE_RESUME, as soon as you attempt to
suspend, the card will be removed, therefore this patch doesn't change the
behavior of this option.
However the removal will be done by pm notifier, which runs while
userspace is still not frozen and thus can freely use del_gendisk, without
the risk of deadlock which would happen otherwise.
Card detect workqueue is now disabled while userspace is frozen, Therefore
if you do use CONFIG_MMC_UNSAFE_RESUME, and remove the card during
suspend, the removal will be detected as soon as userspace is unfrozen,
again at the moment it is safe to call del_gendisk.
Tested with and without CONFIG_MMC_UNSAFE_RESUME with suspend and hibernate.
[akpm@linux-foundation.org: clean up function prototype]
[akpm@linux-foundation.org: fix CONFIG_PM-n linkage, small cleanups]
[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com>
Cc: David Brownell <david-b@pacbell.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: <linux-mmc@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/mmc/core/core.c | 83 +++++++++++++++++++++++++++++++---------------
drivers/mmc/core/host.c | 4 +++
include/linux/mmc/host.h | 3 ++
3 files changed, 64 insertions(+), 26 deletions(-)
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 3168ebd..3e22f98 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1057,6 +1057,17 @@ void mmc_rescan(struct work_struct *work)
container_of(work, struct mmc_host, detect.work);
u32 ocr;
int err;
+ unsigned long flags;
+
+ spin_lock_irqsave(&host->lock, flags);
+
+ if (host->rescan_disable) {
+ spin_unlock_irqrestore(&host->lock, flags);
+ return;
+ }
+
+ spin_unlock_irqrestore(&host->lock, flags);
+
mmc_bus_get(host);
@@ -1267,19 +1278,6 @@ int mmc_suspend_host(struct mmc_host *host, pm_message_t state)
if (host->bus_ops && !host->bus_dead) {
if (host->bus_ops->suspend)
err = host->bus_ops->suspend(host);
- if (err == -ENOSYS || !host->bus_ops->resume) {
- /*
- * We simply "remove" the card in this case.
- * It will be redetected on resume.
- */
- if (host->bus_ops->remove)
- host->bus_ops->remove(host);
- mmc_claim_host(host);
- mmc_detach_bus(host);
- mmc_release_host(host);
- host->pm_flags = 0;
- err = 0;
- }
}
mmc_bus_put(host);
@@ -1311,28 +1309,61 @@ int mmc_resume_host(struct mmc_host *host)
printk(KERN_WARNING "%s: error %d during resume "
"(card was removed?)\n",
mmc_hostname(host), err);
- if (host->bus_ops->remove)
- host->bus_ops->remove(host);
- mmc_claim_host(host);
- mmc_detach_bus(host);
- mmc_release_host(host);
- /* no need to bother upper layers */
err = 0;
}
}
mmc_bus_put(host);
- /*
- * We add a slight delay here so that resume can progress
- * in parallel.
- */
- mmc_detect_change(host, 1);
-
return err;
}
-
EXPORT_SYMBOL(mmc_resume_host);
+/* Do the card removal on suspend if card is assumed removeable
+ * Do that in pm notifier while userspace isn't yet frozen, so we will be able
+ to sync the card.
+*/
+int mmc_pm_notify(struct notifier_block *notify_block,
+ unsigned long mode, void *unused)
+{
+ struct mmc_host *host = container_of(
+ notify_block, struct mmc_host, pm_notify);
+ unsigned long flags;
+
+
+ switch (mode) {
+ case PM_HIBERNATION_PREPARE:
+ case PM_SUSPEND_PREPARE:
+
+ spin_lock_irqsave(&host->lock, flags);
+ host->rescan_disable = 1;
+ spin_unlock_irqrestore(&host->lock, flags);
+ cancel_delayed_work_sync(&host->detect);
+
+ if (!host->bus_ops || host->bus_ops->suspend)
+ break;
+
+ mmc_claim_host(host);
+
+ if (host->bus_ops->remove)
+ host->bus_ops->remove(host);
+
+ mmc_detach_bus(host);
+ mmc_release_host(host);
+ host->pm_flags = 0;
+ break;
+
+ case PM_POST_SUSPEND:
+ case PM_POST_HIBERNATION:
+
+ spin_lock_irqsave(&host->lock, flags);
+ host->rescan_disable = 0;
+ spin_unlock_irqrestore(&host->lock, flags);
+ mmc_detect_change(host, 0);
+
+ }
+
+ return 0;
+}
#endif
static int __init mmc_init(void)
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 4735390..0efe631 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -17,6 +17,7 @@
#include <linux/pagemap.h>
#include <linux/leds.h>
#include <linux/slab.h>
+#include <linux/suspend.h>
#include <linux/mmc/host.h>
@@ -85,6 +86,7 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
init_waitqueue_head(&host->wq);
INIT_DELAYED_WORK(&host->detect, mmc_rescan);
INIT_DELAYED_WORK_DEFERRABLE(&host->disable, mmc_host_deeper_disable);
+ host->pm_notify.notifier_call = mmc_pm_notify;
/*
* By default, hosts do not support SGIO or large requests.
@@ -133,6 +135,7 @@ int mmc_add_host(struct mmc_host *host)
#endif
mmc_start_host(host);
+ register_pm_notifier(&host->pm_notify);
return 0;
}
@@ -149,6 +152,7 @@ EXPORT_SYMBOL(mmc_add_host);
*/
void mmc_remove_host(struct mmc_host *host)
{
+ unregister_pm_notifier(&host->pm_notify);
mmc_stop_host(host);
#ifdef CONFIG_DEBUG_FS
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index 43eaf5c..18d9eb3 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -121,6 +121,7 @@ struct mmc_host {
unsigned int f_min;
unsigned int f_max;
u32 ocr_avail;
+ struct notifier_block pm_notify;
#define MMC_VDD_165_195 0x00000080 /* VDD voltage 1.65 - 1.95 */
#define MMC_VDD_20_21 0x00000100 /* VDD voltage 2.0 ~ 2.1 */
@@ -180,6 +181,7 @@ struct mmc_host {
/* Only used with MMC_CAP_DISABLE */
int enabled; /* host is enabled */
+ int rescan_disable; /* disable card detection */
int nesting_cnt; /* "enable" nesting count */
int en_dis_recurs; /* detect recursion */
unsigned int disable_delay; /* disable delay in msecs */
@@ -254,6 +256,7 @@ int mmc_card_can_sleep(struct mmc_host *host);
int mmc_host_enable(struct mmc_host *host);
int mmc_host_disable(struct mmc_host *host);
int mmc_host_lazy_disable(struct mmc_host *host);
+int mmc_pm_notify(struct notifier_block *notify_block, unsigned long, void *);
static inline void mmc_set_disable_delay(struct mmc_host *host,
unsigned int disable_delay)
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread
* [34-longterm 147/196] mmc: build fix: mmc_pm_notify is only available with CONFIG_PM=y
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (99 preceding siblings ...)
2012-03-13 0:20 ` Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 148/196] b43: Fix warning at drivers/mmc/core/core.c:237 in mmc_wait_for_cmd Paul Gortmaker
` (48 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Uwe Kleine-König, David Brownell, Alan Stern,
linux-mmc, Andrew Morton, Linus Torvalds, Paul Gortmaker
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 81ca03a0e2ea0207b2df80e0edcf4c775c07a505 upstream.
This fixes a build breakage introduced by commit 4c2ef25fe0b8 ("mmc: fix
all hangs related to mmc/sd card insert/removal during suspend/resume")
Cc: David Brownell <david-b@pacbell.net>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: linux-mmc@vger.kernel.org
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Kukjin Kim <kgene.kim@samsung.com>
Acked-by: Maxim Levitsky <maximlevitsky@gmail.com>
Acked-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/mmc/core/host.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 0efe631..d80cfdc 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -86,7 +86,9 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
init_waitqueue_head(&host->wq);
INIT_DELAYED_WORK(&host->detect, mmc_rescan);
INIT_DELAYED_WORK_DEFERRABLE(&host->disable, mmc_host_deeper_disable);
+#ifdef CONFIG_PM
host->pm_notify.notifier_call = mmc_pm_notify;
+#endif
/*
* By default, hosts do not support SGIO or large requests.
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 148/196] b43: Fix warning at drivers/mmc/core/core.c:237 in mmc_wait_for_cmd
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (100 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 147/196] mmc: build fix: mmc_pm_notify is only available with CONFIG_PM=y Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 149/196] dell-laptop: Add another Dell laptop family to the DMI whitelist Paul Gortmaker
` (47 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Larry Finger, John W. Linville, Paul Gortmaker
From: Larry Finger <Larry.Finger@lwfinger.net>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 9f2a0fac625bcef9c579bcf0b0c904ab1a56e7c4 upstream.
On module removal, the sdio version of b43 generates the following warning:
[ 851.560519] ------------[ cut here ]------------
[ 851.560531] WARNING: at drivers/mmc/core/core.c:237 mmc_wait_for_cmd+0x88/0x90()
[ 851.560534] Hardware name: 20552PG
[ 851.560536] Modules linked in: b43(-) ssb mmc_block binfmt_misc rfcomm sco bnep ppdev l2cap ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ipt_REJECT xt_tcpudp iptable_filter ip_tables x_tables bridge stp kvm_intel kvm arc4 iwlagn snd_hda_codec_conexant snd_hda_intel snd_hda_codec iwlcore snd_hwdep snd_pcm thinkpad_acpi mac80211 snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq r852 joydev snd_timer sm_common pcmcia nand snd_seq_device cfg80211 sdhci_pci btusb psmouse tpm_tis yenta_socket nand_ids lp snd pcmcia_rsrc nand_ecc bluetooth sdhci tpm pcmcia_core parport mtd snd_page_alloc serio_raw tpm_bios soundcore nvram led_class sha256_generic aes_i586 aes_generic dm_crypt i915 drm_kms_helper drm ahci intel_agp i2c_algo_bit intel_gtt e1000e libahci video agpgart output
[ 851.560620] Pid: 2504, comm: rmmod Not tainted 2.6.36-titan0+ #1
[ 851.560622] Call Trace:
[ 851.560631] [<c014a102>] warn_slowpath_common+0x72/0xa0
[ 851.560636] [<c04d94c8>] ? mmc_wait_for_cmd+0x88/0x90
[ 851.560641] [<c04d94c8>] ? mmc_wait_for_cmd+0x88/0x90
[ 851.560645] [<c014a152>] warn_slowpath_null+0x22/0x30
[ 851.560649] [<c04d94c8>] mmc_wait_for_cmd+0x88/0x90
[ 851.560655] [<c0401585>] ? device_release+0x25/0x80
[ 851.560660] [<c04df210>] mmc_io_rw_direct_host+0xa0/0x150
[ 851.560665] [<c04df370>] mmc_io_rw_direct+0x30/0x40
[ 851.560669] [<c04e06e7>] sdio_disable_func+0x37/0xa0
[ 851.560683] [<f8dfcb80>] b43_sdio_remove+0x30/0x50 [b43]
[ 851.560687] [<c04df8cc>] sdio_bus_remove+0x1c/0x60
[ 851.560692] [<c016d39f>] ? blocking_notifier_call_chain+0x1f/0x30
[ 851.560697] [<c0404991>] __device_release_driver+0x51/0xb0
[ 851.560701] [<c0404a7f>] driver_detach+0x8f/0xa0
[ 851.560705] [<c0403c83>] bus_remove_driver+0x63/0xa0
[ 851.560709] [<c0405039>] driver_unregister+0x49/0x80
[ 851.560713] [<c0405039>] ? driver_unregister+0x49/0x80
[ 851.560718] [<c04dfad7>] sdio_unregister_driver+0x17/0x20
[ 851.560727] [<f8dfcb42>] b43_sdio_exit+0x12/0x20 [b43]
[ 851.560734] [<f8dfe76f>] b43_exit+0x17/0x3c [b43]
[ 851.560740] [<c017fb8d>] sys_delete_module+0x13d/0x200
[ 851.560747] [<c01fd7d2>] ? do_munmap+0x212/0x300
[ 851.560752] [<c010311f>] sysenter_do_call+0x12/0x28
[ 851.560757] ---[ end trace 31e14488072d2f7d ]---
[ 851.560759] ------------[ cut here ]------------
The warning is caused by b43 not claiming the device before calling
sdio_disable_func().
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: Arnd Hannemann <arnd@arndnet.de>
Tested-by: Arnd Hannemann <arnd@arndnet.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/wireless/b43/sdio.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/b43/sdio.c b/drivers/net/wireless/b43/sdio.c
index 4e56b7b..8b18314 100644
--- a/drivers/net/wireless/b43/sdio.c
+++ b/drivers/net/wireless/b43/sdio.c
@@ -175,7 +175,9 @@ static void b43_sdio_remove(struct sdio_func *func)
struct b43_sdio *sdio = sdio_get_drvdata(func);
ssb_bus_unregister(&sdio->ssb);
+ sdio_claim_host(func);
sdio_disable_func(func);
+ sdio_release_host(func);
kfree(sdio);
sdio_set_drvdata(func, NULL);
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 149/196] dell-laptop: Add another Dell laptop family to the DMI whitelist
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (101 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 148/196] b43: Fix warning at drivers/mmc/core/core.c:237 in mmc_wait_for_cmd Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 150/196] scsi_dh_emc: request flag cleanup Paul Gortmaker
` (46 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Rezwanul Kabir, Matthew Garrett, Paul Gortmaker
From: Rezwanul Kabir <Rezwanul_Kabir@dell.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 410d44c74cf9942e3055d5b7d73953fac8efbacb upstream.
This is to support Precision M4500 and others.
Signed-off-by: Rezwanul Kabir <Rezwanul_Kabir@dell.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/platform/x86/dell-laptop.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index 6110601..0fb56e0 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -83,6 +83,12 @@ static const struct dmi_system_id __initdata dell_device_table[] = {
},
},
{
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_CHASSIS_TYPE, "9"), /*Laptop*/
+ },
+ },
+ {
.ident = "Dell Computer Corporation",
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
@@ -628,4 +634,5 @@ MODULE_AUTHOR("Matthew Garrett <mjg@redhat.com>");
MODULE_DESCRIPTION("Dell laptop driver");
MODULE_LICENSE("GPL");
MODULE_ALIAS("dmi:*svnDellInc.:*:ct8:*");
+MODULE_ALIAS("dmi:*svnDellInc.:*:ct9:*");
MODULE_ALIAS("dmi:*svnDellComputerCorporation.:*:ct8:*");
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 150/196] scsi_dh_emc: request flag cleanup
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (102 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 149/196] dell-laptop: Add another Dell laptop family to the DMI whitelist Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 151/196] cifs: fix another memleak, in cifs_root_iget Paul Gortmaker
` (45 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Mike Christie, James Bottomley, Paul Gortmaker
From: Mike Christie <michaelc@cs.wisc.edu>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 5738d4449c1baf05e8345684d12371f76296473d upstream.
blk_get_request sets the cmd_flags, so we should not and do not
need to set them. If we did set them to a different value then
it can cause a oops in the elevator code.
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/device_handler/scsi_dh_emc.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/scsi/device_handler/scsi_dh_emc.c b/drivers/scsi/device_handler/scsi_dh_emc.c
index e8a0bc3..6faf472 100644
--- a/drivers/scsi/device_handler/scsi_dh_emc.c
+++ b/drivers/scsi/device_handler/scsi_dh_emc.c
@@ -285,13 +285,11 @@ static struct request *get_req(struct scsi_device *sdev, int cmd,
switch (cmd) {
case MODE_SELECT:
len = sizeof(short_trespass);
- rq->cmd_flags |= REQ_RW;
rq->cmd[1] = 0x10;
rq->cmd[4] = len;
break;
case MODE_SELECT_10:
len = sizeof(long_trespass);
- rq->cmd_flags |= REQ_RW;
rq->cmd[1] = 0x10;
rq->cmd[8] = len;
break;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 151/196] cifs: fix another memleak, in cifs_root_iget
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (103 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 150/196] scsi_dh_emc: request flag cleanup Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 152/196] e1000e: Reset 82577/82578 PHY before first PHY register read Paul Gortmaker
` (44 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Oskar Schirmer, Steve French, Paul Gortmaker
From: Oskar Schirmer <oskar@scara.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit a7851ce73b9fdef53f251420e6883cf4f3766534 upstream.
cifs_root_iget allocates full_path through
cifs_build_path_to_root, but fails to kfree it upon
cifs_get_inode_info* failure.
Make all failure exit paths traverse clean up
handling at the end of the function.
Signed-off-by: Oskar Schirmer <oskar@scara.com>
Reviewed-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/cifs/inode.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 49b47c3..da3e83f 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -793,8 +793,10 @@ struct inode *cifs_root_iget(struct super_block *sb, unsigned long ino)
rc = cifs_get_inode_info(&inode, full_path, NULL, sb,
xid, NULL);
- if (!inode)
- return ERR_PTR(-ENOMEM);
+ if (!inode) {
+ inode = ERR_PTR(-ENOMEM);
+ goto out;
+ }
if (rc && cifs_sb->tcon->ipc) {
cFYI(1, ("ipc connection - fake read inode"));
@@ -805,13 +807,11 @@ struct inode *cifs_root_iget(struct super_block *sb, unsigned long ino)
inode->i_uid = cifs_sb->mnt_uid;
inode->i_gid = cifs_sb->mnt_gid;
} else if (rc) {
- kfree(full_path);
- _FreeXid(xid);
iget_failed(inode);
- return ERR_PTR(rc);
+ inode = ERR_PTR(rc);
}
-
+out:
kfree(full_path);
/* can not call macro FreeXid here since in a void func
* TODO: This is no longer true
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 152/196] e1000e: Reset 82577/82578 PHY before first PHY register read
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (104 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 151/196] cifs: fix another memleak, in cifs_root_iget Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 153/196] e1000: fix Tx hangs by disabling 64-bit DMA Paul Gortmaker
` (43 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Bruce Allan, Jeff Kirsher, David S. Miller,
Paul Gortmaker
From: Bruce Allan <bruce.w.allan@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 627c8a041f7aaaea93c766f69bd61d952a277586 upstream.
Reset the PHY before first accessing it. Doing so, ensure that the PHY is
in a known good state before we read/write PHY registers. This fixes a
driver probe failure.
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/e1000e/ich8lan.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 8b5e157..a626012 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -274,6 +274,16 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
phy->ops.power_down = e1000_power_down_phy_copper_ich8lan;
phy->autoneg_mask = AUTONEG_ADVERTISE_SPEED_DEFAULT;
+ /*
+ * Reset the PHY before any acccess to it. Doing so, ensures that
+ * the PHY is in a known good state before we read/write PHY registers.
+ * The generic reset is sufficient here, because we haven't determined
+ * the PHY type yet.
+ */
+ ret_val = e1000e_phy_hw_reset_generic(hw);
+ if (ret_val)
+ goto out;
+
phy->id = e1000_phy_unknown;
ret_val = e1000e_get_phy_id(hw);
if (ret_val)
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 153/196] e1000: fix Tx hangs by disabling 64-bit DMA
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (105 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 152/196] e1000e: Reset 82577/82578 PHY before first PHY register read Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 154/196] btrfs: Require CAP_SYS_ADMIN for filesystem rebalance Paul Gortmaker
` (42 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jesse Brandeburg, Jeff Kirsher, David S. Miller,
Paul Gortmaker
From: Jesse Brandeburg <jesse.brandeburg@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit e508be174ad36b0cf9b324cd04978c2b13c21502 upstream.
Several users report issues with 32-bit adapters when plugged
into PCI slots in machines with >= 4GB ram. In particular AMD
systems with HyperTransport to PCI bridges seem to trigger the
issue, but it isn't limited to only them.
This issue is not easily reproducible here, yet still continues
to occur in the field. For e1000 on PCI devices, just disable DMA
addresses over the 4GB boundary when in PCI (not PCI-X) mode, to
prevent the issue from continuing to pop up. The performance
impact for this is negligible.
The code was refactored to move the init of the hw struct to its
own function. This allows the init to be called very early in
probe, which then allows using hw-> members for this fix.
A slight refactor to the DMA mask code was done for minor
correctness based on the instructions in DMA-API-HOWTO.
[PG: 34 has pci prefix, e.g pci_set_dma_mask vs. dma_set_mask]
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/e1000/e1000_main.c | 162 +++++++++++++++++++++++-----------------
1 file changed, 92 insertions(+), 70 deletions(-)
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 13e34d2..d61af66 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -787,6 +787,70 @@ static const struct net_device_ops e1000_netdev_ops = {
};
/**
+ * e1000_init_hw_struct - initialize members of hw struct
+ * @adapter: board private struct
+ * @hw: structure used by e1000_hw.c
+ *
+ * Factors out initialization of the e1000_hw struct to its own function
+ * that can be called very early at init (just after struct allocation).
+ * Fields are initialized based on PCI device information and
+ * OS network device settings (MTU size).
+ * Returns negative error codes if MAC type setup fails.
+ */
+static int e1000_init_hw_struct(struct e1000_adapter *adapter,
+ struct e1000_hw *hw)
+{
+ struct pci_dev *pdev = adapter->pdev;
+
+ /* PCI config space info */
+ hw->vendor_id = pdev->vendor;
+ hw->device_id = pdev->device;
+ hw->subsystem_vendor_id = pdev->subsystem_vendor;
+ hw->subsystem_id = pdev->subsystem_device;
+ hw->revision_id = pdev->revision;
+
+ pci_read_config_word(pdev, PCI_COMMAND, &hw->pci_cmd_word);
+
+ hw->max_frame_size = adapter->netdev->mtu +
+ ENET_HEADER_SIZE + ETHERNET_FCS_SIZE;
+ hw->min_frame_size = MINIMUM_ETHERNET_FRAME_SIZE;
+
+ /* identify the MAC */
+ if (e1000_set_mac_type(hw)) {
+ DPRINTK(PROBE, ERR, "Unknown MAC Type\n");
+ return -EIO;
+ }
+
+ switch (hw->mac_type) {
+ default:
+ break;
+ case e1000_82541:
+ case e1000_82547:
+ case e1000_82541_rev_2:
+ case e1000_82547_rev_2:
+ hw->phy_init_script = 1;
+ break;
+ }
+
+ e1000_set_media_type(hw);
+ e1000_get_bus_info(hw);
+
+ hw->wait_autoneg_complete = false;
+ hw->tbi_compatibility_en = true;
+ hw->adaptive_ifs = true;
+
+ /* Copper options */
+
+ if (hw->media_type == e1000_media_type_copper) {
+ hw->mdix = AUTO_ALL_MODES;
+ hw->disable_polarity_correction = false;
+ hw->master_slave = E1000_MASTER_SLAVE;
+ }
+
+ return 0;
+}
+
+/**
* e1000_probe - Device Initialization Routine
* @pdev: PCI device information struct
* @ent: entry in e1000_pci_tbl
@@ -823,22 +887,6 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
if (err)
return err;
- if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) &&
- !pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
- pci_using_dac = 1;
- } else {
- err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
- if (err) {
- err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
- if (err) {
- E1000_ERR("No usable DMA configuration, "
- "aborting\n");
- goto err_dma;
- }
- }
- pci_using_dac = 0;
- }
-
err = pci_request_selected_regions(pdev, bars, e1000_driver_name);
if (err)
goto err_pci_reg;
@@ -882,6 +930,32 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
}
}
+ /* make ready for any if (hw->...) below */
+ err = e1000_init_hw_struct(adapter, hw);
+ if (err)
+ goto err_sw_init;
+
+ /*
+ * there is a workaround being applied below that limits
+ * 64-bit DMA addresses to 64-bit hardware. There are some
+ * 32-bit adapters that Tx hang when given 64-bit DMA addresses
+ */
+ pci_using_dac = 0;
+ if ((hw->bus_type == e1000_bus_type_pcix) &&
+ !dma_set_mask(&pdev->dev, DMA_BIT_MASK(64))) {
+ /*
+ * according to DMA-API-HOWTO, coherent calls will always
+ * succeed if the set call did
+ */
+ dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64));
+ pci_using_dac = 1;
+ } else if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(32))) {
+ dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+ } else {
+ pr_err("No usable DMA config, aborting\n");
+ goto err_dma;
+ }
+
netdev->netdev_ops = &e1000_netdev_ops;
e1000_set_ethtool_ops(netdev);
netdev->watchdog_timeo = 5 * HZ;
@@ -956,8 +1030,6 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
if (!is_valid_ether_addr(netdev->perm_addr))
DPRINTK(PROBE, ERR, "Invalid MAC Address\n");
- e1000_get_bus_info(hw);
-
init_timer(&adapter->tx_fifo_stall_timer);
adapter->tx_fifo_stall_timer.function = &e1000_82547_tx_fifo_stall;
adapter->tx_fifo_stall_timer.data = (unsigned long)adapter;
@@ -1070,6 +1142,7 @@ err_eeprom:
iounmap(hw->flash_address);
kfree(adapter->tx_ring);
kfree(adapter->rx_ring);
+err_dma:
err_sw_init:
iounmap(hw->hw_addr);
err_ioremap:
@@ -1077,7 +1150,6 @@ err_ioremap:
err_alloc_etherdev:
pci_release_selected_regions(pdev, bars);
err_pci_reg:
-err_dma:
pci_disable_device(pdev);
return err;
}
@@ -1129,62 +1201,12 @@ static void __devexit e1000_remove(struct pci_dev *pdev)
* @adapter: board private structure to initialize
*
* e1000_sw_init initializes the Adapter private data structure.
- * Fields are initialized based on PCI device information and
- * OS network device settings (MTU size).
+ * e1000_init_hw_struct MUST be called before this function
**/
static int __devinit e1000_sw_init(struct e1000_adapter *adapter)
{
- struct e1000_hw *hw = &adapter->hw;
- struct net_device *netdev = adapter->netdev;
- struct pci_dev *pdev = adapter->pdev;
-
- /* PCI config space info */
-
- hw->vendor_id = pdev->vendor;
- hw->device_id = pdev->device;
- hw->subsystem_vendor_id = pdev->subsystem_vendor;
- hw->subsystem_id = pdev->subsystem_device;
- hw->revision_id = pdev->revision;
-
- pci_read_config_word(pdev, PCI_COMMAND, &hw->pci_cmd_word);
-
adapter->rx_buffer_len = MAXIMUM_ETHERNET_VLAN_SIZE;
- hw->max_frame_size = netdev->mtu +
- ENET_HEADER_SIZE + ETHERNET_FCS_SIZE;
- hw->min_frame_size = MINIMUM_ETHERNET_FRAME_SIZE;
-
- /* identify the MAC */
-
- if (e1000_set_mac_type(hw)) {
- DPRINTK(PROBE, ERR, "Unknown MAC Type\n");
- return -EIO;
- }
-
- switch (hw->mac_type) {
- default:
- break;
- case e1000_82541:
- case e1000_82547:
- case e1000_82541_rev_2:
- case e1000_82547_rev_2:
- hw->phy_init_script = 1;
- break;
- }
-
- e1000_set_media_type(hw);
-
- hw->wait_autoneg_complete = false;
- hw->tbi_compatibility_en = true;
- hw->adaptive_ifs = true;
-
- /* Copper options */
-
- if (hw->media_type == e1000_media_type_copper) {
- hw->mdix = AUTO_ALL_MODES;
- hw->disable_polarity_correction = false;
- hw->master_slave = E1000_MASTER_SLAVE;
- }
adapter->num_tx_queues = 1;
adapter->num_rx_queues = 1;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 154/196] btrfs: Require CAP_SYS_ADMIN for filesystem rebalance
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (106 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 153/196] e1000: fix Tx hangs by disabling 64-bit DMA Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 155/196] init, sched: Fix race between init and kthreadd Paul Gortmaker
` (41 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Ben Hutchings, Chris Mason, Paul Gortmaker
From: Ben Hutchings <ben@decadent.org.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 6f88a4403def422bd8e276ddf6863d6ac71435d2 upstream.
Filesystem rebalancing (BTRFS_IOC_BALANCE) affects the entire
filesystem and may run uninterruptibly for a long time. This does not
seem to be something that an unprivileged user should be able to do.
Reported-by: Aron Xu <happyaron.xu@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/btrfs/volumes.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 8db7b14..c04ebb1 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -22,6 +22,7 @@
#include <linux/blkdev.h>
#include <linux/random.h>
#include <linux/iocontext.h>
+#include <linux/capability.h>
#include <asm/div64.h>
#include "compat.h"
#include "ctree.h"
@@ -1908,6 +1909,9 @@ int btrfs_balance(struct btrfs_root *dev_root)
if (dev_root->fs_info->sb->s_flags & MS_RDONLY)
return -EROFS;
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
mutex_lock(&dev_root->fs_info->volume_mutex);
dev_root = dev_root->fs_info->dev_root;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 155/196] init, sched: Fix race between init and kthreadd
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (107 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 154/196] btrfs: Require CAP_SYS_ADMIN for filesystem rebalance Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 156/196] backlight: MacBookAir3,1(3,2) mbp-nvidia-bl support Paul Gortmaker
` (40 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Peter Zijlstra, Peter Zijlstra, Ingo Molnar,
Paul Gortmaker
From: Peter Zijlstra <peterz@infradead.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b433c3d4549ae74935b585115f076c6fb7bc48fe upstream.
Ilya reported that on a very slow machine he could reliably
reproduce a race between forking init and kthreadd. We first
fork init so that it obtains pid-1, however since the scheduler
is already fully running at this point it can preempt and run
the init thread before we spawn and set kthreadd_task.
The init thread can then attempt spawning kthreads without
kthreadd being present which results in an OOPS.
Reported-by: Ilya Loginov <isloginov@gmail.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
LKML-Reference: <1277736661.3561.110.camel@laptop>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
init/main.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/init/main.c b/init/main.c
index 5c85402..df0e20b 100644
--- a/init/main.c
+++ b/init/main.c
@@ -421,18 +421,26 @@ static void __init setup_command_line(char *command_line)
* gcc-3.4 accidentally inlines this function, so use noinline.
*/
+static __initdata DECLARE_COMPLETION(kthreadd_done);
+
static noinline void __init_refok rest_init(void)
__releases(kernel_lock)
{
int pid;
rcu_scheduler_starting();
+ /*
+ * We need to spawn init first so that it obtains pid-1, however
+ * the init task will end up wanting to create kthreads, which, if
+ * we schedule it before we create kthreadd, will OOPS.
+ */
kernel_thread(kernel_init, NULL, CLONE_FS | CLONE_SIGHAND);
numa_default_policy();
pid = kernel_thread(kthreadd, NULL, CLONE_FS | CLONE_FILES);
rcu_read_lock();
kthreadd_task = find_task_by_pid_ns(pid, &init_pid_ns);
rcu_read_unlock();
+ complete(&kthreadd_done);
unlock_kernel();
/*
@@ -853,6 +861,10 @@ static noinline int init_post(void)
static int __init kernel_init(void * unused)
{
+ /*
+ * Wait until kthreadd is all set-up.
+ */
+ wait_for_completion(&kthreadd_done);
lock_kernel();
/*
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 156/196] backlight: MacBookAir3,1(3,2) mbp-nvidia-bl support
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (108 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 155/196] init, sched: Fix race between init and kthreadd Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 157/196] bonding: Ensure that we unshare skbs prior to calling pskb_may_pull Paul Gortmaker
` (39 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Edgar (gimli) Hucek, Andrew Morton,
Linus Torvalds, Paul Gortmaker
From: "Edgar (gimli) Hucek" <gimli@dark-green.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit bd760e1e5b34351e0705705e5163cb89c1316d71 upstream.
Add support for the MacBookAir3,1 and MacBookAir3,2 to the mbp-nvidia-bl
driver.
Signed-off-by: Edgar (gimli) Hucek <gimli@dark-green.com>
Acked-by: Richard Purdie <rpurdie@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/video/backlight/mbp_nvidia_bl.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/drivers/video/backlight/mbp_nvidia_bl.c b/drivers/video/backlight/mbp_nvidia_bl.c
index 1b5d3fe..0f5268e 100644
--- a/drivers/video/backlight/mbp_nvidia_bl.c
+++ b/drivers/video/backlight/mbp_nvidia_bl.c
@@ -290,6 +290,24 @@ static const struct dmi_system_id __initdata mbp_device_table[] = {
},
.driver_data = (void *)&nvidia_chipset_data,
},
+ {
+ .callback = mbp_dmi_match,
+ .ident = "MacBookAir 3,1",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3,1"),
+ },
+ .driver_data = (void *)&nvidia_chipset_data,
+ },
+ {
+ .callback = mbp_dmi_match,
+ .ident = "MacBookAir 3,2",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3,2"),
+ },
+ .driver_data = (void *)&nvidia_chipset_data,
+ },
{ }
};
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 157/196] bonding: Ensure that we unshare skbs prior to calling pskb_may_pull
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (109 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 156/196] backlight: MacBookAir3,1(3,2) mbp-nvidia-bl support Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 158/196] HID: add MacBookAir 3,1 and 3,2 support Paul Gortmaker
` (38 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Neil Horman, Andy Gospodarek, Jay Vosburgh,
David S. Miller, Paul Gortmaker
From: Neil Horman <nhorman@tuxdriver.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b30532515f0a62bfe17207ab00883dd262497006 upstream.
Recently reported oops:
kernel BUG at net/core/skbuff.c:813!
invalid opcode: 0000 [#1] SMP
last sysfs file: /sys/devices/virtual/net/bond0/broadcast
CPU 8
Modules linked in: sit tunnel4 cpufreq_ondemand acpi_cpufreq freq_table bonding
ipv6 dm_mirror dm_region_hash dm_log cdc_ether usbnet mii serio_raw i2c_i801
i2c_core iTCO_wdt iTCO_vendor_support shpchp ioatdma i7core_edac edac_core bnx2
ixgbe dca mdio sg ext4 mbcache jbd2 sd_mod crc_t10dif mptsas mptscsih mptbase
scsi_transport_sas dm_mod [last unloaded: microcode]
Modules linked in: sit tunnel4 cpufreq_ondemand acpi_cpufreq freq_table bonding
ipv6 dm_mirror dm_region_hash dm_log cdc_ether usbnet mii serio_raw i2c_i801
i2c_core iTCO_wdt iTCO_vendor_support shpchp ioatdma i7core_edac edac_core bnx2
ixgbe dca mdio sg ext4 mbcache jbd2 sd_mod crc_t10dif mptsas mptscsih mptbase
scsi_transport_sas dm_mod [last unloaded: microcode]
Pid: 0, comm: swapper Not tainted 2.6.32-71.el6.x86_64 #1 BladeCenter HS22
-[7870AC1]-
RIP: 0010:[<ffffffff81405b16>] [<ffffffff81405b16>]
pskb_expand_head+0x36/0x1e0
RSP: 0018:ffff880028303b70 EFLAGS: 00010202
RAX: 0000000000000002 RBX: ffff880c6458ec80 RCX: 0000000000000020
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880c6458ec80
RBP: ffff880028303bc0 R08: ffffffff818a6180 R09: ffff880c6458ed64
R10: ffff880c622b36c0 R11: 0000000000000400 R12: 0000000000000000
R13: 0000000000000180 R14: ffff880c622b3000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff880028300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 00000038653452a4 CR3: 0000000001001000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process swapper (pid: 0, threadinfo ffff8806649c2000, task ffff880c64f16ab0)
Stack:
ffff880028303bc0 ffffffff8104fff9 000000000000001c 0000000100000000
<0> ffff880000047d80 ffff880c6458ec80 000000000000001c ffff880c6223da00
<0> ffff880c622b3000 0000000000000000 ffff880028303c10 ffffffff81407f7a
Call Trace:
<IRQ>
[<ffffffff8104fff9>] ? __wake_up_common+0x59/0x90
[<ffffffff81407f7a>] __pskb_pull_tail+0x2aa/0x360
[<ffffffffa0244530>] bond_arp_rcv+0x2c0/0x2e0 [bonding]
[<ffffffff814a0857>] ? packet_rcv+0x377/0x440
[<ffffffff8140f21b>] netif_receive_skb+0x2db/0x670
[<ffffffff8140f788>] napi_skb_finish+0x58/0x70
[<ffffffff8140fc89>] napi_gro_receive+0x39/0x50
[<ffffffffa01286eb>] ixgbe_clean_rx_irq+0x35b/0x900 [ixgbe]
[<ffffffffa01290f6>] ixgbe_clean_rxtx_many+0x136/0x240 [ixgbe]
[<ffffffff8140fe53>] net_rx_action+0x103/0x210
[<ffffffff81073bd7>] __do_softirq+0xb7/0x1e0
[<ffffffff810d8740>] ? handle_IRQ_event+0x60/0x170
[<ffffffff810142cc>] call_softirq+0x1c/0x30
[<ffffffff81015f35>] do_softirq+0x65/0xa0
[<ffffffff810739d5>] irq_exit+0x85/0x90
[<ffffffff814cf915>] do_IRQ+0x75/0xf0
[<ffffffff81013ad3>] ret_from_intr+0x0/0x11
<EOI>
[<ffffffff8101bc01>] ? mwait_idle+0x71/0xd0
[<ffffffff814cd80a>] ? atomic_notifier_call_chain+0x1a/0x20
[<ffffffff81011e96>] cpu_idle+0xb6/0x110
[<ffffffff814c17c8>] start_secondary+0x1fc/0x23f
Resulted from bonding driver registering packet handlers via dev_add_pack and
then trying to call pskb_may_pull. If another packet handler (like for AF_PACKET
sockets) gets called first, the delivered skb will have a user count > 1, which
causes pskb_may_pull to BUG halt when it does its skb_shared check. Fix this by
calling skb_share_check prior to the may_pull call sites in the bonding driver
to clone the skb when needed. Tested by myself and the reported successfully.
Signed-off-by: Neil Horman
CC: Andy Gospodarek <andy@greyhouse.net>
CC: Jay Vosburgh <fubar@us.ibm.com>
CC: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/bonding/bond_3ad.c | 4 ++++
drivers/net/bonding/bond_alb.c | 4 ++++
drivers/net/bonding/bond_main.c | 4 ++++
3 files changed, 12 insertions(+)
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 0ddf4c6..9a002f1 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2466,6 +2466,10 @@ int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct pac
if (!(dev->flags & IFF_MASTER))
goto out;
+ skb = skb_share_check(skb, GFP_ATOMIC);
+ if (!skb)
+ goto out;
+
if (!pskb_may_pull(skb, sizeof(struct lacpdu)))
goto out;
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 0d42b38..e9154ab 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -368,6 +368,10 @@ static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct
goto out;
}
+ skb = skb_share_check(skb, GFP_ATOMIC);
+ if (!skb)
+ goto out;
+
if (!pskb_may_pull(skb, arp_hdr_len(bond_dev)))
goto out;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 0075514..af8eec1 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2645,6 +2645,10 @@ static int bond_arp_rcv(struct sk_buff *skb, struct net_device *dev, struct pack
if (!slave || !slave_do_arp_validate(bond, slave))
goto out_unlock;
+ skb = skb_share_check(skb, GFP_ATOMIC);
+ if (!skb)
+ goto out_unlock;
+
if (!pskb_may_pull(skb, arp_hdr_len(dev)))
goto out_unlock;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 158/196] HID: add MacBookAir 3,1 and 3,2 support
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (110 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 157/196] bonding: Ensure that we unshare skbs prior to calling pskb_may_pull Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 159/196] intel-iommu: Force-disable IOMMU for iGFX on broken Cantiga revisions Paul Gortmaker
` (37 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Edgar (gimli) Hucek, Jiri Kosina, Paul Gortmaker
From: "Edgar (gimli) Hucek" <gimli@dark-green.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 99b9f758bbc904f22faffcf4d83205f4a5e7bc0c upstream.
This patch add support for the MacBookAir3,1 and MacBookAir3,2 to the hid
driver.
Signed-off-by: Edgar (gimli) Hucek <gimli@dark-green.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/hid/hid-apple.c | 46 ++++++++++++++++++++++++++++++++++++++++++----
drivers/hid/hid-core.c | 12 ++++++++++++
drivers/hid/hid-ids.h | 6 ++++++
3 files changed, 60 insertions(+), 4 deletions(-)
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index bba05d0..1a2bb2a 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -59,6 +59,27 @@ struct apple_key_translation {
u8 flags;
};
+static const struct apple_key_translation macbookair_fn_keys[] = {
+ { KEY_BACKSPACE, KEY_DELETE },
+ { KEY_ENTER, KEY_INSERT },
+ { KEY_F1, KEY_BRIGHTNESSDOWN, APPLE_FLAG_FKEY },
+ { KEY_F2, KEY_BRIGHTNESSUP, APPLE_FLAG_FKEY },
+ { KEY_F3, KEY_SCALE, APPLE_FLAG_FKEY },
+ { KEY_F4, KEY_DASHBOARD, APPLE_FLAG_FKEY },
+ { KEY_F6, KEY_PREVIOUSSONG, APPLE_FLAG_FKEY },
+ { KEY_F7, KEY_PLAYPAUSE, APPLE_FLAG_FKEY },
+ { KEY_F8, KEY_NEXTSONG, APPLE_FLAG_FKEY },
+ { KEY_F9, KEY_MUTE, APPLE_FLAG_FKEY },
+ { KEY_F10, KEY_VOLUMEDOWN, APPLE_FLAG_FKEY },
+ { KEY_F11, KEY_VOLUMEUP, APPLE_FLAG_FKEY },
+ { KEY_F12, KEY_EJECTCD, APPLE_FLAG_FKEY },
+ { KEY_UP, KEY_PAGEUP },
+ { KEY_DOWN, KEY_PAGEDOWN },
+ { KEY_LEFT, KEY_HOME },
+ { KEY_RIGHT, KEY_END },
+ { }
+};
+
static const struct apple_key_translation apple_fn_keys[] = {
{ KEY_BACKSPACE, KEY_DELETE },
{ KEY_ENTER, KEY_INSERT },
@@ -157,10 +178,15 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
if (fnmode) {
int do_translate;
- trans = apple_find_translation((hid->product < 0x21d ||
- hid->product >= 0x300) ?
- powerbook_fn_keys : apple_fn_keys,
- usage->code);
+ if(hid->product >= USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI &&
+ hid->product <= USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) {
+ trans = apple_find_translation(macbookair_fn_keys, usage->code);
+ } else if (hid->product < 0x21d || hid->product >= 0x300) {
+ trans = apple_find_translation(powerbook_fn_keys, usage->code);
+ } else {
+ trans = apple_find_translation(apple_fn_keys, usage->code);
+ }
+
if (trans) {
if (test_bit(usage->code, asc->pressed_fn))
do_translate = 1;
@@ -439,6 +465,18 @@ static const struct hid_device_id apple_devices[] = {
.driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS),
.driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI),
+ .driver_data = APPLE_HAS_FN },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO),
+ .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS),
+ .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI),
+ .driver_data = APPLE_HAS_FN },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO),
+ .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS),
+ .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI),
.driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO),
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 0010efa..07ddda5 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1284,6 +1284,12 @@ static const struct hid_device_id hid_blacklist[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
@@ -1715,6 +1721,12 @@ static const struct hid_device_id hid_mouse_ignore_list[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
{ }
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b681cbf..fe054d6 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -92,6 +92,12 @@
#define USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI 0x0236
#define USB_DEVICE_ID_APPLE_WELLSPRING3_ISO 0x0237
#define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS 0x0238
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI 0x023f
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_ISO 0x0240
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_JIS 0x0241
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI 0x0242
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO 0x0243
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS 0x0244
#define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI 0x0239
#define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO 0x023a
#define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS 0x023b
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 159/196] intel-iommu: Force-disable IOMMU for iGFX on broken Cantiga revisions.
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (111 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 158/196] HID: add MacBookAir 3,1 and 3,2 support Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 160/196] ipv6: Silence privacy extensions initialization Paul Gortmaker
` (36 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, David Woodhouse, Paul Gortmaker
From: David Woodhouse <David.Woodhouse@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 2d9e667efdfb4e986074d98e7d9a424003c7c43b upstream.
Certain revisions of this chipset appear to be broken. There is a shadow
GTT which mirrors the real GTT but contains pre-translated physical
addresses, for performance reasons. When a GTT update happens, the
translations are done once and the resulting physical addresses written
back to the shadow GTT.
Except sometimes, the physical address is actually written back to the
_real_ GTT, not the shadow GTT. Thus we start to see faults when that
physical address is fed through translation again.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/pci/intel-iommu.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 2b985b9..67e2f60 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -383,7 +383,7 @@ int dmar_disabled = 0;
int dmar_disabled = 1;
#endif /*CONFIG_DMAR_DEFAULT_ON*/
-static int __initdata dmar_map_gfx = 1;
+static int dmar_map_gfx = 1;
static int dmar_forcedac;
static int intel_iommu_strict;
@@ -3762,6 +3762,12 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
*/
printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n");
rwbf_quirk = 1;
+
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=538163 */
+ if (dev->revision == 0x07) {
+ printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n");
+ dmar_map_gfx = 0;
+ }
}
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 160/196] ipv6: Silence privacy extensions initialization
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (112 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 159/196] intel-iommu: Force-disable IOMMU for iGFX on broken Cantiga revisions Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 161/196] mpt2sas: fix the incorrect scsi_dma_map error checking Paul Gortmaker
` (35 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Romain Francoise, David S. Miller, Paul Gortmaker
From: Romain Francoise <romain@orebokech.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 2fdc1c8093255f9da877d7b9ce3f46c2098377dc upstream.
When a network namespace is created (via CLONE_NEWNET), the loopback
interface is automatically added to the new namespace, triggering a
printk in ipv6_add_dev() if CONFIG_IPV6_PRIVACY is set.
This is problematic for applications which use CLONE_NEWNET as
part of a sandbox, like Chromium's suid sandbox or recent versions of
vsftpd. On a busy machine, it can lead to thousands of useless
"lo: Disabled Privacy Extensions" messages appearing in dmesg.
It's easy enough to check the status of privacy extensions via the
use_tempaddr sysctl, so just removing the printk seems like the most
sensible solution.
Signed-off-by: Romain Francoise <romain@orebokech.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/ipv6/addrconf.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 844ffc5..34ad669 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -408,9 +408,6 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
dev->type == ARPHRD_TUNNEL6 ||
dev->type == ARPHRD_SIT ||
dev->type == ARPHRD_NONE) {
- printk(KERN_INFO
- "%s: Disabled Privacy Extensions\n",
- dev->name);
ndev->cnf.use_tempaddr = -1;
} else {
in6_dev_hold(ndev);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 161/196] mpt2sas: fix the incorrect scsi_dma_map error checking
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (113 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 160/196] ipv6: Silence privacy extensions initialization Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 162/196] powerpc/boot/dts: Install dts from the right directory Paul Gortmaker
` (34 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, FUJITA Tomonori, James Bottomley, Paul Gortmaker
From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit bb789d01620e5d36081b22edb6fb71cf55ff043c upstream.
scsi_dma_map() returns -1 if an error occurred (zero means that the
command has no data). So the following current code can't catch an
error:
sges_left = scsi_dma_map(scmd);
if (!sges_left) {
sdev_printk(KERN_ERR, scmd->device, "pci_map_sg"
" failed: request for %d bytes!\n", scsi_bufflen(scmd));
return -ENOMEM;
}
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: "Desai, Kashyap" <Kashyap.Desai@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/mpt2sas/mpt2sas_scsih.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index 87cf0d2..8d98f09 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -988,7 +988,7 @@ _scsih_build_scatter_gather(struct MPT2SAS_ADAPTER *ioc,
u32 chain_offset;
u32 chain_length;
u32 chain_flags;
- u32 sges_left;
+ int sges_left;
u32 sges_in_segment;
u32 sgl_flags;
u32 sgl_flags_last_element;
@@ -1009,7 +1009,7 @@ _scsih_build_scatter_gather(struct MPT2SAS_ADAPTER *ioc,
sg_scmd = scsi_sglist(scmd);
sges_left = scsi_dma_map(scmd);
- if (!sges_left) {
+ if (sges_left < 0) {
sdev_printk(KERN_ERR, scmd->device, "pci_map_sg"
" failed: request for %d bytes!\n", scsi_bufflen(scmd));
return -ENOMEM;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 162/196] powerpc/boot/dts: Install dts from the right directory
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (114 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 161/196] mpt2sas: fix the incorrect scsi_dma_map error checking Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 163/196] rt2500usb: fallback to SW encryption for TKIP+AES Paul Gortmaker
` (33 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Ben Hutchings, Benjamin Herrenschmidt, Paul Gortmaker
From: Ben Hutchings <ben@decadent.org.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 4d9ef89dee13e964ea8b064d82ff55cf36209237 upstream.
The dts-installed variable is initialised using a wildcard path that
will be expanded relative to the build directory. Use the existing
variable dtstree to generate an absolute wildcard path that will work
when building in a separate directory.
Reported-by: Gerhard Pircher <gerhard_pircher@gmx.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Tested-by: Gerhard Pircher <gerhard_pircher@gmx.net> [against 2.6.32]
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/powerpc/boot/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index bb2465b..22b527b 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -367,7 +367,7 @@ INSTALL := install
extra-installed := $(patsubst $(obj)/%, $(DESTDIR)$(WRAPPER_OBJDIR)/%, $(extra-y))
hostprogs-installed := $(patsubst %, $(DESTDIR)$(WRAPPER_BINDIR)/%, $(hostprogs-y))
wrapper-installed := $(DESTDIR)$(WRAPPER_BINDIR)/wrapper
-dts-installed := $(patsubst $(obj)/dts/%, $(DESTDIR)$(WRAPPER_DTSDIR)/%, $(wildcard $(obj)/dts/*.dts))
+dts-installed := $(patsubst $(dtstree)/%, $(DESTDIR)$(WRAPPER_DTSDIR)/%, $(wildcard $(dtstree)/*.dts))
all-installed := $(extra-installed) $(hostprogs-installed) $(wrapper-installed) $(dts-installed)
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 163/196] rt2500usb: fallback to SW encryption for TKIP+AES
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (115 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 162/196] powerpc/boot/dts: Install dts from the right directory Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 164/196] tehuti: Firmware filename is tehuti/bdx.bin Paul Gortmaker
` (32 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Ondrej Zary, John W. Linville, Paul Gortmaker
From: Ondrej Zary <linux@rainbow-software.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 75f64dd54a185150ebfc45e99351c890d4a2252f upstream.
HW crypto in rt2500usb does not seem to support keys with different ciphers,
which breaks TKIP+AES mode. Fall back to software encryption to fix it.
This should fix long-standing problems with rt2500usb and WPA, such as:
http://rt2x00.serialmonkey.com/phpBB/viewtopic.php?f=4&t=4834
https://bugzilla.redhat.com/show_bug.cgi?id=484888
Also tested that it does not break WEP, TKIP-only and AES-only modes.
Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/wireless/rt2x00/rt2500usb.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 8ebb705..2961228 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -348,6 +348,7 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
int timeout;
u32 mask;
u16 reg;
+ enum cipher curr_cipher;
if (crypto->cmd == SET_KEY) {
/*
@@ -358,6 +359,7 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
mask = TXRX_CSR0_KEY_ID.bit_mask;
rt2500usb_register_read(rt2x00dev, TXRX_CSR0, ®);
+ curr_cipher = rt2x00_get_field16(reg, TXRX_CSR0_ALGORITHM);
reg &= mask;
if (reg && reg == mask)
@@ -366,6 +368,14 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
reg = rt2x00_get_field16(reg, TXRX_CSR0_KEY_ID);
key->hw_key_idx += reg ? ffz(reg) : 0;
+ /*
+ * Hardware requires that all keys use the same cipher
+ * (e.g. TKIP-only, AES-only, but not TKIP+AES).
+ * If this is not the first key, compare the cipher with the
+ * first one and fall back to SW crypto if not the same.
+ */
+ if (key->hw_key_idx > 0 && crypto->cipher != curr_cipher)
+ return -EOPNOTSUPP;
/*
* The encryption key doesn't fit within the CSR cache,
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 164/196] tehuti: Firmware filename is tehuti/bdx.bin
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (116 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 163/196] rt2500usb: fallback to SW encryption for TKIP+AES Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 165/196] wireless: b43: fix error path in SDIO Paul Gortmaker
` (31 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Ben Hutchings, Andy Gospodarek, David S. Miller,
Paul Gortmaker
From: Ben Hutchings <ben@decadent.org.uk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 46814e08d80f87449b5adb3d549a3cae6f9f8148 upstream.
My conversion of tehuti to use request_firmware() was confused about
the filename of the firmware blob. Change the driver to match the
blob.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/tehuti.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c
index f549309..cf4529c 100644
--- a/drivers/net/tehuti.c
+++ b/drivers/net/tehuti.c
@@ -324,7 +324,7 @@ static int bdx_fw_load(struct bdx_priv *priv)
ENTER;
master = READ_REG(priv, regINIT_SEMAPHORE);
if (!READ_REG(priv, regINIT_STATUS) && master) {
- rc = request_firmware(&fw, "tehuti/firmware.bin", &priv->pdev->dev);
+ rc = request_firmware(&fw, "tehuti/bdx.bin", &priv->pdev->dev);
if (rc)
goto out;
bdx_tx_push_desc_safe(priv, (char *)fw->data, fw->size);
@@ -2518,4 +2518,4 @@ module_exit(bdx_module_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR(DRIVER_AUTHOR);
MODULE_DESCRIPTION(BDX_DRV_DESC);
-MODULE_FIRMWARE("tehuti/firmware.bin");
+MODULE_FIRMWARE("tehuti/bdx.bin");
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 165/196] wireless: b43: fix error path in SDIO
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (117 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 164/196] tehuti: Firmware filename is tehuti/bdx.bin Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 166/196] libata: set queue DMA alignment to sector size for ATAPI too Paul Gortmaker
` (30 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Guennadi Liakhovetski, John W. Linville, Paul Gortmaker
From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit e476a5a41ad67d0e2b4a652820c49a3923eb936b upstream.
Fix unbalanced call to sdio_release_host() on the error path.
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/wireless/b43/sdio.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/b43/sdio.c b/drivers/net/wireless/b43/sdio.c
index 8b18314..4808dc7 100644
--- a/drivers/net/wireless/b43/sdio.c
+++ b/drivers/net/wireless/b43/sdio.c
@@ -163,6 +163,7 @@ static int b43_sdio_probe(struct sdio_func *func,
err_free_ssb:
kfree(sdio);
err_disable_func:
+ sdio_claim_host(func);
sdio_disable_func(func);
err_release_host:
sdio_release_host(func);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 166/196] libata: set queue DMA alignment to sector size for ATAPI too
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (118 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 165/196] wireless: b43: fix error path in SDIO Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 167/196] iwlwifi: fix skb usage after free Paul Gortmaker
` (29 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Tejun Heo, Tejun Heo, Jeff Garzik, Paul Gortmaker
From: Tejun Heo <htejun@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 729a6a300e628a48cf12bac93a964a535e83cd1d upstream.
ata_pio_sectors() expects buffer for each sector to be contained in a
single page; otherwise, it ends up overrunning the first page. This
is achieved by setting queue DMA alignment. If sector_size is smaller
than PAGE_SIZE and all buffers are sector_size aligned, buffer for
each sector is always contained in a single page.
This wasn't applied to ATAPI devices but IDENTIFY_PACKET is executed
as ATA_PROT_PIO and thus uses ata_pio_sectors(). Newer versions of
udev issue IDENTIFY_PACKET with unaligned buffer triggering the
problem and causing oops.
This patch fixes the problem by setting sdev->sector_size to
ATA_SECT_SIZE on ATATPI devices and always setting DMA alignment to
sector_size. While at it, add a warning for the unlikely but still
possible scenario where sector_size is larger than PAGE_SIZE, in which
case the alignment wouldn't be enough.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: John Stanley <jpsinthemix@verizon.net>
Tested-by: John Stanley <jpsinthemix@verizon.net>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/ata/libata-scsi.c | 24 ++++++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 1d266e2..0dfa468 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1104,9 +1104,9 @@ static int ata_scsi_dev_config(struct scsi_device *sdev,
struct request_queue *q = sdev->request_queue;
void *buf;
- /* set the min alignment and padding */
- blk_queue_update_dma_alignment(sdev->request_queue,
- ATA_DMA_PAD_SZ - 1);
+ sdev->sector_size = ATA_SECT_SIZE;
+
+ /* set DMA padding */
blk_queue_update_dma_pad(sdev->request_queue,
ATA_DMA_PAD_SZ - 1);
@@ -1120,12 +1120,24 @@ static int ata_scsi_dev_config(struct scsi_device *sdev,
blk_queue_dma_drain(q, atapi_drain_needed, buf, ATAPI_MAX_DRAIN);
} else {
- /* ATA devices must be sector aligned */
- blk_queue_update_dma_alignment(sdev->request_queue,
- ATA_SECT_SIZE - 1);
sdev->manage_start_stop = 1;
}
+ /*
+ * ata_pio_sectors() expects buffer for each sector to not cross
+ * page boundary. Enforce it by requiring buffers to be sector
+ * aligned, which works iff sector_size is not larger than
+ * PAGE_SIZE. ATAPI devices also need the alignment as
+ * IDENTIFY_PACKET is executed as ATA_PROT_PIO.
+ */
+ if (sdev->sector_size > PAGE_SIZE)
+ ata_dev_printk(dev, KERN_WARNING,
+ "sector_size=%u > PAGE_SIZE, PIO may malfunction\n",
+ sdev->sector_size);
+
+ blk_queue_update_dma_alignment(sdev->request_queue,
+ ATA_SECT_SIZE - 1);
+
if (dev->flags & ATA_DFLAG_AN)
set_bit(SDEV_EVT_MEDIA_CHANGE, sdev->supported_events);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 167/196] iwlwifi: fix skb usage after free
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (119 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 166/196] libata: set queue DMA alignment to sector size for ATAPI too Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 168/196] x86: pvclock: Move scale_delta into common header Paul Gortmaker
` (28 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Stanislaw Gruszka, John W. Linville, Paul Gortmaker
From: Stanislaw Gruszka <sgruszka@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit b25026981aecde3685dd0e45ad980fff9f528daa upstream.
Since
commit a120e912eb51e347f36c71b60a1d13af74d30e83
Author: Stanislaw Gruszka <sgruszka@redhat.com>
Date: Fri Feb 19 15:47:33 2010 -0800
iwlwifi: sanity check before counting number of tfds can be free
we use skb->data after calling ieee80211_tx_status_irqsafe(), which
could free skb instantly.
On current kernels I do not observe practical problems related with
bug, but on 2.6.35.y it cause random system hangs when stressing
wireless link.
[PG: since 34, file renamed, + iwlagn_tx_status --> iwl_tx_status]
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Acked-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/wireless/iwlwifi/iwl-tx.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index e950153..92a5f9e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -1234,11 +1234,15 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
tx_info = &txq->txb[txq->q.read_ptr];
- iwl_tx_status(priv, tx_info->skb[0]);
+
+ if (WARN_ON_ONCE(tx_info->skb == NULL))
+ continue;
hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;
- if (hdr && ieee80211_is_data_qos(hdr->frame_control))
+ if (ieee80211_is_data_qos(hdr->frame_control))
nfreed++;
+
+ iwl_tx_status(priv, tx_info->skb[0]);
tx_info->skb[0] = NULL;
if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 168/196] x86: pvclock: Move scale_delta into common header
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (120 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 167/196] iwlwifi: fix skb usage after free Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 169/196] fix oops in scsi_run_queue() Paul Gortmaker
` (27 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Zachary Amsden, Marcelo Tosatti, Paul Gortmaker
From: Zachary Amsden <zamsden@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 347bb4448c2155eb2310923ccaa4be5677649003 upstream.
The scale_delta function for shift / multiply with 31-bit
precision moves to a common header so it can be used by both
kernel and kvm module.
Signed-off-by: Zachary Amsden <zamsden@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/include/asm/pvclock.h | 38 ++++++++++++++++++++++++++++++++++++++
arch/x86/kernel/pvclock.c | 3 ++-
2 files changed, 40 insertions(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h
index daaacab..982aa32 100644
--- a/arch/x86/include/asm/pvclock.h
+++ b/arch/x86/include/asm/pvclock.h
@@ -12,4 +12,42 @@ void pvclock_read_wallclock(struct pvclock_wall_clock *wall,
struct timespec *ts);
void pvclock_resume(void);
+/*
+ * Scale a 64-bit delta by scaling and multiplying by a 32-bit fraction,
+ * yielding a 64-bit result.
+ */
+static inline u64 pvclock_scale_delta(u64 delta, u32 mul_frac, int shift)
+{
+ u64 product;
+#ifdef __i386__
+ u32 tmp1, tmp2;
+#endif
+
+ if (shift < 0)
+ delta >>= -shift;
+ else
+ delta <<= shift;
+
+#ifdef __i386__
+ __asm__ (
+ "mul %5 ; "
+ "mov %4,%%eax ; "
+ "mov %%edx,%4 ; "
+ "mul %5 ; "
+ "xor %5,%5 ; "
+ "add %4,%%eax ; "
+ "adc %5,%%edx ; "
+ : "=A" (product), "=r" (tmp1), "=r" (tmp2)
+ : "a" ((u32)delta), "1" ((u32)(delta >> 32)), "2" (mul_frac) );
+#elif defined(__x86_64__)
+ __asm__ (
+ "mul %%rdx ; shrd $32,%%rdx,%%rax"
+ : "=a" (product) : "0" (delta), "d" ((u64)mul_frac) );
+#else
+#error implement me!
+#endif
+
+ return product;
+}
+
#endif /* _ASM_X86_PVCLOCK_H */
diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
index b12fe8d..929047c 100644
--- a/arch/x86/kernel/pvclock.c
+++ b/arch/x86/kernel/pvclock.c
@@ -74,7 +74,8 @@ static inline u64 scale_delta(u64 delta, u32 mul_frac, int shift)
static u64 pvclock_get_nsec_offset(struct pvclock_shadow_time *shadow)
{
u64 delta = native_read_tsc() - shadow->tsc_timestamp;
- return scale_delta(delta, shadow->tsc_to_nsec_mul, shadow->tsc_shift);
+ return pvclock_scale_delta(delta, shadow->tsc_to_nsec_mul,
+ shadow->tsc_shift);
}
/*
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 169/196] fix oops in scsi_run_queue()
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (121 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 168/196] x86: pvclock: Move scale_delta into common header Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 170/196] dccp: handle invalid feature options length Paul Gortmaker
` (26 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel; +Cc: stable-review, James Bottomley, Paul Gortmaker
From: James Bottomley <James.Bottomley@suse.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit c055f5b2614b4f758ae6cc86733f31fa4c2c5844 upstream.
The recent commit closing the race window in device teardown:
commit 86cbfb5607d4b81b1a993ff689bbd2addd5d3a9b
Author: James Bottomley <James.Bottomley@suse.de>
Date: Fri Apr 22 10:39:59 2011 -0500
[SCSI] put stricter guards on queue dead checks
is causing a potential NULL deref in scsi_run_queue() because the
q->queuedata may already be NULL by the time this function is called.
Since we shouldn't be running a queue that is being torn down, simply
add a NULL check in scsi_run_queue() to forestall this.
Tested-by: Jim Schutt <jaschut@sandia.gov>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/scsi_lib.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index c2a9e12..725f3cd 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -400,10 +400,15 @@ static inline int scsi_host_is_busy(struct Scsi_Host *shost)
static void scsi_run_queue(struct request_queue *q)
{
struct scsi_device *sdev = q->queuedata;
- struct Scsi_Host *shost = sdev->host;
+ struct Scsi_Host *shost;
LIST_HEAD(starved_list);
unsigned long flags;
+ /* if the device is dead, sdev will be NULL, so no queue to run */
+ if (!sdev)
+ return;
+
+ shost = sdev->host;
if (scsi_target(sdev)->single_lun)
scsi_single_lun_run(sdev);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 170/196] dccp: handle invalid feature options length
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (122 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 169/196] fix oops in scsi_run_queue() Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 171/196] cifs: check for bytes_remaining going to zero in CIFS_SessSetup Paul Gortmaker
` (25 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dan Rosenberg, David S. Miller, Paul Gortmaker
From: Dan Rosenberg <drosenberg@vsecurity.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit a294865978b701e4d0d90135672749531b9a900d upstream.
A length of zero (after subtracting two for the type and len fields) for
the DCCPO_{CHANGE,CONFIRM}_{L,R} options will cause an underflow due to
the subtraction. The subsequent code may read past the end of the
options value buffer when parsing. I'm unsure of what the consequences
of this might be, but it's probably not good.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Acked-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/dccp/options.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/dccp/options.c b/net/dccp/options.c
index 1b08cae..b4a853e 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -131,6 +131,8 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
case DCCPO_CHANGE_L ... DCCPO_CONFIRM_R:
if (pkt_type == DCCP_PKT_DATA) /* RFC 4340, 6 */
break;
+ if (len == 0)
+ goto out_invalid_option;
rc = dccp_feat_parse_options(sk, dreq, mandatory, opt,
*value, value + 1, len - 1);
if (rc)
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 171/196] cifs: check for bytes_remaining going to zero in CIFS_SessSetup
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (123 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 170/196] dccp: handle invalid feature options length Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 172/196] Validate size of EFI GUID partition entries Paul Gortmaker
` (24 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jeff Layton, Steve French, Paul Gortmaker
From: Jeff Layton <jlayton@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit fcda7f4578bbf9717444ca6da8a421d21489d078 upstream.
It's possible that when we go to decode the string area in the
SESSION_SETUP response, that bytes_remaining will be 0. Decrementing it at
that point will mean that it can go "negative" and wrap. Check for a
bytes_remaining value of 0, and don't try to decode the string area if
that's the case.
Reported-and-Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/cifs/sess.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index c7d78c0..ff4f5b1 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -906,7 +906,9 @@ ssetup_ntlmssp_authenticate:
}
/* BB check if Unicode and decode strings */
- if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
+ if (bytes_remaining == 0) {
+ /* no string area to decode, do nothing */
+ } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
/* unicode string area must be word-aligned */
if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
++bcc_ptr;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 172/196] Validate size of EFI GUID partition entries.
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (124 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 171/196] cifs: check for bytes_remaining going to zero in CIFS_SessSetup Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 173/196] CIFS: Fix memory over bound bug in cifs_parse_mount_options Paul Gortmaker
` (23 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Timo Warns, Timo Warns, Linus Torvalds, Paul Gortmaker
From: Timo Warns <Warns@pre-sense.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit fa039d5f6b126fbd65eefa05db2f67e44df8f121 upstream.
Otherwise corrupted EFI partition tables can cause total confusion.
Signed-off-by: Timo Warns <warns@pre-sense.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/partitions/efi.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/partitions/efi.c b/fs/partitions/efi.c
index 91babda..ee59684 100644
--- a/fs/partitions/efi.c
+++ b/fs/partitions/efi.c
@@ -350,6 +350,12 @@ is_gpt_valid(struct block_device *bdev, u64 lba,
goto fail;
}
+ /* Check that sizeof_partition_entry has the correct value */
+ if (le32_to_cpu((*gpt)->sizeof_partition_entry) != sizeof(gpt_entry)) {
+ pr_debug("GUID Partitition Entry Size check failed.\n");
+ goto fail;
+ }
+
if (!(*ptes = alloc_read_gpt_entries(bdev, *gpt)))
goto fail;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 173/196] CIFS: Fix memory over bound bug in cifs_parse_mount_options
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (125 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 172/196] Validate size of EFI GUID partition entries Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 174/196] ehea: fix wrongly reported speed and port Paul Gortmaker
` (22 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Pavel Shilovsky, Steve French, Paul Gortmaker
From: Pavel Shilovsky <piastry@etersoft.ru>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 4906e50b37e6f6c264e7ee4237343eb2b7f8d16d upstream.
While password processing we can get out of options array bound if
the next character after array is delimiter. The patch adds a check
if we reach the end.
Signed-off-by: Pavel Shilovsky <piastry@etersoft.ru>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/cifs/connect.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index f6afb59..cebbc29 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -800,8 +800,7 @@ static int
cifs_parse_mount_options(char *options, const char *devname,
struct smb_vol *vol)
{
- char *value;
- char *data;
+ char *value, *data, *end;
unsigned int temp_len, i, j;
char separator[2];
short int override_uid = -1;
@@ -844,6 +843,7 @@ cifs_parse_mount_options(char *options, const char *devname,
if (!options)
return 1;
+ end = options + strlen(options);
if (strncmp(options, "sep=", 4) == 0) {
if (options[4] != 0) {
separator[0] = options[4];
@@ -908,6 +908,7 @@ cifs_parse_mount_options(char *options, const char *devname,
the only illegal character in a password is null */
if ((value[temp_len] == 0) &&
+ (value + temp_len < end) &&
(value[temp_len+1] == separator[0])) {
/* reinsert comma */
value[temp_len] = separator[0];
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 174/196] ehea: fix wrongly reported speed and port
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (126 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 173/196] CIFS: Fix memory over bound bug in cifs_parse_mount_options Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 175/196] NET: slip, fix ldisc->open retval Paul Gortmaker
` (21 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Kleber Sacilotto de Souza, David S. Miller,
Paul Gortmaker
From: Kleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit dcbe14b91a920657ff3a9ba0efb7c5b5562f956a upstream.
Currently EHEA reports to ethtool as supporting 10M, 100M, 1G and
10G and connected to FIBRE independent of the hardware configuration.
However, when connected to FIBRE the only supported speed is 10G
full-duplex, and the other speeds and modes are only supported
when connected to twisted pair.
Signed-off-by: Kleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
Acked-by: Breno Leitao <leitao@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/ehea/ehea_ethtool.c | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)
diff --git a/drivers/net/ehea/ehea_ethtool.c b/drivers/net/ehea/ehea_ethtool.c
index 75b099c..f97da2a 100644
--- a/drivers/net/ehea/ehea_ethtool.c
+++ b/drivers/net/ehea/ehea_ethtool.c
@@ -53,15 +53,20 @@ static int ehea_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
cmd->duplex = -1;
}
- cmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_1000baseT_Full
- | SUPPORTED_100baseT_Full | SUPPORTED_100baseT_Half
- | SUPPORTED_10baseT_Full | SUPPORTED_10baseT_Half
- | SUPPORTED_Autoneg | SUPPORTED_FIBRE);
-
- cmd->advertising = (ADVERTISED_10000baseT_Full | ADVERTISED_Autoneg
- | ADVERTISED_FIBRE);
+ if (cmd->speed == SPEED_10000) {
+ cmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE);
+ cmd->advertising = (ADVERTISED_10000baseT_Full | ADVERTISED_FIBRE);
+ cmd->port = PORT_FIBRE;
+ } else {
+ cmd->supported = (SUPPORTED_1000baseT_Full | SUPPORTED_100baseT_Full
+ | SUPPORTED_100baseT_Half | SUPPORTED_10baseT_Full
+ | SUPPORTED_10baseT_Half | SUPPORTED_Autoneg
+ | SUPPORTED_TP);
+ cmd->advertising = (ADVERTISED_1000baseT_Full | ADVERTISED_Autoneg
+ | ADVERTISED_TP);
+ cmd->port = PORT_TP;
+ }
- cmd->port = PORT_FIBRE;
cmd->autoneg = port->autoneg == 1 ? AUTONEG_ENABLE : AUTONEG_DISABLE;
return 0;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 175/196] NET: slip, fix ldisc->open retval
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (127 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 174/196] ehea: fix wrongly reported speed and port Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 176/196] ne-h8300: Fix regression caused during net_device_ops conversion Paul Gortmaker
` (20 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Matvejchikov Ilya, David S. Miller, Paul Gortmaker
From: Matvejchikov Ilya <matvejchikov@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 057bef938896e6266ae24ec4266d24792d27c29a upstream.
TTY layer expects 0 if the ldisc->open operation succeeded.
Signed-off-by : Matvejchikov Ilya <matvejchikov@gmail.com>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/slip.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index 8969615..2605f3d 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -852,7 +852,9 @@ static int slip_open(struct tty_struct *tty)
/* Done. We have linked the TTY line to a channel. */
rtnl_unlock();
tty->receive_room = 65536; /* We don't flow control */
- return sl->dev->base_addr;
+
+ /* TTY layer expects 0 on success */
+ return 0;
err_free_bufs:
sl_free_bufs(sl);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 176/196] ne-h8300: Fix regression caused during net_device_ops conversion
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (128 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 175/196] NET: slip, fix ldisc->open retval Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 177/196] hydra: " Paul Gortmaker
` (19 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Geert Uytterhoeven, David S. Miller, Paul Gortmaker
From: Geert Uytterhoeven <geert@linux-m68k.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 2592a7354092afd304a8c067319b15ab1e441e35 upstream.
Changeset dcd39c90290297f6e6ed8a04bb20da7ac2b043c5 ("ne-h8300: convert to
net_device_ops") broke ne-h8300 by adding 8390.o to the link. That
meant that lib8390.c was included twice, once in ne-h8300.c and once in
8390.c, subject to different macros. This patch reverts that by
avoiding the wrappers in 8390.c.
Fix based on commits 217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
fix regression caused during net_device_ops conversion") and
4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
NET_POLL_CONTROLLER").
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/Makefile | 2 +-
drivers/net/ne-h8300.c | 16 ++++++++--------
2 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 12b280a..9ae1951 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -141,7 +141,7 @@ obj-$(CONFIG_NE3210) += ne3210.o 8390.o
obj-$(CONFIG_SB1250_MAC) += sb1250-mac.o
obj-$(CONFIG_B44) += b44.o
obj-$(CONFIG_FORCEDETH) += forcedeth.o
-obj-$(CONFIG_NE_H8300) += ne-h8300.o 8390.o
+obj-$(CONFIG_NE_H8300) += ne-h8300.o
obj-$(CONFIG_AX88796) += ax88796.o
obj-$(CONFIG_BCM63XX_ENET) += bcm63xx_enet.o
diff --git a/drivers/net/ne-h8300.c b/drivers/net/ne-h8300.c
index 7bd6662..31da04f 100644
--- a/drivers/net/ne-h8300.c
+++ b/drivers/net/ne-h8300.c
@@ -167,7 +167,7 @@ static void cleanup_card(struct net_device *dev)
#ifndef MODULE
struct net_device * __init ne_probe(int unit)
{
- struct net_device *dev = alloc_ei_netdev();
+ struct net_device *dev = ____alloc_ei_netdev(0);
int err;
if (!dev)
@@ -197,15 +197,15 @@ static const struct net_device_ops ne_netdev_ops = {
.ndo_open = ne_open,
.ndo_stop = ne_close,
- .ndo_start_xmit = ei_start_xmit,
- .ndo_tx_timeout = ei_tx_timeout,
- .ndo_get_stats = ei_get_stats,
- .ndo_set_multicast_list = ei_set_multicast_list,
+ .ndo_start_xmit = __ei_start_xmit,
+ .ndo_tx_timeout = __ei_tx_timeout,
+ .ndo_get_stats = __ei_get_stats,
+ .ndo_set_multicast_list = __ei_set_multicast_list,
.ndo_validate_addr = eth_validate_addr,
- .ndo_set_mac_address = eth_mac_addr,
+ .ndo_set_mac_address = eth_mac_addr,
.ndo_change_mtu = eth_change_mtu,
#ifdef CONFIG_NET_POLL_CONTROLLER
- .ndo_poll_controller = ei_poll,
+ .ndo_poll_controller = __ei_poll,
#endif
};
@@ -638,7 +638,7 @@ int init_module(void)
int err;
for (this_dev = 0; this_dev < MAX_NE_CARDS; this_dev++) {
- struct net_device *dev = alloc_ei_netdev();
+ struct net_device *dev = ____alloc_ei_netdev(0);
if (!dev)
break;
if (io[this_dev]) {
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 177/196] hydra: Fix regression caused during net_device_ops conversion
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (129 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 176/196] ne-h8300: Fix regression caused during net_device_ops conversion Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 178/196] libertas: fix cmdpendingq locking Paul Gortmaker
` (18 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Geert Uytterhoeven, David S. Miller, Paul Gortmaker
From: Geert Uytterhoeven <geert@linux-m68k.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 0b25e0157dfa236a0629c16c8ad6f222f633f682 upstream.
Changeset 5618f0d1193d6b051da9b59b0e32ad24397f06a4 ("hydra: convert to
net_device_ops") broke hydra by adding 8390.o to the link. That
meant that lib8390.c was included twice, once in hydra.c and once in
8390.c, subject to different macros. This patch reverts that by
avoiding the wrappers in 8390.c.
Fix based on commits 217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
fix regression caused during net_device_ops conversion") and
4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
NET_POLL_CONTROLLER").
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/Makefile | 2 +-
drivers/net/hydra.c | 14 +++++++-------
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 9ae1951..1c60c32 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -225,7 +225,7 @@ obj-$(CONFIG_SGI_IOC3_ETH) += ioc3-eth.o
obj-$(CONFIG_DECLANCE) += declance.o
obj-$(CONFIG_ATARILANCE) += atarilance.o
obj-$(CONFIG_A2065) += a2065.o
-obj-$(CONFIG_HYDRA) += hydra.o 8390.o
+obj-$(CONFIG_HYDRA) += hydra.o
obj-$(CONFIG_ARIADNE) += ariadne.o
obj-$(CONFIG_CS89x0) += cs89x0.o
obj-$(CONFIG_MACSONIC) += macsonic.o
diff --git a/drivers/net/hydra.c b/drivers/net/hydra.c
index 24724b4..4b6cb8a 100644
--- a/drivers/net/hydra.c
+++ b/drivers/net/hydra.c
@@ -97,15 +97,15 @@ static const struct net_device_ops hydra_netdev_ops = {
.ndo_open = hydra_open,
.ndo_stop = hydra_close,
- .ndo_start_xmit = ei_start_xmit,
- .ndo_tx_timeout = ei_tx_timeout,
- .ndo_get_stats = ei_get_stats,
- .ndo_set_multicast_list = ei_set_multicast_list,
+ .ndo_start_xmit = __ei_start_xmit,
+ .ndo_tx_timeout = __ei_tx_timeout,
+ .ndo_get_stats = __ei_get_stats,
+ .ndo_set_multicast_list = __ei_set_multicast_list,
.ndo_validate_addr = eth_validate_addr,
- .ndo_set_mac_address = eth_mac_addr,
+ .ndo_set_mac_address = eth_mac_addr,
.ndo_change_mtu = eth_change_mtu,
#ifdef CONFIG_NET_POLL_CONTROLLER
- .ndo_poll_controller = ei_poll,
+ .ndo_poll_controller = __ei_poll,
#endif
};
@@ -124,7 +124,7 @@ static int __devinit hydra_init(struct zorro_dev *z)
0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,
};
- dev = alloc_ei_netdev();
+ dev = ____alloc_ei_netdev(0);
if (!dev)
return -ENOMEM;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 178/196] libertas: fix cmdpendingq locking
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (130 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 177/196] hydra: " Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 179/196] zorro8390: Fix regression caused during net_device_ops conversion Paul Gortmaker
` (17 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Paul Fox, Daniel Drake, John W. Linville, Paul Gortmaker
From: Paul Fox <pgf@laptop.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 2ae1b8b35faba31a59b153cbad07f9c15de99740 upstream.
We occasionally see list corruption using libertas.
While we haven't been able to diagnose this precisely, we have spotted
a possible cause: cmdpendingq is generally modified with driver_lock
held. However, there are a couple of points where this is not the case.
Fix up those operations to execute under the lock, it seems like
the correct thing to do and will hopefully improve the situation.
Signed-off-by: Paul Fox <pgf@laptop.org>
Signed-off-by: Daniel Drake <dsd@laptop.org>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/wireless/libertas/cmd.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index cdb9b96..91bafae 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -1267,8 +1267,8 @@ int lbs_execute_next_command(struct lbs_private *priv)
cpu_to_le16(CMD_SUBCMD_EXIT_PS)) {
lbs_deb_host(
"EXEC_NEXT_CMD: ignore ENTER_PS cmd\n");
- list_del(&cmdnode->list);
spin_lock_irqsave(&priv->driver_lock, flags);
+ list_del(&cmdnode->list);
lbs_complete_command(priv, cmdnode, 0);
spin_unlock_irqrestore(&priv->driver_lock, flags);
@@ -1280,8 +1280,8 @@ int lbs_execute_next_command(struct lbs_private *priv)
(priv->psstate == PS_STATE_PRE_SLEEP)) {
lbs_deb_host(
"EXEC_NEXT_CMD: ignore EXIT_PS cmd in sleep\n");
- list_del(&cmdnode->list);
spin_lock_irqsave(&priv->driver_lock, flags);
+ list_del(&cmdnode->list);
lbs_complete_command(priv, cmdnode, 0);
spin_unlock_irqrestore(&priv->driver_lock, flags);
priv->needtowakeup = 1;
@@ -1294,7 +1294,9 @@ int lbs_execute_next_command(struct lbs_private *priv)
"EXEC_NEXT_CMD: sending EXIT_PS\n");
}
}
+ spin_lock_irqsave(&priv->driver_lock, flags);
list_del(&cmdnode->list);
+ spin_unlock_irqrestore(&priv->driver_lock, flags);
lbs_deb_host("EXEC_NEXT_CMD: sending command 0x%04x\n",
le16_to_cpu(cmd->command));
lbs_submit_command(priv, cmdnode);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 179/196] zorro8390: Fix regression caused during net_device_ops conversion
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (131 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 178/196] libertas: fix cmdpendingq locking Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 180/196] cifs: add fallback in is_path_accessible for old servers Paul Gortmaker
` (16 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Geert Uytterhoeven, David S. Miller, Paul Gortmaker
From: Geert Uytterhoeven <geert@linux-m68k.org>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit cf7e032fc87d59c475df26c4d40bf45d401b2adb upstream.
Changeset b6114794a1c394534659f4a17420e48cf23aa922 ("zorro8390: convert to
net_device_ops") broke zorro8390 by adding 8390.o to the link. That
meant that lib8390.c was included twice, once in zorro8390.c and once in
8390.c, subject to different macros. This patch reverts that by
avoiding the wrappers in 8390.c.
Fix based on commits 217cbfa856dc1cbc2890781626c4032d9e3ec59f ("mac8390:
fix regression caused during net_device_ops conversion") and
4e0168fa4842e27795a75b205a510f25b62181d9 ("mac8390: fix build with
NET_POLL_CONTROLLER").
Reported-by: Christian T. Steigies <cts@debian.org>
Suggested-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Christian T. Steigies <cts@debian.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/Makefile | 2 +-
drivers/net/zorro8390.c | 12 ++++++------
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 1c60c32..263324b 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -213,7 +213,7 @@ obj-$(CONFIG_SC92031) += sc92031.o
obj-$(CONFIG_LP486E) += lp486e.o
obj-$(CONFIG_ETH16I) += eth16i.o
-obj-$(CONFIG_ZORRO8390) += zorro8390.o 8390.o
+obj-$(CONFIG_ZORRO8390) += zorro8390.o
obj-$(CONFIG_HPLANCE) += hplance.o 7990.o
obj-$(CONFIG_MVME147_NET) += mvme147.o 7990.o
obj-$(CONFIG_EQUALIZER) += eql.o
diff --git a/drivers/net/zorro8390.c b/drivers/net/zorro8390.c
index 81c753a..25e720c 100644
--- a/drivers/net/zorro8390.c
+++ b/drivers/net/zorro8390.c
@@ -125,7 +125,7 @@ static int __devinit zorro8390_init_one(struct zorro_dev *z,
board = z->resource.start;
ioaddr = board+cards[i].offset;
- dev = alloc_ei_netdev();
+ dev = ____alloc_ei_netdev(0);
if (!dev)
return -ENOMEM;
if (!request_mem_region(ioaddr, NE_IO_EXTENT*2, DRV_NAME)) {
@@ -145,15 +145,15 @@ static int __devinit zorro8390_init_one(struct zorro_dev *z,
static const struct net_device_ops zorro8390_netdev_ops = {
.ndo_open = zorro8390_open,
.ndo_stop = zorro8390_close,
- .ndo_start_xmit = ei_start_xmit,
- .ndo_tx_timeout = ei_tx_timeout,
- .ndo_get_stats = ei_get_stats,
- .ndo_set_multicast_list = ei_set_multicast_list,
+ .ndo_start_xmit = __ei_start_xmit,
+ .ndo_tx_timeout = __ei_tx_timeout,
+ .ndo_get_stats = __ei_get_stats,
+ .ndo_set_multicast_list = __ei_set_multicast_list,
.ndo_validate_addr = eth_validate_addr,
.ndo_set_mac_address = eth_mac_addr,
.ndo_change_mtu = eth_change_mtu,
#ifdef CONFIG_NET_POLL_CONTROLLER
- .ndo_poll_controller = ei_poll,
+ .ndo_poll_controller = __ei_poll,
#endif
};
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 180/196] cifs: add fallback in is_path_accessible for old servers
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (132 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 179/196] zorro8390: Fix regression caused during net_device_ops conversion Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 181/196] x86, AMD: Fix ARAT feature setting again Paul Gortmaker
` (15 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Jeff Layton, Steve French, Paul Gortmaker
From: Jeff Layton <jlayton@redhat.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 221d1d797202984cb874e3ed9f1388593d34ee22 upstream.
The is_path_accessible check uses a QPathInfo call, which isn't
supported by ancient win9x era servers. Fall back to an older
SMBQueryInfo call if it fails with the magic error codes.
Reported-and-Tested-by: Sandro Bonazzola <sandro.bonazzola@gmail.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/cifs/connect.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index cebbc29..1f6aae0 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2254,6 +2254,11 @@ is_path_accessible(int xid, struct cifsTconInfo *tcon,
0 /* not legacy */, cifs_sb->local_nls,
cifs_sb->mnt_cifs_flags &
CIFS_MOUNT_MAP_SPECIAL_CHR);
+
+ if (rc == -EOPNOTSUPP || rc == -EINVAL)
+ rc = SMBQueryInformation(xid, tcon, full_path, pfile_info,
+ cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
+ CIFS_MOUNT_MAP_SPECIAL_CHR);
kfree(pfile_info);
return rc;
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 181/196] x86, AMD: Fix ARAT feature setting again
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (133 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 180/196] cifs: add fallback in is_path_accessible for old servers Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 13:55 ` Boris Ostrovsky
2012-03-13 0:21 ` [34-longterm 182/196] clocksource: Install completely before selecting Paul Gortmaker
` (14 subsequent siblings)
149 siblings, 1 reply; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Borislav Petkov, Boris Ostrovsky,
Andreas Herrmann, Greg Kroah-Hartman, Hans Rosenfeld,
Nick Bowler, Joerg-Volker-Peetz, Ingo Molnar, Paul Gortmaker
From: Borislav Petkov <borislav.petkov@amd.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 14fb57dccb6e1defe9f89a66f548fcb24c374c1d upstream.
Trying to enable the local APIC timer on early K8 revisions
uncovers a number of other issues with it, in conjunction with
the C1E enter path on AMD. Fixing those causes much more churn
and troubles than the benefit of using that timer brings so
don't enable it on K8 at all, falling back to the original
functionality the kernel had wrt to that.
Reported-and-bisected-by: Nick Bowler <nbowler@elliptictech.com>
Cc: Boris Ostrovsky <Boris.Ostrovsky@amd.com>
Cc: Andreas Herrmann <andreas.herrmann3@amd.com>
Cc: Greg Kroah-Hartman <greg@kroah.com>
Cc: Hans Rosenfeld <hans.rosenfeld@amd.com>
Cc: Nick Bowler <nbowler@elliptictech.com>
Cc: Joerg-Volker-Peetz <jvpeetz@web.de>
Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
Link: http://lkml.kernel.org/r/1305636919-31165-3-git-send-email-bp@amd64.org
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/kernel/cpu/amd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index d618dc1..76a7f76 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -567,7 +567,7 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
#endif
/* As a rule processors have APIC timer running in deep C states */
- if (c->x86 >= 0xf && !cpu_has_amd_erratum(amd_erratum_400))
+ if (c->x86 > 0xf && !cpu_has_amd_erratum(amd_erratum_400))
set_cpu_cap(c, X86_FEATURE_ARAT);
/*
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* Re: [34-longterm 181/196] x86, AMD: Fix ARAT feature setting again
2012-03-13 0:21 ` [34-longterm 181/196] x86, AMD: Fix ARAT feature setting again Paul Gortmaker
@ 2012-03-13 13:55 ` Boris Ostrovsky
2012-03-13 18:42 ` Paul Gortmaker
2012-03-14 14:06 ` Paul Gortmaker
0 siblings, 2 replies; 209+ messages in thread
From: Boris Ostrovsky @ 2012-03-13 13:55 UTC (permalink / raw)
To: Paul Gortmaker
Cc: stable, linux-kernel, stable-review, Borislav Petkov,
Andreas Herrmann, Greg Kroah-Hartman, Hans Rosenfeld,
Nick Bowler, Joerg-Volker-Peetz, Ingo Molnar
On 03/12/12 20:21, Paul Gortmaker wrote:
> From: Borislav Petkov<borislav.petkov@amd.com>
>
> -------------------
> This is a commit scheduled for the next v2.6.34 longterm release.
> If you see a problem with using this for longterm, please comment.
Paul, please use e9cdd343a5e42c43bcda01e609fa23089e026470 instead of the
one below.
-boris
> -------------------
>
> commit 14fb57dccb6e1defe9f89a66f548fcb24c374c1d upstream.
>
> Trying to enable the local APIC timer on early K8 revisions
> uncovers a number of other issues with it, in conjunction with
> the C1E enter path on AMD. Fixing those causes much more churn
> and troubles than the benefit of using that timer brings so
> don't enable it on K8 at all, falling back to the original
> functionality the kernel had wrt to that.
>
> Reported-and-bisected-by: Nick Bowler<nbowler@elliptictech.com>
> Cc: Boris Ostrovsky<Boris.Ostrovsky@amd.com>
> Cc: Andreas Herrmann<andreas.herrmann3@amd.com>
> Cc: Greg Kroah-Hartman<greg@kroah.com>
> Cc: Hans Rosenfeld<hans.rosenfeld@amd.com>
> Cc: Nick Bowler<nbowler@elliptictech.com>
> Cc: Joerg-Volker-Peetz<jvpeetz@web.de>
> Signed-off-by: Borislav Petkov<borislav.petkov@amd.com>
> Link: http://lkml.kernel.org/r/1305636919-31165-3-git-send-email-bp@amd64.org
> Signed-off-by: Ingo Molnar<mingo@elte.hu>
> Signed-off-by: Paul Gortmaker<paul.gortmaker@windriver.com>
> ---
> arch/x86/kernel/cpu/amd.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
> index d618dc1..76a7f76 100644
> --- a/arch/x86/kernel/cpu/amd.c
> +++ b/arch/x86/kernel/cpu/amd.c
> @@ -567,7 +567,7 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
> #endif
>
> /* As a rule processors have APIC timer running in deep C states */
> - if (c->x86>= 0xf&& !cpu_has_amd_erratum(amd_erratum_400))
> + if (c->x86> 0xf&& !cpu_has_amd_erratum(amd_erratum_400))
> set_cpu_cap(c, X86_FEATURE_ARAT);
>
> /*
^ permalink raw reply [flat|nested] 209+ messages in thread
* Re: [34-longterm 181/196] x86, AMD: Fix ARAT feature setting again
2012-03-13 13:55 ` Boris Ostrovsky
@ 2012-03-13 18:42 ` Paul Gortmaker
2012-03-14 14:06 ` Paul Gortmaker
1 sibling, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 18:42 UTC (permalink / raw)
To: Boris Ostrovsky
Cc: stable, linux-kernel, Borislav Petkov, Andreas Herrmann,
Greg Kroah-Hartman, Hans Rosenfeld, Nick Bowler,
Joerg-Volker-Peetz, Ingo Molnar
On 12-03-13 09:55 AM, Boris Ostrovsky wrote:
> On 03/12/12 20:21, Paul Gortmaker wrote:
>> From: Borislav Petkov<borislav.petkov@amd.com>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> If you see a problem with using this for longterm, please comment.
>
>
> Paul, please use e9cdd343a5e42c43bcda01e609fa23089e026470 instead of the
> one below.
Thanks, I'll make the exchange.
P.
>
> -boris
>
>> -------------------
>>
>> commit 14fb57dccb6e1defe9f89a66f548fcb24c374c1d upstream.
>>
>> Trying to enable the local APIC timer on early K8 revisions
>> uncovers a number of other issues with it, in conjunction with
>> the C1E enter path on AMD. Fixing those causes much more churn
>> and troubles than the benefit of using that timer brings so
>> don't enable it on K8 at all, falling back to the original
>> functionality the kernel had wrt to that.
>>
>> Reported-and-bisected-by: Nick Bowler<nbowler@elliptictech.com>
>> Cc: Boris Ostrovsky<Boris.Ostrovsky@amd.com>
>> Cc: Andreas Herrmann<andreas.herrmann3@amd.com>
>> Cc: Greg Kroah-Hartman<greg@kroah.com>
>> Cc: Hans Rosenfeld<hans.rosenfeld@amd.com>
>> Cc: Nick Bowler<nbowler@elliptictech.com>
>> Cc: Joerg-Volker-Peetz<jvpeetz@web.de>
>> Signed-off-by: Borislav Petkov<borislav.petkov@amd.com>
>> Link: http://lkml.kernel.org/r/1305636919-31165-3-git-send-email-bp@amd64.org
>> Signed-off-by: Ingo Molnar<mingo@elte.hu>
>> Signed-off-by: Paul Gortmaker<paul.gortmaker@windriver.com>
>> ---
>> arch/x86/kernel/cpu/amd.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
>> index d618dc1..76a7f76 100644
>> --- a/arch/x86/kernel/cpu/amd.c
>> +++ b/arch/x86/kernel/cpu/amd.c
>> @@ -567,7 +567,7 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
>> #endif
>>
>> /* As a rule processors have APIC timer running in deep C states */
>> - if (c->x86>= 0xf&& !cpu_has_amd_erratum(amd_erratum_400))
>> + if (c->x86> 0xf&& !cpu_has_amd_erratum(amd_erratum_400))
>> set_cpu_cap(c, X86_FEATURE_ARAT);
>>
>> /*
>
>
^ permalink raw reply [flat|nested] 209+ messages in thread
* Re: [34-longterm 181/196] x86, AMD: Fix ARAT feature setting again
2012-03-13 13:55 ` Boris Ostrovsky
2012-03-13 18:42 ` Paul Gortmaker
@ 2012-03-14 14:06 ` Paul Gortmaker
1 sibling, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-14 14:06 UTC (permalink / raw)
To: Boris Ostrovsky
Cc: stable, linux-kernel, Borislav Petkov, Andreas Herrmann,
Greg Kroah-Hartman, Hans Rosenfeld, Nick Bowler,
Joerg-Volker-Peetz, Ingo Molnar
On 12-03-13 09:55 AM, Boris Ostrovsky wrote:
> On 03/12/12 20:21, Paul Gortmaker wrote:
>> From: Borislav Petkov<borislav.petkov@amd.com>
>>
>> -------------------
>> This is a commit scheduled for the next v2.6.34 longterm release.
>> If you see a problem with using this for longterm, please comment.
>
>
> Paul, please use e9cdd343a5e42c43bcda01e609fa23089e026470 instead of the
> one below.
It turns out that the e9cdd wants to apply on top of (vs instead of) the
14fb57dccb commit.
So I will queue it directly after the 14fb57dcc commit.
Thanks,
Paul.
>
> -boris
>
>> -------------------
>>
>> commit 14fb57dccb6e1defe9f89a66f548fcb24c374c1d upstream.
>>
>> Trying to enable the local APIC timer on early K8 revisions
>> uncovers a number of other issues with it, in conjunction with
>> the C1E enter path on AMD. Fixing those causes much more churn
>> and troubles than the benefit of using that timer brings so
>> don't enable it on K8 at all, falling back to the original
>> functionality the kernel had wrt to that.
>>
>> Reported-and-bisected-by: Nick Bowler<nbowler@elliptictech.com>
>> Cc: Boris Ostrovsky<Boris.Ostrovsky@amd.com>
>> Cc: Andreas Herrmann<andreas.herrmann3@amd.com>
>> Cc: Greg Kroah-Hartman<greg@kroah.com>
>> Cc: Hans Rosenfeld<hans.rosenfeld@amd.com>
>> Cc: Nick Bowler<nbowler@elliptictech.com>
>> Cc: Joerg-Volker-Peetz<jvpeetz@web.de>
>> Signed-off-by: Borislav Petkov<borislav.petkov@amd.com>
>> Link: http://lkml.kernel.org/r/1305636919-31165-3-git-send-email-bp@amd64.org
>> Signed-off-by: Ingo Molnar<mingo@elte.hu>
>> Signed-off-by: Paul Gortmaker<paul.gortmaker@windriver.com>
>> ---
>> arch/x86/kernel/cpu/amd.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
>> index d618dc1..76a7f76 100644
>> --- a/arch/x86/kernel/cpu/amd.c
>> +++ b/arch/x86/kernel/cpu/amd.c
>> @@ -567,7 +567,7 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
>> #endif
>>
>> /* As a rule processors have APIC timer running in deep C states */
>> - if (c->x86>= 0xf&& !cpu_has_amd_erratum(amd_erratum_400))
>> + if (c->x86> 0xf&& !cpu_has_amd_erratum(amd_erratum_400))
>> set_cpu_cap(c, X86_FEATURE_ARAT);
>>
>> /*
>
>
^ permalink raw reply [flat|nested] 209+ messages in thread
* [34-longterm 182/196] clocksource: Install completely before selecting
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (134 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 181/196] x86, AMD: Fix ARAT feature setting again Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 183/196] tick: Clear broadcast active bit when switching to oneshot Paul Gortmaker
` (13 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, john stultz, Thomas Gleixner, Paul Gortmaker
From: john stultz <johnstul@us.ibm.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit e05b2efb82596905ebfe88e8612ee81dec9b6592 upstream.
Christian Hoffmann reported that the command line clocksource override
with acpi_pm timer fails:
Kernel command line: <SNIP> clocksource=acpi_pm
hpet clockevent registered
Switching to clocksource hpet
Override clocksource acpi_pm is not HRT compatible.
Cannot switch while in HRT/NOHZ mode.
The watchdog code is what enables CLOCK_SOURCE_VALID_FOR_HRES, but we
actually end up selecting the clocksource before we enqueue it into
the watchdog list, so that's why we see the warning and fail to switch
to acpi_pm timer as requested. That's particularly bad when we want to
debug timekeeping related problems in early boot.
Put the selection call last.
[PG: 34 doesn't have __clocksource_register_scale, so drop that 1/2]
Reported-by: Christian Hoffmann <email@christianhoffmann.info>
Signed-off-by: John Stultz <johnstul@us.ibm.com>
Link: http://lkml.kernel.org/r/%3C1304558210.2943.24.camel%40work-vm%3E
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/time/clocksource.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 1f5dde6..db24c5c 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -638,8 +638,8 @@ int clocksource_register(struct clocksource *cs)
mutex_lock(&clocksource_mutex);
clocksource_enqueue(cs);
- clocksource_select();
clocksource_enqueue_watchdog(cs);
+ clocksource_select();
mutex_unlock(&clocksource_mutex);
return 0;
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 183/196] tick: Clear broadcast active bit when switching to oneshot
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (135 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 182/196] clocksource: Install completely before selecting Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 184/196] x86, apic: Fix spurious error interrupts triggering on all non-boot APs Paul Gortmaker
` (12 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Thomas Gleixner, John Stultz, Paul Gortmaker
From: Thomas Gleixner <tglx@linutronix.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 07f4beb0b5bbfaf36a64aa00d59e670ec578a95a upstream.
The first cpu which switches from periodic to oneshot mode switches
also the broadcast device into oneshot mode. The broadcast device
serves as a backup for per cpu timers which stop in deeper
C-states. To avoid starvation of the cpus which might be in idle and
depend on broadcast mode it marks the other cpus as broadcast active
and sets the brodcast expiry value of those cpus to the next tick.
The oneshot mode broadcast bit for the other cpus is sticky and gets
only cleared when those cpus exit idle. If a cpu was not idle while
the bit got set in consequence the bit prevents that the broadcast
device is armed on behalf of that cpu when it enters idle for the
first time after it switched to oneshot mode.
In most cases that goes unnoticed as one of the other cpus has usually
a timer pending which keeps the broadcast device armed with a short
timeout. Now if the only cpu which has a short timer active has the
bit set then the broadcast device will not be armed on behalf of that
cpu and will fire way after the expected timer expiry. In the case of
Christians bug report it took ~145 seconds which is about half of the
wrap around time of HPET (the limit for that device) due to the fact
that all other cpus had no timers armed which expired before the 145
seconds timeframe.
The solution is simply to clear the broadcast active bit
unconditionally when a cpu switches to oneshot mode after the first
cpu switched the broadcast device over. It's not idle at that point
otherwise it would not be executing that code.
[ I fundamentally hate that broadcast crap. Why the heck thought some
folks that when going into deep idle it's a brilliant concept to
switch off the last device which brings the cpu back from that
state? ]
Thanks to Christian for providing all the valuable debug information!
Reported-and-tested-by: Christian Hoffmann <email@christianhoffmann.info>
Cc: John Stultz <johnstul@us.ibm.com>
Link: http://lkml.kernel.org/r/%3Calpine.LFD.2.02.1105161105170.3078%40ionos%3E
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/time/tick-broadcast.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 2030f62..0f888cb 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -523,10 +523,11 @@ static void tick_broadcast_init_next_event(struct cpumask *mask,
*/
void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
{
+ int cpu = smp_processor_id();
+
/* Set it up only once ! */
if (bc->event_handler != tick_handle_oneshot_broadcast) {
int was_periodic = bc->mode == CLOCK_EVT_MODE_PERIODIC;
- int cpu = smp_processor_id();
bc->event_handler = tick_handle_oneshot_broadcast;
clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
@@ -552,6 +553,15 @@ void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
tick_broadcast_set_event(tick_next_period, 1);
} else
bc->next_event.tv64 = KTIME_MAX;
+ } else {
+ /*
+ * The first cpu which switches to oneshot mode sets
+ * the bit for all other cpus which are in the general
+ * (periodic) broadcast mask. So the bit is set and
+ * would prevent the first broadcast enter after this
+ * to program the bc device.
+ */
+ tick_broadcast_clear_oneshot(cpu);
}
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 184/196] x86, apic: Fix spurious error interrupts triggering on all non-boot APs
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (136 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 183/196] tick: Clear broadcast active bit when switching to oneshot Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 185/196] x86, mce, AMD: Fix leaving freed data in a list Paul Gortmaker
` (11 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Youquan Song, hpa, joe, jbaron, trenn, kent.liu,
chaohong.guo, Ingo Molnar, Paul Gortmaker
From: Youquan Song <youquan.song@intel.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit e503f9e4b092e2349a9477a333543de8f3c7f5d9 upstream.
This patch fixes a bug reported by a customer, who found
that many unreasonable error interrupts reported on all
non-boot CPUs (APs) during the system boot stage.
According to Chapter 10 of Intel Software Developer Manual
Volume 3A, Local APIC may signal an illegal vector error when
an LVT entry is set as an illegal vector value (0~15) under
FIXED delivery mode (bits 8-11 is 0), regardless of whether
the mask bit is set or an interrupt actually happen. These
errors are seen as error interrupts.
The initial value of thermal LVT entries on all APs always reads
0x10000 because APs are woken up by BSP issuing INIT-SIPI-SIPI
sequence to them and LVT registers are reset to 0s except for
the mask bits which are set to 1s when APs receive INIT IPI.
When the BIOS takes over the thermal throttling interrupt,
the LVT thermal deliver mode should be SMI and it is required
from the kernel to keep AP's LVT thermal monitoring register
programmed as such as well.
This issue happens when BIOS does not take over thermal throttling
interrupt, AP's LVT thermal monitor register will be restored to
0x10000 which means vector 0 and fixed deliver mode, so all APs will
signal illegal vector error interrupts.
This patch check if interrupt delivery mode is not fixed mode before
restoring AP's LVT thermal monitor register.
Signed-off-by: Youquan Song <youquan.song@intel.com>
Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
Acked-by: Yong Wang <yong.y.wang@intel.com>
Cc: hpa@linux.intel.com
Cc: joe@perches.com
Cc: jbaron@redhat.com
Cc: trenn@suse.de
Cc: kent.liu@intel.com
Cc: chaohong.guo@intel.com
Link: http://lkml.kernel.org/r/1303402963-17738-1-git-send-email-youquan.song@intel.com
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/include/asm/apicdef.h | 1 +
arch/x86/kernel/cpu/mcheck/therm_throt.c | 12 +++++++-----
2 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/arch/x86/include/asm/apicdef.h b/arch/x86/include/asm/apicdef.h
index 7fe3b30..49d7c96 100644
--- a/arch/x86/include/asm/apicdef.h
+++ b/arch/x86/include/asm/apicdef.h
@@ -78,6 +78,7 @@
#define APIC_DEST_LOGICAL 0x00800
#define APIC_DEST_PHYSICAL 0x00000
#define APIC_DM_FIXED 0x00000
+#define APIC_DM_FIXED_MASK 0x00700
#define APIC_DM_LOWEST 0x00100
#define APIC_DM_SMI 0x00200
#define APIC_DM_REMRD 0x00300
diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
index 81c499e..493b668 100644
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -293,18 +293,20 @@ void intel_init_thermal(struct cpuinfo_x86 *c)
*/
rdmsr(MSR_IA32_MISC_ENABLE, l, h);
+ h = lvtthmr_init;
/*
* The initial value of thermal LVT entries on all APs always reads
* 0x10000 because APs are woken up by BSP issuing INIT-SIPI-SIPI
* sequence to them and LVT registers are reset to 0s except for
* the mask bits which are set to 1s when APs receive INIT IPI.
- * Always restore the value that BIOS has programmed on AP based on
- * BSP's info we saved since BIOS is always setting the same value
- * for all threads/cores
+ * If BIOS takes over the thermal interrupt and sets its interrupt
+ * delivery mode to SMI (not fixed), it restores the value that the
+ * BIOS has programmed on AP based on BSP's info we saved since BIOS
+ * is always setting the same value for all threads/cores.
*/
- apic_write(APIC_LVTTHMR, lvtthmr_init);
+ if ((h & APIC_DM_FIXED_MASK) != APIC_DM_FIXED)
+ apic_write(APIC_LVTTHMR, lvtthmr_init);
- h = lvtthmr_init;
if ((l & MSR_IA32_MISC_ENABLE_TM1) && (h & APIC_DM_SMI)) {
printk(KERN_DEBUG
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 185/196] x86, mce, AMD: Fix leaving freed data in a list
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (137 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 184/196] x86, apic: Fix spurious error interrupts triggering on all non-boot APs Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 186/196] megaraid_sas: Sanity check user supplied length before passing it to dma_alloc_coherent() Paul Gortmaker
` (10 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Julia Lawall, Borislav Petkov, Robert Richter,
Yinghai Lu, Andreas Herrmann, Ingo Molnar, Paul Gortmaker
From: Julia Lawall <julia@diku.dk>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit d9a5ac9ef306eb5cc874f285185a15c303c50009 upstream.
b may be added to a list, but is not removed before being freed
in the case of an error. This is done in the corresponding
deallocation function, so the code here has been changed to
follow that.
The sematic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)
// <smpl>
@@
expression E,E1,E2;
identifier l;
@@
*list_add(&E->l,E1);
... when != E1
when != list_del(&E->l)
when != list_del_init(&E->l)
when != E = E2
*kfree(E);// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Cc: Borislav Petkov <borislav.petkov@amd.com>
Cc: Robert Richter <robert.richter@amd.com>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: Andreas Herrmann <andreas.herrmann3@amd.com>
Link: http://lkml.kernel.org/r/1305294731-12127-1-git-send-email-julia@diku.dk
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/kernel/cpu/mcheck/mce_amd.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index f80ff85..1bdce34 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -469,6 +469,7 @@ recurse:
out_free:
if (b) {
kobject_put(&b->kobj);
+ list_del(&b->miscj);
kfree(b);
}
return err;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 186/196] megaraid_sas: Sanity check user supplied length before passing it to dma_alloc_coherent()
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (138 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 185/196] x86, mce, AMD: Fix leaving freed data in a list Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 187/196] vmxnet3: Fix inconsistent LRO state after initialization Paul Gortmaker
` (9 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Bjørn Mork, Benz, Michael, James Bottomley,
Paul Gortmaker
From: Bjørn Mork <bjorn@mork.no>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 98cb7e4413d189cd2b54daf993a4667d9788c0bb upstream.
The ioc->sgl[i].iov_len value is supplied by the ioctl caller, and can be
zero in some cases. Assume that's valid and continue without error.
Fixes (multiple individual reports of the same problem for quite a while):
http://marc.info/?l=linux-ide&m=128941801715301
http://bugs.debian.org/604627
http://www.mail-archive.com/linux-poweredge@dell.com/msg02575.html
megasas: Failed to alloc kernel SGL buffer for IOCTL
and
[ 69.162538] ------------[ cut here ]------------
[ 69.162806] kernel BUG at /build/buildd/linux-2.6.32/lib/swiotlb.c:368!
[ 69.163134] invalid opcode: 0000 [#1] SMP
[ 69.163570] last sysfs file: /sys/devices/system/cpu/cpu3/cache/index2/shared_cpu_map
[ 69.163975] CPU 0
[ 69.164227] Modules linked in: fbcon tileblit font bitblit softcursor vga16fb vgastate ioatdma radeon ttm drm_kms_helper shpchp drm i2c_algo_bit lp parport floppy pata_jmicron megaraid_sas igb dca
[ 69.167419] Pid: 1206, comm: smartctl Tainted: G W 2.6.32-25-server #45-Ubuntu X8DTN
[ 69.167843] RIP: 0010:[<ffffffff812c4dc5>] [<ffffffff812c4dc5>] map_single+0x255/0x260
[ 69.168370] RSP: 0018:ffff88081c0ebc58 EFLAGS: 00010246
[ 69.168655] RAX: 000000000003bffc RBX: 00000000ffffffff RCX: 0000000000000002
[ 69.169000] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88001dffe000
[ 69.169346] RBP: ffff88081c0ebcb8 R08: 0000000000000000 R09: ffff880000030840
[ 69.169691] R10: 0000000000100000 R11: 0000000000000000 R12: 0000000000000000
[ 69.170036] R13: 00000000ffffffff R14: 0000000000000001 R15: 0000000000200000
[ 69.170382] FS: 00007fb8de189720(0000) GS:ffff88001de00000(0000) knlGS:0000000000000000
[ 69.170794] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 69.171094] CR2: 00007fb8dd59237c CR3: 000000081a790000 CR4: 00000000000006f0
[ 69.171439] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 69.171784] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 69.172130] Process smartctl (pid: 1206, threadinfo ffff88081c0ea000, task ffff88081a760000)
[ 69.194513] Stack:
[ 69.205788] 0000000000000034 00000002817e3390 0000000000000000 ffff88081c0ebe00
[ 69.217739] <0> 0000000000000000 000000000003bffc 0000000000000000 0000000000000000
[ 69.241250] <0> 0000000000000000 00000000ffffffff ffff88081c5b4080 ffff88081c0ebe00
[ 69.277310] Call Trace:
[ 69.289278] [<ffffffff812c52ac>] swiotlb_alloc_coherent+0xec/0x130
[ 69.301118] [<ffffffff81038b31>] x86_swiotlb_alloc_coherent+0x61/0x70
[ 69.313045] [<ffffffffa002d0ce>] megasas_mgmt_fw_ioctl+0x1ae/0x690 [megaraid_sas]
[ 69.336399] [<ffffffffa002d748>] megasas_mgmt_ioctl_fw+0x198/0x240 [megaraid_sas]
[ 69.359346] [<ffffffffa002f695>] megasas_mgmt_ioctl+0x35/0x50 [megaraid_sas]
[ 69.370902] [<ffffffff81153b12>] vfs_ioctl+0x22/0xa0
[ 69.382322] [<ffffffff8115da2a>] ? alloc_fd+0x10a/0x150
[ 69.393622] [<ffffffff81153cb1>] do_vfs_ioctl+0x81/0x410
[ 69.404696] [<ffffffff8155cc13>] ? do_page_fault+0x153/0x3b0
[ 69.415761] [<ffffffff811540c1>] sys_ioctl+0x81/0xa0
[ 69.426640] [<ffffffff810121b2>] system_call_fastpath+0x16/0x1b
[ 69.437491] Code: fe ff ff 48 8b 3d 74 38 76 00 41 bf 00 00 20 00 e8 51 f5 d7 ff 83 e0 ff 48 05 ff 07 00 00 48 c1 e8 0b 48 89 45 c8 e9 13 fe ff ff <0f> 0b eb fe 0f 1f 80 00 00 00 00 55 48 89 e5 48 83 ec 20 4c 89
[ 69.478216] RIP [<ffffffff812c4dc5>] map_single+0x255/0x260
[ 69.489668] RSP <ffff88081c0ebc58>
[ 69.500975] ---[ end trace 6a2181b634e2abc7 ]---
[PG: in 34, file is megaraid_sas.c - not megaraid_sas_base.c]
Reported-by: Bokhan Artem <aptem@ngs.ru>
Reported by: Marc-Christian Petersen <m.c.p@gmx.de>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Cc: "Benz, Michael" <Michael.Benz@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/scsi/megaraid/megaraid_sas.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/megaraid/megaraid_sas.c b/drivers/scsi/megaraid/megaraid_sas.c
index 99e4478..1d2e162 100644
--- a/drivers/scsi/megaraid/megaraid_sas.c
+++ b/drivers/scsi/megaraid/megaraid_sas.c
@@ -3669,6 +3669,9 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
* For each user buffer, create a mirror buffer and copy in
*/
for (i = 0; i < ioc->sge_count; i++) {
+ if (!ioc->sgl[i].iov_len)
+ continue;
+
kbuff_arr[i] = dma_alloc_coherent(&instance->pdev->dev,
ioc->sgl[i].iov_len,
&buf_handle, GFP_KERNEL);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 187/196] vmxnet3: Fix inconsistent LRO state after initialization
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (139 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 186/196] megaraid_sas: Sanity check user supplied length before passing it to dma_alloc_coherent() Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 188/196] taskstats: don't allow duplicate entries in listener mode Paul Gortmaker
` (8 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Thomas Jarosch, David S. Miller, Paul Gortmaker
From: Thomas Jarosch <thomas.jarosch@intra2net.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit ebde6f8acba92abfc203585198a54f47e83e2cd0 upstream.
During initialization of vmxnet3, the state of LRO
gets out of sync with netdev->features.
This leads to very poor TCP performance in a IP forwarding
setup and is hitting many VMware users.
Simplified call sequence:
1. vmxnet3_declare_features() initializes "adapter->lro" to true.
2. The kernel automatically disables LRO if IP forwarding is enabled,
so vmxnet3_set_flags() gets called. This also updates netdev->features.
3. Now vmxnet3_setup_driver_shared() is called. "adapter->lro" is still
set to true and LRO gets enabled again, even though
netdev->features shows it's disabled.
Fix it by updating "adapter->lro", too.
The private vmxnet3 adapter flags are scheduled for removal
in net-next, see commit a0d2730c9571aeba793cb5d3009094ee1d8fda35
"net: vmxnet3: convert to hw_features".
Patch applies to 2.6.37 / 2.6.38 and 2.6.39-rc6.
Please CC: comments.
Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/net/vmxnet3/vmxnet3_ethtool.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
index 3935c44..df7cddd 100644
--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
+++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
@@ -290,6 +290,9 @@ vmxnet3_set_flags(struct net_device *netdev, u32 data) {
/* toggle the LRO feature*/
netdev->features ^= NETIF_F_LRO;
+ /* Update private LRO flag */
+ adapter->lro = lro_requested;
+
/* update harware LRO capability accordingly */
if (lro_requested)
adapter->shared->devRead.misc.uptFeatures &= UPT1_F_LRO;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 188/196] taskstats: don't allow duplicate entries in listener mode
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (140 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 187/196] vmxnet3: Fix inconsistent LRO state after initialization Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 189/196] inet_diag: fix inet_diag_bc_audit() Paul Gortmaker
` (7 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Vasiliy Kulikov, Vasiliy Kulikov, Balbir Singh,
Andrew Morton, Linus Torvalds, Paul Gortmaker
From: Vasiliy Kulikov <segoon@openwall.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 26c4caea9d697043cc5a458b96411b86d7f6babd upstream.
Currently a single process may register exit handlers unlimited times.
It may lead to a bloated listeners chain and very slow process
terminations.
Eg after 10KK sent TASKSTATS_CMD_ATTR_REGISTER_CPUMASKs ~300 Mb of
kernel memory is stolen for the handlers chain and "time id" shows 2-7
seconds instead of normal 0.003. It makes it possible to exhaust all
kernel memory and to eat much of CPU time by triggerring numerous exits
on a single CPU.
The patch limits the number of times a single process may register
itself on a single CPU to one.
One little issue is kept unfixed - as taskstats_exit() is called before
exit_files() in do_exit(), the orphaned listener entry (if it was not
explicitly deregistered) is kept until the next someone's exit() and
implicit deregistration in send_cpu_listeners(). So, if a process
registered itself as a listener exits and the next spawned process gets
the same pid, it would inherit taskstats attributes.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Cc: Balbir Singh <bsingharora@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
kernel/taskstats.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index 11281d5..5e21645 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -292,16 +292,18 @@ ret:
static int add_del_listener(pid_t pid, const struct cpumask *mask, int isadd)
{
struct listener_list *listeners;
- struct listener *s, *tmp;
+ struct listener *s, *tmp, *s2;
unsigned int cpu;
if (!cpumask_subset(mask, cpu_possible_mask))
return -EINVAL;
+ s = NULL;
if (isadd == REGISTER) {
for_each_cpu(cpu, mask) {
- s = kmalloc_node(sizeof(struct listener), GFP_KERNEL,
- cpu_to_node(cpu));
+ if (!s)
+ s = kmalloc_node(sizeof(struct listener),
+ GFP_KERNEL, cpu_to_node(cpu));
if (!s)
goto cleanup;
s->pid = pid;
@@ -310,9 +312,16 @@ static int add_del_listener(pid_t pid, const struct cpumask *mask, int isadd)
listeners = &per_cpu(listener_array, cpu);
down_write(&listeners->sem);
+ list_for_each_entry_safe(s2, tmp, &listeners->list, list) {
+ if (s2->pid == pid)
+ goto next_cpu;
+ }
list_add(&s->list, &listeners->list);
+ s = NULL;
+next_cpu:
up_write(&listeners->sem);
}
+ kfree(s);
return 0;
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 189/196] inet_diag: fix inet_diag_bc_audit()
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (141 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 188/196] taskstats: don't allow duplicate entries in listener mode Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 190/196] gro: Only reset frag0 when skb can be pulled Paul Gortmaker
` (6 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Eric Dumazet, David S. Miller, Paul Gortmaker
From: Eric Dumazet <eric.dumazet@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit eeb1497277d6b1a0a34ed36b97e18f2bd7d6de0d upstream.
A malicious user or buggy application can inject code and trigger an
infinite loop in inet_diag_bc_audit()
Also make sure each instruction is aligned on 4 bytes boundary, to avoid
unaligned accesses.
Reported-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/ipv4/inet_diag.c | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 7403b9b..99366cb 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -437,7 +437,7 @@ static int valid_cc(const void *bc, int len, int cc)
return 0;
if (cc == len)
return 1;
- if (op->yes < 4)
+ if (op->yes < 4 || op->yes & 3)
return 0;
len -= op->yes;
bc += op->yes;
@@ -447,11 +447,11 @@ static int valid_cc(const void *bc, int len, int cc)
static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
{
- const unsigned char *bc = bytecode;
+ const void *bc = bytecode;
int len = bytecode_len;
while (len > 0) {
- struct inet_diag_bc_op *op = (struct inet_diag_bc_op *)bc;
+ const struct inet_diag_bc_op *op = bc;
//printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
switch (op->code) {
@@ -462,22 +462,20 @@ static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
case INET_DIAG_BC_S_LE:
case INET_DIAG_BC_D_GE:
case INET_DIAG_BC_D_LE:
- if (op->yes < 4 || op->yes > len + 4)
- return -EINVAL;
case INET_DIAG_BC_JMP:
- if (op->no < 4 || op->no > len + 4)
+ if (op->no < 4 || op->no > len + 4 || op->no & 3)
return -EINVAL;
if (op->no < len &&
!valid_cc(bytecode, bytecode_len, len - op->no))
return -EINVAL;
break;
case INET_DIAG_BC_NOP:
- if (op->yes < 4 || op->yes > len + 4)
- return -EINVAL;
break;
default:
return -EINVAL;
}
+ if (op->yes < 4 || op->yes > len + 4 || op->yes & 3)
+ return -EINVAL;
bc += op->yes;
len -= op->yes;
}
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 190/196] gro: Only reset frag0 when skb can be pulled
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (142 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 189/196] inet_diag: fix inet_diag_bc_audit() Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 191/196] ipv6: udp: fix the wrong headroom check Paul Gortmaker
` (5 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Herbert Xu, David S. Miller, Paul Gortmaker
From: Herbert Xu <herbert@gondor.apana.org.au>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 17dd759c67f21e34f2156abcf415e1f60605a188 upstream.
Currently skb_gro_header_slow unconditionally resets frag0 and
frag0_len. However, when we can't pull on the skb this leaves
the GRO fields in an inconsistent state.
This patch fixes this by only resetting those fields after the
pskb_may_pull test.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/linux/netdevice.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 0af14f2..0899edf 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1261,9 +1261,12 @@ static inline int skb_gro_header_hard(struct sk_buff *skb, unsigned int hlen)
static inline void *skb_gro_header_slow(struct sk_buff *skb, unsigned int hlen,
unsigned int offset)
{
+ if (!pskb_may_pull(skb, hlen))
+ return NULL;
+
NAPI_GRO_CB(skb)->frag0 = NULL;
NAPI_GRO_CB(skb)->frag0_len = 0;
- return pskb_may_pull(skb, hlen) ? skb->data + offset : NULL;
+ return skb->data + offset;
}
static inline void *skb_gro_mac_header(struct sk_buff *skb)
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 191/196] ipv6: udp: fix the wrong headroom check
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (143 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 190/196] gro: Only reset frag0 when skb can be pulled Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 192/196] rtnetlink: Add missing manual netlink notification in dev_change_net_namespaces Paul Gortmaker
` (4 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Shan Wei, David S. Miller, Paul Gortmaker
From: Shan Wei <shanwei@cn.fujitsu.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit a9cf73ea7ff78f52662c8658d93c226effbbedde upstream.
At this point, skb->data points to skb_transport_header.
So, headroom check is wrong.
For some case:bridge(UFO is on) + eth device(UFO is off),
there is no enough headroom for IPv6 frag head.
But headroom check is always false.
This will bring about data be moved to there prior to skb->head,
when adding IPv6 frag header to skb.
Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/ipv6/udp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index be5e5a1..402a61c 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1314,7 +1314,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, int features)
skb->ip_summed = CHECKSUM_NONE;
/* Check if there is enough headroom to insert fragment header. */
- if ((skb_headroom(skb) < frag_hdr_sz) &&
+ if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) &&
pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
goto out;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 192/196] rtnetlink: Add missing manual netlink notification in dev_change_net_namespaces
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (144 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 191/196] ipv6: udp: fix the wrong headroom check Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 193/196] fs/partitions/efi.c: corrupted GUID partition tables can cause kernel oops Paul Gortmaker
` (3 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Eric W. Biederman, David S. Miller, Paul Gortmaker
From: "Eric W. Biederman" <ebiederm@xmission.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit d2237d35748e7f448a9c2d9dc6a85ef637466e24 upstream.
Renato Westphal noticed that since commit a2835763e130c343ace5320c20d33c281e7097b7
"rtnetlink: handle rtnl_link netlink notifications manually" was merged
we no longer send a netlink message when a networking device is moved
from one network namespace to another.
Fix this by adding the missing manual notification in dev_change_net_namespaces.
Since all network devices that are processed by dev_change_net_namspaces are
in the initialized state the complicated tests that guard the manual
rtmsg_ifinfo calls in rollback_registered and register_netdevice are
unnecessary and we can just perform a plain notification.
Cc: stable@kernel.org
Tested-by: Renato Westphal <renatowestphal@gmail.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/core/dev.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/core/dev.c b/net/core/dev.c
index 1bde8b7..bcd5f6e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5693,6 +5693,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
*/
call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
call_netdevice_notifiers(NETDEV_UNREGISTER_BATCH, dev);
+ rtmsg_ifinfo(RTM_DELLINK, dev, ~0U);
/*
* Flush the unicast and multicast chains
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 193/196] fs/partitions/efi.c: corrupted GUID partition tables can cause kernel oops
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (145 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 192/196] rtnetlink: Add missing manual netlink notification in dev_change_net_namespaces Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 194/196] Bluetooth: Prevent buffer overflow in l2cap config request Paul Gortmaker
` (2 subsequent siblings)
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Timo Warns, Timo Warns, Matt Domsch, Eugene Teo,
Dave Jones, Andrew Morton, Linus Torvalds, Paul Gortmaker
From: Timo Warns <Warns@pre-sense.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 3eb8e74ec72736b9b9d728bad30484ec89c91dde upstream.
The kernel automatically evaluates partition tables of storage devices.
The code for evaluating GUID partitions (in fs/partitions/efi.c) contains
a bug that causes a kernel oops on certain corrupted GUID partition
tables.
This bug has security impacts, because it allows, for example, to
prepare a storage device that crashes a kernel subsystem upon connecting
the device (e.g., a "USB Stick of (Partial) Death").
crc = efi_crc32((const unsigned char *) (*gpt), le32_to_cpu((*gpt)->header_size));
computes a CRC32 checksum over gpt covering (*gpt)->header_size bytes.
There is no validation of (*gpt)->header_size before the efi_crc32 call.
A corrupted partition table may have large values for (*gpt)->header_size.
In this case, the CRC32 computation access memory beyond the memory
allocated for gpt, which may cause a kernel heap overflow.
Validate value of GUID partition table header size.
[akpm@linux-foundation.org: fix layout and indenting]
[PG: replace state->bdev with bdev, since 1493bf217f7f isn't in 34]
Signed-off-by: Timo Warns <warns@pre-sense.de>
Cc: Matt Domsch <Matt_Domsch@dell.com>
Cc: Eugene Teo <eugeneteo@kernel.sg>
Cc: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/partitions/efi.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/fs/partitions/efi.c b/fs/partitions/efi.c
index ee59684..9b40337 100644
--- a/fs/partitions/efi.c
+++ b/fs/partitions/efi.c
@@ -312,6 +312,15 @@ is_gpt_valid(struct block_device *bdev, u64 lba,
goto fail;
}
+ /* Check the GUID Partition Table header size */
+ if (le32_to_cpu((*gpt)->header_size) >
+ bdev_logical_block_size(bdev)) {
+ pr_debug("GUID Partition Table Header size is wrong: %u > %u\n",
+ le32_to_cpu((*gpt)->header_size),
+ bdev_logical_block_size(bdev));
+ goto fail;
+ }
+
/* Check the GUID Partition Table CRC */
origcrc = le32_to_cpu((*gpt)->header_crc32);
(*gpt)->header_crc32 = 0;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 194/196] Bluetooth: Prevent buffer overflow in l2cap config request
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (146 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 193/196] fs/partitions/efi.c: corrupted GUID partition tables can cause kernel oops Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 195/196] befs: Validate length of long symbolic links Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 196/196] net: sk_add_backlog() take rmem_alloc into account Paul Gortmaker
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Dan Rosenberg, Gustavo F. Padovan, Paul Gortmaker
From: Dan Rosenberg <drosenberg@vsecurity.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 7ac28817536797fd40e9646452183606f9e17f71 upstream.
A remote user can provide a small value for the command size field in
the command header of an l2cap configuration request, resulting in an
integer underflow when subtracting the size of the configuration request
header. This results in copying a very large amount of data via
memcpy() and destroying the kernel heap. Check for underflow.
[PG: 34 uses l2cap_pi(sk)->... instead of a local chan->... variable]
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/bluetooth/l2cap.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 9753b69..b21e319 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2746,7 +2746,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
/* Reject if config buffer is too small. */
len = cmd_len - sizeof(*req);
- if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
+ if (len < 0 || l2cap_pi(sk)->conf_len + len >
+ sizeof(l2cap_pi(sk)->conf_req)) {
l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
l2cap_build_conf_rsp(sk, rsp,
L2CAP_CONF_REJECT, flags), rsp);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 195/196] befs: Validate length of long symbolic links.
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (147 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 194/196] Bluetooth: Prevent buffer overflow in l2cap config request Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
2012-03-13 0:21 ` [34-longterm 196/196] net: sk_add_backlog() take rmem_alloc into account Paul Gortmaker
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Timo Warns, Timo Warns, Linus Torvalds, Paul Gortmaker
From: Timo Warns <Warns@pre-sense.de>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit 338d0f0a6fbc82407864606f5b64b75aeb3c70f2 upstream.
Signed-off-by: Timo Warns <warns@pre-sense.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/befs/linuxvfs.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index 34ddda8..9158c07 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -469,17 +469,22 @@ befs_follow_link(struct dentry *dentry, struct nameidata *nd)
befs_data_stream *data = &befs_ino->i_data.ds;
befs_off_t len = data->size;
- befs_debug(sb, "Follow long symlink");
-
- link = kmalloc(len, GFP_NOFS);
- if (!link) {
- link = ERR_PTR(-ENOMEM);
- } else if (befs_read_lsymlink(sb, data, link, len) != len) {
- kfree(link);
- befs_error(sb, "Failed to read entire long symlink");
+ if (len == 0) {
+ befs_error(sb, "Long symlink with illegal length");
link = ERR_PTR(-EIO);
} else {
- link[len - 1] = '\0';
+ befs_debug(sb, "Follow long symlink");
+
+ link = kmalloc(len, GFP_NOFS);
+ if (!link) {
+ link = ERR_PTR(-ENOMEM);
+ } else if (befs_read_lsymlink(sb, data, link, len) != len) {
+ kfree(link);
+ befs_error(sb, "Failed to read entire long symlink");
+ link = ERR_PTR(-EIO);
+ } else {
+ link[len - 1] = '\0';
+ }
}
} else {
link = befs_ino->i_data.symlink;
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread* [34-longterm 196/196] net: sk_add_backlog() take rmem_alloc into account
2012-03-13 0:19 ` [34-longterm 046/196] repair gdbstub to match the gdbserial protocol specification Paul Gortmaker
` (148 preceding siblings ...)
2012-03-13 0:21 ` [34-longterm 195/196] befs: Validate length of long symbolic links Paul Gortmaker
@ 2012-03-13 0:21 ` Paul Gortmaker
149 siblings, 0 replies; 209+ messages in thread
From: Paul Gortmaker @ 2012-03-13 0:21 UTC (permalink / raw)
To: stable, linux-kernel
Cc: stable-review, Eric Dumazet, David S. Miller, Paul Gortmaker
From: Eric Dumazet <eric.dumazet@gmail.com>
-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------
commit c377411f2494a931ff7facdbb3a6839b1266bcf6 upstream.
Current socket backlog limit is not enough to really stop DDOS attacks,
because user thread spend many time to process a full backlog each
round, and user might crazy spin on socket lock.
We should add backlog size and receive_queue size (aka rmem_alloc) to
pace writers, and let user run without being slow down too much.
Introduce a sk_rcvqueues_full() helper, to avoid taking socket lock in
stress situations.
Under huge stress from a multiqueue/RPS enabled NIC, a single flow udp
receiver can now process ~200.000 pps (instead of ~100 pps before the
patch) on a 8 core machine.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/net/sock.h | 13 +++++++++++--
net/core/sock.c | 5 ++++-
net/ipv4/udp.c | 4 ++++
net/ipv6/udp.c | 8 ++++++++
net/sctp/socket.c | 3 ---
5 files changed, 27 insertions(+), 6 deletions(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index 721c7b3..b365fc2 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -255,7 +255,6 @@ struct sock {
struct sk_buff *head;
struct sk_buff *tail;
int len;
- int limit;
} sk_backlog;
wait_queue_head_t *sk_sleep;
struct dst_entry *sk_dst_cache;
@@ -604,10 +603,20 @@ static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)
skb->next = NULL;
}
+/*
+ * Take into account size of receive queue and backlog queue
+ */
+static inline bool sk_rcvqueues_full(const struct sock *sk, const struct sk_buff *skb)
+{
+ unsigned int qsize = sk->sk_backlog.len + atomic_read(&sk->sk_rmem_alloc);
+
+ return qsize + skb->truesize > sk->sk_rcvbuf;
+}
+
/* The per-socket spinlock must be held here. */
static inline __must_check int sk_add_backlog(struct sock *sk, struct sk_buff *skb)
{
- if (sk->sk_backlog.len >= max(sk->sk_backlog.limit, sk->sk_rcvbuf << 1))
+ if (sk_rcvqueues_full(sk, skb))
return -ENOBUFS;
__sk_add_backlog(sk, skb);
diff --git a/net/core/sock.c b/net/core/sock.c
index cf3b9aa..78b7087 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -327,6 +327,10 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
skb->dev = NULL;
+ if (sk_rcvqueues_full(sk, skb)) {
+ atomic_inc(&sk->sk_drops);
+ goto discard_and_relse;
+ }
if (nested)
bh_lock_sock_nested(sk);
else
@@ -1885,7 +1889,6 @@ void sock_init_data(struct socket *sock, struct sock *sk)
sk->sk_allocation = GFP_KERNEL;
sk->sk_rcvbuf = sysctl_rmem_default;
sk->sk_sndbuf = sysctl_wmem_default;
- sk->sk_backlog.limit = sk->sk_rcvbuf << 1;
sk->sk_state = TCP_CLOSE;
sk_set_socket(sk, sock);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index fd510bc..ff6a18e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1410,6 +1410,10 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
goto drop;
}
+
+ if (sk_rcvqueues_full(sk, skb))
+ goto drop;
+
rc = 0;
bh_lock_sock(sk);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 402a61c..479f926 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -590,6 +590,10 @@ static void flush_stack(struct sock **stack, unsigned int count,
sk = stack[i];
if (skb1) {
+ if (sk_rcvqueues_full(sk, skb)) {
+ kfree_skb(skb1);
+ goto drop;
+ }
bh_lock_sock(sk);
if (!sock_owned_by_user(sk))
udpv6_queue_rcv_skb(sk, skb1);
@@ -765,6 +769,10 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
/* deliver */
+ if (sk_rcvqueues_full(sk, skb)) {
+ sock_put(sk);
+ goto discard;
+ }
bh_lock_sock(sk);
if (!sock_owned_by_user(sk))
udpv6_queue_rcv_skb(sk, skb);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 7f28df5..8375609 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3720,9 +3720,6 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
SCTP_DBG_OBJCNT_INC(sock);
- /* Set socket backlog limit. */
- sk->sk_backlog.limit = sysctl_sctp_rmem[1];
-
local_bh_disable();
percpu_counter_inc(&sctp_sockets_allocated);
sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
--
1.7.9.3
^ permalink raw reply related [flat|nested] 209+ messages in thread