* 4 -stable kernel review cycles starting @ 2010-07-01 17:51 Greg KH 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (4 more replies) 0 siblings, 5 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:51 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan First off, sorry for the long delay in the -stable kernel releases, they got pushed to the back-burner for other things recently ("Hey look, is that the sun finally here in the Pacific Northwest?") Please note that there are still a large number of patches that have been submitted to the -stable trees for inclusion, that I have not included yet. Do not worry, they are still in my queue, but due to the large number of patches that I already have queued up, I figured it was better to get what I have applied already out for a release and then work on catching up after this. If anyone has any questions about this, please let me know. thanks, greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* [00/23] 2.6.27.48 stable review 2010-07-01 17:51 4 -stable kernel review cycles starting Greg KH @ 2010-07-01 17:51 ` Greg KH 2010-07-01 17:26 ` [01/23] libata: disable ATAPI AN by default Greg KH ` (22 more replies) 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (3 subsequent siblings) 4 siblings, 23 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:51 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan This is the start of the stable review cycle for the 2.6.27.48 release. There are 23 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. If anyone is a maintainer of the proper subsystem, and wants to add a Signed-off-by: line to the patch, please respond with it. Responses should be made by Sat, July 3, 17:00:00 UTC UTC. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.48-rc1.gz and the diffstat can be found below. thanks, greg k-h Makefile | 2 +- arch/parisc/math-emu/decode_exc.c | 1 + arch/powerpc/lib/string.S | 4 +- arch/powerpc/oprofile/op_model_cell.c | 2 +- arch/powerpc/platforms/pseries/smp.c | 6 + drivers/ata/libata-core.c | 7 +- drivers/char/ipmi/ipmi_si_intf.c | 11 +- drivers/md/md.c | 29 ++++ drivers/md/raid1.c | 9 +- drivers/md/raid10.c | 2 +- drivers/net/arcnet/com20020-pci.c | 4 +- fs/ext4/inode.c | 240 ++++++++++++++++++++++++++------ fs/ext4/resize.c | 3 +- fs/namespace.c | 9 +- fs/nfsd/nfssvc.c | 2 +- include/linux/fs.h | 2 + include/net/sctp/structs.h | 1 + mm/filemap.c | 6 + net/sctp/sm_make_chunk.c | 62 ++++++++- net/tipc/bearer.c | 37 +----- net/tipc/bearer.h | 2 +- net/tipc/net.c | 25 +--- scripts/kconfig/Makefile | 2 +- security/keys/keyring.c | 18 ++-- security/keys/process_keys.c | 6 +- 25 files changed, 359 insertions(+), 133 deletions(-) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [01/23] libata: disable ATAPI AN by default 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH @ 2010-07-01 17:26 ` Greg KH 2010-07-01 17:26 ` [02/23] NFSD: dont report compiled-out versions as present Greg KH ` (21 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:26 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Kay Sievers, Nick Bowler, David Zeuthen, Jeff Garzik 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Tejun Heo <tj@kernel.org> commit e7ecd435692ca9bde9d124be30b3a26e672ea6c2 upstream. There are ATAPI devices which raise AN when hit by commands issued by open(). This leads to infinite loop of AN -> MEDIA_CHANGE uevent -> udev open() to check media -> AN. Both ACS and SerialATA standards don't define in which case ATAPI devices are supposed to raise or not raise AN. They both list media insertion event as a possible use case for ATAPI ANs but there is no clear description of what constitutes such events. As such, it seems a bit too naive to export ANs directly to userland as MEDIA_CHANGE events without further verification (which should behave similarly to windows as it apparently is the only thing that some hardware vendors are testing against). This patch adds libata.atapi_an module parameter and disables ATAPI AN by default for now. Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Kay Sievers <kay.sievers@vrfy.org> Cc: Nick Bowler <nbowler@elliptictech.com> Cc: David Zeuthen <david@fubar.dk> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/libata-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -157,6 +157,10 @@ int libata_allow_tpm = 0; module_param_named(allow_tpm, libata_allow_tpm, int, 0444); MODULE_PARM_DESC(allow_tpm, "Permit the use of TPM commands"); +static int atapi_an; +module_param(atapi_an, int, 0444); +MODULE_PARM_DESC(atapi_an, "Enable ATAPI AN media presence notification (0=0ff [default], 1=on)"); + MODULE_AUTHOR("Jeff Garzik"); MODULE_DESCRIPTION("Library module for ATA devices"); MODULE_LICENSE("GPL"); @@ -2341,7 +2345,8 @@ int ata_dev_configure(struct ata_device * to enable ATAPI AN to discern between PHY status * changed notifications and ATAPI ANs. */ - if ((ap->flags & ATA_FLAG_AN) && ata_id_has_atapi_AN(id) && + if (atapi_an && + (ap->flags & ATA_FLAG_AN) && ata_id_has_atapi_AN(id) && (!sata_pmp_attached(ap) || sata_scr_read(&ap->link, SCR_NOTIFICATION, &sntf) == 0)) { unsigned int err_mask; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [02/23] NFSD: dont report compiled-out versions as present 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH 2010-07-01 17:26 ` [01/23] libata: disable ATAPI AN by default Greg KH @ 2010-07-01 17:26 ` Greg KH 2010-07-01 17:26 ` [03/23] ARCNET: Limit com20020 PCI ID matches for SOHARD cards Greg KH ` (20 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:26 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Pavel Emelyanov, NeilBrown, J. Bruce Fields 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Pavel Emelyanov <xemul@openvz.org> commit 15ddb4aec54422ead137b03ea4e9b3f5db3f7cc2 upstream. The /proc/fs/nfsd/versions file calls nfsd_vers() to check whether the particular nfsd version is present/available. The problem is that once I turn off e.g. NFSD-V4 this call returns -1 which is true from the callers POV which is wrong. The proposal is to report false in that case. The bug has existed since 6658d3a7bbfd1768 "[PATCH] knfsd: remove nfsd_versbits as intermediate storage for desired versions". Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: NeilBrown <neilb@suse.de> Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/nfsd/nfssvc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/nfsd/nfssvc.c +++ b/fs/nfsd/nfssvc.c @@ -126,7 +126,7 @@ struct svc_program nfsd_program = { int nfsd_vers(int vers, enum vers_op change) { if (vers < NFSD_MINVERS || vers >= NFSD_NRVERS) - return -1; + return 0; switch(change) { case NFSD_SET: nfsd_versions[vers] = nfsd_version[vers]; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [03/23] ARCNET: Limit com20020 PCI ID matches for SOHARD cards 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH 2010-07-01 17:26 ` [01/23] libata: disable ATAPI AN by default Greg KH 2010-07-01 17:26 ` [02/23] NFSD: dont report compiled-out versions as present Greg KH @ 2010-07-01 17:26 ` Greg KH 2010-07-01 17:26 ` [04/23] powerpc: Fix handling of strncmp with zero len Greg KH ` (19 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:26 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andreas Bombe, David S. Miller 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Andreas Bombe <aeb@debian.org> commit e7971c80a8e0299f91272ad8e8ac4167623e1862 upstream. The SH SOHARD ARCNET cards are implemented using generic PLX Technology PCI<->IOBus bridges. Subvendor and subdevice IDs were not specified, causing the driver to attach to any such bridge and likely crash the system by attempting to initialize an unrelated device. Fix by specifying subvendor and subdevice according to the values found in the PCI-ID Repository at http://pci-ids.ucw.cz/ . Signed-off-by: Andreas Bombe <aeb@debian.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/arcnet/com20020-pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/arcnet/com20020-pci.c +++ b/drivers/net/arcnet/com20020-pci.c @@ -162,8 +162,8 @@ static struct pci_device_id com20020pci_ { 0x1571, 0xa204, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, { 0x1571, 0xa205, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, { 0x1571, 0xa206, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, - { 0x10B5, 0x9030, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, - { 0x10B5, 0x9050, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, + { 0x10B5, 0x9030, 0x10B5, 0x2978, 0, 0, ARC_CAN_10MBIT }, + { 0x10B5, 0x9050, 0x10B5, 0x2273, 0, 0, ARC_CAN_10MBIT }, { 0x14BA, 0x6000, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, { 0x10B5, 0x2200, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, {0,} ^ permalink raw reply [flat|nested] 666+ messages in thread
* [04/23] powerpc: Fix handling of strncmp with zero len 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (2 preceding siblings ...) 2010-07-01 17:26 ` [03/23] ARCNET: Limit com20020 PCI ID matches for SOHARD cards Greg KH @ 2010-07-01 17:26 ` Greg KH 2010-07-01 17:26 ` [05/23] powerpc/pseries: Only call start-cpu when a CPU is stopped Greg KH ` (18 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:26 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jeff Mahoney, Benjamin Herrenschmidt 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Jeff Mahoney <jeffm@suse.com> commit 637a99022fb119b90fb281715d13172f0394fc12 upstream. Commit 0119536c, which added the assembly version of strncmp to powerpc, mentions that it adds two instructions to the version from boot/string.S to allow it to handle len=0. Unfortunately, it doesn't always return 0 when that is the case. The length is passed in r5, but the return value is passed back in r3. In certain cases, this will happen to work. Otherwise it will pass back the address of the first string as the return value. This patch lifts the len <= 0 handling code from memcpy to handle that case. Reported by: Christian_Sellars@symantec.com Signed-off-by: Jeff Mahoney <jeffm@suse.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/lib/string.S | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/arch/powerpc/lib/string.S +++ b/arch/powerpc/lib/string.S @@ -71,7 +71,7 @@ _GLOBAL(strcmp) _GLOBAL(strncmp) PPC_LCMPI r5,0 - beqlr + ble- 2f mtctr r5 addi r5,r3,-1 addi r4,r4,-1 @@ -82,6 +82,8 @@ _GLOBAL(strncmp) beqlr 1 bdnzt eq,1b blr +2: li r3,0 + blr _GLOBAL(strlen) addi r4,r3,-1 ^ permalink raw reply [flat|nested] 666+ messages in thread
* [05/23] powerpc/pseries: Only call start-cpu when a CPU is stopped 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (3 preceding siblings ...) 2010-07-01 17:26 ` [04/23] powerpc: Fix handling of strncmp with zero len Greg KH @ 2010-07-01 17:26 ` Greg KH 2010-07-02 0:02 ` Michael Neuling 2010-07-01 17:26 ` [06/23] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c Greg KH ` (17 subsequent siblings) 22 siblings, 1 reply; 666+ messages in thread From: Greg KH @ 2010-07-01 17:26 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Michael Neuling, Benjamin Herrenschmidt 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Michael Neuling <mikey@neuling.org> commit aef40e87d866355ffd279ab21021de733242d0d5 upstream. Currently we always call start-cpu irrespective of if the CPU is stopped or not. Unfortunatley on POWER7, firmware seems to not like start-cpu being called when a cpu already been started. This was not the case on POWER6 and earlier. This patch checks to see if the CPU is stopped or not via an query-cpu-stopped-state call, and only calls start-cpu on CPUs which are stopped. This fixes a bug with kexec on POWER7 on PHYP where only the primary thread would make it to the second kernel. Reported-by: Ankita Garg <ankita@linux.vnet.ibm.com> Signed-off-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/platforms/pseries/smp.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/arch/powerpc/platforms/pseries/smp.c +++ b/arch/powerpc/platforms/pseries/smp.c @@ -84,6 +84,12 @@ static inline int __devinit smp_startup_ pcpu = get_hard_smp_processor_id(lcpu); + /* Check to see if the CPU out of FW already for kexec */ + if (smp_query_cpu_stopped(pcpu) == QCSS_NOT_STOPPED){ + cpu_set(lcpu, of_spin_map); + return 1; + } + /* Fixup atomic count: it exited inside IRQ handler. */ task_thread_info(paca[lcpu].__current)->preempt_count = 0; ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [05/23] powerpc/pseries: Only call start-cpu when a CPU is stopped 2010-07-01 17:26 ` [05/23] powerpc/pseries: Only call start-cpu when a CPU is stopped Greg KH @ 2010-07-02 0:02 ` Michael Neuling 2010-07-03 1:56 ` Greg KH 0 siblings, 1 reply; 666+ messages in thread From: Michael Neuling @ 2010-07-02 0:02 UTC (permalink / raw) To: Greg KH Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Benjamin Herrenschmidt This is not going to work without: f8b67691828321f5c85bb853283aa101ae673130 It'll get a build failure. Mikey In message <20100701172856.882121276@clark.site> you wrote: > 2.6.27-stable review patch. If anyone has any objections, please let us know . > > ------------------ > > From: Michael Neuling <mikey@neuling.org> > > commit aef40e87d866355ffd279ab21021de733242d0d5 upstream. > > Currently we always call start-cpu irrespective of if the CPU is > stopped or not. Unfortunatley on POWER7, firmware seems to not like > start-cpu being called when a cpu already been started. This was not > the case on POWER6 and earlier. > > This patch checks to see if the CPU is stopped or not via an > query-cpu-stopped-state call, and only calls start-cpu on CPUs which > are stopped. > > This fixes a bug with kexec on POWER7 on PHYP where only the primary > thread would make it to the second kernel. > > Reported-by: Ankita Garg <ankita@linux.vnet.ibm.com> > Signed-off-by: Michael Neuling <mikey@neuling.org> > Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> > > --- > arch/powerpc/platforms/pseries/smp.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > --- a/arch/powerpc/platforms/pseries/smp.c > +++ b/arch/powerpc/platforms/pseries/smp.c > @@ -84,6 +84,12 @@ static inline int __devinit smp_startup_ > > pcpu = get_hard_smp_processor_id(lcpu); > > + /* Check to see if the CPU out of FW already for kexec */ > + if (smp_query_cpu_stopped(pcpu) == QCSS_NOT_STOPPED){ > + cpu_set(lcpu, of_spin_map); > + return 1; > + } > + > /* Fixup atomic count: it exited inside IRQ handler. */ > task_thread_info(paca[lcpu].__current)->preempt_count = 0; > > > ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [05/23] powerpc/pseries: Only call start-cpu when a CPU is stopped 2010-07-02 0:02 ` Michael Neuling @ 2010-07-03 1:56 ` Greg KH 2010-07-03 7:55 ` Michael Neuling 0 siblings, 1 reply; 666+ messages in thread From: Greg KH @ 2010-07-03 1:56 UTC (permalink / raw) To: Michael Neuling Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Benjamin Herrenschmidt On Fri, Jul 02, 2010 at 10:02:48AM +1000, Michael Neuling wrote: > This is not going to work without: > f8b67691828321f5c85bb853283aa101ae673130 > > It'll get a build failure. But that patch does not apply on the .27 series, care to provide a backported version of it? thanks, greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [05/23] powerpc/pseries: Only call start-cpu when a CPU is stopped 2010-07-03 1:56 ` Greg KH @ 2010-07-03 7:55 ` Michael Neuling 2010-07-05 17:05 ` Greg KH 0 siblings, 1 reply; 666+ messages in thread From: Michael Neuling @ 2010-07-03 7:55 UTC (permalink / raw) To: Greg KH Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Benjamin Herrenschmidt In message <20100703015627.GB16229@suse.de> you wrote: > On Fri, Jul 02, 2010 at 10:02:48AM +1000, Michael Neuling wrote: > > This is not going to work without: > > f8b67691828321f5c85bb853283aa101ae673130 > > > > It'll get a build failure. > > But that patch does not apply on the .27 series, care to provide a > backported version of it? Sure... Compile and boot tested only. Thanks, Mikey From: Michael Neuling <mikey@neuling.org> powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu This moves query_cpu_stopped() out of the hotplug cpu code and into smp.c so it can called in other places and renames it to smp_query_cpu_stopped(). It also cleans up the return values by adding some #defines Signed-off-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Index: clone3/arch/powerpc/platforms/pseries/hotplug-cpu.c =================================================================== --- clone3.orig/arch/powerpc/platforms/pseries/hotplug-cpu.c +++ clone3/arch/powerpc/platforms/pseries/hotplug-cpu.c @@ -66,30 +66,6 @@ static void pseries_mach_cpu_die(void) for(;;); } -static int qcss_tok; /* query-cpu-stopped-state token */ - -/* Get state of physical CPU. - * Return codes: - * 0 - The processor is in the RTAS stopped state - * 1 - stop-self is in progress - * 2 - The processor is not in the RTAS stopped state - * -1 - Hardware Error - * -2 - Hardware Busy, Try again later. - */ -static int query_cpu_stopped(unsigned int pcpu) -{ - int cpu_status, status; - - status = rtas_call(qcss_tok, 1, 2, &cpu_status, pcpu); - if (status != 0) { - printk(KERN_ERR - "RTAS query-cpu-stopped-state failed: %i\n", status); - return status; - } - - return cpu_status; -} - static int pseries_cpu_disable(void) { int cpu = smp_processor_id(); @@ -113,8 +89,9 @@ static void pseries_cpu_die(unsigned int unsigned int pcpu = get_hard_smp_processor_id(cpu); for (tries = 0; tries < 25; tries++) { - cpu_status = query_cpu_stopped(pcpu); - if (cpu_status == 0 || cpu_status == -1) + cpu_status = smp_query_cpu_stopped(pcpu); + if (cpu_status == QCSS_STOPPED || + cpu_status == QCSS_HARDWARE_ERROR) break; msleep(200); } @@ -256,6 +233,7 @@ static int __init pseries_cpu_hotplug_in { struct device_node *np; const char *typep; + int qcss_tok; for_each_node_by_name(np, "interrupt-controller") { typep = of_get_property(np, "compatible", NULL); Index: clone3/arch/powerpc/platforms/pseries/plpar_wrappers.h =================================================================== --- clone3.orig/arch/powerpc/platforms/pseries/plpar_wrappers.h +++ clone3/arch/powerpc/platforms/pseries/plpar_wrappers.h @@ -4,6 +4,14 @@ #include <asm/hvcall.h> #include <asm/page.h> +/* Get state of physical CPU from query_cpu_stopped */ +int smp_query_cpu_stopped(unsigned int pcpu); +#define QCSS_STOPPED 0 +#define QCSS_STOPPING 1 +#define QCSS_NOT_STOPPED 2 +#define QCSS_HARDWARE_ERROR -1 +#define QCSS_HARDWARE_BUSY -2 + static inline long poll_pending(void) { return plpar_hcall_norets(H_POLL_PENDING); Index: clone3/arch/powerpc/platforms/pseries/smp.c =================================================================== --- clone3.orig/arch/powerpc/platforms/pseries/smp.c +++ clone3/arch/powerpc/platforms/pseries/smp.c @@ -59,6 +59,28 @@ static cpumask_t of_spin_map; extern void generic_secondary_smp_init(unsigned long); +/* Query where a cpu is now. Return codes #defined in plpar_wrappers.h */ +int smp_query_cpu_stopped(unsigned int pcpu) +{ + int cpu_status, status; + int qcss_tok = rtas_token("query-cpu-stopped-state"); + + if (qcss_tok == RTAS_UNKNOWN_SERVICE) { + printk(KERN_INFO "Firmware doesn't support " + "query-cpu-stopped-state\n"); + return QCSS_HARDWARE_ERROR; + } + + status = rtas_call(qcss_tok, 1, 2, &cpu_status, pcpu); + if (status != 0) { + printk(KERN_ERR + "RTAS query-cpu-stopped-state failed: %i\n", status); + return status; + } + + return cpu_status; +} + /** * smp_startup_cpu() - start the given cpu * ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [05/23] powerpc/pseries: Only call start-cpu when a CPU is stopped 2010-07-03 7:55 ` Michael Neuling @ 2010-07-05 17:05 ` Greg KH 0 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-05 17:05 UTC (permalink / raw) To: Michael Neuling Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Benjamin Herrenschmidt On Sat, Jul 03, 2010 at 05:55:00PM +1000, Michael Neuling wrote: > In message <20100703015627.GB16229@suse.de> you wrote: > > On Fri, Jul 02, 2010 at 10:02:48AM +1000, Michael Neuling wrote: > > > This is not going to work without: > > > f8b67691828321f5c85bb853283aa101ae673130 > > > > > > It'll get a build failure. > > > > But that patch does not apply on the .27 series, care to provide a > > backported version of it? > > Sure... Compile and boot tested only. Applied, thanks. greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* [06/23] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (4 preceding siblings ...) 2010-07-01 17:26 ` [05/23] powerpc/pseries: Only call start-cpu when a CPU is stopped Greg KH @ 2010-07-01 17:26 ` Greg KH 2010-07-01 17:26 ` [07/23] md/raid1: fix counting of write targets Greg KH ` (16 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:26 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Denis Kirjanov, Robert Richter 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Denis Kirjanov <dkirjanov@hera.kernel.org> commit 238c1a78c957f3dc7cb848b161dcf4805793ed56 upstream. Fix potential initial_lfsr buffer overrun. Writing past the end of the buffer could happen when index == ENTRIES Signed-off-by: Denis Kirjanov <dkirjanov@kernel.org> Signed-off-by: Robert Richter <robert.richter@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/oprofile/op_model_cell.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/powerpc/oprofile/op_model_cell.c +++ b/arch/powerpc/oprofile/op_model_cell.c @@ -821,7 +821,7 @@ static int calculate_lfsr(int n) index = ENTRIES-1; /* make sure index is valid */ - if ((index > ENTRIES) || (index < 0)) + if ((index >= ENTRIES) || (index < 0)) index = ENTRIES-1; return initial_lfsr[index]; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [07/23] md/raid1: fix counting of write targets. 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (5 preceding siblings ...) 2010-07-01 17:26 ` [06/23] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c Greg KH @ 2010-07-01 17:26 ` Greg KH 2010-07-01 17:26 ` [08/23] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB Greg KH ` (15 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:26 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: NeilBrown <neilb@suse.de> commit 964147d5c86d63be79b442c30f3783d49860c078 upstream. There is a very small race window when writing to a RAID1 such that if a device is marked faulty at exactly the wrong time, the write-in-progress will not be sent to the device, but the bitmap (if present) will be updated to say that the write was sent. Then if the device turned out to still be usable as was re-added to the array, the bitmap-based-resync would skip resyncing that block, possibly leading to corruption. This would only be a problem if no further writes were issued to that area of the device (i.e. that bitmap chunk). Suitable for any pending -stable kernel. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/raid1.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -879,9 +879,10 @@ static int make_request(struct request_q if (test_bit(Faulty, &rdev->flags)) { rdev_dec_pending(rdev, mddev); r1_bio->bios[i] = NULL; - } else + } else { r1_bio->bios[i] = bio; - targets++; + targets++; + } } else r1_bio->bios[i] = NULL; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [08/23] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (6 preceding siblings ...) 2010-07-01 17:26 ` [07/23] md/raid1: fix counting of write targets Greg KH @ 2010-07-01 17:26 ` Greg KH 2010-07-01 17:26 ` [09/23] md: set mddev readonly flag on blkdev BLKROSET ioctl Greg KH ` (14 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:26 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: NeilBrown <neilb@suse.de> commit af3a2cd6b8a479345786e7fe5e199ad2f6240e56 upstream. read_balance uses a "unsigned long" for a sector number which will get truncated beyond 2TB. This will cause read-balancing to be non-optimal, and can cause data to be read from the 'wrong' branch during a resync. This has a very small chance of returning wrong data. Reported-by: Jordan Russell <jr-list-2010@quo.to> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/raid1.c | 4 ++-- drivers/md/raid10.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -413,7 +413,7 @@ static void raid1_end_write_request(stru */ static int read_balance(conf_t *conf, r1bio_t *r1_bio) { - const unsigned long this_sector = r1_bio->sector; + const sector_t this_sector = r1_bio->sector; int new_disk = conf->last_used, disk = new_disk; int wonly_disk = -1; const int sectors = r1_bio->sectors; @@ -429,7 +429,7 @@ static int read_balance(conf_t *conf, r1 retry: if (conf->mddev->recovery_cp < MaxSector && (this_sector + sectors >= conf->next_resync)) { - /* Choose the first operation device, for consistancy */ + /* Choose the first operational device, for consistancy */ new_disk = 0; for (rdev = rcu_dereference(conf->mirrors[new_disk].rdev); --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -490,7 +490,7 @@ static int raid10_mergeable_bvec(struct */ static int read_balance(conf_t *conf, r10bio_t *r10_bio) { - const unsigned long this_sector = r10_bio->sector; + const sector_t this_sector = r10_bio->sector; int disk, slot, nslot; const int sectors = r10_bio->sectors; sector_t new_distance, current_distance; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [09/23] md: set mddev readonly flag on blkdev BLKROSET ioctl 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (7 preceding siblings ...) 2010-07-01 17:26 ` [08/23] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB Greg KH @ 2010-07-01 17:26 ` Greg KH 2010-07-01 17:26 ` [10/23] do_generic_file_read: clear page errors when issuing a fresh read of the page Greg KH ` (13 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:26 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dan Williams, NeilBrown 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Dan Williams <dan.j.williams@intel.com> commit e2218350465e7e0931676b4849b594c978437bce upstream. When the user sets the block device to readwrite then the mddev should follow suit. Otherwise, the BUG_ON in md_write_start() will be set to trigger. The reverse direction, setting mddev->ro to match a set readonly request, can be ignored because the blkdev level readonly flag precludes the need to have mddev->ro set correctly. Nevermind the fact that setting mddev->ro to 1 may fail if the array is in use. Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/md.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -4816,6 +4816,7 @@ static int md_ioctl(struct inode *inode, int err = 0; void __user *argp = (void __user *)arg; mddev_t *mddev = NULL; + int ro; if (!capable(CAP_SYS_ADMIN)) return -EACCES; @@ -4951,6 +4952,34 @@ static int md_ioctl(struct inode *inode, err = do_md_stop (mddev, 1, 1); goto done_unlock; + case BLKROSET: + if (get_user(ro, (int __user *)(arg))) { + err = -EFAULT; + goto done_unlock; + } + err = -EINVAL; + + /* if the bdev is going readonly the value of mddev->ro + * does not matter, no writes are coming + */ + if (ro) + goto done_unlock; + + /* are we are already prepared for writes? */ + if (mddev->ro != 1) + goto done_unlock; + + /* transitioning to readauto need only happen for + * arrays that call md_write_start + */ + if (mddev->pers) { + err = restart_array(mddev); + if (err == 0) { + mddev->ro = 2; + set_disk_ro(mddev->gendisk, 0); + } + } + goto done_unlock; } /* ^ permalink raw reply [flat|nested] 666+ messages in thread
* [10/23] do_generic_file_read: clear page errors when issuing a fresh read of the page 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (8 preceding siblings ...) 2010-07-01 17:26 ` [09/23] md: set mddev readonly flag on blkdev BLKROSET ioctl Greg KH @ 2010-07-01 17:26 ` Greg KH 2010-07-01 17:27 ` [11/23] ipmi: handle run_to_completion properly in deliver_recv_msg() Greg KH ` (12 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:26 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jeff Moyer, Rik van Riel, Larry Woodman 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Jeff Moyer <jmoyer@redhat.com> commit 91803b499cca2fe558abad709ce83dc896b80950 upstream. I/O errors can happen due to temporary failures, like multipath errors or losing network contact with the iSCSI server. Because of that, the VM will retry readpage on the page. However, do_generic_file_read does not clear PG_error. This causes the system to be unable to actually use the data in the page cache page, even if the subsequent readpage completes successfully! The function filemap_fault has had a ClearPageError before readpage forever. This patch simply adds the same to do_generic_file_read. Signed-off-by: Jeff Moyer <jmoyer@redhat.com> Signed-off-by: Rik van Riel <riel@redhat.com> Acked-by: Larry Woodman <lwoodman@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- mm/filemap.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/mm/filemap.c +++ b/mm/filemap.c @@ -1118,6 +1118,12 @@ page_not_up_to_date_locked: } readpage: + /* + * A previous I/O error may have been due to temporary + * failures, eg. multipath errors. + * PG_error will be set again if readpage fails. + */ + ClearPageError(page); /* Start the actual read. The read will unlock the page. */ error = mapping->a_ops->readpage(filp, page); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [11/23] ipmi: handle run_to_completion properly in deliver_recv_msg() 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (9 preceding siblings ...) 2010-07-01 17:26 ` [10/23] do_generic_file_read: clear page errors when issuing a fresh read of the page Greg KH @ 2010-07-01 17:27 ` Greg KH 2010-07-01 17:27 ` [12/23] gconfig: fix build failure on fedora 13 Greg KH ` (11 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:27 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jiri Kosina, Corey Minyard 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Jiri Kosina <jkosina@suse.cz> commit a747c5abc329611220f16df0bb4cf0ca4a7fdf0c upstream. If run_to_completion flag is set, it means that we are running in a single-threaded mode, and thus no locks are held. This fixes a deadlock when IPMI notifier is being called during panic. Signed-off-by: Jiri Kosina <jkosina@suse.cz> Acked-by: Corey Minyard <minyard@acm.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/char/ipmi/ipmi_si_intf.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) --- a/drivers/char/ipmi/ipmi_si_intf.c +++ b/drivers/char/ipmi/ipmi_si_intf.c @@ -313,9 +313,14 @@ static void deliver_recv_msg(struct smi_ { /* Deliver the message to the upper layer with the lock released. */ - spin_unlock(&(smi_info->si_lock)); - ipmi_smi_msg_received(smi_info->intf, msg); - spin_lock(&(smi_info->si_lock)); + + if (smi_info->run_to_completion) { + ipmi_smi_msg_received(smi_info->intf, msg); + } else { + spin_unlock(&(smi_info->si_lock)); + ipmi_smi_msg_received(smi_info->intf, msg); + spin_lock(&(smi_info->si_lock)); + } } static void return_hosed_msg(struct smi_info *smi_info, int cCode) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [12/23] gconfig: fix build failure on fedora 13 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (10 preceding siblings ...) 2010-07-01 17:27 ` [11/23] ipmi: handle run_to_completion properly in deliver_recv_msg() Greg KH @ 2010-07-01 17:27 ` Greg KH 2010-07-01 17:27 ` [13/23] ext4: check s_log_groups_per_flex in online resize code Greg KH ` (10 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:27 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Richard Kennedy, Michal Marek 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Richard Kennedy <richard@rsk.demon.co.uk> commit cbab05f041a4cff6ca15856bdd35238b282b64eb upstream. Making gconfig fails on fedora 13 as the linker cannot resolve dlsym. Adding libdl to the link command fixes this. make shows this error :- /usr/bin/ld: scripts/kconfig/kconfig_load.o: undefined reference to symbol 'dlsym@@GLIBC_2.2.5' /usr/bin/ld: note: 'dlsym@@GLIBC_2.2.5' is defined in DSO /lib64/libdl.so.2 so try adding it to the linker command line /lib64/libdl.so.2: could not read symbols: Invalid operation tested on x86_64 fedora 13. Signed-off-by: Richard Kennedy <richard@rsk.demon.co.uk> Reviewed-by: WANG Cong <xiyou.wangcong@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Michal Marek <mmarek@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- scripts/kconfig/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/scripts/kconfig/Makefile +++ b/scripts/kconfig/Makefile @@ -161,7 +161,7 @@ HOSTCFLAGS_zconf.tab.o := -I$(src) HOSTLOADLIBES_qconf = $(KC_QT_LIBS) -ldl HOSTCXXFLAGS_qconf.o = $(KC_QT_CFLAGS) -D LKC_DIRECT_LINK -HOSTLOADLIBES_gconf = `pkg-config --libs gtk+-2.0 gmodule-2.0 libglade-2.0` +HOSTLOADLIBES_gconf = `pkg-config --libs gtk+-2.0 gmodule-2.0 libglade-2.0` -ldl HOSTCFLAGS_gconf.o = `pkg-config --cflags gtk+-2.0 gmodule-2.0 libglade-2.0` \ -D LKC_DIRECT_LINK ^ permalink raw reply [flat|nested] 666+ messages in thread
* [13/23] ext4: check s_log_groups_per_flex in online resize code 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (11 preceding siblings ...) 2010-07-01 17:27 ` [12/23] gconfig: fix build failure on fedora 13 Greg KH @ 2010-07-01 17:27 ` Greg KH 2010-07-01 17:27 ` [14/23] ext4: Use our own write_cache_pages() Greg KH ` (9 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:27 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Eric Sandeen, Theodore Tso 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Eric Sandeen <sandeen@redhat.com> commit 42007efd569f1cf3bfb9a61da60ef6c2179508ca upstream. If groups_per_flex < 2, sbi->s_flex_groups[] doesn't get filled out, and every other access to this first tests s_log_groups_per_flex; same thing needs to happen in resize or we'll wander off into a null pointer when doing an online resize of the file system. Thanks to Christoph Biedl, who came up with the trivial testcase: # truncate --size 128M fsfile # mkfs.ext3 -F fsfile # tune2fs -O extents,uninit_bg,dir_index,flex_bg,huge_file,dir_nlink,extra_isize fsfile # e2fsck -yDf -C0 fsfile # truncate --size 132M fsfile # losetup /dev/loop0 fsfile # mount /dev/loop0 mnt # resize2fs -p /dev/loop0 https://bugzilla.kernel.org/show_bug.cgi?id=13549 Reported-by: Alessandro Polverini <alex@nibbles.it> Test-case-by: Christoph Biedl <bugzilla.kernel.bpeb@manchmal.in-ulm.de> Signed-off-by: Eric Sandeen <sandeen@redhat.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -935,7 +935,8 @@ int ext4_group_add(struct super_block *s percpu_counter_add(&sbi->s_freeinodes_counter, EXT4_INODES_PER_GROUP(sb)); - if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG)) { + if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG) && + sbi->s_log_groups_per_flex) { ext4_group_t flex_group; flex_group = ext4_flex_group(sbi, input->group); sbi->s_flex_groups[flex_group].free_blocks += ^ permalink raw reply [flat|nested] 666+ messages in thread
* [14/23] ext4: Use our own write_cache_pages() 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (12 preceding siblings ...) 2010-07-01 17:27 ` [13/23] ext4: check s_log_groups_per_flex in online resize code Greg KH @ 2010-07-01 17:27 ` Greg KH 2010-07-01 17:27 ` [15/23] ext4: Fix file fragmentation during large file write Greg KH ` (8 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:27 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Theodore Tso, Dave Chinner, Jayson R. King, Kay Diederichs, Ext4 Developers List, Aneesh Kumar K.V 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Theodore Ts'o <tytso@mit.edu> commit 8e48dcfbd7c0892b4cfd064d682cc4c95a29df32 upstream. Make a copy of write_cache_pages() for the benefit of ext4_da_writepages(). This allows us to simplify the code some, and will allow us to further customize the code in future patches. There are some nasty hacks in write_cache_pages(), which Linus has (correctly) characterized as vile. I've just copied it into write_cache_pages_da(), without trying to clean those bits up lest I break something in the ext4's delalloc implementation, which is a bit fragile right now. This will allow Dave Chinner to clean up write_cache_pages() in mm/page-writeback.c, without worrying about breaking ext4. Eventually write_cache_pages_da() will go away when I rewrite ext4's delayed allocation and create a general ext4_writepages() which is used for all of ext4's writeback. Until now this is the lowest risk way to clean up the core write_cache_pages() function. Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Cc: Dave Chinner <david@fromorbit.com> [dev@jaysonking.com: Dropped the hunks which reverted the use of no_nrwrite_index_update, since those lines weren't ever created on 2.6.27.y] [dev@jaysonking.com: Copied from 2.6.27.y's version of write_cache_pages(), plus the changes to it from patch "vfs: Add no_nrwrite_index_update writeback control flag"] Signed-off-by: Jayson R. King <dev@jaysonking.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/ext4/inode.c | 144 +++++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 132 insertions(+), 12 deletions(-) --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -2059,17 +2059,6 @@ static int __mpage_da_writepage(struct p struct buffer_head *bh, *head, fake; sector_t logical; - if (mpd->io_done) { - /* - * Rest of the page in the page_vec - * redirty then and skip then. We will - * try to to write them again after - * starting a new transaction - */ - redirty_page_for_writepage(wbc, page); - unlock_page(page); - return MPAGE_DA_EXTENT_TAIL; - } /* * Can we merge this page to current extent? */ @@ -2160,6 +2149,137 @@ static int __mpage_da_writepage(struct p } /* + * write_cache_pages_da - walk the list of dirty pages of the given + * address space and call the callback function (which usually writes + * the pages). + * + * This is a forked version of write_cache_pages(). Differences: + * Range cyclic is ignored. + * no_nrwrite_index_update is always presumed true + */ +static int write_cache_pages_da(struct address_space *mapping, + struct writeback_control *wbc, + struct mpage_da_data *mpd) +{ + struct backing_dev_info *bdi = mapping->backing_dev_info; + int ret = 0; + int done = 0; + struct pagevec pvec; + int nr_pages; + pgoff_t index; + pgoff_t end; /* Inclusive */ + long nr_to_write = wbc->nr_to_write; + + if (wbc->nonblocking && bdi_write_congested(bdi)) { + wbc->encountered_congestion = 1; + return 0; + } + + pagevec_init(&pvec, 0); + index = wbc->range_start >> PAGE_CACHE_SHIFT; + end = wbc->range_end >> PAGE_CACHE_SHIFT; + + while (!done && (index <= end)) { + int i; + + nr_pages = pagevec_lookup_tag(&pvec, mapping, &index, + PAGECACHE_TAG_DIRTY, + min(end - index, (pgoff_t)PAGEVEC_SIZE-1) + 1); + if (nr_pages == 0) + break; + + for (i = 0; i < nr_pages; i++) { + struct page *page = pvec.pages[i]; + + /* + * At this point, the page may be truncated or + * invalidated (changing page->mapping to NULL), or + * even swizzled back from swapper_space to tmpfs file + * mapping. However, page->index will not change + * because we have a reference on the page. + */ + if (page->index > end) { + done = 1; + break; + } + + lock_page(page); + + /* + * Page truncated or invalidated. We can freely skip it + * then, even for data integrity operations: the page + * has disappeared concurrently, so there could be no + * real expectation of this data interity operation + * even if there is now a new, dirty page at the same + * pagecache address. + */ + if (unlikely(page->mapping != mapping)) { +continue_unlock: + unlock_page(page); + continue; + } + + if (!PageDirty(page)) { + /* someone wrote it for us */ + goto continue_unlock; + } + + if (PageWriteback(page)) { + if (wbc->sync_mode != WB_SYNC_NONE) + wait_on_page_writeback(page); + else + goto continue_unlock; + } + + BUG_ON(PageWriteback(page)); + if (!clear_page_dirty_for_io(page)) + goto continue_unlock; + + ret = __mpage_da_writepage(page, wbc, mpd); + + if (unlikely(ret)) { + if (ret == AOP_WRITEPAGE_ACTIVATE) { + unlock_page(page); + ret = 0; + } else { + done = 1; + break; + } + } + + if (nr_to_write > 0) { + nr_to_write--; + if (nr_to_write == 0 && + wbc->sync_mode == WB_SYNC_NONE) { + /* + * We stop writing back only if we are + * not doing integrity sync. In case of + * integrity sync we have to keep going + * because someone may be concurrently + * dirtying pages, and we might have + * synced a lot of newly appeared dirty + * pages, but have not synced all of the + * old dirty pages. + */ + done = 1; + break; + } + } + + if (wbc->nonblocking && bdi_write_congested(bdi)) { + wbc->encountered_congestion = 1; + done = 1; + break; + } + } + pagevec_release(&pvec); + cond_resched(); + } + return ret; +} + + +/* * mpage_da_writepages - walk the list of dirty pages of the given * address space, allocates non-allocated blocks, maps newly-allocated * blocks to existing bhs and issue IO them @@ -2192,7 +2312,7 @@ static int mpage_da_writepages(struct ad to_write = wbc->nr_to_write; - ret = write_cache_pages(mapping, wbc, __mpage_da_writepage, mpd); + ret = write_cache_pages_da(mapping, wbc, mpd); /* * Handle last extent of pages ^ permalink raw reply [flat|nested] 666+ messages in thread
* [15/23] ext4: Fix file fragmentation during large file write. 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (13 preceding siblings ...) 2010-07-01 17:27 ` [14/23] ext4: Use our own write_cache_pages() Greg KH @ 2010-07-01 17:27 ` Greg KH 2010-07-01 17:27 ` [16/23] ext4: Implement range_cyclic in ext4_da_writepages instead of write_cache_pages Greg KH ` (7 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:27 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jayson R. King, Theodore Tso, Aneesh Kumar K.V, Dave Chinner, Ext4 Developers List, Kay Diederichs 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> commit 22208dedbd7626e5fc4339c417f8d24cc21f79d7 upstream. The range_cyclic writeback mode uses the address_space writeback_index as the start index for writeback. With delayed allocation we were updating writeback_index wrongly resulting in highly fragmented file. This patch reduces the number of extents reduced from 4000 to 27 for a 3GB file. Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu> [dev@jaysonking.com: Some changed lines from the original version of this patch were dropped, since they were rolled up with another cherry-picked patch applied to 2.6.27.y earlier.] [dev@jaysonking.com: Use of wbc->no_nrwrite_index_update was dropped, since write_cache_pages_da() implies it.] Signed-off-by: Jayson R. King <dev@jaysonking.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/ext4/inode.c | 79 ++++++++++++++++++++++++++++++++------------------------ 1 file changed, 46 insertions(+), 33 deletions(-) --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -1721,7 +1721,11 @@ static int mpage_da_submit_io(struct mpa pages_skipped = mpd->wbc->pages_skipped; err = mapping->a_ops->writepage(page, mpd->wbc); - if (!err) + if (!err && (pages_skipped == mpd->wbc->pages_skipped)) + /* + * have successfully written the page + * without skipping the same + */ mpd->pages_written++; /* * In error case, we have to continue because @@ -2295,7 +2299,6 @@ static int mpage_da_writepages(struct ad struct writeback_control *wbc, struct mpage_da_data *mpd) { - long to_write; int ret; if (!mpd->get_block) @@ -2310,19 +2313,18 @@ static int mpage_da_writepages(struct ad mpd->pages_written = 0; mpd->retval = 0; - to_write = wbc->nr_to_write; - ret = write_cache_pages_da(mapping, wbc, mpd); - /* * Handle last extent of pages */ if (!mpd->io_done && mpd->next_page != mpd->first_page) { if (mpage_da_map_blocks(mpd) == 0) mpage_da_submit_io(mpd); - } - wbc->nr_to_write = to_write - mpd->pages_written; + mpd->io_done = 1; + ret = MPAGE_DA_EXTENT_TAIL; + } + wbc->nr_to_write -= mpd->pages_written; return ret; } @@ -2567,11 +2569,13 @@ static int ext4_da_writepages_trans_bloc static int ext4_da_writepages(struct address_space *mapping, struct writeback_control *wbc) { + pgoff_t index; + int range_whole = 0; handle_t *handle = NULL; struct mpage_da_data mpd; struct inode *inode = mapping->host; + long pages_written = 0, pages_skipped; int needed_blocks, ret = 0, nr_to_writebump = 0; - long to_write, pages_skipped = 0; struct ext4_sb_info *sbi = EXT4_SB(mapping->host->i_sb); /* @@ -2605,16 +2609,20 @@ static int ext4_da_writepages(struct add nr_to_writebump = sbi->s_mb_stream_request - wbc->nr_to_write; wbc->nr_to_write = sbi->s_mb_stream_request; } + if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX) + range_whole = 1; - - pages_skipped = wbc->pages_skipped; + if (wbc->range_cyclic) + index = mapping->writeback_index; + else + index = wbc->range_start >> PAGE_CACHE_SHIFT; mpd.wbc = wbc; mpd.inode = mapping->host; -restart_loop: - to_write = wbc->nr_to_write; - while (!ret && to_write > 0) { + pages_skipped = wbc->pages_skipped; + + while (!ret && wbc->nr_to_write > 0) { /* * we insert one extent at a time. So we need @@ -2647,46 +2655,51 @@ restart_loop: goto out_writepages; } } - to_write -= wbc->nr_to_write; - mpd.get_block = ext4_da_get_block_write; ret = mpage_da_writepages(mapping, wbc, &mpd); ext4_journal_stop(handle); - if (mpd.retval == -ENOSPC) + if (mpd.retval == -ENOSPC) { + /* commit the transaction which would + * free blocks released in the transaction + * and try again + */ jbd2_journal_force_commit_nested(sbi->s_journal); - - /* reset the retry count */ - if (ret == MPAGE_DA_EXTENT_TAIL) { + wbc->pages_skipped = pages_skipped; + ret = 0; + } else if (ret == MPAGE_DA_EXTENT_TAIL) { /* * got one extent now try with * rest of the pages */ - to_write += wbc->nr_to_write; + pages_written += mpd.pages_written; + wbc->pages_skipped = pages_skipped; ret = 0; - } else if (wbc->nr_to_write) { + } else if (wbc->nr_to_write) /* * There is no more writeout needed * or we requested for a noblocking writeout * and we found the device congested */ - to_write += wbc->nr_to_write; break; - } - wbc->nr_to_write = to_write; - } - - if (!wbc->range_cyclic && (pages_skipped != wbc->pages_skipped)) { - /* We skipped pages in this loop */ - wbc->nr_to_write = to_write + - wbc->pages_skipped - pages_skipped; - wbc->pages_skipped = pages_skipped; - goto restart_loop; } + if (pages_skipped != wbc->pages_skipped) + printk(KERN_EMERG "This should not happen leaving %s " + "with nr_to_write = %ld ret = %d\n", + __func__, wbc->nr_to_write, ret); + + /* Update index */ + index += pages_written; + if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0)) + /* + * set the writeback_index so that range_cyclic + * mode will write it back later + */ + mapping->writeback_index = index; out_writepages: - wbc->nr_to_write = to_write - nr_to_writebump; + wbc->nr_to_write -= nr_to_writebump; return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [16/23] ext4: Implement range_cyclic in ext4_da_writepages instead of write_cache_pages 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (14 preceding siblings ...) 2010-07-01 17:27 ` [15/23] ext4: Fix file fragmentation during large file write Greg KH @ 2010-07-01 17:27 ` Greg KH 2010-07-01 17:27 ` [17/23] sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4) Greg KH ` (6 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:27 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Theodore Tso, Dave Chinner, Jayson R. King, Kay Diederichs, Ext4 Developers List, Aneesh Kumar K.V 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> commit 2acf2c261b823d9d9ed954f348b97620297a36b5 upstream. With delayed allocation we lock the page in write_cache_pages() and try to build an in memory extent of contiguous blocks. This is needed so that we can get large contiguous blocks request. If range_cyclic mode is enabled, write_cache_pages() will loop back to the 0 index if no I/O has been done yet, and try to start writing from the beginning of the range. That causes an attempt to take the page lock of lower index page while holding the page lock of higher index page, which can cause a dead lock with another writeback thread. The solution is to implement the range_cyclic behavior in ext4_da_writepages() instead. http://bugzilla.kernel.org/show_bug.cgi?id=12579 Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Signed-off-by: Jayson R. King <dev@jaysonking.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/ext4/inode.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -2575,6 +2575,7 @@ static int ext4_da_writepages(struct add struct mpage_da_data mpd; struct inode *inode = mapping->host; long pages_written = 0, pages_skipped; + int range_cyclic, cycled = 1, io_done = 0; int needed_blocks, ret = 0, nr_to_writebump = 0; struct ext4_sb_info *sbi = EXT4_SB(mapping->host->i_sb); @@ -2612,9 +2613,15 @@ static int ext4_da_writepages(struct add if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX) range_whole = 1; - if (wbc->range_cyclic) + range_cyclic = wbc->range_cyclic; + if (wbc->range_cyclic) { index = mapping->writeback_index; - else + if (index) + cycled = 0; + wbc->range_start = index << PAGE_CACHE_SHIFT; + wbc->range_end = LLONG_MAX; + wbc->range_cyclic = 0; + } else index = wbc->range_start >> PAGE_CACHE_SHIFT; mpd.wbc = wbc; @@ -2622,6 +2629,7 @@ static int ext4_da_writepages(struct add pages_skipped = wbc->pages_skipped; +retry: while (!ret && wbc->nr_to_write > 0) { /* @@ -2676,6 +2684,7 @@ static int ext4_da_writepages(struct add pages_written += mpd.pages_written; wbc->pages_skipped = pages_skipped; ret = 0; + io_done = 1; } else if (wbc->nr_to_write) /* * There is no more writeout needed @@ -2684,6 +2693,13 @@ static int ext4_da_writepages(struct add */ break; } + if (!io_done && !cycled) { + cycled = 1; + index = 0; + wbc->range_start = index << PAGE_CACHE_SHIFT; + wbc->range_end = mapping->writeback_index - 1; + goto retry; + } if (pages_skipped != wbc->pages_skipped) printk(KERN_EMERG "This should not happen leaving %s " "with nr_to_write = %ld ret = %d\n", @@ -2691,6 +2707,7 @@ static int ext4_da_writepages(struct add /* Update index */ index += pages_written; + wbc->range_cyclic = range_cyclic; if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0)) /* * set the writeback_index so that range_cyclic ^ permalink raw reply [flat|nested] 666+ messages in thread
* [17/23] sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4) 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (15 preceding siblings ...) 2010-07-01 17:27 ` [16/23] ext4: Implement range_cyclic in ext4_da_writepages instead of write_cache_pages Greg KH @ 2010-07-01 17:27 ` Greg KH 2010-07-01 17:27 ` [18/23] vfs: add NOFOLLOW flag to umount(2) Greg KH ` (5 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:27 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Neil Horman, Vlad Yasevich, David S. Miller 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Neil Horman <nhorman@tuxdriver.com> commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809 upstream. Ok, version 4 Change Notes: 1) Minor cleanups, from Vlads notes Summary: Hey- Recently, it was reported to me that the kernel could oops in the following way: <5> kernel BUG at net/core/skbuff.c:91! <5> invalid operand: 0000 [#1] <5> Modules linked in: sctp netconsole nls_utf8 autofs4 sunrpc iptable_filter ip_tables cpufreq_powersave parport_pc lp parport vmblock(U) vsock(U) vmci(U) vmxnet(U) vmmemctl(U) vmhgfs(U) acpiphp dm_mirror dm_mod button battery ac md5 ipv6 uhci_hcd ehci_hcd snd_ens1371 snd_rawmidi snd_seq_device snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc snd_ac97_codec snd soundcore pcnet32 mii floppy ext3 jbd ata_piix libata mptscsih mptsas mptspi mptscsi mptbase sd_mod scsi_mod <5> CPU: 0 <5> EIP: 0060:[<c02bff27>] Not tainted VLI <5> EFLAGS: 00010216 (2.6.9-89.0.25.EL) <5> EIP is at skb_over_panic+0x1f/0x2d <5> eax: 0000002c ebx: c033f461 ecx: c0357d96 edx: c040fd44 <5> esi: c033f461 edi: df653280 ebp: 00000000 esp: c040fd40 <5> ds: 007b es: 007b ss: 0068 <5> Process swapper (pid: 0, threadinfo=c040f000 task=c0370be0) <5> Stack: c0357d96 e0c29478 00000084 00000004 c033f461 df653280 d7883180 e0c2947d <5> 00000000 00000080 df653490 00000004 de4f1ac0 de4f1ac0 00000004 df653490 <5> 00000001 e0c2877a 08000800 de4f1ac0 df653490 00000000 e0c29d2e 00000004 <5> Call Trace: <5> [<e0c29478>] sctp_addto_chunk+0xb0/0x128 [sctp] <5> [<e0c2947d>] sctp_addto_chunk+0xb5/0x128 [sctp] <5> [<e0c2877a>] sctp_init_cause+0x3f/0x47 [sctp] <5> [<e0c29d2e>] sctp_process_unk_param+0xac/0xb8 [sctp] <5> [<e0c29e90>] sctp_verify_init+0xcc/0x134 [sctp] <5> [<e0c20322>] sctp_sf_do_5_1B_init+0x83/0x28e [sctp] <5> [<e0c25333>] sctp_do_sm+0x41/0x77 [sctp] <5> [<c01555a4>] cache_grow+0x140/0x233 <5> [<e0c26ba1>] sctp_endpoint_bh_rcv+0xc5/0x108 [sctp] <5> [<e0c2b863>] sctp_inq_push+0xe/0x10 [sctp] <5> [<e0c34600>] sctp_rcv+0x454/0x509 [sctp] <5> [<e084e017>] ipt_hook+0x17/0x1c [iptable_filter] <5> [<c02d005e>] nf_iterate+0x40/0x81 <5> [<c02e0bb9>] ip_local_deliver_finish+0x0/0x151 <5> [<c02e0c7f>] ip_local_deliver_finish+0xc6/0x151 <5> [<c02d0362>] nf_hook_slow+0x83/0xb5 <5> [<c02e0bb2>] ip_local_deliver+0x1a2/0x1a9 <5> [<c02e0bb9>] ip_local_deliver_finish+0x0/0x151 <5> [<c02e103e>] ip_rcv+0x334/0x3b4 <5> [<c02c66fd>] netif_receive_skb+0x320/0x35b <5> [<e0a0928b>] init_stall_timer+0x67/0x6a [uhci_hcd] <5> [<c02c67a4>] process_backlog+0x6c/0xd9 <5> [<c02c690f>] net_rx_action+0xfe/0x1f8 <5> [<c012a7b1>] __do_softirq+0x35/0x79 <5> [<c0107efb>] handle_IRQ_event+0x0/0x4f <5> [<c01094de>] do_softirq+0x46/0x4d Its an skb_over_panic BUG halt that results from processing an init chunk in which too many of its variable length parameters are in some way malformed. The problem is in sctp_process_unk_param: if (NULL == *errp) *errp = sctp_make_op_error_space(asoc, chunk, ntohs(chunk->chunk_hdr->length)); if (*errp) { sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM, WORD_ROUND(ntohs(param.p->length))); sctp_addto_chunk(*errp, WORD_ROUND(ntohs(param.p->length)), param.v); When we allocate an error chunk, we assume that the worst case scenario requires that we have chunk_hdr->length data allocated, which would be correct nominally, given that we call sctp_addto_chunk for the violating parameter. Unfortunately, we also, in sctp_init_cause insert a sctp_errhdr_t structure into the error chunk, so the worst case situation in which all parameters are in violation requires chunk_hdr->length+(sizeof(sctp_errhdr_t)*param_count) bytes of data. The result of this error is that a deliberately malformed packet sent to a listening host can cause a remote DOS, described in CVE-2010-1173: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-1173 I've tested the below fix and confirmed that it fixes the issue. We move to a strategy whereby we allocate a fixed size error chunk and ignore errors we don't have space to report. Tested by me successfully Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- include/net/sctp/structs.h | 1 net/sctp/sm_make_chunk.c | 62 +++++++++++++++++++++++++++++++++++++++++---- 2 files changed, 58 insertions(+), 5 deletions(-) --- a/include/net/sctp/structs.h +++ b/include/net/sctp/structs.h @@ -753,6 +753,7 @@ int sctp_user_addto_chunk(struct sctp_ch struct iovec *data); void sctp_chunk_free(struct sctp_chunk *); void *sctp_addto_chunk(struct sctp_chunk *, int len, const void *data); +void *sctp_addto_chunk_fixed(struct sctp_chunk *, int len, const void *data); struct sctp_chunk *sctp_chunkify(struct sk_buff *, const struct sctp_association *, struct sock *); --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -107,7 +107,7 @@ static const struct sctp_paramhdr prsctp __constant_htons(sizeof(struct sctp_paramhdr)), }; -/* A helper to initialize to initialize an op error inside a +/* A helper to initialize an op error inside a * provided chunk, as most cause codes will be embedded inside an * abort chunk. */ @@ -124,6 +124,29 @@ void sctp_init_cause(struct sctp_chunk chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err); } +/* A helper to initialize an op error inside a + * provided chunk, as most cause codes will be embedded inside an + * abort chunk. Differs from sctp_init_cause in that it won't oops + * if there isn't enough space in the op error chunk + */ +int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code, + size_t paylen) +{ + sctp_errhdr_t err; + __u16 len; + + /* Cause code constants are now defined in network order. */ + err.cause = cause_code; + len = sizeof(sctp_errhdr_t) + paylen; + err.length = htons(len); + + if (skb_tailroom(chunk->skb) > len) + return -ENOSPC; + chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk, + sizeof(sctp_errhdr_t), + &err); + return 0; +} /* 3.3.2 Initiation (INIT) (1) * * This chunk is used to initiate a SCTP association between two @@ -1114,6 +1137,24 @@ nodata: return retval; } +/* Create an Operation Error chunk of a fixed size, + * specifically, max(asoc->pathmtu, SCTP_DEFAULT_MAXSEGMENT) + * This is a helper function to allocate an error chunk for + * for those invalid parameter codes in which we may not want + * to report all the errors, if the incomming chunk is large + */ +static inline struct sctp_chunk *sctp_make_op_error_fixed( + const struct sctp_association *asoc, + const struct sctp_chunk *chunk) +{ + size_t size = asoc ? asoc->pathmtu : 0; + + if (!size) + size = SCTP_DEFAULT_MAXSEGMENT; + + return sctp_make_op_error_space(asoc, chunk, size); +} + /* Create an Operation Error chunk. */ struct sctp_chunk *sctp_make_op_error(const struct sctp_association *asoc, const struct sctp_chunk *chunk, @@ -1354,6 +1395,18 @@ void *sctp_addto_chunk(struct sctp_chunk return target; } +/* Append bytes to the end of a chunk. Returns NULL if there isn't sufficient + * space in the chunk + */ +void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk, + int len, const void *data) +{ + if (skb_tailroom(chunk->skb) > len) + return sctp_addto_chunk(chunk, len, data); + else + return NULL; +} + /* Append bytes from user space to the end of a chunk. Will panic if * chunk is not big enough. * Returns a kernel err value. @@ -1957,13 +2010,12 @@ static sctp_ierror_t sctp_process_unk_pa * returning multiple unknown parameters. */ if (NULL == *errp) - *errp = sctp_make_op_error_space(asoc, chunk, - ntohs(chunk->chunk_hdr->length)); + *errp = sctp_make_op_error_fixed(asoc, chunk); if (*errp) { - sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM, + sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM, WORD_ROUND(ntohs(param.p->length))); - sctp_addto_chunk(*errp, + sctp_addto_chunk_fixed(*errp, WORD_ROUND(ntohs(param.p->length)), param.v); } else { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [18/23] vfs: add NOFOLLOW flag to umount(2) 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (16 preceding siblings ...) 2010-07-01 17:27 ` [17/23] sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4) Greg KH @ 2010-07-01 17:27 ` Greg KH 2010-07-01 17:27 ` [19/23] tipc: Fix oops on send prior to entering networked mode (v3) Greg KH ` (4 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:27 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Eugene Teo, Michael Kerrisk, Miklos Szeredi, Al Viro 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Miklos Szeredi <mszeredi@suse.cz> commit db1f05bb85d7966b9176e293f3ceead1cb8b5d79 upstream. Add a new UMOUNT_NOFOLLOW flag to umount(2). This is needed to prevent symlink attacks in unprivileged unmounts (fuse, samba, ncpfs). Additionally, return -EINVAL if an unknown flag is used (and specify an explicitly unused flag: UMOUNT_UNUSED). This makes it possible for the caller to determine if a flag is supported or not. CC: Eugene Teo <eugene@redhat.com> CC: Michael Kerrisk <mtk.manpages@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/namespace.c | 9 ++++++++- include/linux/fs.h | 2 ++ 2 files changed, 10 insertions(+), 1 deletion(-) --- a/fs/namespace.c +++ b/fs/namespace.c @@ -1132,8 +1132,15 @@ SYSCALL_DEFINE2(umount, char __user *, n { struct path path; int retval; + int lookup_flags = 0; - retval = user_path(name, &path); + if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW)) + return -EINVAL; + + if (!(flags & UMOUNT_NOFOLLOW)) + lookup_flags |= LOOKUP_FOLLOW; + + retval = user_path_at(AT_FDCWD, name, lookup_flags, &path); if (retval) goto out; retval = -EINVAL; --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1061,6 +1061,8 @@ extern int send_sigurg(struct fown_struc #define MNT_FORCE 0x00000001 /* Attempt to forcibily umount */ #define MNT_DETACH 0x00000002 /* Just detach from the tree */ #define MNT_EXPIRE 0x00000004 /* Mark for expiry */ +#define UMOUNT_NOFOLLOW 0x00000008 /* Don't follow symlink on umount */ +#define UMOUNT_UNUSED 0x80000000 /* Flag guaranteed to be unused */ extern struct list_head super_blocks; extern spinlock_t sb_lock; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [19/23] tipc: Fix oops on send prior to entering networked mode (v3) 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (17 preceding siblings ...) 2010-07-01 17:27 ` [18/23] vfs: add NOFOLLOW flag to umount(2) Greg KH @ 2010-07-01 17:27 ` Greg KH 2010-07-01 17:27 ` [20/23] parisc: clear floating point exception flag on SIGFPE signal Greg KH ` (3 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:27 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Neil Horman, Allan Stephens, David S. Miller, tipc-discussion 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Neil Horman <nhorman@tuxdriver.com> commit d0021b252eaf65ca07ed14f0d66425dd9ccab9a6 upstream. Fix TIPC to disallow sending to remote addresses prior to entering NET_MODE user programs can oops the kernel by sending datagrams via AF_TIPC prior to entering networked mode. The following backtrace has been observed: ID: 13459 TASK: ffff810014640040 CPU: 0 COMMAND: "tipc-client" [exception RIP: tipc_node_select_next_hop+90] RIP: ffffffff8869d3c3 RSP: ffff81002d9a5ab8 RFLAGS: 00010202 RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000001001001 RBP: 0000000001001001 R8: 0074736575716552 R9: 0000000000000000 R10: ffff81003fbd0680 R11: 00000000000000c8 R12: 0000000000000008 R13: 0000000000000001 R14: 0000000000000001 R15: ffff810015c6ca00 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 RIP: 0000003cbd8d49a3 RSP: 00007fffc84e0be8 RFLAGS: 00010206 RAX: 000000000000002c RBX: ffffffff8005d116 RCX: 0000000000000000 RDX: 0000000000000008 RSI: 00007fffc84e0c00 RDI: 0000000000000003 RBP: 0000000000000000 R8: 00007fffc84e0c10 R9: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffc84e0d10 R14: 0000000000000000 R15: 00007fffc84e0c30 ORIG_RAX: 000000000000002c CS: 0033 SS: 002b What happens is that, when the tipc module in inserted it enters a standalone node mode in which communication to its own address is allowed <0.0.0> but not to other addresses, since the appropriate data structures have not been allocated yet (specifically the tipc_net pointer). There is nothing stopping a client from trying to send such a message however, and if that happens, we attempt to dereference tipc_net.zones while the pointer is still NULL, and explode. The fix is pretty straightforward. Since these oopses all arise from the dereference of global pointers prior to their assignment to allocated values, and since these allocations are small (about 2k total), lets convert these pointers to static arrays of the appropriate size. All the accesses to these bits consider 0/NULL to be a non match when searching, so all the lookups still work properly, and there is no longer a chance of a bad dererence anywhere. As a bonus, this lets us eliminate the setup/teardown routines for those pointers, and elimnates the need to preform any locking around them to prevent access while their being allocated/freed. I've updated the tipc_net structure to behave this way to fix the exact reported problem, and also fixed up the tipc_bearers and media_list arrays to fix an obvious simmilar problem that arises from issuing tipc-config commands to manipulate bearers/links prior to entering networked mode I've tested this for a few hours by running the sanity tests and stress test with the tipcutils suite, and nothing has fallen over. There have been a few lockdep warnings, but those were there before, and can be addressed later, as they didn't actually result in any deadlock. Signed-off-by: Neil Horman <nhorman@tuxdriver.com> CC: Allan Stephens <allan.stephens@windriver.com> CC: David S. Miller <davem@davemloft.net> CC: tipc-discussion@lists.sourceforge.net Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/tipc/bearer.c | 37 ++++++------------------------------- net/tipc/bearer.h | 2 +- net/tipc/net.c | 25 ++++--------------------- 3 files changed, 11 insertions(+), 53 deletions(-) --- a/net/tipc/bearer.c +++ b/net/tipc/bearer.c @@ -45,10 +45,10 @@ #define MAX_ADDR_STR 32 -static struct media *media_list = NULL; +static struct media media_list[MAX_MEDIA]; static u32 media_count = 0; -struct bearer *tipc_bearers = NULL; +struct bearer tipc_bearers[MAX_BEARERS]; /** * media_name_valid - validate media name @@ -108,9 +108,11 @@ int tipc_register_media(u32 media_type, int res = -EINVAL; write_lock_bh(&tipc_net_lock); - if (!media_list) - goto exit; + if (tipc_mode != TIPC_NET_MODE) { + warn("Media <%s> rejected, not in networked mode yet\n", name); + goto exit; + } if (!media_name_valid(name)) { warn("Media <%s> rejected, illegal name\n", name); goto exit; @@ -660,33 +662,10 @@ int tipc_disable_bearer(const char *name -int tipc_bearer_init(void) -{ - int res; - - write_lock_bh(&tipc_net_lock); - tipc_bearers = kcalloc(MAX_BEARERS, sizeof(struct bearer), GFP_ATOMIC); - media_list = kcalloc(MAX_MEDIA, sizeof(struct media), GFP_ATOMIC); - if (tipc_bearers && media_list) { - res = 0; - } else { - kfree(tipc_bearers); - kfree(media_list); - tipc_bearers = NULL; - media_list = NULL; - res = -ENOMEM; - } - write_unlock_bh(&tipc_net_lock); - return res; -} - void tipc_bearer_stop(void) { u32 i; - if (!tipc_bearers) - return; - for (i = 0; i < MAX_BEARERS; i++) { if (tipc_bearers[i].active) tipc_bearers[i].publ.blocked = 1; @@ -695,10 +674,6 @@ void tipc_bearer_stop(void) if (tipc_bearers[i].active) bearer_disable(tipc_bearers[i].publ.name); } - kfree(tipc_bearers); - kfree(media_list); - tipc_bearers = NULL; - media_list = NULL; media_count = 0; } --- a/net/tipc/bearer.h +++ b/net/tipc/bearer.h @@ -114,7 +114,7 @@ struct bearer_name { struct link; -extern struct bearer *tipc_bearers; +extern struct bearer tipc_bearers[]; void tipc_media_addr_printf(struct print_buf *pb, struct tipc_media_addr *a); struct sk_buff *tipc_media_get_names(void); --- a/net/tipc/net.c +++ b/net/tipc/net.c @@ -116,7 +116,8 @@ */ DEFINE_RWLOCK(tipc_net_lock); -struct network tipc_net = { NULL }; +struct _zone *tipc_zones[256] = { NULL, }; +struct network tipc_net = { tipc_zones }; struct tipc_node *tipc_net_select_remote_node(u32 addr, u32 ref) { @@ -158,28 +159,12 @@ void tipc_net_send_external_routes(u32 d } } -static int net_init(void) -{ - memset(&tipc_net, 0, sizeof(tipc_net)); - tipc_net.zones = kcalloc(tipc_max_zones + 1, sizeof(struct _zone *), GFP_ATOMIC); - if (!tipc_net.zones) { - return -ENOMEM; - } - return 0; -} - static void net_stop(void) { u32 z_num; - if (!tipc_net.zones) - return; - - for (z_num = 1; z_num <= tipc_max_zones; z_num++) { + for (z_num = 1; z_num <= tipc_max_zones; z_num++) tipc_zone_delete(tipc_net.zones[z_num]); - } - kfree(tipc_net.zones); - tipc_net.zones = NULL; } static void net_route_named_msg(struct sk_buff *buf) @@ -282,9 +267,7 @@ int tipc_net_start(u32 addr) tipc_named_reinit(); tipc_port_reinit(); - if ((res = tipc_bearer_init()) || - (res = net_init()) || - (res = tipc_cltr_init()) || + if ((res = tipc_cltr_init()) || (res = tipc_bclink_init())) { return res; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [20/23] parisc: clear floating point exception flag on SIGFPE signal 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (18 preceding siblings ...) 2010-07-01 17:27 ` [19/23] tipc: Fix oops on send prior to entering networked mode (v3) Greg KH @ 2010-07-01 17:27 ` Greg KH 2010-07-01 17:27 ` [21/23] KEYS: Return more accurate error codes Greg KH ` (2 subsequent siblings) 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:27 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Helge Deller, Kyle McMartin 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Helge Deller <deller@gmx.de> commit 550f0d922286556c7ea43974bb7921effb5a5278 upstream. Clear the floating point exception flag before returning to user space. This is needed, else the libc trampoline handler may hit the same SIGFPE again while building up a trampoline to a signal handler. Fixes debian bug #559406. Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Kyle McMartin <kyle@mcmartin.ca> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/parisc/math-emu/decode_exc.c | 1 + 1 file changed, 1 insertion(+) --- a/arch/parisc/math-emu/decode_exc.c +++ b/arch/parisc/math-emu/decode_exc.c @@ -342,6 +342,7 @@ decode_fpu(unsigned int Fpu_register[], return SIGNALCODE(SIGFPE, FPE_FLTINV); case DIVISIONBYZEROEXCEPTION: update_trap_counts(Fpu_register, aflags, bflags, trap_counts); + Clear_excp_register(exception_index); return SIGNALCODE(SIGFPE, FPE_FLTDIV); case INEXACTEXCEPTION: update_trap_counts(Fpu_register, aflags, bflags, trap_counts); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [21/23] KEYS: Return more accurate error codes 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (19 preceding siblings ...) 2010-07-01 17:27 ` [20/23] parisc: clear floating point exception flag on SIGFPE signal Greg KH @ 2010-07-01 17:27 ` Greg KH 2010-07-01 17:27 ` [22/23] KEYS: find_keyring_by_name() can gain access to a freed keyring Greg KH 2010-07-01 17:27 ` [23/23] sctp: fix append error cause to ERROR chunk correctly Greg KH 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:27 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dan Carpenter, David Howells, James Morris 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Dan Carpenter <error27@gmail.com> commit 4d09ec0f705cf88a12add029c058b53f288cfaa2 upstream. We were using the wrong variable here so the error codes weren't being returned properly. The original code returns -ENOKEY. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <jmorris@namei.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- a/security/keys/process_keys.c +++ b/security/keys/process_keys.c @@ -508,7 +508,7 @@ try_again: ret = install_thread_keyring(); if (ret < 0) { - key = ERR_PTR(ret); + key_ref = ERR_PTR(ret); goto error; } goto reget_creds; @@ -526,7 +526,7 @@ try_again: ret = install_process_keyring(); if (ret < 0) { - key = ERR_PTR(ret); + key_ref = ERR_PTR(ret); goto error; } goto reget_creds; @@ -585,7 +585,7 @@ try_again: case KEY_SPEC_GROUP_KEYRING: /* group keyrings are not yet supported */ - key = ERR_PTR(-EINVAL); + key_ref = ERR_PTR(-EINVAL); goto error; case KEY_SPEC_REQKEY_AUTH_KEY: ^ permalink raw reply [flat|nested] 666+ messages in thread
* [22/23] KEYS: find_keyring_by_name() can gain access to a freed keyring 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (20 preceding siblings ...) 2010-07-01 17:27 ` [21/23] KEYS: Return more accurate error codes Greg KH @ 2010-07-01 17:27 ` Greg KH 2010-07-01 17:27 ` [23/23] sctp: fix append error cause to ERROR chunk correctly Greg KH 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:27 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, David Howells, Serge Hallyn, James Morris, Ben Hutchings, Chuck Ebbert 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Toshiyuki Okajima <toshi.okajima@jp.fujitsu.com> commit cea7daa3589d6b550546a8c8963599f7c1a3ae5c upstream. find_keyring_by_name() can gain access to a keyring that has had its reference count reduced to zero, and is thus ready to be freed. This then allows the dead keyring to be brought back into use whilst it is being destroyed. The following timeline illustrates the process: |(cleaner) (user) | | free_user(user) sys_keyctl() | | | | key_put(user->session_keyring) keyctl_get_keyring_ID() | || //=> keyring->usage = 0 | | |schedule_work(&key_cleanup_task) lookup_user_key() | || | | kmem_cache_free(,user) | | . |[KEY_SPEC_USER_KEYRING] | . install_user_keyrings() | . || | key_cleanup() [<= worker_thread()] || | | || | [spin_lock(&key_serial_lock)] |[mutex_lock(&key_user_keyr..mutex)] | | || | atomic_read() == 0 || | |{ rb_ease(&key->serial_node,) } || | | || | [spin_unlock(&key_serial_lock)] |find_keyring_by_name() | | ||| | keyring_destroy(keyring) ||[read_lock(&keyring_name_lock)] | || ||| | |[write_lock(&keyring_name_lock)] ||atomic_inc(&keyring->usage) | |. ||| *** GET freeing keyring *** | |. ||[read_unlock(&keyring_name_lock)] | || || | |list_del() |[mutex_unlock(&key_user_k..mutex)] | || | | |[write_unlock(&keyring_name_lock)] ** INVALID keyring is returned ** | | . | kmem_cache_free(,keyring) . | . | atomic_dec(&keyring->usage) v *** DESTROYED *** TIME If CONFIG_SLUB_DEBUG=y then we may see the following message generated: ============================================================================= BUG key_jar: Poison overwritten ----------------------------------------------------------------------------- INFO: 0xffff880197a7e200-0xffff880197a7e200. First byte 0x6a instead of 0x6b INFO: Allocated in key_alloc+0x10b/0x35f age=25 cpu=1 pid=5086 INFO: Freed in key_cleanup+0xd0/0xd5 age=12 cpu=1 pid=10 INFO: Slab 0xffffea000592cb90 objects=16 used=2 fp=0xffff880197a7e200 flags=0x200000000000c3 INFO: Object 0xffff880197a7e200 @offset=512 fp=0xffff880197a7e300 Bytes b4 0xffff880197a7e1f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ Object 0xffff880197a7e200: 6a 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b jkkkkkkkkkkkkkkk Alternatively, we may see a system panic happen, such as: BUG: unable to handle kernel NULL pointer dereference at 0000000000000001 IP: [<ffffffff810e61a3>] kmem_cache_alloc+0x5b/0xe9 PGD 6b2b4067 PUD 6a80d067 PMD 0 Oops: 0000 [#1] SMP last sysfs file: /sys/kernel/kexec_crash_loaded CPU 1 ... Pid: 31245, comm: su Not tainted 2.6.34-rc5-nofixed-nodebug #2 D2089/PRIMERGY RIP: 0010:[<ffffffff810e61a3>] [<ffffffff810e61a3>] kmem_cache_alloc+0x5b/0xe9 RSP: 0018:ffff88006af3bd98 EFLAGS: 00010002 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88007d19900b RDX: 0000000100000000 RSI: 00000000000080d0 RDI: ffffffff81828430 RBP: ffffffff81828430 R08: ffff88000a293750 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000100000 R12: 00000000000080d0 R13: 00000000000080d0 R14: 0000000000000296 R15: ffffffff810f20ce FS: 00007f97116bc700(0000) GS:ffff88000a280000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000001 CR3: 000000006a91c000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process su (pid: 31245, threadinfo ffff88006af3a000, task ffff8800374414c0) Stack: 0000000512e0958e 0000000000008000 ffff880037f8d180 0000000000000001 0000000000000000 0000000000008001 ffff88007d199000 ffffffff810f20ce 0000000000008000 ffff88006af3be48 0000000000000024 ffffffff810face3 Call Trace: [<ffffffff810f20ce>] ? get_empty_filp+0x70/0x12f [<ffffffff810face3>] ? do_filp_open+0x145/0x590 [<ffffffff810ce208>] ? tlb_finish_mmu+0x2a/0x33 [<ffffffff810ce43c>] ? unmap_region+0xd3/0xe2 [<ffffffff810e4393>] ? virt_to_head_page+0x9/0x2d [<ffffffff81103916>] ? alloc_fd+0x69/0x10e [<ffffffff810ef4ed>] ? do_sys_open+0x56/0xfc [<ffffffff81008a02>] ? system_call_fastpath+0x16/0x1b Code: 0f 1f 44 00 00 49 89 c6 fa 66 0f 1f 44 00 00 65 4c 8b 04 25 60 e8 00 00 48 8b 45 00 49 01 c0 49 8b 18 48 85 db 74 0d 48 63 45 18 <48> 8b 04 03 49 89 00 eb 14 4c 89 f9 83 ca ff 44 89 e6 48 89 ef RIP [<ffffffff810e61a3>] kmem_cache_alloc+0x5b/0xe9 This problem is that find_keyring_by_name does not confirm that the keyring is valid before accepting it. Skipping keyrings that have been reduced to a zero count seems the way to go. To this end, use atomic_inc_not_zero() to increment the usage count and skip the candidate keyring if that returns false. The following script _may_ cause the bug to happen, but there's no guarantee as the window of opportunity is small: #!/bin/sh LOOP=100000 USER=dummy_user /bin/su -c "exit;" $USER || { /usr/sbin/adduser -m $USER; add=1; } for ((i=0; i<LOOP; i++)) do /bin/su -c "echo '$i' > /dev/null" $USER done (( add == 1 )) && /usr/sbin/userdel -r $USER exit Note that the nominated user must not be in use. An alternative way of testing this may be: for ((i=0; i<100000; i++)) do keyctl session foo /bin/true || break done >&/dev/null as that uses a keyring named "foo" rather than relying on the user and user-session named keyrings. Reported-by: Toshiyuki Okajima <toshi.okajima@jp.fujitsu.com> Signed-off-by: David Howells <dhowells@redhat.com> Tested-by: Toshiyuki Okajima <toshi.okajima@jp.fujitsu.com> Acked-by: Serge Hallyn <serue@us.ibm.com> Signed-off-by: James Morris <jmorris@namei.org> Cc: Ben Hutchings <ben@decadent.org.uk> Cc: Chuck Ebbert <cebbert@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- security/keys/keyring.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) --- a/security/keys/keyring.c +++ b/security/keys/keyring.c @@ -523,9 +523,8 @@ struct key *find_keyring_by_name(const c struct key *keyring; int bucket; - keyring = ERR_PTR(-EINVAL); if (!name) - goto error; + return ERR_PTR(-EINVAL); bucket = keyring_hash(name); @@ -549,17 +548,18 @@ struct key *find_keyring_by_name(const c KEY_SEARCH) < 0) continue; - /* we've got a match */ - atomic_inc(&keyring->usage); - read_unlock(&keyring_name_lock); - goto error; + /* we've got a match but we might end up racing with + * key_cleanup() if the keyring is currently 'dead' + * (ie. it has a zero usage count) */ + if (!atomic_inc_not_zero(&keyring->usage)) + continue; + goto out; } } - read_unlock(&keyring_name_lock); keyring = ERR_PTR(-ENOKEY); - - error: +out: + read_unlock(&keyring_name_lock); return keyring; } /* end find_keyring_by_name() */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [23/23] sctp: fix append error cause to ERROR chunk correctly 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH ` (21 preceding siblings ...) 2010-07-01 17:27 ` [22/23] KEYS: find_keyring_by_name() can gain access to a freed keyring Greg KH @ 2010-07-01 17:27 ` Greg KH 22 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:27 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Wei Yongjun, Vlad Yasevich, David S. Miller 2.6.27-stable review patch. If anyone has any objections, please let us know. ------------------ From: Wei Yongjun <yjwei@cn.fujitsu.com> commit 2e3219b5c8a2e44e0b83ae6e04f52f20a82ac0f2 upstream. commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809 sctp: Fix skb_over_panic resulting from multiple invalid \ parameter errors (CVE-2010-1173) (v4) cause 'error cause' never be add the the ERROR chunk due to some typo when check valid length in sctp_init_cause_fixed(). Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Reviewed-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/sctp/sm_make_chunk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -140,7 +140,7 @@ int sctp_init_cause_fixed(struct sctp_ch len = sizeof(sctp_errhdr_t) + paylen; err.length = htons(len); - if (skb_tailroom(chunk->skb) > len) + if (skb_tailroom(chunk->skb) < len) return -ENOSPC; chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk, sizeof(sctp_errhdr_t), @@ -1401,7 +1401,7 @@ void *sctp_addto_chunk(struct sctp_chunk void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk, int len, const void *data) { - if (skb_tailroom(chunk->skb) > len) + if (skb_tailroom(chunk->skb) >= len) return sctp_addto_chunk(chunk, len, data); else return NULL; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 000/149] 2.6.32.16 stable review 2010-07-01 17:51 4 -stable kernel review cycles starting Greg KH 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH @ 2010-07-01 17:51 ` Greg KH 2010-07-01 17:30 ` [patch 001/149] oprofile/x86: fix uninitialized counter usage during cpu hotplug Greg KH ` (148 more replies) 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (2 subsequent siblings) 4 siblings, 149 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:51 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan This is the start of the stable review cycle for the 2.6.32.16 release. There are 149 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. If anyone is a maintainer of the proper subsystem, and wants to add a Signed-off-by: line to the patch, please respond with it. Responses should be made by Sat, July 3, 17:00:00 UTC UTC. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.32.16-rc1.gz and the diffstat can be found below. thanks, greg k-h Documentation/hwmon/ltc4245 | 4 +- Documentation/networking/3c509.txt | 12 +- Makefile | 2 +- arch/arm/common/sa1111.c | 9 +- arch/arm/mm/copypage-feroceon.c | 4 +- arch/arm/mm/copypage-v4wb.c | 4 +- arch/arm/mm/copypage-v4wt.c | 4 +- arch/arm/mm/copypage-xsc3.c | 4 +- arch/arm/mm/fault.c | 3 + arch/arm/mm/init.c | 6 +- arch/arm/vfp/vfphw.S | 2 +- arch/blackfin/include/asm/cache.h | 2 + arch/frv/include/asm/cache.h | 2 + arch/m68k/include/asm/cache.h | 2 + arch/mn10300/include/asm/cache.h | 2 + arch/parisc/math-emu/decode_exc.c | 1 + arch/powerpc/kvm/powerpc.c | 3 +- arch/powerpc/lib/string.S | 4 +- arch/powerpc/oprofile/op_model_cell.c | 2 +- arch/powerpc/platforms/pseries/smp.c | 6 + arch/s390/kvm/kvm-s390.c | 4 +- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/include/asm/msr-index.h | 5 +- arch/x86/kernel/amd_iommu.c | 2 +- arch/x86/kernel/cpu/perf_event.c | 5 +- arch/x86/kernel/pvclock.c | 24 +++ arch/x86/kernel/setup.c | 11 ++ arch/x86/kernel/tboot.c | 1 + arch/x86/kvm/mmu.c | 10 +- arch/x86/kvm/vmx.c | 32 +++-- arch/x86/kvm/x86.c | 55 ++++--- arch/x86/oprofile/nmi_int.c | 10 +- arch/x86/xen/suspend.c | 4 +- arch/xtensa/include/asm/cache.h | 1 + drivers/acpi/video_detect.c | 2 +- drivers/ata/libata-core.c | 7 +- drivers/ata/libata-sff.c | 2 +- drivers/ata/sata_nv.c | 5 +- drivers/ata/sata_via.c | 13 ++ drivers/base/cpu.c | 2 +- drivers/char/ipmi/ipmi_si_intf.c | 11 +- drivers/clocksource/sh_cmt.c | 21 ++- drivers/firewire/core-card.c | 24 +++- drivers/gpu/drm/drm_edid.c | 2 +- drivers/gpu/drm/i915/i915_gem.c | 19 +++ drivers/gpu/drm/i915/intel_lvds.c | 4 + drivers/gpu/drm/radeon/radeon_atombios.c | 2 +- drivers/gpu/drm/radeon/radeon_cp.c | 1 + drivers/gpu/drm/radeon/radeon_drv.h | 2 + drivers/gpu/drm/radeon/radeon_state.c | 7 + drivers/hid/hid-core.c | 1 + drivers/hid/hid-gyration.c | 1 + drivers/hid/hid-ids.h | 1 + drivers/hwmon/ltc4245.c | 18 +-- drivers/input/mouse/psmouse-base.c | 14 ++- drivers/md/dm-exception-store.h | 2 +- drivers/md/md.c | 29 ++++ drivers/md/raid1.c | 9 +- drivers/md/raid10.c | 2 +- drivers/media/video/gspca/stv06xx/stv06xx.c | 2 - drivers/net/arcnet/com20020-pci.c | 4 +- drivers/net/atl1e/atl1e_ethtool.c | 2 + drivers/net/can/sja1000/sja1000.c | 20 ++- drivers/net/can/sja1000/sja1000.h | 1 + drivers/net/mlx4/icm.c | 3 +- drivers/net/pppol2tp.c | 3 +- drivers/net/tulip/Kconfig | 4 + drivers/net/tulip/dmfe.c | 21 +++ drivers/net/tulip/tulip_core.c | 32 +++- drivers/net/ucc_geth.c | 12 +- drivers/net/via-velocity.c | 8 +- drivers/net/virtio_net.c | 3 +- drivers/net/wireless/ath/ar9170/hw.h | 1 + drivers/net/wireless/ath/ar9170/main.c | 2 +- drivers/net/wireless/ath/ar9170/usb.c | 10 ++ drivers/net/wireless/ath/ath5k/base.c | 4 +- drivers/net/wireless/ath/ath9k/hw.c | 7 +- drivers/net/wireless/ath/ath9k/hw.h | 1 + drivers/net/wireless/ath/ath9k/main.c | 4 +- drivers/net/wireless/ath/ath9k/pci.c | 1 + drivers/net/wireless/iwlwifi/iwl-5000.c | 23 +++- drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 24 +++- drivers/net/wireless/iwlwifi/iwl-agn.c | 74 +++++++-- drivers/net/wireless/iwlwifi/iwl-dev.h | 3 +- drivers/net/wireless/iwlwifi/iwl-tx.c | 18 ++- drivers/net/wireless/p54/p54usb.c | 1 + drivers/net/wireless/rtl818x/rtl8180_dev.c | 1 + drivers/net/wireless/wl12xx/wl1251_sdio.c | 1 + drivers/oprofile/cpu_buffer.c | 63 ++------ drivers/pci/quirks.c | 14 ++- drivers/rtc/rtc-cmos.c | 5 +- drivers/rtc/rtc-s3c.c | 5 +- drivers/scsi/qla2xxx/qla_isr.c | 28 ++-- drivers/staging/comedi/drivers/ni_mio_cs.c | 2 +- drivers/staging/rtl8192su/r8192U_core.c | 1 + drivers/staging/vt6655/device_main.c | 2 + drivers/usb/class/cdc-acm.c | 6 +- drivers/usb/gadget/fsl_udc_core.c | 2 +- drivers/usb/host/ehci-hub.c | 17 ++ drivers/usb/host/xhci-hcd.c | 54 ++++++- drivers/usb/host/xhci-ring.c | 37 ++++- drivers/usb/serial/cp210x.c | 11 ++ drivers/usb/serial/ftdi_sio.c | 4 + drivers/usb/serial/ir-usb.c | 2 + drivers/usb/serial/kl5kusb105.c | 1 + drivers/usb/serial/kobil_sct.c | 3 +- drivers/usb/serial/mos7840.c | 1 - drivers/usb/serial/option.c | 226 +++++++++++++++++++++++++++ drivers/usb/serial/visor.c | 1 + drivers/usb/storage/unusual_devs.h | 15 ++ drivers/xen/xenbus/xenbus_xs.c | 2 +- fs/btrfs/acl.c | 3 + fs/cifs/cifsproto.h | 6 +- fs/cifs/dir.c | 20 ++- fs/cifs/file.c | 11 +- fs/exofs/dir.c | 2 +- fs/ext4/move_extent.c | 3 + fs/ext4/resize.c | 3 +- fs/fs-writeback.c | 14 ++- fs/gfs2/file.c | 7 + fs/jbd/journal.c | 2 +- fs/jbd2/journal.c | 3 +- fs/libfs.c | 3 +- fs/namespace.c | 9 +- fs/nfsd/nfssvc.c | 2 +- include/linux/fs.h | 4 +- include/linux/pci_ids.h | 1 + include/linux/swap.h | 10 -- include/linux/tboot.h | 1 + include/net/sctp/structs.h | 1 + kernel/compat.c | 25 ++-- kernel/mutex.c | 7 + kernel/perf_event.c | 40 +++-- kernel/posix-timers.c | 11 +- kernel/signal.c | 6 +- mm/filemap.c | 10 +- mm/hugetlb.c | 2 +- net/mac80211/Kconfig | 9 + net/mac80211/rx.c | 3 +- net/mac80211/tx.c | 5 +- net/sctp/sm_make_chunk.c | 62 +++++++- net/tipc/bearer.c | 37 +---- net/tipc/bearer.h | 2 +- net/tipc/net.c | 25 +--- net/wireless/core.h | 2 + net/wireless/nl80211.c | 37 +---- net/wireless/util.c | 33 ++++ net/wireless/wext-compat.c | 5 +- security/keys/keyring.c | 18 +- security/keys/process_keys.c | 6 +- sound/pci/hda/hda_intel.c | 11 +- sound/pci/hda/patch_realtek.c | 1 + sound/pci/hda/patch_sigmatel.c | 2 +- sound/soc/codecs/wm8350.c | 4 +- sound/soc/codecs/wm8400.c | 18 +- sound/soc/codecs/wm8990.c | 18 +- 156 files changed, 1251 insertions(+), 489 deletions(-) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 001/149] oprofile/x86: fix uninitialized counter usage during cpu hotplug 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 002/149] oprofile: remove double ring buffering Greg KH ` (147 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andi Kleen, Robert Richter 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Robert Richter <robert.richter@amd.com> commit 2623a1d55a6260c855e1f6d1895900b50b40a896 upstream. This fixes a NULL pointer dereference that is triggered when taking a cpu offline after oprofile was initialized, e.g.: $ opcontrol --init $ opcontrol --start-daemon $ opcontrol --shutdown $ opcontrol --deinit $ echo 0 > /sys/devices/system/cpu/cpu1/online See the crash dump below. Though the counter has been disabled the cpu notifier is still active and trying to use already freed counter data. This fix is for linux-stable. To proper fix this, the hotplug code must be rewritten. Thus I will leave a WARN_ON_ONCE() message with this patch. BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff8132ad57>] op_amd_stop+0x2d/0x8e PGD 0 Oops: 0000 [#1] SMP last sysfs file: /sys/devices/system/cpu/cpu1/online CPU 1 Modules linked in: Pid: 0, comm: swapper Not tainted 2.6.34-rc5-oprofile-x86_64-standard-00210-g8c00f06 #16 Anaheim/Anaheim RIP: 0010:[<ffffffff8132ad57>] [<ffffffff8132ad57>] op_amd_stop+0x2d/0x8e RSP: 0018:ffff880001843f28 EFLAGS: 00010006 RAX: 0000000000000000 RBX: 0000000000000000 RCX: dead000000200200 RDX: ffff880001843f68 RSI: dead000000100100 RDI: 0000000000000000 RBP: ffff880001843f48 R08: 0000000000000000 R09: ffff880001843f08 R10: ffffffff8102c9a5 R11: ffff88000184ea80 R12: 0000000000000000 R13: ffff88000184f6c0 R14: 0000000000000000 R15: 0000000000000000 FS: 00007fec6a92e6f0(0000) GS:ffff880001840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000000 CR3: 000000000163b000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process swapper (pid: 0, threadinfo ffff88042fcd8000, task ffff88042fcd51d0) Stack: ffff880001843f48 0000000000000001 ffff88042e9f7d38 ffff880001843f68 <0> ffff880001843f58 ffffffff8132a602 ffff880001843f98 ffffffff810521b3 <0> ffff880001843f68 ffff880001843f68 ffff880001843f88 ffff88042fcd9fd8 Call Trace: <IRQ> [<ffffffff8132a602>] nmi_cpu_stop+0x21/0x23 [<ffffffff810521b3>] generic_smp_call_function_single_interrupt+0xdf/0x11b [<ffffffff8101804f>] smp_call_function_single_interrupt+0x22/0x31 [<ffffffff810029f3>] call_function_single_interrupt+0x13/0x20 <EOI> [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff81008701>] ? default_idle+0x22/0x37 [<ffffffff8100896d>] c1e_idle+0xdf/0xe6 [<ffffffff813f1170>] ? atomic_notifier_call_chain+0x13/0x15 [<ffffffff810012fb>] cpu_idle+0x4b/0x7e [<ffffffff813e8a4e>] start_secondary+0x1ae/0x1b2 Code: 89 e5 41 55 49 89 fd 41 54 45 31 e4 53 31 db 48 83 ec 08 89 df e8 be f8 ff ff 48 98 48 83 3c c5 10 67 7a 81 00 74 1f 49 8b 45 08 <42> 8b 0c 20 0f 32 48 c1 e2 20 25 ff ff bf ff 48 09 d0 48 89 c2 RIP [<ffffffff8132ad57>] op_amd_stop+0x2d/0x8e RSP <ffff880001843f28> CR2: 0000000000000000 ---[ end trace 679ac372d674b757 ]--- Kernel panic - not syncing: Fatal exception in interrupt Pid: 0, comm: swapper Tainted: G D 2.6.34-rc5-oprofile-x86_64-standard-00210-g8c00f06 #16 Call Trace: <IRQ> [<ffffffff813ebd6a>] panic+0x9e/0x10c [<ffffffff810474b0>] ? up+0x34/0x39 [<ffffffff81031ccc>] ? kmsg_dump+0x112/0x12c [<ffffffff813eeff1>] oops_end+0x81/0x8e [<ffffffff8101efee>] no_context+0x1f3/0x202 [<ffffffff8101f1b7>] __bad_area_nosemaphore+0x1ba/0x1e0 [<ffffffff81028d24>] ? enqueue_task_fair+0x16d/0x17a [<ffffffff810264dc>] ? activate_task+0x42/0x53 [<ffffffff8102c967>] ? try_to_wake_up+0x272/0x284 [<ffffffff8101f1eb>] bad_area_nosemaphore+0xe/0x10 [<ffffffff813f0f3f>] do_page_fault+0x1c8/0x37c [<ffffffff81028d24>] ? enqueue_task_fair+0x16d/0x17a [<ffffffff813ee55f>] page_fault+0x1f/0x30 [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff8132ad57>] ? op_amd_stop+0x2d/0x8e [<ffffffff8132ad46>] ? op_amd_stop+0x1c/0x8e [<ffffffff8132a602>] nmi_cpu_stop+0x21/0x23 [<ffffffff810521b3>] generic_smp_call_function_single_interrupt+0xdf/0x11b [<ffffffff8101804f>] smp_call_function_single_interrupt+0x22/0x31 [<ffffffff810029f3>] call_function_single_interrupt+0x13/0x20 <EOI> [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff81008701>] ? default_idle+0x22/0x37 [<ffffffff8100896d>] c1e_idle+0xdf/0xe6 [<ffffffff813f1170>] ? atomic_notifier_call_chain+0x13/0x15 [<ffffffff810012fb>] cpu_idle+0x4b/0x7e [<ffffffff813e8a4e>] start_secondary+0x1ae/0x1b2 ------------[ cut here ]------------ WARNING: at /local/rrichter/.source/linux/arch/x86/kernel/smp.c:118 native_smp_send_reschedule+0x27/0x53() Hardware name: Anaheim Modules linked in: Pid: 0, comm: swapper Tainted: G D 2.6.34-rc5-oprofile-x86_64-standard-00210-g8c00f06 #16 Call Trace: <IRQ> [<ffffffff81017f32>] ? native_smp_send_reschedule+0x27/0x53 [<ffffffff81030ee2>] warn_slowpath_common+0x77/0xa4 [<ffffffff81030f1e>] warn_slowpath_null+0xf/0x11 [<ffffffff81017f32>] native_smp_send_reschedule+0x27/0x53 [<ffffffff8102634b>] resched_task+0x60/0x62 [<ffffffff8102653a>] check_preempt_curr_idle+0x10/0x12 [<ffffffff8102c8ea>] try_to_wake_up+0x1f5/0x284 [<ffffffff8102c986>] default_wake_function+0xd/0xf [<ffffffff810a110d>] pollwake+0x57/0x5a [<ffffffff8102c979>] ? default_wake_function+0x0/0xf [<ffffffff81026be5>] __wake_up_common+0x46/0x75 [<ffffffff81026ed0>] __wake_up+0x38/0x50 [<ffffffff81031694>] printk_tick+0x39/0x3b [<ffffffff8103ac37>] update_process_times+0x3f/0x5c [<ffffffff8104dc63>] tick_periodic+0x5d/0x69 [<ffffffff8104dc90>] tick_handle_periodic+0x21/0x71 [<ffffffff81018fd0>] smp_apic_timer_interrupt+0x82/0x95 [<ffffffff81002853>] apic_timer_interrupt+0x13/0x20 [<ffffffff81030cb5>] ? panic_blink_one_second+0x0/0x7b [<ffffffff813ebdd6>] ? panic+0x10a/0x10c [<ffffffff810474b0>] ? up+0x34/0x39 [<ffffffff81031ccc>] ? kmsg_dump+0x112/0x12c [<ffffffff813eeff1>] ? oops_end+0x81/0x8e [<ffffffff8101efee>] ? no_context+0x1f3/0x202 [<ffffffff8101f1b7>] ? __bad_area_nosemaphore+0x1ba/0x1e0 [<ffffffff81028d24>] ? enqueue_task_fair+0x16d/0x17a [<ffffffff810264dc>] ? activate_task+0x42/0x53 [<ffffffff8102c967>] ? try_to_wake_up+0x272/0x284 [<ffffffff8101f1eb>] ? bad_area_nosemaphore+0xe/0x10 [<ffffffff813f0f3f>] ? do_page_fault+0x1c8/0x37c [<ffffffff81028d24>] ? enqueue_task_fair+0x16d/0x17a [<ffffffff813ee55f>] ? page_fault+0x1f/0x30 [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff8132ad57>] ? op_amd_stop+0x2d/0x8e [<ffffffff8132ad46>] ? op_amd_stop+0x1c/0x8e [<ffffffff8132a602>] ? nmi_cpu_stop+0x21/0x23 [<ffffffff810521b3>] ? generic_smp_call_function_single_interrupt+0xdf/0x11b [<ffffffff8101804f>] ? smp_call_function_single_interrupt+0x22/0x31 [<ffffffff810029f3>] ? call_function_single_interrupt+0x13/0x20 <EOI> [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff81008701>] ? default_idle+0x22/0x37 [<ffffffff8100896d>] ? c1e_idle+0xdf/0xe6 [<ffffffff813f1170>] ? atomic_notifier_call_chain+0x13/0x15 [<ffffffff810012fb>] ? cpu_idle+0x4b/0x7e [<ffffffff813e8a4e>] ? start_secondary+0x1ae/0x1b2 ---[ end trace 679ac372d674b758 ]--- Cc: Andi Kleen <andi@firstfloor.org> Signed-off-by: Robert Richter <robert.richter@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/oprofile/nmi_int.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) --- a/arch/x86/oprofile/nmi_int.c +++ b/arch/x86/oprofile/nmi_int.c @@ -95,7 +95,10 @@ static void nmi_cpu_save_registers(struc static void nmi_cpu_start(void *dummy) { struct op_msrs const *msrs = &__get_cpu_var(cpu_msrs); - model->start(msrs); + if (!msrs->controls) + WARN_ON_ONCE(1); + else + model->start(msrs); } static int nmi_start(void) @@ -107,7 +110,10 @@ static int nmi_start(void) static void nmi_cpu_stop(void *dummy) { struct op_msrs const *msrs = &__get_cpu_var(cpu_msrs); - model->stop(msrs); + if (!msrs->controls) + WARN_ON_ONCE(1); + else + model->stop(msrs); } static void nmi_stop(void) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 002/149] oprofile: remove double ring buffering 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH 2010-07-01 17:30 ` [patch 001/149] oprofile/x86: fix uninitialized counter usage during cpu hotplug Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 003/149] cpumask: fix compat getaffinity Greg KH ` (146 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andi Kleen, Steven Rostedt, Robert Richter 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Andi Kleen <andi@firstfloor.org> commit cb6e943ccf19ab6d3189147e9d625a992e016084 upstream. oprofile used a double buffer scheme for its cpu event buffer to avoid races on reading with the old locked ring buffer. But that is obsolete now with the new ring buffer, so simply use a single buffer. This greatly simplifies the code and avoids a lot of sample drops on large runs, especially with call graph. Based on suggestions from Steven Rostedt For stable kernels from v2.6.32, but not earlier. Signed-off-by: Andi Kleen <ak@linux.intel.com> Cc: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Robert Richter <robert.richter@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/oprofile/cpu_buffer.c | 63 ++++++++---------------------------------- 1 file changed, 13 insertions(+), 50 deletions(-) --- a/drivers/oprofile/cpu_buffer.c +++ b/drivers/oprofile/cpu_buffer.c @@ -30,23 +30,7 @@ #define OP_BUFFER_FLAGS 0 -/* - * Read and write access is using spin locking. Thus, writing to the - * buffer by NMI handler (x86) could occur also during critical - * sections when reading the buffer. To avoid this, there are 2 - * buffers for independent read and write access. Read access is in - * process context only, write access only in the NMI handler. If the - * read buffer runs empty, both buffers are swapped atomically. There - * is potentially a small window during swapping where the buffers are - * disabled and samples could be lost. - * - * Using 2 buffers is a little bit overhead, but the solution is clear - * and does not require changes in the ring buffer implementation. It - * can be changed to a single buffer solution when the ring buffer - * access is implemented as non-locking atomic code. - */ -static struct ring_buffer *op_ring_buffer_read; -static struct ring_buffer *op_ring_buffer_write; +static struct ring_buffer *op_ring_buffer; DEFINE_PER_CPU(struct oprofile_cpu_buffer, cpu_buffer); static void wq_sync_buffer(struct work_struct *work); @@ -69,12 +53,9 @@ void oprofile_cpu_buffer_inc_smpl_lost(v void free_cpu_buffers(void) { - if (op_ring_buffer_read) - ring_buffer_free(op_ring_buffer_read); - op_ring_buffer_read = NULL; - if (op_ring_buffer_write) - ring_buffer_free(op_ring_buffer_write); - op_ring_buffer_write = NULL; + if (op_ring_buffer) + ring_buffer_free(op_ring_buffer); + op_ring_buffer = NULL; } #define RB_EVENT_HDR_SIZE 4 @@ -87,11 +68,8 @@ int alloc_cpu_buffers(void) unsigned long byte_size = buffer_size * (sizeof(struct op_sample) + RB_EVENT_HDR_SIZE); - op_ring_buffer_read = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS); - if (!op_ring_buffer_read) - goto fail; - op_ring_buffer_write = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS); - if (!op_ring_buffer_write) + op_ring_buffer = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS); + if (!op_ring_buffer) goto fail; for_each_possible_cpu(i) { @@ -163,16 +141,11 @@ struct op_sample *op_cpu_buffer_write_reserve(struct op_entry *entry, unsigned long size) { entry->event = ring_buffer_lock_reserve - (op_ring_buffer_write, sizeof(struct op_sample) + + (op_ring_buffer, sizeof(struct op_sample) + size * sizeof(entry->sample->data[0])); - if (entry->event) - entry->sample = ring_buffer_event_data(entry->event); - else - entry->sample = NULL; - - if (!entry->sample) + if (!entry->event) return NULL; - + entry->sample = ring_buffer_event_data(entry->event); entry->size = size; entry->data = entry->sample->data; @@ -181,25 +154,16 @@ struct op_sample int op_cpu_buffer_write_commit(struct op_entry *entry) { - return ring_buffer_unlock_commit(op_ring_buffer_write, entry->event); + return ring_buffer_unlock_commit(op_ring_buffer, entry->event); } struct op_sample *op_cpu_buffer_read_entry(struct op_entry *entry, int cpu) { struct ring_buffer_event *e; - e = ring_buffer_consume(op_ring_buffer_read, cpu, NULL); - if (e) - goto event; - if (ring_buffer_swap_cpu(op_ring_buffer_read, - op_ring_buffer_write, - cpu)) + e = ring_buffer_consume(op_ring_buffer, cpu, NULL); + if (!e) return NULL; - e = ring_buffer_consume(op_ring_buffer_read, cpu, NULL); - if (e) - goto event; - return NULL; -event: entry->event = e; entry->sample = ring_buffer_event_data(e); entry->size = (ring_buffer_event_length(e) - sizeof(struct op_sample)) @@ -210,8 +174,7 @@ event: unsigned long op_cpu_buffer_entries(int cpu) { - return ring_buffer_entries_cpu(op_ring_buffer_read, cpu) - + ring_buffer_entries_cpu(op_ring_buffer_write, cpu); + return ring_buffer_entries_cpu(op_ring_buffer, cpu); } static int ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 003/149] cpumask: fix compat getaffinity 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH 2010-07-01 17:30 ` [patch 001/149] oprofile/x86: fix uninitialized counter usage during cpu hotplug Greg KH 2010-07-01 17:30 ` [patch 002/149] oprofile: remove double ring buffering Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 004/149] NFSD: dont report compiled-out versions as present Greg KH ` (145 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, KOSAKI Motohiro, Rusty Russell, Arnd Bergmann, Andi Kleen 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> commit fa9dc265ace9774e62f0e31108e5f47911124bda upstream. Commit a45185d2d "cpumask: convert kernel/compat.c" broke libnuma, which abuses sched_getaffinity to find out NR_CPUS in order to parse /sys/devices/system/node/node*/cpumap. On NUMA systems with less than 32 possibly CPUs, the current compat_sys_sched_getaffinity now returns '4' instead of the actual NR_CPUS/8, which makes libnuma bail out when parsing the cpumap. The libnuma call sched_getaffinity(0, bitmap, 4096) at first. It mean the libnuma expect the return value of sched_getaffinity() is either len argument or NR_CPUS. But it doesn't expect to return nr_cpu_ids. Strictly speaking, userland requirement are 1) Glibc assume the return value mean the lengh of initialized of mask argument. E.g. if sched_getaffinity(1024) return 128, glibc make zero fill rest 896 byte. 2) Libnuma assume the return value can be used to guess NR_CPUS in kernel. It assume len-arg<NR_CPUS makes -EINVAL. But it try len=4096 at first and 4096 is always bigger than NR_CPUS. Then, if we remove strange min_length normalization, we never hit -EINVAL case. sched_getaffinity() already solved this issue. This patch adapts compat_sys_sched_getaffinity() to match the non-compat case. Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Acked-by: Rusty Russell <rusty@rustcorp.com.au> Acked-by: Arnd Bergmann <arnd@arndb.de> Reported-by: Ken Werner <ken.werner@web.de> Cc: Andi Kleen <andi@firstfloor.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/compat.c | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) --- a/kernel/compat.c +++ b/kernel/compat.c @@ -494,29 +494,26 @@ asmlinkage long compat_sys_sched_getaffi { int ret; cpumask_var_t mask; - unsigned long *k; - unsigned int min_length = cpumask_size(); - if (nr_cpu_ids <= BITS_PER_COMPAT_LONG) - min_length = sizeof(compat_ulong_t); - - if (len < min_length) + if ((len * BITS_PER_BYTE) < nr_cpu_ids) + return -EINVAL; + if (len & (sizeof(compat_ulong_t)-1)) return -EINVAL; if (!alloc_cpumask_var(&mask, GFP_KERNEL)) return -ENOMEM; ret = sched_getaffinity(pid, mask); - if (ret < 0) - goto out; + if (ret == 0) { + size_t retlen = min_t(size_t, len, cpumask_size()); - k = cpumask_bits(mask); - ret = compat_put_bitmap(user_mask_ptr, k, min_length * 8); - if (ret == 0) - ret = min_length; - -out: + if (compat_put_bitmap(user_mask_ptr, cpumask_bits(mask), retlen * 8)) + ret = -EFAULT; + else + ret = retlen; + } free_cpumask_var(mask); + return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 004/149] NFSD: dont report compiled-out versions as present 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (2 preceding siblings ...) 2010-07-01 17:30 ` [patch 003/149] cpumask: fix compat getaffinity Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 005/149] sata_nv: use ata_pci_sff_activate_host() instead of ata_host_activate() Greg KH ` (144 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Pavel Emelyanov, NeilBrown, J. Bruce Fields 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Pavel Emelyanov <xemul@openvz.org> commit 15ddb4aec54422ead137b03ea4e9b3f5db3f7cc2 upstream. The /proc/fs/nfsd/versions file calls nfsd_vers() to check whether the particular nfsd version is present/available. The problem is that once I turn off e.g. NFSD-V4 this call returns -1 which is true from the callers POV which is wrong. The proposal is to report false in that case. The bug has existed since 6658d3a7bbfd1768 "[PATCH] knfsd: remove nfsd_versbits as intermediate storage for desired versions". Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: NeilBrown <neilb@suse.de> Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/nfsd/nfssvc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/nfsd/nfssvc.c +++ b/fs/nfsd/nfssvc.c @@ -136,7 +136,7 @@ u32 nfsd_supported_minorversion; int nfsd_vers(int vers, enum vers_op change) { if (vers < NFSD_MINVERS || vers >= NFSD_NRVERS) - return -1; + return 0; switch(change) { case NFSD_SET: nfsd_versions[vers] = nfsd_version[vers]; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 005/149] sata_nv: use ata_pci_sff_activate_host() instead of ata_host_activate() 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (3 preceding siblings ...) 2010-07-01 17:30 ` [patch 004/149] NFSD: dont report compiled-out versions as present Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 006/149] ARCNET: Limit com20020 PCI ID matches for SOHARD cards Greg KH ` (143 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Robert Hancock, Jeff Garzik 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Tejun Heo <tj@kernel.org> commit 95cc2c70c139936a2142bcd583da8af6f9d88efb upstream. sata_nv was incorrectly using ata_host_activate() instead of ata_pci_sff_activate_host() leading to IRQ assignment failure in legacy mode. Fix it. Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Robert Hancock <hancockr@shaw.ca> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/sata_nv.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/drivers/ata/sata_nv.c +++ b/drivers/ata/sata_nv.c @@ -2478,8 +2478,7 @@ static int nv_init_one(struct pci_dev *p } pci_set_master(pdev); - return ata_host_activate(host, pdev->irq, ipriv->irq_handler, - IRQF_SHARED, ipriv->sht); + return ata_pci_sff_activate_host(host, ipriv->irq_handler, ipriv->sht); } #ifdef CONFIG_PM ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 006/149] ARCNET: Limit com20020 PCI ID matches for SOHARD cards 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (4 preceding siblings ...) 2010-07-01 17:30 ` [patch 005/149] sata_nv: use ata_pci_sff_activate_host() instead of ata_host_activate() Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 007/149] rtl8180: fix tx status reporting Greg KH ` (142 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andreas Bombe, David S. Miller 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Andreas Bombe <aeb@debian.org> commit e7971c80a8e0299f91272ad8e8ac4167623e1862 upstream. The SH SOHARD ARCNET cards are implemented using generic PLX Technology PCI<->IOBus bridges. Subvendor and subdevice IDs were not specified, causing the driver to attach to any such bridge and likely crash the system by attempting to initialize an unrelated device. Fix by specifying subvendor and subdevice according to the values found in the PCI-ID Repository at http://pci-ids.ucw.cz/ . Signed-off-by: Andreas Bombe <aeb@debian.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/arcnet/com20020-pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/arcnet/com20020-pci.c +++ b/drivers/net/arcnet/com20020-pci.c @@ -165,8 +165,8 @@ static struct pci_device_id com20020pci_ { 0x1571, 0xa204, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, { 0x1571, 0xa205, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, { 0x1571, 0xa206, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, - { 0x10B5, 0x9030, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, - { 0x10B5, 0x9050, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, + { 0x10B5, 0x9030, 0x10B5, 0x2978, 0, 0, ARC_CAN_10MBIT }, + { 0x10B5, 0x9050, 0x10B5, 0x2273, 0, 0, ARC_CAN_10MBIT }, { 0x14BA, 0x6000, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, { 0x10B5, 0x2200, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, {0,} ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 007/149] rtl8180: fix tx status reporting 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (5 preceding siblings ...) 2010-07-01 17:30 ` [patch 006/149] ARCNET: Limit com20020 PCI ID matches for SOHARD cards Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 008/149] Staging: add Add Sitecom WL-349 to rtl8192su Greg KH ` (141 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, John W. Linville 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: John W. Linville <linville@tuxdriver.com> commit d989ff7cf8d14f1b523f63ba0bf2ec1a9b7c25bc upstream. When reporting Tx status, indicate that only one rate was used. Otherwise, the rate is frozen at rate index 0 (i.e. 1Mb/s). Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/rtl818x/rtl8180_dev.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/wireless/rtl818x/rtl8180_dev.c +++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c @@ -190,6 +190,7 @@ static void rtl8180_handle_tx(struct iee info->flags |= IEEE80211_TX_STAT_ACK; info->status.rates[0].count = (flags & 0xFF) + 1; + info->status.rates[1].idx = -1; ieee80211_tx_status_irqsafe(dev, skb); if (ring->entries - skb_queue_len(&ring->queue) == 2) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 008/149] Staging: add Add Sitecom WL-349 to rtl8192su 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (6 preceding siblings ...) 2010-07-01 17:30 ` [patch 007/149] rtl8180: fix tx status reporting Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 009/149] staging: vt6655: Fix kernel BUG on driver wpa initialization Greg KH ` (140 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Rodrigo Linfati 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Rodrigo Linfati <rodrigo@linfati.cl> commit 64a5a09218626464be35e0229d85b2ab0fcf03fd upstream. Add usb id of Sitecom WL-349 to rtl8192su Signed-off-by: Rodrigo Linfati <rodrigo@linfati.cl> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/staging/rtl8192su/r8192U_core.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/staging/rtl8192su/r8192U_core.c +++ b/drivers/staging/rtl8192su/r8192U_core.c @@ -120,6 +120,7 @@ static struct usb_device_id rtl8192_usb_ {USB_DEVICE(0x050d, 0x805E)}, /* Sitecom */ {USB_DEVICE(0x0df6, 0x0031)}, + {USB_DEVICE(0x0df6, 0x004b)}, /* WL-349 */ /* EnGenius */ {USB_DEVICE(0x1740, 0x9201)}, /* Dlink */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 009/149] staging: vt6655: Fix kernel BUG on driver wpa initialization 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (7 preceding siblings ...) 2010-07-01 17:30 ` [patch 008/149] Staging: add Add Sitecom WL-349 to rtl8192su Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 010/149] Fix racy use of anon_inode_getfd() in perf_event.c Greg KH ` (139 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Larry Finger 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Larry Finger <Larry.Finger@lwfinger.net> commit f65515275ea3e45fdcd0fb78455f542d6fdca086 upstream. In http://bugzilla.novell.com/show_bug.cgi?id=597299, the vt6655 driver generates a kernel BUG on a NULL pointer dereference at NULL. This problem has been traced to a failure in the wpa_set_wpadev() routine. As the vt6656 driver does not call this routine, the vt6655 code is similarly set to skip the call. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Tested-by: Richard Meek <osl2008@googlemail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/staging/vt6655/device_main.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/staging/vt6655/device_main.c +++ b/drivers/staging/vt6655/device_main.c @@ -1089,11 +1089,13 @@ device_found1(struct pci_dev *pcid, cons } //2008-07-21-01<Add>by MikeLiu //register wpadev +#if 0 if(wpa_set_wpadev(pDevice, 1)!=0) { printk("Fail to Register WPADEV?\n"); unregister_netdev(pDevice->dev); free_netdev(dev); } +#endif device_print_info(pDevice); pci_set_drvdata(pcid, pDevice); return 0; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 010/149] Fix racy use of anon_inode_getfd() in perf_event.c 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (8 preceding siblings ...) 2010-07-01 17:30 ` [patch 009/149] staging: vt6655: Fix kernel BUG on driver wpa initialization Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 011/149] posix_timer: Fix error path in timer_create Greg KH ` (138 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Al Viro 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Al Viro <viro@zeniv.linux.org.uk> commit ea635c64e007061f6468ece5cc9cc62d41d4ecf2 upstream. once anon_inode_getfd() is called, you can't expect *anything* about struct file that descriptor points to - another thread might be doing whatever it likes with descriptor table at that point. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/perf_event.c | 40 ++++++++++++++++++++++------------------ 1 file changed, 22 insertions(+), 18 deletions(-) --- a/kernel/perf_event.c +++ b/kernel/perf_event.c @@ -4510,8 +4510,8 @@ SYSCALL_DEFINE5(perf_event_open, struct perf_event_context *ctx; struct file *event_file = NULL; struct file *group_file = NULL; + int event_fd; int fput_needed = 0; - int fput_needed2 = 0; int err; /* for future expandability... */ @@ -4532,12 +4532,18 @@ SYSCALL_DEFINE5(perf_event_open, return -EINVAL; } + event_fd = get_unused_fd_flags(O_RDWR); + if (event_fd < 0) + return event_fd; + /* * Get the target context (task or percpu): */ ctx = find_get_context(pid, cpu); - if (IS_ERR(ctx)) - return PTR_ERR(ctx); + if (IS_ERR(ctx)) { + err = PTR_ERR(ctx); + goto err_fd; + } /* * Look up the group leader (we will attach this event to it): @@ -4577,13 +4583,11 @@ SYSCALL_DEFINE5(perf_event_open, if (IS_ERR(event)) goto err_put_context; - err = anon_inode_getfd("[perf_event]", &perf_fops, event, 0); - if (err < 0) - goto err_free_put_context; - - event_file = fget_light(err, &fput_needed2); - if (!event_file) + event_file = anon_inode_getfile("[perf_event]", &perf_fops, event, O_RDWR); + if (IS_ERR(event_file)) { + err = PTR_ERR(event_file); goto err_free_put_context; + } if (flags & PERF_FLAG_FD_OUTPUT) { err = perf_event_set_output(event, group_fd); @@ -4604,19 +4608,19 @@ SYSCALL_DEFINE5(perf_event_open, list_add_tail(&event->owner_entry, ¤t->perf_event_list); mutex_unlock(¤t->perf_event_mutex); -err_fput_free_put_context: - fput_light(event_file, fput_needed2); + fput_light(group_file, fput_needed); + fd_install(event_fd, event_file); + return event_fd; +err_fput_free_put_context: + fput(event_file); err_free_put_context: - if (err < 0) - free_event(event); - + free_event(event); err_put_context: - if (err < 0) - put_ctx(ctx); - fput_light(group_file, fput_needed); - + put_ctx(ctx); +err_fd: + put_unused_fd(event_fd); return err; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 011/149] posix_timer: Fix error path in timer_create 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (9 preceding siblings ...) 2010-07-01 17:30 ` [patch 010/149] Fix racy use of anon_inode_getfd() in perf_event.c Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 012/149] libata: disable ATAPI AN by default Greg KH ` (137 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andrey Vagin, Oleg Nesterov, Pavel Emelyanov, Thomas Gleixner 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Andrey Vagin <avagin@openvz.org> commit 45e0fffc8a7778282e6a1514a6ae3e7ae6545111 upstream. Move CLOCK_DISPATCH(which_clock, timer_create, (new_timer)) after all posible EFAULT erros. *_timer_create may allocate/get resources. (for example posix_cpu_timer_create does get_task_struct) [ tglx: fold the remove crappy comment patch into this ] Signed-off-by: Andrey Vagin <avagin@openvz.org> Cc: Oleg Nesterov <oleg@tv-sign.ru> Cc: Pavel Emelyanov <xemul@openvz.org> Reviewed-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- a/kernel/posix-timers.c +++ b/kernel/posix-timers.c @@ -559,14 +559,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock, new_timer->it_id = (timer_t) new_timer_id; new_timer->it_clock = which_clock; new_timer->it_overrun = -1; - error = CLOCK_DISPATCH(which_clock, timer_create, (new_timer)); - if (error) - goto out; - /* - * return the timer_id now. The next step is hard to - * back out if there is an error. - */ if (copy_to_user(created_timer_id, &new_timer_id, sizeof (new_timer_id))) { error = -EFAULT; @@ -597,6 +590,10 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock, new_timer->sigq->info.si_tid = new_timer->it_id; new_timer->sigq->info.si_code = SI_TIMER; + error = CLOCK_DISPATCH(which_clock, timer_create, (new_timer)); + if (error) + goto out; + spin_lock_irq(¤t->sighand->siglock); new_timer->it_signal = current->signal; list_add(&new_timer->list, ¤t->signal->posix_timers); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 012/149] libata: disable ATAPI AN by default 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (10 preceding siblings ...) 2010-07-01 17:30 ` [patch 011/149] posix_timer: Fix error path in timer_create Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 013/149] libata: dont flush dcache on slab pages Greg KH ` (136 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Kay Sievers, Nick Bowler, David Zeuthen, Jeff Garzik 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Tejun Heo <tj@kernel.org> commit e7ecd435692ca9bde9d124be30b3a26e672ea6c2 upstream. There are ATAPI devices which raise AN when hit by commands issued by open(). This leads to infinite loop of AN -> MEDIA_CHANGE uevent -> udev open() to check media -> AN. Both ACS and SerialATA standards don't define in which case ATAPI devices are supposed to raise or not raise AN. They both list media insertion event as a possible use case for ATAPI ANs but there is no clear description of what constitutes such events. As such, it seems a bit too naive to export ANs directly to userland as MEDIA_CHANGE events without further verification (which should behave similarly to windows as it apparently is the only thing that some hardware vendors are testing against). This patch adds libata.atapi_an module parameter and disables ATAPI AN by default for now. Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Kay Sievers <kay.sievers@vrfy.org> Cc: Nick Bowler <nbowler@elliptictech.com> Cc: David Zeuthen <david@fubar.dk> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/libata-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -159,6 +159,10 @@ int libata_allow_tpm = 0; module_param_named(allow_tpm, libata_allow_tpm, int, 0444); MODULE_PARM_DESC(allow_tpm, "Permit the use of TPM commands (0=off [default], 1=on)"); +static int atapi_an; +module_param(atapi_an, int, 0444); +MODULE_PARM_DESC(atapi_an, "Enable ATAPI AN media presence notification (0=0ff [default], 1=on)"); + MODULE_AUTHOR("Jeff Garzik"); MODULE_DESCRIPTION("Library module for ATA devices"); MODULE_LICENSE("GPL"); @@ -2570,7 +2574,8 @@ int ata_dev_configure(struct ata_device * to enable ATAPI AN to discern between PHY status * changed notifications and ATAPI ANs. */ - if ((ap->flags & ATA_FLAG_AN) && ata_id_has_atapi_AN(id) && + if (atapi_an && + (ap->flags & ATA_FLAG_AN) && ata_id_has_atapi_AN(id) && (!sata_pmp_attached(ap) || sata_scr_read(&ap->link, SCR_NOTIFICATION, &sntf) == 0)) { unsigned int err_mask; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 013/149] libata: dont flush dcache on slab pages 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (11 preceding siblings ...) 2010-07-01 17:30 ` [patch 012/149] libata: disable ATAPI AN by default Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 014/149] mutex: Fix optimistic spinning vs. BKL Greg KH ` (135 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Sebastian Andrzej Siewior, Jeff Garzik 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> commit 3842e835490cdf17013b30a788f6311bdcfd0571 upstream. page_mapping() check this via VM_BUG_ON(PageSlab(page)) so we bug here with the according debuging turned on. Future TODO: replace this with a flush_dcache_page_for_pio() API Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/libata-sff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/ata/libata-sff.c +++ b/drivers/ata/libata-sff.c @@ -893,7 +893,7 @@ static void ata_pio_sector(struct ata_qu do_write); } - if (!do_write) + if (!do_write && !PageSlab(page)) flush_dcache_page(page); qc->curbytes += qc->sect_size; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 014/149] mutex: Fix optimistic spinning vs. BKL 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (12 preceding siblings ...) 2010-07-01 17:30 ` [patch 013/149] libata: dont flush dcache on slab pages Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 015/149] ALSA: hda: Fix model quirk for Dell M1730 Greg KH ` (134 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tony Breeds, Peter Zijlstra, Benjamin Herrenschmidt, Ingo Molnar 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Tony Breeds <tony@bakeyournoodle.com> commit fd6be105b883244127a734ac9f14ae94a022dcc0 upstream. Currently, we can hit a nasty case with optimistic spinning on mutexes: CPU A tries to take a mutex, while holding the BKL CPU B tried to take the BLK while holding the mutex This looks like a AB-BA scenario but in practice, is allowed and happens due to the auto-release on schedule() nature of the BKL. In that case, the optimistic spinning code can get us into a situation where instead of going to sleep, A will spin waiting for B who is spinning waiting for A, and the only way out of that loop is the need_resched() test in mutex_spin_on_owner(). This patch fixes it by completely disabling spinning if we own the BKL. This adds one more detail to the extensive list of reasons why it's a bad idea for kernel code to be holding the BKL. Signed-off-by: Tony Breeds <tony@bakeyournoodle.com> Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> LKML-Reference: <20100519054636.GC12389@ozlabs.org> [ added an unlikely() attribute to the branch ] Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/mutex.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/kernel/mutex.c +++ b/kernel/mutex.c @@ -172,6 +172,13 @@ __mutex_lock_common(struct mutex *lock, struct thread_info *owner; /* + * If we own the BKL, then don't spin. The owner of + * the mutex might be waiting on us to release the BKL. + */ + if (unlikely(current->lock_depth >= 0)) + break; + + /* * If there's an owner, wait for it to either * release the lock or go to sleep. */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 015/149] ALSA: hda: Fix model quirk for Dell M1730 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (13 preceding siblings ...) 2010-07-01 17:30 ` [patch 014/149] mutex: Fix optimistic spinning vs. BKL Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 016/149] ALSA: hda: Use LPIB for Toshiba A100-259 Greg KH ` (133 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 66668b6fb6861fad7f6bfef6646ac84693474c9a upstream. BugLink: https://launchpad.net/bugs/576160 Symptom: Currently (2.6.32.12) the Dell M1730 uses the 3stack model quirk. Unfortunately this means that capture is not functional out- of-the-box despite ensuring that capture settings are unmuted and raised fully. Test case: boot from Ubuntu 10.04 LTS live cd; capture does not work. Resolution: Correct the model quirk for Dell M1730 to rely on the BIOS configuration. This patch also trivially sorts the quirk into the correct section based on the comments. Reported-and-Tested-By: <picdragon99@msn.com> Tested-By: Daren Hayward Tested-By: Tobias Krais Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/patch_sigmatel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/pci/hda/patch_sigmatel.c +++ b/sound/pci/hda/patch_sigmatel.c @@ -2059,12 +2059,12 @@ static struct snd_pci_quirk stac927x_cfg SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_INTEL, 0xff00, 0x2000, "Intel D965", STAC_D965_3ST), /* Dell 3 stack systems */ - SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f7, "Dell XPS M1730", STAC_DELL_3ST), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01dd, "Dell Dimension E520", STAC_DELL_3ST), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01ed, "Dell ", STAC_DELL_3ST), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f4, "Dell ", STAC_DELL_3ST), /* Dell 3 stack systems with verb table in BIOS */ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f3, "Dell Inspiron 1420", STAC_DELL_BIOS), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f7, "Dell XPS M1730", STAC_DELL_BIOS), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0227, "Dell Vostro 1400 ", STAC_DELL_BIOS), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022e, "Dell ", STAC_DELL_BIOS), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022f, "Dell Inspiron 1525", STAC_DELL_BIOS), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 016/149] ALSA: hda: Use LPIB for Toshiba A100-259 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (14 preceding siblings ...) 2010-07-01 17:30 ` [patch 015/149] ALSA: hda: Fix model quirk for Dell M1730 Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 017/149] ALSA: hda: Use LPIB for Acer Aspire 5110 Greg KH ` (132 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 4e0938dba7fccf37a4aecba4d937da7f312b5d55 upstream. BugLink: https://launchpad.net/bugs/549560 Symptom: on a significant number of hardware, booting from a live cd results in capture working correctly, but once the distribution is installed, booting from the install results in capture not working. Test case: boot from Ubuntu 10.04 LTS live cd; capture works correctly. Install to HD and reboot; capture does not work. Reproduced with 2.6.32 mainline build (vanilla kernel.org compile) Resolution: add SSID for Toshiba A100-259 to the position_fix quirk table, explicitly specifying the LPIB method. I'll be sending additional patches for these SSIDs as bug reports are confirmed. This patch also trivially sorts the quirk table in ascending order by subsystem vendor. Reported-and-Tested-by: <davide.molteni@gmail.com> Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2229,9 +2229,10 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB), SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB), - SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), - SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB), SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 017/149] ALSA: hda: Use LPIB for Acer Aspire 5110 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (15 preceding siblings ...) 2010-07-01 17:30 ` [patch 016/149] ALSA: hda: Use LPIB for Toshiba A100-259 Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 018/149] ALSA: hda: Use LPIB for Sony VPCS11V9E Greg KH ` (131 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 7a68be94e22e7643038726ebc14360752a91800b upstream. BugLink: https://launchpad.net/bugs/583983 Symptom: on a significant number of hardware, booting from a live cd results in capture working correctly, but once the distribution is installed, booting from the install results in capture not working. Test case: boot from Ubuntu 10.04 LTS live cd; capture works correctly. Install to HD and reboot; capture does not work. Reproduced with 2.6.32 mainline build (vanilla kernel.org compile). Resolution: add SSID for Acer Aspire 5110 to the position_fix quirk table, explicitly specifying the LPIB method. I'll be sending additional patches for these SSIDs as bug reports are confirmed. Reported-and-Tested-By: Leo Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2226,6 +2226,7 @@ static int azx_dev_free(struct snd_devic * white/black-listing for position_fix */ static struct snd_pci_quirk position_fix_list[] __devinitdata = { + SND_PCI_QUIRK(0x1025, 0x009f, "Acer Aspire 5110", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB), SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 018/149] ALSA: hda: Use LPIB for Sony VPCS11V9E 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (16 preceding siblings ...) 2010-07-01 17:30 ` [patch 017/149] ALSA: hda: Use LPIB for Acer Aspire 5110 Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 019/149] ALSA: hda: Use LPIB for a Shuttle device Greg KH ` (130 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit e96d3127760a2fc509bca6bf7e61e8bc61497aeb upstream. BugLink: https://launchpad.net/bugs/586347 Symptom: On the Sony VPCS11V9E, using GStreamer-based applications with PulseAudio in Ubuntu 10.04 LTS results in stuttering audio. It appears to worsen with increased I/O. Test case: use Rhythmbox under increased I/O pressure. This symptom is reproducible in the current daily stable alsa-driver snapshots (at least up until 21 May 2010; later snapshots fail to build from source due to missing preprocessor directives when compiled against 2.6.32). Resolution: add SSID for this machine to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: Lauri Kainulainen <lauri@sokkelo.net> Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2232,6 +2232,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), + SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB), SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 019/149] ALSA: hda: Use LPIB for a Shuttle device 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (17 preceding siblings ...) 2010-07-01 17:30 ` [patch 018/149] ALSA: hda: Use LPIB for Sony VPCS11V9E Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 020/149] ACPI: video: fix acpi_backlight=video Greg KH ` (129 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 61bb42c37dfa9016dcacc86bcd41362ab2457d4a upstream. BugLink: https://launchpad.net/bugs/551949 Symptom: On the reporter's Shuttle device, using PulseAudio in Ubuntu 10.04 LTS results in "popping clicking" audio with the PA crashing shortly thereafter. Test case: Using Ubuntu 10.04 LTS (Linux 2.6.32.12), Linux 2.6.33, or Linux 2.6.34, adjust the HDA device's volume with PulseAudio. Resolution: add SSID for this machine to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: Christian Mehlis <mehlis@inf.fu-berlin.de> Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2235,6 +2235,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB), SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1297, 0x3166, "Shuttle", POS_FIX_LPIB), SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB), SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 020/149] ACPI: video: fix acpi_backlight=video 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (18 preceding siblings ...) 2010-07-01 17:30 ` [patch 019/149] ALSA: hda: Use LPIB for a Shuttle device Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 021/149] V4L/DVB: gspca - stv06xx: Remove the 046d:08da from the stv06xx driver Greg KH ` (128 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Kamal Mostafa, Zhang Rui, Bjorn Helgaas, Jiri Kosina, Thomas Renninger, Len Brown 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Kamal Mostafa <kamal@canonical.com> commit eeb4bcb4771679d7b3446c0293334faee11b090a upstream. Make "acpi_backlight=video" param enable ACPI_VIDEO_BACKLIGHT_FORCE_VIDEO as intended, instead of incorrectly enabling video output switching. BugLink: http://bugs.launchpad.net/bugs/573120 Signed-off-by: Kamal Mostafa <kamal@canonical.com> Acked-by: Zhang Rui <rui.zhang@intel.com> Cc: Bjorn Helgaas <bjorn.helgaas@hp.com> Cc: Jiri Kosina <jkosina@suse.cz> Acked-by: Thomas Renninger <trenn@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Len Brown <len.brown@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/acpi/video_detect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/acpi/video_detect.c +++ b/drivers/acpi/video_detect.c @@ -250,7 +250,7 @@ static int __init acpi_backlight(char *s ACPI_VIDEO_BACKLIGHT_FORCE_VENDOR; if (!strcmp("video", str)) acpi_video_support |= - ACPI_VIDEO_OUTPUT_SWITCHING_FORCE_VIDEO; + ACPI_VIDEO_BACKLIGHT_FORCE_VIDEO; } return 1; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 021/149] V4L/DVB: gspca - stv06xx: Remove the 046d:08da from the stv06xx driver 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (19 preceding siblings ...) 2010-07-01 17:30 ` [patch 020/149] ACPI: video: fix acpi_backlight=video Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 022/149] HID: Add the GYR4101US USB ID to hid-gyration Greg KH ` (127 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Erik Andrén, Jean-François Moine, Mauro Carvalho Chehab [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 1276 bytes --] 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Erik Andrén <erik.andren@gmail.com> commit 55e0b489a39bb635a44f769d620e44c70d9c065b upstream. The 046d:08da usb id shouldn't be associated with the stv06xx driver as they're not compatible with each other. This fixes a bug where Quickcam Messenger cams fail to use its proper driver (gspca-zc3xx), rendering the camera inoperable. Signed-off-by: Erik Andrén <erik.andren@gmail.com> Tested-by: Gabriel Craciunescu <nix.or.die@googlemail.com> Signed-off-by: Jean-François Moine <moinejf@free.fr> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/media/video/gspca/stv06xx/stv06xx.c | 2 -- 1 file changed, 2 deletions(-) --- a/drivers/media/video/gspca/stv06xx/stv06xx.c +++ b/drivers/media/video/gspca/stv06xx/stv06xx.c @@ -497,8 +497,6 @@ static const __devinitdata struct usb_de {USB_DEVICE(0x046D, 0x08F5), .driver_info = BRIDGE_ST6422 }, /* QuickCam Messenger (new) */ {USB_DEVICE(0x046D, 0x08F6), .driver_info = BRIDGE_ST6422 }, - /* QuickCam Messenger (new) */ - {USB_DEVICE(0x046D, 0x08DA), .driver_info = BRIDGE_ST6422 }, {} }; MODULE_DEVICE_TABLE(usb, device_table); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 022/149] HID: Add the GYR4101US USB ID to hid-gyration 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (20 preceding siblings ...) 2010-07-01 17:30 ` [patch 021/149] V4L/DVB: gspca - stv06xx: Remove the 046d:08da from the stv06xx driver Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 023/149] ar9170usb: add a couple more USB IDs Greg KH ` (126 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Cory Maccarrone, Jiri Kosina 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Cory Maccarrone <darkstar6262@gmail.com> commit c2fd1a4ebf9127c280d227acb635eb1df213439c upstream. This change adds in the USB product ID for the Gyration GYR4101US USB media center remote control. This remote is similar enough to the other two devices that this driver can be used without any other changes to get full support for the remote. Signed-off-by: Cory Maccarrone <darkstar6262@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/hid/hid-core.c | 1 + drivers/hid/hid-gyration.c | 1 + drivers/hid/hid-ids.h | 1 + 3 files changed, 3 insertions(+) --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1306,6 +1306,7 @@ static const struct hid_device_id hid_bl { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, 0x0012) }, { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE) }, { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_3) }, { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) }, { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) }, { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) }, --- a/drivers/hid/hid-gyration.c +++ b/drivers/hid/hid-gyration.c @@ -73,6 +73,7 @@ static int gyration_event(struct hid_dev static const struct hid_device_id gyration_devices[] = { { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE) }, { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_3) }, { } }; MODULE_DEVICE_TABLE(hid, gyration_devices); --- a/drivers/hid/hid-ids.h +++ b/drivers/hid/hid-ids.h @@ -251,6 +251,7 @@ #define USB_VENDOR_ID_GYRATION 0x0c16 #define USB_DEVICE_ID_GYRATION_REMOTE 0x0002 #define USB_DEVICE_ID_GYRATION_REMOTE_2 0x0003 +#define USB_DEVICE_ID_GYRATION_REMOTE_3 0x0008 #define USB_VENDOR_ID_HAPP 0x078b #define USB_DEVICE_ID_UGCI_DRIVING 0x0010 ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 023/149] ar9170usb: add a couple more USB IDs 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (21 preceding siblings ...) 2010-07-01 17:30 ` [patch 022/149] HID: Add the GYR4101US USB ID to hid-gyration Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 024/149] ar9170usb: fix panic triggered by undersized rxstream buffer Greg KH ` (125 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Christian Lamparter, John W. Linville 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Christian Lamparter <chunkeey@googlemail.com> commit 94d0bbe849190255b93fede8eb46809a38f9b8bf upstream. This patch adds the following 5 entries to the usbid device table: * Netgear WNA1000 * Proxim ORiNOCO Dual Band 802.11n USB Adapter * 3Com Dual Band 802.11n USB Adapter * H3C Dual Band 802.11n USB Adapter * WNC Generic 11n USB dongle Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/ath/ar9170/usb.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/drivers/net/wireless/ath/ar9170/usb.c +++ b/drivers/net/wireless/ath/ar9170/usb.c @@ -66,18 +66,28 @@ static struct usb_device_id ar9170_usb_i { USB_DEVICE(0x0cf3, 0x1001) }, /* TP-Link TL-WN821N v2 */ { USB_DEVICE(0x0cf3, 0x1002) }, + /* 3Com Dual Band 802.11n USB Adapter */ + { USB_DEVICE(0x0cf3, 0x1010) }, + /* H3C Dual Band 802.11n USB Adapter */ + { USB_DEVICE(0x0cf3, 0x1011) }, /* Cace Airpcap NX */ { USB_DEVICE(0xcace, 0x0300) }, /* D-Link DWA 160 A1 */ { USB_DEVICE(0x07d1, 0x3c10) }, /* D-Link DWA 160 A2 */ { USB_DEVICE(0x07d1, 0x3a09) }, + /* Netgear WNA1000 */ + { USB_DEVICE(0x0846, 0x9040) }, /* Netgear WNDA3100 */ { USB_DEVICE(0x0846, 0x9010) }, /* Netgear WN111 v2 */ { USB_DEVICE(0x0846, 0x9001) }, /* Zydas ZD1221 */ { USB_DEVICE(0x0ace, 0x1221) }, + /* Proxim ORiNOCO 802.11n USB */ + { USB_DEVICE(0x1435, 0x0804) }, + /* WNC Generic 11n USB Dongle */ + { USB_DEVICE(0x1435, 0x0326) }, /* ZyXEL NWD271N */ { USB_DEVICE(0x0586, 0x3417) }, /* Z-Com UB81 BG */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 024/149] ar9170usb: fix panic triggered by undersized rxstream buffer 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (22 preceding siblings ...) 2010-07-01 17:30 ` [patch 023/149] ar9170usb: add a couple more USB IDs Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 025/149] USB: visor: fix memory leak Greg KH ` (124 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Christian Lamparter, John W. Linville 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Christian Lamparter <chunkeey@googlemail.com> commit 879999cec9489f8942ebce3ec1b5f23ef948dda7 upstream. While ar9170's USB transport packet size is currently set to 8KiB, the PHY is capable of receiving AMPDUs with up to 64KiB. Such a large frame will be split over several rx URBs and exceed the previously allocated space for rx stream reconstruction. This patch increases the buffer size to 64KiB which is in fact the phy & rx stream designed size limit. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=15591 Reported-by: Christian Mehlis <mehlis@inf.fu-berlin.de> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/ath/ar9170/hw.h | 1 + drivers/net/wireless/ath/ar9170/main.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/wireless/ath/ar9170/hw.h +++ b/drivers/net/wireless/ath/ar9170/hw.h @@ -422,5 +422,6 @@ enum ar9170_txq { #define AR9170_TXQ_DEPTH 32 #define AR9170_TX_MAX_PENDING 128 +#define AR9170_RX_STREAM_MAX_SIZE 65535 #endif /* __AR9170_HW_H */ --- a/drivers/net/wireless/ath/ar9170/main.c +++ b/drivers/net/wireless/ath/ar9170/main.c @@ -2526,7 +2526,7 @@ void *ar9170_alloc(size_t priv_size) * tends to split the streams into seperate rx descriptors. */ - skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL); + skb = __dev_alloc_skb(AR9170_RX_STREAM_MAX_SIZE, GFP_KERNEL); if (!skb) goto err_nomem; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 025/149] USB: visor: fix memory leak 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (23 preceding siblings ...) 2010-07-01 17:30 ` [patch 024/149] ar9170usb: fix panic triggered by undersized rxstream buffer Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 026/149] USB: CP210x New Device IDs 11 New device IDs Greg KH ` (123 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit 199b113978015309dd02c69844c19a1be3f4dbcf upstream. Fix memory leak for some devices (Sony Clie 3.5) due to port private data not being freed on release. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c index 0949427..fb7fc40 100644 --- a/drivers/usb/serial/visor.c +++ b/drivers/usb/serial/visor.c @@ -249,6 +249,7 @@ static struct usb_serial_driver clie_3_5_device = { .throttle = visor_throttle, .unthrottle = visor_unthrottle, .attach = clie_3_5_startup, + .release = visor_release, .write = visor_write, .write_room = visor_write_room, .write_bulk_callback = visor_write_bulk_callback, ^ permalink raw reply related [flat|nested] 666+ messages in thread
* [patch 026/149] USB: CP210x New Device IDs 11 New device IDs 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (24 preceding siblings ...) 2010-07-01 17:30 ` [patch 025/149] USB: visor: fix memory leak Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 027/149] USB: kobil: fix memory leak Greg KH ` (122 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Craig Shelley 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Craig Shelley <craig@microtron.org.uk> commit eefd9029fde4d90d59804eeb54880ab8db5c1866 upstream. Signed-off-by: Craig Shelley <craig@microtron.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/cp210x.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/drivers/usb/serial/cp210x.c +++ b/drivers/usb/serial/cp210x.c @@ -61,6 +61,8 @@ static struct usb_device_id id_table [] { USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */ { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ + { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */ + { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */ { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */ { USB_DEVICE(0x0FCF, 0x1004) }, /* Dynastream ANT2USB */ { USB_DEVICE(0x0FCF, 0x1006) }, /* Dynastream ANT development board */ @@ -72,9 +74,12 @@ static struct usb_device_id id_table [] { USB_DEVICE(0x10C4, 0x1601) }, /* Arkham Technology DS101 Adapter */ { USB_DEVICE(0x10C4, 0x800A) }, /* SPORTident BSM7-D-USB main station */ { USB_DEVICE(0x10C4, 0x803B) }, /* Pololu USB-serial converter */ + { USB_DEVICE(0x10C4, 0x8044) }, /* Cygnal Debug Adapter */ + { USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME build-in converter */ { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */ { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */ { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */ + { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */ { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */ { USB_DEVICE(0x10C4, 0x80CA) }, /* Degree Controls Inc */ { USB_DEVICE(0x10C4, 0x80DD) }, /* Tracient RFID */ @@ -82,12 +87,15 @@ static struct usb_device_id id_table [] { USB_DEVICE(0x10C4, 0x8115) }, /* Arygon NFC/Mifare Reader */ { USB_DEVICE(0x10C4, 0x813D) }, /* Burnside Telecom Deskmobile */ { USB_DEVICE(0x10C4, 0x813F) }, /* Tams Master Easy Control */ + { USB_DEVICE(0x10C4, 0x8149) }, /* West Mountain Radio Computerized Battery Analyzer */ { USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */ { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */ { USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */ + { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */ { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */ { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */ { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */ + { USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */ { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */ { USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */ { USB_DEVICE(0x10C4, 0x81E7) }, /* Aerocomm Radio */ @@ -105,6 +113,7 @@ static struct usb_device_id id_table [] { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */ { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */ { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */ { USB_DEVICE(0x10C4, 0xF003) }, /* Elan Digital Systems USBpulse100 */ @@ -115,6 +124,8 @@ static struct usb_device_id id_table [] { USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */ { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */ { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */ + { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */ + { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */ { } /* Terminating Entry */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 027/149] USB: kobil: fix memory leak 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (25 preceding siblings ...) 2010-07-01 17:30 ` [patch 026/149] USB: CP210x New Device IDs 11 New device IDs Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 028/149] USB: option: add PID for ZTE product Greg KH ` (121 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit c0f631d1948658b27349545b2cbcb4b32f010c7a upstream. An urb transfer buffer is allocated at every open but was never freed. This driver is a bit of a mess... Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/kobil_sct.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/usb/serial/kobil_sct.c +++ b/drivers/usb/serial/kobil_sct.c @@ -345,7 +345,8 @@ static void kobil_close(struct usb_seria /* FIXME: Add rts/dtr methods */ if (port->write_urb) { - usb_kill_urb(port->write_urb); + usb_poison_urb(port->write_urb); + kfree(port->write_urb->transfer_buffer); usb_free_urb(port->write_urb); port->write_urb = NULL; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 028/149] USB: option: add PID for ZTE product 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (26 preceding siblings ...) 2010-07-01 17:30 ` [patch 027/149] USB: kobil: fix memory leak Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 029/149] USB: option.c: Add Pirelli VID/PID and indicate Pirellis modem interface is 0xff Greg KH ` (120 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Joey 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: zhao1980ming <zhao1980ming@163.com> commit a71ee85e1d74e862d68cc9b2f2ab6a806d2550c9 upstream. this patch adds ZTE modem devices Signed-off-by: Joey <zhao.ming9@zte.com.cn> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/option.c | 174 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 174 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -621,6 +621,180 @@ static struct usb_device_id option_ids[] { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1060, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1061, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1062, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1063, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1064, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1065, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1066, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1067, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1068, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1069, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1070, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1071, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1072, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1073, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1074, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1075, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1076, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1077, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1078, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1079, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1080, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1081, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1082, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1083, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1084, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1085, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1086, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1087, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1088, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1089, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1090, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1091, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1092, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1093, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1094, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1095, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1096, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1097, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1098, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1099, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1100, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1101, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1102, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1103, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1104, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1105, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1106, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1107, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1108, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1109, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1110, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1111, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1112, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1113, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1114, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1115, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1116, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1117, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1118, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1119, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1120, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1121, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1122, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1123, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1124, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1125, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1126, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1127, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1128, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1129, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1130, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1131, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1132, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1133, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1134, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1135, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1136, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1137, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1138, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1139, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1140, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1141, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1142, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1143, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1144, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1145, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1146, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1147, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1148, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1149, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1150, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1151, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1152, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1153, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1154, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1155, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1156, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1157, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1158, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1159, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1160, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1161, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1162, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1163, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1164, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1165, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1166, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1167, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1168, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1169, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1170, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1244, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1245, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1246, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1247, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1248, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1249, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1250, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1251, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1252, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1253, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1254, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1255, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1256, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1257, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1258, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1259, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1260, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1261, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1262, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1263, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1264, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1265, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1266, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1267, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1268, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1269, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1271, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1274, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1275, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1276, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1277, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1278, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1279, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1280, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1281, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1282, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1283, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1284, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1285, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1286, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1287, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1288, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1289, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1290, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1291, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1292, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1293, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1294, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1295, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1296, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1297, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) }, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 029/149] USB: option.c: Add Pirelli VID/PID and indicate Pirellis modem interface is 0xff 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (27 preceding siblings ...) 2010-07-01 17:30 ` [patch 028/149] USB: option: add PID for ZTE product Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 030/149] USB: serial: option: add cinterion device id Greg KH ` (119 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, spark 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: spark <spark@bandrich.com> commit 33c387529b7931248c6637bf9720ac7504a0b28b upstream. Signed-off-by: spark <spark@bandrich.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/option.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -334,6 +334,24 @@ static int option_resume(struct usb_ser #define ALCATEL_VENDOR_ID 0x1bbb #define ALCATEL_PRODUCT_X060S 0x0000 +#define PIRELLI_VENDOR_ID 0x1266 +#define PIRELLI_PRODUCT_C100_1 0x1002 +#define PIRELLI_PRODUCT_C100_2 0x1003 +#define PIRELLI_PRODUCT_1004 0x1004 +#define PIRELLI_PRODUCT_1005 0x1005 +#define PIRELLI_PRODUCT_1006 0x1006 +#define PIRELLI_PRODUCT_1007 0x1007 +#define PIRELLI_PRODUCT_1008 0x1008 +#define PIRELLI_PRODUCT_1009 0x1009 +#define PIRELLI_PRODUCT_100A 0x100a +#define PIRELLI_PRODUCT_100B 0x100b +#define PIRELLI_PRODUCT_100C 0x100c +#define PIRELLI_PRODUCT_100D 0x100d +#define PIRELLI_PRODUCT_100E 0x100e +#define PIRELLI_PRODUCT_100F 0x100f +#define PIRELLI_PRODUCT_1011 0x1011 +#define PIRELLI_PRODUCT_1012 0x1012 + /* Airplus products */ #define AIRPLUS_VENDOR_ID 0x1011 #define AIRPLUS_PRODUCT_MCD650 0x3198 @@ -823,6 +841,24 @@ static struct usb_device_id option_ids[] { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) }, { USB_DEVICE(FOUR_G_SYSTEMS_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14) }, { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, + /* Pirelli */ + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_2)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1004)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1005)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1006)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1007)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1008)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1009)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100A)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100B) }, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100C) }, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100D) }, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100E) }, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100F) }, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)}, + { } /* Terminating entry */ }; MODULE_DEVICE_TABLE(usb, option_ids); @@ -945,12 +981,19 @@ static int option_probe(struct usb_seria const struct usb_device_id *id) { struct option_intf_private *data; + /* D-Link DWM 652 still exposes CD-Rom emulation interface in modem mode */ if (serial->dev->descriptor.idVendor == DLINK_VENDOR_ID && serial->dev->descriptor.idProduct == DLINK_PRODUCT_DWM_652 && serial->interface->cur_altsetting->desc.bInterfaceClass == 0x8) return -ENODEV; + /* Bandrich modem and AT command interface is 0xff */ + if ((serial->dev->descriptor.idVendor == BANDRICH_VENDOR_ID || + serial->dev->descriptor.idVendor == PIRELLI_VENDOR_ID) && + serial->interface->cur_altsetting->desc.bInterfaceClass != 0xff) + return -ENODEV; + data = serial->private = kzalloc(sizeof(struct option_intf_private), GFP_KERNEL); if (!data) return -ENOMEM; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 030/149] USB: serial: option: add cinterion device id 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (28 preceding siblings ...) 2010-07-01 17:30 ` [patch 029/149] USB: option.c: Add Pirelli VID/PID and indicate Pirellis modem interface is 0xff Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 031/149] USB: option.c: OLIVETTI OLICARD100 support Greg KH ` (118 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Greg Kroah-Hartman <gregkh@suse.de> commit 6f44bcb60bfa58590142545096b64f44144f0bc1 upstream. This adds a device id for a Cinterion device. Reported-by: John Race <John.Race@roscom.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -364,6 +364,8 @@ static int option_resume(struct usb_ser #define HAIER_VENDOR_ID 0x201e #define HAIER_PRODUCT_CE100 0x2009 +#define CINTERION_VENDOR_ID 0x0681 + static struct usb_device_id option_ids[] = { { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, @@ -859,6 +861,7 @@ static struct usb_device_id option_ids[] { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)}, { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)}, + { USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) }, { } /* Terminating entry */ }; MODULE_DEVICE_TABLE(usb, option_ids); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 031/149] USB: option.c: OLIVETTI OLICARD100 support 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (29 preceding siblings ...) 2010-07-01 17:30 ` [patch 030/149] USB: serial: option: add cinterion device id Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 032/149] USB: ir-usb: fix double free Greg KH ` (117 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Nils Radtke [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 1510 bytes --] 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Nils Radtke <lkml@Think-Future.de> commit 86234d4975ce084d14711283a3bfc69305f97602 upstream. This patch adds support for an olivetti olicard100 HЅDPA usb-stick. This device is a zeroCD one with ID 0b3c:c700 that needs switching via eject or usb-modeswitch with MessageContent="5553424312345678000000000000061b000000030000000000000000000000". After switching it has ID 0b3c:c000 and provides 5 serial ports ttyUSB[0-4]. Port 0 (modem) and 4 are interrupt ports. Signed-off-by: Nils Radtke <lkml@Think-Future.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -366,6 +366,10 @@ static int option_resume(struct usb_ser #define CINTERION_VENDOR_ID 0x0681 +/* Olivetti products */ +#define OLIVETTI_VENDOR_ID 0x0b3c +#define OLIVETTI_PRODUCT_OLICARD100 0xc000 + static struct usb_device_id option_ids[] = { { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, @@ -862,6 +866,8 @@ static struct usb_device_id option_ids[] { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)}, { USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) }, + + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) }, { } /* Terminating entry */ }; MODULE_DEVICE_TABLE(usb, option_ids); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 032/149] USB: ir-usb: fix double free 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (30 preceding siblings ...) 2010-07-01 17:30 ` [patch 031/149] USB: option.c: OLIVETTI OLICARD100 support Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:30 ` [patch 033/149] USB: kl5usb105: fix memory leak Greg KH ` (116 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit 2ff78c0c2b67120c8e503268da3f177cae2228a2 upstream. If the user specifies a custom bulk buffer size we get a double free at port release. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/ir-usb.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/serial/ir-usb.c +++ b/drivers/usb/serial/ir-usb.c @@ -312,6 +312,7 @@ static int ir_open(struct tty_struct *tt kfree(port->read_urb->transfer_buffer); port->read_urb->transfer_buffer = buffer; port->read_urb->transfer_buffer_length = buffer_size; + port->bulk_in_buffer = buffer; buffer = kmalloc(buffer_size, GFP_KERNEL); if (!buffer) { @@ -321,6 +322,7 @@ static int ir_open(struct tty_struct *tt kfree(port->write_urb->transfer_buffer); port->write_urb->transfer_buffer = buffer; port->write_urb->transfer_buffer_length = buffer_size; + port->bulk_out_buffer = buffer; port->bulk_out_size = buffer_size; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 033/149] USB: kl5usb105: fix memory leak 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (31 preceding siblings ...) 2010-07-01 17:30 ` [patch 032/149] USB: ir-usb: fix double free Greg KH @ 2010-07-01 17:30 ` Greg KH 2010-07-01 17:31 ` [patch 034/149] USB: mxc: gadget: Fix bitfield for calculating maximum packet size Greg KH ` (115 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:30 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit 313b0d80c1717ffe8f64b455a4d323996748b91a upstream. Private data was not freed on error path in startup. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/kl5kusb105.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/serial/kl5kusb105.c +++ b/drivers/usb/serial/kl5kusb105.c @@ -310,6 +310,7 @@ err_cleanup: usb_free_urb(priv->write_urb_pool[j]); } } + kfree(priv); usb_set_serial_port_data(serial->port[i], NULL); } return -ENOMEM; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 034/149] USB: mxc: gadget: Fix bitfield for calculating maximum packet size 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (32 preceding siblings ...) 2010-07-01 17:30 ` [patch 033/149] USB: kl5usb105: fix memory leak Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 035/149] USB: unusual-dev: Add bad sense flag for Appotech ax203 based picture frames Greg KH ` (114 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Dinh Nguyen 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Dinh Nguyen <Dinh.Nguyen@freescale.com> commit 88e3b59b5adce5b12e205af0e34d518ba0dcdc0c upstream. The max packet length bit mask used for isochronous endpoints should be 0x7FF instead of 0x8FF. 0x8FF will actually clear higher-order bits in the max packet length field. This patch applies to 2.6.34-rc6. Signed-off-by: Dinh Nguyen <Dinh.Nguyen@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/gadget/fsl_udc_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/gadget/fsl_udc_core.c +++ b/drivers/usb/gadget/fsl_udc_core.c @@ -489,7 +489,7 @@ static int fsl_ep_enable(struct usb_ep * case USB_ENDPOINT_XFER_ISOC: /* Calculate transactions needed for high bandwidth iso */ mult = (unsigned char)(1 + ((max >> 11) & 0x03)); - max = max & 0x8ff; /* bit 0~10 */ + max = max & 0x7ff; /* bit 0~10 */ /* 3 transactions at most */ if (mult > 3) goto en_done; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 035/149] USB: unusual-dev: Add bad sense flag for Appotech ax203 based picture frames 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (33 preceding siblings ...) 2010-07-01 17:31 ` [patch 034/149] USB: mxc: gadget: Fix bitfield for calculating maximum packet size Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 036/149] USB: EHCI: clear PHCD before resuming Greg KH ` (113 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Hans de Goede 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Hans de Goede <hdegoede@redhat.com> commit a78f4f1a16d87f3d33158d036af94e48e32f8aad upstream. These Appotech controllers are found in Picture Frames, they provide a (buggy) emulation of a cdrom drive which contains the windows software Uploading of pictures happens over the corresponding /dev/sg device. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/storage/unusual_devs.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+) --- a/drivers/usb/storage/unusual_devs.h +++ b/drivers/usb/storage/unusual_devs.h @@ -1858,6 +1858,21 @@ UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_IGNORE_RESIDUE ), +/* Reported by Hans de Goede <hdegoede@redhat.com> + * These Appotech controllers are found in Picture Frames, they provide a + * (buggy) emulation of a cdrom drive which contains the windows software + * Uploading of pictures happens over the corresponding /dev/sg device. */ +UNUSUAL_DEV( 0x1908, 0x1315, 0x0000, 0x0000, + "BUILDWIN", + "Photo Frame", + US_SC_DEVICE, US_PR_DEVICE, NULL, + US_FL_BAD_SENSE ), +UNUSUAL_DEV( 0x1908, 0x1320, 0x0000, 0x0000, + "BUILDWIN", + "Photo Frame", + US_SC_DEVICE, US_PR_DEVICE, NULL, + US_FL_BAD_SENSE ), + UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001, "ST", "2A", ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 036/149] USB: EHCI: clear PHCD before resuming 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (34 preceding siblings ...) 2010-07-01 17:31 ` [patch 035/149] USB: unusual-dev: Add bad sense flag for Appotech ax203 based picture frames Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 037/149] USB: xhci: Fix issue with set interface after stall Greg KH ` (112 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Alek Du, David Brownell, Alan Stern 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Alek Du <alek.du@intel.com> commit eab80de01cb398419ef3305f35abcb367c647c8b upstream. This is a bug fix for PHCD (phy clock disable) low power feature: After PHCD is set, any write to PORTSC register is illegal, so when resume ports, clear PHCD bit first. Signed-off-by: Alek Du <alek.du@intel.com> Cc: David Brownell <dbrownell@users.sourceforge.net> Cc: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/ehci-hub.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) --- a/drivers/usb/host/ehci-hub.c +++ b/drivers/usb/host/ehci-hub.c @@ -292,6 +292,16 @@ static int ehci_bus_resume (struct usb_h /* manually resume the ports we suspended during bus_suspend() */ i = HCS_N_PORTS (ehci->hcs_params); while (i--) { + /* clear phy low power mode before resume */ + if (ehci->has_hostpc) { + u32 __iomem *hostpc_reg = + (u32 __iomem *)((u8 *)ehci->regs + + HOSTPC0 + 4 * (i & 0xff)); + temp = ehci_readl(ehci, hostpc_reg); + ehci_writel(ehci, temp & ~HOSTPC_PHCD, + hostpc_reg); + mdelay(5); + } temp = ehci_readl(ehci, &ehci->regs->port_status [i]); temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS); if (test_bit(i, &ehci->bus_suspended) && @@ -676,6 +686,13 @@ static int ehci_hub_control ( if (temp & PORT_SUSPEND) { if ((temp & PORT_PE) == 0) goto error; + /* clear phy low power mode before resume */ + if (hostpc_reg) { + temp1 = ehci_readl(ehci, hostpc_reg); + ehci_writel(ehci, temp1 & ~HOSTPC_PHCD, + hostpc_reg); + mdelay(5); + } /* resume signaling for 20 msec */ temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS); ehci_writel(ehci, temp | PORT_RESUME, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 037/149] USB: xhci: Fix issue with set interface after stall. 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (35 preceding siblings ...) 2010-07-01 17:31 ` [patch 036/149] USB: EHCI: clear PHCD before resuming Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 038/149] USB: xhci: Fix check for room on the ring Greg KH ` (111 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Sarah Sharp <sarah.a.sharp@linux.intel.com> commit 1624ae1c19e227096ba85bfc389d9b99cb6f7dde upstream. When the USB core installs a new interface, it unconditionally clears the halts on all the endpoints on the new interface. Usually the xHCI host needs to know when an endpoint is reset, so it can change its internal endpoint state. In this case, it doesn't care, because the endpoints were never halted in the first place. To avoid issuing a redundant Reset Endpoint command, the xHCI driver looks at xhci_virt_ep->stopped_td to determine if the endpoint was actually halted. However, the functions that handle the stall never set that variable to NULL after it dealt with the stall. So if an endpoint stalled and a Reset Endpoint command completed, and then the class driver tried to install a new alternate setting, the xHCI driver would access the old xhci_virt_ep->stopped_td pointer. A similar problem occurs if the endpoint has been stopped to cancel a transfer. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-hcd.c | 2 ++ drivers/usb/host/xhci-ring.c | 7 +++++++ 2 files changed, 9 insertions(+) --- a/drivers/usb/host/xhci-hcd.c +++ b/drivers/usb/host/xhci-hcd.c @@ -1414,6 +1414,8 @@ void xhci_endpoint_reset(struct usb_hcd kfree(virt_ep->stopped_td); xhci_ring_cmd_db(xhci); } + virt_ep->stopped_td = NULL; + virt_ep->stopped_trb = NULL; spin_unlock_irqrestore(&xhci->lock, flags); if (ret) --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -548,6 +548,8 @@ static void handle_stopped_endpoint(stru /* Otherwise just ring the doorbell to restart the ring */ ring_ep_doorbell(xhci, slot_id, ep_index); } + ep->stopped_td = NULL; + ep->stopped_trb = NULL; /* * Drop the lock and complete the URBs in the cancelled TD list. @@ -1065,8 +1067,13 @@ static int handle_tx_event(struct xhci_h ep->stopped_td = td; ep->stopped_trb = event_trb; + xhci_queue_reset_ep(xhci, slot_id, ep_index); xhci_cleanup_stalled_ring(xhci, td->urb->dev, ep_index); + + ep->stopped_td = NULL; + ep->stopped_trb = NULL; + xhci_ring_cmd_db(xhci); goto td_cleanup; default: ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 038/149] USB: xhci: Fix check for room on the ring. 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (36 preceding siblings ...) 2010-07-01 17:31 ` [patch 037/149] USB: xhci: Fix issue with set interface after stall Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 039/149] USB: xHCI: Fix wrong usage of macro TRB_TYPE Greg KH ` (110 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Sarah Sharp <sarah.a.sharp@linux.intel.com> commit 44ebd037c54f80db3121ac9f5fe6e677b76e11d5 upstream. The length of the scatter gather list a driver can enqueue is limited by the bus' sg_tablesize to 62 entries. Each entry will be described by at least one transfer request block (TRB). If the entry's buffer crosses a 64KB boundary, then that entry will have to be described by two or more TRBs. So even if the USB device driver respects sg_tablesize, the whole scatter list may take more than 62 TRBs to describe, and won't fit on the ring. Don't assume that an empty ring means there is enough room on the transfer ring. The old code would unconditionally queue this too-large transfer, and over write the beginning of the transfer. This would mean the cycle bit was unchanged in those overwritten transfers, causing the hardware to think it didn't own the TRBs, and the host would seem to hang. Now drivers may see submit_urb() fail with -ENOMEM if the transfers are too big to fit on the ring. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-ring.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -241,10 +241,27 @@ static int room_on_ring(struct xhci_hcd int i; union xhci_trb *enq = ring->enqueue; struct xhci_segment *enq_seg = ring->enq_seg; + struct xhci_segment *cur_seg; + unsigned int left_on_ring; /* Check if ring is empty */ - if (enq == ring->dequeue) + if (enq == ring->dequeue) { + /* Can't use link trbs */ + left_on_ring = TRBS_PER_SEGMENT - 1; + for (cur_seg = enq_seg->next; cur_seg != enq_seg; + cur_seg = cur_seg->next) + left_on_ring += TRBS_PER_SEGMENT - 1; + + /* Always need one TRB free in the ring. */ + left_on_ring -= 1; + if (num_trbs > left_on_ring) { + xhci_warn(xhci, "Not enough room on ring; " + "need %u TRBs, %u TRBs left\n", + num_trbs, left_on_ring); + return 0; + } return 1; + } /* Make sure there's an extra empty TRB available */ for (i = 0; i <= num_trbs; ++i) { if (enq == ring->dequeue) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 039/149] USB: xHCI: Fix wrong usage of macro TRB_TYPE 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (37 preceding siblings ...) 2010-07-01 17:31 ` [patch 038/149] USB: xhci: Fix check for room on the ring Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 040/149] mac80211: give warning if building w/out rate ctrl algorithm Greg KH ` (109 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andiry Xu, Sarah Sharp 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Andiry Xu <andiry.xu@amd.com> commit 54b5acf3acb7a1f83ec281d111d3e2812cd7ad9d upstream. Macro TRB_TYPE is misused in some places. Fix the wrong usage. Signed-off-by: Andiry Xu <andiry.xu@amd.com> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-ring.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -350,7 +350,8 @@ static struct xhci_segment *find_trb_seg while (cur_seg->trbs > trb || &cur_seg->trbs[TRBS_PER_SEGMENT - 1] < trb) { generic_trb = &cur_seg->trbs[TRBS_PER_SEGMENT - 1].generic; - if (TRB_TYPE(generic_trb->field[3]) == TRB_LINK && + if ((generic_trb->field[3] & TRB_TYPE_BITMASK) == + TRB_TYPE(TRB_LINK) && (generic_trb->field[3] & LINK_TOGGLE)) *cycle_state = ~(*cycle_state) & 0x1; cur_seg = cur_seg->next; @@ -406,7 +407,7 @@ void xhci_find_new_dequeue_state(struct BUG(); trb = &state->new_deq_ptr->generic; - if (TRB_TYPE(trb->field[3]) == TRB_LINK && + if ((trb->field[3] & TRB_TYPE_BITMASK) == TRB_TYPE(TRB_LINK) && (trb->field[3] & LINK_TOGGLE)) state->new_cycle_state = ~(state->new_cycle_state) & 0x1; next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr); @@ -1210,8 +1211,10 @@ static int handle_tx_event(struct xhci_h for (cur_trb = ep_ring->dequeue, cur_seg = ep_ring->deq_seg; cur_trb != event_trb; next_trb(xhci, ep_ring, &cur_seg, &cur_trb)) { - if (TRB_TYPE(cur_trb->generic.field[3]) != TRB_TR_NOOP && - TRB_TYPE(cur_trb->generic.field[3]) != TRB_LINK) + if ((cur_trb->generic.field[3] & + TRB_TYPE_BITMASK) != TRB_TYPE(TRB_TR_NOOP) && + (cur_trb->generic.field[3] & + TRB_TYPE_BITMASK) != TRB_TYPE(TRB_LINK)) td->urb->actual_length += TRB_LEN(cur_trb->generic.field[2]); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 040/149] mac80211: give warning if building w/out rate ctrl algorithm 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (38 preceding siblings ...) 2010-07-01 17:31 ` [patch 039/149] USB: xHCI: Fix wrong usage of macro TRB_TYPE Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 041/149] mac80211: Fix robust management frame handling (MFP) Greg KH ` (108 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andres Salomon, John W. Linville 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Andres Salomon <dilinger@collabora.co.uk> commit c2ef355bf3ef0b8006b96128726684fba47ac928 upstream. I discovered that if EMBEDDED=y, one can accidentally build a mac80211 stack and drivers w/ no rate control algorithm. For drivers like RTL8187 that don't supply their own RC algorithms, this will cause ieee80211_register_hw to fail (making the driver unusable). This will tell kconfig to provide a warning if no rate control algorithms have been selected. That'll at least warn the user; users that know that their drivers supply a rate control algorithm can safely ignore the warning, and those who don't know (or who expect to be using multiple drivers) can select a default RC algorithm. Signed-off-by: Andres Salomon <dilinger@collabora.co.uk> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/mac80211/Kconfig | 9 +++++++++ 1 file changed, 9 insertions(+) --- a/net/mac80211/Kconfig +++ b/net/mac80211/Kconfig @@ -15,8 +15,12 @@ comment "CFG80211 needs to be enabled fo if MAC80211 != n +config MAC80211_HAS_RC + def_bool n + config MAC80211_RC_PID bool "PID controller based rate control algorithm" if EMBEDDED + select MAC80211_HAS_RC ---help--- This option enables a TX rate control algorithm for mac80211 that uses a PID controller to select the TX @@ -24,12 +28,14 @@ config MAC80211_RC_PID config MAC80211_RC_MINSTREL bool "Minstrel" if EMBEDDED + select MAC80211_HAS_RC default y ---help--- This option enables the 'minstrel' TX rate control algorithm choice prompt "Default rate control algorithm" + depends on MAC80211_HAS_RC default MAC80211_RC_DEFAULT_MINSTREL ---help--- This option selects the default rate control algorithm @@ -62,6 +68,9 @@ config MAC80211_RC_DEFAULT endif +comment "Some wireless drivers require a rate control algorithm" + depends on MAC80211_HAS_RC=n + config MAC80211_MESH bool "Enable mac80211 mesh networking (pre-802.11s) support" depends on MAC80211 && EXPERIMENTAL ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 041/149] mac80211: Fix robust management frame handling (MFP) 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (39 preceding siblings ...) 2010-07-01 17:31 ` [patch 040/149] mac80211: give warning if building w/out rate ctrl algorithm Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 042/149] mac80211: fix rts threshold check Greg KH ` (107 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jouni Malinen, John W. Linville 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Jouni Malinen <j@w1.fi> commit d211e90e28a074447584729018a39910d691d1a8 upstream. Commit e34e09401ee9888dd662b2fca5d607794a56daf2 incorrectly removed use of ieee80211_has_protected() from the management frame case and in practice, made this validation drop all Action frames when MFP is enabled. This should have only been done for frames with Protected field set to zero. Signed-off-by: Jouni Malinen <j@w1.fi> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/mac80211/rx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1220,7 +1220,8 @@ ieee80211_drop_unencrypted(struct ieee80 (rx->key || rx->sdata->drop_unencrypted))) return -EACCES; if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) { - if (unlikely(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && + if (unlikely(!ieee80211_has_protected(fc) && + ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && rx->key)) return -EACCES; /* BIP does not use Protected field, so need to check MMIE */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 042/149] mac80211: fix rts threshold check 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (40 preceding siblings ...) 2010-07-01 17:31 ` [patch 041/149] mac80211: Fix robust management frame handling (MFP) Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 043/149] drm/i915: Reject bind_to_gtt() early if object > aperture Greg KH ` (106 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Shanyu Zhao, John W. Linville 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Shanyu Zhao <shanyu.zhao@intel.com> commit a2c40249a36d0b4d76d1caf6bf806e4ae5b06e8a upstream. Currently whenever rts thresold is set, every packet will use RTS protection no matter its size exceeds the threshold or not. This is due to a bug in the rts threshold check. if (len > tx->local->hw.wiphy->rts_threshold) { txrc.rts = rts = true; } Basically it is comparing an int (len) and a u32 (rts_threshold), and the variable len is assigned as: len = min_t(int, tx->skb->len + FCS_LEN, tx->local->hw.wiphy->frag_threshold); However, when frag_threshold is "-1", len is always "-1", which is 0xffffffff therefore rts is always set to true. Signed-off-by: Shanyu Zhao <shanyu.zhao@intel.com> Reviewed-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/mac80211/tx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -496,7 +496,8 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021 struct ieee80211_hdr *hdr = (void *)tx->skb->data; struct ieee80211_supported_band *sband; struct ieee80211_rate *rate; - int i, len; + int i; + u32 len; bool inval = false, rts = false, short_preamble = false; struct ieee80211_tx_rate_control txrc; u32 sta_flags; @@ -505,7 +506,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021 sband = tx->local->hw.wiphy->bands[tx->channel->band]; - len = min_t(int, tx->skb->len + FCS_LEN, + len = min_t(u32, tx->skb->len + FCS_LEN, tx->local->hw.wiphy->frag_threshold); /* set up the tx rate control struct we give the RC algo */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 043/149] drm/i915: Reject bind_to_gtt() early if object > aperture 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (41 preceding siblings ...) 2010-07-01 17:31 ` [patch 042/149] mac80211: fix rts threshold check Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 044/149] drivers/base/cpu.c: fix the output from /sys/devices/system/cpu/offline Greg KH ` (105 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Chris Wilson, Eric Anholt 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Chris Wilson <chris@chris-wilson.co.uk> commit 654fc6073f68efa3b6c466825749e73e7fbb92cd upstream. If the object is bigger than the entire aperture, reject it early before evicting everything in a vain attempt to find space. v2: Use E2BIG as suggested by Owain G. Ainsworth. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/i915/i915_gem.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -2615,6 +2615,14 @@ i915_gem_object_bind_to_gtt(struct drm_g return -EINVAL; } + /* If the object is bigger than the entire aperture, reject it early + * before evicting everything in a vain attempt to find space. + */ + if (obj->size > dev->gtt_total) { + DRM_ERROR("Attempting to bind an object larger than the aperture\n"); + return -E2BIG; + } + search_free: free_space = drm_mm_search_free(&dev_priv->mm.gtt_space, obj->size, alignment, 0); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 044/149] drivers/base/cpu.c: fix the output from /sys/devices/system/cpu/offline 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (42 preceding siblings ...) 2010-07-01 17:31 ` [patch 043/149] drm/i915: Reject bind_to_gtt() early if object > aperture Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 045/149] can: Fix SJA1000 command register writes on SMP systems Greg KH ` (104 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jan Beulich, Andi Kleen, Stephen Rothwell 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Jan Beulich <JBeulich@novell.com> commit cdc6e3d3968052cebb2f2ddcd742bff29fbd1a90 upstream. Without CONFIG_CPUMASK_OFFSTACK, simply inverting cpu_online_mask leads to CPUs beyond nr_cpu_ids to be displayed twice and CPUs not even possible to be displayed as offline. Signed-off-by: Jan Beulich <jbeulich@novell.com> Cc: Andi Kleen <ak@linux.intel.com> Cc: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/base/cpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/base/cpu.c +++ b/drivers/base/cpu.c @@ -149,7 +149,7 @@ static ssize_t print_cpus_offline(struct /* display offline cpus < nr_cpu_ids */ if (!alloc_cpumask_var(&offline, GFP_KERNEL)) return -ENOMEM; - cpumask_complement(offline, cpu_online_mask); + cpumask_andnot(offline, cpu_possible_mask, cpu_online_mask); n = cpulist_scnprintf(buf, len, offline); free_cpumask_var(offline); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 045/149] can: Fix SJA1000 command register writes on SMP systems 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (43 preceding siblings ...) 2010-07-01 17:31 ` [patch 044/149] drivers/base/cpu.c: fix the output from /sys/devices/system/cpu/offline Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 046/149] PCI quirk: Disable MSI on VIA K8T890 systems Greg KH ` (103 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Oliver Hartkopp, Wolfgang Grandegger, David S. Miller 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Oliver Hartkopp <socketcan@hartkopp.net> commit 57c8a456640fa3ca777652f11f2db4179a3e66b6 upstream. The SJA1000 command register is concurrently written in the rx-path to free the receive buffer _and_ in the tx-path to start the transmission. The SJA1000 data sheet, 6.4.4 COMMAND REGISTER (CMR) states: "Between two commands at least one internal clock cycle is needed in order to proceed. The internal clock is half of the external oscillator frequency." On SMP systems the current implementation leads to a write stall in the tx-path, which can be solved by adding some general locking and some time to settle the write_reg() operation for the command register. Thanks to Klaus Hitschler for the original fix and detailed problem description. This patch applies on net-2.6 and (with some offsets) on net-next-2.6 . Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Acked-by: Wolfgang Grandegger <wg@grandegger.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/can/sja1000/sja1000.c | 20 +++++++++++++++++--- drivers/net/can/sja1000/sja1000.h | 1 + 2 files changed, 18 insertions(+), 3 deletions(-) --- a/drivers/net/can/sja1000/sja1000.c +++ b/drivers/net/can/sja1000/sja1000.c @@ -84,6 +84,20 @@ static struct can_bittiming_const sja100 .brp_inc = 1, }; +static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val) +{ + unsigned long flags; + + /* + * The command register needs some locking and time to settle + * the write_reg() operation - especially on SMP systems. + */ + spin_lock_irqsave(&priv->cmdreg_lock, flags); + priv->write_reg(priv, REG_CMR, val); + priv->read_reg(priv, REG_SR); + spin_unlock_irqrestore(&priv->cmdreg_lock, flags); +} + static int sja1000_probe_chip(struct net_device *dev) { struct sja1000_priv *priv = netdev_priv(dev); @@ -279,7 +293,7 @@ static netdev_tx_t sja1000_start_xmit(st can_put_echo_skb(skb, dev, 0); - priv->write_reg(priv, REG_CMR, CMD_TR); + sja1000_write_cmdreg(priv, CMD_TR); return NETDEV_TX_OK; } @@ -334,7 +348,7 @@ static void sja1000_rx(struct net_device cf->data[i++] = 0; /* release receive buffer */ - priv->write_reg(priv, REG_CMR, CMD_RRB); + sja1000_write_cmdreg(priv, CMD_RRB); netif_rx(skb); @@ -368,7 +382,7 @@ static int sja1000_err(struct net_device cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW; stats->rx_over_errors++; stats->rx_errors++; - priv->write_reg(priv, REG_CMR, CMD_CDO); /* clear bit */ + sja1000_write_cmdreg(priv, CMD_CDO); /* clear bit */ } if (isrc & IRQ_EI) { --- a/drivers/net/can/sja1000/sja1000.h +++ b/drivers/net/can/sja1000/sja1000.h @@ -165,6 +165,7 @@ struct sja1000_priv { void __iomem *reg_base; /* ioremap'ed address to registers */ unsigned long irq_flags; /* for request_irq() */ + spinlock_t cmdreg_lock; /* lock for concurrent cmd register writes */ u16 flags; /* custom mode flags */ u8 ocr; /* output control register */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 046/149] PCI quirk: Disable MSI on VIA K8T890 systems 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (44 preceding siblings ...) 2010-07-01 17:31 ` [patch 045/149] can: Fix SJA1000 command register writes on SMP systems Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 047/149] PCI quirks: disable msi on AMD rs4xx internal gfx bridges Greg KH ` (102 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Matthew Wilcox, Jesse Barnes 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Matthew Wilcox <matthew@wil.cx> commit 134b345081534235dbf228b1005c14590e0570ba upstream. Bugzilla 15287 indicates that there's a problem with Message Signalled Interrupts on VIA K8T890 systems. Add a quirk to disable MSI on these systems. Signed-off-by: Matthew Wilcox <willy@linux.intel.com> Tested-by: Jan Kreuzer <kontrollator@gmx.de> Tested-by: lh <jarryson@gmail.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -2092,6 +2092,7 @@ static void __devinit quirk_disable_msi( } } DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi); +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi); /* Go through the list of Hypertransport capabilities and * return 1 if a HT MSI capability is found and enabled */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 047/149] PCI quirks: disable msi on AMD rs4xx internal gfx bridges 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (45 preceding siblings ...) 2010-07-01 17:31 ` [patch 046/149] PCI quirk: Disable MSI on VIA K8T890 systems Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 048/149] PCI: Disable MSI for MCP55 on P5N32-E SLI Greg KH ` (101 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Alex Deucher, Jesse Barnes 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Alex Deucher <alexdeucher@gmail.com> commit 9313ff450400e6a2ab10fe6b9bdb12a828329410 upstream. Doesn't work reliably for internal gfx. Fixes kernel bug https://bugzilla.kernel.org/show_bug.cgi?id=15626. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -2093,6 +2093,7 @@ static void __devinit quirk_disable_msi( } DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi); DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi); +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi); /* Go through the list of Hypertransport capabilities and * return 1 if a HT MSI capability is found and enabled */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 048/149] PCI: Disable MSI for MCP55 on P5N32-E SLI 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (46 preceding siblings ...) 2010-07-01 17:31 ` [patch 047/149] PCI quirks: disable msi on AMD rs4xx internal gfx bridges Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 049/149] virtio_net: Make delayed refill more reliable Greg KH ` (100 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ben Hutchings, Jesse Barnes 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Ben Hutchings <ben@decadent.org.uk> commit e4146bb9088c01c8b6e82be11f0c371f8aff023c upstream. As reported in <http://bugs.debian.org/552299>, MSI appears to be broken for this on-board device. We already have a quirk for the P5N32-SLI Premium; extend it to cover both variants of the board. Reported-by: Romain DEGEZ <romain.degez@smartjog.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/pci/quirks.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -2185,15 +2185,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8132_BRIDGE, ht_enable_msi_mapping); -/* The P5N32-SLI Premium motherboard from Asus has a problem with msi +/* The P5N32-SLI motherboards from Asus have a problem with msi * for the MCP55 NIC. It is not yet determined whether the msi problem * also affects other devices. As for now, turn off msi for this device. */ static void __devinit nvenet_msi_disable(struct pci_dev *dev) { - if (dmi_name_in_vendors("P5N32-SLI PREMIUM")) { + if (dmi_name_in_vendors("P5N32-SLI PREMIUM") || + dmi_name_in_vendors("P5N32-E SLI")) { dev_info(&dev->dev, - "Disabling msi for MCP55 NIC on P5N32-SLI Premium\n"); + "Disabling msi for MCP55 NIC on P5N32-SLI\n"); dev->no_msi = 1; } } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 049/149] virtio_net: Make delayed refill more reliable 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (47 preceding siblings ...) 2010-07-01 17:31 ` [patch 048/149] PCI: Disable MSI for MCP55 on P5N32-E SLI Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 050/149] mm: hugetlb: fix clear_huge_page() Greg KH ` (99 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Herbert Xu, Rusty Russell, David S. Miller, Bruce Rogers 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Herbert Xu <herbert@gondor.apana.org.au> commit 39d321577405e8e269fd238b278aaf2425fa788a upstream. I have seen RX stalls on a machine that experienced a suspected OOM. After the stall, the RX buffer is empty on the guest side and there are exactly 16 entries available on the host side. As the number of entries is less than that required by a maximal skb, the host cannot proceed. The guest did not have a refill job scheduled. My diagnosis is that an OOM had occured, with the delayed refill job scheduled. The job was able to allocate at least one skb, but not enough to overcome the minimum required by the host to proceed. As the refill job would only reschedule itself if it failed completely to allocate any skbs, this would lead to an RX stall. The following patch removes this stall possibility by always rescheduling the refill job until the ring is totally refilled. Testing has shown that the RX stall no longer occurs whereas previously it would occur within a day. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Acked-by: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by: David S. Miller <davem@davemloft.net> Cc: Bruce Rogers <brogers@novell.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/virtio_net.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -398,8 +398,7 @@ static void refill_work(struct work_stru vi = container_of(work, struct virtnet_info, refill.work); napi_disable(&vi->napi); - try_fill_recv(vi, GFP_KERNEL); - still_empty = (vi->num == 0); + still_empty = !try_fill_recv(vi, GFP_KERNEL); napi_enable(&vi->napi); /* In theory, this can happen: if we don't get any buffers in ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 050/149] mm: hugetlb: fix clear_huge_page() 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (48 preceding siblings ...) 2010-07-01 17:31 ` [patch 049/149] virtio_net: Make delayed refill more reliable Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 051/149] drm/edid: Fix 1024x768@85Hz Greg KH ` (98 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andrea Arcangeli, David Gibson, Mel Gorman, David Rientjes, Lee Schermerhorn 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Andrea Arcangeli <aarcange@redhat.com> commit 74dbdd239bb1348ad86d28b18574d9c1f28b62ca upstream. sz is in bytes, MAX_ORDER_NR_PAGES is in pages. Signed-off-by: Andrea Arcangeli <aarcange@redhat.com> Acked-by: David Gibson <dwg@au1.ibm.com> Cc: Mel Gorman <mel@csn.ul.ie> Cc: David Rientjes <rientjes@google.com> Cc: Lee Schermerhorn <lee.schermerhorn@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- mm/hugetlb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -401,7 +401,7 @@ static void clear_huge_page(struct page { int i; - if (unlikely(sz > MAX_ORDER_NR_PAGES)) { + if (unlikely(sz/PAGE_SIZE > MAX_ORDER_NR_PAGES)) { clear_gigantic_page(page, addr, sz); return; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 051/149] drm/edid: Fix 1024x768@85Hz 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (49 preceding siblings ...) 2010-07-01 17:31 ` [patch 050/149] mm: hugetlb: fix clear_huge_page() Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 052/149] drm/radeon/kms/atom: fix typo in LVDS panel info parsing Greg KH ` (97 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Adam Jackson, Dave Airlie 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Adam Jackson <ajax@redhat.com> commit 61dd98fad58f945ed720ba132681acb58fcee015 upstream. Having hsync both start and end on pixel 1072 ain't gonna work very well. Matches the X server's list. Signed-off-by: Adam Jackson <ajax@redhat.com> Tested-By: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/drm_edid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -324,7 +324,7 @@ static struct drm_display_mode drm_dmt_m DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) }, /* 1024x768@85Hz */ { DRM_MODE("1024x768", DRM_MODE_TYPE_DRIVER, 94500, 1024, 1072, - 1072, 1376, 0, 768, 769, 772, 808, 0, + 1168, 1376, 0, 768, 769, 772, 808, 0, DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) }, /* 1152x864@75Hz */ { DRM_MODE("1152x864", DRM_MODE_TYPE_DRIVER, 108000, 1152, 1216, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 052/149] drm/radeon/kms/atom: fix typo in LVDS panel info parsing 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (50 preceding siblings ...) 2010-07-01 17:31 ` [patch 051/149] drm/edid: Fix 1024x768@85Hz Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 053/149] powerpc: Fix handling of strncmp with zero len Greg KH ` (96 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Alex Deucher, Dave Airlie 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Alex Deucher <alexdeucher@gmail.com> commit 1ff26a3604d0292988d4cade0e49ba9918dbfd46 upstream. Fixes LVDS issues on some laptops; notably laptops with 2048x1536 panels. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/radeon/radeon_atombios.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/radeon/radeon_atombios.c +++ b/drivers/gpu/drm/radeon/radeon_atombios.c @@ -942,7 +942,7 @@ struct radeon_encoder_atom_dig *radeon_a lvds->native_mode.vtotal = lvds->native_mode.vdisplay + le16_to_cpu(lvds_info->info.sLCDTiming.usVBlanking_Time); lvds->native_mode.vsync_start = lvds->native_mode.vdisplay + - le16_to_cpu(lvds_info->info.sLCDTiming.usVSyncWidth); + le16_to_cpu(lvds_info->info.sLCDTiming.usVSyncOffset); lvds->native_mode.vsync_end = lvds->native_mode.vsync_start + le16_to_cpu(lvds_info->info.sLCDTiming.usVSyncWidth); lvds->panel_pwr_delay = ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 053/149] powerpc: Fix handling of strncmp with zero len 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (51 preceding siblings ...) 2010-07-01 17:31 ` [patch 052/149] drm/radeon/kms/atom: fix typo in LVDS panel info parsing Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 054/149] powerpc/pseries: Only call start-cpu when a CPU is stopped Greg KH ` (95 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jeff Mahoney, Benjamin Herrenschmidt 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Jeff Mahoney <jeffm@suse.com> commit 637a99022fb119b90fb281715d13172f0394fc12 upstream. Commit 0119536c, which added the assembly version of strncmp to powerpc, mentions that it adds two instructions to the version from boot/string.S to allow it to handle len=0. Unfortunately, it doesn't always return 0 when that is the case. The length is passed in r5, but the return value is passed back in r3. In certain cases, this will happen to work. Otherwise it will pass back the address of the first string as the return value. This patch lifts the len <= 0 handling code from memcpy to handle that case. Reported by: Christian_Sellars@symantec.com Signed-off-by: Jeff Mahoney <jeffm@suse.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/lib/string.S | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/arch/powerpc/lib/string.S +++ b/arch/powerpc/lib/string.S @@ -71,7 +71,7 @@ _GLOBAL(strcmp) _GLOBAL(strncmp) PPC_LCMPI r5,0 - beqlr + ble- 2f mtctr r5 addi r5,r3,-1 addi r4,r4,-1 @@ -82,6 +82,8 @@ _GLOBAL(strncmp) beqlr 1 bdnzt eq,1b blr +2: li r3,0 + blr _GLOBAL(strlen) addi r4,r3,-1 ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 054/149] powerpc/pseries: Only call start-cpu when a CPU is stopped 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (52 preceding siblings ...) 2010-07-01 17:31 ` [patch 053/149] powerpc: Fix handling of strncmp with zero len Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-02 0:03 ` Michael Neuling 2010-07-01 17:31 ` [patch 055/149] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c Greg KH ` (94 subsequent siblings) 148 siblings, 1 reply; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Michael Neuling, Benjamin Herrenschmidt 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Michael Neuling <mikey@neuling.org> commit aef40e87d866355ffd279ab21021de733242d0d5 upstream. Currently we always call start-cpu irrespective of if the CPU is stopped or not. Unfortunatley on POWER7, firmware seems to not like start-cpu being called when a cpu already been started. This was not the case on POWER6 and earlier. This patch checks to see if the CPU is stopped or not via an query-cpu-stopped-state call, and only calls start-cpu on CPUs which are stopped. This fixes a bug with kexec on POWER7 on PHYP where only the primary thread would make it to the second kernel. Reported-by: Ankita Garg <ankita@linux.vnet.ibm.com> Signed-off-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/platforms/pseries/smp.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/arch/powerpc/platforms/pseries/smp.c +++ b/arch/powerpc/platforms/pseries/smp.c @@ -81,6 +81,12 @@ static inline int __devinit smp_startup_ pcpu = get_hard_smp_processor_id(lcpu); + /* Check to see if the CPU out of FW already for kexec */ + if (smp_query_cpu_stopped(pcpu) == QCSS_NOT_STOPPED){ + cpu_set(lcpu, of_spin_map); + return 1; + } + /* Fixup atomic count: it exited inside IRQ handler. */ task_thread_info(paca[lcpu].__current)->preempt_count = 0; ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 054/149] powerpc/pseries: Only call start-cpu when a CPU is stopped 2010-07-01 17:31 ` [patch 054/149] powerpc/pseries: Only call start-cpu when a CPU is stopped Greg KH @ 2010-07-02 0:03 ` Michael Neuling 2010-07-03 1:57 ` Greg KH 0 siblings, 1 reply; 666+ messages in thread From: Michael Neuling @ 2010-07-02 0:03 UTC (permalink / raw) To: Greg KH Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Benjamin Herrenschmidt This is not going to work without: f8b67691828321f5c85bb853283aa101ae673130 It'll get a build failure. You seemed to have pulled this one the 33 stable. Mikey In message <20100701173211.356448329@clark.site> you wrote: > 2.6.32-stable review patch. If anyone has any objections, please let us know . > > ------------------ > > From: Michael Neuling <mikey@neuling.org> > > commit aef40e87d866355ffd279ab21021de733242d0d5 upstream. > > Currently we always call start-cpu irrespective of if the CPU is > stopped or not. Unfortunatley on POWER7, firmware seems to not like > start-cpu being called when a cpu already been started. This was not > the case on POWER6 and earlier. > > This patch checks to see if the CPU is stopped or not via an > query-cpu-stopped-state call, and only calls start-cpu on CPUs which > are stopped. > > This fixes a bug with kexec on POWER7 on PHYP where only the primary > thread would make it to the second kernel. > > Reported-by: Ankita Garg <ankita@linux.vnet.ibm.com> > Signed-off-by: Michael Neuling <mikey@neuling.org> > Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> > > --- > arch/powerpc/platforms/pseries/smp.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > --- a/arch/powerpc/platforms/pseries/smp.c > +++ b/arch/powerpc/platforms/pseries/smp.c > @@ -81,6 +81,12 @@ static inline int __devinit smp_startup_ > > pcpu = get_hard_smp_processor_id(lcpu); > > + /* Check to see if the CPU out of FW already for kexec */ > + if (smp_query_cpu_stopped(pcpu) == QCSS_NOT_STOPPED){ > + cpu_set(lcpu, of_spin_map); > + return 1; > + } > + > /* Fixup atomic count: it exited inside IRQ handler. */ > task_thread_info(paca[lcpu].__current)->preempt_count = 0; > > > ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 054/149] powerpc/pseries: Only call start-cpu when a CPU is stopped 2010-07-02 0:03 ` Michael Neuling @ 2010-07-03 1:57 ` Greg KH 2010-07-03 7:54 ` Michael Neuling 0 siblings, 1 reply; 666+ messages in thread From: Greg KH @ 2010-07-03 1:57 UTC (permalink / raw) To: Michael Neuling Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Benjamin Herrenschmidt On Fri, Jul 02, 2010 at 10:03:41AM +1000, Michael Neuling wrote: > This is not going to work without: > f8b67691828321f5c85bb853283aa101ae673130 > > It'll get a build failure. That is because that patch does not apply to the .32 series. If it is needed, can you please send me a backported version to apply? thanks, greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 054/149] powerpc/pseries: Only call start-cpu when a CPU is stopped 2010-07-03 1:57 ` Greg KH @ 2010-07-03 7:54 ` Michael Neuling 2010-07-05 17:03 ` Greg KH 0 siblings, 1 reply; 666+ messages in thread From: Michael Neuling @ 2010-07-03 7:54 UTC (permalink / raw) To: Greg KH Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Benjamin Herrenschmidt > > This is not going to work without: > > f8b67691828321f5c85bb853283aa101ae673130 > > > > It'll get a build failure. > > That is because that patch does not apply to the .32 series. If it is > needed, can you please send me a backported version to apply? Sure... Compile and boot tested only. Thanks, Mikey From: Michael Neuling <mikey@neuling.org> powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu This moves query_cpu_stopped() out of the hotplug cpu code and into smp.c so it can called in other places and renames it to smp_query_cpu_stopped(). It also cleans up the return values by adding some #defines Cc: <stable@kernel.org> Signed-off-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Index: clone1/arch/powerpc/platforms/pseries/hotplug-cpu.c =================================================================== --- clone1.orig/arch/powerpc/platforms/pseries/hotplug-cpu.c +++ clone1/arch/powerpc/platforms/pseries/hotplug-cpu.c @@ -66,30 +66,6 @@ static void pseries_mach_cpu_die(void) for(;;); } -static int qcss_tok; /* query-cpu-stopped-state token */ - -/* Get state of physical CPU. - * Return codes: - * 0 - The processor is in the RTAS stopped state - * 1 - stop-self is in progress - * 2 - The processor is not in the RTAS stopped state - * -1 - Hardware Error - * -2 - Hardware Busy, Try again later. - */ -static int query_cpu_stopped(unsigned int pcpu) -{ - int cpu_status, status; - - status = rtas_call(qcss_tok, 1, 2, &cpu_status, pcpu); - if (status != 0) { - printk(KERN_ERR - "RTAS query-cpu-stopped-state failed: %i\n", status); - return status; - } - - return cpu_status; -} - static int pseries_cpu_disable(void) { int cpu = smp_processor_id(); @@ -113,8 +89,9 @@ static void pseries_cpu_die(unsigned int unsigned int pcpu = get_hard_smp_processor_id(cpu); for (tries = 0; tries < 25; tries++) { - cpu_status = query_cpu_stopped(pcpu); - if (cpu_status == 0 || cpu_status == -1) + cpu_status = smp_query_cpu_stopped(pcpu); + if (cpu_status == QCSS_STOPPED || + cpu_status == QCSS_HARDWARE_ERROR) break; cpu_relax(); } @@ -256,6 +233,7 @@ static int __init pseries_cpu_hotplug_in { struct device_node *np; const char *typep; + int qcss_tok; for_each_node_by_name(np, "interrupt-controller") { typep = of_get_property(np, "compatible", NULL); Index: clone1/arch/powerpc/platforms/pseries/plpar_wrappers.h =================================================================== --- clone1.orig/arch/powerpc/platforms/pseries/plpar_wrappers.h +++ clone1/arch/powerpc/platforms/pseries/plpar_wrappers.h @@ -4,6 +4,14 @@ #include <asm/hvcall.h> #include <asm/page.h> +/* Get state of physical CPU from query_cpu_stopped */ +int smp_query_cpu_stopped(unsigned int pcpu); +#define QCSS_STOPPED 0 +#define QCSS_STOPPING 1 +#define QCSS_NOT_STOPPED 2 +#define QCSS_HARDWARE_ERROR -1 +#define QCSS_HARDWARE_BUSY -2 + static inline long poll_pending(void) { return plpar_hcall_norets(H_POLL_PENDING); Index: clone1/arch/powerpc/platforms/pseries/smp.c =================================================================== --- clone1.orig/arch/powerpc/platforms/pseries/smp.c +++ clone1/arch/powerpc/platforms/pseries/smp.c @@ -56,6 +56,28 @@ */ static cpumask_t of_spin_map; +/* Query where a cpu is now. Return codes #defined in plpar_wrappers.h */ +int smp_query_cpu_stopped(unsigned int pcpu) +{ + int cpu_status, status; + int qcss_tok = rtas_token("query-cpu-stopped-state"); + + if (qcss_tok == RTAS_UNKNOWN_SERVICE) { + printk(KERN_INFO "Firmware doesn't support " + "query-cpu-stopped-state\n"); + return QCSS_HARDWARE_ERROR; + } + + status = rtas_call(qcss_tok, 1, 2, &cpu_status, pcpu); + if (status != 0) { + printk(KERN_ERR + "RTAS query-cpu-stopped-state failed: %i\n", status); + return status; + } + + return cpu_status; +} + /** * smp_startup_cpu() - start the given cpu * ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 054/149] powerpc/pseries: Only call start-cpu when a CPU is stopped 2010-07-03 7:54 ` Michael Neuling @ 2010-07-05 17:03 ` Greg KH 0 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-05 17:03 UTC (permalink / raw) To: Michael Neuling Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Benjamin Herrenschmidt On Sat, Jul 03, 2010 at 05:54:45PM +1000, Michael Neuling wrote: > > > This is not going to work without: > > > f8b67691828321f5c85bb853283aa101ae673130 > > > > > > It'll get a build failure. > > > > That is because that patch does not apply to the .32 series. If it is > > needed, can you please send me a backported version to apply? > > Sure... Compile and boot tested only. Applied now, thanks, greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 055/149] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (53 preceding siblings ...) 2010-07-01 17:31 ` [patch 054/149] powerpc/pseries: Only call start-cpu when a CPU is stopped Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 056/149] writeback: disable periodic old data writeback for !dirty_writeback_centisecs Greg KH ` (93 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Denis Kirjanov, Robert Richter 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Denis Kirjanov <dkirjanov@hera.kernel.org> commit 238c1a78c957f3dc7cb848b161dcf4805793ed56 upstream. Fix potential initial_lfsr buffer overrun. Writing past the end of the buffer could happen when index == ENTRIES Signed-off-by: Denis Kirjanov <dkirjanov@kernel.org> Signed-off-by: Robert Richter <robert.richter@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/oprofile/op_model_cell.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/powerpc/oprofile/op_model_cell.c +++ b/arch/powerpc/oprofile/op_model_cell.c @@ -1077,7 +1077,7 @@ static int calculate_lfsr(int n) index = ENTRIES-1; /* make sure index is valid */ - if ((index > ENTRIES) || (index < 0)) + if ((index >= ENTRIES) || (index < 0)) index = ENTRIES-1; return initial_lfsr[index]; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 056/149] writeback: disable periodic old data writeback for !dirty_writeback_centisecs 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (54 preceding siblings ...) 2010-07-01 17:31 ` [patch 055/149] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 057/149] md/raid1: fix counting of write targets Greg KH ` (92 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Jens Axboe 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Jens Axboe <jens.axboe@oracle.com> commit 69b62d01ec44fe0d505d89917392347732135a4d upstream. Prior to 2.6.32, setting /proc/sys/vm/dirty_writeback_centisecs disabled periodic dirty writeback from kupdate. This got broken and now causes excessive sys CPU usage if set to zero, as we'll keep beating on schedule(). Reported-by: Justin Maggard <jmaggard10@gmail.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/fs-writeback.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) --- a/fs/fs-writeback.c +++ b/fs/fs-writeback.c @@ -859,6 +859,12 @@ static long wb_check_old_data_flush(stru unsigned long expired; long nr_pages; + /* + * When set to zero, disable periodic writeback + */ + if (!dirty_writeback_interval) + return 0; + expired = wb->last_old_flush + msecs_to_jiffies(dirty_writeback_interval * 10); if (time_before(jiffies, expired)) @@ -954,8 +960,12 @@ int bdi_writeback_task(struct bdi_writeb break; } - wait_jiffies = msecs_to_jiffies(dirty_writeback_interval * 10); - schedule_timeout_interruptible(wait_jiffies); + if (dirty_writeback_interval) { + wait_jiffies = msecs_to_jiffies(dirty_writeback_interval * 10); + schedule_timeout_interruptible(wait_jiffies); + } else + schedule(); + try_to_freeze(); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 057/149] md/raid1: fix counting of write targets. 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (55 preceding siblings ...) 2010-07-01 17:31 ` [patch 056/149] writeback: disable periodic old data writeback for !dirty_writeback_centisecs Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 058/149] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB Greg KH ` (91 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: NeilBrown <neilb@suse.de> commit 964147d5c86d63be79b442c30f3783d49860c078 upstream. There is a very small race window when writing to a RAID1 such that if a device is marked faulty at exactly the wrong time, the write-in-progress will not be sent to the device, but the bitmap (if present) will be updated to say that the write was sent. Then if the device turned out to still be usable as was re-added to the array, the bitmap-based-resync would skip resyncing that block, possibly leading to corruption. This would only be a problem if no further writes were issued to that area of the device (i.e. that bitmap chunk). Suitable for any pending -stable kernel. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/raid1.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -891,9 +891,10 @@ static int make_request(struct request_q if (test_bit(Faulty, &rdev->flags)) { rdev_dec_pending(rdev, mddev); r1_bio->bios[i] = NULL; - } else + } else { r1_bio->bios[i] = bio; - targets++; + targets++; + } } else r1_bio->bios[i] = NULL; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 058/149] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (56 preceding siblings ...) 2010-07-01 17:31 ` [patch 057/149] md/raid1: fix counting of write targets Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 059/149] md: set mddev readonly flag on blkdev BLKROSET ioctl Greg KH ` (90 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: NeilBrown <neilb@suse.de> commit af3a2cd6b8a479345786e7fe5e199ad2f6240e56 upstream. read_balance uses a "unsigned long" for a sector number which will get truncated beyond 2TB. This will cause read-balancing to be non-optimal, and can cause data to be read from the 'wrong' branch during a resync. This has a very small chance of returning wrong data. Reported-by: Jordan Russell <jr-list-2010@quo.to> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/raid1.c | 4 ++-- drivers/md/raid10.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -417,7 +417,7 @@ static void raid1_end_write_request(stru */ static int read_balance(conf_t *conf, r1bio_t *r1_bio) { - const unsigned long this_sector = r1_bio->sector; + const sector_t this_sector = r1_bio->sector; int new_disk = conf->last_used, disk = new_disk; int wonly_disk = -1; const int sectors = r1_bio->sectors; @@ -433,7 +433,7 @@ static int read_balance(conf_t *conf, r1 retry: if (conf->mddev->recovery_cp < MaxSector && (this_sector + sectors >= conf->next_resync)) { - /* Choose the first operation device, for consistancy */ + /* Choose the first operational device, for consistancy */ new_disk = 0; for (rdev = rcu_dereference(conf->mirrors[new_disk].rdev); --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -493,7 +493,7 @@ static int raid10_mergeable_bvec(struct */ static int read_balance(conf_t *conf, r10bio_t *r10_bio) { - const unsigned long this_sector = r10_bio->sector; + const sector_t this_sector = r10_bio->sector; int disk, slot, nslot; const int sectors = r10_bio->sectors; sector_t new_distance, current_distance; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 059/149] md: set mddev readonly flag on blkdev BLKROSET ioctl 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (57 preceding siblings ...) 2010-07-01 17:31 ` [patch 058/149] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 060/149] x86/amd-iommu: Fix suspend/resume with IOMMU Greg KH ` (89 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dan Williams, NeilBrown 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Dan Williams <dan.j.williams@intel.com> commit e2218350465e7e0931676b4849b594c978437bce upstream. When the user sets the block device to readwrite then the mddev should follow suit. Otherwise, the BUG_ON in md_write_start() will be set to trigger. The reverse direction, setting mddev->ro to match a set readonly request, can be ignored because the blkdev level readonly flag precludes the need to have mddev->ro set correctly. Nevermind the fact that setting mddev->ro to 1 may fail if the array is in use. Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/md.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -5334,6 +5334,7 @@ static int md_ioctl(struct block_device int err = 0; void __user *argp = (void __user *)arg; mddev_t *mddev = NULL; + int ro; if (!capable(CAP_SYS_ADMIN)) return -EACCES; @@ -5469,6 +5470,34 @@ static int md_ioctl(struct block_device err = do_md_stop(mddev, 1, 1); goto done_unlock; + case BLKROSET: + if (get_user(ro, (int __user *)(arg))) { + err = -EFAULT; + goto done_unlock; + } + err = -EINVAL; + + /* if the bdev is going readonly the value of mddev->ro + * does not matter, no writes are coming + */ + if (ro) + goto done_unlock; + + /* are we are already prepared for writes? */ + if (mddev->ro != 1) + goto done_unlock; + + /* transitioning to readauto need only happen for + * arrays that call md_write_start + */ + if (mddev->pers) { + err = restart_array(mddev); + if (err == 0) { + mddev->ro = 2; + set_disk_ro(mddev->gendisk, 0); + } + } + goto done_unlock; } /* ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 060/149] x86/amd-iommu: Fix suspend/resume with IOMMU 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (58 preceding siblings ...) 2010-07-01 17:31 ` [patch 059/149] md: set mddev readonly flag on blkdev BLKROSET ioctl Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 061/149] exofs: confusion between kmap() and kmap_atomic() api Greg KH ` (88 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, iommu, Joerg Roedel 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> This is a suspend resume fix for 2.6.32-stable inclusion. The problem with this patch is that it is not upstream because the code changed with 2.6.33 and the function where this bug is in was removed. So this fix does not make sense anymore for anything later than 2.6.32. The patch was tested by multiple partys and is confirmed to fix the broken suspend/resume issue with the 2.6.32 kernel. This patch fixes suspend/resume with AMD IOMMU enabled. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/kernel/amd_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/x86/kernel/amd_iommu.c +++ b/arch/x86/kernel/amd_iommu.c @@ -544,7 +544,7 @@ static void flush_devices_by_domain(stru for (i = 0; i <= amd_iommu_last_bdf; ++i) { if ((domain == NULL && amd_iommu_pd_table[i] == NULL) || - (amd_iommu_pd_table[i] != domain)) + (domain != NULL && amd_iommu_pd_table[i] != domain)) continue; iommu = amd_iommu_rlookup_table[i]; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 061/149] exofs: confusion between kmap() and kmap_atomic() api 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (59 preceding siblings ...) 2010-07-01 17:31 ` [patch 060/149] x86/amd-iommu: Fix suspend/resume with IOMMU Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 062/149] mn10300: set ARCH_KMALLOC_MINALIGN Greg KH ` (87 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dan Carpenter, Boaz Harrosh 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Dan Carpenter <error27@gmail.com> commit ddf08f4b90a413892bbb9bb2e8a57aed991cd47d upstream. For kmap_atomic() we call kunmap_atomic() on the returned pointer. That's different from kmap() and kunmap() and so it's easy to get them backwards. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Boaz Harrosh <bharrosh@panasas.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/exofs/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/exofs/dir.c +++ b/fs/exofs/dir.c @@ -608,7 +608,7 @@ int exofs_make_empty(struct inode *inode de->inode_no = cpu_to_le64(parent->i_ino); memcpy(de->name, PARENT_DIR, sizeof(PARENT_DIR)); exofs_set_de_type(de, inode); - kunmap_atomic(page, KM_USER0); + kunmap_atomic(kaddr, KM_USER0); err = exofs_commit_chunk(page, 0, chunk_size); fail: page_cache_release(page); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 062/149] mn10300: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (60 preceding siblings ...) 2010-07-01 17:31 ` [patch 061/149] exofs: confusion between kmap() and kmap_atomic() api Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 063/149] m68k: " Greg KH ` (86 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, David Howells, Koichi Yasutake, Pekka Enberg 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit 6cdafaae41d52e6ef9a5c5be23602ef083e4d0f9 upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Acked-by: David Howells <dhowells@redhat.com> Cc: Koichi Yasutake <yasutake.koichi@jp.panasonic.com> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/mn10300/include/asm/cache.h | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/mn10300/include/asm/cache.h +++ b/arch/mn10300/include/asm/cache.h @@ -21,6 +21,8 @@ #define L1_CACHE_DISPARITY L1_CACHE_NENTRIES * L1_CACHE_BYTES #endif +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES + /* data cache purge registers * - read from the register to unconditionally purge that cache line * - write address & 0xffffff00 to conditionally purge that cache line ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 063/149] m68k: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (61 preceding siblings ...) 2010-07-01 17:31 ` [patch 062/149] mn10300: set ARCH_KMALLOC_MINALIGN Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 064/149] rtc-cmos: do dev_set_drvdata() earlier in the initialization Greg KH ` (85 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, Geert Uytterhoeven, Roman Zippel, Pekka Enberg 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit dd6c26a66bdc629a500174ffe73b010b070b9f1b upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Cc: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Roman Zippel <zippel@linux-m68k.org> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/m68k/include/asm/cache.h | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/m68k/include/asm/cache.h +++ b/arch/m68k/include/asm/cache.h @@ -8,4 +8,6 @@ #define L1_CACHE_SHIFT 4 #define L1_CACHE_BYTES (1<< L1_CACHE_SHIFT) +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES + #endif ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 064/149] rtc-cmos: do dev_set_drvdata() earlier in the initialization 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (62 preceding siblings ...) 2010-07-01 17:31 ` [patch 063/149] m68k: " Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 065/149] rtc: s3c: initialize driver data before using it Greg KH ` (84 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dan Carpenter, Alessandro Zummo, Paul Gortmaker, Malte Schroder, Ralf Baechle, Herton Ronaldo Krzesinski 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Dan Carpenter <error27@gmail.com> commit 6ba8bcd457d9fc793ac9435aa2e4138f571d4ec5 upstream. The bug is an oops when dev_get_drvdata() returned null in cmos_update_irq_enable(). The call tree looks like this: rtc_dev_ioctl() => rtc_update_irq_enable() => cmos_update_irq_enable() It's caused by a race condition in the module initialization. It is rtc_device_register() which makes the ioctl operations live so I moved the call to dev_set_drvdata() before the call to rtc_device_register(). Addresses https://bugzilla.kernel.org/show_bug.cgi?id=15963 Reported-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Dan Carpenter <error27@gmail.com> Tested-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: Alessandro Zummo <a.zummo@towertech.it> Cc: Paul Gortmaker <p_gortmaker@yahoo.com> Cc: Malte Schroder <maltesch@gmx.de> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Herton Ronaldo Krzesinski <herton@mandriva.com.br> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/rtc/rtc-cmos.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/rtc/rtc-cmos.c +++ b/drivers/rtc/rtc-cmos.c @@ -723,6 +723,9 @@ cmos_do_probe(struct device *dev, struct } } + cmos_rtc.dev = dev; + dev_set_drvdata(dev, &cmos_rtc); + cmos_rtc.rtc = rtc_device_register(driver_name, dev, &cmos_rtc_ops, THIS_MODULE); if (IS_ERR(cmos_rtc.rtc)) { @@ -730,8 +733,6 @@ cmos_do_probe(struct device *dev, struct goto cleanup0; } - cmos_rtc.dev = dev; - dev_set_drvdata(dev, &cmos_rtc); rename_region(ports, dev_name(&cmos_rtc.rtc->dev)); spin_lock_irq(&rtc_lock); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 065/149] rtc: s3c: initialize driver data before using it 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (63 preceding siblings ...) 2010-07-01 17:31 ` [patch 064/149] rtc-cmos: do dev_set_drvdata() earlier in the initialization Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 066/149] frv: set ARCH_KMALLOC_MINALIGN Greg KH ` (83 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Maurus Cuelenaere, Paul Gortmaker, Alessandro Zummo 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Maurus Cuelenaere <mcuelenaere@gmail.com> commit e893de59a4982791368b3ce412bc67dd601a88a0 upstream. s3c_rtc_setfreq() uses the platform driver data to derive struct rtc_device, so make sure drvdata is set _before_ s3c_rtc_setfreq() is called. Signed-off-by: Maurus Cuelenaere <mcuelenaere@gmail.com> Cc: Paul Gortmaker <p_gortmaker@yahoo.com> Cc: Alessandro Zummo <a.zummo@towertech.it> Cc: Maurus Cuelenaere <mcuelenaere@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/rtc/rtc-s3c.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/rtc/rtc-s3c.c +++ b/drivers/rtc/rtc-s3c.c @@ -456,8 +456,6 @@ static int __devinit s3c_rtc_probe(struc pr_debug("s3c2410_rtc: RTCCON=%02x\n", readb(s3c_rtc_base + S3C2410_RTCCON)); - s3c_rtc_setfreq(&pdev->dev, 1); - device_init_wakeup(&pdev->dev, 1); /* register RTC and exit */ @@ -474,6 +472,9 @@ static int __devinit s3c_rtc_probe(struc rtc->max_user_freq = 128; platform_set_drvdata(pdev, rtc); + + s3c_rtc_setfreq(&pdev->dev, 1); + return 0; err_nortc: ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 066/149] frv: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (64 preceding siblings ...) 2010-07-01 17:31 ` [patch 065/149] rtc: s3c: initialize driver data before using it Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 067/149] xtensa: " Greg KH ` (82 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, David Howells, Pekka Enberg 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit 69dcf3db03626c4f18de624e8632454ea12ff260 upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Acked-by: David Howells <dhowells@redhat.com> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/frv/include/asm/cache.h | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/frv/include/asm/cache.h +++ b/arch/frv/include/asm/cache.h @@ -17,6 +17,8 @@ #define L1_CACHE_SHIFT (CONFIG_FRV_L1_CACHE_SHIFT) #define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT) +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES + #define __cacheline_aligned __attribute__((aligned(L1_CACHE_BYTES))) #define ____cacheline_aligned __attribute__((aligned(L1_CACHE_BYTES))) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 067/149] xtensa: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (65 preceding siblings ...) 2010-07-01 17:31 ` [patch 066/149] frv: set ARCH_KMALLOC_MINALIGN Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 068/149] Blackfin: " Greg KH ` (81 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, Chris Zankel, Pekka Enberg 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit 498900fc9cd1adbad1ba6b55ed9d8f2f5d655ca3 upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Cc: Chris Zankel <chris@zankel.net> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/xtensa/include/asm/cache.h | 1 + 1 file changed, 1 insertion(+) --- a/arch/xtensa/include/asm/cache.h +++ b/arch/xtensa/include/asm/cache.h @@ -29,5 +29,6 @@ # define CACHE_WAY_SIZE ICACHE_WAY_SIZE #endif +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES #endif /* _XTENSA_CACHE_H */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 068/149] Blackfin: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (66 preceding siblings ...) 2010-07-01 17:31 ` [patch 067/149] xtensa: " Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 069/149] tmpfs: insert tmpfs cache pages to inactive list at first Greg KH ` (80 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, Pekka Enberg, Mike Frysinger 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit 76b99699a2bbf9efdb578f9a38a202af2ecb354b upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/blackfin/include/asm/cache.h | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/blackfin/include/asm/cache.h +++ b/arch/blackfin/include/asm/cache.h @@ -15,6 +15,8 @@ #define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT) #define SMP_CACHE_BYTES L1_CACHE_BYTES +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES + #ifdef CONFIG_SMP #define __cacheline_aligned #else ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 069/149] tmpfs: insert tmpfs cache pages to inactive list at first 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (67 preceding siblings ...) 2010-07-01 17:31 ` [patch 068/149] Blackfin: " Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 070/149] mlx4_core: Fix possible chunk sg list overflow in mlx4_alloc_icm() Greg KH ` (79 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, KOSAKI Motohiro, Hugh Dickins, Henrique de Moraes Holschuh 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> commit e9d6c157385e4efa61cb8293e425c9d8beba70d3 upstream. Shaohua Li reported parallel file copy on tmpfs can lead to OOM killer. This is regression of caused by commit 9ff473b9a7 ("vmscan: evict streaming IO first"). Wow, It is 2 years old patch! Currently, tmpfs file cache is inserted active list at first. This means that the insertion doesn't only increase numbers of pages in anon LRU, but it also reduces anon scanning ratio. Therefore, vmscan will get totally confused. It scans almost only file LRU even though the system has plenty unused tmpfs pages. Historically, lru_cache_add_active_anon() was used for two reasons. 1) Intend to priotize shmem page rather than regular file cache. 2) Intend to avoid reclaim priority inversion of used once pages. But we've lost both motivation because (1) Now we have separate anon and file LRU list. then, to insert active list doesn't help such priotize. (2) In past, one pte access bit will cause page activation. then to insert inactive list with pte access bit mean higher priority than to insert active list. Its priority inversion may lead to uninteded lru chun. but it was already solved by commit 645747462 (vmscan: detect mapped file pages used only once). (Thanks Hannes, you are great!) Thus, now we can use lru_cache_add_anon() instead. Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Reported-by: Shaohua Li <shaohua.li@intel.com> Reviewed-by: Wu Fengguang <fengguang.wu@intel.com> Reviewed-by: Johannes Weiner <hannes@cmpxchg.org> Reviewed-by: Rik van Riel <riel@redhat.com> Reviewed-by: Minchan Kim <minchan.kim@gmail.com> Acked-by: Hugh Dickins <hughd@google.com> Cc: Henrique de Moraes Holschuh <hmh@hmh.eng.br> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- include/linux/swap.h | 10 ---------- mm/filemap.c | 4 ++-- 2 files changed, 2 insertions(+), 12 deletions(-) --- a/include/linux/swap.h +++ b/include/linux/swap.h @@ -218,21 +218,11 @@ static inline void lru_cache_add_anon(st __lru_cache_add(page, LRU_INACTIVE_ANON); } -static inline void lru_cache_add_active_anon(struct page *page) -{ - __lru_cache_add(page, LRU_ACTIVE_ANON); -} - static inline void lru_cache_add_file(struct page *page) { __lru_cache_add(page, LRU_INACTIVE_FILE); } -static inline void lru_cache_add_active_file(struct page *page) -{ - __lru_cache_add(page, LRU_ACTIVE_FILE); -} - /* linux/mm/vmscan.c */ extern unsigned long try_to_free_pages(struct zonelist *zonelist, int order, gfp_t gfp_mask, nodemask_t *mask); --- a/mm/filemap.c +++ b/mm/filemap.c @@ -462,7 +462,7 @@ int add_to_page_cache_lru(struct page *p /* * Splice_read and readahead add shmem/tmpfs pages into the page cache * before shmem_readpage has a chance to mark them as SwapBacked: they - * need to go on the active_anon lru below, and mem_cgroup_cache_charge + * need to go on the anon lru below, and mem_cgroup_cache_charge * (called in add_to_page_cache) needs to know where they're going too. */ if (mapping_cap_swap_backed(mapping)) @@ -473,7 +473,7 @@ int add_to_page_cache_lru(struct page *p if (page_is_file_cache(page)) lru_cache_add_file(page); else - lru_cache_add_active_anon(page); + lru_cache_add_anon(page); } return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 070/149] mlx4_core: Fix possible chunk sg list overflow in mlx4_alloc_icm() 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (68 preceding siblings ...) 2010-07-01 17:31 ` [patch 069/149] tmpfs: insert tmpfs cache pages to inactive list at first Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 Greg KH ` (78 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Sebastien Dugue, Roland Dreier 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Sebastien Dugue <sebastien.dugue@bull.net> commit c0dc72bad9cf21071f5e4005de46f7c8b67a138a upstream. If the number of sg entries in the ICM chunk reaches MLX4_ICM_CHUNK_LEN, we must set chunk to NULL even for coherent mappings so that the next time through the loop will allocate another chunk. Otherwise we'll overflow the sg list the next time through the loop. This will lead to memory corruption if this case is hit. mthca does not have this bug. Signed-off-by: Sebastien Dugue <sebastien.dugue@bull.net> Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/mlx4/icm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/mlx4/icm.c +++ b/drivers/net/mlx4/icm.c @@ -174,9 +174,10 @@ struct mlx4_icm *mlx4_alloc_icm(struct m if (chunk->nsg <= 0) goto fail; + } + if (chunk->npages == MLX4_ICM_CHUNK_LEN) chunk = NULL; - } npages -= 1 << cur_order; } else { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (69 preceding siblings ...) 2010-07-01 17:31 ` [patch 070/149] mlx4_core: Fix possible chunk sg list overflow in mlx4_alloc_icm() Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 22:14 ` Kirill A. Shutemov 2010-07-01 17:31 ` [patch 072/149] ARM: 6164/1: Add kto and kfrom to input operands list Greg KH ` (77 subsequent siblings) 148 siblings, 1 reply; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Anfei Zhou, Russell King 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Anfei <anfei.zhou@gmail.com> commit 5e27fb78df95e027723af2c90ecc9b4527ae59e9 upstream. Instruction faults on pre-ARMv6 CPUs are interpreted as a 'translation fault', but do_translation_fault doesn't handle well if user mode trying to run instruction above TASK_SIZE, and result in the infinite retry of that instruction. Signed-off-by: Anfei Zhou <anfei.zhou@gmail.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/mm/fault.c | 3 +++ 1 file changed, 3 insertions(+) --- a/arch/arm/mm/fault.c +++ b/arch/arm/mm/fault.c @@ -386,6 +386,9 @@ do_translation_fault(unsigned long addr, if (addr < TASK_SIZE) return do_page_fault(addr, fsr, regs); + if (user_mode(regs)) + goto bad_area; + index = pgd_index(addr); /* ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-01 17:31 ` [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 Greg KH @ 2010-07-01 22:14 ` Kirill A. Shutemov 2010-07-01 22:17 ` Greg KH 0 siblings, 1 reply; 666+ messages in thread From: Kirill A. Shutemov @ 2010-07-01 22:14 UTC (permalink / raw) To: Greg KH Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Anfei Zhou, Russell King On Thu, Jul 01, 2010 at 10:31:37AM -0700, Greg KH wrote: > 2.6.32-stable review patch. If anyone has any objections, please let us know. > > ------------------ > > From: Anfei <anfei.zhou@gmail.com> > > commit 5e27fb78df95e027723af2c90ecc9b4527ae59e9 upstream. > > Instruction faults on pre-ARMv6 CPUs are interpreted as > a 'translation fault', but do_translation_fault doesn't > handle well if user mode trying to run instruction above > TASK_SIZE, and result in the infinite retry of that > instruction. Actually, this patch helps also on ARMv6+. Probably, better to correct commit message for stable. > Signed-off-by: Anfei Zhou <anfei.zhou@gmail.com> > Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> > > --- > arch/arm/mm/fault.c | 3 +++ > 1 file changed, 3 insertions(+) > > --- a/arch/arm/mm/fault.c > +++ b/arch/arm/mm/fault.c > @@ -386,6 +386,9 @@ do_translation_fault(unsigned long addr, > if (addr < TASK_SIZE) > return do_page_fault(addr, fsr, regs); > > + if (user_mode(regs)) > + goto bad_area; > + > index = pgd_index(addr); > > /* > > > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ -- Kirill A. Shutemov ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-01 22:14 ` Kirill A. Shutemov @ 2010-07-01 22:17 ` Greg KH 2010-07-01 22:25 ` Kirill A. Shutemov 0 siblings, 1 reply; 666+ messages in thread From: Greg KH @ 2010-07-01 22:17 UTC (permalink / raw) To: Kirill A. Shutemov Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Anfei Zhou, Russell King On Fri, Jul 02, 2010 at 01:14:20AM +0300, Kirill A. Shutemov wrote: > On Thu, Jul 01, 2010 at 10:31:37AM -0700, Greg KH wrote: > > 2.6.32-stable review patch. If anyone has any objections, please let us know. > > > > ------------------ > > > > From: Anfei <anfei.zhou@gmail.com> > > > > commit 5e27fb78df95e027723af2c90ecc9b4527ae59e9 upstream. > > > > Instruction faults on pre-ARMv6 CPUs are interpreted as > > a 'translation fault', but do_translation_fault doesn't > > handle well if user mode trying to run instruction above > > TASK_SIZE, and result in the infinite retry of that > > instruction. > > Actually, this patch helps also on ARMv6+. Probably, better to correct > commit message for stable. We (well, I) like to keep the commit log identical to what is upstream just to make things easier all around. Otherwise people start asking for spelling fixes, clarifications, and all sorts of other stuff (like this.) thanks, greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-01 22:17 ` Greg KH @ 2010-07-01 22:25 ` Kirill A. Shutemov 2010-07-01 22:48 ` Russell King 0 siblings, 1 reply; 666+ messages in thread From: Kirill A. Shutemov @ 2010-07-01 22:25 UTC (permalink / raw) To: Greg KH Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Anfei Zhou, Russell King On Thu, Jul 01, 2010 at 03:17:28PM -0700, Greg KH wrote: > On Fri, Jul 02, 2010 at 01:14:20AM +0300, Kirill A. Shutemov wrote: > > On Thu, Jul 01, 2010 at 10:31:37AM -0700, Greg KH wrote: > > > 2.6.32-stable review patch. If anyone has any objections, please let us know. > > > > > > ------------------ > > > > > > From: Anfei <anfei.zhou@gmail.com> > > > > > > commit 5e27fb78df95e027723af2c90ecc9b4527ae59e9 upstream. > > > > > > Instruction faults on pre-ARMv6 CPUs are interpreted as > > > a 'translation fault', but do_translation_fault doesn't > > > handle well if user mode trying to run instruction above > > > TASK_SIZE, and result in the infinite retry of that > > > instruction. > > > > Actually, this patch helps also on ARMv6+. Probably, better to correct > > commit message for stable. > > We (well, I) like to keep the commit log identical to what is upstream > just to make things easier all around. Otherwise people start asking > for spelling fixes, clarifications, and all sorts of other stuff (like > this.) Ok, fair enough. I asked for it because I was confused by this commit message while investigate (the same) problem on ARMv7 CPU. -- Kirill A. Shutemov ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-01 22:25 ` Kirill A. Shutemov @ 2010-07-01 22:48 ` Russell King 2010-07-01 22:59 ` Kirill A. Shutemov 0 siblings, 1 reply; 666+ messages in thread From: Russell King @ 2010-07-01 22:48 UTC (permalink / raw) To: Kirill A. Shutemov Cc: Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Anfei Zhou On Fri, Jul 02, 2010 at 01:25:41AM +0300, Kirill A. Shutemov wrote: > On Thu, Jul 01, 2010 at 03:17:28PM -0700, Greg KH wrote: > > We (well, I) like to keep the commit log identical to what is upstream > > just to make things easier all around. Otherwise people start asking > > for spelling fixes, clarifications, and all sorts of other stuff (like > > this.) > > Ok, fair enough. > > I asked for it because I was confused by this commit message while > investigate (the same) problem on ARMv7 CPU. You shouldn't get anywhere near this on ARMv7, because we know the cause of the prefetch abort on those CPUs. On pre-ARMv6 CPUs, we always treat all prefetch aborts as a translation faults. The problem which this commit addresses occurs when userspace tries to execute code above TASK_SIZE - we're sent into a loop of prefetch aborts (because we are unable to determine that it is a permission fault.) ARMv6 and ARMv7 CPUs have an instruction fault status register, which tells us why the abort happened. On these CPUs, permission faults go nowhere near the translation fault handler. One possibility is that for some reason you're using the legacy prefetch abort code or pre-IFSR code, which will always tell the kernel that its a translation fault - and in this case, this patch would improve the situation. What kernel version are you using? The commit message is accurate for the kernel version to which it was originally applied. -- Russell King Linux kernel 2.6 ARM Linux - http://www.arm.linux.org.uk/ maintainer of: ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-01 22:48 ` Russell King @ 2010-07-01 22:59 ` Kirill A. Shutemov 2010-07-01 23:12 ` Russell King 0 siblings, 1 reply; 666+ messages in thread From: Kirill A. Shutemov @ 2010-07-01 22:59 UTC (permalink / raw) To: Russell King, g Cc: Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Anfei Zhou On Thu, Jul 01, 2010 at 11:48:37PM +0100, Russell King wrote: > On Fri, Jul 02, 2010 at 01:25:41AM +0300, Kirill A. Shutemov wrote: > > On Thu, Jul 01, 2010 at 03:17:28PM -0700, Greg KH wrote: > > > We (well, I) like to keep the commit log identical to what is upstream > > > just to make things easier all around. Otherwise people start asking > > > for spelling fixes, clarifications, and all sorts of other stuff (like > > > this.) > > > > Ok, fair enough. > > > > I asked for it because I was confused by this commit message while > > investigate (the same) problem on ARMv7 CPU. > > You shouldn't get anywhere near this on ARMv7, because we know the cause > of the prefetch abort on those CPUs. > > On pre-ARMv6 CPUs, we always treat all prefetch aborts as a translation > faults. The problem which this commit addresses occurs when userspace > tries to execute code above TASK_SIZE - we're sent into a loop of prefetch > aborts (because we are unable to determine that it is a permission fault.) > > ARMv6 and ARMv7 CPUs have an instruction fault status register, which > tells us why the abort happened. On these CPUs, permission faults go > nowhere near the translation fault handler. I know it. I was involved in writing this code. > One possibility is that for some reason you're using the legacy prefetch > abort code or pre-IFSR code, which will always tell the kernel that its > a translation fault - and in this case, this patch would improve the > situation. What kernel version are you using? 2.6.32 > The commit message is accurate for the kernel version to which it was > originally applied. Simple testcase: #include <stdio.h> #include <unistd.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> int main(int argc, char **argv) { int fd; void (*p)(void); fd = open("/dev/urandom", O_RDONLY); read(0, &p, sizeof(p)); printf("p: %p\n", p); p(); return 0; } If you run this test in loop on kernel without the patch you'll finally get hung instead SIGSEGV. It seems the patch fixes more than it was written for. :) -- Kirill A. Shutemov ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-01 22:59 ` Kirill A. Shutemov @ 2010-07-01 23:12 ` Russell King 2010-07-02 6:29 ` Kirill A. Shutemov 2010-07-06 13:06 ` Kirill A. Shutemov 0 siblings, 2 replies; 666+ messages in thread From: Russell King @ 2010-07-01 23:12 UTC (permalink / raw) To: Kirill A. Shutemov Cc: g, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Anfei Zhou On Fri, Jul 02, 2010 at 01:59:11AM +0300, Kirill A. Shutemov wrote: > On Thu, Jul 01, 2010 at 11:48:37PM +0100, Russell King wrote: > > One possibility is that for some reason you're using the legacy prefetch > > abort code or pre-IFSR code, which will always tell the kernel that its > > a translation fault - and in this case, this patch would improve the > > situation. What kernel version are you using? > > 2.6.32 Should be recent enough. > If you run this test in loop on kernel without the patch you'll finally > get hung instead SIGSEGV. > > It seems the patch fixes more than it was written for. :) Have you investigated the IFSR and IFAR values, and the corresponding page table state? I'm not going to be able to run your test code for a few days. -- Russell King Linux kernel 2.6 ARM Linux - http://www.arm.linux.org.uk/ maintainer of: ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-01 23:12 ` Russell King @ 2010-07-02 6:29 ` Kirill A. Shutemov 2010-07-06 13:06 ` Kirill A. Shutemov 1 sibling, 0 replies; 666+ messages in thread From: Kirill A. Shutemov @ 2010-07-02 6:29 UTC (permalink / raw) To: Russell King Cc: g, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Anfei Zhou On Fri, Jul 02, 2010 at 12:12:07AM +0100, Russell King wrote: > On Fri, Jul 02, 2010 at 01:59:11AM +0300, Kirill A. Shutemov wrote: > > On Thu, Jul 01, 2010 at 11:48:37PM +0100, Russell King wrote: > > > One possibility is that for some reason you're using the legacy prefetch > > > abort code or pre-IFSR code, which will always tell the kernel that its > > > a translation fault - and in this case, this patch would improve the > > > situation. What kernel version are you using? > > > > 2.6.32 > > Should be recent enough. > > > If you run this test in loop on kernel without the patch you'll finally > > get hung instead SIGSEGV. > > > > It seems the patch fixes more than it was written for. :) > > Have you investigated the IFSR and IFAR values, and the corresponding > page table state? In oprofile dump, I saw do_PrefetchAbort() and do_translation_fault() at the top, so I guess IFSR is 5. I don't known value IFAR, but I'll see. > I'm not going to be able to run your test code for > a few days. It's only few minutes or less if you are lucky. -- Kirill A. Shutemov ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-01 23:12 ` Russell King 2010-07-02 6:29 ` Kirill A. Shutemov @ 2010-07-06 13:06 ` Kirill A. Shutemov 2010-07-06 22:58 ` Russell King 1 sibling, 1 reply; 666+ messages in thread From: Kirill A. Shutemov @ 2010-07-06 13:06 UTC (permalink / raw) To: Russell King Cc: Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Anfei Zhou, Alexander Shishkin, Siarhei Siamashka On Fri, Jul 02, 2010 at 12:12:07AM +0100, Russell King wrote: > On Fri, Jul 02, 2010 at 01:59:11AM +0300, Kirill A. Shutemov wrote: > > On Thu, Jul 01, 2010 at 11:48:37PM +0100, Russell King wrote: > > > One possibility is that for some reason you're using the legacy prefetch > > > abort code or pre-IFSR code, which will always tell the kernel that its > > > a translation fault - and in this case, this patch would improve the > > > situation. What kernel version are you using? > > > > 2.6.32 > > Should be recent enough. > > > If you run this test in loop on kernel without the patch you'll finally > > get hung instead SIGSEGV. > > > > It seems the patch fixes more than it was written for. :) > > Have you investigated the IFSR and IFAR values, and the corresponding > page table state? I'm not going to be able to run your test code for > a few days. I've investigated the issue. It's reproducible if you try to jump to the megabyte next to section mapping. On my OMAP3-based device I use address 0xfc1XXXXX for debugging propose. It's a megabyte next to OMAP343X_SMS mapping. On ARM one Linux PGD entry contains two hardware entry. But there is error in do_translation_fault(). It's always call pmd_none() check for the first entry of two, not for the entry corresponded to address. So in case if we try to jump the megabyte next to section mapping, we will have inifinity loop of translation faults. Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name> --- diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c index 9634fe1..825b9da 100644 --- a/arch/arm/mm/fault.c +++ b/arch/arm/mm/fault.c @@ -406,7 +406,8 @@ do_translation_fault(unsigned long addr, unsigned int fsr, pmd_k = pmd_offset(pgd_k, addr); pmd = pmd_offset(pgd, addr); - if (pmd_none(*pmd_k)) + index = (addr >> SECTION_SHIFT) & 1; + if (pmd_none(pmd_k[index])) goto bad_area; copy_pmd(pmd, pmd_k); -- Kirill A. Shutemov ^ permalink raw reply related [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-06 13:06 ` Kirill A. Shutemov @ 2010-07-06 22:58 ` Russell King 2010-07-07 8:56 ` Kirill A. Shutemov 0 siblings, 1 reply; 666+ messages in thread From: Russell King @ 2010-07-06 22:58 UTC (permalink / raw) To: Kirill A. Shutemov Cc: Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Anfei Zhou, Alexander Shishkin, Siarhei Siamashka On Tue, Jul 06, 2010 at 04:06:18PM +0300, Kirill A. Shutemov wrote: > I've investigated the issue. It's reproducible if you try to jump to > the megabyte next to section mapping. Okay, this is specific to the way that OMAP sets up its mappings, which is why it doesn't appear everywhere. > On ARM one Linux PGD entry contains two hardware entry. But there is error > in do_translation_fault(). It's always call pmd_none() check for the first > entry of two, not for the entry corresponded to address. So in case if we > try to jump the megabyte next to section mapping, we will have inifinity > loop of translation faults. Okay, now that we know _why_ it happens, I'm satisfied that the fix previously committed will help this situation. > diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c > index 9634fe1..825b9da 100644 > --- a/arch/arm/mm/fault.c > +++ b/arch/arm/mm/fault.c > @@ -406,7 +406,8 @@ do_translation_fault(unsigned long addr, unsigned int fsr, > pmd_k = pmd_offset(pgd_k, addr); > pmd = pmd_offset(pgd, addr); > > - if (pmd_none(*pmd_k)) > + index = (addr >> SECTION_SHIFT) & 1; > + if (pmd_none(pmd_k[index])) I do think this is extremely obscure, and therefore requires a comment to help people understand what is going on here and why. Leaving it in the commit log would be an invitation for this to be needlessly cut'n'pasted. -- Russell King Linux kernel 2.6 ARM Linux - http://www.arm.linux.org.uk/ maintainer of: ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-06 22:58 ` Russell King 2010-07-07 8:56 ` Kirill A. Shutemov @ 2010-07-07 8:56 ` Kirill A. Shutemov 0 siblings, 0 replies; 666+ messages in thread From: Kirill A. Shutemov @ 2010-07-07 8:56 UTC (permalink / raw) To: Russell King Cc: linux-kernel, alan, Anfei Zhou, Alexander Shishkin, Siarhei Siamashka, linux-arm-kernel, linux-mm On Tue, Jul 06, 2010 at 11:58:15PM +0100, Russell King wrote: > On Tue, Jul 06, 2010 at 04:06:18PM +0300, Kirill A. Shutemov wrote: > > I've investigated the issue. It's reproducible if you try to jump to > > the megabyte next to section mapping. > > Okay, this is specific to the way that OMAP sets up its mappings, which > is why it doesn't appear everywhere. > > > On ARM one Linux PGD entry contains two hardware entry. But there is error > > in do_translation_fault(). It's always call pmd_none() check for the first > > entry of two, not for the entry corresponded to address. So in case if we > > try to jump the megabyte next to section mapping, we will have inifinity > > loop of translation faults. > > Okay, now that we know _why_ it happens, I'm satisfied that the fix > previously committed will help this situation. > > > diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c > > index 9634fe1..825b9da 100644 > > --- a/arch/arm/mm/fault.c > > +++ b/arch/arm/mm/fault.c > > @@ -406,7 +406,8 @@ do_translation_fault(unsigned long addr, unsigned int fsr, > > pmd_k = pmd_offset(pgd_k, addr); > > pmd = pmd_offset(pgd, addr); > > > > - if (pmd_none(*pmd_k)) > > + index = (addr >> SECTION_SHIFT) & 1; > > + if (pmd_none(pmd_k[index])) > > I do think this is extremely obscure, and therefore requires a comment > to help people understand what is going on here and why. Leaving it > in the commit log would be an invitation for this to be needlessly > cut'n'pasted. Ok, I'll fix it. But it seems that the problem is more global. Potentially, any of pmd_none() check may produce false results. I don't see an easy way to fix it. It's not so big problem since we don't have [super]section in userspace, but I guess, we want to have huge pages support in the future. Any ideas how to fix it in the right way? Does Linux VM still expect one PTE table per page? CC list modified. Removed persons who unlikely interested in ARM-specific stuff. linux-arm-kernel and linux-mm added. -- Kirill A. Shutemov ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 @ 2010-07-07 8:56 ` Kirill A. Shutemov 0 siblings, 0 replies; 666+ messages in thread From: Kirill A. Shutemov @ 2010-07-07 8:56 UTC (permalink / raw) To: linux-arm-kernel On Tue, Jul 06, 2010 at 11:58:15PM +0100, Russell King wrote: > On Tue, Jul 06, 2010 at 04:06:18PM +0300, Kirill A. Shutemov wrote: > > I've investigated the issue. It's reproducible if you try to jump to > > the megabyte next to section mapping. > > Okay, this is specific to the way that OMAP sets up its mappings, which > is why it doesn't appear everywhere. > > > On ARM one Linux PGD entry contains two hardware entry. But there is error > > in do_translation_fault(). It's always call pmd_none() check for the first > > entry of two, not for the entry corresponded to address. So in case if we > > try to jump the megabyte next to section mapping, we will have inifinity > > loop of translation faults. > > Okay, now that we know _why_ it happens, I'm satisfied that the fix > previously committed will help this situation. > > > diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c > > index 9634fe1..825b9da 100644 > > --- a/arch/arm/mm/fault.c > > +++ b/arch/arm/mm/fault.c > > @@ -406,7 +406,8 @@ do_translation_fault(unsigned long addr, unsigned int fsr, > > pmd_k = pmd_offset(pgd_k, addr); > > pmd = pmd_offset(pgd, addr); > > > > - if (pmd_none(*pmd_k)) > > + index = (addr >> SECTION_SHIFT) & 1; > > + if (pmd_none(pmd_k[index])) > > I do think this is extremely obscure, and therefore requires a comment > to help people understand what is going on here and why. Leaving it > in the commit log would be an invitation for this to be needlessly > cut'n'pasted. Ok, I'll fix it. But it seems that the problem is more global. Potentially, any of pmd_none() check may produce false results. I don't see an easy way to fix it. It's not so big problem since we don't have [super]section in userspace, but I guess, we want to have huge pages support in the future. Any ideas how to fix it in the right way? Does Linux VM still expect one PTE table per page? CC list modified. Removed persons who unlikely interested in ARM-specific stuff. linux-arm-kernel and linux-mm added. -- Kirill A. Shutemov ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 @ 2010-07-07 8:56 ` Kirill A. Shutemov 0 siblings, 0 replies; 666+ messages in thread From: Kirill A. Shutemov @ 2010-07-07 8:56 UTC (permalink / raw) To: Russell King Cc: linux-kernel, alan, Anfei Zhou, Alexander Shishkin, Siarhei Siamashka, linux-arm-kernel, linux-mm On Tue, Jul 06, 2010 at 11:58:15PM +0100, Russell King wrote: > On Tue, Jul 06, 2010 at 04:06:18PM +0300, Kirill A. Shutemov wrote: > > I've investigated the issue. It's reproducible if you try to jump to > > the megabyte next to section mapping. > > Okay, this is specific to the way that OMAP sets up its mappings, which > is why it doesn't appear everywhere. > > > On ARM one Linux PGD entry contains two hardware entry. But there is error > > in do_translation_fault(). It's always call pmd_none() check for the first > > entry of two, not for the entry corresponded to address. So in case if we > > try to jump the megabyte next to section mapping, we will have inifinity > > loop of translation faults. > > Okay, now that we know _why_ it happens, I'm satisfied that the fix > previously committed will help this situation. > > > diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c > > index 9634fe1..825b9da 100644 > > --- a/arch/arm/mm/fault.c > > +++ b/arch/arm/mm/fault.c > > @@ -406,7 +406,8 @@ do_translation_fault(unsigned long addr, unsigned int fsr, > > pmd_k = pmd_offset(pgd_k, addr); > > pmd = pmd_offset(pgd, addr); > > > > - if (pmd_none(*pmd_k)) > > + index = (addr >> SECTION_SHIFT) & 1; > > + if (pmd_none(pmd_k[index])) > > I do think this is extremely obscure, and therefore requires a comment > to help people understand what is going on here and why. Leaving it > in the commit log would be an invitation for this to be needlessly > cut'n'pasted. Ok, I'll fix it. But it seems that the problem is more global. Potentially, any of pmd_none() check may produce false results. I don't see an easy way to fix it. It's not so big problem since we don't have [super]section in userspace, but I guess, we want to have huge pages support in the future. Any ideas how to fix it in the right way? Does Linux VM still expect one PTE table per page? CC list modified. Removed persons who unlikely interested in ARM-specific stuff. linux-arm-kernel and linux-mm added. -- Kirill A. Shutemov -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-07 8:56 ` Kirill A. Shutemov (?) @ 2010-07-07 22:34 ` Russell King - ARM Linux -1 siblings, 0 replies; 666+ messages in thread From: Russell King - ARM Linux @ 2010-07-07 22:34 UTC (permalink / raw) To: Kirill A. Shutemov Cc: linux-kernel, alan, Anfei Zhou, Alexander Shishkin, Siarhei Siamashka, linux-arm-kernel, linux-mm On Wed, Jul 07, 2010 at 11:56:01AM +0300, Kirill A. Shutemov wrote: > But it seems that the problem is more global. Potentially, any of > pmd_none() check may produce false results. I don't see an easy way to fix > it. It isn't. We normally guarantee that we always fill on both L1 entries. The only exception is for the mappings specified via create_mapping() which is used for the static platform mappings. > Does Linux VM still expect one PTE table per page? Yes, and as far as I can see probably always will. Hence why we need to put two L1 entries in one page and lie to the kernel about the sizes of the hardware entries. ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 @ 2010-07-07 22:34 ` Russell King - ARM Linux 0 siblings, 0 replies; 666+ messages in thread From: Russell King - ARM Linux @ 2010-07-07 22:34 UTC (permalink / raw) To: linux-arm-kernel On Wed, Jul 07, 2010 at 11:56:01AM +0300, Kirill A. Shutemov wrote: > But it seems that the problem is more global. Potentially, any of > pmd_none() check may produce false results. I don't see an easy way to fix > it. It isn't. We normally guarantee that we always fill on both L1 entries. The only exception is for the mappings specified via create_mapping() which is used for the static platform mappings. > Does Linux VM still expect one PTE table per page? Yes, and as far as I can see probably always will. Hence why we need to put two L1 entries in one page and lie to the kernel about the sizes of the hardware entries. ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 @ 2010-07-07 22:34 ` Russell King - ARM Linux 0 siblings, 0 replies; 666+ messages in thread From: Russell King - ARM Linux @ 2010-07-07 22:34 UTC (permalink / raw) To: Kirill A. Shutemov Cc: linux-kernel, alan, Anfei Zhou, Alexander Shishkin, Siarhei Siamashka, linux-arm-kernel, linux-mm On Wed, Jul 07, 2010 at 11:56:01AM +0300, Kirill A. Shutemov wrote: > But it seems that the problem is more global. Potentially, any of > pmd_none() check may produce false results. I don't see an easy way to fix > it. It isn't. We normally guarantee that we always fill on both L1 entries. The only exception is for the mappings specified via create_mapping() which is used for the static platform mappings. > Does Linux VM still expect one PTE table per page? Yes, and as far as I can see probably always will. Hence why we need to put two L1 entries in one page and lie to the kernel about the sizes of the hardware entries. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-07 22:34 ` Russell King - ARM Linux (?) @ 2010-07-08 11:31 ` Kirill A. Shutemov -1 siblings, 0 replies; 666+ messages in thread From: Kirill A. Shutemov @ 2010-07-08 11:31 UTC (permalink / raw) To: Russell King - ARM Linux Cc: linux-kernel, alan, Anfei Zhou, Alexander Shishkin, Siarhei Siamashka, linux-arm-kernel, linux-mm On Wed, Jul 07, 2010 at 11:34:18PM +0100, Russell King - ARM Linux wrote: > On Wed, Jul 07, 2010 at 11:56:01AM +0300, Kirill A. Shutemov wrote: > > But it seems that the problem is more global. Potentially, any of > > pmd_none() check may produce false results. I don't see an easy way to fix > > it. > > It isn't. We normally guarantee that we always fill on both L1 entries. > The only exception is for the mappings specified via create_mapping() > which is used for the static platform mappings. Why do not to change create_mapping() to follow the same rules? I mean, create sections only if it asked for 2*SECTION_SIZE with appropriate alignment. It reduces number of section mappings, but, probably, will be a bit cleaner and less error-prune. > > Does Linux VM still expect one PTE table per page? > > Yes, and as far as I can see probably always will. Hence why we need > to put two L1 entries in one page and lie to the kernel about the sizes > of the hardware entries. Another option is leave half of page with PTE table free. Is it very bad idea? How other architectures handle it? Or only on ARM PTL table size is less than page size? -- Kirill A. Shutemov ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 @ 2010-07-08 11:31 ` Kirill A. Shutemov 0 siblings, 0 replies; 666+ messages in thread From: Kirill A. Shutemov @ 2010-07-08 11:31 UTC (permalink / raw) To: linux-arm-kernel On Wed, Jul 07, 2010 at 11:34:18PM +0100, Russell King - ARM Linux wrote: > On Wed, Jul 07, 2010 at 11:56:01AM +0300, Kirill A. Shutemov wrote: > > But it seems that the problem is more global. Potentially, any of > > pmd_none() check may produce false results. I don't see an easy way to fix > > it. > > It isn't. We normally guarantee that we always fill on both L1 entries. > The only exception is for the mappings specified via create_mapping() > which is used for the static platform mappings. Why do not to change create_mapping() to follow the same rules? I mean, create sections only if it asked for 2*SECTION_SIZE with appropriate alignment. It reduces number of section mappings, but, probably, will be a bit cleaner and less error-prune. > > Does Linux VM still expect one PTE table per page? > > Yes, and as far as I can see probably always will. Hence why we need > to put two L1 entries in one page and lie to the kernel about the sizes > of the hardware entries. Another option is leave half of page with PTE table free. Is it very bad idea? How other architectures handle it? Or only on ARM PTL table size is less than page size? -- Kirill A. Shutemov ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 @ 2010-07-08 11:31 ` Kirill A. Shutemov 0 siblings, 0 replies; 666+ messages in thread From: Kirill A. Shutemov @ 2010-07-08 11:31 UTC (permalink / raw) To: Russell King - ARM Linux Cc: linux-kernel, alan, Anfei Zhou, Alexander Shishkin, Siarhei Siamashka, linux-arm-kernel, linux-mm On Wed, Jul 07, 2010 at 11:34:18PM +0100, Russell King - ARM Linux wrote: > On Wed, Jul 07, 2010 at 11:56:01AM +0300, Kirill A. Shutemov wrote: > > But it seems that the problem is more global. Potentially, any of > > pmd_none() check may produce false results. I don't see an easy way to fix > > it. > > It isn't. We normally guarantee that we always fill on both L1 entries. > The only exception is for the mappings specified via create_mapping() > which is used for the static platform mappings. Why do not to change create_mapping() to follow the same rules? I mean, create sections only if it asked for 2*SECTION_SIZE with appropriate alignment. It reduces number of section mappings, but, probably, will be a bit cleaner and less error-prune. > > Does Linux VM still expect one PTE table per page? > > Yes, and as far as I can see probably always will. Hence why we need > to put two L1 entries in one page and lie to the kernel about the sizes > of the hardware entries. Another option is leave half of page with PTE table free. Is it very bad idea? How other architectures handle it? Or only on ARM PTL table size is less than page size? -- Kirill A. Shutemov -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-08 11:31 ` Kirill A. Shutemov (?) @ 2010-07-12 22:08 ` Kirill A. Shutemov -1 siblings, 0 replies; 666+ messages in thread From: Kirill A. Shutemov @ 2010-07-12 22:08 UTC (permalink / raw) To: Russell King - ARM Linux Cc: Siarhei Siamashka, Anfei Zhou, linux-mm, linux-kernel, Alexander Shishkin, alan, linux-arm-kernel On Thu, Jul 08, 2010 at 02:31:22PM +0300, Kirill A. Shutemov wrote: > On Wed, Jul 07, 2010 at 11:34:18PM +0100, Russell King - ARM Linux wrote: > > On Wed, Jul 07, 2010 at 11:56:01AM +0300, Kirill A. Shutemov wrote: > > > But it seems that the problem is more global. Potentially, any of > > > pmd_none() check may produce false results. I don't see an easy way to fix > > > it. > > > > It isn't. We normally guarantee that we always fill on both L1 entries. > > The only exception is for the mappings specified via create_mapping() > > which is used for the static platform mappings. > > Why do not to change create_mapping() to follow the same rules? > I mean, create sections only if it asked for 2*SECTION_SIZE with > appropriate alignment. It reduces number of section mappings, but, > probably, will be a bit cleaner and less error-prune. > > > > Does Linux VM still expect one PTE table per page? > > > > Yes, and as far as I can see probably always will. Hence why we need > > to put two L1 entries in one page and lie to the kernel about the sizes > > of the hardware entries. > > Another option is leave half of page with PTE table free. Is it very bad > idea? > > How other architectures handle it? Or only on ARM PTL table size is less > than page size? Russell, any comments? I would like to fix it in a right way. -- Kirill A. Shutemov ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 @ 2010-07-12 22:08 ` Kirill A. Shutemov 0 siblings, 0 replies; 666+ messages in thread From: Kirill A. Shutemov @ 2010-07-12 22:08 UTC (permalink / raw) To: linux-arm-kernel On Thu, Jul 08, 2010 at 02:31:22PM +0300, Kirill A. Shutemov wrote: > On Wed, Jul 07, 2010 at 11:34:18PM +0100, Russell King - ARM Linux wrote: > > On Wed, Jul 07, 2010 at 11:56:01AM +0300, Kirill A. Shutemov wrote: > > > But it seems that the problem is more global. Potentially, any of > > > pmd_none() check may produce false results. I don't see an easy way to fix > > > it. > > > > It isn't. We normally guarantee that we always fill on both L1 entries. > > The only exception is for the mappings specified via create_mapping() > > which is used for the static platform mappings. > > Why do not to change create_mapping() to follow the same rules? > I mean, create sections only if it asked for 2*SECTION_SIZE with > appropriate alignment. It reduces number of section mappings, but, > probably, will be a bit cleaner and less error-prune. > > > > Does Linux VM still expect one PTE table per page? > > > > Yes, and as far as I can see probably always will. Hence why we need > > to put two L1 entries in one page and lie to the kernel about the sizes > > of the hardware entries. > > Another option is leave half of page with PTE table free. Is it very bad > idea? > > How other architectures handle it? Or only on ARM PTL table size is less > than page size? Russell, any comments? I would like to fix it in a right way. -- Kirill A. Shutemov ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 @ 2010-07-12 22:08 ` Kirill A. Shutemov 0 siblings, 0 replies; 666+ messages in thread From: Kirill A. Shutemov @ 2010-07-12 22:08 UTC (permalink / raw) To: Russell King - ARM Linux Cc: Siarhei Siamashka, Anfei Zhou, linux-mm, linux-kernel, Alexander Shishkin, alan, linux-arm-kernel On Thu, Jul 08, 2010 at 02:31:22PM +0300, Kirill A. Shutemov wrote: > On Wed, Jul 07, 2010 at 11:34:18PM +0100, Russell King - ARM Linux wrote: > > On Wed, Jul 07, 2010 at 11:56:01AM +0300, Kirill A. Shutemov wrote: > > > But it seems that the problem is more global. Potentially, any of > > > pmd_none() check may produce false results. I don't see an easy way to fix > > > it. > > > > It isn't. We normally guarantee that we always fill on both L1 entries. > > The only exception is for the mappings specified via create_mapping() > > which is used for the static platform mappings. > > Why do not to change create_mapping() to follow the same rules? > I mean, create sections only if it asked for 2*SECTION_SIZE with > appropriate alignment. It reduces number of section mappings, but, > probably, will be a bit cleaner and less error-prune. > > > > Does Linux VM still expect one PTE table per page? > > > > Yes, and as far as I can see probably always will. Hence why we need > > to put two L1 entries in one page and lie to the kernel about the sizes > > of the hardware entries. > > Another option is leave half of page with PTE table free. Is it very bad > idea? > > How other architectures handle it? Or only on ARM PTL table size is less > than page size? Russell, any comments? I would like to fix it in a right way. -- Kirill A. Shutemov -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 072/149] ARM: 6164/1: Add kto and kfrom to input operands list. 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (70 preceding siblings ...) 2010-07-01 17:31 ` [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 073/149] ARM: 6146/1: sa1111: Prevent deadlock in resume path Greg KH ` (76 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Khem Raj, Russell King 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Khem Raj <raj.khem@gmail.com> commit 9a40ac86152c9cffd3dca482a15ddf9a8c5716b3 upstream. When functions incoming parameters are not in input operands list gcc 4.5 does not load the parameters into registers before calling this function but the inline assembly assumes valid addresses inside this function. This breaks the code because r0 and r1 are invalid when execution enters v4wb_copy_user_page () Also the constant needs to be used as third input operand so account for that as well. Tested on qemu arm. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/mm/copypage-feroceon.c | 4 ++-- arch/arm/mm/copypage-v4wb.c | 4 ++-- arch/arm/mm/copypage-v4wt.c | 4 ++-- arch/arm/mm/copypage-xsc3.c | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) --- a/arch/arm/mm/copypage-feroceon.c +++ b/arch/arm/mm/copypage-feroceon.c @@ -18,7 +18,7 @@ feroceon_copy_user_page(void *kto, const { asm("\ stmfd sp!, {r4-r9, lr} \n\ - mov ip, %0 \n\ + mov ip, %2 \n\ 1: mov lr, r1 \n\ ldmia r1!, {r2 - r9} \n\ pld [lr, #32] \n\ @@ -64,7 +64,7 @@ feroceon_copy_user_page(void *kto, const mcr p15, 0, ip, c7, c10, 4 @ drain WB\n\ ldmfd sp!, {r4-r9, pc}" : - : "I" (PAGE_SIZE)); + : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE)); } void feroceon_copy_user_highpage(struct page *to, struct page *from, --- a/arch/arm/mm/copypage-v4wb.c +++ b/arch/arm/mm/copypage-v4wb.c @@ -27,7 +27,7 @@ v4wb_copy_user_page(void *kto, const voi { asm("\ stmfd sp!, {r4, lr} @ 2\n\ - mov r2, %0 @ 1\n\ + mov r2, %2 @ 1\n\ ldmia r1!, {r3, r4, ip, lr} @ 4\n\ 1: mcr p15, 0, r0, c7, c6, 1 @ 1 invalidate D line\n\ stmia r0!, {r3, r4, ip, lr} @ 4\n\ @@ -44,7 +44,7 @@ v4wb_copy_user_page(void *kto, const voi mcr p15, 0, r1, c7, c10, 4 @ 1 drain WB\n\ ldmfd sp!, {r4, pc} @ 3" : - : "I" (PAGE_SIZE / 64)); + : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64)); } void v4wb_copy_user_highpage(struct page *to, struct page *from, --- a/arch/arm/mm/copypage-v4wt.c +++ b/arch/arm/mm/copypage-v4wt.c @@ -25,7 +25,7 @@ v4wt_copy_user_page(void *kto, const voi { asm("\ stmfd sp!, {r4, lr} @ 2\n\ - mov r2, %0 @ 1\n\ + mov r2, %2 @ 1\n\ ldmia r1!, {r3, r4, ip, lr} @ 4\n\ 1: stmia r0!, {r3, r4, ip, lr} @ 4\n\ ldmia r1!, {r3, r4, ip, lr} @ 4+1\n\ @@ -40,7 +40,7 @@ v4wt_copy_user_page(void *kto, const voi mcr p15, 0, r2, c7, c7, 0 @ flush ID cache\n\ ldmfd sp!, {r4, pc} @ 3" : - : "I" (PAGE_SIZE / 64)); + : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64)); } void v4wt_copy_user_highpage(struct page *to, struct page *from, --- a/arch/arm/mm/copypage-xsc3.c +++ b/arch/arm/mm/copypage-xsc3.c @@ -34,7 +34,7 @@ xsc3_mc_copy_user_page(void *kto, const { asm("\ stmfd sp!, {r4, r5, lr} \n\ - mov lr, %0 \n\ + mov lr, %2 \n\ \n\ pld [r1, #0] \n\ pld [r1, #32] \n\ @@ -67,7 +67,7 @@ xsc3_mc_copy_user_page(void *kto, const \n\ ldmfd sp!, {r4, r5, pc}" : - : "I" (PAGE_SIZE / 64 - 1)); + : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64 - 1)); } void xsc3_mc_copy_user_highpage(struct page *to, struct page *from, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 073/149] ARM: 6146/1: sa1111: Prevent deadlock in resume path 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (71 preceding siblings ...) 2010-07-01 17:31 ` [patch 072/149] ARM: 6164/1: Add kto and kfrom to input operands list Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 074/149] ARM: 6144/1: TCM memory bug freeing bug Greg KH ` (75 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Marek Vasut, Russell King 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: =?UTF-8?q?Marek=20Va=C5=A1ut?= <marek.vasut@gmail.com> commit 3defb2476166445982a90c12d33f8947e75476c4 upstream. This patch reorganises the sa1111_resume() function in a manner the spinlock happens after calling the sa1111_wake(). This fixes two bugs: 1) This function called sa1111_wake() which tried to claim the same spinlock the sa1111_resume() already claimed. This would result in certain deadlock. Original idea for this part: Russell King <rmk+kernel@arm.linux.org.uk> 2) The function didn't unlock the spinlock in case the chip didn't report correct ID. Original idea for this part: Julia Lawall <julia@diku.dk> Signed-off-by: Marek Vasut <marek.vasut@gmail.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/common/sa1111.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/arch/arm/common/sa1111.c +++ b/arch/arm/common/sa1111.c @@ -887,8 +887,6 @@ static int sa1111_resume(struct platform if (!save) return 0; - spin_lock_irqsave(&sachip->lock, flags); - /* * Ensure that the SA1111 is still here. * FIXME: shouldn't do this here. @@ -905,6 +903,13 @@ static int sa1111_resume(struct platform * First of all, wake up the chip. */ sa1111_wake(sachip); + + /* + * Only lock for write ops. Also, sa1111_wake must be called with + * released spinlock! + */ + spin_lock_irqsave(&sachip->lock, flags); + sa1111_writel(0, sachip->base + SA1111_INTC + SA1111_INTEN0); sa1111_writel(0, sachip->base + SA1111_INTC + SA1111_INTEN1); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 074/149] ARM: 6144/1: TCM memory bug freeing bug 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (72 preceding siblings ...) 2010-07-01 17:31 ` [patch 073/149] ARM: 6146/1: sa1111: Prevent deadlock in resume path Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 075/149] ARM: VFP: Fix vfp_put_double() for d16-d31 Greg KH ` (74 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Linus Walleij, Russell King 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Linus Walleij <linus.walleij@stericsson.com> commit ea208f646c8fb91c39c852e952fc911e1ad045ab upstream. This fixes a bug in mm/init.c when freeing the TCM compile memory, this was being referred to as a char * which is incorrect: this will dereference the pointer and feed in the value at the location instead of the address to it. Change it to a plain char and use &(char) to reference it. Signed-off-by: Linus Walleij <linus.walleij@stericsson.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/mm/init.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/arch/arm/mm/init.c +++ b/arch/arm/mm/init.c @@ -632,10 +632,10 @@ void __init mem_init(void) void free_initmem(void) { #ifdef CONFIG_HAVE_TCM - extern char *__tcm_start, *__tcm_end; + extern char __tcm_start, __tcm_end; - totalram_pages += free_area(__phys_to_pfn(__pa(__tcm_start)), - __phys_to_pfn(__pa(__tcm_end)), + totalram_pages += free_area(__phys_to_pfn(__pa(&__tcm_start)), + __phys_to_pfn(__pa(&__tcm_end)), "TCM link"); #endif ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 075/149] ARM: VFP: Fix vfp_put_double() for d16-d31 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (73 preceding siblings ...) 2010-07-01 17:31 ` [patch 074/149] ARM: 6144/1: TCM memory bug freeing bug Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 076/149] ASoC: Fix dB scales for WM835x Greg KH ` (73 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Russell King 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Russell King <rmk+kernel@arm.linux.org.uk> commit 138de1c44a8e0606501cd8593407e9248e84f1b7 upstream. vfp_put_double() takes the double value in r0,r1 not r1,r2. Reported-by: Tarun Kanti DebBarma <tarun.kanti@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/vfp/vfphw.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/arm/vfp/vfphw.S +++ b/arch/arm/vfp/vfphw.S @@ -277,7 +277,7 @@ ENTRY(vfp_put_double) #ifdef CONFIG_VFPv3 @ d16 - d31 registers .irp dr,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 -1: mcrr p11, 3, r1, r2, c\dr @ fmdrr r1, r2, d\dr +1: mcrr p11, 3, r0, r1, c\dr @ fmdrr r0, r1, d\dr mov pc, lr .org 1b + 8 .endr ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 076/149] ASoC: Fix dB scales for WM835x 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (74 preceding siblings ...) 2010-07-01 17:31 ` [patch 075/149] ARM: VFP: Fix vfp_put_double() for d16-d31 Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 077/149] ASoC: Fix dB scales for WM8400 Greg KH ` (72 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Mark Brown, Liam Girdwood 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Mark Brown <broonie@opensource.wolfsonmicro.com> commit e6a08c5a8990102bcd1f4bae84b668da6c23caa9 upstream. These should be regular rather than linear scales. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/soc/codecs/wm8350.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/sound/soc/codecs/wm8350.c +++ b/sound/soc/codecs/wm8350.c @@ -423,8 +423,8 @@ static const struct soc_enum wm8350_enum SOC_ENUM_SINGLE(WM8350_INPUT_MIXER_VOLUME, 15, 2, wm8350_lr), }; -static DECLARE_TLV_DB_LINEAR(pre_amp_tlv, -1200, 3525); -static DECLARE_TLV_DB_LINEAR(out_pga_tlv, -5700, 600); +static DECLARE_TLV_DB_SCALE(pre_amp_tlv, -1200, 3525, 0); +static DECLARE_TLV_DB_SCALE(out_pga_tlv, -5700, 600, 0); static DECLARE_TLV_DB_SCALE(dac_pcm_tlv, -7163, 36, 1); static DECLARE_TLV_DB_SCALE(adc_pcm_tlv, -12700, 50, 1); static DECLARE_TLV_DB_SCALE(out_mix_tlv, -1500, 300, 1); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 077/149] ASoC: Fix dB scales for WM8400 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (75 preceding siblings ...) 2010-07-01 17:31 ` [patch 076/149] ASoC: Fix dB scales for WM835x Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 078/149] ASoC: Fix dB scales for WM8990 Greg KH ` (71 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Mark Brown, Liam Girdwood 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Mark Brown <broonie@opensource.wolfsonmicro.com> commit 3351e9fbb0fda6498ee149ee88c67f5849813c57 upstream. These scales should be regular, not linear. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/soc/codecs/wm8400.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) --- a/sound/soc/codecs/wm8400.c +++ b/sound/soc/codecs/wm8400.c @@ -106,21 +106,21 @@ static void wm8400_codec_reset(struct sn wm8400_reset_codec_reg_cache(wm8400->wm8400); } -static const DECLARE_TLV_DB_LINEAR(rec_mix_tlv, -1500, 600); +static const DECLARE_TLV_DB_SCALE(rec_mix_tlv, -1500, 600, 0); -static const DECLARE_TLV_DB_LINEAR(in_pga_tlv, -1650, 3000); +static const DECLARE_TLV_DB_SCALE(in_pga_tlv, -1650, 3000, 0); -static const DECLARE_TLV_DB_LINEAR(out_mix_tlv, -2100, 0); +static const DECLARE_TLV_DB_SCALE(out_mix_tlv, -2100, 0, 0); -static const DECLARE_TLV_DB_LINEAR(out_pga_tlv, -7300, 600); +static const DECLARE_TLV_DB_SCALE(out_pga_tlv, -7300, 600, 0); -static const DECLARE_TLV_DB_LINEAR(out_omix_tlv, -600, 0); +static const DECLARE_TLV_DB_SCALE(out_omix_tlv, -600, 0, 0); -static const DECLARE_TLV_DB_LINEAR(out_dac_tlv, -7163, 0); +static const DECLARE_TLV_DB_SCALE(out_dac_tlv, -7163, 0, 0); -static const DECLARE_TLV_DB_LINEAR(in_adc_tlv, -7163, 1763); +static const DECLARE_TLV_DB_SCALE(in_adc_tlv, -7163, 1763, 0); -static const DECLARE_TLV_DB_LINEAR(out_sidetone_tlv, -3600, 0); +static const DECLARE_TLV_DB_SCALE(out_sidetone_tlv, -3600, 0, 0); static int wm8400_outpga_put_volsw_vu(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) @@ -439,7 +439,7 @@ static int outmixer_event (struct snd_so /* INMIX dB values */ static const unsigned int in_mix_tlv[] = { TLV_DB_RANGE_HEAD(1), - 0,7, TLV_DB_LINEAR_ITEM(-1200, 600), + 0,7, TLV_DB_SCALE_ITEM(-1200, 600, 0), }; /* Left In PGA Connections */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 078/149] ASoC: Fix dB scales for WM8990 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (76 preceding siblings ...) 2010-07-01 17:31 ` [patch 077/149] ASoC: Fix dB scales for WM8400 Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 079/149] drm/radeon: r100/r200 ums: block ability for userspace app to trash 0 page and beyond Greg KH ` (70 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Mark Brown, Liam Girdwood 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Mark Brown <broonie@opensource.wolfsonmicro.com> commit f68596c6d8711650722b2a54328a088a2c21bc5b upstream. These should be regular, not linear. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/soc/codecs/wm8990.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) --- a/sound/soc/codecs/wm8990.c +++ b/sound/soc/codecs/wm8990.c @@ -110,21 +110,21 @@ static const u16 wm8990_reg[] = { #define wm8990_reset(c) snd_soc_write(c, WM8990_RESET, 0) -static const DECLARE_TLV_DB_LINEAR(rec_mix_tlv, -1500, 600); +static const DECLARE_TLV_DB_SCALE(rec_mix_tlv, -1500, 600, 0); -static const DECLARE_TLV_DB_LINEAR(in_pga_tlv, -1650, 3000); +static const DECLARE_TLV_DB_SCALE(in_pga_tlv, -1650, 3000, 0); -static const DECLARE_TLV_DB_LINEAR(out_mix_tlv, 0, -2100); +static const DECLARE_TLV_DB_SCALE(out_mix_tlv, 0, -2100, 0); -static const DECLARE_TLV_DB_LINEAR(out_pga_tlv, -7300, 600); +static const DECLARE_TLV_DB_SCALE(out_pga_tlv, -7300, 600, 0); -static const DECLARE_TLV_DB_LINEAR(out_omix_tlv, -600, 0); +static const DECLARE_TLV_DB_SCALE(out_omix_tlv, -600, 0, 0); -static const DECLARE_TLV_DB_LINEAR(out_dac_tlv, -7163, 0); +static const DECLARE_TLV_DB_SCALE(out_dac_tlv, -7163, 0, 0); -static const DECLARE_TLV_DB_LINEAR(in_adc_tlv, -7163, 1763); +static const DECLARE_TLV_DB_SCALE(in_adc_tlv, -7163, 1763, 0); -static const DECLARE_TLV_DB_LINEAR(out_sidetone_tlv, -3600, 0); +static const DECLARE_TLV_DB_SCALE(out_sidetone_tlv, -3600, 0, 0); static int wm899x_outpga_put_volsw_vu(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) @@ -450,7 +450,7 @@ static int outmixer_event(struct snd_soc /* INMIX dB values */ static const unsigned int in_mix_tlv[] = { TLV_DB_RANGE_HEAD(1), - 0, 7, TLV_DB_LINEAR_ITEM(-1200, 600), + 0, 7, TLV_DB_SCALE_ITEM(-1200, 600, 0), }; /* Left In PGA Connections */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 079/149] drm/radeon: r100/r200 ums: block ability for userspace app to trash 0 page and beyond 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (77 preceding siblings ...) 2010-07-01 17:31 ` [patch 078/149] ASoC: Fix dB scales for WM8990 Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 080/149] drm/radeon: fix the r100/r200 ums block 0 page fix Greg KH ` (69 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Dave Airlie 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Dave Airlie <airlied@redhat.com> commit 566d84d172161cb6c0c4dd834c34abbac6bf7b38 upstream. radeon's have a special ability to passthrough writes in their internal memory space directly to PCI, this ability means that if some of the internal surfaces like the depth buffer point at 0x0, any writes to these will go directly to RAM at 0x0 via PCI busmastering. Now mesa used to always emit clears after emitting state, since the radeon mesa driver was refactored a year or more ago, it was found it could generate a clear request without ever sending any setup state to the card. So the clear would attempt to clear the depth buffer at 0x0, which would overwrite main memory at this point. fs corruption ensues. Also once one app did this correctly, it would never get set back to 0 making this messy to reproduce. The kernel should block this from happening as mesa runs without privs, though it does require the user be connected to the current running X session. This patch implements a check to make sure the depth offset has been set before a depth clear occurs and if it finds one it prints a warning and ignores the depth clear request. There is also a mesa fix to avoid sending the badness going into mesa. This only affects r100/r200 GPUs in user modesetting mode. Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/radeon/radeon_cp.c | 1 + drivers/gpu/drm/radeon/radeon_drv.h | 2 ++ drivers/gpu/drm/radeon/radeon_state.c | 6 ++++++ 3 files changed, 9 insertions(+) --- a/drivers/gpu/drm/radeon/radeon_cp.c +++ b/drivers/gpu/drm/radeon/radeon_cp.c @@ -1646,6 +1646,7 @@ static int radeon_do_resume_cp(struct dr radeon_cp_load_microcode(dev_priv); radeon_cp_init_ring_buffer(dev, dev_priv, file_priv); + dev_priv->have_z_offset = 0; radeon_do_engine_reset(dev); radeon_irq_set_state(dev, RADEON_SW_INT_ENABLE, 1); --- a/drivers/gpu/drm/radeon/radeon_drv.h +++ b/drivers/gpu/drm/radeon/radeon_drv.h @@ -267,6 +267,8 @@ typedef struct drm_radeon_private { u32 scratch_ages[5]; + int have_z_offset; + /* starting from here on, data is preserved accross an open */ uint32_t flags; /* see radeon_chip_flags */ resource_size_t fb_aper_offset; --- a/drivers/gpu/drm/radeon/radeon_state.c +++ b/drivers/gpu/drm/radeon/radeon_state.c @@ -101,6 +101,7 @@ static __inline__ int radeon_check_and_f DRM_ERROR("Invalid depth buffer offset\n"); return -EINVAL; } + dev_priv->have_z_offset = 1; break; case RADEON_EMIT_PP_CNTL: @@ -876,6 +877,11 @@ static void radeon_cp_dispatch_clear(str if (tmp & RADEON_BACK) flags |= RADEON_FRONT; } + if (flags & (RADEON_DEPTH|RADEON_STENCIL)) { + if (!dev_priv->have_z_offset) + printk_once(KERN_ERR "radeon: illegal depth clear request. Buggy mesa detected - please update.\n"); + flags &= ~(RADEON_DEPTH | RADEON_STENCIL); + } if (flags & (RADEON_FRONT | RADEON_BACK)) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 080/149] drm/radeon: fix the r100/r200 ums block 0 page fix 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (78 preceding siblings ...) 2010-07-01 17:31 ` [patch 079/149] drm/radeon: r100/r200 ums: block ability for userspace app to trash 0 page and beyond Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 081/149] hwmon: (ltc4245) Read only one GPIO pin Greg KH ` (68 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Dave Airlie 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Dave Airlie <airlied@redhat.com> commit cf22f20ade30f8c03955324aaf27b1049e182600 upstream. airlied -> brown paper bag. I blame Hi-5 or the Wiggles for lowering my IQ, move the fix inside some brackets instead of breaking everything in site. Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/radeon/radeon_state.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/gpu/drm/radeon/radeon_state.c +++ b/drivers/gpu/drm/radeon/radeon_state.c @@ -878,9 +878,10 @@ static void radeon_cp_dispatch_clear(str flags |= RADEON_FRONT; } if (flags & (RADEON_DEPTH|RADEON_STENCIL)) { - if (!dev_priv->have_z_offset) + if (!dev_priv->have_z_offset) { printk_once(KERN_ERR "radeon: illegal depth clear request. Buggy mesa detected - please update.\n"); - flags &= ~(RADEON_DEPTH | RADEON_STENCIL); + flags &= ~(RADEON_DEPTH | RADEON_STENCIL); + } } if (flags & (RADEON_FRONT | RADEON_BACK)) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 081/149] hwmon: (ltc4245) Read only one GPIO pin 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (79 preceding siblings ...) 2010-07-01 17:31 ` [patch 080/149] drm/radeon: fix the r100/r200 ums block 0 page fix Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 082/149] signals: check_kill_permission(): dont check creds if same_thread_group() Greg KH ` (67 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ira W. Snyder, Jean Delvare 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Ira W. Snyder <iws@ovro.caltech.edu> commit df16dd53c575d0cb9dbee20a3149927c862a9ff6 upstream. Read only one of the GPIO pins as an analog voltage. The ADC can be switched to a different GPIO pin at runtime, but this is not supported. Previously, this driver would report the analog voltage of the currently selected GPIO pin as all three GPIO voltages: in9_input, in10_input and in11_input. Signed-off-by: Ira W. Snyder <iws@ovro.caltech.edu> Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- Documentation/hwmon/ltc4245 | 4 +--- drivers/hwmon/ltc4245.c | 18 +++++------------- 2 files changed, 6 insertions(+), 16 deletions(-) --- a/Documentation/hwmon/ltc4245 +++ b/Documentation/hwmon/ltc4245 @@ -72,9 +72,7 @@ in6_min_alarm 5v output undervoltage a in7_min_alarm 3v output undervoltage alarm in8_min_alarm Vee (-12v) output undervoltage alarm -in9_input GPIO #1 voltage data -in10_input GPIO #2 voltage data -in11_input GPIO #3 voltage data +in9_input GPIO voltage data power1_input 12v power usage (mW) power2_input 5v power usage (mW) --- a/drivers/hwmon/ltc4245.c +++ b/drivers/hwmon/ltc4245.c @@ -45,9 +45,7 @@ enum ltc4245_cmd { LTC4245_VEEIN = 0x19, LTC4245_VEESENSE = 0x1a, LTC4245_VEEOUT = 0x1b, - LTC4245_GPIOADC1 = 0x1c, - LTC4245_GPIOADC2 = 0x1d, - LTC4245_GPIOADC3 = 0x1e, + LTC4245_GPIOADC = 0x1c, }; struct ltc4245_data { @@ -61,7 +59,7 @@ struct ltc4245_data { u8 cregs[0x08]; /* Voltage registers */ - u8 vregs[0x0f]; + u8 vregs[0x0d]; }; static struct ltc4245_data *ltc4245_update_device(struct device *dev) @@ -86,7 +84,7 @@ static struct ltc4245_data *ltc4245_upda data->cregs[i] = val; } - /* Read voltage registers -- 0x10 to 0x1f */ + /* Read voltage registers -- 0x10 to 0x1c */ for (i = 0; i < ARRAY_SIZE(data->vregs); i++) { val = i2c_smbus_read_byte_data(client, i+0x10); if (unlikely(val < 0)) @@ -128,9 +126,7 @@ static int ltc4245_get_voltage(struct de case LTC4245_VEEOUT: voltage = regval * -55; break; - case LTC4245_GPIOADC1: - case LTC4245_GPIOADC2: - case LTC4245_GPIOADC3: + case LTC4245_GPIOADC: voltage = regval * 10; break; default: @@ -297,9 +293,7 @@ LTC4245_ALARM(in7_min_alarm, (1 << 2), L LTC4245_ALARM(in8_min_alarm, (1 << 3), LTC4245_FAULT2); /* GPIO voltages */ -LTC4245_VOLTAGE(in9_input, LTC4245_GPIOADC1); -LTC4245_VOLTAGE(in10_input, LTC4245_GPIOADC2); -LTC4245_VOLTAGE(in11_input, LTC4245_GPIOADC3); +LTC4245_VOLTAGE(in9_input, LTC4245_GPIOADC); /* Power Consumption (virtual) */ LTC4245_POWER(power1_input, LTC4245_12VSENSE); @@ -342,8 +336,6 @@ static struct attribute *ltc4245_attribu &sensor_dev_attr_in8_min_alarm.dev_attr.attr, &sensor_dev_attr_in9_input.dev_attr.attr, - &sensor_dev_attr_in10_input.dev_attr.attr, - &sensor_dev_attr_in11_input.dev_attr.attr, &sensor_dev_attr_power1_input.dev_attr.attr, &sensor_dev_attr_power2_input.dev_attr.attr, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 082/149] signals: check_kill_permission(): dont check creds if same_thread_group() 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (80 preceding siblings ...) 2010-07-01 17:31 ` [patch 081/149] hwmon: (ltc4245) Read only one GPIO pin Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 083/149] do_generic_file_read: clear page errors when issuing a fresh read of the page Greg KH ` (66 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Oleg Nesterov, Roland McGrath, David Howells, Eric Paris, Jakub Jelinek, James Morris, Stephen Smalley 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Oleg Nesterov <oleg@redhat.com> commit 065add3941bdca54fe04ed3471a96bce9af88793 upstream. Andrew Tridgell reports that aio_read(SIGEV_SIGNAL) can fail if the notification from the helper thread races with setresuid(), see http://samba.org/~tridge/junkcode/aio_uid.c This happens because check_kill_permission() doesn't permit sending a signal to the task with the different cred->xids. But there is not any security reason to check ->cred's when the task sends a signal (private or group-wide) to its sub-thread. Whatever we do, any thread can bypass all security checks and send SIGKILL to all threads, or it can block a signal SIG and do kill(gettid(), SIG) to deliver this signal to another sub-thread. Not to mention that CLONE_THREAD implies CLONE_VM. Change check_kill_permission() to avoid the credentials check when the sender and the target are from the same thread group. Also, move "cred = current_cred()" down to avoid calling get_current() twice. Note: David Howells pointed out we could relax this even more, the CLONE_SIGHAND (without CLONE_THREAD) case probably does not need these checks too. Roland said: : The glibc (libpthread) that does set*id across threads has : been in use for a while (2.3.4?), probably in distro's using kernels as old : or older than any active -stable streams. In the race in question, this : kernel bug is breaking valid POSIX application expectations. Reported-by: Andrew Tridgell <tridge@samba.org> Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Roland McGrath <roland@redhat.com> Acked-by: David Howells <dhowells@redhat.com> Cc: Eric Paris <eparis@parisplace.org> Cc: Jakub Jelinek <jakub@redhat.com> Cc: James Morris <jmorris@namei.org> Cc: Roland McGrath <roland@redhat.com> Cc: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/signal.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/kernel/signal.c +++ b/kernel/signal.c @@ -591,7 +591,7 @@ static int rm_from_queue(unsigned long m static int check_kill_permission(int sig, struct siginfo *info, struct task_struct *t) { - const struct cred *cred = current_cred(), *tcred; + const struct cred *cred, *tcred; struct pid *sid; int error; @@ -605,8 +605,10 @@ static int check_kill_permission(int sig if (error) return error; + cred = current_cred(); tcred = __task_cred(t); - if ((cred->euid ^ tcred->suid) && + if (!same_thread_group(current, t) && + (cred->euid ^ tcred->suid) && (cred->euid ^ tcred->uid) && (cred->uid ^ tcred->suid) && (cred->uid ^ tcred->uid) && ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 083/149] do_generic_file_read: clear page errors when issuing a fresh read of the page 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (81 preceding siblings ...) 2010-07-01 17:31 ` [patch 082/149] signals: check_kill_permission(): dont check creds if same_thread_group() Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 084/149] ipmi: handle run_to_completion properly in deliver_recv_msg() Greg KH ` (65 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jeff Moyer, Rik van Riel, Larry Woodman 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Jeff Moyer <jmoyer@redhat.com> commit 91803b499cca2fe558abad709ce83dc896b80950 upstream. I/O errors can happen due to temporary failures, like multipath errors or losing network contact with the iSCSI server. Because of that, the VM will retry readpage on the page. However, do_generic_file_read does not clear PG_error. This causes the system to be unable to actually use the data in the page cache page, even if the subsequent readpage completes successfully! The function filemap_fault has had a ClearPageError before readpage forever. This patch simply adds the same to do_generic_file_read. Signed-off-by: Jeff Moyer <jmoyer@redhat.com> Signed-off-by: Rik van Riel <riel@redhat.com> Acked-by: Larry Woodman <lwoodman@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- mm/filemap.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/mm/filemap.c +++ b/mm/filemap.c @@ -1120,6 +1120,12 @@ page_not_up_to_date_locked: } readpage: + /* + * A previous I/O error may have been due to temporary + * failures, eg. multipath errors. + * PG_error will be set again if readpage fails. + */ + ClearPageError(page); /* Start the actual read. The read will unlock the page. */ error = mapping->a_ops->readpage(filp, page); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 084/149] ipmi: handle run_to_completion properly in deliver_recv_msg() 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (82 preceding siblings ...) 2010-07-01 17:31 ` [patch 083/149] do_generic_file_read: clear page errors when issuing a fresh read of the page Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 085/149] x86, setup: Phoenix BIOS fixup is needed on Dell Inspiron Mini 1012 Greg KH ` (64 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jiri Kosina, Corey Minyard 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Jiri Kosina <jkosina@suse.cz> commit a747c5abc329611220f16df0bb4cf0ca4a7fdf0c upstream. If run_to_completion flag is set, it means that we are running in a single-threaded mode, and thus no locks are held. This fixes a deadlock when IPMI notifier is being called during panic. Signed-off-by: Jiri Kosina <jkosina@suse.cz> Acked-by: Corey Minyard <minyard@acm.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/char/ipmi/ipmi_si_intf.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) --- a/drivers/char/ipmi/ipmi_si_intf.c +++ b/drivers/char/ipmi/ipmi_si_intf.c @@ -310,9 +310,14 @@ static void deliver_recv_msg(struct smi_ { /* Deliver the message to the upper layer with the lock released. */ - spin_unlock(&(smi_info->si_lock)); - ipmi_smi_msg_received(smi_info->intf, msg); - spin_lock(&(smi_info->si_lock)); + + if (smi_info->run_to_completion) { + ipmi_smi_msg_received(smi_info->intf, msg); + } else { + spin_unlock(&(smi_info->si_lock)); + ipmi_smi_msg_received(smi_info->intf, msg); + spin_lock(&(smi_info->si_lock)); + } } static void return_hosed_msg(struct smi_info *smi_info, int cCode) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 085/149] x86, setup: Phoenix BIOS fixup is needed on Dell Inspiron Mini 1012 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (83 preceding siblings ...) 2010-07-01 17:31 ` [patch 084/149] ipmi: handle run_to_completion properly in deliver_recv_msg() Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 086/149] xen: ensure timer tick is resumed even on CPU driving the resume Greg KH ` (63 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Gabor Gombas, H. Peter Anvin 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Gabor Gombas <gombasg@digikabel.hu> commit 3d6e77a3ddb8e4156b89f4273ff8c7d37abaf781 upstream. The low-memory corruption checker triggers during suspend/resume, so we need to reserve the low 64k. Don't be fooled that the BIOS identifies itself as "Dell Inc.", it's still Phoenix BIOS. [ hpa: I think we blacklist almost every BIOS in existence. We should either change this to a whitelist or just make it unconditional. ] Signed-off-by: Gabor Gombas <gombasg@digikabel.hu> LKML-Reference: <201005241913.o4OJDIMM010877@imap1.linux-foundation.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/kernel/setup.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -688,6 +688,17 @@ static struct dmi_system_id __initdata b DMI_MATCH(DMI_BOARD_NAME, "DG45FC"), }, }, + /* + * The Dell Inspiron Mini 1012 has DMI_BIOS_VENDOR = "Dell Inc.", so + * match on the product name. + */ + { + .callback = dmi_low_memory_corruption, + .ident = "Phoenix BIOS", + .matches = { + DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1012"), + }, + }, #endif {} }; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 086/149] xen: ensure timer tick is resumed even on CPU driving the resume 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (84 preceding siblings ...) 2010-07-01 17:31 ` [patch 085/149] x86, setup: Phoenix BIOS fixup is needed on Dell Inspiron Mini 1012 Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 087/149] xen: avoid allocation causing potential swap activity on the resume path Greg KH ` (62 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ian Campbell, Jeremy Fitzhardinge 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Ian Campbell <ian.campbell@citrix.com> commit cd52e17ea8278f8449b6174a8e5ed439a2e44ffb upstream. The core suspend/resume code is run from stop_machine on CPU0 but parts of the suspend/resume machinery (including xen_arch_resume) are run on whichever CPU happened to schedule the xenwatch kernel thread. As part of the non-core resume code xen_arch_resume is called in order to restart the timer tick on non-boot processors. The boot processor itself is taken care of by core timekeeping code. xen_arch_resume uses smp_call_function which does not call the given function on the current processor. This means that we can end up with one CPU not receiving timer ticks if the xenwatch thread happened to be scheduled on CPU > 0. Use on_each_cpu instead of smp_call_function to ensure the timer tick is resumed everywhere. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Jeremy Fitzhardinge <jeremy@goop.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/xen/suspend.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/arch/x86/xen/suspend.c +++ b/arch/x86/xen/suspend.c @@ -60,6 +60,6 @@ static void xen_vcpu_notify_restore(void void xen_arch_resume(void) { - smp_call_function(xen_vcpu_notify_restore, - (void *)CLOCK_EVT_NOTIFY_RESUME, 1); + on_each_cpu(xen_vcpu_notify_restore, + (void *)CLOCK_EVT_NOTIFY_RESUME, 1); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 087/149] xen: avoid allocation causing potential swap activity on the resume path 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (85 preceding siblings ...) 2010-07-01 17:31 ` [patch 086/149] xen: ensure timer tick is resumed even on CPU driving the resume Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 088/149] ALSA: hda: Use LPIB for an ASUS device Greg KH ` (61 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ian Campbell, Jeremy Fitzhardinge 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Ian Campbell <ian.campbell@citrix.com> commit b3831cb55d383e8eb55d3b56c715fb48459b87c9 upstream. Since the device we are resuming could be the device containing the swap device we should ensure that the allocation cannot cause IO. On resume, this path is triggered when the running system tries to continue using its devices. If it cannot then the resume will fail; to try to avoid this we let it dip into the emergency pools. The majority of these changes were made when linux-2.6.18-xen.hg changeset e8b49cfbdac0 was ported upstream in a144ff09bc52ef3f3684ed23eadc9c7c0e57b3aa but somehow this hunk was dropped. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Jeremy Fitzhardinge <jeremy@goop.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/xen/xenbus/xenbus_xs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/xen/xenbus/xenbus_xs.c +++ b/drivers/xen/xenbus/xenbus_xs.c @@ -499,7 +499,7 @@ int xenbus_printf(struct xenbus_transact #define PRINTF_BUFFER_SIZE 4096 char *printf_buffer; - printf_buffer = kmalloc(PRINTF_BUFFER_SIZE, GFP_KERNEL); + printf_buffer = kmalloc(PRINTF_BUFFER_SIZE, GFP_NOIO | __GFP_HIGH); if (printf_buffer == NULL) return -ENOMEM; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 088/149] ALSA: hda: Use LPIB for an ASUS device 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (86 preceding siblings ...) 2010-07-01 17:31 ` [patch 087/149] xen: avoid allocation causing potential swap activity on the resume path Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 089/149] ALSA: hda: Use mb31 quirk for an iMac model Greg KH ` (60 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit dd37f8e8659bc617c3f2a84e007a4824ccdac458 upstream. BugLink: https://launchpad.net/bugs/465942 Symptom: On the reporter's ASUS device, using PulseAudio in Ubuntu 10.04 LTS results in the PA daemon crashing shortly after attempting to select capture or to configure the audio hardware profile. Test case: Using Ubuntu 10.04 LTS (Linux 2.6.32.12), Linux 2.6.33, or Linux 2.6.34, adjust the HDA device's capture volume with PulseAudio. Resolution: add SSID for this machine to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: Irihapeti Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2232,6 +2232,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB), SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB), SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 089/149] ALSA: hda: Use mb31 quirk for an iMac model 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (87 preceding siblings ...) 2010-07-01 17:31 ` [patch 088/149] ALSA: hda: Use LPIB for an ASUS device Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 090/149] ALSA: hda: Use LPIB for another mainboard Greg KH ` (59 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 26fd74fc01991a18f0e3bd54f8b1b75945ee3dbb upstream. BugLink: https://launchpad.net/bugs/542550 Symptom: On the reporter's iMac, in Ubuntu 10.04 LTS neither playback nor capture appear audible out-of-the-box. Test case: Boot from an Ubuntu 10.04 LTS live cd or from an installed configuration and attempt to play or capture audio. Resolution: Specify the mb31 quirk for this machine in the codec SSID table. Reported-and-Tested-By: f3a97 Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -8937,6 +8937,7 @@ static struct snd_pci_quirk alc882_ssid_ SND_PCI_QUIRK(0x106b, 0x1000, "iMac 24", ALC885_IMAC24), SND_PCI_QUIRK(0x106b, 0x2800, "AppleTV", ALC885_IMAC24), SND_PCI_QUIRK(0x106b, 0x2c00, "MacbookPro rev3", ALC885_MBP3), + SND_PCI_QUIRK(0x106b, 0x3000, "iMac", ALC889A_MB31), SND_PCI_QUIRK(0x106b, 0x3600, "Macbook 3,1", ALC889A_MB31), SND_PCI_QUIRK(0x106b, 0x3800, "MacbookPro 4,1", ALC885_MBP3), SND_PCI_QUIRK(0x106b, 0x3e00, "iMac 24 Aluminum", ALC885_IMAC24), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 090/149] ALSA: hda: Use LPIB for another mainboard 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (88 preceding siblings ...) 2010-07-01 17:31 ` [patch 089/149] ALSA: hda: Use mb31 quirk for an iMac model Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 091/149] ALSA: hda: Use LPIB for ASUS M2V Greg KH ` (58 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit b90c076424da8166797bdc34187660fd0124f530 upstream. BugLink: https://launchpad.net/bugs/580749 Symptom: on the original reporter's VIA VT1708-based board, the PulseAudio daemon dies shortly after the user attempts to play an audio file. Test case: boot from Ubuntu 10.04 LTS live cd; attempt to play an audio file. Resolution: add SSID for the original reporter's hardware to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: Harald Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2241,6 +2241,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB), SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB), SND_PCI_QUIRK(0x1565, 0x8218, "Biostar Microtech", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1849, 0x0888, "775Dual-VSTA", POS_FIX_LPIB), SND_PCI_QUIRK(0x8086, 0x2503, "DG965OT AAD63733-203", POS_FIX_LPIB), SND_PCI_QUIRK(0x8086, 0xd601, "eMachines T5212", POS_FIX_LPIB), {} ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 091/149] ALSA: hda: Use LPIB for ASUS M2V 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (89 preceding siblings ...) 2010-07-01 17:31 ` [patch 090/149] ALSA: hda: Use LPIB for another mainboard Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 092/149] Staging: comedi - correct parameter gainlkup for DAQCard-6024E in driver ni_mio_cs.c Greg KH ` (57 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 9f75c1b12c5ef392ddcea575b13560842c28b1b3 upstream. BugLink: https://launchpad.net/bugs/587546 Symptom: On the reporter's ASUS M2V, using PulseAudio in Ubuntu 10.04 LTS results in the PA daemon crashing shortly after attempting playback of an audio file. Test case: Using Ubuntu 10.04 LTS (Linux 2.6.32.12), Linux 2.6.33, or Linux 2.6.34, attempt playback of an audio file while PulseAudio is active. Resolution: add SSID for this machine to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: D Tangman Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2233,6 +2233,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1043, 0x81e7, "ASUS M2V", POS_FIX_LPIB), SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB), SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 092/149] Staging: comedi - correct parameter gainlkup for DAQCard-6024E in driver ni_mio_cs.c 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (90 preceding siblings ...) 2010-07-01 17:31 ` [patch 091/149] ALSA: hda: Use LPIB for ASUS M2V Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:31 ` [patch 093/149] clocksource: sh_cmt: compute mult and shift before registration Greg KH ` (56 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Martin Homuth-Rosemann 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Martin Homuth-Rosemann <homuth-rosemann@gmx.net> commit ebe8622342f12bed387f7de4b5fb7c52005ccb29 upstream. Correct at least one of the incorrect specs for a national instrument data acquisition card DAQCard-6024E. This card has only four different gain settings (+-10V, +-5V, +-0.5V, +-0.05V). Signed-off-by: Martin Homuth-Rosemann <homuth-rosemann@gmx.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/staging/comedi/drivers/ni_mio_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/staging/comedi/drivers/ni_mio_cs.c +++ b/drivers/staging/comedi/drivers/ni_mio_cs.c @@ -123,7 +123,7 @@ static const struct ni_board_struct ni_b .adbits = 12, .ai_fifo_depth = 1024, .alwaysdither = 0, - .gainlkup = ai_gain_16, + .gainlkup = ai_gain_4, .ai_speed = 5000, .n_aochan = 2, .aobits = 12, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 093/149] clocksource: sh_cmt: compute mult and shift before registration 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (91 preceding siblings ...) 2010-07-01 17:31 ` [patch 092/149] Staging: comedi - correct parameter gainlkup for DAQCard-6024E in driver ni_mio_cs.c Greg KH @ 2010-07-01 17:31 ` Greg KH 2010-07-01 17:32 ` [patch 094/149] ath5k: retain promiscuous setting Greg KH ` (55 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:31 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Paul Mundt 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Paul Mundt <lethal@linux-sh.org> commit f4d7c3565c1692c54d9152b52090fe73f0029e37 upstream. Based on the sh_tmu change in 66f49121ffa41a19c59965b31b046d8368fec3c7 ("clocksource: sh_tmu: compute mult and shift before registration"). The same issues impact the sh_cmt driver, so we take the same approach here. Signed-off-by: Paul Mundt <lethal@linux-sh.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/clocksource/sh_cmt.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) --- a/drivers/clocksource/sh_cmt.c +++ b/drivers/clocksource/sh_cmt.c @@ -413,18 +413,10 @@ static cycle_t sh_cmt_clocksource_read(s static int sh_cmt_clocksource_enable(struct clocksource *cs) { struct sh_cmt_priv *p = cs_to_sh_cmt(cs); - int ret; p->total_cycles = 0; - ret = sh_cmt_start(p, FLAG_CLOCKSOURCE); - if (ret) - return ret; - - /* TODO: calculate good shift from rate and counter bit width */ - cs->shift = 0; - cs->mult = clocksource_hz2mult(p->rate, cs->shift); - return 0; + return sh_cmt_start(p, FLAG_CLOCKSOURCE); } static void sh_cmt_clocksource_disable(struct clocksource *cs) @@ -444,7 +436,18 @@ static int sh_cmt_register_clocksource(s cs->disable = sh_cmt_clocksource_disable; cs->mask = CLOCKSOURCE_MASK(sizeof(unsigned long) * 8); cs->flags = CLOCK_SOURCE_IS_CONTINUOUS; + + /* clk_get_rate() needs an enabled clock */ + clk_enable(p->clk); + p->rate = clk_get_rate(p->clk) / (p->width == 16) ? 512 : 8; + clk_disable(p->clk); + + /* TODO: calculate good shift from rate and counter bit width */ + cs->shift = 10; + cs->mult = clocksource_hz2mult(p->rate, cs->shift); + pr_info("sh_cmt: %s used as clock source\n", cs->name); + clocksource_register(cs); return 0; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 094/149] ath5k: retain promiscuous setting 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (92 preceding siblings ...) 2010-07-01 17:31 ` [patch 093/149] clocksource: sh_cmt: compute mult and shift before registration Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 095/149] ahci: add pci quirk for JMB362 Greg KH ` (54 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Bob Copeland, John W. Linville 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Bob Copeland <me@bobcopeland.com> commit 6b5dcccb495b66b3b0b9581cdccfed038e5d68a2 upstream. Commit 56d1de0a21db28e41741cfa0a66e18bc8d920554, "ath5k: clean up filter flags setting" introduced a regression in monitor mode such that the promisc filter flag would get lost. Although we set the promisc flag when it changed, we did not preserve it across subsequent calls to configure_filter. This patch restores the original functionality. Bisected-by: weedy2887@gmail.com Tested-by: weedy2887@gmail.com Tested-by: Rick Farina <sidhayn@gmail.com> Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/ath/ath5k/base.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/net/wireless/ath/ath5k/base.c +++ b/drivers/net/wireless/ath/ath5k/base.c @@ -2975,13 +2975,15 @@ static void ath5k_configure_filter(struc if (changed_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS)) { if (*new_flags & FIF_PROMISC_IN_BSS) { - rfilt |= AR5K_RX_FILTER_PROM; __set_bit(ATH_STAT_PROMISC, sc->status); } else { __clear_bit(ATH_STAT_PROMISC, sc->status); } } + if (test_bit(ATH_STAT_PROMISC, sc->status)) + rfilt |= AR5K_RX_FILTER_PROM; + /* Note, AR5K_RX_FILTER_MCAST is already enabled */ if (*new_flags & FIF_ALLMULTI) { mfilt[0] = ~0; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 095/149] ahci: add pci quirk for JMB362 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (93 preceding siblings ...) 2010-07-01 17:32 ` [patch 094/149] ath5k: retain promiscuous setting Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 096/149] firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder Greg KH ` (53 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Jeff Garzik 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Tejun Heo <tj@kernel.org> commit 4daedcfe8c6851aa01cc1997220f2577f4039c13 upstream. JMB362 is a new variant of jmicron controller which is similar to JMB360 but has two SATA ports instead of one. As there is no PATA port, single function AHCI mode can be used as in JMB360. Add pci quirk for JMB362. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Aries Lee <arieslee@jmicron.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/pci/quirks.c | 5 ++++- include/linux/pci_ids.h | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -1444,7 +1444,8 @@ static void quirk_jmicron_ata(struct pci conf5 &= ~(1 << 24); /* Clear bit 24 */ switch (pdev->device) { - case PCI_DEVICE_ID_JMICRON_JMB360: + case PCI_DEVICE_ID_JMICRON_JMB360: /* SATA single port */ + case PCI_DEVICE_ID_JMICRON_JMB362: /* SATA dual ports */ /* The controller should be in single function ahci mode */ conf1 |= 0x0002A100; /* Set 8, 13, 15, 17 */ break; @@ -1480,12 +1481,14 @@ static void quirk_jmicron_ata(struct pci } DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB360, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, quirk_jmicron_ata); +DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB362, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB360, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, quirk_jmicron_ata); +DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB362, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, quirk_jmicron_ata); --- a/include/linux/pci_ids.h +++ b/include/linux/pci_ids.h @@ -2317,6 +2317,7 @@ #define PCI_VENDOR_ID_JMICRON 0x197B #define PCI_DEVICE_ID_JMICRON_JMB360 0x2360 #define PCI_DEVICE_ID_JMICRON_JMB361 0x2361 +#define PCI_DEVICE_ID_JMICRON_JMB362 0x2362 #define PCI_DEVICE_ID_JMICRON_JMB363 0x2363 #define PCI_DEVICE_ID_JMICRON_JMB365 0x2365 #define PCI_DEVICE_ID_JMICRON_JMB366 0x2366 ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 096/149] firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (94 preceding siblings ...) 2010-07-01 17:32 ` [patch 095/149] ahci: add pci quirk for JMB362 Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 097/149] perf_events: Fix resource leak in x86 __hw_perf_event_init() Greg KH ` (52 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Stefan Richter 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Stefan Richter <stefanr@s5r6.in-berlin.de> commit 10389536742cefbedecb67a5b2906f155cf3a1c3 upstream. Per IEEE 1394 clause 8.4.2.3, a contender for the IRM role shall check whether the current IRM complies to 1394a-2000 or later. If not force a compliant node (e.g. itself) to become IRM. This was implemented in the older ieee1394 driver but not yet in firewire-core. An older Sony camcorder (Sony DCR-TRV25) which implements 1394-1995 IRM but neither 1394a-2000 IRM nor BM was now found to cause an interoperability bug: - Camcorder becomes root node when plugged in, hence gets IRM role. - firewire-core successfully contends for BM role, proceeds to perform gap count optimization and resets the bus. - Sony camcorder ignores presence of a BM (against the spec, this is a firmware bug), performs its idea of gap count optimization and resets the bus. - Preceding two steps are repeated endlessly, bus never settles, regular I/O is practically impossible. http://thread.gmane.org/gmane.linux.kernel.firewire.user/3913 This is an interoperability regression from the old to the new drivers. Fix it indirectly by adding the 1394a IRM check. The spec suggests three and a half methods to determine 1394a compliance of a remote IRM; we choose the method of testing the Config_ROM.Bus_Info.generation field. This is data that firewire-core should have readily available at this point, i.e. does not require extra I/O. Reported-by: Clemens Ladisch <clemens@ladisch.de> (missing 1394a check) Reported-by: H. S. <hs.samix@gmail.com> (issue with Sony DCR-TRV25) Tested-by: H. S. <hs.samix@gmail.com> Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/firewire/core-card.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) --- a/drivers/firewire/core-card.c +++ b/drivers/firewire/core-card.c @@ -239,7 +239,7 @@ void fw_schedule_bm_work(struct fw_card static void fw_card_bm_work(struct work_struct *work) { struct fw_card *card = container_of(work, struct fw_card, work.work); - struct fw_device *root_device; + struct fw_device *root_device, *irm_device; struct fw_node *root_node; unsigned long flags; int root_id, new_root_id, irm_id, local_id; @@ -247,6 +247,7 @@ static void fw_card_bm_work(struct work_ bool do_reset = false; bool root_device_is_running; bool root_device_is_cmc; + bool irm_is_1394_1995_only; spin_lock_irqsave(&card->lock, flags); @@ -256,12 +257,18 @@ static void fw_card_bm_work(struct work_ } generation = card->generation; + root_node = card->root_node; fw_node_get(root_node); root_device = root_node->data; root_device_is_running = root_device && atomic_read(&root_device->state) == FW_DEVICE_RUNNING; root_device_is_cmc = root_device && root_device->cmc; + + irm_device = card->irm_node->data; + irm_is_1394_1995_only = irm_device && irm_device->config_rom && + (irm_device->config_rom[2] & 0x000000f0) == 0; + root_id = root_node->node_id; irm_id = card->irm_node->node_id; local_id = card->local_node->node_id; @@ -284,8 +291,15 @@ static void fw_card_bm_work(struct work_ if (!card->irm_node->link_on) { new_root_id = local_id; - fw_notify("IRM has link off, making local node (%02x) root.\n", - new_root_id); + fw_notify("%s, making local node (%02x) root.\n", + "IRM has link off", new_root_id); + goto pick_me; + } + + if (irm_is_1394_1995_only) { + new_root_id = local_id; + fw_notify("%s, making local node (%02x) root.\n", + "IRM is not 1394a compliant", new_root_id); goto pick_me; } @@ -324,8 +338,8 @@ static void fw_card_bm_work(struct work_ * root, and thus, IRM. */ new_root_id = local_id; - fw_notify("BM lock failed, making local node (%02x) root.\n", - new_root_id); + fw_notify("%s, making local node (%02x) root.\n", + "BM lock failed", new_root_id); goto pick_me; } } else if (card->bm_generation != generation) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 097/149] perf_events: Fix resource leak in x86 __hw_perf_event_init() 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (95 preceding siblings ...) 2010-07-01 17:32 ` [patch 096/149] firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 098/149] sata_nv: dont diddle with nIEN on mcp55 Greg KH ` (51 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Stephane Eranian, peterz, paulus, davem, fweisbec, robert.richter, perfmon2-devel, Ingo Molnar 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Stephane Eranian <eranian@google.com> commit 4b24a88b35e15e04bd8f2c5dda65b5dc8ebca05f upstream. If reserve_pmc_hardware() succeeds but reserve_ds_buffers() fails, then we need to release_pmc_hardware. It won't be done by the destroy() callback because we return before setting it in case of error. Signed-off-by: Stephane Eranian <eranian@google.com> Cc: peterz@infradead.org Cc: paulus@samba.org Cc: davem@davemloft.net Cc: fweisbec@gmail.com Cc: robert.richter@amd.com Cc: perfmon2-devel@lists.sf.net LKML-Reference: <4ba1568b.15185e0a.182a.7802@mx.google.com> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/kernel/cpu/perf_event.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/arch/x86/kernel/cpu/perf_event.c +++ b/arch/x86/kernel/cpu/perf_event.c @@ -1005,8 +1005,11 @@ static int __hw_perf_event_init(struct p if (atomic_read(&active_events) == 0) { if (!reserve_pmc_hardware()) err = -EBUSY; - else + else { err = reserve_bts_hardware(); + if (err) + release_pmc_hardware(); + } } if (!err) atomic_inc(&active_events); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 098/149] sata_nv: dont diddle with nIEN on mcp55 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (96 preceding siblings ...) 2010-07-01 17:32 ` [patch 097/149] perf_events: Fix resource leak in x86 __hw_perf_event_init() Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 099/149] sata_via: magic vt6421 fix for transmission problems w/ WD drives Greg KH ` (50 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Jeff Garzik [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 1774 bytes --] 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Tejun Heo <tj@kernel.org> commit f3faf8fc3fab45c3526efe8c9e99bb23f8723350 upstream. On mcp55, nIEN gets stuck once set and liteon blueray rom iHOS104-08 violates ATA specification and fails to set I on D2H Reg FIS if nIEN is set when the command was issued. When the other party is following the spec, both devices can work fine but when the two flaws are put together, they can't talk to each other. mcp55 has its own IRQ masking mechanism and there's no reason to mess with nIEN in the first place. Fix it by dropping nIEN diddling from nv_mcp55_freeze/thaw(). This was originally reported by Cengiz. Although Cengiz hasn't verified the fix yet, I could reproduce this problem and verfiy the fix. Even if Cengiz is experiencing different or additional problems, this patch is needed. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Cengiz Günay <cgunay@emory.edu> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/sata_nv.c | 2 -- 1 file changed, 2 deletions(-) --- a/drivers/ata/sata_nv.c +++ b/drivers/ata/sata_nv.c @@ -1673,7 +1673,6 @@ static void nv_mcp55_freeze(struct ata_p mask = readl(mmio_base + NV_INT_ENABLE_MCP55); mask &= ~(NV_INT_ALL_MCP55 << shift); writel(mask, mmio_base + NV_INT_ENABLE_MCP55); - ata_sff_freeze(ap); } static void nv_mcp55_thaw(struct ata_port *ap) @@ -1687,7 +1686,6 @@ static void nv_mcp55_thaw(struct ata_por mask = readl(mmio_base + NV_INT_ENABLE_MCP55); mask |= (NV_INT_MASK_MCP55 << shift); writel(mask, mmio_base + NV_INT_ENABLE_MCP55); - ata_sff_thaw(ap); } static void nv_adma_error_handler(struct ata_port *ap) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 099/149] sata_via: magic vt6421 fix for transmission problems w/ WD drives 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (97 preceding siblings ...) 2010-07-01 17:32 ` [patch 098/149] sata_nv: dont diddle with nIEN on mcp55 Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 100/149] drm/i915: Rebind bo if currently bound with incorrect alignment Greg KH ` (49 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Jeff Garzik 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Tejun Heo <tj@kernel.org> commit 8b27ff4cf6d15964aa2987aeb58db4dfb1f87a19 upstream. vt6421 has problems talking to recent WD drives. It causes a lot of transmission errors while high bandwidth transfer as reported in the following bugzilla entry. https://bugzilla.kernel.org/show_bug.cgi?id=15173 Joseph Chan provided the following fix. I don't have any idea what it does but I can verify the issue is gone with the patch applied. Signed-off-by: Tejun Heo <tj@kernel.org> Originally-from: Joseph Chan <JosephChan@via.com.tw> Reported-by: Jorrit Tijben <sjorrit@gmail.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/sata_via.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) --- a/drivers/ata/sata_via.c +++ b/drivers/ata/sata_via.c @@ -558,6 +558,19 @@ static void svia_configure(struct pci_de tmp8 |= NATIVE_MODE_ALL; pci_write_config_byte(pdev, SATA_NATIVE_MODE, tmp8); } + + /* + * vt6421 has problems talking to some drives. The following + * is the magic fix from Joseph Chan <JosephChan@via.com.tw>. + * Please add proper documentation if possible. + * + * https://bugzilla.kernel.org/show_bug.cgi?id=15173 + */ + if (pdev->device == 0x3249) { + pci_read_config_byte(pdev, 0x52, &tmp8); + tmp8 |= 1 << 2; + pci_write_config_byte(pdev, 0x52, tmp8); + } } static int svia_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 100/149] drm/i915: Rebind bo if currently bound with incorrect alignment. 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (98 preceding siblings ...) 2010-07-01 17:32 ` [patch 099/149] sata_via: magic vt6421 fix for transmission problems w/ WD drives Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 101/149] USB: mos7840: fix null-pointer dereference Greg KH ` (48 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Chris Wilson, Eric Anholt 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Chris Wilson <chris@chris-wilson.co.uk> commit ac0c6b5ad3b3b513e1057806d4b7627fcc0ecc27 upstream. Whilst pinning the buffer, check that that its current alignment matches the requested alignment. If it does not, rebind. This should clear up any final render errors whilst resuming, for reference: Bug 27070 - [i915] Page table errors with empty ringbuffer https://bugs.freedesktop.org/show_bug.cgi?id=27070 Bug 15502 - render error detected, EIR: 0x00000010 https://bugzilla.kernel.org/show_bug.cgi?id=15502 Bug 13844 - i915 error: "render error detected" https://bugzilla.kernel.org/show_bug.cgi?id=13844 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/i915/i915_gem.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -3947,6 +3947,17 @@ i915_gem_object_pin(struct drm_gem_objec int ret; i915_verify_inactive(dev, __FILE__, __LINE__); + + if (obj_priv->gtt_space != NULL) { + if (alignment == 0) + alignment = i915_gem_get_gtt_alignment(obj); + if (obj_priv->gtt_offset & (alignment - 1)) { + ret = i915_gem_object_unbind(obj); + if (ret) + return ret; + } + } + if (obj_priv->gtt_space == NULL) { ret = i915_gem_object_bind_to_gtt(obj, alignment); if (ret) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 101/149] USB: mos7840: fix null-pointer dereference 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (99 preceding siblings ...) 2010-07-01 17:32 ` [patch 100/149] drm/i915: Rebind bo if currently bound with incorrect alignment Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 102/149] USB: xhci: Wait for host to start running Greg KH ` (47 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit b41709f1263bb1ad37efc43fea0bb0b670c12e78 upstream. Fix null-pointer dereference on error path. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c index f8424d1..585b7e6 100644 --- a/drivers/usb/serial/mos7840.c +++ b/drivers/usb/serial/mos7840.c @@ -730,7 +730,6 @@ static void mos7840_bulk_in_callback(struct urb *urb) mos7840_port = urb->context; if (!mos7840_port) { dbg("%s", "NULL mos7840_port pointer"); - mos7840_port->read_urb_busy = false; return; } ^ permalink raw reply related [flat|nested] 666+ messages in thread
* [patch 102/149] USB: xhci: Wait for host to start running. 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (100 preceding siblings ...) 2010-07-01 17:32 ` [patch 101/149] USB: mos7840: fix null-pointer dereference Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 103/149] USB: xhci: Wait for controller to be ready after reset Greg KH ` (46 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Sarah Sharp <sarah.a.sharp@linux.intel.com> commit ed07453fd356025cc25272629e982f5e4607632c upstream. When the run bit is set in the xHCI command register, it may take a few microseconds for the host to start running. We cannot ring any doorbells until the host is actually running, so wait until the status register says the host is running. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Reported-by: Shinya Saito <shinya.saito.sx@renesas.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-hcd.c | 39 ++++++++++++++++++++++++++++++++------- 1 file changed, 32 insertions(+), 7 deletions(-) --- a/drivers/usb/host/xhci-hcd.c +++ b/drivers/usb/host/xhci-hcd.c @@ -97,6 +97,33 @@ int xhci_halt(struct xhci_hcd *xhci) } /* + * Set the run bit and wait for the host to be running. + */ +int xhci_start(struct xhci_hcd *xhci) +{ + u32 temp; + int ret; + + temp = xhci_readl(xhci, &xhci->op_regs->command); + temp |= (CMD_RUN); + xhci_dbg(xhci, "// Turn on HC, cmd = 0x%x.\n", + temp); + xhci_writel(xhci, temp, &xhci->op_regs->command); + + /* + * Wait for the HCHalted Status bit to be 0 to indicate the host is + * running. + */ + ret = handshake(xhci, &xhci->op_regs->status, + STS_HALT, 0, XHCI_MAX_HALT_USEC); + if (ret == -ETIMEDOUT) + xhci_err(xhci, "Host took too long to start, " + "waited %u microseconds.\n", + XHCI_MAX_HALT_USEC); + return ret; +} + +/* * Reset a halted HC, and set the internal HC state to HC_STATE_HALT. * * This resets pipelines, timers, counters, state machines, etc. @@ -460,13 +487,11 @@ int xhci_run(struct usb_hcd *hcd) if (NUM_TEST_NOOPS > 0) doorbell = xhci_setup_one_noop(xhci); - temp = xhci_readl(xhci, &xhci->op_regs->command); - temp |= (CMD_RUN); - xhci_dbg(xhci, "// Turn on HC, cmd = 0x%x.\n", - temp); - xhci_writel(xhci, temp, &xhci->op_regs->command); - /* Flush PCI posted writes */ - temp = xhci_readl(xhci, &xhci->op_regs->command); + if (xhci_start(xhci)) { + xhci_halt(xhci); + return -ENODEV; + } + xhci_dbg(xhci, "// @%p = 0x%x\n", &xhci->op_regs->command, temp); if (doorbell) (*doorbell)(xhci); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 103/149] USB: xhci: Wait for controller to be ready after reset. 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (101 preceding siblings ...) 2010-07-01 17:32 ` [patch 102/149] USB: xhci: Wait for host to start running Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 104/149] USB: ftdi_sio: fix DTR/RTS line modes Greg KH ` (45 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Sarah Sharp <sarah.a.sharp@linux.intel.com> commit 2d62f3eea98354d61f90d6b115eecf9be5f4bdfe upstream. After software resets an xHCI host controller, it must wait for the "Controller Not Ready" (CNR) bit in the status register to be cleared. Software is not supposed to ring any doorbells or write to any registers except the status register until this bit is cleared. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-hcd.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) --- a/drivers/usb/host/xhci-hcd.c +++ b/drivers/usb/host/xhci-hcd.c @@ -134,6 +134,7 @@ int xhci_reset(struct xhci_hcd *xhci) { u32 command; u32 state; + int ret; state = xhci_readl(xhci, &xhci->op_regs->status); if ((state & STS_HALT) == 0) { @@ -148,7 +149,17 @@ int xhci_reset(struct xhci_hcd *xhci) /* XXX: Why does EHCI set this here? Shouldn't other code do this? */ xhci_to_hcd(xhci)->state = HC_STATE_HALT; - return handshake(xhci, &xhci->op_regs->command, CMD_RESET, 0, 250 * 1000); + ret = handshake(xhci, &xhci->op_regs->command, + CMD_RESET, 0, 250 * 1000); + if (ret) + return ret; + + xhci_dbg(xhci, "Wait for controller to be ready for doorbell rings\n"); + /* + * xHCI cannot write to any doorbells or operational registers other + * than status until the "Controller Not Ready" flag is cleared. + */ + return handshake(xhci, &xhci->op_regs->status, STS_CNR, 0, 250 * 1000); } /* ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 104/149] USB: ftdi_sio: fix DTR/RTS line modes 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (102 preceding siblings ...) 2010-07-01 17:32 ` [patch 103/149] USB: xhci: Wait for controller to be ready after reset Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 105/149] USB: cdc-acm: fix resource reclaim in error path of acm_probe Greg KH ` (44 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel Mack, Johan Hovold, Alan Cox 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Daniel Mack <daniel@caiaq.de> commit 6a1a82df91fa0eb1cc76069a9efe5714d087eccd upstream. Call set_mctrl() and clear_mctrl() according to the flow control mode selected. This makes serial communication for FT232 connected devices work when CRTSCTS is not set. This fixes a regression introduced by 4175f3e31 ("tty_port: If we are opened non blocking we still need to raise the carrier"). This patch calls the low-level driver's dtr_rts() function which consequently sets TIOCM_DTR | TIOCM_RTS. A later call to set_termios() without CRTSCTS in cflags, however, does not reset these bits, and so data is not actually sent out on the serial wire. Signed-off-by: Daniel Mack <daniel@caiaq.de> Cc: Johan Hovold <jhovold@gmail.com> Cc: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/ftdi_sio.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/usb/serial/ftdi_sio.c +++ b/drivers/usb/serial/ftdi_sio.c @@ -2306,6 +2306,8 @@ static void ftdi_set_termios(struct tty_ "urb failed to set to rts/cts flow control\n"); } + /* raise DTR/RTS */ + set_mctrl(port, TIOCM_DTR | TIOCM_RTS); } else { /* * Xon/Xoff code @@ -2353,6 +2355,8 @@ static void ftdi_set_termios(struct tty_ } } + /* lower DTR/RTS */ + clear_mctrl(port, TIOCM_DTR | TIOCM_RTS); } return; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 105/149] USB: cdc-acm: fix resource reclaim in error path of acm_probe 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (103 preceding siblings ...) 2010-07-01 17:32 ` [patch 104/149] USB: ftdi_sio: fix DTR/RTS line modes Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 106/149] p54usb: Add device ID for Dell WLA3310 USB Greg KH ` (43 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Axel Lin, Oliver Neukum 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Axel Lin <axel.lin@gmail.com> commit c2572b78aa0447244a38e555ebb1b3b48a0088a5 upstream. This patch fixes resource reclaim in error path of acm_probe: 1. In the case of "out of memory (read urbs usb_alloc_urb)\n")", there is no need to call acm_read_buffers_free(acm) here. Fix it by goto alloc_fail6 instead of alloc_fail7. 2. In the case of "out of memory (write urbs usb_alloc_urb)", usb_alloc_urb may fail in any iteration of the for loop. Current implementation does not properly free allocated snd->urb. Fix it by goto alloc_fail8 instead of alloc_fail7. 3. In the case of device_create_file(&intf->dev,&dev_attr_iCountryCodeRelDate) fail, acm->country_codes is kfreed. As a result, device_remove_file for dev_attr_wCountryCodes will not be executed in acm_disconnect. Fix it by calling device_remove_file for dev_attr_wCountryCodes before goto skip_countries. Signed-off-by: Axel Lin <axel.lin@gmail.com> Acked-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/class/cdc-acm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -1201,7 +1201,7 @@ made_compressed_probe: if (rcv->urb == NULL) { dev_dbg(&intf->dev, "out of memory (read urbs usb_alloc_urb)\n"); - goto alloc_fail7; + goto alloc_fail6; } rcv->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; @@ -1225,7 +1225,7 @@ made_compressed_probe: if (snd->urb == NULL) { dev_dbg(&intf->dev, "out of memory (write urbs usb_alloc_urb)"); - goto alloc_fail7; + goto alloc_fail8; } if (usb_endpoint_xfer_int(epwrite)) @@ -1264,6 +1264,7 @@ made_compressed_probe: i = device_create_file(&intf->dev, &dev_attr_iCountryCodeRelDate); if (i < 0) { + device_remove_file(&intf->dev, &dev_attr_wCountryCodes); kfree(acm->country_codes); goto skip_countries; } @@ -1300,6 +1301,7 @@ alloc_fail8: usb_free_urb(acm->wb[i].urb); alloc_fail7: acm_read_buffers_free(acm); +alloc_fail6: for (i = 0; i < num_rx_buf; i++) usb_free_urb(acm->ru[i].urb); usb_free_urb(acm->ctrlurb); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 106/149] p54usb: Add device ID for Dell WLA3310 USB 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (104 preceding siblings ...) 2010-07-01 17:32 ` [patch 105/149] USB: cdc-acm: fix resource reclaim in error path of acm_probe Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 107/149] atl1e: Allow TX checksum offload and TSO to be disabled and reenabled Greg KH ` (42 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jason Dravet, Larry Finger, Christian Lamparter, John W. Linville 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Jason Dravet <dravet@hotmail.com> commit 0f666a08901f8b01f294ca0ad751019375240ae3 upstream. Add Dell WLA3310 USB wireless card, which has a Z-Com XG-705A chipset, to the USB Ids in p54usb. Signed-off-by: Jason Dravet <dravet@hotmail.com> Tested-by: Richard Gregory Tillmore <rtillmore@gmail.com> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Acked-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/p54/p54usb.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/wireless/p54/p54usb.c +++ b/drivers/net/wireless/p54/p54usb.c @@ -78,6 +78,7 @@ static struct usb_device_id p54u_table[] {USB_DEVICE(0x1413, 0x5400)}, /* Telsey 802.11g USB2.0 Adapter */ {USB_DEVICE(0x1435, 0x0427)}, /* Inventel UR054G */ {USB_DEVICE(0x2001, 0x3704)}, /* DLink DWL-G122 rev A2 */ + {USB_DEVICE(0x413c, 0x5513)}, /* Dell WLA3310 USB Wireless Adapter */ {USB_DEVICE(0x413c, 0x8102)}, /* Spinnaker DUT */ {USB_DEVICE(0x413c, 0x8104)}, /* Cohiba Proto board */ {} ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 107/149] atl1e: Allow TX checksum offload and TSO to be disabled and reenabled 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (105 preceding siblings ...) 2010-07-01 17:32 ` [patch 106/149] p54usb: Add device ID for Dell WLA3310 USB Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 108/149] via-velocity: Give RX descriptors to the NIC later on open or MTU change Greg KH ` (41 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ben Hutchings, David S. Miller 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Ben Hutchings <ben@decadent.org.uk> commit ac936929092dc6a5409b627c4c67305ab9b626b3 upstream. Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/atl1e/atl1e_ethtool.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/atl1e/atl1e_ethtool.c +++ b/drivers/net/atl1e/atl1e_ethtool.c @@ -394,11 +394,13 @@ static const struct ethtool_ops atl1e_et .get_eeprom = atl1e_get_eeprom, .set_eeprom = atl1e_set_eeprom, .get_tx_csum = atl1e_get_tx_csum, + .set_tx_csum = ethtool_op_set_tx_hw_csum, .get_sg = ethtool_op_get_sg, .set_sg = ethtool_op_set_sg, #ifdef NETIF_F_TSO .get_tso = ethtool_op_get_tso, #endif + .set_tso = ethtool_op_set_tso, }; void atl1e_set_ethtool_ops(struct net_device *netdev) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 108/149] via-velocity: Give RX descriptors to the NIC later on open or MTU change 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (106 preceding siblings ...) 2010-07-01 17:32 ` [patch 107/149] atl1e: Allow TX checksum offload and TSO to be disabled and reenabled Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 109/149] dmfe/tulip: Let dmfe handle DM910x except for SPARC on-board chips Greg KH ` (40 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ben Hutchings, David S. Miller 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Ben Hutchings <ben@decadent.org.uk> commit 35bb5cadc8c7b1462df57e32e08d964f1be7a75c upstream. velocity_open() calls velocity_give_many_rx_descs(), which gives RX descriptors to the NIC, before installing an interrupt handler or calling velocity_init_registers(). I think this is very unsafe and it appears to explain the bug report <http://bugs.debian.org/508527>. On MTU change, velocity_give_many_rx_descs() is again called before velocity_init_registers(). I'm not sure whether this is unsafe but it does look wrong. Therefore, move the calls to velocity_give_many_rx_descs() after request_irq() and velocity_init_registers(). Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Tested-by: Jan Ceuleers <jan.ceuleers@computer.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/via-velocity.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/net/via-velocity.c +++ b/drivers/net/via-velocity.c @@ -2186,8 +2186,6 @@ static int velocity_open(struct net_devi /* Ensure chip is running */ pci_set_power_state(vptr->pdev, PCI_D0); - velocity_give_many_rx_descs(vptr); - velocity_init_registers(vptr, VELOCITY_INIT_COLD); ret = request_irq(vptr->pdev->irq, &velocity_intr, IRQF_SHARED, @@ -2199,6 +2197,8 @@ static int velocity_open(struct net_devi goto out; } + velocity_give_many_rx_descs(vptr); + mac_enable_int(vptr->mac_regs); netif_start_queue(dev); vptr->flags |= VELOCITY_FLAGS_OPENED; @@ -2287,10 +2287,10 @@ static int velocity_change_mtu(struct ne dev->mtu = new_mtu; - velocity_give_many_rx_descs(vptr); - velocity_init_registers(vptr, VELOCITY_INIT_COLD); + velocity_give_many_rx_descs(vptr); + mac_enable_int(vptr->mac_regs); netif_start_queue(dev); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 109/149] dmfe/tulip: Let dmfe handle DM910x except for SPARC on-board chips 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (107 preceding siblings ...) 2010-07-01 17:32 ` [patch 108/149] via-velocity: Give RX descriptors to the NIC later on open or MTU change Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 110/149] Documentation/3c509: document ethtool support Greg KH ` (39 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ben Hutchings, Grant Grundler, David S. Miller 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Ben Hutchings <ben@decadent.org.uk> commit 4d907069bc1b745f4abd4745c332d33098e733b8 upstream. The Davicom DM9100 and DM9102 chips are used on the motherboards of some SPARC systems (supported by the tulip driver) and also in PCI expansion cards (supported by the dmfe driver). There is no difference in the PCI device ids for the two different configurations, so these drivers both claim the device ids. However, it is possible to distinguish the two configurations by the presence of Open Firmware properties for them, so we do that. Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Grant Grundler <grundler@parisc-linux.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/tulip/Kconfig | 4 ++++ drivers/net/tulip/dmfe.c | 21 +++++++++++++++++++++ drivers/net/tulip/tulip_core.c | 32 +++++++++++++++++++++++++------- 3 files changed, 50 insertions(+), 7 deletions(-) --- a/drivers/net/tulip/Kconfig +++ b/drivers/net/tulip/Kconfig @@ -101,6 +101,10 @@ config TULIP_NAPI_HW_MITIGATION If in doubt, say Y. +config TULIP_DM910X + def_bool y + depends on TULIP && SPARC + config DE4X5 tristate "Generic DECchip & DIGITAL EtherWORKS PCI/EISA" depends on PCI || EISA --- a/drivers/net/tulip/dmfe.c +++ b/drivers/net/tulip/dmfe.c @@ -92,6 +92,10 @@ #include <asm/uaccess.h> #include <asm/irq.h> +#ifdef CONFIG_TULIP_DM910X +#include <linux/of.h> +#endif + /* Board/System/Debug information/definition ---------------- */ #define PCI_DM9132_ID 0x91321282 /* Davicom DM9132 ID */ @@ -377,6 +381,23 @@ static int __devinit dmfe_init_one (stru if (!printed_version++) printk(version); + /* + * SPARC on-board DM910x chips should be handled by the main + * tulip driver, except for early DM9100s. + */ +#ifdef CONFIG_TULIP_DM910X + if ((ent->driver_data == PCI_DM9100_ID && pdev->revision >= 0x30) || + ent->driver_data == PCI_DM9102_ID) { + struct device_node *dp = pci_device_to_OF_node(pdev); + + if (dp && of_get_property(dp, "local-mac-address", NULL)) { + printk(KERN_INFO DRV_NAME + ": skipping on-board DM910x (use tulip)\n"); + return -ENODEV; + } + } +#endif + /* Init network device */ dev = alloc_etherdev(sizeof(*db)); if (dev == NULL) --- a/drivers/net/tulip/tulip_core.c +++ b/drivers/net/tulip/tulip_core.c @@ -196,9 +196,13 @@ struct tulip_chip_table tulip_tbl[] = { | HAS_NWAY | HAS_PCI_MWI, tulip_timer, tulip_media_task }, /* DM910X */ +#ifdef CONFIG_TULIP_DM910X { "Davicom DM9102/DM9102A", 128, 0x0001ebef, HAS_MII | HAS_MEDIA_TABLE | CSR12_IN_SROM | HAS_ACPI, tulip_timer, tulip_media_task }, +#else + { NULL }, +#endif /* RS7112 */ { "Conexant LANfinity", 256, 0x0001ebef, @@ -228,8 +232,10 @@ static struct pci_device_id tulip_pci_tb { 0x1259, 0xa120, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, { 0x11F6, 0x9881, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMPEX9881 }, { 0x8086, 0x0039, PCI_ANY_ID, PCI_ANY_ID, 0, 0, I21145 }, +#ifdef CONFIG_TULIP_DM910X { 0x1282, 0x9100, PCI_ANY_ID, PCI_ANY_ID, 0, 0, DM910X }, { 0x1282, 0x9102, PCI_ANY_ID, PCI_ANY_ID, 0, 0, DM910X }, +#endif { 0x1113, 0x1216, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, { 0x1113, 0x1217, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MX98715 }, { 0x1113, 0x9511, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, @@ -1299,18 +1305,30 @@ static int __devinit tulip_init_one (str } /* - * Early DM9100's need software CRC and the DMFE driver + * DM910x chips should be handled by the dmfe driver, except + * on-board chips on SPARC systems. Also, early DM9100s need + * software CRC which only the dmfe driver supports. */ - if (pdev->vendor == 0x1282 && pdev->device == 0x9100) - { - /* Read Chip revision */ - if (pdev->revision < 0x30) - { - printk(KERN_ERR PFX "skipping early DM9100 with Crc bug (use dmfe)\n"); +#ifdef CONFIG_TULIP_DM910X + if (chip_idx == DM910X) { + struct device_node *dp; + + if (pdev->vendor == 0x1282 && pdev->device == 0x9100 && + pdev->revision < 0x30) { + printk(KERN_INFO PFX + "skipping early DM9100 with Crc bug (use dmfe)\n"); + return -ENODEV; + } + + dp = pci_device_to_OF_node(pdev); + if (!(dp && of_get_property(dp, "local-mac-address", NULL))) { + printk(KERN_INFO PFX + "skipping DM910x expansion card (use dmfe)\n"); return -ENODEV; } } +#endif /* * Looks for early PCI chipsets where people report hangs ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 110/149] Documentation/3c509: document ethtool support 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (108 preceding siblings ...) 2010-07-01 17:32 ` [patch 109/149] dmfe/tulip: Let dmfe handle DM910x except for SPARC on-board chips Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 111/149] wireless: report reasonable bitrate for MCS rates through wext Greg KH ` (38 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ben Hutchings, David S. Miller 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Ben Hutchings <ben@decadent.org.uk> commit aa4e2e171385bb77b4da8b760d26dea2aa291587 upstream. 3c509 was changed to support ethtool in 2002, making the 'xcvr' module parameter obsolete in most cases. More recently 3c509 was converted to the modern driver model and this parameter was removed. Fix the documentation to refer to ethtool rather than the module parameter. Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- Documentation/networking/3c509.txt | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) --- a/Documentation/networking/3c509.txt +++ b/Documentation/networking/3c509.txt @@ -48,11 +48,11 @@ for LILO parameters for doing this: This configures the first found 3c509 card for IRQ 10, base I/O 0x310, and transceiver type 3 (10base2). The flag "0x3c509" must be set to avoid conflicts with other card types when overriding the I/O address. When the driver is -loaded as a module, only the IRQ and transceiver setting may be overridden. -For example, setting two cards to 10base2/IRQ10 and AUI/IRQ11 is done by using -the xcvr and irq module options: +loaded as a module, only the IRQ may be overridden. For example, +setting two cards to IRQ10 and IRQ11 is done by using the irq module +option: - options 3c509 xcvr=3,1 irq=10,11 + options 3c509 irq=10,11 (2) Full-duplex mode @@ -77,6 +77,8 @@ operation. itself full-duplex capable. This is almost certainly one of two things: a full- duplex-capable Ethernet switch (*not* a hub), or a full-duplex-capable NIC on another system that's connected directly to the 3c509B via a crossover cable. + +Full-duplex mode can be enabled using 'ethtool'. /////Extremely important caution concerning full-duplex mode///// Understand that the 3c509B's hardware's full-duplex support is much more @@ -113,6 +115,8 @@ This insured that merely upgrading the d never automatically enable full-duplex mode in an existing installation; it must always be explicitly enabled via one of these code in order to be activated. + +The transceiver type can be changed using 'ethtool'. (4a) Interpretation of error messages and common problems ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 111/149] wireless: report reasonable bitrate for MCS rates through wext 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (109 preceding siblings ...) 2010-07-01 17:32 ` [patch 110/149] Documentation/3c509: document ethtool support Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 112/149] ath9k: add support for 802.11n bonded out AR2427 Greg KH ` (37 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, John W. Linville, Ben Hutchings 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: John W. Linville <linville@tuxdriver.com> commit 254416aae70ab2e6b57fd79782c8a67196234d02 upstream. Previously, cfg80211 had reported "0" for MCS (i.e. 802.11n) bitrates through the wireless extensions interface. However, nl80211 was converting MCS rates into a reasonable bitrate number. This patch moves the nl80211 code to cfg80211 where it is now shared between both the nl80211 interface and the wireless extensions interface. Signed-off-by: John W. Linville <linville@tuxdriver.com> Cc: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/wireless/core.h | 2 ++ net/wireless/nl80211.c | 37 ++----------------------------------- net/wireless/util.c | 33 +++++++++++++++++++++++++++++++++ net/wireless/wext-compat.c | 5 +---- 4 files changed, 38 insertions(+), 39 deletions(-) --- a/net/wireless/core.h +++ b/net/wireless/core.h @@ -385,6 +385,8 @@ int rdev_set_freq(struct cfg80211_regist struct wireless_dev *for_wdev, int freq, enum nl80211_channel_type channel_type); +u16 cfg80211_calculate_bitrate(struct rate_info *rate); + #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS #define CFG80211_DEV_WARN_ON(cond) WARN_ON(cond) #else --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -1562,39 +1562,6 @@ static int parse_station_flags(struct ge return 0; } -static u16 nl80211_calculate_bitrate(struct rate_info *rate) -{ - int modulation, streams, bitrate; - - if (!(rate->flags & RATE_INFO_FLAGS_MCS)) - return rate->legacy; - - /* the formula below does only work for MCS values smaller than 32 */ - if (rate->mcs >= 32) - return 0; - - modulation = rate->mcs & 7; - streams = (rate->mcs >> 3) + 1; - - bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ? - 13500000 : 6500000; - - if (modulation < 4) - bitrate *= (modulation + 1); - else if (modulation == 4) - bitrate *= (modulation + 2); - else - bitrate *= (modulation + 3); - - bitrate *= streams; - - if (rate->flags & RATE_INFO_FLAGS_SHORT_GI) - bitrate = (bitrate / 9) * 10; - - /* do NOT round down here */ - return (bitrate + 50000) / 100000; -} - static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq, int flags, struct net_device *dev, u8 *mac_addr, struct station_info *sinfo) @@ -1641,8 +1608,8 @@ static int nl80211_send_station(struct s if (!txrate) goto nla_put_failure; - /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */ - bitrate = nl80211_calculate_bitrate(&sinfo->txrate); + /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */ + bitrate = cfg80211_calculate_bitrate(&sinfo->txrate); if (bitrate > 0) NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate); --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -682,3 +682,36 @@ int cfg80211_change_iface(struct cfg8021 return err; } + +u16 cfg80211_calculate_bitrate(struct rate_info *rate) +{ + int modulation, streams, bitrate; + + if (!(rate->flags & RATE_INFO_FLAGS_MCS)) + return rate->legacy; + + /* the formula below does only work for MCS values smaller than 32 */ + if (rate->mcs >= 32) + return 0; + + modulation = rate->mcs & 7; + streams = (rate->mcs >> 3) + 1; + + bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ? + 13500000 : 6500000; + + if (modulation < 4) + bitrate *= (modulation + 1); + else if (modulation == 4) + bitrate *= (modulation + 2); + else + bitrate *= (modulation + 3); + + bitrate *= streams; + + if (rate->flags & RATE_INFO_FLAGS_SHORT_GI) + bitrate = (bitrate / 9) * 10; + + /* do NOT round down here */ + return (bitrate + 50000) / 100000; +} --- a/net/wireless/wext-compat.c +++ b/net/wireless/wext-compat.c @@ -1227,10 +1227,7 @@ int cfg80211_wext_giwrate(struct net_dev if (!(sinfo.filled & STATION_INFO_TX_BITRATE)) return -EOPNOTSUPP; - rate->value = 0; - - if (!(sinfo.txrate.flags & RATE_INFO_FLAGS_MCS)) - rate->value = 100000 * sinfo.txrate.legacy; + rate->value = 100000 * cfg80211_calculate_bitrate(&sinfo.txrate); return 0; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 112/149] ath9k: add support for 802.11n bonded out AR2427 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (110 preceding siblings ...) 2010-07-01 17:32 ` [patch 111/149] wireless: report reasonable bitrate for MCS rates through wext Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 113/149] drm/i915: give up on 8xx lid status Greg KH ` (36 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Luis R. Rodriguez, John W. Linville, Ben Hutchings 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Luis R. Rodriguez <lrodriguez@atheros.com> commit 5ffaf8a361b4c9025963959a744f21d8173c7669 upstream. Some single chip family devices are sold in the market with 802.11n bonded out, these have no hardware capability for 802.11n but ath9k can still support them. These are called AR2427. [bwh: backported to 2.6.32] Reported-by: Rolf Leggewie <bugzilla.kernel.org@rolf.leggewie.biz> Tested-by: Bernhard Reiter <ockham@raz.or.at> Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Cc: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/ath/ath9k/hw.c | 7 ++++++- drivers/net/wireless/ath/ath9k/hw.h | 1 + drivers/net/wireless/ath/ath9k/main.c | 4 +++- drivers/net/wireless/ath/ath9k/pci.c | 1 + 4 files changed, 11 insertions(+), 2 deletions(-) --- a/drivers/net/wireless/ath/ath9k/hw.c +++ b/drivers/net/wireless/ath/ath9k/hw.c @@ -398,7 +398,6 @@ static void ath9k_hw_init_config(struct ah->config.pcie_clock_req = 0; ah->config.pcie_waen = 0; ah->config.analog_shiftreg = 1; - ah->config.ht_enable = 1; ah->config.ofdm_trig_low = 200; ah->config.ofdm_trig_high = 500; ah->config.cck_trig_high = 200; @@ -412,6 +411,11 @@ static void ath9k_hw_init_config(struct ah->config.spurchans[i][1] = AR_NO_SPUR; } + if (ah->hw_version.devid != AR2427_DEVID_PCIE) + ah->config.ht_enable = 1; + else + ah->config.ht_enable = 0; + ah->config.intr_mitigation = true; /* @@ -617,6 +621,7 @@ static bool ath9k_hw_devid_supported(u16 case AR9285_DEVID_PCIE: case AR5416_DEVID_AR9287_PCI: case AR5416_DEVID_AR9287_PCIE: + case AR2427_DEVID_PCIE: return true; default: break; --- a/drivers/net/wireless/ath/ath9k/hw.h +++ b/drivers/net/wireless/ath/ath9k/hw.h @@ -37,6 +37,7 @@ #define AR9280_DEVID_PCI 0x0029 #define AR9280_DEVID_PCIE 0x002a #define AR9285_DEVID_PCIE 0x002b +#define AR2427_DEVID_PCIE 0x002c #define AR5416_AR9100_DEVID 0x000b #define AR_SUBVENDOR_ID_NOG 0x0e11 #define AR_SUBVENDOR_ID_NEW_A 0x7065 --- a/drivers/net/wireless/ath/ath9k/main.c +++ b/drivers/net/wireless/ath/ath9k/main.c @@ -1541,12 +1541,14 @@ void ath_set_hw_capab(struct ath_softc * hw->flags = IEEE80211_HW_RX_INCLUDES_FCS | IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING | IEEE80211_HW_SIGNAL_DBM | - IEEE80211_HW_AMPDU_AGGREGATION | IEEE80211_HW_SUPPORTS_PS | IEEE80211_HW_PS_NULLFUNC_STACK | IEEE80211_HW_REPORTS_TX_ACK_STATUS | IEEE80211_HW_SPECTRUM_MGMT; + if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) + hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION; + if (AR_SREV_9160_10_OR_LATER(sc->sc_ah) || modparam_nohwcrypt) hw->flags |= IEEE80211_HW_MFP_CAPABLE; --- a/drivers/net/wireless/ath/ath9k/pci.c +++ b/drivers/net/wireless/ath/ath9k/pci.c @@ -25,6 +25,7 @@ static struct pci_device_id ath_pci_id_t { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */ { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */ { PCI_VDEVICE(ATHEROS, 0x002B) }, /* PCI-E */ + { PCI_VDEVICE(ATHEROS, 0x002C) }, /* PCI-E 802.11n bonded out */ { PCI_VDEVICE(ATHEROS, 0x002D) }, /* PCI */ { PCI_VDEVICE(ATHEROS, 0x002E) }, /* PCI-E */ { 0 } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 113/149] drm/i915: give up on 8xx lid status 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (111 preceding siblings ...) 2010-07-01 17:32 ` [patch 112/149] ath9k: add support for 802.11n bonded out AR2427 Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 114/149] wrong type for magic argument in simple_fill_super() Greg KH ` (35 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jesse Barnes, Eric Anholt, Ben Hutchings 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Jesse Barnes <jbarnes@virtuousgeek.org> commit 7b9c5abee98c54f85bcc04bd4d7ec8d5094c73f4 upstream. These old machines more often than not lie about their lid state. So don't use it to detect LVDS presence, but leave the event handler to deal with lid open/close, when we might need to reset the mode. Fixes kernel bug #15248 Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Eric Anholt <eric@anholt.net> Cc: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/i915/intel_lvds.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/gpu/drm/i915/intel_lvds.c +++ b/drivers/gpu/drm/i915/intel_lvds.c @@ -648,8 +648,12 @@ static const struct dmi_system_id bad_li */ static enum drm_connector_status intel_lvds_detect(struct drm_connector *connector) { + struct drm_device *dev = connector->dev; enum drm_connector_status status = connector_status_connected; + if (IS_I8XX(dev)) + return connector_status_connected; + if (!acpi_lid_open() && !dmi_check_system(bad_lid_status)) status = connector_status_disconnected; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 114/149] wrong type for magic argument in simple_fill_super() 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (112 preceding siblings ...) 2010-07-01 17:32 ` [patch 113/149] drm/i915: give up on 8xx lid status Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 115/149] iwlwifi: check for aggregation frame and queue Greg KH ` (34 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Roberto Sassu, Eric Paris, Al Viro 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Roberto Sassu <roberto.sassu@polito.it> commit 7d683a09990ff095a91b6e724ecee0ff8733274a upstream. It's used to superblock ->s_magic, which is unsigned long. Signed-off-by: Roberto Sassu <roberto.sassu@polito.it> Reviewed-by: Mimi Zohar <zohar@us.ibm.com> Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/libfs.c | 3 ++- include/linux/fs.h | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) --- a/fs/libfs.c +++ b/fs/libfs.c @@ -415,7 +415,8 @@ int simple_write_end(struct file *file, * unique inode values later for this filesystem, then you must take care * to pass it an appropriate max_reserved value to avoid collisions. */ -int simple_fill_super(struct super_block *s, int magic, struct tree_descr *files) +int simple_fill_super(struct super_block *s, unsigned long magic, + struct tree_descr *files) { struct inode *inode; struct dentry *root; --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2376,7 +2376,7 @@ extern const struct file_operations simp extern const struct inode_operations simple_dir_inode_operations; struct tree_descr { char *name; const struct file_operations *ops; int mode; }; struct dentry *d_alloc_name(struct dentry *, const char *); -extern int simple_fill_super(struct super_block *, int, struct tree_descr *); +extern int simple_fill_super(struct super_block *, unsigned long, struct tree_descr *); extern int simple_pin_fs(struct file_system_type *, struct vfsmount **mount, int *count); extern void simple_release_fs(struct vfsmount **mount, int *count); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 115/149] iwlwifi: check for aggregation frame and queue 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (113 preceding siblings ...) 2010-07-01 17:32 ` [patch 114/149] wrong type for magic argument in simple_fill_super() Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 116/149] iwlwifi: recalculate average tpt if not current Greg KH ` (33 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Wey-Yi Guy, Reinette Chatre 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Wey-Yi Guy <wey-yi.w.guy@intel.com> commit 45d427001b5eec03cecaacddb53c73af46bb263e upstream. Error checking for aggregation frames should go into aggregation queue, if aggregation queue not available, use legacy queue instead. Also make sure the aggregation queue is available to activate, if driver and mac80211 is out-of-sync, try to disable the queue and sync-up with mac80211. Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 15 ++++++++++++++- drivers/net/wireless/iwlwifi/iwl-tx.c | 18 ++++++++++++------ 2 files changed, 26 insertions(+), 7 deletions(-) --- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c +++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c @@ -402,10 +402,23 @@ static void rs_tl_turn_on_agg_for_tid(st struct iwl_lq_sta *lq_data, u8 tid, struct ieee80211_sta *sta) { + int ret; + if (rs_tl_get_load(lq_data, tid) > IWL_AGG_LOAD_THRESHOLD) { IWL_DEBUG_HT(priv, "Starting Tx agg: STA: %pM tid: %d\n", sta->addr, tid); - ieee80211_start_tx_ba_session(priv->hw, sta->addr, tid); + ret = ieee80211_start_tx_ba_session(priv->hw, sta->addr, tid); + if (ret == -EAGAIN) { + /* + * driver and mac80211 is out of sync + * this might be cause by reloading firmware + * stop the tx ba session here + */ + IWL_DEBUG_HT(priv, "Fail start Tx agg on tid: %d\n", + tid); + ret = ieee80211_stop_tx_ba_session(priv->hw, sta->addr, tid, + WLAN_BACK_INITIATOR); + } } } --- a/drivers/net/wireless/iwlwifi/iwl-tx.c +++ b/drivers/net/wireless/iwlwifi/iwl-tx.c @@ -791,8 +791,10 @@ int iwl_tx_skb(struct iwl_priv *priv, st hdr->seq_ctrl |= cpu_to_le16(seq_number); seq_number += 0x10; /* aggregation is on for this <sta,tid> */ - if (info->flags & IEEE80211_TX_CTL_AMPDU) + if (info->flags & IEEE80211_TX_CTL_AMPDU && + priv->stations[sta_id].tid[tid].agg.state == IWL_AGG_ON) { txq_id = priv->stations[sta_id].tid[tid].agg.txq_id; + } } txq = &priv->txq[txq_id]; @@ -1273,7 +1275,7 @@ int iwl_tx_agg_stop(struct iwl_priv *pri { int tx_fifo_id, txq_id, sta_id, ssn = -1; struct iwl_tid_data *tid_data; - int ret, write_ptr, read_ptr; + int write_ptr, read_ptr; unsigned long flags; if (!ra) { @@ -1325,13 +1327,17 @@ int iwl_tx_agg_stop(struct iwl_priv *pri priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF; spin_lock_irqsave(&priv->lock, flags); - ret = priv->cfg->ops->lib->txq_agg_disable(priv, txq_id, ssn, + /* + * the only reason this call can fail is queue number out of range, + * which can happen if uCode is reloaded and all the station + * information are lost. if it is outside the range, there is no need + * to deactivate the uCode queue, just return "success" to allow + * mac80211 to clean up it own data. + */ + priv->cfg->ops->lib->txq_agg_disable(priv, txq_id, ssn, tx_fifo_id); spin_unlock_irqrestore(&priv->lock, flags); - if (ret) - return ret; - ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, ra, tid); return 0; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 116/149] iwlwifi: recalculate average tpt if not current 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (114 preceding siblings ...) 2010-07-01 17:32 ` [patch 115/149] iwlwifi: check for aggregation frame and queue Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 117/149] iwlwifi: update supported PCI_ID list for 5xx0 series Greg KH ` (32 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Reinette Chatre, John W. Linville 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Reinette Chatre <reinette.chatre@intel.com> commit 3d79b2a9eeaa066b35c49fbb17e3156a3c482c3e upstream. We currently have this check as a BUG_ON, which is being hit by people. Previously it was an error with a recalculation if not current, return that code. The BUG_ON was introduced by: commit 3110bef78cb4282c58245bc8fd6d95d9ccb19749 Author: Guy Cohen <guy.cohen@intel.com> Date: Tue Sep 9 10:54:54 2008 +0800 iwlwifi: Added support for 3 antennas ... the portion adding the BUG_ON is reverted since we are encountering the error and BUG_ON was created with assumption that error is not encountered. Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c +++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c @@ -2193,9 +2193,12 @@ static void rs_rate_scale_perform(struct /* Else we have enough samples; calculate estimate of * actual average throughput */ - - BUG_ON(window->average_tpt != ((window->success_ratio * - tbl->expected_tpt[index] + 64) / 128)); + if (window->average_tpt != ((window->success_ratio * + tbl->expected_tpt[index] + 64) / 128)) { + IWL_ERR(priv, "expected_tpt should have been calculated by now\n"); + window->average_tpt = ((window->success_ratio * + tbl->expected_tpt[index] + 64) / 128); + } /* If we are searching for better modulation mode, check success. */ if (lq_sta->search_better_tbl && ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 117/149] iwlwifi: update supported PCI_ID list for 5xx0 series 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (115 preceding siblings ...) 2010-07-01 17:32 ` [patch 116/149] iwlwifi: recalculate average tpt if not current Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 118/149] wl1251: fix a memory leak in probe Greg KH ` (31 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Wey-Yi Guy, Reinette Chatre, John W. Linville 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Wey-Yi Guy <wey-yi.w.guy@intel.com> commit ac592574a577162183b5c1dd040a188caa068a29 upstream. Update the PCI_ID list for 5xx0 series. Remove all the PCI_IDs which never made into production or not longer in production. Also make sure the supported bands(a/b/g/n) match specified PCI_IDs Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/iwlwifi/iwl-5000.c | 23 ++++++++- drivers/net/wireless/iwlwifi/iwl-agn.c | 74 ++++++++++++++++++++++++-------- drivers/net/wireless/iwlwifi/iwl-dev.h | 3 - 3 files changed, 78 insertions(+), 22 deletions(-) --- a/drivers/net/wireless/iwlwifi/iwl-5000.c +++ b/drivers/net/wireless/iwlwifi/iwl-5000.c @@ -1674,12 +1674,12 @@ struct iwl_cfg iwl5300_agn_cfg = { .use_rts_for_ht = true, /* use rts/cts protection */ }; -struct iwl_cfg iwl5100_bg_cfg = { - .name = "5100BG", +struct iwl_cfg iwl5100_bgn_cfg = { + .name = "5100BGN", .fw_name_pre = IWL5000_FW_PRE, .ucode_api_max = IWL5000_UCODE_API_MAX, .ucode_api_min = IWL5000_UCODE_API_MIN, - .sku = IWL_SKU_G, + .sku = IWL_SKU_G|IWL_SKU_N, .ops = &iwl5000_ops, .eeprom_size = IWL_5000_EEPROM_IMG_SIZE, .eeprom_ver = EEPROM_5000_EEPROM_VERSION, @@ -1705,7 +1705,6 @@ struct iwl_cfg iwl5100_abg_cfg = { .valid_tx_ant = ANT_B, .valid_rx_ant = ANT_AB, .need_pll_cfg = true, - .ht_greenfield_support = true, }; struct iwl_cfg iwl5100_agn_cfg = { @@ -1762,6 +1761,22 @@ struct iwl_cfg iwl5150_agn_cfg = { .use_rts_for_ht = true, /* use rts/cts protection */ }; +struct iwl_cfg iwl5150_abg_cfg = { + .name = "5150ABG", + .fw_name_pre = IWL5150_FW_PRE, + .ucode_api_max = IWL5150_UCODE_API_MAX, + .ucode_api_min = IWL5150_UCODE_API_MIN, + .sku = IWL_SKU_A|IWL_SKU_G, + .ops = &iwl5150_ops, + .eeprom_size = IWL_5000_EEPROM_IMG_SIZE, + .eeprom_ver = EEPROM_5050_EEPROM_VERSION, + .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION, + .mod_params = &iwl50_mod_params, + .valid_tx_ant = ANT_A, + .valid_rx_ant = ANT_AB, + .need_pll_cfg = true, +}; + MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX)); MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_MAX)); --- a/drivers/net/wireless/iwlwifi/iwl-agn.c +++ b/drivers/net/wireless/iwlwifi/iwl-agn.c @@ -3203,23 +3203,63 @@ static struct pci_device_id iwl_hw_card_ {IWL_PCI_DEVICE(0x4230, PCI_ANY_ID, iwl4965_agn_cfg)}, #endif /* CONFIG_IWL4965 */ #ifdef CONFIG_IWL5000 - {IWL_PCI_DEVICE(0x4232, 0x1205, iwl5100_bg_cfg)}, - {IWL_PCI_DEVICE(0x4232, 0x1305, iwl5100_bg_cfg)}, - {IWL_PCI_DEVICE(0x4232, 0x1206, iwl5100_abg_cfg)}, - {IWL_PCI_DEVICE(0x4232, 0x1306, iwl5100_abg_cfg)}, - {IWL_PCI_DEVICE(0x4232, 0x1326, iwl5100_abg_cfg)}, - {IWL_PCI_DEVICE(0x4237, 0x1216, iwl5100_abg_cfg)}, - {IWL_PCI_DEVICE(0x4232, PCI_ANY_ID, iwl5100_agn_cfg)}, - {IWL_PCI_DEVICE(0x4235, PCI_ANY_ID, iwl5300_agn_cfg)}, - {IWL_PCI_DEVICE(0x4236, PCI_ANY_ID, iwl5300_agn_cfg)}, - {IWL_PCI_DEVICE(0x4237, PCI_ANY_ID, iwl5100_agn_cfg)}, -/* 5350 WiFi/WiMax */ - {IWL_PCI_DEVICE(0x423A, 0x1001, iwl5350_agn_cfg)}, - {IWL_PCI_DEVICE(0x423A, 0x1021, iwl5350_agn_cfg)}, - {IWL_PCI_DEVICE(0x423B, 0x1011, iwl5350_agn_cfg)}, -/* 5150 Wifi/WiMax */ - {IWL_PCI_DEVICE(0x423C, PCI_ANY_ID, iwl5150_agn_cfg)}, - {IWL_PCI_DEVICE(0x423D, PCI_ANY_ID, iwl5150_agn_cfg)}, +/* 5100 Series WiFi */ + {IWL_PCI_DEVICE(0x4232, 0x1201, iwl5100_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1301, iwl5100_agn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1204, iwl5100_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1304, iwl5100_agn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1205, iwl5100_bgn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1305, iwl5100_bgn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1206, iwl5100_abg_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1306, iwl5100_abg_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1221, iwl5100_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1321, iwl5100_agn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1224, iwl5100_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1324, iwl5100_agn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1225, iwl5100_bgn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1325, iwl5100_bgn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1226, iwl5100_abg_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4232, 0x1326, iwl5100_abg_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4237, 0x1211, iwl5100_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4237, 0x1311, iwl5100_agn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4237, 0x1214, iwl5100_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4237, 0x1314, iwl5100_agn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4237, 0x1215, iwl5100_bgn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4237, 0x1315, iwl5100_bgn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4237, 0x1216, iwl5100_abg_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4237, 0x1316, iwl5100_abg_cfg)}, /* Half Mini Card */ + +/* 5300 Series WiFi */ + {IWL_PCI_DEVICE(0x4235, 0x1021, iwl5300_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4235, 0x1121, iwl5300_agn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4235, 0x1024, iwl5300_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4235, 0x1124, iwl5300_agn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4235, 0x1001, iwl5300_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4235, 0x1101, iwl5300_agn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4235, 0x1004, iwl5300_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4235, 0x1104, iwl5300_agn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4236, 0x1011, iwl5300_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4236, 0x1111, iwl5300_agn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x4236, 0x1014, iwl5300_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x4236, 0x1114, iwl5300_agn_cfg)}, /* Half Mini Card */ + +/* 5350 Series WiFi/WiMax */ + {IWL_PCI_DEVICE(0x423A, 0x1001, iwl5350_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x423A, 0x1021, iwl5350_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x423B, 0x1011, iwl5350_agn_cfg)}, /* Mini Card */ + +/* 5150 Series Wifi/WiMax */ + {IWL_PCI_DEVICE(0x423C, 0x1201, iwl5150_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x423C, 0x1301, iwl5150_agn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x423C, 0x1206, iwl5150_abg_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x423C, 0x1306, iwl5150_abg_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x423C, 0x1221, iwl5150_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x423C, 0x1321, iwl5150_agn_cfg)}, /* Half Mini Card */ + + {IWL_PCI_DEVICE(0x423D, 0x1211, iwl5150_agn_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x423D, 0x1311, iwl5150_agn_cfg)}, /* Half Mini Card */ + {IWL_PCI_DEVICE(0x423D, 0x1216, iwl5150_abg_cfg)}, /* Mini Card */ + {IWL_PCI_DEVICE(0x423D, 0x1316, iwl5150_abg_cfg)}, /* Half Mini Card */ /* 6000/6050 Series */ {IWL_PCI_DEVICE(0x008D, PCI_ANY_ID, iwl6000h_2agn_cfg)}, {IWL_PCI_DEVICE(0x008E, PCI_ANY_ID, iwl6000h_2agn_cfg)}, --- a/drivers/net/wireless/iwlwifi/iwl-dev.h +++ b/drivers/net/wireless/iwlwifi/iwl-dev.h @@ -53,9 +53,10 @@ extern struct iwl_cfg iwl4965_agn_cfg; extern struct iwl_cfg iwl5300_agn_cfg; extern struct iwl_cfg iwl5100_agn_cfg; extern struct iwl_cfg iwl5350_agn_cfg; -extern struct iwl_cfg iwl5100_bg_cfg; +extern struct iwl_cfg iwl5100_bgn_cfg; extern struct iwl_cfg iwl5100_abg_cfg; extern struct iwl_cfg iwl5150_agn_cfg; +extern struct iwl_cfg iwl5150_abg_cfg; extern struct iwl_cfg iwl6000h_2agn_cfg; extern struct iwl_cfg iwl6000i_2agn_cfg; extern struct iwl_cfg iwl6000_3agn_cfg; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 118/149] wl1251: fix a memory leak in probe 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (116 preceding siblings ...) 2010-07-01 17:32 ` [patch 117/149] iwlwifi: update supported PCI_ID list for 5xx0 series Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 119/149] ext4: check s_log_groups_per_flex in online resize code Greg KH ` (30 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Grazvydas Ignotas, Kalle Valo, John W. Linville 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Grazvydas Ignotas <notasas@gmail.com> commit aa679c36756003f1fabdb9fc6f00eb159559f7c3 upstream. wl1251_sdio_probe() error path is missing wl1251_free_hw, add it. Signed-off-by: Grazvydas Ignotas <notasas@gmail.com> Acked-by: Kalle Valo <kvalo@adurom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/wl12xx/wl1251_sdio.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/wireless/wl12xx/wl1251_sdio.c +++ b/drivers/net/wireless/wl12xx/wl1251_sdio.c @@ -160,6 +160,7 @@ disable: sdio_disable_func(func); release: sdio_release_host(func); + wl1251_free_hw(wl); return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 119/149] ext4: check s_log_groups_per_flex in online resize code 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (117 preceding siblings ...) 2010-07-01 17:32 ` [patch 118/149] wl1251: fix a memory leak in probe Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-02 4:11 ` tytso 2010-07-01 17:32 ` [patch 120/149] ext4: Make sure the MOVE_EXT ioctl cant overwrite append-only files Greg KH ` (29 subsequent siblings) 148 siblings, 1 reply; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Eric Sandeen, Theodore Tso 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Eric Sandeen <sandeen@redhat.com> commit 42007efd569f1cf3bfb9a61da60ef6c2179508ca upstream. If groups_per_flex < 2, sbi->s_flex_groups[] doesn't get filled out, and every other access to this first tests s_log_groups_per_flex; same thing needs to happen in resize or we'll wander off into a null pointer when doing an online resize of the file system. Thanks to Christoph Biedl, who came up with the trivial testcase: # truncate --size 128M fsfile # mkfs.ext3 -F fsfile # tune2fs -O extents,uninit_bg,dir_index,flex_bg,huge_file,dir_nlink,extra_isize fsfile # e2fsck -yDf -C0 fsfile # truncate --size 132M fsfile # losetup /dev/loop0 fsfile # mount /dev/loop0 mnt # resize2fs -p /dev/loop0 https://bugzilla.kernel.org/show_bug.cgi?id=13549 Reported-by: Alessandro Polverini <alex@nibbles.it> Test-case-by: Christoph Biedl <bugzilla.kernel.bpeb@manchmal.in-ulm.de> Signed-off-by: Eric Sandeen <sandeen@redhat.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -930,7 +930,8 @@ int ext4_group_add(struct super_block *s percpu_counter_add(&sbi->s_freeinodes_counter, EXT4_INODES_PER_GROUP(sb)); - if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG)) { + if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG) && + sbi->s_log_groups_per_flex) { ext4_group_t flex_group; flex_group = ext4_flex_group(sbi, input->group); atomic_add(input->free_blocks_count, ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 119/149] ext4: check s_log_groups_per_flex in online resize code 2010-07-01 17:32 ` [patch 119/149] ext4: check s_log_groups_per_flex in online resize code Greg KH @ 2010-07-02 4:11 ` tytso 2010-07-03 1:55 ` Greg KH 0 siblings, 1 reply; 666+ messages in thread From: tytso @ 2010-07-02 4:11 UTC (permalink / raw) To: Greg KH Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Eric Sandeen On Thu, Jul 01, 2010 at 10:32:25AM -0700, Greg KH wrote: > 2.6.32-stable review patch. If anyone has any objections, please let us know. My only objection to these patches is that I don't know if they are going to cause patch conflicts with the 50 or so patches which I sent you for 2.6.32, which include both this patch and the next one. When I backported the patches I did have to adjust some of them to make sure they would apply cleanly to the latest 2.6.32.X release. By cherry picking them, it could be that dropping those patches from could cause no problems at all; or it could be a bit of a headache. So it might be easier to drop these two and then wait for the next 2.6.32 stable release (which will hopefully be coming soon!) and just take my whole set of patches.... - Ted ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 119/149] ext4: check s_log_groups_per_flex in online resize code 2010-07-02 4:11 ` tytso @ 2010-07-03 1:55 ` Greg KH 0 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-03 1:55 UTC (permalink / raw) To: tytso, linux-kernel, stable, stable-review, torvalds, akpm, alan, Eric Sandeen On Fri, Jul 02, 2010 at 12:11:02AM -0400, tytso@mit.edu wrote: > On Thu, Jul 01, 2010 at 10:32:25AM -0700, Greg KH wrote: > > 2.6.32-stable review patch. If anyone has any objections, please let us know. > > My only objection to these patches is that I don't know if they are > going to cause patch conflicts with the 50 or so patches which I sent > you for 2.6.32, which include both this patch and the next one. When > I backported the patches I did have to adjust some of them to make > sure they would apply cleanly to the latest 2.6.32.X release. By > cherry picking them, it could be that dropping those patches from > could cause no problems at all; or it could be a bit of a headache. > > So it might be easier to drop these two and then wait for the next > 2.6.32 stable release (which will hopefully be coming soon!) and just > take my whole set of patches.... Ok, I've now dropped them and will pick them up for the next release with the full series that you have sent me. thanks, greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 120/149] ext4: Make sure the MOVE_EXT ioctl cant overwrite append-only files 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (118 preceding siblings ...) 2010-07-01 17:32 ` [patch 119/149] ext4: check s_log_groups_per_flex in online resize code Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 121/149] GFS2: Fix permissions checking for setflags ioctl() Greg KH ` (28 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Theodore Tso, Dan Rosenberg 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Theodore Ts'o <tytso@mit.edu> commit 1f5a81e41f8b1a782c68d3843e9ec1bfaadf7d72 upstream. Dan Roseberg has reported a problem with the MOVE_EXT ioctl. If the donor file is an append-only file, we should not allow the operation to proceed, lest we end up overwriting the contents of an append-only file. Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Cc: Dan Rosenberg <dan.j.rosenberg@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/ext4/move_extent.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/ext4/move_extent.c +++ b/fs/ext4/move_extent.c @@ -964,6 +964,9 @@ mext_check_arguments(struct inode *orig_ return -EINVAL; } + if (IS_IMMUTABLE(donor_inode) || IS_APPEND(donor_inode)) + return -EPERM; + /* Ext4 move extent does not support swapfile */ if (IS_SWAPFILE(orig_inode) || IS_SWAPFILE(donor_inode)) { ext4_debug("ext4 move extent: The argument files should " ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 121/149] GFS2: Fix permissions checking for setflags ioctl() 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (119 preceding siblings ...) 2010-07-01 17:32 ` [patch 120/149] ext4: Make sure the MOVE_EXT ioctl cant overwrite append-only files Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 122/149] sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4) Greg KH ` (27 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Steven Whitehouse 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Steven Whitehouse <swhiteho@redhat.com> commit 7df0e0397b9a18358573274db9fdab991941062f upstream. We should be checking for the ownership of the file for which flags are being set, rather than just for write access. Reported-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> Signed-off-by: Steven Whitehouse <swhiteho@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/gfs2/file.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/fs/gfs2/file.c +++ b/fs/gfs2/file.c @@ -218,6 +218,11 @@ static int do_gfs2_set_flags(struct file if (error) goto out_drop_write; + error = -EACCES; + if (!is_owner_or_cap(inode)) + goto out; + + error = 0; flags = ip->i_diskflags; new_flags = (flags & ~mask) | (reqflags & mask); if ((new_flags ^ flags) == 0) @@ -275,8 +280,10 @@ static int gfs2_set_flags(struct file *f { struct inode *inode = filp->f_path.dentry->d_inode; u32 fsflags, gfsflags; + if (get_user(fsflags, ptr)) return -EFAULT; + gfsflags = fsflags_cvt(fsflags_to_gfs2, fsflags); if (!S_ISDIR(inode->i_mode)) { if (gfsflags & GFS2_DIF_INHERIT_JDATA) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 122/149] sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4) 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (120 preceding siblings ...) 2010-07-01 17:32 ` [patch 121/149] GFS2: Fix permissions checking for setflags ioctl() Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 123/149] CIFS: Allow null nd (as nfs server uses) on create Greg KH ` (26 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Neil Horman, Vlad Yasevich, David S. Miller 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Neil Horman <nhorman@tuxdriver.com> commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809 upstream. Ok, version 4 Change Notes: 1) Minor cleanups, from Vlads notes Summary: Hey- Recently, it was reported to me that the kernel could oops in the following way: <5> kernel BUG at net/core/skbuff.c:91! <5> invalid operand: 0000 [#1] <5> Modules linked in: sctp netconsole nls_utf8 autofs4 sunrpc iptable_filter ip_tables cpufreq_powersave parport_pc lp parport vmblock(U) vsock(U) vmci(U) vmxnet(U) vmmemctl(U) vmhgfs(U) acpiphp dm_mirror dm_mod button battery ac md5 ipv6 uhci_hcd ehci_hcd snd_ens1371 snd_rawmidi snd_seq_device snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc snd_ac97_codec snd soundcore pcnet32 mii floppy ext3 jbd ata_piix libata mptscsih mptsas mptspi mptscsi mptbase sd_mod scsi_mod <5> CPU: 0 <5> EIP: 0060:[<c02bff27>] Not tainted VLI <5> EFLAGS: 00010216 (2.6.9-89.0.25.EL) <5> EIP is at skb_over_panic+0x1f/0x2d <5> eax: 0000002c ebx: c033f461 ecx: c0357d96 edx: c040fd44 <5> esi: c033f461 edi: df653280 ebp: 00000000 esp: c040fd40 <5> ds: 007b es: 007b ss: 0068 <5> Process swapper (pid: 0, threadinfo=c040f000 task=c0370be0) <5> Stack: c0357d96 e0c29478 00000084 00000004 c033f461 df653280 d7883180 e0c2947d <5> 00000000 00000080 df653490 00000004 de4f1ac0 de4f1ac0 00000004 df653490 <5> 00000001 e0c2877a 08000800 de4f1ac0 df653490 00000000 e0c29d2e 00000004 <5> Call Trace: <5> [<e0c29478>] sctp_addto_chunk+0xb0/0x128 [sctp] <5> [<e0c2947d>] sctp_addto_chunk+0xb5/0x128 [sctp] <5> [<e0c2877a>] sctp_init_cause+0x3f/0x47 [sctp] <5> [<e0c29d2e>] sctp_process_unk_param+0xac/0xb8 [sctp] <5> [<e0c29e90>] sctp_verify_init+0xcc/0x134 [sctp] <5> [<e0c20322>] sctp_sf_do_5_1B_init+0x83/0x28e [sctp] <5> [<e0c25333>] sctp_do_sm+0x41/0x77 [sctp] <5> [<c01555a4>] cache_grow+0x140/0x233 <5> [<e0c26ba1>] sctp_endpoint_bh_rcv+0xc5/0x108 [sctp] <5> [<e0c2b863>] sctp_inq_push+0xe/0x10 [sctp] <5> [<e0c34600>] sctp_rcv+0x454/0x509 [sctp] <5> [<e084e017>] ipt_hook+0x17/0x1c [iptable_filter] <5> [<c02d005e>] nf_iterate+0x40/0x81 <5> [<c02e0bb9>] ip_local_deliver_finish+0x0/0x151 <5> [<c02e0c7f>] ip_local_deliver_finish+0xc6/0x151 <5> [<c02d0362>] nf_hook_slow+0x83/0xb5 <5> [<c02e0bb2>] ip_local_deliver+0x1a2/0x1a9 <5> [<c02e0bb9>] ip_local_deliver_finish+0x0/0x151 <5> [<c02e103e>] ip_rcv+0x334/0x3b4 <5> [<c02c66fd>] netif_receive_skb+0x320/0x35b <5> [<e0a0928b>] init_stall_timer+0x67/0x6a [uhci_hcd] <5> [<c02c67a4>] process_backlog+0x6c/0xd9 <5> [<c02c690f>] net_rx_action+0xfe/0x1f8 <5> [<c012a7b1>] __do_softirq+0x35/0x79 <5> [<c0107efb>] handle_IRQ_event+0x0/0x4f <5> [<c01094de>] do_softirq+0x46/0x4d Its an skb_over_panic BUG halt that results from processing an init chunk in which too many of its variable length parameters are in some way malformed. The problem is in sctp_process_unk_param: if (NULL == *errp) *errp = sctp_make_op_error_space(asoc, chunk, ntohs(chunk->chunk_hdr->length)); if (*errp) { sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM, WORD_ROUND(ntohs(param.p->length))); sctp_addto_chunk(*errp, WORD_ROUND(ntohs(param.p->length)), param.v); When we allocate an error chunk, we assume that the worst case scenario requires that we have chunk_hdr->length data allocated, which would be correct nominally, given that we call sctp_addto_chunk for the violating parameter. Unfortunately, we also, in sctp_init_cause insert a sctp_errhdr_t structure into the error chunk, so the worst case situation in which all parameters are in violation requires chunk_hdr->length+(sizeof(sctp_errhdr_t)*param_count) bytes of data. The result of this error is that a deliberately malformed packet sent to a listening host can cause a remote DOS, described in CVE-2010-1173: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-1173 I've tested the below fix and confirmed that it fixes the issue. We move to a strategy whereby we allocate a fixed size error chunk and ignore errors we don't have space to report. Tested by me successfully Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- include/net/sctp/structs.h | 1 net/sctp/sm_make_chunk.c | 62 +++++++++++++++++++++++++++++++++++++++++---- 2 files changed, 58 insertions(+), 5 deletions(-) --- a/include/net/sctp/structs.h +++ b/include/net/sctp/structs.h @@ -772,6 +772,7 @@ int sctp_user_addto_chunk(struct sctp_ch struct iovec *data); void sctp_chunk_free(struct sctp_chunk *); void *sctp_addto_chunk(struct sctp_chunk *, int len, const void *data); +void *sctp_addto_chunk_fixed(struct sctp_chunk *, int len, const void *data); struct sctp_chunk *sctp_chunkify(struct sk_buff *, const struct sctp_association *, struct sock *); --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -107,7 +107,7 @@ static const struct sctp_paramhdr prsctp cpu_to_be16(sizeof(struct sctp_paramhdr)), }; -/* A helper to initialize to initialize an op error inside a +/* A helper to initialize an op error inside a * provided chunk, as most cause codes will be embedded inside an * abort chunk. */ @@ -124,6 +124,29 @@ void sctp_init_cause(struct sctp_chunk chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err); } +/* A helper to initialize an op error inside a + * provided chunk, as most cause codes will be embedded inside an + * abort chunk. Differs from sctp_init_cause in that it won't oops + * if there isn't enough space in the op error chunk + */ +int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code, + size_t paylen) +{ + sctp_errhdr_t err; + __u16 len; + + /* Cause code constants are now defined in network order. */ + err.cause = cause_code; + len = sizeof(sctp_errhdr_t) + paylen; + err.length = htons(len); + + if (skb_tailroom(chunk->skb) > len) + return -ENOSPC; + chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk, + sizeof(sctp_errhdr_t), + &err); + return 0; +} /* 3.3.2 Initiation (INIT) (1) * * This chunk is used to initiate a SCTP association between two @@ -1125,6 +1148,24 @@ nodata: return retval; } +/* Create an Operation Error chunk of a fixed size, + * specifically, max(asoc->pathmtu, SCTP_DEFAULT_MAXSEGMENT) + * This is a helper function to allocate an error chunk for + * for those invalid parameter codes in which we may not want + * to report all the errors, if the incomming chunk is large + */ +static inline struct sctp_chunk *sctp_make_op_error_fixed( + const struct sctp_association *asoc, + const struct sctp_chunk *chunk) +{ + size_t size = asoc ? asoc->pathmtu : 0; + + if (!size) + size = SCTP_DEFAULT_MAXSEGMENT; + + return sctp_make_op_error_space(asoc, chunk, size); +} + /* Create an Operation Error chunk. */ struct sctp_chunk *sctp_make_op_error(const struct sctp_association *asoc, const struct sctp_chunk *chunk, @@ -1365,6 +1406,18 @@ void *sctp_addto_chunk(struct sctp_chunk return target; } +/* Append bytes to the end of a chunk. Returns NULL if there isn't sufficient + * space in the chunk + */ +void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk, + int len, const void *data) +{ + if (skb_tailroom(chunk->skb) > len) + return sctp_addto_chunk(chunk, len, data); + else + return NULL; +} + /* Append bytes from user space to the end of a chunk. Will panic if * chunk is not big enough. * Returns a kernel err value. @@ -1968,13 +2021,12 @@ static sctp_ierror_t sctp_process_unk_pa * returning multiple unknown parameters. */ if (NULL == *errp) - *errp = sctp_make_op_error_space(asoc, chunk, - ntohs(chunk->chunk_hdr->length)); + *errp = sctp_make_op_error_fixed(asoc, chunk); if (*errp) { - sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM, + sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM, WORD_ROUND(ntohs(param.p->length))); - sctp_addto_chunk(*errp, + sctp_addto_chunk_fixed(*errp, WORD_ROUND(ntohs(param.p->length)), param.v); } else { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 123/149] CIFS: Allow null nd (as nfs server uses) on create 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (121 preceding siblings ...) 2010-07-01 17:32 ` [patch 122/149] sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4) Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 124/149] vfs: add NOFOLLOW flag to umount(2) Greg KH ` (25 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Shirish Pargaonkar, Steve French 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Steve French <sfrench@us.ibm.com> commit fa588e0c57048b3d4bfcd772d80dc0615f83fd35 upstream. While creating a file on a server which supports unix extensions such as Samba, if a file is being created which does not supply nameidata (i.e. nd is null), cifs client can oops when calling cifs_posix_open. Signed-off-by: Shirish Pargaonkar <shirishp@us.ibm.com> Signed-off-by: Steve French <sfrench@us.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/cifs/cifsproto.h | 6 ++++-- fs/cifs/dir.c | 20 ++++++++++++-------- fs/cifs/file.c | 11 +++++++---- 3 files changed, 23 insertions(+), 14 deletions(-) --- a/fs/cifs/cifsproto.h +++ b/fs/cifs/cifsproto.h @@ -95,8 +95,10 @@ extern struct cifsFileInfo *cifs_new_fil __u16 fileHandle, struct file *file, struct vfsmount *mnt, unsigned int oflags); extern int cifs_posix_open(char *full_path, struct inode **pinode, - struct vfsmount *mnt, int mode, int oflags, - __u32 *poplock, __u16 *pnetfid, int xid); + struct vfsmount *mnt, + struct super_block *sb, + int mode, int oflags, + __u32 *poplock, __u16 *pnetfid, int xid); extern void cifs_unix_basic_to_fattr(struct cifs_fattr *fattr, FILE_UNIX_BASIC_INFO *info, struct cifs_sb_info *cifs_sb); --- a/fs/cifs/dir.c +++ b/fs/cifs/dir.c @@ -183,13 +183,14 @@ cifs_new_fileinfo(struct inode *newinode } int cifs_posix_open(char *full_path, struct inode **pinode, - struct vfsmount *mnt, int mode, int oflags, - __u32 *poplock, __u16 *pnetfid, int xid) + struct vfsmount *mnt, struct super_block *sb, + int mode, int oflags, + __u32 *poplock, __u16 *pnetfid, int xid) { int rc; FILE_UNIX_BASIC_INFO *presp_data; __u32 posix_flags = 0; - struct cifs_sb_info *cifs_sb = CIFS_SB(mnt->mnt_sb); + struct cifs_sb_info *cifs_sb = CIFS_SB(sb); struct cifs_fattr fattr; cFYI(1, ("posix open %s", full_path)); @@ -241,7 +242,7 @@ int cifs_posix_open(char *full_path, str /* get new inode and set it up */ if (*pinode == NULL) { - *pinode = cifs_iget(mnt->mnt_sb, &fattr); + *pinode = cifs_iget(sb, &fattr); if (!*pinode) { rc = -ENOMEM; goto posix_open_ret; @@ -250,7 +251,8 @@ int cifs_posix_open(char *full_path, str cifs_fattr_to_inode(*pinode, &fattr); } - cifs_new_fileinfo(*pinode, *pnetfid, NULL, mnt, oflags); + if (mnt) + cifs_new_fileinfo(*pinode, *pnetfid, NULL, mnt, oflags); posix_open_ret: kfree(presp_data); @@ -314,13 +316,14 @@ cifs_create(struct inode *inode, struct if (nd && (nd->flags & LOOKUP_OPEN)) oflags = nd->intent.open.flags; else - oflags = FMODE_READ; + oflags = FMODE_READ | SMB_O_CREAT; if (tcon->unix_ext && (tcon->ses->capabilities & CAP_UNIX) && (CIFS_UNIX_POSIX_PATH_OPS_CAP & le64_to_cpu(tcon->fsUnixInfo.Capability))) { - rc = cifs_posix_open(full_path, &newinode, nd->path.mnt, - mode, oflags, &oplock, &fileHandle, xid); + rc = cifs_posix_open(full_path, &newinode, + nd ? nd->path.mnt : NULL, + inode->i_sb, mode, oflags, &oplock, &fileHandle, xid); /* EIO could indicate that (posix open) operation is not supported, despite what server claimed in capability negotation. EREMOTE indicates DFS junction, which is not @@ -677,6 +680,7 @@ cifs_lookup(struct inode *parent_dir_ino (nd->flags & LOOKUP_OPEN) && !pTcon->broken_posix_open && (nd->intent.open.flags & O_CREAT)) { rc = cifs_posix_open(full_path, &newInode, nd->path.mnt, + parent_dir_inode->i_sb, nd->intent.open.create_mode, nd->intent.open.flags, &oplock, &fileHandle, xid); --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -295,10 +295,12 @@ int cifs_open(struct inode *inode, struc (CIFS_UNIX_POSIX_PATH_OPS_CAP & le64_to_cpu(tcon->fsUnixInfo.Capability))) { int oflags = (int) cifs_posix_convert_flags(file->f_flags); + oflags |= SMB_O_CREAT; /* can not refresh inode info since size could be stale */ rc = cifs_posix_open(full_path, &inode, file->f_path.mnt, - cifs_sb->mnt_file_mode /* ignored */, - oflags, &oplock, &netfid, xid); + inode->i_sb, + cifs_sb->mnt_file_mode /* ignored */, + oflags, &oplock, &netfid, xid); if (rc == 0) { cFYI(1, ("posix open succeeded")); /* no need for special case handling of setting mode @@ -510,8 +512,9 @@ reopen_error_exit: int oflags = (int) cifs_posix_convert_flags(file->f_flags); /* can not refresh inode info since size could be stale */ rc = cifs_posix_open(full_path, NULL, file->f_path.mnt, - cifs_sb->mnt_file_mode /* ignored */, - oflags, &oplock, &netfid, xid); + inode->i_sb, + cifs_sb->mnt_file_mode /* ignored */, + oflags, &oplock, &netfid, xid); if (rc == 0) { cFYI(1, ("posix reopen succeeded")); goto reopen_success; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 124/149] vfs: add NOFOLLOW flag to umount(2) 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (122 preceding siblings ...) 2010-07-01 17:32 ` [patch 123/149] CIFS: Allow null nd (as nfs server uses) on create Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 125/149] l2tp: Fix oops in pppol2tp_xmit Greg KH ` (24 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Eugene Teo, Michael Kerrisk, Miklos Szeredi, Al Viro 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Miklos Szeredi <mszeredi@suse.cz> commit db1f05bb85d7966b9176e293f3ceead1cb8b5d79 upstream. Add a new UMOUNT_NOFOLLOW flag to umount(2). This is needed to prevent symlink attacks in unprivileged unmounts (fuse, samba, ncpfs). Additionally, return -EINVAL if an unknown flag is used (and specify an explicitly unused flag: UMOUNT_UNUSED). This makes it possible for the caller to determine if a flag is supported or not. CC: Eugene Teo <eugene@redhat.com> CC: Michael Kerrisk <mtk.manpages@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/namespace.c | 9 ++++++++- include/linux/fs.h | 2 ++ 2 files changed, 10 insertions(+), 1 deletion(-) --- a/fs/namespace.c +++ b/fs/namespace.c @@ -1119,8 +1119,15 @@ SYSCALL_DEFINE2(umount, char __user *, n { struct path path; int retval; + int lookup_flags = 0; - retval = user_path(name, &path); + if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW)) + return -EINVAL; + + if (!(flags & UMOUNT_NOFOLLOW)) + lookup_flags |= LOOKUP_FOLLOW; + + retval = user_path_at(AT_FDCWD, name, lookup_flags, &path); if (retval) goto out; retval = -EINVAL; --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1310,6 +1310,8 @@ extern int send_sigurg(struct fown_struc #define MNT_FORCE 0x00000001 /* Attempt to forcibily umount */ #define MNT_DETACH 0x00000002 /* Just detach from the tree */ #define MNT_EXPIRE 0x00000004 /* Mark for expiry */ +#define UMOUNT_NOFOLLOW 0x00000008 /* Don't follow symlink on umount */ +#define UMOUNT_UNUSED 0x80000000 /* Flag guaranteed to be unused */ extern struct list_head super_blocks; extern spinlock_t sb_lock; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 125/149] l2tp: Fix oops in pppol2tp_xmit 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (123 preceding siblings ...) 2010-07-01 17:32 ` [patch 124/149] vfs: add NOFOLLOW flag to umount(2) Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 126/149] Btrfs: should add a permission check for setfacl Greg KH ` (23 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, James Chapman, David S. Miller 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: James Chapman <jchapman@katalix.com> commit 3feec9095d12e311b7d4eb7fe7e5dfa75d4a72a5 upstream. When transmitting L2TP frames, we derive the outgoing interface's UDP checksum hardware assist capabilities from the tunnel dst dev. This can sometimes be NULL, especially when routing protocols are used and routing changes occur. This patch just checks for NULL dst or dev pointers when checking for netdev hardware assist features. BUG: unable to handle kernel NULL pointer dereference at 0000000c IP: [<f89d074c>] pppol2tp_xmit+0x341/0x4da [pppol2tp] *pde = 00000000 Oops: 0000 [#1] SMP last sysfs file: /sys/class/net/lo/operstate Modules linked in: pppol2tp pppox ppp_generic slhc ipv6 dummy loop snd_hda_codec_atihdmi snd_hda_intel snd_hda_codec snd_pcm snd_timer snd soundcore snd_page_alloc evdev psmouse serio_raw processor button i2c_piix4 i2c_core ati_agp agpgart pcspkr ext3 jbd mbcache sd_mod ide_pci_generic atiixp ide_core ahci ata_generic floppy ehci_hcd ohci_hcd libata e1000e scsi_mod usbcore nls_base thermal fan thermal_sys [last unloaded: scsi_wait_scan] Pid: 0, comm: swapper Not tainted (2.6.32.8 #1) EIP: 0060:[<f89d074c>] EFLAGS: 00010297 CPU: 3 EIP is at pppol2tp_xmit+0x341/0x4da [pppol2tp] EAX: 00000000 EBX: f64d1680 ECX: 000005b9 EDX: 00000000 ESI: f6b91850 EDI: f64d16ac EBP: f6a0c4c0 ESP: f70a9cac DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 Process swapper (pid: 0, ti=f70a8000 task=f70a31c0 task.ti=f70a8000) Stack: 000005a9 000005b9 f734c400 f66652c0 f7352e00 f67dc800 00000000 f6b91800 <0> 000005a3 f70ef6c4 f67dcda9 000005a3 f89b192e 00000246 000005a3 f64d1680 <0> f63633e0 f6363320 f64d1680 f65a7320 f65a7364 f65856c0 f64d1680 f679f02f Call Trace: [<f89b192e>] ? ppp_push+0x459/0x50e [ppp_generic] [<f89b217f>] ? ppp_xmit_process+0x3b6/0x430 [ppp_generic] [<f89b2306>] ? ppp_start_xmit+0x10d/0x120 [ppp_generic] [<c11c15cb>] ? dev_hard_start_xmit+0x21f/0x2b2 [<c11d0947>] ? sch_direct_xmit+0x48/0x10e [<c11c19a0>] ? dev_queue_xmit+0x263/0x3a6 [<c11e2a9f>] ? ip_finish_output+0x1f7/0x221 [<c11df682>] ? ip_forward_finish+0x2e/0x30 [<c11de645>] ? ip_rcv_finish+0x295/0x2a9 [<c11c0b19>] ? netif_receive_skb+0x3e9/0x404 [<f814b791>] ? e1000_clean_rx_irq+0x253/0x2fc [e1000e] [<f814cb7a>] ? e1000_clean+0x63/0x1fc [e1000e] [<c1047eff>] ? sched_clock_local+0x15/0x11b [<c11c1095>] ? net_rx_action+0x96/0x195 [<c1035750>] ? __do_softirq+0xaa/0x151 [<c1035828>] ? do_softirq+0x31/0x3c [<c10358fe>] ? irq_exit+0x26/0x58 [<c1004b21>] ? do_IRQ+0x78/0x89 [<c1003729>] ? common_interrupt+0x29/0x30 [<c101ac28>] ? native_safe_halt+0x2/0x3 [<c1008c54>] ? default_idle+0x55/0x75 [<c1009045>] ? c1e_idle+0xd2/0xd5 [<c100233c>] ? cpu_idle+0x46/0x62 Code: 8d 45 08 f0 ff 45 08 89 6b 08 c7 43 68 7e fb 9c f8 8a 45 24 83 e0 0c 3c 04 75 09 80 63 64 f3 e9 b4 00 00 00 8b 43 18 8b 4c 24 04 <8b> 40 0c 8d 79 11 f6 40 44 0e 8a 43 64 75 51 6a 00 8b 4c 24 08 EIP: [<f89d074c>] pppol2tp_xmit+0x341/0x4da [pppol2tp] SS:ESP 0068:f70a9cac CR2: 000000000000000c Signed-off-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/pppol2tp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/pppol2tp.c +++ b/drivers/net/pppol2tp.c @@ -1178,7 +1178,8 @@ static int pppol2tp_xmit(struct ppp_chan /* Calculate UDP checksum if configured to do so */ if (sk_tun->sk_no_check == UDP_CSUM_NOXMIT) skb->ip_summed = CHECKSUM_NONE; - else if (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM)) { + else if ((skb_dst(skb) && skb_dst(skb)->dev) && + (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) { skb->ip_summed = CHECKSUM_COMPLETE; csum = skb_checksum(skb, 0, udp_len, 0); uh->check = csum_tcpudp_magic(inet->saddr, inet->daddr, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 126/149] Btrfs: should add a permission check for setfacl 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (124 preceding siblings ...) 2010-07-01 17:32 ` [patch 125/149] l2tp: Fix oops in pppol2tp_xmit Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 127/149] ucc_geth: Fix empty TX queue processing Greg KH ` (22 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Shi Weihua, Chris Mason 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Shi Weihua <shiwh@cn.fujitsu.com> commit 2f26afba46f0ebf155cf9be746496a0304a5b7cf upstream. On btrfs, do the following ------------------ # su user1 # cd btrfs-part/ # touch aaa # getfacl aaa # file: aaa # owner: user1 # group: user1 user::rw- group::rw- other::r-- # su user2 # cd btrfs-part/ # setfacl -m u::rwx aaa # getfacl aaa # file: aaa # owner: user1 # group: user1 user::rwx <- successed to setfacl group::rw- other::r-- ------------------ but we should prohibit it that user2 changing user1's acl. In fact, on ext3 and other fs, a message occurs: setfacl: aaa: Operation not permitted This patch fixed it. Signed-off-by: Shi Weihua <shiwh@cn.fujitsu.com> Signed-off-by: Chris Mason <chris.mason@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/btrfs/acl.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/btrfs/acl.c +++ b/fs/btrfs/acl.c @@ -157,6 +157,9 @@ static int btrfs_xattr_set_acl(struct in int ret = 0; struct posix_acl *acl = NULL; + if (!is_owner_or_cap(inode)) + return -EPERM; + if (value) { acl = posix_acl_from_xattr(value, size); if (acl == NULL) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 127/149] ucc_geth: Fix empty TX queue processing 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (125 preceding siblings ...) 2010-07-01 17:32 ` [patch 126/149] Btrfs: should add a permission check for setfacl Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 128/149] ucc_geth: Fix netdev watchdog triggering on link changes Greg KH ` (21 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Anton Vorontsov, David S. Miller 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Anton Vorontsov <avorontsov@ru.mvista.com> commit 7583605b6d29f1f7f6fc505b883328089f3485ad upstream. Following oops was seen with the ucc_geth driver: Unable to handle kernel paging request for data at address 0x00000058 Faulting instruction address: 0xc024f2fc Oops: Kernel access of bad area, sig: 11 [#1] [...] NIP [c024f2fc] skb_recycle_check+0x14/0x100 LR [e30aa0a4] ucc_geth_poll+0xd8/0x4e0 [ucc_geth_driver] Call Trace: [df857d50] [c000b03c] __ipipe_grab_irq+0x3c/0xa4 (unreliable) [df857d60] [e30aa0a4] ucc_geth_poll+0xd8/0x4e0 [ucc_geth_driver] [df857dd0] [c0258cf8] net_rx_action+0xf8/0x1b8 [df857e10] [c0032a38] __do_softirq+0xb8/0x13c [df857e60] [c00065cc] do_softirq+0xa0/0xac [...] This is because ucc_geth_tx() tries to process an empty queue when queues are logically stopped. Stopping the queues doesn't disable polling, and since nowadays ucc_geth_tx() is actually called from the polling routine, the oops above might pop up. Fix this by removing 'netif_queue_stopped() == 0' check. Reported-by: Lennart Sorensen <lsorense@csclub.uwaterloo.ca> Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com> Tested-by: Lennart Sorensen <lsorense@csclub.uwaterloo.ca> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/ucc_geth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ucc_geth.c +++ b/drivers/net/ucc_geth.c @@ -3273,7 +3273,7 @@ static int ucc_geth_tx(struct net_device /* Handle the transmitted buffer and release */ /* the BD to be used with the current frame */ - if ((bd == ugeth->txBd[txQ]) && (netif_queue_stopped(dev) == 0)) + if (bd == ugeth->txBd[txQ]) /* queue empty? */ break; dev->stats.tx_packets++; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 128/149] ucc_geth: Fix netdev watchdog triggering on link changes 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (126 preceding siblings ...) 2010-07-01 17:32 ` [patch 127/149] ucc_geth: Fix empty TX queue processing Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 129/149] ucc_geth: Fix full TX queue processing Greg KH ` (20 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Anton Vorontsov, David S. Miller 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Anton Vorontsov <avorontsov@ru.mvista.com> commit 08b5e1c91ce95793c59a59529a362a1bcc81faae upstream. Since commit 864fdf884e82bacbe8ca5e93bd43393a61d2e2b4 ("ucc_geth: Fix hangs after switching from full to half duplex") ucc_geth driver disables the controller during MAC configuration changes. Though, disabling the controller might take quite awhile, and so the netdev watchdog might get upset: NETDEV WATCHDOG: eth2 (ucc_geth): transmit queue 0 timed out ------------[ cut here ]------------ Badness at c02729a8 [verbose debug info unavailable] NIP: c02729a8 LR: c02729a8 CTR: c01b6088 REGS: c0451c40 TRAP: 0700 Not tainted (2.6.32-trunk-8360e) [...] NIP [c02729a8] dev_watchdog+0x280/0x290 LR [c02729a8] dev_watchdog+0x280/0x290 Call Trace: [c0451cf0] [c02729a8] dev_watchdog+0x280/0x290 (unreliable) [c0451d50] [c00377c4] run_timer_softirq+0x164/0x224 [c0451da0] [c0032a38] __do_softirq+0xb8/0x13c [c0451df0] [c00065cc] do_softirq+0xa0/0xac [c0451e00] [c003280c] irq_exit+0x7c/0x9c [c0451e10] [c00640c4] __ipipe_sync_stage+0x248/0x24c [...] This patch fixes the issue by detaching the netdev during the time we change the configuration. Reported-by: Lennart Sorensen <lsorense@csclub.uwaterloo.ca> Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com> Tested-by: Lennart Sorensen <lsorense@csclub.uwaterloo.ca> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/ucc_geth.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/drivers/net/ucc_geth.c +++ b/drivers/net/ucc_geth.c @@ -1563,7 +1563,10 @@ static int ugeth_disable(struct ucc_geth static void ugeth_quiesce(struct ucc_geth_private *ugeth) { - /* Wait for and prevent any further xmits. */ + /* Prevent any further xmits, plus detach the device. */ + netif_device_detach(ugeth->ndev); + + /* Wait for any current xmits to finish. */ netif_tx_disable(ugeth->ndev); /* Disable the interrupt to avoid NAPI rescheduling. */ @@ -1577,7 +1580,7 @@ static void ugeth_activate(struct ucc_ge { napi_enable(&ugeth->napi); enable_irq(ugeth->ug_info->uf_info.irq); - netif_tx_wake_all_queues(ugeth->ndev); + netif_device_attach(ugeth->ndev); } /* Called every time the controller might need to be made ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 129/149] ucc_geth: Fix full TX queue processing 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (127 preceding siblings ...) 2010-07-01 17:32 ` [patch 128/149] ucc_geth: Fix netdev watchdog triggering on link changes Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 130/149] tipc: Fix oops on send prior to entering networked mode (v3) Greg KH ` (19 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jiajun Wu, Anton Vorontsov, David S. Miller 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Jiajun Wu <b06378@freescale.com> commit 34692421bc7d6145ef383b014860f4fde10b7505 upstream. commit 7583605b6d29f1f7f6fc505b883328089f3485ad ("ucc_geth: Fix empty TX queue processing") fixed empty TX queue mishandling, but didn't account another corner case: when TX queue becomes full. Without this patch the driver will stop transmiting when TX queue becomes full since 'bd == ugeth->txBd[txQ]' actually checks for two things: queue empty or full. Let's better check for NULL skb, which unambiguously signals an empty queue. Signed-off-by: Jiajun Wu <b06378@freescale.com> Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/ucc_geth.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/drivers/net/ucc_geth.c +++ b/drivers/net/ucc_geth.c @@ -3276,13 +3276,12 @@ static int ucc_geth_tx(struct net_device /* Handle the transmitted buffer and release */ /* the BD to be used with the current frame */ - if (bd == ugeth->txBd[txQ]) /* queue empty? */ + skb = ugeth->tx_skbuff[txQ][ugeth->skb_dirtytx[txQ]]; + if (!skb) break; dev->stats.tx_packets++; - skb = ugeth->tx_skbuff[txQ][ugeth->skb_dirtytx[txQ]]; - if (skb_queue_len(&ugeth->rx_recycle) < RX_BD_RING_LEN && skb_recycle_check(skb, ugeth->ug_info->uf_info.max_rx_buf_length + ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 130/149] tipc: Fix oops on send prior to entering networked mode (v3) 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (128 preceding siblings ...) 2010-07-01 17:32 ` [patch 129/149] ucc_geth: Fix full TX queue processing Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 131/149] Input: psmouse - reset all types of mice before reconnecting Greg KH ` (18 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Neil Horman, Allan Stephens, David S. Miller, tipc-discussion 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Neil Horman <nhorman@tuxdriver.com> commit d0021b252eaf65ca07ed14f0d66425dd9ccab9a6 upstream. Fix TIPC to disallow sending to remote addresses prior to entering NET_MODE user programs can oops the kernel by sending datagrams via AF_TIPC prior to entering networked mode. The following backtrace has been observed: ID: 13459 TASK: ffff810014640040 CPU: 0 COMMAND: "tipc-client" [exception RIP: tipc_node_select_next_hop+90] RIP: ffffffff8869d3c3 RSP: ffff81002d9a5ab8 RFLAGS: 00010202 RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000001001001 RBP: 0000000001001001 R8: 0074736575716552 R9: 0000000000000000 R10: ffff81003fbd0680 R11: 00000000000000c8 R12: 0000000000000008 R13: 0000000000000001 R14: 0000000000000001 R15: ffff810015c6ca00 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 RIP: 0000003cbd8d49a3 RSP: 00007fffc84e0be8 RFLAGS: 00010206 RAX: 000000000000002c RBX: ffffffff8005d116 RCX: 0000000000000000 RDX: 0000000000000008 RSI: 00007fffc84e0c00 RDI: 0000000000000003 RBP: 0000000000000000 R8: 00007fffc84e0c10 R9: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffc84e0d10 R14: 0000000000000000 R15: 00007fffc84e0c30 ORIG_RAX: 000000000000002c CS: 0033 SS: 002b What happens is that, when the tipc module in inserted it enters a standalone node mode in which communication to its own address is allowed <0.0.0> but not to other addresses, since the appropriate data structures have not been allocated yet (specifically the tipc_net pointer). There is nothing stopping a client from trying to send such a message however, and if that happens, we attempt to dereference tipc_net.zones while the pointer is still NULL, and explode. The fix is pretty straightforward. Since these oopses all arise from the dereference of global pointers prior to their assignment to allocated values, and since these allocations are small (about 2k total), lets convert these pointers to static arrays of the appropriate size. All the accesses to these bits consider 0/NULL to be a non match when searching, so all the lookups still work properly, and there is no longer a chance of a bad dererence anywhere. As a bonus, this lets us eliminate the setup/teardown routines for those pointers, and elimnates the need to preform any locking around them to prevent access while their being allocated/freed. I've updated the tipc_net structure to behave this way to fix the exact reported problem, and also fixed up the tipc_bearers and media_list arrays to fix an obvious simmilar problem that arises from issuing tipc-config commands to manipulate bearers/links prior to entering networked mode I've tested this for a few hours by running the sanity tests and stress test with the tipcutils suite, and nothing has fallen over. There have been a few lockdep warnings, but those were there before, and can be addressed later, as they didn't actually result in any deadlock. Signed-off-by: Neil Horman <nhorman@tuxdriver.com> CC: Allan Stephens <allan.stephens@windriver.com> CC: David S. Miller <davem@davemloft.net> CC: tipc-discussion@lists.sourceforge.net Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/tipc/bearer.c | 37 ++++++------------------------------- net/tipc/bearer.h | 2 +- net/tipc/net.c | 25 ++++--------------------- 3 files changed, 11 insertions(+), 53 deletions(-) --- a/net/tipc/bearer.c +++ b/net/tipc/bearer.c @@ -45,10 +45,10 @@ #define MAX_ADDR_STR 32 -static struct media *media_list = NULL; +static struct media media_list[MAX_MEDIA]; static u32 media_count = 0; -struct bearer *tipc_bearers = NULL; +struct bearer tipc_bearers[MAX_BEARERS]; /** * media_name_valid - validate media name @@ -108,9 +108,11 @@ int tipc_register_media(u32 media_type, int res = -EINVAL; write_lock_bh(&tipc_net_lock); - if (!media_list) - goto exit; + if (tipc_mode != TIPC_NET_MODE) { + warn("Media <%s> rejected, not in networked mode yet\n", name); + goto exit; + } if (!media_name_valid(name)) { warn("Media <%s> rejected, illegal name\n", name); goto exit; @@ -660,33 +662,10 @@ int tipc_disable_bearer(const char *name -int tipc_bearer_init(void) -{ - int res; - - write_lock_bh(&tipc_net_lock); - tipc_bearers = kcalloc(MAX_BEARERS, sizeof(struct bearer), GFP_ATOMIC); - media_list = kcalloc(MAX_MEDIA, sizeof(struct media), GFP_ATOMIC); - if (tipc_bearers && media_list) { - res = 0; - } else { - kfree(tipc_bearers); - kfree(media_list); - tipc_bearers = NULL; - media_list = NULL; - res = -ENOMEM; - } - write_unlock_bh(&tipc_net_lock); - return res; -} - void tipc_bearer_stop(void) { u32 i; - if (!tipc_bearers) - return; - for (i = 0; i < MAX_BEARERS; i++) { if (tipc_bearers[i].active) tipc_bearers[i].publ.blocked = 1; @@ -695,10 +674,6 @@ void tipc_bearer_stop(void) if (tipc_bearers[i].active) bearer_disable(tipc_bearers[i].publ.name); } - kfree(tipc_bearers); - kfree(media_list); - tipc_bearers = NULL; - media_list = NULL; media_count = 0; } --- a/net/tipc/bearer.h +++ b/net/tipc/bearer.h @@ -114,7 +114,7 @@ struct bearer_name { struct link; -extern struct bearer *tipc_bearers; +extern struct bearer tipc_bearers[]; void tipc_media_addr_printf(struct print_buf *pb, struct tipc_media_addr *a); struct sk_buff *tipc_media_get_names(void); --- a/net/tipc/net.c +++ b/net/tipc/net.c @@ -116,7 +116,8 @@ */ DEFINE_RWLOCK(tipc_net_lock); -struct network tipc_net = { NULL }; +struct _zone *tipc_zones[256] = { NULL, }; +struct network tipc_net = { tipc_zones }; struct tipc_node *tipc_net_select_remote_node(u32 addr, u32 ref) { @@ -158,28 +159,12 @@ void tipc_net_send_external_routes(u32 d } } -static int net_init(void) -{ - memset(&tipc_net, 0, sizeof(tipc_net)); - tipc_net.zones = kcalloc(tipc_max_zones + 1, sizeof(struct _zone *), GFP_ATOMIC); - if (!tipc_net.zones) { - return -ENOMEM; - } - return 0; -} - static void net_stop(void) { u32 z_num; - if (!tipc_net.zones) - return; - - for (z_num = 1; z_num <= tipc_max_zones; z_num++) { + for (z_num = 1; z_num <= tipc_max_zones; z_num++) tipc_zone_delete(tipc_net.zones[z_num]); - } - kfree(tipc_net.zones); - tipc_net.zones = NULL; } static void net_route_named_msg(struct sk_buff *buf) @@ -282,9 +267,7 @@ int tipc_net_start(u32 addr) tipc_named_reinit(); tipc_port_reinit(); - if ((res = tipc_bearer_init()) || - (res = net_init()) || - (res = tipc_cltr_init()) || + if ((res = tipc_cltr_init()) || (res = tipc_bclink_init())) { return res; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 131/149] Input: psmouse - reset all types of mice before reconnecting 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (129 preceding siblings ...) 2010-07-01 17:32 ` [patch 130/149] tipc: Fix oops on send prior to entering networked mode (v3) Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 132/149] KVM: s390: Fix possible memory leak of in kvm_arch_vcpu_create() Greg KH ` (17 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dmitry Torokhov, Tim Gardner 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Dmitry Torokhov <dmitry.torokhov@gmail.com> commit ef110b24e28f36620f63dab94708a17c7e267358 upstream. Synaptics hardware requires resetting device after suspend to ram in order for the device to be operational. The reset lives in synaptics-specific reconnect handler, but it is not being invoked if synaptics support is disabled and the device is handled as a standard PS/2 device (bare or IntelliMouse protocol). Let's add reset into generic reconnect handler as well. Signed-off-by: Dmitry Torokhov <dtor@mail.ru> Cc: Tim Gardner <tim.gardner@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/input/mouse/psmouse-base.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) --- a/drivers/input/mouse/psmouse-base.c +++ b/drivers/input/mouse/psmouse-base.c @@ -1349,6 +1349,7 @@ static int psmouse_reconnect(struct seri struct psmouse *psmouse = serio_get_drvdata(serio); struct psmouse *parent = NULL; struct serio_driver *drv = serio->drv; + unsigned char type; int rc = -1; if (!drv || !psmouse) { @@ -1368,10 +1369,15 @@ static int psmouse_reconnect(struct seri if (psmouse->reconnect) { if (psmouse->reconnect(psmouse)) goto out; - } else if (psmouse_probe(psmouse) < 0 || - psmouse->type != psmouse_extensions(psmouse, - psmouse_max_proto, false)) { - goto out; + } else { + psmouse_reset(psmouse); + + if (psmouse_probe(psmouse) < 0) + goto out; + + type = psmouse_extensions(psmouse, psmouse_max_proto, false); + if (psmouse->type != type) + goto out; } /* ok, the device type (and capabilities) match the old one, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 132/149] KVM: s390: Fix possible memory leak of in kvm_arch_vcpu_create() 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (130 preceding siblings ...) 2010-07-01 17:32 ` [patch 131/149] Input: psmouse - reset all types of mice before reconnecting Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 133/149] KVM: PPC: Do not create debugfs if fail to create vcpu Greg KH ` (16 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Wei Yongjun, Carsten Otte, Avi Kivity 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Wei Yongjun <yjwei@cn.fujitsu.com> This patch fixed possible memory leak in kvm_arch_vcpu_create() under s390, which would happen when kvm_arch_vcpu_create() fails. Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Acked-by: Carsten Otte <cotte@de.ibm.com> Cc: stable@kernel.org Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 7b06bf2ffa15e119c7439ed0b024d44f66d7b605) --- arch/s390/kvm/kvm-s390.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -338,11 +338,13 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st rc = kvm_vcpu_init(vcpu, kvm, id); if (rc) - goto out_free_cpu; + goto out_free_sie_block; VM_EVENT(kvm, 3, "create cpu %d at %p, sie block at %p", id, vcpu, vcpu->arch.sie_block); return vcpu; +out_free_sie_block: + free_page((unsigned long)(vcpu->arch.sie_block)); out_free_cpu: kfree(vcpu); out_nomem: ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 133/149] KVM: PPC: Do not create debugfs if fail to create vcpu 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (131 preceding siblings ...) 2010-07-01 17:32 ` [patch 132/149] KVM: s390: Fix possible memory leak of in kvm_arch_vcpu_create() Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock Greg KH ` (15 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Wei Yongjun, Alexander Graf, Avi Kivity 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Wei Yongjun <yjwei@cn.fujitsu.com> If fail to create the vcpu, we should not create the debugfs for it. Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Acked-by: Alexander Graf <agraf@suse.de> Cc: stable@kernel.org Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 06056bfb944a0302a8f22eb45f09123de7fb417b) --- arch/powerpc/kvm/powerpc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/arch/powerpc/kvm/powerpc.c +++ b/arch/powerpc/kvm/powerpc.c @@ -176,7 +176,8 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st { struct kvm_vcpu *vcpu; vcpu = kvmppc_core_vcpu_create(kvm, id); - kvmppc_create_vcpu_debugfs(vcpu, id); + if (!IS_ERR(vcpu)) + kvmppc_create_vcpu_debugfs(vcpu, id); return vcpu; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (132 preceding siblings ...) 2010-07-01 17:32 ` [patch 133/149] KVM: PPC: Do not create debugfs if fail to create vcpu Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-07 12:47 ` Peter Palfrader 2010-07-01 17:32 ` [patch 135/149] KVM: Dont allow lmsw to clear cr0.pe Greg KH ` (14 subsequent siblings) 148 siblings, 1 reply; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Avi Kivity, Marcelo Tosatti 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Glauber Costa <glommer@redhat.com> In recent stress tests, it was found that pvclock-based systems could seriously warp in smp systems. Using ingo's time-warp-test.c, I could trigger a scenario as bad as 1.5mi warps a minute in some systems. (to be fair, it wasn't that bad in most of them). Investigating further, I found out that such warps were caused by the very offset-based calculation pvclock is based on. This happens even on some machines that report constant_tsc in its tsc flags, specially on multi-socket ones. Two reads of the same kernel timestamp at approx the same time, will likely have tsc timestamped in different occasions too. This means the delta we calculate is unpredictable at best, and can probably be smaller in a cpu that is legitimately reading clock in a forward ocasion. Some adjustments on the host could make this window less likely to happen, but still, it pretty much poses as an intrinsic problem of the mechanism. A while ago, I though about using a shared variable anyway, to hold clock last state, but gave up due to the high contention locking was likely to introduce, possibly rendering the thing useless on big machines. I argue, however, that locking is not necessary. We do a read-and-return sequence in pvclock, and between read and return, the global value can have changed. However, it can only have changed by means of an addition of a positive value. So if we detected that our clock timestamp is less than the current global, we know that we need to return a higher one, even though it is not exactly the one we compared to. OTOH, if we detect we're greater than the current time source, we atomically replace the value with our new readings. This do causes contention on big boxes (but big here means *BIG*), but it seems like a good trade off, since it provide us with a time source guaranteed to be stable wrt time warps. After this patch is applied, I don't see a single warp in time during 5 days of execution, in any of the machines I saw them before. Signed-off-by: Glauber Costa <glommer@redhat.com> Acked-by: Zachary Amsden <zamsden@redhat.com> CC: Jeremy Fitzhardinge <jeremy@goop.org> CC: Avi Kivity <avi@redhat.com> CC: Marcelo Tosatti <mtosatti@redhat.com> CC: Zachary Amsden <zamsden@redhat.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 489fb490dbf8dab0249ad82b56688ae3842a79e8) --- arch/x86/kernel/pvclock.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) --- a/arch/x86/kernel/pvclock.c +++ b/arch/x86/kernel/pvclock.c @@ -109,11 +109,14 @@ unsigned long pvclock_tsc_khz(struct pvc return pv_tsc_khz; } +static atomic64_t last_value = ATOMIC64_INIT(0); + cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src) { struct pvclock_shadow_time shadow; unsigned version; cycle_t ret, offset; + u64 last; do { version = pvclock_get_time_values(&shadow, src); @@ -123,6 +126,27 @@ cycle_t pvclock_clocksource_read(struct barrier(); } while (version != src->version); + /* + * Assumption here is that last_value, a global accumulator, always goes + * forward. If we are less than that, we should not be much smaller. + * We assume there is an error marging we're inside, and then the correction + * does not sacrifice accuracy. + * + * For reads: global may have changed between test and return, + * but this means someone else updated poked the clock at a later time. + * We just need to make sure we are not seeing a backwards event. + * + * For updates: last_value = ret is not enough, since two vcpus could be + * updating at the same time, and one of them could be slightly behind, + * making the assumption that last_value always go forward fail to hold. + */ + last = atomic64_read(&last_value); + do { + if (ret < last) + return last; + last = atomic64_cmpxchg(&last_value, last, ret); + } while (unlikely(last != ret)); + return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-01 17:32 ` [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock Greg KH @ 2010-07-07 12:47 ` Peter Palfrader 2010-07-07 13:51 ` Glauber Costa 2010-07-08 9:41 ` Avi Kivity 0 siblings, 2 replies; 666+ messages in thread From: Peter Palfrader @ 2010-07-07 12:47 UTC (permalink / raw) To: Greg KH Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Avi Kivity, Marcelo Tosatti Hey, Greg KH schrieb am Donnerstag, dem 01. Juli 2010: > 2.6.32-stable review patch. If anyone has any objections, please let us know. 2.6.32.16 fails to boot on my KVM domains using qemu-kvm 0.11.1. Bisecting between 2.6.32.14 which worked and .16 turned up this commit as the first culprit[0]. The host is still running 2.6.32.14 and has 8 cores on 2 CPUs. The single-cpu KVM domain hangs just after printing 'Write protecting the kernel read-only data: 9492k'[1]. On a successful boot this line would usually be followed by 'INIT: version 2.86 booting'. A 2.6.32.16 with this patch reverted boots fine. If there's any info you need please just ask. Cheers, Peter 0. http://asteria.noreply.org/~weasel/volatile/2010-07-07-x9KxN34l17c/fileztnjyZ 1. http://asteria.noreply.org/~weasel/volatile/2010-07-07-VTRuAQGOKlY/zoe-2.6.32.16.png 2. http://asteria.noreply.org/~weasel/volatile/2010-07-07-Fq0PVc1ecsc/config-2.6.32.16-dsa-amd64 -- | .''`. ** Debian GNU/Linux ** Peter Palfrader | : :' : The universal http://www.palfrader.org/ | `. `' Operating System | `- http://www.debian.org/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-07 12:47 ` Peter Palfrader @ 2010-07-07 13:51 ` Glauber Costa 2010-07-07 14:33 ` Peter Palfrader 2010-07-08 9:41 ` Avi Kivity 1 sibling, 1 reply; 666+ messages in thread From: Glauber Costa @ 2010-07-07 13:51 UTC (permalink / raw) To: Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Zachary Amsden, Jeremy Fitzhardinge, Avi Kivity, Marcelo Tosatti On Wed, Jul 07, 2010 at 02:47:31PM +0200, Peter Palfrader wrote: > Hey, > > Greg KH schrieb am Donnerstag, dem 01. Juli 2010: > > > 2.6.32-stable review patch. If anyone has any objections, please let us know. > > 2.6.32.16 fails to boot on my KVM domains using qemu-kvm 0.11.1. > > Bisecting between 2.6.32.14 which worked and .16 turned up this commit > as the first culprit[0]. > > The host is still running 2.6.32.14 and has 8 cores on 2 CPUs. The > single-cpu KVM domain hangs just after printing 'Write protecting the > kernel read-only data: 9492k'[1]. On a successful boot this line would > usually be followed by 'INIT: version 2.86 booting'. > > A 2.6.32.16 with this patch reverted boots fine. > > If there's any info you need please just ask. if you boot with another clocksource, and then switch to kvmclock with the machine already running, do you see anything strange or suspicious? ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-07 13:51 ` Glauber Costa @ 2010-07-07 14:33 ` Peter Palfrader 2010-07-07 15:15 ` Gleb Natapov 2010-07-07 18:15 ` Glauber Costa 0 siblings, 2 replies; 666+ messages in thread From: Peter Palfrader @ 2010-07-07 14:33 UTC (permalink / raw) To: Glauber Costa Cc: Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Zachary Amsden, Jeremy Fitzhardinge, Avi Kivity, Marcelo Tosatti On Wed, 07 Jul 2010, Glauber Costa wrote: > > 2.6.32.16 fails to boot on my KVM domains using qemu-kvm 0.11.1. > > > > Bisecting between 2.6.32.14 which worked and .16 turned up this commit > > as the first culprit[0]. > > > > The host is still running 2.6.32.14 and has 8 cores on 2 CPUs. The > > single-cpu KVM domain hangs just after printing 'Write protecting the > > kernel read-only data: 9492k'[1]. On a successful boot this line would > > usually be followed by 'INIT: version 2.86 booting'. > > > > A 2.6.32.16 with this patch reverted boots fine. > > > > If there's any info you need please just ask. > if you boot with another clocksource, and then switch to kvmclock with the machine already > running, do you see anything strange or suspicious? Booting with various clocksource=xxx kernel parameters does not change the behaviour at all, i.e. the boot still hangs. Cheers, Peter -- | .''`. ** Debian GNU/Linux ** Peter Palfrader | : :' : The universal http://www.palfrader.org/ | `. `' Operating System | `- http://www.debian.org/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-07 14:33 ` Peter Palfrader @ 2010-07-07 15:15 ` Gleb Natapov 2010-07-07 20:05 ` Peter Palfrader 2010-07-07 18:15 ` Glauber Costa 1 sibling, 1 reply; 666+ messages in thread From: Gleb Natapov @ 2010-07-07 15:15 UTC (permalink / raw) To: Peter Palfrader, Glauber Costa, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Zachary Amsden, Jeremy Fitzhardinge, Avi Kivity, Marcelo Tosatti On Wed, Jul 07, 2010 at 04:33:39PM +0200, Peter Palfrader wrote: > On Wed, 07 Jul 2010, Glauber Costa wrote: > > > > 2.6.32.16 fails to boot on my KVM domains using qemu-kvm 0.11.1. > > > > > > Bisecting between 2.6.32.14 which worked and .16 turned up this commit > > > as the first culprit[0]. > > > > > > The host is still running 2.6.32.14 and has 8 cores on 2 CPUs. The > > > single-cpu KVM domain hangs just after printing 'Write protecting the > > > kernel read-only data: 9492k'[1]. On a successful boot this line would > > > usually be followed by 'INIT: version 2.86 booting'. > > > > > > A 2.6.32.16 with this patch reverted boots fine. > > > > > > If there's any info you need please just ask. > > > if you boot with another clocksource, and then switch to kvmclock with the machine already > > running, do you see anything strange or suspicious? > > Booting with various clocksource=xxx kernel parameters does not change > the behaviour at all, i.e. the boot still hangs. > And what if you provide -cpu qemu64,-kvmclock to qemu command line? -- Gleb. ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-07 15:15 ` Gleb Natapov @ 2010-07-07 20:05 ` Peter Palfrader 2010-07-08 5:31 ` Gleb Natapov 0 siblings, 1 reply; 666+ messages in thread From: Peter Palfrader @ 2010-07-07 20:05 UTC (permalink / raw) To: Gleb Natapov Cc: Glauber Costa, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Zachary Amsden, Jeremy Fitzhardinge, Avi Kivity, Marcelo Tosatti On Wed, 07 Jul 2010, Gleb Natapov wrote: > On Wed, Jul 07, 2010 at 04:33:39PM +0200, Peter Palfrader wrote: > > On Wed, 07 Jul 2010, Glauber Costa wrote: > > > > > > 2.6.32.16 fails to boot on my KVM domains using qemu-kvm 0.11.1. > > > > > > > > Bisecting between 2.6.32.14 which worked and .16 turned up this commit > > > > as the first culprit[0]. > > > > > > > > The host is still running 2.6.32.14 and has 8 cores on 2 CPUs. The > > > > single-cpu KVM domain hangs just after printing 'Write protecting the > > > > kernel read-only data: 9492k'[1]. On a successful boot this line would > > > > usually be followed by 'INIT: version 2.86 booting'. > > > > > > > > A 2.6.32.16 with this patch reverted boots fine. > > > > > > > > If there's any info you need please just ask. > > > > > if you boot with another clocksource, and then switch to kvmclock with the machine already > > > running, do you see anything strange or suspicious? > > > > Booting with various clocksource=xxx kernel parameters does not change > > the behaviour at all, i.e. the boot still hangs. > > > And what if you provide -cpu qemu64,-kvmclock to qemu command line? Adding that to the glob of options that already were there from libvirt didn't disable it, but using an LD_PRELOAD wrapper[1] to that purpose on the host when starting kvm did help. Now, with kvmclock no longer being available at all the system picks tsc and indeed boots 2.6.32.16 successfully. - Peter 1. http://people.debian.org/~paravoid/kvm-noclock-3.tar.gz -- | .''`. ** Debian GNU/Linux ** Peter Palfrader | : :' : The universal http://www.palfrader.org/ | `. `' Operating System | `- http://www.debian.org/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-07 20:05 ` Peter Palfrader @ 2010-07-08 5:31 ` Gleb Natapov 2010-07-08 8:51 ` Peter Palfrader 0 siblings, 1 reply; 666+ messages in thread From: Gleb Natapov @ 2010-07-08 5:31 UTC (permalink / raw) To: Peter Palfrader, Glauber Costa, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Zachary Amsden, Jeremy Fitzhardinge, Avi Kivity, Marcelo Tosatti On Wed, Jul 07, 2010 at 10:05:36PM +0200, Peter Palfrader wrote: > On Wed, 07 Jul 2010, Gleb Natapov wrote: > > > On Wed, Jul 07, 2010 at 04:33:39PM +0200, Peter Palfrader wrote: > > > On Wed, 07 Jul 2010, Glauber Costa wrote: > > > > > > > > 2.6.32.16 fails to boot on my KVM domains using qemu-kvm 0.11.1. > > > > > > > > > > Bisecting between 2.6.32.14 which worked and .16 turned up this commit > > > > > as the first culprit[0]. > > > > > > > > > > The host is still running 2.6.32.14 and has 8 cores on 2 CPUs. The > > > > > single-cpu KVM domain hangs just after printing 'Write protecting the > > > > > kernel read-only data: 9492k'[1]. On a successful boot this line would > > > > > usually be followed by 'INIT: version 2.86 booting'. > > > > > > > > > > A 2.6.32.16 with this patch reverted boots fine. > > > > > > > > > > If there's any info you need please just ask. > > > > > > > if you boot with another clocksource, and then switch to kvmclock with the machine already > > > > running, do you see anything strange or suspicious? > > > > > > Booting with various clocksource=xxx kernel parameters does not change > > > the behaviour at all, i.e. the boot still hangs. > > > > > And what if you provide -cpu qemu64,-kvmclock to qemu command line? > > Adding that to the glob of options that already were there from libvirt > didn't disable it, but using an LD_PRELOAD wrapper[1] to that purpose on > the host when starting kvm did help. > Strange. -kvmclock should have had the same effect. What qemu is it? What is your command line? > Now, with kvmclock no longer being available at all the system picks tsc > and indeed boots 2.6.32.16 successfully. > > - Peter > 1. http://people.debian.org/~paravoid/kvm-noclock-3.tar.gz > -- > | .''`. ** Debian GNU/Linux ** > Peter Palfrader | : :' : The universal > http://www.palfrader.org/ | `. `' Operating System > | `- http://www.debian.org/ -- Gleb. ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-08 5:31 ` Gleb Natapov @ 2010-07-08 8:51 ` Peter Palfrader 2010-07-08 11:03 ` Gleb Natapov 0 siblings, 1 reply; 666+ messages in thread From: Peter Palfrader @ 2010-07-08 8:51 UTC (permalink / raw) To: Gleb Natapov Cc: Glauber Costa, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Zachary Amsden, Jeremy Fitzhardinge, Avi Kivity, Marcelo Tosatti On Thu, 08 Jul 2010, Gleb Natapov wrote: > > > And what if you provide -cpu qemu64,-kvmclock to qemu command line? > > > > Adding that to the glob of options that already were there from libvirt > > didn't disable it, but using an LD_PRELOAD wrapper[1] to that purpose on > > the host when starting kvm did help. > > > Strange. -kvmclock should have had the same effect. What qemu is it? > What is your command line? | QEMU PC emulator version 0.11.1 (qemu-kvm-0.11.1), Copyright (c) 2003-2008 Fabrice Bellard from the debian package qemu-kvm (0.11.1+dfsg-1~bpo50+1) /usr/bin/kvm -S -M pc-0.11 -enable-kvm -m 512 -smp 1 -name zoe -uuid 1885e784-c831-4ef8-9576-8eaa9abf3a8b -monitor unix:/var/lib/libvirt/qemu/zoe.monitor,server,nowait -boot c -drive file=/dev/vg_sookie_system/zoe-boot,if=ide,bus=0,unit=0,boot=on -drive file=/dev/vg_sookie_system/zoe-root,if=virtio -drive file=/dev/vg_sookie_system/zoe-swap,if=virtio -net nic,macaddr=00:16:36:40:00:0b,vlan=0,model=virtio,name=net0 -net tap,fd=25,vlan=0,name=hostnet0 -net nic,macaddr=00:16:36:40:05:0b,vlan=1,model=virtio,name=net1 -net tap,fd=28,vlan=1,name=hostnet1 -serial none -parallel none -usb -vnc 127.0.0.1:10 -vga cirrus -balloon virtio And I had added "-cpu qemu64,-kvmclock" to that at either the front or the end. Cheers, [should we trim the CC list? If yes, to what?] -- | .''`. ** Debian GNU/Linux ** Peter Palfrader | : :' : The universal http://www.palfrader.org/ | `. `' Operating System | `- http://www.debian.org/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-08 8:51 ` Peter Palfrader @ 2010-07-08 11:03 ` Gleb Natapov 0 siblings, 0 replies; 666+ messages in thread From: Gleb Natapov @ 2010-07-08 11:03 UTC (permalink / raw) To: Peter Palfrader, Glauber Costa, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Zachary Amsden, Jeremy Fitzhardinge, Avi Kivity, Marcelo Tosatti On Thu, Jul 08, 2010 at 10:51:14AM +0200, Peter Palfrader wrote: > On Thu, 08 Jul 2010, Gleb Natapov wrote: > > > > > And what if you provide -cpu qemu64,-kvmclock to qemu command line? > > > > > > Adding that to the glob of options that already were there from libvirt > > > didn't disable it, but using an LD_PRELOAD wrapper[1] to that purpose on > > > the host when starting kvm did help. > > > > > Strange. -kvmclock should have had the same effect. What qemu is it? > > What is your command line? > > | QEMU PC emulator version 0.11.1 (qemu-kvm-0.11.1), Copyright (c) 2003-2008 Fabrice Bellard > from the debian package qemu-kvm (0.11.1+dfsg-1~bpo50+1) That explain it. 0.11 is really old. Don't have this ability. > [should we trim the CC list? If yes, to what?] Better not to. -- Gleb. ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-07 14:33 ` Peter Palfrader 2010-07-07 15:15 ` Gleb Natapov @ 2010-07-07 18:15 ` Glauber Costa 2010-07-07 20:11 ` Zachary Amsden 1 sibling, 1 reply; 666+ messages in thread From: Glauber Costa @ 2010-07-07 18:15 UTC (permalink / raw) To: Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Zachary Amsden, Jeremy Fitzhardinge, Avi Kivity, Marcelo Tosatti On Wed, Jul 07, 2010 at 04:33:39PM +0200, Peter Palfrader wrote: > On Wed, 07 Jul 2010, Glauber Costa wrote: > > > > 2.6.32.16 fails to boot on my KVM domains using qemu-kvm 0.11.1. > > > > > > Bisecting between 2.6.32.14 which worked and .16 turned up this commit > > > as the first culprit[0]. > > > > > > The host is still running 2.6.32.14 and has 8 cores on 2 CPUs. The > > > single-cpu KVM domain hangs just after printing 'Write protecting the > > > kernel read-only data: 9492k'[1]. On a successful boot this line would > > > usually be followed by 'INIT: version 2.86 booting'. > > > > > > A 2.6.32.16 with this patch reverted boots fine. > > > > > > If there's any info you need please just ask. > > > if you boot with another clocksource, and then switch to kvmclock with the machine already > > running, do you see anything strange or suspicious? > > Booting with various clocksource=xxx kernel parameters does not change > the behaviour at all, i.e. the boot still hangs. wow, it is really weird then. that patch shouldn't affect anything outside the pvclock realm. ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-07 18:15 ` Glauber Costa @ 2010-07-07 20:11 ` Zachary Amsden 2010-07-07 21:08 ` Glauber Costa 0 siblings, 1 reply; 666+ messages in thread From: Zachary Amsden @ 2010-07-07 20:11 UTC (permalink / raw) To: Glauber Costa Cc: Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Jeremy Fitzhardinge, Avi Kivity, Marcelo Tosatti On 07/07/2010 08:15 AM, Glauber Costa wrote: > On Wed, Jul 07, 2010 at 04:33:39PM +0200, Peter Palfrader wrote: > >> On Wed, 07 Jul 2010, Glauber Costa wrote: >> >> >>>> 2.6.32.16 fails to boot on my KVM domains using qemu-kvm 0.11.1. >>>> >>>> Bisecting between 2.6.32.14 which worked and .16 turned up this commit >>>> as the first culprit[0]. >>>> >>>> The host is still running 2.6.32.14 and has 8 cores on 2 CPUs. The >>>> single-cpu KVM domain hangs just after printing 'Write protecting the >>>> kernel read-only data: 9492k'[1]. On a successful boot this line would >>>> usually be followed by 'INIT: version 2.86 booting'. >>>> >>>> A 2.6.32.16 with this patch reverted boots fine. >>>> >>>> If there's any info you need please just ask. >>>> >> >>> if you boot with another clocksource, and then switch to kvmclock with the machine already >>> running, do you see anything strange or suspicious? >>> >> Booting with various clocksource=xxx kernel parameters does not change >> the behaviour at all, i.e. the boot still hangs. >> > wow, it is really weird then. > > that patch shouldn't affect anything outside the pvclock realm. > Unless you added data which is mistakenly in read-only section, I can't see how it would affect anything either. Of course, you have changed the data and text size, it is possible this triggered another bug. What exact section does the per-cpu pvclock data fall into? It's read-only in the kernel, but writeable from the hypervisor. Also, did this patch arrive before or after the pvclock reboot bugfix? Because if the hypervisor is still writing the pvclock page, clocksource=xxx would not change that behavior without that fix. Zach ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-07 20:11 ` Zachary Amsden @ 2010-07-07 21:08 ` Glauber Costa 0 siblings, 0 replies; 666+ messages in thread From: Glauber Costa @ 2010-07-07 21:08 UTC (permalink / raw) To: Zachary Amsden Cc: Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Jeremy Fitzhardinge, Avi Kivity, Marcelo Tosatti On Wed, Jul 07, 2010 at 10:11:58AM -1000, Zachary Amsden wrote: > On 07/07/2010 08:15 AM, Glauber Costa wrote: > >On Wed, Jul 07, 2010 at 04:33:39PM +0200, Peter Palfrader wrote: > >>On Wed, 07 Jul 2010, Glauber Costa wrote: > >> > >>>>2.6.32.16 fails to boot on my KVM domains using qemu-kvm 0.11.1. > >>>> > >>>>Bisecting between 2.6.32.14 which worked and .16 turned up this commit > >>>>as the first culprit[0]. > >>>> > >>>>The host is still running 2.6.32.14 and has 8 cores on 2 CPUs. The > >>>>single-cpu KVM domain hangs just after printing 'Write protecting the > >>>>kernel read-only data: 9492k'[1]. On a successful boot this line would > >>>>usually be followed by 'INIT: version 2.86 booting'. > >>>> > >>>>A 2.6.32.16 with this patch reverted boots fine. > >>>> > >>>>If there's any info you need please just ask. > >>>if you boot with another clocksource, and then switch to kvmclock with the machine already > >>>running, do you see anything strange or suspicious? > >>Booting with various clocksource=xxx kernel parameters does not change > >>the behaviour at all, i.e. the boot still hangs. > >wow, it is really weird then. > > > >that patch shouldn't affect anything outside the pvclock realm. > > Unless you added data which is mistakenly in read-only section, I > can't see how it would affect anything either. Of course, you have > changed the data and text size, it is possible this triggered > another bug. Yes, but at least this patch alone, does not touch anything on that regard (or at least should not). > What exact section does the per-cpu pvclock data fall into? It's > read-only in the kernel, but writeable from the hypervisor. it is not explicitly marked read only in the kernel, afaik. we just trust the kernel not to use it. > > Also, did this patch arrive before or after the pvclock reboot > bugfix? Because if the hypervisor is still writing the pvclock > page, clocksource=xxx would not change that behavior without that > fix. Dunno in which order they got applied in stable. But from what I understood, this is not a reboot scenario. It happens on first boot, right? ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-07 12:47 ` Peter Palfrader 2010-07-07 13:51 ` Glauber Costa @ 2010-07-08 9:41 ` Avi Kivity 2010-07-13 10:23 ` Peter Palfrader 1 sibling, 1 reply; 666+ messages in thread From: Avi Kivity @ 2010-07-08 9:41 UTC (permalink / raw) To: Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti On 07/07/2010 03:47 PM, Peter Palfrader wrote: > Hey, > > Greg KH schrieb am Donnerstag, dem 01. Juli 2010: > > >> 2.6.32-stable review patch. If anyone has any objections, please let us know. >> > 2.6.32.16 fails to boot on my KVM domains using qemu-kvm 0.11.1. > > Bisecting between 2.6.32.14 which worked and .16 turned up this commit > as the first culprit[0]. > > The host is still running 2.6.32.14 and has 8 cores on 2 CPUs. The > single-cpu KVM domain hangs just after printing 'Write protecting the > kernel read-only data: 9492k'[1]. On a successful boot this line would > usually be followed by 'INIT: version 2.86 booting'. > > A 2.6.32.16 with this patch reverted boots fine. > > If there's any info you need please just ask. > I'm unable to reproduce. Can you provide the stack trace where this hangs? Add CONFIG_DEBUG_INFO, and then - copy vmlinux somewhere on the host filesystem - start the guest - when it hangs, type 'gdbserver' in the qemu monitor - on the host, the 'gdb /path/to/vmlinux' - 'target remote :1234' - 'backtrace' -- error compiling committee.c: too many arguments to function ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-08 9:41 ` Avi Kivity @ 2010-07-13 10:23 ` Peter Palfrader 2010-07-13 13:23 ` Avi Kivity 0 siblings, 1 reply; 666+ messages in thread From: Peter Palfrader @ 2010-07-13 10:23 UTC (permalink / raw) To: Avi Kivity Cc: Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti Sorry for the delay. On Thu, 08 Jul 2010, Avi Kivity wrote: > I'm unable to reproduce. > > Can you provide the stack trace where this hangs? Here goes: | (gdb) target remote :1234 | Remote debugging using :1234 | [New Thread 1] | 0xffffffff81702314 in _spin_lock (lock=0xffffffff81ab9e30) | at /scratch/kernel/2.6.32.16/arch/x86/include/asm/spinlock.h:65 | 65 /scratch/kernel/2.6.32.16/arch/x86/include/asm/spinlock.h: No such file or directory. | in /scratch/kernel/2.6.32.16/arch/x86/include/asm/spinlock.h | (gdb) bt | #0 0xffffffff81702314 in _spin_lock (lock=0xffffffff81ab9e30) | at /scratch/kernel/2.6.32.16/arch/x86/include/asm/spinlock.h:65 | #1 0xffffffff8107b214 in vprintk ( | fmt=0xffffffff818a3ee8 "<1>BUG: unable to handle kernel ", | args=0xffff88001f8f2c38) at kernel/printk.c:705 | #2 0xffffffff816ff387 in printk (fmt=0xffffffff81ab9e30 "") | at kernel/printk.c:595 | #3 0xffffffff8105b94a in no_context (regs=0xffff88001f8f2e98, error_code=3, | address=18446744071586262656) at arch/x86/mm/fault.c:583 | #4 0xffffffff8105bb65 in __bad_area_nosemaphore (regs=0xffff88001f8f2e98, | error_code=3, address=18446744071586262656, si_code=196609) | at arch/x86/mm/fault.c:741 | #5 0xffffffff8105bc4e in bad_area_nosemaphore (regs=0xffffffff81ab9e30, | error_code=18446612132843695160, address=4294892530) | at arch/x86/mm/fault.c:748 | #6 0xffffffff8105c02f in do_page_fault (regs=0xffff88001f8f2e98, error_code=3) | at arch/x86/mm/fault.c:1061 | #7 0xffffffff81702765 in page_fault () | #8 0x000d3496569e13a8 in ?? () | #9 0x00000000b4b2c8e7 in ?? () | #10 0x00000003ede5a5a5 in ?? () | #11 0x0000000000000001 in per_cpu__irq_stack_union () | #12 0xffff880001c11e80 in ?? () | ---Type <return> to continue, or q <return> to quit--- | #13 0x0000000000000000 in ?? () | (gdb) | (gdb) | (gdb) | (gdb) bt full | #0 0xffffffff81702314 in _spin_lock (lock=0xffffffff81ab9e30) | at /scratch/kernel/2.6.32.16/arch/x86/include/asm/spinlock.h:65 | No locals. | #1 0xffffffff8107b214 in vprintk ( | fmt=0xffffffff818a3ee8 "<1>BUG: unable to handle kernel ", | args=0xffff88001f8f2c38) at kernel/printk.c:705 | printed_len = 0 | current_log_level = 4 | flags = 70 | p = <value optimized out> | #2 0xffffffff816ff387 in printk (fmt=0xffffffff81ab9e30 "") | at kernel/printk.c:595 | args = {{gp_offset = 8, fp_offset = 48, | overflow_arg_area = 0xffff88001f8f2d18, | reg_save_area = 0xffff88001f8f2c58}} | r = 256 | #3 0xffffffff8105b94a in no_context (regs=0xffff88001f8f2e98, error_code=3, | address=18446744071586262656) at arch/x86/mm/fault.c:583 | tsk = (struct task_struct *) 0xffff88001f908000 | flags = 146 | sig = <value optimized out> | #4 0xffffffff8105bb65 in __bad_area_nosemaphore (regs=0xffff88001f8f2e98, | error_code=3, address=18446744071586262656, si_code=196609) | ---Type <return> to continue, or q <return> to quit--- | at arch/x86/mm/fault.c:741 | tsk = (struct task_struct *) 0xffff88001f908000 | #5 0xffffffff8105bc4e in bad_area_nosemaphore (regs=0xffffffff81ab9e30, | error_code=18446612132843695160, address=4294892530) | at arch/x86/mm/fault.c:748 | No locals. | #6 0xffffffff8105c02f in do_page_fault (regs=0xffff88001f8f2e98, error_code=3) | at arch/x86/mm/fault.c:1061 | vma = <value optimized out> | tsk = (struct task_struct *) 0xffff88001f908000 | address = 18446744071586262656 | mm = (struct mm_struct *) 0x0 | write = <value optimized out> | fault = 256 | #7 0xffffffff81702765 in page_fault () | No symbol table info available. | #8 0x000d3496569e13a8 in ?? () | No symbol table info available. | #9 0x00000000b4b2c8e7 in ?? () | No symbol table info available. | #10 0x00000003ede5a5a5 in ?? () | No symbol table info available. | #11 0x0000000000000001 in per_cpu__irq_stack_union () | ---Type <return> to continue, or q <return> to quit--- | No symbol table info available. | #12 0xffff880001c11e80 in ?? () | No symbol table info available. | #13 0x0000000000000000 in ?? () | No symbol table info available. | (gdb) quit So, I disabled PRINTK_TIME and tried again. This time I got: VFS: Mounted root (ext3 filesystem) readonly on device 253:0. Freeing unused kernel memory: 632k freed Write protecting the kernel read-only data: 9492k BUG: unable to handle kernel paging request at ffffffff81712e80 IP: [<ffffffff81054f73>] pvclock_clocksource_read+0x83/0xc0 PGD 1003067 PUD 1007063 PMD 7e8b1063 PTE 8000000001712161 Oops: 0003 [#1] SMP last sysfs file: CPU 0 Pid: 1, comm: swapper Not tainted 2.6.32.16-dsa-amd64 #2 RIP: 0010:[<ffffffff81054f73>] [<ffffffff81054f73>] pvclock_clocksource_read+0x83/0xc0 RSP: 0018:ffff88007fb47880 EFLAGS: 00010283 RAX: 000d362a57085b85 RBX: ffff880001c11e80 RCX: 000d362a573c6400 RDX: 000d362a57085b85 RSI: 000000000001c410 RDI: ffff880001c11e80 RBP: ffff88007fb478c0 R08: 000000000001a9f2 R09: 6db6db6db6db6db7 R10: ffff88007f15a0a0 R11: ffff88007f15a040 R12: 0000000000000001 R13: 0000001112bb6a47 R14: 00000000b4b2c8e7 R15: 000d362a573c2e34 FS: 0000000000000000(0000) GS:ffff880001c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: ffffffff81712e80 CR3: 0000000001001000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process swapper (pid: 1, threadinfo ffff88007fb46000, task ffff88007fb50000) Stack: ffff88007fb47900 ffffffff0001a9f2 ffff88007e884150 ffffffff81975c00 <0> 00000000000001b6 ffffffffb3c3c368 ffff88007fb29078 0000000000000000 <0> ffff88007fb478d0 ffffffff8105423c ffff88007fb478e0 ffffffff81054249 Call Trace: [<ffffffff8105423c>] kvm_clock_read+0x1c/0x20 [<ffffffff81054249>] kvm_clock_get_cycles+0x9/0x10 [<ffffffff81099101>] ktime_get_ts+0x71/0xe0 [<ffffffff810add4d>] __delayacct_blkio_start+0x1d/0x20 [<ffffffff8170032a>] io_schedule+0x5a/0xd0 [<ffffffff81117bdd>] sync_buffer+0x3d/0x50 [<ffffffff817008ca>] __wait_on_bit+0x5a/0x90 [<ffffffff81117ba0>] ? sync_buffer+0x0/0x50 [<ffffffff81117ba0>] ? sync_buffer+0x0/0x50 [<ffffffff81700974>] out_of_line_wait_on_bit+0x74/0x90 [<ffffffff81090b30>] ? wake_bit_function+0x0/0x40 [<ffffffff81117b46>] __wait_on_buffer+0x26/0x30 [<ffffffff8116331d>] ext3_find_entry+0x19d/0x6b0 [<ffffffff81060e90>] ? do_flush_tlb_all+0x0/0x70 [<ffffffff8116418d>] ext3_lookup+0x4d/0x130 [<ffffffff81105203>] ? d_alloc+0x123/0x1b0 [<ffffffff810f9fe6>] do_lookup+0x206/0x260 [<ffffffff810fbe6b>] __link_path_walk+0x19b/0x1000 [<ffffffff81060eb8>] ? do_flush_tlb_all+0x28/0x70 [<ffffffff8107fece>] ? on_each_cpu+0x2e/0x50 [<ffffffff810fcf5e>] path_walk+0x6e/0xe0 [<ffffffff810fd0eb>] do_path_lookup+0x5b/0x60 [<ffffffff810fe015>] do_filp_open+0xf5/0xb10 [<ffffffff810a4026>] ? smp_call_function_many+0x1e6/0x230 [<ffffffff8105cad0>] ? __cpa_flush_range+0x0/0x30 [<ffffffff8105caf5>] ? __cpa_flush_range+0x25/0x30 [<ffffffff8105db73>] ? change_page_attr_set_clr+0x273/0x410 [<ffffffff81108a5a>] ? alloc_fd+0x4a/0x140 [<ffffffff810eed7f>] do_sys_open+0x7f/0x140 [<ffffffff810eee6b>] sys_open+0x1b/0x20 [<ffffffff810091ef>] init_post+0x3f/0x1b0 [<ffffffff81a106e5>] kernel_init+0x1a2/0x1ba [<ffffffff810373ca>] child_rip+0xa/0x20 [<ffffffff81a10543>] ? kernel_init+0x0/0x1ba [<ffffffff810373c0>] ? child_rip+0x0/0x20 Code: 78 4f 44 89 e1 48 d3 e0 44 89 f2 48 f7 e2 48 0f ac d0 20 4a 8d 0c 38 44 39 03 75 a4 48 8b 15 15 df 6b 00 48 39 ca 77 17 48 89 d0 <f0> 48 0f b1 0d 04 df 6b 00 48 39 c1 48 89 c2 75 e7 48 89 ca 48 RIP [<ffffffff81054f73>] pvclock_clocksource_read+0x83/0xc0 RSP <ffff88007fb47880> CR2: ffffffff81712e80 ---[ end trace 38f25e02ae34d4c1 ]--- BUG: unable to handle kernel paging request at ffffffff81712e80 IP: [<ffffffff81054f73>] pvclock_clocksource_read+0x83/0xc0 PGD 1003067 PUD 1007063 PMD 7e8b1063 PTE 8000000001712161 Oops: 0003 [#2] SMP last sysfs file: CPU 0 Pid: 1, comm: swapper Tainted: G D 2.6.32.16-dsa-amd64 #2 RIP: 0010:[<ffffffff81054f73>] [<ffffffff81054f73>] pvclock_clocksource_read+0x83/0xc0 RSP: 0018:ffff880001c03e78 EFLAGS: 00010097 RAX: 000d362a57085b85 RBX: ffff880001c11e80 RCX: 000d362a5b7e8c49 RDX: 000d362a57085b85 RSI: 0000000000000000 RDI: ffff880001c11e80 RBP: ffff880001c03eb8 R08: 000000000001e50c R09: 0000000000000001 R10: ffffffff81ac2360 R11: 0000000000000021 R12: 0000000000000001 R13: 000000111eca7f9f R14: 00000000b4b2c8e7 R15: 000d362a5b7dc64c FS: 0000000000000000(0000) GS:ffff880001c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: ffffffff81712e80 CR3: 0000000001001000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process swapper (pid: 1, threadinfo ffff88007fb46000, task ffff88007fb50000) Stack: 0000000000000282 000000000001e50c 0000000000000001 ffffffff81975c00 <0> 0000000000000000 0000000023493c1b 00000000000001b6 0000000000000000 <0> ffff880001c03ec8 ffffffff8105423c ffff880001c03ed8 ffffffff81054249 Call Trace: <IRQ> [<ffffffff8105423c>] kvm_clock_read+0x1c/0x20 [<ffffffff81054249>] kvm_clock_get_cycles+0x9/0x10 [<ffffffff810991da>] ktime_get+0x6a/0xf0 [<ffffffff81093cd4>] hrtimer_interrupt+0x54/0x1f0 [<ffffffff810374cc>] ? call_softirq+0x1c/0x30 [<ffffffff8104e138>] smp_apic_timer_interrupt+0x68/0xa0 [<ffffffff81036eb3>] apic_timer_interrupt+0x13/0x20 <EOI> [<ffffffff810a5bb4>] ? acct_collect+0x164/0x1b0 [<ffffffff810a5af5>] ? acct_collect+0xa5/0x1b0 [<ffffffff8107e5bc>] ? do_exit+0x6ec/0x7a0 [<ffffffff8103a943>] ? oops_end+0xa3/0xb0 [<ffffffff8105b8a8>] ? no_context+0xe8/0x260 [<ffffffff810c442d>] ? zone_statistics+0x7d/0xa0 [<ffffffff8105bb65>] ? __bad_area_nosemaphore+0x145/0x220 [<ffffffff810b2a01>] ? mempool_alloc_slab+0x11/0x20 [<ffffffff810b2b30>] ? mempool_alloc+0x60/0x130 [<ffffffff8105bc4e>] ? bad_area_nosemaphore+0xe/0x10 [<ffffffff8105c02f>] ? do_page_fault+0x1cf/0x280 [<ffffffff81702765>] ? page_fault+0x25/0x30 [<ffffffff81054f73>] ? pvclock_clocksource_read+0x83/0xc0 [<ffffffff8105423c>] ? kvm_clock_read+0x1c/0x20 [<ffffffff81054249>] ? kvm_clock_get_cycles+0x9/0x10 [<ffffffff81099101>] ? ktime_get_ts+0x71/0xe0 [<ffffffff810add4d>] ? __delayacct_blkio_start+0x1d/0x20 [<ffffffff8170032a>] ? io_schedule+0x5a/0xd0 [<ffffffff81117bdd>] ? sync_buffer+0x3d/0x50 [<ffffffff817008ca>] ? __wait_on_bit+0x5a/0x90 [<ffffffff81117ba0>] ? sync_buffer+0x0/0x50 [<ffffffff81117ba0>] ? sync_buffer+0x0/0x50 [<ffffffff81700974>] ? out_of_line_wait_on_bit+0x74/0x90 [<ffffffff81090b30>] ? wake_bit_function+0x0/0x40 [<ffffffff81117b46>] ? __wait_on_buffer+0x26/0x30 [<ffffffff8116331d>] ? ext3_find_entry+0x19d/0x6b0 [<ffffffff81060e90>] ? do_flush_tlb_all+0x0/0x70 [<ffffffff8116418d>] ? ext3_lookup+0x4d/0x130 [<ffffffff81105203>] ? d_alloc+0x123/0x1b0 [<ffffffff810f9fe6>] ? do_lookup+0x206/0x260 [<ffffffff810fbe6b>] ? __link_path_walk+0x19b/0x1000 [<ffffffff81060eb8>] ? do_flush_tlb_all+0x28/0x70 [<ffffffff8107fece>] ? on_each_cpu+0x2e/0x50 [<ffffffff810fcf5e>] ? path_walk+0x6e/0xe0 [<ffffffff810fd0eb>] ? do_path_lookup+0x5b/0x60 [<ffffffff810fe015>] ? do_filp_open+0xf5/0xb10 [<ffffffff810a4026>] ? smp_call_function_many+0x1e6/0x230 [<ffffffff8105cad0>] ? __cpa_flush_range+0x0/0x30 [<ffffffff8105caf5>] ? __cpa_flush_range+0x25/0x30 [<ffffffff8105db73>] ? change_page_attr_set_clr+0x273/0x410 [<ffffffff81108a5a>] ? alloc_fd+0x4a/0x140 [<ffffffff810eed7f>] ? do_sys_open+0x7f/0x140 [<ffffffff810eee6b>] ? sys_open+0x1b/0x20 [<ffffffff810091ef>] ? init_post+0x3f/0x1b0 [<ffffffff81a106e5>] ? kernel_init+0x1a2/0x1ba [<ffffffff810373ca>] ? child_rip+0xa/0x20 [<ffffffff81a10543>] ? kernel_init+0x0/0x1ba [<ffffffff810373c0>] ? child_rip+0x0/0x20 Code: 78 4f 44 89 e1 48 d3 e0 44 89 f2 48 f7 e2 48 0f ac d0 20 4a 8d 0c 38 44 39 03 75 a4 48 8b 15 15 df 6b 00 48 39 ca 77 17 48 89 d0 <f0> 48 0f b1 0d 04 df 6b 00 48 39 c1 48 89 c2 75 e7 48 89 ca 48 RIP [<ffffffff81054f73>] pvclock_clocksource_read+0x83/0xc0 RSP <ffff880001c03e78> CR2: ffffffff81712e80 ---[ end trace 38f25e02ae34d4c2 ]--- Kernel panic - not syncing: Fatal exception in interrupt Pid: 1, comm: swapper Tainted: G D 2.6.32.16-dsa-amd64 #2 Call Trace: <IRQ> [<ffffffff816ff24f>] panic+0xa0/0x171 [<ffffffff81095095>] ? up+0x35/0x50 [<ffffffff8107ae7d>] ? release_console_sem+0x1cd/0x220 [<ffffffff8107b155>] ? console_unblank+0x75/0x90 [<ffffffff8103a93b>] oops_end+0x9b/0xb0 [<ffffffff8105b8a8>] no_context+0xe8/0x260 [<ffffffff8105bb65>] __bad_area_nosemaphore+0x145/0x220 [<ffffffff810b2a22>] ? mempool_free_slab+0x12/0x20 [<ffffffff810b2aba>] ? mempool_free+0x8a/0xa0 [<ffffffff813ec9cb>] ? mix_pool_bytes_extract+0x14b/0x160 [<ffffffff8105bc4e>] bad_area_nosemaphore+0xe/0x10 [<ffffffff8105c02f>] do_page_fault+0x1cf/0x280 [<ffffffff81702765>] page_fault+0x25/0x30 [<ffffffff81054f73>] ? pvclock_clocksource_read+0x83/0xc0 [<ffffffff81054f3e>] ? pvclock_clocksource_read+0x4e/0xc0 [<ffffffff8105423c>] kvm_clock_read+0x1c/0x20 [<ffffffff81054249>] kvm_clock_get_cycles+0x9/0x10 [<ffffffff810991da>] ktime_get+0x6a/0xf0 [<ffffffff81093cd4>] hrtimer_interrupt+0x54/0x1f0 [<ffffffff810374cc>] ? call_softirq+0x1c/0x30 [<ffffffff8104e138>] smp_apic_timer_interrupt+0x68/0xa0 [<ffffffff81036eb3>] apic_timer_interrupt+0x13/0x20 <EOI> [<ffffffff810a5bb4>] ? acct_collect+0x164/0x1b0 [<ffffffff810a5af5>] ? acct_collect+0xa5/0x1b0 [<ffffffff8107e5bc>] ? do_exit+0x6ec/0x7a0 [<ffffffff8103a943>] ? oops_end+0xa3/0xb0 [<ffffffff8105b8a8>] ? no_context+0xe8/0x260 [<ffffffff810c442d>] ? zone_statistics+0x7d/0xa0 [<ffffffff8105bb65>] ? __bad_area_nosemaphore+0x145/0x220 [<ffffffff810b2a01>] ? mempool_alloc_slab+0x11/0x20 [<ffffffff810b2b30>] ? mempool_alloc+0x60/0x130 [<ffffffff8105bc4e>] ? bad_area_nosemaphore+0xe/0x10 [<ffffffff8105c02f>] ? do_page_fault+0x1cf/0x280 [<ffffffff81702765>] ? page_fault+0x25/0x30 [<ffffffff81054f73>] ? pvclock_clocksource_read+0x83/0xc0 [<ffffffff8105423c>] ? kvm_clock_read+0x1c/0x20 [<ffffffff81054249>] ? kvm_clock_get_cycles+0x9/0x10 [<ffffffff81099101>] ? ktime_get_ts+0x71/0xe0 [<ffffffff810add4d>] ? __delayacct_blkio_start+0x1d/0x20 [<ffffffff8170032a>] ? io_schedule+0x5a/0xd0 [<ffffffff81117bdd>] ? sync_buffer+0x3d/0x50 [<ffffffff817008ca>] ? __wait_on_bit+0x5a/0x90 [<ffffffff81117ba0>] ? sync_buffer+0x0/0x50 [<ffffffff81117ba0>] ? sync_buffer+0x0/0x50 [<ffffffff81700974>] ? out_of_line_wait_on_bit+0x74/0x90 [<ffffffff81090b30>] ? wake_bit_function+0x0/0x40 [<ffffffff81117b46>] ? __wait_on_buffer+0x26/0x30 [<ffffffff8116331d>] ? ext3_find_entry+0x19d/0x6b0 [<ffffffff81060e90>] ? do_flush_tlb_all+0x0/0x70 [<ffffffff8116418d>] ? ext3_lookup+0x4d/0x130 [<ffffffff81105203>] ? d_alloc+0x123/0x1b0 [<ffffffff810f9fe6>] ? do_lookup+0x206/0x260 [<ffffffff810fbe6b>] ? __link_path_walk+0x19b/0x1000 [<ffffffff81060eb8>] ? do_flush_tlb_all+0x28/0x70 [<ffffffff8107fece>] ? on_each_cpu+0x2e/0x50 [<ffffffff810fcf5e>] ? path_walk+0x6e/0xe0 [<ffffffff810fd0eb>] ? do_path_lookup+0x5b/0x60 [<ffffffff810fe015>] ? do_filp_open+0xf5/0xb10 [<ffffffff810a4026>] ? smp_call_function_many+0x1e6/0x230 [<ffffffff8105cad0>] ? __cpa_flush_range+0x0/0x30 [<ffffffff8105caf5>] ? __cpa_flush_range+0x25/0x30 [<ffffffff8105db73>] ? change_page_attr_set_clr+0x273/0x410 [<ffffffff81108a5a>] ? alloc_fd+0x4a/0x140 [<ffffffff810eed7f>] ? do_sys_open+0x7f/0x140 [<ffffffff810eee6b>] ? sys_open+0x1b/0x20 [<ffffffff810091ef>] ? init_post+0x3f/0x1b0 [<ffffffff81a106e5>] ? kernel_init+0x1a2/0x1ba [<ffffffff810373ca>] ? child_rip+0xa/0x20 [<ffffffff81a10543>] ? kernel_init+0x0/0x1ba [<ffffffff810373c0>] ? child_rip+0x0/0x20 [Also available at http://asteria.noreply.org/~weasel/volatile/2010-07-13-CQL4Lj0xCNo/typescript.zoe.kvmclock.panic ] -- | .''`. ** Debian GNU/Linux ** Peter Palfrader | : :' : The universal http://www.palfrader.org/ | `. `' Operating System | `- http://www.debian.org/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 10:23 ` Peter Palfrader @ 2010-07-13 13:23 ` Avi Kivity 2010-07-13 14:19 ` Peter Palfrader 0 siblings, 1 reply; 666+ messages in thread From: Avi Kivity @ 2010-07-13 13:23 UTC (permalink / raw) To: Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti On 07/13/2010 01:23 PM, Peter Palfrader wrote: > Sorry for the delay. > A good trace is worth it. > [<ffffffff810373c0>] ? child_rip+0x0/0x20 > Code: 78 4f 44 89 e1 48 d3 e0 44 89 f2 48 f7 e2 48 0f ac d0 20 4a 8d 0c 38 44 39 03 75 a4 48 8b 15 15 df 6b 00 48 39 ca 77 17 48 89 d0<f0> 48 0f b1 0d 04 df 6b 00 48 39 c1 48 89 c2 75 e7 48 89 ca 48 > RIP [<ffffffff81054f73>] pvclock_clocksource_read+0x83/0xc0 > RSP<ffff88007fb47880> > CR2: ffffffff81712e80 > ---[ end trace 38f25e02ae34d4c1 ]--- > BUG: unable to handle kernel paging request at ffffffff81712e80 > IP: [<ffffffff81054f73>] pvclock_clocksource_read+0x83/0xc0 > PGD 1003067 PUD 1007063 PMD 7e8b1063 PTE 8000000001712161 > Read-only pte > Oops: 0003 [#2] SMP > Write fault. > Code: 78 4f 44 89 e1 48 d3 e0 44 89 f2 48 f7 e2 48 0f ac d0 20 4a 8d 0c 38 44 39 03 75 a4 48 8b 15 15 df 6b 00 48 39 ca 77 17 48 89 d0<f0> 48 0f b1 0d 04 df 6b 00 48 39 c1 48 89 c2 75 e7 48 89 ca 48 > RIP [<ffffffff81054f73>] pvclock_clocksource_read+0x83/0xc0 > --> lock cmpxchg %rcx,0x6bdf04(%rip) > static atomic64_t last_value = ATOMIC64_INIT(0); > > cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src) > { > [...] > last = atomic64_read(&last_value); > do { > if (ret < last) > return last; > last = atomic64_cmpxchg(&last_value, last, ret); > } while (unlikely(last != ret)); > > return ret; > } So it looks like last_value was placed in a read only section. Please post your System.map somewhere. -- error compiling committee.c: too many arguments to function ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 13:23 ` Avi Kivity @ 2010-07-13 14:19 ` Peter Palfrader 2010-07-13 15:57 ` Avi Kivity 0 siblings, 1 reply; 666+ messages in thread From: Peter Palfrader @ 2010-07-13 14:19 UTC (permalink / raw) To: Avi Kivity Cc: Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti On Tue, 13 Jul 2010, Avi Kivity wrote: >> BUG: unable to handle kernel paging request at ffffffff81712e80 >> IP: [<ffffffff81054f73>] pvclock_clocksource_read+0x83/0xc0 >> PGD 1003067 PUD 1007063 PMD 7e8b1063 PTE 8000000001712161 > Read-only pte >> Oops: 0003 [#2] SMP > Write fault. >> Code: 78 4f 44 89 e1 48 d3 e0 44 89 f2 48 f7 e2 48 0f ac d0 20 4a 8d 0c 38 44 39 03 75 a4 48 8b 15 15 df 6b 00 48 39 ca 77 17 48 89 d0<f0> 48 0f b1 0d 04 df 6b 00 48 39 c1 48 89 c2 75 e7 48 89 ca 48 >> RIP [<ffffffff81054f73>] pvclock_clocksource_read+0x83/0xc0 > --> lock cmpxchg %rcx,0x6bdf04(%rip) >> static atomic64_t last_value = ATOMIC64_INIT(0); >> >> cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src) >> last = atomic64_cmpxchg(&last_value, last, ret); > So it looks like last_value was placed in a read only section. Please > post your System.map somewhere. weasel@intrepid:~$ publish System.map http://asteria.noreply.org/~weasel/volatile/2010-07-13-mbm2xEdd8Q4/System.map weasel@intrepid:~$ grep -i last_value System.map ffffffff81712e80 r last_value ffffffff81b05240 b last_value.26163 Cheers, Peter -- | .''`. ** Debian GNU/Linux ** Peter Palfrader | : :' : The universal http://www.palfrader.org/ | `. `' Operating System | `- http://www.debian.org/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 14:19 ` Peter Palfrader @ 2010-07-13 15:57 ` Avi Kivity 2010-07-13 16:22 ` Peter Palfrader 2010-07-13 16:34 ` Linus Torvalds 0 siblings, 2 replies; 666+ messages in thread From: Avi Kivity @ 2010-07-13 15:57 UTC (permalink / raw) To: Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti On 07/13/2010 05:19 PM, Peter Palfrader wrote: > >> So it looks like last_value was placed in a read only section. Please >> post your System.map somewhere. >> > weasel@intrepid:~$ publish System.map > http://asteria.noreply.org/~weasel/volatile/2010-07-13-mbm2xEdd8Q4/System.map > weasel@intrepid:~$ grep -i last_value System.map > ffffffff81712e80 r last_value > ffffffff81b05240 b last_value.26163 > "r" = "read only" How does it look in 'nm arch/x86/kernel/pvclock.o'? ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 15:57 ` Avi Kivity @ 2010-07-13 16:22 ` Peter Palfrader 2010-07-13 16:34 ` Avi Kivity 2010-07-13 16:34 ` Linus Torvalds 1 sibling, 1 reply; 666+ messages in thread From: Peter Palfrader @ 2010-07-13 16:22 UTC (permalink / raw) To: Avi Kivity Cc: Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti On Tue, 13 Jul 2010, Avi Kivity wrote: >>> So it looks like last_value was placed in a read only section. Please >>> post your System.map somewhere. >>> >> weasel@intrepid:~$ publish System.map >> http://asteria.noreply.org/~weasel/volatile/2010-07-13-mbm2xEdd8Q4/System.map >> weasel@intrepid:~$ grep -i last_value System.map >> ffffffff81712e80 r last_value >> ffffffff81b05240 b last_value.26163 >> > > "r" = "read only" > > How does it look in 'nm arch/x86/kernel/pvclock.o'? The same: [git|v2.6.32.16] weasel@thelma:/scratch/kernel/2.6.32.16$ nm arch/x86/kernel/pvclock.o 0000000000000000 r last_value U native_read_tsc 0000000000000040 T pvclock_clocksource_read 0000000000000100 T pvclock_read_wallclock 0000000000000000 T pvclock_tsc_khz U set_normalized_timespec -- | .''`. ** Debian GNU/Linux ** Peter Palfrader | : :' : The universal http://www.palfrader.org/ | `. `' Operating System | `- http://www.debian.org/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 16:22 ` Peter Palfrader @ 2010-07-13 16:34 ` Avi Kivity 2010-07-13 16:40 ` Avi Kivity 2010-07-13 16:53 ` Peter Palfrader 0 siblings, 2 replies; 666+ messages in thread From: Avi Kivity @ 2010-07-13 16:34 UTC (permalink / raw) To: Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti On 07/13/2010 07:22 PM, Peter Palfrader wrote: >>> >>> weasel@intrepid:~$ publish System.map >>> http://asteria.noreply.org/~weasel/volatile/2010-07-13-mbm2xEdd8Q4/System.map >>> weasel@intrepid:~$ grep -i last_value System.map >>> ffffffff81712e80 r last_value >>> ffffffff81b05240 b last_value.26163 >>> >>> >> "r" = "read only" >> >> How does it look in 'nm arch/x86/kernel/pvclock.o'? >> > The same: > > [git|v2.6.32.16] weasel@thelma:/scratch/kernel/2.6.32.16$ nm arch/x86/kernel/pvclock.o > 0000000000000000 r last_value > U native_read_tsc > 0000000000000040 T pvclock_clocksource_read > 0000000000000100 T pvclock_read_wallclock > 0000000000000000 T pvclock_tsc_khz > U set_normalized_timespec > But it's > > static atomic64_t last_value = ATOMIC64_INIT(0); > Doesn't make any sense. Let's try to see if the toolchain is confused: - rename last_value to some random name - drop the 'static' qualifier - drop the '= ATOMIC64_INIT(0)' - all of the above (better start with the last). No need to rebuild everything, just look at the output of nm pvclock.o. My bet is that dropping 'static' will fix it. We may have the wrong constraints on atomic64_cmpxchg64(), so the compiler thinks we never change last_value. -- error compiling committee.c: too many arguments to function ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 16:34 ` Avi Kivity @ 2010-07-13 16:40 ` Avi Kivity 2010-07-13 16:45 ` Avi Kivity 2010-07-13 16:53 ` Peter Palfrader 1 sibling, 1 reply; 666+ messages in thread From: Avi Kivity @ 2010-07-13 16:40 UTC (permalink / raw) To: Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti On 07/13/2010 07:34 PM, Avi Kivity wrote: > > My bet is that dropping 'static' will fix it. We may have the wrong > constraints on atomic64_cmpxchg64(), so the compiler thinks we never > change last_value. > The constraints are there, but maybe the toolchain is confused. -- error compiling committee.c: too many arguments to function ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 16:40 ` Avi Kivity @ 2010-07-13 16:45 ` Avi Kivity 2010-07-13 17:25 ` Peter Palfrader 0 siblings, 1 reply; 666+ messages in thread From: Avi Kivity @ 2010-07-13 16:45 UTC (permalink / raw) To: Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti On 07/13/2010 07:40 PM, Avi Kivity wrote: > On 07/13/2010 07:34 PM, Avi Kivity wrote: >> >> My bet is that dropping 'static' will fix it. We may have the wrong >> constraints on atomic64_cmpxchg64(), so the compiler thinks we never >> change last_value. >> > > The constraints are there, but maybe the toolchain is confused. > No they aren't, as Linus just pointed out. His patch should fix the problem. -- error compiling committee.c: too many arguments to function ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 16:45 ` Avi Kivity @ 2010-07-13 17:25 ` Peter Palfrader 2010-07-13 17:50 ` Linus Torvalds 0 siblings, 1 reply; 666+ messages in thread From: Peter Palfrader @ 2010-07-13 17:25 UTC (permalink / raw) To: Avi Kivity Cc: Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti On Tue, 13 Jul 2010, Avi Kivity wrote: > On 07/13/2010 07:40 PM, Avi Kivity wrote: >> On 07/13/2010 07:34 PM, Avi Kivity wrote: >>> >>> My bet is that dropping 'static' will fix it. We may have the wrong >>> constraints on atomic64_cmpxchg64(), so the compiler thinks we never >>> change last_value. >>> >> >> The constraints are there, but maybe the toolchain is confused. >> > > No they aren't, as Linus just pointed out. His patch should fix the > problem. Linus's patch touches __xchg() whereas we're using __cmpxchg() in this particular case I think. At least, applying it to my 2.6.32.16 tree didn't help, last_value was still read-only. Or I backported it wrong. -- | .''`. ** Debian GNU/Linux ** Peter Palfrader | : :' : The universal http://www.palfrader.org/ | `. `' Operating System | `- http://www.debian.org/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 17:25 ` Peter Palfrader @ 2010-07-13 17:50 ` Linus Torvalds 2010-07-13 17:59 ` Linus Torvalds 0 siblings, 1 reply; 666+ messages in thread From: Linus Torvalds @ 2010-07-13 17:50 UTC (permalink / raw) To: Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti [-- Attachment #1: Type: text/plain, Size: 560 bytes --] On Tue, Jul 13, 2010 at 10:25 AM, Peter Palfrader <peter@palfrader.org> wrote: > > Linus's patch touches __xchg() whereas we're using __cmpxchg() in this > particular case I think. > > At least, applying it to my 2.6.32.16 tree didn't help, last_value was > still read-only. Or I backported it wrong. No, you didn't back-port it wrong. I just didn't fix the right part. I thought the PV code used xchg, not cmpxchg, so I only patched that. But cmpxchg has the exact same issue. Does this fix it? Again: UNTESTED. Linus [-- Attachment #2: diff --] [-- Type: application/octet-stream, Size: 1738 bytes --] arch/x86/include/asm/cmpxchg_64.h | 28 ++++++++++++---------------- 1 files changed, 12 insertions(+), 16 deletions(-) diff --git a/arch/x86/include/asm/cmpxchg_64.h b/arch/x86/include/asm/cmpxchg_64.h index 485ae41..f6face7 100644 --- a/arch/x86/include/asm/cmpxchg_64.h +++ b/arch/x86/include/asm/cmpxchg_64.h @@ -71,28 +71,24 @@ extern void __cmpxchg_wrong_size(void); __typeof__(*(ptr)) __new = (new); \ switch (size) { \ case 1: \ - asm volatile(lock "cmpxchgb %b1,%2" \ - : "=a"(__ret) \ - : "q"(__new), "m"(*__xg(ptr)), "0"(__old) \ - : "memory"); \ + asm volatile(lock "cmpxchgb %b2,%1" \ + : "=a"(__ret), "+m" (*ptr) \ + : "q"(__new), "0"(__old)); \ break; \ case 2: \ - asm volatile(lock "cmpxchgw %w1,%2" \ - : "=a"(__ret) \ - : "r"(__new), "m"(*__xg(ptr)), "0"(__old) \ - : "memory"); \ + asm volatile(lock "cmpxchgw %w2,%1" \ + : "=a"(__ret), "+m" (*ptr) \ + : "r"(__new), "0"(__old)); \ break; \ case 4: \ - asm volatile(lock "cmpxchgl %k1,%2" \ - : "=a"(__ret) \ - : "r"(__new), "m"(*__xg(ptr)), "0"(__old) \ - : "memory"); \ + asm volatile(lock "cmpxchgl %k2,%1" \ + : "=a"(__ret), "+m" (*ptr) \ + : "r"(__new), "0"(__old)); \ break; \ case 8: \ - asm volatile(lock "cmpxchgq %1,%2" \ - : "=a"(__ret) \ - : "r"(__new), "m"(*__xg(ptr)), "0"(__old) \ - : "memory"); \ + asm volatile(lock "cmpxchgq %2,%1" \ + : "=a"(__ret), "+m" (*ptr) \ + : "r"(__new), "0"(__old)); \ break; \ default: \ __cmpxchg_wrong_size(); \ ^ permalink raw reply related [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 17:50 ` Linus Torvalds @ 2010-07-13 17:59 ` Linus Torvalds 2010-07-13 18:21 ` Jeremy Fitzhardinge 2010-07-13 18:23 ` Peter Palfrader 0 siblings, 2 replies; 666+ messages in thread From: Linus Torvalds @ 2010-07-13 17:59 UTC (permalink / raw) To: Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti On Tue, Jul 13, 2010 at 10:50 AM, Linus Torvalds <torvalds@linux-foundation.org> wrote: > > No, you didn't back-port it wrong. I just didn't fix the right part. I > thought the PV code used xchg, not cmpxchg, so I only patched that. > But cmpxchg has the exact same issue. > > Does this fix it? Btw, this second patch was a bit more aggressive than the first one, and actually removes the "memory" clobber entirely, and the fake cast of the target type. That shouldn't matter _except_ if people actually use cmpxchg to implement their own locking, since now the compiler could potentially move unrelated memory references around the lock. Of course, if you use cmpxchg to implement your own locking, you're probably doing something wrong anyway (ie you'll get the wrong memory barriers on various architectures), so it should all be fine. But I thought I'd mention it. And I don't really know how much gcc moves memory accesses around a "asm volatile" - the gcc docs are historically very vague ("volatile asms aren't moved around 'significantly'", whatever 'significant' means) And btw, none of the above should be taken to mean that I have tested the patch or found it to be otherwise good. It might be totally broken for other reasons. Caveat emptor. Linus ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 17:59 ` Linus Torvalds @ 2010-07-13 18:21 ` Jeremy Fitzhardinge 2010-07-13 22:14 ` H. Peter Anvin 2010-07-13 18:23 ` Peter Palfrader 1 sibling, 1 reply; 666+ messages in thread From: Jeremy Fitzhardinge @ 2010-07-13 18:21 UTC (permalink / raw) To: Linus Torvalds Cc: Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/13/2010 10:59 AM, Linus Torvalds wrote: > Btw, this second patch was a bit more aggressive than the first one, > and actually removes the "memory" clobber entirely, and the fake cast > of the target type. > > That shouldn't matter _except_ if people actually use cmpxchg to > implement their own locking, since now the compiler could potentially > move unrelated memory references around the lock. Of course, if you > use cmpxchg to implement your own locking, you're probably doing > something wrong anyway (ie you'll get the wrong memory barriers on > various architectures), so it should all be fine. > There are some places which rely on xchg/cmpxchg being a barrier in arch-specific code. For example, the Xen code uses as part of the shared memory protocol with the hypervisor. > But I thought I'd mention it. And I don't really know how much gcc > moves memory accesses around a "asm volatile" - the gcc docs are > historically very vague ("volatile asms aren't moved around > 'significantly'", whatever 'significant' means) > "asm volatile"'s only real meaning is that it will not get elided if it appears its output is unused (assuming it is reachable at all). I don't think you can consider it having any meaningful effects on ordering. J ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 18:21 ` Jeremy Fitzhardinge @ 2010-07-13 22:14 ` H. Peter Anvin 2010-07-13 23:49 ` Jeremy Fitzhardinge 0 siblings, 1 reply; 666+ messages in thread From: H. Peter Anvin @ 2010-07-13 22:14 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/13/2010 11:21 AM, Jeremy Fitzhardinge wrote: > > "asm volatile"'s only real meaning is that it will not get elided if it > appears its output is unused (assuming it is reachable at all). I don't > think you can consider it having any meaningful effects on ordering. > Actually, I believe volatile operations (including asm volatile) are strictly ordered *with respect to other volatile operations*. As such I would think we'd want to keep the "memory" clobber here, to make it strictly ordered with regards to *all* memory operations. As for the concept in this patch, it's obviously the right thing, but as Linus said elsewhere it's incomplete. Conceptually: Acked-by: H. Peter Anvin <hpa@zytor.com> Unfortunately I can't write the productization patch right now since I have a plane to catch in about an hour, but if noone beats me to it I'll to it Thursday. -hpa ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 22:14 ` H. Peter Anvin @ 2010-07-13 23:49 ` Jeremy Fitzhardinge 2010-07-14 0:15 ` Linus Torvalds 0 siblings, 1 reply; 666+ messages in thread From: Jeremy Fitzhardinge @ 2010-07-13 23:49 UTC (permalink / raw) To: H. Peter Anvin Cc: Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/13/2010 03:14 PM, H. Peter Anvin wrote: > Actually, I believe volatile operations (including asm volatile) are > strictly ordered *with respect to other volatile operations*. The documentation makes no reference to that property; in fact it suggests it is outright not true: Note that even a volatile `asm' instruction can be moved relative to other code, including across jump instructions. For example, on many targets there is a system register which can be set to control the rounding mode of floating point operations. You might try setting it with a volatile `asm', like this PowerPC example: asm volatile("mtfsf 255,%0" : : "f" (fpenv)); sum = x + y; This will not work reliably, as the compiler may move the addition back before the volatile `asm'. To make it work you need to add an artificial dependency to the `asm' referencing a variable in the code you don't want moved, for example: asm volatile ("mtfsf 255,%1" : "=X"(sum): "f"(fpenv)); sum = x + y; Similarly, you can't expect a sequence of volatile `asm' instructions to remain perfectly consecutive. [...] An `asm' instruction without any output operands will be treated identically to a volatile `asm' instruction. > As such I > would think we'd want to keep the "memory" clobber here, to make it > strictly ordered with regards to *all* memory operations. > That would keep its overall effect consistent. J ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 23:49 ` Jeremy Fitzhardinge @ 2010-07-14 0:15 ` Linus Torvalds 2010-07-14 17:19 ` Jeremy Fitzhardinge 0 siblings, 1 reply; 666+ messages in thread From: Linus Torvalds @ 2010-07-14 0:15 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: H. Peter Anvin, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On Tue, Jul 13, 2010 at 4:49 PM, Jeremy Fitzhardinge <jeremy@goop.org> wrote: > > The documentation makes no reference to that property; in fact it > suggests it is outright not true: The gcc documentation wrt inline asm's is totally worthless. Don't even bother quoting it - because the gcc people themselves have never cared. If the docs ever end up not matching what they want to do, they will just change the documentation. In other words, at least historically the docs are not in any way meaningful. They are not a "these are the semantics we guarantee", they are just random noise. As I mentioned, the docs historically just said something like "will not be moved significantly", and apparently they've been changed to be something else. The only thing that has ever been meaningful is "this works". And, of course, that has changed over time too, including actual recommendations on how to make something work (as mentioned, iirc "+" was only valid on register constraints, and "+m" used to not be allowed _or_ recommended, these days it's the only way to do certain things). It's irritating, because in other circumstances, gcc people take the reverse approach, and consider paper documentation more important than actual implementation issues. So sometimes they say "hey, this is the spec", but when it comes to their own docs, the answer has historically been "we'll just change the spec". Linus ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 0:15 ` Linus Torvalds @ 2010-07-14 17:19 ` Jeremy Fitzhardinge 2010-07-14 17:30 ` H. Peter Anvin 0 siblings, 1 reply; 666+ messages in thread From: Jeremy Fitzhardinge @ 2010-07-14 17:19 UTC (permalink / raw) To: Linus Torvalds Cc: H. Peter Anvin, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/13/2010 05:15 PM, Linus Torvalds wrote: > The gcc documentation wrt inline asm's is totally worthless. Don't > even bother quoting it - because the gcc people themselves have never > cared. If the docs ever end up not matching what they want to do, they > will just change the documentation. > > In other words, at least historically the docs are not in any way > meaningful. They are not a "these are the semantics we guarantee", > they are just random noise. As I mentioned, the docs historically just > said something like "will not be moved significantly", and apparently > they've been changed to be something else. > > Sure, I completely agree. At the moment the docs say "asm volatile guarantees nothing", and we can work with that. So long as we don't expect asm volatile to mean anything more (ie, magic semantics involving reordering), everyone is happy. BTW, gcc 2.95's docs do mention "asm volatile" having an effect on ordering, which is probably where the notion came from: "If you write an `asm' instruction with no outputs, GNU CC [...] not delete the instruction or move it outside of loops. [...] you should write the `volatile' keyword to prevent future versions of GNU CC from moving the instruction around within a core region". Lucky we never relied on that, right? Right? J ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 17:19 ` Jeremy Fitzhardinge @ 2010-07-14 17:30 ` H. Peter Anvin 2010-07-14 17:34 ` Jeremy Fitzhardinge 0 siblings, 1 reply; 666+ messages in thread From: H. Peter Anvin @ 2010-07-14 17:30 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/14/2010 10:19 AM, Jeremy Fitzhardinge wrote: > On 07/13/2010 05:15 PM, Linus Torvalds wrote: >> The gcc documentation wrt inline asm's is totally worthless. Don't >> even bother quoting it - because the gcc people themselves have never >> cared. If the docs ever end up not matching what they want to do, they >> will just change the documentation. >> >> In other words, at least historically the docs are not in any way >> meaningful. They are not a "these are the semantics we guarantee", >> they are just random noise. As I mentioned, the docs historically just >> said something like "will not be moved significantly", and apparently >> they've been changed to be something else. > > Sure, I completely agree. At the moment the docs say "asm volatile > guarantees nothing", and we can work with that. So long as we don't > expect asm volatile to mean anything more (ie, magic semantics involving > reordering), everyone is happy. Except we do. > BTW, gcc 2.95's docs do mention "asm volatile" having an effect on > ordering, which is probably where the notion came from: "If you write an > `asm' instruction with no outputs, GNU CC [...] not delete the > instruction or move it outside of loops. [...] you should write the > `volatile' keyword to prevent future versions of GNU CC from moving the > instruction around within a core region". Lucky we never relied on > that, right? Right? If gcc ever starts reordering volatile operations, including "asm volatile", the kernel will break, and will be unfixable. Just about every single driver will break. All over the kernel we're explicitly or implicitly making the assumption that volatile operations are strictly ordered by the compiler with respect to each other. -hpa ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 17:30 ` H. Peter Anvin @ 2010-07-14 17:34 ` Jeremy Fitzhardinge 2010-07-14 17:45 ` H. Peter Anvin 0 siblings, 1 reply; 666+ messages in thread From: Jeremy Fitzhardinge @ 2010-07-14 17:34 UTC (permalink / raw) To: H. Peter Anvin Cc: Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/14/2010 10:30 AM, H. Peter Anvin wrote: > If gcc ever starts reordering volatile operations, including "asm > volatile", the kernel will break, and will be unfixable. Just about > every single driver will break. All over the kernel we're explicitly or > implicitly making the assumption that volatile operations are strictly > ordered by the compiler with respect to each other. > Can you give an example? All the cases I've seen rely on the ordering properties of "memory" clobbers, which is sound. (And volatile variables are a completely unrelated issue, of course.) J ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 17:34 ` Jeremy Fitzhardinge @ 2010-07-14 17:45 ` H. Peter Anvin 2010-07-14 17:57 ` Jeremy Fitzhardinge 0 siblings, 1 reply; 666+ messages in thread From: H. Peter Anvin @ 2010-07-14 17:45 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/14/2010 10:34 AM, Jeremy Fitzhardinge wrote: > On 07/14/2010 10:30 AM, H. Peter Anvin wrote: >> If gcc ever starts reordering volatile operations, including "asm >> volatile", the kernel will break, and will be unfixable. Just about >> every single driver will break. All over the kernel we're explicitly or >> implicitly making the assumption that volatile operations are strictly >> ordered by the compiler with respect to each other. > > Can you give an example? All the cases I've seen rely on the ordering > properties of "memory" clobbers, which is sound. (And volatile > variables are a completely unrelated issue, of course.) > I/O ports, for example. -hpa ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 17:45 ` H. Peter Anvin @ 2010-07-14 17:57 ` Jeremy Fitzhardinge 2010-07-14 18:08 ` H. Peter Anvin 2010-07-14 20:16 ` Avi Kivity 0 siblings, 2 replies; 666+ messages in thread From: Jeremy Fitzhardinge @ 2010-07-14 17:57 UTC (permalink / raw) To: H. Peter Anvin Cc: Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/14/2010 10:45 AM, H. Peter Anvin wrote: > On 07/14/2010 10:34 AM, Jeremy Fitzhardinge wrote: > >> On 07/14/2010 10:30 AM, H. Peter Anvin wrote: >> >>> If gcc ever starts reordering volatile operations, including "asm >>> volatile", the kernel will break, and will be unfixable. Just about >>> every single driver will break. All over the kernel we're explicitly or >>> implicitly making the assumption that volatile operations are strictly >>> ordered by the compiler with respect to each other. >>> >> Can you give an example? All the cases I've seen rely on the ordering >> properties of "memory" clobbers, which is sound. (And volatile >> variables are a completely unrelated issue, of course.) >> >> > I/O ports, for example. > Yes, it looks like they should have memory barriers if we want them to be ordered with respect to normal writes; afaict "asm volatile" has never had strict ordering wrt memory ops. Anything else? J ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 17:57 ` Jeremy Fitzhardinge @ 2010-07-14 18:08 ` H. Peter Anvin 2010-07-14 18:15 ` Jeremy Fitzhardinge 2010-07-14 18:18 ` H.J. Lu 2010-07-14 20:16 ` Avi Kivity 1 sibling, 2 replies; 666+ messages in thread From: H. Peter Anvin @ 2010-07-14 18:08 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti, H.J. Lu [Adding H.J. to the Cc: list] On 07/14/2010 10:57 AM, Jeremy Fitzhardinge wrote: >>> >> I/O ports, for example. >> > > Yes, it looks like they should have memory barriers if we want them to > be ordered with respect to normal writes; afaict "asm volatile" has > never had strict ordering wrt memory ops. > Noone has talked about strict ordering between volatiles and (non-volatile) memory ops in general. I have been talking about volatile to volatile ordering, and I thought I'd been very clear about that. H.J., we're having a debate about the actual semantics of "volatile", especially "asm volatile" in gcc. In particular, I believe that volatile operations should not be possible to reorder with regards to each other, and the kernel depends on that fact. -hpa P.S: gcc 4.4 seems to handle "const volatile" incorrectly, probably by applying CSE to those values. ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 18:08 ` H. Peter Anvin @ 2010-07-14 18:15 ` Jeremy Fitzhardinge 2010-07-14 18:19 ` H. Peter Anvin 2010-07-14 18:23 ` Linus Torvalds 2010-07-14 18:18 ` H.J. Lu 1 sibling, 2 replies; 666+ messages in thread From: Jeremy Fitzhardinge @ 2010-07-14 18:15 UTC (permalink / raw) To: H. Peter Anvin Cc: Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti, H.J. Lu On 07/14/2010 11:08 AM, H. Peter Anvin wrote: > Noone has talked about strict ordering between volatiles and > (non-volatile) memory ops in general. I have been talking about > volatile to volatile ordering, and I thought I'd been very clear about that. > OK. > H.J., we're having a debate about the actual semantics of "volatile", > especially "asm volatile" in gcc. In particular, I believe that > volatile operations should not be possible to reorder with regards to > each other, and the kernel depends on that fact. > I think we should consider that deprecated and rely on dependencies and clobbers. J ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 18:15 ` Jeremy Fitzhardinge @ 2010-07-14 18:19 ` H. Peter Anvin 2010-07-14 20:58 ` Jeremy Fitzhardinge 2010-07-14 18:23 ` Linus Torvalds 1 sibling, 1 reply; 666+ messages in thread From: H. Peter Anvin @ 2010-07-14 18:19 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti, H.J. Lu On 07/14/2010 11:15 AM, Jeremy Fitzhardinge wrote: > > I think we should consider that deprecated and rely on dependencies and > clobbers. > I don't think that's practical in general. If the compiler is *that broken*, I don't see how it is usable at all. As Linus indicated, I don't think we can assume the gcc documentation to accurately reflect the intent of the gcc team, mostly because I think it often lags way behind what they're thinking. -hpa ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 18:19 ` H. Peter Anvin @ 2010-07-14 20:58 ` Jeremy Fitzhardinge 0 siblings, 0 replies; 666+ messages in thread From: Jeremy Fitzhardinge @ 2010-07-14 20:58 UTC (permalink / raw) To: H. Peter Anvin Cc: Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti, H.J. Lu On 07/14/2010 11:19 AM, H. Peter Anvin wrote: > On 07/14/2010 11:15 AM, Jeremy Fitzhardinge wrote: > >> I think we should consider that deprecated and rely on dependencies and >> clobbers. >> >> > I don't think that's practical in general. If the compiler is *that > broken*, I don't see how it is usable at all. > Well, over the years, gcc has explicitly changed the docs to weaken the meaning of "asm volatile" from "not being moved ``significantly''" to "no real guarantees about movement at all". I don't see why its so broken. There are lots of mechanisms to control asm ordering; we don't need "asm volatile" as well. But we do need it to mean "still emit an apparently dead asm with no outputs (or unused outputs)". They can still be omitted if the whole basic block is dead code, and they can be duplicated by things like inlining and loop unrolling. But presumably they can never be evaluated more times than the source code says they should be, so to that extent they're like volatile variables. I think the use of the "volatile" keyword here is a red herring. Just because the gcc devs decided to use it as a qualifier for asm statements doesn't mean that one should read anything other than a vague, vague relationship to volatile variables (and extra-vague given how weakly defined *they* are). > As Linus indicated, I don't think we can assume the gcc documentation to > accurately reflect the intent of the gcc team, mostly because I think it > often lags way behind what they're thinking. > I can get not trusting gcc to do what the documentation says it should do, but relying on it to do things that the documentation definitely says it doesn't seems foolhardy. I'm finding it a bit surreal to be arguing on the side of "don't trust gcc" vs you and Linus on the "gcc developers are arbitrary, capricious and untrustworthy, but we can rely on this piece of undocumented behaviour" side. J ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 18:15 ` Jeremy Fitzhardinge 2010-07-14 18:19 ` H. Peter Anvin @ 2010-07-14 18:23 ` Linus Torvalds 1 sibling, 0 replies; 666+ messages in thread From: Linus Torvalds @ 2010-07-14 18:23 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: H. Peter Anvin, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti, H.J. Lu On Wed, Jul 14, 2010 at 11:15 AM, Jeremy Fitzhardinge <jeremy@goop.org> wrote: > > I think we should consider that deprecated and rely on dependencies and > clobbers. That makes no sense. According to that logic, "asm volatile" has no semantic meaning at ALL. That's just crazy talk. The sane compiler semantics for "asm volatile" is that it acts as a volatile memory access. That's what the naming implies, and it has valid semantics that also happen to match the historical semantics. It means that it cannot be removed or duplicated, and it cannot be re-ordered wrt other volatile accesses (whether "asm volatile" or a traditional C volatile memory access). I agree that we could just add memory clobbers to them all, but my objection to that is that it just makes the whole keyword totally pointless. Linus ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 18:08 ` H. Peter Anvin 2010-07-14 18:15 ` Jeremy Fitzhardinge @ 2010-07-14 18:18 ` H.J. Lu 2010-07-14 19:00 ` H. Peter Anvin 1 sibling, 1 reply; 666+ messages in thread From: H.J. Lu @ 2010-07-14 18:18 UTC (permalink / raw) To: H. Peter Anvin Cc: Jeremy Fitzhardinge, Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On Wed, Jul 14, 2010 at 11:08 AM, H. Peter Anvin <hpa@zytor.com> wrote: > [Adding H.J. to the Cc: list] > > On 07/14/2010 10:57 AM, Jeremy Fitzhardinge wrote: >>>> >>> I/O ports, for example. >>> >> >> Yes, it looks like they should have memory barriers if we want them to >> be ordered with respect to normal writes; afaict "asm volatile" has >> never had strict ordering wrt memory ops. >> > > Noone has talked about strict ordering between volatiles and > (non-volatile) memory ops in general. I have been talking about > volatile to volatile ordering, and I thought I'd been very clear about that. > > H.J., we're having a debate about the actual semantics of "volatile", > especially "asm volatile" in gcc. In particular, I believe that > volatile operations should not be possible to reorder with regards to > each other, and the kernel depends on that fact. > > -hpa > > P.S: gcc 4.4 seems to handle "const volatile" incorrectly, probably by > applying CSE to those values. > > There are some discussions on: http://gcc.gnu.org/ml/gcc-patches/2010-06/msg02001.html http://gcc.gnu.org/ml/gcc-patches/2010-07/msg00001.html Are they related? -- H.J. ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 18:18 ` H.J. Lu @ 2010-07-14 19:00 ` H. Peter Anvin 2010-07-14 19:32 ` H.J. Lu 0 siblings, 1 reply; 666+ messages in thread From: H. Peter Anvin @ 2010-07-14 19:00 UTC (permalink / raw) To: H.J. Lu Cc: Jeremy Fitzhardinge, Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/14/2010 11:18 AM, H.J. Lu wrote: > > There are some discussions on: > > http://gcc.gnu.org/ml/gcc-patches/2010-06/msg02001.html > http://gcc.gnu.org/ml/gcc-patches/2010-07/msg00001.html > > Are they related? > Not directly as far as I can tell. The issue is if gcc can ever reorder, duplicate or elide a volatile operation (either asm volatile or a volatile-annotated memory reference.) In my (and Linus') opinion, this would be an incredibly serious bug. The gcc 4.4 issue, which is separate from the definition issue, is that it seems to assume that it can elide references to "const volatile" objects. "const volatile" should mean a value that could change at any time but which is a bug to write to -- for example a readonly hardware register. -hpa ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 19:00 ` H. Peter Anvin @ 2010-07-14 19:32 ` H.J. Lu 2010-07-14 19:36 ` H. Peter Anvin 0 siblings, 1 reply; 666+ messages in thread From: H.J. Lu @ 2010-07-14 19:32 UTC (permalink / raw) To: H. Peter Anvin Cc: Jeremy Fitzhardinge, Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On Wed, Jul 14, 2010 at 12:00 PM, H. Peter Anvin <hpa@zytor.com> wrote: > On 07/14/2010 11:18 AM, H.J. Lu wrote: >> >> There are some discussions on: >> >> http://gcc.gnu.org/ml/gcc-patches/2010-06/msg02001.html >> http://gcc.gnu.org/ml/gcc-patches/2010-07/msg00001.html >> >> Are they related? >> > > Not directly as far as I can tell. > > The issue is if gcc can ever reorder, duplicate or elide a volatile > operation (either asm volatile or a volatile-annotated memory > reference.) In my (and Linus') opinion, this would be an incredibly > serious bug. > > Is there a gcc bug for this? -- H.J. ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 19:32 ` H.J. Lu @ 2010-07-14 19:36 ` H. Peter Anvin 2010-07-14 19:40 ` H.J. Lu 0 siblings, 1 reply; 666+ messages in thread From: H. Peter Anvin @ 2010-07-14 19:36 UTC (permalink / raw) To: H.J. Lu Cc: Jeremy Fitzhardinge, Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/14/2010 12:32 PM, H.J. Lu wrote: > On Wed, Jul 14, 2010 at 12:00 PM, H. Peter Anvin <hpa@zytor.com> wrote: >> On 07/14/2010 11:18 AM, H.J. Lu wrote: >>> >>> There are some discussions on: >>> >>> http://gcc.gnu.org/ml/gcc-patches/2010-06/msg02001.html >>> http://gcc.gnu.org/ml/gcc-patches/2010-07/msg00001.html >>> >>> Are they related? >>> >> >> Not directly as far as I can tell. >> >> The issue is if gcc can ever reorder, duplicate or elide a volatile >> operation (either asm volatile or a volatile-annotated memory >> reference.) In my (and Linus') opinion, this would be an incredibly >> serious bug. > > Is there a gcc bug for this? > Are you asking for a bug report against the documentation? We're not sure what the semantics intended by the gcc team to be, which I guess is a documentation bug. -hpa ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 19:36 ` H. Peter Anvin @ 2010-07-14 19:40 ` H.J. Lu 2010-07-14 21:11 ` Jeremy Fitzhardinge 0 siblings, 1 reply; 666+ messages in thread From: H.J. Lu @ 2010-07-14 19:40 UTC (permalink / raw) To: H. Peter Anvin Cc: Jeremy Fitzhardinge, Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On Wed, Jul 14, 2010 at 12:36 PM, H. Peter Anvin <hpa@zytor.com> wrote: > On 07/14/2010 12:32 PM, H.J. Lu wrote: >> On Wed, Jul 14, 2010 at 12:00 PM, H. Peter Anvin <hpa@zytor.com> wrote: >>> On 07/14/2010 11:18 AM, H.J. Lu wrote: >>>> >>>> There are some discussions on: >>>> >>>> http://gcc.gnu.org/ml/gcc-patches/2010-06/msg02001.html >>>> http://gcc.gnu.org/ml/gcc-patches/2010-07/msg00001.html >>>> >>>> Are they related? >>>> >>> >>> Not directly as far as I can tell. >>> >>> The issue is if gcc can ever reorder, duplicate or elide a volatile >>> operation (either asm volatile or a volatile-annotated memory >>> reference.) In my (and Linus') opinion, this would be an incredibly >>> serious bug. >> >> Is there a gcc bug for this? >> > > Are you asking for a bug report against the documentation? We're not > sure what the semantics intended by the gcc team to be, which I guess is > a documentation bug. > Documentation bug is also a bug :-). -- H.J. ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 19:40 ` H.J. Lu @ 2010-07-14 21:11 ` Jeremy Fitzhardinge 2010-07-14 19:58 ` H. Peter Anvin 2010-07-14 20:33 ` H. Peter Anvin 0 siblings, 2 replies; 666+ messages in thread From: Jeremy Fitzhardinge @ 2010-07-14 21:11 UTC (permalink / raw) To: H.J. Lu Cc: H. Peter Anvin, Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/14/2010 12:40 PM, H.J. Lu wrote: > On Wed, Jul 14, 2010 at 12:36 PM, H. Peter Anvin <hpa@zytor.com> wrote: > >> On 07/14/2010 12:32 PM, H.J. Lu wrote: >> >>> On Wed, Jul 14, 2010 at 12:00 PM, H. Peter Anvin <hpa@zytor.com> wrote: >>> >>>> On 07/14/2010 11:18 AM, H.J. Lu wrote: >>>> >>>>> There are some discussions on: >>>>> >>>>> http://gcc.gnu.org/ml/gcc-patches/2010-06/msg02001.html >>>>> http://gcc.gnu.org/ml/gcc-patches/2010-07/msg00001.html >>>>> >>>>> Are they related? >>>>> >>>>> >>>> Not directly as far as I can tell. >>>> >>>> The issue is if gcc can ever reorder, duplicate or elide a volatile >>>> operation (either asm volatile or a volatile-annotated memory >>>> reference.) In my (and Linus') opinion, this would be an incredibly >>>> serious bug. >>>> >>> Is there a gcc bug for this? >>> >>> >> Are you asking for a bug report against the documentation? We're not >> sure what the semantics intended by the gcc team to be, which I guess is >> a documentation bug. >> >> > Documentation bug is also a bug :-). > The question is "what are the real ordering semantics of asm volatile"? What ordering is enforced between other asm volatiles? What ordering is enforced between asm volatiles and regular memory accesses? asm volatile and other code? The documentation discusses this to some extent, but mostly says "there are no ordering guarantees". Older versions of gcc - 2.95, for example - are more explicit, saying that "asm volatiles" won't be moved out of their basic block (I think that's how I parse it, anyway). Linux relies on "asm volatile" being ordered at least with respect to other asm volatiles. Is this reasonable now? Will gcc break this at some point in the future? If we can't rely on "asm volatile" ordering semantics, what other mechanism can we use (for example, to order clts with respect to FPU-using code)? Thanks, J ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 21:11 ` Jeremy Fitzhardinge @ 2010-07-14 19:58 ` H. Peter Anvin 2010-07-14 20:33 ` H. Peter Anvin 1 sibling, 0 replies; 666+ messages in thread From: H. Peter Anvin @ 2010-07-14 19:58 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: H.J. Lu, Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/14/2010 11:11 PM, Jeremy Fitzhardinge wrote: > > The question is "what are the real ordering semantics of asm volatile"? > What ordering is enforced between other asm volatiles? What ordering is > enforced between asm volatiles and regular memory accesses? asm volatile > and other code? > > The documentation discusses this to some extent, but mostly says "there > are no ordering guarantees". Older versions of gcc - 2.95, for example > - are more explicit, saying that "asm volatiles" won't be moved out of > their basic block (I think that's how I parse it, anyway). > I looked over the text, and I think you're confusing static reordering and duplication with execution reordering (gcc is indeed free to move around and even replicate asm volatile statements). One thing is that the docs makes it perfectly clear that asm volatile is not ordered with respect to *non*-volatile operations (*all* the examples are volatile-nonvolatile.) It says that asm volatile statements may not be "consecutive", i.e. gcc may generate code in between them, but all of this is well known and understood. The other thing that the documentation *does* specifically make clear is that an "asm volatile" has an implicit dependency on all memory (as an input, as opposed to an output/clobber.) I actually found the following statement in the gcc documentation, although it is in the section on C++ (6.1 in my version); the text, though, makes it clear that it applies to both C and C++: Both the C and C++ standard have the concept of volatile objects. These are normally accessed by pointers and used for accessing hardware. The standards encourage compilers to refrain from optimizations concerning accesses to volatile objects. The C standard leaves it implementation defined as to what constitutes a volatile access. The C++ standard omits to specify this, except to say that C++ should behave in a similar manner to C with respect to volatiles, where possible. The minimum either standard specifies is that at a sequence point all previous accesses to volatile objects have stabilized and no subsequent accesses have occurred. Thus an implementation is free to reorder and ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ combine volatile accesses which occur between sequence points, but ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cannot do so for accesses across a sequence point. The use of ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ volatiles does not allow you to violate the restriction on updating objects multiple times within a sequence point. [My emphasis, obviously.] I think that pretty much settles the matter, since any statement (including an asm statement) inherently has a sequence point before or after it. However, I will file a gcc bug report to clarify. -hpa ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 21:11 ` Jeremy Fitzhardinge 2010-07-14 19:58 ` H. Peter Anvin @ 2010-07-14 20:33 ` H. Peter Anvin 1 sibling, 0 replies; 666+ messages in thread From: H. Peter Anvin @ 2010-07-14 20:33 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: H.J. Lu, Linus Torvalds, Peter Palfrader, Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti For those that are interested: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44943 -hpa ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 17:57 ` Jeremy Fitzhardinge 2010-07-14 18:08 ` H. Peter Anvin @ 2010-07-14 20:16 ` Avi Kivity 2010-07-14 20:40 ` Jeremy Fitzhardinge 1 sibling, 1 reply; 666+ messages in thread From: Avi Kivity @ 2010-07-14 20:16 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: H. Peter Anvin, Linus Torvalds, Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/14/2010 08:57 PM, Jeremy Fitzhardinge wrote: > Anything else? 1. set up a mapping 2. invlpg or set cr3 3. use the mapping Moving the invlpg will break your code. -- I have a truly marvellous patch that fixes the bug which this signature is too narrow to contain. ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 20:16 ` Avi Kivity @ 2010-07-14 20:40 ` Jeremy Fitzhardinge 2010-07-14 20:45 ` Zachary Amsden 2010-07-14 20:50 ` H. Peter Anvin 0 siblings, 2 replies; 666+ messages in thread From: Jeremy Fitzhardinge @ 2010-07-14 20:40 UTC (permalink / raw) To: Avi Kivity Cc: H. Peter Anvin, Linus Torvalds, Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/14/2010 01:16 PM, Avi Kivity wrote: > On 07/14/2010 08:57 PM, Jeremy Fitzhardinge wrote: >> Anything else? > > 1. set up a mapping > 2. invlpg or set cr3 > 3. use the mapping > > Moving the invlpg will break your code. invlpg uses memory clobbers. All the crX ops seem to use a __force_order variable to sequence them - but it looks like it's done precisely backwards and it's barking mad to do allow write_crX to be reordered with respect to memory ops. Hm, looks like glommer added it surreptitiously while unifying system_32.h and system_64.h (system_32.h relied on asm volatile not being reordered; system_64.h used memory clobbers). J ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 20:40 ` Jeremy Fitzhardinge @ 2010-07-14 20:45 ` Zachary Amsden 2010-07-14 20:54 ` Zachary Amsden ` (2 more replies) 2010-07-14 20:50 ` H. Peter Anvin 1 sibling, 3 replies; 666+ messages in thread From: Zachary Amsden @ 2010-07-14 20:45 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: Avi Kivity, H. Peter Anvin, Linus Torvalds, Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Marcelo Tosatti On 07/14/2010 10:40 AM, Jeremy Fitzhardinge wrote: > On 07/14/2010 01:16 PM, Avi Kivity wrote: > >> On 07/14/2010 08:57 PM, Jeremy Fitzhardinge wrote: >> >>> Anything else? >>> >> 1. set up a mapping >> 2. invlpg or set cr3 >> 3. use the mapping >> >> Moving the invlpg will break your code. >> > invlpg uses memory clobbers. All the crX ops seem to use a > __force_order variable to sequence them - but it looks like it's done > precisely backwards and it's barking mad to do allow write_crX to be > reordered with respect to memory ops. > > Hm, looks like glommer added it surreptitiously while unifying > system_32.h and system_64.h (system_32.h relied on asm volatile not > being reordered; system_64.h used memory clobbers). > J > clts() has no memory clobber; it is used to serialize execution of code within kernel_fpu_begin() / kernel_fpu_end() blocks. If the code within is reordered before the clts(), we've corrupted guest FPU state. That's the kind of bug I think Linus is talking about. We've been expecting volatile to work that way for over a decade, by my recollection, and if it doesn't, there is going to be a lot of broken code. Shouldn't we at least get a compiler switch to force the volatile behavior? I'd suggest it default to conservative. ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 20:45 ` Zachary Amsden @ 2010-07-14 20:54 ` Zachary Amsden 2010-07-14 21:11 ` Jeremy Fitzhardinge 2010-07-16 4:48 ` H. Peter Anvin 2 siblings, 0 replies; 666+ messages in thread From: Zachary Amsden @ 2010-07-14 20:54 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: Avi Kivity, H. Peter Anvin, Linus Torvalds, Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Marcelo Tosatti On 07/14/2010 10:45 AM, Zachary Amsden wrote: > On 07/14/2010 10:40 AM, Jeremy Fitzhardinge wrote: >> On 07/14/2010 01:16 PM, Avi Kivity wrote: >>> On 07/14/2010 08:57 PM, Jeremy Fitzhardinge wrote: >>>> Anything else? >>> 1. set up a mapping >>> 2. invlpg or set cr3 >>> 3. use the mapping >>> >>> Moving the invlpg will break your code. >> invlpg uses memory clobbers. All the crX ops seem to use a >> __force_order variable to sequence them - but it looks like it's done >> precisely backwards and it's barking mad to do allow write_crX to be >> reordered with respect to memory ops. >> >> Hm, looks like glommer added it surreptitiously while unifying >> system_32.h and system_64.h (system_32.h relied on asm volatile not >> being reordered; system_64.h used memory clobbers). >> J > > clts() has no memory clobber; it is used to serialize execution of > code within kernel_fpu_begin() / kernel_fpu_end() blocks. > > If the code within is reordered before the clts(), we've corrupted > guest FPU state. > > That's the kind of bug I think Linus is talking about. We've been > expecting volatile to work that way for over a decade, by my > recollection, and if it doesn't, there is going to be a lot of broken > code. > > Shouldn't we at least get a compiler switch to force the volatile > behavior? I'd suggest it default to conservative. Hmm, well, despite that not being quite correct (if guest has used FPU, we save it, which has a memory clobber), it seems to be the case that a reordering of the clts() among the other volatile asm statements would be a very bad thing - you'd get kernel FPU exceptions. And among asm volatiles, clts() is fairly unique in not having any clobbers or dependencies at all, so it could happen. Zach ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 20:45 ` Zachary Amsden 2010-07-14 20:54 ` Zachary Amsden @ 2010-07-14 21:11 ` Jeremy Fitzhardinge 2010-07-16 4:48 ` H. Peter Anvin 2 siblings, 0 replies; 666+ messages in thread From: Jeremy Fitzhardinge @ 2010-07-14 21:11 UTC (permalink / raw) To: Zachary Amsden Cc: Avi Kivity, H. Peter Anvin, Linus Torvalds, Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Marcelo Tosatti On 07/14/2010 01:45 PM, Zachary Amsden wrote: > clts() has no memory clobber; it is used to serialize execution of > code within kernel_fpu_begin() / kernel_fpu_end() blocks. > > If the code within is reordered before the clts(), we've corrupted > guest FPU state. Hm, that's awkward - you'd really need some way of specifying ordering with respect to the FPU state, and "memory" would only be an approximate proxy of that. And not a good one, since gcc wouldn't regard register-only fpu ops as being affected by a memory clobber. J ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 20:45 ` Zachary Amsden 2010-07-14 20:54 ` Zachary Amsden 2010-07-14 21:11 ` Jeremy Fitzhardinge @ 2010-07-16 4:48 ` H. Peter Anvin 2 siblings, 0 replies; 666+ messages in thread From: H. Peter Anvin @ 2010-07-16 4:48 UTC (permalink / raw) To: Zachary Amsden Cc: Jeremy Fitzhardinge, Avi Kivity, Linus Torvalds, Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Marcelo Tosatti On 07/14/2010 01:45 PM, Zachary Amsden wrote: > That's the kind of bug I think Linus is talking about. We've been > expecting volatile to work that way for over a decade, by my > recollection, and if it doesn't, there is going to be a lot of broken code. > > Shouldn't we at least get a compiler switch to force the volatile > behavior? I'd suggest it default to conservative. At this point, it looks like there is no reason to be alarmed. The documentation actually contains a statement about volatiles not being mutually reordered across sequence points, and since asm is a statement (rather than an expression) it is always surrounded by sequence points. I have filed a gcc ticket to ask for clarification. -hpa -- H. Peter Anvin, Intel Open Source Technology Center I work for Intel. I don't speak on their behalf. ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 20:40 ` Jeremy Fitzhardinge 2010-07-14 20:45 ` Zachary Amsden @ 2010-07-14 20:50 ` H. Peter Anvin 2010-07-14 21:11 ` Jeremy Fitzhardinge 1 sibling, 1 reply; 666+ messages in thread From: H. Peter Anvin @ 2010-07-14 20:50 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: Avi Kivity, Linus Torvalds, Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/14/2010 01:40 PM, Jeremy Fitzhardinge wrote: > On 07/14/2010 01:16 PM, Avi Kivity wrote: >> On 07/14/2010 08:57 PM, Jeremy Fitzhardinge wrote: >>> Anything else? >> >> 1. set up a mapping >> 2. invlpg or set cr3 >> 3. use the mapping >> >> Moving the invlpg will break your code. > > invlpg uses memory clobbers. All the crX ops seem to use a > __force_order variable to sequence them - but it looks like it's done > precisely backwards and it's barking mad to do allow write_crX to be > reordered with respect to memory ops. > > Hm, looks like glommer added it surreptitiously while unifying > system_32.h and system_64.h (system_32.h relied on asm volatile not > being reordered; system_64.h used memory clobbers). > J invlpg, in the general case, definitely needs a memory clobber even if volatiles are ordered, since it needs to be ordered with regards to non-volatile memory operations. Note that memory clobbers don't by themselves enforce ordering since they don't prevent the ordering of memory clobbers with respect to each other. -hpa ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-14 20:50 ` H. Peter Anvin @ 2010-07-14 21:11 ` Jeremy Fitzhardinge 0 siblings, 0 replies; 666+ messages in thread From: Jeremy Fitzhardinge @ 2010-07-14 21:11 UTC (permalink / raw) To: H. Peter Anvin Cc: Avi Kivity, Linus Torvalds, Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/14/2010 01:50 PM, H. Peter Anvin wrote: > invlpg, in the general case, definitely needs a memory clobber even if > volatiles are ordered, since it needs to be ordered with regards to > non-volatile memory operations. > Yes. I'd say write_crX should need that too, since they can they can have a variety global effects on how memory addressing works (from tlb flush to switching pagetable formats). > Note that memory clobbers don't by themselves enforce ordering since > they don't prevent the ordering of memory clobbers with respect to each > other. > Hm. Well we do *definitely* rely on that. I guess technically we'd need at least a memory input on the asm to be ordered with respect to a memory clobber. But that doesn't seem to have been an issue (or perhaps its mixed up with the secret semantics of asm volatile). J ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 17:59 ` Linus Torvalds 2010-07-13 18:21 ` Jeremy Fitzhardinge @ 2010-07-13 18:23 ` Peter Palfrader 1 sibling, 0 replies; 666+ messages in thread From: Peter Palfrader @ 2010-07-13 18:23 UTC (permalink / raw) To: Linus Torvalds Cc: Avi Kivity, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti [-- Attachment #1: Type: text/plain, Size: 1125 bytes --] On Tue, 13 Jul 2010, Linus Torvalds wrote: > On Tue, Jul 13, 2010 at 10:50 AM, Linus Torvalds > <torvalds@linux-foundation.org> wrote: > > > > No, you didn't back-port it wrong. I just didn't fix the right part. I > > thought the PV code used xchg, not cmpxchg, so I only patched that. > > But cmpxchg has the exact same issue. > > > > Does this fix it? It appears to, thanks a lot. [git|v2.6.32.16] weasel@thelma:/scratch/kernel/2.6.32.16$ nm arch/x86/kernel/pvclock.o 0000000000000000 b last_value .. And it did boot too. > Btw, this second patch was a bit more aggressive than the first one, > and actually removes the "memory" clobber entirely, and the fake cast > of the target type. Without the cast gcc spews a fair amount of warnings. About four every time it hits the include file. Just for completeness' sake I attached the patch on top of 2.6.32.16 that I built with. -- | .''`. ** Debian GNU/Linux ** Peter Palfrader | : :' : The universal http://www.palfrader.org/ | `. `' Operating System | `- http://www.debian.org/ [-- Attachment #2: linus.diff.backported --] [-- Type: text/plain, Size: 2339 bytes --] diff --git a/arch/x86/include/asm/cmpxchg_64.h b/arch/x86/include/asm/cmpxchg_64.h index 52de72e..f0551c5 100644 --- a/arch/x86/include/asm/cmpxchg_64.h +++ b/arch/x86/include/asm/cmpxchg_64.h @@ -26,26 +26,26 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, switch (size) { case 1: asm volatile("xchgb %b0,%1" - : "=q" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=q" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; case 2: asm volatile("xchgw %w0,%1" - : "=r" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=r" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; case 4: asm volatile("xchgl %k0,%1" - : "=r" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=r" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; case 8: asm volatile("xchgq %0,%1" - : "=r" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=r" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; } @@ -66,28 +66,24 @@ static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old, unsigned long prev; switch (size) { case 1: - asm volatile(LOCK_PREFIX "cmpxchgb %b1,%2" - : "=a"(prev) - : "q"(new), "m"(*__xg(ptr)), "0"(old) - : "memory"); + asm volatile(LOCK_PREFIX "cmpxchgb %b2,%1" + : "=a"(prev), "+m" (*__xg(ptr)) + : "q"(new), "0"(old)); return prev; case 2: - asm volatile(LOCK_PREFIX "cmpxchgw %w1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) - : "memory"); + asm volatile(LOCK_PREFIX "cmpxchgw %w2,%1" + : "=a"(prev), "+m" (*__xg(ptr)) + : "r"(new), "0"(old)); return prev; case 4: - asm volatile(LOCK_PREFIX "cmpxchgl %k1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) - : "memory"); + asm volatile(LOCK_PREFIX "cmpxchgl %k2,%1" + : "=a"(prev), "+m" (*__xg(ptr)) + : "r"(new), "0"(old)); return prev; case 8: - asm volatile(LOCK_PREFIX "cmpxchgq %1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) - : "memory"); + asm volatile(LOCK_PREFIX "cmpxchgq %2,%1" + : "=a"(prev), "+m" (*__xg(ptr)) + : "r"(new), "0"(old)); return prev; } return old; ^ permalink raw reply related [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 16:34 ` Avi Kivity 2010-07-13 16:40 ` Avi Kivity @ 2010-07-13 16:53 ` Peter Palfrader 1 sibling, 0 replies; 666+ messages in thread From: Peter Palfrader @ 2010-07-13 16:53 UTC (permalink / raw) To: Avi Kivity Cc: Greg KH, linux-kernel, stable, stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti On Tue, 13 Jul 2010, Avi Kivity wrote: >> The same: >> >> [git|v2.6.32.16] weasel@thelma:/scratch/kernel/2.6.32.16$ nm arch/x86/kernel/pvclock.o >> 0000000000000000 r last_value >> U native_read_tsc >> 0000000000000040 T pvclock_clocksource_read >> 0000000000000100 T pvclock_read_wallclock >> 0000000000000000 T pvclock_tsc_khz >> U set_normalized_timespec >> > > But it's > >> >> static atomic64_t last_value = ATOMIC64_INIT(0); >> > > Doesn't make any sense. > > Let's try to see if the toolchain is confused: > > - rename last_value to some random name 0000000000000000 r some_random_name > - drop the 'static' qualifier 0000000000000000 B last_value > - drop the '= ATOMIC64_INIT(0)' 0000000000000000 b last_value > - all of the above 0000000000000000 B some_random_name make -f scripts/Makefile.build obj=arch/x86/kernel arch/x86/kernel/pvclock.o gcc -Wp,-MD,arch/x86/kernel/.pvclock.o.d -nostdinc -isystem /usr/lib/gcc/x86_64-linux-gnu/4.3.2/include -Iinclude -I/scratch/kernel/2.6.32.16/arch/x86/include -include include/linux/autoconf.h -D__KERNEL__ -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common -Werror-implicit-function-declaration -Wno-format-security -fno-delete-null-pointer-checks -O2 -m64 -mtune=generic -mno-red-zone -mcmodel=kernel -funit-at-a-time -maccumulate-outgoing-args -fstack-protector -DCONFIG_AS_CFI=1 -DCONFIG_AS_CFI_SIGNAL_FRAME=1 -pipe -Wno-sign-compare -fno-asynchronous-unwind-tables -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -fno-omit-frame-pointer -fno-optimize-sibling-calls -g -Wdeclaration-after-statement -Wno-pointer-sign -fno-strict-overflow -D"KBUILD_STR(s)=#s" -D"KBUILD_BASENAME=KBUILD_STR(pvclock)" -D"KBUILD_MODNAME=KBUILD_STR(pvclock)" -c -o arch/x86/kernel/pvclock.o arch/x86/kernel/pvclock.c [git|v2.6.32.16] weasel@thelma:/scratch/kernel/2.6.32.16$ gcc --version gcc (Debian 4.3.2-1.1) 4.3.2 Copyright (C) 2008 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Using -O0 also results in a writeable last_value (b). -- | .''`. ** Debian GNU/Linux ** Peter Palfrader | : :' : The universal http://www.palfrader.org/ | `. `' Operating System | `- http://www.debian.org/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 15:57 ` Avi Kivity 2010-07-13 16:22 ` Peter Palfrader @ 2010-07-13 16:34 ` Linus Torvalds 2010-07-13 18:04 ` Avi Kivity 1 sibling, 1 reply; 666+ messages in thread From: Linus Torvalds @ 2010-07-13 16:34 UTC (permalink / raw) To: Avi Kivity, Ingo Molnar, H. Peter Anvin Cc: Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti [-- Attachment #1: Type: text/plain, Size: 2312 bytes --] On Tue, Jul 13, 2010 at 8:57 AM, Avi Kivity <avi@redhat.com> wrote: > On 07/13/2010 05:19 PM, Peter Palfrader wrote: >> >>> So it looks like last_value was placed in a read only section. Please >>> post your System.map somewhere. >>> >> >> weasel@intrepid:~$ publish System.map >> >> http://asteria.noreply.org/~weasel/volatile/2010-07-13-mbm2xEdd8Q4/System.map >> weasel@intrepid:~$ grep -i last_value System.map >> ffffffff81712e80 r last_value >> ffffffff81b05240 b last_value.26163 >> > > "r" = "read only" > > How does it look in 'nm arch/x86/kernel/pvclock.o'? I bet it is the same. And I have a suspicion: because the only write access to that variable is in an asm that uses the "memory" clobber to say it wrote to it (rather than say it writes to it directly), and because the variable is marked 'static', gcc decides that nothing ever writes to it in that compilation unit, and it can be made read-only. Look at our definition for "xchg()" in arch/x86/include/asm/cmpxchg_64.h. It boils down to asm volatile("xchgq %0,%1" \ : "=r" (__x) \ : "m" (*__xg(ptr)), "0" (__x) \ : "memory"); \ for the 8-byte case (which is obviously what atomic64_xchg() uses). And the _reason_ we do that thing where we use a memory _input_ and then a clobber is that older versions of gcc did not accept the thing we _want_ to use, namely using "+m" to say that we actually change the memory. So the above is "wrong", but has historical reasons - and it's apparently never been changed. However, the "+m" was fixed, and we use it elsewhere, so I think the "m" plus memory clobber is now purely historical. Does a patch something like the appended fix it? I also suspect we should look at some other uses in this area. The atomic64_64.h file uses "=m" and "m", which looks like another legacy thing (again, "+m" historically wasn't allowed, and then later became the 'correct' way to do things). NOTE NOTE NOTE! This is UNTESTED and INCOMPLETE. We should do cmpxchg too, and the 32-bit versions. I'm adding Ingo and Peter to the cc. Linus [-- Attachment #2: diff --] [-- Type: application/octet-stream, Size: 1363 bytes --] arch/x86/include/asm/cmpxchg_64.h | 16 ++++++++-------- 1 files changed, 8 insertions(+), 8 deletions(-) diff --git a/arch/x86/include/asm/cmpxchg_64.h b/arch/x86/include/asm/cmpxchg_64.h index 485ae41..70ac0a4 100644 --- a/arch/x86/include/asm/cmpxchg_64.h +++ b/arch/x86/include/asm/cmpxchg_64.h @@ -26,26 +26,26 @@ extern void __cmpxchg_wrong_size(void); switch (size) { \ case 1: \ asm volatile("xchgb %b0,%1" \ - : "=q" (__x) \ - : "m" (*__xg(ptr)), "0" (__x) \ + : "=q" (__x), "+m" (*__xg(ptr)) \ + : "0" (__x) \ : "memory"); \ break; \ case 2: \ asm volatile("xchgw %w0,%1" \ - : "=r" (__x) \ - : "m" (*__xg(ptr)), "0" (__x) \ + : "=r" (__x), "+m" (*__xg(ptr)) \ + : "0" (__x) \ : "memory"); \ break; \ case 4: \ asm volatile("xchgl %k0,%1" \ - : "=r" (__x) \ - : "m" (*__xg(ptr)), "0" (__x) \ + : "=r" (__x), "+m" (*__xg(ptr)) \ + : "0" (__x) \ : "memory"); \ break; \ case 8: \ asm volatile("xchgq %0,%1" \ - : "=r" (__x) \ - : "m" (*__xg(ptr)), "0" (__x) \ + : "=r" (__x), "+m" (*__xg(ptr)) \ + : "0" (__x) \ : "memory"); \ break; \ default: \ ^ permalink raw reply related [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 16:34 ` Linus Torvalds @ 2010-07-13 18:04 ` Avi Kivity 2010-07-13 18:15 ` Linus Torvalds 2010-07-13 18:25 ` [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock Peter Palfrader 0 siblings, 2 replies; 666+ messages in thread From: Avi Kivity @ 2010-07-13 18:04 UTC (permalink / raw) To: Linus Torvalds Cc: Ingo Molnar, H. Peter Anvin, Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti On 07/13/2010 07:34 PM, Linus Torvalds wrote: > > I bet it is the same. And I have a suspicion: because the only write > access to that variable is in an asm that uses the "memory" clobber to > say it wrote to it (rather than say it writes to it directly), and > because the variable is marked 'static', gcc decides that nothing ever > writes to it in that compilation unit, and it can be made read-only. > > Look at our definition for "xchg()" in > arch/x86/include/asm/cmpxchg_64.h. It boils down to > > asm volatile("xchgq %0,%1" \ > : "=r" (__x) \ > : "m" (*__xg(ptr)), "0" (__x) \ > : "memory"); \ > > for the 8-byte case (which is obviously what atomic64_xchg() uses). > And the _reason_ we do that thing where we use a memory _input_ and > then a clobber is that older versions of gcc did not accept the thing > we _want_ to use, namely using "+m" to say that we actually change the > memory. So the above is "wrong", but has historical reasons - and > it's apparently never been changed. > > However, the "+m" was fixed, and we use it elsewhere, so I think the > "m" plus memory clobber is now purely historical. Does a patch > something like the appended fix it? I also suspect we should look at > some other uses in this area. The atomic64_64.h file uses "=m" and > "m", which looks like another legacy thing (again, "+m" historically > wasn't allowed, and then later became the 'correct' way to do things). > > Well, current upstream uses "m": > case 8: \ > asm volatile(lock "cmpxchgq %1,%2" \ > : "=a"(__ret) \ > : "r"(__new), "m"(*__xg(ptr)), "0"(__old) \ > : "memory"); \ > break; \ and works; I also failed to reproduce with 2.6.32.16. So I expect some toolchain involvement. Peter, what gcc are you using? -- I have a truly marvellous patch that fixes the bug which this signature is too narrow to contain. ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 18:04 ` Avi Kivity @ 2010-07-13 18:15 ` Linus Torvalds 2010-07-27 17:46 ` Jeremy Fitzhardinge 2010-07-13 18:25 ` [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock Peter Palfrader 1 sibling, 1 reply; 666+ messages in thread From: Linus Torvalds @ 2010-07-13 18:15 UTC (permalink / raw) To: Avi Kivity Cc: Ingo Molnar, H. Peter Anvin, Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti On Tue, Jul 13, 2010 at 11:04 AM, Avi Kivity <avi@redhat.com> wrote: > > Well, current upstream uses "m": Yes, I'd expect current 2.6.34 to also show the same problem. > and works; I also failed to reproduce with 2.6.32.16. So I expect some > toolchain involvement. And yes, I do believe it's likely a newer gcc that triggers it too, otherwise we'd have seen more reports of it. Linus ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 18:15 ` Linus Torvalds @ 2010-07-27 17:46 ` Jeremy Fitzhardinge 2010-07-27 17:52 ` H. Peter Anvin 2010-07-27 23:57 ` xchg() and cmpxchg() H. Peter Anvin 0 siblings, 2 replies; 666+ messages in thread From: Jeremy Fitzhardinge @ 2010-07-27 17:46 UTC (permalink / raw) To: Linus Torvalds Cc: Avi Kivity, Ingo Molnar, H. Peter Anvin, Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/13/2010 11:15 AM, Linus Torvalds wrote: > On Tue, Jul 13, 2010 at 11:04 AM, Avi Kivity<avi@redhat.com> wrote: >> Well, current upstream uses "m": > Yes, I'd expect current 2.6.34 to also show the same problem. > >> and works; I also failed to reproduce with 2.6.32.16. So I expect some >> toolchain involvement. > And yes, I do believe it's likely a newer gcc that triggers it too, > otherwise we'd have seen more reports of it. Did anyone get around to doing a proper fix for this? I don't see one in tip.git or linux-2.6.git. And it needs to get back into stable... Thanks, J ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-27 17:46 ` Jeremy Fitzhardinge @ 2010-07-27 17:52 ` H. Peter Anvin 2010-07-27 23:57 ` xchg() and cmpxchg() H. Peter Anvin 1 sibling, 0 replies; 666+ messages in thread From: H. Peter Anvin @ 2010-07-27 17:52 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: Linus Torvalds, Avi Kivity, Ingo Molnar, Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti On 07/27/2010 10:46 AM, Jeremy Fitzhardinge wrote: > On 07/13/2010 11:15 AM, Linus Torvalds wrote: >> On Tue, Jul 13, 2010 at 11:04 AM, Avi Kivity<avi@redhat.com> wrote: >>> Well, current upstream uses "m": >> Yes, I'd expect current 2.6.34 to also show the same problem. >> >>> and works; I also failed to reproduce with 2.6.32.16. So I expect some >>> toolchain involvement. >> And yes, I do believe it's likely a newer gcc that triggers it too, >> otherwise we'd have seen more reports of it. > > Did anyone get around to doing a proper fix for this? I don't see one > in tip.git or linux-2.6.git. And it needs to get back into stable... > I'll go ahead and write it up. -hpa -- H. Peter Anvin, Intel Open Source Technology Center I work for Intel. I don't speak on their behalf. ^ permalink raw reply [flat|nested] 666+ messages in thread
* xchg() and cmpxchg() 2010-07-27 17:46 ` Jeremy Fitzhardinge 2010-07-27 17:52 ` H. Peter Anvin @ 2010-07-27 23:57 ` H. Peter Anvin 2010-07-28 5:33 ` [tip:x86/urgent] x86: Add memory modify constraints to " tip-bot for H. Peter Anvin 1 sibling, 1 reply; 666+ messages in thread From: H. Peter Anvin @ 2010-07-27 23:57 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: Linus Torvalds, Avi Kivity, Ingo Molnar, Peter Palfrader, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Marcelo Tosatti Okay, I've stared at this issue for most of the day, and I have a fix for the immediate issue. However, I also am convinced that the whole scheme with the __xg() macro is just broken. It was introduced in 1.3.11 when xchg and cmpxchg where neither "asm volatile" nor had "memory" clobbers as an apparent way to keep gcc from moving memory references around it, but since the array type is "unsigned long" rather than a char type, it probably doesn't even work right, and with asm volatile/memory clobber it should not be necessary. At this point I'd like to push an urgent patch to fix the immediate issue, and a cleanup patch getting rid of __xg() for .36. -hpa -- H. Peter Anvin, Intel Open Source Technology Center I work for Intel. I don't speak on their behalf. ^ permalink raw reply [flat|nested] 666+ messages in thread
* [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-07-27 23:57 ` xchg() and cmpxchg() H. Peter Anvin @ 2010-07-28 5:33 ` tip-bot for H. Peter Anvin 2010-07-28 15:45 ` Linus Torvalds 2010-08-02 23:51 ` [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() Jeremy Fitzhardinge 0 siblings, 2 replies; 666+ messages in thread From: tip-bot for H. Peter Anvin @ 2010-07-28 5:33 UTC (permalink / raw) To: linux-tip-commits Cc: linux-kernel, hpa, mingo, torvalds, glommer, alan, zamsden, stable, mtosatti, gregkh, tglx, peter, avi Commit-ID: 113fc5a6e8c2288619ff7e8187a6f556b7e0d372 Gitweb: http://git.kernel.org/tip/113fc5a6e8c2288619ff7e8187a6f556b7e0d372 Author: H. Peter Anvin <hpa@zytor.com> AuthorDate: Tue, 27 Jul 2010 17:01:49 -0700 Committer: H. Peter Anvin <hpa@zytor.com> CommitDate: Tue, 27 Jul 2010 17:14:02 -0700 x86: Add memory modify constraints to xchg() and cmpxchg() xchg() and cmpxchg() modify their memory operands, not merely read them. For some versions of gcc the "memory" clobber has apparently dealt with the situation, but not for all. Originally-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: H. Peter Anvin <hpa@zytor.com> Cc: Glauber Costa <glommer@redhat.com> Cc: Avi Kivity <avi@redhat.com> Cc: Peter Palfrader <peter@palfrader.org> Cc: Greg KH <gregkh@suse.de> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Cc: Zachary Amsden <zamsden@redhat.com> Cc: Marcelo Tosatti <mtosatti@redhat.com> Cc: <stable@kernel.org> LKML-Reference: <4C4F7277.8050306@zytor.com> --- arch/x86/include/asm/cmpxchg_32.h | 68 ++++++++++++++++++------------------ arch/x86/include/asm/cmpxchg_64.h | 40 +++++++++++----------- 2 files changed, 54 insertions(+), 54 deletions(-) diff --git a/arch/x86/include/asm/cmpxchg_32.h b/arch/x86/include/asm/cmpxchg_32.h index 8859e12..c1cf59d 100644 --- a/arch/x86/include/asm/cmpxchg_32.h +++ b/arch/x86/include/asm/cmpxchg_32.h @@ -27,20 +27,20 @@ struct __xchg_dummy { switch (size) { \ case 1: \ asm volatile("xchgb %b0,%1" \ - : "=q" (__x) \ - : "m" (*__xg(ptr)), "0" (__x) \ + : "=q" (__x), "+m" (*__xg(ptr)) \ + : "0" (__x) \ : "memory"); \ break; \ case 2: \ asm volatile("xchgw %w0,%1" \ - : "=r" (__x) \ - : "m" (*__xg(ptr)), "0" (__x) \ + : "=r" (__x), "+m" (*__xg(ptr)) \ + : "0" (__x) \ : "memory"); \ break; \ case 4: \ asm volatile("xchgl %0,%1" \ - : "=r" (__x) \ - : "m" (*__xg(ptr)), "0" (__x) \ + : "=r" (__x), "+m" (*__xg(ptr)) \ + : "0" (__x) \ : "memory"); \ break; \ default: \ @@ -70,14 +70,14 @@ static inline void __set_64bit(unsigned long long *ptr, unsigned int low, unsigned int high) { asm volatile("\n1:\t" - "movl (%0), %%eax\n\t" - "movl 4(%0), %%edx\n\t" - LOCK_PREFIX "cmpxchg8b (%0)\n\t" + "movl (%1), %%eax\n\t" + "movl 4(%1), %%edx\n\t" + LOCK_PREFIX "cmpxchg8b (%1)\n\t" "jnz 1b" - : /* no outputs */ - : "D"(ptr), - "b"(low), - "c"(high) + : "=m" (*ptr) + : "D" (ptr), + "b" (low), + "c" (high) : "ax", "dx", "memory"); } @@ -121,21 +121,21 @@ extern void __cmpxchg_wrong_size(void); __typeof__(*(ptr)) __new = (new); \ switch (size) { \ case 1: \ - asm volatile(lock "cmpxchgb %b1,%2" \ - : "=a"(__ret) \ - : "q"(__new), "m"(*__xg(ptr)), "0"(__old) \ + asm volatile(lock "cmpxchgb %b2,%1" \ + : "=a" (__ret), "+m" (*__xg(ptr)) \ + : "q" (__new), "0" (__old) \ : "memory"); \ break; \ case 2: \ - asm volatile(lock "cmpxchgw %w1,%2" \ - : "=a"(__ret) \ - : "r"(__new), "m"(*__xg(ptr)), "0"(__old) \ + asm volatile(lock "cmpxchgw %w2,%1" \ + : "=a" (__ret), "+m" (*__xg(ptr)) \ + : "r" (__new), "0" (__old) \ : "memory"); \ break; \ case 4: \ - asm volatile(lock "cmpxchgl %1,%2" \ - : "=a"(__ret) \ - : "r"(__new), "m"(*__xg(ptr)), "0"(__old) \ + asm volatile(lock "cmpxchgl %2,%1" \ + : "=a" (__ret), "+m" (*__xg(ptr)) \ + : "r" (__new), "0" (__old) \ : "memory"); \ break; \ default: \ @@ -180,12 +180,12 @@ static inline unsigned long long __cmpxchg64(volatile void *ptr, unsigned long long new) { unsigned long long prev; - asm volatile(LOCK_PREFIX "cmpxchg8b %3" - : "=A"(prev) - : "b"((unsigned long)new), - "c"((unsigned long)(new >> 32)), - "m"(*__xg(ptr)), - "0"(old) + asm volatile(LOCK_PREFIX "cmpxchg8b %1" + : "=A" (prev), + "+m" (*__xg(ptr)) + : "b" ((unsigned long)new), + "c" ((unsigned long)(new >> 32)), + "0" (old) : "memory"); return prev; } @@ -195,12 +195,12 @@ static inline unsigned long long __cmpxchg64_local(volatile void *ptr, unsigned long long new) { unsigned long long prev; - asm volatile("cmpxchg8b %3" - : "=A"(prev) - : "b"((unsigned long)new), - "c"((unsigned long)(new >> 32)), - "m"(*__xg(ptr)), - "0"(old) + asm volatile("cmpxchg8b %1" + : "=A" (prev), + "+m" (*__xg(ptr)) + : "b" ((unsigned long)new), + "c" ((unsigned long)(new >> 32)), + "0" (old) : "memory"); return prev; } diff --git a/arch/x86/include/asm/cmpxchg_64.h b/arch/x86/include/asm/cmpxchg_64.h index 485ae41..b92f147 100644 --- a/arch/x86/include/asm/cmpxchg_64.h +++ b/arch/x86/include/asm/cmpxchg_64.h @@ -26,26 +26,26 @@ extern void __cmpxchg_wrong_size(void); switch (size) { \ case 1: \ asm volatile("xchgb %b0,%1" \ - : "=q" (__x) \ - : "m" (*__xg(ptr)), "0" (__x) \ + : "=q" (__x), "+m" (*__xg(ptr)) \ + : "0" (__x) \ : "memory"); \ break; \ case 2: \ asm volatile("xchgw %w0,%1" \ - : "=r" (__x) \ - : "m" (*__xg(ptr)), "0" (__x) \ + : "=r" (__x), "+m" (*__xg(ptr)) \ + : "0" (__x) \ : "memory"); \ break; \ case 4: \ asm volatile("xchgl %k0,%1" \ - : "=r" (__x) \ - : "m" (*__xg(ptr)), "0" (__x) \ + : "=r" (__x), "+m" (*__xg(ptr)) \ + : "0" (__x) \ : "memory"); \ break; \ case 8: \ asm volatile("xchgq %0,%1" \ - : "=r" (__x) \ - : "m" (*__xg(ptr)), "0" (__x) \ + : "=r" (__x), "+m" (*__xg(ptr)) \ + : "0" (__x) \ : "memory"); \ break; \ default: \ @@ -71,27 +71,27 @@ extern void __cmpxchg_wrong_size(void); __typeof__(*(ptr)) __new = (new); \ switch (size) { \ case 1: \ - asm volatile(lock "cmpxchgb %b1,%2" \ - : "=a"(__ret) \ - : "q"(__new), "m"(*__xg(ptr)), "0"(__old) \ + asm volatile(lock "cmpxchgb %b2,%1" \ + : "=a" (__ret), "+m" (*__xg(ptr)) \ + : "q" (__new), "0" (__old) \ : "memory"); \ break; \ case 2: \ - asm volatile(lock "cmpxchgw %w1,%2" \ - : "=a"(__ret) \ - : "r"(__new), "m"(*__xg(ptr)), "0"(__old) \ + asm volatile(lock "cmpxchgw %w2,%1" \ + : "=a" (__ret), "+m" (*__xg(ptr)) \ + : "r" (__new), "0" (__old) \ : "memory"); \ break; \ case 4: \ - asm volatile(lock "cmpxchgl %k1,%2" \ - : "=a"(__ret) \ - : "r"(__new), "m"(*__xg(ptr)), "0"(__old) \ + asm volatile(lock "cmpxchgl %k2,%1" \ + : "=a" (__ret), "+m" (*__xg(ptr)) \ + : "r" (__new), "0" (__old) \ : "memory"); \ break; \ case 8: \ - asm volatile(lock "cmpxchgq %1,%2" \ - : "=a"(__ret) \ - : "r"(__new), "m"(*__xg(ptr)), "0"(__old) \ + asm volatile(lock "cmpxchgq %2,%1" \ + : "=a" (__ret), "+m" (*__xg(ptr)) \ + : "r" (__new), "0" (__old) \ : "memory"); \ break; \ default: \ ^ permalink raw reply related [flat|nested] 666+ messages in thread
* Re: [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-07-28 5:33 ` [tip:x86/urgent] x86: Add memory modify constraints to " tip-bot for H. Peter Anvin @ 2010-07-28 15:45 ` Linus Torvalds 2010-07-28 15:59 ` H. Peter Anvin ` (4 more replies) 2010-08-02 23:51 ` [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() Jeremy Fitzhardinge 1 sibling, 5 replies; 666+ messages in thread From: Linus Torvalds @ 2010-07-28 15:45 UTC (permalink / raw) To: mingo, hpa, linux-kernel, torvalds, glommer, alan, zamsden, stable, mtosatti, gregkh, peter, tglx, avi Cc: linux-tip-commits On Tue, Jul 27, 2010 at 10:33 PM, tip-bot for H. Peter Anvin <hpa@zytor.com> wrote: > > x86: Add memory modify constraints to xchg() and cmpxchg() Ack. I assume this doesn't really change the code generated? At least not with a gcc that honors the whole memory clobber thing properly? I also suspect that we can/should get rid of the __xg() thing - it was there just to make sure gcc didn't see the memory read as a single word and tried to optimize it. With the "+m" it probably doesn't matter any more (don't know if it ever did) Linus ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-07-28 15:45 ` Linus Torvalds @ 2010-07-28 15:59 ` H. Peter Anvin 2010-07-28 23:00 ` H. Peter Anvin ` (3 subsequent siblings) 4 siblings, 0 replies; 666+ messages in thread From: H. Peter Anvin @ 2010-07-28 15:59 UTC (permalink / raw) To: Linus Torvalds Cc: mingo, linux-kernel, glommer, alan, zamsden, stable, mtosatti, gregkh, peter, tglx, avi, linux-tip-commits On 07/28/2010 08:45 AM, Linus Torvalds wrote: > On Tue, Jul 27, 2010 at 10:33 PM, tip-bot for H. Peter Anvin > <hpa@zytor.com> wrote: >> >> x86: Add memory modify constraints to xchg() and cmpxchg() > > Ack. I assume this doesn't really change the code generated? At least > not with a gcc that honors the whole memory clobber thing properly? I didn't do a binary A:B comparison, on the assumption it would preturb the code too much to be equal, but I guess it would be a good idea to at least try. > I also suspect that we can/should get rid of the __xg() thing - it was > there just to make sure gcc didn't see the memory read as a single > word and tried to optimize it. With the "+m" it probably doesn't > matter any more (don't know if it ever did) "+m" would still see as a single word, but the __xg() thing should be obsoleted by asm volatile + "memory", neither of which were in the 1.3.11 version. -hpa -- H. Peter Anvin, Intel Open Source Technology Center I work for Intel. I don't speak on their behalf. ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-07-28 15:45 ` Linus Torvalds 2010-07-28 15:59 ` H. Peter Anvin @ 2010-07-28 23:00 ` H. Peter Anvin 2010-07-28 23:28 ` [tip:x86/asm] x86, asm: Clean up and simplify <asm/cmpxchg.h> tip-bot for H. Peter Anvin ` (2 subsequent siblings) 4 siblings, 0 replies; 666+ messages in thread From: H. Peter Anvin @ 2010-07-28 23:00 UTC (permalink / raw) To: Linus Torvalds Cc: mingo, linux-kernel, glommer, alan, zamsden, stable, mtosatti, gregkh, peter, tglx, avi, linux-tip-commits On 07/28/2010 08:45 AM, Linus Torvalds wrote: > On Tue, Jul 27, 2010 at 10:33 PM, tip-bot for H. Peter Anvin > <hpa@zytor.com> wrote: >> >> x86: Add memory modify constraints to xchg() and cmpxchg() > > Ack. I assume this doesn't really change the code generated? At least > not with a gcc that honors the whole memory clobber thing properly? > > I also suspect that we can/should get rid of the __xg() thing - it was > there just to make sure gcc didn't see the memory read as a single > word and tried to optimize it. With the "+m" it probably doesn't > matter any more (don't know if it ever did) > For what it's worth, it fairly heavily preturbs code around __set_64bit(), which implies it actually does something useful in that case. The rest of the code looks similar enough. -hpa ^ permalink raw reply [flat|nested] 666+ messages in thread
* [tip:x86/asm] x86, asm: Clean up and simplify <asm/cmpxchg.h> 2010-07-28 15:45 ` Linus Torvalds 2010-07-28 15:59 ` H. Peter Anvin 2010-07-28 23:00 ` H. Peter Anvin @ 2010-07-28 23:28 ` tip-bot for H. Peter Anvin 2010-07-29 20:12 ` [tip:x86/asm] x86, asm: Move cmpxchg emulation code to arch/x86/lib tip-bot for H. Peter Anvin 2010-07-29 20:13 ` [tip:x86/asm] x86, asm: Merge cmpxchg_486_u64() and cmpxchg8b_emu() tip-bot for H. Peter Anvin 4 siblings, 0 replies; 666+ messages in thread From: tip-bot for H. Peter Anvin @ 2010-07-28 23:28 UTC (permalink / raw) To: linux-tip-commits; +Cc: linux-kernel, hpa, mingo, tglx, hpa Commit-ID: 4532b305e8f0c238dd73048068ff8a6dd1380291 Gitweb: http://git.kernel.org/tip/4532b305e8f0c238dd73048068ff8a6dd1380291 Author: H. Peter Anvin <hpa@linux.intel.com> AuthorDate: Wed, 28 Jul 2010 15:18:35 -0700 Committer: H. Peter Anvin <hpa@linux.intel.com> CommitDate: Wed, 28 Jul 2010 15:24:09 -0700 x86, asm: Clean up and simplify <asm/cmpxchg.h> Remove the __xg() hack to create a memory barrier near xchg and cmpxchg; it has been there since 1.3.11 but should not be necessary with "asm volatile" and a "memory" clobber, neither of which were there in the original implementation. However, we *should* make this a volatile reference. Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> LKML-Reference: <AANLkTikAmaDPji-TVDarmG1yD=fwbffcsmEU=YEuP+8r@mail.gmail.com> --- arch/x86/include/asm/cmpxchg_32.h | 75 ++++++++++++++++++++---------------- arch/x86/include/asm/cmpxchg_64.h | 61 ++++++++++++++++++++--------- 2 files changed, 84 insertions(+), 52 deletions(-) diff --git a/arch/x86/include/asm/cmpxchg_32.h b/arch/x86/include/asm/cmpxchg_32.h index 20955ea..f5bd1fd 100644 --- a/arch/x86/include/asm/cmpxchg_32.h +++ b/arch/x86/include/asm/cmpxchg_32.h @@ -11,38 +11,42 @@ extern void __xchg_wrong_size(void); /* - * Note: no "lock" prefix even on SMP: xchg always implies lock anyway - * Note 2: xchg has side effect, so that attribute volatile is necessary, - * but generally the primitive is invalid, *ptr is output argument. --ANK + * Note: no "lock" prefix even on SMP: xchg always implies lock anyway. + * Since this is generally used to protect other memory information, we + * use "asm volatile" and "memory" clobbers to prevent gcc from moving + * information around. */ - -struct __xchg_dummy { - unsigned long a[100]; -}; -#define __xg(x) ((struct __xchg_dummy *)(x)) - #define __xchg(x, ptr, size) \ ({ \ __typeof(*(ptr)) __x = (x); \ switch (size) { \ case 1: \ - asm volatile("xchgb %b0,%1" \ - : "=q" (__x), "+m" (*__xg(ptr)) \ + { \ + volatile u8 *__ptr = (volatile u8 *)(ptr); \ + asm volatile("xchgb %0,%1" \ + : "=q" (__x), "+m" (*__ptr) \ : "0" (__x) \ : "memory"); \ break; \ + } \ case 2: \ - asm volatile("xchgw %w0,%1" \ - : "=r" (__x), "+m" (*__xg(ptr)) \ + { \ + volatile u16 *__ptr = (volatile u16 *)(ptr); \ + asm volatile("xchgw %0,%1" \ + : "=r" (__x), "+m" (*__ptr) \ : "0" (__x) \ : "memory"); \ break; \ + } \ case 4: \ + { \ + volatile u32 *__ptr = (volatile u32 *)(ptr); \ asm volatile("xchgl %0,%1" \ - : "=r" (__x), "+m" (*__xg(ptr)) \ + : "=r" (__x), "+m" (*__ptr) \ : "0" (__x) \ : "memory"); \ break; \ + } \ default: \ __xchg_wrong_size(); \ } \ @@ -94,23 +98,32 @@ extern void __cmpxchg_wrong_size(void); __typeof__(*(ptr)) __new = (new); \ switch (size) { \ case 1: \ - asm volatile(lock "cmpxchgb %b2,%1" \ - : "=a" (__ret), "+m" (*__xg(ptr)) \ + { \ + volatile u8 *__ptr = (volatile u8 *)(ptr); \ + asm volatile(lock "cmpxchgb %2,%1" \ + : "=a" (__ret), "+m" (*__ptr) \ : "q" (__new), "0" (__old) \ : "memory"); \ break; \ + } \ case 2: \ - asm volatile(lock "cmpxchgw %w2,%1" \ - : "=a" (__ret), "+m" (*__xg(ptr)) \ + { \ + volatile u16 *__ptr = (volatile u16 *)(ptr); \ + asm volatile(lock "cmpxchgw %2,%1" \ + : "=a" (__ret), "+m" (*__ptr) \ : "r" (__new), "0" (__old) \ : "memory"); \ break; \ + } \ case 4: \ + { \ + volatile u32 *__ptr = (volatile u32 *)(ptr); \ asm volatile(lock "cmpxchgl %2,%1" \ - : "=a" (__ret), "+m" (*__xg(ptr)) \ + : "=a" (__ret), "+m" (*__ptr) \ : "r" (__new), "0" (__old) \ : "memory"); \ break; \ + } \ default: \ __cmpxchg_wrong_size(); \ } \ @@ -148,31 +161,27 @@ extern void __cmpxchg_wrong_size(void); (unsigned long long)(n))) #endif -static inline unsigned long long __cmpxchg64(volatile void *ptr, - unsigned long long old, - unsigned long long new) +static inline u64 __cmpxchg64(volatile u64 *ptr, u64 old, u64 new) { - unsigned long long prev; + u64 prev; asm volatile(LOCK_PREFIX "cmpxchg8b %1" : "=A" (prev), - "+m" (*__xg(ptr)) - : "b" ((unsigned long)new), - "c" ((unsigned long)(new >> 32)), + "+m" (*ptr) + : "b" ((u32)new), + "c" ((u32)(new >> 32)), "0" (old) : "memory"); return prev; } -static inline unsigned long long __cmpxchg64_local(volatile void *ptr, - unsigned long long old, - unsigned long long new) +static inline u64 __cmpxchg64_local(volatile u64 *ptr, u64 old, u64 new) { - unsigned long long prev; + u64 prev; asm volatile("cmpxchg8b %1" : "=A" (prev), - "+m" (*__xg(ptr)) - : "b" ((unsigned long)new), - "c" ((unsigned long)(new >> 32)), + "+m" (*ptr) + : "b" ((u32)new), + "c" ((u32)(new >> 32)), "0" (old) : "memory"); return prev; diff --git a/arch/x86/include/asm/cmpxchg_64.h b/arch/x86/include/asm/cmpxchg_64.h index 9596e7c..423ae58 100644 --- a/arch/x86/include/asm/cmpxchg_64.h +++ b/arch/x86/include/asm/cmpxchg_64.h @@ -3,8 +3,6 @@ #include <asm/alternative.h> /* Provides LOCK_PREFIX */ -#define __xg(x) ((volatile long *)(x)) - static inline void set_64bit(volatile u64 *ptr, u64 val) { *ptr = val; @@ -14,38 +12,51 @@ extern void __xchg_wrong_size(void); extern void __cmpxchg_wrong_size(void); /* - * Note: no "lock" prefix even on SMP: xchg always implies lock anyway - * Note 2: xchg has side effect, so that attribute volatile is necessary, - * but generally the primitive is invalid, *ptr is output argument. --ANK + * Note: no "lock" prefix even on SMP: xchg always implies lock anyway. + * Since this is generally used to protect other memory information, we + * use "asm volatile" and "memory" clobbers to prevent gcc from moving + * information around. */ #define __xchg(x, ptr, size) \ ({ \ __typeof(*(ptr)) __x = (x); \ switch (size) { \ case 1: \ - asm volatile("xchgb %b0,%1" \ - : "=q" (__x), "+m" (*__xg(ptr)) \ + { \ + volatile u8 *__ptr = (volatile u8 *)(ptr); \ + asm volatile("xchgb %0,%1" \ + : "=q" (__x), "+m" (*__ptr) \ : "0" (__x) \ : "memory"); \ break; \ + } \ case 2: \ - asm volatile("xchgw %w0,%1" \ - : "=r" (__x), "+m" (*__xg(ptr)) \ + { \ + volatile u16 *__ptr = (volatile u16 *)(ptr); \ + asm volatile("xchgw %0,%1" \ + : "=r" (__x), "+m" (*__ptr) \ : "0" (__x) \ : "memory"); \ break; \ + } \ case 4: \ - asm volatile("xchgl %k0,%1" \ - : "=r" (__x), "+m" (*__xg(ptr)) \ + { \ + volatile u32 *__ptr = (volatile u32 *)(ptr); \ + asm volatile("xchgl %0,%1" \ + : "=r" (__x), "+m" (*__ptr) \ : "0" (__x) \ : "memory"); \ break; \ + } \ case 8: \ + { \ + volatile u64 *__ptr = (volatile u64 *)(ptr); \ asm volatile("xchgq %0,%1" \ - : "=r" (__x), "+m" (*__xg(ptr)) \ + : "=r" (__x), "+m" (*__ptr) \ : "0" (__x) \ : "memory"); \ break; \ + } \ default: \ __xchg_wrong_size(); \ } \ @@ -69,29 +80,41 @@ extern void __cmpxchg_wrong_size(void); __typeof__(*(ptr)) __new = (new); \ switch (size) { \ case 1: \ - asm volatile(lock "cmpxchgb %b2,%1" \ - : "=a" (__ret), "+m" (*__xg(ptr)) \ + { \ + volatile u8 *__ptr = (volatile u8 *)(ptr); \ + asm volatile(lock "cmpxchgb %2,%1" \ + : "=a" (__ret), "+m" (*__ptr) \ : "q" (__new), "0" (__old) \ : "memory"); \ break; \ + } \ case 2: \ - asm volatile(lock "cmpxchgw %w2,%1" \ - : "=a" (__ret), "+m" (*__xg(ptr)) \ + { \ + volatile u16 *__ptr = (volatile u16 *)(ptr); \ + asm volatile(lock "cmpxchgw %2,%1" \ + : "=a" (__ret), "+m" (*__ptr) \ : "r" (__new), "0" (__old) \ : "memory"); \ break; \ + } \ case 4: \ - asm volatile(lock "cmpxchgl %k2,%1" \ - : "=a" (__ret), "+m" (*__xg(ptr)) \ + { \ + volatile u32 *__ptr = (volatile u32 *)(ptr); \ + asm volatile(lock "cmpxchgl %2,%1" \ + : "=a" (__ret), "+m" (*__ptr) \ : "r" (__new), "0" (__old) \ : "memory"); \ break; \ + } \ case 8: \ + { \ + volatile u64 *__ptr = (volatile u64 *)(ptr); \ asm volatile(lock "cmpxchgq %2,%1" \ - : "=a" (__ret), "+m" (*__xg(ptr)) \ + : "=a" (__ret), "+m" (*__ptr) \ : "r" (__new), "0" (__old) \ : "memory"); \ break; \ + } \ default: \ __cmpxchg_wrong_size(); \ } \ ^ permalink raw reply related [flat|nested] 666+ messages in thread
* [tip:x86/asm] x86, asm: Move cmpxchg emulation code to arch/x86/lib 2010-07-28 15:45 ` Linus Torvalds ` (2 preceding siblings ...) 2010-07-28 23:28 ` [tip:x86/asm] x86, asm: Clean up and simplify <asm/cmpxchg.h> tip-bot for H. Peter Anvin @ 2010-07-29 20:12 ` tip-bot for H. Peter Anvin 2010-07-29 20:13 ` [tip:x86/asm] x86, asm: Merge cmpxchg_486_u64() and cmpxchg8b_emu() tip-bot for H. Peter Anvin 4 siblings, 0 replies; 666+ messages in thread From: tip-bot for H. Peter Anvin @ 2010-07-29 20:12 UTC (permalink / raw) To: linux-tip-commits; +Cc: linux-kernel, hpa, mingo, tglx, hpa Commit-ID: 90c8f92f5c807807ca74d5f2f313794925174e6b Gitweb: http://git.kernel.org/tip/90c8f92f5c807807ca74d5f2f313794925174e6b Author: H. Peter Anvin <hpa@linux.intel.com> AuthorDate: Wed, 28 Jul 2010 16:53:49 -0700 Committer: H. Peter Anvin <hpa@linux.intel.com> CommitDate: Wed, 28 Jul 2010 16:53:49 -0700 x86, asm: Move cmpxchg emulation code to arch/x86/lib Move cmpxchg emulation code from arch/x86/kernel/cpu (which is otherwise CPU identification) to arch/x86/lib, where other emulation code lives already. Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> LKML-Reference: <AANLkTikAmaDPji-TVDarmG1yD=fwbffcsmEU=YEuP+8r@mail.gmail.com> --- arch/x86/kernel/cpu/Makefile | 2 +- arch/x86/lib/Makefile | 1 + arch/x86/{kernel/cpu => lib}/cmpxchg.c | 0 3 files changed, 2 insertions(+), 1 deletions(-) diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile index 3a785da..c47c439 100644 --- a/arch/x86/kernel/cpu/Makefile +++ b/arch/x86/kernel/cpu/Makefile @@ -16,7 +16,7 @@ obj-y := intel_cacheinfo.o addon_cpuid_features.o obj-y += proc.o capflags.o powerflags.o common.o obj-y += vmware.o hypervisor.o sched.o mshyperv.o -obj-$(CONFIG_X86_32) += bugs.o cmpxchg.o +obj-$(CONFIG_X86_32) += bugs.o obj-$(CONFIG_X86_64) += bugs_64.o obj-$(CONFIG_CPU_SUP_INTEL) += intel.o diff --git a/arch/x86/lib/Makefile b/arch/x86/lib/Makefile index f871e04..e10cf07 100644 --- a/arch/x86/lib/Makefile +++ b/arch/x86/lib/Makefile @@ -30,6 +30,7 @@ ifeq ($(CONFIG_X86_32),y) lib-y += checksum_32.o lib-y += strstr_32.o lib-y += semaphore_32.o string_32.o + lib-y += cmpxchg.o ifneq ($(CONFIG_X86_CMPXCHG64),y) lib-y += cmpxchg8b_emu.o atomic64_386_32.o endif diff --git a/arch/x86/kernel/cpu/cmpxchg.c b/arch/x86/lib/cmpxchg.c similarity index 100% rename from arch/x86/kernel/cpu/cmpxchg.c rename to arch/x86/lib/cmpxchg.c ^ permalink raw reply related [flat|nested] 666+ messages in thread
* [tip:x86/asm] x86, asm: Merge cmpxchg_486_u64() and cmpxchg8b_emu() 2010-07-28 15:45 ` Linus Torvalds ` (3 preceding siblings ...) 2010-07-29 20:12 ` [tip:x86/asm] x86, asm: Move cmpxchg emulation code to arch/x86/lib tip-bot for H. Peter Anvin @ 2010-07-29 20:13 ` tip-bot for H. Peter Anvin 4 siblings, 0 replies; 666+ messages in thread From: tip-bot for H. Peter Anvin @ 2010-07-29 20:13 UTC (permalink / raw) To: linux-tip-commits; +Cc: linux-kernel, hpa, mingo, tglx, hpa Commit-ID: a378d9338e8dde78314b3a6ae003de351936c729 Gitweb: http://git.kernel.org/tip/a378d9338e8dde78314b3a6ae003de351936c729 Author: H. Peter Anvin <hpa@linux.intel.com> AuthorDate: Wed, 28 Jul 2010 17:05:11 -0700 Committer: H. Peter Anvin <hpa@linux.intel.com> CommitDate: Wed, 28 Jul 2010 17:05:11 -0700 x86, asm: Merge cmpxchg_486_u64() and cmpxchg8b_emu() We have two functions for doing exactly the same thing -- emulating cmpxchg8b on 486 and older hardware -- with different calling conventions, and yet doing the same thing. Drop the C version and use the assembly version, via alternatives, for both the local and non-local versions of cmpxchg8b. Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> LKML-Reference: <AANLkTikAmaDPji-TVDarmG1yD=fwbffcsmEU=YEuP+8r@mail.gmail.com> --- arch/x86/include/asm/cmpxchg_32.h | 30 ++++++++++++++---------------- arch/x86/lib/cmpxchg.c | 18 ------------------ 2 files changed, 14 insertions(+), 34 deletions(-) diff --git a/arch/x86/include/asm/cmpxchg_32.h b/arch/x86/include/asm/cmpxchg_32.h index f5bd1fd..284a6e8 100644 --- a/arch/x86/include/asm/cmpxchg_32.h +++ b/arch/x86/include/asm/cmpxchg_32.h @@ -246,8 +246,6 @@ static inline unsigned long cmpxchg_386(volatile void *ptr, unsigned long old, * to simulate the cmpxchg8b on the 80386 and 80486 CPU. */ -extern unsigned long long cmpxchg_486_u64(volatile void *, u64, u64); - #define cmpxchg64(ptr, o, n) \ ({ \ __typeof__(*(ptr)) __ret; \ @@ -265,20 +263,20 @@ extern unsigned long long cmpxchg_486_u64(volatile void *, u64, u64); __ret; }) - -#define cmpxchg64_local(ptr, o, n) \ -({ \ - __typeof__(*(ptr)) __ret; \ - if (likely(boot_cpu_data.x86 > 4)) \ - __ret = (__typeof__(*(ptr)))__cmpxchg64_local((ptr), \ - (unsigned long long)(o), \ - (unsigned long long)(n)); \ - else \ - __ret = (__typeof__(*(ptr)))cmpxchg_486_u64((ptr), \ - (unsigned long long)(o), \ - (unsigned long long)(n)); \ - __ret; \ -}) +#define cmpxchg64_local(ptr, o, n) \ +({ \ + __typeof__(*(ptr)) __ret; \ + __typeof__(*(ptr)) __old = (o); \ + __typeof__(*(ptr)) __new = (n); \ + alternative_io("call cmpxchg8b_emu", \ + "cmpxchg8b (%%esi)" , \ + X86_FEATURE_CX8, \ + "=A" (__ret), \ + "S" ((ptr)), "0" (__old), \ + "b" ((unsigned int)__new), \ + "c" ((unsigned int)(__new>>32)) \ + : "memory"); \ + __ret; }) #endif diff --git a/arch/x86/lib/cmpxchg.c b/arch/x86/lib/cmpxchg.c index 2056ccf..5d619f6 100644 --- a/arch/x86/lib/cmpxchg.c +++ b/arch/x86/lib/cmpxchg.c @@ -52,21 +52,3 @@ unsigned long cmpxchg_386_u32(volatile void *ptr, u32 old, u32 new) } EXPORT_SYMBOL(cmpxchg_386_u32); #endif - -#ifndef CONFIG_X86_CMPXCHG64 -unsigned long long cmpxchg_486_u64(volatile void *ptr, u64 old, u64 new) -{ - u64 prev; - unsigned long flags; - - /* Poor man's cmpxchg8b for 386 and 486. Unsuitable for SMP */ - local_irq_save(flags); - prev = *(u64 *)ptr; - if (prev == old) - *(u64 *)ptr = new; - local_irq_restore(flags); - return prev; -} -EXPORT_SYMBOL(cmpxchg_486_u64); -#endif - ^ permalink raw reply related [flat|nested] 666+ messages in thread
* Re: [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-07-28 5:33 ` [tip:x86/urgent] x86: Add memory modify constraints to " tip-bot for H. Peter Anvin 2010-07-28 15:45 ` Linus Torvalds @ 2010-08-02 23:51 ` Jeremy Fitzhardinge 2010-08-02 23:59 ` [stable] " Greg KH 2010-08-03 12:43 ` Peter Palfrader 1 sibling, 2 replies; 666+ messages in thread From: Jeremy Fitzhardinge @ 2010-08-02 23:51 UTC (permalink / raw) To: mingo, H. Peter Anvin, linux-kernel, torvalds, glommer, alan, zamsden, stable, mtosatti, gregkh, peter, tglx, avi Cc: linux-tip-commits, Stable Kernel On 07/27/2010 10:33 PM, tip-bot for H. Peter Anvin wrote: > Commit-ID: 113fc5a6e8c2288619ff7e8187a6f556b7e0d372 > Gitweb: http://git.kernel.org/tip/113fc5a6e8c2288619ff7e8187a6f556b7e0d372 > Author: H. Peter Anvin<hpa@zytor.com> > AuthorDate: Tue, 27 Jul 2010 17:01:49 -0700 > Committer: H. Peter Anvin<hpa@zytor.com> > CommitDate: Tue, 27 Jul 2010 17:14:02 -0700 > > x86: Add memory modify constraints to xchg() and cmpxchg() Here's the 2.6.32 version for stable. J From: Jeremy Fitzhardinge<jeremy.fitzhardinge@citrix.com> Date: Tue, 27 Jul 2010 23:03:58 -0700 Subject: [PATCH] x86: Add memory modify constraints to xchg() and cmpxchg() xchg() and cmpxchg() modify their memory operands, not merely read them. For some versions of gcc the "memory" clobber has apparently dealt with the situation, but not for all. Also adds the missing 8-byte case for __sync_cmpxchg(). Based on HPA's patch. Signed-off-by: Jeremy Fitzhardinge<jeremy.fitzhardinge@citrix.com> Cc: "H. Peter Anvin"<hpa@zytor.com> Cc: Stable Kernel<stable@kernel.org> diff --git a/arch/x86/include/asm/cmpxchg_32.h b/arch/x86/include/asm/cmpxchg_32.h index ee1931b..5af5051 100644 --- a/arch/x86/include/asm/cmpxchg_32.h +++ b/arch/x86/include/asm/cmpxchg_32.h @@ -34,12 +34,12 @@ static inline void __set_64bit(unsigned long long *ptr, unsigned int low, unsigned int high) { asm volatile("\n1:\t" - "movl (%0), %%eax\n\t" - "movl 4(%0), %%edx\n\t" - LOCK_PREFIX "cmpxchg8b (%0)\n\t" + "movl (%1), %%eax\n\t" + "movl 4(%1), %%edx\n\t" + LOCK_PREFIX "cmpxchg8b %0\n\t" "jnz 1b" - : /* no outputs */ - : "D"(ptr), + : "=m"(*ptr) + : "D" (ptr), "b"(low), "c"(high) : "ax", "dx", "memory"); @@ -82,20 +82,20 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, switch (size) { case 1: asm volatile("xchgb %b0,%1" - : "=q" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=q" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; case 2: asm volatile("xchgw %w0,%1" - : "=r" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=r" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; case 4: asm volatile("xchgl %0,%1" - : "=r" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=r" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; } @@ -139,21 +139,21 @@ static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old, unsigned long prev; switch (size) { case 1: - asm volatile(LOCK_PREFIX "cmpxchgb %b1,%2" - : "=a"(prev) - : "q"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile(LOCK_PREFIX "cmpxchgb %b2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "q"(new), "0"(old) : "memory"); return prev; case 2: - asm volatile(LOCK_PREFIX "cmpxchgw %w1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile(LOCK_PREFIX "cmpxchgw %w2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 4: - asm volatile(LOCK_PREFIX "cmpxchgl %1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile(LOCK_PREFIX "cmpxchgl %2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; } @@ -172,21 +172,21 @@ static inline unsigned long __sync_cmpxchg(volatile void *ptr, unsigned long prev; switch (size) { case 1: - asm volatile("lock; cmpxchgb %b1,%2" - : "=a"(prev) - : "q"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("lock; cmpxchgb %b2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "q"(new), "0"(old) : "memory"); return prev; case 2: - asm volatile("lock; cmpxchgw %w1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("lock; cmpxchgw %w2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 4: - asm volatile("lock; cmpxchgl %1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("lock; cmpxchgl %2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; } @@ -200,21 +200,21 @@ static inline unsigned long __cmpxchg_local(volatile void *ptr, unsigned long prev; switch (size) { case 1: - asm volatile("cmpxchgb %b1,%2" - : "=a"(prev) - : "q"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("cmpxchgb %b2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "q"(new), "0"(old) : "memory"); return prev; case 2: - asm volatile("cmpxchgw %w1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("cmpxchgw %w2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 4: - asm volatile("cmpxchgl %1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("cmpxchgl %2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; } @@ -226,11 +226,10 @@ static inline unsigned long long __cmpxchg64(volatile void *ptr, unsigned long long new) { unsigned long long prev; - asm volatile(LOCK_PREFIX "cmpxchg8b %3" - : "=A"(prev) + asm volatile(LOCK_PREFIX "cmpxchg8b %1" + : "=A"(prev), "+m" (*__xg(ptr)) : "b"((unsigned long)new), "c"((unsigned long)(new>> 32)), - "m"(*__xg(ptr)), "0"(old) : "memory"); return prev; @@ -241,11 +240,10 @@ static inline unsigned long long __cmpxchg64_local(volatile void *ptr, unsigned long long new) { unsigned long long prev; - asm volatile("cmpxchg8b %3" - : "=A"(prev) + asm volatile("cmpxchg8b %1" + : "=A"(prev), "+m"(*__xg(ptr)) : "b"((unsigned long)new), "c"((unsigned long)(new>> 32)), - "m"(*__xg(ptr)), "0"(old) : "memory"); return prev; diff --git a/arch/x86/include/asm/cmpxchg_64.h b/arch/x86/include/asm/cmpxchg_64.h index 52de72e..1871cb0 100644 --- a/arch/x86/include/asm/cmpxchg_64.h +++ b/arch/x86/include/asm/cmpxchg_64.h @@ -26,26 +26,26 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, switch (size) { case 1: asm volatile("xchgb %b0,%1" - : "=q" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=q" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; case 2: asm volatile("xchgw %w0,%1" - : "=r" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=r" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; case 4: asm volatile("xchgl %k0,%1" - : "=r" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=r" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; case 8: asm volatile("xchgq %0,%1" - : "=r" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=r" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; } @@ -66,27 +66,27 @@ static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old, unsigned long prev; switch (size) { case 1: - asm volatile(LOCK_PREFIX "cmpxchgb %b1,%2" - : "=a"(prev) - : "q"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile(LOCK_PREFIX "cmpxchgb %b2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "q"(new), "0"(old) : "memory"); return prev; case 2: - asm volatile(LOCK_PREFIX "cmpxchgw %w1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile(LOCK_PREFIX "cmpxchgw %w2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 4: - asm volatile(LOCK_PREFIX "cmpxchgl %k1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile(LOCK_PREFIX "cmpxchgl %k2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 8: - asm volatile(LOCK_PREFIX "cmpxchgq %1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile(LOCK_PREFIX "cmpxchgq %2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; } @@ -105,21 +105,27 @@ static inline unsigned long __sync_cmpxchg(volatile void *ptr, unsigned long prev; switch (size) { case 1: - asm volatile("lock; cmpxchgb %b1,%2" - : "=a"(prev) - : "q"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("lock; cmpxchgb %b2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "q"(new), "0"(old) : "memory"); return prev; case 2: - asm volatile("lock; cmpxchgw %w1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("lock; cmpxchgw %w2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 4: - asm volatile("lock; cmpxchgl %1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("lock; cmpxchgl %k2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) + : "memory"); + return prev; + case 8: + asm volatile("lock; cmpxchgq %2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; } @@ -133,27 +139,27 @@ static inline unsigned long __cmpxchg_local(volatile void *ptr, unsigned long prev; switch (size) { case 1: - asm volatile("cmpxchgb %b1,%2" - : "=a"(prev) - : "q"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("cmpxchgb %b2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "q"(new), "0"(old) : "memory"); return prev; case 2: - asm volatile("cmpxchgw %w1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("cmpxchgw %w2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 4: - asm volatile("cmpxchgl %k1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("cmpxchgl %k2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 8: - asm volatile("cmpxchgq %1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("cmpxchgq %2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; } ^ permalink raw reply related [flat|nested] 666+ messages in thread
* Re: [stable] [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-08-02 23:51 ` [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() Jeremy Fitzhardinge @ 2010-08-02 23:59 ` Greg KH 2010-09-09 19:53 ` Tomáš Janoušek 2010-08-03 12:43 ` Peter Palfrader 1 sibling, 1 reply; 666+ messages in thread From: Greg KH @ 2010-08-02 23:59 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: mingo, H. Peter Anvin, linux-kernel, torvalds, glommer, alan, zamsden, stable, mtosatti, gregkh, peter, tglx, avi, linux-tip-commits On Mon, Aug 02, 2010 at 04:51:27PM -0700, Jeremy Fitzhardinge wrote: > On 07/27/2010 10:33 PM, tip-bot for H. Peter Anvin wrote: > >Commit-ID: 113fc5a6e8c2288619ff7e8187a6f556b7e0d372 > >Gitweb: http://git.kernel.org/tip/113fc5a6e8c2288619ff7e8187a6f556b7e0d372 > >Author: H. Peter Anvin<hpa@zytor.com> > >AuthorDate: Tue, 27 Jul 2010 17:01:49 -0700 > >Committer: H. Peter Anvin<hpa@zytor.com> > >CommitDate: Tue, 27 Jul 2010 17:14:02 -0700 > > > >x86: Add memory modify constraints to xchg() and cmpxchg() > > Here's the 2.6.32 version for stable. Thanks, I'll queue it up when it hits Linus's tree. greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [stable] [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-08-02 23:59 ` [stable] " Greg KH @ 2010-09-09 19:53 ` Tomáš Janoušek 2010-09-09 21:00 ` H. Peter Anvin 2010-09-09 21:15 ` H. Peter Anvin 0 siblings, 2 replies; 666+ messages in thread From: Tomáš Janoušek @ 2010-09-09 19:53 UTC (permalink / raw) To: Greg KH Cc: Jeremy Fitzhardinge, mingo, H. Peter Anvin, linux-kernel, torvalds, glommer, alan, zamsden, stable, mtosatti, gregkh, peter, tglx, avi, linux-tip-commits Hello, 2.6.32.21 does not boot on my HP Compaq nx7300. I bisected it to this patch: On Mon, Aug 02, 2010 at 04:59:50PM -0700, Greg KH wrote: > On Mon, Aug 02, 2010 at 04:51:27PM -0700, Jeremy Fitzhardinge wrote: > > On 07/27/2010 10:33 PM, tip-bot for H. Peter Anvin wrote: > > >Commit-ID: 113fc5a6e8c2288619ff7e8187a6f556b7e0d372 > > >Gitweb: http://git.kernel.org/tip/113fc5a6e8c2288619ff7e8187a6f556b7e0d372 > > >Author: H. Peter Anvin<hpa@zytor.com> > > >AuthorDate: Tue, 27 Jul 2010 17:01:49 -0700 > > >Committer: H. Peter Anvin<hpa@zytor.com> > > >CommitDate: Tue, 27 Jul 2010 17:14:02 -0700 > > > > > >x86: Add memory modify constraints to xchg() and cmpxchg() > > > > Here's the 2.6.32 version for stable. > > Thanks, I'll queue it up when it hits Linus's tree. Here's a video of the crash: http://store.lisk.in/tmp/09092010019.mp4 With boot_delay=30, it sometimes just reboots and sometimes prints the trace. Without it, it always prints the trace. The crash occurs during the initialization of intel-agp (which explains why I can't reproduce it in qemu). More details in the video. The system boots and works just fine with 2.6.32.21 with the patch reverted. v2.6.36-rc3-185-gd56557a works fine as well, perhaps there were other fixes that didn't get to stable (e.g. 4532b30). I'm compiling the kernel with the latest gcc in Debian (-dumpversion says 4.4.5, dpkg reports 4:4.4.4-2). Shall I post dmesg/lspci as well? Since I have an easy workaround and other things to do, I won't spend time trying to backport those other fixes myself, but if you're going to fix this, I will help with testing. Regards, -- Tomáš Janoušek, a.k.a. Liskni_si, http://work.lisk.in/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [stable] [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-09-09 19:53 ` Tomáš Janoušek @ 2010-09-09 21:00 ` H. Peter Anvin 2010-09-09 21:09 ` Tomáš Janoušek 2010-09-09 21:15 ` H. Peter Anvin 1 sibling, 1 reply; 666+ messages in thread From: H. Peter Anvin @ 2010-09-09 21:00 UTC (permalink / raw) To: Tomáš Janoušek Cc: Greg KH, Jeremy Fitzhardinge, mingo, linux-kernel, torvalds, glommer, alan, zamsden, stable, mtosatti, gregkh, peter, tglx, avi, linux-tip-commits On 09/09/2010 12:53 PM, Tomáš Janoušek wrote: > Hello, > > 2.6.32.21 does not boot on my HP Compaq nx7300. I bisected it to this patch: > > On Mon, Aug 02, 2010 at 04:59:50PM -0700, Greg KH wrote: >> On Mon, Aug 02, 2010 at 04:51:27PM -0700, Jeremy Fitzhardinge wrote: >>> On 07/27/2010 10:33 PM, tip-bot for H. Peter Anvin wrote: >>>> Commit-ID: 113fc5a6e8c2288619ff7e8187a6f556b7e0d372 >>>> Gitweb: http://git.kernel.org/tip/113fc5a6e8c2288619ff7e8187a6f556b7e0d372 >>>> Author: H. Peter Anvin<hpa@zytor.com> >>>> AuthorDate: Tue, 27 Jul 2010 17:01:49 -0700 >>>> Committer: H. Peter Anvin<hpa@zytor.com> >>>> CommitDate: Tue, 27 Jul 2010 17:14:02 -0700 >>>> >>>> x86: Add memory modify constraints to xchg() and cmpxchg() >>> >>> Here's the 2.6.32 version for stable. >> >> Thanks, I'll queue it up when it hits Linus's tree. > > Here's a video of the crash: http://store.lisk.in/tmp/09092010019.mp4 > With boot_delay=30, it sometimes just reboots and sometimes prints the trace. > Without it, it always prints the trace. The crash occurs during the > initialization of intel-agp (which explains why I can't reproduce it in qemu). > More details in the video. > > The system boots and works just fine with 2.6.32.21 with the patch reverted. > v2.6.36-rc3-185-gd56557a works fine as well, perhaps there were other fixes > that didn't get to stable (e.g. 4532b30). > > I'm compiling the kernel with the latest gcc in Debian (-dumpversion says > 4.4.5, dpkg reports 4:4.4.4-2). Shall I post dmesg/lspci as well? > > Since I have an easy workaround and other things to do, I won't spend time > trying to backport those other fixes myself, but if you're going to fix this, > I will help with testing. > Could you give us your .config and also what version of gcc and binutils is on your system? -hpa ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [stable] [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-09-09 21:00 ` H. Peter Anvin @ 2010-09-09 21:09 ` Tomáš Janoušek 0 siblings, 0 replies; 666+ messages in thread From: Tomáš Janoušek @ 2010-09-09 21:09 UTC (permalink / raw) To: H. Peter Anvin Cc: Greg KH, Jeremy Fitzhardinge, mingo, linux-kernel, torvalds, glommer, alan, zamsden, stable, mtosatti, gregkh, peter, tglx, avi, linux-tip-commits Hello, On Thu, Sep 09, 2010 at 02:00:24PM -0700, H. Peter Anvin wrote: > Could you give us your .config and also what version of gcc and binutils > is on your system? http://store.lisk.in/tmp/.config.2.6.32.21-debug $ ld -V GNU ld (GNU Binutils for Debian) 2.20.1-system.20100303 (that's 2.20.1-12 in Debian testing) $ cc -dumpversion 4.4.5 (that's 4:4.4.4-2 in Debian testing) $ cat /proc/version Linux version 2.6.36-rc3-lis-00187-ga784c32 (tomi@notes.lisk.in) (gcc version 4.4.5 20100728 (prerelease) (Debian 4.4.4-8) ) #103 SMP Thu Sep 9 16:40:09 CEST 2010 Regards, -- Tomáš Janoušek, a.k.a. Liskni_si, http://work.lisk.in/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [stable] [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-09-09 19:53 ` Tomáš Janoušek 2010-09-09 21:00 ` H. Peter Anvin @ 2010-09-09 21:15 ` H. Peter Anvin 2010-09-10 13:10 ` Tomáš Janoušek 1 sibling, 1 reply; 666+ messages in thread From: H. Peter Anvin @ 2010-09-09 21:15 UTC (permalink / raw) To: Tomáš Janoušek Cc: Greg KH, Jeremy Fitzhardinge, mingo, linux-kernel, torvalds, glommer, alan, zamsden, stable, mtosatti, gregkh, peter, tglx, avi, linux-tip-commits > > The system boots and works just fine with 2.6.32.21 with the patch reverted. > v2.6.36-rc3-185-gd56557a works fine as well, perhaps there were other fixes > that didn't get to stable (e.g. 4532b30). > I believe this needs 69309a05907546fb686b251d4ab041c26afe1e1d, which I think is being queued up for stable. Could you try applying 69309a05907546fb686b251d4ab041c26afe1e1d and see if it solves your problem. -hpa ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [stable] [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-09-09 21:15 ` H. Peter Anvin @ 2010-09-10 13:10 ` Tomáš Janoušek 2010-09-23 18:37 ` Greg KH 0 siblings, 1 reply; 666+ messages in thread From: Tomáš Janoušek @ 2010-09-10 13:10 UTC (permalink / raw) To: H. Peter Anvin Cc: Greg KH, Jeremy Fitzhardinge, mingo, linux-kernel, torvalds, glommer, alan, zamsden, stable, mtosatti, gregkh, peter, tglx, avi, linux-tip-commits Hello, On Thu, Sep 09, 2010 at 02:15:16PM -0700, H. Peter Anvin wrote: > > The system boots and works just fine with 2.6.32.21 with the patch reverted. > > v2.6.36-rc3-185-gd56557a works fine as well, perhaps there were other fixes > > that didn't get to stable (e.g. 4532b30). > > I believe this needs 69309a05907546fb686b251d4ab041c26afe1e1d, which I > think is being queued up for stable. > > Could you try applying 69309a05907546fb686b251d4ab041c26afe1e1d and see > if it solves your problem. It does indeed. Thanks. -- Tomáš Janoušek, a.k.a. Liskni_si, http://work.lisk.in/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [stable] [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-09-10 13:10 ` Tomáš Janoušek @ 2010-09-23 18:37 ` Greg KH 2010-09-24 7:17 ` Tomáš Janoušek 0 siblings, 1 reply; 666+ messages in thread From: Greg KH @ 2010-09-23 18:37 UTC (permalink / raw) To: Tomáš Janoušek Cc: H. Peter Anvin, Jeremy Fitzhardinge, mingo, linux-kernel, torvalds, glommer, alan, zamsden, stable, mtosatti, gregkh, peter, tglx, avi, linux-tip-commits On Fri, Sep 10, 2010 at 03:10:35PM +0200, Tomáš Janoušek wrote: > Hello, > > On Thu, Sep 09, 2010 at 02:15:16PM -0700, H. Peter Anvin wrote: > > > The system boots and works just fine with 2.6.32.21 with the patch reverted. > > > v2.6.36-rc3-185-gd56557a works fine as well, perhaps there were other fixes > > > that didn't get to stable (e.g. 4532b30). > > > > I believe this needs 69309a05907546fb686b251d4ab041c26afe1e1d, which I > > think is being queued up for stable. > > > > Could you try applying 69309a05907546fb686b251d4ab041c26afe1e1d and see > > if it solves your problem. > > It does indeed. Thanks. Hm, that patch doesn't apply to the latest .32-stable tree. Can someone provide me with a backported version so I make sure I get it correct? thanks, greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [stable] [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-09-23 18:37 ` Greg KH @ 2010-09-24 7:17 ` Tomáš Janoušek 2010-09-24 15:52 ` Greg KH 0 siblings, 1 reply; 666+ messages in thread From: Tomáš Janoušek @ 2010-09-24 7:17 UTC (permalink / raw) To: Greg KH Cc: H. Peter Anvin, Jeremy Fitzhardinge, mingo, linux-kernel, torvalds, glommer, alan, zamsden, stable, mtosatti, gregkh, peter, tglx, avi, linux-tip-commits [-- Attachment #1: Type: text/plain, Size: 317 bytes --] Hello, On Thu, Sep 23, 2010 at 11:37:24AM -0700, Greg KH wrote: > Hm, that patch doesn't apply to the latest .32-stable tree. Can someone > provide me with a backported version so I make sure I get it correct? I'm attaching the one I used and tested. -- Tomáš Janoušek, a.k.a. Liskni_si, http://work.lisk.in/ [-- Attachment #2: 0001-x86-asm-Clean-up-and-simplify-set_64bit.patch --] [-- Type: text/plain, Size: 4867 bytes --] From 48a45b4cd701520435188fcf9ef0c04e73c79172 Mon Sep 17 00:00:00 2001 From: H. Peter Anvin <hpa@zytor.com> Date: Tue, 27 Jul 2010 23:29:52 -0700 Subject: [PATCH] x86, asm: Clean up and simplify set_64bit() Clean up and simplify set_64bit(). This code is quite old (1.3.11) and contains a fair bit of auxilliary machinery that current versions of gcc handle just fine automatically. Worse, the auxilliary machinery can actually cause an unnecessary spill to memory. Furthermore, the loading of the old value inside the loop in the 32-bit case is unnecessary: if the value doesn't match, the CMPXCHG8B instruction will already have loaded the "new previous" value for us. Clean up the comment, too, and remove page references to obsolete versions of the Intel SDM. Signed-off-by: H. Peter Anvin <hpa@zytor.com> LKML-Reference: <tip-*@vger.kernel.org> --- arch/x86/include/asm/cmpxchg_32.h | 65 +++++++++++-------------------------- arch/x86/include/asm/cmpxchg_64.h | 4 +-- 2 files changed, 20 insertions(+), 49 deletions(-) diff --git a/arch/x86/include/asm/cmpxchg_32.h b/arch/x86/include/asm/cmpxchg_32.h index 5af5051..9873a5f 100644 --- a/arch/x86/include/asm/cmpxchg_32.h +++ b/arch/x86/include/asm/cmpxchg_32.h @@ -17,60 +17,33 @@ struct __xchg_dummy { #define __xg(x) ((struct __xchg_dummy *)(x)) /* - * The semantics of XCHGCMP8B are a bit strange, this is why - * there is a loop and the loading of %%eax and %%edx has to - * be inside. This inlines well in most cases, the cached - * cost is around ~38 cycles. (in the future we might want - * to do an SIMD/3DNOW!/MMX/FPU 64-bit store here, but that - * might have an implicit FPU-save as a cost, so it's not - * clear which path to go.) + * CMPXCHG8B only writes to the target if we had the previous + * value in registers, otherwise it acts as a read and gives us the + * "new previous" value. That is why there is a loop. Preloading + * EDX:EAX is a performance optimization: in the common case it means + * we need only one locked operation. * - * cmpxchg8b must be used with the lock prefix here to allow - * the instruction to be executed atomically, see page 3-102 - * of the instruction set reference 24319102.pdf. We need - * the reader side to see the coherent 64bit value. + * A SIMD/3DNOW!/MMX/FPU 64-bit store here would require at the very + * least an FPU save and/or %cr0.ts manipulation. + * + * cmpxchg8b must be used with the lock prefix here to allow the + * instruction to be executed atomically. We need to have the reader + * side to see the coherent 64bit value. */ -static inline void __set_64bit(unsigned long long *ptr, - unsigned int low, unsigned int high) +static inline void set_64bit(volatile u64 *ptr, u64 value) { + u32 low = value; + u32 high = value >> 32; + u64 prev = *ptr; + asm volatile("\n1:\t" - "movl (%1), %%eax\n\t" - "movl 4(%1), %%edx\n\t" LOCK_PREFIX "cmpxchg8b %0\n\t" "jnz 1b" - : "=m"(*ptr) - : "D" (ptr), - "b"(low), - "c"(high) - : "ax", "dx", "memory"); -} - -static inline void __set_64bit_constant(unsigned long long *ptr, - unsigned long long value) -{ - __set_64bit(ptr, (unsigned int)value, (unsigned int)(value >> 32)); -} - -#define ll_low(x) *(((unsigned int *)&(x)) + 0) -#define ll_high(x) *(((unsigned int *)&(x)) + 1) - -static inline void __set_64bit_var(unsigned long long *ptr, - unsigned long long value) -{ - __set_64bit(ptr, ll_low(value), ll_high(value)); + : "=m" (*ptr), "+A" (prev) + : "b" (low), "c" (high) + : "memory"); } -#define set_64bit(ptr, value) \ - (__builtin_constant_p((value)) \ - ? __set_64bit_constant((ptr), (value)) \ - : __set_64bit_var((ptr), (value))) - -#define _set_64bit(ptr, value) \ - (__builtin_constant_p(value) \ - ? __set_64bit(ptr, (unsigned int)(value), \ - (unsigned int)((value) >> 32)) \ - : __set_64bit(ptr, ll_low((value)), ll_high((value)))) - /* * Note: no "lock" prefix even on SMP: xchg always implies lock anyway * Note 2: xchg has side effect, so that attribute volatile is necessary, diff --git a/arch/x86/include/asm/cmpxchg_64.h b/arch/x86/include/asm/cmpxchg_64.h index 1871cb0..e8cb051 100644 --- a/arch/x86/include/asm/cmpxchg_64.h +++ b/arch/x86/include/asm/cmpxchg_64.h @@ -8,13 +8,11 @@ #define __xg(x) ((volatile long *)(x)) -static inline void set_64bit(volatile unsigned long *ptr, unsigned long val) +static inline void set_64bit(volatile u64 *ptr, u64 val) { *ptr = val; } -#define _set_64bit set_64bit - /* * Note: no "lock" prefix even on SMP: xchg always implies lock anyway * Note 2: xchg has side effect, so that attribute volatile is necessary, -- 1.7.1 ^ permalink raw reply related [flat|nested] 666+ messages in thread
* Re: [stable] [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-09-24 7:17 ` Tomáš Janoušek @ 2010-09-24 15:52 ` Greg KH 0 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-09-24 15:52 UTC (permalink / raw) To: Tomáš Janoušek Cc: H. Peter Anvin, Jeremy Fitzhardinge, mingo, linux-kernel, torvalds, glommer, alan, zamsden, stable, mtosatti, gregkh, peter, tglx, avi, linux-tip-commits On Fri, Sep 24, 2010 at 09:17:36AM +0200, Tomáš Janoušek wrote: > Hello, > > On Thu, Sep 23, 2010 at 11:37:24AM -0700, Greg KH wrote: > > Hm, that patch doesn't apply to the latest .32-stable tree. Can someone > > provide me with a backported version so I make sure I get it correct? > > I'm attaching the one I used and tested. That worked, thanks, I've queued it up now. greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-08-02 23:51 ` [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() Jeremy Fitzhardinge 2010-08-02 23:59 ` [stable] " Greg KH @ 2010-08-03 12:43 ` Peter Palfrader 2010-08-10 22:33 ` Greg KH 1 sibling, 1 reply; 666+ messages in thread From: Peter Palfrader @ 2010-08-03 12:43 UTC (permalink / raw) To: Jeremy Fitzhardinge Cc: mingo, H. Peter Anvin, linux-kernel, torvalds, glommer, alan, zamsden, stable, mtosatti, gregkh, tglx, avi, linux-tip-commits [-- Attachment #1: Type: text/plain, Size: 936 bytes --] On Mon, 02 Aug 2010, Jeremy Fitzhardinge wrote: >> Commit-ID: 113fc5a6e8c2288619ff7e8187a6f556b7e0d372 >> Gitweb: http://git.kernel.org/tip/113fc5a6e8c2288619ff7e8187a6f556b7e0d372 >> Author: H. Peter Anvin<hpa@zytor.com> >> AuthorDate: Tue, 27 Jul 2010 17:01:49 -0700 >> Committer: H. Peter Anvin<hpa@zytor.com> >> CommitDate: Tue, 27 Jul 2010 17:14:02 -0700 >> >> x86: Add memory modify constraints to xchg() and cmpxchg() > > Here's the 2.6.32 version for stable. Thanks a lot everyone. This patch resolves the issue for me on top of 2.6.32.17. (I had some whitespace issue with applying the patch, so I've attached the cleaned up version in case it wasn't just me.) Cheers, Peter -- | .''`. ** Debian GNU/Linux ** Peter Palfrader | : :' : The universal http://www.palfrader.org/ | `. `' Operating System | `- http://www.debian.org/ [-- Attachment #2: 0001-x86-Add-memory-modify-constraints-to-xchg-and-cmp.patch --] [-- Type: text/x-diff, Size: 10868 bytes --] From f6fd342ddae3f7edecd0254e5c4e6795d4fba4a9 Mon Sep 17 00:00:00 2001 From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com> Date: Tue, 27 Jul 2010 23:03:58 -0700 Subject: [PATCH] x86: Add memory modify constraints to xchg() and cmpxchg() xchg() and cmpxchg() modify their memory operands, not merely read them. For some versions of gcc the "memory" clobber has apparently dealt with the situation, but not for all. Also adds the missing 8-byte case for __sync_cmpxchg(). Based on HPA's patch. Signed-off-by: Jeremy Fitzhardinge<jeremy.fitzhardinge@citrix.com> Cc: "H. Peter Anvin"<hpa@zytor.com> Cc: Stable Kernel<stable@kernel.org> --- arch/x86/include/asm/cmpxchg_32.h | 86 +++++++++++++++++------------------ arch/x86/include/asm/cmpxchg_64.h | 88 ++++++++++++++++++++----------------- 2 files changed, 89 insertions(+), 85 deletions(-) diff --git a/arch/x86/include/asm/cmpxchg_32.h b/arch/x86/include/asm/cmpxchg_32.h index ee1931b..5af5051 100644 --- a/arch/x86/include/asm/cmpxchg_32.h +++ b/arch/x86/include/asm/cmpxchg_32.h @@ -34,12 +34,12 @@ static inline void __set_64bit(unsigned long long *ptr, unsigned int low, unsigned int high) { asm volatile("\n1:\t" - "movl (%0), %%eax\n\t" - "movl 4(%0), %%edx\n\t" - LOCK_PREFIX "cmpxchg8b (%0)\n\t" + "movl (%1), %%eax\n\t" + "movl 4(%1), %%edx\n\t" + LOCK_PREFIX "cmpxchg8b %0\n\t" "jnz 1b" - : /* no outputs */ - : "D"(ptr), + : "=m"(*ptr) + : "D" (ptr), "b"(low), "c"(high) : "ax", "dx", "memory"); @@ -82,20 +82,20 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, switch (size) { case 1: asm volatile("xchgb %b0,%1" - : "=q" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=q" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; case 2: asm volatile("xchgw %w0,%1" - : "=r" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=r" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; case 4: asm volatile("xchgl %0,%1" - : "=r" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=r" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; } @@ -139,21 +139,21 @@ static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old, unsigned long prev; switch (size) { case 1: - asm volatile(LOCK_PREFIX "cmpxchgb %b1,%2" - : "=a"(prev) - : "q"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile(LOCK_PREFIX "cmpxchgb %b2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "q"(new), "0"(old) : "memory"); return prev; case 2: - asm volatile(LOCK_PREFIX "cmpxchgw %w1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile(LOCK_PREFIX "cmpxchgw %w2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 4: - asm volatile(LOCK_PREFIX "cmpxchgl %1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile(LOCK_PREFIX "cmpxchgl %2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; } @@ -172,21 +172,21 @@ static inline unsigned long __sync_cmpxchg(volatile void *ptr, unsigned long prev; switch (size) { case 1: - asm volatile("lock; cmpxchgb %b1,%2" - : "=a"(prev) - : "q"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("lock; cmpxchgb %b2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "q"(new), "0"(old) : "memory"); return prev; case 2: - asm volatile("lock; cmpxchgw %w1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("lock; cmpxchgw %w2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 4: - asm volatile("lock; cmpxchgl %1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("lock; cmpxchgl %2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; } @@ -200,21 +200,21 @@ static inline unsigned long __cmpxchg_local(volatile void *ptr, unsigned long prev; switch (size) { case 1: - asm volatile("cmpxchgb %b1,%2" - : "=a"(prev) - : "q"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("cmpxchgb %b2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "q"(new), "0"(old) : "memory"); return prev; case 2: - asm volatile("cmpxchgw %w1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("cmpxchgw %w2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 4: - asm volatile("cmpxchgl %1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("cmpxchgl %2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; } @@ -226,11 +226,10 @@ static inline unsigned long long __cmpxchg64(volatile void *ptr, unsigned long long new) { unsigned long long prev; - asm volatile(LOCK_PREFIX "cmpxchg8b %3" - : "=A"(prev) + asm volatile(LOCK_PREFIX "cmpxchg8b %1" + : "=A"(prev), "+m" (*__xg(ptr)) : "b"((unsigned long)new), "c"((unsigned long)(new >> 32)), - "m"(*__xg(ptr)), "0"(old) : "memory"); return prev; @@ -241,11 +240,10 @@ static inline unsigned long long __cmpxchg64_local(volatile void *ptr, unsigned long long new) { unsigned long long prev; - asm volatile("cmpxchg8b %3" - : "=A"(prev) + asm volatile("cmpxchg8b %1" + : "=A"(prev), "+m"(*__xg(ptr)) : "b"((unsigned long)new), "c"((unsigned long)(new >> 32)), - "m"(*__xg(ptr)), "0"(old) : "memory"); return prev; diff --git a/arch/x86/include/asm/cmpxchg_64.h b/arch/x86/include/asm/cmpxchg_64.h index 52de72e..1871cb0 100644 --- a/arch/x86/include/asm/cmpxchg_64.h +++ b/arch/x86/include/asm/cmpxchg_64.h @@ -26,26 +26,26 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, switch (size) { case 1: asm volatile("xchgb %b0,%1" - : "=q" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=q" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; case 2: asm volatile("xchgw %w0,%1" - : "=r" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=r" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; case 4: asm volatile("xchgl %k0,%1" - : "=r" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=r" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; case 8: asm volatile("xchgq %0,%1" - : "=r" (x) - : "m" (*__xg(ptr)), "0" (x) + : "=r" (x), "+m" (*__xg(ptr)) + : "0" (x) : "memory"); break; } @@ -66,27 +66,27 @@ static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old, unsigned long prev; switch (size) { case 1: - asm volatile(LOCK_PREFIX "cmpxchgb %b1,%2" - : "=a"(prev) - : "q"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile(LOCK_PREFIX "cmpxchgb %b2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "q"(new), "0"(old) : "memory"); return prev; case 2: - asm volatile(LOCK_PREFIX "cmpxchgw %w1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile(LOCK_PREFIX "cmpxchgw %w2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 4: - asm volatile(LOCK_PREFIX "cmpxchgl %k1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile(LOCK_PREFIX "cmpxchgl %k2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 8: - asm volatile(LOCK_PREFIX "cmpxchgq %1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile(LOCK_PREFIX "cmpxchgq %2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; } @@ -105,21 +105,27 @@ static inline unsigned long __sync_cmpxchg(volatile void *ptr, unsigned long prev; switch (size) { case 1: - asm volatile("lock; cmpxchgb %b1,%2" - : "=a"(prev) - : "q"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("lock; cmpxchgb %b2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "q"(new), "0"(old) : "memory"); return prev; case 2: - asm volatile("lock; cmpxchgw %w1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("lock; cmpxchgw %w2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 4: - asm volatile("lock; cmpxchgl %1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("lock; cmpxchgl %k2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) + : "memory"); + return prev; + case 8: + asm volatile("lock; cmpxchgq %2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; } @@ -133,27 +139,27 @@ static inline unsigned long __cmpxchg_local(volatile void *ptr, unsigned long prev; switch (size) { case 1: - asm volatile("cmpxchgb %b1,%2" - : "=a"(prev) - : "q"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("cmpxchgb %b2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "q"(new), "0"(old) : "memory"); return prev; case 2: - asm volatile("cmpxchgw %w1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("cmpxchgw %w2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 4: - asm volatile("cmpxchgl %k1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("cmpxchgl %k2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; case 8: - asm volatile("cmpxchgq %1,%2" - : "=a"(prev) - : "r"(new), "m"(*__xg(ptr)), "0"(old) + asm volatile("cmpxchgq %2,%1" + : "=a"(prev), "+m"(*__xg(ptr)) + : "r"(new), "0"(old) : "memory"); return prev; } -- 1.5.6.5 ^ permalink raw reply related [flat|nested] 666+ messages in thread
* Re: [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() 2010-08-03 12:43 ` Peter Palfrader @ 2010-08-10 22:33 ` Greg KH 0 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-08-10 22:33 UTC (permalink / raw) To: Peter Palfrader, Jeremy Fitzhardinge, mingo, H. Peter Anvin, linux-kernel, torvalds, glommer, alan, zamsden, stable, mtosatti, gregkh, tglx, avi, linux-tip-commits On Tue, Aug 03, 2010 at 02:43:51PM +0200, Peter Palfrader wrote: > On Mon, 02 Aug 2010, Jeremy Fitzhardinge wrote: > > >> Commit-ID: 113fc5a6e8c2288619ff7e8187a6f556b7e0d372 > >> Gitweb: http://git.kernel.org/tip/113fc5a6e8c2288619ff7e8187a6f556b7e0d372 > >> Author: H. Peter Anvin<hpa@zytor.com> > >> AuthorDate: Tue, 27 Jul 2010 17:01:49 -0700 > >> Committer: H. Peter Anvin<hpa@zytor.com> > >> CommitDate: Tue, 27 Jul 2010 17:14:02 -0700 > >> > >> x86: Add memory modify constraints to xchg() and cmpxchg() > > > > Here's the 2.6.32 version for stable. > > Thanks a lot everyone. This patch resolves the issue for me on top > of 2.6.32.17. > > (I had some whitespace issue with applying the patch, so I've attached > the cleaned up version in case it wasn't just me.) Thanks, I needed this version, it wasn't just you :) greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 18:04 ` Avi Kivity 2010-07-13 18:15 ` Linus Torvalds @ 2010-07-13 18:25 ` Peter Palfrader 2010-07-13 23:53 ` [Stable-review] " Ben Hutchings 1 sibling, 1 reply; 666+ messages in thread From: Peter Palfrader @ 2010-07-13 18:25 UTC (permalink / raw) To: Avi Kivity Cc: Linus Torvalds, Ingo Molnar, H. Peter Anvin, Greg KH, linux-kernel, stable, stable-review, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Marcelo Tosatti On Tue, 13 Jul 2010, Avi Kivity wrote: > Well, current upstream uses "m": > >> case 8: \ >> asm volatile(lock "cmpxchgq %1,%2" \ >> : "=a"(__ret) \ >> : "r"(__new), "m"(*__xg(ptr)), "0"(__old) \ >> : "memory"); \ >> break; \ > > and works; I also failed to reproduce with 2.6.32.16. So I expect some > toolchain involvement. > > Peter, what gcc are you using? gcc (Debian 4.3.2-1.1) 4.3.2 -- | .''`. ** Debian GNU/Linux ** Peter Palfrader | : :' : The universal http://www.palfrader.org/ | `. `' Operating System | `- http://www.debian.org/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [Stable-review] [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock 2010-07-13 18:25 ` [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock Peter Palfrader @ 2010-07-13 23:53 ` Ben Hutchings 0 siblings, 0 replies; 666+ messages in thread From: Ben Hutchings @ 2010-07-13 23:53 UTC (permalink / raw) To: Peter Palfrader Cc: Avi Kivity, Jeremy Fitzhardinge, Zachary Amsden, akpm, Glauber Costa, Greg KH, linux-kernel, stable-review, Ingo Molnar, Linus Torvalds, stable, alan, H Peter Anvin [-- Attachment #1: Type: text/plain, Size: 1138 bytes --] On Tue, 2010-07-13 at 20:25 +0200, Peter Palfrader wrote: > On Tue, 13 Jul 2010, Avi Kivity wrote: > > > Well, current upstream uses "m": > > > >> case 8: \ > >> asm volatile(lock "cmpxchgq %1,%2" \ > >> : "=a"(__ret) \ > >> : "r"(__new), "m"(*__xg(ptr)), "0"(__old) \ > >> : "memory"); \ > >> break; \ > > > > and works; I also failed to reproduce with 2.6.32.16. So I expect some > > toolchain involvement. > > > > Peter, what gcc are you using? > > gcc (Debian 4.3.2-1.1) 4.3.2 The experimental Debian packages of 2.6.35-rc5 are built with gcc 4.4 and they don't have this bug - last_value is marked as 'b' in System.map, which I assume means BSS. So this may be specific to gcc 4.3. Ben. -- Ben Hutchings Once a job is fouled up, anything done to improve it makes it worse. [-- Attachment #2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 828 bytes --] ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 135/149] KVM: Dont allow lmsw to clear cr0.pe 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (133 preceding siblings ...) 2010-07-01 17:32 ` [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 136/149] KVM: x86: Check LMA bit before set_efer Greg KH ` (13 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Avi Kivity, Marcelo Tosatti 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Avi Kivity <avi@redhat.com> The current lmsw implementation allows the guest to clear cr0.pe, contrary to the manual, which breaks EMM386.EXE. Fix by ORing the old cr0.pe with lmsw's operand. Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit f78e917688edbf1f14c318d2e50dc8e7dad20445) --- arch/x86/kvm/x86.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -345,7 +345,7 @@ EXPORT_SYMBOL_GPL(kvm_set_cr0); void kvm_lmsw(struct kvm_vcpu *vcpu, unsigned long msw) { - kvm_set_cr0(vcpu, (vcpu->arch.cr0 & ~0x0ful) | (msw & 0x0f)); + kvm_set_cr0(vcpu, (vcpu->arch.cr0 & ~0x0eul) | (msw & 0x0f)); } EXPORT_SYMBOL_GPL(kvm_lmsw); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 136/149] KVM: x86: Check LMA bit before set_efer 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (134 preceding siblings ...) 2010-07-01 17:32 ` [patch 135/149] KVM: Dont allow lmsw to clear cr0.pe Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 137/149] KVM: MMU: Segregate shadow pages with different cr0.wp Greg KH ` (12 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Sheng Yang, Marcelo Tosatti 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Sheng Yang <sheng@linux.intel.com> kvm_x86_ops->set_efer() would execute vcpu->arch.efer = efer, so the checking of LMA bit didn't work. Signed-off-by: Sheng Yang <sheng@linux.intel.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit a3d204e28579427609c3d15d2310127ebaa47d94) --- arch/x86/kvm/x86.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -516,11 +516,11 @@ static void set_efer(struct kvm_vcpu *vc } } - kvm_x86_ops->set_efer(vcpu, efer); - efer &= ~EFER_LMA; efer |= vcpu->arch.shadow_efer & EFER_LMA; + kvm_x86_ops->set_efer(vcpu, efer); + vcpu->arch.shadow_efer = efer; vcpu->arch.mmu.base_role.nxe = (efer & EFER_NX) && !tdp_enabled; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 137/149] KVM: MMU: Segregate shadow pages with different cr0.wp 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (135 preceding siblings ...) 2010-07-01 17:32 ` [patch 136/149] KVM: x86: Check LMA bit before set_efer Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 138/149] KVM: VMX: enable VMXON check with SMX enabled (Intel TXT) Greg KH ` (11 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Avi Kivity, Marcelo Tosatti 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Avi Kivity <avi@redhat.com> When cr0.wp=0, we may shadow a gpte having u/s=1 and r/w=0 with an spte having u/s=0 and r/w=1. This allows excessive access if the guest sets cr0.wp=1 and accesses through this spte. Fix by making cr0.wp part of the base role; we'll have different sptes for the two cases and the problem disappears. Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 3dbe141595faa48a067add3e47bba3205b79d33c) --- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/mmu.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -193,6 +193,7 @@ union kvm_mmu_page_role { unsigned invalid:1; unsigned cr4_pge:1; unsigned nxe:1; + unsigned cr0_wp:1; }; }; --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -221,7 +221,7 @@ void kvm_mmu_set_mask_ptes(u64 user_mask } EXPORT_SYMBOL_GPL(kvm_mmu_set_mask_ptes); -static int is_write_protection(struct kvm_vcpu *vcpu) +static bool is_write_protection(struct kvm_vcpu *vcpu) { return vcpu->arch.cr0 & X86_CR0_WP; } @@ -2445,6 +2445,7 @@ static int init_kvm_softmmu(struct kvm_v r = paging32_init_context(vcpu); vcpu->arch.mmu.base_role.glevels = vcpu->arch.mmu.root_level; + vcpu->arch.mmu.base_role.cr0_wp = is_write_protection(vcpu); return r; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 138/149] KVM: VMX: enable VMXON check with SMX enabled (Intel TXT) 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (136 preceding siblings ...) 2010-07-01 17:32 ` [patch 137/149] KVM: MMU: Segregate shadow pages with different cr0.wp Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 139/149] KVM: MMU: Dont read pdptrs with mmu spinlock held in mmu_alloc_roots Greg KH ` (10 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Shane Wang, Avi Kivity 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Shane Wang <shane.wang@intel.com> Per document, for feature control MSR: Bit 1 enables VMXON in SMX operation. If the bit is clear, execution of VMXON in SMX operation causes a general-protection exception. Bit 2 enables VMXON outside SMX operation. If the bit is clear, execution of VMXON outside SMX operation causes a general-protection exception. This patch is to enable this kind of check with SMX for VMXON in KVM. Signed-off-by: Shane Wang <shane.wang@intel.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit cafd66595d92591e4bd25c3904e004fc6f897e2d) --- arch/x86/include/asm/msr-index.h | 5 +++-- arch/x86/kernel/tboot.c | 1 + arch/x86/kvm/vmx.c | 32 +++++++++++++++++++++----------- include/linux/tboot.h | 1 + 4 files changed, 26 insertions(+), 13 deletions(-) --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -198,8 +198,9 @@ #define MSR_IA32_EBL_CR_POWERON 0x0000002a #define MSR_IA32_FEATURE_CONTROL 0x0000003a -#define FEATURE_CONTROL_LOCKED (1<<0) -#define FEATURE_CONTROL_VMXON_ENABLED (1<<2) +#define FEATURE_CONTROL_LOCKED (1<<0) +#define FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX (1<<1) +#define FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX (1<<2) #define MSR_IA32_APICBASE 0x0000001b #define MSR_IA32_APICBASE_BSP (1<<8) --- a/arch/x86/kernel/tboot.c +++ b/arch/x86/kernel/tboot.c @@ -46,6 +46,7 @@ /* Global pointer to shared data; NULL means no measured launch. */ struct tboot *tboot __read_mostly; +EXPORT_SYMBOL(tboot); /* timeout for APs (in secs) to enter wait-for-SIPI state during shutdown */ #define AP_WAIT_TIMEOUT 1 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -26,6 +26,7 @@ #include <linux/sched.h> #include <linux/moduleparam.h> #include <linux/ftrace_event.h> +#include <linux/tboot.h> #include "kvm_cache_regs.h" #include "x86.h" @@ -1140,9 +1141,16 @@ static __init int vmx_disabled_by_bios(v u64 msr; rdmsrl(MSR_IA32_FEATURE_CONTROL, msr); - return (msr & (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) - == FEATURE_CONTROL_LOCKED; + if (msr & FEATURE_CONTROL_LOCKED) { + if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX) + && tboot_enabled()) + return 1; + if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX) + && !tboot_enabled()) + return 1; + } + + return 0; /* locked but not enabled */ } @@ -1150,18 +1158,20 @@ static void hardware_enable(void *garbag { int cpu = raw_smp_processor_id(); u64 phys_addr = __pa(per_cpu(vmxarea, cpu)); - u64 old; + u64 old, test_bits; INIT_LIST_HEAD(&per_cpu(vcpus_on_cpu, cpu)); rdmsrl(MSR_IA32_FEATURE_CONTROL, old); - if ((old & (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) - != (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) + + test_bits = FEATURE_CONTROL_LOCKED; + test_bits |= FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX; + if (tboot_enabled()) + test_bits |= FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX; + + if ((old & test_bits) != test_bits) { /* enable and lock */ - wrmsrl(MSR_IA32_FEATURE_CONTROL, old | - FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED); + wrmsrl(MSR_IA32_FEATURE_CONTROL, old | test_bits); + } write_cr4(read_cr4() | X86_CR4_VMXE); /* FIXME: not cpu hotplug safe */ asm volatile (ASM_VMX_VMXON_RAX : : "a"(&phys_addr), "m"(phys_addr) --- a/include/linux/tboot.h +++ b/include/linux/tboot.h @@ -150,6 +150,7 @@ extern int tboot_force_iommu(void); #else +#define tboot_enabled() 0 #define tboot_probe() do { } while (0) #define tboot_shutdown(shutdown_type) do { } while (0) #define tboot_sleep(sleep_state, pm1a_control, pm1b_control) \ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 139/149] KVM: MMU: Dont read pdptrs with mmu spinlock held in mmu_alloc_roots 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (137 preceding siblings ...) 2010-07-01 17:32 ` [patch 138/149] KVM: VMX: enable VMXON check with SMX enabled (Intel TXT) Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 140/149] KVM: Fix wallclock version writing race Greg KH ` (9 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Avi Kivity 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Avi Kivity <avi@redhat.com> On svm, kvm_read_pdptr() may require reading guest memory, which can sleep. Push the spinlock into mmu_alloc_roots(), and only take it after we've read the pdptr. Tested-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 8facbbff071ff2b19268d3732e31badc60471e21) --- arch/x86/kvm/mmu.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -2091,11 +2091,13 @@ static int mmu_alloc_roots(struct kvm_vc direct = 1; if (mmu_check_root(vcpu, root_gfn)) return 1; + spin_lock(&vcpu->kvm->mmu_lock); sp = kvm_mmu_get_page(vcpu, root_gfn, 0, PT64_ROOT_LEVEL, direct, ACC_ALL, NULL); root = __pa(sp->spt); ++sp->root_count; + spin_unlock(&vcpu->kvm->mmu_lock); vcpu->arch.mmu.root_hpa = root; return 0; } @@ -2117,11 +2119,14 @@ static int mmu_alloc_roots(struct kvm_vc root_gfn = 0; if (mmu_check_root(vcpu, root_gfn)) return 1; + spin_lock(&vcpu->kvm->mmu_lock); sp = kvm_mmu_get_page(vcpu, root_gfn, i << 30, PT32_ROOT_LEVEL, direct, ACC_ALL, NULL); root = __pa(sp->spt); ++sp->root_count; + spin_unlock(&vcpu->kvm->mmu_lock); + vcpu->arch.mmu.pae_root[i] = root | PT_PRESENT_MASK; } vcpu->arch.mmu.root_hpa = __pa(vcpu->arch.mmu.pae_root); @@ -2485,7 +2490,9 @@ int kvm_mmu_load(struct kvm_vcpu *vcpu) goto out; spin_lock(&vcpu->kvm->mmu_lock); kvm_mmu_free_some_pages(vcpu); + spin_unlock(&vcpu->kvm->mmu_lock); r = mmu_alloc_roots(vcpu); + spin_lock(&vcpu->kvm->mmu_lock); mmu_sync_roots(vcpu); spin_unlock(&vcpu->kvm->mmu_lock); if (r) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 140/149] KVM: Fix wallclock version writing race 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (138 preceding siblings ...) 2010-07-01 17:32 ` [patch 139/149] KVM: MMU: Dont read pdptrs with mmu spinlock held in mmu_alloc_roots Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 141/149] KVM: x86: Add missing locking to arch specific vcpu ioctls Greg KH ` (8 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Glauber Costa, Avi Kivity 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Avi Kivity <avi@redhat.com> Wallclock writing uses an unprotected global variable to hold the version; this can cause one guest to interfere with another if both write their wallclock at the same time. Acked-by: Glauber Costa <glommer@redhat.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 9ed3c444ab8987c7b219173a2f7807e3f71e234e) --- arch/x86/kvm/x86.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -554,14 +554,22 @@ static int do_set_msr(struct kvm_vcpu *v static void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock) { - static int version; + int version; + int r; struct pvclock_wall_clock wc; struct timespec boot; if (!wall_clock) return; - version++; + r = kvm_read_guest(kvm, wall_clock, &version, sizeof(version)); + if (r) + return; + + if (version & 1) + ++version; /* first time write, random junk */ + + ++version; kvm_write_guest(kvm, wall_clock, &version, sizeof(version)); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 141/149] KVM: x86: Add missing locking to arch specific vcpu ioctls 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (139 preceding siblings ...) 2010-07-01 17:32 ` [patch 140/149] KVM: Fix wallclock version writing race Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 142/149] KVM: x86: Inject #GP with the right rip on efer writes Greg KH ` (7 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Avi Kivity 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Avi Kivity <avi@redhat.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 8fbf065d625617bbbf6b72d5f78f84ad13c8b547) --- arch/x86/kvm/x86.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1420,6 +1420,7 @@ static int kvm_vcpu_ioctl_get_cpuid2(str { int r; + vcpu_load(vcpu); r = -E2BIG; if (cpuid->nent < vcpu->arch.cpuid_nent) goto out; @@ -1431,6 +1432,7 @@ static int kvm_vcpu_ioctl_get_cpuid2(str out: cpuid->nent = vcpu->arch.cpuid_nent; + vcpu_put(vcpu); return r; } @@ -1680,6 +1682,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce( int r; unsigned bank_num = mcg_cap & 0xff, bank; + vcpu_load(vcpu); r = -EINVAL; if (!bank_num || bank_num >= KVM_MAX_MCE_BANKS) goto out; @@ -1694,6 +1697,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce( for (bank = 0; bank < bank_num; bank++) vcpu->arch.mce_banks[bank*4] = ~(u64)0; out: + vcpu_put(vcpu); return r; } @@ -1896,7 +1900,9 @@ long kvm_arch_vcpu_ioctl(struct file *fi r = -EFAULT; if (copy_from_user(&mce, argp, sizeof mce)) goto out; + vcpu_load(vcpu); r = kvm_vcpu_ioctl_x86_set_mce(vcpu, &mce); + vcpu_put(vcpu); break; } default: ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 142/149] KVM: x86: Inject #GP with the right rip on efer writes 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (140 preceding siblings ...) 2010-07-01 17:32 ` [patch 141/149] KVM: x86: Add missing locking to arch specific vcpu ioctls Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 143/149] jbd: jbd-debug and jbd2-debug should be writable Greg KH ` (6 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Roedel, Joerg <Joerg.Roedel@amd.com> This patch fixes a bug in the KVM efer-msr write path. If a guest writes to a reserved efer bit the set_efer function injects the #GP directly. The architecture dependent wrmsr function does not see this, assumes success and advances the rip. This results in a #GP in the guest with the wrong rip. This patch fixes this by reporting efer write errors back to the architectural wrmsr function. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit b69e8caef5b190af48c525f6d715e7b7728a77f6) --- arch/x86/kvm/x86.c | 31 ++++++++++++------------------- 1 file changed, 12 insertions(+), 19 deletions(-) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -483,37 +483,29 @@ static u32 emulated_msrs[] = { MSR_IA32_MISC_ENABLE, }; -static void set_efer(struct kvm_vcpu *vcpu, u64 efer) +static int set_efer(struct kvm_vcpu *vcpu, u64 efer) { - if (efer & efer_reserved_bits) { - kvm_inject_gp(vcpu, 0); - return; - } + if (efer & efer_reserved_bits) + return 1; if (is_paging(vcpu) - && (vcpu->arch.shadow_efer & EFER_LME) != (efer & EFER_LME)) { - kvm_inject_gp(vcpu, 0); - return; - } + && (vcpu->arch.shadow_efer & EFER_LME) != (efer & EFER_LME)) + return 1; if (efer & EFER_FFXSR) { struct kvm_cpuid_entry2 *feat; feat = kvm_find_cpuid_entry(vcpu, 0x80000001, 0); - if (!feat || !(feat->edx & bit(X86_FEATURE_FXSR_OPT))) { - kvm_inject_gp(vcpu, 0); - return; - } + if (!feat || !(feat->edx & bit(X86_FEATURE_FXSR_OPT))) + return 1; } if (efer & EFER_SVME) { struct kvm_cpuid_entry2 *feat; feat = kvm_find_cpuid_entry(vcpu, 0x80000001, 0); - if (!feat || !(feat->ecx & bit(X86_FEATURE_SVM))) { - kvm_inject_gp(vcpu, 0); - return; - } + if (!feat || !(feat->ecx & bit(X86_FEATURE_SVM))) + return 1; } efer &= ~EFER_LMA; @@ -525,6 +517,8 @@ static void set_efer(struct kvm_vcpu *vc vcpu->arch.mmu.base_role.nxe = (efer & EFER_NX) && !tdp_enabled; kvm_mmu_reset_context(vcpu); + + return 0; } void kvm_enable_efer_bits(u64 mask) @@ -827,8 +821,7 @@ int kvm_set_msr_common(struct kvm_vcpu * { switch (msr) { case MSR_EFER: - set_efer(vcpu, data); - break; + return set_efer(vcpu, data); case MSR_K7_HWCR: data &= ~(u64)0x40; /* ignore flush filter disable */ if (data != 0) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 143/149] jbd: jbd-debug and jbd2-debug should be writable 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (141 preceding siblings ...) 2010-07-01 17:32 ` [patch 142/149] KVM: x86: Inject #GP with the right rip on efer writes Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 144/149] parisc: clear floating point exception flag on SIGFPE signal Greg KH ` (5 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Yin Kangkai, Jan Kara, Theodore Tso 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Yin Kangkai <kangkai.yin@intel.com> commit 765f8361902d015c864d5e62019b2f139452d7ef upstream. jbd-debug and jbd2-debug is currently read-only (S_IRUGO), which is not correct. Make it writable so that we can start debuging. Signed-off-by: Yin Kangkai <kangkai.yin@intel.com> Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jan Kara <jack@suse.cz> Cc: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/jbd/journal.c | 2 +- fs/jbd2/journal.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) --- a/fs/jbd/journal.c +++ b/fs/jbd/journal.c @@ -1913,7 +1913,7 @@ static void __init jbd_create_debugfs_en { jbd_debugfs_dir = debugfs_create_dir("jbd", NULL); if (jbd_debugfs_dir) - jbd_debug = debugfs_create_u8("jbd-debug", S_IRUGO, + jbd_debug = debugfs_create_u8("jbd-debug", S_IRUGO | S_IWUSR, jbd_debugfs_dir, &journal_enable_debug); } --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -2115,7 +2115,8 @@ static void __init jbd2_create_debugfs_e { jbd2_debugfs_dir = debugfs_create_dir("jbd2", NULL); if (jbd2_debugfs_dir) - jbd2_debug = debugfs_create_u8(JBD2_DEBUG_NAME, S_IRUGO, + jbd2_debug = debugfs_create_u8(JBD2_DEBUG_NAME, + S_IRUGO | S_IWUSR, jbd2_debugfs_dir, &jbd2_journal_enable_debug); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 144/149] parisc: clear floating point exception flag on SIGFPE signal 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (142 preceding siblings ...) 2010-07-01 17:32 ` [patch 143/149] jbd: jbd-debug and jbd2-debug should be writable Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 145/149] dm snapshot: simplify sector_to_chunk expression Greg KH ` (4 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Helge Deller, Kyle McMartin 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Helge Deller <deller@gmx.de> commit 550f0d922286556c7ea43974bb7921effb5a5278 upstream. Clear the floating point exception flag before returning to user space. This is needed, else the libc trampoline handler may hit the same SIGFPE again while building up a trampoline to a signal handler. Fixes debian bug #559406. Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Kyle McMartin <kyle@mcmartin.ca> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/parisc/math-emu/decode_exc.c | 1 + 1 file changed, 1 insertion(+) --- a/arch/parisc/math-emu/decode_exc.c +++ b/arch/parisc/math-emu/decode_exc.c @@ -342,6 +342,7 @@ decode_fpu(unsigned int Fpu_register[], return SIGNALCODE(SIGFPE, FPE_FLTINV); case DIVISIONBYZEROEXCEPTION: update_trap_counts(Fpu_register, aflags, bflags, trap_counts); + Clear_excp_register(exception_index); return SIGNALCODE(SIGFPE, FPE_FLTDIV); case INEXACTEXCEPTION: update_trap_counts(Fpu_register, aflags, bflags, trap_counts); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 145/149] dm snapshot: simplify sector_to_chunk expression 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (143 preceding siblings ...) 2010-07-01 17:32 ` [patch 144/149] parisc: clear floating point exception flag on SIGFPE signal Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 146/149] KEYS: Return more accurate error codes Greg KH ` (3 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Mikulas Patocka, Alasdair G Kergon 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Mikulas Patocka <mpatocka@redhat.com> commit 102c6ddb1d081a6a1fede38c43a42c9811313ec7 upstream. Removed unnecessary 'and' masking: The right shift discards the lower bits so there is no need to clear them. (A later patch needs this change to support a 32-bit chunk_mask.) Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Reviewed-by: Mike Snitzer <snitzer@redhat.com> Reviewed-by: Jonathan Brassow <jbrassow@redhat.com> Signed-off-by: Alasdair G Kergon <agk@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/dm-exception-store.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/md/dm-exception-store.h +++ b/drivers/md/dm-exception-store.h @@ -162,7 +162,7 @@ static inline sector_t get_dev_size(stru static inline chunk_t sector_to_chunk(struct dm_exception_store *store, sector_t sector) { - return (sector & ~store->chunk_mask) >> store->chunk_shift; + return sector >> store->chunk_shift; } int dm_exception_store_type_register(struct dm_exception_store_type *type); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 146/149] KEYS: Return more accurate error codes 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (144 preceding siblings ...) 2010-07-01 17:32 ` [patch 145/149] dm snapshot: simplify sector_to_chunk expression Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 147/149] KEYS: find_keyring_by_name() can gain access to a freed keyring Greg KH ` (2 subsequent siblings) 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dan Carpenter, David Howells, James Morris 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Dan Carpenter <error27@gmail.com> commit 4d09ec0f705cf88a12add029c058b53f288cfaa2 upstream. We were using the wrong variable here so the error codes weren't being returned properly. The original code returns -ENOKEY. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <jmorris@namei.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- security/keys/process_keys.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/security/keys/process_keys.c +++ b/security/keys/process_keys.c @@ -509,7 +509,7 @@ try_again: ret = install_thread_keyring(); if (ret < 0) { - key = ERR_PTR(ret); + key_ref = ERR_PTR(ret); goto error; } goto reget_creds; @@ -527,7 +527,7 @@ try_again: ret = install_process_keyring(); if (ret < 0) { - key = ERR_PTR(ret); + key_ref = ERR_PTR(ret); goto error; } goto reget_creds; @@ -586,7 +586,7 @@ try_again: case KEY_SPEC_GROUP_KEYRING: /* group keyrings are not yet supported */ - key = ERR_PTR(-EINVAL); + key_ref = ERR_PTR(-EINVAL); goto error; case KEY_SPEC_REQKEY_AUTH_KEY: ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 147/149] KEYS: find_keyring_by_name() can gain access to a freed keyring 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (145 preceding siblings ...) 2010-07-01 17:32 ` [patch 146/149] KEYS: Return more accurate error codes Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 148/149] [SCSI] qla2xxx: Disable MSI on qla24xx chips other than QLA2432 Greg KH 2010-07-01 17:32 ` [patch 149/149] sctp: fix append error cause to ERROR chunk correctly Greg KH 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, David Howells, Serge Hallyn, James Morris, Ben Hutchings, Chuck Ebbert 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Toshiyuki Okajima <toshi.okajima@jp.fujitsu.com> commit cea7daa3589d6b550546a8c8963599f7c1a3ae5c upstream. find_keyring_by_name() can gain access to a keyring that has had its reference count reduced to zero, and is thus ready to be freed. This then allows the dead keyring to be brought back into use whilst it is being destroyed. The following timeline illustrates the process: |(cleaner) (user) | | free_user(user) sys_keyctl() | | | | key_put(user->session_keyring) keyctl_get_keyring_ID() | || //=> keyring->usage = 0 | | |schedule_work(&key_cleanup_task) lookup_user_key() | || | | kmem_cache_free(,user) | | . |[KEY_SPEC_USER_KEYRING] | . install_user_keyrings() | . || | key_cleanup() [<= worker_thread()] || | | || | [spin_lock(&key_serial_lock)] |[mutex_lock(&key_user_keyr..mutex)] | | || | atomic_read() == 0 || | |{ rb_ease(&key->serial_node,) } || | | || | [spin_unlock(&key_serial_lock)] |find_keyring_by_name() | | ||| | keyring_destroy(keyring) ||[read_lock(&keyring_name_lock)] | || ||| | |[write_lock(&keyring_name_lock)] ||atomic_inc(&keyring->usage) | |. ||| *** GET freeing keyring *** | |. ||[read_unlock(&keyring_name_lock)] | || || | |list_del() |[mutex_unlock(&key_user_k..mutex)] | || | | |[write_unlock(&keyring_name_lock)] ** INVALID keyring is returned ** | | . | kmem_cache_free(,keyring) . | . | atomic_dec(&keyring->usage) v *** DESTROYED *** TIME If CONFIG_SLUB_DEBUG=y then we may see the following message generated: ============================================================================= BUG key_jar: Poison overwritten ----------------------------------------------------------------------------- INFO: 0xffff880197a7e200-0xffff880197a7e200. First byte 0x6a instead of 0x6b INFO: Allocated in key_alloc+0x10b/0x35f age=25 cpu=1 pid=5086 INFO: Freed in key_cleanup+0xd0/0xd5 age=12 cpu=1 pid=10 INFO: Slab 0xffffea000592cb90 objects=16 used=2 fp=0xffff880197a7e200 flags=0x200000000000c3 INFO: Object 0xffff880197a7e200 @offset=512 fp=0xffff880197a7e300 Bytes b4 0xffff880197a7e1f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ Object 0xffff880197a7e200: 6a 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b jkkkkkkkkkkkkkkk Alternatively, we may see a system panic happen, such as: BUG: unable to handle kernel NULL pointer dereference at 0000000000000001 IP: [<ffffffff810e61a3>] kmem_cache_alloc+0x5b/0xe9 PGD 6b2b4067 PUD 6a80d067 PMD 0 Oops: 0000 [#1] SMP last sysfs file: /sys/kernel/kexec_crash_loaded CPU 1 ... Pid: 31245, comm: su Not tainted 2.6.34-rc5-nofixed-nodebug #2 D2089/PRIMERGY RIP: 0010:[<ffffffff810e61a3>] [<ffffffff810e61a3>] kmem_cache_alloc+0x5b/0xe9 RSP: 0018:ffff88006af3bd98 EFLAGS: 00010002 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88007d19900b RDX: 0000000100000000 RSI: 00000000000080d0 RDI: ffffffff81828430 RBP: ffffffff81828430 R08: ffff88000a293750 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000100000 R12: 00000000000080d0 R13: 00000000000080d0 R14: 0000000000000296 R15: ffffffff810f20ce FS: 00007f97116bc700(0000) GS:ffff88000a280000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000001 CR3: 000000006a91c000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process su (pid: 31245, threadinfo ffff88006af3a000, task ffff8800374414c0) Stack: 0000000512e0958e 0000000000008000 ffff880037f8d180 0000000000000001 0000000000000000 0000000000008001 ffff88007d199000 ffffffff810f20ce 0000000000008000 ffff88006af3be48 0000000000000024 ffffffff810face3 Call Trace: [<ffffffff810f20ce>] ? get_empty_filp+0x70/0x12f [<ffffffff810face3>] ? do_filp_open+0x145/0x590 [<ffffffff810ce208>] ? tlb_finish_mmu+0x2a/0x33 [<ffffffff810ce43c>] ? unmap_region+0xd3/0xe2 [<ffffffff810e4393>] ? virt_to_head_page+0x9/0x2d [<ffffffff81103916>] ? alloc_fd+0x69/0x10e [<ffffffff810ef4ed>] ? do_sys_open+0x56/0xfc [<ffffffff81008a02>] ? system_call_fastpath+0x16/0x1b Code: 0f 1f 44 00 00 49 89 c6 fa 66 0f 1f 44 00 00 65 4c 8b 04 25 60 e8 00 00 48 8b 45 00 49 01 c0 49 8b 18 48 85 db 74 0d 48 63 45 18 <48> 8b 04 03 49 89 00 eb 14 4c 89 f9 83 ca ff 44 89 e6 48 89 ef RIP [<ffffffff810e61a3>] kmem_cache_alloc+0x5b/0xe9 This problem is that find_keyring_by_name does not confirm that the keyring is valid before accepting it. Skipping keyrings that have been reduced to a zero count seems the way to go. To this end, use atomic_inc_not_zero() to increment the usage count and skip the candidate keyring if that returns false. The following script _may_ cause the bug to happen, but there's no guarantee as the window of opportunity is small: #!/bin/sh LOOP=100000 USER=dummy_user /bin/su -c "exit;" $USER || { /usr/sbin/adduser -m $USER; add=1; } for ((i=0; i<LOOP; i++)) do /bin/su -c "echo '$i' > /dev/null" $USER done (( add == 1 )) && /usr/sbin/userdel -r $USER exit Note that the nominated user must not be in use. An alternative way of testing this may be: for ((i=0; i<100000; i++)) do keyctl session foo /bin/true || break done >&/dev/null as that uses a keyring named "foo" rather than relying on the user and user-session named keyrings. Reported-by: Toshiyuki Okajima <toshi.okajima@jp.fujitsu.com> Signed-off-by: David Howells <dhowells@redhat.com> Tested-by: Toshiyuki Okajima <toshi.okajima@jp.fujitsu.com> Acked-by: Serge Hallyn <serue@us.ibm.com> Signed-off-by: James Morris <jmorris@namei.org> Cc: Ben Hutchings <ben@decadent.org.uk> Cc: Chuck Ebbert <cebbert@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- security/keys/keyring.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) --- a/security/keys/keyring.c +++ b/security/keys/keyring.c @@ -524,9 +524,8 @@ struct key *find_keyring_by_name(const c struct key *keyring; int bucket; - keyring = ERR_PTR(-EINVAL); if (!name) - goto error; + return ERR_PTR(-EINVAL); bucket = keyring_hash(name); @@ -553,17 +552,18 @@ struct key *find_keyring_by_name(const c KEY_SEARCH) < 0) continue; - /* we've got a match */ - atomic_inc(&keyring->usage); - read_unlock(&keyring_name_lock); - goto error; + /* we've got a match but we might end up racing with + * key_cleanup() if the keyring is currently 'dead' + * (ie. it has a zero usage count) */ + if (!atomic_inc_not_zero(&keyring->usage)) + continue; + goto out; } } - read_unlock(&keyring_name_lock); keyring = ERR_PTR(-ENOKEY); - - error: +out: + read_unlock(&keyring_name_lock); return keyring; } /* end find_keyring_by_name() */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 148/149] [SCSI] qla2xxx: Disable MSI on qla24xx chips other than QLA2432. 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (146 preceding siblings ...) 2010-07-01 17:32 ` [patch 147/149] KEYS: find_keyring_by_name() can gain access to a freed keyring Greg KH @ 2010-07-01 17:32 ` Greg KH 2010-07-01 17:32 ` [patch 149/149] sctp: fix append error cause to ERROR chunk correctly Greg KH 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Giridhar Malavali, James Bottomley, Ben Hutchings 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Ben Hutchings <ben@decadent.org.uk> commit 6377a7ae1ab82859edccdbc8eaea63782efb134d upstream. On specific platforms, MSI is unreliable on some of the QLA24xx chips, resulting in fatal I/O errors under load, as reported in <http://bugs.debian.org/572322> and by some RHEL customers. Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> Cc: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/scsi/qla2xxx/qla_isr.c | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-) --- a/drivers/scsi/qla2xxx/qla_isr.c +++ b/drivers/scsi/qla2xxx/qla_isr.c @@ -2240,30 +2240,28 @@ qla2x00_request_irqs(struct qla_hw_data /* If possible, enable MSI-X. */ if (!IS_QLA2432(ha) && !IS_QLA2532(ha) && - !IS_QLA8432(ha) && !IS_QLA8001(ha)) - goto skip_msix; + !IS_QLA8432(ha) && !IS_QLA8001(ha)) + goto skip_msi; + + if (ha->pdev->subsystem_vendor == PCI_VENDOR_ID_HP && + (ha->pdev->subsystem_device == 0x7040 || + ha->pdev->subsystem_device == 0x7041 || + ha->pdev->subsystem_device == 0x1705)) { + DEBUG2(qla_printk(KERN_WARNING, ha, + "MSI-X: Unsupported ISP2432 SSVID/SSDID (0x%X,0x%X).\n", + ha->pdev->subsystem_vendor, + ha->pdev->subsystem_device)); + goto skip_msi; + } if (IS_QLA2432(ha) && (ha->pdev->revision < QLA_MSIX_CHIP_REV_24XX || !QLA_MSIX_FW_MODE_1(ha->fw_attributes))) { DEBUG2(qla_printk(KERN_WARNING, ha, "MSI-X: Unsupported ISP2432 (0x%X, 0x%X).\n", ha->pdev->revision, ha->fw_attributes)); - goto skip_msix; } - if (ha->pdev->subsystem_vendor == PCI_VENDOR_ID_HP && - (ha->pdev->subsystem_device == 0x7040 || - ha->pdev->subsystem_device == 0x7041 || - ha->pdev->subsystem_device == 0x1705)) { - DEBUG2(qla_printk(KERN_WARNING, ha, - "MSI-X: Unsupported ISP2432 SSVID/SSDID (0x%X, 0x%X).\n", - ha->pdev->subsystem_vendor, - ha->pdev->subsystem_device)); - - goto skip_msi; - } - ret = qla24xx_enable_msix(ha, rsp); if (!ret) { DEBUG2(qla_printk(KERN_INFO, ha, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 149/149] sctp: fix append error cause to ERROR chunk correctly 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH ` (147 preceding siblings ...) 2010-07-01 17:32 ` [patch 148/149] [SCSI] qla2xxx: Disable MSI on qla24xx chips other than QLA2432 Greg KH @ 2010-07-01 17:32 ` Greg KH 148 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:32 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Wei Yongjun, Vlad Yasevich, David S. Miller 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: Wei Yongjun <yjwei@cn.fujitsu.com> commit 2e3219b5c8a2e44e0b83ae6e04f52f20a82ac0f2 upstream. commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809 sctp: Fix skb_over_panic resulting from multiple invalid \ parameter errors (CVE-2010-1173) (v4) cause 'error cause' never be add the the ERROR chunk due to some typo when check valid length in sctp_init_cause_fixed(). Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Reviewed-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/sctp/sm_make_chunk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -140,7 +140,7 @@ int sctp_init_cause_fixed(struct sctp_ch len = sizeof(sctp_errhdr_t) + paylen; err.length = htons(len); - if (skb_tailroom(chunk->skb) > len) + if (skb_tailroom(chunk->skb) < len) return -ENOSPC; chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk, sizeof(sctp_errhdr_t), @@ -1412,7 +1412,7 @@ void *sctp_addto_chunk(struct sctp_chunk void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk, int len, const void *data) { - if (skb_tailroom(chunk->skb) > len) + if (skb_tailroom(chunk->skb) >= len) return sctp_addto_chunk(chunk, len, data); else return NULL; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 000/164] 2.6.33.6 stable review 2010-07-01 17:51 4 -stable kernel review cycles starting Greg KH 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH @ 2010-07-01 17:51 ` Greg KH 2010-07-01 17:33 ` [patch 001/164] Fix racy use of anon_inode_getfd() in perf_event.c Greg KH ` (163 more replies) 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH 2010-07-01 21:55 ` 4 -stable kernel review cycles starting Florian Fainelli 4 siblings, 164 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:51 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan This is the start of the stable review cycle for the 2.6.33.6 release. There are 164 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. If anyone is a maintainer of the proper subsystem, and wants to add a Signed-off-by: line to the patch, please respond with it. Responses should be made by Sat, July 3, 17:00:00 UTC UTC. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.33.6-rc1.gz and the diffstat can be found below. thanks, greg k-h Documentation/hwmon/ltc4245 | 4 +- Makefile | 2 +- arch/arm/common/sa1111.c | 9 +- arch/arm/mm/copypage-feroceon.c | 4 +- arch/arm/mm/copypage-v4wb.c | 4 +- arch/arm/mm/copypage-v4wt.c | 4 +- arch/arm/mm/copypage-xsc3.c | 4 +- arch/arm/mm/fault.c | 3 + arch/arm/mm/init.c | 6 +- arch/arm/vfp/vfphw.S | 2 +- arch/blackfin/include/asm/cache.h | 2 + arch/frv/include/asm/cache.h | 2 + arch/m68k/include/asm/cache.h | 2 + arch/mn10300/include/asm/cache.h | 2 + arch/parisc/math-emu/decode_exc.c | 1 + arch/powerpc/kvm/book3s.c | 10 + arch/powerpc/kvm/booke.c | 15 ++- arch/powerpc/kvm/powerpc.c | 3 +- arch/powerpc/lib/string.S | 4 +- arch/powerpc/oprofile/op_model_cell.c | 2 +- arch/powerpc/platforms/pseries/hotplug-cpu.c | 30 +--- arch/powerpc/platforms/pseries/plpar_wrappers.h | 8 + arch/powerpc/platforms/pseries/smp.c | 28 +++ arch/s390/kvm/kvm-s390.c | 4 +- arch/x86/include/asm/kvm_host.h | 3 + arch/x86/include/asm/msr-index.h | 5 +- arch/x86/kernel/amd_iommu.c | 16 +- arch/x86/kernel/amd_iommu_init.c | 20 ++- arch/x86/kernel/cpu/perf_event.c | 5 +- arch/x86/kernel/pvclock.c | 24 +++ arch/x86/kernel/setup.c | 11 + arch/x86/kernel/tboot.c | 1 + arch/x86/kvm/mmu.c | 12 +- arch/x86/kvm/svm.c | 164 +++++++++++------ arch/x86/kvm/vmx.c | 37 +++- arch/x86/kvm/x86.c | 58 ++++--- arch/x86/oprofile/nmi_int.c | 10 +- arch/x86/xen/suspend.c | 4 +- arch/xtensa/include/asm/cache.h | 1 + block/cfq-iosched.c | 20 ++- drivers/acpi/video_detect.c | 2 +- drivers/ata/libata-core.c | 7 +- drivers/ata/libata-sff.c | 2 +- drivers/ata/sata_nv.c | 5 +- drivers/ata/sata_via.c | 13 ++ drivers/base/cpu.c | 2 +- drivers/char/ipmi/ipmi_si_intf.c | 11 +- drivers/clocksource/sh_cmt.c | 21 ++- drivers/clocksource/sh_tmu.c | 20 +- drivers/firewire/core-card.c | 24 ++- drivers/gpu/drm/drm_edid.c | 2 +- drivers/gpu/drm/i915/i915_drv.c | 5 +- drivers/gpu/drm/i915/i915_drv.h | 3 +- drivers/gpu/drm/i915/i915_gem.c | 19 ++ drivers/gpu/drm/radeon/radeon_atombios.c | 7 +- drivers/gpu/drm/radeon/radeon_cp.c | 1 + drivers/gpu/drm/radeon/radeon_drv.h | 2 + drivers/gpu/drm/radeon/radeon_state.c | 7 + drivers/hid/hid-core.c | 1 + drivers/hid/hid-gyration.c | 1 + drivers/hid/hid-ids.h | 1 + drivers/hwmon/ltc4245.c | 18 +-- drivers/input/mouse/psmouse-base.c | 14 +- drivers/md/linear.c | 1 + drivers/md/md.c | 99 +++++++++-- drivers/md/md.h | 1 + drivers/md/raid1.c | 9 +- drivers/md/raid10.c | 2 +- drivers/md/raid5.c | 7 +- drivers/media/video/gspca/stv06xx/stv06xx.c | 2 - drivers/net/arcnet/com20020-pci.c | 4 +- drivers/net/can/sja1000/sja1000.c | 20 ++- drivers/net/can/sja1000/sja1000.h | 1 + drivers/net/mlx4/icm.c | 3 +- drivers/net/pppol2tp.c | 3 +- drivers/net/wireless/ath/ar9170/hw.h | 1 + drivers/net/wireless/ath/ar9170/main.c | 2 +- drivers/net/wireless/ath/ar9170/usb.c | 10 + drivers/net/wireless/ath/ath5k/base.c | 11 +- drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 10 +- drivers/net/wireless/iwlwifi/iwl-agn.c | 8 + drivers/net/wireless/iwlwifi/iwl3945-base.c | 7 + drivers/net/wireless/p54/p54usb.c | 1 + drivers/net/wireless/rtl818x/rtl8180_dev.c | 1 + drivers/net/wireless/wl12xx/wl1251_sdio.c | 1 + drivers/oprofile/cpu_buffer.c | 63 ++----- drivers/pci/quirks.c | 14 +- drivers/platform/x86/eeepc-laptop.c | 18 ++ drivers/rtc/rtc-cmos.c | 5 +- drivers/rtc/rtc-s3c.c | 5 +- drivers/scsi/qla2xxx/qla_isr.c | 28 ++-- drivers/staging/comedi/drivers/ni_mio_cs.c | 2 +- drivers/staging/rt2860/usb_main_dev.c | 1 + drivers/staging/rtl8192su/r8192U_core.c | 1 + drivers/staging/vt6655/device_main.c | 2 + drivers/usb/class/cdc-acm.c | 6 +- drivers/usb/gadget/fsl_udc_core.c | 2 +- drivers/usb/host/ehci-hub.c | 17 ++ drivers/usb/host/fhci.h | 9 +- drivers/usb/host/xhci-hcd.c | 54 +++++- drivers/usb/host/xhci-pci.c | 2 +- drivers/usb/host/xhci-ring.c | 37 ++++- drivers/usb/serial/cp210x.c | 11 + drivers/usb/serial/ftdi_sio.c | 4 + drivers/usb/serial/ir-usb.c | 2 + drivers/usb/serial/kl5kusb105.c | 1 + drivers/usb/serial/kobil_sct.c | 3 +- drivers/usb/serial/mos7840.c | 1 - drivers/usb/serial/option.c | 226 +++++++++++++++++++++++ drivers/usb/serial/visor.c | 1 + drivers/usb/storage/unusual_devs.h | 15 ++ drivers/xen/xenbus/xenbus_xs.c | 2 +- fs/btrfs/acl.c | 3 + fs/cifs/cifsproto.h | 6 +- fs/cifs/dir.c | 20 ++- fs/cifs/file.c | 11 +- fs/exofs/dir.c | 2 +- fs/ext4/move_extent.c | 3 + fs/ext4/resize.c | 3 +- fs/fs-writeback.c | 14 ++- fs/gfs2/file.c | 7 + fs/libfs.c | 3 +- fs/namespace.c | 9 +- fs/nfsd/nfssvc.c | 2 +- include/linux/fs.h | 4 +- include/linux/pci_ids.h | 1 + include/linux/swap.h | 10 - include/linux/tboot.h | 1 + include/net/sctp/structs.h | 1 + include/trace/events/signal.h | 3 +- kernel/compat.c | 25 +-- kernel/mutex.c | 7 + kernel/perf_event.c | 45 +++-- kernel/posix-timers.c | 11 +- kernel/signal.c | 6 +- kernel/trace/trace.c | 136 ++++++++++---- mm/filemap.c | 10 +- net/mac80211/Kconfig | 9 + net/mac80211/cfg.c | 7 +- net/mac80211/rx.c | 3 +- net/mac80211/tx.c | 5 +- net/sctp/sm_make_chunk.c | 62 ++++++- net/wireless/core.h | 2 + net/wireless/nl80211.c | 37 +---- net/wireless/util.c | 33 ++++ net/wireless/wext-compat.c | 5 +- scripts/kconfig/Makefile | 2 +- security/keys/keyring.c | 18 +- security/keys/process_keys.c | 6 +- sound/pci/hda/hda_intel.c | 9 +- sound/pci/hda/patch_realtek.c | 1 + sound/pci/hda/patch_sigmatel.c | 2 +- sound/soc/codecs/wm8350.c | 4 +- sound/soc/codecs/wm8400.c | 18 +- sound/soc/codecs/wm8990.c | 18 +- 155 files changed, 1492 insertions(+), 562 deletions(-) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 001/164] Fix racy use of anon_inode_getfd() in perf_event.c 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 002/164] posix_timer: Fix error path in timer_create Greg KH ` (162 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Al Viro 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Al Viro <viro@zeniv.linux.org.uk> commit ea635c64e007061f6468ece5cc9cc62d41d4ecf2 upstream. once anon_inode_getfd() is called, you can't expect *anything* about struct file that descriptor points to - another thread might be doing whatever it likes with descriptor table at that point. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/perf_event.c | 40 ++++++++++++++++++++++------------------ 1 file changed, 22 insertions(+), 18 deletions(-) --- a/kernel/perf_event.c +++ b/kernel/perf_event.c @@ -4712,8 +4712,8 @@ SYSCALL_DEFINE5(perf_event_open, struct perf_event_context *ctx; struct file *event_file = NULL; struct file *group_file = NULL; + int event_fd; int fput_needed = 0; - int fput_needed2 = 0; int err; /* for future expandability... */ @@ -4734,12 +4734,18 @@ SYSCALL_DEFINE5(perf_event_open, return -EINVAL; } + event_fd = get_unused_fd_flags(O_RDWR); + if (event_fd < 0) + return event_fd; + /* * Get the target context (task or percpu): */ ctx = find_get_context(pid, cpu); - if (IS_ERR(ctx)) - return PTR_ERR(ctx); + if (IS_ERR(ctx)) { + err = PTR_ERR(ctx); + goto err_fd; + } /* * Look up the group leader (we will attach this event to it): @@ -4779,13 +4785,11 @@ SYSCALL_DEFINE5(perf_event_open, if (IS_ERR(event)) goto err_put_context; - err = anon_inode_getfd("[perf_event]", &perf_fops, event, O_RDWR); - if (err < 0) - goto err_free_put_context; - - event_file = fget_light(err, &fput_needed2); - if (!event_file) + event_file = anon_inode_getfile("[perf_event]", &perf_fops, event, O_RDWR); + if (IS_ERR(event_file)) { + err = PTR_ERR(event_file); goto err_free_put_context; + } if (flags & PERF_FLAG_FD_OUTPUT) { err = perf_event_set_output(event, group_fd); @@ -4806,19 +4810,19 @@ SYSCALL_DEFINE5(perf_event_open, list_add_tail(&event->owner_entry, ¤t->perf_event_list); mutex_unlock(¤t->perf_event_mutex); -err_fput_free_put_context: - fput_light(event_file, fput_needed2); + fput_light(group_file, fput_needed); + fd_install(event_fd, event_file); + return event_fd; +err_fput_free_put_context: + fput(event_file); err_free_put_context: - if (err < 0) - free_event(event); - + free_event(event); err_put_context: - if (err < 0) - put_ctx(ctx); - fput_light(group_file, fput_needed); - + put_ctx(ctx); +err_fd: + put_unused_fd(event_fd); return err; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 002/164] posix_timer: Fix error path in timer_create 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH 2010-07-01 17:33 ` [patch 001/164] Fix racy use of anon_inode_getfd() in perf_event.c Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 003/164] libata: disable ATAPI AN by default Greg KH ` (161 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andrey Vagin, Oleg Nesterov, Pavel Emelyanov, Thomas Gleixner 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andrey Vagin <avagin@openvz.org> commit 45e0fffc8a7778282e6a1514a6ae3e7ae6545111 upstream. Move CLOCK_DISPATCH(which_clock, timer_create, (new_timer)) after all posible EFAULT erros. *_timer_create may allocate/get resources. (for example posix_cpu_timer_create does get_task_struct) [ tglx: fold the remove crappy comment patch into this ] Signed-off-by: Andrey Vagin <avagin@openvz.org> Cc: Oleg Nesterov <oleg@tv-sign.ru> Cc: Pavel Emelyanov <xemul@openvz.org> Reviewed-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/posix-timers.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) --- a/kernel/posix-timers.c +++ b/kernel/posix-timers.c @@ -559,14 +559,7 @@ SYSCALL_DEFINE3(timer_create, const cloc new_timer->it_id = (timer_t) new_timer_id; new_timer->it_clock = which_clock; new_timer->it_overrun = -1; - error = CLOCK_DISPATCH(which_clock, timer_create, (new_timer)); - if (error) - goto out; - /* - * return the timer_id now. The next step is hard to - * back out if there is an error. - */ if (copy_to_user(created_timer_id, &new_timer_id, sizeof (new_timer_id))) { error = -EFAULT; @@ -597,6 +590,10 @@ SYSCALL_DEFINE3(timer_create, const cloc new_timer->sigq->info.si_tid = new_timer->it_id; new_timer->sigq->info.si_code = SI_TIMER; + error = CLOCK_DISPATCH(which_clock, timer_create, (new_timer)); + if (error) + goto out; + spin_lock_irq(¤t->sighand->siglock); new_timer->it_signal = current->signal; list_add(&new_timer->list, ¤t->signal->posix_timers); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 003/164] libata: disable ATAPI AN by default 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH 2010-07-01 17:33 ` [patch 001/164] Fix racy use of anon_inode_getfd() in perf_event.c Greg KH 2010-07-01 17:33 ` [patch 002/164] posix_timer: Fix error path in timer_create Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 004/164] libata: dont flush dcache on slab pages Greg KH ` (160 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Kay Sievers, Nick Bowler, David Zeuthen, Jeff Garzik 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tejun Heo <tj@kernel.org> commit e7ecd435692ca9bde9d124be30b3a26e672ea6c2 upstream. There are ATAPI devices which raise AN when hit by commands issued by open(). This leads to infinite loop of AN -> MEDIA_CHANGE uevent -> udev open() to check media -> AN. Both ACS and SerialATA standards don't define in which case ATAPI devices are supposed to raise or not raise AN. They both list media insertion event as a possible use case for ATAPI ANs but there is no clear description of what constitutes such events. As such, it seems a bit too naive to export ANs directly to userland as MEDIA_CHANGE events without further verification (which should behave similarly to windows as it apparently is the only thing that some hardware vendors are testing against). This patch adds libata.atapi_an module parameter and disables ATAPI AN by default for now. Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Kay Sievers <kay.sievers@vrfy.org> Cc: Nick Bowler <nbowler@elliptictech.com> Cc: David Zeuthen <david@fubar.dk> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/libata-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -159,6 +159,10 @@ int libata_allow_tpm = 0; module_param_named(allow_tpm, libata_allow_tpm, int, 0444); MODULE_PARM_DESC(allow_tpm, "Permit the use of TPM commands (0=off [default], 1=on)"); +static int atapi_an; +module_param(atapi_an, int, 0444); +MODULE_PARM_DESC(atapi_an, "Enable ATAPI AN media presence notification (0=0ff [default], 1=on)"); + MODULE_AUTHOR("Jeff Garzik"); MODULE_DESCRIPTION("Library module for ATA devices"); MODULE_LICENSE("GPL"); @@ -2570,7 +2574,8 @@ int ata_dev_configure(struct ata_device * to enable ATAPI AN to discern between PHY status * changed notifications and ATAPI ANs. */ - if ((ap->flags & ATA_FLAG_AN) && ata_id_has_atapi_AN(id) && + if (atapi_an && + (ap->flags & ATA_FLAG_AN) && ata_id_has_atapi_AN(id) && (!sata_pmp_attached(ap) || sata_scr_read(&ap->link, SCR_NOTIFICATION, &sntf) == 0)) { unsigned int err_mask; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 004/164] libata: dont flush dcache on slab pages 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (2 preceding siblings ...) 2010-07-01 17:33 ` [patch 003/164] libata: disable ATAPI AN by default Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 005/164] oprofile/x86: fix uninitialized counter usage during cpu hotplug Greg KH ` (159 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Sebastian Andrzej Siewior, Jeff Garzik 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> commit 3842e835490cdf17013b30a788f6311bdcfd0571 upstream. page_mapping() check this via VM_BUG_ON(PageSlab(page)) so we bug here with the according debuging turned on. Future TODO: replace this with a flush_dcache_page_for_pio() API Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/libata-sff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/ata/libata-sff.c +++ b/drivers/ata/libata-sff.c @@ -893,7 +893,7 @@ static void ata_pio_sector(struct ata_qu do_write); } - if (!do_write) + if (!do_write && !PageSlab(page)) flush_dcache_page(page); qc->curbytes += qc->sect_size; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 005/164] oprofile/x86: fix uninitialized counter usage during cpu hotplug 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (3 preceding siblings ...) 2010-07-01 17:33 ` [patch 004/164] libata: dont flush dcache on slab pages Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 006/164] oprofile: remove double ring buffering Greg KH ` (158 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andi Kleen, Robert Richter 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Robert Richter <robert.richter@amd.com> commit 2623a1d55a6260c855e1f6d1895900b50b40a896 upstream. This fixes a NULL pointer dereference that is triggered when taking a cpu offline after oprofile was initialized, e.g.: $ opcontrol --init $ opcontrol --start-daemon $ opcontrol --shutdown $ opcontrol --deinit $ echo 0 > /sys/devices/system/cpu/cpu1/online See the crash dump below. Though the counter has been disabled the cpu notifier is still active and trying to use already freed counter data. This fix is for linux-stable. To proper fix this, the hotplug code must be rewritten. Thus I will leave a WARN_ON_ONCE() message with this patch. BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff8132ad57>] op_amd_stop+0x2d/0x8e PGD 0 Oops: 0000 [#1] SMP last sysfs file: /sys/devices/system/cpu/cpu1/online CPU 1 Modules linked in: Pid: 0, comm: swapper Not tainted 2.6.34-rc5-oprofile-x86_64-standard-00210-g8c00f06 #16 Anaheim/Anaheim RIP: 0010:[<ffffffff8132ad57>] [<ffffffff8132ad57>] op_amd_stop+0x2d/0x8e RSP: 0018:ffff880001843f28 EFLAGS: 00010006 RAX: 0000000000000000 RBX: 0000000000000000 RCX: dead000000200200 RDX: ffff880001843f68 RSI: dead000000100100 RDI: 0000000000000000 RBP: ffff880001843f48 R08: 0000000000000000 R09: ffff880001843f08 R10: ffffffff8102c9a5 R11: ffff88000184ea80 R12: 0000000000000000 R13: ffff88000184f6c0 R14: 0000000000000000 R15: 0000000000000000 FS: 00007fec6a92e6f0(0000) GS:ffff880001840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000000 CR3: 000000000163b000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process swapper (pid: 0, threadinfo ffff88042fcd8000, task ffff88042fcd51d0) Stack: ffff880001843f48 0000000000000001 ffff88042e9f7d38 ffff880001843f68 <0> ffff880001843f58 ffffffff8132a602 ffff880001843f98 ffffffff810521b3 <0> ffff880001843f68 ffff880001843f68 ffff880001843f88 ffff88042fcd9fd8 Call Trace: <IRQ> [<ffffffff8132a602>] nmi_cpu_stop+0x21/0x23 [<ffffffff810521b3>] generic_smp_call_function_single_interrupt+0xdf/0x11b [<ffffffff8101804f>] smp_call_function_single_interrupt+0x22/0x31 [<ffffffff810029f3>] call_function_single_interrupt+0x13/0x20 <EOI> [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff81008701>] ? default_idle+0x22/0x37 [<ffffffff8100896d>] c1e_idle+0xdf/0xe6 [<ffffffff813f1170>] ? atomic_notifier_call_chain+0x13/0x15 [<ffffffff810012fb>] cpu_idle+0x4b/0x7e [<ffffffff813e8a4e>] start_secondary+0x1ae/0x1b2 Code: 89 e5 41 55 49 89 fd 41 54 45 31 e4 53 31 db 48 83 ec 08 89 df e8 be f8 ff ff 48 98 48 83 3c c5 10 67 7a 81 00 74 1f 49 8b 45 08 <42> 8b 0c 20 0f 32 48 c1 e2 20 25 ff ff bf ff 48 09 d0 48 89 c2 RIP [<ffffffff8132ad57>] op_amd_stop+0x2d/0x8e RSP <ffff880001843f28> CR2: 0000000000000000 ---[ end trace 679ac372d674b757 ]--- Kernel panic - not syncing: Fatal exception in interrupt Pid: 0, comm: swapper Tainted: G D 2.6.34-rc5-oprofile-x86_64-standard-00210-g8c00f06 #16 Call Trace: <IRQ> [<ffffffff813ebd6a>] panic+0x9e/0x10c [<ffffffff810474b0>] ? up+0x34/0x39 [<ffffffff81031ccc>] ? kmsg_dump+0x112/0x12c [<ffffffff813eeff1>] oops_end+0x81/0x8e [<ffffffff8101efee>] no_context+0x1f3/0x202 [<ffffffff8101f1b7>] __bad_area_nosemaphore+0x1ba/0x1e0 [<ffffffff81028d24>] ? enqueue_task_fair+0x16d/0x17a [<ffffffff810264dc>] ? activate_task+0x42/0x53 [<ffffffff8102c967>] ? try_to_wake_up+0x272/0x284 [<ffffffff8101f1eb>] bad_area_nosemaphore+0xe/0x10 [<ffffffff813f0f3f>] do_page_fault+0x1c8/0x37c [<ffffffff81028d24>] ? enqueue_task_fair+0x16d/0x17a [<ffffffff813ee55f>] page_fault+0x1f/0x30 [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff8132ad57>] ? op_amd_stop+0x2d/0x8e [<ffffffff8132ad46>] ? op_amd_stop+0x1c/0x8e [<ffffffff8132a602>] nmi_cpu_stop+0x21/0x23 [<ffffffff810521b3>] generic_smp_call_function_single_interrupt+0xdf/0x11b [<ffffffff8101804f>] smp_call_function_single_interrupt+0x22/0x31 [<ffffffff810029f3>] call_function_single_interrupt+0x13/0x20 <EOI> [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff81008701>] ? default_idle+0x22/0x37 [<ffffffff8100896d>] c1e_idle+0xdf/0xe6 [<ffffffff813f1170>] ? atomic_notifier_call_chain+0x13/0x15 [<ffffffff810012fb>] cpu_idle+0x4b/0x7e [<ffffffff813e8a4e>] start_secondary+0x1ae/0x1b2 ------------[ cut here ]------------ WARNING: at /local/rrichter/.source/linux/arch/x86/kernel/smp.c:118 native_smp_send_reschedule+0x27/0x53() Hardware name: Anaheim Modules linked in: Pid: 0, comm: swapper Tainted: G D 2.6.34-rc5-oprofile-x86_64-standard-00210-g8c00f06 #16 Call Trace: <IRQ> [<ffffffff81017f32>] ? native_smp_send_reschedule+0x27/0x53 [<ffffffff81030ee2>] warn_slowpath_common+0x77/0xa4 [<ffffffff81030f1e>] warn_slowpath_null+0xf/0x11 [<ffffffff81017f32>] native_smp_send_reschedule+0x27/0x53 [<ffffffff8102634b>] resched_task+0x60/0x62 [<ffffffff8102653a>] check_preempt_curr_idle+0x10/0x12 [<ffffffff8102c8ea>] try_to_wake_up+0x1f5/0x284 [<ffffffff8102c986>] default_wake_function+0xd/0xf [<ffffffff810a110d>] pollwake+0x57/0x5a [<ffffffff8102c979>] ? default_wake_function+0x0/0xf [<ffffffff81026be5>] __wake_up_common+0x46/0x75 [<ffffffff81026ed0>] __wake_up+0x38/0x50 [<ffffffff81031694>] printk_tick+0x39/0x3b [<ffffffff8103ac37>] update_process_times+0x3f/0x5c [<ffffffff8104dc63>] tick_periodic+0x5d/0x69 [<ffffffff8104dc90>] tick_handle_periodic+0x21/0x71 [<ffffffff81018fd0>] smp_apic_timer_interrupt+0x82/0x95 [<ffffffff81002853>] apic_timer_interrupt+0x13/0x20 [<ffffffff81030cb5>] ? panic_blink_one_second+0x0/0x7b [<ffffffff813ebdd6>] ? panic+0x10a/0x10c [<ffffffff810474b0>] ? up+0x34/0x39 [<ffffffff81031ccc>] ? kmsg_dump+0x112/0x12c [<ffffffff813eeff1>] ? oops_end+0x81/0x8e [<ffffffff8101efee>] ? no_context+0x1f3/0x202 [<ffffffff8101f1b7>] ? __bad_area_nosemaphore+0x1ba/0x1e0 [<ffffffff81028d24>] ? enqueue_task_fair+0x16d/0x17a [<ffffffff810264dc>] ? activate_task+0x42/0x53 [<ffffffff8102c967>] ? try_to_wake_up+0x272/0x284 [<ffffffff8101f1eb>] ? bad_area_nosemaphore+0xe/0x10 [<ffffffff813f0f3f>] ? do_page_fault+0x1c8/0x37c [<ffffffff81028d24>] ? enqueue_task_fair+0x16d/0x17a [<ffffffff813ee55f>] ? page_fault+0x1f/0x30 [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff8132ad57>] ? op_amd_stop+0x2d/0x8e [<ffffffff8132ad46>] ? op_amd_stop+0x1c/0x8e [<ffffffff8132a602>] ? nmi_cpu_stop+0x21/0x23 [<ffffffff810521b3>] ? generic_smp_call_function_single_interrupt+0xdf/0x11b [<ffffffff8101804f>] ? smp_call_function_single_interrupt+0x22/0x31 [<ffffffff810029f3>] ? call_function_single_interrupt+0x13/0x20 <EOI> [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff81008701>] ? default_idle+0x22/0x37 [<ffffffff8100896d>] ? c1e_idle+0xdf/0xe6 [<ffffffff813f1170>] ? atomic_notifier_call_chain+0x13/0x15 [<ffffffff810012fb>] ? cpu_idle+0x4b/0x7e [<ffffffff813e8a4e>] ? start_secondary+0x1ae/0x1b2 ---[ end trace 679ac372d674b758 ]--- Cc: Andi Kleen <andi@firstfloor.org> Signed-off-by: Robert Richter <robert.richter@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/oprofile/nmi_int.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) --- a/arch/x86/oprofile/nmi_int.c +++ b/arch/x86/oprofile/nmi_int.c @@ -95,7 +95,10 @@ static void nmi_cpu_save_registers(struc static void nmi_cpu_start(void *dummy) { struct op_msrs const *msrs = &__get_cpu_var(cpu_msrs); - model->start(msrs); + if (!msrs->controls) + WARN_ON_ONCE(1); + else + model->start(msrs); } static int nmi_start(void) @@ -107,7 +110,10 @@ static int nmi_start(void) static void nmi_cpu_stop(void *dummy) { struct op_msrs const *msrs = &__get_cpu_var(cpu_msrs); - model->stop(msrs); + if (!msrs->controls) + WARN_ON_ONCE(1); + else + model->stop(msrs); } static void nmi_stop(void) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 006/164] oprofile: remove double ring buffering 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (4 preceding siblings ...) 2010-07-01 17:33 ` [patch 005/164] oprofile/x86: fix uninitialized counter usage during cpu hotplug Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 007/164] cpumask: fix compat getaffinity Greg KH ` (157 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andi Kleen, Steven Rostedt, Robert Richter 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andi Kleen <andi@firstfloor.org> commit cb6e943ccf19ab6d3189147e9d625a992e016084 upstream. oprofile used a double buffer scheme for its cpu event buffer to avoid races on reading with the old locked ring buffer. But that is obsolete now with the new ring buffer, so simply use a single buffer. This greatly simplifies the code and avoids a lot of sample drops on large runs, especially with call graph. Based on suggestions from Steven Rostedt For stable kernels from v2.6.32, but not earlier. Signed-off-by: Andi Kleen <ak@linux.intel.com> Cc: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Robert Richter <robert.richter@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/oprofile/cpu_buffer.c | 63 ++++++++---------------------------------- 1 file changed, 13 insertions(+), 50 deletions(-) --- a/drivers/oprofile/cpu_buffer.c +++ b/drivers/oprofile/cpu_buffer.c @@ -30,23 +30,7 @@ #define OP_BUFFER_FLAGS 0 -/* - * Read and write access is using spin locking. Thus, writing to the - * buffer by NMI handler (x86) could occur also during critical - * sections when reading the buffer. To avoid this, there are 2 - * buffers for independent read and write access. Read access is in - * process context only, write access only in the NMI handler. If the - * read buffer runs empty, both buffers are swapped atomically. There - * is potentially a small window during swapping where the buffers are - * disabled and samples could be lost. - * - * Using 2 buffers is a little bit overhead, but the solution is clear - * and does not require changes in the ring buffer implementation. It - * can be changed to a single buffer solution when the ring buffer - * access is implemented as non-locking atomic code. - */ -static struct ring_buffer *op_ring_buffer_read; -static struct ring_buffer *op_ring_buffer_write; +static struct ring_buffer *op_ring_buffer; DEFINE_PER_CPU(struct oprofile_cpu_buffer, op_cpu_buffer); static void wq_sync_buffer(struct work_struct *work); @@ -68,12 +52,9 @@ void oprofile_cpu_buffer_inc_smpl_lost(v void free_cpu_buffers(void) { - if (op_ring_buffer_read) - ring_buffer_free(op_ring_buffer_read); - op_ring_buffer_read = NULL; - if (op_ring_buffer_write) - ring_buffer_free(op_ring_buffer_write); - op_ring_buffer_write = NULL; + if (op_ring_buffer) + ring_buffer_free(op_ring_buffer); + op_ring_buffer = NULL; } #define RB_EVENT_HDR_SIZE 4 @@ -86,11 +67,8 @@ int alloc_cpu_buffers(void) unsigned long byte_size = buffer_size * (sizeof(struct op_sample) + RB_EVENT_HDR_SIZE); - op_ring_buffer_read = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS); - if (!op_ring_buffer_read) - goto fail; - op_ring_buffer_write = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS); - if (!op_ring_buffer_write) + op_ring_buffer = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS); + if (!op_ring_buffer) goto fail; for_each_possible_cpu(i) { @@ -162,16 +140,11 @@ struct op_sample *op_cpu_buffer_write_reserve(struct op_entry *entry, unsigned long size) { entry->event = ring_buffer_lock_reserve - (op_ring_buffer_write, sizeof(struct op_sample) + + (op_ring_buffer, sizeof(struct op_sample) + size * sizeof(entry->sample->data[0])); - if (entry->event) - entry->sample = ring_buffer_event_data(entry->event); - else - entry->sample = NULL; - - if (!entry->sample) + if (!entry->event) return NULL; - + entry->sample = ring_buffer_event_data(entry->event); entry->size = size; entry->data = entry->sample->data; @@ -180,25 +153,16 @@ struct op_sample int op_cpu_buffer_write_commit(struct op_entry *entry) { - return ring_buffer_unlock_commit(op_ring_buffer_write, entry->event); + return ring_buffer_unlock_commit(op_ring_buffer, entry->event); } struct op_sample *op_cpu_buffer_read_entry(struct op_entry *entry, int cpu) { struct ring_buffer_event *e; - e = ring_buffer_consume(op_ring_buffer_read, cpu, NULL); - if (e) - goto event; - if (ring_buffer_swap_cpu(op_ring_buffer_read, - op_ring_buffer_write, - cpu)) + e = ring_buffer_consume(op_ring_buffer, cpu, NULL); + if (!e) return NULL; - e = ring_buffer_consume(op_ring_buffer_read, cpu, NULL); - if (e) - goto event; - return NULL; -event: entry->event = e; entry->sample = ring_buffer_event_data(e); entry->size = (ring_buffer_event_length(e) - sizeof(struct op_sample)) @@ -209,8 +173,7 @@ event: unsigned long op_cpu_buffer_entries(int cpu) { - return ring_buffer_entries_cpu(op_ring_buffer_read, cpu) - + ring_buffer_entries_cpu(op_ring_buffer_write, cpu); + return ring_buffer_entries_cpu(op_ring_buffer, cpu); } static int ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 007/164] cpumask: fix compat getaffinity 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (5 preceding siblings ...) 2010-07-01 17:33 ` [patch 006/164] oprofile: remove double ring buffering Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 008/164] NFSD: dont report compiled-out versions as present Greg KH ` (156 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, KOSAKI Motohiro, Rusty Russell, Arnd Bergmann, Andi Kleen 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> commit fa9dc265ace9774e62f0e31108e5f47911124bda upstream. Commit a45185d2d "cpumask: convert kernel/compat.c" broke libnuma, which abuses sched_getaffinity to find out NR_CPUS in order to parse /sys/devices/system/node/node*/cpumap. On NUMA systems with less than 32 possibly CPUs, the current compat_sys_sched_getaffinity now returns '4' instead of the actual NR_CPUS/8, which makes libnuma bail out when parsing the cpumap. The libnuma call sched_getaffinity(0, bitmap, 4096) at first. It mean the libnuma expect the return value of sched_getaffinity() is either len argument or NR_CPUS. But it doesn't expect to return nr_cpu_ids. Strictly speaking, userland requirement are 1) Glibc assume the return value mean the lengh of initialized of mask argument. E.g. if sched_getaffinity(1024) return 128, glibc make zero fill rest 896 byte. 2) Libnuma assume the return value can be used to guess NR_CPUS in kernel. It assume len-arg<NR_CPUS makes -EINVAL. But it try len=4096 at first and 4096 is always bigger than NR_CPUS. Then, if we remove strange min_length normalization, we never hit -EINVAL case. sched_getaffinity() already solved this issue. This patch adapts compat_sys_sched_getaffinity() to match the non-compat case. Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Acked-by: Rusty Russell <rusty@rustcorp.com.au> Acked-by: Arnd Bergmann <arnd@arndb.de> Reported-by: Ken Werner <ken.werner@web.de> Cc: Andi Kleen <andi@firstfloor.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/compat.c | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) --- a/kernel/compat.c +++ b/kernel/compat.c @@ -494,29 +494,26 @@ asmlinkage long compat_sys_sched_getaffi { int ret; cpumask_var_t mask; - unsigned long *k; - unsigned int min_length = cpumask_size(); - if (nr_cpu_ids <= BITS_PER_COMPAT_LONG) - min_length = sizeof(compat_ulong_t); - - if (len < min_length) + if ((len * BITS_PER_BYTE) < nr_cpu_ids) + return -EINVAL; + if (len & (sizeof(compat_ulong_t)-1)) return -EINVAL; if (!alloc_cpumask_var(&mask, GFP_KERNEL)) return -ENOMEM; ret = sched_getaffinity(pid, mask); - if (ret < 0) - goto out; + if (ret == 0) { + size_t retlen = min_t(size_t, len, cpumask_size()); - k = cpumask_bits(mask); - ret = compat_put_bitmap(user_mask_ptr, k, min_length * 8); - if (ret == 0) - ret = min_length; - -out: + if (compat_put_bitmap(user_mask_ptr, cpumask_bits(mask), retlen * 8)) + ret = -EFAULT; + else + ret = retlen; + } free_cpumask_var(mask); + return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 008/164] NFSD: dont report compiled-out versions as present 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (6 preceding siblings ...) 2010-07-01 17:33 ` [patch 007/164] cpumask: fix compat getaffinity Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 009/164] sata_nv: use ata_pci_sff_activate_host() instead of ata_host_activate() Greg KH ` (155 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Pavel Emelyanov, NeilBrown, J. Bruce Fields 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pavel Emelyanov <xemul@openvz.org> commit 15ddb4aec54422ead137b03ea4e9b3f5db3f7cc2 upstream. The /proc/fs/nfsd/versions file calls nfsd_vers() to check whether the particular nfsd version is present/available. The problem is that once I turn off e.g. NFSD-V4 this call returns -1 which is true from the callers POV which is wrong. The proposal is to report false in that case. The bug has existed since 6658d3a7bbfd1768 "[PATCH] knfsd: remove nfsd_versbits as intermediate storage for desired versions". Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: NeilBrown <neilb@suse.de> Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/nfsd/nfssvc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/nfsd/nfssvc.c +++ b/fs/nfsd/nfssvc.c @@ -120,7 +120,7 @@ u32 nfsd_supported_minorversion; int nfsd_vers(int vers, enum vers_op change) { if (vers < NFSD_MINVERS || vers >= NFSD_NRVERS) - return -1; + return 0; switch(change) { case NFSD_SET: nfsd_versions[vers] = nfsd_version[vers]; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 009/164] sata_nv: use ata_pci_sff_activate_host() instead of ata_host_activate() 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (7 preceding siblings ...) 2010-07-01 17:33 ` [patch 008/164] NFSD: dont report compiled-out versions as present Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 010/164] ARCNET: Limit com20020 PCI ID matches for SOHARD cards Greg KH ` (154 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Robert Hancock, Jeff Garzik 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tejun Heo <tj@kernel.org> commit 95cc2c70c139936a2142bcd583da8af6f9d88efb upstream. sata_nv was incorrectly using ata_host_activate() instead of ata_pci_sff_activate_host() leading to IRQ assignment failure in legacy mode. Fix it. Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Robert Hancock <hancockr@shaw.ca> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/sata_nv.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/drivers/ata/sata_nv.c +++ b/drivers/ata/sata_nv.c @@ -2478,8 +2478,7 @@ static int nv_init_one(struct pci_dev *p } pci_set_master(pdev); - return ata_host_activate(host, pdev->irq, ipriv->irq_handler, - IRQF_SHARED, ipriv->sht); + return ata_pci_sff_activate_host(host, ipriv->irq_handler, ipriv->sht); } #ifdef CONFIG_PM ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 010/164] ARCNET: Limit com20020 PCI ID matches for SOHARD cards 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (8 preceding siblings ...) 2010-07-01 17:33 ` [patch 009/164] sata_nv: use ata_pci_sff_activate_host() instead of ata_host_activate() Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 011/164] rtl8180: fix tx status reporting Greg KH ` (153 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andreas Bombe, David S. Miller 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andreas Bombe <aeb@debian.org> commit e7971c80a8e0299f91272ad8e8ac4167623e1862 upstream. The SH SOHARD ARCNET cards are implemented using generic PLX Technology PCI<->IOBus bridges. Subvendor and subdevice IDs were not specified, causing the driver to attach to any such bridge and likely crash the system by attempting to initialize an unrelated device. Fix by specifying subvendor and subdevice according to the values found in the PCI-ID Repository at http://pci-ids.ucw.cz/ . Signed-off-by: Andreas Bombe <aeb@debian.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/arcnet/com20020-pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/arcnet/com20020-pci.c +++ b/drivers/net/arcnet/com20020-pci.c @@ -165,8 +165,8 @@ static struct pci_device_id com20020pci_ { 0x1571, 0xa204, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, { 0x1571, 0xa205, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, { 0x1571, 0xa206, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, - { 0x10B5, 0x9030, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, - { 0x10B5, 0x9050, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, + { 0x10B5, 0x9030, 0x10B5, 0x2978, 0, 0, ARC_CAN_10MBIT }, + { 0x10B5, 0x9050, 0x10B5, 0x2273, 0, 0, ARC_CAN_10MBIT }, { 0x14BA, 0x6000, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, { 0x10B5, 0x2200, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, {0,} ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 011/164] rtl8180: fix tx status reporting 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (9 preceding siblings ...) 2010-07-01 17:33 ` [patch 010/164] ARCNET: Limit com20020 PCI ID matches for SOHARD cards Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 012/164] Staging: add Add Sitecom WL-349 to rtl8192su Greg KH ` (152 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, John W. Linville 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: John W. Linville <linville@tuxdriver.com> commit d989ff7cf8d14f1b523f63ba0bf2ec1a9b7c25bc upstream. When reporting Tx status, indicate that only one rate was used. Otherwise, the rate is frozen at rate index 0 (i.e. 1Mb/s). Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/rtl818x/rtl8180_dev.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/wireless/rtl818x/rtl8180_dev.c +++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c @@ -189,6 +189,7 @@ static void rtl8180_handle_tx(struct iee info->flags |= IEEE80211_TX_STAT_ACK; info->status.rates[0].count = (flags & 0xFF) + 1; + info->status.rates[1].idx = -1; ieee80211_tx_status_irqsafe(dev, skb); if (ring->entries - skb_queue_len(&ring->queue) == 2) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 012/164] Staging: add Add Sitecom WL-349 to rtl8192su 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (10 preceding siblings ...) 2010-07-01 17:33 ` [patch 011/164] rtl8180: fix tx status reporting Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 013/164] staging: vt6655: Fix kernel BUG on driver wpa initialization Greg KH ` (151 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Rodrigo Linfati 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Rodrigo Linfati <rodrigo@linfati.cl> commit 64a5a09218626464be35e0229d85b2ab0fcf03fd upstream. Add usb id of Sitecom WL-349 to rtl8192su Signed-off-by: Rodrigo Linfati <rodrigo@linfati.cl> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/staging/rtl8192su/r8192U_core.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/staging/rtl8192su/r8192U_core.c +++ b/drivers/staging/rtl8192su/r8192U_core.c @@ -120,6 +120,7 @@ static struct usb_device_id rtl8192_usb_ {USB_DEVICE(0x050d, 0x805E)}, /* Sitecom */ {USB_DEVICE(0x0df6, 0x0031)}, + {USB_DEVICE(0x0df6, 0x004b)}, /* WL-349 */ /* EnGenius */ {USB_DEVICE(0x1740, 0x9201)}, /* Dlink */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 013/164] staging: vt6655: Fix kernel BUG on driver wpa initialization 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (11 preceding siblings ...) 2010-07-01 17:33 ` [patch 012/164] Staging: add Add Sitecom WL-349 to rtl8192su Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 014/164] Staging: rt2870: add device ID of MelCo.,Inc. WLI-UC-G301N Greg KH ` (150 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Larry Finger 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Larry Finger <Larry.Finger@lwfinger.net> commit f65515275ea3e45fdcd0fb78455f542d6fdca086 upstream. In http://bugzilla.novell.com/show_bug.cgi?id=597299, the vt6655 driver generates a kernel BUG on a NULL pointer dereference at NULL. This problem has been traced to a failure in the wpa_set_wpadev() routine. As the vt6656 driver does not call this routine, the vt6655 code is similarly set to skip the call. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Tested-by: Richard Meek <osl2008@googlemail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/staging/vt6655/device_main.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/staging/vt6655/device_main.c +++ b/drivers/staging/vt6655/device_main.c @@ -1089,11 +1089,13 @@ device_found1(struct pci_dev *pcid, cons } //2008-07-21-01<Add>by MikeLiu //register wpadev +#if 0 if(wpa_set_wpadev(pDevice, 1)!=0) { printk("Fail to Register WPADEV?\n"); unregister_netdev(pDevice->dev); free_netdev(dev); } +#endif device_print_info(pDevice); pci_set_drvdata(pcid, pDevice); return 0; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 014/164] Staging: rt2870: add device ID of MelCo.,Inc. WLI-UC-G301N 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (12 preceding siblings ...) 2010-07-01 17:33 ` [patch 013/164] staging: vt6655: Fix kernel BUG on driver wpa initialization Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 015/164] mutex: Fix optimistic spinning vs. BKL Greg KH ` (149 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Nobhiro KUSUNO 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Nobuhiro KUSUNO <n-kusuno@fc4.so-net.ne.jp> commit de37cd49b5a54facef174cf34496919857436e8f upstream. My wireless LAN module 'MelCo.,Inc. WLI-UC-G301N' works fine, if the following line is added into 2870_main_dev.c. Signed-off-by: Nobhiro KUSUNO <n-kusuno@fc4.so-net.ne.jp> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/staging/rt2860/usb_main_dev.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/staging/rt2860/usb_main_dev.c +++ b/drivers/staging/rt2860/usb_main_dev.c @@ -97,6 +97,7 @@ struct usb_device_id rtusb_usb_id[] = { {USB_DEVICE(0x5A57, 0x0282)}, /* Zinwell */ {USB_DEVICE(0x7392, 0x7718)}, {USB_DEVICE(0x7392, 0x7717)}, + {USB_DEVICE(0x0411, 0x016f)}, /* MelCo.,Inc. WLI-UC-G301N */ {USB_DEVICE(0x1737, 0x0070)}, /* Linksys WUSB100 */ {USB_DEVICE(0x1737, 0x0071)}, /* Linksys WUSB600N */ {USB_DEVICE(0x0411, 0x00e8)}, /* Buffalo WLI-UC-G300N */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 015/164] mutex: Fix optimistic spinning vs. BKL 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (13 preceding siblings ...) 2010-07-01 17:33 ` [patch 014/164] Staging: rt2870: add device ID of MelCo.,Inc. WLI-UC-G301N Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 016/164] ALSA: hda: Fix model quirk for Dell M1730 Greg KH ` (148 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tony Breeds, Peter Zijlstra, Benjamin Herrenschmidt, Ingo Molnar 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tony Breeds <tony@bakeyournoodle.com> commit fd6be105b883244127a734ac9f14ae94a022dcc0 upstream. Currently, we can hit a nasty case with optimistic spinning on mutexes: CPU A tries to take a mutex, while holding the BKL CPU B tried to take the BLK while holding the mutex This looks like a AB-BA scenario but in practice, is allowed and happens due to the auto-release on schedule() nature of the BKL. In that case, the optimistic spinning code can get us into a situation where instead of going to sleep, A will spin waiting for B who is spinning waiting for A, and the only way out of that loop is the need_resched() test in mutex_spin_on_owner(). This patch fixes it by completely disabling spinning if we own the BKL. This adds one more detail to the extensive list of reasons why it's a bad idea for kernel code to be holding the BKL. Signed-off-by: Tony Breeds <tony@bakeyournoodle.com> Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> LKML-Reference: <20100519054636.GC12389@ozlabs.org> [ added an unlikely() attribute to the branch ] Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/mutex.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/kernel/mutex.c +++ b/kernel/mutex.c @@ -172,6 +172,13 @@ __mutex_lock_common(struct mutex *lock, struct thread_info *owner; /* + * If we own the BKL, then don't spin. The owner of + * the mutex might be waiting on us to release the BKL. + */ + if (unlikely(current->lock_depth >= 0)) + break; + + /* * If there's an owner, wait for it to either * release the lock or go to sleep. */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 016/164] ALSA: hda: Fix model quirk for Dell M1730 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (14 preceding siblings ...) 2010-07-01 17:33 ` [patch 015/164] mutex: Fix optimistic spinning vs. BKL Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 017/164] ALSA: hda: Use LPIB for Toshiba A100-259 Greg KH ` (147 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 66668b6fb6861fad7f6bfef6646ac84693474c9a upstream. BugLink: https://launchpad.net/bugs/576160 Symptom: Currently (2.6.32.12) the Dell M1730 uses the 3stack model quirk. Unfortunately this means that capture is not functional out- of-the-box despite ensuring that capture settings are unmuted and raised fully. Test case: boot from Ubuntu 10.04 LTS live cd; capture does not work. Resolution: Correct the model quirk for Dell M1730 to rely on the BIOS configuration. This patch also trivially sorts the quirk into the correct section based on the comments. Reported-and-Tested-By: <picdragon99@msn.com> Tested-By: Daren Hayward Tested-By: Tobias Krais Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/patch_sigmatel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/pci/hda/patch_sigmatel.c +++ b/sound/pci/hda/patch_sigmatel.c @@ -2070,12 +2070,12 @@ static struct snd_pci_quirk stac927x_cfg SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_INTEL, 0xff00, 0x2000, "Intel D965", STAC_D965_3ST), /* Dell 3 stack systems */ - SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f7, "Dell XPS M1730", STAC_DELL_3ST), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01dd, "Dell Dimension E520", STAC_DELL_3ST), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01ed, "Dell ", STAC_DELL_3ST), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f4, "Dell ", STAC_DELL_3ST), /* Dell 3 stack systems with verb table in BIOS */ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f3, "Dell Inspiron 1420", STAC_DELL_BIOS), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f7, "Dell XPS M1730", STAC_DELL_BIOS), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0227, "Dell Vostro 1400 ", STAC_DELL_BIOS), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022e, "Dell ", STAC_DELL_BIOS), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022f, "Dell Inspiron 1525", STAC_DELL_BIOS), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 017/164] ALSA: hda: Use LPIB for Toshiba A100-259 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (15 preceding siblings ...) 2010-07-01 17:33 ` [patch 016/164] ALSA: hda: Fix model quirk for Dell M1730 Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 018/164] ALSA: hda: Use LPIB for Acer Aspire 5110 Greg KH ` (146 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 4e0938dba7fccf37a4aecba4d937da7f312b5d55 upstream. BugLink: https://launchpad.net/bugs/549560 Symptom: on a significant number of hardware, booting from a live cd results in capture working correctly, but once the distribution is installed, booting from the install results in capture not working. Test case: boot from Ubuntu 10.04 LTS live cd; capture works correctly. Install to HD and reboot; capture does not work. Reproduced with 2.6.32 mainline build (vanilla kernel.org compile) Resolution: add SSID for Toshiba A100-259 to the position_fix quirk table, explicitly specifying the LPIB method. I'll be sending additional patches for these SSIDs as bug reports are confirmed. This patch also trivially sorts the quirk table in ascending order by subsystem vendor. Reported-and-Tested-by: <davide.molteni@gmail.com> Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2267,8 +2267,9 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB), SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB), - SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB), SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 018/164] ALSA: hda: Use LPIB for Acer Aspire 5110 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (16 preceding siblings ...) 2010-07-01 17:33 ` [patch 017/164] ALSA: hda: Use LPIB for Toshiba A100-259 Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 019/164] ALSA: hda: Use LPIB for Sony VPCS11V9E Greg KH ` (145 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 7a68be94e22e7643038726ebc14360752a91800b upstream. BugLink: https://launchpad.net/bugs/583983 Symptom: on a significant number of hardware, booting from a live cd results in capture working correctly, but once the distribution is installed, booting from the install results in capture not working. Test case: boot from Ubuntu 10.04 LTS live cd; capture works correctly. Install to HD and reboot; capture does not work. Reproduced with 2.6.32 mainline build (vanilla kernel.org compile). Resolution: add SSID for Acer Aspire 5110 to the position_fix quirk table, explicitly specifying the LPIB method. I'll be sending additional patches for these SSIDs as bug reports are confirmed. Reported-and-Tested-By: Leo Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2263,6 +2263,7 @@ static int azx_dev_free(struct snd_devic * white/black-listing for position_fix */ static struct snd_pci_quirk position_fix_list[] __devinitdata = { + SND_PCI_QUIRK(0x1025, 0x009f, "Acer Aspire 5110", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 019/164] ALSA: hda: Use LPIB for Sony VPCS11V9E 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (17 preceding siblings ...) 2010-07-01 17:33 ` [patch 018/164] ALSA: hda: Use LPIB for Acer Aspire 5110 Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 020/164] ALSA: hda: Use LPIB for a Shuttle device Greg KH ` (144 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit e96d3127760a2fc509bca6bf7e61e8bc61497aeb upstream. BugLink: https://launchpad.net/bugs/586347 Symptom: On the Sony VPCS11V9E, using GStreamer-based applications with PulseAudio in Ubuntu 10.04 LTS results in stuttering audio. It appears to worsen with increased I/O. Test case: use Rhythmbox under increased I/O pressure. This symptom is reproducible in the current daily stable alsa-driver snapshots (at least up until 21 May 2010; later snapshots fail to build from source due to missing preprocessor directives when compiled against 2.6.32). Resolution: add SSID for this machine to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: Lauri Kainulainen <lauri@sokkelo.net> Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2269,6 +2269,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB), SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), + SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB), SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 020/164] ALSA: hda: Use LPIB for a Shuttle device 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (18 preceding siblings ...) 2010-07-01 17:33 ` [patch 019/164] ALSA: hda: Use LPIB for Sony VPCS11V9E Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 021/164] ACPI: video: fix acpi_backlight=video Greg KH ` (143 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 61bb42c37dfa9016dcacc86bcd41362ab2457d4a upstream. BugLink: https://launchpad.net/bugs/551949 Symptom: On the reporter's Shuttle device, using PulseAudio in Ubuntu 10.04 LTS results in "popping clicking" audio with the PA crashing shortly thereafter. Test case: Using Ubuntu 10.04 LTS (Linux 2.6.32.12), Linux 2.6.33, or Linux 2.6.34, adjust the HDA device's volume with PulseAudio. Resolution: add SSID for this machine to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: Christian Mehlis <mehlis@inf.fu-berlin.de> Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2272,6 +2272,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB), SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1297, 0x3166, "Shuttle", POS_FIX_LPIB), SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB), SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 021/164] ACPI: video: fix acpi_backlight=video 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (19 preceding siblings ...) 2010-07-01 17:33 ` [patch 020/164] ALSA: hda: Use LPIB for a Shuttle device Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 022/164] V4L/DVB: gspca - stv06xx: Remove the 046d:08da from the stv06xx driver Greg KH ` (142 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Kamal Mostafa, Zhang Rui, Bjorn Helgaas, Jiri Kosina, Thomas Renninger, Len Brown 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kamal Mostafa <kamal@canonical.com> commit eeb4bcb4771679d7b3446c0293334faee11b090a upstream. Make "acpi_backlight=video" param enable ACPI_VIDEO_BACKLIGHT_FORCE_VIDEO as intended, instead of incorrectly enabling video output switching. BugLink: http://bugs.launchpad.net/bugs/573120 Signed-off-by: Kamal Mostafa <kamal@canonical.com> Acked-by: Zhang Rui <rui.zhang@intel.com> Cc: Bjorn Helgaas <bjorn.helgaas@hp.com> Cc: Jiri Kosina <jkosina@suse.cz> Acked-by: Thomas Renninger <trenn@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Len Brown <len.brown@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/acpi/video_detect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/acpi/video_detect.c +++ b/drivers/acpi/video_detect.c @@ -250,7 +250,7 @@ static int __init acpi_backlight(char *s ACPI_VIDEO_BACKLIGHT_FORCE_VENDOR; if (!strcmp("video", str)) acpi_video_support |= - ACPI_VIDEO_OUTPUT_SWITCHING_FORCE_VIDEO; + ACPI_VIDEO_BACKLIGHT_FORCE_VIDEO; } return 1; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 022/164] V4L/DVB: gspca - stv06xx: Remove the 046d:08da from the stv06xx driver 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (20 preceding siblings ...) 2010-07-01 17:33 ` [patch 021/164] ACPI: video: fix acpi_backlight=video Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 023/164] HID: Add the GYR4101US USB ID to hid-gyration Greg KH ` (141 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Erik Andrén, Jean-François Moine, Mauro Carvalho Chehab [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 1276 bytes --] 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Erik Andrén <erik.andren@gmail.com> commit 55e0b489a39bb635a44f769d620e44c70d9c065b upstream. The 046d:08da usb id shouldn't be associated with the stv06xx driver as they're not compatible with each other. This fixes a bug where Quickcam Messenger cams fail to use its proper driver (gspca-zc3xx), rendering the camera inoperable. Signed-off-by: Erik Andrén <erik.andren@gmail.com> Tested-by: Gabriel Craciunescu <nix.or.die@googlemail.com> Signed-off-by: Jean-François Moine <moinejf@free.fr> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/media/video/gspca/stv06xx/stv06xx.c | 2 -- 1 file changed, 2 deletions(-) --- a/drivers/media/video/gspca/stv06xx/stv06xx.c +++ b/drivers/media/video/gspca/stv06xx/stv06xx.c @@ -496,8 +496,6 @@ static const __devinitdata struct usb_de {USB_DEVICE(0x046D, 0x08F5), .driver_info = BRIDGE_ST6422 }, /* QuickCam Messenger (new) */ {USB_DEVICE(0x046D, 0x08F6), .driver_info = BRIDGE_ST6422 }, - /* QuickCam Messenger (new) */ - {USB_DEVICE(0x046D, 0x08DA), .driver_info = BRIDGE_ST6422 }, {} }; MODULE_DEVICE_TABLE(usb, device_table); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 023/164] HID: Add the GYR4101US USB ID to hid-gyration 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (21 preceding siblings ...) 2010-07-01 17:33 ` [patch 022/164] V4L/DVB: gspca - stv06xx: Remove the 046d:08da from the stv06xx driver Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 024/164] ar9170usb: add a couple more USB IDs Greg KH ` (140 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Cory Maccarrone, Jiri Kosina 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Cory Maccarrone <darkstar6262@gmail.com> commit c2fd1a4ebf9127c280d227acb635eb1df213439c upstream. This change adds in the USB product ID for the Gyration GYR4101US USB media center remote control. This remote is similar enough to the other two devices that this driver can be used without any other changes to get full support for the remote. Signed-off-by: Cory Maccarrone <darkstar6262@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/hid/hid-core.c | 1 + drivers/hid/hid-gyration.c | 1 + drivers/hid/hid-ids.h | 1 + 3 files changed, 3 insertions(+) --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1305,6 +1305,7 @@ static const struct hid_device_id hid_bl { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, 0x0012) }, { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE) }, { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_3) }, { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) }, { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) }, { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) }, --- a/drivers/hid/hid-gyration.c +++ b/drivers/hid/hid-gyration.c @@ -73,6 +73,7 @@ static int gyration_event(struct hid_dev static const struct hid_device_id gyration_devices[] = { { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE) }, { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_3) }, { } }; MODULE_DEVICE_TABLE(hid, gyration_devices); --- a/drivers/hid/hid-ids.h +++ b/drivers/hid/hid-ids.h @@ -256,6 +256,7 @@ #define USB_VENDOR_ID_GYRATION 0x0c16 #define USB_DEVICE_ID_GYRATION_REMOTE 0x0002 #define USB_DEVICE_ID_GYRATION_REMOTE_2 0x0003 +#define USB_DEVICE_ID_GYRATION_REMOTE_3 0x0008 #define USB_VENDOR_ID_HAPP 0x078b #define USB_DEVICE_ID_UGCI_DRIVING 0x0010 ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 024/164] ar9170usb: add a couple more USB IDs 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (22 preceding siblings ...) 2010-07-01 17:33 ` [patch 023/164] HID: Add the GYR4101US USB ID to hid-gyration Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 025/164] ar9170usb: fix panic triggered by undersized rxstream buffer Greg KH ` (139 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Christian Lamparter, John W. Linville 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Christian Lamparter <chunkeey@googlemail.com> commit 94d0bbe849190255b93fede8eb46809a38f9b8bf upstream. This patch adds the following 5 entries to the usbid device table: * Netgear WNA1000 * Proxim ORiNOCO Dual Band 802.11n USB Adapter * 3Com Dual Band 802.11n USB Adapter * H3C Dual Band 802.11n USB Adapter * WNC Generic 11n USB dongle Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/ath/ar9170/usb.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/drivers/net/wireless/ath/ar9170/usb.c +++ b/drivers/net/wireless/ath/ar9170/usb.c @@ -66,18 +66,28 @@ static struct usb_device_id ar9170_usb_i { USB_DEVICE(0x0cf3, 0x1001) }, /* TP-Link TL-WN821N v2 */ { USB_DEVICE(0x0cf3, 0x1002) }, + /* 3Com Dual Band 802.11n USB Adapter */ + { USB_DEVICE(0x0cf3, 0x1010) }, + /* H3C Dual Band 802.11n USB Adapter */ + { USB_DEVICE(0x0cf3, 0x1011) }, /* Cace Airpcap NX */ { USB_DEVICE(0xcace, 0x0300) }, /* D-Link DWA 160 A1 */ { USB_DEVICE(0x07d1, 0x3c10) }, /* D-Link DWA 160 A2 */ { USB_DEVICE(0x07d1, 0x3a09) }, + /* Netgear WNA1000 */ + { USB_DEVICE(0x0846, 0x9040) }, /* Netgear WNDA3100 */ { USB_DEVICE(0x0846, 0x9010) }, /* Netgear WN111 v2 */ { USB_DEVICE(0x0846, 0x9001) }, /* Zydas ZD1221 */ { USB_DEVICE(0x0ace, 0x1221) }, + /* Proxim ORiNOCO 802.11n USB */ + { USB_DEVICE(0x1435, 0x0804) }, + /* WNC Generic 11n USB Dongle */ + { USB_DEVICE(0x1435, 0x0326) }, /* ZyXEL NWD271N */ { USB_DEVICE(0x0586, 0x3417) }, /* Z-Com UB81 BG */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 025/164] ar9170usb: fix panic triggered by undersized rxstream buffer 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (23 preceding siblings ...) 2010-07-01 17:33 ` [patch 024/164] ar9170usb: add a couple more USB IDs Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 026/164] USB: visor: fix memory leak Greg KH ` (138 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Christian Lamparter, John W. Linville 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Christian Lamparter <chunkeey@googlemail.com> commit 879999cec9489f8942ebce3ec1b5f23ef948dda7 upstream. While ar9170's USB transport packet size is currently set to 8KiB, the PHY is capable of receiving AMPDUs with up to 64KiB. Such a large frame will be split over several rx URBs and exceed the previously allocated space for rx stream reconstruction. This patch increases the buffer size to 64KiB which is in fact the phy & rx stream designed size limit. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=15591 Reported-by: Christian Mehlis <mehlis@inf.fu-berlin.de> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/ath/ar9170/hw.h | 1 + drivers/net/wireless/ath/ar9170/main.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/wireless/ath/ar9170/hw.h +++ b/drivers/net/wireless/ath/ar9170/hw.h @@ -424,5 +424,6 @@ enum ar9170_txq { #define AR9170_TXQ_DEPTH 32 #define AR9170_TX_MAX_PENDING 128 +#define AR9170_RX_STREAM_MAX_SIZE 65535 #endif /* __AR9170_HW_H */ --- a/drivers/net/wireless/ath/ar9170/main.c +++ b/drivers/net/wireless/ath/ar9170/main.c @@ -2538,7 +2538,7 @@ void *ar9170_alloc(size_t priv_size) * tends to split the streams into seperate rx descriptors. */ - skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL); + skb = __dev_alloc_skb(AR9170_RX_STREAM_MAX_SIZE, GFP_KERNEL); if (!skb) goto err_nomem; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 026/164] USB: visor: fix memory leak 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (24 preceding siblings ...) 2010-07-01 17:33 ` [patch 025/164] ar9170usb: fix panic triggered by undersized rxstream buffer Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 027/164] USB: CP210x New Device IDs 11 New device IDs Greg KH ` (137 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit 199b113978015309dd02c69844c19a1be3f4dbcf upstream. Fix memory leak for some devices (Sony Clie 3.5) due to port private data not being freed on release. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/visor.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/serial/visor.c +++ b/drivers/usb/serial/visor.c @@ -249,6 +249,7 @@ static struct usb_serial_driver clie_3_5 .throttle = visor_throttle, .unthrottle = visor_unthrottle, .attach = clie_3_5_startup, + .release = visor_release, .write = visor_write, .write_room = visor_write_room, .write_bulk_callback = visor_write_bulk_callback, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 027/164] USB: CP210x New Device IDs 11 New device IDs 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (25 preceding siblings ...) 2010-07-01 17:33 ` [patch 026/164] USB: visor: fix memory leak Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 028/164] USB: kobil: fix memory leak Greg KH ` (136 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Craig Shelley 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Craig Shelley <craig@microtron.org.uk> commit eefd9029fde4d90d59804eeb54880ab8db5c1866 upstream. Signed-off-by: Craig Shelley <craig@microtron.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/cp210x.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/drivers/usb/serial/cp210x.c +++ b/drivers/usb/serial/cp210x.c @@ -61,6 +61,8 @@ static struct usb_device_id id_table [] { USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */ { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ + { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */ + { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */ { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */ { USB_DEVICE(0x0FCF, 0x1004) }, /* Dynastream ANT2USB */ { USB_DEVICE(0x0FCF, 0x1006) }, /* Dynastream ANT development board */ @@ -72,9 +74,12 @@ static struct usb_device_id id_table [] { USB_DEVICE(0x10C4, 0x1601) }, /* Arkham Technology DS101 Adapter */ { USB_DEVICE(0x10C4, 0x800A) }, /* SPORTident BSM7-D-USB main station */ { USB_DEVICE(0x10C4, 0x803B) }, /* Pololu USB-serial converter */ + { USB_DEVICE(0x10C4, 0x8044) }, /* Cygnal Debug Adapter */ + { USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME build-in converter */ { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */ { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */ { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */ + { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */ { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */ { USB_DEVICE(0x10C4, 0x80CA) }, /* Degree Controls Inc */ { USB_DEVICE(0x10C4, 0x80DD) }, /* Tracient RFID */ @@ -82,12 +87,15 @@ static struct usb_device_id id_table [] { USB_DEVICE(0x10C4, 0x8115) }, /* Arygon NFC/Mifare Reader */ { USB_DEVICE(0x10C4, 0x813D) }, /* Burnside Telecom Deskmobile */ { USB_DEVICE(0x10C4, 0x813F) }, /* Tams Master Easy Control */ + { USB_DEVICE(0x10C4, 0x8149) }, /* West Mountain Radio Computerized Battery Analyzer */ { USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */ { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */ { USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */ + { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */ { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */ { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */ { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */ + { USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */ { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */ { USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */ { USB_DEVICE(0x10C4, 0x81E7) }, /* Aerocomm Radio */ @@ -105,6 +113,7 @@ static struct usb_device_id id_table [] { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */ { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */ { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */ { USB_DEVICE(0x10C4, 0xF003) }, /* Elan Digital Systems USBpulse100 */ @@ -115,6 +124,8 @@ static struct usb_device_id id_table [] { USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */ { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */ { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */ + { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */ + { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */ { } /* Terminating Entry */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 028/164] USB: kobil: fix memory leak 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (26 preceding siblings ...) 2010-07-01 17:33 ` [patch 027/164] USB: CP210x New Device IDs 11 New device IDs Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 029/164] USB: option: add PID for ZTE product Greg KH ` (135 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit c0f631d1948658b27349545b2cbcb4b32f010c7a upstream. An urb transfer buffer is allocated at every open but was never freed. This driver is a bit of a mess... Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/kobil_sct.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/usb/serial/kobil_sct.c +++ b/drivers/usb/serial/kobil_sct.c @@ -345,7 +345,8 @@ static void kobil_close(struct usb_seria /* FIXME: Add rts/dtr methods */ if (port->write_urb) { - usb_kill_urb(port->write_urb); + usb_poison_urb(port->write_urb); + kfree(port->write_urb->transfer_buffer); usb_free_urb(port->write_urb); port->write_urb = NULL; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 029/164] USB: option: add PID for ZTE product 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (27 preceding siblings ...) 2010-07-01 17:33 ` [patch 028/164] USB: kobil: fix memory leak Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 030/164] USB: option.c: Add Pirelli VID/PID and indicate Pirellis modem interface is 0xff Greg KH ` (134 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Joey 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: zhao1980ming <zhao1980ming@163.com> commit a71ee85e1d74e862d68cc9b2f2ab6a806d2550c9 upstream. this patch adds ZTE modem devices Signed-off-by: Joey <zhao.ming9@zte.com.cn> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/option.c | 174 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 174 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -621,6 +621,180 @@ static struct usb_device_id option_ids[] { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1060, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1061, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1062, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1063, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1064, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1065, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1066, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1067, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1068, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1069, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1070, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1071, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1072, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1073, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1074, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1075, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1076, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1077, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1078, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1079, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1080, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1081, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1082, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1083, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1084, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1085, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1086, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1087, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1088, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1089, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1090, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1091, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1092, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1093, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1094, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1095, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1096, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1097, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1098, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1099, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1100, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1101, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1102, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1103, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1104, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1105, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1106, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1107, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1108, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1109, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1110, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1111, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1112, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1113, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1114, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1115, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1116, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1117, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1118, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1119, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1120, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1121, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1122, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1123, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1124, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1125, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1126, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1127, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1128, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1129, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1130, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1131, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1132, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1133, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1134, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1135, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1136, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1137, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1138, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1139, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1140, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1141, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1142, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1143, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1144, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1145, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1146, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1147, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1148, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1149, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1150, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1151, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1152, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1153, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1154, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1155, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1156, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1157, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1158, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1159, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1160, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1161, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1162, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1163, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1164, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1165, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1166, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1167, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1168, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1169, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1170, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1244, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1245, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1246, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1247, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1248, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1249, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1250, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1251, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1252, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1253, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1254, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1255, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1256, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1257, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1258, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1259, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1260, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1261, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1262, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1263, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1264, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1265, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1266, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1267, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1268, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1269, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1271, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1274, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1275, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1276, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1277, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1278, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1279, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1280, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1281, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1282, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1283, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1284, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1285, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1286, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1287, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1288, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1289, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1290, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1291, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1292, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1293, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1294, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1295, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1296, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1297, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) }, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 030/164] USB: option.c: Add Pirelli VID/PID and indicate Pirellis modem interface is 0xff 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (28 preceding siblings ...) 2010-07-01 17:33 ` [patch 029/164] USB: option: add PID for ZTE product Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 031/164] USB: serial: option: add cinterion device id Greg KH ` (133 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, spark 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: spark <spark@bandrich.com> commit 33c387529b7931248c6637bf9720ac7504a0b28b upstream. Signed-off-by: spark <spark@bandrich.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/option.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -334,6 +334,24 @@ static int option_resume(struct usb_ser #define ALCATEL_VENDOR_ID 0x1bbb #define ALCATEL_PRODUCT_X060S 0x0000 +#define PIRELLI_VENDOR_ID 0x1266 +#define PIRELLI_PRODUCT_C100_1 0x1002 +#define PIRELLI_PRODUCT_C100_2 0x1003 +#define PIRELLI_PRODUCT_1004 0x1004 +#define PIRELLI_PRODUCT_1005 0x1005 +#define PIRELLI_PRODUCT_1006 0x1006 +#define PIRELLI_PRODUCT_1007 0x1007 +#define PIRELLI_PRODUCT_1008 0x1008 +#define PIRELLI_PRODUCT_1009 0x1009 +#define PIRELLI_PRODUCT_100A 0x100a +#define PIRELLI_PRODUCT_100B 0x100b +#define PIRELLI_PRODUCT_100C 0x100c +#define PIRELLI_PRODUCT_100D 0x100d +#define PIRELLI_PRODUCT_100E 0x100e +#define PIRELLI_PRODUCT_100F 0x100f +#define PIRELLI_PRODUCT_1011 0x1011 +#define PIRELLI_PRODUCT_1012 0x1012 + /* Airplus products */ #define AIRPLUS_VENDOR_ID 0x1011 #define AIRPLUS_PRODUCT_MCD650 0x3198 @@ -823,6 +841,24 @@ static struct usb_device_id option_ids[] { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) }, { USB_DEVICE(FOUR_G_SYSTEMS_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14) }, { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, + /* Pirelli */ + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_2)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1004)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1005)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1006)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1007)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1008)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1009)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100A)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100B) }, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100C) }, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100D) }, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100E) }, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100F) }, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)}, + { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)}, + { } /* Terminating entry */ }; MODULE_DEVICE_TABLE(usb, option_ids); @@ -945,12 +981,19 @@ static int option_probe(struct usb_seria const struct usb_device_id *id) { struct option_intf_private *data; + /* D-Link DWM 652 still exposes CD-Rom emulation interface in modem mode */ if (serial->dev->descriptor.idVendor == DLINK_VENDOR_ID && serial->dev->descriptor.idProduct == DLINK_PRODUCT_DWM_652 && serial->interface->cur_altsetting->desc.bInterfaceClass == 0x8) return -ENODEV; + /* Bandrich modem and AT command interface is 0xff */ + if ((serial->dev->descriptor.idVendor == BANDRICH_VENDOR_ID || + serial->dev->descriptor.idVendor == PIRELLI_VENDOR_ID) && + serial->interface->cur_altsetting->desc.bInterfaceClass != 0xff) + return -ENODEV; + data = serial->private = kzalloc(sizeof(struct option_intf_private), GFP_KERNEL); if (!data) return -ENOMEM; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 031/164] USB: serial: option: add cinterion device id 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (29 preceding siblings ...) 2010-07-01 17:33 ` [patch 030/164] USB: option.c: Add Pirelli VID/PID and indicate Pirellis modem interface is 0xff Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 032/164] USB: option.c: OLIVETTI OLICARD100 support Greg KH ` (132 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Greg Kroah-Hartman <gregkh@suse.de> commit 6f44bcb60bfa58590142545096b64f44144f0bc1 upstream. This adds a device id for a Cinterion device. Reported-by: John Race <John.Race@roscom.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -364,6 +364,8 @@ static int option_resume(struct usb_ser #define HAIER_VENDOR_ID 0x201e #define HAIER_PRODUCT_CE100 0x2009 +#define CINTERION_VENDOR_ID 0x0681 + static struct usb_device_id option_ids[] = { { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, @@ -859,6 +861,7 @@ static struct usb_device_id option_ids[] { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)}, { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)}, + { USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) }, { } /* Terminating entry */ }; MODULE_DEVICE_TABLE(usb, option_ids); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 032/164] USB: option.c: OLIVETTI OLICARD100 support 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (30 preceding siblings ...) 2010-07-01 17:33 ` [patch 031/164] USB: serial: option: add cinterion device id Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 033/164] USB: ir-usb: fix double free Greg KH ` (131 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Nils Radtke [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 1510 bytes --] 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Nils Radtke <lkml@Think-Future.de> commit 86234d4975ce084d14711283a3bfc69305f97602 upstream. This patch adds support for an olivetti olicard100 HЅDPA usb-stick. This device is a zeroCD one with ID 0b3c:c700 that needs switching via eject or usb-modeswitch with MessageContent="5553424312345678000000000000061b000000030000000000000000000000". After switching it has ID 0b3c:c000 and provides 5 serial ports ttyUSB[0-4]. Port 0 (modem) and 4 are interrupt ports. Signed-off-by: Nils Radtke <lkml@Think-Future.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -366,6 +366,10 @@ static int option_resume(struct usb_ser #define CINTERION_VENDOR_ID 0x0681 +/* Olivetti products */ +#define OLIVETTI_VENDOR_ID 0x0b3c +#define OLIVETTI_PRODUCT_OLICARD100 0xc000 + static struct usb_device_id option_ids[] = { { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, @@ -862,6 +866,8 @@ static struct usb_device_id option_ids[] { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)}, { USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) }, + + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) }, { } /* Terminating entry */ }; MODULE_DEVICE_TABLE(usb, option_ids); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 033/164] USB: ir-usb: fix double free 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (31 preceding siblings ...) 2010-07-01 17:33 ` [patch 032/164] USB: option.c: OLIVETTI OLICARD100 support Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 034/164] USB: kl5usb105: fix memory leak Greg KH ` (130 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit 2ff78c0c2b67120c8e503268da3f177cae2228a2 upstream. If the user specifies a custom bulk buffer size we get a double free at port release. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/ir-usb.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/serial/ir-usb.c +++ b/drivers/usb/serial/ir-usb.c @@ -312,6 +312,7 @@ static int ir_open(struct tty_struct *tt kfree(port->read_urb->transfer_buffer); port->read_urb->transfer_buffer = buffer; port->read_urb->transfer_buffer_length = buffer_size; + port->bulk_in_buffer = buffer; buffer = kmalloc(buffer_size, GFP_KERNEL); if (!buffer) { @@ -321,6 +322,7 @@ static int ir_open(struct tty_struct *tt kfree(port->write_urb->transfer_buffer); port->write_urb->transfer_buffer = buffer; port->write_urb->transfer_buffer_length = buffer_size; + port->bulk_out_buffer = buffer; port->bulk_out_size = buffer_size; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 034/164] USB: kl5usb105: fix memory leak 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (32 preceding siblings ...) 2010-07-01 17:33 ` [patch 033/164] USB: ir-usb: fix double free Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 035/164] USB: mxc: gadget: Fix bitfield for calculating maximum packet size Greg KH ` (129 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit 313b0d80c1717ffe8f64b455a4d323996748b91a upstream. Private data was not freed on error path in startup. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/kl5kusb105.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/serial/kl5kusb105.c +++ b/drivers/usb/serial/kl5kusb105.c @@ -310,6 +310,7 @@ err_cleanup: usb_free_urb(priv->write_urb_pool[j]); } } + kfree(priv); usb_set_serial_port_data(serial->port[i], NULL); } return -ENOMEM; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 035/164] USB: mxc: gadget: Fix bitfield for calculating maximum packet size 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (33 preceding siblings ...) 2010-07-01 17:33 ` [patch 034/164] USB: kl5usb105: fix memory leak Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 036/164] USB: unusual-dev: Add bad sense flag for Appotech ax203 based picture frames Greg KH ` (128 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Dinh Nguyen 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dinh Nguyen <Dinh.Nguyen@freescale.com> commit 88e3b59b5adce5b12e205af0e34d518ba0dcdc0c upstream. The max packet length bit mask used for isochronous endpoints should be 0x7FF instead of 0x8FF. 0x8FF will actually clear higher-order bits in the max packet length field. This patch applies to 2.6.34-rc6. Signed-off-by: Dinh Nguyen <Dinh.Nguyen@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/gadget/fsl_udc_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/gadget/fsl_udc_core.c +++ b/drivers/usb/gadget/fsl_udc_core.c @@ -489,7 +489,7 @@ static int fsl_ep_enable(struct usb_ep * case USB_ENDPOINT_XFER_ISOC: /* Calculate transactions needed for high bandwidth iso */ mult = (unsigned char)(1 + ((max >> 11) & 0x03)); - max = max & 0x8ff; /* bit 0~10 */ + max = max & 0x7ff; /* bit 0~10 */ /* 3 transactions at most */ if (mult > 3) goto en_done; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 036/164] USB: unusual-dev: Add bad sense flag for Appotech ax203 based picture frames 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (34 preceding siblings ...) 2010-07-01 17:33 ` [patch 035/164] USB: mxc: gadget: Fix bitfield for calculating maximum packet size Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 037/164] USB: FHCI: cq_get() should check kfifo_out()s return value Greg KH ` (127 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Hans de Goede 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Hans de Goede <hdegoede@redhat.com> commit a78f4f1a16d87f3d33158d036af94e48e32f8aad upstream. These Appotech controllers are found in Picture Frames, they provide a (buggy) emulation of a cdrom drive which contains the windows software Uploading of pictures happens over the corresponding /dev/sg device. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/storage/unusual_devs.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+) --- a/drivers/usb/storage/unusual_devs.h +++ b/drivers/usb/storage/unusual_devs.h @@ -1858,6 +1858,21 @@ UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_IGNORE_RESIDUE ), +/* Reported by Hans de Goede <hdegoede@redhat.com> + * These Appotech controllers are found in Picture Frames, they provide a + * (buggy) emulation of a cdrom drive which contains the windows software + * Uploading of pictures happens over the corresponding /dev/sg device. */ +UNUSUAL_DEV( 0x1908, 0x1315, 0x0000, 0x0000, + "BUILDWIN", + "Photo Frame", + US_SC_DEVICE, US_PR_DEVICE, NULL, + US_FL_BAD_SENSE ), +UNUSUAL_DEV( 0x1908, 0x1320, 0x0000, 0x0000, + "BUILDWIN", + "Photo Frame", + US_SC_DEVICE, US_PR_DEVICE, NULL, + US_FL_BAD_SENSE ), + UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001, "ST", "2A", ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 037/164] USB: FHCI: cq_get() should check kfifo_out()s return value 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (35 preceding siblings ...) 2010-07-01 17:33 ` [patch 036/164] USB: unusual-dev: Add bad sense flag for Appotech ax203 based picture frames Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 038/164] USB: EHCI: clear PHCD before resuming Greg KH ` (126 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Anton Vorontsov 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Anton Vorontsov <avorontsov@mvista.com> commit 7f1cccd3ec8789e52897bc34420ca81a5e2edeab upstream. Since commit 7acd72eb85f1c7a15e8b5eb554994949241737f1 ("kfifo: rename kfifo_put... into kfifo_in... and kfifo_get... into kfifo_out..."), kfifo_out() is marked __must_check, and that causes gcc to produce lots of warnings like this: CC drivers/usb/host/fhci-mem.o In file included from drivers/usb/host/fhci-hcd.c:34: drivers/usb/host/fhci.h: In function 'cq_get': drivers/usb/host/fhci.h:520: warning: ignoring return value of 'kfifo_out', declared with attribute warn_unused_result ... This patch fixes the issue by properly checking the return value. Signed-off-by: Anton Vorontsov <avorontsov@mvista.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/fhci.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/drivers/usb/host/fhci.h +++ b/drivers/usb/host/fhci.h @@ -20,6 +20,7 @@ #include <linux/kernel.h> #include <linux/types.h> +#include <linux/bug.h> #include <linux/spinlock.h> #include <linux/interrupt.h> #include <linux/kfifo.h> @@ -515,9 +516,13 @@ static inline int cq_put(struct kfifo *k static inline void *cq_get(struct kfifo *kfifo) { - void *p = NULL; + unsigned int sz; + void *p; + + sz = kfifo_out(kfifo, (void *)&p, sizeof(p)); + if (sz != sizeof(p)) + return NULL; - kfifo_out(kfifo, (void *)&p, sizeof(p)); return p; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 038/164] USB: EHCI: clear PHCD before resuming 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (36 preceding siblings ...) 2010-07-01 17:33 ` [patch 037/164] USB: FHCI: cq_get() should check kfifo_out()s return value Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 039/164] USB: xhci: Fix issue with set interface after stall Greg KH ` (125 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Alek Du, David Brownell, Alan Stern 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alek Du <alek.du@intel.com> commit eab80de01cb398419ef3305f35abcb367c647c8b upstream. This is a bug fix for PHCD (phy clock disable) low power feature: After PHCD is set, any write to PORTSC register is illegal, so when resume ports, clear PHCD bit first. Signed-off-by: Alek Du <alek.du@intel.com> Cc: David Brownell <dbrownell@users.sourceforge.net> Cc: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/ehci-hub.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) --- a/drivers/usb/host/ehci-hub.c +++ b/drivers/usb/host/ehci-hub.c @@ -294,6 +294,16 @@ static int ehci_bus_resume (struct usb_h /* manually resume the ports we suspended during bus_suspend() */ i = HCS_N_PORTS (ehci->hcs_params); while (i--) { + /* clear phy low power mode before resume */ + if (ehci->has_hostpc) { + u32 __iomem *hostpc_reg = + (u32 __iomem *)((u8 *)ehci->regs + + HOSTPC0 + 4 * (i & 0xff)); + temp = ehci_readl(ehci, hostpc_reg); + ehci_writel(ehci, temp & ~HOSTPC_PHCD, + hostpc_reg); + mdelay(5); + } temp = ehci_readl(ehci, &ehci->regs->port_status [i]); temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS); if (test_bit(i, &ehci->bus_suspended) && @@ -678,6 +688,13 @@ static int ehci_hub_control ( if (temp & PORT_SUSPEND) { if ((temp & PORT_PE) == 0) goto error; + /* clear phy low power mode before resume */ + if (hostpc_reg) { + temp1 = ehci_readl(ehci, hostpc_reg); + ehci_writel(ehci, temp1 & ~HOSTPC_PHCD, + hostpc_reg); + mdelay(5); + } /* resume signaling for 20 msec */ temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS); ehci_writel(ehci, temp | PORT_RESUME, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 039/164] USB: xhci: Fix issue with set interface after stall. 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (37 preceding siblings ...) 2010-07-01 17:33 ` [patch 038/164] USB: EHCI: clear PHCD before resuming Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 040/164] USB: xhci: Limit bus sg_tablesize to 62 TRBs Greg KH ` (124 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sarah Sharp <sarah.a.sharp@linux.intel.com> commit 1624ae1c19e227096ba85bfc389d9b99cb6f7dde upstream. When the USB core installs a new interface, it unconditionally clears the halts on all the endpoints on the new interface. Usually the xHCI host needs to know when an endpoint is reset, so it can change its internal endpoint state. In this case, it doesn't care, because the endpoints were never halted in the first place. To avoid issuing a redundant Reset Endpoint command, the xHCI driver looks at xhci_virt_ep->stopped_td to determine if the endpoint was actually halted. However, the functions that handle the stall never set that variable to NULL after it dealt with the stall. So if an endpoint stalled and a Reset Endpoint command completed, and then the class driver tried to install a new alternate setting, the xHCI driver would access the old xhci_virt_ep->stopped_td pointer. A similar problem occurs if the endpoint has been stopped to cancel a transfer. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-hcd.c | 2 ++ drivers/usb/host/xhci-ring.c | 7 +++++++ 2 files changed, 9 insertions(+) --- a/drivers/usb/host/xhci-hcd.c +++ b/drivers/usb/host/xhci-hcd.c @@ -1452,6 +1452,8 @@ void xhci_endpoint_reset(struct usb_hcd kfree(virt_ep->stopped_td); xhci_ring_cmd_db(xhci); } + virt_ep->stopped_td = NULL; + virt_ep->stopped_trb = NULL; spin_unlock_irqrestore(&xhci->lock, flags); if (ret) --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -577,6 +577,8 @@ static void handle_stopped_endpoint(stru /* Otherwise just ring the doorbell to restart the ring */ ring_ep_doorbell(xhci, slot_id, ep_index); } + ep->stopped_td = NULL; + ep->stopped_trb = NULL; /* * Drop the lock and complete the URBs in the cancelled TD list. @@ -1049,8 +1051,13 @@ static void xhci_cleanup_halted_endpoint ep->ep_state |= EP_HALTED; ep->stopped_td = td; ep->stopped_trb = event_trb; + xhci_queue_reset_ep(xhci, slot_id, ep_index); xhci_cleanup_stalled_ring(xhci, td->urb->dev, ep_index); + + ep->stopped_td = NULL; + ep->stopped_trb = NULL; + xhci_ring_cmd_db(xhci); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 040/164] USB: xhci: Limit bus sg_tablesize to 62 TRBs. 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (38 preceding siblings ...) 2010-07-01 17:33 ` [patch 039/164] USB: xhci: Fix issue with set interface after stall Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 041/164] USB: xhci: Fix check for room on the ring Greg KH ` (123 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sarah Sharp <sarah.a.sharp@linux.intel.com> commit bc88d2eba5e19d10dd546e428314909d889b3b6a upstream. When a scatter-gather list is enqueued to the xHCI driver, it translates each entry into a transfer request block (TRB). Only 63 TRBs can be used per ring segment, and there must be one additional TRB reserved to make sure the hardware does not think the ring is empty (so the enqueue pointer doesn't equal the dequeue pointer). Limit the bus sg_tablesize to 62 TRBs. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/host/xhci-pci.c +++ b/drivers/usb/host/xhci-pci.c @@ -54,7 +54,7 @@ static int xhci_pci_setup(struct usb_hcd struct pci_dev *pdev = to_pci_dev(hcd->self.controller); int retval; - hcd->self.sg_tablesize = TRBS_PER_SEGMENT - 1; + hcd->self.sg_tablesize = TRBS_PER_SEGMENT - 2; xhci->cap_regs = hcd->regs; xhci->op_regs = hcd->regs + ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 041/164] USB: xhci: Fix check for room on the ring. 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (39 preceding siblings ...) 2010-07-01 17:33 ` [patch 040/164] USB: xhci: Limit bus sg_tablesize to 62 TRBs Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 042/164] USB: xHCI: Fix wrong usage of macro TRB_TYPE Greg KH ` (122 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sarah Sharp <sarah.a.sharp@linux.intel.com> commit 44ebd037c54f80db3121ac9f5fe6e677b76e11d5 upstream. The length of the scatter gather list a driver can enqueue is limited by the bus' sg_tablesize to 62 entries. Each entry will be described by at least one transfer request block (TRB). If the entry's buffer crosses a 64KB boundary, then that entry will have to be described by two or more TRBs. So even if the USB device driver respects sg_tablesize, the whole scatter list may take more than 62 TRBs to describe, and won't fit on the ring. Don't assume that an empty ring means there is enough room on the transfer ring. The old code would unconditionally queue this too-large transfer, and over write the beginning of the transfer. This would mean the cycle bit was unchanged in those overwritten transfers, causing the hardware to think it didn't own the TRBs, and the host would seem to hang. Now drivers may see submit_urb() fail with -ENOMEM if the transfers are too big to fit on the ring. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-ring.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -241,10 +241,27 @@ static int room_on_ring(struct xhci_hcd int i; union xhci_trb *enq = ring->enqueue; struct xhci_segment *enq_seg = ring->enq_seg; + struct xhci_segment *cur_seg; + unsigned int left_on_ring; /* Check if ring is empty */ - if (enq == ring->dequeue) + if (enq == ring->dequeue) { + /* Can't use link trbs */ + left_on_ring = TRBS_PER_SEGMENT - 1; + for (cur_seg = enq_seg->next; cur_seg != enq_seg; + cur_seg = cur_seg->next) + left_on_ring += TRBS_PER_SEGMENT - 1; + + /* Always need one TRB free in the ring. */ + left_on_ring -= 1; + if (num_trbs > left_on_ring) { + xhci_warn(xhci, "Not enough room on ring; " + "need %u TRBs, %u TRBs left\n", + num_trbs, left_on_ring); + return 0; + } return 1; + } /* Make sure there's an extra empty TRB available */ for (i = 0; i <= num_trbs; ++i) { if (enq == ring->dequeue) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 042/164] USB: xHCI: Fix wrong usage of macro TRB_TYPE 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (40 preceding siblings ...) 2010-07-01 17:33 ` [patch 041/164] USB: xhci: Fix check for room on the ring Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 043/164] ath5k: consistently use rx_bufsize for RX DMA Greg KH ` (121 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andiry Xu, Sarah Sharp 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andiry Xu <andiry.xu@amd.com> commit 54b5acf3acb7a1f83ec281d111d3e2812cd7ad9d upstream. Macro TRB_TYPE is misused in some places. Fix the wrong usage. Signed-off-by: Andiry Xu <andiry.xu@amd.com> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-ring.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -350,7 +350,8 @@ static struct xhci_segment *find_trb_seg while (cur_seg->trbs > trb || &cur_seg->trbs[TRBS_PER_SEGMENT - 1] < trb) { generic_trb = &cur_seg->trbs[TRBS_PER_SEGMENT - 1].generic; - if (TRB_TYPE(generic_trb->field[3]) == TRB_LINK && + if ((generic_trb->field[3] & TRB_TYPE_BITMASK) == + TRB_TYPE(TRB_LINK) && (generic_trb->field[3] & LINK_TOGGLE)) *cycle_state = ~(*cycle_state) & 0x1; cur_seg = cur_seg->next; @@ -406,7 +407,7 @@ void xhci_find_new_dequeue_state(struct BUG(); trb = &state->new_deq_ptr->generic; - if (TRB_TYPE(trb->field[3]) == TRB_LINK && + if ((trb->field[3] & TRB_TYPE_BITMASK) == TRB_TYPE(TRB_LINK) && (trb->field[3] & LINK_TOGGLE)) state->new_cycle_state = ~(state->new_cycle_state) & 0x1; next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr); @@ -1394,8 +1395,10 @@ static int handle_tx_event(struct xhci_h for (cur_trb = ep_ring->dequeue, cur_seg = ep_ring->deq_seg; cur_trb != event_trb; next_trb(xhci, ep_ring, &cur_seg, &cur_trb)) { - if (TRB_TYPE(cur_trb->generic.field[3]) != TRB_TR_NOOP && - TRB_TYPE(cur_trb->generic.field[3]) != TRB_LINK) + if ((cur_trb->generic.field[3] & + TRB_TYPE_BITMASK) != TRB_TYPE(TRB_TR_NOOP) && + (cur_trb->generic.field[3] & + TRB_TYPE_BITMASK) != TRB_TYPE(TRB_LINK)) td->urb->actual_length += TRB_LEN(cur_trb->generic.field[2]); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 043/164] ath5k: consistently use rx_bufsize for RX DMA 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (41 preceding siblings ...) 2010-07-01 17:33 ` [patch 042/164] USB: xHCI: Fix wrong usage of macro TRB_TYPE Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 044/164] mac80211: give warning if building w/out rate ctrl algorithm Greg KH ` (120 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Bruno Randolf, John W. Linville 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bruno Randolf <br1@einfach.org> commit b5eae9ff5ba6d76de19286dd6429acd7cde3f79d upstream. We should use the same buffer size we set up for DMA also in the hardware descriptor. Previously we used common->rx_bufsize for setting up the DMA mapping, but used skb_tailroom(skb) for the size we tell to the hardware in the descriptor itself. The problem is that skb_tailroom(skb) can give us a larger value than the size we set up for DMA before. This allows the hardware to write into memory locations not set up for DMA. In practice this should rarely happen because all packets should be smaller than the maximum 802.11 packet size. On the tested platform rx_bufsize is 2528, and we allocated an skb of 2559 bytes length (including padding for cache alignment) but sbk_tailroom() was 2592. Just consistently use rx_bufsize for all RX DMA memory sizes. Also use the return value of the descriptor setup function. Signed-off-by: Bruno Randolf <br1@einfach.org> Reviewed-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/ath/ath5k/base.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/drivers/net/wireless/ath/ath5k/base.c +++ b/drivers/net/wireless/ath/ath5k/base.c @@ -1210,6 +1210,7 @@ ath5k_rxbuf_setup(struct ath5k_softc *sc struct ath5k_hw *ah = sc->ah; struct sk_buff *skb = bf->skb; struct ath5k_desc *ds; + int ret; if (!skb) { skb = ath5k_rx_skb_alloc(sc, &bf->skbaddr); @@ -1236,9 +1237,9 @@ ath5k_rxbuf_setup(struct ath5k_softc *sc ds = bf->desc; ds->ds_link = bf->daddr; /* link to self */ ds->ds_data = bf->skbaddr; - ah->ah_setup_rx_desc(ah, ds, - skb_tailroom(skb), /* buffer size */ - 0); + ret = ah->ah_setup_rx_desc(ah, ds, ah->common.rx_bufsize, 0); + if (ret) + return ret; if (sc->rxlink != NULL) *sc->rxlink = bf->daddr; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 044/164] mac80211: give warning if building w/out rate ctrl algorithm 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (42 preceding siblings ...) 2010-07-01 17:33 ` [patch 043/164] ath5k: consistently use rx_bufsize for RX DMA Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 045/164] mac80211: Fix robust management frame handling (MFP) Greg KH ` (119 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andres Salomon, John W. Linville 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andres Salomon <dilinger@collabora.co.uk> commit c2ef355bf3ef0b8006b96128726684fba47ac928 upstream. I discovered that if EMBEDDED=y, one can accidentally build a mac80211 stack and drivers w/ no rate control algorithm. For drivers like RTL8187 that don't supply their own RC algorithms, this will cause ieee80211_register_hw to fail (making the driver unusable). This will tell kconfig to provide a warning if no rate control algorithms have been selected. That'll at least warn the user; users that know that their drivers supply a rate control algorithm can safely ignore the warning, and those who don't know (or who expect to be using multiple drivers) can select a default RC algorithm. Signed-off-by: Andres Salomon <dilinger@collabora.co.uk> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/mac80211/Kconfig | 9 +++++++++ 1 file changed, 9 insertions(+) --- a/net/mac80211/Kconfig +++ b/net/mac80211/Kconfig @@ -15,8 +15,12 @@ comment "CFG80211 needs to be enabled fo if MAC80211 != n +config MAC80211_HAS_RC + def_bool n + config MAC80211_RC_PID bool "PID controller based rate control algorithm" if EMBEDDED + select MAC80211_HAS_RC ---help--- This option enables a TX rate control algorithm for mac80211 that uses a PID controller to select the TX @@ -24,12 +28,14 @@ config MAC80211_RC_PID config MAC80211_RC_MINSTREL bool "Minstrel" if EMBEDDED + select MAC80211_HAS_RC default y ---help--- This option enables the 'minstrel' TX rate control algorithm choice prompt "Default rate control algorithm" + depends on MAC80211_HAS_RC default MAC80211_RC_DEFAULT_MINSTREL ---help--- This option selects the default rate control algorithm @@ -62,6 +68,9 @@ config MAC80211_RC_DEFAULT endif +comment "Some wireless drivers require a rate control algorithm" + depends on MAC80211_HAS_RC=n + config MAC80211_MESH bool "Enable mac80211 mesh networking (pre-802.11s) support" depends on MAC80211 && EXPERIMENTAL ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 045/164] mac80211: Fix robust management frame handling (MFP) 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (43 preceding siblings ...) 2010-07-01 17:33 ` [patch 044/164] mac80211: give warning if building w/out rate ctrl algorithm Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 046/164] mac80211: fix rts threshold check Greg KH ` (118 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jouni Malinen, John W. Linville 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jouni Malinen <j@w1.fi> commit d211e90e28a074447584729018a39910d691d1a8 upstream. Commit e34e09401ee9888dd662b2fca5d607794a56daf2 incorrectly removed use of ieee80211_has_protected() from the management frame case and in practice, made this validation drop all Action frames when MFP is enabled. This should have only been done for frames with Protected field set to zero. Signed-off-by: Jouni Malinen <j@w1.fi> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/mac80211/rx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1399,7 +1399,8 @@ ieee80211_drop_unencrypted(struct ieee80 (rx->key || rx->sdata->drop_unencrypted))) return -EACCES; if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) { - if (unlikely(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && + if (unlikely(!ieee80211_has_protected(fc) && + ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && rx->key)) return -EACCES; /* BIP does not use Protected field, so need to check MMIE */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 046/164] mac80211: fix rts threshold check 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (44 preceding siblings ...) 2010-07-01 17:33 ` [patch 045/164] mac80211: Fix robust management frame handling (MFP) Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 047/164] mac80211: fix handling of 4-address-mode in ieee80211_change_iface Greg KH ` (117 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Shanyu Zhao, John W. Linville 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shanyu Zhao <shanyu.zhao@intel.com> commit a2c40249a36d0b4d76d1caf6bf806e4ae5b06e8a upstream. Currently whenever rts thresold is set, every packet will use RTS protection no matter its size exceeds the threshold or not. This is due to a bug in the rts threshold check. if (len > tx->local->hw.wiphy->rts_threshold) { txrc.rts = rts = true; } Basically it is comparing an int (len) and a u32 (rts_threshold), and the variable len is assigned as: len = min_t(int, tx->skb->len + FCS_LEN, tx->local->hw.wiphy->frag_threshold); However, when frag_threshold is "-1", len is always "-1", which is 0xffffffff therefore rts is always set to true. Signed-off-by: Shanyu Zhao <shanyu.zhao@intel.com> Reviewed-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/mac80211/tx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -501,7 +501,8 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021 struct ieee80211_hdr *hdr = (void *)tx->skb->data; struct ieee80211_supported_band *sband; struct ieee80211_rate *rate; - int i, len; + int i; + u32 len; bool inval = false, rts = false, short_preamble = false; struct ieee80211_tx_rate_control txrc; u32 sta_flags; @@ -510,7 +511,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021 sband = tx->local->hw.wiphy->bands[tx->channel->band]; - len = min_t(int, tx->skb->len + FCS_LEN, + len = min_t(u32, tx->skb->len + FCS_LEN, tx->local->hw.wiphy->frag_threshold); /* set up the tx rate control struct we give the RC algo */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 047/164] mac80211: fix handling of 4-address-mode in ieee80211_change_iface 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (45 preceding siblings ...) 2010-07-01 17:33 ` [patch 046/164] mac80211: fix rts threshold check Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 048/164] drm/i915: Fix 82854 PCI ID, and treat it like other 85X Greg KH ` (116 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Felix Fietkau, John W. Linville 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Felix Fietkau <nbd@openwrt.org> commit f7917af92024d43bc20bc1afc92de27b0bd0f50b upstream. A misplaced interface type check bails out too early if the interface is not in monitor mode. This patch moves it to the right place, so that it only covers changes to the monitor flags. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/mac80211/cfg.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -98,9 +98,6 @@ static int ieee80211_change_iface(struct params->mesh_id_len, params->mesh_id); - if (sdata->vif.type != NL80211_IFTYPE_MONITOR || !flags) - return 0; - if (type == NL80211_IFTYPE_AP_VLAN && params && params->use_4addr == 0) rcu_assign_pointer(sdata->u.vlan.sta, NULL); @@ -108,7 +105,9 @@ static int ieee80211_change_iface(struct params && params->use_4addr >= 0) sdata->u.mgd.use_4addr = params->use_4addr; - sdata->u.mntr_flags = *flags; + if (sdata->vif.type == NL80211_IFTYPE_MONITOR && flags) + sdata->u.mntr_flags = *flags; + return 0; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 048/164] drm/i915: Fix 82854 PCI ID, and treat it like other 85X 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (46 preceding siblings ...) 2010-07-01 17:33 ` [patch 047/164] mac80211: fix handling of 4-address-mode in ieee80211_change_iface Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 049/164] drm/i915: Reject bind_to_gtt() early if object > aperture Greg KH ` (115 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Adam Jackson, Eric Anholt 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Adam Jackson <ajax@redhat.com> commit 5ce8ba7c9279a63f99e1f131602580472b8af968 upstream. pci.ids and the datasheet both say it's 358e, not 35e8. Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/i915/i915_drv.c | 5 +++-- drivers/gpu/drm/i915/i915_drv.h | 3 ++- 2 files changed, 5 insertions(+), 3 deletions(-) --- a/drivers/gpu/drm/i915/i915_drv.c +++ b/drivers/gpu/drm/i915/i915_drv.c @@ -68,7 +68,8 @@ const static struct intel_device_info in }; const static struct intel_device_info intel_i85x_info = { - .is_i8xx = 1, .is_mobile = 1, .cursor_needs_physical = 1, + .is_i8xx = 1, .is_i85x = 1, .is_mobile = 1, + .cursor_needs_physical = 1, }; const static struct intel_device_info intel_i865g_info = { @@ -140,7 +141,7 @@ const static struct pci_device_id pciidl INTEL_VGA_DEVICE(0x3577, &intel_i830_info), INTEL_VGA_DEVICE(0x2562, &intel_845g_info), INTEL_VGA_DEVICE(0x3582, &intel_i85x_info), - INTEL_VGA_DEVICE(0x35e8, &intel_i85x_info), + INTEL_VGA_DEVICE(0x358e, &intel_i85x_info), INTEL_VGA_DEVICE(0x2572, &intel_i865g_info), INTEL_VGA_DEVICE(0x2582, &intel_i915g_info), INTEL_VGA_DEVICE(0x258a, &intel_i915g_info), --- a/drivers/gpu/drm/i915/i915_drv.h +++ b/drivers/gpu/drm/i915/i915_drv.h @@ -175,6 +175,7 @@ struct intel_overlay; struct intel_device_info { u8 is_mobile : 1; u8 is_i8xx : 1; + u8 is_i85x : 1; u8 is_i915g : 1; u8 is_i9xx : 1; u8 is_i945gm : 1; @@ -1027,7 +1028,7 @@ extern int i915_wait_ring(struct drm_dev #define IS_I830(dev) ((dev)->pci_device == 0x3577) #define IS_845G(dev) ((dev)->pci_device == 0x2562) -#define IS_I85X(dev) ((dev)->pci_device == 0x3582) +#define IS_I85X(dev) (INTEL_INFO(dev)->is_i85x) #define IS_I865G(dev) ((dev)->pci_device == 0x2572) #define IS_GEN2(dev) (INTEL_INFO(dev)->is_i8xx) #define IS_I915G(dev) (INTEL_INFO(dev)->is_i915g) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 049/164] drm/i915: Reject bind_to_gtt() early if object > aperture 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (47 preceding siblings ...) 2010-07-01 17:33 ` [patch 048/164] drm/i915: Fix 82854 PCI ID, and treat it like other 85X Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 050/164] drivers/base/cpu.c: fix the output from /sys/devices/system/cpu/offline Greg KH ` (114 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Chris Wilson, Eric Anholt 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chris Wilson <chris@chris-wilson.co.uk> commit 654fc6073f68efa3b6c466825749e73e7fbb92cd upstream. If the object is bigger than the entire aperture, reject it early before evicting everything in a vain attempt to find space. v2: Use E2BIG as suggested by Owain G. Ainsworth. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/i915/i915_gem.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -2641,6 +2641,14 @@ i915_gem_object_bind_to_gtt(struct drm_g return -EINVAL; } + /* If the object is bigger than the entire aperture, reject it early + * before evicting everything in a vain attempt to find space. + */ + if (obj->size > dev->gtt_total) { + DRM_ERROR("Attempting to bind an object larger than the aperture\n"); + return -E2BIG; + } + search_free: free_space = drm_mm_search_free(&dev_priv->mm.gtt_space, obj->size, alignment, 0); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 050/164] drivers/base/cpu.c: fix the output from /sys/devices/system/cpu/offline 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (48 preceding siblings ...) 2010-07-01 17:33 ` [patch 049/164] drm/i915: Reject bind_to_gtt() early if object > aperture Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 051/164] can: Fix SJA1000 command register writes on SMP systems Greg KH ` (113 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jan Beulich, Andi Kleen, Stephen Rothwell 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jan Beulich <JBeulich@novell.com> commit cdc6e3d3968052cebb2f2ddcd742bff29fbd1a90 upstream. Without CONFIG_CPUMASK_OFFSTACK, simply inverting cpu_online_mask leads to CPUs beyond nr_cpu_ids to be displayed twice and CPUs not even possible to be displayed as offline. Signed-off-by: Jan Beulich <jbeulich@novell.com> Cc: Andi Kleen <ak@linux.intel.com> Cc: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/base/cpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/base/cpu.c +++ b/drivers/base/cpu.c @@ -183,7 +183,7 @@ static ssize_t print_cpus_offline(struct /* display offline cpus < nr_cpu_ids */ if (!alloc_cpumask_var(&offline, GFP_KERNEL)) return -ENOMEM; - cpumask_complement(offline, cpu_online_mask); + cpumask_andnot(offline, cpu_possible_mask, cpu_online_mask); n = cpulist_scnprintf(buf, len, offline); free_cpumask_var(offline); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 051/164] can: Fix SJA1000 command register writes on SMP systems 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (49 preceding siblings ...) 2010-07-01 17:33 ` [patch 050/164] drivers/base/cpu.c: fix the output from /sys/devices/system/cpu/offline Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 052/164] PCI quirk: Disable MSI on VIA K8T890 systems Greg KH ` (112 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Oliver Hartkopp, Wolfgang Grandegger, David S. Miller 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Oliver Hartkopp <socketcan@hartkopp.net> commit 57c8a456640fa3ca777652f11f2db4179a3e66b6 upstream. The SJA1000 command register is concurrently written in the rx-path to free the receive buffer _and_ in the tx-path to start the transmission. The SJA1000 data sheet, 6.4.4 COMMAND REGISTER (CMR) states: "Between two commands at least one internal clock cycle is needed in order to proceed. The internal clock is half of the external oscillator frequency." On SMP systems the current implementation leads to a write stall in the tx-path, which can be solved by adding some general locking and some time to settle the write_reg() operation for the command register. Thanks to Klaus Hitschler for the original fix and detailed problem description. This patch applies on net-2.6 and (with some offsets) on net-next-2.6 . Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Acked-by: Wolfgang Grandegger <wg@grandegger.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/can/sja1000/sja1000.c | 20 +++++++++++++++++--- drivers/net/can/sja1000/sja1000.h | 1 + 2 files changed, 18 insertions(+), 3 deletions(-) --- a/drivers/net/can/sja1000/sja1000.c +++ b/drivers/net/can/sja1000/sja1000.c @@ -84,6 +84,20 @@ static struct can_bittiming_const sja100 .brp_inc = 1, }; +static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val) +{ + unsigned long flags; + + /* + * The command register needs some locking and time to settle + * the write_reg() operation - especially on SMP systems. + */ + spin_lock_irqsave(&priv->cmdreg_lock, flags); + priv->write_reg(priv, REG_CMR, val); + priv->read_reg(priv, REG_SR); + spin_unlock_irqrestore(&priv->cmdreg_lock, flags); +} + static int sja1000_probe_chip(struct net_device *dev) { struct sja1000_priv *priv = netdev_priv(dev); @@ -279,7 +293,7 @@ static netdev_tx_t sja1000_start_xmit(st can_put_echo_skb(skb, dev, 0); - priv->write_reg(priv, REG_CMR, CMD_TR); + sja1000_write_cmdreg(priv, CMD_TR); return NETDEV_TX_OK; } @@ -328,7 +342,7 @@ static void sja1000_rx(struct net_device cf->can_id = id; /* release receive buffer */ - priv->write_reg(priv, REG_CMR, CMD_RRB); + sja1000_write_cmdreg(priv, CMD_RRB); netif_rx(skb); @@ -356,7 +370,7 @@ static int sja1000_err(struct net_device cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW; stats->rx_over_errors++; stats->rx_errors++; - priv->write_reg(priv, REG_CMR, CMD_CDO); /* clear bit */ + sja1000_write_cmdreg(priv, CMD_CDO); /* clear bit */ } if (isrc & IRQ_EI) { --- a/drivers/net/can/sja1000/sja1000.h +++ b/drivers/net/can/sja1000/sja1000.h @@ -167,6 +167,7 @@ struct sja1000_priv { void __iomem *reg_base; /* ioremap'ed address to registers */ unsigned long irq_flags; /* for request_irq() */ + spinlock_t cmdreg_lock; /* lock for concurrent cmd register writes */ u16 flags; /* custom mode flags */ u8 ocr; /* output control register */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 052/164] PCI quirk: Disable MSI on VIA K8T890 systems 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (50 preceding siblings ...) 2010-07-01 17:33 ` [patch 051/164] can: Fix SJA1000 command register writes on SMP systems Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:33 ` [patch 053/164] PCI quirks: disable msi on AMD rs4xx internal gfx bridges Greg KH ` (111 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Matthew Wilcox, Jesse Barnes 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Matthew Wilcox <matthew@wil.cx> commit 134b345081534235dbf228b1005c14590e0570ba upstream. Bugzilla 15287 indicates that there's a problem with Message Signalled Interrupts on VIA K8T890 systems. Add a quirk to disable MSI on these systems. Signed-off-by: Matthew Wilcox <willy@linux.intel.com> Tested-by: Jan Kreuzer <kontrollator@gmx.de> Tested-by: lh <jarryson@gmail.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -2113,6 +2113,7 @@ static void __devinit quirk_disable_msi( } } DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi); +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi); /* Go through the list of Hypertransport capabilities and * return 1 if a HT MSI capability is found and enabled */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 053/164] PCI quirks: disable msi on AMD rs4xx internal gfx bridges 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (51 preceding siblings ...) 2010-07-01 17:33 ` [patch 052/164] PCI quirk: Disable MSI on VIA K8T890 systems Greg KH @ 2010-07-01 17:33 ` Greg KH 2010-07-01 17:34 ` [patch 054/164] PCI: Disable MSI for MCP55 on P5N32-E SLI Greg KH ` (110 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:33 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Alex Deucher, Jesse Barnes 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alex Deucher <alexdeucher@gmail.com> commit 9313ff450400e6a2ab10fe6b9bdb12a828329410 upstream. Doesn't work reliably for internal gfx. Fixes kernel bug https://bugzilla.kernel.org/show_bug.cgi?id=15626. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -2114,6 +2114,7 @@ static void __devinit quirk_disable_msi( } DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi); DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi); +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi); /* Go through the list of Hypertransport capabilities and * return 1 if a HT MSI capability is found and enabled */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 054/164] PCI: Disable MSI for MCP55 on P5N32-E SLI 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (52 preceding siblings ...) 2010-07-01 17:33 ` [patch 053/164] PCI quirks: disable msi on AMD rs4xx internal gfx bridges Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 055/164] drm/edid: Fix 1024x768@85Hz Greg KH ` (109 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ben Hutchings, Jesse Barnes 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ben Hutchings <ben@decadent.org.uk> commit e4146bb9088c01c8b6e82be11f0c371f8aff023c upstream. As reported in <http://bugs.debian.org/552299>, MSI appears to be broken for this on-board device. We already have a quirk for the P5N32-SLI Premium; extend it to cover both variants of the board. Reported-by: Romain DEGEZ <romain.degez@smartjog.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/pci/quirks.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -2206,15 +2206,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8132_BRIDGE, ht_enable_msi_mapping); -/* The P5N32-SLI Premium motherboard from Asus has a problem with msi +/* The P5N32-SLI motherboards from Asus have a problem with msi * for the MCP55 NIC. It is not yet determined whether the msi problem * also affects other devices. As for now, turn off msi for this device. */ static void __devinit nvenet_msi_disable(struct pci_dev *dev) { - if (dmi_name_in_vendors("P5N32-SLI PREMIUM")) { + if (dmi_name_in_vendors("P5N32-SLI PREMIUM") || + dmi_name_in_vendors("P5N32-E SLI")) { dev_info(&dev->dev, - "Disabling msi for MCP55 NIC on P5N32-SLI Premium\n"); + "Disabling msi for MCP55 NIC on P5N32-SLI\n"); dev->no_msi = 1; } } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 055/164] drm/edid: Fix 1024x768@85Hz 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (53 preceding siblings ...) 2010-07-01 17:34 ` [patch 054/164] PCI: Disable MSI for MCP55 on P5N32-E SLI Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 056/164] drm/radeon/kms: reset ddc_bus in object header parsing Greg KH ` (108 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Adam Jackson, Dave Airlie 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Adam Jackson <ajax@redhat.com> commit 61dd98fad58f945ed720ba132681acb58fcee015 upstream. Having hsync both start and end on pixel 1072 ain't gonna work very well. Matches the X server's list. Signed-off-by: Adam Jackson <ajax@redhat.com> Tested-By: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/drm_edid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -334,7 +334,7 @@ static struct drm_display_mode drm_dmt_m DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) }, /* 1024x768@85Hz */ { DRM_MODE("1024x768", DRM_MODE_TYPE_DRIVER, 94500, 1024, 1072, - 1072, 1376, 0, 768, 769, 772, 808, 0, + 1168, 1376, 0, 768, 769, 772, 808, 0, DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) }, /* 1152x864@75Hz */ { DRM_MODE("1152x864", DRM_MODE_TYPE_DRIVER, 108000, 1152, 1216, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 056/164] drm/radeon/kms: reset ddc_bus in object header parsing 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (54 preceding siblings ...) 2010-07-01 17:34 ` [patch 055/164] drm/edid: Fix 1024x768@85Hz Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 057/164] drm/radeon/kms/atom: fix typo in LVDS panel info parsing Greg KH ` (107 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Alex Deucher, Dave Airlie 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alex Deucher <alexdeucher@gmail.com> commit 2bfcc0fc698d550689ef020c73b2d977b73e728c upstream. Some LVDS connectors don't have a ddc bus, so reset the ddc bus to invalid before parsing the next connector to avoid using stale ddc bus data. Should fix fdo bug 28164. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/radeon/radeon_atombios.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/drivers/gpu/drm/radeon/radeon_atombios.c +++ b/drivers/gpu/drm/radeon/radeon_atombios.c @@ -514,6 +514,8 @@ bool radeon_get_atom_connector_info_from } /* look up gpio for ddc, hpd */ + ddc_bus.valid = false; + hpd.hpd = RADEON_HPD_NONE; if ((le16_to_cpu(path->usDeviceTag) & (ATOM_DEVICE_TV_SUPPORT | ATOM_DEVICE_CV_SUPPORT)) == 0) { for (j = 0; j < con_obj->ucNumberOfObjects; j++) { @@ -569,9 +571,6 @@ bool radeon_get_atom_connector_info_from break; } } - } else { - hpd.hpd = RADEON_HPD_NONE; - ddc_bus.valid = false; } conn_id = le16_to_cpu(path->usConnObjectId); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 057/164] drm/radeon/kms/atom: fix typo in LVDS panel info parsing 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (55 preceding siblings ...) 2010-07-01 17:34 ` [patch 056/164] drm/radeon/kms: reset ddc_bus in object header parsing Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 058/164] powerpc: Fix handling of strncmp with zero len Greg KH ` (106 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Alex Deucher, Dave Airlie 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alex Deucher <alexdeucher@gmail.com> commit 1ff26a3604d0292988d4cade0e49ba9918dbfd46 upstream. Fixes LVDS issues on some laptops; notably laptops with 2048x1536 panels. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/radeon/radeon_atombios.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/radeon/radeon_atombios.c +++ b/drivers/gpu/drm/radeon/radeon_atombios.c @@ -1136,7 +1136,7 @@ struct radeon_encoder_atom_dig *radeon_a lvds->native_mode.vtotal = lvds->native_mode.vdisplay + le16_to_cpu(lvds_info->info.sLCDTiming.usVBlanking_Time); lvds->native_mode.vsync_start = lvds->native_mode.vdisplay + - le16_to_cpu(lvds_info->info.sLCDTiming.usVSyncWidth); + le16_to_cpu(lvds_info->info.sLCDTiming.usVSyncOffset); lvds->native_mode.vsync_end = lvds->native_mode.vsync_start + le16_to_cpu(lvds_info->info.sLCDTiming.usVSyncWidth); lvds->panel_pwr_delay = ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 058/164] powerpc: Fix handling of strncmp with zero len 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (56 preceding siblings ...) 2010-07-01 17:34 ` [patch 057/164] drm/radeon/kms/atom: fix typo in LVDS panel info parsing Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 059/164] powerpc/pseries: Only call start-cpu when a CPU is stopped Greg KH ` (105 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jeff Mahoney, Benjamin Herrenschmidt 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jeff Mahoney <jeffm@suse.com> commit 637a99022fb119b90fb281715d13172f0394fc12 upstream. Commit 0119536c, which added the assembly version of strncmp to powerpc, mentions that it adds two instructions to the version from boot/string.S to allow it to handle len=0. Unfortunately, it doesn't always return 0 when that is the case. The length is passed in r5, but the return value is passed back in r3. In certain cases, this will happen to work. Otherwise it will pass back the address of the first string as the return value. This patch lifts the len <= 0 handling code from memcpy to handle that case. Reported by: Christian_Sellars@symantec.com Signed-off-by: Jeff Mahoney <jeffm@suse.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/lib/string.S | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/arch/powerpc/lib/string.S +++ b/arch/powerpc/lib/string.S @@ -71,7 +71,7 @@ _GLOBAL(strcmp) _GLOBAL(strncmp) PPC_LCMPI r5,0 - beqlr + ble- 2f mtctr r5 addi r5,r3,-1 addi r4,r4,-1 @@ -82,6 +82,8 @@ _GLOBAL(strncmp) beqlr 1 bdnzt eq,1b blr +2: li r3,0 + blr _GLOBAL(strlen) addi r4,r3,-1 ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 059/164] powerpc/pseries: Only call start-cpu when a CPU is stopped 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (57 preceding siblings ...) 2010-07-01 17:34 ` [patch 058/164] powerpc: Fix handling of strncmp with zero len Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 060/164] powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu Greg KH ` (104 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Michael Neuling, Benjamin Herrenschmidt 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michael Neuling <mikey@neuling.org> commit aef40e87d866355ffd279ab21021de733242d0d5 upstream. Currently we always call start-cpu irrespective of if the CPU is stopped or not. Unfortunatley on POWER7, firmware seems to not like start-cpu being called when a cpu already been started. This was not the case on POWER6 and earlier. This patch checks to see if the CPU is stopped or not via an query-cpu-stopped-state call, and only calls start-cpu on CPUs which are stopped. This fixes a bug with kexec on POWER7 on PHYP where only the primary thread would make it to the second kernel. Reported-by: Ankita Garg <ankita@linux.vnet.ibm.com> Signed-off-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/platforms/pseries/smp.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/arch/powerpc/platforms/pseries/smp.c +++ b/arch/powerpc/platforms/pseries/smp.c @@ -82,6 +82,12 @@ static inline int __devinit smp_startup_ pcpu = get_hard_smp_processor_id(lcpu); + /* Check to see if the CPU out of FW already for kexec */ + if (smp_query_cpu_stopped(pcpu) == QCSS_NOT_STOPPED){ + cpu_set(lcpu, of_spin_map); + return 1; + } + /* Fixup atomic count: it exited inside IRQ handler. */ task_thread_info(paca[lcpu].__current)->preempt_count = 0; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 060/164] powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (58 preceding siblings ...) 2010-07-01 17:34 ` [patch 059/164] powerpc/pseries: Only call start-cpu when a CPU is stopped Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 061/164] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c Greg KH ` (103 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Michael Neuling, Benjamin Herrenschmidt 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michael Neuling <mikey@neuling.org> commit f8b67691828321f5c85bb853283aa101ae673130 upstream. This moves query_cpu_stopped() out of the hotplug cpu code and into smp.c so it can called in other places and renames it to smp_query_cpu_stopped(). It also cleans up the return values by adding some #defines Signed-off-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/platforms/pseries/hotplug-cpu.c | 30 +++--------------------- arch/powerpc/platforms/pseries/plpar_wrappers.h | 8 ++++++ arch/powerpc/platforms/pseries/smp.c | 22 +++++++++++++++++ 3 files changed, 34 insertions(+), 26 deletions(-) --- a/arch/powerpc/platforms/pseries/hotplug-cpu.c +++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c @@ -154,30 +154,6 @@ static void pseries_mach_cpu_die(void) for(;;); } -static int qcss_tok; /* query-cpu-stopped-state token */ - -/* Get state of physical CPU. - * Return codes: - * 0 - The processor is in the RTAS stopped state - * 1 - stop-self is in progress - * 2 - The processor is not in the RTAS stopped state - * -1 - Hardware Error - * -2 - Hardware Busy, Try again later. - */ -static int query_cpu_stopped(unsigned int pcpu) -{ - int cpu_status, status; - - status = rtas_call(qcss_tok, 1, 2, &cpu_status, pcpu); - if (status != 0) { - printk(KERN_ERR - "RTAS query-cpu-stopped-state failed: %i\n", status); - return status; - } - - return cpu_status; -} - static int pseries_cpu_disable(void) { int cpu = smp_processor_id(); @@ -224,8 +200,9 @@ static void pseries_cpu_die(unsigned int } else if (get_preferred_offline_state(cpu) == CPU_STATE_OFFLINE) { for (tries = 0; tries < 25; tries++) { - cpu_status = query_cpu_stopped(pcpu); - if (cpu_status == 0 || cpu_status == -1) + cpu_status = smp_query_cpu_stopped(pcpu); + if (cpu_status == QCSS_STOPPED || + cpu_status == QCSS_HARDWARE_ERROR) break; cpu_relax(); } @@ -400,6 +377,7 @@ static int __init pseries_cpu_hotplug_in struct device_node *np; const char *typep; int cpu; + int qcss_tok; for_each_node_by_name(np, "interrupt-controller") { typep = of_get_property(np, "compatible", NULL); --- a/arch/powerpc/platforms/pseries/plpar_wrappers.h +++ b/arch/powerpc/platforms/pseries/plpar_wrappers.h @@ -4,6 +4,14 @@ #include <asm/hvcall.h> #include <asm/page.h> +/* Get state of physical CPU from query_cpu_stopped */ +int smp_query_cpu_stopped(unsigned int pcpu); +#define QCSS_STOPPED 0 +#define QCSS_STOPPING 1 +#define QCSS_NOT_STOPPED 2 +#define QCSS_HARDWARE_ERROR -1 +#define QCSS_HARDWARE_BUSY -2 + static inline long poll_pending(void) { return plpar_hcall_norets(H_POLL_PENDING); --- a/arch/powerpc/platforms/pseries/smp.c +++ b/arch/powerpc/platforms/pseries/smp.c @@ -57,6 +57,28 @@ */ static cpumask_t of_spin_map; +/* Query where a cpu is now. Return codes #defined in plpar_wrappers.h */ +int smp_query_cpu_stopped(unsigned int pcpu) +{ + int cpu_status, status; + int qcss_tok = rtas_token("query-cpu-stopped-state"); + + if (qcss_tok == RTAS_UNKNOWN_SERVICE) { + printk(KERN_INFO "Firmware doesn't support " + "query-cpu-stopped-state\n"); + return QCSS_HARDWARE_ERROR; + } + + status = rtas_call(qcss_tok, 1, 2, &cpu_status, pcpu); + if (status != 0) { + printk(KERN_ERR + "RTAS query-cpu-stopped-state failed: %i\n", status); + return status; + } + + return cpu_status; +} + /** * smp_startup_cpu() - start the given cpu * ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 061/164] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (59 preceding siblings ...) 2010-07-01 17:34 ` [patch 060/164] powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 062/164] writeback: disable periodic old data writeback for !dirty_writeback_centisecs Greg KH ` (102 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Denis Kirjanov, Robert Richter 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Denis Kirjanov <dkirjanov@hera.kernel.org> commit 238c1a78c957f3dc7cb848b161dcf4805793ed56 upstream. Fix potential initial_lfsr buffer overrun. Writing past the end of the buffer could happen when index == ENTRIES Signed-off-by: Denis Kirjanov <dkirjanov@kernel.org> Signed-off-by: Robert Richter <robert.richter@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/oprofile/op_model_cell.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/powerpc/oprofile/op_model_cell.c +++ b/arch/powerpc/oprofile/op_model_cell.c @@ -1077,7 +1077,7 @@ static int calculate_lfsr(int n) index = ENTRIES-1; /* make sure index is valid */ - if ((index > ENTRIES) || (index < 0)) + if ((index >= ENTRIES) || (index < 0)) index = ENTRIES-1; return initial_lfsr[index]; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 062/164] writeback: disable periodic old data writeback for !dirty_writeback_centisecs 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (60 preceding siblings ...) 2010-07-01 17:34 ` [patch 061/164] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 063/164] md/raid1: fix counting of write targets Greg KH ` (101 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Jens Axboe 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jens Axboe <jens.axboe@oracle.com> commit 69b62d01ec44fe0d505d89917392347732135a4d upstream. Prior to 2.6.32, setting /proc/sys/vm/dirty_writeback_centisecs disabled periodic dirty writeback from kupdate. This got broken and now causes excessive sys CPU usage if set to zero, as we'll keep beating on schedule(). Reported-by: Justin Maggard <jmaggard10@gmail.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/fs-writeback.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) --- a/fs/fs-writeback.c +++ b/fs/fs-writeback.c @@ -834,6 +834,12 @@ static long wb_check_old_data_flush(stru unsigned long expired; long nr_pages; + /* + * When set to zero, disable periodic writeback + */ + if (!dirty_writeback_interval) + return 0; + expired = wb->last_old_flush + msecs_to_jiffies(dirty_writeback_interval * 10); if (time_before(jiffies, expired)) @@ -929,8 +935,12 @@ int bdi_writeback_task(struct bdi_writeb break; } - wait_jiffies = msecs_to_jiffies(dirty_writeback_interval * 10); - schedule_timeout_interruptible(wait_jiffies); + if (dirty_writeback_interval) { + wait_jiffies = msecs_to_jiffies(dirty_writeback_interval * 10); + schedule_timeout_interruptible(wait_jiffies); + } else + schedule(); + try_to_freeze(); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 063/164] md/raid1: fix counting of write targets. 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (61 preceding siblings ...) 2010-07-01 17:34 ` [patch 062/164] writeback: disable periodic old data writeback for !dirty_writeback_centisecs Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 064/164] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB Greg KH ` (100 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: NeilBrown <neilb@suse.de> commit 964147d5c86d63be79b442c30f3783d49860c078 upstream. There is a very small race window when writing to a RAID1 such that if a device is marked faulty at exactly the wrong time, the write-in-progress will not be sent to the device, but the bitmap (if present) will be updated to say that the write was sent. Then if the device turned out to still be usable as was re-added to the array, the bitmap-based-resync would skip resyncing that block, possibly leading to corruption. This would only be a problem if no further writes were issued to that area of the device (i.e. that bitmap chunk). Suitable for any pending -stable kernel. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/raid1.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -911,9 +911,10 @@ static int make_request(struct request_q if (test_bit(Faulty, &rdev->flags)) { rdev_dec_pending(rdev, mddev); r1_bio->bios[i] = NULL; - } else + } else { r1_bio->bios[i] = bio; - targets++; + targets++; + } } else r1_bio->bios[i] = NULL; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 064/164] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (62 preceding siblings ...) 2010-07-01 17:34 ` [patch 063/164] md/raid1: fix counting of write targets Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 065/164] md/linear: avoid possible oops and array stop Greg KH ` (99 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: NeilBrown <neilb@suse.de> commit af3a2cd6b8a479345786e7fe5e199ad2f6240e56 upstream. read_balance uses a "unsigned long" for a sector number which will get truncated beyond 2TB. This will cause read-balancing to be non-optimal, and can cause data to be read from the 'wrong' branch during a resync. This has a very small chance of returning wrong data. Reported-by: Jordan Russell <jr-list-2010@quo.to> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/raid1.c | 4 ++-- drivers/md/raid10.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -417,7 +417,7 @@ static void raid1_end_write_request(stru */ static int read_balance(conf_t *conf, r1bio_t *r1_bio) { - const unsigned long this_sector = r1_bio->sector; + const sector_t this_sector = r1_bio->sector; int new_disk = conf->last_used, disk = new_disk; int wonly_disk = -1; const int sectors = r1_bio->sectors; @@ -433,7 +433,7 @@ static int read_balance(conf_t *conf, r1 retry: if (conf->mddev->recovery_cp < MaxSector && (this_sector + sectors >= conf->next_resync)) { - /* Choose the first operation device, for consistancy */ + /* Choose the first operational device, for consistancy */ new_disk = 0; for (rdev = rcu_dereference(conf->mirrors[new_disk].rdev); --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -493,7 +493,7 @@ static int raid10_mergeable_bvec(struct */ static int read_balance(conf_t *conf, r10bio_t *r10_bio) { - const unsigned long this_sector = r10_bio->sector; + const sector_t this_sector = r10_bio->sector; int disk, slot, nslot; const int sectors = r10_bio->sectors; sector_t new_distance, current_distance; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 065/164] md/linear: avoid possible oops and array stop 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (63 preceding siblings ...) 2010-07-01 17:34 ` [patch 064/164] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 066/164] md: remove unneeded sysfs files more promptly Greg KH ` (98 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: NeilBrown <neilb@suse.de> commit ef2f80ff7325b2c1888ff02ead28957b5840bf51 upstream. Since commit ef286f6fa673cd7fb367e1b145069d8dbfcc6081 it has been important that each personality clears ->private in the ->stop() function, or sets it to a attribute group to be removed. linear.c doesn't. This can sometimes lead to an oops, though it doesn't always. Suitable for 2.6.33-stable and 2.6.34. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/linear.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/md/linear.c +++ b/drivers/md/linear.c @@ -281,6 +281,7 @@ static int linear_stop (mddev_t *mddev) rcu_barrier(); blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/ kfree(conf); + mddev->private = NULL; return 0; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 066/164] md: remove unneeded sysfs files more promptly 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (64 preceding siblings ...) 2010-07-01 17:34 ` [patch 065/164] md/linear: avoid possible oops and array stop Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 067/164] md: set mddev readonly flag on blkdev BLKROSET ioctl Greg KH ` (97 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: NeilBrown <neilb@suse.de> commit b6eb127d274385d81ce8dd45c98190f097bce1b4 upstream. When an array is stopped we need to remove some sysfs files which are dependent on the type of array. We need to delay that deletion as deleting them while holding reconfig_mutex can lead to deadlocks. We currently delay them until the array is completely destroyed. However it is possible to deactivate and then reactivate the array. It is also possible to need to remove sysfs files when changing level, which can potentially happen several times before an array is destroyed. So we need to delete these files more promptly: as soon as reconfig_mutex is dropped. We need to ensure this happens before do_md_run can restart the array, so we use open_mutex for some extra locking. This is not deadlock prone. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/md.c | 41 +++++++++++++++++++++++++++++++---------- 1 file changed, 31 insertions(+), 10 deletions(-) --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -507,9 +507,32 @@ static inline int mddev_trylock(mddev_t return mutex_trylock(&mddev->reconfig_mutex); } +static struct attribute_group md_redundancy_group; + static inline void mddev_unlock(mddev_t * mddev) { - mutex_unlock(&mddev->reconfig_mutex); + if (mddev->pers == NULL && mddev->private) { + /* These cannot be removed under reconfig_mutex as + * an access to the files will try to take reconfig_mutex + * while holding the file unremovable, which leads to + * a deadlock. + * So hold open_mutex instead - we are allowed to take + * it while holding reconfig_mutex, and md_run can + * use it to wait for the remove to complete. + */ + mutex_lock(&mddev->open_mutex); + mutex_unlock(&mddev->reconfig_mutex); + + sysfs_remove_group(&mddev->kobj, &md_redundancy_group); + if (mddev->private != (void*)1) + sysfs_remove_group(&mddev->kobj, mddev->private); + if (mddev->sysfs_action) + sysfs_put(mddev->sysfs_action); + mddev->sysfs_action = NULL; + mddev->private = NULL; + mutex_unlock(&mddev->open_mutex); + } else + mutex_unlock(&mddev->reconfig_mutex); md_wakeup_thread(mddev->thread); } @@ -4081,15 +4104,6 @@ static void mddev_delayed_delete(struct { mddev_t *mddev = container_of(ws, mddev_t, del_work); - if (mddev->private) { - sysfs_remove_group(&mddev->kobj, &md_redundancy_group); - if (mddev->private != (void*)1) - sysfs_remove_group(&mddev->kobj, mddev->private); - if (mddev->sysfs_action) - sysfs_put(mddev->sysfs_action); - mddev->sysfs_action = NULL; - mddev->private = NULL; - } sysfs_remove_group(&mddev->kobj, &md_bitmap_group); kobject_del(&mddev->kobj); kobject_put(&mddev->kobj); @@ -4247,6 +4261,13 @@ static int do_md_run(mddev_t * mddev) if (mddev->pers) return -EBUSY; + /* These two calls synchronise us with the + * sysfs_remove_group calls in mddev_unlock, + * so they must have completed. + */ + mutex_lock(&mddev->open_mutex); + mutex_unlock(&mddev->open_mutex); + /* * Analyze all RAID superblock(s) */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 067/164] md: set mddev readonly flag on blkdev BLKROSET ioctl 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (65 preceding siblings ...) 2010-07-01 17:34 ` [patch 066/164] md: remove unneeded sysfs files more promptly Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 068/164] x86/amd-iommu: Fix crash when request_mem_region fails Greg KH ` (96 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dan Williams, NeilBrown 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Williams <dan.j.williams@intel.com> commit e2218350465e7e0931676b4849b594c978437bce upstream. When the user sets the block device to readwrite then the mddev should follow suit. Otherwise, the BUG_ON in md_write_start() will be set to trigger. The reverse direction, setting mddev->ro to match a set readonly request, can be ignored because the blkdev level readonly flag precludes the need to have mddev->ro set correctly. Nevermind the fact that setting mddev->ro to 1 may fail if the array is in use. Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/md.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -5516,6 +5516,7 @@ static int md_ioctl(struct block_device int err = 0; void __user *argp = (void __user *)arg; mddev_t *mddev = NULL; + int ro; if (!capable(CAP_SYS_ADMIN)) return -EACCES; @@ -5651,6 +5652,34 @@ static int md_ioctl(struct block_device err = do_md_stop(mddev, 1, 1); goto done_unlock; + case BLKROSET: + if (get_user(ro, (int __user *)(arg))) { + err = -EFAULT; + goto done_unlock; + } + err = -EINVAL; + + /* if the bdev is going readonly the value of mddev->ro + * does not matter, no writes are coming + */ + if (ro) + goto done_unlock; + + /* are we are already prepared for writes? */ + if (mddev->ro != 1) + goto done_unlock; + + /* transitioning to readauto need only happen for + * arrays that call md_write_start + */ + if (mddev->pers) { + err = restart_array(mddev); + if (err == 0) { + mddev->ro = 2; + set_disk_ro(mddev->gendisk, 0); + } + } + goto done_unlock; } /* ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 068/164] x86/amd-iommu: Fix crash when request_mem_region fails 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (66 preceding siblings ...) 2010-07-01 17:34 ` [patch 067/164] md: set mddev readonly flag on blkdev BLKROSET ioctl Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 069/164] x86/amd-iommu: Fall back to GART if initialization fails Greg KH ` (95 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Joerg Roedel 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> commit e82752d8b5a7e0a5e4d607fd8713549e2a4e2741 upstream. When request_mem_region fails the error path tries to disable the IOMMUs. This accesses the mmio-region which was not allocated leading to a kernel crash. This patch fixes the issue. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/kernel/amd_iommu_init.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) --- a/arch/x86/kernel/amd_iommu_init.c +++ b/arch/x86/kernel/amd_iommu_init.c @@ -286,8 +286,12 @@ static u8 * __init iommu_map_mmio_space( { u8 *ret; - if (!request_mem_region(address, MMIO_REGION_LENGTH, "amd_iommu")) + if (!request_mem_region(address, MMIO_REGION_LENGTH, "amd_iommu")) { + pr_err("AMD-Vi: Can not reserve memory region %llx for mmio\n", + address); + pr_err("AMD-Vi: This is a BIOS bug. Please contact your hardware vendor\n"); return NULL; + } ret = ioremap_nocache(address, MMIO_REGION_LENGTH); if (ret != NULL) @@ -1296,7 +1300,7 @@ static int __init amd_iommu_init(void) ret = amd_iommu_init_dma_ops(); if (ret) - goto free; + goto free_disable; amd_iommu_init_api(); @@ -1314,9 +1318,10 @@ static int __init amd_iommu_init(void) out: return ret; -free: +free_disable: disable_iommus(); +free: amd_iommu_uninit_devices(); free_pages((unsigned long)amd_iommu_pd_alloc_bitmap, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 069/164] x86/amd-iommu: Fall back to GART if initialization fails 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (67 preceding siblings ...) 2010-07-01 17:34 ` [patch 068/164] x86/amd-iommu: Fix crash when request_mem_region fails Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 070/164] exofs: confusion between kmap() and kmap_atomic() api Greg KH ` (94 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Joerg Roedel 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> commit d7f0776975334070a93370ae048fda0c31a91c38 upstream. This patch implements a fallback to the GART IOMMU if this is possible and the AMD IOMMU initialization failed. Otherwise the fallback would be nommu which is very problematic on machines with more than 4GB of memory or swiotlb which hurts io-performance. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/kernel/amd_iommu.c | 4 ---- arch/x86/kernel/amd_iommu_init.c | 9 +++++++++ 2 files changed, 9 insertions(+), 4 deletions(-) --- a/arch/x86/kernel/amd_iommu.c +++ b/arch/x86/kernel/amd_iommu.c @@ -2256,10 +2256,6 @@ int __init amd_iommu_init_dma_ops(void) iommu_detected = 1; swiotlb = 0; -#ifdef CONFIG_GART_IOMMU - gart_iommu_aperture_disabled = 1; - gart_iommu_aperture = 0; -#endif /* Make the driver finally visible to the drivers */ dma_ops = &amd_iommu_dma_ops; --- a/arch/x86/kernel/amd_iommu_init.c +++ b/arch/x86/kernel/amd_iommu_init.c @@ -1340,6 +1340,15 @@ free: free_unity_maps(); +#ifdef CONFIG_GART_IOMMU + /* + * We failed to initialize the AMD IOMMU - try fallback to GART + * if possible. + */ + gart_iommu_init(); + +#endif + goto out; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 070/164] exofs: confusion between kmap() and kmap_atomic() api 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (68 preceding siblings ...) 2010-07-01 17:34 ` [patch 069/164] x86/amd-iommu: Fall back to GART if initialization fails Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 071/164] mn10300: set ARCH_KMALLOC_MINALIGN Greg KH ` (93 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dan Carpenter, Boaz Harrosh 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Carpenter <error27@gmail.com> commit ddf08f4b90a413892bbb9bb2e8a57aed991cd47d upstream. For kmap_atomic() we call kunmap_atomic() on the returned pointer. That's different from kmap() and kunmap() and so it's easy to get them backwards. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Boaz Harrosh <bharrosh@panasas.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/exofs/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/exofs/dir.c +++ b/fs/exofs/dir.c @@ -608,7 +608,7 @@ int exofs_make_empty(struct inode *inode de->inode_no = cpu_to_le64(parent->i_ino); memcpy(de->name, PARENT_DIR, sizeof(PARENT_DIR)); exofs_set_de_type(de, inode); - kunmap_atomic(page, KM_USER0); + kunmap_atomic(kaddr, KM_USER0); err = exofs_commit_chunk(page, 0, chunk_size); fail: page_cache_release(page); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 071/164] mn10300: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (69 preceding siblings ...) 2010-07-01 17:34 ` [patch 070/164] exofs: confusion between kmap() and kmap_atomic() api Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 072/164] m68k: " Greg KH ` (92 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, David Howells, Koichi Yasutake, Pekka Enberg 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit 6cdafaae41d52e6ef9a5c5be23602ef083e4d0f9 upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Acked-by: David Howells <dhowells@redhat.com> Cc: Koichi Yasutake <yasutake.koichi@jp.panasonic.com> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/mn10300/include/asm/cache.h | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/mn10300/include/asm/cache.h +++ b/arch/mn10300/include/asm/cache.h @@ -21,6 +21,8 @@ #define L1_CACHE_DISPARITY L1_CACHE_NENTRIES * L1_CACHE_BYTES #endif +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES + /* data cache purge registers * - read from the register to unconditionally purge that cache line * - write address & 0xffffff00 to conditionally purge that cache line ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 072/164] m68k: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (70 preceding siblings ...) 2010-07-01 17:34 ` [patch 071/164] mn10300: set ARCH_KMALLOC_MINALIGN Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 073/164] rtc-cmos: do dev_set_drvdata() earlier in the initialization Greg KH ` (91 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, Geert Uytterhoeven, Roman Zippel, Pekka Enberg 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit dd6c26a66bdc629a500174ffe73b010b070b9f1b upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Cc: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Roman Zippel <zippel@linux-m68k.org> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/m68k/include/asm/cache.h | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/m68k/include/asm/cache.h +++ b/arch/m68k/include/asm/cache.h @@ -8,4 +8,6 @@ #define L1_CACHE_SHIFT 4 #define L1_CACHE_BYTES (1<< L1_CACHE_SHIFT) +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES + #endif ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 073/164] rtc-cmos: do dev_set_drvdata() earlier in the initialization 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (71 preceding siblings ...) 2010-07-01 17:34 ` [patch 072/164] m68k: " Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 074/164] rtc: s3c: initialize driver data before using it Greg KH ` (90 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dan Carpenter, Alessandro Zummo, Paul Gortmaker, Malte Schroder, Ralf Baechle, Herton Ronaldo Krzesinski 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Carpenter <error27@gmail.com> commit 6ba8bcd457d9fc793ac9435aa2e4138f571d4ec5 upstream. The bug is an oops when dev_get_drvdata() returned null in cmos_update_irq_enable(). The call tree looks like this: rtc_dev_ioctl() => rtc_update_irq_enable() => cmos_update_irq_enable() It's caused by a race condition in the module initialization. It is rtc_device_register() which makes the ioctl operations live so I moved the call to dev_set_drvdata() before the call to rtc_device_register(). Addresses https://bugzilla.kernel.org/show_bug.cgi?id=15963 Reported-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Dan Carpenter <error27@gmail.com> Tested-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: Alessandro Zummo <a.zummo@towertech.it> Cc: Paul Gortmaker <p_gortmaker@yahoo.com> Cc: Malte Schroder <maltesch@gmx.de> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Herton Ronaldo Krzesinski <herton@mandriva.com.br> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/rtc/rtc-cmos.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/rtc/rtc-cmos.c +++ b/drivers/rtc/rtc-cmos.c @@ -719,6 +719,9 @@ cmos_do_probe(struct device *dev, struct } } + cmos_rtc.dev = dev; + dev_set_drvdata(dev, &cmos_rtc); + cmos_rtc.rtc = rtc_device_register(driver_name, dev, &cmos_rtc_ops, THIS_MODULE); if (IS_ERR(cmos_rtc.rtc)) { @@ -726,8 +729,6 @@ cmos_do_probe(struct device *dev, struct goto cleanup0; } - cmos_rtc.dev = dev; - dev_set_drvdata(dev, &cmos_rtc); rename_region(ports, dev_name(&cmos_rtc.rtc->dev)); spin_lock_irq(&rtc_lock); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 074/164] rtc: s3c: initialize driver data before using it 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (72 preceding siblings ...) 2010-07-01 17:34 ` [patch 073/164] rtc-cmos: do dev_set_drvdata() earlier in the initialization Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 075/164] frv: set ARCH_KMALLOC_MINALIGN Greg KH ` (89 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Maurus Cuelenaere, Paul Gortmaker, Alessandro Zummo 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Maurus Cuelenaere <mcuelenaere@gmail.com> commit e893de59a4982791368b3ce412bc67dd601a88a0 upstream. s3c_rtc_setfreq() uses the platform driver data to derive struct rtc_device, so make sure drvdata is set _before_ s3c_rtc_setfreq() is called. Signed-off-by: Maurus Cuelenaere <mcuelenaere@gmail.com> Cc: Paul Gortmaker <p_gortmaker@yahoo.com> Cc: Alessandro Zummo <a.zummo@towertech.it> Cc: Maurus Cuelenaere <mcuelenaere@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/rtc/rtc-s3c.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/rtc/rtc-s3c.c +++ b/drivers/rtc/rtc-s3c.c @@ -456,8 +456,6 @@ static int __devinit s3c_rtc_probe(struc pr_debug("s3c2410_rtc: RTCCON=%02x\n", readb(s3c_rtc_base + S3C2410_RTCCON)); - s3c_rtc_setfreq(&pdev->dev, 1); - device_init_wakeup(&pdev->dev, 1); /* register RTC and exit */ @@ -474,6 +472,9 @@ static int __devinit s3c_rtc_probe(struc rtc->max_user_freq = 128; platform_set_drvdata(pdev, rtc); + + s3c_rtc_setfreq(&pdev->dev, 1); + return 0; err_nortc: ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 075/164] frv: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (73 preceding siblings ...) 2010-07-01 17:34 ` [patch 074/164] rtc: s3c: initialize driver data before using it Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 076/164] xtensa: " Greg KH ` (88 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, David Howells, Pekka Enberg 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit 69dcf3db03626c4f18de624e8632454ea12ff260 upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Acked-by: David Howells <dhowells@redhat.com> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/frv/include/asm/cache.h | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/frv/include/asm/cache.h +++ b/arch/frv/include/asm/cache.h @@ -17,6 +17,8 @@ #define L1_CACHE_SHIFT (CONFIG_FRV_L1_CACHE_SHIFT) #define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT) +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES + #define __cacheline_aligned __attribute__((aligned(L1_CACHE_BYTES))) #define ____cacheline_aligned __attribute__((aligned(L1_CACHE_BYTES))) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 076/164] xtensa: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (74 preceding siblings ...) 2010-07-01 17:34 ` [patch 075/164] frv: set ARCH_KMALLOC_MINALIGN Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 077/164] Blackfin: " Greg KH ` (87 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, Chris Zankel, Pekka Enberg 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit 498900fc9cd1adbad1ba6b55ed9d8f2f5d655ca3 upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Cc: Chris Zankel <chris@zankel.net> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/xtensa/include/asm/cache.h | 1 + 1 file changed, 1 insertion(+) --- a/arch/xtensa/include/asm/cache.h +++ b/arch/xtensa/include/asm/cache.h @@ -29,5 +29,6 @@ # define CACHE_WAY_SIZE ICACHE_WAY_SIZE #endif +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES #endif /* _XTENSA_CACHE_H */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 077/164] Blackfin: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (75 preceding siblings ...) 2010-07-01 17:34 ` [patch 076/164] xtensa: " Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 078/164] tmpfs: insert tmpfs cache pages to inactive list at first Greg KH ` (86 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, Pekka Enberg, Mike Frysinger 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit 76b99699a2bbf9efdb578f9a38a202af2ecb354b upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/blackfin/include/asm/cache.h | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/blackfin/include/asm/cache.h +++ b/arch/blackfin/include/asm/cache.h @@ -15,6 +15,8 @@ #define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT) #define SMP_CACHE_BYTES L1_CACHE_BYTES +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES + #ifdef CONFIG_SMP #define __cacheline_aligned #else ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 078/164] tmpfs: insert tmpfs cache pages to inactive list at first 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (76 preceding siblings ...) 2010-07-01 17:34 ` [patch 077/164] Blackfin: " Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 079/164] md: manage redundancy group in sysfs when changing level Greg KH ` (85 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, KOSAKI Motohiro, Hugh Dickins, Henrique de Moraes Holschuh 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> commit e9d6c157385e4efa61cb8293e425c9d8beba70d3 upstream. Shaohua Li reported parallel file copy on tmpfs can lead to OOM killer. This is regression of caused by commit 9ff473b9a7 ("vmscan: evict streaming IO first"). Wow, It is 2 years old patch! Currently, tmpfs file cache is inserted active list at first. This means that the insertion doesn't only increase numbers of pages in anon LRU, but it also reduces anon scanning ratio. Therefore, vmscan will get totally confused. It scans almost only file LRU even though the system has plenty unused tmpfs pages. Historically, lru_cache_add_active_anon() was used for two reasons. 1) Intend to priotize shmem page rather than regular file cache. 2) Intend to avoid reclaim priority inversion of used once pages. But we've lost both motivation because (1) Now we have separate anon and file LRU list. then, to insert active list doesn't help such priotize. (2) In past, one pte access bit will cause page activation. then to insert inactive list with pte access bit mean higher priority than to insert active list. Its priority inversion may lead to uninteded lru chun. but it was already solved by commit 645747462 (vmscan: detect mapped file pages used only once). (Thanks Hannes, you are great!) Thus, now we can use lru_cache_add_anon() instead. Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Reported-by: Shaohua Li <shaohua.li@intel.com> Reviewed-by: Wu Fengguang <fengguang.wu@intel.com> Reviewed-by: Johannes Weiner <hannes@cmpxchg.org> Reviewed-by: Rik van Riel <riel@redhat.com> Reviewed-by: Minchan Kim <minchan.kim@gmail.com> Acked-by: Hugh Dickins <hughd@google.com> Cc: Henrique de Moraes Holschuh <hmh@hmh.eng.br> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- include/linux/swap.h | 10 ---------- mm/filemap.c | 4 ++-- 2 files changed, 2 insertions(+), 12 deletions(-) --- a/include/linux/swap.h +++ b/include/linux/swap.h @@ -223,21 +223,11 @@ static inline void lru_cache_add_anon(st __lru_cache_add(page, LRU_INACTIVE_ANON); } -static inline void lru_cache_add_active_anon(struct page *page) -{ - __lru_cache_add(page, LRU_ACTIVE_ANON); -} - static inline void lru_cache_add_file(struct page *page) { __lru_cache_add(page, LRU_INACTIVE_FILE); } -static inline void lru_cache_add_active_file(struct page *page) -{ - __lru_cache_add(page, LRU_ACTIVE_FILE); -} - /* linux/mm/vmscan.c */ extern unsigned long try_to_free_pages(struct zonelist *zonelist, int order, gfp_t gfp_mask, nodemask_t *mask); --- a/mm/filemap.c +++ b/mm/filemap.c @@ -441,7 +441,7 @@ int add_to_page_cache_lru(struct page *p /* * Splice_read and readahead add shmem/tmpfs pages into the page cache * before shmem_readpage has a chance to mark them as SwapBacked: they - * need to go on the active_anon lru below, and mem_cgroup_cache_charge + * need to go on the anon lru below, and mem_cgroup_cache_charge * (called in add_to_page_cache) needs to know where they're going too. */ if (mapping_cap_swap_backed(mapping)) @@ -452,7 +452,7 @@ int add_to_page_cache_lru(struct page *p if (page_is_file_cache(page)) lru_cache_add_file(page); else - lru_cache_add_active_anon(page); + lru_cache_add_anon(page); } return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 079/164] md: manage redundancy group in sysfs when changing level. 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (77 preceding siblings ...) 2010-07-01 17:34 ` [patch 078/164] tmpfs: insert tmpfs cache pages to inactive list at first Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 080/164] mlx4_core: Fix possible chunk sg list overflow in mlx4_alloc_icm() Greg KH ` (84 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: NeilBrown <neilb@suse.de> commit a64c876fd357906a1f7193723866562ad290654c upstream. Some levels expect the 'redundancy group' to be present, others don't. So when we change level of an array we might need to add or remove this group. This requires fixing up the current practice of overloading ->private to indicate (when ->pers == NULL) that something needs to be removed. So create a new ->to_remove to fill that role. When changing levels, we may need to add or remove attributes. When changing RAID5 -> RAID6, we both add and remove the same thing. It is important to catch this and optimise it out as the removal is delayed until a lock is released, so trying to add immediately would cause problems. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/md.c | 43 ++++++++++++++++++++++++++++++++----------- drivers/md/md.h | 1 + drivers/md/raid5.c | 7 +++++-- 3 files changed, 38 insertions(+), 13 deletions(-) --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -509,9 +509,9 @@ static inline int mddev_trylock(mddev_t static struct attribute_group md_redundancy_group; -static inline void mddev_unlock(mddev_t * mddev) +static void mddev_unlock(mddev_t * mddev) { - if (mddev->pers == NULL && mddev->private) { + if (mddev->to_remove) { /* These cannot be removed under reconfig_mutex as * an access to the files will try to take reconfig_mutex * while holding the file unremovable, which leads to @@ -520,16 +520,20 @@ static inline void mddev_unlock(mddev_t * it while holding reconfig_mutex, and md_run can * use it to wait for the remove to complete. */ + struct attribute_group *to_remove = mddev->to_remove; + mddev->to_remove = NULL; mutex_lock(&mddev->open_mutex); mutex_unlock(&mddev->reconfig_mutex); - sysfs_remove_group(&mddev->kobj, &md_redundancy_group); - if (mddev->private != (void*)1) - sysfs_remove_group(&mddev->kobj, mddev->private); - if (mddev->sysfs_action) - sysfs_put(mddev->sysfs_action); - mddev->sysfs_action = NULL; - mddev->private = NULL; + if (to_remove != &md_redundancy_group) + sysfs_remove_group(&mddev->kobj, to_remove); + if (mddev->pers == NULL || + mddev->pers->sync_request == NULL) { + sysfs_remove_group(&mddev->kobj, &md_redundancy_group); + if (mddev->sysfs_action) + sysfs_put(mddev->sysfs_action); + mddev->sysfs_action = NULL; + } mutex_unlock(&mddev->open_mutex); } else mutex_unlock(&mddev->reconfig_mutex); @@ -3002,6 +3006,23 @@ level_store(mddev_t *mddev, const char * /* Looks like we have a winner */ mddev_suspend(mddev); mddev->pers->stop(mddev); + + if (mddev->pers->sync_request == NULL && + pers->sync_request != NULL) { + /* need to add the md_redundancy_group */ + if (sysfs_create_group(&mddev->kobj, &md_redundancy_group)) + printk(KERN_WARNING + "md: cannot register extra attributes for %s\n", + mdname(mddev)); + mddev->sysfs_action = sysfs_get_dirent(mddev->kobj.sd, "sync_action"); + } + if (mddev->pers->sync_request != NULL && + pers->sync_request == NULL) { + /* need to remove the md_redundancy_group */ + if (mddev->to_remove == NULL) + mddev->to_remove = &md_redundancy_group; + } + module_put(mddev->pers->owner); /* Invalidate devices that are now superfluous */ list_for_each_entry(rdev, &mddev->disks, same_set) @@ -4556,8 +4577,8 @@ static int do_md_stop(mddev_t * mddev, i mddev->queue->unplug_fn = NULL; mddev->queue->backing_dev_info.congested_fn = NULL; module_put(mddev->pers->owner); - if (mddev->pers->sync_request && mddev->private == NULL) - mddev->private = (void*)1; + if (mddev->pers->sync_request && mddev->to_remove == NULL) + mddev->to_remove = &md_redundancy_group; mddev->pers = NULL; /* tell userspace to handle 'inactive' */ sysfs_notify_dirent(mddev->sysfs_state); --- a/drivers/md/md.h +++ b/drivers/md/md.h @@ -305,6 +305,7 @@ struct mddev_s atomic_t max_corr_read_errors; /* max read retries */ struct list_head all_mddevs; + struct attribute_group *to_remove; /* Generic barrier handling. * If there is a pending barrier request, all other * writes are blocked while the devices are flushed. --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -5086,7 +5086,9 @@ static int run(mddev_t *mddev) } /* Ok, everything is just fine now */ - if (sysfs_create_group(&mddev->kobj, &raid5_attrs_group)) + if (mddev->to_remove == &raid5_attrs_group) + mddev->to_remove = NULL; + else if (sysfs_create_group(&mddev->kobj, &raid5_attrs_group)) printk(KERN_WARNING "raid5: failed to create sysfs attributes for %s\n", mdname(mddev)); @@ -5133,7 +5135,8 @@ static int stop(mddev_t *mddev) mddev->queue->backing_dev_info.congested_fn = NULL; blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/ free_conf(conf); - mddev->private = &raid5_attrs_group; + mddev->private = NULL; + mddev->to_remove = &raid5_attrs_group; return 0; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 080/164] mlx4_core: Fix possible chunk sg list overflow in mlx4_alloc_icm() 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (78 preceding siblings ...) 2010-07-01 17:34 ` [patch 079/164] md: manage redundancy group in sysfs when changing level Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 081/164] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 Greg KH ` (83 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Sebastien Dugue, Roland Dreier 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sebastien Dugue <sebastien.dugue@bull.net> commit c0dc72bad9cf21071f5e4005de46f7c8b67a138a upstream. If the number of sg entries in the ICM chunk reaches MLX4_ICM_CHUNK_LEN, we must set chunk to NULL even for coherent mappings so that the next time through the loop will allocate another chunk. Otherwise we'll overflow the sg list the next time through the loop. This will lead to memory corruption if this case is hit. mthca does not have this bug. Signed-off-by: Sebastien Dugue <sebastien.dugue@bull.net> Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/mlx4/icm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/mlx4/icm.c +++ b/drivers/net/mlx4/icm.c @@ -174,9 +174,10 @@ struct mlx4_icm *mlx4_alloc_icm(struct m if (chunk->nsg <= 0) goto fail; + } + if (chunk->npages == MLX4_ICM_CHUNK_LEN) chunk = NULL; - } npages -= 1 << cur_order; } else { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 081/164] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (79 preceding siblings ...) 2010-07-01 17:34 ` [patch 080/164] mlx4_core: Fix possible chunk sg list overflow in mlx4_alloc_icm() Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 082/164] ARM: 6164/1: Add kto and kfrom to input operands list Greg KH ` (82 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Anfei Zhou, Russell King 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Anfei <anfei.zhou@gmail.com> commit 5e27fb78df95e027723af2c90ecc9b4527ae59e9 upstream. Instruction faults on pre-ARMv6 CPUs are interpreted as a 'translation fault', but do_translation_fault doesn't handle well if user mode trying to run instruction above TASK_SIZE, and result in the infinite retry of that instruction. Signed-off-by: Anfei Zhou <anfei.zhou@gmail.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/mm/fault.c | 3 +++ 1 file changed, 3 insertions(+) --- a/arch/arm/mm/fault.c +++ b/arch/arm/mm/fault.c @@ -386,6 +386,9 @@ do_translation_fault(unsigned long addr, if (addr < TASK_SIZE) return do_page_fault(addr, fsr, regs); + if (user_mode(regs)) + goto bad_area; + index = pgd_index(addr); /* ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 082/164] ARM: 6164/1: Add kto and kfrom to input operands list. 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (80 preceding siblings ...) 2010-07-01 17:34 ` [patch 081/164] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 083/164] ARM: 6146/1: sa1111: Prevent deadlock in resume path Greg KH ` (81 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Khem Raj, Russell King 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Khem Raj <raj.khem@gmail.com> commit 9a40ac86152c9cffd3dca482a15ddf9a8c5716b3 upstream. When functions incoming parameters are not in input operands list gcc 4.5 does not load the parameters into registers before calling this function but the inline assembly assumes valid addresses inside this function. This breaks the code because r0 and r1 are invalid when execution enters v4wb_copy_user_page () Also the constant needs to be used as third input operand so account for that as well. Tested on qemu arm. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/mm/copypage-feroceon.c | 4 ++-- arch/arm/mm/copypage-v4wb.c | 4 ++-- arch/arm/mm/copypage-v4wt.c | 4 ++-- arch/arm/mm/copypage-xsc3.c | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) --- a/arch/arm/mm/copypage-feroceon.c +++ b/arch/arm/mm/copypage-feroceon.c @@ -18,7 +18,7 @@ feroceon_copy_user_page(void *kto, const { asm("\ stmfd sp!, {r4-r9, lr} \n\ - mov ip, %0 \n\ + mov ip, %2 \n\ 1: mov lr, r1 \n\ ldmia r1!, {r2 - r9} \n\ pld [lr, #32] \n\ @@ -64,7 +64,7 @@ feroceon_copy_user_page(void *kto, const mcr p15, 0, ip, c7, c10, 4 @ drain WB\n\ ldmfd sp!, {r4-r9, pc}" : - : "I" (PAGE_SIZE)); + : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE)); } void feroceon_copy_user_highpage(struct page *to, struct page *from, --- a/arch/arm/mm/copypage-v4wb.c +++ b/arch/arm/mm/copypage-v4wb.c @@ -27,7 +27,7 @@ v4wb_copy_user_page(void *kto, const voi { asm("\ stmfd sp!, {r4, lr} @ 2\n\ - mov r2, %0 @ 1\n\ + mov r2, %2 @ 1\n\ ldmia r1!, {r3, r4, ip, lr} @ 4\n\ 1: mcr p15, 0, r0, c7, c6, 1 @ 1 invalidate D line\n\ stmia r0!, {r3, r4, ip, lr} @ 4\n\ @@ -44,7 +44,7 @@ v4wb_copy_user_page(void *kto, const voi mcr p15, 0, r1, c7, c10, 4 @ 1 drain WB\n\ ldmfd sp!, {r4, pc} @ 3" : - : "I" (PAGE_SIZE / 64)); + : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64)); } void v4wb_copy_user_highpage(struct page *to, struct page *from, --- a/arch/arm/mm/copypage-v4wt.c +++ b/arch/arm/mm/copypage-v4wt.c @@ -25,7 +25,7 @@ v4wt_copy_user_page(void *kto, const voi { asm("\ stmfd sp!, {r4, lr} @ 2\n\ - mov r2, %0 @ 1\n\ + mov r2, %2 @ 1\n\ ldmia r1!, {r3, r4, ip, lr} @ 4\n\ 1: stmia r0!, {r3, r4, ip, lr} @ 4\n\ ldmia r1!, {r3, r4, ip, lr} @ 4+1\n\ @@ -40,7 +40,7 @@ v4wt_copy_user_page(void *kto, const voi mcr p15, 0, r2, c7, c7, 0 @ flush ID cache\n\ ldmfd sp!, {r4, pc} @ 3" : - : "I" (PAGE_SIZE / 64)); + : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64)); } void v4wt_copy_user_highpage(struct page *to, struct page *from, --- a/arch/arm/mm/copypage-xsc3.c +++ b/arch/arm/mm/copypage-xsc3.c @@ -34,7 +34,7 @@ xsc3_mc_copy_user_page(void *kto, const { asm("\ stmfd sp!, {r4, r5, lr} \n\ - mov lr, %0 \n\ + mov lr, %2 \n\ \n\ pld [r1, #0] \n\ pld [r1, #32] \n\ @@ -67,7 +67,7 @@ xsc3_mc_copy_user_page(void *kto, const \n\ ldmfd sp!, {r4, r5, pc}" : - : "I" (PAGE_SIZE / 64 - 1)); + : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64 - 1)); } void xsc3_mc_copy_user_highpage(struct page *to, struct page *from, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 083/164] ARM: 6146/1: sa1111: Prevent deadlock in resume path 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (81 preceding siblings ...) 2010-07-01 17:34 ` [patch 082/164] ARM: 6164/1: Add kto and kfrom to input operands list Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 084/164] ARM: 6144/1: TCM memory bug freeing bug Greg KH ` (80 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Marek Vasut, Russell King 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: =?UTF-8?q?Marek=20Va=C5=A1ut?= <marek.vasut@gmail.com> commit 3defb2476166445982a90c12d33f8947e75476c4 upstream. This patch reorganises the sa1111_resume() function in a manner the spinlock happens after calling the sa1111_wake(). This fixes two bugs: 1) This function called sa1111_wake() which tried to claim the same spinlock the sa1111_resume() already claimed. This would result in certain deadlock. Original idea for this part: Russell King <rmk+kernel@arm.linux.org.uk> 2) The function didn't unlock the spinlock in case the chip didn't report correct ID. Original idea for this part: Julia Lawall <julia@diku.dk> Signed-off-by: Marek Vasut <marek.vasut@gmail.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/common/sa1111.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/arch/arm/common/sa1111.c +++ b/arch/arm/common/sa1111.c @@ -887,8 +887,6 @@ static int sa1111_resume(struct platform if (!save) return 0; - spin_lock_irqsave(&sachip->lock, flags); - /* * Ensure that the SA1111 is still here. * FIXME: shouldn't do this here. @@ -905,6 +903,13 @@ static int sa1111_resume(struct platform * First of all, wake up the chip. */ sa1111_wake(sachip); + + /* + * Only lock for write ops. Also, sa1111_wake must be called with + * released spinlock! + */ + spin_lock_irqsave(&sachip->lock, flags); + sa1111_writel(0, sachip->base + SA1111_INTC + SA1111_INTEN0); sa1111_writel(0, sachip->base + SA1111_INTC + SA1111_INTEN1); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 084/164] ARM: 6144/1: TCM memory bug freeing bug 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (82 preceding siblings ...) 2010-07-01 17:34 ` [patch 083/164] ARM: 6146/1: sa1111: Prevent deadlock in resume path Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 085/164] ARM: VFP: Fix vfp_put_double() for d16-d31 Greg KH ` (79 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Linus Walleij, Russell King 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Linus Walleij <linus.walleij@stericsson.com> commit ea208f646c8fb91c39c852e952fc911e1ad045ab upstream. This fixes a bug in mm/init.c when freeing the TCM compile memory, this was being referred to as a char * which is incorrect: this will dereference the pointer and feed in the value at the location instead of the address to it. Change it to a plain char and use &(char) to reference it. Signed-off-by: Linus Walleij <linus.walleij@stericsson.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/mm/init.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/arch/arm/mm/init.c +++ b/arch/arm/mm/init.c @@ -632,10 +632,10 @@ void __init mem_init(void) void free_initmem(void) { #ifdef CONFIG_HAVE_TCM - extern char *__tcm_start, *__tcm_end; + extern char __tcm_start, __tcm_end; - totalram_pages += free_area(__phys_to_pfn(__pa(__tcm_start)), - __phys_to_pfn(__pa(__tcm_end)), + totalram_pages += free_area(__phys_to_pfn(__pa(&__tcm_start)), + __phys_to_pfn(__pa(&__tcm_end)), "TCM link"); #endif ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 085/164] ARM: VFP: Fix vfp_put_double() for d16-d31 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (83 preceding siblings ...) 2010-07-01 17:34 ` [patch 084/164] ARM: 6144/1: TCM memory bug freeing bug Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 086/164] ASoC: Fix dB scales for WM835x Greg KH ` (78 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Russell King 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Russell King <rmk+kernel@arm.linux.org.uk> commit 138de1c44a8e0606501cd8593407e9248e84f1b7 upstream. vfp_put_double() takes the double value in r0,r1 not r1,r2. Reported-by: Tarun Kanti DebBarma <tarun.kanti@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/vfp/vfphw.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/arm/vfp/vfphw.S +++ b/arch/arm/vfp/vfphw.S @@ -277,7 +277,7 @@ ENTRY(vfp_put_double) #ifdef CONFIG_VFPv3 @ d16 - d31 registers .irp dr,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 -1: mcrr p11, 3, r1, r2, c\dr @ fmdrr r1, r2, d\dr +1: mcrr p11, 3, r0, r1, c\dr @ fmdrr r0, r1, d\dr mov pc, lr .org 1b + 8 .endr ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 086/164] ASoC: Fix dB scales for WM835x 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (84 preceding siblings ...) 2010-07-01 17:34 ` [patch 085/164] ARM: VFP: Fix vfp_put_double() for d16-d31 Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 087/164] ASoC: Fix dB scales for WM8400 Greg KH ` (77 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Mark Brown, Liam Girdwood 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mark Brown <broonie@opensource.wolfsonmicro.com> commit e6a08c5a8990102bcd1f4bae84b668da6c23caa9 upstream. These should be regular rather than linear scales. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/soc/codecs/wm8350.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/sound/soc/codecs/wm8350.c +++ b/sound/soc/codecs/wm8350.c @@ -423,8 +423,8 @@ static const struct soc_enum wm8350_enum SOC_ENUM_SINGLE(WM8350_INPUT_MIXER_VOLUME, 15, 2, wm8350_lr), }; -static DECLARE_TLV_DB_LINEAR(pre_amp_tlv, -1200, 3525); -static DECLARE_TLV_DB_LINEAR(out_pga_tlv, -5700, 600); +static DECLARE_TLV_DB_SCALE(pre_amp_tlv, -1200, 3525, 0); +static DECLARE_TLV_DB_SCALE(out_pga_tlv, -5700, 600, 0); static DECLARE_TLV_DB_SCALE(dac_pcm_tlv, -7163, 36, 1); static DECLARE_TLV_DB_SCALE(adc_pcm_tlv, -12700, 50, 1); static DECLARE_TLV_DB_SCALE(out_mix_tlv, -1500, 300, 1); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 087/164] ASoC: Fix dB scales for WM8400 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (85 preceding siblings ...) 2010-07-01 17:34 ` [patch 086/164] ASoC: Fix dB scales for WM835x Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 088/164] ASoC: Fix dB scales for WM8990 Greg KH ` (76 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Mark Brown, Liam Girdwood 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mark Brown <broonie@opensource.wolfsonmicro.com> commit 3351e9fbb0fda6498ee149ee88c67f5849813c57 upstream. These scales should be regular, not linear. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/soc/codecs/wm8400.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) --- a/sound/soc/codecs/wm8400.c +++ b/sound/soc/codecs/wm8400.c @@ -106,21 +106,21 @@ static void wm8400_codec_reset(struct sn wm8400_reset_codec_reg_cache(wm8400->wm8400); } -static const DECLARE_TLV_DB_LINEAR(rec_mix_tlv, -1500, 600); +static const DECLARE_TLV_DB_SCALE(rec_mix_tlv, -1500, 600, 0); -static const DECLARE_TLV_DB_LINEAR(in_pga_tlv, -1650, 3000); +static const DECLARE_TLV_DB_SCALE(in_pga_tlv, -1650, 3000, 0); -static const DECLARE_TLV_DB_LINEAR(out_mix_tlv, -2100, 0); +static const DECLARE_TLV_DB_SCALE(out_mix_tlv, -2100, 0, 0); -static const DECLARE_TLV_DB_LINEAR(out_pga_tlv, -7300, 600); +static const DECLARE_TLV_DB_SCALE(out_pga_tlv, -7300, 600, 0); -static const DECLARE_TLV_DB_LINEAR(out_omix_tlv, -600, 0); +static const DECLARE_TLV_DB_SCALE(out_omix_tlv, -600, 0, 0); -static const DECLARE_TLV_DB_LINEAR(out_dac_tlv, -7163, 0); +static const DECLARE_TLV_DB_SCALE(out_dac_tlv, -7163, 0, 0); -static const DECLARE_TLV_DB_LINEAR(in_adc_tlv, -7163, 1763); +static const DECLARE_TLV_DB_SCALE(in_adc_tlv, -7163, 1763, 0); -static const DECLARE_TLV_DB_LINEAR(out_sidetone_tlv, -3600, 0); +static const DECLARE_TLV_DB_SCALE(out_sidetone_tlv, -3600, 0, 0); static int wm8400_outpga_put_volsw_vu(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) @@ -439,7 +439,7 @@ static int outmixer_event (struct snd_so /* INMIX dB values */ static const unsigned int in_mix_tlv[] = { TLV_DB_RANGE_HEAD(1), - 0,7, TLV_DB_LINEAR_ITEM(-1200, 600), + 0,7, TLV_DB_SCALE_ITEM(-1200, 600, 0), }; /* Left In PGA Connections */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 088/164] ASoC: Fix dB scales for WM8990 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (86 preceding siblings ...) 2010-07-01 17:34 ` [patch 087/164] ASoC: Fix dB scales for WM8400 Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 089/164] drm/radeon: r100/r200 ums: block ability for userspace app to trash 0 page and beyond Greg KH ` (75 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Mark Brown, Liam Girdwood 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mark Brown <broonie@opensource.wolfsonmicro.com> commit f68596c6d8711650722b2a54328a088a2c21bc5b upstream. These should be regular, not linear. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/soc/codecs/wm8990.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) --- a/sound/soc/codecs/wm8990.c +++ b/sound/soc/codecs/wm8990.c @@ -110,21 +110,21 @@ static const u16 wm8990_reg[] = { #define wm8990_reset(c) snd_soc_write(c, WM8990_RESET, 0) -static const DECLARE_TLV_DB_LINEAR(rec_mix_tlv, -1500, 600); +static const DECLARE_TLV_DB_SCALE(rec_mix_tlv, -1500, 600, 0); -static const DECLARE_TLV_DB_LINEAR(in_pga_tlv, -1650, 3000); +static const DECLARE_TLV_DB_SCALE(in_pga_tlv, -1650, 3000, 0); -static const DECLARE_TLV_DB_LINEAR(out_mix_tlv, 0, -2100); +static const DECLARE_TLV_DB_SCALE(out_mix_tlv, 0, -2100, 0); -static const DECLARE_TLV_DB_LINEAR(out_pga_tlv, -7300, 600); +static const DECLARE_TLV_DB_SCALE(out_pga_tlv, -7300, 600, 0); -static const DECLARE_TLV_DB_LINEAR(out_omix_tlv, -600, 0); +static const DECLARE_TLV_DB_SCALE(out_omix_tlv, -600, 0, 0); -static const DECLARE_TLV_DB_LINEAR(out_dac_tlv, -7163, 0); +static const DECLARE_TLV_DB_SCALE(out_dac_tlv, -7163, 0, 0); -static const DECLARE_TLV_DB_LINEAR(in_adc_tlv, -7163, 1763); +static const DECLARE_TLV_DB_SCALE(in_adc_tlv, -7163, 1763, 0); -static const DECLARE_TLV_DB_LINEAR(out_sidetone_tlv, -3600, 0); +static const DECLARE_TLV_DB_SCALE(out_sidetone_tlv, -3600, 0, 0); static int wm899x_outpga_put_volsw_vu(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) @@ -450,7 +450,7 @@ static int outmixer_event(struct snd_soc /* INMIX dB values */ static const unsigned int in_mix_tlv[] = { TLV_DB_RANGE_HEAD(1), - 0, 7, TLV_DB_LINEAR_ITEM(-1200, 600), + 0, 7, TLV_DB_SCALE_ITEM(-1200, 600, 0), }; /* Left In PGA Connections */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 089/164] drm/radeon: r100/r200 ums: block ability for userspace app to trash 0 page and beyond 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (87 preceding siblings ...) 2010-07-01 17:34 ` [patch 088/164] ASoC: Fix dB scales for WM8990 Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 090/164] drm/radeon: fix the r100/r200 ums block 0 page fix Greg KH ` (74 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Dave Airlie 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dave Airlie <airlied@redhat.com> commit 566d84d172161cb6c0c4dd834c34abbac6bf7b38 upstream. radeon's have a special ability to passthrough writes in their internal memory space directly to PCI, this ability means that if some of the internal surfaces like the depth buffer point at 0x0, any writes to these will go directly to RAM at 0x0 via PCI busmastering. Now mesa used to always emit clears after emitting state, since the radeon mesa driver was refactored a year or more ago, it was found it could generate a clear request without ever sending any setup state to the card. So the clear would attempt to clear the depth buffer at 0x0, which would overwrite main memory at this point. fs corruption ensues. Also once one app did this correctly, it would never get set back to 0 making this messy to reproduce. The kernel should block this from happening as mesa runs without privs, though it does require the user be connected to the current running X session. This patch implements a check to make sure the depth offset has been set before a depth clear occurs and if it finds one it prints a warning and ignores the depth clear request. There is also a mesa fix to avoid sending the badness going into mesa. This only affects r100/r200 GPUs in user modesetting mode. Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/radeon/radeon_cp.c | 1 + drivers/gpu/drm/radeon/radeon_drv.h | 2 ++ drivers/gpu/drm/radeon/radeon_state.c | 6 ++++++ 3 files changed, 9 insertions(+) --- a/drivers/gpu/drm/radeon/radeon_cp.c +++ b/drivers/gpu/drm/radeon/radeon_cp.c @@ -1646,6 +1646,7 @@ static int radeon_do_resume_cp(struct dr radeon_cp_load_microcode(dev_priv); radeon_cp_init_ring_buffer(dev, dev_priv, file_priv); + dev_priv->have_z_offset = 0; radeon_do_engine_reset(dev); radeon_irq_set_state(dev, RADEON_SW_INT_ENABLE, 1); --- a/drivers/gpu/drm/radeon/radeon_drv.h +++ b/drivers/gpu/drm/radeon/radeon_drv.h @@ -268,6 +268,8 @@ typedef struct drm_radeon_private { u32 scratch_ages[5]; + int have_z_offset; + /* starting from here on, data is preserved accross an open */ uint32_t flags; /* see radeon_chip_flags */ resource_size_t fb_aper_offset; --- a/drivers/gpu/drm/radeon/radeon_state.c +++ b/drivers/gpu/drm/radeon/radeon_state.c @@ -101,6 +101,7 @@ static __inline__ int radeon_check_and_f DRM_ERROR("Invalid depth buffer offset\n"); return -EINVAL; } + dev_priv->have_z_offset = 1; break; case RADEON_EMIT_PP_CNTL: @@ -876,6 +877,11 @@ static void radeon_cp_dispatch_clear(str if (tmp & RADEON_BACK) flags |= RADEON_FRONT; } + if (flags & (RADEON_DEPTH|RADEON_STENCIL)) { + if (!dev_priv->have_z_offset) + printk_once(KERN_ERR "radeon: illegal depth clear request. Buggy mesa detected - please update.\n"); + flags &= ~(RADEON_DEPTH | RADEON_STENCIL); + } if (flags & (RADEON_FRONT | RADEON_BACK)) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 090/164] drm/radeon: fix the r100/r200 ums block 0 page fix 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (88 preceding siblings ...) 2010-07-01 17:34 ` [patch 089/164] drm/radeon: r100/r200 ums: block ability for userspace app to trash 0 page and beyond Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 091/164] hwmon: (ltc4245) Read only one GPIO pin Greg KH ` (73 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Dave Airlie 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dave Airlie <airlied@redhat.com> commit cf22f20ade30f8c03955324aaf27b1049e182600 upstream. airlied -> brown paper bag. I blame Hi-5 or the Wiggles for lowering my IQ, move the fix inside some brackets instead of breaking everything in site. Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/radeon/radeon_state.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/gpu/drm/radeon/radeon_state.c +++ b/drivers/gpu/drm/radeon/radeon_state.c @@ -878,9 +878,10 @@ static void radeon_cp_dispatch_clear(str flags |= RADEON_FRONT; } if (flags & (RADEON_DEPTH|RADEON_STENCIL)) { - if (!dev_priv->have_z_offset) + if (!dev_priv->have_z_offset) { printk_once(KERN_ERR "radeon: illegal depth clear request. Buggy mesa detected - please update.\n"); - flags &= ~(RADEON_DEPTH | RADEON_STENCIL); + flags &= ~(RADEON_DEPTH | RADEON_STENCIL); + } } if (flags & (RADEON_FRONT | RADEON_BACK)) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 091/164] hwmon: (ltc4245) Read only one GPIO pin 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (89 preceding siblings ...) 2010-07-01 17:34 ` [patch 090/164] drm/radeon: fix the r100/r200 ums block 0 page fix Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 092/164] signals: check_kill_permission(): dont check creds if same_thread_group() Greg KH ` (72 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ira W. Snyder, Jean Delvare 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ira W. Snyder <iws@ovro.caltech.edu> commit df16dd53c575d0cb9dbee20a3149927c862a9ff6 upstream. Read only one of the GPIO pins as an analog voltage. The ADC can be switched to a different GPIO pin at runtime, but this is not supported. Previously, this driver would report the analog voltage of the currently selected GPIO pin as all three GPIO voltages: in9_input, in10_input and in11_input. Signed-off-by: Ira W. Snyder <iws@ovro.caltech.edu> Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- Documentation/hwmon/ltc4245 | 4 +--- drivers/hwmon/ltc4245.c | 18 +++++------------- 2 files changed, 6 insertions(+), 16 deletions(-) --- a/Documentation/hwmon/ltc4245 +++ b/Documentation/hwmon/ltc4245 @@ -72,9 +72,7 @@ in6_min_alarm 5v output undervoltage a in7_min_alarm 3v output undervoltage alarm in8_min_alarm Vee (-12v) output undervoltage alarm -in9_input GPIO #1 voltage data -in10_input GPIO #2 voltage data -in11_input GPIO #3 voltage data +in9_input GPIO voltage data power1_input 12v power usage (mW) power2_input 5v power usage (mW) --- a/drivers/hwmon/ltc4245.c +++ b/drivers/hwmon/ltc4245.c @@ -45,9 +45,7 @@ enum ltc4245_cmd { LTC4245_VEEIN = 0x19, LTC4245_VEESENSE = 0x1a, LTC4245_VEEOUT = 0x1b, - LTC4245_GPIOADC1 = 0x1c, - LTC4245_GPIOADC2 = 0x1d, - LTC4245_GPIOADC3 = 0x1e, + LTC4245_GPIOADC = 0x1c, }; struct ltc4245_data { @@ -61,7 +59,7 @@ struct ltc4245_data { u8 cregs[0x08]; /* Voltage registers */ - u8 vregs[0x0f]; + u8 vregs[0x0d]; }; static struct ltc4245_data *ltc4245_update_device(struct device *dev) @@ -86,7 +84,7 @@ static struct ltc4245_data *ltc4245_upda data->cregs[i] = val; } - /* Read voltage registers -- 0x10 to 0x1f */ + /* Read voltage registers -- 0x10 to 0x1c */ for (i = 0; i < ARRAY_SIZE(data->vregs); i++) { val = i2c_smbus_read_byte_data(client, i+0x10); if (unlikely(val < 0)) @@ -128,9 +126,7 @@ static int ltc4245_get_voltage(struct de case LTC4245_VEEOUT: voltage = regval * -55; break; - case LTC4245_GPIOADC1: - case LTC4245_GPIOADC2: - case LTC4245_GPIOADC3: + case LTC4245_GPIOADC: voltage = regval * 10; break; default: @@ -297,9 +293,7 @@ LTC4245_ALARM(in7_min_alarm, (1 << 2), L LTC4245_ALARM(in8_min_alarm, (1 << 3), LTC4245_FAULT2); /* GPIO voltages */ -LTC4245_VOLTAGE(in9_input, LTC4245_GPIOADC1); -LTC4245_VOLTAGE(in10_input, LTC4245_GPIOADC2); -LTC4245_VOLTAGE(in11_input, LTC4245_GPIOADC3); +LTC4245_VOLTAGE(in9_input, LTC4245_GPIOADC); /* Power Consumption (virtual) */ LTC4245_POWER(power1_input, LTC4245_12VSENSE); @@ -342,8 +336,6 @@ static struct attribute *ltc4245_attribu &sensor_dev_attr_in8_min_alarm.dev_attr.attr, &sensor_dev_attr_in9_input.dev_attr.attr, - &sensor_dev_attr_in10_input.dev_attr.attr, - &sensor_dev_attr_in11_input.dev_attr.attr, &sensor_dev_attr_power1_input.dev_attr.attr, &sensor_dev_attr_power2_input.dev_attr.attr, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 092/164] signals: check_kill_permission(): dont check creds if same_thread_group() 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (90 preceding siblings ...) 2010-07-01 17:34 ` [patch 091/164] hwmon: (ltc4245) Read only one GPIO pin Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 093/164] do_generic_file_read: clear page errors when issuing a fresh read of the page Greg KH ` (71 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Oleg Nesterov, Roland McGrath, David Howells, Eric Paris, Jakub Jelinek, James Morris, Stephen Smalley 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Oleg Nesterov <oleg@redhat.com> commit 065add3941bdca54fe04ed3471a96bce9af88793 upstream. Andrew Tridgell reports that aio_read(SIGEV_SIGNAL) can fail if the notification from the helper thread races with setresuid(), see http://samba.org/~tridge/junkcode/aio_uid.c This happens because check_kill_permission() doesn't permit sending a signal to the task with the different cred->xids. But there is not any security reason to check ->cred's when the task sends a signal (private or group-wide) to its sub-thread. Whatever we do, any thread can bypass all security checks and send SIGKILL to all threads, or it can block a signal SIG and do kill(gettid(), SIG) to deliver this signal to another sub-thread. Not to mention that CLONE_THREAD implies CLONE_VM. Change check_kill_permission() to avoid the credentials check when the sender and the target are from the same thread group. Also, move "cred = current_cred()" down to avoid calling get_current() twice. Note: David Howells pointed out we could relax this even more, the CLONE_SIGHAND (without CLONE_THREAD) case probably does not need these checks too. Roland said: : The glibc (libpthread) that does set*id across threads has : been in use for a while (2.3.4?), probably in distro's using kernels as old : or older than any active -stable streams. In the race in question, this : kernel bug is breaking valid POSIX application expectations. Reported-by: Andrew Tridgell <tridge@samba.org> Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Roland McGrath <roland@redhat.com> Acked-by: David Howells <dhowells@redhat.com> Cc: Eric Paris <eparis@parisplace.org> Cc: Jakub Jelinek <jakub@redhat.com> Cc: James Morris <jmorris@namei.org> Cc: Roland McGrath <roland@redhat.com> Cc: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/signal.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/kernel/signal.c +++ b/kernel/signal.c @@ -625,7 +625,7 @@ static inline bool si_fromuser(const str static int check_kill_permission(int sig, struct siginfo *info, struct task_struct *t) { - const struct cred *cred = current_cred(), *tcred; + const struct cred *cred, *tcred; struct pid *sid; int error; @@ -639,8 +639,10 @@ static int check_kill_permission(int sig if (error) return error; + cred = current_cred(); tcred = __task_cred(t); - if ((cred->euid ^ tcred->suid) && + if (!same_thread_group(current, t) && + (cred->euid ^ tcred->suid) && (cred->euid ^ tcred->uid) && (cred->uid ^ tcred->suid) && (cred->uid ^ tcred->uid) && ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 093/164] do_generic_file_read: clear page errors when issuing a fresh read of the page 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (91 preceding siblings ...) 2010-07-01 17:34 ` [patch 092/164] signals: check_kill_permission(): dont check creds if same_thread_group() Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 094/164] ipmi: handle run_to_completion properly in deliver_recv_msg() Greg KH ` (70 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jeff Moyer, Rik van Riel, Larry Woodman 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jeff Moyer <jmoyer@redhat.com> commit 91803b499cca2fe558abad709ce83dc896b80950 upstream. I/O errors can happen due to temporary failures, like multipath errors or losing network contact with the iSCSI server. Because of that, the VM will retry readpage on the page. However, do_generic_file_read does not clear PG_error. This causes the system to be unable to actually use the data in the page cache page, even if the subsequent readpage completes successfully! The function filemap_fault has had a ClearPageError before readpage forever. This patch simply adds the same to do_generic_file_read. Signed-off-by: Jeff Moyer <jmoyer@redhat.com> Signed-off-by: Rik van Riel <riel@redhat.com> Acked-by: Larry Woodman <lwoodman@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- mm/filemap.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/mm/filemap.c +++ b/mm/filemap.c @@ -1099,6 +1099,12 @@ page_not_up_to_date_locked: } readpage: + /* + * A previous I/O error may have been due to temporary + * failures, eg. multipath errors. + * PG_error will be set again if readpage fails. + */ + ClearPageError(page); /* Start the actual read. The read will unlock the page. */ error = mapping->a_ops->readpage(filp, page); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 094/164] ipmi: handle run_to_completion properly in deliver_recv_msg() 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (92 preceding siblings ...) 2010-07-01 17:34 ` [patch 093/164] do_generic_file_read: clear page errors when issuing a fresh read of the page Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 095/164] x86, setup: Phoenix BIOS fixup is needed on Dell Inspiron Mini 1012 Greg KH ` (69 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jiri Kosina, Corey Minyard 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jiri Kosina <jkosina@suse.cz> commit a747c5abc329611220f16df0bb4cf0ca4a7fdf0c upstream. If run_to_completion flag is set, it means that we are running in a single-threaded mode, and thus no locks are held. This fixes a deadlock when IPMI notifier is being called during panic. Signed-off-by: Jiri Kosina <jkosina@suse.cz> Acked-by: Corey Minyard <minyard@acm.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/char/ipmi/ipmi_si_intf.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) --- a/drivers/char/ipmi/ipmi_si_intf.c +++ b/drivers/char/ipmi/ipmi_si_intf.c @@ -311,9 +311,14 @@ static void deliver_recv_msg(struct smi_ { /* Deliver the message to the upper layer with the lock released. */ - spin_unlock(&(smi_info->si_lock)); - ipmi_smi_msg_received(smi_info->intf, msg); - spin_lock(&(smi_info->si_lock)); + + if (smi_info->run_to_completion) { + ipmi_smi_msg_received(smi_info->intf, msg); + } else { + spin_unlock(&(smi_info->si_lock)); + ipmi_smi_msg_received(smi_info->intf, msg); + spin_lock(&(smi_info->si_lock)); + } } static void return_hosed_msg(struct smi_info *smi_info, int cCode) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 095/164] x86, setup: Phoenix BIOS fixup is needed on Dell Inspiron Mini 1012 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (93 preceding siblings ...) 2010-07-01 17:34 ` [patch 094/164] ipmi: handle run_to_completion properly in deliver_recv_msg() Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 096/164] xen: ensure timer tick is resumed even on CPU driving the resume Greg KH ` (68 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Gabor Gombas, H. Peter Anvin 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Gabor Gombas <gombasg@digikabel.hu> commit 3d6e77a3ddb8e4156b89f4273ff8c7d37abaf781 upstream. The low-memory corruption checker triggers during suspend/resume, so we need to reserve the low 64k. Don't be fooled that the BIOS identifies itself as "Dell Inc.", it's still Phoenix BIOS. [ hpa: I think we blacklist almost every BIOS in existence. We should either change this to a whitelist or just make it unconditional. ] Signed-off-by: Gabor Gombas <gombasg@digikabel.hu> LKML-Reference: <201005241913.o4OJDIMM010877@imap1.linux-foundation.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/kernel/setup.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -663,6 +663,17 @@ static struct dmi_system_id __initdata b DMI_MATCH(DMI_BOARD_NAME, "DG45FC"), }, }, + /* + * The Dell Inspiron Mini 1012 has DMI_BIOS_VENDOR = "Dell Inc.", so + * match on the product name. + */ + { + .callback = dmi_low_memory_corruption, + .ident = "Phoenix BIOS", + .matches = { + DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1012"), + }, + }, #endif {} }; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 096/164] xen: ensure timer tick is resumed even on CPU driving the resume 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (94 preceding siblings ...) 2010-07-01 17:34 ` [patch 095/164] x86, setup: Phoenix BIOS fixup is needed on Dell Inspiron Mini 1012 Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 097/164] xen: avoid allocation causing potential swap activity on the resume path Greg KH ` (67 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ian Campbell, Jeremy Fitzhardinge 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ian Campbell <ian.campbell@citrix.com> commit cd52e17ea8278f8449b6174a8e5ed439a2e44ffb upstream. The core suspend/resume code is run from stop_machine on CPU0 but parts of the suspend/resume machinery (including xen_arch_resume) are run on whichever CPU happened to schedule the xenwatch kernel thread. As part of the non-core resume code xen_arch_resume is called in order to restart the timer tick on non-boot processors. The boot processor itself is taken care of by core timekeeping code. xen_arch_resume uses smp_call_function which does not call the given function on the current processor. This means that we can end up with one CPU not receiving timer ticks if the xenwatch thread happened to be scheduled on CPU > 0. Use on_each_cpu instead of smp_call_function to ensure the timer tick is resumed everywhere. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Jeremy Fitzhardinge <jeremy@goop.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/xen/suspend.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/arch/x86/xen/suspend.c +++ b/arch/x86/xen/suspend.c @@ -60,6 +60,6 @@ static void xen_vcpu_notify_restore(void void xen_arch_resume(void) { - smp_call_function(xen_vcpu_notify_restore, - (void *)CLOCK_EVT_NOTIFY_RESUME, 1); + on_each_cpu(xen_vcpu_notify_restore, + (void *)CLOCK_EVT_NOTIFY_RESUME, 1); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 097/164] xen: avoid allocation causing potential swap activity on the resume path 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (95 preceding siblings ...) 2010-07-01 17:34 ` [patch 096/164] xen: ensure timer tick is resumed even on CPU driving the resume Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 098/164] ALSA: hda: Use LPIB for an ASUS device Greg KH ` (66 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ian Campbell, Jeremy Fitzhardinge 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ian Campbell <ian.campbell@citrix.com> commit b3831cb55d383e8eb55d3b56c715fb48459b87c9 upstream. Since the device we are resuming could be the device containing the swap device we should ensure that the allocation cannot cause IO. On resume, this path is triggered when the running system tries to continue using its devices. If it cannot then the resume will fail; to try to avoid this we let it dip into the emergency pools. The majority of these changes were made when linux-2.6.18-xen.hg changeset e8b49cfbdac0 was ported upstream in a144ff09bc52ef3f3684ed23eadc9c7c0e57b3aa but somehow this hunk was dropped. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Jeremy Fitzhardinge <jeremy@goop.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/xen/xenbus/xenbus_xs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/xen/xenbus/xenbus_xs.c +++ b/drivers/xen/xenbus/xenbus_xs.c @@ -499,7 +499,7 @@ int xenbus_printf(struct xenbus_transact #define PRINTF_BUFFER_SIZE 4096 char *printf_buffer; - printf_buffer = kmalloc(PRINTF_BUFFER_SIZE, GFP_KERNEL); + printf_buffer = kmalloc(PRINTF_BUFFER_SIZE, GFP_NOIO | __GFP_HIGH); if (printf_buffer == NULL) return -ENOMEM; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 098/164] ALSA: hda: Use LPIB for an ASUS device 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (96 preceding siblings ...) 2010-07-01 17:34 ` [patch 097/164] xen: avoid allocation causing potential swap activity on the resume path Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 099/164] ALSA: hda: Use mb31 quirk for an iMac model Greg KH ` (65 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit dd37f8e8659bc617c3f2a84e007a4824ccdac458 upstream. BugLink: https://launchpad.net/bugs/465942 Symptom: On the reporter's ASUS device, using PulseAudio in Ubuntu 10.04 LTS results in the PA daemon crashing shortly after attempting to select capture or to configure the audio hardware profile. Test case: Using Ubuntu 10.04 LTS (Linux 2.6.32.12), Linux 2.6.33, or Linux 2.6.34, adjust the HDA device's capture volume with PulseAudio. Resolution: add SSID for this machine to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: Irihapeti Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2269,6 +2269,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB), SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB), SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB), SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 099/164] ALSA: hda: Use mb31 quirk for an iMac model 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (97 preceding siblings ...) 2010-07-01 17:34 ` [patch 098/164] ALSA: hda: Use LPIB for an ASUS device Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 100/164] ALSA: hda: Use LPIB for another mainboard Greg KH ` (64 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 26fd74fc01991a18f0e3bd54f8b1b75945ee3dbb upstream. BugLink: https://launchpad.net/bugs/542550 Symptom: On the reporter's iMac, in Ubuntu 10.04 LTS neither playback nor capture appear audible out-of-the-box. Test case: Boot from an Ubuntu 10.04 LTS live cd or from an installed configuration and attempt to play or capture audio. Resolution: Specify the mb31 quirk for this machine in the codec SSID table. Reported-and-Tested-By: f3a97 Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -9116,6 +9116,7 @@ static struct snd_pci_quirk alc882_ssid_ SND_PCI_QUIRK(0x106b, 0x1000, "iMac 24", ALC885_IMAC24), SND_PCI_QUIRK(0x106b, 0x2800, "AppleTV", ALC885_IMAC24), SND_PCI_QUIRK(0x106b, 0x2c00, "MacbookPro rev3", ALC885_MBP3), + SND_PCI_QUIRK(0x106b, 0x3000, "iMac", ALC889A_MB31), SND_PCI_QUIRK(0x106b, 0x3600, "Macbook 3,1", ALC889A_MB31), SND_PCI_QUIRK(0x106b, 0x3800, "MacbookPro 4,1", ALC885_MBP3), SND_PCI_QUIRK(0x106b, 0x3e00, "iMac 24 Aluminum", ALC885_IMAC24), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 100/164] ALSA: hda: Use LPIB for another mainboard 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (98 preceding siblings ...) 2010-07-01 17:34 ` [patch 099/164] ALSA: hda: Use mb31 quirk for an iMac model Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 101/164] ALSA: hda: Use LPIB for ASUS M2V Greg KH ` (63 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit b90c076424da8166797bdc34187660fd0124f530 upstream. BugLink: https://launchpad.net/bugs/580749 Symptom: on the original reporter's VIA VT1708-based board, the PulseAudio daemon dies shortly after the user attempts to play an audio file. Test case: boot from Ubuntu 10.04 LTS live cd; attempt to play an audio file. Resolution: add SSID for the original reporter's hardware to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: Harald Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2278,6 +2278,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB), SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB), SND_PCI_QUIRK(0x1565, 0x8218, "Biostar Microtech", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1849, 0x0888, "775Dual-VSTA", POS_FIX_LPIB), SND_PCI_QUIRK(0x8086, 0x2503, "DG965OT AAD63733-203", POS_FIX_LPIB), SND_PCI_QUIRK(0x8086, 0xd601, "eMachines T5212", POS_FIX_LPIB), {} ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 101/164] ALSA: hda: Use LPIB for ASUS M2V 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (99 preceding siblings ...) 2010-07-01 17:34 ` [patch 100/164] ALSA: hda: Use LPIB for another mainboard Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 102/164] Staging: comedi - correct parameter gainlkup for DAQCard-6024E in driver ni_mio_cs.c Greg KH ` (62 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 9f75c1b12c5ef392ddcea575b13560842c28b1b3 upstream. BugLink: https://launchpad.net/bugs/587546 Symptom: On the reporter's ASUS M2V, using PulseAudio in Ubuntu 10.04 LTS results in the PA daemon crashing shortly after attempting playback of an audio file. Test case: Using Ubuntu 10.04 LTS (Linux 2.6.32.12), Linux 2.6.33, or Linux 2.6.34, attempt playback of an audio file while PulseAudio is active. Resolution: add SSID for this machine to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: D Tangman Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2270,6 +2270,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1043, 0x81e7, "ASUS M2V", POS_FIX_LPIB), SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB), SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 102/164] Staging: comedi - correct parameter gainlkup for DAQCard-6024E in driver ni_mio_cs.c 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (100 preceding siblings ...) 2010-07-01 17:34 ` [patch 101/164] ALSA: hda: Use LPIB for ASUS M2V Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 103/164] clocksource: sh_tmu: compute mult and shift before registration Greg KH ` (61 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Martin Homuth-Rosemann 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Martin Homuth-Rosemann <homuth-rosemann@gmx.net> commit ebe8622342f12bed387f7de4b5fb7c52005ccb29 upstream. Correct at least one of the incorrect specs for a national instrument data acquisition card DAQCard-6024E. This card has only four different gain settings (+-10V, +-5V, +-0.5V, +-0.05V). Signed-off-by: Martin Homuth-Rosemann <homuth-rosemann@gmx.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/staging/comedi/drivers/ni_mio_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/staging/comedi/drivers/ni_mio_cs.c +++ b/drivers/staging/comedi/drivers/ni_mio_cs.c @@ -123,7 +123,7 @@ static const struct ni_board_struct ni_b .adbits = 12, .ai_fifo_depth = 1024, .alwaysdither = 0, - .gainlkup = ai_gain_16, + .gainlkup = ai_gain_4, .ai_speed = 5000, .n_aochan = 2, .aobits = 12, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 103/164] clocksource: sh_tmu: compute mult and shift before registration 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (101 preceding siblings ...) 2010-07-01 17:34 ` [patch 102/164] Staging: comedi - correct parameter gainlkup for DAQCard-6024E in driver ni_mio_cs.c Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 104/164] clocksource: sh_cmt: " Greg KH ` (60 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Aurelien Jarno, Paul Mundt 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Aurelien Jarno <aurelien@aurel32.net> commit 66f49121ffa41a19c59965b31b046d8368fec3c7 upstream. Since commit 98962465ed9e6ea99c38e0af63fe1dcb5a79dc25 ("nohz: Prevent clocksource wrapping during idle"), the CPU of an R2D board never goes to idle. This commit assumes that mult and shift are assigned before the clocksource is registered. As a consequence the safe maximum sleep time is negative and the CPU never goes into idle. This patch fixes the problem by moving mult and shift initialization from sh_tmu_clocksource_enable() to sh_tmu_register_clocksource(). Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Paul Mundt <lethal@linux-sh.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/clocksource/sh_tmu.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) --- a/drivers/clocksource/sh_tmu.c +++ b/drivers/clocksource/sh_tmu.c @@ -199,16 +199,8 @@ static cycle_t sh_tmu_clocksource_read(s static int sh_tmu_clocksource_enable(struct clocksource *cs) { struct sh_tmu_priv *p = cs_to_sh_tmu(cs); - int ret; - ret = sh_tmu_enable(p); - if (ret) - return ret; - - /* TODO: calculate good shift from rate and counter bit width */ - cs->shift = 10; - cs->mult = clocksource_hz2mult(p->rate, cs->shift); - return 0; + return sh_tmu_enable(p); } static void sh_tmu_clocksource_disable(struct clocksource *cs) @@ -228,6 +220,16 @@ static int sh_tmu_register_clocksource(s cs->disable = sh_tmu_clocksource_disable; cs->mask = CLOCKSOURCE_MASK(32); cs->flags = CLOCK_SOURCE_IS_CONTINUOUS; + + /* clk_get_rate() needs an enabled clock */ + clk_enable(p->clk); + /* channel will be configured at parent clock / 4 */ + p->rate = clk_get_rate(p->clk) / 4; + clk_disable(p->clk); + /* TODO: calculate good shift from rate and counter bit width */ + cs->shift = 10; + cs->mult = clocksource_hz2mult(p->rate, cs->shift); + pr_info("sh_tmu: %s used as clock source\n", cs->name); clocksource_register(cs); return 0; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 104/164] clocksource: sh_cmt: compute mult and shift before registration 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (102 preceding siblings ...) 2010-07-01 17:34 ` [patch 103/164] clocksource: sh_tmu: compute mult and shift before registration Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 105/164] gconfig: fix build failure on fedora 13 Greg KH ` (59 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Paul Mundt 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Paul Mundt <lethal@linux-sh.org> commit f4d7c3565c1692c54d9152b52090fe73f0029e37 upstream. Based on the sh_tmu change in 66f49121ffa41a19c59965b31b046d8368fec3c7 ("clocksource: sh_tmu: compute mult and shift before registration"). The same issues impact the sh_cmt driver, so we take the same approach here. Signed-off-by: Paul Mundt <lethal@linux-sh.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/clocksource/sh_cmt.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) --- a/drivers/clocksource/sh_cmt.c +++ b/drivers/clocksource/sh_cmt.c @@ -413,18 +413,10 @@ static cycle_t sh_cmt_clocksource_read(s static int sh_cmt_clocksource_enable(struct clocksource *cs) { struct sh_cmt_priv *p = cs_to_sh_cmt(cs); - int ret; p->total_cycles = 0; - ret = sh_cmt_start(p, FLAG_CLOCKSOURCE); - if (ret) - return ret; - - /* TODO: calculate good shift from rate and counter bit width */ - cs->shift = 0; - cs->mult = clocksource_hz2mult(p->rate, cs->shift); - return 0; + return sh_cmt_start(p, FLAG_CLOCKSOURCE); } static void sh_cmt_clocksource_disable(struct clocksource *cs) @@ -444,7 +436,18 @@ static int sh_cmt_register_clocksource(s cs->disable = sh_cmt_clocksource_disable; cs->mask = CLOCKSOURCE_MASK(sizeof(unsigned long) * 8); cs->flags = CLOCK_SOURCE_IS_CONTINUOUS; + + /* clk_get_rate() needs an enabled clock */ + clk_enable(p->clk); + p->rate = clk_get_rate(p->clk) / (p->width == 16) ? 512 : 8; + clk_disable(p->clk); + + /* TODO: calculate good shift from rate and counter bit width */ + cs->shift = 10; + cs->mult = clocksource_hz2mult(p->rate, cs->shift); + pr_info("sh_cmt: %s used as clock source\n", cs->name); + clocksource_register(cs); return 0; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 105/164] gconfig: fix build failure on fedora 13 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (103 preceding siblings ...) 2010-07-01 17:34 ` [patch 104/164] clocksource: sh_cmt: " Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 106/164] arch/x86/kernel: Add missing spin_unlock Greg KH ` (58 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Richard Kennedy, Michal Marek 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Richard Kennedy <richard@rsk.demon.co.uk> commit cbab05f041a4cff6ca15856bdd35238b282b64eb upstream. Making gconfig fails on fedora 13 as the linker cannot resolve dlsym. Adding libdl to the link command fixes this. make shows this error :- /usr/bin/ld: scripts/kconfig/kconfig_load.o: undefined reference to symbol 'dlsym@@GLIBC_2.2.5' /usr/bin/ld: note: 'dlsym@@GLIBC_2.2.5' is defined in DSO /lib64/libdl.so.2 so try adding it to the linker command line /lib64/libdl.so.2: could not read symbols: Invalid operation tested on x86_64 fedora 13. Signed-off-by: Richard Kennedy <richard@rsk.demon.co.uk> Reviewed-by: WANG Cong <xiyou.wangcong@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Michal Marek <mmarek@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- scripts/kconfig/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/scripts/kconfig/Makefile +++ b/scripts/kconfig/Makefile @@ -198,7 +198,7 @@ HOSTCFLAGS_zconf.tab.o := -I$(src) HOSTLOADLIBES_qconf = $(KC_QT_LIBS) -ldl HOSTCXXFLAGS_qconf.o = $(KC_QT_CFLAGS) -D LKC_DIRECT_LINK -HOSTLOADLIBES_gconf = `pkg-config --libs gtk+-2.0 gmodule-2.0 libglade-2.0` +HOSTLOADLIBES_gconf = `pkg-config --libs gtk+-2.0 gmodule-2.0 libglade-2.0` -ldl HOSTCFLAGS_gconf.o = `pkg-config --cflags gtk+-2.0 gmodule-2.0 libglade-2.0` \ -D LKC_DIRECT_LINK ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 106/164] arch/x86/kernel: Add missing spin_unlock 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (104 preceding siblings ...) 2010-07-01 17:34 ` [patch 105/164] gconfig: fix build failure on fedora 13 Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 107/164] ath5k: retain promiscuous setting Greg KH ` (57 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Julia Lawall, Joerg Roedel 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Julia Lawall <julia@diku.dk> commit 84fe6c19e4a598e8071e3bd1b2c923454eae1268 upstream. Add a spin_unlock missing on the error path. The locks and unlocks are balanced in other functions, so it seems that the same should be the case here. The semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression E1; @@ * spin_lock(E1,...); <+... when != E1 if (...) { ... when != E1 * return ...; } ...+> * spin_unlock(E1,...); // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/kernel/amd_iommu.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) --- a/arch/x86/kernel/amd_iommu.c +++ b/arch/x86/kernel/amd_iommu.c @@ -1419,6 +1419,7 @@ static int __attach_device(struct device struct protection_domain *domain) { struct iommu_dev_data *dev_data, *alias_data; + int ret; dev_data = get_dev_data(dev); alias_data = get_dev_data(dev_data->alias); @@ -1430,13 +1431,14 @@ static int __attach_device(struct device spin_lock(&domain->lock); /* Some sanity checks */ + ret = -EBUSY; if (alias_data->domain != NULL && alias_data->domain != domain) - return -EBUSY; + goto out_unlock; if (dev_data->domain != NULL && dev_data->domain != domain) - return -EBUSY; + goto out_unlock; /* Do real assignment */ if (dev_data->alias != dev) { @@ -1452,10 +1454,14 @@ static int __attach_device(struct device atomic_inc(&dev_data->bind); + ret = 0; + +out_unlock: + /* ready */ spin_unlock(&domain->lock); - return 0; + return ret; } /* ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 107/164] ath5k: retain promiscuous setting 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (105 preceding siblings ...) 2010-07-01 17:34 ` [patch 106/164] arch/x86/kernel: Add missing spin_unlock Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 108/164] ahci: add pci quirk for JMB362 Greg KH ` (56 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Bob Copeland, John W. Linville 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bob Copeland <me@bobcopeland.com> commit 6b5dcccb495b66b3b0b9581cdccfed038e5d68a2 upstream. Commit 56d1de0a21db28e41741cfa0a66e18bc8d920554, "ath5k: clean up filter flags setting" introduced a regression in monitor mode such that the promisc filter flag would get lost. Although we set the promisc flag when it changed, we did not preserve it across subsequent calls to configure_filter. This patch restores the original functionality. Bisected-by: weedy2887@gmail.com Tested-by: weedy2887@gmail.com Tested-by: Rick Farina <sidhayn@gmail.com> Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/ath/ath5k/base.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/net/wireless/ath/ath5k/base.c +++ b/drivers/net/wireless/ath/ath5k/base.c @@ -2997,13 +2997,15 @@ static void ath5k_configure_filter(struc if (changed_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS)) { if (*new_flags & FIF_PROMISC_IN_BSS) { - rfilt |= AR5K_RX_FILTER_PROM; __set_bit(ATH_STAT_PROMISC, sc->status); } else { __clear_bit(ATH_STAT_PROMISC, sc->status); } } + if (test_bit(ATH_STAT_PROMISC, sc->status)) + rfilt |= AR5K_RX_FILTER_PROM; + /* Note, AR5K_RX_FILTER_MCAST is already enabled */ if (*new_flags & FIF_ALLMULTI) { mfilt[0] = ~0; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 108/164] ahci: add pci quirk for JMB362 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (106 preceding siblings ...) 2010-07-01 17:34 ` [patch 107/164] ath5k: retain promiscuous setting Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 109/164] firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder Greg KH ` (55 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Jeff Garzik 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tejun Heo <tj@kernel.org> commit 4daedcfe8c6851aa01cc1997220f2577f4039c13 upstream. JMB362 is a new variant of jmicron controller which is similar to JMB360 but has two SATA ports instead of one. As there is no PATA port, single function AHCI mode can be used as in JMB360. Add pci quirk for JMB362. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Aries Lee <arieslee@jmicron.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/pci/quirks.c | 5 ++++- include/linux/pci_ids.h | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -1461,7 +1461,8 @@ static void quirk_jmicron_ata(struct pci conf5 &= ~(1 << 24); /* Clear bit 24 */ switch (pdev->device) { - case PCI_DEVICE_ID_JMICRON_JMB360: + case PCI_DEVICE_ID_JMICRON_JMB360: /* SATA single port */ + case PCI_DEVICE_ID_JMICRON_JMB362: /* SATA dual ports */ /* The controller should be in single function ahci mode */ conf1 |= 0x0002A100; /* Set 8, 13, 15, 17 */ break; @@ -1497,12 +1498,14 @@ static void quirk_jmicron_ata(struct pci } DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB360, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, quirk_jmicron_ata); +DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB362, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB360, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, quirk_jmicron_ata); +DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB362, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, quirk_jmicron_ata); --- a/include/linux/pci_ids.h +++ b/include/linux/pci_ids.h @@ -2322,6 +2322,7 @@ #define PCI_VENDOR_ID_JMICRON 0x197B #define PCI_DEVICE_ID_JMICRON_JMB360 0x2360 #define PCI_DEVICE_ID_JMICRON_JMB361 0x2361 +#define PCI_DEVICE_ID_JMICRON_JMB362 0x2362 #define PCI_DEVICE_ID_JMICRON_JMB363 0x2363 #define PCI_DEVICE_ID_JMICRON_JMB365 0x2365 #define PCI_DEVICE_ID_JMICRON_JMB366 0x2366 ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 109/164] firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (107 preceding siblings ...) 2010-07-01 17:34 ` [patch 108/164] ahci: add pci quirk for JMB362 Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 110/164] perf_events: Fix resource leak in x86 __hw_perf_event_init() Greg KH ` (54 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Stefan Richter 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Stefan Richter <stefanr@s5r6.in-berlin.de> commit 10389536742cefbedecb67a5b2906f155cf3a1c3 upstream. Per IEEE 1394 clause 8.4.2.3, a contender for the IRM role shall check whether the current IRM complies to 1394a-2000 or later. If not force a compliant node (e.g. itself) to become IRM. This was implemented in the older ieee1394 driver but not yet in firewire-core. An older Sony camcorder (Sony DCR-TRV25) which implements 1394-1995 IRM but neither 1394a-2000 IRM nor BM was now found to cause an interoperability bug: - Camcorder becomes root node when plugged in, hence gets IRM role. - firewire-core successfully contends for BM role, proceeds to perform gap count optimization and resets the bus. - Sony camcorder ignores presence of a BM (against the spec, this is a firmware bug), performs its idea of gap count optimization and resets the bus. - Preceding two steps are repeated endlessly, bus never settles, regular I/O is practically impossible. http://thread.gmane.org/gmane.linux.kernel.firewire.user/3913 This is an interoperability regression from the old to the new drivers. Fix it indirectly by adding the 1394a IRM check. The spec suggests three and a half methods to determine 1394a compliance of a remote IRM; we choose the method of testing the Config_ROM.Bus_Info.generation field. This is data that firewire-core should have readily available at this point, i.e. does not require extra I/O. Reported-by: Clemens Ladisch <clemens@ladisch.de> (missing 1394a check) Reported-by: H. S. <hs.samix@gmail.com> (issue with Sony DCR-TRV25) Tested-by: H. S. <hs.samix@gmail.com> Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/firewire/core-card.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) --- a/drivers/firewire/core-card.c +++ b/drivers/firewire/core-card.c @@ -231,7 +231,7 @@ void fw_schedule_bm_work(struct fw_card static void fw_card_bm_work(struct work_struct *work) { struct fw_card *card = container_of(work, struct fw_card, work.work); - struct fw_device *root_device; + struct fw_device *root_device, *irm_device; struct fw_node *root_node; unsigned long flags; int root_id, new_root_id, irm_id, local_id; @@ -239,6 +239,7 @@ static void fw_card_bm_work(struct work_ bool do_reset = false; bool root_device_is_running; bool root_device_is_cmc; + bool irm_is_1394_1995_only; spin_lock_irqsave(&card->lock, flags); @@ -248,12 +249,18 @@ static void fw_card_bm_work(struct work_ } generation = card->generation; + root_node = card->root_node; fw_node_get(root_node); root_device = root_node->data; root_device_is_running = root_device && atomic_read(&root_device->state) == FW_DEVICE_RUNNING; root_device_is_cmc = root_device && root_device->cmc; + + irm_device = card->irm_node->data; + irm_is_1394_1995_only = irm_device && irm_device->config_rom && + (irm_device->config_rom[2] & 0x000000f0) == 0; + root_id = root_node->node_id; irm_id = card->irm_node->node_id; local_id = card->local_node->node_id; @@ -276,8 +283,15 @@ static void fw_card_bm_work(struct work_ if (!card->irm_node->link_on) { new_root_id = local_id; - fw_notify("IRM has link off, making local node (%02x) root.\n", - new_root_id); + fw_notify("%s, making local node (%02x) root.\n", + "IRM has link off", new_root_id); + goto pick_me; + } + + if (irm_is_1394_1995_only) { + new_root_id = local_id; + fw_notify("%s, making local node (%02x) root.\n", + "IRM is not 1394a compliant", new_root_id); goto pick_me; } @@ -316,8 +330,8 @@ static void fw_card_bm_work(struct work_ * root, and thus, IRM. */ new_root_id = local_id; - fw_notify("BM lock failed, making local node (%02x) root.\n", - new_root_id); + fw_notify("%s, making local node (%02x) root.\n", + "BM lock failed", new_root_id); goto pick_me; } } else if (card->bm_generation != generation) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 110/164] perf_events: Fix resource leak in x86 __hw_perf_event_init() 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (108 preceding siblings ...) 2010-07-01 17:34 ` [patch 109/164] firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 111/164] sata_nv: dont diddle with nIEN on mcp55 Greg KH ` (53 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Stephane Eranian, peterz, paulus, davem, fweisbec, robert.richter, perfmon2-devel, Ingo Molnar 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Stephane Eranian <eranian@google.com> commit 4b24a88b35e15e04bd8f2c5dda65b5dc8ebca05f upstream. If reserve_pmc_hardware() succeeds but reserve_ds_buffers() fails, then we need to release_pmc_hardware. It won't be done by the destroy() callback because we return before setting it in case of error. Signed-off-by: Stephane Eranian <eranian@google.com> Cc: peterz@infradead.org Cc: paulus@samba.org Cc: davem@davemloft.net Cc: fweisbec@gmail.com Cc: robert.richter@amd.com Cc: perfmon2-devel@lists.sf.net LKML-Reference: <4ba1568b.15185e0a.182a.7802@mx.google.com> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/kernel/cpu/perf_event.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/arch/x86/kernel/cpu/perf_event.c +++ b/arch/x86/kernel/cpu/perf_event.c @@ -1060,8 +1060,11 @@ static int __hw_perf_event_init(struct p if (atomic_read(&active_events) == 0) { if (!reserve_pmc_hardware()) err = -EBUSY; - else + else { err = reserve_bts_hardware(); + if (err) + release_pmc_hardware(); + } } if (!err) atomic_inc(&active_events); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 111/164] sata_nv: dont diddle with nIEN on mcp55 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (109 preceding siblings ...) 2010-07-01 17:34 ` [patch 110/164] perf_events: Fix resource leak in x86 __hw_perf_event_init() Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 112/164] sata_via: magic vt6421 fix for transmission problems w/ WD drives Greg KH ` (52 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Jeff Garzik [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 1774 bytes --] 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tejun Heo <tj@kernel.org> commit f3faf8fc3fab45c3526efe8c9e99bb23f8723350 upstream. On mcp55, nIEN gets stuck once set and liteon blueray rom iHOS104-08 violates ATA specification and fails to set I on D2H Reg FIS if nIEN is set when the command was issued. When the other party is following the spec, both devices can work fine but when the two flaws are put together, they can't talk to each other. mcp55 has its own IRQ masking mechanism and there's no reason to mess with nIEN in the first place. Fix it by dropping nIEN diddling from nv_mcp55_freeze/thaw(). This was originally reported by Cengiz. Although Cengiz hasn't verified the fix yet, I could reproduce this problem and verfiy the fix. Even if Cengiz is experiencing different or additional problems, this patch is needed. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Cengiz Günay <cgunay@emory.edu> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/sata_nv.c | 2 -- 1 file changed, 2 deletions(-) --- a/drivers/ata/sata_nv.c +++ b/drivers/ata/sata_nv.c @@ -1673,7 +1673,6 @@ static void nv_mcp55_freeze(struct ata_p mask = readl(mmio_base + NV_INT_ENABLE_MCP55); mask &= ~(NV_INT_ALL_MCP55 << shift); writel(mask, mmio_base + NV_INT_ENABLE_MCP55); - ata_sff_freeze(ap); } static void nv_mcp55_thaw(struct ata_port *ap) @@ -1687,7 +1686,6 @@ static void nv_mcp55_thaw(struct ata_por mask = readl(mmio_base + NV_INT_ENABLE_MCP55); mask |= (NV_INT_MASK_MCP55 << shift); writel(mask, mmio_base + NV_INT_ENABLE_MCP55); - ata_sff_thaw(ap); } static void nv_adma_error_handler(struct ata_port *ap) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 112/164] sata_via: magic vt6421 fix for transmission problems w/ WD drives 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (110 preceding siblings ...) 2010-07-01 17:34 ` [patch 111/164] sata_nv: dont diddle with nIEN on mcp55 Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:34 ` [patch 113/164] drm/i915: Rebind bo if currently bound with incorrect alignment Greg KH ` (51 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Jeff Garzik 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tejun Heo <tj@kernel.org> commit 8b27ff4cf6d15964aa2987aeb58db4dfb1f87a19 upstream. vt6421 has problems talking to recent WD drives. It causes a lot of transmission errors while high bandwidth transfer as reported in the following bugzilla entry. https://bugzilla.kernel.org/show_bug.cgi?id=15173 Joseph Chan provided the following fix. I don't have any idea what it does but I can verify the issue is gone with the patch applied. Signed-off-by: Tejun Heo <tj@kernel.org> Originally-from: Joseph Chan <JosephChan@via.com.tw> Reported-by: Jorrit Tijben <sjorrit@gmail.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/sata_via.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) --- a/drivers/ata/sata_via.c +++ b/drivers/ata/sata_via.c @@ -558,6 +558,19 @@ static void svia_configure(struct pci_de tmp8 |= NATIVE_MODE_ALL; pci_write_config_byte(pdev, SATA_NATIVE_MODE, tmp8); } + + /* + * vt6421 has problems talking to some drives. The following + * is the magic fix from Joseph Chan <JosephChan@via.com.tw>. + * Please add proper documentation if possible. + * + * https://bugzilla.kernel.org/show_bug.cgi?id=15173 + */ + if (pdev->device == 0x3249) { + pci_read_config_byte(pdev, 0x52, &tmp8); + tmp8 |= 1 << 2; + pci_write_config_byte(pdev, 0x52, tmp8); + } } static int svia_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 113/164] drm/i915: Rebind bo if currently bound with incorrect alignment. 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (111 preceding siblings ...) 2010-07-01 17:34 ` [patch 112/164] sata_via: magic vt6421 fix for transmission problems w/ WD drives Greg KH @ 2010-07-01 17:34 ` Greg KH 2010-07-01 17:35 ` [patch 114/164] USB: mos7840: fix null-pointer dereference Greg KH ` (50 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:34 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Chris Wilson, Eric Anholt 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chris Wilson <chris@chris-wilson.co.uk> commit ac0c6b5ad3b3b513e1057806d4b7627fcc0ecc27 upstream. Whilst pinning the buffer, check that that its current alignment matches the requested alignment. If it does not, rebind. This should clear up any final render errors whilst resuming, for reference: Bug 27070 - [i915] Page table errors with empty ringbuffer https://bugs.freedesktop.org/show_bug.cgi?id=27070 Bug 15502 - render error detected, EIR: 0x00000010 https://bugzilla.kernel.org/show_bug.cgi?id=15502 Bug 13844 - i915 error: "render error detected" https://bugzilla.kernel.org/show_bug.cgi?id=13844 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/i915/i915_gem.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -4183,6 +4183,17 @@ i915_gem_object_pin(struct drm_gem_objec int ret; i915_verify_inactive(dev, __FILE__, __LINE__); + + if (obj_priv->gtt_space != NULL) { + if (alignment == 0) + alignment = i915_gem_get_gtt_alignment(obj); + if (obj_priv->gtt_offset & (alignment - 1)) { + ret = i915_gem_object_unbind(obj); + if (ret) + return ret; + } + } + if (obj_priv->gtt_space == NULL) { ret = i915_gem_object_bind_to_gtt(obj, alignment); if (ret) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 114/164] USB: mos7840: fix null-pointer dereference 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (112 preceding siblings ...) 2010-07-01 17:34 ` [patch 113/164] drm/i915: Rebind bo if currently bound with incorrect alignment Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 115/164] USB: xhci: Wait for host to start running Greg KH ` (49 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit b41709f1263bb1ad37efc43fea0bb0b670c12e78 upstream. Fix null-pointer dereference on error path. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/mos7840.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/usb/serial/mos7840.c +++ b/drivers/usb/serial/mos7840.c @@ -717,7 +717,6 @@ static void mos7840_bulk_in_callback(str mos7840_port = urb->context; if (!mos7840_port) { dbg("%s", "NULL mos7840_port pointer"); - mos7840_port->read_urb_busy = false; return; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 115/164] USB: xhci: Wait for host to start running. 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (113 preceding siblings ...) 2010-07-01 17:35 ` [patch 114/164] USB: mos7840: fix null-pointer dereference Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 116/164] USB: xhci: Wait for controller to be ready after reset Greg KH ` (48 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sarah Sharp <sarah.a.sharp@linux.intel.com> commit ed07453fd356025cc25272629e982f5e4607632c upstream. When the run bit is set in the xHCI command register, it may take a few microseconds for the host to start running. We cannot ring any doorbells until the host is actually running, so wait until the status register says the host is running. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Reported-by: Shinya Saito <shinya.saito.sx@renesas.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-hcd.c | 39 ++++++++++++++++++++++++++++++++------- 1 file changed, 32 insertions(+), 7 deletions(-) --- a/drivers/usb/host/xhci-hcd.c +++ b/drivers/usb/host/xhci-hcd.c @@ -104,6 +104,33 @@ int xhci_halt(struct xhci_hcd *xhci) } /* + * Set the run bit and wait for the host to be running. + */ +int xhci_start(struct xhci_hcd *xhci) +{ + u32 temp; + int ret; + + temp = xhci_readl(xhci, &xhci->op_regs->command); + temp |= (CMD_RUN); + xhci_dbg(xhci, "// Turn on HC, cmd = 0x%x.\n", + temp); + xhci_writel(xhci, temp, &xhci->op_regs->command); + + /* + * Wait for the HCHalted Status bit to be 0 to indicate the host is + * running. + */ + ret = handshake(xhci, &xhci->op_regs->status, + STS_HALT, 0, XHCI_MAX_HALT_USEC); + if (ret == -ETIMEDOUT) + xhci_err(xhci, "Host took too long to start, " + "waited %u microseconds.\n", + XHCI_MAX_HALT_USEC); + return ret; +} + +/* * Reset a halted HC, and set the internal HC state to HC_STATE_HALT. * * This resets pipelines, timers, counters, state machines, etc. @@ -451,13 +478,11 @@ int xhci_run(struct usb_hcd *hcd) if (NUM_TEST_NOOPS > 0) doorbell = xhci_setup_one_noop(xhci); - temp = xhci_readl(xhci, &xhci->op_regs->command); - temp |= (CMD_RUN); - xhci_dbg(xhci, "// Turn on HC, cmd = 0x%x.\n", - temp); - xhci_writel(xhci, temp, &xhci->op_regs->command); - /* Flush PCI posted writes */ - temp = xhci_readl(xhci, &xhci->op_regs->command); + if (xhci_start(xhci)) { + xhci_halt(xhci); + return -ENODEV; + } + xhci_dbg(xhci, "// @%p = 0x%x\n", &xhci->op_regs->command, temp); if (doorbell) (*doorbell)(xhci); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 116/164] USB: xhci: Wait for controller to be ready after reset. 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (114 preceding siblings ...) 2010-07-01 17:35 ` [patch 115/164] USB: xhci: Wait for host to start running Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 117/164] USB: ftdi_sio: fix DTR/RTS line modes Greg KH ` (47 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sarah Sharp <sarah.a.sharp@linux.intel.com> commit 2d62f3eea98354d61f90d6b115eecf9be5f4bdfe upstream. After software resets an xHCI host controller, it must wait for the "Controller Not Ready" (CNR) bit in the status register to be cleared. Software is not supposed to ring any doorbells or write to any registers except the status register until this bit is cleared. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-hcd.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) --- a/drivers/usb/host/xhci-hcd.c +++ b/drivers/usb/host/xhci-hcd.c @@ -141,6 +141,7 @@ int xhci_reset(struct xhci_hcd *xhci) { u32 command; u32 state; + int ret; state = xhci_readl(xhci, &xhci->op_regs->status); if ((state & STS_HALT) == 0) { @@ -155,7 +156,17 @@ int xhci_reset(struct xhci_hcd *xhci) /* XXX: Why does EHCI set this here? Shouldn't other code do this? */ xhci_to_hcd(xhci)->state = HC_STATE_HALT; - return handshake(xhci, &xhci->op_regs->command, CMD_RESET, 0, 250 * 1000); + ret = handshake(xhci, &xhci->op_regs->command, + CMD_RESET, 0, 250 * 1000); + if (ret) + return ret; + + xhci_dbg(xhci, "Wait for controller to be ready for doorbell rings\n"); + /* + * xHCI cannot write to any doorbells or operational registers other + * than status until the "Controller Not Ready" flag is cleared. + */ + return handshake(xhci, &xhci->op_regs->status, STS_CNR, 0, 250 * 1000); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 117/164] USB: ftdi_sio: fix DTR/RTS line modes 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (115 preceding siblings ...) 2010-07-01 17:35 ` [patch 116/164] USB: xhci: Wait for controller to be ready after reset Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 118/164] USB: cdc-acm: fix resource reclaim in error path of acm_probe Greg KH ` (46 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel Mack, Johan Hovold, Alan Cox 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel Mack <daniel@caiaq.de> commit 6a1a82df91fa0eb1cc76069a9efe5714d087eccd upstream. Call set_mctrl() and clear_mctrl() according to the flow control mode selected. This makes serial communication for FT232 connected devices work when CRTSCTS is not set. This fixes a regression introduced by 4175f3e31 ("tty_port: If we are opened non blocking we still need to raise the carrier"). This patch calls the low-level driver's dtr_rts() function which consequently sets TIOCM_DTR | TIOCM_RTS. A later call to set_termios() without CRTSCTS in cflags, however, does not reset these bits, and so data is not actually sent out on the serial wire. Signed-off-by: Daniel Mack <daniel@caiaq.de> Cc: Johan Hovold <jhovold@gmail.com> Cc: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/ftdi_sio.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/usb/serial/ftdi_sio.c +++ b/drivers/usb/serial/ftdi_sio.c @@ -2312,6 +2312,8 @@ static void ftdi_set_termios(struct tty_ "urb failed to set to rts/cts flow control\n"); } + /* raise DTR/RTS */ + set_mctrl(port, TIOCM_DTR | TIOCM_RTS); } else { /* * Xon/Xoff code @@ -2359,6 +2361,8 @@ static void ftdi_set_termios(struct tty_ } } + /* lower DTR/RTS */ + clear_mctrl(port, TIOCM_DTR | TIOCM_RTS); } return; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 118/164] USB: cdc-acm: fix resource reclaim in error path of acm_probe 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (116 preceding siblings ...) 2010-07-01 17:35 ` [patch 117/164] USB: ftdi_sio: fix DTR/RTS line modes Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 119/164] p54usb: Add device ID for Dell WLA3310 USB Greg KH ` (45 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Axel Lin, Oliver Neukum 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Axel Lin <axel.lin@gmail.com> commit c2572b78aa0447244a38e555ebb1b3b48a0088a5 upstream. This patch fixes resource reclaim in error path of acm_probe: 1. In the case of "out of memory (read urbs usb_alloc_urb)\n")", there is no need to call acm_read_buffers_free(acm) here. Fix it by goto alloc_fail6 instead of alloc_fail7. 2. In the case of "out of memory (write urbs usb_alloc_urb)", usb_alloc_urb may fail in any iteration of the for loop. Current implementation does not properly free allocated snd->urb. Fix it by goto alloc_fail8 instead of alloc_fail7. 3. In the case of device_create_file(&intf->dev,&dev_attr_iCountryCodeRelDate) fail, acm->country_codes is kfreed. As a result, device_remove_file for dev_attr_wCountryCodes will not be executed in acm_disconnect. Fix it by calling device_remove_file for dev_attr_wCountryCodes before goto skip_countries. Signed-off-by: Axel Lin <axel.lin@gmail.com> Acked-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/class/cdc-acm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -1201,7 +1201,7 @@ made_compressed_probe: if (rcv->urb == NULL) { dev_dbg(&intf->dev, "out of memory (read urbs usb_alloc_urb)\n"); - goto alloc_fail7; + goto alloc_fail6; } rcv->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; @@ -1225,7 +1225,7 @@ made_compressed_probe: if (snd->urb == NULL) { dev_dbg(&intf->dev, "out of memory (write urbs usb_alloc_urb)"); - goto alloc_fail7; + goto alloc_fail8; } if (usb_endpoint_xfer_int(epwrite)) @@ -1264,6 +1264,7 @@ made_compressed_probe: i = device_create_file(&intf->dev, &dev_attr_iCountryCodeRelDate); if (i < 0) { + device_remove_file(&intf->dev, &dev_attr_wCountryCodes); kfree(acm->country_codes); goto skip_countries; } @@ -1300,6 +1301,7 @@ alloc_fail8: usb_free_urb(acm->wb[i].urb); alloc_fail7: acm_read_buffers_free(acm); +alloc_fail6: for (i = 0; i < num_rx_buf; i++) usb_free_urb(acm->ru[i].urb); usb_free_urb(acm->ctrlurb); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 119/164] p54usb: Add device ID for Dell WLA3310 USB 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (117 preceding siblings ...) 2010-07-01 17:35 ` [patch 118/164] USB: cdc-acm: fix resource reclaim in error path of acm_probe Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 120/164] wireless: report reasonable bitrate for MCS rates through wext Greg KH ` (44 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jason Dravet, Larry Finger, Christian Lamparter, John W. Linville 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jason Dravet <dravet@hotmail.com> commit 0f666a08901f8b01f294ca0ad751019375240ae3 upstream. Add Dell WLA3310 USB wireless card, which has a Z-Com XG-705A chipset, to the USB Ids in p54usb. Signed-off-by: Jason Dravet <dravet@hotmail.com> Tested-by: Richard Gregory Tillmore <rtillmore@gmail.com> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Acked-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/p54/p54usb.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/wireless/p54/p54usb.c +++ b/drivers/net/wireless/p54/p54usb.c @@ -78,6 +78,7 @@ static struct usb_device_id p54u_table[] {USB_DEVICE(0x1413, 0x5400)}, /* Telsey 802.11g USB2.0 Adapter */ {USB_DEVICE(0x1435, 0x0427)}, /* Inventel UR054G */ {USB_DEVICE(0x2001, 0x3704)}, /* DLink DWL-G122 rev A2 */ + {USB_DEVICE(0x413c, 0x5513)}, /* Dell WLA3310 USB Wireless Adapter */ {USB_DEVICE(0x413c, 0x8102)}, /* Spinnaker DUT */ {USB_DEVICE(0x413c, 0x8104)}, /* Cohiba Proto board */ {} ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 120/164] wireless: report reasonable bitrate for MCS rates through wext 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (118 preceding siblings ...) 2010-07-01 17:35 ` [patch 119/164] p54usb: Add device ID for Dell WLA3310 USB Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 121/164] wrong type for magic argument in simple_fill_super() Greg KH ` (43 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, John W. Linville, Ben Hutchings 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: John W. Linville <linville@tuxdriver.com> commit 254416aae70ab2e6b57fd79782c8a67196234d02 upstream. Previously, cfg80211 had reported "0" for MCS (i.e. 802.11n) bitrates through the wireless extensions interface. However, nl80211 was converting MCS rates into a reasonable bitrate number. This patch moves the nl80211 code to cfg80211 where it is now shared between both the nl80211 interface and the wireless extensions interface. Signed-off-by: John W. Linville <linville@tuxdriver.com> Cc: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- a/net/wireless/core.h +++ b/net/wireless/core.h @@ -378,6 +378,8 @@ int rdev_set_freq(struct cfg80211_registered_device *rdev, struct wireless_dev *for_wdev, int freq, enum nl80211_channel_type channel_type); +u16 cfg80211_calculate_bitrate(struct rate_info *rate); + #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS #define CFG80211_DEV_WARN_ON(cond) WARN_ON(cond) #else diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index a602843..7cb0d64 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -1637,39 +1637,6 @@ static int parse_station_flags(struct genl_info *info, return 0; } -static u16 nl80211_calculate_bitrate(struct rate_info *rate) -{ - int modulation, streams, bitrate; - - if (!(rate->flags & RATE_INFO_FLAGS_MCS)) - return rate->legacy; - - /* the formula below does only work for MCS values smaller than 32 */ - if (rate->mcs >= 32) - return 0; - - modulation = rate->mcs & 7; - streams = (rate->mcs >> 3) + 1; - - bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ? - 13500000 : 6500000; - - if (modulation < 4) - bitrate *= (modulation + 1); - else if (modulation == 4) - bitrate *= (modulation + 2); - else - bitrate *= (modulation + 3); - - bitrate *= streams; - - if (rate->flags & RATE_INFO_FLAGS_SHORT_GI) - bitrate = (bitrate / 9) * 10; - - /* do NOT round down here */ - return (bitrate + 50000) / 100000; -} - static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq, int flags, struct net_device *dev, u8 *mac_addr, struct station_info *sinfo) @@ -1716,8 +1683,8 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq, if (!txrate) goto nla_put_failure; - /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */ - bitrate = nl80211_calculate_bitrate(&sinfo->txrate); + /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */ + bitrate = cfg80211_calculate_bitrate(&sinfo->txrate); if (bitrate > 0) NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate); diff --git a/net/wireless/util.c b/net/wireless/util.c index 59361fd..a3c841a 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -720,3 +720,36 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev, return err; } + +u16 cfg80211_calculate_bitrate(struct rate_info *rate) +{ + int modulation, streams, bitrate; + + if (!(rate->flags & RATE_INFO_FLAGS_MCS)) + return rate->legacy; + + /* the formula below does only work for MCS values smaller than 32 */ + if (rate->mcs >= 32) + return 0; + + modulation = rate->mcs & 7; + streams = (rate->mcs >> 3) + 1; + + bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ? + 13500000 : 6500000; + + if (modulation < 4) + bitrate *= (modulation + 1); + else if (modulation == 4) + bitrate *= (modulation + 2); + else + bitrate *= (modulation + 3); + + bitrate *= streams; + + if (rate->flags & RATE_INFO_FLAGS_SHORT_GI) + bitrate = (bitrate / 9) * 10; + + /* do NOT round down here */ + return (bitrate + 50000) / 100000; +} diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c index 584eb48..2fa8de1 100644 --- a/net/wireless/wext-compat.c +++ b/net/wireless/wext-compat.c @@ -1256,10 +1256,7 @@ int cfg80211_wext_giwrate(struct net_device *dev, if (!(sinfo.filled & STATION_INFO_TX_BITRATE)) return -EOPNOTSUPP; - rate->value = 0; - - if (!(sinfo.txrate.flags & RATE_INFO_FLAGS_MCS)) - rate->value = 100000 * sinfo.txrate.legacy; + rate->value = 100000 * cfg80211_calculate_bitrate(&sinfo.txrate); return 0; } ^ permalink raw reply related [flat|nested] 666+ messages in thread
* [patch 121/164] wrong type for magic argument in simple_fill_super() 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (119 preceding siblings ...) 2010-07-01 17:35 ` [patch 120/164] wireless: report reasonable bitrate for MCS rates through wext Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 122/164] cfq-iosched: fix an oops caused by slab leak Greg KH ` (42 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Roberto Sassu, Eric Paris, Al Viro 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Roberto Sassu <roberto.sassu@polito.it> commit 7d683a09990ff095a91b6e724ecee0ff8733274a upstream. It's used to superblock ->s_magic, which is unsigned long. Signed-off-by: Roberto Sassu <roberto.sassu@polito.it> Reviewed-by: Mimi Zohar <zohar@us.ibm.com> Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/libfs.c | 3 ++- include/linux/fs.h | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) --- a/fs/libfs.c +++ b/fs/libfs.c @@ -415,7 +415,8 @@ int simple_write_end(struct file *file, * unique inode values later for this filesystem, then you must take care * to pass it an appropriate max_reserved value to avoid collisions. */ -int simple_fill_super(struct super_block *s, int magic, struct tree_descr *files) +int simple_fill_super(struct super_block *s, unsigned long magic, + struct tree_descr *files) { struct inode *inode; struct dentry *root; --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2359,7 +2359,7 @@ extern const struct file_operations simp extern const struct inode_operations simple_dir_inode_operations; struct tree_descr { char *name; const struct file_operations *ops; int mode; }; struct dentry *d_alloc_name(struct dentry *, const char *); -extern int simple_fill_super(struct super_block *, int, struct tree_descr *); +extern int simple_fill_super(struct super_block *, unsigned long, struct tree_descr *); extern int simple_pin_fs(struct file_system_type *, struct vfsmount **mount, int *count); extern void simple_release_fs(struct vfsmount **mount, int *count); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 122/164] cfq-iosched: fix an oops caused by slab leak 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (120 preceding siblings ...) 2010-07-01 17:35 ` [patch 121/164] wrong type for magic argument in simple_fill_super() Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 123/164] iwlwifi: reset card during probe Greg KH ` (41 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Shaohua Li, Jens Axboe 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shaohua Li <shaohua.li@intel.com> commit d02a2c077fb81f3224c770be62a318165b23b486 upstream. I got below oops when unloading cfq-iosched. Considering scenario: queue A merge to B, C merge to D and B will be merged to D. Before B is merged to D, we do split B. We should put B's reference for D. [ 807.768536] ============================================================================= [ 807.768539] BUG cfq_queue: Objects remaining on kmem_cache_close() [ 807.768541] ----------------------------------------------------------------------------- [ 807.768543] [ 807.768546] INFO: Slab 0xffffea0003e6b4e0 objects=26 used=1 fp=0xffff88011d584fd8 flags=0x200000000004082 [ 807.768550] Pid: 5946, comm: rmmod Tainted: G W 2.6.34-07097-gf4b87de-dirty #724 [ 807.768552] Call Trace: [ 807.768560] [<ffffffff81104e8d>] slab_err+0x8f/0x9d [ 807.768564] [<ffffffff811059e1>] ? flush_cpu_slab+0x0/0x93 [ 807.768569] [<ffffffff8164be52>] ? add_preempt_count+0xe/0xca [ 807.768572] [<ffffffff8164bd9c>] ? sub_preempt_count+0xe/0xb6 [ 807.768577] [<ffffffff81648871>] ? _raw_spin_unlock+0x15/0x30 [ 807.768580] [<ffffffff8164bd9c>] ? sub_preempt_count+0xe/0xb6 [ 807.768584] [<ffffffff811061bc>] list_slab_objects+0x9b/0x19f [ 807.768588] [<ffffffff8164bf0a>] ? add_preempt_count+0xc6/0xca [ 807.768591] [<ffffffff81109e27>] kmem_cache_destroy+0x13f/0x21d [ 807.768597] [<ffffffffa000ff13>] cfq_slab_kill+0x1a/0x43 [cfq_iosched] [ 807.768601] [<ffffffffa000ffcf>] cfq_exit+0x93/0x9e [cfq_iosched] [ 807.768606] [<ffffffff810973a2>] sys_delete_module+0x1b1/0x219 [ 807.768612] [<ffffffff8102fb5b>] system_call_fastpath+0x16/0x1b [ 807.768618] INFO: Object 0xffff88011d584618 @offset=1560 [ 807.768622] INFO: Allocated in cfq_get_queue+0x11e/0x274 [cfq_iosched] age=7173 cpu=1 pid=5496 [ 807.768626] ============================================================================= Signed-off-by: Shaohua Li <shaohua.li@intel.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- block/cfq-iosched.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) --- a/block/cfq-iosched.c +++ b/block/cfq-iosched.c @@ -2481,15 +2481,10 @@ static void cfq_free_io_context(struct i __call_for_each_cic(ioc, cic_free_func); } -static void cfq_exit_cfqq(struct cfq_data *cfqd, struct cfq_queue *cfqq) +static void cfq_put_cooperator(struct cfq_queue *cfqq) { struct cfq_queue *__cfqq, *next; - if (unlikely(cfqq == cfqd->active_queue)) { - __cfq_slice_expired(cfqd, cfqq, 0); - cfq_schedule_dispatch(cfqd); - } - /* * If this queue was scheduled to merge with another queue, be * sure to drop the reference taken on that queue (and others in @@ -2505,6 +2500,16 @@ static void cfq_exit_cfqq(struct cfq_dat cfq_put_queue(__cfqq); __cfqq = next; } +} + +static void cfq_exit_cfqq(struct cfq_data *cfqd, struct cfq_queue *cfqq) +{ + if (unlikely(cfqq == cfqd->active_queue)) { + __cfq_slice_expired(cfqd, cfqq, 0); + cfq_schedule_dispatch(cfqd); + } + + cfq_put_cooperator(cfqq); cfq_put_queue(cfqq); } @@ -3459,6 +3464,9 @@ split_cfqq(struct cfq_io_context *cic, s } cic_set_cfqq(cic, NULL, 1); + + cfq_put_cooperator(cfqq); + cfq_put_queue(cfqq); return NULL; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 123/164] iwlwifi: reset card during probe 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (121 preceding siblings ...) 2010-07-01 17:35 ` [patch 122/164] cfq-iosched: fix an oops caused by slab leak Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 124/164] iwlwifi: recalculate average tpt if not current Greg KH ` (40 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Reinette Chatre 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Reinette Chatre <reinette.chatre@intel.com> commit 4843b5a731b31916d100cfc5ba4d03ae78462ed9 upstream. To ensure that card is in a sane state during probe we add a reset call. This change was prompted by users of kdump who was not able to bring up the wireless driver in the kdump kernel. The problem here was that the primary kernel, which is not running at the time, left the wireless card up and running. When the kdump kernel starts it is thus possible to immediately receive interrupts from firmware after registering interrupt, but without being ready to deal with interrupts from firmware yet. Reported-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/iwlwifi/iwl-agn.c | 8 ++++++++ drivers/net/wireless/iwlwifi/iwl3945-base.c | 7 +++++++ 2 files changed, 15 insertions(+) --- a/drivers/net/wireless/iwlwifi/iwl-agn.c +++ b/drivers/net/wireless/iwlwifi/iwl-agn.c @@ -3365,6 +3365,14 @@ static int iwl_pci_probe(struct pci_dev */ spin_lock_init(&priv->reg_lock); spin_lock_init(&priv->lock); + + /* + * stop and reset the on-board processor just in case it is in a + * strange state ... like being left stranded by a primary kernel + * and this is now the kdump kernel trying to start up + */ + iwl_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET); + iwl_hw_detect(priv); IWL_INFO(priv, "Detected Intel Wireless WiFi Link %s REV=0x%X\n", priv->cfg->name, priv->hw_rev); --- a/drivers/net/wireless/iwlwifi/iwl3945-base.c +++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c @@ -4022,6 +4022,13 @@ static int iwl3945_pci_probe(struct pci_ spin_lock_init(&priv->reg_lock); spin_lock_init(&priv->lock); + /* + * stop and reset the on-board processor just in case it is in a + * strange state ... like being left stranded by a primary kernel + * and this is now the kdump kernel trying to start up + */ + iwl_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET); + /*********************** * 4. Read EEPROM * ********************/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 124/164] iwlwifi: recalculate average tpt if not current 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (122 preceding siblings ...) 2010-07-01 17:35 ` [patch 123/164] iwlwifi: reset card during probe Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 125/164] perf: Fix signed comparison in perf_adjust_period() Greg KH ` (39 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Reinette Chatre, John W. Linville 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Reinette Chatre <reinette.chatre@intel.com> commit 3d79b2a9eeaa066b35c49fbb17e3156a3c482c3e upstream. We currently have this check as a BUG_ON, which is being hit by people. Previously it was an error with a recalculation if not current, return that code. The BUG_ON was introduced by: commit 3110bef78cb4282c58245bc8fd6d95d9ccb19749 Author: Guy Cohen <guy.cohen@intel.com> Date: Tue Sep 9 10:54:54 2008 +0800 iwlwifi: Added support for 3 antennas ... the portion adding the BUG_ON is reverted since we are encountering the error and BUG_ON was created with assumption that error is not encountered. Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c +++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c @@ -2083,10 +2083,12 @@ static void rs_rate_scale_perform(struct } /* Else we have enough samples; calculate estimate of * actual average throughput */ - - /* Sanity-check TPT calculations */ - BUG_ON(window->average_tpt != ((window->success_ratio * - tbl->expected_tpt[index] + 64) / 128)); + if (window->average_tpt != ((window->success_ratio * + tbl->expected_tpt[index] + 64) / 128)) { + IWL_ERR(priv, "expected_tpt should have been calculated by now\n"); + window->average_tpt = ((window->success_ratio * + tbl->expected_tpt[index] + 64) / 128); + } /* If we are searching for better modulation mode, check success. */ if (lq_sta->search_better_tbl && ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 125/164] perf: Fix signed comparison in perf_adjust_period() 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (123 preceding siblings ...) 2010-07-01 17:35 ` [patch 124/164] iwlwifi: recalculate average tpt if not current Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 126/164] tracing: Fix null pointer deref with SEND_SIG_FORCED Greg KH ` (38 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Peter Zijlstra, Ingo Molnar 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Peter Zijlstra <a.p.zijlstra@chello.nl> commit f6ab91add6355e231e1c47897027b2a6ee4fa268 upstream. Frederic reported that frequency driven swevents didn't work properly and even caused a division-by-zero error. It turns out there are two bugs, the division-by-zero comes from a failure to deal with that in perf_calculate_period(). The other was more interesting and turned out to be a wrong comparison in perf_adjust_period(). The comparison was between an s64 and u64 and got implicitly converted to an unsigned comparison. The problem is that period_left is typically < 0, so it ended up being always true. Cure this by making the local period variables s64. Reported-by: Frederic Weisbecker <fweisbec@gmail.com> Tested-by: Frederic Weisbecker <fweisbec@gmail.com> Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> LKML-Reference: <new-submission> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/perf_event.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/kernel/perf_event.c +++ b/kernel/perf_event.c @@ -1417,13 +1417,16 @@ do { \ divisor = nsec * frequency; } + if (!divisor) + return dividend; + return div64_u64(dividend, divisor); } static void perf_adjust_period(struct perf_event *event, u64 nsec, u64 count) { struct hw_perf_event *hwc = &event->hw; - u64 period, sample_period; + s64 period, sample_period; s64 delta; period = perf_calculate_period(event, nsec, count); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 126/164] tracing: Fix null pointer deref with SEND_SIG_FORCED 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (124 preceding siblings ...) 2010-07-01 17:35 ` [patch 125/164] perf: Fix signed comparison in perf_adjust_period() Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 127/164] wl1251: fix a memory leak in probe Greg KH ` (37 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Oleg Nesterov, Roland McGrath, Steven Rostedt, Jason Baron, Masami Hiramatsu, Frederic Weisbecker 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Oleg Nesterov <oleg@redhat.com> commit b9b76dfaac6fa2c289ee8a005be637afd2da7e2f upstream. BUG: unable to handle kernel NULL pointer dereference at 0000000000000006 IP: [<ffffffff8107bd37>] ftrace_raw_event_signal_generate+0x87/0x140 TP_STORE_SIGINFO() forgets about SEND_SIG_FORCED, fix. We should probably export is_si_special() and change TP_STORE_SIGINFO() to use it in the longer term. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Roland McGrath <roland@redhat.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Jason Baron <jbaron@redhat.com> Cc: Masami Hiramatsu <mhiramat@redhat.com> LKML-Reference: <20100603213409.GA8307@redhat.com> Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- include/trace/events/signal.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/include/trace/events/signal.h +++ b/include/trace/events/signal.h @@ -10,7 +10,8 @@ #define TP_STORE_SIGINFO(__entry, info) \ do { \ - if (info == SEND_SIG_NOINFO) { \ + if (info == SEND_SIG_NOINFO || \ + info == SEND_SIG_FORCED) { \ __entry->errno = 0; \ __entry->code = SI_USER; \ } else if (info == SEND_SIG_PRIV) { \ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 127/164] wl1251: fix a memory leak in probe 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (125 preceding siblings ...) 2010-07-01 17:35 ` [patch 126/164] tracing: Fix null pointer deref with SEND_SIG_FORCED Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 128/164] ext4: check s_log_groups_per_flex in online resize code Greg KH ` (36 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Grazvydas Ignotas, Kalle Valo, John W. Linville 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Grazvydas Ignotas <notasas@gmail.com> commit aa679c36756003f1fabdb9fc6f00eb159559f7c3 upstream. wl1251_sdio_probe() error path is missing wl1251_free_hw, add it. Signed-off-by: Grazvydas Ignotas <notasas@gmail.com> Acked-by: Kalle Valo <kvalo@adurom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/wl12xx/wl1251_sdio.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/wireless/wl12xx/wl1251_sdio.c +++ b/drivers/net/wireless/wl12xx/wl1251_sdio.c @@ -160,6 +160,7 @@ disable: sdio_disable_func(func); release: sdio_release_host(func); + wl1251_free_hw(wl); return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 128/164] ext4: check s_log_groups_per_flex in online resize code 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (126 preceding siblings ...) 2010-07-01 17:35 ` [patch 127/164] wl1251: fix a memory leak in probe Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 129/164] ext4: Make sure the MOVE_EXT ioctl cant overwrite append-only files Greg KH ` (35 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Eric Sandeen, Theodore Tso 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Sandeen <sandeen@redhat.com> commit 42007efd569f1cf3bfb9a61da60ef6c2179508ca upstream. If groups_per_flex < 2, sbi->s_flex_groups[] doesn't get filled out, and every other access to this first tests s_log_groups_per_flex; same thing needs to happen in resize or we'll wander off into a null pointer when doing an online resize of the file system. Thanks to Christoph Biedl, who came up with the trivial testcase: # truncate --size 128M fsfile # mkfs.ext3 -F fsfile # tune2fs -O extents,uninit_bg,dir_index,flex_bg,huge_file,dir_nlink,extra_isize fsfile # e2fsck -yDf -C0 fsfile # truncate --size 132M fsfile # losetup /dev/loop0 fsfile # mount /dev/loop0 mnt # resize2fs -p /dev/loop0 https://bugzilla.kernel.org/show_bug.cgi?id=13549 Reported-by: Alessandro Polverini <alex@nibbles.it> Test-case-by: Christoph Biedl <bugzilla.kernel.bpeb@manchmal.in-ulm.de> Signed-off-by: Eric Sandeen <sandeen@redhat.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -930,7 +930,8 @@ int ext4_group_add(struct super_block *s percpu_counter_add(&sbi->s_freeinodes_counter, EXT4_INODES_PER_GROUP(sb)); - if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG)) { + if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG) && + sbi->s_log_groups_per_flex) { ext4_group_t flex_group; flex_group = ext4_flex_group(sbi, input->group); atomic_add(input->free_blocks_count, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 129/164] ext4: Make sure the MOVE_EXT ioctl cant overwrite append-only files 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (127 preceding siblings ...) 2010-07-01 17:35 ` [patch 128/164] ext4: check s_log_groups_per_flex in online resize code Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 130/164] GFS2: Fix permissions checking for setflags ioctl() Greg KH ` (34 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Theodore Tso, Dan Rosenberg 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Theodore Ts'o <tytso@mit.edu> commit 1f5a81e41f8b1a782c68d3843e9ec1bfaadf7d72 upstream. Dan Roseberg has reported a problem with the MOVE_EXT ioctl. If the donor file is an append-only file, we should not allow the operation to proceed, lest we end up overwriting the contents of an append-only file. Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Cc: Dan Rosenberg <dan.j.rosenberg@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/ext4/move_extent.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/ext4/move_extent.c +++ b/fs/ext4/move_extent.c @@ -964,6 +964,9 @@ mext_check_arguments(struct inode *orig_ return -EINVAL; } + if (IS_IMMUTABLE(donor_inode) || IS_APPEND(donor_inode)) + return -EPERM; + /* Ext4 move extent does not support swapfile */ if (IS_SWAPFILE(orig_inode) || IS_SWAPFILE(donor_inode)) { ext4_debug("ext4 move extent: The argument files should " ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 130/164] GFS2: Fix permissions checking for setflags ioctl() 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (128 preceding siblings ...) 2010-07-01 17:35 ` [patch 129/164] ext4: Make sure the MOVE_EXT ioctl cant overwrite append-only files Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 131/164] sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4) Greg KH ` (33 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Steven Whitehouse 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Steven Whitehouse <swhiteho@redhat.com> commit 7df0e0397b9a18358573274db9fdab991941062f upstream. We should be checking for the ownership of the file for which flags are being set, rather than just for write access. Reported-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> Signed-off-by: Steven Whitehouse <swhiteho@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/gfs2/file.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/fs/gfs2/file.c +++ b/fs/gfs2/file.c @@ -218,6 +218,11 @@ static int do_gfs2_set_flags(struct file if (error) goto out_drop_write; + error = -EACCES; + if (!is_owner_or_cap(inode)) + goto out; + + error = 0; flags = ip->i_diskflags; new_flags = (flags & ~mask) | (reqflags & mask); if ((new_flags ^ flags) == 0) @@ -275,8 +280,10 @@ static int gfs2_set_flags(struct file *f { struct inode *inode = filp->f_path.dentry->d_inode; u32 fsflags, gfsflags; + if (get_user(fsflags, ptr)) return -EFAULT; + gfsflags = fsflags_cvt(fsflags_to_gfs2, fsflags); if (!S_ISDIR(inode->i_mode)) { if (gfsflags & GFS2_DIF_INHERIT_JDATA) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 131/164] sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4) 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (129 preceding siblings ...) 2010-07-01 17:35 ` [patch 130/164] GFS2: Fix permissions checking for setflags ioctl() Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 132/164] CIFS: Allow null nd (as nfs server uses) on create Greg KH ` (32 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Neil Horman, Vlad Yasevich, David S. Miller 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Neil Horman <nhorman@tuxdriver.com> commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809 upstream. Ok, version 4 Change Notes: 1) Minor cleanups, from Vlads notes Summary: Hey- Recently, it was reported to me that the kernel could oops in the following way: <5> kernel BUG at net/core/skbuff.c:91! <5> invalid operand: 0000 [#1] <5> Modules linked in: sctp netconsole nls_utf8 autofs4 sunrpc iptable_filter ip_tables cpufreq_powersave parport_pc lp parport vmblock(U) vsock(U) vmci(U) vmxnet(U) vmmemctl(U) vmhgfs(U) acpiphp dm_mirror dm_mod button battery ac md5 ipv6 uhci_hcd ehci_hcd snd_ens1371 snd_rawmidi snd_seq_device snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc snd_ac97_codec snd soundcore pcnet32 mii floppy ext3 jbd ata_piix libata mptscsih mptsas mptspi mptscsi mptbase sd_mod scsi_mod <5> CPU: 0 <5> EIP: 0060:[<c02bff27>] Not tainted VLI <5> EFLAGS: 00010216 (2.6.9-89.0.25.EL) <5> EIP is at skb_over_panic+0x1f/0x2d <5> eax: 0000002c ebx: c033f461 ecx: c0357d96 edx: c040fd44 <5> esi: c033f461 edi: df653280 ebp: 00000000 esp: c040fd40 <5> ds: 007b es: 007b ss: 0068 <5> Process swapper (pid: 0, threadinfo=c040f000 task=c0370be0) <5> Stack: c0357d96 e0c29478 00000084 00000004 c033f461 df653280 d7883180 e0c2947d <5> 00000000 00000080 df653490 00000004 de4f1ac0 de4f1ac0 00000004 df653490 <5> 00000001 e0c2877a 08000800 de4f1ac0 df653490 00000000 e0c29d2e 00000004 <5> Call Trace: <5> [<e0c29478>] sctp_addto_chunk+0xb0/0x128 [sctp] <5> [<e0c2947d>] sctp_addto_chunk+0xb5/0x128 [sctp] <5> [<e0c2877a>] sctp_init_cause+0x3f/0x47 [sctp] <5> [<e0c29d2e>] sctp_process_unk_param+0xac/0xb8 [sctp] <5> [<e0c29e90>] sctp_verify_init+0xcc/0x134 [sctp] <5> [<e0c20322>] sctp_sf_do_5_1B_init+0x83/0x28e [sctp] <5> [<e0c25333>] sctp_do_sm+0x41/0x77 [sctp] <5> [<c01555a4>] cache_grow+0x140/0x233 <5> [<e0c26ba1>] sctp_endpoint_bh_rcv+0xc5/0x108 [sctp] <5> [<e0c2b863>] sctp_inq_push+0xe/0x10 [sctp] <5> [<e0c34600>] sctp_rcv+0x454/0x509 [sctp] <5> [<e084e017>] ipt_hook+0x17/0x1c [iptable_filter] <5> [<c02d005e>] nf_iterate+0x40/0x81 <5> [<c02e0bb9>] ip_local_deliver_finish+0x0/0x151 <5> [<c02e0c7f>] ip_local_deliver_finish+0xc6/0x151 <5> [<c02d0362>] nf_hook_slow+0x83/0xb5 <5> [<c02e0bb2>] ip_local_deliver+0x1a2/0x1a9 <5> [<c02e0bb9>] ip_local_deliver_finish+0x0/0x151 <5> [<c02e103e>] ip_rcv+0x334/0x3b4 <5> [<c02c66fd>] netif_receive_skb+0x320/0x35b <5> [<e0a0928b>] init_stall_timer+0x67/0x6a [uhci_hcd] <5> [<c02c67a4>] process_backlog+0x6c/0xd9 <5> [<c02c690f>] net_rx_action+0xfe/0x1f8 <5> [<c012a7b1>] __do_softirq+0x35/0x79 <5> [<c0107efb>] handle_IRQ_event+0x0/0x4f <5> [<c01094de>] do_softirq+0x46/0x4d Its an skb_over_panic BUG halt that results from processing an init chunk in which too many of its variable length parameters are in some way malformed. The problem is in sctp_process_unk_param: if (NULL == *errp) *errp = sctp_make_op_error_space(asoc, chunk, ntohs(chunk->chunk_hdr->length)); if (*errp) { sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM, WORD_ROUND(ntohs(param.p->length))); sctp_addto_chunk(*errp, WORD_ROUND(ntohs(param.p->length)), param.v); When we allocate an error chunk, we assume that the worst case scenario requires that we have chunk_hdr->length data allocated, which would be correct nominally, given that we call sctp_addto_chunk for the violating parameter. Unfortunately, we also, in sctp_init_cause insert a sctp_errhdr_t structure into the error chunk, so the worst case situation in which all parameters are in violation requires chunk_hdr->length+(sizeof(sctp_errhdr_t)*param_count) bytes of data. The result of this error is that a deliberately malformed packet sent to a listening host can cause a remote DOS, described in CVE-2010-1173: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-1173 I've tested the below fix and confirmed that it fixes the issue. We move to a strategy whereby we allocate a fixed size error chunk and ignore errors we don't have space to report. Tested by me successfully Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- include/net/sctp/structs.h | 1 net/sctp/sm_make_chunk.c | 62 +++++++++++++++++++++++++++++++++++++++++---- 2 files changed, 58 insertions(+), 5 deletions(-) --- a/include/net/sctp/structs.h +++ b/include/net/sctp/structs.h @@ -778,6 +778,7 @@ int sctp_user_addto_chunk(struct sctp_ch struct iovec *data); void sctp_chunk_free(struct sctp_chunk *); void *sctp_addto_chunk(struct sctp_chunk *, int len, const void *data); +void *sctp_addto_chunk_fixed(struct sctp_chunk *, int len, const void *data); struct sctp_chunk *sctp_chunkify(struct sk_buff *, const struct sctp_association *, struct sock *); --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -107,7 +107,7 @@ static const struct sctp_paramhdr prsctp cpu_to_be16(sizeof(struct sctp_paramhdr)), }; -/* A helper to initialize to initialize an op error inside a +/* A helper to initialize an op error inside a * provided chunk, as most cause codes will be embedded inside an * abort chunk. */ @@ -124,6 +124,29 @@ void sctp_init_cause(struct sctp_chunk chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err); } +/* A helper to initialize an op error inside a + * provided chunk, as most cause codes will be embedded inside an + * abort chunk. Differs from sctp_init_cause in that it won't oops + * if there isn't enough space in the op error chunk + */ +int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code, + size_t paylen) +{ + sctp_errhdr_t err; + __u16 len; + + /* Cause code constants are now defined in network order. */ + err.cause = cause_code; + len = sizeof(sctp_errhdr_t) + paylen; + err.length = htons(len); + + if (skb_tailroom(chunk->skb) > len) + return -ENOSPC; + chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk, + sizeof(sctp_errhdr_t), + &err); + return 0; +} /* 3.3.2 Initiation (INIT) (1) * * This chunk is used to initiate a SCTP association between two @@ -1131,6 +1154,24 @@ nodata: return retval; } +/* Create an Operation Error chunk of a fixed size, + * specifically, max(asoc->pathmtu, SCTP_DEFAULT_MAXSEGMENT) + * This is a helper function to allocate an error chunk for + * for those invalid parameter codes in which we may not want + * to report all the errors, if the incomming chunk is large + */ +static inline struct sctp_chunk *sctp_make_op_error_fixed( + const struct sctp_association *asoc, + const struct sctp_chunk *chunk) +{ + size_t size = asoc ? asoc->pathmtu : 0; + + if (!size) + size = SCTP_DEFAULT_MAXSEGMENT; + + return sctp_make_op_error_space(asoc, chunk, size); +} + /* Create an Operation Error chunk. */ struct sctp_chunk *sctp_make_op_error(const struct sctp_association *asoc, const struct sctp_chunk *chunk, @@ -1373,6 +1414,18 @@ void *sctp_addto_chunk(struct sctp_chunk return target; } +/* Append bytes to the end of a chunk. Returns NULL if there isn't sufficient + * space in the chunk + */ +void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk, + int len, const void *data) +{ + if (skb_tailroom(chunk->skb) > len) + return sctp_addto_chunk(chunk, len, data); + else + return NULL; +} + /* Append bytes from user space to the end of a chunk. Will panic if * chunk is not big enough. * Returns a kernel err value. @@ -1976,13 +2029,12 @@ static sctp_ierror_t sctp_process_unk_pa * returning multiple unknown parameters. */ if (NULL == *errp) - *errp = sctp_make_op_error_space(asoc, chunk, - ntohs(chunk->chunk_hdr->length)); + *errp = sctp_make_op_error_fixed(asoc, chunk); if (*errp) { - sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM, + sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM, WORD_ROUND(ntohs(param.p->length))); - sctp_addto_chunk(*errp, + sctp_addto_chunk_fixed(*errp, WORD_ROUND(ntohs(param.p->length)), param.v); } else { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 132/164] CIFS: Allow null nd (as nfs server uses) on create 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (130 preceding siblings ...) 2010-07-01 17:35 ` [patch 131/164] sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4) Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 133/164] vfs: add NOFOLLOW flag to umount(2) Greg KH ` (31 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Shirish Pargaonkar, Steve French 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Steve French <sfrench@us.ibm.com> commit fa588e0c57048b3d4bfcd772d80dc0615f83fd35 upstream. While creating a file on a server which supports unix extensions such as Samba, if a file is being created which does not supply nameidata (i.e. nd is null), cifs client can oops when calling cifs_posix_open. Signed-off-by: Shirish Pargaonkar <shirishp@us.ibm.com> Signed-off-by: Steve French <sfrench@us.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/cifs/cifsproto.h | 6 ++++-- fs/cifs/dir.c | 20 ++++++++++++-------- fs/cifs/file.c | 11 +++++++---- 3 files changed, 23 insertions(+), 14 deletions(-) --- a/fs/cifs/cifsproto.h +++ b/fs/cifs/cifsproto.h @@ -95,8 +95,10 @@ extern struct cifsFileInfo *cifs_new_fil __u16 fileHandle, struct file *file, struct vfsmount *mnt, unsigned int oflags); extern int cifs_posix_open(char *full_path, struct inode **pinode, - struct vfsmount *mnt, int mode, int oflags, - __u32 *poplock, __u16 *pnetfid, int xid); + struct vfsmount *mnt, + struct super_block *sb, + int mode, int oflags, + __u32 *poplock, __u16 *pnetfid, int xid); extern void cifs_unix_basic_to_fattr(struct cifs_fattr *fattr, FILE_UNIX_BASIC_INFO *info, struct cifs_sb_info *cifs_sb); --- a/fs/cifs/dir.c +++ b/fs/cifs/dir.c @@ -183,13 +183,14 @@ cifs_new_fileinfo(struct inode *newinode } int cifs_posix_open(char *full_path, struct inode **pinode, - struct vfsmount *mnt, int mode, int oflags, - __u32 *poplock, __u16 *pnetfid, int xid) + struct vfsmount *mnt, struct super_block *sb, + int mode, int oflags, + __u32 *poplock, __u16 *pnetfid, int xid) { int rc; FILE_UNIX_BASIC_INFO *presp_data; __u32 posix_flags = 0; - struct cifs_sb_info *cifs_sb = CIFS_SB(mnt->mnt_sb); + struct cifs_sb_info *cifs_sb = CIFS_SB(sb); struct cifs_fattr fattr; cFYI(1, ("posix open %s", full_path)); @@ -242,7 +243,7 @@ int cifs_posix_open(char *full_path, str /* get new inode and set it up */ if (*pinode == NULL) { - *pinode = cifs_iget(mnt->mnt_sb, &fattr); + *pinode = cifs_iget(sb, &fattr); if (!*pinode) { rc = -ENOMEM; goto posix_open_ret; @@ -251,7 +252,8 @@ int cifs_posix_open(char *full_path, str cifs_fattr_to_inode(*pinode, &fattr); } - cifs_new_fileinfo(*pinode, *pnetfid, NULL, mnt, oflags); + if (mnt) + cifs_new_fileinfo(*pinode, *pnetfid, NULL, mnt, oflags); posix_open_ret: kfree(presp_data); @@ -315,13 +317,14 @@ cifs_create(struct inode *inode, struct if (nd && (nd->flags & LOOKUP_OPEN)) oflags = nd->intent.open.flags; else - oflags = FMODE_READ; + oflags = FMODE_READ | SMB_O_CREAT; if (tcon->unix_ext && (tcon->ses->capabilities & CAP_UNIX) && (CIFS_UNIX_POSIX_PATH_OPS_CAP & le64_to_cpu(tcon->fsUnixInfo.Capability))) { - rc = cifs_posix_open(full_path, &newinode, nd->path.mnt, - mode, oflags, &oplock, &fileHandle, xid); + rc = cifs_posix_open(full_path, &newinode, + nd ? nd->path.mnt : NULL, + inode->i_sb, mode, oflags, &oplock, &fileHandle, xid); /* EIO could indicate that (posix open) operation is not supported, despite what server claimed in capability negotation. EREMOTE indicates DFS junction, which is not @@ -678,6 +681,7 @@ cifs_lookup(struct inode *parent_dir_ino (nd->flags & LOOKUP_OPEN) && !pTcon->broken_posix_open && (nd->intent.open.flags & O_CREAT)) { rc = cifs_posix_open(full_path, &newInode, nd->path.mnt, + parent_dir_inode->i_sb, nd->intent.open.create_mode, nd->intent.open.flags, &oplock, &fileHandle, xid); --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -297,10 +297,12 @@ int cifs_open(struct inode *inode, struc (CIFS_UNIX_POSIX_PATH_OPS_CAP & le64_to_cpu(tcon->fsUnixInfo.Capability))) { int oflags = (int) cifs_posix_convert_flags(file->f_flags); + oflags |= SMB_O_CREAT; /* can not refresh inode info since size could be stale */ rc = cifs_posix_open(full_path, &inode, file->f_path.mnt, - cifs_sb->mnt_file_mode /* ignored */, - oflags, &oplock, &netfid, xid); + inode->i_sb, + cifs_sb->mnt_file_mode /* ignored */, + oflags, &oplock, &netfid, xid); if (rc == 0) { cFYI(1, ("posix open succeeded")); /* no need for special case handling of setting mode @@ -512,8 +514,9 @@ reopen_error_exit: int oflags = (int) cifs_posix_convert_flags(file->f_flags); /* can not refresh inode info since size could be stale */ rc = cifs_posix_open(full_path, NULL, file->f_path.mnt, - cifs_sb->mnt_file_mode /* ignored */, - oflags, &oplock, &netfid, xid); + inode->i_sb, + cifs_sb->mnt_file_mode /* ignored */, + oflags, &oplock, &netfid, xid); if (rc == 0) { cFYI(1, ("posix reopen succeeded")); goto reopen_success; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 133/164] vfs: add NOFOLLOW flag to umount(2) 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (131 preceding siblings ...) 2010-07-01 17:35 ` [patch 132/164] CIFS: Allow null nd (as nfs server uses) on create Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 134/164] l2tp: Fix oops in pppol2tp_xmit Greg KH ` (30 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Eugene Teo, Michael Kerrisk, Miklos Szeredi, Al Viro 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Miklos Szeredi <mszeredi@suse.cz> commit db1f05bb85d7966b9176e293f3ceead1cb8b5d79 upstream. Add a new UMOUNT_NOFOLLOW flag to umount(2). This is needed to prevent symlink attacks in unprivileged unmounts (fuse, samba, ncpfs). Additionally, return -EINVAL if an unknown flag is used (and specify an explicitly unused flag: UMOUNT_UNUSED). This makes it possible for the caller to determine if a flag is supported or not. CC: Eugene Teo <eugene@redhat.com> CC: Michael Kerrisk <mtk.manpages@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/namespace.c | 9 ++++++++- include/linux/fs.h | 2 ++ 2 files changed, 10 insertions(+), 1 deletion(-) --- a/fs/namespace.c +++ b/fs/namespace.c @@ -1121,8 +1121,15 @@ SYSCALL_DEFINE2(umount, char __user *, n { struct path path; int retval; + int lookup_flags = 0; - retval = user_path(name, &path); + if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW)) + return -EINVAL; + + if (!(flags & UMOUNT_NOFOLLOW)) + lookup_flags |= LOOKUP_FOLLOW; + + retval = user_path_at(AT_FDCWD, name, lookup_flags, &path); if (retval) goto out; retval = -EINVAL; --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1308,6 +1308,8 @@ extern int send_sigurg(struct fown_struc #define MNT_FORCE 0x00000001 /* Attempt to forcibily umount */ #define MNT_DETACH 0x00000002 /* Just detach from the tree */ #define MNT_EXPIRE 0x00000004 /* Mark for expiry */ +#define UMOUNT_NOFOLLOW 0x00000008 /* Don't follow symlink on umount */ +#define UMOUNT_UNUSED 0x80000000 /* Flag guaranteed to be unused */ extern struct list_head super_blocks; extern spinlock_t sb_lock; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 134/164] l2tp: Fix oops in pppol2tp_xmit 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (132 preceding siblings ...) 2010-07-01 17:35 ` [patch 133/164] vfs: add NOFOLLOW flag to umount(2) Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 135/164] Btrfs: should add a permission check for setfacl Greg KH ` (29 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, James Chapman, David S. Miller 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: James Chapman <jchapman@katalix.com> commit 3feec9095d12e311b7d4eb7fe7e5dfa75d4a72a5 upstream. When transmitting L2TP frames, we derive the outgoing interface's UDP checksum hardware assist capabilities from the tunnel dst dev. This can sometimes be NULL, especially when routing protocols are used and routing changes occur. This patch just checks for NULL dst or dev pointers when checking for netdev hardware assist features. BUG: unable to handle kernel NULL pointer dereference at 0000000c IP: [<f89d074c>] pppol2tp_xmit+0x341/0x4da [pppol2tp] *pde = 00000000 Oops: 0000 [#1] SMP last sysfs file: /sys/class/net/lo/operstate Modules linked in: pppol2tp pppox ppp_generic slhc ipv6 dummy loop snd_hda_codec_atihdmi snd_hda_intel snd_hda_codec snd_pcm snd_timer snd soundcore snd_page_alloc evdev psmouse serio_raw processor button i2c_piix4 i2c_core ati_agp agpgart pcspkr ext3 jbd mbcache sd_mod ide_pci_generic atiixp ide_core ahci ata_generic floppy ehci_hcd ohci_hcd libata e1000e scsi_mod usbcore nls_base thermal fan thermal_sys [last unloaded: scsi_wait_scan] Pid: 0, comm: swapper Not tainted (2.6.32.8 #1) EIP: 0060:[<f89d074c>] EFLAGS: 00010297 CPU: 3 EIP is at pppol2tp_xmit+0x341/0x4da [pppol2tp] EAX: 00000000 EBX: f64d1680 ECX: 000005b9 EDX: 00000000 ESI: f6b91850 EDI: f64d16ac EBP: f6a0c4c0 ESP: f70a9cac DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 Process swapper (pid: 0, ti=f70a8000 task=f70a31c0 task.ti=f70a8000) Stack: 000005a9 000005b9 f734c400 f66652c0 f7352e00 f67dc800 00000000 f6b91800 <0> 000005a3 f70ef6c4 f67dcda9 000005a3 f89b192e 00000246 000005a3 f64d1680 <0> f63633e0 f6363320 f64d1680 f65a7320 f65a7364 f65856c0 f64d1680 f679f02f Call Trace: [<f89b192e>] ? ppp_push+0x459/0x50e [ppp_generic] [<f89b217f>] ? ppp_xmit_process+0x3b6/0x430 [ppp_generic] [<f89b2306>] ? ppp_start_xmit+0x10d/0x120 [ppp_generic] [<c11c15cb>] ? dev_hard_start_xmit+0x21f/0x2b2 [<c11d0947>] ? sch_direct_xmit+0x48/0x10e [<c11c19a0>] ? dev_queue_xmit+0x263/0x3a6 [<c11e2a9f>] ? ip_finish_output+0x1f7/0x221 [<c11df682>] ? ip_forward_finish+0x2e/0x30 [<c11de645>] ? ip_rcv_finish+0x295/0x2a9 [<c11c0b19>] ? netif_receive_skb+0x3e9/0x404 [<f814b791>] ? e1000_clean_rx_irq+0x253/0x2fc [e1000e] [<f814cb7a>] ? e1000_clean+0x63/0x1fc [e1000e] [<c1047eff>] ? sched_clock_local+0x15/0x11b [<c11c1095>] ? net_rx_action+0x96/0x195 [<c1035750>] ? __do_softirq+0xaa/0x151 [<c1035828>] ? do_softirq+0x31/0x3c [<c10358fe>] ? irq_exit+0x26/0x58 [<c1004b21>] ? do_IRQ+0x78/0x89 [<c1003729>] ? common_interrupt+0x29/0x30 [<c101ac28>] ? native_safe_halt+0x2/0x3 [<c1008c54>] ? default_idle+0x55/0x75 [<c1009045>] ? c1e_idle+0xd2/0xd5 [<c100233c>] ? cpu_idle+0x46/0x62 Code: 8d 45 08 f0 ff 45 08 89 6b 08 c7 43 68 7e fb 9c f8 8a 45 24 83 e0 0c 3c 04 75 09 80 63 64 f3 e9 b4 00 00 00 8b 43 18 8b 4c 24 04 <8b> 40 0c 8d 79 11 f6 40 44 0e 8a 43 64 75 51 6a 00 8b 4c 24 08 EIP: [<f89d074c>] pppol2tp_xmit+0x341/0x4da [pppol2tp] SS:ESP 0068:f70a9cac CR2: 000000000000000c Signed-off-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/pppol2tp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/pppol2tp.c +++ b/drivers/net/pppol2tp.c @@ -977,7 +977,8 @@ static int pppol2tp_sendmsg(struct kiocb /* Calculate UDP checksum if configured to do so */ if (sk_tun->sk_no_check == UDP_CSUM_NOXMIT) skb->ip_summed = CHECKSUM_NONE; - else if (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM)) { + else if ((skb_dst(skb) && skb_dst(skb)->dev) && + (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) { skb->ip_summed = CHECKSUM_COMPLETE; csum = skb_checksum(skb, 0, udp_len, 0); uh->check = csum_tcpudp_magic(inet->inet_saddr, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 135/164] Btrfs: should add a permission check for setfacl 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (133 preceding siblings ...) 2010-07-01 17:35 ` [patch 134/164] l2tp: Fix oops in pppol2tp_xmit Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 136/164] eeepc-laptop: check wireless hotplug events Greg KH ` (28 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Shi Weihua, Chris Mason 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shi Weihua <shiwh@cn.fujitsu.com> commit 2f26afba46f0ebf155cf9be746496a0304a5b7cf upstream. On btrfs, do the following ------------------ # su user1 # cd btrfs-part/ # touch aaa # getfacl aaa # file: aaa # owner: user1 # group: user1 user::rw- group::rw- other::r-- # su user2 # cd btrfs-part/ # setfacl -m u::rwx aaa # getfacl aaa # file: aaa # owner: user1 # group: user1 user::rwx <- successed to setfacl group::rw- other::r-- ------------------ but we should prohibit it that user2 changing user1's acl. In fact, on ext3 and other fs, a message occurs: setfacl: aaa: Operation not permitted This patch fixed it. Signed-off-by: Shi Weihua <shiwh@cn.fujitsu.com> Signed-off-by: Chris Mason <chris.mason@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/btrfs/acl.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/btrfs/acl.c +++ b/fs/btrfs/acl.c @@ -159,6 +159,9 @@ static int btrfs_xattr_acl_set(struct de int ret; struct posix_acl *acl = NULL; + if (!is_owner_or_cap(dentry->d_inode)) + return -EPERM; + if (value) { acl = posix_acl_from_xattr(value, size); if (acl == NULL) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 136/164] eeepc-laptop: check wireless hotplug events 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (134 preceding siblings ...) 2010-07-01 17:35 ` [patch 135/164] Btrfs: should add a permission check for setfacl Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 137/164] tracing: Consolidate protection of reader access to the ring buffer Greg KH ` (27 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Alan Jenkins, Corentin Chary 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alan Jenkins <alan-jenkins@tuffmail.co.uk> commit bc9d24a3aeb1532fc3e234907a8b6d671f7ed68f upstream. Before we mark the wireless device as unplugged, check PCI config space to see whether the wireless device is really disabled (and vice versa). This works around newer models which don't want the hotplug code, where we end up disabling the wired network device. My old 701 still works correctly with this. I can also simulate an afflicted model by changing the hardcoded PCI bus/slot number in the driver, and it seems to work nicely (although it is a bit noisy). In future this type of hotplug support will be implemented by the PCI core. The existing blacklist and the new warning message will be removed at that point. Signed-off-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk> Signed-off-by: Corentin Chary <corentincj@iksaif.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/platform/x86/eeepc-laptop.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) --- a/drivers/platform/x86/eeepc-laptop.c +++ b/drivers/platform/x86/eeepc-laptop.c @@ -578,6 +578,8 @@ static void eeepc_rfkill_hotplug(struct struct pci_dev *dev; struct pci_bus *bus; bool blocked = eeepc_wlan_rfkill_blocked(eeepc); + bool absent; + u32 l; if (eeepc->wlan_rfkill) rfkill_set_sw_state(eeepc->wlan_rfkill, blocked); @@ -591,6 +593,22 @@ static void eeepc_rfkill_hotplug(struct goto out_unlock; } + if (pci_bus_read_config_dword(bus, 0, PCI_VENDOR_ID, &l)) { + pr_err("Unable to read PCI config space?\n"); + goto out_unlock; + } + absent = (l == 0xffffffff); + + if (blocked != absent) { + pr_warning("BIOS says wireless lan is %s, " + "but the pci device is %s\n", + blocked ? "blocked" : "unblocked", + absent ? "absent" : "present"); + pr_warning("skipped wireless hotplug as probably " + "inappropriate for this model\n"); + goto out_unlock; + } + if (!blocked) { dev = pci_get_slot(bus, 0); if (dev) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 137/164] tracing: Consolidate protection of reader access to the ring buffer 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (135 preceding siblings ...) 2010-07-01 17:35 ` [patch 136/164] eeepc-laptop: check wireless hotplug events Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 138/164] Input: psmouse - reset all types of mice before reconnecting Greg KH ` (26 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Lai Jiangshan, Steven Rostedt 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Lai Jiangshan <laijs@cn.fujitsu.com> commit 7e53bd42d14c75192b99674c40fcc359392da59d upstream. At the beginning, access to the ring buffer was fully serialized by trace_types_lock. Patch d7350c3f4569 gives more freedom to readers, and patch b04cc6b1f6 adds code to protect trace_pipe and cpu#/trace_pipe. But actually it is not enough, ring buffer readers are not always read-only, they may consume data. This patch makes accesses to trace, trace_pipe, trace_pipe_raw cpu#/trace, cpu#/trace_pipe and cpu#/trace_pipe_raw serialized. And removes tracing_reader_cpumask which is used to protect trace_pipe. Details: Ring buffer serializes readers, but it is low level protection. The validity of the events (which returns by ring_buffer_peek() ..etc) are not protected by ring buffer. The content of events may become garbage if we allow another process to consume these events concurrently: A) the page of the consumed events may become a normal page (not reader page) in ring buffer, and this page will be rewritten by the events producer. B) The page of the consumed events may become a page for splice_read, and this page will be returned to system. This patch adds trace_access_lock() and trace_access_unlock() primitives. These primitives allow multi process access to different cpu ring buffers concurrently. These primitives don't distinguish read-only and read-consume access. Multi read-only access is also serialized. And we don't use these primitives when we open files, we only use them when we read files. Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com> LKML-Reference: <4B447D52.1050602@cn.fujitsu.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/trace/trace.c | 136 ++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 97 insertions(+), 39 deletions(-) --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -32,6 +32,7 @@ #include <linux/splice.h> #include <linux/kdebug.h> #include <linux/string.h> +#include <linux/rwsem.h> #include <linux/ctype.h> #include <linux/init.h> #include <linux/poll.h> @@ -102,9 +103,6 @@ static inline void ftrace_enable_cpu(voi static cpumask_var_t __read_mostly tracing_buffer_mask; -/* Define which cpu buffers are currently read in trace_pipe */ -static cpumask_var_t tracing_reader_cpumask; - #define for_each_tracing_cpu(cpu) \ for_each_cpu(cpu, tracing_buffer_mask) @@ -243,12 +241,91 @@ static struct tracer *current_trace __r /* * trace_types_lock is used to protect the trace_types list. - * This lock is also used to keep user access serialized. - * Accesses from userspace will grab this lock while userspace - * activities happen inside the kernel. */ static DEFINE_MUTEX(trace_types_lock); +/* + * serialize the access of the ring buffer + * + * ring buffer serializes readers, but it is low level protection. + * The validity of the events (which returns by ring_buffer_peek() ..etc) + * are not protected by ring buffer. + * + * The content of events may become garbage if we allow other process consumes + * these events concurrently: + * A) the page of the consumed events may become a normal page + * (not reader page) in ring buffer, and this page will be rewrited + * by events producer. + * B) The page of the consumed events may become a page for splice_read, + * and this page will be returned to system. + * + * These primitives allow multi process access to different cpu ring buffer + * concurrently. + * + * These primitives don't distinguish read-only and read-consume access. + * Multi read-only access are also serialized. + */ + +#ifdef CONFIG_SMP +static DECLARE_RWSEM(all_cpu_access_lock); +static DEFINE_PER_CPU(struct mutex, cpu_access_lock); + +static inline void trace_access_lock(int cpu) +{ + if (cpu == TRACE_PIPE_ALL_CPU) { + /* gain it for accessing the whole ring buffer. */ + down_write(&all_cpu_access_lock); + } else { + /* gain it for accessing a cpu ring buffer. */ + + /* Firstly block other trace_access_lock(TRACE_PIPE_ALL_CPU). */ + down_read(&all_cpu_access_lock); + + /* Secondly block other access to this @cpu ring buffer. */ + mutex_lock(&per_cpu(cpu_access_lock, cpu)); + } +} + +static inline void trace_access_unlock(int cpu) +{ + if (cpu == TRACE_PIPE_ALL_CPU) { + up_write(&all_cpu_access_lock); + } else { + mutex_unlock(&per_cpu(cpu_access_lock, cpu)); + up_read(&all_cpu_access_lock); + } +} + +static inline void trace_access_lock_init(void) +{ + int cpu; + + for_each_possible_cpu(cpu) + mutex_init(&per_cpu(cpu_access_lock, cpu)); +} + +#else + +static DEFINE_MUTEX(access_lock); + +static inline void trace_access_lock(int cpu) +{ + (void)cpu; + mutex_lock(&access_lock); +} + +static inline void trace_access_unlock(int cpu) +{ + (void)cpu; + mutex_unlock(&access_lock); +} + +static inline void trace_access_lock_init(void) +{ +} + +#endif + /* trace_wait is a waitqueue for tasks blocked on trace_poll */ static DECLARE_WAIT_QUEUE_HEAD(trace_wait); @@ -1601,12 +1678,6 @@ static void tracing_iter_reset(struct tr } /* - * No necessary locking here. The worst thing which can - * happen is loosing events consumed at the same time - * by a trace_pipe reader. - * Other than that, we don't risk to crash the ring buffer - * because it serializes the readers. - * * The current tracer is copied to avoid a global locking * all around. */ @@ -1662,12 +1733,16 @@ static void *s_start(struct seq_file *m, } trace_event_read_lock(); + trace_access_lock(cpu_file); return p; } static void s_stop(struct seq_file *m, void *p) { + struct trace_iterator *iter = m->private; + atomic_dec(&trace_record_cmdline_disabled); + trace_access_unlock(iter->cpu_file); trace_event_read_unlock(); } @@ -2858,22 +2933,6 @@ static int tracing_open_pipe(struct inod mutex_lock(&trace_types_lock); - /* We only allow one reader per cpu */ - if (cpu_file == TRACE_PIPE_ALL_CPU) { - if (!cpumask_empty(tracing_reader_cpumask)) { - ret = -EBUSY; - goto out; - } - cpumask_setall(tracing_reader_cpumask); - } else { - if (!cpumask_test_cpu(cpu_file, tracing_reader_cpumask)) - cpumask_set_cpu(cpu_file, tracing_reader_cpumask); - else { - ret = -EBUSY; - goto out; - } - } - /* create a buffer to store the information to pass to userspace */ iter = kzalloc(sizeof(*iter), GFP_KERNEL); if (!iter) { @@ -2929,12 +2988,6 @@ static int tracing_release_pipe(struct i mutex_lock(&trace_types_lock); - if (iter->cpu_file == TRACE_PIPE_ALL_CPU) - cpumask_clear(tracing_reader_cpumask); - else - cpumask_clear_cpu(iter->cpu_file, tracing_reader_cpumask); - - if (iter->trace->pipe_close) iter->trace->pipe_close(iter); @@ -3096,6 +3149,7 @@ waitagain: iter->pos = -1; trace_event_read_lock(); + trace_access_lock(iter->cpu_file); while (find_next_entry_inc(iter) != NULL) { enum print_line_t ret; int len = iter->seq.len; @@ -3112,6 +3166,7 @@ waitagain: if (iter->seq.len >= cnt) break; } + trace_access_unlock(iter->cpu_file); trace_event_read_unlock(); /* Now copy what we have to the user */ @@ -3237,6 +3292,7 @@ static ssize_t tracing_splice_read_pipe( } trace_event_read_lock(); + trace_access_lock(iter->cpu_file); /* Fill as many pages as possible. */ for (i = 0, rem = len; i < PIPE_BUFFERS && rem; i++) { @@ -3260,6 +3316,7 @@ static ssize_t tracing_splice_read_pipe( trace_seq_init(&iter->seq); } + trace_access_unlock(iter->cpu_file); trace_event_read_unlock(); mutex_unlock(&iter->mutex); @@ -3561,10 +3618,12 @@ tracing_buffers_read(struct file *filp, info->read = 0; + trace_access_lock(info->cpu); ret = ring_buffer_read_page(info->tr->buffer, &info->spare, count, info->cpu, 0); + trace_access_unlock(info->cpu); if (ret < 0) return 0; @@ -3692,6 +3751,7 @@ tracing_buffers_splice_read(struct file len &= PAGE_MASK; } + trace_access_lock(info->cpu); entries = ring_buffer_entries_cpu(info->tr->buffer, info->cpu); for (i = 0; i < PIPE_BUFFERS && len && entries; i++, len -= PAGE_SIZE) { @@ -3739,6 +3799,7 @@ tracing_buffers_splice_read(struct file entries = ring_buffer_entries_cpu(info->tr->buffer, info->cpu); } + trace_access_unlock(info->cpu); spd.nr_pages = i; /* did we read anything? */ @@ -4175,6 +4236,8 @@ static __init int tracer_init_debugfs(vo struct dentry *d_tracer; int cpu; + trace_access_lock_init(); + d_tracer = tracing_init_dentry(); trace_create_file("tracing_enabled", 0644, d_tracer, @@ -4409,9 +4472,6 @@ __init static int tracer_alloc_buffers(v if (!alloc_cpumask_var(&tracing_cpumask, GFP_KERNEL)) goto out_free_buffer_mask; - if (!zalloc_cpumask_var(&tracing_reader_cpumask, GFP_KERNEL)) - goto out_free_tracing_cpumask; - /* To save memory, keep the ring buffer size to its minimum */ if (ring_buffer_expanded) ring_buf_size = trace_buf_size; @@ -4469,8 +4529,6 @@ __init static int tracer_alloc_buffers(v return 0; out_free_cpumask: - free_cpumask_var(tracing_reader_cpumask); -out_free_tracing_cpumask: free_cpumask_var(tracing_cpumask); out_free_buffer_mask: free_cpumask_var(tracing_buffer_mask); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 138/164] Input: psmouse - reset all types of mice before reconnecting 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (136 preceding siblings ...) 2010-07-01 17:35 ` [patch 137/164] tracing: Consolidate protection of reader access to the ring buffer Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 139/164] KVM: SVM: Dont use kmap_atomic in nested_svm_map Greg KH ` (25 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dmitry Torokhov, Tim Gardner 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dmitry Torokhov <dmitry.torokhov@gmail.com> commit ef110b24e28f36620f63dab94708a17c7e267358 upstream. Synaptics hardware requires resetting device after suspend to ram in order for the device to be operational. The reset lives in synaptics-specific reconnect handler, but it is not being invoked if synaptics support is disabled and the device is handled as a standard PS/2 device (bare or IntelliMouse protocol). Let's add reset into generic reconnect handler as well. Signed-off-by: Dmitry Torokhov <dtor@mail.ru> Cc: Tim Gardner <tim.gardner@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/input/mouse/psmouse-base.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) --- a/drivers/input/mouse/psmouse-base.c +++ b/drivers/input/mouse/psmouse-base.c @@ -1382,6 +1382,7 @@ static int psmouse_reconnect(struct seri struct psmouse *psmouse = serio_get_drvdata(serio); struct psmouse *parent = NULL; struct serio_driver *drv = serio->drv; + unsigned char type; int rc = -1; if (!drv || !psmouse) { @@ -1401,10 +1402,15 @@ static int psmouse_reconnect(struct seri if (psmouse->reconnect) { if (psmouse->reconnect(psmouse)) goto out; - } else if (psmouse_probe(psmouse) < 0 || - psmouse->type != psmouse_extensions(psmouse, - psmouse_max_proto, false)) { - goto out; + } else { + psmouse_reset(psmouse); + + if (psmouse_probe(psmouse) < 0) + goto out; + + type = psmouse_extensions(psmouse, psmouse_max_proto, false); + if (psmouse->type != type) + goto out; } /* ok, the device type (and capabilities) match the old one, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 139/164] KVM: SVM: Dont use kmap_atomic in nested_svm_map 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (137 preceding siblings ...) 2010-07-01 17:35 ` [patch 138/164] Input: psmouse - reset all types of mice before reconnecting Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 140/164] KVM: SVM: Fix schedule-while-atomic on nested exception handling Greg KH ` (24 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> Use of kmap_atomic disables preemption but if we run in shadow-shadow mode the vmrun emulation executes kvm_set_cr3 which might sleep or fault. So use kmap instead for nested_svm_map. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 7597f129d8b6799da7a264e6d6f7401668d3a36d) --- arch/x86/kvm/svm.c | 47 ++++++++++++++++++++++++----------------------- 1 file changed, 24 insertions(+), 23 deletions(-) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1398,7 +1398,7 @@ static inline int nested_svm_intr(struct return 0; } -static void *nested_svm_map(struct vcpu_svm *svm, u64 gpa, enum km_type idx) +static void *nested_svm_map(struct vcpu_svm *svm, u64 gpa, struct page **_page) { struct page *page; @@ -1406,7 +1406,9 @@ static void *nested_svm_map(struct vcpu_ if (is_error_page(page)) goto error; - return kmap_atomic(page, idx); + *_page = page; + + return kmap(page); error: kvm_release_page_clean(page); @@ -1415,16 +1417,9 @@ error: return NULL; } -static void nested_svm_unmap(void *addr, enum km_type idx) +static void nested_svm_unmap(struct page *page) { - struct page *page; - - if (!addr) - return; - - page = kmap_atomic_to_page(addr); - - kunmap_atomic(addr, idx); + kunmap(page); kvm_release_page_dirty(page); } @@ -1432,6 +1427,7 @@ static bool nested_svm_exit_handled_msr( { u32 param = svm->vmcb->control.exit_info_1 & 1; u32 msr = svm->vcpu.arch.regs[VCPU_REGS_RCX]; + struct page *page; bool ret = false; u32 t0, t1; u8 *msrpm; @@ -1439,7 +1435,7 @@ static bool nested_svm_exit_handled_msr( if (!(svm->nested.intercept & (1ULL << INTERCEPT_MSR_PROT))) return false; - msrpm = nested_svm_map(svm, svm->nested.vmcb_msrpm, KM_USER0); + msrpm = nested_svm_map(svm, svm->nested.vmcb_msrpm, &page); if (!msrpm) goto out; @@ -1467,7 +1463,7 @@ static bool nested_svm_exit_handled_msr( ret = msrpm[t1] & ((1 << param) << t0); out: - nested_svm_unmap(msrpm, KM_USER0); + nested_svm_unmap(page); return ret; } @@ -1590,6 +1586,7 @@ static int nested_svm_vmexit(struct vcpu struct vmcb *nested_vmcb; struct vmcb *hsave = svm->nested.hsave; struct vmcb *vmcb = svm->vmcb; + struct page *page; trace_kvm_nested_vmexit_inject(vmcb->control.exit_code, vmcb->control.exit_info_1, @@ -1597,7 +1594,7 @@ static int nested_svm_vmexit(struct vcpu vmcb->control.exit_int_info, vmcb->control.exit_int_info_err); - nested_vmcb = nested_svm_map(svm, svm->nested.vmcb, KM_USER0); + nested_vmcb = nested_svm_map(svm, svm->nested.vmcb, &page); if (!nested_vmcb) return 1; @@ -1687,7 +1684,7 @@ static int nested_svm_vmexit(struct vcpu /* Exit nested SVM mode */ svm->nested.vmcb = 0; - nested_svm_unmap(nested_vmcb, KM_USER0); + nested_svm_unmap(page); kvm_mmu_reset_context(&svm->vcpu); kvm_mmu_load(&svm->vcpu); @@ -1698,9 +1695,10 @@ static int nested_svm_vmexit(struct vcpu static bool nested_svm_vmrun_msrpm(struct vcpu_svm *svm) { u32 *nested_msrpm; + struct page *page; int i; - nested_msrpm = nested_svm_map(svm, svm->nested.vmcb_msrpm, KM_USER0); + nested_msrpm = nested_svm_map(svm, svm->nested.vmcb_msrpm, &page); if (!nested_msrpm) return false; @@ -1709,7 +1707,7 @@ static bool nested_svm_vmrun_msrpm(struc svm->vmcb->control.msrpm_base_pa = __pa(svm->nested.msrpm); - nested_svm_unmap(nested_msrpm, KM_USER0); + nested_svm_unmap(page); return true; } @@ -1719,8 +1717,9 @@ static bool nested_svm_vmrun(struct vcpu struct vmcb *nested_vmcb; struct vmcb *hsave = svm->nested.hsave; struct vmcb *vmcb = svm->vmcb; + struct page *page; - nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, KM_USER0); + nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page); if (!nested_vmcb) return false; @@ -1832,7 +1831,7 @@ static bool nested_svm_vmrun(struct vcpu svm->vmcb->control.event_inj = nested_vmcb->control.event_inj; svm->vmcb->control.event_inj_err = nested_vmcb->control.event_inj_err; - nested_svm_unmap(nested_vmcb, KM_USER0); + nested_svm_unmap(page); enable_gif(svm); @@ -1858,6 +1857,7 @@ static void nested_svm_vmloadsave(struct static int vmload_interception(struct vcpu_svm *svm) { struct vmcb *nested_vmcb; + struct page *page; if (nested_svm_check_permissions(svm)) return 1; @@ -1865,12 +1865,12 @@ static int vmload_interception(struct vc svm->next_rip = kvm_rip_read(&svm->vcpu) + 3; skip_emulated_instruction(&svm->vcpu); - nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, KM_USER0); + nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page); if (!nested_vmcb) return 1; nested_svm_vmloadsave(nested_vmcb, svm->vmcb); - nested_svm_unmap(nested_vmcb, KM_USER0); + nested_svm_unmap(page); return 1; } @@ -1878,6 +1878,7 @@ static int vmload_interception(struct vc static int vmsave_interception(struct vcpu_svm *svm) { struct vmcb *nested_vmcb; + struct page *page; if (nested_svm_check_permissions(svm)) return 1; @@ -1885,12 +1886,12 @@ static int vmsave_interception(struct vc svm->next_rip = kvm_rip_read(&svm->vcpu) + 3; skip_emulated_instruction(&svm->vcpu); - nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, KM_USER0); + nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page); if (!nested_vmcb) return 1; nested_svm_vmloadsave(svm->vmcb, nested_vmcb); - nested_svm_unmap(nested_vmcb, KM_USER0); + nested_svm_unmap(page); return 1; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 140/164] KVM: SVM: Fix schedule-while-atomic on nested exception handling 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (138 preceding siblings ...) 2010-07-01 17:35 ` [patch 139/164] KVM: SVM: Dont use kmap_atomic in nested_svm_map Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 141/164] KVM: SVM: Sync all control registers on nested vmexit Greg KH ` (23 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> Move the actual vmexit routine out of code that runs with irqs and preemption disabled. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit b8e88bc8ffba5fe53fb8d8a0a4be3bbcffeebe56) --- arch/x86/kvm/svm.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -128,6 +128,7 @@ static void svm_flush_tlb(struct kvm_vcp static void svm_complete_interrupts(struct vcpu_svm *svm); static int nested_svm_exit_handled(struct vcpu_svm *svm); +static int nested_svm_intercept(struct vcpu_svm *svm); static int nested_svm_vmexit(struct vcpu_svm *svm); static int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr, bool has_error_code, u32 error_code); @@ -1359,6 +1360,8 @@ static int nested_svm_check_permissions( static int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr, bool has_error_code, u32 error_code) { + int vmexit; + if (!is_nested(svm)) return 0; @@ -1367,7 +1370,11 @@ static int nested_svm_check_exception(st svm->vmcb->control.exit_info_1 = error_code; svm->vmcb->control.exit_info_2 = svm->vcpu.arch.cr2; - return nested_svm_exit_handled(svm); + vmexit = nested_svm_intercept(svm); + if (vmexit == NESTED_EXIT_DONE) + svm->nested.exit_required = true; + + return vmexit; } static inline int nested_svm_intr(struct vcpu_svm *svm) @@ -1496,7 +1503,7 @@ static int nested_svm_exit_special(struc /* * If this function returns true, this #vmexit was already handled */ -static int nested_svm_exit_handled(struct vcpu_svm *svm) +static int nested_svm_intercept(struct vcpu_svm *svm) { u32 exit_code = svm->vmcb->control.exit_code; int vmexit = NESTED_EXIT_HOST; @@ -1542,9 +1549,17 @@ static int nested_svm_exit_handled(struc } } - if (vmexit == NESTED_EXIT_DONE) { + return vmexit; +} + +static int nested_svm_exit_handled(struct vcpu_svm *svm) +{ + int vmexit; + + vmexit = nested_svm_intercept(svm); + + if (vmexit == NESTED_EXIT_DONE) nested_svm_vmexit(svm); - } return vmexit; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 141/164] KVM: SVM: Sync all control registers on nested vmexit 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (139 preceding siblings ...) 2010-07-01 17:35 ` [patch 140/164] KVM: SVM: Fix schedule-while-atomic on nested exception handling Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 142/164] KVM: SVM: Fix nested msr intercept handling Greg KH ` (22 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> Currently the vmexit emulation does not sync control registers were the access is typically intercepted by the nested hypervisor. But we can not count on that intercepts to sync these registers too and make the code architecturally more correct. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit cdbbdc1210223879450555fee04c29ebf116576b) --- arch/x86/kvm/svm.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1622,9 +1622,13 @@ static int nested_svm_vmexit(struct vcpu nested_vmcb->save.ds = vmcb->save.ds; nested_vmcb->save.gdtr = vmcb->save.gdtr; nested_vmcb->save.idtr = vmcb->save.idtr; + nested_vmcb->save.cr0 = svm->vcpu.arch.cr0; if (npt_enabled) nested_vmcb->save.cr3 = vmcb->save.cr3; + else + nested_vmcb->save.cr3 = svm->vcpu.arch.cr3; nested_vmcb->save.cr2 = vmcb->save.cr2; + nested_vmcb->save.cr4 = svm->vcpu.arch.cr4; nested_vmcb->save.rflags = vmcb->save.rflags; nested_vmcb->save.rip = vmcb->save.rip; nested_vmcb->save.rsp = vmcb->save.rsp; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 142/164] KVM: SVM: Fix nested msr intercept handling 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (140 preceding siblings ...) 2010-07-01 17:35 ` [patch 141/164] KVM: SVM: Sync all control registers on nested vmexit Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 143/164] KVM: SVM: Dont sync nested cr8 to lapic and back Greg KH ` (21 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> The nested_svm_exit_handled_msr() function maps only one page of the guests msr permission bitmap. This patch changes the code to use kvm_read_guest to fix the bug. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 4c7da8cb43c09e71a405b5aeaa58a1dbac3c39e9) --- arch/x86/kvm/svm.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1434,19 +1434,13 @@ static bool nested_svm_exit_handled_msr( { u32 param = svm->vmcb->control.exit_info_1 & 1; u32 msr = svm->vcpu.arch.regs[VCPU_REGS_RCX]; - struct page *page; bool ret = false; u32 t0, t1; - u8 *msrpm; + u8 val; if (!(svm->nested.intercept & (1ULL << INTERCEPT_MSR_PROT))) return false; - msrpm = nested_svm_map(svm, svm->nested.vmcb_msrpm, &page); - - if (!msrpm) - goto out; - switch (msr) { case 0 ... 0x1fff: t0 = (msr * 2) % 8; @@ -1467,11 +1461,10 @@ static bool nested_svm_exit_handled_msr( goto out; } - ret = msrpm[t1] & ((1 << param) << t0); + if (!kvm_read_guest(svm->vcpu.kvm, svm->nested.vmcb_msrpm + t1, &val, 1)) + ret = val & ((1 << param) << t0); out: - nested_svm_unmap(page); - return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 143/164] KVM: SVM: Dont sync nested cr8 to lapic and back 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (141 preceding siblings ...) 2010-07-01 17:35 ` [patch 142/164] KVM: SVM: Fix nested msr intercept handling Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 144/164] KVM: SVM: Fix wrong interrupt injection in enable_irq_windows Greg KH ` (20 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> This patch makes syncing of the guest tpr to the lapic conditional on !nested. Otherwise a nested guest using the TPR could freeze the guest. Another important change this patch introduces is that the cr8 intercept bits are no longer ORed at vmrun emulation if the guest sets VINTR_MASKING in its VMCB. The reason is that nested cr8 accesses need alway be handled by the nested hypervisor because they change the shadow version of the tpr. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 88ab24adc7142506c8583ac36a34fa388300b750) --- arch/x86/kvm/svm.c | 46 +++++++++++++++++++++++++++++++--------------- 1 file changed, 31 insertions(+), 15 deletions(-) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1805,21 +1805,6 @@ static bool nested_svm_vmrun(struct vcpu svm->vmcb->save.dr6 = nested_vmcb->save.dr6; svm->vmcb->save.cpl = nested_vmcb->save.cpl; - /* We don't want a nested guest to be more powerful than the guest, - so all intercepts are ORed */ - svm->vmcb->control.intercept_cr_read |= - nested_vmcb->control.intercept_cr_read; - svm->vmcb->control.intercept_cr_write |= - nested_vmcb->control.intercept_cr_write; - svm->vmcb->control.intercept_dr_read |= - nested_vmcb->control.intercept_dr_read; - svm->vmcb->control.intercept_dr_write |= - nested_vmcb->control.intercept_dr_write; - svm->vmcb->control.intercept_exceptions |= - nested_vmcb->control.intercept_exceptions; - - svm->vmcb->control.intercept |= nested_vmcb->control.intercept; - svm->nested.vmcb_msrpm = nested_vmcb->control.msrpm_base_pa; /* cache intercepts */ @@ -1837,6 +1822,28 @@ static bool nested_svm_vmrun(struct vcpu else svm->vcpu.arch.hflags &= ~HF_VINTR_MASK; + if (svm->vcpu.arch.hflags & HF_VINTR_MASK) { + /* We only want the cr8 intercept bits of the guest */ + svm->vmcb->control.intercept_cr_read &= ~INTERCEPT_CR8_MASK; + svm->vmcb->control.intercept_cr_write &= ~INTERCEPT_CR8_MASK; + } + + /* We don't want a nested guest to be more powerful than the guest, + so all intercepts are ORed */ + svm->vmcb->control.intercept_cr_read |= + nested_vmcb->control.intercept_cr_read; + svm->vmcb->control.intercept_cr_write |= + nested_vmcb->control.intercept_cr_write; + svm->vmcb->control.intercept_dr_read |= + nested_vmcb->control.intercept_dr_read; + svm->vmcb->control.intercept_dr_write |= + nested_vmcb->control.intercept_dr_write; + svm->vmcb->control.intercept_exceptions |= + nested_vmcb->control.intercept_exceptions; + + svm->vmcb->control.intercept |= nested_vmcb->control.intercept; + + svm->vmcb->control.lbr_ctl = nested_vmcb->control.lbr_ctl; svm->vmcb->control.int_vector = nested_vmcb->control.int_vector; svm->vmcb->control.int_state = nested_vmcb->control.int_state; svm->vmcb->control.tsc_offset += nested_vmcb->control.tsc_offset; @@ -2500,6 +2507,9 @@ static void update_cr8_intercept(struct { struct vcpu_svm *svm = to_svm(vcpu); + if (is_nested(svm) && (vcpu->arch.hflags & HF_VINTR_MASK)) + return; + if (irr == -1) return; @@ -2603,6 +2613,9 @@ static inline void sync_cr8_to_lapic(str { struct vcpu_svm *svm = to_svm(vcpu); + if (is_nested(svm) && (vcpu->arch.hflags & HF_VINTR_MASK)) + return; + if (!(svm->vmcb->control.intercept_cr_write & INTERCEPT_CR8_MASK)) { int cr8 = svm->vmcb->control.int_ctl & V_TPR_MASK; kvm_set_cr8(vcpu, cr8); @@ -2614,6 +2627,9 @@ static inline void sync_lapic_to_cr8(str struct vcpu_svm *svm = to_svm(vcpu); u64 cr8; + if (is_nested(svm) && (vcpu->arch.hflags & HF_VINTR_MASK)) + return; + cr8 = kvm_get_cr8(vcpu); svm->vmcb->control.int_ctl &= ~V_TPR_MASK; svm->vmcb->control.int_ctl |= cr8 & V_TPR_MASK; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 144/164] KVM: SVM: Fix wrong interrupt injection in enable_irq_windows 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (142 preceding siblings ...) 2010-07-01 17:35 ` [patch 143/164] KVM: SVM: Dont sync nested cr8 to lapic and back Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 145/164] KVM: s390: Fix possible memory leak of in kvm_arch_vcpu_create() Greg KH ` (19 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> The nested_svm_intr() function does not execute the vmexit anymore. Therefore we may still be in the nested state after that function ran. This patch changes the nested_svm_intr() function to return wether the irq window could be enabled. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 8fe546547cf6857a9d984bfe2f2194910f3fc5d0) --- arch/x86/kvm/svm.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1377,16 +1377,17 @@ static int nested_svm_check_exception(st return vmexit; } -static inline int nested_svm_intr(struct vcpu_svm *svm) +/* This function returns true if it is save to enable the irq window */ +static inline bool nested_svm_intr(struct vcpu_svm *svm) { if (!is_nested(svm)) - return 0; + return true; if (!(svm->vcpu.arch.hflags & HF_VINTR_MASK)) - return 0; + return true; if (!(svm->vcpu.arch.hflags & HF_HIF_MASK)) - return 0; + return false; svm->vmcb->control.exit_code = SVM_EXIT_INTR; @@ -1399,10 +1400,10 @@ static inline int nested_svm_intr(struct */ svm->nested.exit_required = true; trace_kvm_nested_intr_vmexit(svm->vmcb->save.rip); - return 1; + return false; } - return 0; + return true; } static void *nested_svm_map(struct vcpu_svm *svm, u64 gpa, struct page **_page) @@ -2567,13 +2568,11 @@ static void enable_irq_window(struct kvm { struct vcpu_svm *svm = to_svm(vcpu); - nested_svm_intr(svm); - /* In case GIF=0 we can't rely on the CPU to tell us when * GIF becomes 1, because that's a separate STGI/VMRUN intercept. * The next time we get that intercept, this function will be * called again though and we'll get the vintr intercept. */ - if (gif_set(svm)) { + if (gif_set(svm) && nested_svm_intr(svm)) { svm_set_vintr(svm); svm_inject_irq(svm, 0x0); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 145/164] KVM: s390: Fix possible memory leak of in kvm_arch_vcpu_create() 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (143 preceding siblings ...) 2010-07-01 17:35 ` [patch 144/164] KVM: SVM: Fix wrong interrupt injection in enable_irq_windows Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 146/164] KVM: PPC: Do not create debugfs if fail to create vcpu Greg KH ` (18 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Wei Yongjun, Carsten Otte, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wei Yongjun <yjwei@cn.fujitsu.com> This patch fixed possible memory leak in kvm_arch_vcpu_create() under s390, which would happen when kvm_arch_vcpu_create() fails. Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Acked-by: Carsten Otte <cotte@de.ibm.com> Cc: stable@kernel.org Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 7b06bf2ffa15e119c7439ed0b024d44f66d7b605) --- arch/s390/kvm/kvm-s390.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -339,11 +339,13 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st rc = kvm_vcpu_init(vcpu, kvm, id); if (rc) - goto out_free_cpu; + goto out_free_sie_block; VM_EVENT(kvm, 3, "create cpu %d at %p, sie block at %p", id, vcpu, vcpu->arch.sie_block); return vcpu; +out_free_sie_block: + free_page((unsigned long)(vcpu->arch.sie_block)); out_free_cpu: kfree(vcpu); out_nomem: ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 146/164] KVM: PPC: Do not create debugfs if fail to create vcpu 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (144 preceding siblings ...) 2010-07-01 17:35 ` [patch 145/164] KVM: s390: Fix possible memory leak of in kvm_arch_vcpu_create() Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 147/164] KVM: x86: Add callback to let modules decide over some supported cpuid bits Greg KH ` (17 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Wei Yongjun, Alexander Graf, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wei Yongjun <yjwei@cn.fujitsu.com> If fail to create the vcpu, we should not create the debugfs for it. Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Acked-by: Alexander Graf <agraf@suse.de> Cc: stable@kernel.org Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 06056bfb944a0302a8f22eb45f09123de7fb417b) --- arch/powerpc/kvm/powerpc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/arch/powerpc/kvm/powerpc.c +++ b/arch/powerpc/kvm/powerpc.c @@ -181,7 +181,8 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st { struct kvm_vcpu *vcpu; vcpu = kvmppc_core_vcpu_create(kvm, id); - kvmppc_create_vcpu_debugfs(vcpu, id); + if (!IS_ERR(vcpu)) + kvmppc_create_vcpu_debugfs(vcpu, id); return vcpu; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 147/164] KVM: x86: Add callback to let modules decide over some supported cpuid bits 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (145 preceding siblings ...) 2010-07-01 17:35 ` [patch 146/164] KVM: PPC: Do not create debugfs if fail to create vcpu Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 148/164] KVM: SVM: Report emulated SVM features to userspace Greg KH ` (16 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> This patch adds the get_supported_cpuid callback to kvm_x86_ops. It will be used in do_cpuid_ent to delegate the decission about some supported cpuid bits to the architecture modules. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit d4330ef2fb2236a1e3a176f0f68360f4c0a8661b) --- arch/x86/include/asm/kvm_host.h | 2 ++ arch/x86/kvm/svm.c | 5 +++++ arch/x86/kvm/vmx.c | 5 +++++ arch/x86/kvm/x86.c | 3 +++ 4 files changed, 15 insertions(+) --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -533,6 +533,8 @@ struct kvm_x86_ops { u64 (*get_mt_mask)(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio); bool (*gb_page_enable)(void); + void (*set_supported_cpuid)(u32 func, struct kvm_cpuid_entry2 *entry); + const struct trace_print_flags *exit_reasons_str; }; --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -2885,6 +2885,10 @@ static u64 svm_get_mt_mask(struct kvm_vc return 0; } +static void svm_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry) +{ +} + static const struct trace_print_flags svm_exit_reasons_str[] = { { SVM_EXIT_READ_CR0, "read_cr0" }, { SVM_EXIT_READ_CR3, "read_cr3" }, @@ -3009,6 +3013,7 @@ static struct kvm_x86_ops svm_x86_ops = .exit_reasons_str = svm_exit_reasons_str, .gb_page_enable = svm_gb_page_enable, + .set_supported_cpuid = svm_set_supported_cpuid, }; static int __init svm_init(void) --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -3993,6 +3993,10 @@ static bool vmx_gb_page_enable(void) return false; } +static void vmx_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry) +{ +} + static struct kvm_x86_ops vmx_x86_ops = { .cpu_has_kvm_support = cpu_has_kvm_support, .disabled_by_bios = vmx_disabled_by_bios, @@ -4057,6 +4061,7 @@ static struct kvm_x86_ops vmx_x86_ops = .exit_reasons_str = vmx_exit_reasons_str, .gb_page_enable = vmx_gb_page_enable, + .set_supported_cpuid = vmx_set_supported_cpuid, }; static int __init vmx_init(void) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1688,6 +1688,9 @@ static void do_cpuid_ent(struct kvm_cpui entry->ecx &= kvm_supported_word6_x86_features; break; } + + kvm_x86_ops->set_supported_cpuid(function, entry); + put_cpu(); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 148/164] KVM: SVM: Report emulated SVM features to userspace 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (146 preceding siblings ...) 2010-07-01 17:35 ` [patch 147/164] KVM: x86: Add callback to let modules decide over some supported cpuid bits Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 149/164] x86, paravirt: Add a global synchronization point for pvclock Greg KH ` (15 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> This patch implements the reporting of the emulated SVM features to userspace instead of the real hardware capabilities. Every real hardware capability needs emulation in nested svm so the old behavior was broken. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit c2c63a493924e09a1984d1374a0e60dfd54fc0b0) --- arch/x86/kvm/svm.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -2887,6 +2887,16 @@ static u64 svm_get_mt_mask(struct kvm_vc static void svm_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry) { + switch (func) { + case 0x8000000A: + entry->eax = 1; /* SVM revision 1 */ + entry->ebx = 8; /* Lets support 8 ASIDs in case we add proper + ASID emulation to nested SVM */ + entry->ecx = 0; /* Reserved */ + entry->edx = 0; /* Do not support any additional features */ + + break; + } } static const struct trace_print_flags svm_exit_reasons_str[] = { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 149/164] x86, paravirt: Add a global synchronization point for pvclock 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (147 preceding siblings ...) 2010-07-01 17:35 ` [patch 148/164] KVM: SVM: Report emulated SVM features to userspace Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 150/164] KVM: Dont allow lmsw to clear cr0.pe Greg KH ` (14 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Avi Kivity, Marcelo Tosatti 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Glauber Costa <glommer@redhat.com> In recent stress tests, it was found that pvclock-based systems could seriously warp in smp systems. Using ingo's time-warp-test.c, I could trigger a scenario as bad as 1.5mi warps a minute in some systems. (to be fair, it wasn't that bad in most of them). Investigating further, I found out that such warps were caused by the very offset-based calculation pvclock is based on. This happens even on some machines that report constant_tsc in its tsc flags, specially on multi-socket ones. Two reads of the same kernel timestamp at approx the same time, will likely have tsc timestamped in different occasions too. This means the delta we calculate is unpredictable at best, and can probably be smaller in a cpu that is legitimately reading clock in a forward ocasion. Some adjustments on the host could make this window less likely to happen, but still, it pretty much poses as an intrinsic problem of the mechanism. A while ago, I though about using a shared variable anyway, to hold clock last state, but gave up due to the high contention locking was likely to introduce, possibly rendering the thing useless on big machines. I argue, however, that locking is not necessary. We do a read-and-return sequence in pvclock, and between read and return, the global value can have changed. However, it can only have changed by means of an addition of a positive value. So if we detected that our clock timestamp is less than the current global, we know that we need to return a higher one, even though it is not exactly the one we compared to. OTOH, if we detect we're greater than the current time source, we atomically replace the value with our new readings. This do causes contention on big boxes (but big here means *BIG*), but it seems like a good trade off, since it provide us with a time source guaranteed to be stable wrt time warps. After this patch is applied, I don't see a single warp in time during 5 days of execution, in any of the machines I saw them before. Signed-off-by: Glauber Costa <glommer@redhat.com> Acked-by: Zachary Amsden <zamsden@redhat.com> CC: Jeremy Fitzhardinge <jeremy@goop.org> CC: Avi Kivity <avi@redhat.com> CC: Marcelo Tosatti <mtosatti@redhat.com> CC: Zachary Amsden <zamsden@redhat.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 489fb490dbf8dab0249ad82b56688ae3842a79e8) --- arch/x86/kernel/pvclock.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) --- a/arch/x86/kernel/pvclock.c +++ b/arch/x86/kernel/pvclock.c @@ -109,11 +109,14 @@ unsigned long pvclock_tsc_khz(struct pvc return pv_tsc_khz; } +static atomic64_t last_value = ATOMIC64_INIT(0); + cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src) { struct pvclock_shadow_time shadow; unsigned version; cycle_t ret, offset; + u64 last; do { version = pvclock_get_time_values(&shadow, src); @@ -123,6 +126,27 @@ cycle_t pvclock_clocksource_read(struct barrier(); } while (version != src->version); + /* + * Assumption here is that last_value, a global accumulator, always goes + * forward. If we are less than that, we should not be much smaller. + * We assume there is an error marging we're inside, and then the correction + * does not sacrifice accuracy. + * + * For reads: global may have changed between test and return, + * but this means someone else updated poked the clock at a later time. + * We just need to make sure we are not seeing a backwards event. + * + * For updates: last_value = ret is not enough, since two vcpus could be + * updating at the same time, and one of them could be slightly behind, + * making the assumption that last_value always go forward fail to hold. + */ + last = atomic64_read(&last_value); + do { + if (ret < last) + return last; + last = atomic64_cmpxchg(&last_value, last, ret); + } while (unlikely(last != ret)); + return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 150/164] KVM: Dont allow lmsw to clear cr0.pe 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (148 preceding siblings ...) 2010-07-01 17:35 ` [patch 149/164] x86, paravirt: Add a global synchronization point for pvclock Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 151/164] KVM: x86: Check LMA bit before set_efer Greg KH ` (13 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Avi Kivity, Marcelo Tosatti 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Avi Kivity <avi@redhat.com> The current lmsw implementation allows the guest to clear cr0.pe, contrary to the manual, which breaks EMM386.EXE. Fix by ORing the old cr0.pe with lmsw's operand. Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit f78e917688edbf1f14c318d2e50dc8e7dad20445) --- arch/x86/kvm/x86.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -432,7 +432,7 @@ EXPORT_SYMBOL_GPL(kvm_set_cr0); void kvm_lmsw(struct kvm_vcpu *vcpu, unsigned long msw) { - kvm_set_cr0(vcpu, (vcpu->arch.cr0 & ~0x0ful) | (msw & 0x0f)); + kvm_set_cr0(vcpu, (vcpu->arch.cr0 & ~0x0eul) | (msw & 0x0f)); } EXPORT_SYMBOL_GPL(kvm_lmsw); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 151/164] KVM: x86: Check LMA bit before set_efer 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (149 preceding siblings ...) 2010-07-01 17:35 ` [patch 150/164] KVM: Dont allow lmsw to clear cr0.pe Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 152/164] KVM: MMU: Segregate shadow pages with different cr0.wp Greg KH ` (12 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Sheng Yang, Marcelo Tosatti 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sheng Yang <sheng@linux.intel.com> kvm_x86_ops->set_efer() would execute vcpu->arch.efer = efer, so the checking of LMA bit didn't work. Signed-off-by: Sheng Yang <sheng@linux.intel.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit a3d204e28579427609c3d15d2310127ebaa47d94) --- arch/x86/kvm/x86.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -603,11 +603,11 @@ static void set_efer(struct kvm_vcpu *vc } } - kvm_x86_ops->set_efer(vcpu, efer); - efer &= ~EFER_LMA; efer |= vcpu->arch.shadow_efer & EFER_LMA; + kvm_x86_ops->set_efer(vcpu, efer); + vcpu->arch.shadow_efer = efer; vcpu->arch.mmu.base_role.nxe = (efer & EFER_NX) && !tdp_enabled; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 152/164] KVM: MMU: Segregate shadow pages with different cr0.wp 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (150 preceding siblings ...) 2010-07-01 17:35 ` [patch 151/164] KVM: x86: Check LMA bit before set_efer Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 153/164] KVM: VMX: enable VMXON check with SMX enabled (Intel TXT) Greg KH ` (11 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Avi Kivity, Marcelo Tosatti 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Avi Kivity <avi@redhat.com> When cr0.wp=0, we may shadow a gpte having u/s=1 and r/w=0 with an spte having u/s=0 and r/w=1. This allows excessive access if the guest sets cr0.wp=1 and accesses through this spte. Fix by making cr0.wp part of the base role; we'll have different sptes for the two cases and the problem disappears. Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 3dbe141595faa48a067add3e47bba3205b79d33c) --- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/mmu.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -193,6 +193,7 @@ union kvm_mmu_page_role { unsigned invalid:1; unsigned cr4_pge:1; unsigned nxe:1; + unsigned cr0_wp:1; }; }; --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -227,7 +227,7 @@ void kvm_mmu_set_mask_ptes(u64 user_mask } EXPORT_SYMBOL_GPL(kvm_mmu_set_mask_ptes); -static int is_write_protection(struct kvm_vcpu *vcpu) +static bool is_write_protection(struct kvm_vcpu *vcpu) { return vcpu->arch.cr0 & X86_CR0_WP; } @@ -2448,6 +2448,7 @@ static int init_kvm_softmmu(struct kvm_v r = paging32_init_context(vcpu); vcpu->arch.mmu.base_role.glevels = vcpu->arch.mmu.root_level; + vcpu->arch.mmu.base_role.cr0_wp = is_write_protection(vcpu); return r; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 153/164] KVM: VMX: enable VMXON check with SMX enabled (Intel TXT) 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (151 preceding siblings ...) 2010-07-01 17:35 ` [patch 152/164] KVM: MMU: Segregate shadow pages with different cr0.wp Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 154/164] KVM: MMU: Dont read pdptrs with mmu spinlock held in mmu_alloc_roots Greg KH ` (10 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Shane Wang, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shane Wang <shane.wang@intel.com> Per document, for feature control MSR: Bit 1 enables VMXON in SMX operation. If the bit is clear, execution of VMXON in SMX operation causes a general-protection exception. Bit 2 enables VMXON outside SMX operation. If the bit is clear, execution of VMXON outside SMX operation causes a general-protection exception. This patch is to enable this kind of check with SMX for VMXON in KVM. Signed-off-by: Shane Wang <shane.wang@intel.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit cafd66595d92591e4bd25c3904e004fc6f897e2d) --- arch/x86/include/asm/msr-index.h | 5 +++-- arch/x86/kernel/tboot.c | 1 + arch/x86/kvm/vmx.c | 32 +++++++++++++++++++++----------- include/linux/tboot.h | 1 + 4 files changed, 26 insertions(+), 13 deletions(-) --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -199,8 +199,9 @@ #define MSR_IA32_EBL_CR_POWERON 0x0000002a #define MSR_IA32_FEATURE_CONTROL 0x0000003a -#define FEATURE_CONTROL_LOCKED (1<<0) -#define FEATURE_CONTROL_VMXON_ENABLED (1<<2) +#define FEATURE_CONTROL_LOCKED (1<<0) +#define FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX (1<<1) +#define FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX (1<<2) #define MSR_IA32_APICBASE 0x0000001b #define MSR_IA32_APICBASE_BSP (1<<8) --- a/arch/x86/kernel/tboot.c +++ b/arch/x86/kernel/tboot.c @@ -46,6 +46,7 @@ /* Global pointer to shared data; NULL means no measured launch. */ struct tboot *tboot __read_mostly; +EXPORT_SYMBOL(tboot); /* timeout for APs (in secs) to enter wait-for-SIPI state during shutdown */ #define AP_WAIT_TIMEOUT 1 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -26,6 +26,7 @@ #include <linux/sched.h> #include <linux/moduleparam.h> #include <linux/ftrace_event.h> +#include <linux/tboot.h> #include "kvm_cache_regs.h" #include "x86.h" @@ -1125,9 +1126,16 @@ static __init int vmx_disabled_by_bios(v u64 msr; rdmsrl(MSR_IA32_FEATURE_CONTROL, msr); - return (msr & (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) - == FEATURE_CONTROL_LOCKED; + if (msr & FEATURE_CONTROL_LOCKED) { + if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX) + && tboot_enabled()) + return 1; + if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX) + && !tboot_enabled()) + return 1; + } + + return 0; /* locked but not enabled */ } @@ -1135,21 +1143,23 @@ static int hardware_enable(void *garbage { int cpu = raw_smp_processor_id(); u64 phys_addr = __pa(per_cpu(vmxarea, cpu)); - u64 old; + u64 old, test_bits; if (read_cr4() & X86_CR4_VMXE) return -EBUSY; INIT_LIST_HEAD(&per_cpu(vcpus_on_cpu, cpu)); rdmsrl(MSR_IA32_FEATURE_CONTROL, old); - if ((old & (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) - != (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) + + test_bits = FEATURE_CONTROL_LOCKED; + test_bits |= FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX; + if (tboot_enabled()) + test_bits |= FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX; + + if ((old & test_bits) != test_bits) { /* enable and lock */ - wrmsrl(MSR_IA32_FEATURE_CONTROL, old | - FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED); + wrmsrl(MSR_IA32_FEATURE_CONTROL, old | test_bits); + } write_cr4(read_cr4() | X86_CR4_VMXE); /* FIXME: not cpu hotplug safe */ asm volatile (ASM_VMX_VMXON_RAX : : "a"(&phys_addr), "m"(phys_addr) --- a/include/linux/tboot.h +++ b/include/linux/tboot.h @@ -150,6 +150,7 @@ extern int tboot_force_iommu(void); #else +#define tboot_enabled() 0 #define tboot_probe() do { } while (0) #define tboot_shutdown(shutdown_type) do { } while (0) #define tboot_sleep(sleep_state, pm1a_control, pm1b_control) \ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 154/164] KVM: MMU: Dont read pdptrs with mmu spinlock held in mmu_alloc_roots 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (152 preceding siblings ...) 2010-07-01 17:35 ` [patch 153/164] KVM: VMX: enable VMXON check with SMX enabled (Intel TXT) Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 155/164] KVM: Fix wallclock version writing race Greg KH ` (9 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Avi Kivity <avi@redhat.com> On svm, kvm_read_pdptr() may require reading guest memory, which can sleep. Push the spinlock into mmu_alloc_roots(), and only take it after we've read the pdptr. Tested-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 8facbbff071ff2b19268d3732e31badc60471e21) --- arch/x86/kvm/mmu.c | 9 +++++++++ 1 file changed, 9 insertions(+) --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -2097,11 +2097,14 @@ static int mmu_alloc_roots(struct kvm_vc direct = 1; if (mmu_check_root(vcpu, root_gfn)) return 1; + + spin_lock(&vcpu->kvm->mmu_lock); sp = kvm_mmu_get_page(vcpu, root_gfn, 0, PT64_ROOT_LEVEL, direct, ACC_ALL, NULL); root = __pa(sp->spt); ++sp->root_count; + spin_unlock(&vcpu->kvm->mmu_lock); vcpu->arch.mmu.root_hpa = root; return 0; } @@ -2123,11 +2126,15 @@ static int mmu_alloc_roots(struct kvm_vc root_gfn = 0; if (mmu_check_root(vcpu, root_gfn)) return 1; + + spin_lock(&vcpu->kvm->mmu_lock); sp = kvm_mmu_get_page(vcpu, root_gfn, i << 30, PT32_ROOT_LEVEL, direct, ACC_ALL, NULL); root = __pa(sp->spt); ++sp->root_count; + spin_unlock(&vcpu->kvm->mmu_lock); + vcpu->arch.mmu.pae_root[i] = root | PT_PRESENT_MASK; } vcpu->arch.mmu.root_hpa = __pa(vcpu->arch.mmu.pae_root); @@ -2488,7 +2495,9 @@ int kvm_mmu_load(struct kvm_vcpu *vcpu) goto out; spin_lock(&vcpu->kvm->mmu_lock); kvm_mmu_free_some_pages(vcpu); + spin_unlock(&vcpu->kvm->mmu_lock); r = mmu_alloc_roots(vcpu); + spin_lock(&vcpu->kvm->mmu_lock); mmu_sync_roots(vcpu); spin_unlock(&vcpu->kvm->mmu_lock); if (r) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 155/164] KVM: Fix wallclock version writing race 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (153 preceding siblings ...) 2010-07-01 17:35 ` [patch 154/164] KVM: MMU: Dont read pdptrs with mmu spinlock held in mmu_alloc_roots Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 156/164] KVM: PPC: Add missing vcpu_load()/vcpu_put() in vcpu ioctls Greg KH ` (8 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Glauber Costa, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Avi Kivity <avi@redhat.com> Wallclock writing uses an unprotected global variable to hold the version; this can cause one guest to interfere with another if both write their wallclock at the same time. Acked-by: Glauber Costa <glommer@redhat.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 9ed3c444ab8987c7b219173a2f7807e3f71e234e) --- arch/x86/kvm/x86.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -641,14 +641,22 @@ static int do_set_msr(struct kvm_vcpu *v static void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock) { - static int version; + int version; + int r; struct pvclock_wall_clock wc; struct timespec boot; if (!wall_clock) return; - version++; + r = kvm_read_guest(kvm, wall_clock, &version, sizeof(version)); + if (r) + return; + + if (version & 1) + ++version; /* first time write, random junk */ + + ++version; kvm_write_guest(kvm, wall_clock, &version, sizeof(version)); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 156/164] KVM: PPC: Add missing vcpu_load()/vcpu_put() in vcpu ioctls 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (154 preceding siblings ...) 2010-07-01 17:35 ` [patch 155/164] KVM: Fix wallclock version writing race Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 157/164] KVM: x86: Add missing locking to arch specific " Greg KH ` (7 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Avi Kivity <avi@redhat.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 98001d8d017cea1ee0f9f35c6227bbd63ef5005b) --- arch/powerpc/kvm/book3s.c | 10 ++++++++++ arch/powerpc/kvm/booke.c | 15 ++++++++++++++- 2 files changed, 24 insertions(+), 1 deletion(-) --- a/arch/powerpc/kvm/book3s.c +++ b/arch/powerpc/kvm/book3s.c @@ -766,6 +766,8 @@ int kvm_arch_vcpu_ioctl_get_sregs(struct struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu); int i; + vcpu_load(vcpu); + sregs->pvr = vcpu->arch.pvr; sregs->u.s.sdr1 = to_book3s(vcpu)->sdr1; @@ -784,6 +786,9 @@ int kvm_arch_vcpu_ioctl_get_sregs(struct sregs->u.s.ppc32.dbat[i] = vcpu3s->dbat[i].raw; } } + + vcpu_put(vcpu); + return 0; } @@ -793,6 +798,8 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu); int i; + vcpu_load(vcpu); + kvmppc_set_pvr(vcpu, sregs->pvr); vcpu3s->sdr1 = sregs->u.s.sdr1; @@ -819,6 +826,9 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct /* Flush the MMU after messing with the segments */ kvmppc_mmu_pte_flush(vcpu, 0, 0); + + vcpu_put(vcpu); + return 0; } --- a/arch/powerpc/kvm/booke.c +++ b/arch/powerpc/kvm/booke.c @@ -443,6 +443,8 @@ int kvm_arch_vcpu_ioctl_get_regs(struct { int i; + vcpu_load(vcpu); + regs->pc = vcpu->arch.pc; regs->cr = vcpu->arch.cr; regs->ctr = vcpu->arch.ctr; @@ -463,6 +465,8 @@ int kvm_arch_vcpu_ioctl_get_regs(struct for (i = 0; i < ARRAY_SIZE(regs->gpr); i++) regs->gpr[i] = vcpu->arch.gpr[i]; + vcpu_put(vcpu); + return 0; } @@ -470,6 +474,8 @@ int kvm_arch_vcpu_ioctl_set_regs(struct { int i; + vcpu_load(vcpu); + vcpu->arch.pc = regs->pc; vcpu->arch.cr = regs->cr; vcpu->arch.ctr = regs->ctr; @@ -489,6 +495,8 @@ int kvm_arch_vcpu_ioctl_set_regs(struct for (i = 0; i < ARRAY_SIZE(vcpu->arch.gpr); i++) vcpu->arch.gpr[i] = regs->gpr[i]; + vcpu_put(vcpu); + return 0; } @@ -517,7 +525,12 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct k int kvm_arch_vcpu_ioctl_translate(struct kvm_vcpu *vcpu, struct kvm_translation *tr) { - return kvmppc_core_vcpu_translate(vcpu, tr); + int r; + + vcpu_load(vcpu); + r = kvmppc_core_vcpu_translate(vcpu, tr); + vcpu_put(vcpu); + return r; } int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm, struct kvm_dirty_log *log) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 157/164] KVM: x86: Add missing locking to arch specific vcpu ioctls 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (155 preceding siblings ...) 2010-07-01 17:35 ` [patch 156/164] KVM: PPC: Add missing vcpu_load()/vcpu_put() in vcpu ioctls Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 158/164] KVM: x86: Inject #GP with the right rip on efer writes Greg KH ` (6 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Avi Kivity <avi@redhat.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 8fbf065d625617bbbf6b72d5f78f84ad13c8b547) --- arch/x86/kvm/x86.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1550,6 +1550,7 @@ static int kvm_vcpu_ioctl_get_cpuid2(str { int r; + vcpu_load(vcpu); r = -E2BIG; if (cpuid->nent < vcpu->arch.cpuid_nent) goto out; @@ -1561,6 +1562,7 @@ static int kvm_vcpu_ioctl_get_cpuid2(str out: cpuid->nent = vcpu->arch.cpuid_nent; + vcpu_put(vcpu); return r; } @@ -1813,6 +1815,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce( int r; unsigned bank_num = mcg_cap & 0xff, bank; + vcpu_load(vcpu); r = -EINVAL; if (!bank_num || bank_num >= KVM_MAX_MCE_BANKS) goto out; @@ -1827,6 +1830,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce( for (bank = 0; bank < bank_num; bank++) vcpu->arch.mce_banks[bank*4] = ~(u64)0; out: + vcpu_put(vcpu); return r; } @@ -2094,7 +2098,9 @@ long kvm_arch_vcpu_ioctl(struct file *fi r = -EFAULT; if (copy_from_user(&mce, argp, sizeof mce)) goto out; + vcpu_load(vcpu); r = kvm_vcpu_ioctl_x86_set_mce(vcpu, &mce); + vcpu_put(vcpu); break; } case KVM_GET_VCPU_EVENTS: { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 158/164] KVM: x86: Inject #GP with the right rip on efer writes 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (156 preceding siblings ...) 2010-07-01 17:35 ` [patch 157/164] KVM: x86: Add missing locking to arch specific " Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 159/164] KVM: SVM: Dont allow nested guest to VMMCALL into host Greg KH ` (5 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Roedel, Joerg <Joerg.Roedel@amd.com> This patch fixes a bug in the KVM efer-msr write path. If a guest writes to a reserved efer bit the set_efer function injects the #GP directly. The architecture dependent wrmsr function does not see this, assumes success and advances the rip. This results in a #GP in the guest with the wrong rip. This patch fixes this by reporting efer write errors back to the architectural wrmsr function. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit b69e8caef5b190af48c525f6d715e7b7728a77f6) --- arch/x86/kvm/x86.c | 31 ++++++++++++------------------- 1 file changed, 12 insertions(+), 19 deletions(-) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -570,37 +570,29 @@ static u32 emulated_msrs[] = { MSR_IA32_MISC_ENABLE, }; -static void set_efer(struct kvm_vcpu *vcpu, u64 efer) +static int set_efer(struct kvm_vcpu *vcpu, u64 efer) { - if (efer & efer_reserved_bits) { - kvm_inject_gp(vcpu, 0); - return; - } + if (efer & efer_reserved_bits) + return 1; if (is_paging(vcpu) - && (vcpu->arch.shadow_efer & EFER_LME) != (efer & EFER_LME)) { - kvm_inject_gp(vcpu, 0); - return; - } + && (vcpu->arch.shadow_efer & EFER_LME) != (efer & EFER_LME)) + return 1; if (efer & EFER_FFXSR) { struct kvm_cpuid_entry2 *feat; feat = kvm_find_cpuid_entry(vcpu, 0x80000001, 0); - if (!feat || !(feat->edx & bit(X86_FEATURE_FXSR_OPT))) { - kvm_inject_gp(vcpu, 0); - return; - } + if (!feat || !(feat->edx & bit(X86_FEATURE_FXSR_OPT))) + return 1; } if (efer & EFER_SVME) { struct kvm_cpuid_entry2 *feat; feat = kvm_find_cpuid_entry(vcpu, 0x80000001, 0); - if (!feat || !(feat->ecx & bit(X86_FEATURE_SVM))) { - kvm_inject_gp(vcpu, 0); - return; - } + if (!feat || !(feat->ecx & bit(X86_FEATURE_SVM))) + return 1; } efer &= ~EFER_LMA; @@ -612,6 +604,8 @@ static void set_efer(struct kvm_vcpu *vc vcpu->arch.mmu.base_role.nxe = (efer & EFER_NX) && !tdp_enabled; kvm_mmu_reset_context(vcpu); + + return 0; } void kvm_enable_efer_bits(u64 mask) @@ -946,8 +940,7 @@ int kvm_set_msr_common(struct kvm_vcpu * { switch (msr) { case MSR_EFER: - set_efer(vcpu, data); - break; + return set_efer(vcpu, data); case MSR_K7_HWCR: data &= ~(u64)0x40; /* ignore flush filter disable */ if (data != 0) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 159/164] KVM: SVM: Dont allow nested guest to VMMCALL into host 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (157 preceding siblings ...) 2010-07-01 17:35 ` [patch 158/164] KVM: x86: Inject #GP with the right rip on efer writes Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 160/164] parisc: clear floating point exception flag on SIGFPE signal Greg KH ` (4 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> This patch disables the possibility for a l2-guest to do a VMMCALL directly into the host. This would happen if the l1-hypervisor doesn't intercept VMMCALL and the l2-guest executes this instruction. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (cherry picked from commit 0d945bd9351199744c1e89d57a70615b6ee9f394) --- arch/x86/kvm/svm.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1829,8 +1829,13 @@ static bool nested_svm_vmrun(struct vcpu svm->vmcb->control.intercept_cr_write &= ~INTERCEPT_CR8_MASK; } - /* We don't want a nested guest to be more powerful than the guest, - so all intercepts are ORed */ + /* We don't want to see VMMCALLs from a nested guest */ + svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMMCALL); + + /* + * We don't want a nested guest to be more powerful than the guest, so + * all intercepts are ORed + */ svm->vmcb->control.intercept_cr_read |= nested_vmcb->control.intercept_cr_read; svm->vmcb->control.intercept_cr_write |= ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 160/164] parisc: clear floating point exception flag on SIGFPE signal 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (158 preceding siblings ...) 2010-07-01 17:35 ` [patch 159/164] KVM: SVM: Dont allow nested guest to VMMCALL into host Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 161/164] KEYS: Return more accurate error codes Greg KH ` (3 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Helge Deller, Kyle McMartin 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Helge Deller <deller@gmx.de> commit 550f0d922286556c7ea43974bb7921effb5a5278 upstream. Clear the floating point exception flag before returning to user space. This is needed, else the libc trampoline handler may hit the same SIGFPE again while building up a trampoline to a signal handler. Fixes debian bug #559406. Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Kyle McMartin <kyle@mcmartin.ca> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/parisc/math-emu/decode_exc.c | 1 + 1 file changed, 1 insertion(+) --- a/arch/parisc/math-emu/decode_exc.c +++ b/arch/parisc/math-emu/decode_exc.c @@ -342,6 +342,7 @@ decode_fpu(unsigned int Fpu_register[], return SIGNALCODE(SIGFPE, FPE_FLTINV); case DIVISIONBYZEROEXCEPTION: update_trap_counts(Fpu_register, aflags, bflags, trap_counts); + Clear_excp_register(exception_index); return SIGNALCODE(SIGFPE, FPE_FLTDIV); case INEXACTEXCEPTION: update_trap_counts(Fpu_register, aflags, bflags, trap_counts); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 161/164] KEYS: Return more accurate error codes 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (159 preceding siblings ...) 2010-07-01 17:35 ` [patch 160/164] parisc: clear floating point exception flag on SIGFPE signal Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 162/164] KEYS: find_keyring_by_name() can gain access to a freed keyring Greg KH ` (2 subsequent siblings) 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dan Carpenter, David Howells, James Morris 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Carpenter <error27@gmail.com> commit 4d09ec0f705cf88a12add029c058b53f288cfaa2 upstream. We were using the wrong variable here so the error codes weren't being returned properly. The original code returns -ENOKEY. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <jmorris@namei.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- security/keys/process_keys.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/security/keys/process_keys.c +++ b/security/keys/process_keys.c @@ -509,7 +509,7 @@ try_again: ret = install_thread_keyring(); if (ret < 0) { - key = ERR_PTR(ret); + key_ref = ERR_PTR(ret); goto error; } goto reget_creds; @@ -527,7 +527,7 @@ try_again: ret = install_process_keyring(); if (ret < 0) { - key = ERR_PTR(ret); + key_ref = ERR_PTR(ret); goto error; } goto reget_creds; @@ -586,7 +586,7 @@ try_again: case KEY_SPEC_GROUP_KEYRING: /* group keyrings are not yet supported */ - key = ERR_PTR(-EINVAL); + key_ref = ERR_PTR(-EINVAL); goto error; case KEY_SPEC_REQKEY_AUTH_KEY: ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 162/164] KEYS: find_keyring_by_name() can gain access to a freed keyring 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (160 preceding siblings ...) 2010-07-01 17:35 ` [patch 161/164] KEYS: Return more accurate error codes Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 163/164] [SCSI] qla2xxx: Disable MSI on qla24xx chips other than QLA2432 Greg KH 2010-07-01 17:35 ` [patch 164/164] sctp: fix append error cause to ERROR chunk correctly Greg KH 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, David Howells, Serge Hallyn, James Morris, Ben Hutchings, Chuck Ebbert 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Toshiyuki Okajima <toshi.okajima@jp.fujitsu.com> commit cea7daa3589d6b550546a8c8963599f7c1a3ae5c upstream. find_keyring_by_name() can gain access to a keyring that has had its reference count reduced to zero, and is thus ready to be freed. This then allows the dead keyring to be brought back into use whilst it is being destroyed. The following timeline illustrates the process: |(cleaner) (user) | | free_user(user) sys_keyctl() | | | | key_put(user->session_keyring) keyctl_get_keyring_ID() | || //=> keyring->usage = 0 | | |schedule_work(&key_cleanup_task) lookup_user_key() | || | | kmem_cache_free(,user) | | . |[KEY_SPEC_USER_KEYRING] | . install_user_keyrings() | . || | key_cleanup() [<= worker_thread()] || | | || | [spin_lock(&key_serial_lock)] |[mutex_lock(&key_user_keyr..mutex)] | | || | atomic_read() == 0 || | |{ rb_ease(&key->serial_node,) } || | | || | [spin_unlock(&key_serial_lock)] |find_keyring_by_name() | | ||| | keyring_destroy(keyring) ||[read_lock(&keyring_name_lock)] | || ||| | |[write_lock(&keyring_name_lock)] ||atomic_inc(&keyring->usage) | |. ||| *** GET freeing keyring *** | |. ||[read_unlock(&keyring_name_lock)] | || || | |list_del() |[mutex_unlock(&key_user_k..mutex)] | || | | |[write_unlock(&keyring_name_lock)] ** INVALID keyring is returned ** | | . | kmem_cache_free(,keyring) . | . | atomic_dec(&keyring->usage) v *** DESTROYED *** TIME If CONFIG_SLUB_DEBUG=y then we may see the following message generated: ============================================================================= BUG key_jar: Poison overwritten ----------------------------------------------------------------------------- INFO: 0xffff880197a7e200-0xffff880197a7e200. First byte 0x6a instead of 0x6b INFO: Allocated in key_alloc+0x10b/0x35f age=25 cpu=1 pid=5086 INFO: Freed in key_cleanup+0xd0/0xd5 age=12 cpu=1 pid=10 INFO: Slab 0xffffea000592cb90 objects=16 used=2 fp=0xffff880197a7e200 flags=0x200000000000c3 INFO: Object 0xffff880197a7e200 @offset=512 fp=0xffff880197a7e300 Bytes b4 0xffff880197a7e1f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ Object 0xffff880197a7e200: 6a 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b jkkkkkkkkkkkkkkk Alternatively, we may see a system panic happen, such as: BUG: unable to handle kernel NULL pointer dereference at 0000000000000001 IP: [<ffffffff810e61a3>] kmem_cache_alloc+0x5b/0xe9 PGD 6b2b4067 PUD 6a80d067 PMD 0 Oops: 0000 [#1] SMP last sysfs file: /sys/kernel/kexec_crash_loaded CPU 1 ... Pid: 31245, comm: su Not tainted 2.6.34-rc5-nofixed-nodebug #2 D2089/PRIMERGY RIP: 0010:[<ffffffff810e61a3>] [<ffffffff810e61a3>] kmem_cache_alloc+0x5b/0xe9 RSP: 0018:ffff88006af3bd98 EFLAGS: 00010002 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88007d19900b RDX: 0000000100000000 RSI: 00000000000080d0 RDI: ffffffff81828430 RBP: ffffffff81828430 R08: ffff88000a293750 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000100000 R12: 00000000000080d0 R13: 00000000000080d0 R14: 0000000000000296 R15: ffffffff810f20ce FS: 00007f97116bc700(0000) GS:ffff88000a280000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000001 CR3: 000000006a91c000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process su (pid: 31245, threadinfo ffff88006af3a000, task ffff8800374414c0) Stack: 0000000512e0958e 0000000000008000 ffff880037f8d180 0000000000000001 0000000000000000 0000000000008001 ffff88007d199000 ffffffff810f20ce 0000000000008000 ffff88006af3be48 0000000000000024 ffffffff810face3 Call Trace: [<ffffffff810f20ce>] ? get_empty_filp+0x70/0x12f [<ffffffff810face3>] ? do_filp_open+0x145/0x590 [<ffffffff810ce208>] ? tlb_finish_mmu+0x2a/0x33 [<ffffffff810ce43c>] ? unmap_region+0xd3/0xe2 [<ffffffff810e4393>] ? virt_to_head_page+0x9/0x2d [<ffffffff81103916>] ? alloc_fd+0x69/0x10e [<ffffffff810ef4ed>] ? do_sys_open+0x56/0xfc [<ffffffff81008a02>] ? system_call_fastpath+0x16/0x1b Code: 0f 1f 44 00 00 49 89 c6 fa 66 0f 1f 44 00 00 65 4c 8b 04 25 60 e8 00 00 48 8b 45 00 49 01 c0 49 8b 18 48 85 db 74 0d 48 63 45 18 <48> 8b 04 03 49 89 00 eb 14 4c 89 f9 83 ca ff 44 89 e6 48 89 ef RIP [<ffffffff810e61a3>] kmem_cache_alloc+0x5b/0xe9 This problem is that find_keyring_by_name does not confirm that the keyring is valid before accepting it. Skipping keyrings that have been reduced to a zero count seems the way to go. To this end, use atomic_inc_not_zero() to increment the usage count and skip the candidate keyring if that returns false. The following script _may_ cause the bug to happen, but there's no guarantee as the window of opportunity is small: #!/bin/sh LOOP=100000 USER=dummy_user /bin/su -c "exit;" $USER || { /usr/sbin/adduser -m $USER; add=1; } for ((i=0; i<LOOP; i++)) do /bin/su -c "echo '$i' > /dev/null" $USER done (( add == 1 )) && /usr/sbin/userdel -r $USER exit Note that the nominated user must not be in use. An alternative way of testing this may be: for ((i=0; i<100000; i++)) do keyctl session foo /bin/true || break done >&/dev/null as that uses a keyring named "foo" rather than relying on the user and user-session named keyrings. Reported-by: Toshiyuki Okajima <toshi.okajima@jp.fujitsu.com> Signed-off-by: David Howells <dhowells@redhat.com> Tested-by: Toshiyuki Okajima <toshi.okajima@jp.fujitsu.com> Acked-by: Serge Hallyn <serue@us.ibm.com> Signed-off-by: James Morris <jmorris@namei.org> Cc: Ben Hutchings <ben@decadent.org.uk> Cc: Chuck Ebbert <cebbert@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- security/keys/keyring.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) --- a/security/keys/keyring.c +++ b/security/keys/keyring.c @@ -524,9 +524,8 @@ struct key *find_keyring_by_name(const c struct key *keyring; int bucket; - keyring = ERR_PTR(-EINVAL); if (!name) - goto error; + return ERR_PTR(-EINVAL); bucket = keyring_hash(name); @@ -553,17 +552,18 @@ struct key *find_keyring_by_name(const c KEY_SEARCH) < 0) continue; - /* we've got a match */ - atomic_inc(&keyring->usage); - read_unlock(&keyring_name_lock); - goto error; + /* we've got a match but we might end up racing with + * key_cleanup() if the keyring is currently 'dead' + * (ie. it has a zero usage count) */ + if (!atomic_inc_not_zero(&keyring->usage)) + continue; + goto out; } } - read_unlock(&keyring_name_lock); keyring = ERR_PTR(-ENOKEY); - - error: +out: + read_unlock(&keyring_name_lock); return keyring; } /* end find_keyring_by_name() */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 163/164] [SCSI] qla2xxx: Disable MSI on qla24xx chips other than QLA2432. 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (161 preceding siblings ...) 2010-07-01 17:35 ` [patch 162/164] KEYS: find_keyring_by_name() can gain access to a freed keyring Greg KH @ 2010-07-01 17:35 ` Greg KH 2010-07-01 17:35 ` [patch 164/164] sctp: fix append error cause to ERROR chunk correctly Greg KH 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Giridhar Malavali, James Bottomley, Ben Hutchings 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ben Hutchings <ben@decadent.org.uk> commit 6377a7ae1ab82859edccdbc8eaea63782efb134d upstream. On specific platforms, MSI is unreliable on some of the QLA24xx chips, resulting in fatal I/O errors under load, as reported in <http://bugs.debian.org/572322> and by some RHEL customers. Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de> Cc: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/scsi/qla2xxx/qla_isr.c | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-) --- a/drivers/scsi/qla2xxx/qla_isr.c +++ b/drivers/scsi/qla2xxx/qla_isr.c @@ -2169,30 +2169,28 @@ qla2x00_request_irqs(struct qla_hw_data /* If possible, enable MSI-X. */ if (!IS_QLA2432(ha) && !IS_QLA2532(ha) && - !IS_QLA8432(ha) && !IS_QLA8001(ha)) - goto skip_msix; + !IS_QLA8432(ha) && !IS_QLA8001(ha)) + goto skip_msi; + + if (ha->pdev->subsystem_vendor == PCI_VENDOR_ID_HP && + (ha->pdev->subsystem_device == 0x7040 || + ha->pdev->subsystem_device == 0x7041 || + ha->pdev->subsystem_device == 0x1705)) { + DEBUG2(qla_printk(KERN_WARNING, ha, + "MSI-X: Unsupported ISP2432 SSVID/SSDID (0x%X,0x%X).\n", + ha->pdev->subsystem_vendor, + ha->pdev->subsystem_device)); + goto skip_msi; + } if (IS_QLA2432(ha) && (ha->pdev->revision < QLA_MSIX_CHIP_REV_24XX || !QLA_MSIX_FW_MODE_1(ha->fw_attributes))) { DEBUG2(qla_printk(KERN_WARNING, ha, "MSI-X: Unsupported ISP2432 (0x%X, 0x%X).\n", ha->pdev->revision, ha->fw_attributes)); - goto skip_msix; } - if (ha->pdev->subsystem_vendor == PCI_VENDOR_ID_HP && - (ha->pdev->subsystem_device == 0x7040 || - ha->pdev->subsystem_device == 0x7041 || - ha->pdev->subsystem_device == 0x1705)) { - DEBUG2(qla_printk(KERN_WARNING, ha, - "MSI-X: Unsupported ISP2432 SSVID/SSDID (0x%X, 0x%X).\n", - ha->pdev->subsystem_vendor, - ha->pdev->subsystem_device)); - - goto skip_msi; - } - ret = qla24xx_enable_msix(ha, rsp); if (!ret) { DEBUG2(qla_printk(KERN_INFO, ha, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [patch 164/164] sctp: fix append error cause to ERROR chunk correctly 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH ` (162 preceding siblings ...) 2010-07-01 17:35 ` [patch 163/164] [SCSI] qla2xxx: Disable MSI on qla24xx chips other than QLA2432 Greg KH @ 2010-07-01 17:35 ` Greg KH 163 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:35 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Wei Yongjun, Vlad Yasevich, David S. Miller 2.6.33-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wei Yongjun <yjwei@cn.fujitsu.com> commit 2e3219b5c8a2e44e0b83ae6e04f52f20a82ac0f2 upstream. commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809 sctp: Fix skb_over_panic resulting from multiple invalid \ parameter errors (CVE-2010-1173) (v4) cause 'error cause' never be add the the ERROR chunk due to some typo when check valid length in sctp_init_cause_fixed(). Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Reviewed-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/sctp/sm_make_chunk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -140,7 +140,7 @@ int sctp_init_cause_fixed(struct sctp_ch len = sizeof(sctp_errhdr_t) + paylen; err.length = htons(len); - if (skb_tailroom(chunk->skb) > len) + if (skb_tailroom(chunk->skb) < len) return -ENOSPC; chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk, sizeof(sctp_errhdr_t), @@ -1420,7 +1420,7 @@ void *sctp_addto_chunk(struct sctp_chunk void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk, int len, const void *data) { - if (skb_tailroom(chunk->skb) > len) + if (skb_tailroom(chunk->skb) >= len) return sctp_addto_chunk(chunk, len, data); else return NULL; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [000/200] 2.6.34.1 stable review 2010-07-01 17:51 4 -stable kernel review cycles starting Greg KH ` (2 preceding siblings ...) 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH @ 2010-07-01 17:52 ` Greg KH 2010-07-01 17:41 ` [001/200] oprofile/x86: fix uninitialized counter usage during cpu hotplug Greg KH ` (199 more replies) 2010-07-01 21:55 ` 4 -stable kernel review cycles starting Florian Fainelli 4 siblings, 200 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:52 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan This is the start of the stable review cycle for the 2.6.34.1 release. There are 200 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. If anyone is a maintainer of the proper subsystem, and wants to add a Signed-off-by: line to the patch, please respond with it. Responses should be made by Sat, July 3, 17:00:00 UTC UTC. Anything received after that time might be too late. The whole patch series can be found in one patch at: kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.34.1-rc1.gz and the diffstat can be found below. thanks, greg k-h Documentation/hwmon/ltc4245 | 4 +- Makefile | 2 +- arch/arm/common/sa1111.c | 9 +- arch/arm/mach-mx2/devices.c | 4 +- arch/arm/mm/cache-v7.S | 4 + arch/arm/mm/copypage-feroceon.c | 4 +- arch/arm/mm/copypage-v4wb.c | 4 +- arch/arm/mm/copypage-v4wt.c | 4 +- arch/arm/mm/copypage-xsc3.c | 4 +- arch/arm/mm/fault.c | 3 + arch/arm/mm/init.c | 6 +- arch/arm/vfp/vfphw.S | 2 +- arch/blackfin/include/asm/cache.h | 2 + arch/frv/include/asm/cache.h | 2 + arch/m68k/include/asm/cache.h | 2 + arch/mn10300/include/asm/cache.h | 2 + arch/parisc/math-emu/decode_exc.c | 1 + arch/powerpc/kernel/asm-offsets.c | 8 + arch/powerpc/kernel/head_fsl_booke.S | 13 +- arch/powerpc/kvm/book3s.c | 10 + arch/powerpc/kvm/booke.c | 15 +- arch/powerpc/kvm/powerpc.c | 3 +- arch/powerpc/lib/string.S | 4 +- arch/powerpc/mm/fsl_booke_mmu.c | 25 +-- arch/powerpc/mm/mmu_decl.h | 10 +- arch/powerpc/mm/pgtable_32.c | 8 + arch/powerpc/mm/pgtable_64.c | 8 + arch/powerpc/mm/tlb_nohash_low.S | 28 ++ arch/powerpc/oprofile/op_model_cell.c | 2 +- arch/powerpc/platforms/pseries/hotplug-cpu.c | 30 +-- arch/powerpc/platforms/pseries/plpar_wrappers.h | 8 + arch/powerpc/platforms/pseries/smp.c | 28 ++ arch/s390/kvm/kvm-s390.c | 4 +- arch/x86/include/asm/kvm_host.h | 3 + arch/x86/include/asm/msr-index.h | 5 +- arch/x86/kernel/amd_iommu.c | 16 +- arch/x86/kernel/amd_iommu_init.c | 20 ++- arch/x86/kernel/cpu/perf_event.c | 5 +- arch/x86/kernel/pvclock.c | 24 ++ arch/x86/kernel/setup.c | 11 + arch/x86/kernel/tboot.c | 1 + arch/x86/kvm/mmu.c | 10 +- arch/x86/kvm/svm.c | 163 ++++++++----- arch/x86/kvm/vmx.c | 38 ++- arch/x86/kvm/x86.c | 58 +++-- arch/x86/oprofile/nmi_int.c | 10 +- arch/x86/xen/suspend.c | 4 +- arch/xtensa/include/asm/cache.h | 1 + block/cfq-iosched.c | 20 +- drivers/acpi/video_detect.c | 2 +- drivers/ata/libata-core.c | 7 +- drivers/ata/libata-sff.c | 2 +- drivers/ata/sata_nv.c | 5 +- drivers/ata/sata_via.c | 13 + drivers/base/cpu.c | 2 +- drivers/char/ipmi/ipmi_si_intf.c | 11 +- drivers/clocksource/sh_cmt.c | 21 +- drivers/clocksource/sh_tmu.c | 20 +- drivers/firewire/core-card.c | 24 ++- drivers/gpu/drm/drm_edid.c | 2 +- drivers/gpu/drm/i915/i915_gem.c | 19 ++ drivers/gpu/drm/i915/intel_display.c | 6 - drivers/gpu/drm/i915/intel_dp.c | 10 - drivers/gpu/drm/radeon/radeon.h | 1 + drivers/gpu/drm/radeon/radeon_agp.c | 5 + drivers/gpu/drm/radeon/radeon_atombios.c | 7 +- drivers/gpu/drm/radeon/radeon_device.c | 2 + drivers/gpu/drm/radeon/radeon_display.c | 5 +- drivers/gpu/drm/radeon/radeon_state.c | 5 +- drivers/hid/hid-core.c | 1 + drivers/hid/hid-gyration.c | 1 + drivers/hid/hid-ids.h | 1 + drivers/hwmon/ltc4245.c | 18 +- drivers/md/linear.c | 1 + drivers/md/md.c | 99 +++++++- drivers/md/md.h | 1 + drivers/md/raid1.c | 9 +- drivers/md/raid10.c | 2 +- drivers/md/raid5.c | 7 +- drivers/media/video/uvc/uvc_ctrl.c | 2 + drivers/misc/vmware_balloon.c | 18 ++- drivers/net/arcnet/com20020-pci.c | 4 +- drivers/net/can/sja1000/sja1000.c | 20 ++- drivers/net/can/sja1000/sja1000.h | 1 + drivers/net/mlx4/icm.c | 3 +- drivers/net/wireless/ath/ar9170/hw.h | 1 + drivers/net/wireless/ath/ar9170/main.c | 2 +- drivers/net/wireless/ath/ar9170/usb.c | 10 + drivers/net/wireless/ath/ath5k/base.c | 11 +- drivers/net/wireless/ath/ath9k/hw.c | 4 +- drivers/net/wireless/ath/ath9k/init.c | 3 + drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 10 +- drivers/net/wireless/iwlwifi/iwl-scan.c | 21 ++- drivers/net/wireless/iwlwifi/iwl-tx.c | 2 + drivers/net/wireless/p54/p54usb.c | 1 + drivers/net/wireless/rtl818x/rtl8180_dev.c | 1 + drivers/net/wireless/wl12xx/wl1251_sdio.c | 1 + drivers/oprofile/cpu_buffer.c | 63 +---- drivers/pci/quirks.c | 13 +- drivers/pcmcia/ds.c | 1 + drivers/pcmcia/yenta_socket.c | 5 +- drivers/platform/x86/Kconfig | 1 + drivers/rtc/rtc-cmos.c | 5 +- drivers/rtc/rtc-s3c.c | 5 +- drivers/scsi/libsas/sas_ata.c | 5 +- drivers/scsi/libsas/sas_scsi_host.c | 16 +- drivers/serial/68328serial.c | 2 +- drivers/staging/batman-adv/proc.c | 51 +++-- drivers/staging/batman-adv/vis.c | 235 ++++++++++++------ drivers/staging/batman-adv/vis.h | 8 +- drivers/staging/comedi/drivers/ni_mio_cs.c | 2 +- drivers/staging/rt2860/usb_main_dev.c | 1 + drivers/staging/vt6655/device_main.c | 2 + drivers/usb/class/cdc-acm.c | 6 +- drivers/usb/core/driver.c | 2 + drivers/usb/core/hcd.c | 169 ++++++++----- drivers/usb/core/message.c | 45 +--- drivers/usb/core/urb.c | 9 +- drivers/usb/core/usb.c | 4 + drivers/usb/gadget/fsl_udc_core.c | 2 +- drivers/usb/host/ehci-au1xxx.c | 16 +- drivers/usb/host/ehci-fsl.c | 2 + drivers/usb/host/ehci-hub.c | 158 ++++++++++--- drivers/usb/host/ehci-pci.c | 15 +- drivers/usb/host/ehci.h | 10 + drivers/usb/host/fhci.h | 9 +- drivers/usb/host/whci/qset.c | 2 +- drivers/usb/host/xhci-pci.c | 2 +- drivers/usb/host/xhci-ring.c | 39 +++- drivers/usb/host/xhci.c | 54 ++++- drivers/usb/mon/mon_bin.c | 2 +- drivers/usb/mon/mon_text.c | 4 +- drivers/usb/serial/cp210x.c | 11 + drivers/usb/serial/cypress_m8.c | 2 +- drivers/usb/serial/digi_acceleport.c | 4 +- drivers/usb/serial/ftdi_sio.c | 4 + drivers/usb/serial/ir-usb.c | 2 + drivers/usb/serial/kl5kusb105.c | 1 + drivers/usb/serial/kobil_sct.c | 3 +- drivers/usb/serial/mos7840.c | 1 - drivers/usb/serial/option.c | 180 ++++++++++++++ drivers/usb/serial/qcaux.c | 5 + drivers/usb/serial/spcp8x5.c | 4 +- drivers/usb/serial/visor.c | 1 + drivers/usb/storage/unusual_devs.h | 15 ++ drivers/vhost/net.c | 2 +- drivers/video/arcfb.c | 8 +- drivers/video/hgafb.c | 10 +- drivers/video/vfb.c | 4 +- drivers/video/vga16fb.c | 10 +- drivers/video/w100fb.c | 10 +- drivers/xen/xenbus/xenbus_xs.c | 2 +- fs/aio.c | 65 +++-- fs/btrfs/acl.c | 3 + fs/cifs/cifsproto.h | 6 +- fs/cifs/dir.c | 20 +- fs/cifs/file.c | 11 +- fs/compat.c | 132 ++++++---- fs/dcache.c | 1 + fs/exofs/dir.c | 2 +- fs/ext4/move_extent.c | 3 + fs/ext4/resize.c | 3 +- fs/fs-writeback.c | 14 +- fs/gfs2/file.c | 7 + fs/libfs.c | 3 +- fs/namei.c | 2 +- fs/nfs/write.c | 20 ++- fs/nfsd/nfssvc.c | 2 +- fs/nfsd/vfs.c | 11 +- fs/nfsd/vfs.h | 1 + include/linux/aio.h | 5 + include/linux/compat.h | 4 + include/linux/fs.h | 2 +- include/linux/miscdevice.h | 7 +- include/linux/pci_ids.h | 1 + include/linux/perf_event.h | 5 +- include/linux/slub_def.h | 11 +- include/linux/swap.h | 10 - include/linux/tboot.h | 1 + include/linux/usb.h | 9 + include/trace/events/signal.h | 3 +- kernel/cgroup.c | 2 +- kernel/compat.c | 25 +- kernel/mutex.c | 7 + kernel/perf_event.c | 299 +++++++++++++--------- kernel/posix-timers.c | 11 +- kernel/signal.c | 6 +- lib/idr.c | 5 +- mm/filemap.c | 10 +- mm/slub.c | 33 +-- net/mac80211/Kconfig | 9 + net/mac80211/cfg.c | 7 +- net/mac80211/mlme.c | 40 +++- net/mac80211/rx.c | 3 +- net/mac80211/tx.c | 5 +- scripts/kconfig/Makefile | 2 +- sound/core/pcm_lib.c | 13 +- sound/core/pcm_native.c | 39 +--- sound/pci/hda/hda_intel.c | 9 +- sound/pci/hda/patch_realtek.c | 1 + sound/pci/hda/patch_sigmatel.c | 2 +- sound/soc/codecs/wm8350.c | 4 +- sound/soc/codecs/wm8400.c | 18 +- sound/soc/codecs/wm8990.c | 18 +- sound/soc/imx/imx-pcm-dma-mx2.c | 7 +- tools/perf/bench/mem-memcpy.c | 2 +- tools/perf/bench/sched-messaging.c | 4 +- tools/perf/builtin-annotate.c | 8 +- tools/perf/builtin-buildid-cache.c | 2 +- tools/perf/builtin-buildid-list.c | 4 +- tools/perf/builtin-diff.c | 4 +- tools/perf/builtin-help.c | 2 +- tools/perf/builtin-lock.c | 2 +- tools/perf/builtin-probe.c | 2 +- tools/perf/builtin-record.c | 24 +- tools/perf/builtin-report.c | 6 +- tools/perf/builtin-sched.c | 6 +- tools/perf/builtin-stat.c | 10 +- tools/perf/builtin-timechart.c | 2 +- tools/perf/builtin-top.c | 47 +++-- tools/perf/builtin-trace.c | 2 +- tools/perf/util/debug.c | 2 +- tools/perf/util/debug.h | 3 +- tools/perf/util/parse-options.c | 6 + tools/perf/util/parse-options.h | 4 +- tools/perf/util/symbol.c | 25 +- tools/perf/util/symbol.h | 15 ++ tools/perf/util/trace-event-parse.c | 2 +- tools/perf/util/trace-event.h | 3 +- 229 files changed, 2312 insertions(+), 1134 deletions(-) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [001/200] oprofile/x86: fix uninitialized counter usage during cpu hotplug 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [002/200] oprofile: remove double ring buffering Greg KH ` (198 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andi Kleen, Robert Richter 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Robert Richter <robert.richter@amd.com> commit 2623a1d55a6260c855e1f6d1895900b50b40a896 upstream. This fixes a NULL pointer dereference that is triggered when taking a cpu offline after oprofile was initialized, e.g.: $ opcontrol --init $ opcontrol --start-daemon $ opcontrol --shutdown $ opcontrol --deinit $ echo 0 > /sys/devices/system/cpu/cpu1/online See the crash dump below. Though the counter has been disabled the cpu notifier is still active and trying to use already freed counter data. This fix is for linux-stable. To proper fix this, the hotplug code must be rewritten. Thus I will leave a WARN_ON_ONCE() message with this patch. BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff8132ad57>] op_amd_stop+0x2d/0x8e PGD 0 Oops: 0000 [#1] SMP last sysfs file: /sys/devices/system/cpu/cpu1/online CPU 1 Modules linked in: Pid: 0, comm: swapper Not tainted 2.6.34-rc5-oprofile-x86_64-standard-00210-g8c00f06 #16 Anaheim/Anaheim RIP: 0010:[<ffffffff8132ad57>] [<ffffffff8132ad57>] op_amd_stop+0x2d/0x8e RSP: 0018:ffff880001843f28 EFLAGS: 00010006 RAX: 0000000000000000 RBX: 0000000000000000 RCX: dead000000200200 RDX: ffff880001843f68 RSI: dead000000100100 RDI: 0000000000000000 RBP: ffff880001843f48 R08: 0000000000000000 R09: ffff880001843f08 R10: ffffffff8102c9a5 R11: ffff88000184ea80 R12: 0000000000000000 R13: ffff88000184f6c0 R14: 0000000000000000 R15: 0000000000000000 FS: 00007fec6a92e6f0(0000) GS:ffff880001840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000000 CR3: 000000000163b000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process swapper (pid: 0, threadinfo ffff88042fcd8000, task ffff88042fcd51d0) Stack: ffff880001843f48 0000000000000001 ffff88042e9f7d38 ffff880001843f68 <0> ffff880001843f58 ffffffff8132a602 ffff880001843f98 ffffffff810521b3 <0> ffff880001843f68 ffff880001843f68 ffff880001843f88 ffff88042fcd9fd8 Call Trace: <IRQ> [<ffffffff8132a602>] nmi_cpu_stop+0x21/0x23 [<ffffffff810521b3>] generic_smp_call_function_single_interrupt+0xdf/0x11b [<ffffffff8101804f>] smp_call_function_single_interrupt+0x22/0x31 [<ffffffff810029f3>] call_function_single_interrupt+0x13/0x20 <EOI> [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff81008701>] ? default_idle+0x22/0x37 [<ffffffff8100896d>] c1e_idle+0xdf/0xe6 [<ffffffff813f1170>] ? atomic_notifier_call_chain+0x13/0x15 [<ffffffff810012fb>] cpu_idle+0x4b/0x7e [<ffffffff813e8a4e>] start_secondary+0x1ae/0x1b2 Code: 89 e5 41 55 49 89 fd 41 54 45 31 e4 53 31 db 48 83 ec 08 89 df e8 be f8 ff ff 48 98 48 83 3c c5 10 67 7a 81 00 74 1f 49 8b 45 08 <42> 8b 0c 20 0f 32 48 c1 e2 20 25 ff ff bf ff 48 09 d0 48 89 c2 RIP [<ffffffff8132ad57>] op_amd_stop+0x2d/0x8e RSP <ffff880001843f28> CR2: 0000000000000000 ---[ end trace 679ac372d674b757 ]--- Kernel panic - not syncing: Fatal exception in interrupt Pid: 0, comm: swapper Tainted: G D 2.6.34-rc5-oprofile-x86_64-standard-00210-g8c00f06 #16 Call Trace: <IRQ> [<ffffffff813ebd6a>] panic+0x9e/0x10c [<ffffffff810474b0>] ? up+0x34/0x39 [<ffffffff81031ccc>] ? kmsg_dump+0x112/0x12c [<ffffffff813eeff1>] oops_end+0x81/0x8e [<ffffffff8101efee>] no_context+0x1f3/0x202 [<ffffffff8101f1b7>] __bad_area_nosemaphore+0x1ba/0x1e0 [<ffffffff81028d24>] ? enqueue_task_fair+0x16d/0x17a [<ffffffff810264dc>] ? activate_task+0x42/0x53 [<ffffffff8102c967>] ? try_to_wake_up+0x272/0x284 [<ffffffff8101f1eb>] bad_area_nosemaphore+0xe/0x10 [<ffffffff813f0f3f>] do_page_fault+0x1c8/0x37c [<ffffffff81028d24>] ? enqueue_task_fair+0x16d/0x17a [<ffffffff813ee55f>] page_fault+0x1f/0x30 [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff8132ad57>] ? op_amd_stop+0x2d/0x8e [<ffffffff8132ad46>] ? op_amd_stop+0x1c/0x8e [<ffffffff8132a602>] nmi_cpu_stop+0x21/0x23 [<ffffffff810521b3>] generic_smp_call_function_single_interrupt+0xdf/0x11b [<ffffffff8101804f>] smp_call_function_single_interrupt+0x22/0x31 [<ffffffff810029f3>] call_function_single_interrupt+0x13/0x20 <EOI> [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff81008701>] ? default_idle+0x22/0x37 [<ffffffff8100896d>] c1e_idle+0xdf/0xe6 [<ffffffff813f1170>] ? atomic_notifier_call_chain+0x13/0x15 [<ffffffff810012fb>] cpu_idle+0x4b/0x7e [<ffffffff813e8a4e>] start_secondary+0x1ae/0x1b2 ------------[ cut here ]------------ WARNING: at /local/rrichter/.source/linux/arch/x86/kernel/smp.c:118 native_smp_send_reschedule+0x27/0x53() Hardware name: Anaheim Modules linked in: Pid: 0, comm: swapper Tainted: G D 2.6.34-rc5-oprofile-x86_64-standard-00210-g8c00f06 #16 Call Trace: <IRQ> [<ffffffff81017f32>] ? native_smp_send_reschedule+0x27/0x53 [<ffffffff81030ee2>] warn_slowpath_common+0x77/0xa4 [<ffffffff81030f1e>] warn_slowpath_null+0xf/0x11 [<ffffffff81017f32>] native_smp_send_reschedule+0x27/0x53 [<ffffffff8102634b>] resched_task+0x60/0x62 [<ffffffff8102653a>] check_preempt_curr_idle+0x10/0x12 [<ffffffff8102c8ea>] try_to_wake_up+0x1f5/0x284 [<ffffffff8102c986>] default_wake_function+0xd/0xf [<ffffffff810a110d>] pollwake+0x57/0x5a [<ffffffff8102c979>] ? default_wake_function+0x0/0xf [<ffffffff81026be5>] __wake_up_common+0x46/0x75 [<ffffffff81026ed0>] __wake_up+0x38/0x50 [<ffffffff81031694>] printk_tick+0x39/0x3b [<ffffffff8103ac37>] update_process_times+0x3f/0x5c [<ffffffff8104dc63>] tick_periodic+0x5d/0x69 [<ffffffff8104dc90>] tick_handle_periodic+0x21/0x71 [<ffffffff81018fd0>] smp_apic_timer_interrupt+0x82/0x95 [<ffffffff81002853>] apic_timer_interrupt+0x13/0x20 [<ffffffff81030cb5>] ? panic_blink_one_second+0x0/0x7b [<ffffffff813ebdd6>] ? panic+0x10a/0x10c [<ffffffff810474b0>] ? up+0x34/0x39 [<ffffffff81031ccc>] ? kmsg_dump+0x112/0x12c [<ffffffff813eeff1>] ? oops_end+0x81/0x8e [<ffffffff8101efee>] ? no_context+0x1f3/0x202 [<ffffffff8101f1b7>] ? __bad_area_nosemaphore+0x1ba/0x1e0 [<ffffffff81028d24>] ? enqueue_task_fair+0x16d/0x17a [<ffffffff810264dc>] ? activate_task+0x42/0x53 [<ffffffff8102c967>] ? try_to_wake_up+0x272/0x284 [<ffffffff8101f1eb>] ? bad_area_nosemaphore+0xe/0x10 [<ffffffff813f0f3f>] ? do_page_fault+0x1c8/0x37c [<ffffffff81028d24>] ? enqueue_task_fair+0x16d/0x17a [<ffffffff813ee55f>] ? page_fault+0x1f/0x30 [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff8132ad57>] ? op_amd_stop+0x2d/0x8e [<ffffffff8132ad46>] ? op_amd_stop+0x1c/0x8e [<ffffffff8132a602>] ? nmi_cpu_stop+0x21/0x23 [<ffffffff810521b3>] ? generic_smp_call_function_single_interrupt+0xdf/0x11b [<ffffffff8101804f>] ? smp_call_function_single_interrupt+0x22/0x31 [<ffffffff810029f3>] ? call_function_single_interrupt+0x13/0x20 <EOI> [<ffffffff8102c9a5>] ? wake_up_process+0x10/0x12 [<ffffffff81008701>] ? default_idle+0x22/0x37 [<ffffffff8100896d>] ? c1e_idle+0xdf/0xe6 [<ffffffff813f1170>] ? atomic_notifier_call_chain+0x13/0x15 [<ffffffff810012fb>] ? cpu_idle+0x4b/0x7e [<ffffffff813e8a4e>] ? start_secondary+0x1ae/0x1b2 ---[ end trace 679ac372d674b758 ]--- Cc: Andi Kleen <andi@firstfloor.org> Signed-off-by: Robert Richter <robert.richter@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- a/arch/x86/oprofile/nmi_int.c +++ b/arch/x86/oprofile/nmi_int.c @@ -95,7 +95,10 @@ static void nmi_cpu_save_registers(struct op_msrs *msrs) static void nmi_cpu_start(void *dummy) { struct op_msrs const *msrs = &__get_cpu_var(cpu_msrs); - model->start(msrs); + if (!msrs->controls) + WARN_ON_ONCE(1); + else + model->start(msrs); } static int nmi_start(void) @@ -107,7 +110,10 @@ static int nmi_start(void) static void nmi_cpu_stop(void *dummy) { struct op_msrs const *msrs = &__get_cpu_var(cpu_msrs); - model->stop(msrs); + if (!msrs->controls) + WARN_ON_ONCE(1); + else + model->stop(msrs); } static void nmi_stop(void) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [002/200] oprofile: remove double ring buffering 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH 2010-07-01 17:41 ` [001/200] oprofile/x86: fix uninitialized counter usage during cpu hotplug Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [004/200] perf: Fix exit() vs PERF_FORMAT_GROUP Greg KH ` (197 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andi Kleen, Steven Rostedt, Robert Richter 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andi Kleen <andi@firstfloor.org> commit cb6e943ccf19ab6d3189147e9d625a992e016084 upstream. oprofile used a double buffer scheme for its cpu event buffer to avoid races on reading with the old locked ring buffer. But that is obsolete now with the new ring buffer, so simply use a single buffer. This greatly simplifies the code and avoids a lot of sample drops on large runs, especially with call graph. Based on suggestions from Steven Rostedt For stable kernels from v2.6.32, but not earlier. Signed-off-by: Andi Kleen <ak@linux.intel.com> Cc: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Robert Richter <robert.richter@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/oprofile/cpu_buffer.c | 63 ++++++++---------------------------------- 1 file changed, 13 insertions(+), 50 deletions(-) --- a/drivers/oprofile/cpu_buffer.c +++ b/drivers/oprofile/cpu_buffer.c @@ -30,23 +30,7 @@ #define OP_BUFFER_FLAGS 0 -/* - * Read and write access is using spin locking. Thus, writing to the - * buffer by NMI handler (x86) could occur also during critical - * sections when reading the buffer. To avoid this, there are 2 - * buffers for independent read and write access. Read access is in - * process context only, write access only in the NMI handler. If the - * read buffer runs empty, both buffers are swapped atomically. There - * is potentially a small window during swapping where the buffers are - * disabled and samples could be lost. - * - * Using 2 buffers is a little bit overhead, but the solution is clear - * and does not require changes in the ring buffer implementation. It - * can be changed to a single buffer solution when the ring buffer - * access is implemented as non-locking atomic code. - */ -static struct ring_buffer *op_ring_buffer_read; -static struct ring_buffer *op_ring_buffer_write; +static struct ring_buffer *op_ring_buffer; DEFINE_PER_CPU(struct oprofile_cpu_buffer, op_cpu_buffer); static void wq_sync_buffer(struct work_struct *work); @@ -68,12 +52,9 @@ void oprofile_cpu_buffer_inc_smpl_lost(v void free_cpu_buffers(void) { - if (op_ring_buffer_read) - ring_buffer_free(op_ring_buffer_read); - op_ring_buffer_read = NULL; - if (op_ring_buffer_write) - ring_buffer_free(op_ring_buffer_write); - op_ring_buffer_write = NULL; + if (op_ring_buffer) + ring_buffer_free(op_ring_buffer); + op_ring_buffer = NULL; } #define RB_EVENT_HDR_SIZE 4 @@ -86,11 +67,8 @@ int alloc_cpu_buffers(void) unsigned long byte_size = buffer_size * (sizeof(struct op_sample) + RB_EVENT_HDR_SIZE); - op_ring_buffer_read = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS); - if (!op_ring_buffer_read) - goto fail; - op_ring_buffer_write = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS); - if (!op_ring_buffer_write) + op_ring_buffer = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS); + if (!op_ring_buffer) goto fail; for_each_possible_cpu(i) { @@ -162,16 +140,11 @@ struct op_sample *op_cpu_buffer_write_reserve(struct op_entry *entry, unsigned long size) { entry->event = ring_buffer_lock_reserve - (op_ring_buffer_write, sizeof(struct op_sample) + + (op_ring_buffer, sizeof(struct op_sample) + size * sizeof(entry->sample->data[0])); - if (entry->event) - entry->sample = ring_buffer_event_data(entry->event); - else - entry->sample = NULL; - - if (!entry->sample) + if (!entry->event) return NULL; - + entry->sample = ring_buffer_event_data(entry->event); entry->size = size; entry->data = entry->sample->data; @@ -180,25 +153,16 @@ struct op_sample int op_cpu_buffer_write_commit(struct op_entry *entry) { - return ring_buffer_unlock_commit(op_ring_buffer_write, entry->event); + return ring_buffer_unlock_commit(op_ring_buffer, entry->event); } struct op_sample *op_cpu_buffer_read_entry(struct op_entry *entry, int cpu) { struct ring_buffer_event *e; - e = ring_buffer_consume(op_ring_buffer_read, cpu, NULL); - if (e) - goto event; - if (ring_buffer_swap_cpu(op_ring_buffer_read, - op_ring_buffer_write, - cpu)) + e = ring_buffer_consume(op_ring_buffer, cpu, NULL); + if (!e) return NULL; - e = ring_buffer_consume(op_ring_buffer_read, cpu, NULL); - if (e) - goto event; - return NULL; -event: entry->event = e; entry->sample = ring_buffer_event_data(e); entry->size = (ring_buffer_event_length(e) - sizeof(struct op_sample)) @@ -209,8 +173,7 @@ event: unsigned long op_cpu_buffer_entries(int cpu) { - return ring_buffer_entries_cpu(op_ring_buffer_read, cpu) - + ring_buffer_entries_cpu(op_ring_buffer_write, cpu); + return ring_buffer_entries_cpu(op_ring_buffer, cpu); } static int ^ permalink raw reply [flat|nested] 666+ messages in thread
* [004/200] perf: Fix exit() vs PERF_FORMAT_GROUP 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH 2010-07-01 17:41 ` [001/200] oprofile/x86: fix uninitialized counter usage during cpu hotplug Greg KH 2010-07-01 17:41 ` [002/200] oprofile: remove double ring buffering Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [005/200] perf top: Properly notify the user that vmlinux is missing Greg KH ` (196 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Peter Zijlstra, Arnaldo Carvalho de Melo, Frederic Weisbecker, Paul Mackerras, Ingo Molnar 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Peter Zijlstra <peterz@infradead.org> commit 050735b08ca8a016bbace4445fa025b88fee770b upstream. Both Stephane and Corey reported that PERF_FORMAT_GROUP didn't work as expected if the task the counters were attached to quit before the read() call. The cause is that we unconditionally destroy the grouping when we remove counters from their context. Fix this by splitting off the group destroy from the list removal such that perf_event_remove_from_context() does not do this and change perf_event_release() to do so. Reported-by: Corey Ashford <cjashfor@linux.vnet.ibm.com> Reported-by: Stephane Eranian <eranian@google.com> Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Paul Mackerras <paulus@samba.org> LKML-Reference: <1273571513.5605.3527.camel@twins> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/perf_event.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) --- a/kernel/perf_event.c +++ b/kernel/perf_event.c @@ -315,8 +315,6 @@ list_add_event(struct perf_event *event, static void list_del_event(struct perf_event *event, struct perf_event_context *ctx) { - struct perf_event *sibling, *tmp; - if (list_empty(&event->group_entry)) return; ctx->nr_events--; @@ -340,6 +338,12 @@ list_del_event(struct perf_event *event, */ if (event->state > PERF_EVENT_STATE_OFF) event->state = PERF_EVENT_STATE_OFF; +} + +static void +perf_destroy_group(struct perf_event *event, struct perf_event_context *ctx) +{ + struct perf_event *sibling, *tmp; /* * If this was a group event with sibling events then @@ -1856,9 +1860,18 @@ int perf_event_release_kernel(struct per { struct perf_event_context *ctx = event->ctx; + /* + * Remove from the PMU, can't get re-enabled since we got + * here because the last ref went. + */ + perf_event_disable(event); + WARN_ON_ONCE(ctx->parent_ctx); mutex_lock(&ctx->mutex); - perf_event_remove_from_context(event); + raw_spin_lock_irq(&ctx->lock); + list_del_event(event, ctx); + perf_destroy_group(event, ctx); + raw_spin_unlock_irq(&ctx->lock); mutex_unlock(&ctx->mutex); mutex_lock(&event->owner->perf_event_mutex); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [005/200] perf top: Properly notify the user that vmlinux is missing 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (2 preceding siblings ...) 2010-07-01 17:41 ` [004/200] perf: Fix exit() vs PERF_FORMAT_GROUP Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [006/200] perf: Fix exit() vs event-groups Greg KH ` (195 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Arnaldo Carvalho de Melo, Frédéric Weisbecker, Mike Galbraith, Peter Zijlstra, Paul Mackerras, Ingo Molnar [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 5914 bytes --] 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Arnaldo Carvalho de Melo <acme@redhat.com> commit b0a9ab62ab96e258a0ddd81d7fe2719c3db36006 upstream. Before this patch this message would very briefly appear on the screen and then the screen would get updates only on the top, for number of interrupts received, etc, but no annotation would be performed: [root@doppio linux-2.6-tip]# perf top -s n_tty_write > /tmp/bla objdump: '[kernel.kallsyms]': No such file Now this is what the user gets: [root@doppio linux-2.6-tip]# perf top -s n_tty_write Can't annotate n_tty_write: No vmlinux file was found in the path: [0] vmlinux [1] /boot/vmlinux [2] /boot/vmlinux-2.6.33-rc5 [3] /lib/modules/2.6.33-rc5/build/vmlinux [4] /usr/lib/debug/lib/modules/2.6.33-rc5/vmlinux [root@doppio linux-2.6-tip]# This bug was introduced when we added automatic search for vmlinux, before that time the user had to specify a vmlinux file. Reported-by: David S. Miller <davem@davemloft.net> Reported-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Frédéric Weisbecker <fweisbec@gmail.com> Cc: Mike Galbraith <efault@gmx.de> Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Paul Mackerras <paulus@samba.org> LKML-Reference: <1268664418-28328-2-git-send-email-acme@infradead.org> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- tools/perf/builtin-top.c | 33 +++++++++++++++++++++++++-------- tools/perf/util/symbol.c | 25 ++++++++++++------------- tools/perf/util/symbol.h | 15 +++++++++++++++ 3 files changed, 52 insertions(+), 21 deletions(-) --- a/tools/perf/builtin-top.c +++ b/tools/perf/builtin-top.c @@ -169,7 +169,7 @@ static void sig_winch_handler(int sig __ update_print_entries(&winsize); } -static void parse_source(struct sym_entry *syme) +static int parse_source(struct sym_entry *syme) { struct symbol *sym; struct sym_entry_source *source; @@ -180,12 +180,21 @@ static void parse_source(struct sym_entr u64 len; if (!syme) - return; + return -1; + + sym = sym_entry__symbol(syme); + map = syme->map; + + /* + * We can't annotate with just /proc/kallsyms + */ + if (map->dso->origin == DSO__ORIG_KERNEL) + return -1; if (syme->src == NULL) { syme->src = zalloc(sizeof(*source)); if (syme->src == NULL) - return; + return -1; pthread_mutex_init(&syme->src->lock, NULL); } @@ -195,9 +204,6 @@ static void parse_source(struct sym_entr pthread_mutex_lock(&source->lock); goto out_assign; } - - sym = sym_entry__symbol(syme); - map = syme->map; path = map->dso->long_name; len = sym->end - sym->start; @@ -209,7 +215,7 @@ static void parse_source(struct sym_entr file = popen(command, "r"); if (!file) - return; + return -1; pthread_mutex_lock(&source->lock); source->lines_tail = &source->lines; @@ -245,6 +251,7 @@ static void parse_source(struct sym_entr out_assign: sym_filter_entry = syme; pthread_mutex_unlock(&source->lock); + return 0; } static void __zero_source_counters(struct sym_entry *syme) @@ -990,7 +997,17 @@ static void event__process_sample(const if (sym_filter_entry_sched) { sym_filter_entry = sym_filter_entry_sched; sym_filter_entry_sched = NULL; - parse_source(sym_filter_entry); + if (parse_source(sym_filter_entry) < 0) { + struct symbol *sym = sym_entry__symbol(sym_filter_entry); + + pr_err("Can't annotate %s", sym->name); + if (sym_filter_entry->map->dso->origin == DSO__ORIG_KERNEL) { + pr_err(": No vmlinux file was found in the path:\n"); + vmlinux_path__fprintf(stderr); + } else + pr_err(".\n"); + exit(1); + } } syme = symbol__priv(al.sym); --- a/tools/perf/util/symbol.c +++ b/tools/perf/util/symbol.c @@ -18,18 +18,6 @@ #define NT_GNU_BUILD_ID 3 #endif -enum dso_origin { - DSO__ORIG_KERNEL = 0, - DSO__ORIG_JAVA_JIT, - DSO__ORIG_BUILD_ID_CACHE, - DSO__ORIG_FEDORA, - DSO__ORIG_UBUNTU, - DSO__ORIG_BUILDID, - DSO__ORIG_DSO, - DSO__ORIG_KMODULE, - DSO__ORIG_NOT_FOUND, -}; - static void dsos__add(struct list_head *head, struct dso *dso); static struct map *map__new2(u64 start, struct dso *dso, enum map_type type); static int dso__load_kernel_sym(struct dso *self, struct map *map, @@ -1025,7 +1013,7 @@ static int dso__load_sym(struct dso *sel } curr_map->map_ip = identity__map_ip; curr_map->unmap_ip = identity__map_ip; - curr_dso->origin = DSO__ORIG_KERNEL; + curr_dso->origin = self->origin; map_groups__insert(kmap->kmaps, curr_map); dsos__add(&dsos__kernel, curr_dso); dso__set_loaded(curr_dso, map->type); @@ -1895,6 +1883,17 @@ out_fail: return -1; } +size_t vmlinux_path__fprintf(FILE *fp) +{ + int i; + size_t printed = 0; + + for (i = 0; i < vmlinux_path__nr_entries; ++i) + printed += fprintf(fp, "[%d] %s\n", i, vmlinux_path[i]); + + return printed; +} + static int setup_list(struct strlist **list, const char *list_str, const char *list_name) { --- a/tools/perf/util/symbol.h +++ b/tools/perf/util/symbol.h @@ -150,6 +150,19 @@ size_t dsos__fprintf_buildid(FILE *fp, b size_t dso__fprintf_buildid(struct dso *self, FILE *fp); size_t dso__fprintf(struct dso *self, enum map_type type, FILE *fp); + +enum dso_origin { + DSO__ORIG_KERNEL = 0, + DSO__ORIG_JAVA_JIT, + DSO__ORIG_BUILD_ID_CACHE, + DSO__ORIG_FEDORA, + DSO__ORIG_UBUNTU, + DSO__ORIG_BUILDID, + DSO__ORIG_DSO, + DSO__ORIG_KMODULE, + DSO__ORIG_NOT_FOUND, +}; + char dso__symtab_origin(const struct dso *self); void dso__set_long_name(struct dso *self, char *name); void dso__set_build_id(struct dso *self, void *build_id); @@ -169,4 +182,6 @@ int kallsyms__parse(const char *filename int symbol__init(void); bool symbol_type__is_a(char symbol_type, enum map_type map_type); +size_t vmlinux_path__fprintf(FILE *fp); + #endif /* __PERF_SYMBOL */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [006/200] perf: Fix exit() vs event-groups 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (3 preceding siblings ...) 2010-07-01 17:41 ` [005/200] perf top: Properly notify the user that vmlinux is missing Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [007/200] Fix racy use of anon_inode_getfd() in perf_event.c Greg KH ` (194 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Peter Zijlstra, Paul Mackerras, Mike Galbraith, Arnaldo Carvalho de Melo, Frederic Weisbecker, Ingo Molnar 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Peter Zijlstra <a.p.zijlstra@chello.nl> commit 96c21a460a37880abfbc8445d5b098dbab958a29 upstream. Corey reported that the value scale times of group siblings are not updated when the monitored task dies. The problem appears to be that we only update the group leader's time values, fix it by updating the whole group. Reported-by: Corey Ashford <cjashfor@linux.vnet.ibm.com> Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Paul Mackerras <paulus@samba.org> Cc: Mike Galbraith <efault@gmx.de> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> LKML-Reference: <1273588935.1810.6.camel@laptop> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/perf_event.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) --- a/kernel/perf_event.c +++ b/kernel/perf_event.c @@ -262,6 +262,18 @@ static void update_event_times(struct pe event->total_time_running = run_end - event->tstamp_running; } +/* + * Update total_time_enabled and total_time_running for all events in a group. + */ +static void update_group_times(struct perf_event *leader) +{ + struct perf_event *event; + + update_event_times(leader); + list_for_each_entry(event, &leader->sibling_list, group_entry) + update_event_times(event); +} + static struct list_head * ctx_group_list(struct perf_event *event, struct perf_event_context *ctx) { @@ -327,7 +339,7 @@ list_del_event(struct perf_event *event, if (event->group_leader != event) event->group_leader->nr_siblings--; - update_event_times(event); + update_group_times(event); /* * If event was in error state, then keep it @@ -509,18 +521,6 @@ retry: } /* - * Update total_time_enabled and total_time_running for all events in a group. - */ -static void update_group_times(struct perf_event *leader) -{ - struct perf_event *event; - - update_event_times(leader); - list_for_each_entry(event, &leader->sibling_list, group_entry) - update_event_times(event); -} - -/* * Cross CPU call to disable a performance event */ static void __perf_event_disable(void *info) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [007/200] Fix racy use of anon_inode_getfd() in perf_event.c 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (4 preceding siblings ...) 2010-07-01 17:41 ` [006/200] perf: Fix exit() vs event-groups Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [008/200] VFS: fix recent breakage of FS_REVAL_DOT Greg KH ` (193 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Al Viro 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Al Viro <viro@zeniv.linux.org.uk> commit ea635c64e007061f6468ece5cc9cc62d41d4ecf2 upstream. once anon_inode_getfd() is called, you can't expect *anything* about struct file that descriptor points to - another thread might be doing whatever it likes with descriptor table at that point. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/perf_event.c | 40 ++++++++++++++++++++++------------------ 1 file changed, 22 insertions(+), 18 deletions(-) --- a/kernel/perf_event.c +++ b/kernel/perf_event.c @@ -4811,8 +4811,8 @@ SYSCALL_DEFINE5(perf_event_open, struct perf_event_context *ctx; struct file *event_file = NULL; struct file *group_file = NULL; + int event_fd; int fput_needed = 0; - int fput_needed2 = 0; int err; /* for future expandability... */ @@ -4833,12 +4833,18 @@ SYSCALL_DEFINE5(perf_event_open, return -EINVAL; } + event_fd = get_unused_fd_flags(O_RDWR); + if (event_fd < 0) + return event_fd; + /* * Get the target context (task or percpu): */ ctx = find_get_context(pid, cpu); - if (IS_ERR(ctx)) - return PTR_ERR(ctx); + if (IS_ERR(ctx)) { + err = PTR_ERR(ctx); + goto err_fd; + } /* * Look up the group leader (we will attach this event to it): @@ -4878,13 +4884,11 @@ SYSCALL_DEFINE5(perf_event_open, if (IS_ERR(event)) goto err_put_context; - err = anon_inode_getfd("[perf_event]", &perf_fops, event, O_RDWR); - if (err < 0) - goto err_free_put_context; - - event_file = fget_light(err, &fput_needed2); - if (!event_file) + event_file = anon_inode_getfile("[perf_event]", &perf_fops, event, O_RDWR); + if (IS_ERR(event_file)) { + err = PTR_ERR(event_file); goto err_free_put_context; + } if (flags & PERF_FLAG_FD_OUTPUT) { err = perf_event_set_output(event, group_fd); @@ -4905,19 +4909,19 @@ SYSCALL_DEFINE5(perf_event_open, list_add_tail(&event->owner_entry, ¤t->perf_event_list); mutex_unlock(¤t->perf_event_mutex); -err_fput_free_put_context: - fput_light(event_file, fput_needed2); + fput_light(group_file, fput_needed); + fd_install(event_fd, event_file); + return event_fd; +err_fput_free_put_context: + fput(event_file); err_free_put_context: - if (err < 0) - free_event(event); - + free_event(event); err_put_context: - if (err < 0) - put_ctx(ctx); - fput_light(group_file, fput_needed); - + put_ctx(ctx); +err_fd: + put_unused_fd(event_fd); return err; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [008/200] VFS: fix recent breakage of FS_REVAL_DOT 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (5 preceding siblings ...) 2010-07-01 17:41 ` [007/200] Fix racy use of anon_inode_getfd() in perf_event.c Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [009/200] posix_timer: Fix error path in timer_create Greg KH ` (192 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, NeilBrown, Al Viro 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Neil Brown <neilb@suse.de> commit 176306f59ac7a35369cbba87aff13e14c5916074 upstream. Commit 1f36f774b22a0ceb7dd33eca626746c81a97b6a5 broke FS_REVAL_DOT semantics. In particular, before this patch, the command ls -l in an NFS mounted directory would always check if the directory on the server had changed and if so would flush and refill the pagecache for the dir. After this patch, the same "ls -l" will repeatedly return stale date until the cached attributes for the directory time out. The following patch fixes this by ensuring the d_revalidate is called by do_last when "." is being looked-up. link_path_walk has already called d_revalidate, but in that case LOOKUP_OPEN is not set so nfs_lookup_verify_inode chooses not to do any validation. The following patch restores the original behaviour. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/namei.c +++ b/fs/namei.c @@ -1620,6 +1620,7 @@ static struct file *do_last(struct namei case LAST_DOTDOT: follow_dotdot(nd); dir = nd->path.dentry; + case LAST_DOT: if (nd->path.mnt->mnt_sb->s_type->fs_flags & FS_REVAL_DOT) { if (!dir->d_op->d_revalidate(dir, nd)) { error = -ESTALE; @@ -1627,7 +1628,6 @@ static struct file *do_last(struct namei } } /* fallthrough */ - case LAST_DOT: case LAST_ROOT: if (open_flag & O_CREAT) goto exit; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [009/200] posix_timer: Fix error path in timer_create 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (6 preceding siblings ...) 2010-07-01 17:41 ` [008/200] VFS: fix recent breakage of FS_REVAL_DOT Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [010/200] libata: disable ATAPI AN by default Greg KH ` (191 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andrey Vagin, Oleg Nesterov, Pavel Emelyanov, Thomas Gleixner 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andrey Vagin <avagin@openvz.org> commit 45e0fffc8a7778282e6a1514a6ae3e7ae6545111 upstream. Move CLOCK_DISPATCH(which_clock, timer_create, (new_timer)) after all posible EFAULT erros. *_timer_create may allocate/get resources. (for example posix_cpu_timer_create does get_task_struct) [ tglx: fold the remove crappy comment patch into this ] Signed-off-by: Andrey Vagin <avagin@openvz.org> Cc: Oleg Nesterov <oleg@tv-sign.ru> Cc: Pavel Emelyanov <xemul@openvz.org> Reviewed-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/posix-timers.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) --- a/kernel/posix-timers.c +++ b/kernel/posix-timers.c @@ -559,14 +559,7 @@ SYSCALL_DEFINE3(timer_create, const cloc new_timer->it_id = (timer_t) new_timer_id; new_timer->it_clock = which_clock; new_timer->it_overrun = -1; - error = CLOCK_DISPATCH(which_clock, timer_create, (new_timer)); - if (error) - goto out; - /* - * return the timer_id now. The next step is hard to - * back out if there is an error. - */ if (copy_to_user(created_timer_id, &new_timer_id, sizeof (new_timer_id))) { error = -EFAULT; @@ -597,6 +590,10 @@ SYSCALL_DEFINE3(timer_create, const cloc new_timer->sigq->info.si_tid = new_timer->it_id; new_timer->sigq->info.si_code = SI_TIMER; + error = CLOCK_DISPATCH(which_clock, timer_create, (new_timer)); + if (error) + goto out; + spin_lock_irq(¤t->sighand->siglock); new_timer->it_signal = current->signal; list_add(&new_timer->list, ¤t->signal->posix_timers); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [010/200] libata: disable ATAPI AN by default 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (7 preceding siblings ...) 2010-07-01 17:41 ` [009/200] posix_timer: Fix error path in timer_create Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [011/200] libata: dont flush dcache on slab pages Greg KH ` (190 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Kay Sievers, Nick Bowler, David Zeuthen, Jeff Garzik 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tejun Heo <tj@kernel.org> commit e7ecd435692ca9bde9d124be30b3a26e672ea6c2 upstream. There are ATAPI devices which raise AN when hit by commands issued by open(). This leads to infinite loop of AN -> MEDIA_CHANGE uevent -> udev open() to check media -> AN. Both ACS and SerialATA standards don't define in which case ATAPI devices are supposed to raise or not raise AN. They both list media insertion event as a possible use case for ATAPI ANs but there is no clear description of what constitutes such events. As such, it seems a bit too naive to export ANs directly to userland as MEDIA_CHANGE events without further verification (which should behave similarly to windows as it apparently is the only thing that some hardware vendors are testing against). This patch adds libata.atapi_an module parameter and disables ATAPI AN by default for now. Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Kay Sievers <kay.sievers@vrfy.org> Cc: Nick Bowler <nbowler@elliptictech.com> Cc: David Zeuthen <david@fubar.dk> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/libata-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -160,6 +160,10 @@ int libata_allow_tpm = 0; module_param_named(allow_tpm, libata_allow_tpm, int, 0444); MODULE_PARM_DESC(allow_tpm, "Permit the use of TPM commands (0=off [default], 1=on)"); +static int atapi_an; +module_param(atapi_an, int, 0444); +MODULE_PARM_DESC(atapi_an, "Enable ATAPI AN media presence notification (0=0ff [default], 1=on)"); + MODULE_AUTHOR("Jeff Garzik"); MODULE_DESCRIPTION("Library module for ATA devices"); MODULE_LICENSE("GPL"); @@ -2572,7 +2576,8 @@ int ata_dev_configure(struct ata_device * to enable ATAPI AN to discern between PHY status * changed notifications and ATAPI ANs. */ - if ((ap->flags & ATA_FLAG_AN) && ata_id_has_atapi_AN(id) && + if (atapi_an && + (ap->flags & ATA_FLAG_AN) && ata_id_has_atapi_AN(id) && (!sata_pmp_attached(ap) || sata_scr_read(&ap->link, SCR_NOTIFICATION, &sntf) == 0)) { unsigned int err_mask; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [011/200] libata: dont flush dcache on slab pages 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (8 preceding siblings ...) 2010-07-01 17:41 ` [010/200] libata: disable ATAPI AN by default Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [012/200] cpumask: fix compat getaffinity Greg KH ` (189 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Sebastian Andrzej Siewior, Jeff Garzik 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> commit 3842e835490cdf17013b30a788f6311bdcfd0571 upstream. page_mapping() check this via VM_BUG_ON(PageSlab(page)) so we bug here with the according debuging turned on. Future TODO: replace this with a flush_dcache_page_for_pio() API Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/libata-sff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/ata/libata-sff.c +++ b/drivers/ata/libata-sff.c @@ -894,7 +894,7 @@ static void ata_pio_sector(struct ata_qu do_write); } - if (!do_write) + if (!do_write && !PageSlab(page)) flush_dcache_page(page); qc->curbytes += qc->sect_size; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [012/200] cpumask: fix compat getaffinity 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (9 preceding siblings ...) 2010-07-01 17:41 ` [011/200] libata: dont flush dcache on slab pages Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [013/200] NFSD: dont report compiled-out versions as present Greg KH ` (188 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, KOSAKI Motohiro, Rusty Russell, Arnd Bergmann, Andi Kleen 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> commit fa9dc265ace9774e62f0e31108e5f47911124bda upstream. Commit a45185d2d "cpumask: convert kernel/compat.c" broke libnuma, which abuses sched_getaffinity to find out NR_CPUS in order to parse /sys/devices/system/node/node*/cpumap. On NUMA systems with less than 32 possibly CPUs, the current compat_sys_sched_getaffinity now returns '4' instead of the actual NR_CPUS/8, which makes libnuma bail out when parsing the cpumap. The libnuma call sched_getaffinity(0, bitmap, 4096) at first. It mean the libnuma expect the return value of sched_getaffinity() is either len argument or NR_CPUS. But it doesn't expect to return nr_cpu_ids. Strictly speaking, userland requirement are 1) Glibc assume the return value mean the lengh of initialized of mask argument. E.g. if sched_getaffinity(1024) return 128, glibc make zero fill rest 896 byte. 2) Libnuma assume the return value can be used to guess NR_CPUS in kernel. It assume len-arg<NR_CPUS makes -EINVAL. But it try len=4096 at first and 4096 is always bigger than NR_CPUS. Then, if we remove strange min_length normalization, we never hit -EINVAL case. sched_getaffinity() already solved this issue. This patch adapts compat_sys_sched_getaffinity() to match the non-compat case. Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Acked-by: Rusty Russell <rusty@rustcorp.com.au> Acked-by: Arnd Bergmann <arnd@arndb.de> Reported-by: Ken Werner <ken.werner@web.de> Cc: Andi Kleen <andi@firstfloor.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/compat.c | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) --- a/kernel/compat.c +++ b/kernel/compat.c @@ -495,29 +495,26 @@ asmlinkage long compat_sys_sched_getaffi { int ret; cpumask_var_t mask; - unsigned long *k; - unsigned int min_length = cpumask_size(); - if (nr_cpu_ids <= BITS_PER_COMPAT_LONG) - min_length = sizeof(compat_ulong_t); - - if (len < min_length) + if ((len * BITS_PER_BYTE) < nr_cpu_ids) + return -EINVAL; + if (len & (sizeof(compat_ulong_t)-1)) return -EINVAL; if (!alloc_cpumask_var(&mask, GFP_KERNEL)) return -ENOMEM; ret = sched_getaffinity(pid, mask); - if (ret < 0) - goto out; + if (ret == 0) { + size_t retlen = min_t(size_t, len, cpumask_size()); - k = cpumask_bits(mask); - ret = compat_put_bitmap(user_mask_ptr, k, min_length * 8); - if (ret == 0) - ret = min_length; - -out: + if (compat_put_bitmap(user_mask_ptr, cpumask_bits(mask), retlen * 8)) + ret = -EFAULT; + else + ret = retlen; + } free_cpumask_var(mask); + return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [013/200] NFSD: dont report compiled-out versions as present 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (10 preceding siblings ...) 2010-07-01 17:41 ` [012/200] cpumask: fix compat getaffinity Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [014/200] nfsd: dont break lease while servicing a COMMIT Greg KH ` (187 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Pavel Emelyanov, NeilBrown, J. Bruce Fields 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pavel Emelyanov <xemul@openvz.org> commit 15ddb4aec54422ead137b03ea4e9b3f5db3f7cc2 upstream. The /proc/fs/nfsd/versions file calls nfsd_vers() to check whether the particular nfsd version is present/available. The problem is that once I turn off e.g. NFSD-V4 this call returns -1 which is true from the callers POV which is wrong. The proposal is to report false in that case. The bug has existed since 6658d3a7bbfd1768 "[PATCH] knfsd: remove nfsd_versbits as intermediate storage for desired versions". Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: NeilBrown <neilb@suse.de> Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/nfsd/nfssvc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/nfsd/nfssvc.c +++ b/fs/nfsd/nfssvc.c @@ -120,7 +120,7 @@ u32 nfsd_supported_minorversion; int nfsd_vers(int vers, enum vers_op change) { if (vers < NFSD_MINVERS || vers >= NFSD_NRVERS) - return -1; + return 0; switch(change) { case NFSD_SET: nfsd_versions[vers] = nfsd_version[vers]; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [014/200] nfsd: dont break lease while servicing a COMMIT 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (11 preceding siblings ...) 2010-07-01 17:41 ` [013/200] NFSD: dont report compiled-out versions as present Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [015/200] sata_nv: use ata_pci_sff_activate_host() instead of ata_host_activate() Greg KH ` (186 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jeff Layton, J. Bruce Fields 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jeff Layton <jlayton@redhat.com> commit 91885258e8343bb65c08f668d7e6c16563eb4284 upstream. This is the second attempt to fix the problem whereby a COMMIT call causes a lease break and triggers a possible deadlock. The problem is that nfsd attempts to break a lease on a COMMIT call. This triggers a delegation recall if the lease is held for a delegation. If the client is the one holding the delegation and it's the same one on which it's issuing the COMMIT, then it can't return that delegation until the COMMIT is complete. But, nfsd won't complete the COMMIT until the delegation is returned. The client and server are essentially deadlocked until the state is marked bad (due to the client not responding on the callback channel). The first patch attempted to deal with this by eliminating the open of the file altogether and simply had nfsd_commit pass a NULL file pointer to the vfs_fsync_range. That would conflict with some work in progress by Christoph Hellwig to clean up the fsync interface, so this patch takes a different approach. This declares a new NFSD_MAY_NOT_BREAK_LEASE access flag that indicates to nfsd_open that it should not break any leases when opening the file, and has nfsd_commit set that flag on the nfsd_open call. For now, this patch leaves nfsd_commit opening the file with write access since I'm not clear on what sort of access would be more appropriate. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/nfsd/vfs.c | 8 +++++--- fs/nfsd/vfs.h | 1 + 2 files changed, 6 insertions(+), 3 deletions(-) --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -724,7 +724,7 @@ nfsd_open(struct svc_rqst *rqstp, struct struct inode *inode; int flags = O_RDONLY|O_LARGEFILE; __be32 err; - int host_err; + int host_err = 0; validate_process_creds(); @@ -761,7 +761,8 @@ nfsd_open(struct svc_rqst *rqstp, struct * Check to see if there are any leases on this file. * This may block while leases are broken. */ - host_err = break_lease(inode, O_NONBLOCK | ((access & NFSD_MAY_WRITE) ? O_WRONLY : 0)); + if (!(access & NFSD_MAY_NOT_BREAK_LEASE)) + host_err = break_lease(inode, O_NONBLOCK | ((access & NFSD_MAY_WRITE) ? O_WRONLY : 0)); if (host_err == -EWOULDBLOCK) host_err = -ETIMEDOUT; if (host_err) /* NOMEM or WOULDBLOCK */ @@ -1169,7 +1170,8 @@ nfsd_commit(struct svc_rqst *rqstp, stru goto out; } - err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_WRITE, &file); + err = nfsd_open(rqstp, fhp, S_IFREG, + NFSD_MAY_WRITE|NFSD_MAY_NOT_BREAK_LEASE, &file); if (err) goto out; if (EX_ISSYNC(fhp->fh_export)) { --- a/fs/nfsd/vfs.h +++ b/fs/nfsd/vfs.h @@ -20,6 +20,7 @@ #define NFSD_MAY_OWNER_OVERRIDE 64 #define NFSD_MAY_LOCAL_ACCESS 128 /* IRIX doing local access check on device special file*/ #define NFSD_MAY_BYPASS_GSS_ON_ROOT 256 +#define NFSD_MAY_NOT_BREAK_LEASE 512 #define NFSD_MAY_CREATE (NFSD_MAY_EXEC|NFSD_MAY_WRITE) #define NFSD_MAY_REMOVE (NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [015/200] sata_nv: use ata_pci_sff_activate_host() instead of ata_host_activate() 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (12 preceding siblings ...) 2010-07-01 17:41 ` [014/200] nfsd: dont break lease while servicing a COMMIT Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [016/200] ARCNET: Limit com20020 PCI ID matches for SOHARD cards Greg KH ` (185 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Robert Hancock, Jeff Garzik 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tejun Heo <tj@kernel.org> commit 95cc2c70c139936a2142bcd583da8af6f9d88efb upstream. sata_nv was incorrectly using ata_host_activate() instead of ata_pci_sff_activate_host() leading to IRQ assignment failure in legacy mode. Fix it. Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Robert Hancock <hancockr@shaw.ca> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/sata_nv.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/drivers/ata/sata_nv.c +++ b/drivers/ata/sata_nv.c @@ -2479,8 +2479,7 @@ static int nv_init_one(struct pci_dev *p } pci_set_master(pdev); - return ata_host_activate(host, pdev->irq, ipriv->irq_handler, - IRQF_SHARED, ipriv->sht); + return ata_pci_sff_activate_host(host, ipriv->irq_handler, ipriv->sht); } #ifdef CONFIG_PM ^ permalink raw reply [flat|nested] 666+ messages in thread
* [016/200] ARCNET: Limit com20020 PCI ID matches for SOHARD cards 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (13 preceding siblings ...) 2010-07-01 17:41 ` [015/200] sata_nv: use ata_pci_sff_activate_host() instead of ata_host_activate() Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [017/200] rtl8180: fix tx status reporting Greg KH ` (184 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andreas Bombe, David S. Miller 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andreas Bombe <aeb@debian.org> commit e7971c80a8e0299f91272ad8e8ac4167623e1862 upstream. The SH SOHARD ARCNET cards are implemented using generic PLX Technology PCI<->IOBus bridges. Subvendor and subdevice IDs were not specified, causing the driver to attach to any such bridge and likely crash the system by attempting to initialize an unrelated device. Fix by specifying subvendor and subdevice according to the values found in the PCI-ID Repository at http://pci-ids.ucw.cz/ . Signed-off-by: Andreas Bombe <aeb@debian.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/arcnet/com20020-pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/arcnet/com20020-pci.c +++ b/drivers/net/arcnet/com20020-pci.c @@ -164,8 +164,8 @@ static DEFINE_PCI_DEVICE_TABLE(com20020p { 0x1571, 0xa204, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, { 0x1571, 0xa205, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, { 0x1571, 0xa206, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, - { 0x10B5, 0x9030, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, - { 0x10B5, 0x9050, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, + { 0x10B5, 0x9030, 0x10B5, 0x2978, 0, 0, ARC_CAN_10MBIT }, + { 0x10B5, 0x9050, 0x10B5, 0x2273, 0, 0, ARC_CAN_10MBIT }, { 0x14BA, 0x6000, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, { 0x10B5, 0x2200, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ARC_CAN_10MBIT }, {0,} ^ permalink raw reply [flat|nested] 666+ messages in thread
* [017/200] rtl8180: fix tx status reporting 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (14 preceding siblings ...) 2010-07-01 17:41 ` [016/200] ARCNET: Limit com20020 PCI ID matches for SOHARD cards Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [018/200] staging: vt6655: Fix kernel BUG on driver wpa initialization Greg KH ` (183 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: John W. Linville <linville@tuxdriver.com> commit d989ff7cf8d14f1b523f63ba0bf2ec1a9b7c25bc upstream. When reporting Tx status, indicate that only one rate was used. Otherwise, the rate is frozen at rate index 0 (i.e. 1Mb/s). Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/rtl818x/rtl8180_dev.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/wireless/rtl818x/rtl8180_dev.c +++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c @@ -188,6 +188,7 @@ static void rtl8180_handle_tx(struct iee info->flags |= IEEE80211_TX_STAT_ACK; info->status.rates[0].count = (flags & 0xFF) + 1; + info->status.rates[1].idx = -1; ieee80211_tx_status_irqsafe(dev, skb); if (ring->entries - skb_queue_len(&ring->queue) == 2) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [018/200] staging: vt6655: Fix kernel BUG on driver wpa initialization 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (15 preceding siblings ...) 2010-07-01 17:41 ` [017/200] rtl8180: fix tx status reporting Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [019/200] Staging: rt2870: add device ID of MelCo.,Inc. WLI-UC-G301N Greg KH ` (182 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Larry Finger 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Larry Finger <Larry.Finger@lwfinger.net> commit f65515275ea3e45fdcd0fb78455f542d6fdca086 upstream. In http://bugzilla.novell.com/show_bug.cgi?id=597299, the vt6655 driver generates a kernel BUG on a NULL pointer dereference at NULL. This problem has been traced to a failure in the wpa_set_wpadev() routine. As the vt6656 driver does not call this routine, the vt6655 code is similarly set to skip the call. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Tested-by: Richard Meek <osl2008@googlemail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/staging/vt6655/device_main.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/staging/vt6655/device_main.c +++ b/drivers/staging/vt6655/device_main.c @@ -1090,11 +1090,13 @@ device_found1(struct pci_dev *pcid, cons } //2008-07-21-01<Add>by MikeLiu //register wpadev +#if 0 if(wpa_set_wpadev(pDevice, 1)!=0) { printk("Fail to Register WPADEV?\n"); unregister_netdev(pDevice->dev); free_netdev(dev); } +#endif device_print_info(pDevice); pci_set_drvdata(pcid, pDevice); return 0; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [019/200] Staging: rt2870: add device ID of MelCo.,Inc. WLI-UC-G301N 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (16 preceding siblings ...) 2010-07-01 17:41 ` [018/200] staging: vt6655: Fix kernel BUG on driver wpa initialization Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [020/200] Staging: batman-adv: dont have interrupts disabled while sending Greg KH ` (181 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Nobhiro KUSUNO 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Nobuhiro KUSUNO <n-kusuno@fc4.so-net.ne.jp> commit de37cd49b5a54facef174cf34496919857436e8f upstream. My wireless LAN module 'MelCo.,Inc. WLI-UC-G301N' works fine, if the following line is added into 2870_main_dev.c. Signed-off-by: Nobhiro KUSUNO <n-kusuno@fc4.so-net.ne.jp> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/staging/rt2860/usb_main_dev.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/staging/rt2860/usb_main_dev.c +++ b/drivers/staging/rt2860/usb_main_dev.c @@ -98,6 +98,7 @@ struct usb_device_id rtusb_usb_id[] = { {USB_DEVICE(0x5A57, 0x0282)}, /* Zinwell */ {USB_DEVICE(0x7392, 0x7718)}, {USB_DEVICE(0x7392, 0x7717)}, + {USB_DEVICE(0x0411, 0x016f)}, /* MelCo.,Inc. WLI-UC-G301N */ {USB_DEVICE(0x1737, 0x0070)}, /* Linksys WUSB100 */ {USB_DEVICE(0x1737, 0x0071)}, /* Linksys WUSB600N */ {USB_DEVICE(0x0411, 0x00e8)}, /* Buffalo WLI-UC-G300N */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [020/200] Staging: batman-adv: dont have interrupts disabled while sending. 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (17 preceding siblings ...) 2010-07-01 17:41 ` [019/200] Staging: rt2870: add device ID of MelCo.,Inc. WLI-UC-G301N Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [021/200] Staging: batman-adv: Fix VIS output bug for secondary interfaces Greg KH ` (180 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andrew Lunn, Marek Lindner, Simon Wunderlich [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 14246 bytes --] 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andrew Lunn <andrew@lunn.ch> commit 107c32fe68f0b64acb7edd31d44d79b87c7fa8b4 upstream. send_vis_packets() would disable interrupts before calling dev_queue_xmit() which resulting in a backtrace in local_bh_enable(). Fix this by using kref on the vis_info object so that we can call send_vis_packets() without holding vis_hash_lock. vis_hash_lock also used to protect recv_list, so we now need a new lock to protect that instead of vis_hash_lock. Also a few checkpatch cleanups. Reported-by: Linus Lüssing <linus.luessing@web.de> Signed-off-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/staging/batman-adv/vis.c | 198 +++++++++++++++++++++++++++------------ drivers/staging/batman-adv/vis.h | 1 2 files changed, 139 insertions(+), 60 deletions(-) --- a/drivers/staging/batman-adv/vis.c +++ b/drivers/staging/batman-adv/vis.c @@ -29,22 +29,26 @@ struct hashtable_t *vis_hash; DEFINE_SPINLOCK(vis_hash_lock); +static DEFINE_SPINLOCK(recv_list_lock); static struct vis_info *my_vis_info; static struct list_head send_list; /* always locked with vis_hash_lock */ static void start_vis_timer(void); /* free the info */ -static void free_info(void *data) +static void free_info(struct kref *ref) { - struct vis_info *info = data; + struct vis_info *info = container_of(ref, struct vis_info, refcount); struct recvlist_node *entry, *tmp; + unsigned long flags; list_del_init(&info->send_list); + spin_lock_irqsave(&recv_list_lock, flags); list_for_each_entry_safe(entry, tmp, &info->recv_list, list) { list_del(&entry->list); kfree(entry); } + spin_unlock_irqrestore(&recv_list_lock, flags); kfree(info); } @@ -142,36 +146,65 @@ void proc_vis_read_entry(struct seq_file } } +/* add the info packet to the send list, if it was not + * already linked in. */ +static void send_list_add(struct vis_info *info) +{ + if (list_empty(&info->send_list)) { + kref_get(&info->refcount); + list_add_tail(&info->send_list, &send_list); + } +} + +/* delete the info packet from the send list, if it was + * linked in. */ +static void send_list_del(struct vis_info *info) +{ + if (!list_empty(&info->send_list)) { + list_del_init(&info->send_list); + kref_put(&info->refcount, free_info); + } +} + /* tries to add one entry to the receive list. */ static void recv_list_add(struct list_head *recv_list, char *mac) { struct recvlist_node *entry; + unsigned long flags; + entry = kmalloc(sizeof(struct recvlist_node), GFP_ATOMIC); if (!entry) return; memcpy(entry->mac, mac, ETH_ALEN); + spin_lock_irqsave(&recv_list_lock, flags); list_add_tail(&entry->list, recv_list); + spin_unlock_irqrestore(&recv_list_lock, flags); } /* returns 1 if this mac is in the recv_list */ static int recv_list_is_in(struct list_head *recv_list, char *mac) { struct recvlist_node *entry; + unsigned long flags; + spin_lock_irqsave(&recv_list_lock, flags); list_for_each_entry(entry, recv_list, list) { - if (memcmp(entry->mac, mac, ETH_ALEN) == 0) + if (memcmp(entry->mac, mac, ETH_ALEN) == 0) { + spin_unlock_irqrestore(&recv_list_lock, flags); return 1; + } } - + spin_unlock_irqrestore(&recv_list_lock, flags); return 0; } /* try to add the packet to the vis_hash. return NULL if invalid (e.g. too old, - * broken.. ). vis hash must be locked outside. is_new is set when the packet + * broken.. ). vis hash must be locked outside. is_new is set when the packet * is newer than old entries in the hash. */ static struct vis_info *add_packet(struct vis_packet *vis_packet, - int vis_info_len, int *is_new) + int vis_info_len, int *is_new, + int make_broadcast) { struct vis_info *info, *old_info; struct vis_info search_elem; @@ -198,13 +231,15 @@ static struct vis_info *add_packet(struc } /* remove old entry */ hash_remove(vis_hash, old_info); - free_info(old_info); + send_list_del(old_info); + kref_put(&old_info->refcount, free_info); } info = kmalloc(sizeof(struct vis_info) + vis_info_len, GFP_ATOMIC); if (info == NULL) return NULL; + kref_init(&info->refcount); INIT_LIST_HEAD(&info->send_list); INIT_LIST_HEAD(&info->recv_list); info->first_seen = jiffies; @@ -214,16 +249,21 @@ static struct vis_info *add_packet(struc /* initialize and add new packet. */ *is_new = 1; + /* Make it a broadcast packet, if required */ + if (make_broadcast) + memcpy(info->packet.target_orig, broadcastAddr, ETH_ALEN); + /* repair if entries is longer than packet. */ if (info->packet.entries * sizeof(struct vis_info_entry) > vis_info_len) - info->packet.entries = vis_info_len / sizeof(struct vis_info_entry); + info->packet.entries = vis_info_len / + sizeof(struct vis_info_entry); recv_list_add(&info->recv_list, info->packet.sender_orig); /* try to add it */ if (hash_add(vis_hash, info) < 0) { /* did not work (for some reason) */ - free_info(info); + kref_put(&old_info->refcount, free_info); info = NULL; } @@ -234,22 +274,21 @@ static struct vis_info *add_packet(struc void receive_server_sync_packet(struct vis_packet *vis_packet, int vis_info_len) { struct vis_info *info; - int is_new; + int is_new, make_broadcast; unsigned long flags; int vis_server = atomic_read(&vis_mode); + make_broadcast = (vis_server == VIS_TYPE_SERVER_SYNC); + spin_lock_irqsave(&vis_hash_lock, flags); - info = add_packet(vis_packet, vis_info_len, &is_new); + info = add_packet(vis_packet, vis_info_len, &is_new, make_broadcast); if (info == NULL) goto end; /* only if we are server ourselves and packet is newer than the one in * hash.*/ - if (vis_server == VIS_TYPE_SERVER_SYNC && is_new) { - memcpy(info->packet.target_orig, broadcastAddr, ETH_ALEN); - if (list_empty(&info->send_list)) - list_add_tail(&info->send_list, &send_list); - } + if (vis_server == VIS_TYPE_SERVER_SYNC && is_new) + send_list_add(info); end: spin_unlock_irqrestore(&vis_hash_lock, flags); } @@ -262,31 +301,32 @@ void receive_client_update_packet(struct int is_new; unsigned long flags; int vis_server = atomic_read(&vis_mode); + int are_target = 0; /* clients shall not broadcast. */ if (is_bcast(vis_packet->target_orig)) return; + /* Are we the target for this VIS packet? */ + if (vis_server == VIS_TYPE_SERVER_SYNC && + is_my_mac(vis_packet->target_orig)) + are_target = 1; + spin_lock_irqsave(&vis_hash_lock, flags); - info = add_packet(vis_packet, vis_info_len, &is_new); + info = add_packet(vis_packet, vis_info_len, &is_new, are_target); if (info == NULL) goto end; /* note that outdated packets will be dropped at this point. */ /* send only if we're the target server or ... */ - if (vis_server == VIS_TYPE_SERVER_SYNC && - is_my_mac(info->packet.target_orig) && - is_new) { + if (are_target && is_new) { info->packet.vis_type = VIS_TYPE_SERVER_SYNC; /* upgrade! */ - memcpy(info->packet.target_orig, broadcastAddr, ETH_ALEN); - if (list_empty(&info->send_list)) - list_add_tail(&info->send_list, &send_list); + send_list_add(info); /* ... we're not the recipient (and thus need to forward). */ } else if (!is_my_mac(info->packet.target_orig)) { - if (list_empty(&info->send_list)) - list_add_tail(&info->send_list, &send_list); + send_list_add(info); } end: spin_unlock_irqrestore(&vis_hash_lock, flags); @@ -361,14 +401,17 @@ static int generate_vis_packet(void) while (hash_iterate(orig_hash, &hashit_global)) { orig_node = hashit_global.bucket->data; if (orig_node->router != NULL - && compare_orig(orig_node->router->addr, orig_node->orig) + && compare_orig(orig_node->router->addr, + orig_node->orig) && orig_node->batman_if && (orig_node->batman_if->if_active == IF_ACTIVE) && orig_node->router->tq_avg > 0) { /* fill one entry into buffer. */ entry = &entry_array[info->packet.entries]; - memcpy(entry->src, orig_node->batman_if->net_dev->dev_addr, ETH_ALEN); + memcpy(entry->src, + orig_node->batman_if->net_dev->dev_addr, + ETH_ALEN); memcpy(entry->dest, orig_node->orig, ETH_ALEN); entry->quality = orig_node->router->tq_avg; info->packet.entries++; @@ -400,6 +443,8 @@ static int generate_vis_packet(void) return 0; } +/* free old vis packets. Must be called with this vis_hash_lock + * held */ static void purge_vis_packets(void) { HASHIT(hashit); @@ -412,7 +457,8 @@ static void purge_vis_packets(void) if (time_after(jiffies, info->first_seen + (VIS_TIMEOUT*HZ)/1000)) { hash_remove_bucket(vis_hash, &hashit); - free_info(info); + send_list_del(info); + kref_put(&info->refcount, free_info); } } } @@ -422,6 +468,8 @@ static void broadcast_vis_packet(struct HASHIT(hashit); struct orig_node *orig_node; unsigned long flags; + struct batman_if *batman_if; + uint8_t dstaddr[ETH_ALEN]; spin_lock_irqsave(&orig_hash_lock, flags); @@ -430,45 +478,56 @@ static void broadcast_vis_packet(struct orig_node = hashit.bucket->data; /* if it's a vis server and reachable, send it. */ - if (orig_node && - (orig_node->flags & VIS_SERVER) && - orig_node->batman_if && - orig_node->router) { + if ((!orig_node) || (!orig_node->batman_if) || + (!orig_node->router)) + continue; + if (!(orig_node->flags & VIS_SERVER)) + continue; + /* don't send it if we already received the packet from + * this node. */ + if (recv_list_is_in(&info->recv_list, orig_node->orig)) + continue; + + memcpy(info->packet.target_orig, orig_node->orig, ETH_ALEN); + batman_if = orig_node->batman_if; + memcpy(dstaddr, orig_node->router->addr, ETH_ALEN); + spin_unlock_irqrestore(&orig_hash_lock, flags); + + send_raw_packet((unsigned char *)&info->packet, + packet_length, batman_if, dstaddr); + + spin_lock_irqsave(&orig_hash_lock, flags); - /* don't send it if we already received the packet from - * this node. */ - if (recv_list_is_in(&info->recv_list, orig_node->orig)) - continue; - - memcpy(info->packet.target_orig, - orig_node->orig, ETH_ALEN); - - send_raw_packet((unsigned char *) &info->packet, - packet_length, - orig_node->batman_if, - orig_node->router->addr); - } } - memcpy(info->packet.target_orig, broadcastAddr, ETH_ALEN); spin_unlock_irqrestore(&orig_hash_lock, flags); + memcpy(info->packet.target_orig, broadcastAddr, ETH_ALEN); } static void unicast_vis_packet(struct vis_info *info, int packet_length) { struct orig_node *orig_node; unsigned long flags; + struct batman_if *batman_if; + uint8_t dstaddr[ETH_ALEN]; spin_lock_irqsave(&orig_hash_lock, flags); orig_node = ((struct orig_node *) hash_find(orig_hash, info->packet.target_orig)); - if ((orig_node != NULL) && - (orig_node->batman_if != NULL) && - (orig_node->router != NULL)) { - send_raw_packet((unsigned char *) &info->packet, packet_length, - orig_node->batman_if, - orig_node->router->addr); - } + if ((!orig_node) || (!orig_node->batman_if) || (!orig_node->router)) + goto out; + + /* don't lock while sending the packets ... we therefore + * copy the required data before sending */ + batman_if = orig_node->batman_if; + memcpy(dstaddr, orig_node->router->addr, ETH_ALEN); + spin_unlock_irqrestore(&orig_hash_lock, flags); + + send_raw_packet((unsigned char *)&info->packet, + packet_length, batman_if, dstaddr); + return; + +out: spin_unlock_irqrestore(&orig_hash_lock, flags); } @@ -502,15 +561,24 @@ static void send_vis_packets(struct work unsigned long flags; spin_lock_irqsave(&vis_hash_lock, flags); + purge_vis_packets(); - if (generate_vis_packet() == 0) + if (generate_vis_packet() == 0) { /* schedule if generation was successful */ - list_add_tail(&my_vis_info->send_list, &send_list); + send_list_add(my_vis_info); + } list_for_each_entry_safe(info, temp, &send_list, send_list) { - list_del_init(&info->send_list); + + kref_get(&info->refcount); + spin_unlock_irqrestore(&vis_hash_lock, flags); + send_vis_packet(info); + + spin_lock_irqsave(&vis_hash_lock, flags); + send_list_del(info); + kref_put(&info->refcount, free_info); } spin_unlock_irqrestore(&vis_hash_lock, flags); start_vis_timer(); @@ -543,6 +611,7 @@ int vis_init(void) my_vis_info->first_seen = jiffies - atomic_read(&vis_interval); INIT_LIST_HEAD(&my_vis_info->recv_list); INIT_LIST_HEAD(&my_vis_info->send_list); + kref_init(&my_vis_info->refcount); my_vis_info->packet.version = COMPAT_VERSION; my_vis_info->packet.packet_type = BAT_VIS; my_vis_info->packet.ttl = TTL; @@ -556,9 +625,9 @@ int vis_init(void) if (hash_add(vis_hash, my_vis_info) < 0) { printk(KERN_ERR - "batman-adv:Can't add own vis packet into hash\n"); - free_info(my_vis_info); /* not in hash, need to remove it - * manually. */ + "batman-adv:Can't add own vis packet into hash\n"); + /* not in hash, need to remove it manually. */ + kref_put(&my_vis_info->refcount, free_info); goto err; } @@ -572,6 +641,15 @@ err: return 0; } +/* Decrease the reference count on a hash item info */ +static void free_info_ref(void *data) +{ + struct vis_info *info = data; + + send_list_del(info); + kref_put(&info->refcount, free_info); +} + /* shutdown vis-server */ void vis_quit(void) { @@ -583,7 +661,7 @@ void vis_quit(void) spin_lock_irqsave(&vis_hash_lock, flags); /* properly remove, kill timers ... */ - hash_delete(vis_hash, free_info); + hash_delete(vis_hash, free_info_ref); vis_hash = NULL; my_vis_info = NULL; spin_unlock_irqrestore(&vis_hash_lock, flags); --- a/drivers/staging/batman-adv/vis.h +++ b/drivers/staging/batman-adv/vis.h @@ -29,6 +29,7 @@ struct vis_info { /* list of server-neighbors we received a vis-packet * from. we should not reply to them. */ struct list_head send_list; + struct kref refcount; /* this packet might be part of the vis send queue. */ struct vis_packet packet; /* vis_info may follow here*/ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [021/200] Staging: batman-adv: Fix VIS output bug for secondary interfaces 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (18 preceding siblings ...) 2010-07-01 17:41 ` [020/200] Staging: batman-adv: dont have interrupts disabled while sending Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [022/200] Staging: batman-adv: Fixing wrap-around bug in vis Greg KH ` (179 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Linus LÃŒssing, Andrew Lunn [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 7573 bytes --] 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@web.de> commit f6497e38fda6970819daacb67725d67474079381 upstream. TQ and HNA records for originators on secondary interfaces were wrongly being included on the primary interface. Ensure we output a line for each source interface on every node, so we correctly separate primary and secondary interface records. Signed-off-by: Linus Lüssing <linus.luessing@web.de> Signed-off-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/staging/batman-adv/proc.c | 51 ++++++++++++++++++++++++++------------ drivers/staging/batman-adv/vis.c | 25 ++++++------------ drivers/staging/batman-adv/vis.h | 7 +++-- 3 files changed, 49 insertions(+), 34 deletions(-) --- a/drivers/staging/batman-adv/proc.c +++ b/drivers/staging/batman-adv/proc.c @@ -41,7 +41,7 @@ static int proc_interfaces_read(struct s rcu_read_lock(); list_for_each_entry_rcu(batman_if, &if_list, list) { - seq_printf(seq, "[%8s] %s %s \n", + seq_printf(seq, "[%8s] %s %s\n", (batman_if->if_active == IF_ACTIVE ? "active" : "inactive"), batman_if->dev, @@ -188,18 +188,18 @@ static int proc_originators_read(struct rcu_read_lock(); if (list_empty(&if_list)) { rcu_read_unlock(); - seq_printf(seq, "BATMAN disabled - please specify interfaces to enable it \n"); + seq_printf(seq, "BATMAN disabled - please specify interfaces to enable it\n"); goto end; } if (((struct batman_if *)if_list.next)->if_active != IF_ACTIVE) { rcu_read_unlock(); - seq_printf(seq, "BATMAN disabled - primary interface not active \n"); + seq_printf(seq, "BATMAN disabled - primary interface not active\n"); goto end; } seq_printf(seq, - " %-14s (%s/%i) %17s [%10s]: %20s ... [B.A.T.M.A.N. adv %s%s, MainIF/MAC: %s/%s] \n", + " %-14s (%s/%i) %17s [%10s]: %20s ... [B.A.T.M.A.N. adv %s%s, MainIF/MAC: %s/%s]\n", "Originator", "#", TQ_MAX_VALUE, "Nexthop", "outgoingIF", "Potential nexthops", SOURCE_VERSION, REVISION_VERSION_STR, ((struct batman_if *)if_list.next)->dev, @@ -240,7 +240,7 @@ static int proc_originators_read(struct spin_unlock_irqrestore(&orig_hash_lock, flags); if (batman_count == 0) - seq_printf(seq, "No batman nodes in range ... \n"); + seq_printf(seq, "No batman nodes in range ...\n"); end: return 0; @@ -262,7 +262,7 @@ static int proc_transt_local_read(struct rcu_read_lock(); if (list_empty(&if_list)) { rcu_read_unlock(); - seq_printf(seq, "BATMAN disabled - please specify interfaces to enable it \n"); + seq_printf(seq, "BATMAN disabled - please specify interfaces to enable it\n"); goto end; } @@ -294,7 +294,7 @@ static int proc_transt_global_read(struc rcu_read_lock(); if (list_empty(&if_list)) { rcu_read_unlock(); - seq_printf(seq, "BATMAN disabled - please specify interfaces to enable it \n"); + seq_printf(seq, "BATMAN disabled - please specify interfaces to enable it\n"); goto end; } rcu_read_unlock(); @@ -350,9 +350,9 @@ static int proc_vis_srv_read(struct seq_ { int vis_server = atomic_read(&vis_mode); - seq_printf(seq, "[%c] client mode (server disabled) \n", + seq_printf(seq, "[%c] client mode (server disabled)\n", (vis_server == VIS_TYPE_CLIENT_UPDATE) ? 'x' : ' '); - seq_printf(seq, "[%c] server mode (server enabled) \n", + seq_printf(seq, "[%c] server mode (server enabled)\n", (vis_server == VIS_TYPE_SERVER_SYNC) ? 'x' : ' '); return 0; @@ -369,6 +369,8 @@ static int proc_vis_data_read(struct seq struct vis_info *info; struct vis_info_entry *entries; HLIST_HEAD(vis_if_list); + struct if_list_entry *entry; + struct hlist_node *pos, *n; int i; char tmp_addr_str[ETH_STR_LEN]; unsigned long flags; @@ -387,17 +389,34 @@ static int proc_vis_data_read(struct seq info = hashit.bucket->data; entries = (struct vis_info_entry *) ((char *)info + sizeof(struct vis_info)); - addr_to_string(tmp_addr_str, info->packet.vis_orig); - seq_printf(seq, "%s,", tmp_addr_str); for (i = 0; i < info->packet.entries; i++) { - proc_vis_read_entry(seq, &entries[i], &vis_if_list, - info->packet.vis_orig); + if (entries[i].quality == 0) + continue; + proc_vis_insert_interface(entries[i].src, &vis_if_list, + compare_orig(entries[i].src, + info->packet.vis_orig)); } - /* add primary/secondary records */ - proc_vis_read_prim_sec(seq, &vis_if_list); - seq_printf(seq, "\n"); + hlist_for_each_entry(entry, pos, &vis_if_list, list) { + addr_to_string(tmp_addr_str, entry->addr); + seq_printf(seq, "%s,", tmp_addr_str); + + for (i = 0; i < info->packet.entries; i++) + proc_vis_read_entry(seq, &entries[i], + entry->addr, entry->primary); + + /* add primary/secondary records */ + if (compare_orig(entry->addr, info->packet.vis_orig)) + proc_vis_read_prim_sec(seq, &vis_if_list); + + seq_printf(seq, "\n"); + } + + hlist_for_each_entry_safe(entry, pos, n, &vis_if_list, list) { + hlist_del(&entry->list); + kfree(entry); + } } spin_unlock_irqrestore(&vis_hash_lock, flags); --- a/drivers/staging/batman-adv/vis.c +++ b/drivers/staging/batman-adv/vis.c @@ -86,7 +86,7 @@ static int vis_info_choose(void *data, i /* insert interface to the list of interfaces of one originator, if it * does not already exist in the list */ -static void proc_vis_insert_interface(const uint8_t *interface, +void proc_vis_insert_interface(const uint8_t *interface, struct hlist_head *if_list, bool primary) { @@ -111,39 +111,32 @@ void proc_vis_read_prim_sec(struct seq_f struct hlist_head *if_list) { struct if_list_entry *entry; - struct hlist_node *pos, *n; + struct hlist_node *pos; char tmp_addr_str[ETH_STR_LEN]; - hlist_for_each_entry_safe(entry, pos, n, if_list, list) { - if (entry->primary) { + hlist_for_each_entry(entry, pos, if_list, list) { + if (entry->primary) seq_printf(seq, "PRIMARY, "); - } else { + else { addr_to_string(tmp_addr_str, entry->addr); seq_printf(seq, "SEC %s, ", tmp_addr_str); } - - hlist_del(&entry->list); - kfree(entry); } } /* read an entry */ void proc_vis_read_entry(struct seq_file *seq, struct vis_info_entry *entry, - struct hlist_head *if_list, - uint8_t *vis_orig) + uint8_t *src, + bool primary) { char to[40]; addr_to_string(to, entry->dest); - if (entry->quality == 0) { - proc_vis_insert_interface(vis_orig, if_list, true); + if (primary && entry->quality == 0) seq_printf(seq, "HNA %s, ", to); - } else { - proc_vis_insert_interface(entry->src, if_list, - compare_orig(entry->src, vis_orig)); + else if (compare_orig(entry->src, src)) seq_printf(seq, "TQ %s %d, ", to, entry->quality); - } } /* add the info packet to the send list, if it was not --- a/drivers/staging/batman-adv/vis.h +++ b/drivers/staging/batman-adv/vis.h @@ -49,10 +49,13 @@ struct recvlist_node { extern struct hashtable_t *vis_hash; extern spinlock_t vis_hash_lock; +void proc_vis_insert_interface(const uint8_t *interface, + struct hlist_head *if_list, + bool primary); void proc_vis_read_entry(struct seq_file *seq, struct vis_info_entry *entry, - struct hlist_head *if_list, - uint8_t *vis_orig); + uint8_t *src, + bool primary); void proc_vis_read_prim_sec(struct seq_file *seq, struct hlist_head *if_list); void receive_server_sync_packet(struct vis_packet *vis_packet, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [022/200] Staging: batman-adv: Fixing wrap-around bug in vis 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (19 preceding siblings ...) 2010-07-01 17:41 ` [021/200] Staging: batman-adv: Fix VIS output bug for secondary interfaces Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [023/200] mutex: Fix optimistic spinning vs. BKL Greg KH ` (178 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Linus LÃŒssing, Sven Eckelmann, Andrew Lunn [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 2541 bytes --] 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@web.de> commit ea4ceb18b525fd7016c10995c0f1313a729c7e2b upstream. When the seqno for a vis packet had a wrap around from i.e. 255 to 0, add_packet() would falsely claim the older packet with the seqno 255 as newer as the one with the seqno of 0 and would therefore ignore the new packet. This happens with all following vis packets until the old vis packet expires after 180 seconds timeout. This patch fixes this issue and gets rid of these highly undesired 3min. breaks for the vis-server. Signed-off-by: Linus Lüssing <linus.luessing@web.de> Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de> Signed-off-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/staging/batman-adv/vis.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) --- a/drivers/staging/batman-adv/vis.c +++ b/drivers/staging/batman-adv/vis.c @@ -27,6 +27,22 @@ #include "hard-interface.h" #include "hash.h" +/* Returns the smallest signed integer in two's complement with the sizeof x */ +#define smallest_signed_int(x) (1u << (7u + 8u * (sizeof(x) - 1u))) + +/* Checks if a sequence number x is a predecessor/successor of y. + they handle overflows/underflows and can correctly check for a + predecessor/successor unless the variable sequence number has grown by + more then 2**(bitwidth(x)-1)-1. + This means that for a uint8_t with the maximum value 255, it would think: + * when adding nothing - it is neither a predecessor nor a successor + * before adding more than 127 to the starting value - it is a predecessor, + * when adding 128 - it is neither a predecessor nor a successor, + * after adding more than 127 to the starting value - it is a successor */ +#define seq_before(x, y) ({typeof(x) _dummy = (x - y); \ + _dummy > smallest_signed_int(_dummy); }) +#define seq_after(x, y) seq_before(y, x) + struct hashtable_t *vis_hash; DEFINE_SPINLOCK(vis_hash_lock); static DEFINE_SPINLOCK(recv_list_lock); @@ -212,7 +228,7 @@ static struct vis_info *add_packet(struc old_info = hash_find(vis_hash, &search_elem); if (old_info != NULL) { - if (vis_packet->seqno - old_info->packet.seqno <= 0) { + if (!seq_after(vis_packet->seqno, old_info->packet.seqno)) { if (old_info->packet.seqno == vis_packet->seqno) { recv_list_add(&old_info->recv_list, vis_packet->sender_orig); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [023/200] mutex: Fix optimistic spinning vs. BKL 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (20 preceding siblings ...) 2010-07-01 17:41 ` [022/200] Staging: batman-adv: Fixing wrap-around bug in vis Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [024/200] ALSA: pcm: fix delta calculation at boundary wraparound Greg KH ` (177 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tony Breeds, Peter Zijlstra, Benjamin Herrenschmidt, Ingo Molnar 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tony Breeds <tony@bakeyournoodle.com> commit fd6be105b883244127a734ac9f14ae94a022dcc0 upstream. Currently, we can hit a nasty case with optimistic spinning on mutexes: CPU A tries to take a mutex, while holding the BKL CPU B tried to take the BLK while holding the mutex This looks like a AB-BA scenario but in practice, is allowed and happens due to the auto-release on schedule() nature of the BKL. In that case, the optimistic spinning code can get us into a situation where instead of going to sleep, A will spin waiting for B who is spinning waiting for A, and the only way out of that loop is the need_resched() test in mutex_spin_on_owner(). This patch fixes it by completely disabling spinning if we own the BKL. This adds one more detail to the extensive list of reasons why it's a bad idea for kernel code to be holding the BKL. Signed-off-by: Tony Breeds <tony@bakeyournoodle.com> Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> LKML-Reference: <20100519054636.GC12389@ozlabs.org> [ added an unlikely() attribute to the branch ] Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/mutex.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/kernel/mutex.c +++ b/kernel/mutex.c @@ -172,6 +172,13 @@ __mutex_lock_common(struct mutex *lock, struct thread_info *owner; /* + * If we own the BKL, then don't spin. The owner of + * the mutex might be waiting on us to release the BKL. + */ + if (unlikely(current->lock_depth >= 0)) + break; + + /* * If there's an owner, wait for it to either * release the lock or go to sleep. */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [024/200] ALSA: pcm: fix delta calculation at boundary wraparound 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (21 preceding siblings ...) 2010-07-01 17:41 ` [023/200] mutex: Fix optimistic spinning vs. BKL Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [025/200] ALSA: pcm: fix the fix of the runtime->boundary calculation Greg KH ` (176 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Clemens Ladisch, Takashi Iwai 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Clemens Ladisch <clemens@ladisch.de> commit b406e6103baa3da85950f22d3d46d21a8da654c5 upstream. In the cleanup of the hw_ptr update functions in 2.6.33, the calculation of the delta value was changed to use the modulo operator to protect against a negative difference due to the pointer wrapping around at the boundary. However, the ptr variables are unsigned, so a negative difference would result in the two complement's value which has no relation to the actual difference relative to the boundary; the result is typically some value near LONG_MAX-boundary. Furthermore, even if the modulo operation would be done with signed types, the result of a negative dividend could be negative. The invalid delta value is then caught by the following checks, but this means that the pointer update is ignored. To fix this, use a range check as in the other pointer calculations. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/core/pcm_lib.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/sound/core/pcm_lib.c +++ b/sound/core/pcm_lib.c @@ -345,7 +345,9 @@ static int snd_pcm_update_hw_ptr0(struct new_hw_ptr = hw_base + pos; } __delta: - delta = (new_hw_ptr - old_hw_ptr) % runtime->boundary; + delta = new_hw_ptr - old_hw_ptr; + if (delta < 0) + delta += runtime->boundary; if (xrun_debug(substream, in_interrupt ? XRUN_DEBUG_PERIODUPDATE : XRUN_DEBUG_HWPTRUPDATE)) { char name[16]; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [025/200] ALSA: pcm: fix the fix of the runtime->boundary calculation 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (22 preceding siblings ...) 2010-07-01 17:41 ` [024/200] ALSA: pcm: fix delta calculation at boundary wraparound Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [026/200] ALSA: hda: Fix model quirk for Dell M1730 Greg KH ` (175 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Clemens Ladisch, Takashi Iwai 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Clemens Ladisch <clemens@ladisch.de> commit ead4046b2fdfd69acc4272e693afd249ad3eb689 upstream. Commit 7910b4a1db63fefc3d291853d33c34c5b6352e8e in 2.6.34 changed the runtime->boundary calculation to make this value a multiple of both the buffer_size and the period_size, because the latter is assumed by the runtime->hw_ptr_interrupt calculation. However, due to the lack of a ioctl that could read the software parameters before they are set, the kernel requires that alsa-lib calculates the boundary value, too. The changed algorithm leads to a different boundary value used by alsa-lib, which makes, e.g., mplayer fail to play a 44.1 kHz file because the silence_size parameter is now invalid; bug report: <https://bugtrack.alsa-project.org/alsa-bug/view.php?id=5015>. This patch reverts the change to the boundary calculation, and instead fixes the hw_ptr_interrupt calculation to be period-aligned regardless of the boundary value. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/core/pcm_lib.c | 9 +++++++-- sound/core/pcm_native.c | 39 +++------------------------------------ 2 files changed, 10 insertions(+), 38 deletions(-) --- a/sound/core/pcm_lib.c +++ b/sound/core/pcm_lib.c @@ -441,8 +441,13 @@ static int snd_pcm_update_hw_ptr0(struct snd_pcm_playback_silence(substream, new_hw_ptr); if (in_interrupt) { - runtime->hw_ptr_interrupt = new_hw_ptr - - (new_hw_ptr % runtime->period_size); + delta = new_hw_ptr - runtime->hw_ptr_interrupt; + if (delta < 0) + delta += runtime->boundary; + delta -= (snd_pcm_uframes_t)delta % runtime->period_size; + runtime->hw_ptr_interrupt += delta; + if (runtime->hw_ptr_interrupt >= runtime->boundary) + runtime->hw_ptr_interrupt -= runtime->boundary; } runtime->hw_ptr_base = hw_base; runtime->status->hw_ptr = new_hw_ptr; --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -27,7 +27,6 @@ #include <linux/pm_qos_params.h> #include <linux/uio.h> #include <linux/dma-mapping.h> -#include <linux/math64.h> #include <sound/core.h> #include <sound/control.h> #include <sound/info.h> @@ -370,38 +369,6 @@ static int period_to_usecs(struct snd_pc return usecs; } -static int calc_boundary(struct snd_pcm_runtime *runtime) -{ - u_int64_t boundary; - - boundary = (u_int64_t)runtime->buffer_size * - (u_int64_t)runtime->period_size; -#if BITS_PER_LONG < 64 - /* try to find lowest common multiple for buffer and period */ - if (boundary > LONG_MAX - runtime->buffer_size) { - u_int32_t remainder = -1; - u_int32_t divident = runtime->buffer_size; - u_int32_t divisor = runtime->period_size; - while (remainder) { - remainder = divident % divisor; - if (remainder) { - divident = divisor; - divisor = remainder; - } - } - boundary = div_u64(boundary, divisor); - if (boundary > LONG_MAX - runtime->buffer_size) - return -ERANGE; - } -#endif - if (boundary == 0) - return -ERANGE; - runtime->boundary = boundary; - while (runtime->boundary * 2 <= LONG_MAX - runtime->buffer_size) - runtime->boundary *= 2; - return 0; -} - static int snd_pcm_hw_params(struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params) { @@ -477,9 +444,9 @@ static int snd_pcm_hw_params(struct snd_ runtime->stop_threshold = runtime->buffer_size; runtime->silence_threshold = 0; runtime->silence_size = 0; - err = calc_boundary(runtime); - if (err < 0) - goto _error; + runtime->boundary = runtime->buffer_size; + while (runtime->boundary * 2 <= LONG_MAX - runtime->buffer_size) + runtime->boundary *= 2; snd_pcm_timer_resolution_change(substream); runtime->status->state = SNDRV_PCM_STATE_SETUP; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [026/200] ALSA: hda: Fix model quirk for Dell M1730 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (23 preceding siblings ...) 2010-07-01 17:41 ` [025/200] ALSA: pcm: fix the fix of the runtime->boundary calculation Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [027/200] ALSA: hda: Use LPIB for Toshiba A100-259 Greg KH ` (174 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 66668b6fb6861fad7f6bfef6646ac84693474c9a upstream. BugLink: https://launchpad.net/bugs/576160 Symptom: Currently (2.6.32.12) the Dell M1730 uses the 3stack model quirk. Unfortunately this means that capture is not functional out- of-the-box despite ensuring that capture settings are unmuted and raised fully. Test case: boot from Ubuntu 10.04 LTS live cd; capture does not work. Resolution: Correct the model quirk for Dell M1730 to rely on the BIOS configuration. This patch also trivially sorts the quirk into the correct section based on the comments. Reported-and-Tested-By: <picdragon99@msn.com> Tested-By: Daren Hayward Tested-By: Tobias Krais Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/patch_sigmatel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/pci/hda/patch_sigmatel.c +++ b/sound/pci/hda/patch_sigmatel.c @@ -2078,12 +2078,12 @@ static struct snd_pci_quirk stac927x_cfg SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_INTEL, 0xff00, 0x2000, "Intel D965", STAC_D965_3ST), /* Dell 3 stack systems */ - SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f7, "Dell XPS M1730", STAC_DELL_3ST), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01dd, "Dell Dimension E520", STAC_DELL_3ST), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01ed, "Dell ", STAC_DELL_3ST), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f4, "Dell ", STAC_DELL_3ST), /* Dell 3 stack systems with verb table in BIOS */ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f3, "Dell Inspiron 1420", STAC_DELL_BIOS), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f7, "Dell XPS M1730", STAC_DELL_BIOS), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0227, "Dell Vostro 1400 ", STAC_DELL_BIOS), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022e, "Dell ", STAC_DELL_BIOS), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022f, "Dell Inspiron 1525", STAC_DELL_BIOS), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [027/200] ALSA: hda: Use LPIB for Toshiba A100-259 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (24 preceding siblings ...) 2010-07-01 17:41 ` [026/200] ALSA: hda: Fix model quirk for Dell M1730 Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [028/200] ALSA: hda: Use LPIB for Acer Aspire 5110 Greg KH ` (173 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 4e0938dba7fccf37a4aecba4d937da7f312b5d55 upstream. BugLink: https://launchpad.net/bugs/549560 Symptom: on a significant number of hardware, booting from a live cd results in capture working correctly, but once the distribution is installed, booting from the install results in capture not working. Test case: boot from Ubuntu 10.04 LTS live cd; capture works correctly. Install to HD and reboot; capture does not work. Reproduced with 2.6.32 mainline build (vanilla kernel.org compile) Resolution: add SSID for Toshiba A100-259 to the position_fix quirk table, explicitly specifying the LPIB method. I'll be sending additional patches for these SSIDs as bug reports are confirmed. This patch also trivially sorts the quirk table in ascending order by subsystem vendor. Reported-and-Tested-by: <davide.molteni@gmail.com> Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2267,8 +2267,9 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB), SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB), - SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB), SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [028/200] ALSA: hda: Use LPIB for Acer Aspire 5110 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (25 preceding siblings ...) 2010-07-01 17:41 ` [027/200] ALSA: hda: Use LPIB for Toshiba A100-259 Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:41 ` [029/200] ALSA: hda: Use LPIB for Sony VPCS11V9E Greg KH ` (172 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 7a68be94e22e7643038726ebc14360752a91800b upstream. BugLink: https://launchpad.net/bugs/583983 Symptom: on a significant number of hardware, booting from a live cd results in capture working correctly, but once the distribution is installed, booting from the install results in capture not working. Test case: boot from Ubuntu 10.04 LTS live cd; capture works correctly. Install to HD and reboot; capture does not work. Reproduced with 2.6.32 mainline build (vanilla kernel.org compile). Resolution: add SSID for Acer Aspire 5110 to the position_fix quirk table, explicitly specifying the LPIB method. I'll be sending additional patches for these SSIDs as bug reports are confirmed. Reported-and-Tested-By: Leo Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2263,6 +2263,7 @@ static int azx_dev_free(struct snd_devic * white/black-listing for position_fix */ static struct snd_pci_quirk position_fix_list[] __devinitdata = { + SND_PCI_QUIRK(0x1025, 0x009f, "Acer Aspire 5110", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [029/200] ALSA: hda: Use LPIB for Sony VPCS11V9E 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (26 preceding siblings ...) 2010-07-01 17:41 ` [028/200] ALSA: hda: Use LPIB for Acer Aspire 5110 Greg KH @ 2010-07-01 17:41 ` Greg KH 2010-07-01 17:42 ` [030/200] ALSA: hda: Use LPIB for a Shuttle device Greg KH ` (171 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:41 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit e96d3127760a2fc509bca6bf7e61e8bc61497aeb upstream. BugLink: https://launchpad.net/bugs/586347 Symptom: On the Sony VPCS11V9E, using GStreamer-based applications with PulseAudio in Ubuntu 10.04 LTS results in stuttering audio. It appears to worsen with increased I/O. Test case: use Rhythmbox under increased I/O pressure. This symptom is reproducible in the current daily stable alsa-driver snapshots (at least up until 21 May 2010; later snapshots fail to build from source due to missing preprocessor directives when compiled against 2.6.32). Resolution: add SSID for this machine to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: Lauri Kainulainen <lauri@sokkelo.net> Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2269,6 +2269,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB), SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), + SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB), SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [030/200] ALSA: hda: Use LPIB for a Shuttle device 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (27 preceding siblings ...) 2010-07-01 17:41 ` [029/200] ALSA: hda: Use LPIB for Sony VPCS11V9E Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [031/200] ACPI: video: fix acpi_backlight=video Greg KH ` (170 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 61bb42c37dfa9016dcacc86bcd41362ab2457d4a upstream. BugLink: https://launchpad.net/bugs/551949 Symptom: On the reporter's Shuttle device, using PulseAudio in Ubuntu 10.04 LTS results in "popping clicking" audio with the PA crashing shortly thereafter. Test case: Using Ubuntu 10.04 LTS (Linux 2.6.32.12), Linux 2.6.33, or Linux 2.6.34, adjust the HDA device's volume with PulseAudio. Resolution: add SSID for this machine to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: Christian Mehlis <mehlis@inf.fu-berlin.de> Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2272,6 +2272,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB), SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1297, 0x3166, "Shuttle", POS_FIX_LPIB), SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB), SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [031/200] ACPI: video: fix acpi_backlight=video 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (28 preceding siblings ...) 2010-07-01 17:42 ` [030/200] ALSA: hda: Use LPIB for a Shuttle device Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [032/200] HID: Add the GYR4101US USB ID to hid-gyration Greg KH ` (169 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Kamal Mostafa, Zhang Rui, Bjorn Helgaas, Jiri Kosina, Thomas Renninger, Len Brown 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kamal Mostafa <kamal@canonical.com> commit eeb4bcb4771679d7b3446c0293334faee11b090a upstream. Make "acpi_backlight=video" param enable ACPI_VIDEO_BACKLIGHT_FORCE_VIDEO as intended, instead of incorrectly enabling video output switching. BugLink: http://bugs.launchpad.net/bugs/573120 Signed-off-by: Kamal Mostafa <kamal@canonical.com> Acked-by: Zhang Rui <rui.zhang@intel.com> Cc: Bjorn Helgaas <bjorn.helgaas@hp.com> Cc: Jiri Kosina <jkosina@suse.cz> Acked-by: Thomas Renninger <trenn@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Len Brown <len.brown@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/acpi/video_detect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/acpi/video_detect.c +++ b/drivers/acpi/video_detect.c @@ -250,7 +250,7 @@ static int __init acpi_backlight(char *s ACPI_VIDEO_BACKLIGHT_FORCE_VENDOR; if (!strcmp("video", str)) acpi_video_support |= - ACPI_VIDEO_OUTPUT_SWITCHING_FORCE_VIDEO; + ACPI_VIDEO_BACKLIGHT_FORCE_VIDEO; } return 1; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [032/200] HID: Add the GYR4101US USB ID to hid-gyration 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (29 preceding siblings ...) 2010-07-01 17:42 ` [031/200] ACPI: video: fix acpi_backlight=video Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [033/200] ar9170usb: add a couple more USB IDs Greg KH ` (168 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Cory Maccarrone, Jiri Kosina 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Cory Maccarrone <darkstar6262@gmail.com> commit c2fd1a4ebf9127c280d227acb635eb1df213439c upstream. This change adds in the USB product ID for the Gyration GYR4101US USB media center remote control. This remote is similar enough to the other two devices that this driver can be used without any other changes to get full support for the remote. Signed-off-by: Cory Maccarrone <darkstar6262@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/hid/hid-core.c | 1 + drivers/hid/hid-gyration.c | 1 + drivers/hid/hid-ids.h | 1 + 3 files changed, 3 insertions(+) --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1305,6 +1305,7 @@ static const struct hid_device_id hid_bl { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, 0x0012) }, { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE) }, { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_3) }, { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) }, { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) }, { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) }, --- a/drivers/hid/hid-gyration.c +++ b/drivers/hid/hid-gyration.c @@ -73,6 +73,7 @@ static int gyration_event(struct hid_dev static const struct hid_device_id gyration_devices[] = { { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE) }, { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_3) }, { } }; MODULE_DEVICE_TABLE(hid, gyration_devices); --- a/drivers/hid/hid-ids.h +++ b/drivers/hid/hid-ids.h @@ -267,6 +267,7 @@ #define USB_VENDOR_ID_GYRATION 0x0c16 #define USB_DEVICE_ID_GYRATION_REMOTE 0x0002 #define USB_DEVICE_ID_GYRATION_REMOTE_2 0x0003 +#define USB_DEVICE_ID_GYRATION_REMOTE_3 0x0008 #define USB_VENDOR_ID_HAPP 0x078b #define USB_DEVICE_ID_UGCI_DRIVING 0x0010 ^ permalink raw reply [flat|nested] 666+ messages in thread
* [033/200] ar9170usb: add a couple more USB IDs 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (30 preceding siblings ...) 2010-07-01 17:42 ` [032/200] HID: Add the GYR4101US USB ID to hid-gyration Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [034/200] ar9170usb: fix panic triggered by undersized rxstream buffer Greg KH ` (167 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Christian Lamparter, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Christian Lamparter <chunkeey@googlemail.com> commit 94d0bbe849190255b93fede8eb46809a38f9b8bf upstream. This patch adds the following 5 entries to the usbid device table: * Netgear WNA1000 * Proxim ORiNOCO Dual Band 802.11n USB Adapter * 3Com Dual Band 802.11n USB Adapter * H3C Dual Band 802.11n USB Adapter * WNC Generic 11n USB dongle Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/ath/ar9170/usb.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/drivers/net/wireless/ath/ar9170/usb.c +++ b/drivers/net/wireless/ath/ar9170/usb.c @@ -67,18 +67,28 @@ static struct usb_device_id ar9170_usb_i { USB_DEVICE(0x0cf3, 0x1001) }, /* TP-Link TL-WN821N v2 */ { USB_DEVICE(0x0cf3, 0x1002) }, + /* 3Com Dual Band 802.11n USB Adapter */ + { USB_DEVICE(0x0cf3, 0x1010) }, + /* H3C Dual Band 802.11n USB Adapter */ + { USB_DEVICE(0x0cf3, 0x1011) }, /* Cace Airpcap NX */ { USB_DEVICE(0xcace, 0x0300) }, /* D-Link DWA 160 A1 */ { USB_DEVICE(0x07d1, 0x3c10) }, /* D-Link DWA 160 A2 */ { USB_DEVICE(0x07d1, 0x3a09) }, + /* Netgear WNA1000 */ + { USB_DEVICE(0x0846, 0x9040) }, /* Netgear WNDA3100 */ { USB_DEVICE(0x0846, 0x9010) }, /* Netgear WN111 v2 */ { USB_DEVICE(0x0846, 0x9001) }, /* Zydas ZD1221 */ { USB_DEVICE(0x0ace, 0x1221) }, + /* Proxim ORiNOCO 802.11n USB */ + { USB_DEVICE(0x1435, 0x0804) }, + /* WNC Generic 11n USB Dongle */ + { USB_DEVICE(0x1435, 0x0326) }, /* ZyXEL NWD271N */ { USB_DEVICE(0x0586, 0x3417) }, /* Z-Com UB81 BG */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [034/200] ar9170usb: fix panic triggered by undersized rxstream buffer 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (31 preceding siblings ...) 2010-07-01 17:42 ` [033/200] ar9170usb: add a couple more USB IDs Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [035/200] ARM: 6135/1: mx21/devices: fix USBOTG resource Greg KH ` (166 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Christian Lamparter, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Christian Lamparter <chunkeey@googlemail.com> commit 879999cec9489f8942ebce3ec1b5f23ef948dda7 upstream. While ar9170's USB transport packet size is currently set to 8KiB, the PHY is capable of receiving AMPDUs with up to 64KiB. Such a large frame will be split over several rx URBs and exceed the previously allocated space for rx stream reconstruction. This patch increases the buffer size to 64KiB which is in fact the phy & rx stream designed size limit. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=15591 Reported-by: Christian Mehlis <mehlis@inf.fu-berlin.de> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/ath/ar9170/hw.h | 1 + drivers/net/wireless/ath/ar9170/main.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/wireless/ath/ar9170/hw.h +++ b/drivers/net/wireless/ath/ar9170/hw.h @@ -425,5 +425,6 @@ enum ar9170_txq { #define AR9170_TXQ_DEPTH 32 #define AR9170_TX_MAX_PENDING 128 +#define AR9170_RX_STREAM_MAX_SIZE 65535 #endif /* __AR9170_HW_H */ --- a/drivers/net/wireless/ath/ar9170/main.c +++ b/drivers/net/wireless/ath/ar9170/main.c @@ -2516,7 +2516,7 @@ void *ar9170_alloc(size_t priv_size) * tends to split the streams into separate rx descriptors. */ - skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL); + skb = __dev_alloc_skb(AR9170_RX_STREAM_MAX_SIZE, GFP_KERNEL); if (!skb) goto err_nomem; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [035/200] ARM: 6135/1: mx21/devices: fix USBOTG resource 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (32 preceding siblings ...) 2010-07-01 17:42 ` [034/200] ar9170usb: fix panic triggered by undersized rxstream buffer Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [036/200] USB: visor: fix memory leak Greg KH ` (165 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Wolfram Sang, Russell King 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wolfram Sang <w.sang@pengutronix.de> commit e1695307e6b85477afd2421d3b4891ca5bea8300 upstream. It got a typo from 988addf82e4c03739375279de73929580a2d4a6a. Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/mach-mx2/devices.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/arch/arm/mach-mx2/devices.c +++ b/arch/arm/mach-mx2/devices.c @@ -483,8 +483,8 @@ int __init mxc_register_gpios(void) #ifdef CONFIG_MACH_MX21 static struct resource mx21_usbhc_resources[] = { { - .start = MX21_BASE_ADDR, - .end = MX21_BASE_ADDR + 0x1FFF, + .start = MX21_USBOTG_BASE_ADDR, + .end = MX21_USBOTG_BASE_ADDR + SZ_8K - 1, .flags = IORESOURCE_MEM, }, { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [036/200] USB: visor: fix memory leak 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (33 preceding siblings ...) 2010-07-01 17:42 ` [035/200] ARM: 6135/1: mx21/devices: fix USBOTG resource Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [037/200] USB: CP210x New Device IDs 11 New device IDs Greg KH ` (164 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit 199b113978015309dd02c69844c19a1be3f4dbcf upstream. Fix memory leak for some devices (Sony Clie 3.5) due to port private data not being freed on release. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/visor.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/serial/visor.c +++ b/drivers/usb/serial/visor.c @@ -249,6 +249,7 @@ static struct usb_serial_driver clie_3_5 .throttle = visor_throttle, .unthrottle = visor_unthrottle, .attach = clie_3_5_startup, + .release = visor_release, .write = visor_write, .write_room = visor_write_room, .write_bulk_callback = visor_write_bulk_callback, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [037/200] USB: CP210x New Device IDs 11 New device IDs 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (34 preceding siblings ...) 2010-07-01 17:42 ` [036/200] USB: visor: fix memory leak Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [038/200] USB: kobil: fix memory leak Greg KH ` (163 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Craig Shelley 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Craig Shelley <craig@microtron.org.uk> commit eefd9029fde4d90d59804eeb54880ab8db5c1866 upstream. Signed-off-by: Craig Shelley <craig@microtron.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/cp210x.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/drivers/usb/serial/cp210x.c +++ b/drivers/usb/serial/cp210x.c @@ -61,6 +61,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */ { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ + { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */ + { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */ { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */ { USB_DEVICE(0x0FCF, 0x1004) }, /* Dynastream ANT2USB */ { USB_DEVICE(0x0FCF, 0x1006) }, /* Dynastream ANT development board */ @@ -72,9 +74,12 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10C4, 0x1601) }, /* Arkham Technology DS101 Adapter */ { USB_DEVICE(0x10C4, 0x800A) }, /* SPORTident BSM7-D-USB main station */ { USB_DEVICE(0x10C4, 0x803B) }, /* Pololu USB-serial converter */ + { USB_DEVICE(0x10C4, 0x8044) }, /* Cygnal Debug Adapter */ + { USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME build-in converter */ { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */ { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */ { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */ + { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */ { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */ { USB_DEVICE(0x10C4, 0x80CA) }, /* Degree Controls Inc */ { USB_DEVICE(0x10C4, 0x80DD) }, /* Tracient RFID */ @@ -82,12 +87,15 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10C4, 0x8115) }, /* Arygon NFC/Mifare Reader */ { USB_DEVICE(0x10C4, 0x813D) }, /* Burnside Telecom Deskmobile */ { USB_DEVICE(0x10C4, 0x813F) }, /* Tams Master Easy Control */ + { USB_DEVICE(0x10C4, 0x8149) }, /* West Mountain Radio Computerized Battery Analyzer */ { USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */ { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */ { USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */ + { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */ { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */ { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */ { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */ + { USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */ { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */ { USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */ { USB_DEVICE(0x10C4, 0x81E7) }, /* Aerocomm Radio */ @@ -105,6 +113,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */ { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */ { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */ { USB_DEVICE(0x10C4, 0xF003) }, /* Elan Digital Systems USBpulse100 */ @@ -115,6 +124,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */ { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */ { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */ + { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */ + { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */ { } /* Terminating Entry */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [038/200] USB: kobil: fix memory leak 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (35 preceding siblings ...) 2010-07-01 17:42 ` [037/200] USB: CP210x New Device IDs 11 New device IDs Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [039/200] USB: tty: fix incorrect use of tty_insert_flip_string_fixed_flag Greg KH ` (162 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit c0f631d1948658b27349545b2cbcb4b32f010c7a upstream. An urb transfer buffer is allocated at every open but was never freed. This driver is a bit of a mess... Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/kobil_sct.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/usb/serial/kobil_sct.c +++ b/drivers/usb/serial/kobil_sct.c @@ -345,7 +345,8 @@ static void kobil_close(struct usb_seria /* FIXME: Add rts/dtr methods */ if (port->write_urb) { - usb_kill_urb(port->write_urb); + usb_poison_urb(port->write_urb); + kfree(port->write_urb->transfer_buffer); usb_free_urb(port->write_urb); port->write_urb = NULL; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [039/200] USB: tty: fix incorrect use of tty_insert_flip_string_fixed_flag 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (36 preceding siblings ...) 2010-07-01 17:42 ` [038/200] USB: kobil: fix memory leak Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [040/200] USB: option: add PID for ZTE product Greg KH ` (161 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit 70ced221cc9f041481f129e63cc5b1dedb0ff959 upstream. Fix regression introduced by commit a108bfcb372d8c4452701039308fb95747911c59 (USB: tty: Prune uses of tty_request_room in the USB layer) which broke three drivers (cypress_m8, digi_acceleport and spcp8x5) through incorrect use of tty_insert_flip_string_fixed_flag. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/cypress_m8.c | 2 +- drivers/usb/serial/digi_acceleport.c | 4 ++-- drivers/usb/serial/spcp8x5.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) --- a/drivers/usb/serial/cypress_m8.c +++ b/drivers/usb/serial/cypress_m8.c @@ -1309,7 +1309,7 @@ static void cypress_read_int_callback(st /* process read if there is data other than line status */ if (tty && bytes > i) { tty_insert_flip_string_fixed_flag(tty, data + i, - bytes - i, tty_flag); + tty_flag, bytes - i); tty_flip_buffer_push(tty); } --- a/drivers/usb/serial/digi_acceleport.c +++ b/drivers/usb/serial/digi_acceleport.c @@ -1703,8 +1703,8 @@ static int digi_read_inb_callback(struct /* data length is len-1 (one byte of len is port_status) */ --len; if (len > 0) { - tty_insert_flip_string_fixed_flag(tty, data, len, - flag); + tty_insert_flip_string_fixed_flag(tty, data, flag, + len); tty_flip_buffer_push(tty); } } --- a/drivers/usb/serial/spcp8x5.c +++ b/drivers/usb/serial/spcp8x5.c @@ -726,8 +726,8 @@ static void spcp8x5_read_bulk_callback(s /* overrun is special, not associated with a char */ if (status & UART_OVERRUN_ERROR) tty_insert_flip_char(tty, 0, TTY_OVERRUN); - tty_insert_flip_string_fixed_flag(tty, data, - urb->actual_length, tty_flag); + tty_insert_flip_string_fixed_flag(tty, data, tty_flag, + urb->actual_length); tty_flip_buffer_push(tty); } tty_kref_put(tty); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [040/200] USB: option: add PID for ZTE product 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (37 preceding siblings ...) 2010-07-01 17:42 ` [039/200] USB: tty: fix incorrect use of tty_insert_flip_string_fixed_flag Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [041/200] USB: option.c: OLIVETTI OLICARD100 support Greg KH ` (160 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Joey 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: zhao1980ming <zhao1980ming@163.com> commit a71ee85e1d74e862d68cc9b2f2ab6a806d2550c9 upstream. this patch adds ZTE modem devices Signed-off-by: Joey <zhao.ming9@zte.com.cn> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/option.c | 174 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 174 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -675,6 +675,180 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1060, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1061, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1062, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1063, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1064, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1065, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1066, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1067, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1068, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1069, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1070, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1071, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1072, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1073, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1074, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1075, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1076, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1077, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1078, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1079, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1080, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1081, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1082, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1083, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1084, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1085, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1086, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1087, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1088, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1089, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1090, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1091, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1092, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1093, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1094, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1095, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1096, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1097, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1098, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1099, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1100, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1101, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1102, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1103, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1104, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1105, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1106, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1107, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1108, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1109, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1110, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1111, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1112, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1113, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1114, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1115, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1116, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1117, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1118, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1119, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1120, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1121, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1122, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1123, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1124, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1125, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1126, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1127, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1128, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1129, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1130, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1131, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1132, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1133, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1134, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1135, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1136, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1137, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1138, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1139, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1140, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1141, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1142, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1143, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1144, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1145, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1146, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1147, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1148, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1149, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1150, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1151, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1152, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1153, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1154, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1155, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1156, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1157, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1158, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1159, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1160, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1161, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1162, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1163, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1164, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1165, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1166, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1167, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1168, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1169, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1170, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1244, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1245, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1246, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1247, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1248, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1249, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1250, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1251, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1252, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1253, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1254, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1255, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1256, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1257, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1258, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1259, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1260, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1261, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1262, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1263, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1264, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1265, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1266, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1267, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1268, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1269, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1271, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1274, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1275, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1276, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1277, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1278, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1279, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1280, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1281, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1282, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1283, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1284, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1285, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1286, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1287, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1288, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1289, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1290, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1291, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1292, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1293, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1294, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1295, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1296, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1297, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) }, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [041/200] USB: option.c: OLIVETTI OLICARD100 support 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (38 preceding siblings ...) 2010-07-01 17:42 ` [040/200] USB: option: add PID for ZTE product Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [042/200] USB: ir-usb: fix double free Greg KH ` (159 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Nils Radtke [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 1490 bytes --] 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Nils Radtke <lkml@Think-Future.de> commit 86234d4975ce084d14711283a3bfc69305f97602 upstream. This patch adds support for an olivetti olicard100 HЅDPA usb-stick. This device is a zeroCD one with ID 0b3c:c700 that needs switching via eject or usb-modeswitch with MessageContent="5553424312345678000000000000061b000000030000000000000000000000". After switching it has ID 0b3c:c000 and provides 5 serial ports ttyUSB[0-4]. Port 0 (modem) and 4 are interrupt ports. Signed-off-by: Nils Radtke <lkml@Think-Future.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -380,6 +380,10 @@ static int option_resume(struct usb_ser #define CINTERION_VENDOR_ID 0x0681 +/* Olivetti products */ +#define OLIVETTI_VENDOR_ID 0x0b3c +#define OLIVETTI_PRODUCT_OLICARD100 0xc000 + /* some devices interfaces need special handling due to a number of reasons */ enum option_blacklist_reason { OPTION_BLACKLIST_NONE = 0, @@ -900,6 +904,8 @@ static const struct usb_device_id option { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)}, { USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) }, + + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) }, { } /* Terminating entry */ }; MODULE_DEVICE_TABLE(usb, option_ids); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [042/200] USB: ir-usb: fix double free 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (39 preceding siblings ...) 2010-07-01 17:42 ` [041/200] USB: option.c: OLIVETTI OLICARD100 support Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [043/200] USB: kl5usb105: fix memory leak Greg KH ` (158 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit 2ff78c0c2b67120c8e503268da3f177cae2228a2 upstream. If the user specifies a custom bulk buffer size we get a double free at port release. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/ir-usb.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/serial/ir-usb.c +++ b/drivers/usb/serial/ir-usb.c @@ -312,6 +312,7 @@ static int ir_open(struct tty_struct *tt kfree(port->read_urb->transfer_buffer); port->read_urb->transfer_buffer = buffer; port->read_urb->transfer_buffer_length = buffer_size; + port->bulk_in_buffer = buffer; buffer = kmalloc(buffer_size, GFP_KERNEL); if (!buffer) { @@ -321,6 +322,7 @@ static int ir_open(struct tty_struct *tt kfree(port->write_urb->transfer_buffer); port->write_urb->transfer_buffer = buffer; port->write_urb->transfer_buffer_length = buffer_size; + port->bulk_out_buffer = buffer; port->bulk_out_size = buffer_size; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [043/200] USB: kl5usb105: fix memory leak 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (40 preceding siblings ...) 2010-07-01 17:42 ` [042/200] USB: ir-usb: fix double free Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [044/200] USB: qcaux: add Samsung U520 device ID Greg KH ` (157 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit 313b0d80c1717ffe8f64b455a4d323996748b91a upstream. Private data was not freed on error path in startup. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/kl5kusb105.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/serial/kl5kusb105.c +++ b/drivers/usb/serial/kl5kusb105.c @@ -321,6 +321,7 @@ err_cleanup: usb_free_urb(priv->write_urb_pool[j]); } } + kfree(priv); usb_set_serial_port_data(serial->port[i], NULL); } return -ENOMEM; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [044/200] USB: qcaux: add Samsung U520 device ID 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (41 preceding siblings ...) 2010-07-01 17:42 ` [043/200] USB: kl5usb105: fix memory leak Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [045/200] USB: mxc: gadget: Fix bitfield for calculating maximum packet size Greg KH ` (156 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Dan Williams 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Williams <dcbw@redhat.com> commit f5cddcd0995366f15d2b6b0df556a2cd99fa806e upstream. Another CDC-ACM + vendor specific interface layout. Signed-off-by: Dan Williams <dcbw@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/qcaux.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/usb/serial/qcaux.c +++ b/drivers/usb/serial/qcaux.c @@ -50,6 +50,10 @@ #define SANYO_VENDOR_ID 0x0474 #define SANYO_PRODUCT_KATANA_LX 0x0754 /* SCP-3800 (Katana LX) */ +/* Samsung devices */ +#define SAMSUNG_VENDOR_ID 0x04e8 +#define SAMSUNG_PRODUCT_U520 0x6640 /* SCH-U520 */ + static struct usb_device_id id_table[] = { { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, UTSTARCOM_PRODUCT_PC5740, 0xff, 0x00, 0x00) }, { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, UTSTARCOM_PRODUCT_PC5750, 0xff, 0x00, 0x00) }, @@ -61,6 +65,7 @@ static struct usb_device_id id_table[] = { USB_DEVICE_AND_INTERFACE_INFO(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDX650, 0xff, 0xff, 0x00) }, { USB_DEVICE_AND_INTERFACE_INFO(LG_VENDOR_ID, LG_PRODUCT_VX4400_6000, 0xff, 0xff, 0x00) }, { USB_DEVICE_AND_INTERFACE_INFO(SANYO_VENDOR_ID, SANYO_PRODUCT_KATANA_LX, 0xff, 0xff, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_U520, 0xff, 0x00, 0x00) }, { }, }; MODULE_DEVICE_TABLE(usb, id_table); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [045/200] USB: mxc: gadget: Fix bitfield for calculating maximum packet size 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (42 preceding siblings ...) 2010-07-01 17:42 ` [044/200] USB: qcaux: add Samsung U520 device ID Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [046/200] USB: unusual-dev: Add bad sense flag for Appotech ax203 based picture frames Greg KH ` (155 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Dinh Nguyen 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dinh Nguyen <Dinh.Nguyen@freescale.com> commit 88e3b59b5adce5b12e205af0e34d518ba0dcdc0c upstream. The max packet length bit mask used for isochronous endpoints should be 0x7FF instead of 0x8FF. 0x8FF will actually clear higher-order bits in the max packet length field. This patch applies to 2.6.34-rc6. Signed-off-by: Dinh Nguyen <Dinh.Nguyen@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/gadget/fsl_udc_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/gadget/fsl_udc_core.c +++ b/drivers/usb/gadget/fsl_udc_core.c @@ -489,7 +489,7 @@ static int fsl_ep_enable(struct usb_ep * case USB_ENDPOINT_XFER_ISOC: /* Calculate transactions needed for high bandwidth iso */ mult = (unsigned char)(1 + ((max >> 11) & 0x03)); - max = max & 0x8ff; /* bit 0~10 */ + max = max & 0x7ff; /* bit 0~10 */ /* 3 transactions at most */ if (mult > 3) goto en_done; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [046/200] USB: unusual-dev: Add bad sense flag for Appotech ax203 based picture frames 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (43 preceding siblings ...) 2010-07-01 17:42 ` [045/200] USB: mxc: gadget: Fix bitfield for calculating maximum packet size Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [047/200] USB: fix usbmon and DMA mapping for scatter-gather URBs Greg KH ` (154 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Hans de Goede 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Hans de Goede <hdegoede@redhat.com> commit a78f4f1a16d87f3d33158d036af94e48e32f8aad upstream. These Appotech controllers are found in Picture Frames, they provide a (buggy) emulation of a cdrom drive which contains the windows software Uploading of pictures happens over the corresponding /dev/sg device. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/storage/unusual_devs.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+) --- a/drivers/usb/storage/unusual_devs.h +++ b/drivers/usb/storage/unusual_devs.h @@ -1853,6 +1853,21 @@ UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_IGNORE_RESIDUE ), +/* Reported by Hans de Goede <hdegoede@redhat.com> + * These Appotech controllers are found in Picture Frames, they provide a + * (buggy) emulation of a cdrom drive which contains the windows software + * Uploading of pictures happens over the corresponding /dev/sg device. */ +UNUSUAL_DEV( 0x1908, 0x1315, 0x0000, 0x0000, + "BUILDWIN", + "Photo Frame", + US_SC_DEVICE, US_PR_DEVICE, NULL, + US_FL_BAD_SENSE ), +UNUSUAL_DEV( 0x1908, 0x1320, 0x0000, 0x0000, + "BUILDWIN", + "Photo Frame", + US_SC_DEVICE, US_PR_DEVICE, NULL, + US_FL_BAD_SENSE ), + UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001, "ST", "2A", ^ permalink raw reply [flat|nested] 666+ messages in thread
* [047/200] USB: fix usbmon and DMA mapping for scatter-gather URBs 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (44 preceding siblings ...) 2010-07-01 17:42 ` [046/200] USB: unusual-dev: Add bad sense flag for Appotech ax203 based picture frames Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [048/200] USB: FHCI: cq_get() should check kfifo_out()s return value Greg KH ` (153 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Alan Stern 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alan Stern <stern@rowland.harvard.edu> commit ff9c895f07d36193c75533bda8193bde8ca99d02 upstream. This patch (as1368) fixes a rather obscure bug in usbmon: When tracing URBs sent by the scatter-gather library, it accesses the data buffers while they are still mapped for DMA. The solution is to move the mapping and unmapping out of the s-g library and into the usual place in hcd.c. This requires the addition of new URB flag bits to describe the kind of mapping needed, since we have to call dma_map_sg() if the HCD supports native scatter-gather operation and dma_map_page() if it doesn't. The nice thing about having the new flags is that they simplify the testing for unmapping. The patch removes the only caller of usb_buffer_[un]map_sg(), so those functions are #if'ed out. A later patch will remove them entirely. As a result of this change, urb->sg will be set in situations where it wasn't set previously. Hence the xhci and whci drivers are adjusted to test urb->num_sgs instead, which retains its original meaning and is nonzero only when the HCD has to handle a scatterlist. Finally, even when a submission error occurs we don't want to hand URBs to usbmon before they are unmapped. The submission path is rearranged so that map_urb_for_dma() is called only for non-root-hub URBs and unmap_urb_for_dma() is called immediately after a submission error. This simplifies the error handling. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/core/hcd.c | 169 ++++++++++++++++++++++++++----------------- drivers/usb/core/message.c | 45 ++--------- drivers/usb/core/urb.c | 9 +- drivers/usb/core/usb.c | 4 + drivers/usb/host/whci/qset.c | 2 drivers/usb/host/xhci-ring.c | 2 drivers/usb/mon/mon_bin.c | 2 drivers/usb/mon/mon_text.c | 4 - include/linux/usb.h | 9 ++ 9 files changed, 138 insertions(+), 108 deletions(-) --- a/drivers/usb/core/hcd.c +++ b/drivers/usb/core/hcd.c @@ -1261,6 +1261,51 @@ static void hcd_free_coherent(struct usb *dma_handle = 0; } +static void unmap_urb_for_dma(struct usb_hcd *hcd, struct urb *urb) +{ + enum dma_data_direction dir; + + if (urb->transfer_flags & URB_SETUP_MAP_SINGLE) + dma_unmap_single(hcd->self.controller, + urb->setup_dma, + sizeof(struct usb_ctrlrequest), + DMA_TO_DEVICE); + else if (urb->transfer_flags & URB_SETUP_MAP_LOCAL) + hcd_free_coherent(urb->dev->bus, + &urb->setup_dma, + (void **) &urb->setup_packet, + sizeof(struct usb_ctrlrequest), + DMA_TO_DEVICE); + + dir = usb_urb_dir_in(urb) ? DMA_FROM_DEVICE : DMA_TO_DEVICE; + if (urb->transfer_flags & URB_DMA_MAP_SG) + dma_unmap_sg(hcd->self.controller, + urb->sg->sg, + urb->num_sgs, + dir); + else if (urb->transfer_flags & URB_DMA_MAP_PAGE) + dma_unmap_page(hcd->self.controller, + urb->transfer_dma, + urb->transfer_buffer_length, + dir); + else if (urb->transfer_flags & URB_DMA_MAP_SINGLE) + dma_unmap_single(hcd->self.controller, + urb->transfer_dma, + urb->transfer_buffer_length, + dir); + else if (urb->transfer_flags & URB_MAP_LOCAL) + hcd_free_coherent(urb->dev->bus, + &urb->transfer_dma, + &urb->transfer_buffer, + urb->transfer_buffer_length, + dir); + + /* Make it safe to call this routine more than once */ + urb->transfer_flags &= ~(URB_SETUP_MAP_SINGLE | URB_SETUP_MAP_LOCAL | + URB_DMA_MAP_SG | URB_DMA_MAP_PAGE | + URB_DMA_MAP_SINGLE | URB_MAP_LOCAL); +} + static int map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags) { @@ -1272,8 +1317,6 @@ static int map_urb_for_dma(struct usb_hc * unless it uses pio or talks to another transport, * or uses the provided scatter gather list for bulk. */ - if (is_root_hub(urb->dev)) - return 0; if (usb_endpoint_xfer_control(&urb->ep->desc) && !(urb->transfer_flags & URB_NO_SETUP_DMA_MAP)) { @@ -1286,6 +1329,7 @@ static int map_urb_for_dma(struct usb_hc if (dma_mapping_error(hcd->self.controller, urb->setup_dma)) return -EAGAIN; + urb->transfer_flags |= URB_SETUP_MAP_SINGLE; } else if (hcd->driver->flags & HCD_LOCAL_MEM) ret = hcd_alloc_coherent( urb->dev->bus, mem_flags, @@ -1293,20 +1337,57 @@ static int map_urb_for_dma(struct usb_hc (void **)&urb->setup_packet, sizeof(struct usb_ctrlrequest), DMA_TO_DEVICE); + if (ret) + return ret; + urb->transfer_flags |= URB_SETUP_MAP_LOCAL; } dir = usb_urb_dir_in(urb) ? DMA_FROM_DEVICE : DMA_TO_DEVICE; - if (ret == 0 && urb->transfer_buffer_length != 0 + if (urb->transfer_buffer_length != 0 && !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)) { if (hcd->self.uses_dma) { - urb->transfer_dma = dma_map_single ( - hcd->self.controller, - urb->transfer_buffer, - urb->transfer_buffer_length, - dir); - if (dma_mapping_error(hcd->self.controller, + if (urb->num_sgs) { + int n = dma_map_sg( + hcd->self.controller, + urb->sg->sg, + urb->num_sgs, + dir); + if (n <= 0) + ret = -EAGAIN; + else + urb->transfer_flags |= URB_DMA_MAP_SG; + if (n != urb->num_sgs) { + urb->num_sgs = n; + urb->transfer_flags |= + URB_DMA_SG_COMBINED; + } + } else if (urb->sg) { + struct scatterlist *sg; + + sg = (struct scatterlist *) urb->sg; + urb->transfer_dma = dma_map_page( + hcd->self.controller, + sg_page(sg), + sg->offset, + urb->transfer_buffer_length, + dir); + if (dma_mapping_error(hcd->self.controller, urb->transfer_dma)) - return -EAGAIN; + ret = -EAGAIN; + else + urb->transfer_flags |= URB_DMA_MAP_PAGE; + } else { + urb->transfer_dma = dma_map_single( + hcd->self.controller, + urb->transfer_buffer, + urb->transfer_buffer_length, + dir); + if (dma_mapping_error(hcd->self.controller, + urb->transfer_dma)) + ret = -EAGAIN; + else + urb->transfer_flags |= URB_DMA_MAP_SINGLE; + } } else if (hcd->driver->flags & HCD_LOCAL_MEM) { ret = hcd_alloc_coherent( urb->dev->bus, mem_flags, @@ -1314,55 +1395,16 @@ static int map_urb_for_dma(struct usb_hc &urb->transfer_buffer, urb->transfer_buffer_length, dir); - - if (ret && usb_endpoint_xfer_control(&urb->ep->desc) - && !(urb->transfer_flags & URB_NO_SETUP_DMA_MAP)) - hcd_free_coherent(urb->dev->bus, - &urb->setup_dma, - (void **)&urb->setup_packet, - sizeof(struct usb_ctrlrequest), - DMA_TO_DEVICE); + if (ret == 0) + urb->transfer_flags |= URB_MAP_LOCAL; } + if (ret && (urb->transfer_flags & (URB_SETUP_MAP_SINGLE | + URB_SETUP_MAP_LOCAL))) + unmap_urb_for_dma(hcd, urb); } return ret; } -static void unmap_urb_for_dma(struct usb_hcd *hcd, struct urb *urb) -{ - enum dma_data_direction dir; - - if (is_root_hub(urb->dev)) - return; - - if (usb_endpoint_xfer_control(&urb->ep->desc) - && !(urb->transfer_flags & URB_NO_SETUP_DMA_MAP)) { - if (hcd->self.uses_dma) - dma_unmap_single(hcd->self.controller, urb->setup_dma, - sizeof(struct usb_ctrlrequest), - DMA_TO_DEVICE); - else if (hcd->driver->flags & HCD_LOCAL_MEM) - hcd_free_coherent(urb->dev->bus, &urb->setup_dma, - (void **)&urb->setup_packet, - sizeof(struct usb_ctrlrequest), - DMA_TO_DEVICE); - } - - dir = usb_urb_dir_in(urb) ? DMA_FROM_DEVICE : DMA_TO_DEVICE; - if (urb->transfer_buffer_length != 0 - && !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)) { - if (hcd->self.uses_dma) - dma_unmap_single(hcd->self.controller, - urb->transfer_dma, - urb->transfer_buffer_length, - dir); - else if (hcd->driver->flags & HCD_LOCAL_MEM) - hcd_free_coherent(urb->dev->bus, &urb->transfer_dma, - &urb->transfer_buffer, - urb->transfer_buffer_length, - dir); - } -} - /*-------------------------------------------------------------------------*/ /* may be called in any context with a valid urb->dev usecount @@ -1391,21 +1433,20 @@ int usb_hcd_submit_urb (struct urb *urb, * URBs must be submitted in process context with interrupts * enabled. */ - status = map_urb_for_dma(hcd, urb, mem_flags); - if (unlikely(status)) { - usbmon_urb_submit_error(&hcd->self, urb, status); - goto error; - } - if (is_root_hub(urb->dev)) + if (is_root_hub(urb->dev)) { status = rh_urb_enqueue(hcd, urb); - else - status = hcd->driver->urb_enqueue(hcd, urb, mem_flags); + } else { + status = map_urb_for_dma(hcd, urb, mem_flags); + if (likely(status == 0)) { + status = hcd->driver->urb_enqueue(hcd, urb, mem_flags); + if (unlikely(status)) + unmap_urb_for_dma(hcd, urb); + } + } if (unlikely(status)) { usbmon_urb_submit_error(&hcd->self, urb, status); - unmap_urb_for_dma(hcd, urb); - error: urb->hcpriv = NULL; INIT_LIST_HEAD(&urb->urb_list); atomic_dec(&urb->use_count); --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -259,9 +259,6 @@ static void sg_clean(struct usb_sg_reque kfree(io->urbs); io->urbs = NULL; } - if (io->dev->dev.dma_mask != NULL) - usb_buffer_unmap_sg(io->dev, usb_pipein(io->pipe), - io->sg, io->nents); io->dev = NULL; } @@ -364,7 +361,6 @@ int usb_sg_init(struct usb_sg_request *i { int i; int urb_flags; - int dma; int use_sg; if (!io || !dev || !sg @@ -378,21 +374,9 @@ int usb_sg_init(struct usb_sg_request *i io->pipe = pipe; io->sg = sg; io->nents = nents; - - /* not all host controllers use DMA (like the mainstream pci ones); - * they can use PIO (sl811) or be software over another transport. - */ - dma = (dev->dev.dma_mask != NULL); - if (dma) - io->entries = usb_buffer_map_sg(dev, usb_pipein(pipe), - sg, nents); - else - io->entries = nents; + io->entries = nents; /* initialize all the urbs we'll use */ - if (io->entries <= 0) - return io->entries; - if (dev->bus->sg_tablesize > 0) { io->urbs = kmalloc(sizeof *io->urbs, mem_flags); use_sg = true; @@ -404,8 +388,6 @@ int usb_sg_init(struct usb_sg_request *i goto nomem; urb_flags = 0; - if (dma) - urb_flags |= URB_NO_TRANSFER_DMA_MAP; if (usb_pipein(pipe)) urb_flags |= URB_SHORT_NOT_OK; @@ -423,12 +405,13 @@ int usb_sg_init(struct usb_sg_request *i io->urbs[0]->complete = sg_complete; io->urbs[0]->context = io; + /* A length of zero means transfer the whole sg list */ io->urbs[0]->transfer_buffer_length = length; if (length == 0) { for_each_sg(sg, sg, io->entries, i) { io->urbs[0]->transfer_buffer_length += - sg_dma_len(sg); + sg->length; } } io->urbs[0]->sg = io; @@ -454,26 +437,16 @@ int usb_sg_init(struct usb_sg_request *i io->urbs[i]->context = io; /* - * Some systems need to revert to PIO when DMA is temporarily - * unavailable. For their sakes, both transfer_buffer and - * transfer_dma are set when possible. - * - * Note that if IOMMU coalescing occurred, we cannot - * trust sg_page anymore, so check if S/G list shrunk. + * Some systems can't use DMA; they use PIO instead. + * For their sakes, transfer_buffer is set whenever + * possible. */ - if (io->nents == io->entries && !PageHighMem(sg_page(sg))) + if (!PageHighMem(sg_page(sg))) io->urbs[i]->transfer_buffer = sg_virt(sg); else io->urbs[i]->transfer_buffer = NULL; - if (dma) { - io->urbs[i]->transfer_dma = sg_dma_address(sg); - len = sg_dma_len(sg); - } else { - /* hc may use _only_ transfer_buffer */ - len = sg->length; - } - + len = sg->length; if (length) { len = min_t(unsigned, len, length); length -= len; @@ -481,6 +454,8 @@ int usb_sg_init(struct usb_sg_request *i io->entries = i + 1; } io->urbs[i]->transfer_buffer_length = len; + + io->urbs[i]->sg = (struct usb_sg_request *) sg; } io->urbs[--i]->transfer_flags &= ~URB_NO_INTERRUPT; } --- a/drivers/usb/core/urb.c +++ b/drivers/usb/core/urb.c @@ -333,9 +333,12 @@ int usb_submit_urb(struct urb *urb, gfp_ is_out = usb_endpoint_dir_out(&ep->desc); } - /* Cache the direction for later use */ - urb->transfer_flags = (urb->transfer_flags & ~URB_DIR_MASK) | - (is_out ? URB_DIR_OUT : URB_DIR_IN); + /* Clear the internal flags and cache the direction for later use */ + urb->transfer_flags &= ~(URB_DIR_MASK | URB_DMA_MAP_SINGLE | + URB_DMA_MAP_PAGE | URB_DMA_MAP_SG | URB_MAP_LOCAL | + URB_SETUP_MAP_SINGLE | URB_SETUP_MAP_LOCAL | + URB_DMA_SG_COMBINED); + urb->transfer_flags |= (is_out ? URB_DIR_OUT : URB_DIR_IN); if (xfertype != USB_ENDPOINT_XFER_CONTROL && dev->state < USB_STATE_CONFIGURED) --- a/drivers/usb/core/usb.c +++ b/drivers/usb/core/usb.c @@ -893,6 +893,7 @@ void usb_buffer_unmap(struct urb *urb) EXPORT_SYMBOL_GPL(usb_buffer_unmap); #endif /* 0 */ +#if 0 /** * usb_buffer_map_sg - create scatterlist DMA mapping(s) for an endpoint * @dev: device to which the scatterlist will be mapped @@ -936,6 +937,7 @@ int usb_buffer_map_sg(const struct usb_d is_in ? DMA_FROM_DEVICE : DMA_TO_DEVICE) ? : -ENOMEM; } EXPORT_SYMBOL_GPL(usb_buffer_map_sg); +#endif /* XXX DISABLED, no users currently. If you wish to re-enable this * XXX please determine whether the sync is to transfer ownership of @@ -972,6 +974,7 @@ void usb_buffer_dmasync_sg(const struct EXPORT_SYMBOL_GPL(usb_buffer_dmasync_sg); #endif +#if 0 /** * usb_buffer_unmap_sg - free DMA mapping(s) for a scatterlist * @dev: device to which the scatterlist will be mapped @@ -997,6 +1000,7 @@ void usb_buffer_unmap_sg(const struct us is_in ? DMA_FROM_DEVICE : DMA_TO_DEVICE); } EXPORT_SYMBOL_GPL(usb_buffer_unmap_sg); +#endif /* To disable USB, kernel command line is 'nousb' not 'usbcore.nousb' */ #ifdef MODULE --- a/drivers/usb/host/whci/qset.c +++ b/drivers/usb/host/whci/qset.c @@ -646,7 +646,7 @@ int qset_add_urb(struct whc *whc, struct wurb->urb = urb; INIT_WORK(&wurb->dequeue_work, urb_dequeue_work); - if (urb->sg) { + if (urb->num_sgs) { ret = qset_add_urb_sg(whc, qset, urb, mem_flags); if (ret == -EINVAL) { qset_free_stds(qset, urb); --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -1938,7 +1938,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd * int running_total, trb_buff_len, ret; u64 addr; - if (urb->sg) + if (urb->num_sgs) return queue_bulk_sg_tx(xhci, mem_flags, urb, slot_id, ep_index); ep_ring = xhci->devs[slot_id]->eps[ep_index].ring; --- a/drivers/usb/mon/mon_bin.c +++ b/drivers/usb/mon/mon_bin.c @@ -416,7 +416,7 @@ static unsigned int mon_bin_get_data(con } else { /* If IOMMU coalescing occurred, we cannot trust sg_page */ - if (urb->sg->nents != urb->num_sgs) { + if (urb->transfer_flags & URB_DMA_SG_COMBINED) { *flag = 'D'; return length; } --- a/drivers/usb/mon/mon_text.c +++ b/drivers/usb/mon/mon_text.c @@ -161,9 +161,7 @@ static inline char mon_text_get_data(str } else { struct scatterlist *sg = urb->sg->sg; - /* If IOMMU coalescing occurred, we cannot trust sg_page */ - if (urb->sg->nents != urb->num_sgs || - PageHighMem(sg_page(sg))) + if (PageHighMem(sg_page(sg))) return 'D'; /* For the text interface we copy only the first sg buffer */ --- a/include/linux/usb.h +++ b/include/linux/usb.h @@ -965,10 +965,19 @@ extern int usb_disabled(void); * needed */ #define URB_FREE_BUFFER 0x0100 /* Free transfer buffer with the URB */ +/* The following flags are used internally by usbcore and HCDs */ #define URB_DIR_IN 0x0200 /* Transfer from device to host */ #define URB_DIR_OUT 0 #define URB_DIR_MASK URB_DIR_IN +#define URB_DMA_MAP_SINGLE 0x00010000 /* Non-scatter-gather mapping */ +#define URB_DMA_MAP_PAGE 0x00020000 /* HCD-unsupported S-G */ +#define URB_DMA_MAP_SG 0x00040000 /* HCD-supported S-G */ +#define URB_MAP_LOCAL 0x00080000 /* HCD-local-memory mapping */ +#define URB_SETUP_MAP_SINGLE 0x00100000 /* Setup packet DMA mapped */ +#define URB_SETUP_MAP_LOCAL 0x00200000 /* HCD-local setup packet */ +#define URB_DMA_SG_COMBINED 0x00400000 /* S-G entries were combined */ + struct usb_iso_packet_descriptor { unsigned int offset; unsigned int length; /* expected length */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [048/200] USB: FHCI: cq_get() should check kfifo_out()s return value 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (45 preceding siblings ...) 2010-07-01 17:42 ` [047/200] USB: fix usbmon and DMA mapping for scatter-gather URBs Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [049/200] USB: EHCI: clear PHCD before resuming Greg KH ` (152 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Anton Vorontsov 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Anton Vorontsov <avorontsov@mvista.com> commit 7f1cccd3ec8789e52897bc34420ca81a5e2edeab upstream. Since commit 7acd72eb85f1c7a15e8b5eb554994949241737f1 ("kfifo: rename kfifo_put... into kfifo_in... and kfifo_get... into kfifo_out..."), kfifo_out() is marked __must_check, and that causes gcc to produce lots of warnings like this: CC drivers/usb/host/fhci-mem.o In file included from drivers/usb/host/fhci-hcd.c:34: drivers/usb/host/fhci.h: In function 'cq_get': drivers/usb/host/fhci.h:520: warning: ignoring return value of 'kfifo_out', declared with attribute warn_unused_result ... This patch fixes the issue by properly checking the return value. Signed-off-by: Anton Vorontsov <avorontsov@mvista.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/fhci.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/drivers/usb/host/fhci.h +++ b/drivers/usb/host/fhci.h @@ -20,6 +20,7 @@ #include <linux/kernel.h> #include <linux/types.h> +#include <linux/bug.h> #include <linux/spinlock.h> #include <linux/interrupt.h> #include <linux/kfifo.h> @@ -515,9 +516,13 @@ static inline int cq_put(struct kfifo *k static inline void *cq_get(struct kfifo *kfifo) { - void *p = NULL; + unsigned int sz; + void *p; + + sz = kfifo_out(kfifo, (void *)&p, sizeof(p)); + if (sz != sizeof(p)) + return NULL; - kfifo_out(kfifo, (void *)&p, sizeof(p)); return p; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [049/200] USB: EHCI: clear PHCD before resuming 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (46 preceding siblings ...) 2010-07-01 17:42 ` [048/200] USB: FHCI: cq_get() should check kfifo_out()s return value Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [050/200] USB: EHCI: fix controller wakeup flag settings during suspend Greg KH ` (151 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Alek Du, David Brownell, Alan Stern 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alek Du <alek.du@intel.com> commit eab80de01cb398419ef3305f35abcb367c647c8b upstream. This is a bug fix for PHCD (phy clock disable) low power feature: After PHCD is set, any write to PORTSC register is illegal, so when resume ports, clear PHCD bit first. Signed-off-by: Alek Du <alek.du@intel.com> Cc: David Brownell <dbrownell@users.sourceforge.net> Cc: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/ehci-hub.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) --- a/drivers/usb/host/ehci-hub.c +++ b/drivers/usb/host/ehci-hub.c @@ -294,6 +294,16 @@ static int ehci_bus_resume (struct usb_h /* manually resume the ports we suspended during bus_suspend() */ i = HCS_N_PORTS (ehci->hcs_params); while (i--) { + /* clear phy low power mode before resume */ + if (ehci->has_hostpc) { + u32 __iomem *hostpc_reg = + (u32 __iomem *)((u8 *)ehci->regs + + HOSTPC0 + 4 * (i & 0xff)); + temp = ehci_readl(ehci, hostpc_reg); + ehci_writel(ehci, temp & ~HOSTPC_PHCD, + hostpc_reg); + mdelay(5); + } temp = ehci_readl(ehci, &ehci->regs->port_status [i]); temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS); if (test_bit(i, &ehci->bus_suspended) && @@ -678,6 +688,13 @@ static int ehci_hub_control ( if (temp & PORT_SUSPEND) { if ((temp & PORT_PE) == 0) goto error; + /* clear phy low power mode before resume */ + if (hostpc_reg) { + temp1 = ehci_readl(ehci, hostpc_reg); + ehci_writel(ehci, temp1 & ~HOSTPC_PHCD, + hostpc_reg); + mdelay(5); + } /* resume signaling for 20 msec */ temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS); ehci_writel(ehci, temp | PORT_RESUME, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [050/200] USB: EHCI: fix controller wakeup flag settings during suspend 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (47 preceding siblings ...) 2010-07-01 17:42 ` [049/200] USB: EHCI: clear PHCD before resuming Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [051/200] USB: xhci: Fix issue with set interface after stall Greg KH ` (150 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Alan Stern, Alek Du 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alan Stern <stern@rowland.harvard.edu> commit 16032c4f5b291af541e9114a09ea20ff5a0dc474 upstream. This patch (as1380) fixes a bug in the wakeup settings for EHCI host controllers. When the controller is suspended, if it isn't enabled for remote wakeup then we have to turn off all the port wakeup flags. Disabling PCI PME# isn't good enough, because some systems (Intel) evidently use alternate wakeup signalling paths. In addition, the patch improves the handling of the Intel Moorestown hardware by performing various power-up and power-down delays just once instead of once for each port (i.e., the delays are moved outside of the port loops). This requires extra code, but the total delay time is reduced. There are also a few additional minor cleanups. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Reported-by: Ondrej Zary <linux@rainbow-software.org> CC: Alek Du <alek.du@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/ehci-au1xxx.c | 16 --- drivers/usb/host/ehci-fsl.c | 2 drivers/usb/host/ehci-hub.c | 173 +++++++++++++++++++++++++++++------------ drivers/usb/host/ehci-pci.c | 15 --- drivers/usb/host/ehci.h | 10 ++ 5 files changed, 145 insertions(+), 71 deletions(-) --- a/drivers/usb/host/ehci-au1xxx.c +++ b/drivers/usb/host/ehci-au1xxx.c @@ -215,26 +215,17 @@ static int ehci_hcd_au1xxx_drv_suspend(s msleep(10); /* Root hub was already suspended. Disable irq emission and - * mark HW unaccessible, bail out if RH has been resumed. Use - * the spinlock to properly synchronize with possible pending - * RH suspend or resume activity. - * - * This is still racy as hcd->state is manipulated outside of - * any locks =P But that will be a different fix. + * mark HW unaccessible. The PM and USB cores make sure that + * the root hub is either suspended or stopped. */ spin_lock_irqsave(&ehci->lock, flags); - if (hcd->state != HC_STATE_SUSPENDED) { - rc = -EINVAL; - goto bail; - } + ehci_prepare_ports_for_controller_suspend(ehci); ehci_writel(ehci, 0, &ehci->regs->intr_enable); (void)ehci_readl(ehci, &ehci->regs->intr_enable); clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags); au1xxx_stop_ehc(); - -bail: spin_unlock_irqrestore(&ehci->lock, flags); // could save FLADJ in case of Vaux power loss @@ -264,6 +255,7 @@ static int ehci_hcd_au1xxx_drv_resume(st if (ehci_readl(ehci, &ehci->regs->configured_flag) == FLAG_CF) { int mask = INTR_MASK; + ehci_prepare_ports_for_controller_resume(ehci); if (!hcd->self.root_hub->do_remote_wakeup) mask &= ~STS_PCD; ehci_writel(ehci, mask, &ehci->regs->intr_enable); --- a/drivers/usb/host/ehci-fsl.c +++ b/drivers/usb/host/ehci-fsl.c @@ -313,6 +313,7 @@ static int ehci_fsl_drv_suspend(struct d struct ehci_fsl *ehci_fsl = hcd_to_ehci_fsl(hcd); void __iomem *non_ehci = hcd->regs; + ehci_prepare_ports_for_controller_suspend(hcd_to_ehci(hcd)); if (!fsl_deep_sleep()) return 0; @@ -327,6 +328,7 @@ static int ehci_fsl_drv_resume(struct de struct ehci_hcd *ehci = hcd_to_ehci(hcd); void __iomem *non_ehci = hcd->regs; + ehci_prepare_ports_for_controller_resume(ehci); if (!fsl_deep_sleep()) return 0; --- a/drivers/usb/host/ehci-hub.c +++ b/drivers/usb/host/ehci-hub.c @@ -106,12 +106,75 @@ static void ehci_handover_companion_port ehci->owned_ports = 0; } +static void ehci_adjust_port_wakeup_flags(struct ehci_hcd *ehci, + bool suspending) +{ + int port; + u32 temp; + + /* If remote wakeup is enabled for the root hub but disabled + * for the controller, we must adjust all the port wakeup flags + * when the controller is suspended or resumed. In all other + * cases they don't need to be changed. + */ + if (!ehci_to_hcd(ehci)->self.root_hub->do_remote_wakeup || + device_may_wakeup(ehci_to_hcd(ehci)->self.controller)) + return; + + /* clear phy low-power mode before changing wakeup flags */ + if (ehci->has_hostpc) { + port = HCS_N_PORTS(ehci->hcs_params); + while (port--) { + u32 __iomem *hostpc_reg; + + hostpc_reg = (u32 __iomem *)((u8 *) ehci->regs + + HOSTPC0 + 4 * port); + temp = ehci_readl(ehci, hostpc_reg); + ehci_writel(ehci, temp & ~HOSTPC_PHCD, hostpc_reg); + } + msleep(5); + } + + port = HCS_N_PORTS(ehci->hcs_params); + while (port--) { + u32 __iomem *reg = &ehci->regs->port_status[port]; + u32 t1 = ehci_readl(ehci, reg) & ~PORT_RWC_BITS; + u32 t2 = t1 & ~PORT_WAKE_BITS; + + /* If we are suspending the controller, clear the flags. + * If we are resuming the controller, set the wakeup flags. + */ + if (!suspending) { + if (t1 & PORT_CONNECT) + t2 |= PORT_WKOC_E | PORT_WKDISC_E; + else + t2 |= PORT_WKOC_E | PORT_WKCONN_E; + } + ehci_vdbg(ehci, "port %d, %08x -> %08x\n", + port + 1, t1, t2); + ehci_writel(ehci, t2, reg); + } + + /* enter phy low-power mode again */ + if (ehci->has_hostpc) { + port = HCS_N_PORTS(ehci->hcs_params); + while (port--) { + u32 __iomem *hostpc_reg; + + hostpc_reg = (u32 __iomem *)((u8 *) ehci->regs + + HOSTPC0 + 4 * port); + temp = ehci_readl(ehci, hostpc_reg); + ehci_writel(ehci, temp | HOSTPC_PHCD, hostpc_reg); + } + } +} + static int ehci_bus_suspend (struct usb_hcd *hcd) { struct ehci_hcd *ehci = hcd_to_ehci (hcd); int port; int mask; - u32 __iomem *hostpc_reg = NULL; + int changed; ehci_dbg(ehci, "suspend root hub\n"); @@ -155,15 +218,13 @@ static int ehci_bus_suspend (struct usb_ */ ehci->bus_suspended = 0; ehci->owned_ports = 0; + changed = 0; port = HCS_N_PORTS(ehci->hcs_params); while (port--) { u32 __iomem *reg = &ehci->regs->port_status [port]; u32 t1 = ehci_readl(ehci, reg) & ~PORT_RWC_BITS; - u32 t2 = t1; + u32 t2 = t1 & ~PORT_WAKE_BITS; - if (ehci->has_hostpc) - hostpc_reg = (u32 __iomem *)((u8 *)ehci->regs - + HOSTPC0 + 4 * (port & 0xff)); /* keep track of which ports we suspend */ if (t1 & PORT_OWNER) set_bit(port, &ehci->owned_ports); @@ -172,40 +233,45 @@ static int ehci_bus_suspend (struct usb_ set_bit(port, &ehci->bus_suspended); } - /* enable remote wakeup on all ports */ + /* enable remote wakeup on all ports, if told to do so */ if (hcd->self.root_hub->do_remote_wakeup) { /* only enable appropriate wake bits, otherwise the * hardware can not go phy low power mode. If a race * condition happens here(connection change during bits * set), the port change detection will finally fix it. */ - if (t1 & PORT_CONNECT) { + if (t1 & PORT_CONNECT) t2 |= PORT_WKOC_E | PORT_WKDISC_E; - t2 &= ~PORT_WKCONN_E; - } else { + else t2 |= PORT_WKOC_E | PORT_WKCONN_E; - t2 &= ~PORT_WKDISC_E; - } - } else - t2 &= ~PORT_WAKE_BITS; + } if (t1 != t2) { ehci_vdbg (ehci, "port %d, %08x -> %08x\n", port + 1, t1, t2); ehci_writel(ehci, t2, reg); - if (hostpc_reg) { - u32 t3; + changed = 1; + } + } - spin_unlock_irq(&ehci->lock); - msleep(5);/* 5ms for HCD enter low pwr mode */ - spin_lock_irq(&ehci->lock); - t3 = ehci_readl(ehci, hostpc_reg); - ehci_writel(ehci, t3 | HOSTPC_PHCD, hostpc_reg); - t3 = ehci_readl(ehci, hostpc_reg); - ehci_dbg(ehci, "Port%d phy low pwr mode %s\n", + if (changed && ehci->has_hostpc) { + spin_unlock_irq(&ehci->lock); + msleep(5); /* 5 ms for HCD to enter low-power mode */ + spin_lock_irq(&ehci->lock); + + port = HCS_N_PORTS(ehci->hcs_params); + while (port--) { + u32 __iomem *hostpc_reg; + u32 t3; + + hostpc_reg = (u32 __iomem *)((u8 *) ehci->regs + + HOSTPC0 + 4 * port); + t3 = ehci_readl(ehci, hostpc_reg); + ehci_writel(ehci, t3 | HOSTPC_PHCD, hostpc_reg); + t3 = ehci_readl(ehci, hostpc_reg); + ehci_dbg(ehci, "Port %d phy low-power mode %s\n", port, (t3 & HOSTPC_PHCD) ? "succeeded" : "failed"); - } } } @@ -291,19 +357,28 @@ static int ehci_bus_resume (struct usb_h msleep(8); spin_lock_irq(&ehci->lock); + /* clear phy low-power mode before resume */ + if (ehci->bus_suspended && ehci->has_hostpc) { + i = HCS_N_PORTS(ehci->hcs_params); + while (i--) { + if (test_bit(i, &ehci->bus_suspended)) { + u32 __iomem *hostpc_reg; + + hostpc_reg = (u32 __iomem *)((u8 *) ehci->regs + + HOSTPC0 + 4 * i); + temp = ehci_readl(ehci, hostpc_reg); + ehci_writel(ehci, temp & ~HOSTPC_PHCD, + hostpc_reg); + } + } + spin_unlock_irq(&ehci->lock); + msleep(5); + spin_lock_irq(&ehci->lock); + } + /* manually resume the ports we suspended during bus_suspend() */ i = HCS_N_PORTS (ehci->hcs_params); while (i--) { - /* clear phy low power mode before resume */ - if (ehci->has_hostpc) { - u32 __iomem *hostpc_reg = - (u32 __iomem *)((u8 *)ehci->regs - + HOSTPC0 + 4 * (i & 0xff)); - temp = ehci_readl(ehci, hostpc_reg); - ehci_writel(ehci, temp & ~HOSTPC_PHCD, - hostpc_reg); - mdelay(5); - } temp = ehci_readl(ehci, &ehci->regs->port_status [i]); temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS); if (test_bit(i, &ehci->bus_suspended) && @@ -685,23 +760,25 @@ static int ehci_hub_control ( goto error; if (ehci->no_selective_suspend) break; - if (temp & PORT_SUSPEND) { - if ((temp & PORT_PE) == 0) - goto error; - /* clear phy low power mode before resume */ - if (hostpc_reg) { - temp1 = ehci_readl(ehci, hostpc_reg); - ehci_writel(ehci, temp1 & ~HOSTPC_PHCD, + if (!(temp & PORT_SUSPEND)) + break; + if ((temp & PORT_PE) == 0) + goto error; + + /* clear phy low-power mode before resume */ + if (hostpc_reg) { + temp1 = ehci_readl(ehci, hostpc_reg); + ehci_writel(ehci, temp1 & ~HOSTPC_PHCD, hostpc_reg); - mdelay(5); - } - /* resume signaling for 20 msec */ - temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS); - ehci_writel(ehci, temp | PORT_RESUME, - status_reg); - ehci->reset_done [wIndex] = jiffies - + msecs_to_jiffies (20); + spin_unlock_irqrestore(&ehci->lock, flags); + msleep(5);/* wait to leave low-power mode */ + spin_lock_irqsave(&ehci->lock, flags); } + /* resume signaling for 20 msec */ + temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS); + ehci_writel(ehci, temp | PORT_RESUME, status_reg); + ehci->reset_done[wIndex] = jiffies + + msecs_to_jiffies(20); break; case USB_PORT_FEAT_C_SUSPEND: clear_bit(wIndex, &ehci->port_c_suspend); --- a/drivers/usb/host/ehci-pci.c +++ b/drivers/usb/host/ehci-pci.c @@ -284,23 +284,15 @@ static int ehci_pci_suspend(struct usb_h msleep(10); /* Root hub was already suspended. Disable irq emission and - * mark HW unaccessible, bail out if RH has been resumed. Use - * the spinlock to properly synchronize with possible pending - * RH suspend or resume activity. - * - * This is still racy as hcd->state is manipulated outside of - * any locks =P But that will be a different fix. + * mark HW unaccessible. The PM and USB cores make sure that + * the root hub is either suspended or stopped. */ spin_lock_irqsave (&ehci->lock, flags); - if (hcd->state != HC_STATE_SUSPENDED) { - rc = -EINVAL; - goto bail; - } + ehci_prepare_ports_for_controller_suspend(ehci); ehci_writel(ehci, 0, &ehci->regs->intr_enable); (void)ehci_readl(ehci, &ehci->regs->intr_enable); clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags); - bail: spin_unlock_irqrestore (&ehci->lock, flags); // could save FLADJ in case of Vaux power loss @@ -330,6 +322,7 @@ static int ehci_pci_resume(struct usb_hc !hibernated) { int mask = INTR_MASK; + ehci_prepare_ports_for_controller_resume(ehci); if (!hcd->self.root_hub->do_remote_wakeup) mask &= ~STS_PCD; ehci_writel(ehci, mask, &ehci->regs->intr_enable); --- a/drivers/usb/host/ehci.h +++ b/drivers/usb/host/ehci.h @@ -536,6 +536,16 @@ struct ehci_fstn { /*-------------------------------------------------------------------------*/ +/* Prepare the PORTSC wakeup flags during controller suspend/resume */ + +#define ehci_prepare_ports_for_controller_suspend(ehci) \ + ehci_adjust_port_wakeup_flags(ehci, true); + +#define ehci_prepare_ports_for_controller_resume(ehci) \ + ehci_adjust_port_wakeup_flags(ehci, false); + +/*-------------------------------------------------------------------------*/ + #ifdef CONFIG_USB_EHCI_ROOT_HUB_TT /* ^ permalink raw reply [flat|nested] 666+ messages in thread
* [051/200] USB: xhci: Fix issue with set interface after stall. 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (48 preceding siblings ...) 2010-07-01 17:42 ` [050/200] USB: EHCI: fix controller wakeup flag settings during suspend Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [052/200] USB: xhci: Limit bus sg_tablesize to 62 TRBs Greg KH ` (149 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sarah Sharp <sarah.a.sharp@linux.intel.com> commit 1624ae1c19e227096ba85bfc389d9b99cb6f7dde upstream. When the USB core installs a new interface, it unconditionally clears the halts on all the endpoints on the new interface. Usually the xHCI host needs to know when an endpoint is reset, so it can change its internal endpoint state. In this case, it doesn't care, because the endpoints were never halted in the first place. To avoid issuing a redundant Reset Endpoint command, the xHCI driver looks at xhci_virt_ep->stopped_td to determine if the endpoint was actually halted. However, the functions that handle the stall never set that variable to NULL after it dealt with the stall. So if an endpoint stalled and a Reset Endpoint command completed, and then the class driver tried to install a new alternate setting, the xHCI driver would access the old xhci_virt_ep->stopped_td pointer. A similar problem occurs if the endpoint has been stopped to cancel a transfer. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-ring.c | 7 +++++++ drivers/usb/host/xhci.c | 2 ++ 2 files changed, 9 insertions(+) --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -578,6 +578,8 @@ static void handle_stopped_endpoint(stru /* Otherwise just ring the doorbell to restart the ring */ ring_ep_doorbell(xhci, slot_id, ep_index); } + ep->stopped_td = NULL; + ep->stopped_trb = NULL; /* * Drop the lock and complete the URBs in the cancelled TD list. @@ -1061,8 +1063,13 @@ static void xhci_cleanup_halted_endpoint ep->ep_state |= EP_HALTED; ep->stopped_td = td; ep->stopped_trb = event_trb; + xhci_queue_reset_ep(xhci, slot_id, ep_index); xhci_cleanup_stalled_ring(xhci, td->urb->dev, ep_index); + + ep->stopped_td = NULL; + ep->stopped_trb = NULL; + xhci_ring_cmd_db(xhci); } --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -1438,6 +1438,8 @@ void xhci_endpoint_reset(struct usb_hcd kfree(virt_ep->stopped_td); xhci_ring_cmd_db(xhci); } + virt_ep->stopped_td = NULL; + virt_ep->stopped_trb = NULL; spin_unlock_irqrestore(&xhci->lock, flags); if (ret) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [052/200] USB: xhci: Limit bus sg_tablesize to 62 TRBs. 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (49 preceding siblings ...) 2010-07-01 17:42 ` [051/200] USB: xhci: Fix issue with set interface after stall Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [053/200] USB: xhci: Fix check for room on the ring Greg KH ` (148 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sarah Sharp <sarah.a.sharp@linux.intel.com> commit bc88d2eba5e19d10dd546e428314909d889b3b6a upstream. When a scatter-gather list is enqueued to the xHCI driver, it translates each entry into a transfer request block (TRB). Only 63 TRBs can be used per ring segment, and there must be one additional TRB reserved to make sure the hardware does not think the ring is empty (so the enqueue pointer doesn't equal the dequeue pointer). Limit the bus sg_tablesize to 62 TRBs. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/host/xhci-pci.c +++ b/drivers/usb/host/xhci-pci.c @@ -54,7 +54,7 @@ static int xhci_pci_setup(struct usb_hcd struct pci_dev *pdev = to_pci_dev(hcd->self.controller); int retval; - hcd->self.sg_tablesize = TRBS_PER_SEGMENT - 1; + hcd->self.sg_tablesize = TRBS_PER_SEGMENT - 2; xhci->cap_regs = hcd->regs; xhci->op_regs = hcd->regs + ^ permalink raw reply [flat|nested] 666+ messages in thread
* [053/200] USB: xhci: Fix check for room on the ring. 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (50 preceding siblings ...) 2010-07-01 17:42 ` [052/200] USB: xhci: Limit bus sg_tablesize to 62 TRBs Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [054/200] USB: xHCI: Fix wrong usage of macro TRB_TYPE Greg KH ` (147 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sarah Sharp <sarah.a.sharp@linux.intel.com> commit 44ebd037c54f80db3121ac9f5fe6e677b76e11d5 upstream. The length of the scatter gather list a driver can enqueue is limited by the bus' sg_tablesize to 62 entries. Each entry will be described by at least one transfer request block (TRB). If the entry's buffer crosses a 64KB boundary, then that entry will have to be described by two or more TRBs. So even if the USB device driver respects sg_tablesize, the whole scatter list may take more than 62 TRBs to describe, and won't fit on the ring. Don't assume that an empty ring means there is enough room on the transfer ring. The old code would unconditionally queue this too-large transfer, and over write the beginning of the transfer. This would mean the cycle bit was unchanged in those overwritten transfers, causing the hardware to think it didn't own the TRBs, and the host would seem to hang. Now drivers may see submit_urb() fail with -ENOMEM if the transfers are too big to fit on the ring. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-ring.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -242,10 +242,27 @@ static int room_on_ring(struct xhci_hcd int i; union xhci_trb *enq = ring->enqueue; struct xhci_segment *enq_seg = ring->enq_seg; + struct xhci_segment *cur_seg; + unsigned int left_on_ring; /* Check if ring is empty */ - if (enq == ring->dequeue) + if (enq == ring->dequeue) { + /* Can't use link trbs */ + left_on_ring = TRBS_PER_SEGMENT - 1; + for (cur_seg = enq_seg->next; cur_seg != enq_seg; + cur_seg = cur_seg->next) + left_on_ring += TRBS_PER_SEGMENT - 1; + + /* Always need one TRB free in the ring. */ + left_on_ring -= 1; + if (num_trbs > left_on_ring) { + xhci_warn(xhci, "Not enough room on ring; " + "need %u TRBs, %u TRBs left\n", + num_trbs, left_on_ring); + return 0; + } return 1; + } /* Make sure there's an extra empty TRB available */ for (i = 0; i <= num_trbs; ++i) { if (enq == ring->dequeue) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [054/200] USB: xHCI: Fix wrong usage of macro TRB_TYPE 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (51 preceding siblings ...) 2010-07-01 17:42 ` [053/200] USB: xhci: Fix check for room on the ring Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [055/200] ath5k: consistently use rx_bufsize for RX DMA Greg KH ` (146 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andiry Xu, Sarah Sharp 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andiry Xu <andiry.xu@amd.com> commit 54b5acf3acb7a1f83ec281d111d3e2812cd7ad9d upstream. Macro TRB_TYPE is misused in some places. Fix the wrong usage. Signed-off-by: Andiry Xu <andiry.xu@amd.com> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci-ring.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -351,7 +351,8 @@ static struct xhci_segment *find_trb_seg while (cur_seg->trbs > trb || &cur_seg->trbs[TRBS_PER_SEGMENT - 1] < trb) { generic_trb = &cur_seg->trbs[TRBS_PER_SEGMENT - 1].generic; - if (TRB_TYPE(generic_trb->field[3]) == TRB_LINK && + if ((generic_trb->field[3] & TRB_TYPE_BITMASK) == + TRB_TYPE(TRB_LINK) && (generic_trb->field[3] & LINK_TOGGLE)) *cycle_state = ~(*cycle_state) & 0x1; cur_seg = cur_seg->next; @@ -407,7 +408,7 @@ void xhci_find_new_dequeue_state(struct BUG(); trb = &state->new_deq_ptr->generic; - if (TRB_TYPE(trb->field[3]) == TRB_LINK && + if ((trb->field[3] & TRB_TYPE_BITMASK) == TRB_TYPE(TRB_LINK) && (trb->field[3] & LINK_TOGGLE)) state->new_cycle_state = ~(state->new_cycle_state) & 0x1; next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr); @@ -1414,8 +1415,10 @@ static int handle_tx_event(struct xhci_h for (cur_trb = ep_ring->dequeue, cur_seg = ep_ring->deq_seg; cur_trb != event_trb; next_trb(xhci, ep_ring, &cur_seg, &cur_trb)) { - if (TRB_TYPE(cur_trb->generic.field[3]) != TRB_TR_NOOP && - TRB_TYPE(cur_trb->generic.field[3]) != TRB_LINK) + if ((cur_trb->generic.field[3] & + TRB_TYPE_BITMASK) != TRB_TYPE(TRB_TR_NOOP) && + (cur_trb->generic.field[3] & + TRB_TYPE_BITMASK) != TRB_TYPE(TRB_LINK)) td->urb->actual_length += TRB_LEN(cur_trb->generic.field[2]); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [055/200] ath5k: consistently use rx_bufsize for RX DMA 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (52 preceding siblings ...) 2010-07-01 17:42 ` [054/200] USB: xHCI: Fix wrong usage of macro TRB_TYPE Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [056/200] fbdev: section cleanup in hgafb Greg KH ` (145 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Bruno Randolf, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bruno Randolf <br1@einfach.org> commit b5eae9ff5ba6d76de19286dd6429acd7cde3f79d upstream. We should use the same buffer size we set up for DMA also in the hardware descriptor. Previously we used common->rx_bufsize for setting up the DMA mapping, but used skb_tailroom(skb) for the size we tell to the hardware in the descriptor itself. The problem is that skb_tailroom(skb) can give us a larger value than the size we set up for DMA before. This allows the hardware to write into memory locations not set up for DMA. In practice this should rarely happen because all packets should be smaller than the maximum 802.11 packet size. On the tested platform rx_bufsize is 2528, and we allocated an skb of 2559 bytes length (including padding for cache alignment) but sbk_tailroom() was 2592. Just consistently use rx_bufsize for all RX DMA memory sizes. Also use the return value of the descriptor setup function. Signed-off-by: Bruno Randolf <br1@einfach.org> Reviewed-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/ath/ath5k/base.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/drivers/net/wireless/ath/ath5k/base.c +++ b/drivers/net/wireless/ath/ath5k/base.c @@ -1211,6 +1211,7 @@ ath5k_rxbuf_setup(struct ath5k_softc *sc struct ath5k_hw *ah = sc->ah; struct sk_buff *skb = bf->skb; struct ath5k_desc *ds; + int ret; if (!skb) { skb = ath5k_rx_skb_alloc(sc, &bf->skbaddr); @@ -1237,9 +1238,9 @@ ath5k_rxbuf_setup(struct ath5k_softc *sc ds = bf->desc; ds->ds_link = bf->daddr; /* link to self */ ds->ds_data = bf->skbaddr; - ah->ah_setup_rx_desc(ah, ds, - skb_tailroom(skb), /* buffer size */ - 0); + ret = ah->ah_setup_rx_desc(ah, ds, ah->common.rx_bufsize, 0); + if (ret) + return ret; if (sc->rxlink != NULL) *sc->rxlink = bf->daddr; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [056/200] fbdev: section cleanup in hgafb 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (53 preceding siblings ...) 2010-07-01 17:42 ` [055/200] ath5k: consistently use rx_bufsize for RX DMA Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [057/200] fbdev: section cleanup in vfb Greg KH ` (144 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Henrik Kretzschmar, Uwe Kleine-König [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 3274 bytes --] 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Henrik Kretzschmar <henne@nachtwindheim.de> commit e217e6e39f62e47f7e659b715235dbd57df480f8 upstream. Fix up the sections in the hgafb driver, by * moving hga_default_var and hga_fix from .init.data to .devinit.data * moving hga_detect() from .init.text to .devinit.text * moving hga_fb_remove() from .text to .devexit.text This fixes the following warnings issued by modpost: WARNING: drivers/video/hgafb.o(.devinit.text+0x18): Section mismatch in referenc e from the function hgafb_probe() to the function .init.text:hga_card_detect() The function __devinit hgafb_probe() references a function __init hga_card_detect(). If hga_card_detect is only used by hgafb_probe then annotate hga_card_detect with a matching annotation. WARNING: drivers/video/hgafb.o(.devinit.text+0xfe): Section mismatch in referenc e from the function hgafb_probe() to the variable .init.data:hga_fix The function __devinit hgafb_probe() references a variable __initdata hga_fix. If hga_fix is only used by hgafb_probe then annotate hga_fix with a matching annotation. WARNING: drivers/video/hgafb.o(.devinit.text+0x105): Section mismatch in reference from the function hgafb_probe() to the variable .init.data:hga_default_var The function __devinit hgafb_probe() references a variable __initdata hga_default_var. If hga_default_var is only used by hgafb_probe then annotate hga_default_var with a matching annotation. Signed-off-by: Henrik Kretzschmar <henne@nachtwindheim.de> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/video/hgafb.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) --- a/drivers/video/hgafb.c +++ b/drivers/video/hgafb.c @@ -106,7 +106,7 @@ static DEFINE_SPINLOCK(hga_reg_lock); /* Framebuffer driver structures */ -static struct fb_var_screeninfo __initdata hga_default_var = { +static struct fb_var_screeninfo hga_default_var __devinitdata = { .xres = 720, .yres = 348, .xres_virtual = 720, @@ -120,7 +120,7 @@ static struct fb_var_screeninfo __initda .width = -1, }; -static struct fb_fix_screeninfo __initdata hga_fix = { +static struct fb_fix_screeninfo hga_fix __devinitdata = { .id = "HGA", .type = FB_TYPE_PACKED_PIXELS, /* (not sure) */ .visual = FB_VISUAL_MONO10, @@ -276,7 +276,7 @@ static void hga_blank(int blank_mode) spin_unlock_irqrestore(&hga_reg_lock, flags); } -static int __init hga_card_detect(void) +static int __devinit hga_card_detect(void) { int count = 0; void __iomem *p, *q; @@ -596,7 +596,7 @@ static int __devinit hgafb_probe(struct return 0; } -static int hgafb_remove(struct platform_device *pdev) +static int __devexit hgafb_remove(struct platform_device *pdev) { struct fb_info *info = platform_get_drvdata(pdev); @@ -621,7 +621,7 @@ static int hgafb_remove(struct platform_ static struct platform_driver hgafb_driver = { .probe = hgafb_probe, - .remove = hgafb_remove, + .remove = __devexit_p(hgafb_remove), .driver = { .name = "hgafb", }, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [057/200] fbdev: section cleanup in vfb 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (54 preceding siblings ...) 2010-07-01 17:42 ` [056/200] fbdev: section cleanup in hgafb Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [058/200] fbdev: section cleanup in vga16fb Greg KH ` (143 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Henrik Kretzschmar, Uwe Kleine-König [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 2024 bytes --] 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Henrik Kretzschmar <henne@nachtwindheim.de> commit 3cc04971661e37e7de6fbf9808ede554b5e1cb4e upstream. Fix up the section in the vfb driver, by moving the variables vfb_default and vfb_fix from .init.data to .devinit.data This fixes the following warnings issued by modpost: WARNING: drivers/video/vfb.o(.devinit.text+0xf8): Section mismatch in reference from the function vfb_probe() to the variable .init.data:vfb_default The function __devinit vfb_probe() references a variable __initdata vfb_default. If vfb_default is only used by vfb_probe then annotate vfb_default with a matching annotation. WARNING: drivers/video/vfb.o(.devinit.text+0x114): Section mismatch in reference from the function vfb_probe() to the variable .init.data:vfb_fix The function __devinit vfb_probe() references a variable __initdata vfb_fix. If vfb_fix is only used by vfb_probe then annotate vfb_fix with a matching annotation. Signed-off-by: Henrik Kretzschmar <henne@nachtwindheim.de> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/video/vfb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/video/vfb.c +++ b/drivers/video/vfb.c @@ -78,7 +78,7 @@ static void rvfree(void *mem, unsigned l vfree(mem); } -static struct fb_var_screeninfo vfb_default __initdata = { +static struct fb_var_screeninfo vfb_default __devinitdata = { .xres = 640, .yres = 480, .xres_virtual = 640, @@ -100,7 +100,7 @@ static struct fb_var_screeninfo vfb_defa .vmode = FB_VMODE_NONINTERLACED, }; -static struct fb_fix_screeninfo vfb_fix __initdata = { +static struct fb_fix_screeninfo vfb_fix __devinitdata = { .id = "Virtual FB", .type = FB_TYPE_PACKED_PIXELS, .visual = FB_VISUAL_PSEUDOCOLOR, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [058/200] fbdev: section cleanup in vga16fb 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (55 preceding siblings ...) 2010-07-01 17:42 ` [057/200] fbdev: section cleanup in vfb Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [059/200] fbdev: section cleanup in arcfb Greg KH ` (142 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Henrik Kretzschmar, Uwe Kleine-König [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 3332 bytes --] 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Henrik Kretzschmar <henne@nachtwindheim.de> commit ad1458464cbbe6935be6e20d70920301733158af upstream. Fix up the sections in the vga16fb driver, by moving: * the variables vga16_defined and vga16fb from .init.data to .devinit.data * vga16fb_setup() from .text to .init.text * vga16fb_remove() from .text. to .devexit.text This fixes the following warnings issued by modpost: WARNING: drivers/video/built-in.o(.devinit.text+0x1a420): Section mismatch in re ference from the function vga16fb_probe() to the (unknown reference) .init.data: (unknown) The function __devinit vga16fb_probe() references a (unknown reference) __initdata (unknown). If (unknown) is only used by vga16fb_probe then annotate (unknown) with a matching annotation. WARNING: drivers/video/built-in.o(.devinit.text+0x1a437): Section mismatch in reference from the function vga16fb_probe() to the variable .init.data:vga16fb_defined The function __devinit vga16fb_probe() references a variable __initdata vga16fb_defined. If vga16fb_defined is only used by vga16fb_probe then annotate vga16fb_defined with a matching annotation. WARNING: drivers/video/built-in.o(.devinit.text+0x1a457): Section mismatch in reference from the function vga16fb_probe() to the variable .init.data:vga16fb_fix The function __devinit vga16fb_probe() references a variable __initdata vga16fb_fix. If vga16fb_fix is only used by vga16fb_probe then annotate vga16fb_fix with a matching annotation. Signed-off-by: Henrik Kretzschmar <henne@nachtwindheim.de> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/video/vga16fb.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) --- a/drivers/video/vga16fb.c +++ b/drivers/video/vga16fb.c @@ -65,7 +65,7 @@ struct vga16fb_par { /* --------------------------------------------------------------------- */ -static struct fb_var_screeninfo vga16fb_defined __initdata = { +static struct fb_var_screeninfo vga16fb_defined __devinitdata = { .xres = 640, .yres = 480, .xres_virtual = 640, @@ -85,7 +85,7 @@ static struct fb_var_screeninfo vga16fb_ }; /* name should not depend on EGA/VGA */ -static struct fb_fix_screeninfo vga16fb_fix __initdata = { +static struct fb_fix_screeninfo vga16fb_fix __devinitdata = { .id = "VGA16 VGA", .smem_start = VGA_FB_PHYS, .smem_len = VGA_FB_PHYS_LEN, @@ -1278,7 +1278,7 @@ static struct fb_ops vga16fb_ops = { }; #ifndef MODULE -static int vga16fb_setup(char *options) +static int __init vga16fb_setup(char *options) { char *this_opt; @@ -1376,7 +1376,7 @@ static int __devinit vga16fb_probe(struc return ret; } -static int vga16fb_remove(struct platform_device *dev) +static int __devexit vga16fb_remove(struct platform_device *dev) { struct fb_info *info = platform_get_drvdata(dev); @@ -1393,7 +1393,7 @@ static int vga16fb_remove(struct platfor static struct platform_driver vga16fb_driver = { .probe = vga16fb_probe, - .remove = vga16fb_remove, + .remove = __devexit_p(vga16fb_remove), .driver = { .name = "vga16fb", }, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [059/200] fbdev: section cleanup in arcfb 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (56 preceding siblings ...) 2010-07-01 17:42 ` [058/200] fbdev: section cleanup in vga16fb Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [060/200] fbdev: section cleanup in w100fb Greg KH ` (141 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Henrik Kretzschmar, Uwe Kleine-König [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 2524 bytes --] 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Henrik Kretzschmar <henne@nachtwindheim.de> commit bd9b5caf8616501d2ab6f17210b11f81ea7546eb upstream. Fix the sections in the arcfb driver, by moving: * the variables arcfb_fix and arcfb_var from .init.data to .devinit.data * arcfb_remove() from .text to .devexit.text This fixes the following warnings issued by modpost: WARNING: drivers/video/built-in.o(.devinit.text+0x543): Section mismatch in reference from the function arcfb_probe() to the variable .init.data:arcfb_var The function __devinit arcfb_probe() references a variable __initdata arcfb_var. If arcfb_var is only used by arcfb_probe then annotate arcfb_var with a matching annotation. WARNING: drivers/video/built-in.o(.devinit.text+0x558): Section mismatch in reference from the function arcfb_probe() to the variable .init.data:arcfb_fix The function __devinit arcfb_probe() references a variable __initdata arcfb_fix. If arcfb_fix is only used by arcfb_probe then annotate arcfb_fix with a matching annotation. Signed-off-by: Henrik Kretzschmar <henne@nachtwindheim.de> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/video/arcfb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/video/arcfb.c +++ b/drivers/video/arcfb.c @@ -80,7 +80,7 @@ struct arcfb_par { spinlock_t lock; }; -static struct fb_fix_screeninfo arcfb_fix __initdata = { +static struct fb_fix_screeninfo arcfb_fix __devinitdata = { .id = "arcfb", .type = FB_TYPE_PACKED_PIXELS, .visual = FB_VISUAL_MONO01, @@ -90,7 +90,7 @@ static struct fb_fix_screeninfo arcfb_fi .accel = FB_ACCEL_NONE, }; -static struct fb_var_screeninfo arcfb_var __initdata = { +static struct fb_var_screeninfo arcfb_var __devinitdata = { .xres = 128, .yres = 64, .xres_virtual = 128, @@ -588,7 +588,7 @@ err: return retval; } -static int arcfb_remove(struct platform_device *dev) +static int __devexit arcfb_remove(struct platform_device *dev) { struct fb_info *info = platform_get_drvdata(dev); @@ -602,7 +602,7 @@ static int arcfb_remove(struct platform_ static struct platform_driver arcfb_driver = { .probe = arcfb_probe, - .remove = arcfb_remove, + .remove = __devexit_p(arcfb_remove), .driver = { .name = "arcfb", }, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [060/200] fbdev: section cleanup in w100fb 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (57 preceding siblings ...) 2010-07-01 17:42 ` [059/200] fbdev: section cleanup in arcfb Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [061/200] mac80211: give warning if building w/out rate ctrl algorithm Greg KH ` (140 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Henrik Kretzschmar, Uwe Kleine-König [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 2227 bytes --] 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Henrik Kretzschmar <henne@nachtwindheim.de> commit fb6cb3270af8f2ad3dd556906a9c52aa85754849 upstream. Fix up the section in the w100fb driver, by moving: * w100fb_remove() from .text to .devexit.text * w100_get_xtal_table() from .text to .devinit.text * w100fb_init() from .devinit.text to .init.text Signed-off-by: Henrik Kretzschmar <henne@nachtwindheim.de> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/video/w100fb.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) --- a/drivers/video/w100fb.c +++ b/drivers/video/w100fb.c @@ -53,7 +53,7 @@ static void w100_update_enable(void); static void w100_update_disable(void); static void calc_hsync(struct w100fb_par *par); static void w100_init_graphic_engine(struct w100fb_par *par); -struct w100_pll_info *w100_get_xtal_table(unsigned int freq); +struct w100_pll_info *w100_get_xtal_table(unsigned int freq) __devinit; /* Pseudo palette size */ #define MAX_PALETTES 16 @@ -782,7 +782,7 @@ out: } -static int w100fb_remove(struct platform_device *pdev) +static int __devexit w100fb_remove(struct platform_device *pdev) { struct fb_info *info = platform_get_drvdata(pdev); struct w100fb_par *par=info->par; @@ -1020,7 +1020,7 @@ static struct pll_entries { { 0 }, }; -struct w100_pll_info *w100_get_xtal_table(unsigned int freq) +struct w100_pll_info __devinit *w100_get_xtal_table(unsigned int freq) { struct pll_entries *pll_entry = w100_pll_tables; @@ -1611,7 +1611,7 @@ static void w100_vsync(void) static struct platform_driver w100fb_driver = { .probe = w100fb_probe, - .remove = w100fb_remove, + .remove = __devexit_p(w100fb_remove), .suspend = w100fb_suspend, .resume = w100fb_resume, .driver = { @@ -1619,7 +1619,7 @@ static struct platform_driver w100fb_dri }, }; -int __devinit w100fb_init(void) +int __init w100fb_init(void) { return platform_driver_register(&w100fb_driver); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [061/200] mac80211: give warning if building w/out rate ctrl algorithm 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (58 preceding siblings ...) 2010-07-01 17:42 ` [060/200] fbdev: section cleanup in w100fb Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [062/200] mac80211: Fix robust management frame handling (MFP) Greg KH ` (139 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Andres Salomon, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andres Salomon <dilinger@collabora.co.uk> commit c2ef355bf3ef0b8006b96128726684fba47ac928 upstream. I discovered that if EMBEDDED=y, one can accidentally build a mac80211 stack and drivers w/ no rate control algorithm. For drivers like RTL8187 that don't supply their own RC algorithms, this will cause ieee80211_register_hw to fail (making the driver unusable). This will tell kconfig to provide a warning if no rate control algorithms have been selected. That'll at least warn the user; users that know that their drivers supply a rate control algorithm can safely ignore the warning, and those who don't know (or who expect to be using multiple drivers) can select a default RC algorithm. Signed-off-by: Andres Salomon <dilinger@collabora.co.uk> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/mac80211/Kconfig | 9 +++++++++ 1 file changed, 9 insertions(+) --- a/net/mac80211/Kconfig +++ b/net/mac80211/Kconfig @@ -15,8 +15,12 @@ comment "CFG80211 needs to be enabled fo if MAC80211 != n +config MAC80211_HAS_RC + def_bool n + config MAC80211_RC_PID bool "PID controller based rate control algorithm" if EMBEDDED + select MAC80211_HAS_RC ---help--- This option enables a TX rate control algorithm for mac80211 that uses a PID controller to select the TX @@ -24,12 +28,14 @@ config MAC80211_RC_PID config MAC80211_RC_MINSTREL bool "Minstrel" if EMBEDDED + select MAC80211_HAS_RC default y ---help--- This option enables the 'minstrel' TX rate control algorithm choice prompt "Default rate control algorithm" + depends on MAC80211_HAS_RC default MAC80211_RC_DEFAULT_MINSTREL ---help--- This option selects the default rate control algorithm @@ -62,6 +68,9 @@ config MAC80211_RC_DEFAULT endif +comment "Some wireless drivers require a rate control algorithm" + depends on MAC80211_HAS_RC=n + config MAC80211_MESH bool "Enable mac80211 mesh networking (pre-802.11s) support" depends on MAC80211 && EXPERIMENTAL ^ permalink raw reply [flat|nested] 666+ messages in thread
* [062/200] mac80211: Fix robust management frame handling (MFP) 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (59 preceding siblings ...) 2010-07-01 17:42 ` [061/200] mac80211: give warning if building w/out rate ctrl algorithm Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [063/200] mac80211: fix rts threshold check Greg KH ` (138 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jouni Malinen, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jouni Malinen <j@w1.fi> commit d211e90e28a074447584729018a39910d691d1a8 upstream. Commit e34e09401ee9888dd662b2fca5d607794a56daf2 incorrectly removed use of ieee80211_has_protected() from the management frame case and in practice, made this validation drop all Action frames when MFP is enabled. This should have only been done for frames with Protected field set to zero. Signed-off-by: Jouni Malinen <j@w1.fi> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/mac80211/rx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1414,7 +1414,8 @@ ieee80211_drop_unencrypted_mgmt(struct i return res; if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) { - if (unlikely(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && + if (unlikely(!ieee80211_has_protected(fc) && + ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && rx->key)) return -EACCES; /* BIP does not use Protected field, so need to check MMIE */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [063/200] mac80211: fix rts threshold check 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (60 preceding siblings ...) 2010-07-01 17:42 ` [062/200] mac80211: Fix robust management frame handling (MFP) Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [064/200] mac80211: fix handling of 4-address-mode in ieee80211_change_iface Greg KH ` (137 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Shanyu Zhao, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shanyu Zhao <shanyu.zhao@intel.com> commit a2c40249a36d0b4d76d1caf6bf806e4ae5b06e8a upstream. Currently whenever rts thresold is set, every packet will use RTS protection no matter its size exceeds the threshold or not. This is due to a bug in the rts threshold check. if (len > tx->local->hw.wiphy->rts_threshold) { txrc.rts = rts = true; } Basically it is comparing an int (len) and a u32 (rts_threshold), and the variable len is assigned as: len = min_t(int, tx->skb->len + FCS_LEN, tx->local->hw.wiphy->frag_threshold); However, when frag_threshold is "-1", len is always "-1", which is 0xffffffff therefore rts is always set to true. Signed-off-by: Shanyu Zhao <shanyu.zhao@intel.com> Reviewed-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/mac80211/tx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -584,7 +584,8 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021 struct ieee80211_hdr *hdr = (void *)tx->skb->data; struct ieee80211_supported_band *sband; struct ieee80211_rate *rate; - int i, len; + int i; + u32 len; bool inval = false, rts = false, short_preamble = false; struct ieee80211_tx_rate_control txrc; u32 sta_flags; @@ -593,7 +594,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021 sband = tx->local->hw.wiphy->bands[tx->channel->band]; - len = min_t(int, tx->skb->len + FCS_LEN, + len = min_t(u32, tx->skb->len + FCS_LEN, tx->local->hw.wiphy->frag_threshold); /* set up the tx rate control struct we give the RC algo */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [064/200] mac80211: fix handling of 4-address-mode in ieee80211_change_iface 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (61 preceding siblings ...) 2010-07-01 17:42 ` [063/200] mac80211: fix rts threshold check Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [065/200] ath9k_hw: fix hardware deinit Greg KH ` (136 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Felix Fietkau, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Felix Fietkau <nbd@openwrt.org> commit f7917af92024d43bc20bc1afc92de27b0bd0f50b upstream. A misplaced interface type check bails out too early if the interface is not in monitor mode. This patch moves it to the right place, so that it only covers changes to the monitor flags. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/mac80211/cfg.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -97,9 +97,6 @@ static int ieee80211_change_iface(struct params->mesh_id_len, params->mesh_id); - if (sdata->vif.type != NL80211_IFTYPE_MONITOR || !flags) - return 0; - if (type == NL80211_IFTYPE_AP_VLAN && params && params->use_4addr == 0) rcu_assign_pointer(sdata->u.vlan.sta, NULL); @@ -107,7 +104,9 @@ static int ieee80211_change_iface(struct params && params->use_4addr >= 0) sdata->u.mgd.use_4addr = params->use_4addr; - sdata->u.mntr_flags = *flags; + if (sdata->vif.type == NL80211_IFTYPE_MONITOR && flags) + sdata->u.mntr_flags = *flags; + return 0; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [065/200] ath9k_hw: fix hardware deinit 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (62 preceding siblings ...) 2010-07-01 17:42 ` [064/200] mac80211: fix handling of 4-address-mode in ieee80211_change_iface Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [066/200] drm/i915: Reject bind_to_gtt() early if object > aperture Greg KH ` (135 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Sujith, Luis R. Rodriguez, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sujith <Sujith.Manoharan@atheros.com> commit 736b3a27b3c50c4a23717b802240435a69e8d0ff upstream. Without this you will get a panic if the device initialization fails. Also, free ath_hw instance properly. ath9k_hw_deinit() shouldn't do it. Signed-off-by: Sujith <Sujith.Manoharan@atheros.com> Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/ath/ath9k/hw.c | 4 +--- drivers/net/wireless/ath/ath9k/init.c | 3 +++ 2 files changed, 4 insertions(+), 3 deletions(-) --- a/drivers/net/wireless/ath/ath9k/hw.c +++ b/drivers/net/wireless/ath/ath9k/hw.c @@ -1241,7 +1241,7 @@ void ath9k_hw_deinit(struct ath_hw *ah) { struct ath_common *common = ath9k_hw_common(ah); - if (common->state <= ATH_HW_INITIALIZED) + if (common->state < ATH_HW_INITIALIZED) goto free_hw; if (!AR_SREV_9100(ah)) @@ -1252,8 +1252,6 @@ void ath9k_hw_deinit(struct ath_hw *ah) free_hw: if (!AR_SREV_9280_10_OR_LATER(ah)) ath9k_hw_rf_free_ext_banks(ah); - kfree(ah); - ah = NULL; } EXPORT_SYMBOL(ath9k_hw_deinit); --- a/drivers/net/wireless/ath/ath9k/init.c +++ b/drivers/net/wireless/ath/ath9k/init.c @@ -760,6 +760,9 @@ static void ath9k_deinit_softc(struct at tasklet_kill(&sc->intr_tq); tasklet_kill(&sc->bcon_tasklet); + + kfree(sc->sc_ah); + sc->sc_ah = NULL; } void ath9k_deinit_device(struct ath_softc *sc) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [066/200] drm/i915: Reject bind_to_gtt() early if object > aperture 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (63 preceding siblings ...) 2010-07-01 17:42 ` [065/200] ath9k_hw: fix hardware deinit Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [067/200] [SCSI] libsas: fix deref before check in commit 70b25f890ce Greg KH ` (134 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Chris Wilson, Eric Anholt 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chris Wilson <chris@chris-wilson.co.uk> commit 654fc6073f68efa3b6c466825749e73e7fbb92cd upstream. If the object is bigger than the entire aperture, reject it early before evicting everything in a vain attempt to find space. v2: Use E2BIG as suggested by Owain G. Ainsworth. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/i915/i915_gem.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -2688,6 +2688,14 @@ i915_gem_object_bind_to_gtt(struct drm_g return -EINVAL; } + /* If the object is bigger than the entire aperture, reject it early + * before evicting everything in a vain attempt to find space. + */ + if (obj->size > dev->gtt_total) { + DRM_ERROR("Attempting to bind an object larger than the aperture\n"); + return -E2BIG; + } + search_free: free_space = drm_mm_search_free(&dev_priv->mm.gtt_space, obj->size, alignment, 0); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [067/200] [SCSI] libsas: fix deref before check in commit 70b25f890ce 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (64 preceding siblings ...) 2010-07-01 17:42 ` [066/200] drm/i915: Reject bind_to_gtt() early if object > aperture Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [068/200] drivers/base/cpu.c: fix the output from /sys/devices/system/cpu/offline Greg KH ` (133 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, James Bottomley 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: James Bottomley <James.Bottomley@suse.de> commit 1b4d0d8ea7b3cbd107f345ab766416f9b38ce66a upstream. commit 70b25f890ce9f0520c64075ce9225a5b020a513e Author: Tejun Heo <tj@kernel.org> Date: Thu Apr 15 09:00:08 2010 +0900 [SCSI] fix locking around blk_abort_request() Introduced a reference before check problem, fix this by moving the lock shorthand code to be right at the point of actual use. Reported-by: Dan Carpenter <error27@gmail.com> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: James Bottomley <James.Bottomley@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/scsi/libsas/sas_ata.c | 5 +++-- drivers/scsi/libsas/sas_scsi_host.c | 16 ++++++++-------- 2 files changed, 11 insertions(+), 10 deletions(-) --- a/drivers/scsi/libsas/sas_ata.c +++ b/drivers/scsi/libsas/sas_ata.c @@ -395,12 +395,13 @@ int sas_ata_init_host_and_port(struct do void sas_ata_task_abort(struct sas_task *task) { struct ata_queued_cmd *qc = task->uldd_task; - struct request_queue *q = qc->scsicmd->device->request_queue; struct completion *waiting; - unsigned long flags; /* Bounce SCSI-initiated commands to the SCSI EH */ if (qc->scsicmd) { + struct request_queue *q = qc->scsicmd->device->request_queue; + unsigned long flags; + spin_lock_irqsave(q->queue_lock, flags); blk_abort_request(qc->scsicmd->request); spin_unlock_irqrestore(q->queue_lock, flags); --- a/drivers/scsi/libsas/sas_scsi_host.c +++ b/drivers/scsi/libsas/sas_scsi_host.c @@ -1030,8 +1030,6 @@ int __sas_task_abort(struct sas_task *ta void sas_task_abort(struct sas_task *task) { struct scsi_cmnd *sc = task->uldd_task; - struct request_queue *q = sc->device->request_queue; - unsigned long flags; /* Escape for libsas internal commands */ if (!sc) { @@ -1043,13 +1041,15 @@ void sas_task_abort(struct sas_task *tas if (dev_is_sata(task->dev)) { sas_ata_task_abort(task); - return; - } + } else { + struct request_queue *q = sc->device->request_queue; + unsigned long flags; - spin_lock_irqsave(q->queue_lock, flags); - blk_abort_request(sc->request); - spin_unlock_irqrestore(q->queue_lock, flags); - scsi_schedule_eh(sc->device->host); + spin_lock_irqsave(q->queue_lock, flags); + blk_abort_request(sc->request); + spin_unlock_irqrestore(q->queue_lock, flags); + scsi_schedule_eh(sc->device->host); + } } int sas_slave_alloc(struct scsi_device *scsi_dev) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [068/200] drivers/base/cpu.c: fix the output from /sys/devices/system/cpu/offline 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (65 preceding siblings ...) 2010-07-01 17:42 ` [067/200] [SCSI] libsas: fix deref before check in commit 70b25f890ce Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [069/200] can: Fix SJA1000 command register writes on SMP systems Greg KH ` (132 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jan Beulich, Andi Kleen, Stephen Rothwell 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jan Beulich <JBeulich@novell.com> commit cdc6e3d3968052cebb2f2ddcd742bff29fbd1a90 upstream. Without CONFIG_CPUMASK_OFFSTACK, simply inverting cpu_online_mask leads to CPUs beyond nr_cpu_ids to be displayed twice and CPUs not even possible to be displayed as offline. Signed-off-by: Jan Beulich <jbeulich@novell.com> Cc: Andi Kleen <ak@linux.intel.com> Cc: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/base/cpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/base/cpu.c +++ b/drivers/base/cpu.c @@ -186,7 +186,7 @@ static ssize_t print_cpus_offline(struct /* display offline cpus < nr_cpu_ids */ if (!alloc_cpumask_var(&offline, GFP_KERNEL)) return -ENOMEM; - cpumask_complement(offline, cpu_online_mask); + cpumask_andnot(offline, cpu_possible_mask, cpu_online_mask); n = cpulist_scnprintf(buf, len, offline); free_cpumask_var(offline); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [069/200] can: Fix SJA1000 command register writes on SMP systems 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (66 preceding siblings ...) 2010-07-01 17:42 ` [068/200] drivers/base/cpu.c: fix the output from /sys/devices/system/cpu/offline Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [070/200] PCI quirks: disable msi on AMD rs4xx internal gfx bridges Greg KH ` (131 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Oliver Hartkopp, Wolfgang Grandegger, David S. Miller 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Oliver Hartkopp <socketcan@hartkopp.net> commit 57c8a456640fa3ca777652f11f2db4179a3e66b6 upstream. The SJA1000 command register is concurrently written in the rx-path to free the receive buffer _and_ in the tx-path to start the transmission. The SJA1000 data sheet, 6.4.4 COMMAND REGISTER (CMR) states: "Between two commands at least one internal clock cycle is needed in order to proceed. The internal clock is half of the external oscillator frequency." On SMP systems the current implementation leads to a write stall in the tx-path, which can be solved by adding some general locking and some time to settle the write_reg() operation for the command register. Thanks to Klaus Hitschler for the original fix and detailed problem description. This patch applies on net-2.6 and (with some offsets) on net-next-2.6 . Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Acked-by: Wolfgang Grandegger <wg@grandegger.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/can/sja1000/sja1000.c | 20 +++++++++++++++++--- drivers/net/can/sja1000/sja1000.h | 1 + 2 files changed, 18 insertions(+), 3 deletions(-) --- a/drivers/net/can/sja1000/sja1000.c +++ b/drivers/net/can/sja1000/sja1000.c @@ -84,6 +84,20 @@ static struct can_bittiming_const sja100 .brp_inc = 1, }; +static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val) +{ + unsigned long flags; + + /* + * The command register needs some locking and time to settle + * the write_reg() operation - especially on SMP systems. + */ + spin_lock_irqsave(&priv->cmdreg_lock, flags); + priv->write_reg(priv, REG_CMR, val); + priv->read_reg(priv, REG_SR); + spin_unlock_irqrestore(&priv->cmdreg_lock, flags); +} + static int sja1000_probe_chip(struct net_device *dev) { struct sja1000_priv *priv = netdev_priv(dev); @@ -297,7 +311,7 @@ static netdev_tx_t sja1000_start_xmit(st can_put_echo_skb(skb, dev, 0); - priv->write_reg(priv, REG_CMR, CMD_TR); + sja1000_write_cmdreg(priv, CMD_TR); return NETDEV_TX_OK; } @@ -346,7 +360,7 @@ static void sja1000_rx(struct net_device cf->can_id = id; /* release receive buffer */ - priv->write_reg(priv, REG_CMR, CMD_RRB); + sja1000_write_cmdreg(priv, CMD_RRB); netif_rx(skb); @@ -374,7 +388,7 @@ static int sja1000_err(struct net_device cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW; stats->rx_over_errors++; stats->rx_errors++; - priv->write_reg(priv, REG_CMR, CMD_CDO); /* clear bit */ + sja1000_write_cmdreg(priv, CMD_CDO); /* clear bit */ } if (isrc & IRQ_EI) { --- a/drivers/net/can/sja1000/sja1000.h +++ b/drivers/net/can/sja1000/sja1000.h @@ -167,6 +167,7 @@ struct sja1000_priv { void __iomem *reg_base; /* ioremap'ed address to registers */ unsigned long irq_flags; /* for request_irq() */ + spinlock_t cmdreg_lock; /* lock for concurrent cmd register writes */ u16 flags; /* custom mode flags */ u8 ocr; /* output control register */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [070/200] PCI quirks: disable msi on AMD rs4xx internal gfx bridges 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (67 preceding siblings ...) 2010-07-01 17:42 ` [069/200] can: Fix SJA1000 command register writes on SMP systems Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [071/200] PCI: Disable MSI for MCP55 on P5N32-E SLI Greg KH ` (130 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Alex Deucher, Jesse Barnes 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alex Deucher <alexdeucher@gmail.com> commit 9313ff450400e6a2ab10fe6b9bdb12a828329410 upstream. Doesn't work reliably for internal gfx. Fixes kernel bug https://bugzilla.kernel.org/show_bug.cgi?id=15626. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -2127,6 +2127,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AM DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASUSTEK, 0x9602, quirk_disable_msi); DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AI, 0x9602, quirk_disable_msi); DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi); +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi); /* Go through the list of Hypertransport capabilities and * return 1 if a HT MSI capability is found and enabled */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [071/200] PCI: Disable MSI for MCP55 on P5N32-E SLI 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (68 preceding siblings ...) 2010-07-01 17:42 ` [070/200] PCI quirks: disable msi on AMD rs4xx internal gfx bridges Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [072/200] drm/radeon/kms: dont default display priority to high on rs4xx Greg KH ` (129 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ben Hutchings, Jesse Barnes 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ben Hutchings <ben@decadent.org.uk> commit e4146bb9088c01c8b6e82be11f0c371f8aff023c upstream. As reported in <http://bugs.debian.org/552299>, MSI appears to be broken for this on-board device. We already have a quirk for the P5N32-SLI Premium; extend it to cover both variants of the board. Reported-by: Romain DEGEZ <romain.degez@smartjog.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/pci/quirks.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -2219,15 +2219,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8132_BRIDGE, ht_enable_msi_mapping); -/* The P5N32-SLI Premium motherboard from Asus has a problem with msi +/* The P5N32-SLI motherboards from Asus have a problem with msi * for the MCP55 NIC. It is not yet determined whether the msi problem * also affects other devices. As for now, turn off msi for this device. */ static void __devinit nvenet_msi_disable(struct pci_dev *dev) { - if (dmi_name_in_vendors("P5N32-SLI PREMIUM")) { + if (dmi_name_in_vendors("P5N32-SLI PREMIUM") || + dmi_name_in_vendors("P5N32-E SLI")) { dev_info(&dev->dev, - "Disabling msi for MCP55 NIC on P5N32-SLI Premium\n"); + "Disabling msi for MCP55 NIC on P5N32-SLI\n"); dev->no_msi = 1; } } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [072/200] drm/radeon/kms: dont default display priority to high on rs4xx 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (69 preceding siblings ...) 2010-07-01 17:42 ` [071/200] PCI: Disable MSI for MCP55 on P5N32-E SLI Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [073/200] drm/edid: Fix 1024x768@85Hz Greg KH ` (128 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Alex Deucher, Dave Airlie 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alex Deucher <alexdeucher@gmail.com> commit 45737447ed160faaba036c0709226bf9057f7b72 upstream. Seems to cause issues with the sound hardware. Fixes kernel bug 15982: https://bugzilla.kernel.org/show_bug.cgi?id=15982 Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/radeon/radeon_display.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/radeon/radeon_display.c +++ b/drivers/gpu/drm/radeon/radeon_display.c @@ -978,8 +978,11 @@ void radeon_update_display_priority(stru /* set display priority to high for r3xx, rv515 chips * this avoids flickering due to underflow to the * display controllers during heavy acceleration. + * Don't force high on rs4xx igp chips as it seems to + * affect the sound card. See kernel bug 15982. */ - if (ASIC_IS_R300(rdev) || (rdev->family == CHIP_RV515)) + if ((ASIC_IS_R300(rdev) || (rdev->family == CHIP_RV515)) && + !(rdev->flags & RADEON_IS_IGP)) rdev->disp_priority = 2; else rdev->disp_priority = 0; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [073/200] drm/edid: Fix 1024x768@85Hz 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (70 preceding siblings ...) 2010-07-01 17:42 ` [072/200] drm/radeon/kms: dont default display priority to high on rs4xx Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [074/200] drm/radeon/kms: reset ddc_bus in object header parsing Greg KH ` (127 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Adam Jackson, Dave Airlie 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Adam Jackson <ajax@redhat.com> commit 61dd98fad58f945ed720ba132681acb58fcee015 upstream. Having hsync both start and end on pixel 1072 ain't gonna work very well. Matches the X server's list. Signed-off-by: Adam Jackson <ajax@redhat.com> Tested-By: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/drm_edid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -335,7 +335,7 @@ static struct drm_display_mode drm_dmt_m DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) }, /* 1024x768@85Hz */ { DRM_MODE("1024x768", DRM_MODE_TYPE_DRIVER, 94500, 1024, 1072, - 1072, 1376, 0, 768, 769, 772, 808, 0, + 1168, 1376, 0, 768, 769, 772, 808, 0, DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) }, /* 1152x864@75Hz */ { DRM_MODE("1152x864", DRM_MODE_TYPE_DRIVER, 108000, 1152, 1216, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [074/200] drm/radeon/kms: reset ddc_bus in object header parsing 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (71 preceding siblings ...) 2010-07-01 17:42 ` [073/200] drm/edid: Fix 1024x768@85Hz Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [075/200] drm/radeon/kms/atom: fix typo in LVDS panel info parsing Greg KH ` (126 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Alex Deucher, Dave Airlie 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alex Deucher <alexdeucher@gmail.com> commit 2bfcc0fc698d550689ef020c73b2d977b73e728c upstream. Some LVDS connectors don't have a ddc bus, so reset the ddc bus to invalid before parsing the next connector to avoid using stale ddc bus data. Should fix fdo bug 28164. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/radeon/radeon_atombios.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/drivers/gpu/drm/radeon/radeon_atombios.c +++ b/drivers/gpu/drm/radeon/radeon_atombios.c @@ -530,6 +530,8 @@ bool radeon_get_atom_connector_info_from } /* look up gpio for ddc, hpd */ + ddc_bus.valid = false; + hpd.hpd = RADEON_HPD_NONE; if ((le16_to_cpu(path->usDeviceTag) & (ATOM_DEVICE_TV_SUPPORT | ATOM_DEVICE_CV_SUPPORT)) == 0) { for (j = 0; j < con_obj->ucNumberOfObjects; j++) { @@ -585,9 +587,6 @@ bool radeon_get_atom_connector_info_from break; } } - } else { - hpd.hpd = RADEON_HPD_NONE; - ddc_bus.valid = false; } /* needed for aux chan transactions */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [075/200] drm/radeon/kms/atom: fix typo in LVDS panel info parsing 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (72 preceding siblings ...) 2010-07-01 17:42 ` [074/200] drm/radeon/kms: reset ddc_bus in object header parsing Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [076/200] drm/radeon/kms: release AGP bridge at suspend Greg KH ` (125 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Alex Deucher, Dave Airlie 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alex Deucher <alexdeucher@gmail.com> commit 1ff26a3604d0292988d4cade0e49ba9918dbfd46 upstream. Fixes LVDS issues on some laptops; notably laptops with 2048x1536 panels. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/radeon/radeon_atombios.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/radeon/radeon_atombios.c +++ b/drivers/gpu/drm/radeon/radeon_atombios.c @@ -1173,7 +1173,7 @@ struct radeon_encoder_atom_dig *radeon_a lvds->native_mode.vtotal = lvds->native_mode.vdisplay + le16_to_cpu(lvds_info->info.sLCDTiming.usVBlanking_Time); lvds->native_mode.vsync_start = lvds->native_mode.vdisplay + - le16_to_cpu(lvds_info->info.sLCDTiming.usVSyncWidth); + le16_to_cpu(lvds_info->info.sLCDTiming.usVSyncOffset); lvds->native_mode.vsync_end = lvds->native_mode.vsync_start + le16_to_cpu(lvds_info->info.sLCDTiming.usVSyncWidth); lvds->panel_pwr_delay = ^ permalink raw reply [flat|nested] 666+ messages in thread
* [076/200] drm/radeon/kms: release AGP bridge at suspend 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (73 preceding siblings ...) 2010-07-01 17:42 ` [075/200] drm/radeon/kms/atom: fix typo in LVDS panel info parsing Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [077/200] powerpc: Fix handling of strncmp with zero len Greg KH ` (124 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jerome Glisse, Dave Airlie 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jerome Glisse <jglisse@redhat.com> commit 10b06122afcc78468bd1d009633cb71e528acdc5 upstream. I think it's good to release the AGP bridge at suspend and reacquire it at resume. Also fix : https://bugzilla.kernel.org/show_bug.cgi?id=15969 Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/radeon/radeon.h | 1 + drivers/gpu/drm/radeon/radeon_agp.c | 5 +++++ drivers/gpu/drm/radeon/radeon_device.c | 2 ++ 3 files changed, 8 insertions(+) --- a/drivers/gpu/drm/radeon/radeon.h +++ b/drivers/gpu/drm/radeon/radeon.h @@ -566,6 +566,7 @@ typedef int (*radeon_packet3_check_t)(st */ int radeon_agp_init(struct radeon_device *rdev); void radeon_agp_resume(struct radeon_device *rdev); +void radeon_agp_suspend(struct radeon_device *rdev); void radeon_agp_fini(struct radeon_device *rdev); --- a/drivers/gpu/drm/radeon/radeon_agp.c +++ b/drivers/gpu/drm/radeon/radeon_agp.c @@ -270,3 +270,8 @@ void radeon_agp_fini(struct radeon_devic } #endif } + +void radeon_agp_suspend(struct radeon_device *rdev) +{ + radeon_agp_fini(rdev); +} --- a/drivers/gpu/drm/radeon/radeon_device.c +++ b/drivers/gpu/drm/radeon/radeon_device.c @@ -748,6 +748,8 @@ int radeon_suspend_kms(struct drm_device /* evict remaining vram memory */ radeon_bo_evict_vram(rdev); + radeon_agp_suspend(rdev); + pci_save_state(dev->pdev); if (state.event == PM_EVENT_SUSPEND) { /* Shut down the device */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [077/200] powerpc: Fix handling of strncmp with zero len 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (74 preceding siblings ...) 2010-07-01 17:42 ` [076/200] drm/radeon/kms: release AGP bridge at suspend Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [078/200] powerpc/pseries: Only call start-cpu when a CPU is stopped Greg KH ` (123 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jeff Mahoney, Benjamin Herrenschmidt 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jeff Mahoney <jeffm@suse.com> commit 637a99022fb119b90fb281715d13172f0394fc12 upstream. Commit 0119536c, which added the assembly version of strncmp to powerpc, mentions that it adds two instructions to the version from boot/string.S to allow it to handle len=0. Unfortunately, it doesn't always return 0 when that is the case. The length is passed in r5, but the return value is passed back in r3. In certain cases, this will happen to work. Otherwise it will pass back the address of the first string as the return value. This patch lifts the len <= 0 handling code from memcpy to handle that case. Reported by: Christian_Sellars@symantec.com Signed-off-by: Jeff Mahoney <jeffm@suse.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/lib/string.S | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/arch/powerpc/lib/string.S +++ b/arch/powerpc/lib/string.S @@ -71,7 +71,7 @@ _GLOBAL(strcmp) _GLOBAL(strncmp) PPC_LCMPI r5,0 - beqlr + ble- 2f mtctr r5 addi r5,r3,-1 addi r4,r4,-1 @@ -82,6 +82,8 @@ _GLOBAL(strncmp) beqlr 1 bdnzt eq,1b blr +2: li r3,0 + blr _GLOBAL(strlen) addi r4,r3,-1 ^ permalink raw reply [flat|nested] 666+ messages in thread
* [078/200] powerpc/pseries: Only call start-cpu when a CPU is stopped 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (75 preceding siblings ...) 2010-07-01 17:42 ` [077/200] powerpc: Fix handling of strncmp with zero len Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [079/200] powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu Greg KH ` (122 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Michael Neuling, Benjamin Herrenschmidt 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michael Neuling <mikey@neuling.org> commit aef40e87d866355ffd279ab21021de733242d0d5 upstream. Currently we always call start-cpu irrespective of if the CPU is stopped or not. Unfortunatley on POWER7, firmware seems to not like start-cpu being called when a cpu already been started. This was not the case on POWER6 and earlier. This patch checks to see if the CPU is stopped or not via an query-cpu-stopped-state call, and only calls start-cpu on CPUs which are stopped. This fixes a bug with kexec on POWER7 on PHYP where only the primary thread would make it to the second kernel. Reported-by: Ankita Garg <ankita@linux.vnet.ibm.com> Signed-off-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/platforms/pseries/smp.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/arch/powerpc/platforms/pseries/smp.c +++ b/arch/powerpc/platforms/pseries/smp.c @@ -82,6 +82,12 @@ static inline int __devinit smp_startup_ pcpu = get_hard_smp_processor_id(lcpu); + /* Check to see if the CPU out of FW already for kexec */ + if (smp_query_cpu_stopped(pcpu) == QCSS_NOT_STOPPED){ + cpu_set(lcpu, of_spin_map); + return 1; + } + /* Fixup atomic count: it exited inside IRQ handler. */ task_thread_info(paca[lcpu].__current)->preempt_count = 0; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [079/200] powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (76 preceding siblings ...) 2010-07-01 17:42 ` [078/200] powerpc/pseries: Only call start-cpu when a CPU is stopped Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-02 0:15 ` Michael Neuling 2010-07-01 17:42 ` [080/200] powerpc: Fix ioremap_flags() with book3e pte definition Greg KH ` (121 subsequent siblings) 199 siblings, 1 reply; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Michael Neuling, Benjamin Herrenschmidt 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michael Neuling <mikey@neuling.org> commit f8b67691828321f5c85bb853283aa101ae673130 upstream. This moves query_cpu_stopped() out of the hotplug cpu code and into smp.c so it can called in other places and renames it to smp_query_cpu_stopped(). It also cleans up the return values by adding some #defines Signed-off-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/platforms/pseries/hotplug-cpu.c | 30 +++--------------------- arch/powerpc/platforms/pseries/plpar_wrappers.h | 8 ++++++ arch/powerpc/platforms/pseries/smp.c | 22 +++++++++++++++++ 3 files changed, 34 insertions(+), 26 deletions(-) --- a/arch/powerpc/platforms/pseries/hotplug-cpu.c +++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c @@ -154,30 +154,6 @@ static void pseries_mach_cpu_die(void) for(;;); } -static int qcss_tok; /* query-cpu-stopped-state token */ - -/* Get state of physical CPU. - * Return codes: - * 0 - The processor is in the RTAS stopped state - * 1 - stop-self is in progress - * 2 - The processor is not in the RTAS stopped state - * -1 - Hardware Error - * -2 - Hardware Busy, Try again later. - */ -static int query_cpu_stopped(unsigned int pcpu) -{ - int cpu_status, status; - - status = rtas_call(qcss_tok, 1, 2, &cpu_status, pcpu); - if (status != 0) { - printk(KERN_ERR - "RTAS query-cpu-stopped-state failed: %i\n", status); - return status; - } - - return cpu_status; -} - static int pseries_cpu_disable(void) { int cpu = smp_processor_id(); @@ -224,8 +200,9 @@ static void pseries_cpu_die(unsigned int } else if (get_preferred_offline_state(cpu) == CPU_STATE_OFFLINE) { for (tries = 0; tries < 25; tries++) { - cpu_status = query_cpu_stopped(pcpu); - if (cpu_status == 0 || cpu_status == -1) + cpu_status = smp_query_cpu_stopped(pcpu); + if (cpu_status == QCSS_STOPPED || + cpu_status == QCSS_HARDWARE_ERROR) break; cpu_relax(); } @@ -388,6 +365,7 @@ static int __init pseries_cpu_hotplug_in struct device_node *np; const char *typep; int cpu; + int qcss_tok; for_each_node_by_name(np, "interrupt-controller") { typep = of_get_property(np, "compatible", NULL); --- a/arch/powerpc/platforms/pseries/plpar_wrappers.h +++ b/arch/powerpc/platforms/pseries/plpar_wrappers.h @@ -4,6 +4,14 @@ #include <asm/hvcall.h> #include <asm/page.h> +/* Get state of physical CPU from query_cpu_stopped */ +int smp_query_cpu_stopped(unsigned int pcpu); +#define QCSS_STOPPED 0 +#define QCSS_STOPPING 1 +#define QCSS_NOT_STOPPED 2 +#define QCSS_HARDWARE_ERROR -1 +#define QCSS_HARDWARE_BUSY -2 + static inline long poll_pending(void) { return plpar_hcall_norets(H_POLL_PENDING); --- a/arch/powerpc/platforms/pseries/smp.c +++ b/arch/powerpc/platforms/pseries/smp.c @@ -57,6 +57,28 @@ */ static cpumask_t of_spin_map; +/* Query where a cpu is now. Return codes #defined in plpar_wrappers.h */ +int smp_query_cpu_stopped(unsigned int pcpu) +{ + int cpu_status, status; + int qcss_tok = rtas_token("query-cpu-stopped-state"); + + if (qcss_tok == RTAS_UNKNOWN_SERVICE) { + printk(KERN_INFO "Firmware doesn't support " + "query-cpu-stopped-state\n"); + return QCSS_HARDWARE_ERROR; + } + + status = rtas_call(qcss_tok, 1, 2, &cpu_status, pcpu); + if (status != 0) { + printk(KERN_ERR + "RTAS query-cpu-stopped-state failed: %i\n", status); + return status; + } + + return cpu_status; +} + /** * smp_startup_cpu() - start the given cpu * ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [079/200] powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu 2010-07-01 17:42 ` [079/200] powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu Greg KH @ 2010-07-02 0:15 ` Michael Neuling 2010-07-03 1:58 ` Greg KH 0 siblings, 1 reply; 666+ messages in thread From: Michael Neuling @ 2010-07-02 0:15 UTC (permalink / raw) To: Greg KH Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Benjamin Herrenschmidt Greg, This won't break ppc64, but it pointless without: aef40e87d866355ffd279ab21021de733242d0d5 powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu There are two patches that can be put in stable, f8b676918 and aef40e87d. In this batch of stable releases you have: 2.6.27.48 : aef40e87d only (breaks ppc64) 2.6.32.16 : aef40e87d only (breaks ppc64) 2.6.33.6 : aef40e87d & f8b676918 (works!) 2.6.34.1 : f8b676918 only (does nothing) Mikey In message <20100701174253.083176764@clark.site> you wrote: > 2.6.34-stable review patch. If anyone has any objections, please let me know . > > ------------------ > > From: Michael Neuling <mikey@neuling.org> > > commit f8b67691828321f5c85bb853283aa101ae673130 upstream. > > This moves query_cpu_stopped() out of the hotplug cpu code and into > smp.c so it can called in other places and renames it to > smp_query_cpu_stopped(). > > It also cleans up the return values by adding some #defines > > Signed-off-by: Michael Neuling <mikey@neuling.org> > Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> > > --- > arch/powerpc/platforms/pseries/hotplug-cpu.c | 30 +++------------------ --- > arch/powerpc/platforms/pseries/plpar_wrappers.h | 8 ++++++ > arch/powerpc/platforms/pseries/smp.c | 22 +++++++++++++++++ > 3 files changed, 34 insertions(+), 26 deletions(-) > > --- a/arch/powerpc/platforms/pseries/hotplug-cpu.c > +++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c > @@ -154,30 +154,6 @@ static void pseries_mach_cpu_die(void) > for(;;); > } > > -static int qcss_tok; /* query-cpu-stopped-state token */ > - > -/* Get state of physical CPU. > - * Return codes: > - * 0 - The processor is in the RTAS stopped state > - * 1 - stop-self is in progress > - * 2 - The processor is not in the RTAS stopped state > - * -1 - Hardware Error > - * -2 - Hardware Busy, Try again later. > - */ > -static int query_cpu_stopped(unsigned int pcpu) > -{ > - int cpu_status, status; > - > - status = rtas_call(qcss_tok, 1, 2, &cpu_status, pcpu); > - if (status != 0) { > - printk(KERN_ERR > - "RTAS query-cpu-stopped-state failed: %i\n", status); > - return status; > - } > - > - return cpu_status; > -} > - > static int pseries_cpu_disable(void) > { > int cpu = smp_processor_id(); > @@ -224,8 +200,9 @@ static void pseries_cpu_die(unsigned int > } else if (get_preferred_offline_state(cpu) == CPU_STATE_OFFLINE) { > > for (tries = 0; tries < 25; tries++) { > - cpu_status = query_cpu_stopped(pcpu); > - if (cpu_status == 0 || cpu_status == -1) > + cpu_status = smp_query_cpu_stopped(pcpu); > + if (cpu_status == QCSS_STOPPED || > + cpu_status == QCSS_HARDWARE_ERROR) > break; > cpu_relax(); > } > @@ -388,6 +365,7 @@ static int __init pseries_cpu_hotplug_in > struct device_node *np; > const char *typep; > int cpu; > + int qcss_tok; > > for_each_node_by_name(np, "interrupt-controller") { > typep = of_get_property(np, "compatible", NULL); > --- a/arch/powerpc/platforms/pseries/plpar_wrappers.h > +++ b/arch/powerpc/platforms/pseries/plpar_wrappers.h > @@ -4,6 +4,14 @@ > #include <asm/hvcall.h> > #include <asm/page.h> > > +/* Get state of physical CPU from query_cpu_stopped */ > +int smp_query_cpu_stopped(unsigned int pcpu); > +#define QCSS_STOPPED 0 > +#define QCSS_STOPPING 1 > +#define QCSS_NOT_STOPPED 2 > +#define QCSS_HARDWARE_ERROR -1 > +#define QCSS_HARDWARE_BUSY -2 > + > static inline long poll_pending(void) > { > return plpar_hcall_norets(H_POLL_PENDING); > --- a/arch/powerpc/platforms/pseries/smp.c > +++ b/arch/powerpc/platforms/pseries/smp.c > @@ -57,6 +57,28 @@ > */ > static cpumask_t of_spin_map; > > +/* Query where a cpu is now. Return codes #defined in plpar_wrappers.h */ > +int smp_query_cpu_stopped(unsigned int pcpu) > +{ > + int cpu_status, status; > + int qcss_tok = rtas_token("query-cpu-stopped-state"); > + > + if (qcss_tok == RTAS_UNKNOWN_SERVICE) { > + printk(KERN_INFO "Firmware doesn't support " > + "query-cpu-stopped-state\n"); > + return QCSS_HARDWARE_ERROR; > + } > + > + status = rtas_call(qcss_tok, 1, 2, &cpu_status, pcpu); > + if (status != 0) { > + printk(KERN_ERR > + "RTAS query-cpu-stopped-state failed: %i\n", status); > + return status; > + } > + > + return cpu_status; > +} > + > /** > * smp_startup_cpu() - start the given cpu > * > > ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [079/200] powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu 2010-07-02 0:15 ` Michael Neuling @ 2010-07-03 1:58 ` Greg KH 2010-07-03 7:55 ` Michael Neuling 0 siblings, 1 reply; 666+ messages in thread From: Greg KH @ 2010-07-03 1:58 UTC (permalink / raw) To: Michael Neuling Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Benjamin Herrenschmidt On Fri, Jul 02, 2010 at 10:15:18AM +1000, Michael Neuling wrote: > Greg, > > This won't break ppc64, but it pointless without: > aef40e87d866355ffd279ab21021de733242d0d5 powerpc/pseries: Make > query_cpu_stopped callable outside hotplug cpu That patch does not apply to the .34 tree, as it seems to be already included there. If not, can you please send me a backported version? thanks, greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [079/200] powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu 2010-07-03 1:58 ` Greg KH @ 2010-07-03 7:55 ` Michael Neuling 2010-07-05 17:04 ` Greg KH 0 siblings, 1 reply; 666+ messages in thread From: Michael Neuling @ 2010-07-03 7:55 UTC (permalink / raw) To: Greg KH Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Benjamin Herrenschmidt > > Greg, > > > > This won't break ppc64, but it pointless without: > > aef40e87d866355ffd279ab21021de733242d0d5 powerpc/pseries: Make > > query_cpu_stopped callable outside hotplug cpu > > That patch does not apply to the .34 tree, as it seems to be already > included there. If not, can you please send me a backported version? Sorry, my bad. aef40e87d866355ffd279ab21021de733242d0d5 is 078/200 in this series (seemed to escape my inbox). All is good. Thanks, Mikey ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [079/200] powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu 2010-07-03 7:55 ` Michael Neuling @ 2010-07-05 17:04 ` Greg KH 0 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-05 17:04 UTC (permalink / raw) To: Michael Neuling Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan, Benjamin Herrenschmidt On Sat, Jul 03, 2010 at 05:55:12PM +1000, Michael Neuling wrote: > > > Greg, > > > > > > This won't break ppc64, but it pointless without: > > > aef40e87d866355ffd279ab21021de733242d0d5 powerpc/pseries: Make > > > query_cpu_stopped callable outside hotplug cpu > > > > That patch does not apply to the .34 tree, as it seems to be already > > included there. If not, can you please send me a backported version? > > Sorry, my bad. > > aef40e87d866355ffd279ab21021de733242d0d5 is 078/200 in this series > (seemed to escape my inbox). All is good. Great, thanks for verifying. greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* [080/200] powerpc: Fix ioremap_flags() with book3e pte definition 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (77 preceding siblings ...) 2010-07-01 17:42 ` [079/200] powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [081/200] powerpc/fsl-booke: Fix InstructionTLBError execute permission check Greg KH ` (120 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Li Yang, Benjamin Herrenschmidt, Kumar Gala 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Benjamin Herrenschmidt <benh@kernel.crashing.org> commit 55052eeca6d71d76f7c3f156c0501814d8e5e6d3 upstream. We can't just clear the user read permission in book3e pte, because that will also clear supervisor read permission. This surely isn't desired. Fix the problem by adding the supervisor read back. BenH: Slightly simplified the ifdef and applied to ppc64 too Signed-off-by: Li Yang <leoli@freescale.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Kumar Gala <galak@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/mm/pgtable_32.c | 8 ++++++++ arch/powerpc/mm/pgtable_64.c | 8 ++++++++ 2 files changed, 16 insertions(+) --- a/arch/powerpc/mm/pgtable_32.c +++ b/arch/powerpc/mm/pgtable_32.c @@ -146,6 +146,14 @@ ioremap_flags(phys_addr_t addr, unsigned /* we don't want to let _PAGE_USER and _PAGE_EXEC leak out */ flags &= ~(_PAGE_USER | _PAGE_EXEC); +#ifdef _PAGE_BAP_SR + /* _PAGE_USER contains _PAGE_BAP_SR on BookE using the new PTE format + * which means that we just cleared supervisor access... oops ;-) This + * restores it + */ + flags |= _PAGE_BAP_SR; +#endif + return __ioremap_caller(addr, size, flags, __builtin_return_address(0)); } EXPORT_SYMBOL(ioremap_flags); --- a/arch/powerpc/mm/pgtable_64.c +++ b/arch/powerpc/mm/pgtable_64.c @@ -265,6 +265,14 @@ void __iomem * ioremap_flags(phys_addr_t /* we don't want to let _PAGE_USER and _PAGE_EXEC leak out */ flags &= ~(_PAGE_USER | _PAGE_EXEC); +#ifdef _PAGE_BAP_SR + /* _PAGE_USER contains _PAGE_BAP_SR on BookE using the new PTE format + * which means that we just cleared supervisor access... oops ;-) This + * restores it + */ + flags |= _PAGE_BAP_SR; +#endif + if (ppc_md.ioremap) return ppc_md.ioremap(addr, size, flags, caller); return __ioremap_caller(addr, size, flags, caller); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [081/200] powerpc/fsl-booke: Fix InstructionTLBError execute permission check 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (78 preceding siblings ...) 2010-07-01 17:42 ` [080/200] powerpc: Fix ioremap_flags() with book3e pte definition Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [082/200] powerpc/fsl-booke: Move loadcam_entry back to asm code to fix SMP ftrace Greg KH ` (119 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Li Yang, Jin Qing, Kumar Gala 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Li Yang <leoli@freescale.com> commit 78e2e68a2b79f394b7cd61e07987a8a89af907f7 upstream. In CONFIG_PTE_64BIT the PTE format has unique permission bits for user and supervisor execute. However on !CONFIG_PTE_64BIT we overload the supervisor bit to imply user execute with _PAGE_USER set. This allows us to use the same permission check mask for user or supervisor code on !CONFIG_PTE_64BIT. However, on CONFIG_PTE_64BIT we map _PAGE_EXEC to _PAGE_BAP_UX so we need a different permission mask based on the fault coming from a kernel address or user space. Without unique permission masks we see issues like the following with modules: Unable to handle kernel paging request for instruction fetch Faulting instruction address: 0xf938d040 Oops: Kernel access of bad area, sig: 11 [#1] Signed-off-by: Li Yang <leoli@freescale.com> Signed-off-by: Jin Qing <b24347@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/kernel/head_fsl_booke.S | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) --- a/arch/powerpc/kernel/head_fsl_booke.S +++ b/arch/powerpc/kernel/head_fsl_booke.S @@ -639,6 +639,13 @@ interrupt_base: rlwinm r12,r12,0,16,1 mtspr SPRN_MAS1,r12 + /* Make up the required permissions for kernel code */ +#ifdef CONFIG_PTE_64BIT + li r13,_PAGE_PRESENT | _PAGE_BAP_SX + oris r13,r13,_PAGE_ACCESSED@h +#else + li r13,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC +#endif b 4f /* Get the PGD for the current thread */ @@ -646,15 +653,15 @@ interrupt_base: mfspr r11,SPRN_SPRG_THREAD lwz r11,PGDIR(r11) -4: - /* Make up the required permissions */ + /* Make up the required permissions for user code */ #ifdef CONFIG_PTE_64BIT - li r13,_PAGE_PRESENT | _PAGE_EXEC + li r13,_PAGE_PRESENT | _PAGE_BAP_UX oris r13,r13,_PAGE_ACCESSED@h #else li r13,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC #endif +4: FIND_PTE andc. r13,r13,r11 /* Check permission */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [082/200] powerpc/fsl-booke: Move loadcam_entry back to asm code to fix SMP ftrace 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (79 preceding siblings ...) 2010-07-01 17:42 ` [081/200] powerpc/fsl-booke: Fix InstructionTLBError execute permission check Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [083/200] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c Greg KH ` (118 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Kumar Gala 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kumar Gala <galak@kernel.crashing.org> commit 78f622377f7d31d988db350a43c5689dd5f31876 upstream. When we build with ftrace enabled its possible that loadcam_entry would have used the stack pointer (even though the code doesn't need it). We call loadcam_entry in __secondary_start before the stack is setup. To ensure that loadcam_entry doesn't use the stack pointer the easiest solution is to just have it in asm code. Signed-off-by: Kumar Gala <galak@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/kernel/asm-offsets.c | 8 ++++++++ arch/powerpc/mm/fsl_booke_mmu.c | 25 +++---------------------- arch/powerpc/mm/mmu_decl.h | 8 ++++++++ arch/powerpc/mm/tlb_nohash_low.S | 28 ++++++++++++++++++++++++++++ 4 files changed, 47 insertions(+), 22 deletions(-) --- a/arch/powerpc/kernel/asm-offsets.c +++ b/arch/powerpc/kernel/asm-offsets.c @@ -447,6 +447,14 @@ int main(void) DEFINE(PGD_T_LOG2, PGD_T_LOG2); DEFINE(PTE_T_LOG2, PTE_T_LOG2); #endif +#ifdef CONFIG_FSL_BOOKE + DEFINE(TLBCAM_SIZE, sizeof(struct tlbcam)); + DEFINE(TLBCAM_MAS0, offsetof(struct tlbcam, MAS0)); + DEFINE(TLBCAM_MAS1, offsetof(struct tlbcam, MAS1)); + DEFINE(TLBCAM_MAS2, offsetof(struct tlbcam, MAS2)); + DEFINE(TLBCAM_MAS3, offsetof(struct tlbcam, MAS3)); + DEFINE(TLBCAM_MAS7, offsetof(struct tlbcam, MAS7)); +#endif #ifdef CONFIG_KVM_EXIT_TIMING DEFINE(VCPU_TIMING_EXIT_TBU, offsetof(struct kvm_vcpu, --- a/arch/powerpc/mm/fsl_booke_mmu.c +++ b/arch/powerpc/mm/fsl_booke_mmu.c @@ -2,7 +2,7 @@ * Modifications by Kumar Gala (galak@kernel.crashing.org) to support * E500 Book E processors. * - * Copyright 2004 Freescale Semiconductor, Inc + * Copyright 2004,2010 Freescale Semiconductor, Inc. * * This file contains the routines for initializing the MMU * on the 4xx series of chips. @@ -56,19 +56,13 @@ unsigned int tlbcam_index; -#define NUM_TLBCAMS (64) #if defined(CONFIG_LOWMEM_CAM_NUM_BOOL) && (CONFIG_LOWMEM_CAM_NUM >= NUM_TLBCAMS) #error "LOWMEM_CAM_NUM must be less than NUM_TLBCAMS" #endif -struct tlbcam { - u32 MAS0; - u32 MAS1; - unsigned long MAS2; - u32 MAS3; - u32 MAS7; -} TLBCAM[NUM_TLBCAMS]; +#define NUM_TLBCAMS (64) +struct tlbcam TLBCAM[NUM_TLBCAMS]; struct tlbcamrange { unsigned long start; @@ -109,19 +103,6 @@ unsigned long p_mapped_by_tlbcam(phys_ad return 0; } -void loadcam_entry(int idx) -{ - mtspr(SPRN_MAS0, TLBCAM[idx].MAS0); - mtspr(SPRN_MAS1, TLBCAM[idx].MAS1); - mtspr(SPRN_MAS2, TLBCAM[idx].MAS2); - mtspr(SPRN_MAS3, TLBCAM[idx].MAS3); - - if (mmu_has_feature(MMU_FTR_BIG_PHYS)) - mtspr(SPRN_MAS7, TLBCAM[idx].MAS7); - - asm volatile("isync;tlbwe;isync" : : : "memory"); -} - /* * Set up one of the I/D BAT (block address translation) register pairs. * The parameters are not checked; in particular size must be a power --- a/arch/powerpc/mm/mmu_decl.h +++ b/arch/powerpc/mm/mmu_decl.h @@ -149,7 +149,15 @@ extern unsigned long mmu_mapin_ram(unsig extern void MMU_init_hw(void); extern unsigned long mmu_mapin_ram(unsigned long top); extern void adjust_total_lowmem(void); +extern void loadcam_entry(unsigned int index); +struct tlbcam { + u32 MAS0; + u32 MAS1; + unsigned long MAS2; + u32 MAS3; + u32 MAS7; +}; #elif defined(CONFIG_PPC32) /* anything 32-bit except 4xx or 8xx */ extern void MMU_init_hw(void); --- a/arch/powerpc/mm/tlb_nohash_low.S +++ b/arch/powerpc/mm/tlb_nohash_low.S @@ -271,3 +271,31 @@ _GLOBAL(set_context) #else #error Unsupported processor type ! #endif + +#if defined(CONFIG_FSL_BOOKE) +/* + * extern void loadcam_entry(unsigned int index) + * + * Load TLBCAM[index] entry in to the L2 CAM MMU + */ +_GLOBAL(loadcam_entry) + LOAD_REG_ADDR(r4, TLBCAM) + mulli r5,r3,TLBCAM_SIZE + add r3,r5,r4 + lwz r4,TLBCAM_MAS0(r3) + mtspr SPRN_MAS0,r4 + lwz r4,TLBCAM_MAS1(r3) + mtspr SPRN_MAS1,r4 + PPC_LL r4,TLBCAM_MAS2(r3) + mtspr SPRN_MAS2,r4 + lwz r4,TLBCAM_MAS3(r3) + mtspr SPRN_MAS3,r4 +BEGIN_MMU_FTR_SECTION + lwz r4,TLBCAM_MAS7(r3) + mtspr SPRN_MAS7,r4 +END_MMU_FTR_SECTION_IFSET(MMU_FTR_BIG_PHYS) + isync + tlbwe + isync + blr +#endif ^ permalink raw reply [flat|nested] 666+ messages in thread
* [083/200] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (80 preceding siblings ...) 2010-07-01 17:42 ` [082/200] powerpc/fsl-booke: Move loadcam_entry back to asm code to fix SMP ftrace Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [084/200] writeback: disable periodic old data writeback for !dirty_writeback_centisecs Greg KH ` (117 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Denis Kirjanov, Robert Richter 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Denis Kirjanov <dkirjanov@hera.kernel.org> commit 238c1a78c957f3dc7cb848b161dcf4805793ed56 upstream. Fix potential initial_lfsr buffer overrun. Writing past the end of the buffer could happen when index == ENTRIES Signed-off-by: Denis Kirjanov <dkirjanov@kernel.org> Signed-off-by: Robert Richter <robert.richter@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/powerpc/oprofile/op_model_cell.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/powerpc/oprofile/op_model_cell.c +++ b/arch/powerpc/oprofile/op_model_cell.c @@ -1077,7 +1077,7 @@ static int calculate_lfsr(int n) index = ENTRIES-1; /* make sure index is valid */ - if ((index > ENTRIES) || (index < 0)) + if ((index >= ENTRIES) || (index < 0)) index = ENTRIES-1; return initial_lfsr[index]; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [084/200] writeback: disable periodic old data writeback for !dirty_writeback_centisecs 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (81 preceding siblings ...) 2010-07-01 17:42 ` [083/200] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [085/200] md/raid1: fix counting of write targets Greg KH ` (116 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Jens Axboe 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jens Axboe <jens.axboe@oracle.com> commit 69b62d01ec44fe0d505d89917392347732135a4d upstream. Prior to 2.6.32, setting /proc/sys/vm/dirty_writeback_centisecs disabled periodic dirty writeback from kupdate. This got broken and now causes excessive sys CPU usage if set to zero, as we'll keep beating on schedule(). Reported-by: Justin Maggard <jmaggard10@gmail.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/fs-writeback.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) --- a/fs/fs-writeback.c +++ b/fs/fs-writeback.c @@ -852,6 +852,12 @@ static long wb_check_old_data_flush(stru unsigned long expired; long nr_pages; + /* + * When set to zero, disable periodic writeback + */ + if (!dirty_writeback_interval) + return 0; + expired = wb->last_old_flush + msecs_to_jiffies(dirty_writeback_interval * 10); if (time_before(jiffies, expired)) @@ -947,8 +953,12 @@ int bdi_writeback_task(struct bdi_writeb break; } - wait_jiffies = msecs_to_jiffies(dirty_writeback_interval * 10); - schedule_timeout_interruptible(wait_jiffies); + if (dirty_writeback_interval) { + wait_jiffies = msecs_to_jiffies(dirty_writeback_interval * 10); + schedule_timeout_interruptible(wait_jiffies); + } else + schedule(); + try_to_freeze(); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [085/200] md/raid1: fix counting of write targets. 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (82 preceding siblings ...) 2010-07-01 17:42 ` [084/200] writeback: disable periodic old data writeback for !dirty_writeback_centisecs Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [086/200] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB Greg KH ` (115 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: NeilBrown <neilb@suse.de> commit 964147d5c86d63be79b442c30f3783d49860c078 upstream. There is a very small race window when writing to a RAID1 such that if a device is marked faulty at exactly the wrong time, the write-in-progress will not be sent to the device, but the bitmap (if present) will be updated to say that the write was sent. Then if the device turned out to still be usable as was re-added to the array, the bitmap-based-resync would skip resyncing that block, possibly leading to corruption. This would only be a problem if no further writes were issued to that area of the device (i.e. that bitmap chunk). Suitable for any pending -stable kernel. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/raid1.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -912,9 +912,10 @@ static int make_request(struct request_q if (test_bit(Faulty, &rdev->flags)) { rdev_dec_pending(rdev, mddev); r1_bio->bios[i] = NULL; - } else + } else { r1_bio->bios[i] = bio; - targets++; + targets++; + } } else r1_bio->bios[i] = NULL; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [086/200] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (83 preceding siblings ...) 2010-07-01 17:42 ` [085/200] md/raid1: fix counting of write targets Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [087/200] md/linear: avoid possible oops and array stop Greg KH ` (114 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: NeilBrown <neilb@suse.de> commit af3a2cd6b8a479345786e7fe5e199ad2f6240e56 upstream. read_balance uses a "unsigned long" for a sector number which will get truncated beyond 2TB. This will cause read-balancing to be non-optimal, and can cause data to be read from the 'wrong' branch during a resync. This has a very small chance of returning wrong data. Reported-by: Jordan Russell <jr-list-2010@quo.to> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/raid1.c | 4 ++-- drivers/md/raid10.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -418,7 +418,7 @@ static void raid1_end_write_request(stru */ static int read_balance(conf_t *conf, r1bio_t *r1_bio) { - const unsigned long this_sector = r1_bio->sector; + const sector_t this_sector = r1_bio->sector; int new_disk = conf->last_used, disk = new_disk; int wonly_disk = -1; const int sectors = r1_bio->sectors; @@ -434,7 +434,7 @@ static int read_balance(conf_t *conf, r1 retry: if (conf->mddev->recovery_cp < MaxSector && (this_sector + sectors >= conf->next_resync)) { - /* Choose the first operation device, for consistancy */ + /* Choose the first operational device, for consistancy */ new_disk = 0; for (rdev = rcu_dereference(conf->mirrors[new_disk].rdev); --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -494,7 +494,7 @@ static int raid10_mergeable_bvec(struct */ static int read_balance(conf_t *conf, r10bio_t *r10_bio) { - const unsigned long this_sector = r10_bio->sector; + const sector_t this_sector = r10_bio->sector; int disk, slot, nslot; const int sectors = r10_bio->sectors; sector_t new_distance, current_distance; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [087/200] md/linear: avoid possible oops and array stop 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (84 preceding siblings ...) 2010-07-01 17:42 ` [086/200] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [088/200] md: remove unneeded sysfs files more promptly Greg KH ` (113 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: NeilBrown <neilb@suse.de> commit ef2f80ff7325b2c1888ff02ead28957b5840bf51 upstream. Since commit ef286f6fa673cd7fb367e1b145069d8dbfcc6081 it has been important that each personality clears ->private in the ->stop() function, or sets it to a attribute group to be removed. linear.c doesn't. This can sometimes lead to an oops, though it doesn't always. Suitable for 2.6.33-stable and 2.6.34. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/linear.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/md/linear.c +++ b/drivers/md/linear.c @@ -282,6 +282,7 @@ static int linear_stop (mddev_t *mddev) rcu_barrier(); blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/ kfree(conf); + mddev->private = NULL; return 0; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [088/200] md: remove unneeded sysfs files more promptly 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (85 preceding siblings ...) 2010-07-01 17:42 ` [087/200] md/linear: avoid possible oops and array stop Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:42 ` [089/200] md: set mddev readonly flag on blkdev BLKROSET ioctl Greg KH ` (112 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: NeilBrown <neilb@suse.de> commit b6eb127d274385d81ce8dd45c98190f097bce1b4 upstream. When an array is stopped we need to remove some sysfs files which are dependent on the type of array. We need to delay that deletion as deleting them while holding reconfig_mutex can lead to deadlocks. We currently delay them until the array is completely destroyed. However it is possible to deactivate and then reactivate the array. It is also possible to need to remove sysfs files when changing level, which can potentially happen several times before an array is destroyed. So we need to delete these files more promptly: as soon as reconfig_mutex is dropped. We need to ensure this happens before do_md_run can restart the array, so we use open_mutex for some extra locking. This is not deadlock prone. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/md.c | 41 +++++++++++++++++++++++++++++++---------- 1 file changed, 31 insertions(+), 10 deletions(-) --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -508,9 +508,32 @@ static inline int mddev_trylock(mddev_t return mutex_trylock(&mddev->reconfig_mutex); } +static struct attribute_group md_redundancy_group; + static inline void mddev_unlock(mddev_t * mddev) { - mutex_unlock(&mddev->reconfig_mutex); + if (mddev->pers == NULL && mddev->private) { + /* These cannot be removed under reconfig_mutex as + * an access to the files will try to take reconfig_mutex + * while holding the file unremovable, which leads to + * a deadlock. + * So hold open_mutex instead - we are allowed to take + * it while holding reconfig_mutex, and md_run can + * use it to wait for the remove to complete. + */ + mutex_lock(&mddev->open_mutex); + mutex_unlock(&mddev->reconfig_mutex); + + sysfs_remove_group(&mddev->kobj, &md_redundancy_group); + if (mddev->private != (void*)1) + sysfs_remove_group(&mddev->kobj, mddev->private); + if (mddev->sysfs_action) + sysfs_put(mddev->sysfs_action); + mddev->sysfs_action = NULL; + mddev->private = NULL; + mutex_unlock(&mddev->open_mutex); + } else + mutex_unlock(&mddev->reconfig_mutex); md_wakeup_thread(mddev->thread); } @@ -4082,15 +4105,6 @@ static void mddev_delayed_delete(struct { mddev_t *mddev = container_of(ws, mddev_t, del_work); - if (mddev->private) { - sysfs_remove_group(&mddev->kobj, &md_redundancy_group); - if (mddev->private != (void*)1) - sysfs_remove_group(&mddev->kobj, mddev->private); - if (mddev->sysfs_action) - sysfs_put(mddev->sysfs_action); - mddev->sysfs_action = NULL; - mddev->private = NULL; - } sysfs_remove_group(&mddev->kobj, &md_bitmap_group); kobject_del(&mddev->kobj); kobject_put(&mddev->kobj); @@ -4248,6 +4262,13 @@ static int do_md_run(mddev_t * mddev) if (mddev->pers) return -EBUSY; + /* These two calls synchronise us with the + * sysfs_remove_group calls in mddev_unlock, + * so they must have completed. + */ + mutex_lock(&mddev->open_mutex); + mutex_unlock(&mddev->open_mutex); + /* * Analyze all RAID superblock(s) */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [089/200] md: set mddev readonly flag on blkdev BLKROSET ioctl 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (86 preceding siblings ...) 2010-07-01 17:42 ` [088/200] md: remove unneeded sysfs files more promptly Greg KH @ 2010-07-01 17:42 ` Greg KH 2010-07-01 17:43 ` [090/200] x86/amd-iommu: Fix crash when request_mem_region fails Greg KH ` (111 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:42 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dan Williams, NeilBrown 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Williams <dan.j.williams@intel.com> commit e2218350465e7e0931676b4849b594c978437bce upstream. When the user sets the block device to readwrite then the mddev should follow suit. Otherwise, the BUG_ON in md_write_start() will be set to trigger. The reverse direction, setting mddev->ro to match a set readonly request, can be ignored because the blkdev level readonly flag precludes the need to have mddev->ro set correctly. Nevermind the fact that setting mddev->ro to 1 may fail if the array is in use. Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/md.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -5517,6 +5517,7 @@ static int md_ioctl(struct block_device int err = 0; void __user *argp = (void __user *)arg; mddev_t *mddev = NULL; + int ro; if (!capable(CAP_SYS_ADMIN)) return -EACCES; @@ -5652,6 +5653,34 @@ static int md_ioctl(struct block_device err = do_md_stop(mddev, 1, 1); goto done_unlock; + case BLKROSET: + if (get_user(ro, (int __user *)(arg))) { + err = -EFAULT; + goto done_unlock; + } + err = -EINVAL; + + /* if the bdev is going readonly the value of mddev->ro + * does not matter, no writes are coming + */ + if (ro) + goto done_unlock; + + /* are we are already prepared for writes? */ + if (mddev->ro != 1) + goto done_unlock; + + /* transitioning to readauto need only happen for + * arrays that call md_write_start + */ + if (mddev->pers) { + err = restart_array(mddev); + if (err == 0) { + mddev->ro = 2; + set_disk_ro(mddev->gendisk, 0); + } + } + goto done_unlock; } /* ^ permalink raw reply [flat|nested] 666+ messages in thread
* [090/200] x86/amd-iommu: Fix crash when request_mem_region fails 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (87 preceding siblings ...) 2010-07-01 17:42 ` [089/200] md: set mddev readonly flag on blkdev BLKROSET ioctl Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [091/200] x86/amd-iommu: Fall back to GART if initialization fails Greg KH ` (110 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Joerg Roedel 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> commit e82752d8b5a7e0a5e4d607fd8713549e2a4e2741 upstream. When request_mem_region fails the error path tries to disable the IOMMUs. This accesses the mmio-region which was not allocated leading to a kernel crash. This patch fixes the issue. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/kernel/amd_iommu_init.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) --- a/arch/x86/kernel/amd_iommu_init.c +++ b/arch/x86/kernel/amd_iommu_init.c @@ -286,8 +286,12 @@ static u8 * __init iommu_map_mmio_space( { u8 *ret; - if (!request_mem_region(address, MMIO_REGION_LENGTH, "amd_iommu")) + if (!request_mem_region(address, MMIO_REGION_LENGTH, "amd_iommu")) { + pr_err("AMD-Vi: Can not reserve memory region %llx for mmio\n", + address); + pr_err("AMD-Vi: This is a BIOS bug. Please contact your hardware vendor\n"); return NULL; + } ret = ioremap_nocache(address, MMIO_REGION_LENGTH); if (ret != NULL) @@ -1313,7 +1317,7 @@ static int __init amd_iommu_init(void) ret = amd_iommu_init_dma_ops(); if (ret) - goto free; + goto free_disable; amd_iommu_init_api(); @@ -1331,9 +1335,10 @@ static int __init amd_iommu_init(void) out: return ret; -free: +free_disable: disable_iommus(); +free: amd_iommu_uninit_devices(); free_pages((unsigned long)amd_iommu_pd_alloc_bitmap, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [091/200] x86/amd-iommu: Fall back to GART if initialization fails 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (88 preceding siblings ...) 2010-07-01 17:43 ` [090/200] x86/amd-iommu: Fix crash when request_mem_region fails Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [092/200] eeepc-wmi: depends on BACKLIGHT_CLASS_DEVICE Greg KH ` (109 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Joerg Roedel 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> commit d7f0776975334070a93370ae048fda0c31a91c38 upstream. This patch implements a fallback to the GART IOMMU if this is possible and the AMD IOMMU initialization failed. Otherwise the fallback would be nommu which is very problematic on machines with more than 4GB of memory or swiotlb which hurts io-performance. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/kernel/amd_iommu.c | 4 ---- arch/x86/kernel/amd_iommu_init.c | 9 +++++++++ 2 files changed, 9 insertions(+), 4 deletions(-) --- a/arch/x86/kernel/amd_iommu.c +++ b/arch/x86/kernel/amd_iommu.c @@ -2257,10 +2257,6 @@ int __init amd_iommu_init_dma_ops(void) iommu_detected = 1; swiotlb = 0; -#ifdef CONFIG_GART_IOMMU - gart_iommu_aperture_disabled = 1; - gart_iommu_aperture = 0; -#endif /* Make the driver finally visible to the drivers */ dma_ops = &amd_iommu_dma_ops; --- a/arch/x86/kernel/amd_iommu_init.c +++ b/arch/x86/kernel/amd_iommu_init.c @@ -1357,6 +1357,15 @@ free: free_unity_maps(); +#ifdef CONFIG_GART_IOMMU + /* + * We failed to initialize the AMD IOMMU - try fallback to GART + * if possible. + */ + gart_iommu_init(); + +#endif + goto out; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [092/200] eeepc-wmi: depends on BACKLIGHT_CLASS_DEVICE 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (89 preceding siblings ...) 2010-07-01 17:43 ` [091/200] x86/amd-iommu: Fall back to GART if initialization fails Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [093/200] clean DCACHE_CANT_MOUNT in d_delete() Greg KH ` (108 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Randy Dunlap 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Randy Dunlap <randy.dunlap@oracle.com> commit 89a7644be2c59eea443b0db2514fd42d5de909f8 upstream. eeepc-wmi uses backlight*() interfaces so it should depend on BACKLIGHT_CLASS_DEVICE. eeepc-wmi.c:(.text+0x2d7f54): undefined reference to `backlight_force_update' eeepc-wmi.c:(.text+0x2d8012): undefined reference to `backlight_device_register' eeepc-wmi.c:(.devinit.text+0x1c31c): undefined reference to `backlight_device_unregister' eeepc-wmi.c:(.devexit.text+0x2f8b): undefined reference to `backlight_device_unregister' Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/platform/x86/Kconfig | 1 + 1 file changed, 1 insertion(+) --- a/drivers/platform/x86/Kconfig +++ b/drivers/platform/x86/Kconfig @@ -390,6 +390,7 @@ config EEEPC_WMI depends on ACPI_WMI depends on INPUT depends on EXPERIMENTAL + depends on BACKLIGHT_CLASS_DEVICE select INPUT_SPARSEKMAP ---help--- Say Y here if you want to support WMI-based hotkeys on Eee PC laptops. ^ permalink raw reply [flat|nested] 666+ messages in thread
* [093/200] clean DCACHE_CANT_MOUNT in d_delete() 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (90 preceding siblings ...) 2010-07-01 17:43 ` [092/200] eeepc-wmi: depends on BACKLIGHT_CLASS_DEVICE Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [094/200] exofs: confusion between kmap() and kmap_atomic() api Greg KH ` (107 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Al Viro 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Al Viro <viro@zeniv.linux.org.uk> commit 13e3c5e5b9c67e59074d24e29f3ff794bb4dfef0 upstream. We set the "it's dead, don't mount on it" flag _and_ do not remove it if we turn the damn thing negative and leave it around. And if it goes positive afterwards, well... Fortunately, there's only one place where that needs to be caught: only d_delete() can turn the sucker negative without immediately freeing it; all other places that can lead to ->d_iput() call are followed by unconditionally freeing struct dentry in question. So the fix is obvious: Addresses https://bugzilla.kernel.org/show_bug.cgi?id=16014 Reported-by: Adam Tkac <vonsch@gmail.com> Tested-by: Adam Tkac <vonsch@gmail.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/dcache.c | 1 + 1 file changed, 1 insertion(+) --- a/fs/dcache.c +++ b/fs/dcache.c @@ -1529,6 +1529,7 @@ void d_delete(struct dentry * dentry) spin_lock(&dentry->d_lock); isdir = S_ISDIR(dentry->d_inode->i_mode); if (atomic_read(&dentry->d_count) == 1) { + dentry->d_flags &= ~DCACHE_CANT_MOUNT; dentry_iput(dentry); fsnotify_nameremove(dentry, isdir); return; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [094/200] exofs: confusion between kmap() and kmap_atomic() api 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (91 preceding siblings ...) 2010-07-01 17:43 ` [093/200] clean DCACHE_CANT_MOUNT in d_delete() Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [095/200] mn10300: set ARCH_KMALLOC_MINALIGN Greg KH ` (106 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dan Carpenter, Boaz Harrosh 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Carpenter <error27@gmail.com> commit ddf08f4b90a413892bbb9bb2e8a57aed991cd47d upstream. For kmap_atomic() we call kunmap_atomic() on the returned pointer. That's different from kmap() and kunmap() and so it's easy to get them backwards. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Boaz Harrosh <bharrosh@panasas.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/exofs/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/exofs/dir.c +++ b/fs/exofs/dir.c @@ -608,7 +608,7 @@ int exofs_make_empty(struct inode *inode de->inode_no = cpu_to_le64(parent->i_ino); memcpy(de->name, PARENT_DIR, sizeof(PARENT_DIR)); exofs_set_de_type(de, inode); - kunmap_atomic(page, KM_USER0); + kunmap_atomic(kaddr, KM_USER0); err = exofs_commit_chunk(page, 0, chunk_size); fail: page_cache_release(page); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [095/200] mn10300: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (92 preceding siblings ...) 2010-07-01 17:43 ` [094/200] exofs: confusion between kmap() and kmap_atomic() api Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [096/200] m68knommu: fix broken use of BUAD_TABLE_SIZE in 68328serial driver Greg KH ` (105 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, David Howells, Koichi Yasutake, Pekka Enberg 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit 6cdafaae41d52e6ef9a5c5be23602ef083e4d0f9 upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Acked-by: David Howells <dhowells@redhat.com> Cc: Koichi Yasutake <yasutake.koichi@jp.panasonic.com> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/mn10300/include/asm/cache.h | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/mn10300/include/asm/cache.h +++ b/arch/mn10300/include/asm/cache.h @@ -21,6 +21,8 @@ #define L1_CACHE_DISPARITY L1_CACHE_NENTRIES * L1_CACHE_BYTES #endif +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES + /* data cache purge registers * - read from the register to unconditionally purge that cache line * - write address & 0xffffff00 to conditionally purge that cache line ^ permalink raw reply [flat|nested] 666+ messages in thread
* [096/200] m68knommu: fix broken use of BUAD_TABLE_SIZE in 68328serial driver 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (93 preceding siblings ...) 2010-07-01 17:43 ` [095/200] mn10300: set ARCH_KMALLOC_MINALIGN Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [097/200] m68k: set ARCH_KMALLOC_MINALIGN Greg KH ` (104 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Greg Ungerer, Thiago Farina 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Greg Ungerer <gerg@snapgear.com> commit e9a137cb00d8b0f71c08a9e67d993f53e7713d21 upstream. Commit 8b505ca8e2600eb9e7dd2d6b2682a81717671374 ("serial: 68328serial.c: remove BAUD_TABLE_SIZE macro") misses one use of BAUD_TABLE_SIZE. So the resulting 68328serial.c does not compile: drivers/serial/68328serial.c: In function `m68328_console_setup': drivers/serial/68328serial.c:1439: error: `BAUD_TABLE_SIZE' undeclared (first use in this function) drivers/serial/68328serial.c:1439: error: (Each undeclared identifier is reported only once drivers/serial/68328serial.c:1439: error: for each function it appears in.) Fix that last use of it. Signed-off-by: Greg Ungerer <gerg@uclinux.org> Cc: Thiago Farina <tfransosi@gmail.com> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/serial/68328serial.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/serial/68328serial.c +++ b/drivers/serial/68328serial.c @@ -1437,7 +1437,7 @@ int m68328_console_setup(struct console for (i = 0; i < ARRAY_SIZE(baud_table); i++) if (baud_table[i] == n) break; - if (i < BAUD_TABLE_SIZE) { + if (i < ARRAY_SIZE(baud_table)) { m68328_console_baud = n; m68328_console_cbaud = 0; if (i > 15) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [097/200] m68k: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (94 preceding siblings ...) 2010-07-01 17:43 ` [096/200] m68knommu: fix broken use of BUAD_TABLE_SIZE in 68328serial driver Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [098/200] rtc-cmos: do dev_set_drvdata() earlier in the initialization Greg KH ` (103 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, Geert Uytterhoeven, Roman Zippel, Pekka Enberg 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit dd6c26a66bdc629a500174ffe73b010b070b9f1b upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Cc: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Roman Zippel <zippel@linux-m68k.org> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/m68k/include/asm/cache.h | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/m68k/include/asm/cache.h +++ b/arch/m68k/include/asm/cache.h @@ -8,4 +8,6 @@ #define L1_CACHE_SHIFT 4 #define L1_CACHE_BYTES (1<< L1_CACHE_SHIFT) +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES + #endif ^ permalink raw reply [flat|nested] 666+ messages in thread
* [098/200] rtc-cmos: do dev_set_drvdata() earlier in the initialization 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (95 preceding siblings ...) 2010-07-01 17:43 ` [097/200] m68k: set ARCH_KMALLOC_MINALIGN Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [099/200] rtc: s3c: initialize driver data before using it Greg KH ` (102 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dan Carpenter, Alessandro Zummo, Paul Gortmaker, Malte Schroder, Ralf Baechle, Herton Ronaldo Krzesinski 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Carpenter <error27@gmail.com> commit 6ba8bcd457d9fc793ac9435aa2e4138f571d4ec5 upstream. The bug is an oops when dev_get_drvdata() returned null in cmos_update_irq_enable(). The call tree looks like this: rtc_dev_ioctl() => rtc_update_irq_enable() => cmos_update_irq_enable() It's caused by a race condition in the module initialization. It is rtc_device_register() which makes the ioctl operations live so I moved the call to dev_set_drvdata() before the call to rtc_device_register(). Addresses https://bugzilla.kernel.org/show_bug.cgi?id=15963 Reported-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Dan Carpenter <error27@gmail.com> Tested-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: Alessandro Zummo <a.zummo@towertech.it> Cc: Paul Gortmaker <p_gortmaker@yahoo.com> Cc: Malte Schroder <maltesch@gmx.de> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Herton Ronaldo Krzesinski <herton@mandriva.com.br> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/rtc/rtc-cmos.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/rtc/rtc-cmos.c +++ b/drivers/rtc/rtc-cmos.c @@ -719,6 +719,9 @@ cmos_do_probe(struct device *dev, struct } } + cmos_rtc.dev = dev; + dev_set_drvdata(dev, &cmos_rtc); + cmos_rtc.rtc = rtc_device_register(driver_name, dev, &cmos_rtc_ops, THIS_MODULE); if (IS_ERR(cmos_rtc.rtc)) { @@ -726,8 +729,6 @@ cmos_do_probe(struct device *dev, struct goto cleanup0; } - cmos_rtc.dev = dev; - dev_set_drvdata(dev, &cmos_rtc); rename_region(ports, dev_name(&cmos_rtc.rtc->dev)); spin_lock_irq(&rtc_lock); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [099/200] rtc: s3c: initialize driver data before using it 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (96 preceding siblings ...) 2010-07-01 17:43 ` [098/200] rtc-cmos: do dev_set_drvdata() earlier in the initialization Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [100/200] frv: set ARCH_KMALLOC_MINALIGN Greg KH ` (101 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Maurus Cuelenaere, Paul Gortmaker, Alessandro Zummo 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Maurus Cuelenaere <mcuelenaere@gmail.com> commit e893de59a4982791368b3ce412bc67dd601a88a0 upstream. s3c_rtc_setfreq() uses the platform driver data to derive struct rtc_device, so make sure drvdata is set _before_ s3c_rtc_setfreq() is called. Signed-off-by: Maurus Cuelenaere <mcuelenaere@gmail.com> Cc: Paul Gortmaker <p_gortmaker@yahoo.com> Cc: Alessandro Zummo <a.zummo@towertech.it> Cc: Maurus Cuelenaere <mcuelenaere@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/rtc/rtc-s3c.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/rtc/rtc-s3c.c +++ b/drivers/rtc/rtc-s3c.c @@ -457,8 +457,6 @@ static int __devinit s3c_rtc_probe(struc pr_debug("s3c2410_rtc: RTCCON=%02x\n", readb(s3c_rtc_base + S3C2410_RTCCON)); - s3c_rtc_setfreq(&pdev->dev, 1); - device_init_wakeup(&pdev->dev, 1); /* register RTC and exit */ @@ -475,6 +473,9 @@ static int __devinit s3c_rtc_probe(struc rtc->max_user_freq = 128; platform_set_drvdata(pdev, rtc); + + s3c_rtc_setfreq(&pdev->dev, 1); + return 0; err_nortc: ^ permalink raw reply [flat|nested] 666+ messages in thread
* [100/200] frv: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (97 preceding siblings ...) 2010-07-01 17:43 ` [099/200] rtc: s3c: initialize driver data before using it Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [101/200] xtensa: " Greg KH ` (100 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, David Howells, Pekka Enberg 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit 69dcf3db03626c4f18de624e8632454ea12ff260 upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Acked-by: David Howells <dhowells@redhat.com> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/frv/include/asm/cache.h | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/frv/include/asm/cache.h +++ b/arch/frv/include/asm/cache.h @@ -17,6 +17,8 @@ #define L1_CACHE_SHIFT (CONFIG_FRV_L1_CACHE_SHIFT) #define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT) +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES + #define __cacheline_aligned __attribute__((aligned(L1_CACHE_BYTES))) #define ____cacheline_aligned __attribute__((aligned(L1_CACHE_BYTES))) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [101/200] xtensa: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (98 preceding siblings ...) 2010-07-01 17:43 ` [100/200] frv: set ARCH_KMALLOC_MINALIGN Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [102/200] Blackfin: " Greg KH ` (99 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, Chris Zankel, Pekka Enberg 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit 498900fc9cd1adbad1ba6b55ed9d8f2f5d655ca3 upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Cc: Chris Zankel <chris@zankel.net> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/xtensa/include/asm/cache.h | 1 + 1 file changed, 1 insertion(+) --- a/arch/xtensa/include/asm/cache.h +++ b/arch/xtensa/include/asm/cache.h @@ -29,5 +29,6 @@ # define CACHE_WAY_SIZE ICACHE_WAY_SIZE #endif +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES #endif /* _XTENSA_CACHE_H */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [102/200] Blackfin: set ARCH_KMALLOC_MINALIGN 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (99 preceding siblings ...) 2010-07-01 17:43 ` [101/200] xtensa: " Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [103/200] tmpfs: insert tmpfs cache pages to inactive list at first Greg KH ` (98 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, FUJITA Tomonori, Pekka Enberg, Mike Frysinger 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> commit 76b99699a2bbf9efdb578f9a38a202af2ecb354b upstream. Architectures that handle DMA-non-coherent memory need to set ARCH_KMALLOC_MINALIGN to make sure that kmalloc'ed buffer is DMA-safe: the buffer doesn't share a cache with the others. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Acked-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/blackfin/include/asm/cache.h | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/blackfin/include/asm/cache.h +++ b/arch/blackfin/include/asm/cache.h @@ -15,6 +15,8 @@ #define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT) #define SMP_CACHE_BYTES L1_CACHE_BYTES +#define ARCH_KMALLOC_MINALIGN L1_CACHE_BYTES + #ifdef CONFIG_SMP #define __cacheline_aligned #else ^ permalink raw reply [flat|nested] 666+ messages in thread
* [103/200] tmpfs: insert tmpfs cache pages to inactive list at first 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (100 preceding siblings ...) 2010-07-01 17:43 ` [102/200] Blackfin: " Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [104/200] md: manage redundancy group in sysfs when changing level Greg KH ` (97 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, KOSAKI Motohiro, Hugh Dickins, Henrique de Moraes Holschuh 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> commit e9d6c157385e4efa61cb8293e425c9d8beba70d3 upstream. Shaohua Li reported parallel file copy on tmpfs can lead to OOM killer. This is regression of caused by commit 9ff473b9a7 ("vmscan: evict streaming IO first"). Wow, It is 2 years old patch! Currently, tmpfs file cache is inserted active list at first. This means that the insertion doesn't only increase numbers of pages in anon LRU, but it also reduces anon scanning ratio. Therefore, vmscan will get totally confused. It scans almost only file LRU even though the system has plenty unused tmpfs pages. Historically, lru_cache_add_active_anon() was used for two reasons. 1) Intend to priotize shmem page rather than regular file cache. 2) Intend to avoid reclaim priority inversion of used once pages. But we've lost both motivation because (1) Now we have separate anon and file LRU list. then, to insert active list doesn't help such priotize. (2) In past, one pte access bit will cause page activation. then to insert inactive list with pte access bit mean higher priority than to insert active list. Its priority inversion may lead to uninteded lru chun. but it was already solved by commit 645747462 (vmscan: detect mapped file pages used only once). (Thanks Hannes, you are great!) Thus, now we can use lru_cache_add_anon() instead. Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Reported-by: Shaohua Li <shaohua.li@intel.com> Reviewed-by: Wu Fengguang <fengguang.wu@intel.com> Reviewed-by: Johannes Weiner <hannes@cmpxchg.org> Reviewed-by: Rik van Riel <riel@redhat.com> Reviewed-by: Minchan Kim <minchan.kim@gmail.com> Acked-by: Hugh Dickins <hughd@google.com> Cc: Henrique de Moraes Holschuh <hmh@hmh.eng.br> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- include/linux/swap.h | 10 ---------- mm/filemap.c | 4 ++-- 2 files changed, 2 insertions(+), 12 deletions(-) --- a/include/linux/swap.h +++ b/include/linux/swap.h @@ -223,21 +223,11 @@ static inline void lru_cache_add_anon(st __lru_cache_add(page, LRU_INACTIVE_ANON); } -static inline void lru_cache_add_active_anon(struct page *page) -{ - __lru_cache_add(page, LRU_ACTIVE_ANON); -} - static inline void lru_cache_add_file(struct page *page) { __lru_cache_add(page, LRU_INACTIVE_FILE); } -static inline void lru_cache_add_active_file(struct page *page) -{ - __lru_cache_add(page, LRU_ACTIVE_FILE); -} - /* linux/mm/vmscan.c */ extern unsigned long try_to_free_pages(struct zonelist *zonelist, int order, gfp_t gfp_mask, nodemask_t *mask); --- a/mm/filemap.c +++ b/mm/filemap.c @@ -441,7 +441,7 @@ int add_to_page_cache_lru(struct page *p /* * Splice_read and readahead add shmem/tmpfs pages into the page cache * before shmem_readpage has a chance to mark them as SwapBacked: they - * need to go on the active_anon lru below, and mem_cgroup_cache_charge + * need to go on the anon lru below, and mem_cgroup_cache_charge * (called in add_to_page_cache) needs to know where they're going too. */ if (mapping_cap_swap_backed(mapping)) @@ -452,7 +452,7 @@ int add_to_page_cache_lru(struct page *p if (page_is_file_cache(page)) lru_cache_add_file(page); else - lru_cache_add_active_anon(page); + lru_cache_add_anon(page); } return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [104/200] md: manage redundancy group in sysfs when changing level. 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (101 preceding siblings ...) 2010-07-01 17:43 ` [103/200] tmpfs: insert tmpfs cache pages to inactive list at first Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [105/200] mlx4_core: Fix possible chunk sg list overflow in mlx4_alloc_icm() Greg KH ` (96 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, NeilBrown 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: NeilBrown <neilb@suse.de> commit a64c876fd357906a1f7193723866562ad290654c upstream. Some levels expect the 'redundancy group' to be present, others don't. So when we change level of an array we might need to add or remove this group. This requires fixing up the current practice of overloading ->private to indicate (when ->pers == NULL) that something needs to be removed. So create a new ->to_remove to fill that role. When changing levels, we may need to add or remove attributes. When changing RAID5 -> RAID6, we both add and remove the same thing. It is important to catch this and optimise it out as the removal is delayed until a lock is released, so trying to add immediately would cause problems. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/md/md.c | 43 ++++++++++++++++++++++++++++++++----------- drivers/md/md.h | 1 + drivers/md/raid5.c | 7 +++++-- 3 files changed, 38 insertions(+), 13 deletions(-) --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -510,9 +510,9 @@ static inline int mddev_trylock(mddev_t static struct attribute_group md_redundancy_group; -static inline void mddev_unlock(mddev_t * mddev) +static void mddev_unlock(mddev_t * mddev) { - if (mddev->pers == NULL && mddev->private) { + if (mddev->to_remove) { /* These cannot be removed under reconfig_mutex as * an access to the files will try to take reconfig_mutex * while holding the file unremovable, which leads to @@ -521,16 +521,20 @@ static inline void mddev_unlock(mddev_t * it while holding reconfig_mutex, and md_run can * use it to wait for the remove to complete. */ + struct attribute_group *to_remove = mddev->to_remove; + mddev->to_remove = NULL; mutex_lock(&mddev->open_mutex); mutex_unlock(&mddev->reconfig_mutex); - sysfs_remove_group(&mddev->kobj, &md_redundancy_group); - if (mddev->private != (void*)1) - sysfs_remove_group(&mddev->kobj, mddev->private); - if (mddev->sysfs_action) - sysfs_put(mddev->sysfs_action); - mddev->sysfs_action = NULL; - mddev->private = NULL; + if (to_remove != &md_redundancy_group) + sysfs_remove_group(&mddev->kobj, to_remove); + if (mddev->pers == NULL || + mddev->pers->sync_request == NULL) { + sysfs_remove_group(&mddev->kobj, &md_redundancy_group); + if (mddev->sysfs_action) + sysfs_put(mddev->sysfs_action); + mddev->sysfs_action = NULL; + } mutex_unlock(&mddev->open_mutex); } else mutex_unlock(&mddev->reconfig_mutex); @@ -3003,6 +3007,23 @@ level_store(mddev_t *mddev, const char * /* Looks like we have a winner */ mddev_suspend(mddev); mddev->pers->stop(mddev); + + if (mddev->pers->sync_request == NULL && + pers->sync_request != NULL) { + /* need to add the md_redundancy_group */ + if (sysfs_create_group(&mddev->kobj, &md_redundancy_group)) + printk(KERN_WARNING + "md: cannot register extra attributes for %s\n", + mdname(mddev)); + mddev->sysfs_action = sysfs_get_dirent(mddev->kobj.sd, "sync_action"); + } + if (mddev->pers->sync_request != NULL && + pers->sync_request == NULL) { + /* need to remove the md_redundancy_group */ + if (mddev->to_remove == NULL) + mddev->to_remove = &md_redundancy_group; + } + module_put(mddev->pers->owner); /* Invalidate devices that are now superfluous */ list_for_each_entry(rdev, &mddev->disks, same_set) @@ -4557,8 +4578,8 @@ static int do_md_stop(mddev_t * mddev, i mddev->queue->unplug_fn = NULL; mddev->queue->backing_dev_info.congested_fn = NULL; module_put(mddev->pers->owner); - if (mddev->pers->sync_request && mddev->private == NULL) - mddev->private = (void*)1; + if (mddev->pers->sync_request && mddev->to_remove == NULL) + mddev->to_remove = &md_redundancy_group; mddev->pers = NULL; /* tell userspace to handle 'inactive' */ sysfs_notify_dirent(mddev->sysfs_state); --- a/drivers/md/md.h +++ b/drivers/md/md.h @@ -305,6 +305,7 @@ struct mddev_s atomic_t max_corr_read_errors; /* max read retries */ struct list_head all_mddevs; + struct attribute_group *to_remove; /* Generic barrier handling. * If there is a pending barrier request, all other * writes are blocked while the devices are flushed. --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -5087,7 +5087,9 @@ static int run(mddev_t *mddev) } /* Ok, everything is just fine now */ - if (sysfs_create_group(&mddev->kobj, &raid5_attrs_group)) + if (mddev->to_remove == &raid5_attrs_group) + mddev->to_remove = NULL; + else if (sysfs_create_group(&mddev->kobj, &raid5_attrs_group)) printk(KERN_WARNING "raid5: failed to create sysfs attributes for %s\n", mdname(mddev)); @@ -5134,7 +5136,8 @@ static int stop(mddev_t *mddev) mddev->queue->backing_dev_info.congested_fn = NULL; blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/ free_conf(conf); - mddev->private = &raid5_attrs_group; + mddev->private = NULL; + mddev->to_remove = &raid5_attrs_group; return 0; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [105/200] mlx4_core: Fix possible chunk sg list overflow in mlx4_alloc_icm() 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (102 preceding siblings ...) 2010-07-01 17:43 ` [104/200] md: manage redundancy group in sysfs when changing level Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [106/200] ARM: 6139/1: ARMv7: Use the Inner Shareable I-cache on MP Greg KH ` (95 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Sebastien Dugue, Roland Dreier 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sebastien Dugue <sebastien.dugue@bull.net> commit c0dc72bad9cf21071f5e4005de46f7c8b67a138a upstream. If the number of sg entries in the ICM chunk reaches MLX4_ICM_CHUNK_LEN, we must set chunk to NULL even for coherent mappings so that the next time through the loop will allocate another chunk. Otherwise we'll overflow the sg list the next time through the loop. This will lead to memory corruption if this case is hit. mthca does not have this bug. Signed-off-by: Sebastien Dugue <sebastien.dugue@bull.net> Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/mlx4/icm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/mlx4/icm.c +++ b/drivers/net/mlx4/icm.c @@ -175,9 +175,10 @@ struct mlx4_icm *mlx4_alloc_icm(struct m if (chunk->nsg <= 0) goto fail; + } + if (chunk->npages == MLX4_ICM_CHUNK_LEN) chunk = NULL; - } npages -= 1 << cur_order; } else { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [106/200] ARM: 6139/1: ARMv7: Use the Inner Shareable I-cache on MP 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (103 preceding siblings ...) 2010-07-01 17:43 ` [105/200] mlx4_core: Fix possible chunk sg list overflow in mlx4_alloc_icm() Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [107/200] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 Greg KH ` (94 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Santosh Shilimkar, Catalin Marinas, Russell King 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Santosh Shilimkar <santosh.shilimkar@ti.com> commit a901ff715d53c109821cbbd9d7ea1f2a311646a9 upstream. This patch fixes the flush_cache_all for ARMv7 SMP.It was missing from commit b8349b569aae661dea9d59d7d2ee587ccea3336c Signed-off-by: Santosh Shilimkar <santosh.shilimkar@ti.com> Acked-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S index 06a90dc..37c8157 100644 --- a/arch/arm/mm/cache-v7.S +++ b/arch/arm/mm/cache-v7.S @@ -91,7 +91,11 @@ ENTRY(v7_flush_kern_cache_all) THUMB( stmfd sp!, {r4-r7, r9-r11, lr} ) bl v7_flush_dcache_all mov r0, #0 +#ifdef CONFIG_SMP + mcr p15, 0, r0, c7, c1, 0 @ invalidate I-cache inner shareable +#else mcr p15, 0, r0, c7, c5, 0 @ I+BTB cache invalidate +#endif ARM( ldmfd sp!, {r4-r5, r7, r9-r11, lr} ) THUMB( ldmfd sp!, {r4-r7, r9-r11, lr} ) mov pc, lr ^ permalink raw reply related [flat|nested] 666+ messages in thread
* [107/200] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (104 preceding siblings ...) 2010-07-01 17:43 ` [106/200] ARM: 6139/1: ARMv7: Use the Inner Shareable I-cache on MP Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [108/200] ARM: 6164/1: Add kto and kfrom to input operands list Greg KH ` (93 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Anfei Zhou, Russell King 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Anfei <anfei.zhou@gmail.com> commit 5e27fb78df95e027723af2c90ecc9b4527ae59e9 upstream. Instruction faults on pre-ARMv6 CPUs are interpreted as a 'translation fault', but do_translation_fault doesn't handle well if user mode trying to run instruction above TASK_SIZE, and result in the infinite retry of that instruction. Signed-off-by: Anfei Zhou <anfei.zhou@gmail.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/mm/fault.c | 3 +++ 1 file changed, 3 insertions(+) --- a/arch/arm/mm/fault.c +++ b/arch/arm/mm/fault.c @@ -393,6 +393,9 @@ do_translation_fault(unsigned long addr, if (addr < TASK_SIZE) return do_page_fault(addr, fsr, regs); + if (user_mode(regs)) + goto bad_area; + index = pgd_index(addr); /* ^ permalink raw reply [flat|nested] 666+ messages in thread
* [108/200] ARM: 6164/1: Add kto and kfrom to input operands list. 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (105 preceding siblings ...) 2010-07-01 17:43 ` [107/200] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [109/200] ARM: 6146/1: sa1111: Prevent deadlock in resume path Greg KH ` (92 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Khem Raj, Russell King 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Khem Raj <raj.khem@gmail.com> commit 9a40ac86152c9cffd3dca482a15ddf9a8c5716b3 upstream. When functions incoming parameters are not in input operands list gcc 4.5 does not load the parameters into registers before calling this function but the inline assembly assumes valid addresses inside this function. This breaks the code because r0 and r1 are invalid when execution enters v4wb_copy_user_page () Also the constant needs to be used as third input operand so account for that as well. Tested on qemu arm. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/mm/copypage-feroceon.c | 4 ++-- arch/arm/mm/copypage-v4wb.c | 4 ++-- arch/arm/mm/copypage-v4wt.c | 4 ++-- arch/arm/mm/copypage-xsc3.c | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) --- a/arch/arm/mm/copypage-feroceon.c +++ b/arch/arm/mm/copypage-feroceon.c @@ -18,7 +18,7 @@ feroceon_copy_user_page(void *kto, const { asm("\ stmfd sp!, {r4-r9, lr} \n\ - mov ip, %0 \n\ + mov ip, %2 \n\ 1: mov lr, r1 \n\ ldmia r1!, {r2 - r9} \n\ pld [lr, #32] \n\ @@ -64,7 +64,7 @@ feroceon_copy_user_page(void *kto, const mcr p15, 0, ip, c7, c10, 4 @ drain WB\n\ ldmfd sp!, {r4-r9, pc}" : - : "I" (PAGE_SIZE)); + : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE)); } void feroceon_copy_user_highpage(struct page *to, struct page *from, --- a/arch/arm/mm/copypage-v4wb.c +++ b/arch/arm/mm/copypage-v4wb.c @@ -27,7 +27,7 @@ v4wb_copy_user_page(void *kto, const voi { asm("\ stmfd sp!, {r4, lr} @ 2\n\ - mov r2, %0 @ 1\n\ + mov r2, %2 @ 1\n\ ldmia r1!, {r3, r4, ip, lr} @ 4\n\ 1: mcr p15, 0, r0, c7, c6, 1 @ 1 invalidate D line\n\ stmia r0!, {r3, r4, ip, lr} @ 4\n\ @@ -44,7 +44,7 @@ v4wb_copy_user_page(void *kto, const voi mcr p15, 0, r1, c7, c10, 4 @ 1 drain WB\n\ ldmfd sp!, {r4, pc} @ 3" : - : "I" (PAGE_SIZE / 64)); + : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64)); } void v4wb_copy_user_highpage(struct page *to, struct page *from, --- a/arch/arm/mm/copypage-v4wt.c +++ b/arch/arm/mm/copypage-v4wt.c @@ -25,7 +25,7 @@ v4wt_copy_user_page(void *kto, const voi { asm("\ stmfd sp!, {r4, lr} @ 2\n\ - mov r2, %0 @ 1\n\ + mov r2, %2 @ 1\n\ ldmia r1!, {r3, r4, ip, lr} @ 4\n\ 1: stmia r0!, {r3, r4, ip, lr} @ 4\n\ ldmia r1!, {r3, r4, ip, lr} @ 4+1\n\ @@ -40,7 +40,7 @@ v4wt_copy_user_page(void *kto, const voi mcr p15, 0, r2, c7, c7, 0 @ flush ID cache\n\ ldmfd sp!, {r4, pc} @ 3" : - : "I" (PAGE_SIZE / 64)); + : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64)); } void v4wt_copy_user_highpage(struct page *to, struct page *from, --- a/arch/arm/mm/copypage-xsc3.c +++ b/arch/arm/mm/copypage-xsc3.c @@ -34,7 +34,7 @@ xsc3_mc_copy_user_page(void *kto, const { asm("\ stmfd sp!, {r4, r5, lr} \n\ - mov lr, %0 \n\ + mov lr, %2 \n\ \n\ pld [r1, #0] \n\ pld [r1, #32] \n\ @@ -67,7 +67,7 @@ xsc3_mc_copy_user_page(void *kto, const \n\ ldmfd sp!, {r4, r5, pc}" : - : "I" (PAGE_SIZE / 64 - 1)); + : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64 - 1)); } void xsc3_mc_copy_user_highpage(struct page *to, struct page *from, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [109/200] ARM: 6146/1: sa1111: Prevent deadlock in resume path 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (106 preceding siblings ...) 2010-07-01 17:43 ` [108/200] ARM: 6164/1: Add kto and kfrom to input operands list Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [110/200] ARM: 6144/1: TCM memory bug freeing bug Greg KH ` (91 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Marek Vasut, Russell King 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: =?UTF-8?q?Marek=20Va=C5=A1ut?= <marek.vasut@gmail.com> commit 3defb2476166445982a90c12d33f8947e75476c4 upstream. This patch reorganises the sa1111_resume() function in a manner the spinlock happens after calling the sa1111_wake(). This fixes two bugs: 1) This function called sa1111_wake() which tried to claim the same spinlock the sa1111_resume() already claimed. This would result in certain deadlock. Original idea for this part: Russell King <rmk+kernel@arm.linux.org.uk> 2) The function didn't unlock the spinlock in case the chip didn't report correct ID. Original idea for this part: Julia Lawall <julia@diku.dk> Signed-off-by: Marek Vasut <marek.vasut@gmail.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/common/sa1111.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/arch/arm/common/sa1111.c +++ b/arch/arm/common/sa1111.c @@ -951,8 +951,6 @@ static int sa1111_resume(struct platform if (!save) return 0; - spin_lock_irqsave(&sachip->lock, flags); - /* * Ensure that the SA1111 is still here. * FIXME: shouldn't do this here. @@ -969,6 +967,13 @@ static int sa1111_resume(struct platform * First of all, wake up the chip. */ sa1111_wake(sachip); + + /* + * Only lock for write ops. Also, sa1111_wake must be called with + * released spinlock! + */ + spin_lock_irqsave(&sachip->lock, flags); + sa1111_writel(0, sachip->base + SA1111_INTC + SA1111_INTEN0); sa1111_writel(0, sachip->base + SA1111_INTC + SA1111_INTEN1); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [110/200] ARM: 6144/1: TCM memory bug freeing bug 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (107 preceding siblings ...) 2010-07-01 17:43 ` [109/200] ARM: 6146/1: sa1111: Prevent deadlock in resume path Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [111/200] ARM: VFP: Fix vfp_put_double() for d16-d31 Greg KH ` (90 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Linus Walleij, Russell King 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Linus Walleij <linus.walleij@stericsson.com> commit ea208f646c8fb91c39c852e952fc911e1ad045ab upstream. This fixes a bug in mm/init.c when freeing the TCM compile memory, this was being referred to as a char * which is incorrect: this will dereference the pointer and feed in the value at the location instead of the address to it. Change it to a plain char and use &(char) to reference it. Signed-off-by: Linus Walleij <linus.walleij@stericsson.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/mm/init.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/arch/arm/mm/init.c +++ b/arch/arm/mm/init.c @@ -712,10 +712,10 @@ void __init mem_init(void) void free_initmem(void) { #ifdef CONFIG_HAVE_TCM - extern char *__tcm_start, *__tcm_end; + extern char __tcm_start, __tcm_end; - totalram_pages += free_area(__phys_to_pfn(__pa(__tcm_start)), - __phys_to_pfn(__pa(__tcm_end)), + totalram_pages += free_area(__phys_to_pfn(__pa(&__tcm_start)), + __phys_to_pfn(__pa(&__tcm_end)), "TCM link"); #endif ^ permalink raw reply [flat|nested] 666+ messages in thread
* [111/200] ARM: VFP: Fix vfp_put_double() for d16-d31 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (108 preceding siblings ...) 2010-07-01 17:43 ` [110/200] ARM: 6144/1: TCM memory bug freeing bug Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [112/200] aio: fix the compat vectored operations Greg KH ` (89 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Russell King 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Russell King <rmk+kernel@arm.linux.org.uk> commit 138de1c44a8e0606501cd8593407e9248e84f1b7 upstream. vfp_put_double() takes the double value in r0,r1 not r1,r2. Reported-by: Tarun Kanti DebBarma <tarun.kanti@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/arm/vfp/vfphw.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/arm/vfp/vfphw.S +++ b/arch/arm/vfp/vfphw.S @@ -277,7 +277,7 @@ ENTRY(vfp_put_double) #ifdef CONFIG_VFPv3 @ d16 - d31 registers .irp dr,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 -1: mcrr p11, 3, r1, r2, c\dr @ fmdrr r1, r2, d\dr +1: mcrr p11, 3, r0, r1, c\dr @ fmdrr r0, r1, d\dr mov pc, lr .org 1b + 8 .endr ^ permalink raw reply [flat|nested] 666+ messages in thread
* [112/200] aio: fix the compat vectored operations 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (109 preceding siblings ...) 2010-07-01 17:43 ` [111/200] ARM: VFP: Fix vfp_put_double() for d16-d31 Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [113/200] idr: fix backtrack logic in idr_remove_all Greg KH ` (88 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jeff Moyer, Zach Brown 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jeff Moyer <jmoyer@redhat.com> commit 9d85cba718efeef9ca00ce3f7f34f5880737aa9b upstream. The aio compat code was not converting the struct iovecs from 32bit to 64bit pointers, causing either EINVAL to be returned from io_getevents, or EFAULT as the result of the I/O. This patch passes a compat flag to io_submit to signal that pointer conversion is necessary for a given iocb array. A variant of this was tested by Michael Tokarev. I have also updated the libaio test harness to exercise this code path with good success. Further, I grabbed a copy of ltp and ran the testcases/kernel/syscall/readv and writev tests there (compiled with -m32 on my 64bit system). All seems happy, but extra eyes on this would be welcome. [akpm@linux-foundation.org: coding-style fixes] [akpm@linux-foundation.org: fix CONFIG_COMPAT=n build] Signed-off-by: Jeff Moyer <jmoyer@redhat.com> Reported-by: Michael Tokarev <mjt@tls.msk.ru> Cc: Zach Brown <zach.brown@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/aio.c | 65 ++++++++++++++++++++++++++++++++-------------------- fs/compat.c | 2 - include/linux/aio.h | 5 ++++ 3 files changed, 47 insertions(+), 25 deletions(-) --- a/fs/aio.c +++ b/fs/aio.c @@ -36,6 +36,7 @@ #include <linux/blkdev.h> #include <linux/mempool.h> #include <linux/hash.h> +#include <linux/compat.h> #include <asm/kmap_types.h> #include <asm/uaccess.h> @@ -1384,13 +1385,22 @@ static ssize_t aio_fsync(struct kiocb *i return ret; } -static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb) +static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat) { ssize_t ret; - ret = rw_copy_check_uvector(type, (struct iovec __user *)kiocb->ki_buf, - kiocb->ki_nbytes, 1, - &kiocb->ki_inline_vec, &kiocb->ki_iovec); +#ifdef CONFIG_COMPAT + if (compat) + ret = compat_rw_copy_check_uvector(type, + (struct compat_iovec __user *)kiocb->ki_buf, + kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec, + &kiocb->ki_iovec); + else +#endif + ret = rw_copy_check_uvector(type, + (struct iovec __user *)kiocb->ki_buf, + kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec, + &kiocb->ki_iovec); if (ret < 0) goto out; @@ -1420,7 +1430,7 @@ static ssize_t aio_setup_single_vector(s * Performs the initial checks and aio retry method * setup for the kiocb at the time of io submission. */ -static ssize_t aio_setup_iocb(struct kiocb *kiocb) +static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat) { struct file *file = kiocb->ki_filp; ssize_t ret = 0; @@ -1469,7 +1479,7 @@ static ssize_t aio_setup_iocb(struct kio ret = security_file_permission(file, MAY_READ); if (unlikely(ret)) break; - ret = aio_setup_vectored_rw(READ, kiocb); + ret = aio_setup_vectored_rw(READ, kiocb, compat); if (ret) break; ret = -EINVAL; @@ -1483,7 +1493,7 @@ static ssize_t aio_setup_iocb(struct kio ret = security_file_permission(file, MAY_WRITE); if (unlikely(ret)) break; - ret = aio_setup_vectored_rw(WRITE, kiocb); + ret = aio_setup_vectored_rw(WRITE, kiocb, compat); if (ret) break; ret = -EINVAL; @@ -1548,7 +1558,8 @@ static void aio_batch_free(struct hlist_ } static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb, - struct iocb *iocb, struct hlist_head *batch_hash) + struct iocb *iocb, struct hlist_head *batch_hash, + bool compat) { struct kiocb *req; struct file *file; @@ -1609,7 +1620,7 @@ static int io_submit_one(struct kioctx * req->ki_left = req->ki_nbytes = iocb->aio_nbytes; req->ki_opcode = iocb->aio_lio_opcode; - ret = aio_setup_iocb(req); + ret = aio_setup_iocb(req, compat); if (ret) goto out_put_req; @@ -1637,20 +1648,8 @@ out_put_req: return ret; } -/* sys_io_submit: - * Queue the nr iocbs pointed to by iocbpp for processing. Returns - * the number of iocbs queued. May return -EINVAL if the aio_context - * specified by ctx_id is invalid, if nr is < 0, if the iocb at - * *iocbpp[0] is not properly initialized, if the operation specified - * is invalid for the file descriptor in the iocb. May fail with - * -EFAULT if any of the data structures point to invalid data. May - * fail with -EBADF if the file descriptor specified in the first - * iocb is invalid. May fail with -EAGAIN if insufficient resources - * are available to queue any iocbs. Will return 0 if nr is 0. Will - * fail with -ENOSYS if not implemented. - */ -SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr, - struct iocb __user * __user *, iocbpp) +long do_io_submit(aio_context_t ctx_id, long nr, + struct iocb __user *__user *iocbpp, bool compat) { struct kioctx *ctx; long ret = 0; @@ -1687,7 +1686,7 @@ SYSCALL_DEFINE3(io_submit, aio_context_t break; } - ret = io_submit_one(ctx, user_iocb, &tmp, batch_hash); + ret = io_submit_one(ctx, user_iocb, &tmp, batch_hash, compat); if (ret) break; } @@ -1697,6 +1696,24 @@ SYSCALL_DEFINE3(io_submit, aio_context_t return i ? i : ret; } +/* sys_io_submit: + * Queue the nr iocbs pointed to by iocbpp for processing. Returns + * the number of iocbs queued. May return -EINVAL if the aio_context + * specified by ctx_id is invalid, if nr is < 0, if the iocb at + * *iocbpp[0] is not properly initialized, if the operation specified + * is invalid for the file descriptor in the iocb. May fail with + * -EFAULT if any of the data structures point to invalid data. May + * fail with -EBADF if the file descriptor specified in the first + * iocb is invalid. May fail with -EAGAIN if insufficient resources + * are available to queue any iocbs. Will return 0 if nr is 0. Will + * fail with -ENOSYS if not implemented. + */ +SYSCALL_DEFINE3(io_submit, aio_context_t, ctx_id, long, nr, + struct iocb __user * __user *, iocbpp) +{ + return do_io_submit(ctx_id, nr, iocbpp, 0); +} + /* lookup_kiocb * Finds a given iocb for cancellation. */ --- a/fs/compat.c +++ b/fs/compat.c @@ -600,7 +600,7 @@ compat_sys_io_submit(aio_context_t ctx_i iocb64 = compat_alloc_user_space(nr * sizeof(*iocb64)); ret = copy_iocb(nr, iocb, iocb64); if (!ret) - ret = sys_io_submit(ctx_id, nr, iocb64); + ret = do_io_submit(ctx_id, nr, iocb64, 1); return ret; } --- a/include/linux/aio.h +++ b/include/linux/aio.h @@ -212,6 +212,8 @@ extern void kick_iocb(struct kiocb *iocb extern int aio_complete(struct kiocb *iocb, long res, long res2); struct mm_struct; extern void exit_aio(struct mm_struct *mm); +extern long do_io_submit(aio_context_t ctx_id, long nr, + struct iocb __user *__user *iocbpp, bool compat); #else static inline ssize_t wait_on_sync_kiocb(struct kiocb *iocb) { return 0; } static inline int aio_put_req(struct kiocb *iocb) { return 0; } @@ -219,6 +221,9 @@ static inline void kick_iocb(struct kioc static inline int aio_complete(struct kiocb *iocb, long res, long res2) { return 0; } struct mm_struct; static inline void exit_aio(struct mm_struct *mm) { } +static inline long do_io_submit(aio_context_t ctx_id, long nr, + struct iocb __user * __user *iocbpp, + bool compat) { return 0; } #endif /* CONFIG_AIO */ static inline struct kiocb *list_kiocb(struct list_head *h) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [113/200] idr: fix backtrack logic in idr_remove_all 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (110 preceding siblings ...) 2010-07-01 17:43 ` [112/200] aio: fix the compat vectored operations Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [114/200] ASoC: Update Freescale i.MX SSI driver DMA parameter handling Greg KH ` (87 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Imre Deak, Eric Paris, Paul E. McKenney 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Imre Deak <imre.deak@nokia.com> commit 2dcb22b346be7b7b7e630a8970d69cf3f1111ec1 upstream. Currently idr_remove_all will fail with a use after free error if idr::layers is bigger than 2, which on 32 bit systems corresponds to items more than 1024. This is due to stepping back too many levels during backtracking. For simplicity let's assume that IDR_BITS=1 -> we have 2 nodes at each level below the root node and each leaf node stores two IDs. (In reality for 32 bit systems IDR_BITS=5, with 32 nodes at each sub-root level and 32 IDs in each leaf node). The sequence of freeing the nodes at the moment is as follows: layer 1 -> a(7) 2 -> b(3) c(5) 3 -> d(1) e(2) f(4) g(6) Until step 4 things go fine, but then node c is freed, whereas node g should be freed first. Since node c contains the pointer to node g we'll have a use after free error at step 6. How many levels we step back after visiting the leaf nodes is currently determined by the msb of the id we are currently visiting: Step 1. node d with IDs 0,1 is freed, current ID is advanced to 2. msb of the current ID bit 1. This means we need to step back 1 level to node b and take the next sibling, node e. 2-3. node e with IDs 2,3 is freed, current ID is 4, msb is bit 2. This means we need to step back 2 levels to node a, freeing node b on the way. 4-5. node f with IDs 4,5 is freed, current ID is 6, msb is still bit 2. This means we again need to step back 2 levels to node a and free c on the way. 6. We should visit node g, but its pointer is not available as node c was freed. The fix changes how we determine the number of levels to step back. Instead of deducting this merely from the msb of the current ID, we should really check if advancing the ID causes an overflow to a bit position corresponding to a given layer. In the above example overflow from bit 0 to bit 1 should mean stepping back 1 level. Overflow from bit 1 to bit 2 should mean stepping back 2 levels and so on. The fix was tested with IDs up to 1 << 20, which corresponds to 4 layers on 32 bit systems. Signed-off-by: Imre Deak <imre.deak@nokia.com> Reviewed-by: Tejun Heo <tj@kernel.org> Cc: Eric Paris <eparis@redhat.com> Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- lib/idr.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/lib/idr.c +++ b/lib/idr.c @@ -445,6 +445,7 @@ EXPORT_SYMBOL(idr_remove); void idr_remove_all(struct idr *idp) { int n, id, max; + int bt_mask; struct idr_layer *p; struct idr_layer *pa[MAX_LEVEL]; struct idr_layer **paa = &pa[0]; @@ -462,8 +463,10 @@ void idr_remove_all(struct idr *idp) p = p->ary[(id >> n) & IDR_MASK]; } + bt_mask = id; id += 1 << n; - while (n < fls(id)) { + /* Get the highest bit that the above add changed from 0->1. */ + while (n < fls(id ^ bt_mask)) { if (p) free_layer(p); n += IDR_BITS; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [114/200] ASoC: Update Freescale i.MX SSI driver DMA parameter handling 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (111 preceding siblings ...) 2010-07-01 17:43 ` [113/200] idr: fix backtrack logic in idr_remove_all Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [115/200] ASoC: Fix dB scales for WM835x Greg KH ` (86 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Stuart Longland, Liam Girdwood, Mark Brown 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Stuart Longland <redhatter@gentoo.org> commit e2b3e622b259e62aa2450a25f1c20cca1bfdc81e upstream. This updates the i.MX SSI driver to make it compatible with the ASoC tree following the move of DMA parameters from the DAI to the audio substream object. Signed-off-by: Stuart Longland <redhatter@gentoo.org> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/soc/imx/imx-pcm-dma-mx2.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/sound/soc/imx/imx-pcm-dma-mx2.c +++ b/sound/soc/imx/imx-pcm-dma-mx2.c @@ -73,7 +73,8 @@ static void snd_imx_dma_err_callback(int { struct snd_pcm_substream *substream = data; struct snd_soc_pcm_runtime *rtd = substream->private_data; - struct imx_pcm_dma_params *dma_params = rtd->dai->cpu_dai->dma_data; + struct imx_pcm_dma_params *dma_params = + snd_soc_dai_get_dma_data(rtd->dai->cpu_dai, substream); struct snd_pcm_runtime *runtime = substream->runtime; struct imx_pcm_runtime_data *iprtd = runtime->private_data; int ret; @@ -102,7 +103,7 @@ static int imx_ssi_dma_alloc(struct snd_ struct imx_pcm_runtime_data *iprtd = runtime->private_data; int ret; - dma_params = snd_soc_get_dma_data(rtd->dai->cpu_dai, substream); + dma_params = snd_soc_dai_get_dma_data(rtd->dai->cpu_dai, substream); iprtd->dma = imx_dma_request_by_prio(DRV_NAME, DMA_PRIO_HIGH); if (iprtd->dma < 0) { @@ -212,7 +213,7 @@ static int snd_imx_pcm_prepare(struct sn struct imx_pcm_runtime_data *iprtd = runtime->private_data; int err; - dma_params = snd_soc_get_dma_data(rtd->dai->cpu_dai, substream); + dma_params = snd_soc_dai_get_dma_data(rtd->dai->cpu_dai, substream); iprtd->substream = substream; iprtd->buf = (unsigned int *)substream->dma_buffer.area; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [115/200] ASoC: Fix dB scales for WM835x 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (112 preceding siblings ...) 2010-07-01 17:43 ` [114/200] ASoC: Update Freescale i.MX SSI driver DMA parameter handling Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [116/200] ASoC: Fix dB scales for WM8400 Greg KH ` (85 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Mark Brown, Liam Girdwood 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mark Brown <broonie@opensource.wolfsonmicro.com> commit e6a08c5a8990102bcd1f4bae84b668da6c23caa9 upstream. These should be regular rather than linear scales. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c index e5a48da..c342c2c 100644 --- a/sound/soc/codecs/wm8350.c +++ b/sound/soc/codecs/wm8350.c @@ -425,8 +425,8 @@ static const struct soc_enum wm8350_enum[] = { SOC_ENUM_SINGLE(WM8350_INPUT_MIXER_VOLUME, 15, 2, wm8350_lr), }; -static DECLARE_TLV_DB_LINEAR(pre_amp_tlv, -1200, 3525); -static DECLARE_TLV_DB_LINEAR(out_pga_tlv, -5700, 600); +static DECLARE_TLV_DB_SCALE(pre_amp_tlv, -1200, 3525, 0); +static DECLARE_TLV_DB_SCALE(out_pga_tlv, -5700, 600, 0); static DECLARE_TLV_DB_SCALE(dac_pcm_tlv, -7163, 36, 1); static DECLARE_TLV_DB_SCALE(adc_pcm_tlv, -12700, 50, 1); static DECLARE_TLV_DB_SCALE(out_mix_tlv, -1500, 300, 1); ^ permalink raw reply related [flat|nested] 666+ messages in thread
* [116/200] ASoC: Fix dB scales for WM8400 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (113 preceding siblings ...) 2010-07-01 17:43 ` [115/200] ASoC: Fix dB scales for WM835x Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [117/200] ASoC: Fix dB scales for WM8990 Greg KH ` (84 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Mark Brown, Liam Girdwood 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mark Brown <broonie@opensource.wolfsonmicro.com> commit 3351e9fbb0fda6498ee149ee88c67f5849813c57 upstream. These scales should be regular, not linear. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/soc/codecs/wm8400.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) --- a/sound/soc/codecs/wm8400.c +++ b/sound/soc/codecs/wm8400.c @@ -107,21 +107,21 @@ static void wm8400_codec_reset(struct sn wm8400_reset_codec_reg_cache(wm8400->wm8400); } -static const DECLARE_TLV_DB_LINEAR(rec_mix_tlv, -1500, 600); +static const DECLARE_TLV_DB_SCALE(rec_mix_tlv, -1500, 600, 0); -static const DECLARE_TLV_DB_LINEAR(in_pga_tlv, -1650, 3000); +static const DECLARE_TLV_DB_SCALE(in_pga_tlv, -1650, 3000, 0); -static const DECLARE_TLV_DB_LINEAR(out_mix_tlv, -2100, 0); +static const DECLARE_TLV_DB_SCALE(out_mix_tlv, -2100, 0, 0); -static const DECLARE_TLV_DB_LINEAR(out_pga_tlv, -7300, 600); +static const DECLARE_TLV_DB_SCALE(out_pga_tlv, -7300, 600, 0); -static const DECLARE_TLV_DB_LINEAR(out_omix_tlv, -600, 0); +static const DECLARE_TLV_DB_SCALE(out_omix_tlv, -600, 0, 0); -static const DECLARE_TLV_DB_LINEAR(out_dac_tlv, -7163, 0); +static const DECLARE_TLV_DB_SCALE(out_dac_tlv, -7163, 0, 0); -static const DECLARE_TLV_DB_LINEAR(in_adc_tlv, -7163, 1763); +static const DECLARE_TLV_DB_SCALE(in_adc_tlv, -7163, 1763, 0); -static const DECLARE_TLV_DB_LINEAR(out_sidetone_tlv, -3600, 0); +static const DECLARE_TLV_DB_SCALE(out_sidetone_tlv, -3600, 0, 0); static int wm8400_outpga_put_volsw_vu(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) @@ -440,7 +440,7 @@ static int outmixer_event (struct snd_so /* INMIX dB values */ static const unsigned int in_mix_tlv[] = { TLV_DB_RANGE_HEAD(1), - 0,7, TLV_DB_LINEAR_ITEM(-1200, 600), + 0,7, TLV_DB_SCALE_ITEM(-1200, 600, 0), }; /* Left In PGA Connections */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [117/200] ASoC: Fix dB scales for WM8990 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (114 preceding siblings ...) 2010-07-01 17:43 ` [116/200] ASoC: Fix dB scales for WM8400 Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [118/200] drm/radeon: fix the r100/r200 ums block 0 page fix Greg KH ` (83 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Mark Brown, Liam Girdwood 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mark Brown <broonie@opensource.wolfsonmicro.com> commit f68596c6d8711650722b2a54328a088a2c21bc5b upstream. These should be regular, not linear. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/soc/codecs/wm8990.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) --- a/sound/soc/codecs/wm8990.c +++ b/sound/soc/codecs/wm8990.c @@ -111,21 +111,21 @@ static const u16 wm8990_reg[] = { #define wm8990_reset(c) snd_soc_write(c, WM8990_RESET, 0) -static const DECLARE_TLV_DB_LINEAR(rec_mix_tlv, -1500, 600); +static const DECLARE_TLV_DB_SCALE(rec_mix_tlv, -1500, 600, 0); -static const DECLARE_TLV_DB_LINEAR(in_pga_tlv, -1650, 3000); +static const DECLARE_TLV_DB_SCALE(in_pga_tlv, -1650, 3000, 0); -static const DECLARE_TLV_DB_LINEAR(out_mix_tlv, 0, -2100); +static const DECLARE_TLV_DB_SCALE(out_mix_tlv, 0, -2100, 0); -static const DECLARE_TLV_DB_LINEAR(out_pga_tlv, -7300, 600); +static const DECLARE_TLV_DB_SCALE(out_pga_tlv, -7300, 600, 0); -static const DECLARE_TLV_DB_LINEAR(out_omix_tlv, -600, 0); +static const DECLARE_TLV_DB_SCALE(out_omix_tlv, -600, 0, 0); -static const DECLARE_TLV_DB_LINEAR(out_dac_tlv, -7163, 0); +static const DECLARE_TLV_DB_SCALE(out_dac_tlv, -7163, 0, 0); -static const DECLARE_TLV_DB_LINEAR(in_adc_tlv, -7163, 1763); +static const DECLARE_TLV_DB_SCALE(in_adc_tlv, -7163, 1763, 0); -static const DECLARE_TLV_DB_LINEAR(out_sidetone_tlv, -3600, 0); +static const DECLARE_TLV_DB_SCALE(out_sidetone_tlv, -3600, 0, 0); static int wm899x_outpga_put_volsw_vu(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) @@ -451,7 +451,7 @@ static int outmixer_event(struct snd_soc /* INMIX dB values */ static const unsigned int in_mix_tlv[] = { TLV_DB_RANGE_HEAD(1), - 0, 7, TLV_DB_LINEAR_ITEM(-1200, 600), + 0, 7, TLV_DB_SCALE_ITEM(-1200, 600, 0), }; /* Left In PGA Connections */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [118/200] drm/radeon: fix the r100/r200 ums block 0 page fix 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (115 preceding siblings ...) 2010-07-01 17:43 ` [117/200] ASoC: Fix dB scales for WM8990 Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [119/200] SLUB: Allow full duplication of kmalloc array for 390 Greg KH ` (82 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Dave Airlie 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dave Airlie <airlied@redhat.com> commit cf22f20ade30f8c03955324aaf27b1049e182600 upstream. airlied -> brown paper bag. I blame Hi-5 or the Wiggles for lowering my IQ, move the fix inside some brackets instead of breaking everything in site. Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/radeon/radeon_state.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/gpu/drm/radeon/radeon_state.c +++ b/drivers/gpu/drm/radeon/radeon_state.c @@ -900,9 +900,10 @@ static void radeon_cp_dispatch_clear(str flags |= RADEON_FRONT; } if (flags & (RADEON_DEPTH|RADEON_STENCIL)) { - if (!dev_priv->have_z_offset) + if (!dev_priv->have_z_offset) { printk_once(KERN_ERR "radeon: illegal depth clear request. Buggy mesa detected - please update.\n"); - flags &= ~(RADEON_DEPTH | RADEON_STENCIL); + flags &= ~(RADEON_DEPTH | RADEON_STENCIL); + } } if (flags & (RADEON_FRONT | RADEON_BACK)) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [119/200] SLUB: Allow full duplication of kmalloc array for 390 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (116 preceding siblings ...) 2010-07-01 17:43 ` [118/200] drm/radeon: fix the r100/r200 ums block 0 page fix Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [120/200] slub: move kmem_cache_node into its own cacheline Greg KH ` (81 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Christoph Lameter, Pekka Enberg 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Christoph Lameter <cl@linux-foundation.org> commit 0f1f694260e0d35b5ce7d471f6e679c3dd4d7d94 upstream. Commit 756dee75872a2a764b478e18076360b8a4ec9045 ("SLUB: Get rid of dynamic DMA kmalloc cache allocation") makes S390 run out of kmalloc caches. Increase the number of kmalloc caches to a safe size. Reported-by: Heiko Carstens <heiko.carstens@de.ibm.com> Tested-by: Heiko Carstens <heiko.carstens@de.ibm.com> Signed-off-by: Christoph Lameter <cl@linux-foundation.org> Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- include/linux/slub_def.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/include/linux/slub_def.h +++ b/include/linux/slub_def.h @@ -132,7 +132,7 @@ struct kmem_cache { #ifdef CONFIG_ZONE_DMA #define SLUB_DMA __GFP_DMA /* Reserve extra caches for potential DMA use */ -#define KMALLOC_CACHES (2 * SLUB_PAGE_SHIFT - 6) +#define KMALLOC_CACHES (2 * SLUB_PAGE_SHIFT) #else /* Disable DMA functionality */ #define SLUB_DMA (__force gfp_t)0 ^ permalink raw reply [flat|nested] 666+ messages in thread
* [120/200] slub: move kmem_cache_node into its own cacheline 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (117 preceding siblings ...) 2010-07-01 17:43 ` [119/200] SLUB: Allow full duplication of kmalloc array for 390 Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [121/200] hwmon: (ltc4245) Read only one GPIO pin Greg KH ` (80 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Yanmin Zhang, Christoph Lameter, Alexander Duyck, Pekka Enberg 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alexander Duyck <alexander.h.duyck@intel.com> commit 73367bd8eef4f4eb311005886aaa916013073265 upstream. This patch is meant to improve the performance of SLUB by moving the local kmem_cache_node lock into it's own cacheline separate from kmem_cache. This is accomplished by simply removing the local_node when NUMA is enabled. On my system with 2 nodes I saw around a 5% performance increase w/ hackbench times dropping from 6.2 seconds to 5.9 seconds on average. I suspect the performance gain would increase as the number of nodes increases, but I do not have the data to currently back that up. Bugzilla-Reference: http://bugzilla.kernel.org/show_bug.cgi?id=15713 Reported-by: Alex Shi <alex.shi@intel.com> Tested-by: Alex Shi <alex.shi@intel.com> Acked-by: Yanmin Zhang <yanmin_zhang@linux.intel.com> Acked-by: Christoph Lameter <cl@linux-foundation.org> Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com> Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- include/linux/slub_def.h | 9 +++------ mm/slub.c | 33 +++++++++++---------------------- 2 files changed, 14 insertions(+), 28 deletions(-) --- a/include/linux/slub_def.h +++ b/include/linux/slub_def.h @@ -75,12 +75,6 @@ struct kmem_cache { int offset; /* Free pointer offset. */ struct kmem_cache_order_objects oo; - /* - * Avoid an extra cache line for UP, SMP and for the node local to - * struct kmem_cache. - */ - struct kmem_cache_node local_node; - /* Allocation and freeing of slabs */ struct kmem_cache_order_objects max; struct kmem_cache_order_objects min; @@ -102,6 +96,9 @@ struct kmem_cache { */ int remote_node_defrag_ratio; struct kmem_cache_node *node[MAX_NUMNODES]; +#else + /* Avoid an extra cache line for UP */ + struct kmem_cache_node local_node; #endif }; --- a/mm/slub.c +++ b/mm/slub.c @@ -2141,7 +2141,7 @@ static void free_kmem_cache_nodes(struct for_each_node_state(node, N_NORMAL_MEMORY) { struct kmem_cache_node *n = s->node[node]; - if (n && n != &s->local_node) + if (n) kmem_cache_free(kmalloc_caches, n); s->node[node] = NULL; } @@ -2150,33 +2150,22 @@ static void free_kmem_cache_nodes(struct static int init_kmem_cache_nodes(struct kmem_cache *s, gfp_t gfpflags) { int node; - int local_node; - - if (slab_state >= UP && (s < kmalloc_caches || - s >= kmalloc_caches + KMALLOC_CACHES)) - local_node = page_to_nid(virt_to_page(s)); - else - local_node = 0; for_each_node_state(node, N_NORMAL_MEMORY) { struct kmem_cache_node *n; - if (local_node == node) - n = &s->local_node; - else { - if (slab_state == DOWN) { - early_kmem_cache_node_alloc(gfpflags, node); - continue; - } - n = kmem_cache_alloc_node(kmalloc_caches, - gfpflags, node); - - if (!n) { - free_kmem_cache_nodes(s); - return 0; - } + if (slab_state == DOWN) { + early_kmem_cache_node_alloc(gfpflags, node); + continue; + } + n = kmem_cache_alloc_node(kmalloc_caches, + gfpflags, node); + if (!n) { + free_kmem_cache_nodes(s); + return 0; } + s->node[node] = n; init_kmem_cache_node(n, s); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [121/200] hwmon: (ltc4245) Read only one GPIO pin 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (118 preceding siblings ...) 2010-07-01 17:43 ` [120/200] slub: move kmem_cache_node into its own cacheline Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [122/200] signals: check_kill_permission(): dont check creds if same_thread_group() Greg KH ` (79 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ira W. Snyder, Jean Delvare 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ira W. Snyder <iws@ovro.caltech.edu> commit df16dd53c575d0cb9dbee20a3149927c862a9ff6 upstream. Read only one of the GPIO pins as an analog voltage. The ADC can be switched to a different GPIO pin at runtime, but this is not supported. Previously, this driver would report the analog voltage of the currently selected GPIO pin as all three GPIO voltages: in9_input, in10_input and in11_input. Signed-off-by: Ira W. Snyder <iws@ovro.caltech.edu> Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- Documentation/hwmon/ltc4245 | 4 +--- drivers/hwmon/ltc4245.c | 18 +++++------------- 2 files changed, 6 insertions(+), 16 deletions(-) --- a/Documentation/hwmon/ltc4245 +++ b/Documentation/hwmon/ltc4245 @@ -72,9 +72,7 @@ in6_min_alarm 5v output undervoltage a in7_min_alarm 3v output undervoltage alarm in8_min_alarm Vee (-12v) output undervoltage alarm -in9_input GPIO #1 voltage data -in10_input GPIO #2 voltage data -in11_input GPIO #3 voltage data +in9_input GPIO voltage data power1_input 12v power usage (mW) power2_input 5v power usage (mW) --- a/drivers/hwmon/ltc4245.c +++ b/drivers/hwmon/ltc4245.c @@ -45,9 +45,7 @@ enum ltc4245_cmd { LTC4245_VEEIN = 0x19, LTC4245_VEESENSE = 0x1a, LTC4245_VEEOUT = 0x1b, - LTC4245_GPIOADC1 = 0x1c, - LTC4245_GPIOADC2 = 0x1d, - LTC4245_GPIOADC3 = 0x1e, + LTC4245_GPIOADC = 0x1c, }; struct ltc4245_data { @@ -61,7 +59,7 @@ struct ltc4245_data { u8 cregs[0x08]; /* Voltage registers */ - u8 vregs[0x0f]; + u8 vregs[0x0d]; }; static struct ltc4245_data *ltc4245_update_device(struct device *dev) @@ -86,7 +84,7 @@ static struct ltc4245_data *ltc4245_upda data->cregs[i] = val; } - /* Read voltage registers -- 0x10 to 0x1f */ + /* Read voltage registers -- 0x10 to 0x1c */ for (i = 0; i < ARRAY_SIZE(data->vregs); i++) { val = i2c_smbus_read_byte_data(client, i+0x10); if (unlikely(val < 0)) @@ -128,9 +126,7 @@ static int ltc4245_get_voltage(struct de case LTC4245_VEEOUT: voltage = regval * -55; break; - case LTC4245_GPIOADC1: - case LTC4245_GPIOADC2: - case LTC4245_GPIOADC3: + case LTC4245_GPIOADC: voltage = regval * 10; break; default: @@ -297,9 +293,7 @@ LTC4245_ALARM(in7_min_alarm, (1 << 2), L LTC4245_ALARM(in8_min_alarm, (1 << 3), LTC4245_FAULT2); /* GPIO voltages */ -LTC4245_VOLTAGE(in9_input, LTC4245_GPIOADC1); -LTC4245_VOLTAGE(in10_input, LTC4245_GPIOADC2); -LTC4245_VOLTAGE(in11_input, LTC4245_GPIOADC3); +LTC4245_VOLTAGE(in9_input, LTC4245_GPIOADC); /* Power Consumption (virtual) */ LTC4245_POWER(power1_input, LTC4245_12VSENSE); @@ -342,8 +336,6 @@ static struct attribute *ltc4245_attribu &sensor_dev_attr_in8_min_alarm.dev_attr.attr, &sensor_dev_attr_in9_input.dev_attr.attr, - &sensor_dev_attr_in10_input.dev_attr.attr, - &sensor_dev_attr_in11_input.dev_attr.attr, &sensor_dev_attr_power1_input.dev_attr.attr, &sensor_dev_attr_power2_input.dev_attr.attr, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [122/200] signals: check_kill_permission(): dont check creds if same_thread_group() 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (119 preceding siblings ...) 2010-07-01 17:43 ` [121/200] hwmon: (ltc4245) Read only one GPIO pin Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [123/200] compat: factor out compat_rw_copy_check_uvector from compat_do_readv_writev Greg KH ` (78 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Oleg Nesterov, Roland McGrath, David Howells, Eric Paris, Jakub Jelinek, James Morris, Stephen Smalley 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Oleg Nesterov <oleg@redhat.com> commit 065add3941bdca54fe04ed3471a96bce9af88793 upstream. Andrew Tridgell reports that aio_read(SIGEV_SIGNAL) can fail if the notification from the helper thread races with setresuid(), see http://samba.org/~tridge/junkcode/aio_uid.c This happens because check_kill_permission() doesn't permit sending a signal to the task with the different cred->xids. But there is not any security reason to check ->cred's when the task sends a signal (private or group-wide) to its sub-thread. Whatever we do, any thread can bypass all security checks and send SIGKILL to all threads, or it can block a signal SIG and do kill(gettid(), SIG) to deliver this signal to another sub-thread. Not to mention that CLONE_THREAD implies CLONE_VM. Change check_kill_permission() to avoid the credentials check when the sender and the target are from the same thread group. Also, move "cred = current_cred()" down to avoid calling get_current() twice. Note: David Howells pointed out we could relax this even more, the CLONE_SIGHAND (without CLONE_THREAD) case probably does not need these checks too. Roland said: : The glibc (libpthread) that does set*id across threads has : been in use for a while (2.3.4?), probably in distro's using kernels as old : or older than any active -stable streams. In the race in question, this : kernel bug is breaking valid POSIX application expectations. Reported-by: Andrew Tridgell <tridge@samba.org> Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Roland McGrath <roland@redhat.com> Acked-by: David Howells <dhowells@redhat.com> Cc: Eric Paris <eparis@parisplace.org> Cc: Jakub Jelinek <jakub@redhat.com> Cc: James Morris <jmorris@namei.org> Cc: Roland McGrath <roland@redhat.com> Cc: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/signal.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/kernel/signal.c +++ b/kernel/signal.c @@ -642,7 +642,7 @@ static inline bool si_fromuser(const str static int check_kill_permission(int sig, struct siginfo *info, struct task_struct *t) { - const struct cred *cred = current_cred(), *tcred; + const struct cred *cred, *tcred; struct pid *sid; int error; @@ -656,8 +656,10 @@ static int check_kill_permission(int sig if (error) return error; + cred = current_cred(); tcred = __task_cred(t); - if ((cred->euid ^ tcred->suid) && + if (!same_thread_group(current, t) && + (cred->euid ^ tcred->suid) && (cred->euid ^ tcred->uid) && (cred->uid ^ tcred->suid) && (cred->uid ^ tcred->uid) && ^ permalink raw reply [flat|nested] 666+ messages in thread
* [123/200] compat: factor out compat_rw_copy_check_uvector from compat_do_readv_writev 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (120 preceding siblings ...) 2010-07-01 17:43 ` [122/200] signals: check_kill_permission(): dont check creds if same_thread_group() Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [124/200] fs/compat_rw_copy_check_uvector: add missing compat_ptr call Greg KH ` (77 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jeff Moyer, Zach Brown 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jeff Moyer <jmoyer@redhat.com> commit b83733639a494d5f42fa00a2506563fbd2d3015d upstream. It was reported in http://lkml.org/lkml/2010/3/8/309 that 32 bit readv and writev AIO operations were not functioning properly. It turns out that the code to convert the 32bit io vectors to 64 bits was never written. The results of that can be pretty bad, but in my testing, it mostly ended up in generating EFAULT as we walked off the list of I/O vectors provided. This patch set fixes the problem in my environment. are greatly appreciated. This patch: Factor out code that will be used by both compat_do_readv_writev and the compat aio submission code paths. Signed-off-by: Jeff Moyer <jmoyer@redhat.com> Reported-by: Michael Tokarev <mjt@tls.msk.ru> Cc: Zach Brown <zach.brown@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/compat.c | 130 +++++++++++++++++++++++++++++-------------------- include/linux/compat.h | 4 + 2 files changed, 81 insertions(+), 53 deletions(-) --- a/fs/compat.c +++ b/fs/compat.c @@ -568,6 +568,79 @@ out: return ret; } +/* A write operation does a read from user space and vice versa */ +#define vrfy_dir(type) ((type) == READ ? VERIFY_WRITE : VERIFY_READ) + +ssize_t compat_rw_copy_check_uvector(int type, + const struct compat_iovec __user *uvector, unsigned long nr_segs, + unsigned long fast_segs, struct iovec *fast_pointer, + struct iovec **ret_pointer) +{ + compat_ssize_t tot_len; + struct iovec *iov = *ret_pointer = fast_pointer; + ssize_t ret = 0; + int seg; + + /* + * SuS says "The readv() function *may* fail if the iovcnt argument + * was less than or equal to 0, or greater than {IOV_MAX}. Linux has + * traditionally returned zero for zero segments, so... + */ + if (nr_segs == 0) + goto out; + + ret = -EINVAL; + if (nr_segs > UIO_MAXIOV || nr_segs < 0) + goto out; + if (nr_segs > fast_segs) { + ret = -ENOMEM; + iov = kmalloc(nr_segs*sizeof(struct iovec), GFP_KERNEL); + if (iov == NULL) { + *ret_pointer = fast_pointer; + goto out; + } + } + *ret_pointer = iov; + + /* + * Single unix specification: + * We should -EINVAL if an element length is not >= 0 and fitting an + * ssize_t. The total length is fitting an ssize_t + * + * Be careful here because iov_len is a size_t not an ssize_t + */ + tot_len = 0; + ret = -EINVAL; + for (seg = 0; seg < nr_segs; seg++) { + compat_ssize_t tmp = tot_len; + compat_uptr_t buf; + compat_ssize_t len; + + if (__get_user(len, &uvector->iov_len) || + __get_user(buf, &uvector->iov_base)) { + ret = -EFAULT; + goto out; + } + if (len < 0) /* size_t not fitting in compat_ssize_t .. */ + goto out; + tot_len += len; + if (tot_len < tmp) /* maths overflow on the compat_ssize_t */ + goto out; + if (!access_ok(vrfy_dir(type), buf, len)) { + ret = -EFAULT; + goto out; + } + iov->iov_base = compat_ptr(buf); + iov->iov_len = (compat_size_t) len; + uvector++; + iov++; + } + ret = tot_len; + +out: + return ret; +} + static inline long copy_iocb(long nr, u32 __user *ptr32, struct iocb __user * __user *ptr64) { @@ -1077,70 +1150,21 @@ static ssize_t compat_do_readv_writev(in { compat_ssize_t tot_len; struct iovec iovstack[UIO_FASTIOV]; - struct iovec *iov=iovstack, *vector; + struct iovec *iov; ssize_t ret; - int seg; io_fn_t fn; iov_fn_t fnv; - /* - * SuS says "The readv() function *may* fail if the iovcnt argument - * was less than or equal to 0, or greater than {IOV_MAX}. Linux has - * traditionally returned zero for zero segments, so... - */ - ret = 0; - if (nr_segs == 0) - goto out; - - /* - * First get the "struct iovec" from user memory and - * verify all the pointers - */ ret = -EINVAL; - if ((nr_segs > UIO_MAXIOV) || (nr_segs <= 0)) - goto out; if (!file->f_op) goto out; - if (nr_segs > UIO_FASTIOV) { - ret = -ENOMEM; - iov = kmalloc(nr_segs*sizeof(struct iovec), GFP_KERNEL); - if (!iov) - goto out; - } + ret = -EFAULT; if (!access_ok(VERIFY_READ, uvector, nr_segs*sizeof(*uvector))) goto out; - /* - * Single unix specification: - * We should -EINVAL if an element length is not >= 0 and fitting an - * ssize_t. The total length is fitting an ssize_t - * - * Be careful here because iov_len is a size_t not an ssize_t - */ - tot_len = 0; - vector = iov; - ret = -EINVAL; - for (seg = 0 ; seg < nr_segs; seg++) { - compat_ssize_t tmp = tot_len; - compat_ssize_t len; - compat_uptr_t buf; - - if (__get_user(len, &uvector->iov_len) || - __get_user(buf, &uvector->iov_base)) { - ret = -EFAULT; - goto out; - } - if (len < 0) /* size_t not fitting an compat_ssize_t .. */ - goto out; - tot_len += len; - if (tot_len < tmp) /* maths overflow on the compat_ssize_t */ - goto out; - vector->iov_base = compat_ptr(buf); - vector->iov_len = (compat_size_t) len; - uvector++; - vector++; - } + tot_len = compat_rw_copy_check_uvector(type, uvector, nr_segs, + UIO_FASTIOV, iovstack, &iov); if (tot_len == 0) { ret = 0; goto out; --- a/include/linux/compat.h +++ b/include/linux/compat.h @@ -356,5 +356,9 @@ asmlinkage long compat_sys_newfstatat(un asmlinkage long compat_sys_openat(unsigned int dfd, const char __user *filename, int flags, int mode); +extern ssize_t compat_rw_copy_check_uvector(int type, + const struct compat_iovec __user *uvector, unsigned long nr_segs, + unsigned long fast_segs, struct iovec *fast_pointer, + struct iovec **ret_pointer); #endif /* CONFIG_COMPAT */ #endif /* _LINUX_COMPAT_H */ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [124/200] fs/compat_rw_copy_check_uvector: add missing compat_ptr call 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (121 preceding siblings ...) 2010-07-01 17:43 ` [123/200] compat: factor out compat_rw_copy_check_uvector from compat_do_readv_writev Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [125/200] do_generic_file_read: clear page errors when issuing a fresh read of the page Greg KH ` (76 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Heiko Carstens 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Heiko Carstens <heiko.carstens@de.ibm.com> commit 7cbe17701a0379c7b05a79a6df4f24e41d2afde8 upstream. A call to access_ok is missing a compat_ptr conversion. Introduced with b83733639a494d5f42fa00a2506563fbd2d3015d "compat: factor out compat_rw_copy_check_uvector from compat_do_readv_writev" fs/compat.c: In function 'compat_rw_copy_check_uvector': fs/compat.c:629: warning: passing argument 1 of '__access_ok' makes pointer from integer without a cast Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Reviewed-by: Jeff Moyer <jmoyer@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/compat.c +++ b/fs/compat.c @@ -626,7 +626,7 @@ ssize_t compat_rw_copy_check_uvector(int tot_len += len; if (tot_len < tmp) /* maths overflow on the compat_ssize_t */ goto out; - if (!access_ok(vrfy_dir(type), buf, len)) { + if (!access_ok(vrfy_dir(type), compat_ptr(buf), len)) { ret = -EFAULT; goto out; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [125/200] do_generic_file_read: clear page errors when issuing a fresh read of the page 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (122 preceding siblings ...) 2010-07-01 17:43 ` [124/200] fs/compat_rw_copy_check_uvector: add missing compat_ptr call Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [126/200] ipmi: handle run_to_completion properly in deliver_recv_msg() Greg KH ` (75 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jeff Moyer, Rik van Riel, Larry Woodman 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jeff Moyer <jmoyer@redhat.com> commit 91803b499cca2fe558abad709ce83dc896b80950 upstream. I/O errors can happen due to temporary failures, like multipath errors or losing network contact with the iSCSI server. Because of that, the VM will retry readpage on the page. However, do_generic_file_read does not clear PG_error. This causes the system to be unable to actually use the data in the page cache page, even if the subsequent readpage completes successfully! The function filemap_fault has had a ClearPageError before readpage forever. This patch simply adds the same to do_generic_file_read. Signed-off-by: Jeff Moyer <jmoyer@redhat.com> Signed-off-by: Rik van Riel <riel@redhat.com> Acked-by: Larry Woodman <lwoodman@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- mm/filemap.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/mm/filemap.c +++ b/mm/filemap.c @@ -1099,6 +1099,12 @@ page_not_up_to_date_locked: } readpage: + /* + * A previous I/O error may have been due to temporary + * failures, eg. multipath errors. + * PG_error will be set again if readpage fails. + */ + ClearPageError(page); /* Start the actual read. The read will unlock the page. */ error = mapping->a_ops->readpage(filp, page); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [126/200] ipmi: handle run_to_completion properly in deliver_recv_msg() 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (123 preceding siblings ...) 2010-07-01 17:43 ` [125/200] do_generic_file_read: clear page errors when issuing a fresh read of the page Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [127/200] x86, setup: Phoenix BIOS fixup is needed on Dell Inspiron Mini 1012 Greg KH ` (74 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jiri Kosina, Corey Minyard 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jiri Kosina <jkosina@suse.cz> commit a747c5abc329611220f16df0bb4cf0ca4a7fdf0c upstream. If run_to_completion flag is set, it means that we are running in a single-threaded mode, and thus no locks are held. This fixes a deadlock when IPMI notifier is being called during panic. Signed-off-by: Jiri Kosina <jkosina@suse.cz> Acked-by: Corey Minyard <minyard@acm.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/char/ipmi/ipmi_si_intf.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) --- a/drivers/char/ipmi/ipmi_si_intf.c +++ b/drivers/char/ipmi/ipmi_si_intf.c @@ -314,9 +314,14 @@ static void deliver_recv_msg(struct smi_ { /* Deliver the message to the upper layer with the lock released. */ - spin_unlock(&(smi_info->si_lock)); - ipmi_smi_msg_received(smi_info->intf, msg); - spin_lock(&(smi_info->si_lock)); + + if (smi_info->run_to_completion) { + ipmi_smi_msg_received(smi_info->intf, msg); + } else { + spin_unlock(&(smi_info->si_lock)); + ipmi_smi_msg_received(smi_info->intf, msg); + spin_lock(&(smi_info->si_lock)); + } } static void return_hosed_msg(struct smi_info *smi_info, int cCode) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [127/200] x86, setup: Phoenix BIOS fixup is needed on Dell Inspiron Mini 1012 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (124 preceding siblings ...) 2010-07-01 17:43 ` [126/200] ipmi: handle run_to_completion properly in deliver_recv_msg() Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [128/200] xen: ensure timer tick is resumed even on CPU driving the resume Greg KH ` (73 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Gabor Gombas, H. Peter Anvin 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Gabor Gombas <gombasg@digikabel.hu> commit 3d6e77a3ddb8e4156b89f4273ff8c7d37abaf781 upstream. The low-memory corruption checker triggers during suspend/resume, so we need to reserve the low 64k. Don't be fooled that the BIOS identifies itself as "Dell Inc.", it's still Phoenix BIOS. [ hpa: I think we blacklist almost every BIOS in existence. We should either change this to a whitelist or just make it unconditional. ] Signed-off-by: Gabor Gombas <gombasg@digikabel.hu> LKML-Reference: <201005241913.o4OJDIMM010877@imap1.linux-foundation.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/kernel/setup.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -676,6 +676,17 @@ static struct dmi_system_id __initdata b DMI_MATCH(DMI_BOARD_NAME, "DG45FC"), }, }, + /* + * The Dell Inspiron Mini 1012 has DMI_BIOS_VENDOR = "Dell Inc.", so + * match on the product name. + */ + { + .callback = dmi_low_memory_corruption, + .ident = "Phoenix BIOS", + .matches = { + DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1012"), + }, + }, #endif {} }; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [128/200] xen: ensure timer tick is resumed even on CPU driving the resume 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (125 preceding siblings ...) 2010-07-01 17:43 ` [127/200] x86, setup: Phoenix BIOS fixup is needed on Dell Inspiron Mini 1012 Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [129/200] xen: avoid allocation causing potential swap activity on the resume path Greg KH ` (72 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ian Campbell, Jeremy Fitzhardinge 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ian Campbell <ian.campbell@citrix.com> commit cd52e17ea8278f8449b6174a8e5ed439a2e44ffb upstream. The core suspend/resume code is run from stop_machine on CPU0 but parts of the suspend/resume machinery (including xen_arch_resume) are run on whichever CPU happened to schedule the xenwatch kernel thread. As part of the non-core resume code xen_arch_resume is called in order to restart the timer tick on non-boot processors. The boot processor itself is taken care of by core timekeeping code. xen_arch_resume uses smp_call_function which does not call the given function on the current processor. This means that we can end up with one CPU not receiving timer ticks if the xenwatch thread happened to be scheduled on CPU > 0. Use on_each_cpu instead of smp_call_function to ensure the timer tick is resumed everywhere. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Jeremy Fitzhardinge <jeremy@goop.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/xen/suspend.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/arch/x86/xen/suspend.c +++ b/arch/x86/xen/suspend.c @@ -60,6 +60,6 @@ static void xen_vcpu_notify_restore(void void xen_arch_resume(void) { - smp_call_function(xen_vcpu_notify_restore, - (void *)CLOCK_EVT_NOTIFY_RESUME, 1); + on_each_cpu(xen_vcpu_notify_restore, + (void *)CLOCK_EVT_NOTIFY_RESUME, 1); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [129/200] xen: avoid allocation causing potential swap activity on the resume path 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (126 preceding siblings ...) 2010-07-01 17:43 ` [128/200] xen: ensure timer tick is resumed even on CPU driving the resume Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [130/200] ALSA: hda: Use LPIB for an ASUS device Greg KH ` (71 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Ian Campbell, Jeremy Fitzhardinge 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ian Campbell <ian.campbell@citrix.com> commit b3831cb55d383e8eb55d3b56c715fb48459b87c9 upstream. Since the device we are resuming could be the device containing the swap device we should ensure that the allocation cannot cause IO. On resume, this path is triggered when the running system tries to continue using its devices. If it cannot then the resume will fail; to try to avoid this we let it dip into the emergency pools. The majority of these changes were made when linux-2.6.18-xen.hg changeset e8b49cfbdac0 was ported upstream in a144ff09bc52ef3f3684ed23eadc9c7c0e57b3aa but somehow this hunk was dropped. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Jeremy Fitzhardinge <jeremy@goop.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/xen/xenbus/xenbus_xs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/xen/xenbus/xenbus_xs.c +++ b/drivers/xen/xenbus/xenbus_xs.c @@ -499,7 +499,7 @@ int xenbus_printf(struct xenbus_transact #define PRINTF_BUFFER_SIZE 4096 char *printf_buffer; - printf_buffer = kmalloc(PRINTF_BUFFER_SIZE, GFP_KERNEL); + printf_buffer = kmalloc(PRINTF_BUFFER_SIZE, GFP_NOIO | __GFP_HIGH); if (printf_buffer == NULL) return -ENOMEM; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [130/200] ALSA: hda: Use LPIB for an ASUS device 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (127 preceding siblings ...) 2010-07-01 17:43 ` [129/200] xen: avoid allocation causing potential swap activity on the resume path Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [131/200] ALSA: hda: Use mb31 quirk for an iMac model Greg KH ` (70 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit dd37f8e8659bc617c3f2a84e007a4824ccdac458 upstream. BugLink: https://launchpad.net/bugs/465942 Symptom: On the reporter's ASUS device, using PulseAudio in Ubuntu 10.04 LTS results in the PA daemon crashing shortly after attempting to select capture or to configure the audio hardware profile. Test case: Using Ubuntu 10.04 LTS (Linux 2.6.32.12), Linux 2.6.33, or Linux 2.6.34, adjust the HDA device's capture volume with PulseAudio. Resolution: add SSID for this machine to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: Irihapeti Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2269,6 +2269,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB), SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB), SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB), SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [131/200] ALSA: hda: Use mb31 quirk for an iMac model 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (128 preceding siblings ...) 2010-07-01 17:43 ` [130/200] ALSA: hda: Use LPIB for an ASUS device Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [132/200] ALSA: hda: Use LPIB for another mainboard Greg KH ` (69 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 26fd74fc01991a18f0e3bd54f8b1b75945ee3dbb upstream. BugLink: https://launchpad.net/bugs/542550 Symptom: On the reporter's iMac, in Ubuntu 10.04 LTS neither playback nor capture appear audible out-of-the-box. Test case: Boot from an Ubuntu 10.04 LTS live cd or from an installed configuration and attempt to play or capture audio. Resolution: Specify the mb31 quirk for this machine in the codec SSID table. Reported-and-Tested-By: f3a97 Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -9392,6 +9392,7 @@ static struct snd_pci_quirk alc882_ssid_ SND_PCI_QUIRK(0x106b, 0x1000, "iMac 24", ALC885_IMAC24), SND_PCI_QUIRK(0x106b, 0x2800, "AppleTV", ALC885_IMAC24), SND_PCI_QUIRK(0x106b, 0x2c00, "MacbookPro rev3", ALC885_MBP3), + SND_PCI_QUIRK(0x106b, 0x3000, "iMac", ALC889A_MB31), SND_PCI_QUIRK(0x106b, 0x3600, "Macbook 3,1", ALC889A_MB31), SND_PCI_QUIRK(0x106b, 0x3800, "MacbookPro 4,1", ALC885_MBP3), SND_PCI_QUIRK(0x106b, 0x3e00, "iMac 24 Aluminum", ALC885_IMAC24), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [132/200] ALSA: hda: Use LPIB for another mainboard 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (129 preceding siblings ...) 2010-07-01 17:43 ` [131/200] ALSA: hda: Use mb31 quirk for an iMac model Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [133/200] ALSA: hda: Use LPIB for ASUS M2V Greg KH ` (68 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit b90c076424da8166797bdc34187660fd0124f530 upstream. BugLink: https://launchpad.net/bugs/580749 Symptom: on the original reporter's VIA VT1708-based board, the PulseAudio daemon dies shortly after the user attempts to play an audio file. Test case: boot from Ubuntu 10.04 LTS live cd; attempt to play an audio file. Resolution: add SSID for the original reporter's hardware to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: Harald Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2278,6 +2278,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB), SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB), SND_PCI_QUIRK(0x1565, 0x8218, "Biostar Microtech", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1849, 0x0888, "775Dual-VSTA", POS_FIX_LPIB), SND_PCI_QUIRK(0x8086, 0x2503, "DG965OT AAD63733-203", POS_FIX_LPIB), SND_PCI_QUIRK(0x8086, 0xd601, "eMachines T5212", POS_FIX_LPIB), {} ^ permalink raw reply [flat|nested] 666+ messages in thread
* [133/200] ALSA: hda: Use LPIB for ASUS M2V 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (130 preceding siblings ...) 2010-07-01 17:43 ` [132/200] ALSA: hda: Use LPIB for another mainboard Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [134/200] vmware balloon: clamp number of collected non-balloonable pages Greg KH ` (67 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel T Chen, Takashi Iwai 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel T Chen <crimsun@ubuntu.com> commit 9f75c1b12c5ef392ddcea575b13560842c28b1b3 upstream. BugLink: https://launchpad.net/bugs/587546 Symptom: On the reporter's ASUS M2V, using PulseAudio in Ubuntu 10.04 LTS results in the PA daemon crashing shortly after attempting playback of an audio file. Test case: Using Ubuntu 10.04 LTS (Linux 2.6.32.12), Linux 2.6.33, or Linux 2.6.34, attempt playback of an audio file while PulseAudio is active. Resolution: add SSID for this machine to the position_fix quirk table, explicitly specifying the LPIB method. Reported-and-Tested-By: D Tangman Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2270,6 +2270,7 @@ static struct snd_pci_quirk position_fix SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB), + SND_PCI_QUIRK(0x1043, 0x81e7, "ASUS M2V", POS_FIX_LPIB), SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB), SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB), SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB), ^ permalink raw reply [flat|nested] 666+ messages in thread
* [134/200] vmware balloon: clamp number of collected non-balloonable pages 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (131 preceding siblings ...) 2010-07-01 17:43 ` [133/200] ALSA: hda: Use LPIB for ASUS M2V Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [135/200] Staging: comedi - correct parameter gainlkup for DAQCard-6024E in driver ni_mio_cs.c Greg KH ` (66 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dmitry Torokhov, Bhavesh Davda 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dmitry Torokhov <dtor@vmware.com> commit 55adaa495edc429be84399f83df80dfb7f36598b upstream. Limit number of accumulated non-balloonable pages during inflation cycle, otherwise there is a chance we will be spinning and growing the list forever. This happens during torture tests when balloon target changes while we are in the middle of inflation cycle and monitor starts refusing to lock pages (since they are not needed anymore). Signed-off-by: Dmitry Torokhov <dtor@vmware.com> Acked-by: Bhavesh Davda <bhavesh@vmware.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/misc/vmware_balloon.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) --- a/drivers/misc/vmware_balloon.c +++ b/drivers/misc/vmware_balloon.c @@ -45,7 +45,7 @@ MODULE_AUTHOR("VMware, Inc."); MODULE_DESCRIPTION("VMware Memory Control (Balloon) Driver"); -MODULE_VERSION("1.2.1.0-K"); +MODULE_VERSION("1.2.1.1-k"); MODULE_ALIAS("dmi:*:svnVMware*:*"); MODULE_ALIAS("vmware_vmmemctl"); MODULE_LICENSE("GPL"); @@ -101,6 +101,8 @@ MODULE_LICENSE("GPL"); /* Maximum number of page allocations without yielding processor */ #define VMW_BALLOON_YIELD_THRESHOLD 1024 +/* Maximum number of refused pages we accumulate during inflation cycle */ +#define VMW_BALLOON_MAX_REFUSED 16 /* * Hypervisor communication port definitions. @@ -183,6 +185,7 @@ struct vmballoon { /* transient list of non-balloonable pages */ struct list_head refused_pages; + unsigned int n_refused_pages; /* balloon size in pages */ unsigned int size; @@ -428,14 +431,21 @@ static int vmballoon_reserve_page(struct /* inform monitor */ locked = vmballoon_send_lock_page(b, page_to_pfn(page)); if (!locked) { + STATS_INC(b->stats.refused_alloc); + if (b->reset_required) { __free_page(page); return -EIO; } - /* place on list of non-balloonable pages, retry allocation */ + /* + * Place page on the list of non-balloonable pages + * and retry allocation, unless we already accumulated + * too many of them, in which case take a breather. + */ list_add(&page->lru, &b->refused_pages); - STATS_INC(b->stats.refused_alloc); + if (++b->n_refused_pages >= VMW_BALLOON_MAX_REFUSED) + return -EIO; } } while (!locked); @@ -483,6 +493,8 @@ static void vmballoon_release_refused_pa __free_page(page); STATS_INC(b->stats.refused_free); } + + b->n_refused_pages = 0; } /* ^ permalink raw reply [flat|nested] 666+ messages in thread
* [135/200] Staging: comedi - correct parameter gainlkup for DAQCard-6024E in driver ni_mio_cs.c 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (132 preceding siblings ...) 2010-07-01 17:43 ` [134/200] vmware balloon: clamp number of collected non-balloonable pages Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [136/200] clocksource: sh_tmu: compute mult and shift before registration Greg KH ` (65 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Martin Homuth-Rosemann 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Martin Homuth-Rosemann <homuth-rosemann@gmx.net> commit ebe8622342f12bed387f7de4b5fb7c52005ccb29 upstream. Correct at least one of the incorrect specs for a national instrument data acquisition card DAQCard-6024E. This card has only four different gain settings (+-10V, +-5V, +-0.5V, +-0.05V). Signed-off-by: Martin Homuth-Rosemann <homuth-rosemann@gmx.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/staging/comedi/drivers/ni_mio_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/staging/comedi/drivers/ni_mio_cs.c +++ b/drivers/staging/comedi/drivers/ni_mio_cs.c @@ -123,7 +123,7 @@ static const struct ni_board_struct ni_b .adbits = 12, .ai_fifo_depth = 1024, .alwaysdither = 0, - .gainlkup = ai_gain_16, + .gainlkup = ai_gain_4, .ai_speed = 5000, .n_aochan = 2, .aobits = 12, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [136/200] clocksource: sh_tmu: compute mult and shift before registration 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (133 preceding siblings ...) 2010-07-01 17:43 ` [135/200] Staging: comedi - correct parameter gainlkup for DAQCard-6024E in driver ni_mio_cs.c Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [137/200] clocksource: sh_cmt: " Greg KH ` (64 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Aurelien Jarno, Paul Mundt 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Aurelien Jarno <aurelien@aurel32.net> commit 66f49121ffa41a19c59965b31b046d8368fec3c7 upstream. Since commit 98962465ed9e6ea99c38e0af63fe1dcb5a79dc25 ("nohz: Prevent clocksource wrapping during idle"), the CPU of an R2D board never goes to idle. This commit assumes that mult and shift are assigned before the clocksource is registered. As a consequence the safe maximum sleep time is negative and the CPU never goes into idle. This patch fixes the problem by moving mult and shift initialization from sh_tmu_clocksource_enable() to sh_tmu_register_clocksource(). Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Paul Mundt <lethal@linux-sh.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/clocksource/sh_tmu.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) --- a/drivers/clocksource/sh_tmu.c +++ b/drivers/clocksource/sh_tmu.c @@ -200,16 +200,8 @@ static cycle_t sh_tmu_clocksource_read(s static int sh_tmu_clocksource_enable(struct clocksource *cs) { struct sh_tmu_priv *p = cs_to_sh_tmu(cs); - int ret; - ret = sh_tmu_enable(p); - if (ret) - return ret; - - /* TODO: calculate good shift from rate and counter bit width */ - cs->shift = 10; - cs->mult = clocksource_hz2mult(p->rate, cs->shift); - return 0; + return sh_tmu_enable(p); } static void sh_tmu_clocksource_disable(struct clocksource *cs) @@ -229,6 +221,16 @@ static int sh_tmu_register_clocksource(s cs->disable = sh_tmu_clocksource_disable; cs->mask = CLOCKSOURCE_MASK(32); cs->flags = CLOCK_SOURCE_IS_CONTINUOUS; + + /* clk_get_rate() needs an enabled clock */ + clk_enable(p->clk); + /* channel will be configured at parent clock / 4 */ + p->rate = clk_get_rate(p->clk) / 4; + clk_disable(p->clk); + /* TODO: calculate good shift from rate and counter bit width */ + cs->shift = 10; + cs->mult = clocksource_hz2mult(p->rate, cs->shift); + pr_info("sh_tmu: %s used as clock source\n", cs->name); clocksource_register(cs); return 0; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [137/200] clocksource: sh_cmt: compute mult and shift before registration 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (134 preceding siblings ...) 2010-07-01 17:43 ` [136/200] clocksource: sh_tmu: compute mult and shift before registration Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [138/200] gconfig: fix build failure on fedora 13 Greg KH ` (63 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Paul Mundt 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Paul Mundt <lethal@linux-sh.org> commit f4d7c3565c1692c54d9152b52090fe73f0029e37 upstream. Based on the sh_tmu change in 66f49121ffa41a19c59965b31b046d8368fec3c7 ("clocksource: sh_tmu: compute mult and shift before registration"). The same issues impact the sh_cmt driver, so we take the same approach here. Signed-off-by: Paul Mundt <lethal@linux-sh.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/clocksource/sh_cmt.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) --- a/drivers/clocksource/sh_cmt.c +++ b/drivers/clocksource/sh_cmt.c @@ -413,18 +413,10 @@ static cycle_t sh_cmt_clocksource_read(s static int sh_cmt_clocksource_enable(struct clocksource *cs) { struct sh_cmt_priv *p = cs_to_sh_cmt(cs); - int ret; p->total_cycles = 0; - ret = sh_cmt_start(p, FLAG_CLOCKSOURCE); - if (ret) - return ret; - - /* TODO: calculate good shift from rate and counter bit width */ - cs->shift = 0; - cs->mult = clocksource_hz2mult(p->rate, cs->shift); - return 0; + return sh_cmt_start(p, FLAG_CLOCKSOURCE); } static void sh_cmt_clocksource_disable(struct clocksource *cs) @@ -451,7 +443,18 @@ static int sh_cmt_register_clocksource(s cs->resume = sh_cmt_clocksource_resume; cs->mask = CLOCKSOURCE_MASK(sizeof(unsigned long) * 8); cs->flags = CLOCK_SOURCE_IS_CONTINUOUS; + + /* clk_get_rate() needs an enabled clock */ + clk_enable(p->clk); + p->rate = clk_get_rate(p->clk) / (p->width == 16) ? 512 : 8; + clk_disable(p->clk); + + /* TODO: calculate good shift from rate and counter bit width */ + cs->shift = 10; + cs->mult = clocksource_hz2mult(p->rate, cs->shift); + pr_info("sh_cmt: %s used as clock source\n", cs->name); + clocksource_register(cs); return 0; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [138/200] gconfig: fix build failure on fedora 13 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (135 preceding siblings ...) 2010-07-01 17:43 ` [137/200] clocksource: sh_cmt: " Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [139/200] arch/x86/kernel: Add missing spin_unlock Greg KH ` (62 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Richard Kennedy, Michal Marek 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Richard Kennedy <richard@rsk.demon.co.uk> commit cbab05f041a4cff6ca15856bdd35238b282b64eb upstream. Making gconfig fails on fedora 13 as the linker cannot resolve dlsym. Adding libdl to the link command fixes this. make shows this error :- /usr/bin/ld: scripts/kconfig/kconfig_load.o: undefined reference to symbol 'dlsym@@GLIBC_2.2.5' /usr/bin/ld: note: 'dlsym@@GLIBC_2.2.5' is defined in DSO /lib64/libdl.so.2 so try adding it to the linker command line /lib64/libdl.so.2: could not read symbols: Invalid operation tested on x86_64 fedora 13. Signed-off-by: Richard Kennedy <richard@rsk.demon.co.uk> Reviewed-by: WANG Cong <xiyou.wangcong@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Michal Marek <mmarek@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- scripts/kconfig/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/scripts/kconfig/Makefile +++ b/scripts/kconfig/Makefile @@ -208,7 +208,7 @@ HOSTCFLAGS_zconf.tab.o := -I$(src) HOSTLOADLIBES_qconf = $(KC_QT_LIBS) -ldl HOSTCXXFLAGS_qconf.o = $(KC_QT_CFLAGS) -D LKC_DIRECT_LINK -HOSTLOADLIBES_gconf = `pkg-config --libs gtk+-2.0 gmodule-2.0 libglade-2.0` +HOSTLOADLIBES_gconf = `pkg-config --libs gtk+-2.0 gmodule-2.0 libglade-2.0` -ldl HOSTCFLAGS_gconf.o = `pkg-config --cflags gtk+-2.0 gmodule-2.0 libglade-2.0` \ -D LKC_DIRECT_LINK ^ permalink raw reply [flat|nested] 666+ messages in thread
* [139/200] arch/x86/kernel: Add missing spin_unlock 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (136 preceding siblings ...) 2010-07-01 17:43 ` [138/200] gconfig: fix build failure on fedora 13 Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [140/200] pcmcia: only keep saved I365_CSCINT flag if there is no PCI irq Greg KH ` (61 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Julia Lawall, Joerg Roedel 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Julia Lawall <julia@diku.dk> commit 84fe6c19e4a598e8071e3bd1b2c923454eae1268 upstream. Add a spin_unlock missing on the error path. The locks and unlocks are balanced in other functions, so it seems that the same should be the case here. The semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression E1; @@ * spin_lock(E1,...); <+... when != E1 if (...) { ... when != E1 * return ...; } ...+> * spin_unlock(E1,...); // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/kernel/amd_iommu.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) --- a/arch/x86/kernel/amd_iommu.c +++ b/arch/x86/kernel/amd_iommu.c @@ -1420,6 +1420,7 @@ static int __attach_device(struct device struct protection_domain *domain) { struct iommu_dev_data *dev_data, *alias_data; + int ret; dev_data = get_dev_data(dev); alias_data = get_dev_data(dev_data->alias); @@ -1431,13 +1432,14 @@ static int __attach_device(struct device spin_lock(&domain->lock); /* Some sanity checks */ + ret = -EBUSY; if (alias_data->domain != NULL && alias_data->domain != domain) - return -EBUSY; + goto out_unlock; if (dev_data->domain != NULL && dev_data->domain != domain) - return -EBUSY; + goto out_unlock; /* Do real assignment */ if (dev_data->alias != dev) { @@ -1453,10 +1455,14 @@ static int __attach_device(struct device atomic_inc(&dev_data->bind); + ret = 0; + +out_unlock: + /* ready */ spin_unlock(&domain->lock); - return 0; + return ret; } /* ^ permalink raw reply [flat|nested] 666+ messages in thread
* [140/200] pcmcia: only keep saved I365_CSCINT flag if there is no PCI irq 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (137 preceding siblings ...) 2010-07-01 17:43 ` [139/200] arch/x86/kernel: Add missing spin_unlock Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [141/200] pcmcia: avoid validate_cis failure on CIS override Greg KH ` (60 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dominik Brodowski 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dominik Brodowski <linux@dominikbrodowski.net> commit 02caa56e4b789b80ae7e0f0f0789f94b44ad32ef upstream. Keeping the saved I365_CSCINT flag around breaks PCMCIA on some system, and is only needed on a few systems to get PCMCIA to work. This patch allows PCMCIA to work on both types, and it fixes https://bugzilla.kernel.org/show_bug.cgi?id=16015 Reported-by: Justin P. Mattock <justinmattock@gmail.com> Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/pcmcia/yenta_socket.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/pcmcia/yenta_socket.c +++ b/drivers/pcmcia/yenta_socket.c @@ -975,7 +975,7 @@ static irqreturn_t yenta_probe_handler(i /* probes the PCI interrupt, use only on override functions */ static int yenta_probe_cb_irq(struct yenta_socket *socket) { - u8 reg; + u8 reg = 0; if (!socket->cb_irq) return -1; @@ -989,7 +989,8 @@ static int yenta_probe_cb_irq(struct yen } /* generate interrupt, wait */ - reg = exca_readb(socket, I365_CSCINT); + if (!socket->dev->irq) + reg = exca_readb(socket, I365_CSCINT); exca_writeb(socket, I365_CSCINT, reg | I365_CSC_STSCHG); cb_writel(socket, CB_SOCKET_EVENT, -1); cb_writel(socket, CB_SOCKET_MASK, CB_CSTSMASK); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [141/200] pcmcia: avoid validate_cis failure on CIS override 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (138 preceding siblings ...) 2010-07-01 17:43 ` [140/200] pcmcia: only keep saved I365_CSCINT flag if there is no PCI irq Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [142/200] mac80211: fix deauth before assoc Greg KH ` (59 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Dominik Brodowski 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dominik Brodowski <linux@dominikbrodowski.net> commit b83156b52dd77979cc93bafc2283929532f6f7d0 upstream. Commit a8408c17 introduced a new check to pccard_validate_cis(), which avoids any "late" calls to this function. This broke the insertion of cards which require a CIS override which changes the number of card functions. Fix this by asserting that this is _not_ a late call, but a proper call early during the card insertion process. Fixes https://bugzilla.kernel.org/show_bug.cgi?id=16138 Reported-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/pcmcia/ds.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/pcmcia/ds.c +++ b/drivers/pcmcia/ds.c @@ -682,6 +682,7 @@ static void pcmcia_requery(struct pcmcia if (old_funcs != new_funcs) { /* we need to re-start */ pcmcia_card_remove(s, NULL); + s->functions = 0; pcmcia_card_add(s); } } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [142/200] mac80211: fix deauth before assoc 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (139 preceding siblings ...) 2010-07-01 17:43 ` [141/200] pcmcia: avoid validate_cis failure on CIS override Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [143/200] ath5k: retain promiscuous setting Greg KH ` (58 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Johannes Berg, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johannes Berg <johannes.berg@intel.com> commit b054b747a694927879c94dd11af54d04346aed7d upstream. When we receive a deauthentication frame before having successfully associated, we neither print a message nor abort assocation. The former makes it hard to debug, while the latter later causes a warning in cfg80211 when, as will typically be the case, association timed out. This warning was reported by many, e.g. in https://bugzilla.kernel.org/show_bug.cgi?id=15981, but I couldn't initially pinpoint it. I verified the fix by hacking hostapd to send a deauth frame instead of an association response. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Tested-by: Miles Lane <miles.lane@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/mac80211/mlme.c | 40 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 38 insertions(+), 2 deletions(-) --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -1530,9 +1530,45 @@ static void ieee80211_sta_rx_queued_mgmt mutex_unlock(&ifmgd->mtx); if (skb->len >= 24 + 2 /* mgmt + deauth reason */ && - (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH) - cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len); + (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH) { + struct ieee80211_local *local = sdata->local; + struct ieee80211_work *wk; + + mutex_lock(&local->work_mtx); + list_for_each_entry(wk, &local->work_list, list) { + if (wk->sdata != sdata) + continue; + + if (wk->type != IEEE80211_WORK_ASSOC) + continue; + + if (memcmp(mgmt->bssid, wk->filter_ta, ETH_ALEN)) + continue; + if (memcmp(mgmt->sa, wk->filter_ta, ETH_ALEN)) + continue; + /* + * Printing the message only here means we can't + * spuriously print it, but it also means that it + * won't be printed when the frame comes in before + * we even tried to associate or in similar cases. + * + * Ultimately, I suspect cfg80211 should print the + * messages instead. + */ + printk(KERN_DEBUG + "%s: deauthenticated from %pM (Reason: %u)\n", + sdata->name, mgmt->bssid, + le16_to_cpu(mgmt->u.deauth.reason_code)); + + list_del_rcu(&wk->list); + free_work(wk); + break; + } + mutex_unlock(&local->work_mtx); + + cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len); + } out: kfree_skb(skb); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [143/200] ath5k: retain promiscuous setting 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (140 preceding siblings ...) 2010-07-01 17:43 ` [142/200] mac80211: fix deauth before assoc Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [144/200] ahci: add pci quirk for JMB362 Greg KH ` (57 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Bob Copeland, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bob Copeland <me@bobcopeland.com> commit 6b5dcccb495b66b3b0b9581cdccfed038e5d68a2 upstream. Commit 56d1de0a21db28e41741cfa0a66e18bc8d920554, "ath5k: clean up filter flags setting" introduced a regression in monitor mode such that the promisc filter flag would get lost. Although we set the promisc flag when it changed, we did not preserve it across subsequent calls to configure_filter. This patch restores the original functionality. Bisected-by: weedy2887@gmail.com Tested-by: weedy2887@gmail.com Tested-by: Rick Farina <sidhayn@gmail.com> Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/ath/ath5k/base.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/net/wireless/ath/ath5k/base.c +++ b/drivers/net/wireless/ath/ath5k/base.c @@ -2994,13 +2994,15 @@ static void ath5k_configure_filter(struc if (changed_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS)) { if (*new_flags & FIF_PROMISC_IN_BSS) { - rfilt |= AR5K_RX_FILTER_PROM; __set_bit(ATH_STAT_PROMISC, sc->status); } else { __clear_bit(ATH_STAT_PROMISC, sc->status); } } + if (test_bit(ATH_STAT_PROMISC, sc->status)) + rfilt |= AR5K_RX_FILTER_PROM; + /* Note, AR5K_RX_FILTER_MCAST is already enabled */ if (*new_flags & FIF_ALLMULTI) { mfilt[0] = ~0; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [144/200] ahci: add pci quirk for JMB362 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (141 preceding siblings ...) 2010-07-01 17:43 ` [143/200] ath5k: retain promiscuous setting Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [145/200] firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder Greg KH ` (56 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Jeff Garzik 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tejun Heo <tj@kernel.org> commit 4daedcfe8c6851aa01cc1997220f2577f4039c13 upstream. JMB362 is a new variant of jmicron controller which is similar to JMB360 but has two SATA ports instead of one. As there is no PATA port, single function AHCI mode can be used as in JMB360. Add pci quirk for JMB362. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Aries Lee <arieslee@jmicron.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/pci/quirks.c | 5 ++++- include/linux/pci_ids.h | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -1457,7 +1457,8 @@ static void quirk_jmicron_ata(struct pci conf5 &= ~(1 << 24); /* Clear bit 24 */ switch (pdev->device) { - case PCI_DEVICE_ID_JMICRON_JMB360: + case PCI_DEVICE_ID_JMICRON_JMB360: /* SATA single port */ + case PCI_DEVICE_ID_JMICRON_JMB362: /* SATA dual ports */ /* The controller should be in single function ahci mode */ conf1 |= 0x0002A100; /* Set 8, 13, 15, 17 */ break; @@ -1493,12 +1494,14 @@ static void quirk_jmicron_ata(struct pci } DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB360, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, quirk_jmicron_ata); +DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB362, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, quirk_jmicron_ata); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB360, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, quirk_jmicron_ata); +DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB362, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, quirk_jmicron_ata); DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, quirk_jmicron_ata); --- a/include/linux/pci_ids.h +++ b/include/linux/pci_ids.h @@ -2321,6 +2321,7 @@ #define PCI_VENDOR_ID_JMICRON 0x197B #define PCI_DEVICE_ID_JMICRON_JMB360 0x2360 #define PCI_DEVICE_ID_JMICRON_JMB361 0x2361 +#define PCI_DEVICE_ID_JMICRON_JMB362 0x2362 #define PCI_DEVICE_ID_JMICRON_JMB363 0x2363 #define PCI_DEVICE_ID_JMICRON_JMB365 0x2365 #define PCI_DEVICE_ID_JMICRON_JMB366 0x2366 ^ permalink raw reply [flat|nested] 666+ messages in thread
* [145/200] firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (142 preceding siblings ...) 2010-07-01 17:43 ` [144/200] ahci: add pci quirk for JMB362 Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [146/200] misc: Fix allocation borrowed by vhost_net Greg KH ` (55 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Stefan Richter 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Stefan Richter <stefanr@s5r6.in-berlin.de> commit 10389536742cefbedecb67a5b2906f155cf3a1c3 upstream. Per IEEE 1394 clause 8.4.2.3, a contender for the IRM role shall check whether the current IRM complies to 1394a-2000 or later. If not force a compliant node (e.g. itself) to become IRM. This was implemented in the older ieee1394 driver but not yet in firewire-core. An older Sony camcorder (Sony DCR-TRV25) which implements 1394-1995 IRM but neither 1394a-2000 IRM nor BM was now found to cause an interoperability bug: - Camcorder becomes root node when plugged in, hence gets IRM role. - firewire-core successfully contends for BM role, proceeds to perform gap count optimization and resets the bus. - Sony camcorder ignores presence of a BM (against the spec, this is a firmware bug), performs its idea of gap count optimization and resets the bus. - Preceding two steps are repeated endlessly, bus never settles, regular I/O is practically impossible. http://thread.gmane.org/gmane.linux.kernel.firewire.user/3913 This is an interoperability regression from the old to the new drivers. Fix it indirectly by adding the 1394a IRM check. The spec suggests three and a half methods to determine 1394a compliance of a remote IRM; we choose the method of testing the Config_ROM.Bus_Info.generation field. This is data that firewire-core should have readily available at this point, i.e. does not require extra I/O. Reported-by: Clemens Ladisch <clemens@ladisch.de> (missing 1394a check) Reported-by: H. S. <hs.samix@gmail.com> (issue with Sony DCR-TRV25) Tested-by: H. S. <hs.samix@gmail.com> Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/firewire/core-card.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) --- a/drivers/firewire/core-card.c +++ b/drivers/firewire/core-card.c @@ -231,7 +231,7 @@ void fw_schedule_bm_work(struct fw_card static void fw_card_bm_work(struct work_struct *work) { struct fw_card *card = container_of(work, struct fw_card, work.work); - struct fw_device *root_device; + struct fw_device *root_device, *irm_device; struct fw_node *root_node; unsigned long flags; int root_id, new_root_id, irm_id, local_id; @@ -239,6 +239,7 @@ static void fw_card_bm_work(struct work_ bool do_reset = false; bool root_device_is_running; bool root_device_is_cmc; + bool irm_is_1394_1995_only; spin_lock_irqsave(&card->lock, flags); @@ -248,12 +249,18 @@ static void fw_card_bm_work(struct work_ } generation = card->generation; + root_node = card->root_node; fw_node_get(root_node); root_device = root_node->data; root_device_is_running = root_device && atomic_read(&root_device->state) == FW_DEVICE_RUNNING; root_device_is_cmc = root_device && root_device->cmc; + + irm_device = card->irm_node->data; + irm_is_1394_1995_only = irm_device && irm_device->config_rom && + (irm_device->config_rom[2] & 0x000000f0) == 0; + root_id = root_node->node_id; irm_id = card->irm_node->node_id; local_id = card->local_node->node_id; @@ -276,8 +283,15 @@ static void fw_card_bm_work(struct work_ if (!card->irm_node->link_on) { new_root_id = local_id; - fw_notify("IRM has link off, making local node (%02x) root.\n", - new_root_id); + fw_notify("%s, making local node (%02x) root.\n", + "IRM has link off", new_root_id); + goto pick_me; + } + + if (irm_is_1394_1995_only) { + new_root_id = local_id; + fw_notify("%s, making local node (%02x) root.\n", + "IRM is not 1394a compliant", new_root_id); goto pick_me; } @@ -316,8 +330,8 @@ static void fw_card_bm_work(struct work_ * root, and thus, IRM. */ new_root_id = local_id; - fw_notify("BM lock failed, making local node (%02x) root.\n", - new_root_id); + fw_notify("%s, making local node (%02x) root.\n", + "BM lock failed", new_root_id); goto pick_me; } } else if (card->bm_generation != generation) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [146/200] misc: Fix allocation borrowed by vhost_net 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (143 preceding siblings ...) 2010-07-01 17:43 ` [145/200] firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [147/200] cgroups: alloc_css_id() increments hierarchy depth Greg KH ` (54 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Alan Cox 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alan Cox <alan@linux.intel.com> commit 79907d89c397b8bc2e05b347ec94e928ea919d33 upstream. 10, 233 is allocated officially to /dev/kmview which is shipping in Ubuntu and Debian distributions. vhost_net seem to have borrowed it without making a proper request and this causes regressions in the other distributions. vhost_net can use a dynamic minor so use that instead. Also update the file with a comment to try and avoid future misunderstandings. Signed-off-by: Alan Cox <device@lanana.org> [ We should have caught this before 2.6.34 got released. - Linus ] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/vhost/net.c | 2 +- include/linux/miscdevice.h | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -637,7 +637,7 @@ const static struct file_operations vhos }; static struct miscdevice vhost_net_misc = { - VHOST_NET_MINOR, + MISC_DYNAMIC_MINOR, "vhost-net", &vhost_net_fops, }; --- a/include/linux/miscdevice.h +++ b/include/linux/miscdevice.h @@ -3,6 +3,12 @@ #include <linux/module.h> #include <linux/major.h> +/* + * These allocations are managed by device@lanana.org. If you use an + * entry that is not in assigned your entry may well be moved and + * reassigned, or set dynamic if a fixed value is not justified. + */ + #define PSMOUSE_MINOR 1 #define MS_BUSMOUSE_MINOR 2 #define ATIXL_BUSMOUSE_MINOR 3 @@ -30,7 +36,6 @@ #define HPET_MINOR 228 #define FUSE_MINOR 229 #define KVM_MINOR 232 -#define VHOST_NET_MINOR 233 #define MISC_DYNAMIC_MINOR 255 struct device; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [147/200] cgroups: alloc_css_id() increments hierarchy depth 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (144 preceding siblings ...) 2010-07-01 17:43 ` [146/200] misc: Fix allocation borrowed by vhost_net Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [148/200] perf_events: Fix resource leak in x86 __hw_perf_event_init() Greg KH ` (53 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Greg Thelen, Paul Menage, KAMEZAWA Hiroyuki, Li Zefan 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Greg Thelen <gthelen@google.com> commit 94b3dd0f7bb393d93e84a173b1df9b8b64c83ac4 upstream. Child groups should have a greater depth than their parents. Prior to this change, the parent would incorrectly report zero memory usage for child cgroups when use_hierarchy is enabled. test script: mount -t cgroup none /cgroups -o memory cd /cgroups mkdir cg1 echo 1 > cg1/memory.use_hierarchy mkdir cg1/cg11 echo $$ > cg1/cg11/tasks dd if=/dev/zero of=/tmp/foo bs=1M count=1 echo echo CHILD grep cache cg1/cg11/memory.stat echo echo PARENT grep cache cg1/memory.stat echo $$ > tasks rmdir cg1/cg11 cg1 cd / umount /cgroups Using fae9c79, a recent patch that changed alloc_css_id() depth computation, the parent incorrectly reports zero usage: root@ubuntu:~# ./test 1+0 records in 1+0 records out 1048576 bytes (1.0 MB) copied, 0.0151844 s, 69.1 MB/s CHILD cache 1048576 total_cache 1048576 PARENT cache 0 total_cache 0 With this patch, the parent correctly includes child usage: root@ubuntu:~# ./test 1+0 records in 1+0 records out 1048576 bytes (1.0 MB) copied, 0.0136827 s, 76.6 MB/s CHILD cache 1052672 total_cache 1052672 PARENT cache 0 total_cache 1052672 Signed-off-by: Greg Thelen <gthelen@google.com> Acked-by: Paul Menage <menage@google.com> Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Acked-by: Li Zefan <lizf@cn.fujitsu.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -4599,7 +4599,7 @@ static int alloc_css_id(struct cgroup_su parent_css = parent->subsys[subsys_id]; child_css = child->subsys[subsys_id]; parent_id = parent_css->id; - depth = parent_id->depth; + depth = parent_id->depth + 1; child_id = get_new_cssid(ss, depth); if (IS_ERR(child_id)) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [148/200] perf_events: Fix resource leak in x86 __hw_perf_event_init() 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (145 preceding siblings ...) 2010-07-01 17:43 ` [147/200] cgroups: alloc_css_id() increments hierarchy depth Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:43 ` [149/200] sata_nv: dont diddle with nIEN on mcp55 Greg KH ` (52 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Stephane Eranian, peterz, paulus, davem, fweisbec, robert.richter, perfmon2-devel, Ingo Molnar 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Stephane Eranian <eranian@google.com> commit 4b24a88b35e15e04bd8f2c5dda65b5dc8ebca05f upstream. If reserve_pmc_hardware() succeeds but reserve_ds_buffers() fails, then we need to release_pmc_hardware. It won't be done by the destroy() callback because we return before setting it in case of error. Signed-off-by: Stephane Eranian <eranian@google.com> Cc: peterz@infradead.org Cc: paulus@samba.org Cc: davem@davemloft.net Cc: fweisbec@gmail.com Cc: robert.richter@amd.com Cc: perfmon2-devel@lists.sf.net LKML-Reference: <4ba1568b.15185e0a.182a.7802@mx.google.com> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/x86/kernel/cpu/perf_event.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/arch/x86/kernel/cpu/perf_event.c +++ b/arch/x86/kernel/cpu/perf_event.c @@ -460,8 +460,11 @@ static int __hw_perf_event_init(struct p if (atomic_read(&active_events) == 0) { if (!reserve_pmc_hardware()) err = -EBUSY; - else + else { err = reserve_bts_hardware(); + if (err) + release_pmc_hardware(); + } } if (!err) atomic_inc(&active_events); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [149/200] sata_nv: dont diddle with nIEN on mcp55 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (146 preceding siblings ...) 2010-07-01 17:43 ` [148/200] perf_events: Fix resource leak in x86 __hw_perf_event_init() Greg KH @ 2010-07-01 17:43 ` Greg KH 2010-07-01 17:44 ` [150/200] sata_via: magic vt6421 fix for transmission problems w/ WD drives Greg KH ` (51 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:43 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Jeff Garzik [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 1774 bytes --] 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tejun Heo <tj@kernel.org> commit f3faf8fc3fab45c3526efe8c9e99bb23f8723350 upstream. On mcp55, nIEN gets stuck once set and liteon blueray rom iHOS104-08 violates ATA specification and fails to set I on D2H Reg FIS if nIEN is set when the command was issued. When the other party is following the spec, both devices can work fine but when the two flaws are put together, they can't talk to each other. mcp55 has its own IRQ masking mechanism and there's no reason to mess with nIEN in the first place. Fix it by dropping nIEN diddling from nv_mcp55_freeze/thaw(). This was originally reported by Cengiz. Although Cengiz hasn't verified the fix yet, I could reproduce this problem and verfiy the fix. Even if Cengiz is experiencing different or additional problems, this patch is needed. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Cengiz Günay <cgunay@emory.edu> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/sata_nv.c | 2 -- 1 file changed, 2 deletions(-) --- a/drivers/ata/sata_nv.c +++ b/drivers/ata/sata_nv.c @@ -1674,7 +1674,6 @@ static void nv_mcp55_freeze(struct ata_p mask = readl(mmio_base + NV_INT_ENABLE_MCP55); mask &= ~(NV_INT_ALL_MCP55 << shift); writel(mask, mmio_base + NV_INT_ENABLE_MCP55); - ata_sff_freeze(ap); } static void nv_mcp55_thaw(struct ata_port *ap) @@ -1688,7 +1687,6 @@ static void nv_mcp55_thaw(struct ata_por mask = readl(mmio_base + NV_INT_ENABLE_MCP55); mask |= (NV_INT_MASK_MCP55 << shift); writel(mask, mmio_base + NV_INT_ENABLE_MCP55); - ata_sff_thaw(ap); } static void nv_adma_error_handler(struct ata_port *ap) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [150/200] sata_via: magic vt6421 fix for transmission problems w/ WD drives 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (147 preceding siblings ...) 2010-07-01 17:43 ` [149/200] sata_nv: dont diddle with nIEN on mcp55 Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [151/200] drm/i915: Rebind bo if currently bound with incorrect alignment Greg KH ` (50 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Tejun Heo, Jeff Garzik 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tejun Heo <tj@kernel.org> commit 8b27ff4cf6d15964aa2987aeb58db4dfb1f87a19 upstream. vt6421 has problems talking to recent WD drives. It causes a lot of transmission errors while high bandwidth transfer as reported in the following bugzilla entry. https://bugzilla.kernel.org/show_bug.cgi?id=15173 Joseph Chan provided the following fix. I don't have any idea what it does but I can verify the issue is gone with the patch applied. Signed-off-by: Tejun Heo <tj@kernel.org> Originally-from: Joseph Chan <JosephChan@via.com.tw> Reported-by: Jorrit Tijben <sjorrit@gmail.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/ata/sata_via.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) --- a/drivers/ata/sata_via.c +++ b/drivers/ata/sata_via.c @@ -575,6 +575,19 @@ static void svia_configure(struct pci_de tmp8 |= NATIVE_MODE_ALL; pci_write_config_byte(pdev, SATA_NATIVE_MODE, tmp8); } + + /* + * vt6421 has problems talking to some drives. The following + * is the magic fix from Joseph Chan <JosephChan@via.com.tw>. + * Please add proper documentation if possible. + * + * https://bugzilla.kernel.org/show_bug.cgi?id=15173 + */ + if (pdev->device == 0x3249) { + pci_read_config_byte(pdev, 0x52, &tmp8); + tmp8 |= 1 << 2; + pci_write_config_byte(pdev, 0x52, tmp8); + } } static int svia_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [151/200] drm/i915: Rebind bo if currently bound with incorrect alignment. 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (148 preceding siblings ...) 2010-07-01 17:44 ` [150/200] sata_via: magic vt6421 fix for transmission problems w/ WD drives Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [152/200] drm/i915: Kill dangerous pending-flip debugging Greg KH ` (49 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Chris Wilson, Eric Anholt 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chris Wilson <chris@chris-wilson.co.uk> commit ac0c6b5ad3b3b513e1057806d4b7627fcc0ecc27 upstream. Whilst pinning the buffer, check that that its current alignment matches the requested alignment. If it does not, rebind. This should clear up any final render errors whilst resuming, for reference: Bug 27070 - [i915] Page table errors with empty ringbuffer https://bugs.freedesktop.org/show_bug.cgi?id=27070 Bug 15502 - render error detected, EIR: 0x00000010 https://bugzilla.kernel.org/show_bug.cgi?id=15502 Bug 13844 - i915 error: "render error detected" https://bugzilla.kernel.org/show_bug.cgi?id=13844 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/i915/i915_gem.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -4239,6 +4239,17 @@ i915_gem_object_pin(struct drm_gem_objec int ret; i915_verify_inactive(dev, __FILE__, __LINE__); + + if (obj_priv->gtt_space != NULL) { + if (alignment == 0) + alignment = i915_gem_get_gtt_alignment(obj); + if (obj_priv->gtt_offset & (alignment - 1)) { + ret = i915_gem_object_unbind(obj); + if (ret) + return ret; + } + } + if (obj_priv->gtt_space == NULL) { ret = i915_gem_object_bind_to_gtt(obj, alignment); if (ret) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [152/200] drm/i915: Kill dangerous pending-flip debugging 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (149 preceding siblings ...) 2010-07-01 17:44 ` [151/200] drm/i915: Rebind bo if currently bound with incorrect alignment Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [153/200] USB: mos7840: fix null-pointer dereference Greg KH ` (48 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Chris Wilson, Jesse Barnes, Eric Anholt 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chris Wilson <chris@chris-wilson.co.uk> commit 9908ff736adf261e749b4887486a32ffa209304c upstream. We can, by virtue of a vblank interrupt firing in the middle of setting up the unpin work (i.e. after we set the unpin_work field and before we write to the ringbuffer) enter intel_finish_page_flip() prior to receiving the pending flip notification. Therefore we can expect to hit intel_finish_page_flip() under normal circumstances without a pending flip and even without installing the pending_flip_obj. This is exacerbated by aperture thrashing whilst binding the framebuffer Bug 28079 - "glresize" causes kernel panic in intel_finish_page_flip. https://bugs.freedesktop.org/show_bug.cgi?id=28079 Reported-by: Nick Bowler <nbowler@draconx.ca> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Jesse Barnes <jbarnes@virtuousgeek.org> Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/i915/intel_display.c | 6 ------ 1 file changed, 6 deletions(-) --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -4155,12 +4155,6 @@ void intel_finish_page_flip(struct drm_d spin_lock_irqsave(&dev->event_lock, flags); work = intel_crtc->unpin_work; if (work == NULL || !work->pending) { - if (work && !work->pending) { - obj_priv = to_intel_bo(work->pending_flip_obj); - DRM_DEBUG_DRIVER("flip finish: %p (%d) not pending?\n", - obj_priv, - atomic_read(&obj_priv->pending_flip)); - } spin_unlock_irqrestore(&dev->event_lock, flags); return; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [153/200] USB: mos7840: fix null-pointer dereference 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (150 preceding siblings ...) 2010-07-01 17:44 ` [152/200] drm/i915: Kill dangerous pending-flip debugging Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [154/200] USB: xhci: Wait for host to start running Greg KH ` (47 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Johan Hovold 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johan Hovold <jhovold@gmail.com> commit b41709f1263bb1ad37efc43fea0bb0b670c12e78 upstream. Fix null-pointer dereference on error path. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/mos7840.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/usb/serial/mos7840.c +++ b/drivers/usb/serial/mos7840.c @@ -731,7 +731,6 @@ static void mos7840_bulk_in_callback(str mos7840_port = urb->context; if (!mos7840_port) { dbg("%s", "NULL mos7840_port pointer"); - mos7840_port->read_urb_busy = false; return; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [154/200] USB: xhci: Wait for host to start running. 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (151 preceding siblings ...) 2010-07-01 17:44 ` [153/200] USB: mos7840: fix null-pointer dereference Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [155/200] USB: xhci: Wait for controller to be ready after reset Greg KH ` (46 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sarah Sharp <sarah.a.sharp@linux.intel.com> commit ed07453fd356025cc25272629e982f5e4607632c upstream. When the run bit is set in the xHCI command register, it may take a few microseconds for the host to start running. We cannot ring any doorbells until the host is actually running, so wait until the status register says the host is running. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Reported-by: Shinya Saito <shinya.saito.sx@renesas.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci.c | 39 ++++++++++++++++++++++++++++++++------- 1 file changed, 32 insertions(+), 7 deletions(-) --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -105,6 +105,33 @@ int xhci_halt(struct xhci_hcd *xhci) } /* + * Set the run bit and wait for the host to be running. + */ +int xhci_start(struct xhci_hcd *xhci) +{ + u32 temp; + int ret; + + temp = xhci_readl(xhci, &xhci->op_regs->command); + temp |= (CMD_RUN); + xhci_dbg(xhci, "// Turn on HC, cmd = 0x%x.\n", + temp); + xhci_writel(xhci, temp, &xhci->op_regs->command); + + /* + * Wait for the HCHalted Status bit to be 0 to indicate the host is + * running. + */ + ret = handshake(xhci, &xhci->op_regs->status, + STS_HALT, 0, XHCI_MAX_HALT_USEC); + if (ret == -ETIMEDOUT) + xhci_err(xhci, "Host took too long to start, " + "waited %u microseconds.\n", + XHCI_MAX_HALT_USEC); + return ret; +} + +/* * Reset a halted HC, and set the internal HC state to HC_STATE_HALT. * * This resets pipelines, timers, counters, state machines, etc. @@ -452,13 +479,11 @@ int xhci_run(struct usb_hcd *hcd) if (NUM_TEST_NOOPS > 0) doorbell = xhci_setup_one_noop(xhci); - temp = xhci_readl(xhci, &xhci->op_regs->command); - temp |= (CMD_RUN); - xhci_dbg(xhci, "// Turn on HC, cmd = 0x%x.\n", - temp); - xhci_writel(xhci, temp, &xhci->op_regs->command); - /* Flush PCI posted writes */ - temp = xhci_readl(xhci, &xhci->op_regs->command); + if (xhci_start(xhci)) { + xhci_halt(xhci); + return -ENODEV; + } + xhci_dbg(xhci, "// @%p = 0x%x\n", &xhci->op_regs->command, temp); if (doorbell) (*doorbell)(xhci); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [155/200] USB: xhci: Wait for controller to be ready after reset. 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (152 preceding siblings ...) 2010-07-01 17:44 ` [154/200] USB: xhci: Wait for host to start running Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [156/200] USB: ftdi_sio: fix DTR/RTS line modes Greg KH ` (45 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Sarah Sharp 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sarah Sharp <sarah.a.sharp@linux.intel.com> commit 2d62f3eea98354d61f90d6b115eecf9be5f4bdfe upstream. After software resets an xHCI host controller, it must wait for the "Controller Not Ready" (CNR) bit in the status register to be cleared. Software is not supposed to ring any doorbells or write to any registers except the status register until this bit is cleared. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/host/xhci.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -142,6 +142,7 @@ int xhci_reset(struct xhci_hcd *xhci) { u32 command; u32 state; + int ret; state = xhci_readl(xhci, &xhci->op_regs->status); if ((state & STS_HALT) == 0) { @@ -156,7 +157,17 @@ int xhci_reset(struct xhci_hcd *xhci) /* XXX: Why does EHCI set this here? Shouldn't other code do this? */ xhci_to_hcd(xhci)->state = HC_STATE_HALT; - return handshake(xhci, &xhci->op_regs->command, CMD_RESET, 0, 250 * 1000); + ret = handshake(xhci, &xhci->op_regs->command, + CMD_RESET, 0, 250 * 1000); + if (ret) + return ret; + + xhci_dbg(xhci, "Wait for controller to be ready for doorbell rings\n"); + /* + * xHCI cannot write to any doorbells or operational registers other + * than status until the "Controller Not Ready" flag is cleared. + */ + return handshake(xhci, &xhci->op_regs->status, STS_CNR, 0, 250 * 1000); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [156/200] USB: ftdi_sio: fix DTR/RTS line modes 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (153 preceding siblings ...) 2010-07-01 17:44 ` [155/200] USB: xhci: Wait for controller to be ready after reset Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [157/200] USB: cdc-acm: fix resource reclaim in error path of acm_probe Greg KH ` (44 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Daniel Mack, Johan Hovold, Alan Cox 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel Mack <daniel@caiaq.de> commit 6a1a82df91fa0eb1cc76069a9efe5714d087eccd upstream. Call set_mctrl() and clear_mctrl() according to the flow control mode selected. This makes serial communication for FT232 connected devices work when CRTSCTS is not set. This fixes a regression introduced by 4175f3e31 ("tty_port: If we are opened non blocking we still need to raise the carrier"). This patch calls the low-level driver's dtr_rts() function which consequently sets TIOCM_DTR | TIOCM_RTS. A later call to set_termios() without CRTSCTS in cflags, however, does not reset these bits, and so data is not actually sent out on the serial wire. Signed-off-by: Daniel Mack <daniel@caiaq.de> Cc: Johan Hovold <jhovold@gmail.com> Cc: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/serial/ftdi_sio.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/usb/serial/ftdi_sio.c +++ b/drivers/usb/serial/ftdi_sio.c @@ -2289,6 +2289,8 @@ static void ftdi_set_termios(struct tty_ "urb failed to set to rts/cts flow control\n"); } + /* raise DTR/RTS */ + set_mctrl(port, TIOCM_DTR | TIOCM_RTS); } else { /* * Xon/Xoff code @@ -2336,6 +2338,8 @@ static void ftdi_set_termios(struct tty_ } } + /* lower DTR/RTS */ + clear_mctrl(port, TIOCM_DTR | TIOCM_RTS); } return; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [157/200] USB: cdc-acm: fix resource reclaim in error path of acm_probe 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (154 preceding siblings ...) 2010-07-01 17:44 ` [156/200] USB: ftdi_sio: fix DTR/RTS line modes Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [158/200] USB: unbind all interfaces before rebinding them Greg KH ` (43 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Axel Lin, Oliver Neukum 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Axel Lin <axel.lin@gmail.com> commit c2572b78aa0447244a38e555ebb1b3b48a0088a5 upstream. This patch fixes resource reclaim in error path of acm_probe: 1. In the case of "out of memory (read urbs usb_alloc_urb)\n")", there is no need to call acm_read_buffers_free(acm) here. Fix it by goto alloc_fail6 instead of alloc_fail7. 2. In the case of "out of memory (write urbs usb_alloc_urb)", usb_alloc_urb may fail in any iteration of the for loop. Current implementation does not properly free allocated snd->urb. Fix it by goto alloc_fail8 instead of alloc_fail7. 3. In the case of device_create_file(&intf->dev,&dev_attr_iCountryCodeRelDate) fail, acm->country_codes is kfreed. As a result, device_remove_file for dev_attr_wCountryCodes will not be executed in acm_disconnect. Fix it by calling device_remove_file for dev_attr_wCountryCodes before goto skip_countries. Signed-off-by: Axel Lin <axel.lin@gmail.com> Acked-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/class/cdc-acm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -1201,7 +1201,7 @@ made_compressed_probe: if (rcv->urb == NULL) { dev_dbg(&intf->dev, "out of memory (read urbs usb_alloc_urb)\n"); - goto alloc_fail7; + goto alloc_fail6; } rcv->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; @@ -1225,7 +1225,7 @@ made_compressed_probe: if (snd->urb == NULL) { dev_dbg(&intf->dev, "out of memory (write urbs usb_alloc_urb)"); - goto alloc_fail7; + goto alloc_fail8; } if (usb_endpoint_xfer_int(epwrite)) @@ -1264,6 +1264,7 @@ made_compressed_probe: i = device_create_file(&intf->dev, &dev_attr_iCountryCodeRelDate); if (i < 0) { + device_remove_file(&intf->dev, &dev_attr_wCountryCodes); kfree(acm->country_codes); goto skip_countries; } @@ -1300,6 +1301,7 @@ alloc_fail8: usb_free_urb(acm->wb[i].urb); alloc_fail7: acm_read_buffers_free(acm); +alloc_fail6: for (i = 0; i < num_rx_buf; i++) usb_free_urb(acm->ru[i].urb); usb_free_urb(acm->ctrlurb); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [158/200] USB: unbind all interfaces before rebinding them 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (155 preceding siblings ...) 2010-07-01 17:44 ` [157/200] USB: cdc-acm: fix resource reclaim in error path of acm_probe Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [159/200] p54usb: Add device ID for Dell WLA3310 USB Greg KH ` (42 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Alan Stern [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #1: Type: text/plain, Size: 1578 bytes --] 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alan Stern <stern@rowland.harvard.edu> commit c043f1245654a726925529007210e9f786426448 upstream. This patch (as1387) fixes a bug introduced during the changeover to the runtime PM framework. When a driver doesn't support resume or reset-resume, and consequently its interfaces need to be unbound and rebound, we have to unbind all the interfaces before trying to rebind any of them. Otherwise the driver's probe method for one interface could try to claim a different interface and fail, because that other interface hasn't been unbound yet. This fixes Bugzilla #15788. The symptom is that some USB sound cards don't work after hibernation. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Tested-by: François Valenduc <francois.valenduc@tvcablenet.be> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/usb/core/driver.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/core/driver.c +++ b/drivers/usb/core/driver.c @@ -1322,6 +1322,7 @@ int usb_resume(struct device *dev, pm_me /* For all other calls, take the device back to full power and * tell the PM core in case it was autosuspended previously. + * Unbind the interfaces that will need rebinding later. */ } else { status = usb_resume_both(udev, msg); @@ -1330,6 +1331,7 @@ int usb_resume(struct device *dev, pm_me pm_runtime_set_active(dev); pm_runtime_enable(dev); udev->last_busy = jiffies; + do_unbind_rebind(udev, DO_REBIND); } } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [159/200] p54usb: Add device ID for Dell WLA3310 USB 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (156 preceding siblings ...) 2010-07-01 17:44 ` [158/200] USB: unbind all interfaces before rebinding them Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [160/200] wrong type for magic argument in simple_fill_super() Greg KH ` (41 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Jason Dravet, Larry Finger, Christian Lamparter, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jason Dravet <dravet@hotmail.com> commit 0f666a08901f8b01f294ca0ad751019375240ae3 upstream. Add Dell WLA3310 USB wireless card, which has a Z-Com XG-705A chipset, to the USB Ids in p54usb. Signed-off-by: Jason Dravet <dravet@hotmail.com> Tested-by: Richard Gregory Tillmore <rtillmore@gmail.com> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Acked-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/p54/p54usb.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/wireless/p54/p54usb.c +++ b/drivers/net/wireless/p54/p54usb.c @@ -80,6 +80,7 @@ static struct usb_device_id p54u_table[] {USB_DEVICE(0x1413, 0x5400)}, /* Telsey 802.11g USB2.0 Adapter */ {USB_DEVICE(0x1435, 0x0427)}, /* Inventel UR054G */ {USB_DEVICE(0x2001, 0x3704)}, /* DLink DWL-G122 rev A2 */ + {USB_DEVICE(0x413c, 0x5513)}, /* Dell WLA3310 USB Wireless Adapter */ {USB_DEVICE(0x413c, 0x8102)}, /* Spinnaker DUT */ {USB_DEVICE(0x413c, 0x8104)}, /* Cohiba Proto board */ {} ^ permalink raw reply [flat|nested] 666+ messages in thread
* [160/200] wrong type for magic argument in simple_fill_super() 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (157 preceding siblings ...) 2010-07-01 17:44 ` [159/200] p54usb: Add device ID for Dell WLA3310 USB Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [161/200] cfq-iosched: fix an oops caused by slab leak Greg KH ` (40 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Roberto Sassu, Eric Paris, Al Viro 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Roberto Sassu <roberto.sassu@polito.it> commit 7d683a09990ff095a91b6e724ecee0ff8733274a upstream. It's used to superblock ->s_magic, which is unsigned long. Signed-off-by: Roberto Sassu <roberto.sassu@polito.it> Reviewed-by: Mimi Zohar <zohar@us.ibm.com> Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/libfs.c | 3 ++- include/linux/fs.h | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) --- a/fs/libfs.c +++ b/fs/libfs.c @@ -418,7 +418,8 @@ int simple_write_end(struct file *file, * unique inode values later for this filesystem, then you must take care * to pass it an appropriate max_reserved value to avoid collisions. */ -int simple_fill_super(struct super_block *s, int magic, struct tree_descr *files) +int simple_fill_super(struct super_block *s, unsigned long magic, + struct tree_descr *files) { struct inode *inode; struct dentry *root; --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2356,7 +2356,7 @@ extern const struct file_operations simp extern const struct inode_operations simple_dir_inode_operations; struct tree_descr { char *name; const struct file_operations *ops; int mode; }; struct dentry *d_alloc_name(struct dentry *, const char *); -extern int simple_fill_super(struct super_block *, int, struct tree_descr *); +extern int simple_fill_super(struct super_block *, unsigned long, struct tree_descr *); extern int simple_pin_fs(struct file_system_type *, struct vfsmount **mount, int *count); extern void simple_release_fs(struct vfsmount **mount, int *count); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [161/200] cfq-iosched: fix an oops caused by slab leak 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (158 preceding siblings ...) 2010-07-01 17:44 ` [160/200] wrong type for magic argument in simple_fill_super() Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [162/200] iwlwifi: fix internal scan race Greg KH ` (39 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Shaohua Li, Jens Axboe 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shaohua Li <shaohua.li@intel.com> commit d02a2c077fb81f3224c770be62a318165b23b486 upstream. I got below oops when unloading cfq-iosched. Considering scenario: queue A merge to B, C merge to D and B will be merged to D. Before B is merged to D, we do split B. We should put B's reference for D. [ 807.768536] ============================================================================= [ 807.768539] BUG cfq_queue: Objects remaining on kmem_cache_close() [ 807.768541] ----------------------------------------------------------------------------- [ 807.768543] [ 807.768546] INFO: Slab 0xffffea0003e6b4e0 objects=26 used=1 fp=0xffff88011d584fd8 flags=0x200000000004082 [ 807.768550] Pid: 5946, comm: rmmod Tainted: G W 2.6.34-07097-gf4b87de-dirty #724 [ 807.768552] Call Trace: [ 807.768560] [<ffffffff81104e8d>] slab_err+0x8f/0x9d [ 807.768564] [<ffffffff811059e1>] ? flush_cpu_slab+0x0/0x93 [ 807.768569] [<ffffffff8164be52>] ? add_preempt_count+0xe/0xca [ 807.768572] [<ffffffff8164bd9c>] ? sub_preempt_count+0xe/0xb6 [ 807.768577] [<ffffffff81648871>] ? _raw_spin_unlock+0x15/0x30 [ 807.768580] [<ffffffff8164bd9c>] ? sub_preempt_count+0xe/0xb6 [ 807.768584] [<ffffffff811061bc>] list_slab_objects+0x9b/0x19f [ 807.768588] [<ffffffff8164bf0a>] ? add_preempt_count+0xc6/0xca [ 807.768591] [<ffffffff81109e27>] kmem_cache_destroy+0x13f/0x21d [ 807.768597] [<ffffffffa000ff13>] cfq_slab_kill+0x1a/0x43 [cfq_iosched] [ 807.768601] [<ffffffffa000ffcf>] cfq_exit+0x93/0x9e [cfq_iosched] [ 807.768606] [<ffffffff810973a2>] sys_delete_module+0x1b1/0x219 [ 807.768612] [<ffffffff8102fb5b>] system_call_fastpath+0x16/0x1b [ 807.768618] INFO: Object 0xffff88011d584618 @offset=1560 [ 807.768622] INFO: Allocated in cfq_get_queue+0x11e/0x274 [cfq_iosched] age=7173 cpu=1 pid=5496 [ 807.768626] ============================================================================= Signed-off-by: Shaohua Li <shaohua.li@intel.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- block/cfq-iosched.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) --- a/block/cfq-iosched.c +++ b/block/cfq-iosched.c @@ -2503,15 +2503,10 @@ static void cfq_free_io_context(struct i __call_for_each_cic(ioc, cic_free_func); } -static void cfq_exit_cfqq(struct cfq_data *cfqd, struct cfq_queue *cfqq) +static void cfq_put_cooperator(struct cfq_queue *cfqq) { struct cfq_queue *__cfqq, *next; - if (unlikely(cfqq == cfqd->active_queue)) { - __cfq_slice_expired(cfqd, cfqq, 0); - cfq_schedule_dispatch(cfqd); - } - /* * If this queue was scheduled to merge with another queue, be * sure to drop the reference taken on that queue (and others in @@ -2527,6 +2522,16 @@ static void cfq_exit_cfqq(struct cfq_dat cfq_put_queue(__cfqq); __cfqq = next; } +} + +static void cfq_exit_cfqq(struct cfq_data *cfqd, struct cfq_queue *cfqq) +{ + if (unlikely(cfqq == cfqd->active_queue)) { + __cfq_slice_expired(cfqd, cfqq, 0); + cfq_schedule_dispatch(cfqd); + } + + cfq_put_cooperator(cfqq); cfq_put_queue(cfqq); } @@ -3470,6 +3475,9 @@ split_cfqq(struct cfq_io_context *cic, s } cic_set_cfqq(cic, NULL, 1); + + cfq_put_cooperator(cfqq); + cfq_put_queue(cfqq); return NULL; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [162/200] iwlwifi: fix internal scan race 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (159 preceding siblings ...) 2010-07-01 17:44 ` [161/200] cfq-iosched: fix an oops caused by slab leak Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [163/200] iwlwifi: recalculate average tpt if not current Greg KH ` (38 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Reinette Chatre, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Reinette Chatre <reinette.chatre@intel.com> commit 073d5eab6fc85b6c278d507a5633b759a85dc878 upstream. It is possible for internal scan to race against itself if the device is not returning the scan results from first requests. What happens in this case is the cleanup done during the abort of the first internal scan also cleans up part of the new scan, causing it to access memory it shouldn't. Here are details: * First internal scan is triggered and scan command sent to device. * After seven seconds there is no scan results so the watchdog timer triggers a scan abort. * The scan abort succeeds and a SCAN_COMPLETE_NOTIFICATION is received for failed scan. * During processing of SCAN_COMPLETE_NOTIFICATION we clear STATUS_SCANNING and queue the "scan_completed" work. ** At this time, since the problem that caused the internal scan in first place is still present, a new internal scan is triggered. The behavior at this point is a bit different between 2.6.34 and 2.6.35 since 2.6.35 has a lot of this synchronized. The rest of the race description will thus be generalized. ** As part of preparing for the scan "is_internal_short_scan" is set to true. * At this point the completion work for fist scan is run. As part of this there is some locking missing around the "is_internal_short_scan" variable and it is set to "false". ** Now the second scan runs and it considers itself a real (not internal0 scan and thus causes problems with wrong memory being accessed. The fix is twofold. * Since "is_internal_short_scan" should be protected by mutex, fix this in scan completion work so that changes to it can be serialized. * Do not queue a new internal scan if one is in progress. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=15824 Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/iwlwifi/iwl-scan.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) --- a/drivers/net/wireless/iwlwifi/iwl-scan.c +++ b/drivers/net/wireless/iwlwifi/iwl-scan.c @@ -561,6 +561,11 @@ static void iwl_bg_start_internal_scan(s mutex_lock(&priv->mutex); + if (priv->is_internal_short_scan == true) { + IWL_DEBUG_SCAN(priv, "Internal scan already in progress\n"); + goto unlock; + } + if (!iwl_is_ready_rf(priv)) { IWL_DEBUG_SCAN(priv, "not ready or exit pending\n"); goto unlock; @@ -958,17 +963,27 @@ void iwl_bg_scan_completed(struct work_s { struct iwl_priv *priv = container_of(work, struct iwl_priv, scan_completed); + bool internal = false; IWL_DEBUG_SCAN(priv, "SCAN complete scan\n"); cancel_delayed_work(&priv->scan_check); - if (!priv->is_internal_short_scan) - ieee80211_scan_completed(priv->hw, false); - else { + mutex_lock(&priv->mutex); + if (priv->is_internal_short_scan) { priv->is_internal_short_scan = false; IWL_DEBUG_SCAN(priv, "internal short scan completed\n"); + internal = true; } + mutex_unlock(&priv->mutex); + + /* + * Do not hold mutex here since this will cause mac80211 to call + * into driver again into functions that will attempt to take + * mutex. + */ + if (!internal) + ieee80211_scan_completed(priv->hw, false); if (test_bit(STATUS_EXIT_PENDING, &priv->status)) return; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [163/200] iwlwifi: recalculate average tpt if not current 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (160 preceding siblings ...) 2010-07-01 17:44 ` [162/200] iwlwifi: fix internal scan race Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [164/200] perf: Fix signed comparison in perf_adjust_period() Greg KH ` (37 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Reinette Chatre, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Reinette Chatre <reinette.chatre@intel.com> commit 3d79b2a9eeaa066b35c49fbb17e3156a3c482c3e upstream. We currently have this check as a BUG_ON, which is being hit by people. Previously it was an error with a recalculation if not current, return that code. The BUG_ON was introduced by: commit 3110bef78cb4282c58245bc8fd6d95d9ccb19749 Author: Guy Cohen <guy.cohen@intel.com> Date: Tue Sep 9 10:54:54 2008 +0800 iwlwifi: Added support for 3 antennas ... the portion adding the BUG_ON is reverted since we are encountering the error and BUG_ON was created with assumption that error is not encountered. Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c +++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c @@ -2077,10 +2077,12 @@ static void rs_rate_scale_perform(struct } /* Else we have enough samples; calculate estimate of * actual average throughput */ - - /* Sanity-check TPT calculations */ - BUG_ON(window->average_tpt != ((window->success_ratio * - tbl->expected_tpt[index] + 64) / 128)); + if (window->average_tpt != ((window->success_ratio * + tbl->expected_tpt[index] + 64) / 128)) { + IWL_ERR(priv, "expected_tpt should have been calculated by now\n"); + window->average_tpt = ((window->success_ratio * + tbl->expected_tpt[index] + 64) / 128); + } /* If we are searching for better modulation mode, check success. */ if (lq_sta->search_better_tbl && ^ permalink raw reply [flat|nested] 666+ messages in thread
* [164/200] perf: Fix signed comparison in perf_adjust_period() 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (161 preceding siblings ...) 2010-07-01 17:44 ` [163/200] iwlwifi: recalculate average tpt if not current Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [165/200] tracing: Fix null pointer deref with SEND_SIG_FORCED Greg KH ` (36 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Peter Zijlstra, Ingo Molnar 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Peter Zijlstra <a.p.zijlstra@chello.nl> commit f6ab91add6355e231e1c47897027b2a6ee4fa268 upstream. Frederic reported that frequency driven swevents didn't work properly and even caused a division-by-zero error. It turns out there are two bugs, the division-by-zero comes from a failure to deal with that in perf_calculate_period(). The other was more interesting and turned out to be a wrong comparison in perf_adjust_period(). The comparison was between an s64 and u64 and got implicitly converted to an unsigned comparison. The problem is that period_left is typically < 0, so it ended up being always true. Cure this by making the local period variables s64. Reported-by: Frederic Weisbecker <fweisbec@gmail.com> Tested-by: Frederic Weisbecker <fweisbec@gmail.com> Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> LKML-Reference: <new-submission> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- kernel/perf_event.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/kernel/perf_event.c +++ b/kernel/perf_event.c @@ -1456,6 +1456,9 @@ do { \ divisor = nsec * frequency; } + if (!divisor) + return dividend; + return div64_u64(dividend, divisor); } @@ -1478,7 +1481,7 @@ static int perf_event_start(struct perf_ static void perf_adjust_period(struct perf_event *event, u64 nsec, u64 count) { struct hw_perf_event *hwc = &event->hw; - u64 period, sample_period; + s64 period, sample_period; s64 delta; period = perf_calculate_period(event, nsec, count); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [165/200] tracing: Fix null pointer deref with SEND_SIG_FORCED 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (162 preceding siblings ...) 2010-07-01 17:44 ` [164/200] perf: Fix signed comparison in perf_adjust_period() Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [166/200] nfsd: nfsd_setattr needs to call commit_metadata Greg KH ` (35 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Oleg Nesterov, Roland McGrath, Steven Rostedt, Jason Baron, Masami Hiramatsu, Frederic Weisbecker 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Oleg Nesterov <oleg@redhat.com> commit b9b76dfaac6fa2c289ee8a005be637afd2da7e2f upstream. BUG: unable to handle kernel NULL pointer dereference at 0000000000000006 IP: [<ffffffff8107bd37>] ftrace_raw_event_signal_generate+0x87/0x140 TP_STORE_SIGINFO() forgets about SEND_SIG_FORCED, fix. We should probably export is_si_special() and change TP_STORE_SIGINFO() to use it in the longer term. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Roland McGrath <roland@redhat.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Jason Baron <jbaron@redhat.com> Cc: Masami Hiramatsu <mhiramat@redhat.com> LKML-Reference: <20100603213409.GA8307@redhat.com> Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- include/trace/events/signal.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/include/trace/events/signal.h +++ b/include/trace/events/signal.h @@ -10,7 +10,8 @@ #define TP_STORE_SIGINFO(__entry, info) \ do { \ - if (info == SEND_SIG_NOINFO) { \ + if (info == SEND_SIG_NOINFO || \ + info == SEND_SIG_FORCED) { \ __entry->errno = 0; \ __entry->code = SI_USER; \ } else if (info == SEND_SIG_PRIV) { \ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [166/200] nfsd: nfsd_setattr needs to call commit_metadata 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (163 preceding siblings ...) 2010-07-01 17:44 ` [165/200] tracing: Fix null pointer deref with SEND_SIG_FORCED Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [167/200] wl1251: fix a memory leak in probe Greg KH ` (34 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Christoph Hellwig, J. Bruce Fields 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Christoph Hellwig <hch@lst.de> commit b160fdabe93a8a53094f90f02bf4dcb500782aab upstream. The conversion of write_inode_now calls to commit_metadata in commit f501912a35c02eadc55ca9396ece55fe36f785d0 missed out the call in nfsd_setattr. But without this conversion we can't guarantee that a SETATTR request has actually been commited to disk with XFS, which causes a regression from 2.6.32 (only for NFSv2, but anyway). Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/nfsd/vfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -443,8 +443,7 @@ nfsd_setattr(struct svc_rqst *rqstp, str if (size_change) put_write_access(inode); if (!err) - if (EX_ISSYNC(fhp->fh_export)) - write_inode_now(inode, 1); + commit_metadata(fhp); out: return err; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [167/200] wl1251: fix a memory leak in probe 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (164 preceding siblings ...) 2010-07-01 17:44 ` [166/200] nfsd: nfsd_setattr needs to call commit_metadata Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [168/200] iwlwifi: add missing rcu_read_lock Greg KH ` (33 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Grazvydas Ignotas, Kalle Valo, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Grazvydas Ignotas <notasas@gmail.com> commit aa679c36756003f1fabdb9fc6f00eb159559f7c3 upstream. wl1251_sdio_probe() error path is missing wl1251_free_hw, add it. Signed-off-by: Grazvydas Ignotas <notasas@gmail.com> Acked-by: Kalle Valo <kvalo@adurom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/wl12xx/wl1251_sdio.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/wireless/wl12xx/wl1251_sdio.c +++ b/drivers/net/wireless/wl12xx/wl1251_sdio.c @@ -160,6 +160,7 @@ disable: sdio_disable_func(func); release: sdio_release_host(func); + wl1251_free_hw(wl); return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [168/200] iwlwifi: add missing rcu_read_lock 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (165 preceding siblings ...) 2010-07-01 17:44 ` [167/200] wl1251: fix a memory leak in probe Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [169/200] perf_events: Fix races and clean up perf_event and perf_mmap_data interaction Greg KH ` (32 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Johannes Berg, Reinette Chatre, John W. Linville 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johannes Berg <johannes.berg@intel.com> commit 6db6340c42d027b6364d49fa99d69019aca24de4 upstream. Using ieee80211_find_sta() needs to be under RCU read lock, which iwlwifi currently misses, so fix it. Reported-by: Miles Lane <miles.lane@gmail.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Acked-by: Reinette Chatre <reinette.chatre@intel.com> Tested-by: Miles Lane <miles.lane@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/iwlwifi/iwl-tx.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/wireless/iwlwifi/iwl-tx.c +++ b/drivers/net/wireless/iwlwifi/iwl-tx.c @@ -1198,6 +1198,7 @@ static void iwl_tx_status(struct iwl_pri struct ieee80211_sta *sta; struct iwl_station_priv *sta_priv; + rcu_read_lock(); sta = ieee80211_find_sta(priv->vif, hdr->addr1); if (sta) { sta_priv = (void *)sta->drv_priv; @@ -1206,6 +1207,7 @@ static void iwl_tx_status(struct iwl_pri atomic_dec_return(&sta_priv->pending_frames) == 0) ieee80211_sta_block_awake(priv->hw, sta, false); } + rcu_read_unlock(); ieee80211_tx_status_irqsafe(priv->hw, skb); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [169/200] perf_events: Fix races and clean up perf_event and perf_mmap_data interaction 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (166 preceding siblings ...) 2010-07-01 17:44 ` [168/200] iwlwifi: add missing rcu_read_lock Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [170/200] ext4: check s_log_groups_per_flex in online resize code Greg KH ` (31 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Peter Zijlstra, Ingo Molnar 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Peter Zijlstra <a.p.zijlstra@chello.nl> commit ac9721f3f54b27a16c7e1afb2481e7ee95a70318 upstream. In order to move toward separate buffer objects, rework the whole perf_mmap_data construct to be a more self-sufficient entity, one with its own lifetime rules. This greatly sanitizes the whole output redirection code, which was riddled with bugs and races. Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> LKML-Reference: <new-submission> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- include/linux/perf_event.h | 5 - kernel/perf_event.c | 217 ++++++++++++++++++++++++++------------------- 2 files changed, 129 insertions(+), 93 deletions(-) --- a/include/linux/perf_event.h +++ b/include/linux/perf_event.h @@ -531,6 +531,7 @@ enum perf_event_active_state { struct file; struct perf_mmap_data { + atomic_t refcount; struct rcu_head rcu_head; #ifdef CONFIG_PERF_USE_VMALLOC struct work_struct work; @@ -538,7 +539,6 @@ struct perf_mmap_data { int data_order; int nr_pages; /* nr of data pages */ int writable; /* are we writable */ - int nr_locked; /* nr pages mlocked */ atomic_t poll; /* POLL_ for wakeups */ atomic_t events; /* event_id limit */ @@ -582,7 +582,6 @@ struct perf_event { int nr_siblings; int group_flags; struct perf_event *group_leader; - struct perf_event *output; const struct pmu *pmu; enum perf_event_active_state state; @@ -643,6 +642,8 @@ struct perf_event { /* mmap bits */ struct mutex mmap_mutex; atomic_t mmap_count; + int mmap_locked; + struct user_struct *mmap_user; struct perf_mmap_data *data; /* poll related */ --- a/kernel/perf_event.c +++ b/kernel/perf_event.c @@ -1832,6 +1832,7 @@ static void free_event_rcu(struct rcu_he } static void perf_pending_sync(struct perf_event *event); +static void perf_mmap_data_put(struct perf_mmap_data *data); static void free_event(struct perf_event *event) { @@ -1847,9 +1848,9 @@ static void free_event(struct perf_event atomic_dec(&nr_task_events); } - if (event->output) { - fput(event->output->filp); - event->output = NULL; + if (event->data) { + perf_mmap_data_put(event->data); + event->data = NULL; } if (event->destroy) @@ -2154,7 +2155,27 @@ unlock: return ret; } -static int perf_event_set_output(struct perf_event *event, int output_fd); +static const struct file_operations perf_fops; + +static struct perf_event *perf_fget_light(int fd, int *fput_needed) +{ + struct file *file; + + file = fget_light(fd, fput_needed); + if (!file) + return ERR_PTR(-EBADF); + + if (file->f_op != &perf_fops) { + fput_light(file, *fput_needed); + *fput_needed = 0; + return ERR_PTR(-EBADF); + } + + return file->private_data; +} + +static int perf_event_set_output(struct perf_event *event, + struct perf_event *output_event); static int perf_event_set_filter(struct perf_event *event, void __user *arg); static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg) @@ -2181,7 +2202,23 @@ static long perf_ioctl(struct file *file return perf_event_period(event, (u64 __user *)arg); case PERF_EVENT_IOC_SET_OUTPUT: - return perf_event_set_output(event, arg); + { + struct perf_event *output_event = NULL; + int fput_needed = 0; + int ret; + + if (arg != -1) { + output_event = perf_fget_light(arg, &fput_needed); + if (IS_ERR(output_event)) + return PTR_ERR(output_event); + } + + ret = perf_event_set_output(event, output_event); + if (output_event) + fput_light(output_event->filp, fput_needed); + + return ret; + } case PERF_EVENT_IOC_SET_FILTER: return perf_event_set_filter(event, (void __user *)arg); @@ -2306,8 +2343,6 @@ perf_mmap_data_alloc(struct perf_event * unsigned long size; int i; - WARN_ON(atomic_read(&event->mmap_count)); - size = sizeof(struct perf_mmap_data); size += nr_pages * sizeof(void *); @@ -2414,8 +2449,6 @@ perf_mmap_data_alloc(struct perf_event * unsigned long size; void *all_buf; - WARN_ON(atomic_read(&event->mmap_count)); - size = sizeof(struct perf_mmap_data); size += sizeof(void *); @@ -2495,7 +2528,7 @@ perf_mmap_data_init(struct perf_event *e if (!data->watermark) data->watermark = max_size / 2; - + atomic_set(&data->refcount, 1); rcu_assign_pointer(event->data, data); } @@ -2507,13 +2540,26 @@ static void perf_mmap_data_free_rcu(stru perf_mmap_data_free(data); } -static void perf_mmap_data_release(struct perf_event *event) +static struct perf_mmap_data *perf_mmap_data_get(struct perf_event *event) { - struct perf_mmap_data *data = event->data; + struct perf_mmap_data *data; + + rcu_read_lock(); + data = rcu_dereference(event->data); + if (data) { + if (!atomic_inc_not_zero(&data->refcount)) + data = NULL; + } + rcu_read_unlock(); - WARN_ON(atomic_read(&event->mmap_count)); + return data; +} + +static void perf_mmap_data_put(struct perf_mmap_data *data) +{ + if (!atomic_dec_and_test(&data->refcount)) + return; - rcu_assign_pointer(event->data, NULL); call_rcu(&data->rcu_head, perf_mmap_data_free_rcu); } @@ -2528,15 +2574,18 @@ static void perf_mmap_close(struct vm_ar { struct perf_event *event = vma->vm_file->private_data; - WARN_ON_ONCE(event->ctx->parent_ctx); if (atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex)) { unsigned long size = perf_data_size(event->data); - struct user_struct *user = current_user(); + struct user_struct *user = event->mmap_user; + struct perf_mmap_data *data = event->data; atomic_long_sub((size >> PAGE_SHIFT) + 1, &user->locked_vm); - vma->vm_mm->locked_vm -= event->data->nr_locked; - perf_mmap_data_release(event); + vma->vm_mm->locked_vm -= event->mmap_locked; + rcu_assign_pointer(event->data, NULL); mutex_unlock(&event->mmap_mutex); + + perf_mmap_data_put(data); + free_uid(user); } } @@ -2580,13 +2629,10 @@ static int perf_mmap(struct file *file, WARN_ON_ONCE(event->ctx->parent_ctx); mutex_lock(&event->mmap_mutex); - if (event->output) { - ret = -EINVAL; - goto unlock; - } - - if (atomic_inc_not_zero(&event->mmap_count)) { - if (nr_pages != event->data->nr_pages) + if (event->data) { + if (event->data->nr_pages == nr_pages) + atomic_inc(&event->data->refcount); + else ret = -EINVAL; goto unlock; } @@ -2618,21 +2664,23 @@ static int perf_mmap(struct file *file, WARN_ON(event->data); data = perf_mmap_data_alloc(event, nr_pages); - ret = -ENOMEM; - if (!data) + if (!data) { + ret = -ENOMEM; goto unlock; + } - ret = 0; perf_mmap_data_init(event, data); - - atomic_set(&event->mmap_count, 1); - atomic_long_add(user_extra, &user->locked_vm); - vma->vm_mm->locked_vm += extra; - event->data->nr_locked = extra; if (vma->vm_flags & VM_WRITE) event->data->writable = 1; + atomic_long_add(user_extra, &user->locked_vm); + event->mmap_locked = extra; + event->mmap_user = get_current_user(); + vma->vm_mm->locked_vm += event->mmap_locked; + unlock: + if (!ret) + atomic_inc(&event->mmap_count); mutex_unlock(&event->mmap_mutex); vma->vm_flags |= VM_RESERVED; @@ -2962,7 +3010,6 @@ int perf_output_begin(struct perf_output struct perf_event *event, unsigned int size, int nmi, int sample) { - struct perf_event *output_event; struct perf_mmap_data *data; unsigned long tail, offset, head; int have_lost; @@ -2979,10 +3026,6 @@ int perf_output_begin(struct perf_output if (event->parent) event = event->parent; - output_event = rcu_dereference(event->output); - if (output_event) - event = output_event; - data = rcu_dereference(event->data); if (!data) goto out; @@ -4746,54 +4789,41 @@ err_size: goto out; } -static int perf_event_set_output(struct perf_event *event, int output_fd) +static int +perf_event_set_output(struct perf_event *event, struct perf_event *output_event) { - struct perf_event *output_event = NULL; - struct file *output_file = NULL; - struct perf_event *old_output; - int fput_needed = 0; + struct perf_mmap_data *data = NULL, *old_data = NULL; int ret = -EINVAL; - if (!output_fd) + if (!output_event) goto set; - output_file = fget_light(output_fd, &fput_needed); - if (!output_file) - return -EBADF; - - if (output_file->f_op != &perf_fops) - goto out; - - output_event = output_file->private_data; - - /* Don't chain output fds */ - if (output_event->output) - goto out; - - /* Don't set an output fd when we already have an output channel */ - if (event->data) + /* don't allow circular references */ + if (event == output_event) goto out; - atomic_long_inc(&output_file->f_count); - set: mutex_lock(&event->mmap_mutex); - old_output = event->output; - rcu_assign_pointer(event->output, output_event); - mutex_unlock(&event->mmap_mutex); + /* Can't redirect output if we've got an active mmap() */ + if (atomic_read(&event->mmap_count)) + goto unlock; - if (old_output) { - /* - * we need to make sure no existing perf_output_*() - * is still referencing this event. - */ - synchronize_rcu(); - fput(old_output->filp); + if (output_event) { + /* get the buffer we want to redirect to */ + data = perf_mmap_data_get(output_event); + if (!data) + goto unlock; } + old_data = event->data; + rcu_assign_pointer(event->data, data); ret = 0; +unlock: + mutex_unlock(&event->mmap_mutex); + + if (old_data) + perf_mmap_data_put(old_data); out: - fput_light(output_file, fput_needed); return ret; } @@ -4809,7 +4839,7 @@ SYSCALL_DEFINE5(perf_event_open, struct perf_event_attr __user *, attr_uptr, pid_t, pid, int, cpu, int, group_fd, unsigned long, flags) { - struct perf_event *event, *group_leader; + struct perf_event *event, *group_leader = NULL, *output_event = NULL; struct perf_event_attr attr; struct perf_event_context *ctx; struct file *event_file = NULL; @@ -4840,6 +4870,19 @@ SYSCALL_DEFINE5(perf_event_open, if (event_fd < 0) return event_fd; + if (group_fd != -1) { + group_leader = perf_fget_light(group_fd, &fput_needed); + if (IS_ERR(group_leader)) { + err = PTR_ERR(group_leader); + goto err_put_context; + } + group_file = group_leader->filp; + if (flags & PERF_FLAG_FD_OUTPUT) + output_event = group_leader; + if (flags & PERF_FLAG_FD_NO_GROUP) + group_leader = NULL; + } + /* * Get the target context (task or percpu): */ @@ -4852,16 +4895,9 @@ SYSCALL_DEFINE5(perf_event_open, /* * Look up the group leader (we will attach this event to it): */ - group_leader = NULL; - if (group_fd != -1 && !(flags & PERF_FLAG_FD_NO_GROUP)) { + if (group_leader) { err = -EINVAL; - group_file = fget_light(group_fd, &fput_needed); - if (!group_file) - goto err_put_context; - if (group_file->f_op != &perf_fops) - goto err_put_context; - group_leader = group_file->private_data; /* * Do not allow a recursive hierarchy (this new sibling * becoming part of another group-sibling): @@ -4883,9 +4919,16 @@ SYSCALL_DEFINE5(perf_event_open, event = perf_event_alloc(&attr, cpu, ctx, group_leader, NULL, NULL, GFP_KERNEL); - err = PTR_ERR(event); - if (IS_ERR(event)) + if (IS_ERR(event)) { + err = PTR_ERR(event); goto err_put_context; + } + + if (output_event) { + err = perf_event_set_output(event, output_event); + if (err) + goto err_free_put_context; + } event_file = anon_inode_getfile("[perf_event]", &perf_fops, event, O_RDWR); if (IS_ERR(event_file)) { @@ -4893,12 +4936,6 @@ SYSCALL_DEFINE5(perf_event_open, goto err_free_put_context; } - if (flags & PERF_FLAG_FD_OUTPUT) { - err = perf_event_set_output(event, group_fd); - if (err) - goto err_fput_free_put_context; - } - event->filp = event_file; WARN_ON_ONCE(ctx->parent_ctx); mutex_lock(&ctx->mutex); @@ -4916,8 +4953,6 @@ SYSCALL_DEFINE5(perf_event_open, fd_install(event_fd, event_file); return event_fd; -err_fput_free_put_context: - fput(event_file); err_free_put_context: free_event(event); err_put_context: ^ permalink raw reply [flat|nested] 666+ messages in thread
* [170/200] ext4: check s_log_groups_per_flex in online resize code 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (167 preceding siblings ...) 2010-07-01 17:44 ` [169/200] perf_events: Fix races and clean up perf_event and perf_mmap_data interaction Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [171/200] ext4: Make sure the MOVE_EXT ioctl cant overwrite append-only files Greg KH ` (30 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Eric Sandeen, Theodore Tso 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Sandeen <sandeen@redhat.com> commit 42007efd569f1cf3bfb9a61da60ef6c2179508ca upstream. If groups_per_flex < 2, sbi->s_flex_groups[] doesn't get filled out, and every other access to this first tests s_log_groups_per_flex; same thing needs to happen in resize or we'll wander off into a null pointer when doing an online resize of the file system. Thanks to Christoph Biedl, who came up with the trivial testcase: # truncate --size 128M fsfile # mkfs.ext3 -F fsfile # tune2fs -O extents,uninit_bg,dir_index,flex_bg,huge_file,dir_nlink,extra_isize fsfile # e2fsck -yDf -C0 fsfile # truncate --size 132M fsfile # losetup /dev/loop0 fsfile # mount /dev/loop0 mnt # resize2fs -p /dev/loop0 https://bugzilla.kernel.org/show_bug.cgi?id=13549 Reported-by: Alessandro Polverini <alex@nibbles.it> Test-case-by: Christoph Biedl <bugzilla.kernel.bpeb@manchmal.in-ulm.de> Signed-off-by: Eric Sandeen <sandeen@redhat.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -911,7 +911,8 @@ int ext4_group_add(struct super_block *s percpu_counter_add(&sbi->s_freeinodes_counter, EXT4_INODES_PER_GROUP(sb)); - if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG)) { + if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG) && + sbi->s_log_groups_per_flex) { ext4_group_t flex_group; flex_group = ext4_flex_group(sbi, input->group); atomic_add(input->free_blocks_count, ^ permalink raw reply [flat|nested] 666+ messages in thread
* [171/200] ext4: Make sure the MOVE_EXT ioctl cant overwrite append-only files 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (168 preceding siblings ...) 2010-07-01 17:44 ` [170/200] ext4: check s_log_groups_per_flex in online resize code Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [172/200] GFS2: Fix permissions checking for setflags ioctl() Greg KH ` (29 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Theodore Tso, Dan Rosenberg 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Theodore Ts'o <tytso@mit.edu> commit 1f5a81e41f8b1a782c68d3843e9ec1bfaadf7d72 upstream. Dan Roseberg has reported a problem with the MOVE_EXT ioctl. If the donor file is an append-only file, we should not allow the operation to proceed, lest we end up overwriting the contents of an append-only file. Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Cc: Dan Rosenberg <dan.j.rosenberg@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/ext4/move_extent.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/ext4/move_extent.c +++ b/fs/ext4/move_extent.c @@ -959,6 +959,9 @@ mext_check_arguments(struct inode *orig_ return -EINVAL; } + if (IS_IMMUTABLE(donor_inode) || IS_APPEND(donor_inode)) + return -EPERM; + /* Ext4 move extent does not support swapfile */ if (IS_SWAPFILE(orig_inode) || IS_SWAPFILE(donor_inode)) { ext4_debug("ext4 move extent: The argument files should " ^ permalink raw reply [flat|nested] 666+ messages in thread
* [172/200] GFS2: Fix permissions checking for setflags ioctl() 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (169 preceding siblings ...) 2010-07-01 17:44 ` [171/200] ext4: Make sure the MOVE_EXT ioctl cant overwrite append-only files Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [173/200] CIFS: Allow null nd (as nfs server uses) on create Greg KH ` (28 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Steven Whitehouse 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Steven Whitehouse <swhiteho@redhat.com> commit 7df0e0397b9a18358573274db9fdab991941062f upstream. We should be checking for the ownership of the file for which flags are being set, rather than just for write access. Reported-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> Signed-off-by: Steven Whitehouse <swhiteho@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/gfs2/file.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/fs/gfs2/file.c +++ b/fs/gfs2/file.c @@ -218,6 +218,11 @@ static int do_gfs2_set_flags(struct file if (error) goto out_drop_write; + error = -EACCES; + if (!is_owner_or_cap(inode)) + goto out; + + error = 0; flags = ip->i_diskflags; new_flags = (flags & ~mask) | (reqflags & mask); if ((new_flags ^ flags) == 0) @@ -275,8 +280,10 @@ static int gfs2_set_flags(struct file *f { struct inode *inode = filp->f_path.dentry->d_inode; u32 fsflags, gfsflags; + if (get_user(fsflags, ptr)) return -EFAULT; + gfsflags = fsflags_cvt(fsflags_to_gfs2, fsflags); if (!S_ISDIR(inode->i_mode)) { if (gfsflags & GFS2_DIF_INHERIT_JDATA) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [173/200] CIFS: Allow null nd (as nfs server uses) on create 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (170 preceding siblings ...) 2010-07-01 17:44 ` [172/200] GFS2: Fix permissions checking for setflags ioctl() Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [174/200] Btrfs: should add a permission check for setfacl Greg KH ` (27 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Shirish Pargaonkar, Steve French 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Steve French <sfrench@us.ibm.com> commit fa588e0c57048b3d4bfcd772d80dc0615f83fd35 upstream. While creating a file on a server which supports unix extensions such as Samba, if a file is being created which does not supply nameidata (i.e. nd is null), cifs client can oops when calling cifs_posix_open. Signed-off-by: Shirish Pargaonkar <shirishp@us.ibm.com> Signed-off-by: Steve French <sfrench@us.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/cifs/cifsproto.h | 6 ++++-- fs/cifs/dir.c | 20 ++++++++++++-------- fs/cifs/file.c | 11 +++++++---- 3 files changed, 23 insertions(+), 14 deletions(-) --- a/fs/cifs/cifsproto.h +++ b/fs/cifs/cifsproto.h @@ -95,8 +95,10 @@ extern struct cifsFileInfo *cifs_new_fil __u16 fileHandle, struct file *file, struct vfsmount *mnt, unsigned int oflags); extern int cifs_posix_open(char *full_path, struct inode **pinode, - struct vfsmount *mnt, int mode, int oflags, - __u32 *poplock, __u16 *pnetfid, int xid); + struct vfsmount *mnt, + struct super_block *sb, + int mode, int oflags, + __u32 *poplock, __u16 *pnetfid, int xid); extern void cifs_unix_basic_to_fattr(struct cifs_fattr *fattr, FILE_UNIX_BASIC_INFO *info, struct cifs_sb_info *cifs_sb); --- a/fs/cifs/dir.c +++ b/fs/cifs/dir.c @@ -183,13 +183,14 @@ cifs_new_fileinfo(struct inode *newinode } int cifs_posix_open(char *full_path, struct inode **pinode, - struct vfsmount *mnt, int mode, int oflags, - __u32 *poplock, __u16 *pnetfid, int xid) + struct vfsmount *mnt, struct super_block *sb, + int mode, int oflags, + __u32 *poplock, __u16 *pnetfid, int xid) { int rc; FILE_UNIX_BASIC_INFO *presp_data; __u32 posix_flags = 0; - struct cifs_sb_info *cifs_sb = CIFS_SB(mnt->mnt_sb); + struct cifs_sb_info *cifs_sb = CIFS_SB(sb); struct cifs_fattr fattr; cFYI(1, ("posix open %s", full_path)); @@ -242,7 +243,7 @@ int cifs_posix_open(char *full_path, str /* get new inode and set it up */ if (*pinode == NULL) { - *pinode = cifs_iget(mnt->mnt_sb, &fattr); + *pinode = cifs_iget(sb, &fattr); if (!*pinode) { rc = -ENOMEM; goto posix_open_ret; @@ -251,7 +252,8 @@ int cifs_posix_open(char *full_path, str cifs_fattr_to_inode(*pinode, &fattr); } - cifs_new_fileinfo(*pinode, *pnetfid, NULL, mnt, oflags); + if (mnt) + cifs_new_fileinfo(*pinode, *pnetfid, NULL, mnt, oflags); posix_open_ret: kfree(presp_data); @@ -315,13 +317,14 @@ cifs_create(struct inode *inode, struct if (nd && (nd->flags & LOOKUP_OPEN)) oflags = nd->intent.open.flags; else - oflags = FMODE_READ; + oflags = FMODE_READ | SMB_O_CREAT; if (tcon->unix_ext && (tcon->ses->capabilities & CAP_UNIX) && (CIFS_UNIX_POSIX_PATH_OPS_CAP & le64_to_cpu(tcon->fsUnixInfo.Capability))) { - rc = cifs_posix_open(full_path, &newinode, nd->path.mnt, - mode, oflags, &oplock, &fileHandle, xid); + rc = cifs_posix_open(full_path, &newinode, + nd ? nd->path.mnt : NULL, + inode->i_sb, mode, oflags, &oplock, &fileHandle, xid); /* EIO could indicate that (posix open) operation is not supported, despite what server claimed in capability negotation. EREMOTE indicates DFS junction, which is not @@ -678,6 +681,7 @@ cifs_lookup(struct inode *parent_dir_ino (nd->flags & LOOKUP_OPEN) && !pTcon->broken_posix_open && (nd->intent.open.flags & O_CREAT)) { rc = cifs_posix_open(full_path, &newInode, nd->path.mnt, + parent_dir_inode->i_sb, nd->intent.open.create_mode, nd->intent.open.flags, &oplock, &fileHandle, xid); --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -298,10 +298,12 @@ int cifs_open(struct inode *inode, struc (CIFS_UNIX_POSIX_PATH_OPS_CAP & le64_to_cpu(tcon->fsUnixInfo.Capability))) { int oflags = (int) cifs_posix_convert_flags(file->f_flags); + oflags |= SMB_O_CREAT; /* can not refresh inode info since size could be stale */ rc = cifs_posix_open(full_path, &inode, file->f_path.mnt, - cifs_sb->mnt_file_mode /* ignored */, - oflags, &oplock, &netfid, xid); + inode->i_sb, + cifs_sb->mnt_file_mode /* ignored */, + oflags, &oplock, &netfid, xid); if (rc == 0) { cFYI(1, ("posix open succeeded")); /* no need for special case handling of setting mode @@ -513,8 +515,9 @@ reopen_error_exit: int oflags = (int) cifs_posix_convert_flags(file->f_flags); /* can not refresh inode info since size could be stale */ rc = cifs_posix_open(full_path, NULL, file->f_path.mnt, - cifs_sb->mnt_file_mode /* ignored */, - oflags, &oplock, &netfid, xid); + inode->i_sb, + cifs_sb->mnt_file_mode /* ignored */, + oflags, &oplock, &netfid, xid); if (rc == 0) { cFYI(1, ("posix reopen succeeded")); goto reopen_success; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [174/200] Btrfs: should add a permission check for setfacl 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (171 preceding siblings ...) 2010-07-01 17:44 ` [173/200] CIFS: Allow null nd (as nfs server uses) on create Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [175/200] NFS: Ensure that we mark the inode as dirty if we exit early from commit Greg KH ` (26 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Shi Weihua, Chris Mason 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shi Weihua <shiwh@cn.fujitsu.com> commit 2f26afba46f0ebf155cf9be746496a0304a5b7cf upstream. On btrfs, do the following ------------------ # su user1 # cd btrfs-part/ # touch aaa # getfacl aaa # file: aaa # owner: user1 # group: user1 user::rw- group::rw- other::r-- # su user2 # cd btrfs-part/ # setfacl -m u::rwx aaa # getfacl aaa # file: aaa # owner: user1 # group: user1 user::rwx <- successed to setfacl group::rw- other::r-- ------------------ but we should prohibit it that user2 changing user1's acl. In fact, on ext3 and other fs, a message occurs: setfacl: aaa: Operation not permitted This patch fixed it. Signed-off-by: Shi Weihua <shiwh@cn.fujitsu.com> Signed-off-by: Chris Mason <chris.mason@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/btrfs/acl.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/btrfs/acl.c +++ b/fs/btrfs/acl.c @@ -160,6 +160,9 @@ static int btrfs_xattr_acl_set(struct de int ret; struct posix_acl *acl = NULL; + if (!is_owner_or_cap(dentry->d_inode)) + return -EPERM; + if (value) { acl = posix_acl_from_xattr(value, size); if (acl == NULL) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [175/200] NFS: Ensure that we mark the inode as dirty if we exit early from commit 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (172 preceding siblings ...) 2010-07-01 17:44 ` [174/200] Btrfs: should add a permission check for setfacl Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [176/200] NFS: Fix another nfs_wb_page() deadlock Greg KH ` (25 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Trond Myklebust 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Trond Myklebust <Trond.Myklebust@netapp.com> commit c5efa5fc91f1f6d1d47e65f39e7ec6d1157c777d upstream. If we exit from nfs_commit_inode() without ensuring that the COMMIT rpc call has been completed, we must re-mark the inode as dirty. Otherwise, future calls to sync_inode() with the WB_SYNC_ALL flag set will fail to ensure that the data is on the disk. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/nfs/write.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -1386,7 +1386,7 @@ static int nfs_commit_inode(struct inode int res = 0; if (!nfs_commit_set_lock(NFS_I(inode), may_wait)) - goto out; + goto out_mark_dirty; spin_lock(&inode->i_lock); res = nfs_scan_commit(inode, &head, 0, 0); spin_unlock(&inode->i_lock); @@ -1398,9 +1398,18 @@ static int nfs_commit_inode(struct inode wait_on_bit(&NFS_I(inode)->flags, NFS_INO_COMMIT, nfs_wait_bit_killable, TASK_KILLABLE); + else + goto out_mark_dirty; } else nfs_commit_clear_lock(NFS_I(inode)); -out: + return res; + /* Note: If we exit without ensuring that the commit is complete, + * we must mark the inode as dirty. Otherwise, future calls to + * sync_inode() with the WB_SYNC_ALL flag set will fail to ensure + * that the data is on the disk. + */ +out_mark_dirty: + __mark_inode_dirty(inode, I_DIRTY_DATASYNC); return res; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [176/200] NFS: Fix another nfs_wb_page() deadlock 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (173 preceding siblings ...) 2010-07-01 17:44 ` [175/200] NFS: Ensure that we mark the inode as dirty if we exit early from commit Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [177/200] V4L/DVB: uvcvideo: Prevent division by 0 when control step value is 0 Greg KH ` (24 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Trond Myklebust 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Trond Myklebust <Trond.Myklebust@netapp.com> commit 0522f6adedd2736cbca3c0e16ca51df668993eee upstream. J.R. Okajima reports that the call to sync_inode() in nfs_wb_page() can deadlock with other writeback flush calls. It boils down to the fact that we cannot ever call writeback_single_inode() while holding a page lock (even if we do set nr_to_write to zero) since another process may already be waiting in the call to do_writepages(), and so will deny us the I_SYNC lock. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/nfs/write.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -1518,14 +1518,17 @@ int nfs_wb_page(struct inode *inode, str }; int ret; - while(PagePrivate(page)) { + for (;;) { wait_on_page_writeback(page); if (clear_page_dirty_for_io(page)) { ret = nfs_writepage_locked(page, &wbc); if (ret < 0) goto out_error; + continue; } - ret = sync_inode(inode, &wbc); + if (!PagePrivate(page)) + break; + ret = nfs_commit_inode(inode, FLUSH_SYNC); if (ret < 0) goto out_error; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [177/200] V4L/DVB: uvcvideo: Prevent division by 0 when control step value is 0 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (174 preceding siblings ...) 2010-07-01 17:44 ` [176/200] NFS: Fix another nfs_wb_page() deadlock Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [178/200] KVM: SVM: Dont use kmap_atomic in nested_svm_map Greg KH ` (23 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Laurent Pinchart, Mauro Carvalho Chehab 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Laurent Pinchart <laurent.pinchart@ideasonboard.com> commit cf7a50eeb6f462a0b7d1619fcb27a727a2981769 upstream. The control step values reported by the device are used as a divisor unchecked, which can result in a division by zero. Check the step value and make it 1 when null. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/media/video/uvc/uvc_ctrl.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/media/video/uvc/uvc_ctrl.c +++ b/drivers/media/video/uvc/uvc_ctrl.c @@ -1047,6 +1047,8 @@ int uvc_ctrl_set(struct uvc_video_chain uvc_ctrl_data(ctrl, UVC_CTRL_DATA_MAX)); step = mapping->get(mapping, UVC_GET_RES, uvc_ctrl_data(ctrl, UVC_CTRL_DATA_RES)); + if (step == 0) + step = 1; xctrl->value = min + (xctrl->value - min + step/2) / step * step; xctrl->value = clamp(xctrl->value, min, max); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [178/200] KVM: SVM: Dont use kmap_atomic in nested_svm_map 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (175 preceding siblings ...) 2010-07-01 17:44 ` [177/200] V4L/DVB: uvcvideo: Prevent division by 0 when control step value is 0 Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [179/200] KVM: SVM: Fix schedule-while-atomic on nested exception handling Greg KH ` (22 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> Use of kmap_atomic disables preemption but if we run in shadow-shadow mode the vmrun emulation executes kvm_set_cr3 which might sleep or fault. So use kmap instead for nested_svm_map. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit 7597f129d8b6799da7a264e6d6f7401668d3a36d) --- arch/x86/kvm/svm.c | 47 ++++++++++++++++++++++++----------------------- 1 file changed, 24 insertions(+), 23 deletions(-) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1423,7 +1423,7 @@ static inline int nested_svm_intr(struct return 0; } -static void *nested_svm_map(struct vcpu_svm *svm, u64 gpa, enum km_type idx) +static void *nested_svm_map(struct vcpu_svm *svm, u64 gpa, struct page **_page) { struct page *page; @@ -1431,7 +1431,9 @@ static void *nested_svm_map(struct vcpu_ if (is_error_page(page)) goto error; - return kmap_atomic(page, idx); + *_page = page; + + return kmap(page); error: kvm_release_page_clean(page); @@ -1440,16 +1442,9 @@ error: return NULL; } -static void nested_svm_unmap(void *addr, enum km_type idx) +static void nested_svm_unmap(struct page *page) { - struct page *page; - - if (!addr) - return; - - page = kmap_atomic_to_page(addr); - - kunmap_atomic(addr, idx); + kunmap(page); kvm_release_page_dirty(page); } @@ -1457,6 +1452,7 @@ static bool nested_svm_exit_handled_msr( { u32 param = svm->vmcb->control.exit_info_1 & 1; u32 msr = svm->vcpu.arch.regs[VCPU_REGS_RCX]; + struct page *page; bool ret = false; u32 t0, t1; u8 *msrpm; @@ -1464,7 +1460,7 @@ static bool nested_svm_exit_handled_msr( if (!(svm->nested.intercept & (1ULL << INTERCEPT_MSR_PROT))) return false; - msrpm = nested_svm_map(svm, svm->nested.vmcb_msrpm, KM_USER0); + msrpm = nested_svm_map(svm, svm->nested.vmcb_msrpm, &page); if (!msrpm) goto out; @@ -1492,7 +1488,7 @@ static bool nested_svm_exit_handled_msr( ret = msrpm[t1] & ((1 << param) << t0); out: - nested_svm_unmap(msrpm, KM_USER0); + nested_svm_unmap(page); return ret; } @@ -1615,6 +1611,7 @@ static int nested_svm_vmexit(struct vcpu struct vmcb *nested_vmcb; struct vmcb *hsave = svm->nested.hsave; struct vmcb *vmcb = svm->vmcb; + struct page *page; trace_kvm_nested_vmexit_inject(vmcb->control.exit_code, vmcb->control.exit_info_1, @@ -1622,7 +1619,7 @@ static int nested_svm_vmexit(struct vcpu vmcb->control.exit_int_info, vmcb->control.exit_int_info_err); - nested_vmcb = nested_svm_map(svm, svm->nested.vmcb, KM_USER0); + nested_vmcb = nested_svm_map(svm, svm->nested.vmcb, &page); if (!nested_vmcb) return 1; @@ -1712,7 +1709,7 @@ static int nested_svm_vmexit(struct vcpu /* Exit nested SVM mode */ svm->nested.vmcb = 0; - nested_svm_unmap(nested_vmcb, KM_USER0); + nested_svm_unmap(page); kvm_mmu_reset_context(&svm->vcpu); kvm_mmu_load(&svm->vcpu); @@ -1723,9 +1720,10 @@ static int nested_svm_vmexit(struct vcpu static bool nested_svm_vmrun_msrpm(struct vcpu_svm *svm) { u32 *nested_msrpm; + struct page *page; int i; - nested_msrpm = nested_svm_map(svm, svm->nested.vmcb_msrpm, KM_USER0); + nested_msrpm = nested_svm_map(svm, svm->nested.vmcb_msrpm, &page); if (!nested_msrpm) return false; @@ -1734,7 +1732,7 @@ static bool nested_svm_vmrun_msrpm(struc svm->vmcb->control.msrpm_base_pa = __pa(svm->nested.msrpm); - nested_svm_unmap(nested_msrpm, KM_USER0); + nested_svm_unmap(page); return true; } @@ -1744,8 +1742,9 @@ static bool nested_svm_vmrun(struct vcpu struct vmcb *nested_vmcb; struct vmcb *hsave = svm->nested.hsave; struct vmcb *vmcb = svm->vmcb; + struct page *page; - nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, KM_USER0); + nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page); if (!nested_vmcb) return false; @@ -1857,7 +1856,7 @@ static bool nested_svm_vmrun(struct vcpu svm->vmcb->control.event_inj = nested_vmcb->control.event_inj; svm->vmcb->control.event_inj_err = nested_vmcb->control.event_inj_err; - nested_svm_unmap(nested_vmcb, KM_USER0); + nested_svm_unmap(page); enable_gif(svm); @@ -1883,6 +1882,7 @@ static void nested_svm_vmloadsave(struct static int vmload_interception(struct vcpu_svm *svm) { struct vmcb *nested_vmcb; + struct page *page; if (nested_svm_check_permissions(svm)) return 1; @@ -1890,12 +1890,12 @@ static int vmload_interception(struct vc svm->next_rip = kvm_rip_read(&svm->vcpu) + 3; skip_emulated_instruction(&svm->vcpu); - nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, KM_USER0); + nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page); if (!nested_vmcb) return 1; nested_svm_vmloadsave(nested_vmcb, svm->vmcb); - nested_svm_unmap(nested_vmcb, KM_USER0); + nested_svm_unmap(page); return 1; } @@ -1903,6 +1903,7 @@ static int vmload_interception(struct vc static int vmsave_interception(struct vcpu_svm *svm) { struct vmcb *nested_vmcb; + struct page *page; if (nested_svm_check_permissions(svm)) return 1; @@ -1910,12 +1911,12 @@ static int vmsave_interception(struct vc svm->next_rip = kvm_rip_read(&svm->vcpu) + 3; skip_emulated_instruction(&svm->vcpu); - nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, KM_USER0); + nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page); if (!nested_vmcb) return 1; nested_svm_vmloadsave(svm->vmcb, nested_vmcb); - nested_svm_unmap(nested_vmcb, KM_USER0); + nested_svm_unmap(page); return 1; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [179/200] KVM: SVM: Fix schedule-while-atomic on nested exception handling 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (176 preceding siblings ...) 2010-07-01 17:44 ` [178/200] KVM: SVM: Dont use kmap_atomic in nested_svm_map Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [180/200] KVM: SVM: Sync all control registers on nested vmexit Greg KH ` (21 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> Move the actual vmexit routine out of code that runs with irqs and preemption disabled. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit b8e88bc8ffba5fe53fb8d8a0a4be3bbcffeebe56) --- arch/x86/kvm/svm.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -129,6 +129,7 @@ static void svm_flush_tlb(struct kvm_vcp static void svm_complete_interrupts(struct vcpu_svm *svm); static int nested_svm_exit_handled(struct vcpu_svm *svm); +static int nested_svm_intercept(struct vcpu_svm *svm); static int nested_svm_vmexit(struct vcpu_svm *svm); static int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr, bool has_error_code, u32 error_code); @@ -1384,6 +1385,8 @@ static int nested_svm_check_permissions( static int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr, bool has_error_code, u32 error_code) { + int vmexit; + if (!is_nested(svm)) return 0; @@ -1392,7 +1395,11 @@ static int nested_svm_check_exception(st svm->vmcb->control.exit_info_1 = error_code; svm->vmcb->control.exit_info_2 = svm->vcpu.arch.cr2; - return nested_svm_exit_handled(svm); + vmexit = nested_svm_intercept(svm); + if (vmexit == NESTED_EXIT_DONE) + svm->nested.exit_required = true; + + return vmexit; } static inline int nested_svm_intr(struct vcpu_svm *svm) @@ -1521,7 +1528,7 @@ static int nested_svm_exit_special(struc /* * If this function returns true, this #vmexit was already handled */ -static int nested_svm_exit_handled(struct vcpu_svm *svm) +static int nested_svm_intercept(struct vcpu_svm *svm) { u32 exit_code = svm->vmcb->control.exit_code; int vmexit = NESTED_EXIT_HOST; @@ -1567,9 +1574,17 @@ static int nested_svm_exit_handled(struc } } - if (vmexit == NESTED_EXIT_DONE) { + return vmexit; +} + +static int nested_svm_exit_handled(struct vcpu_svm *svm) +{ + int vmexit; + + vmexit = nested_svm_intercept(svm); + + if (vmexit == NESTED_EXIT_DONE) nested_svm_vmexit(svm); - } return vmexit; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [180/200] KVM: SVM: Sync all control registers on nested vmexit 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (177 preceding siblings ...) 2010-07-01 17:44 ` [179/200] KVM: SVM: Fix schedule-while-atomic on nested exception handling Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [181/200] KVM: SVM: Fix nested msr intercept handling Greg KH ` (20 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> Currently the vmexit emulation does not sync control registers were the access is typically intercepted by the nested hypervisor. But we can not count on that intercepts to sync these registers too and make the code architecturally more correct. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit cdbbdc1210223879450555fee04c29ebf116576b) --- arch/x86/kvm/svm.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1647,9 +1647,13 @@ static int nested_svm_vmexit(struct vcpu nested_vmcb->save.ds = vmcb->save.ds; nested_vmcb->save.gdtr = vmcb->save.gdtr; nested_vmcb->save.idtr = vmcb->save.idtr; + nested_vmcb->save.cr0 = kvm_read_cr0(&svm->vcpu); if (npt_enabled) nested_vmcb->save.cr3 = vmcb->save.cr3; + else + nested_vmcb->save.cr3 = svm->vcpu.arch.cr3; nested_vmcb->save.cr2 = vmcb->save.cr2; + nested_vmcb->save.cr4 = svm->vcpu.arch.cr4; nested_vmcb->save.rflags = vmcb->save.rflags; nested_vmcb->save.rip = vmcb->save.rip; nested_vmcb->save.rsp = vmcb->save.rsp; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [181/200] KVM: SVM: Fix nested msr intercept handling 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (178 preceding siblings ...) 2010-07-01 17:44 ` [180/200] KVM: SVM: Sync all control registers on nested vmexit Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [182/200] KVM: SVM: Dont sync nested cr8 to lapic and back Greg KH ` (19 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> The nested_svm_exit_handled_msr() function maps only one page of the guests msr permission bitmap. This patch changes the code to use kvm_read_guest to fix the bug. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit 4c7da8cb43c09e71a405b5aeaa58a1dbac3c39e9) --- arch/x86/kvm/svm.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1459,19 +1459,13 @@ static bool nested_svm_exit_handled_msr( { u32 param = svm->vmcb->control.exit_info_1 & 1; u32 msr = svm->vcpu.arch.regs[VCPU_REGS_RCX]; - struct page *page; bool ret = false; u32 t0, t1; - u8 *msrpm; + u8 val; if (!(svm->nested.intercept & (1ULL << INTERCEPT_MSR_PROT))) return false; - msrpm = nested_svm_map(svm, svm->nested.vmcb_msrpm, &page); - - if (!msrpm) - goto out; - switch (msr) { case 0 ... 0x1fff: t0 = (msr * 2) % 8; @@ -1492,11 +1486,10 @@ static bool nested_svm_exit_handled_msr( goto out; } - ret = msrpm[t1] & ((1 << param) << t0); + if (!kvm_read_guest(svm->vcpu.kvm, svm->nested.vmcb_msrpm + t1, &val, 1)) + ret = val & ((1 << param) << t0); out: - nested_svm_unmap(page); - return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [182/200] KVM: SVM: Dont sync nested cr8 to lapic and back 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (179 preceding siblings ...) 2010-07-01 17:44 ` [181/200] KVM: SVM: Fix nested msr intercept handling Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [183/200] KVM: SVM: Fix wrong interrupt injection in enable_irq_windows Greg KH ` (18 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> This patch makes syncing of the guest tpr to the lapic conditional on !nested. Otherwise a nested guest using the TPR could freeze the guest. Another important change this patch introduces is that the cr8 intercept bits are no longer ORed at vmrun emulation if the guest sets VINTR_MASKING in its VMCB. The reason is that nested cr8 accesses need alway be handled by the nested hypervisor because they change the shadow version of the tpr. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit 88ab24adc7142506c8583ac36a34fa388300b750) --- arch/x86/kvm/svm.c | 46 +++++++++++++++++++++++++++++++--------------- 1 file changed, 31 insertions(+), 15 deletions(-) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1830,21 +1830,6 @@ static bool nested_svm_vmrun(struct vcpu svm->vmcb->save.dr6 = nested_vmcb->save.dr6; svm->vmcb->save.cpl = nested_vmcb->save.cpl; - /* We don't want a nested guest to be more powerful than the guest, - so all intercepts are ORed */ - svm->vmcb->control.intercept_cr_read |= - nested_vmcb->control.intercept_cr_read; - svm->vmcb->control.intercept_cr_write |= - nested_vmcb->control.intercept_cr_write; - svm->vmcb->control.intercept_dr_read |= - nested_vmcb->control.intercept_dr_read; - svm->vmcb->control.intercept_dr_write |= - nested_vmcb->control.intercept_dr_write; - svm->vmcb->control.intercept_exceptions |= - nested_vmcb->control.intercept_exceptions; - - svm->vmcb->control.intercept |= nested_vmcb->control.intercept; - svm->nested.vmcb_msrpm = nested_vmcb->control.msrpm_base_pa; /* cache intercepts */ @@ -1862,6 +1847,28 @@ static bool nested_svm_vmrun(struct vcpu else svm->vcpu.arch.hflags &= ~HF_VINTR_MASK; + if (svm->vcpu.arch.hflags & HF_VINTR_MASK) { + /* We only want the cr8 intercept bits of the guest */ + svm->vmcb->control.intercept_cr_read &= ~INTERCEPT_CR8_MASK; + svm->vmcb->control.intercept_cr_write &= ~INTERCEPT_CR8_MASK; + } + + /* We don't want a nested guest to be more powerful than the guest, + so all intercepts are ORed */ + svm->vmcb->control.intercept_cr_read |= + nested_vmcb->control.intercept_cr_read; + svm->vmcb->control.intercept_cr_write |= + nested_vmcb->control.intercept_cr_write; + svm->vmcb->control.intercept_dr_read |= + nested_vmcb->control.intercept_dr_read; + svm->vmcb->control.intercept_dr_write |= + nested_vmcb->control.intercept_dr_write; + svm->vmcb->control.intercept_exceptions |= + nested_vmcb->control.intercept_exceptions; + + svm->vmcb->control.intercept |= nested_vmcb->control.intercept; + + svm->vmcb->control.lbr_ctl = nested_vmcb->control.lbr_ctl; svm->vmcb->control.int_vector = nested_vmcb->control.int_vector; svm->vmcb->control.int_state = nested_vmcb->control.int_state; svm->vmcb->control.tsc_offset += nested_vmcb->control.tsc_offset; @@ -2524,6 +2531,9 @@ static void update_cr8_intercept(struct { struct vcpu_svm *svm = to_svm(vcpu); + if (is_nested(svm) && (vcpu->arch.hflags & HF_VINTR_MASK)) + return; + if (irr == -1) return; @@ -2627,6 +2637,9 @@ static inline void sync_cr8_to_lapic(str { struct vcpu_svm *svm = to_svm(vcpu); + if (is_nested(svm) && (vcpu->arch.hflags & HF_VINTR_MASK)) + return; + if (!(svm->vmcb->control.intercept_cr_write & INTERCEPT_CR8_MASK)) { int cr8 = svm->vmcb->control.int_ctl & V_TPR_MASK; kvm_set_cr8(vcpu, cr8); @@ -2638,6 +2651,9 @@ static inline void sync_lapic_to_cr8(str struct vcpu_svm *svm = to_svm(vcpu); u64 cr8; + if (is_nested(svm) && (vcpu->arch.hflags & HF_VINTR_MASK)) + return; + cr8 = kvm_get_cr8(vcpu); svm->vmcb->control.int_ctl &= ~V_TPR_MASK; svm->vmcb->control.int_ctl |= cr8 & V_TPR_MASK; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [183/200] KVM: SVM: Fix wrong interrupt injection in enable_irq_windows 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (180 preceding siblings ...) 2010-07-01 17:44 ` [182/200] KVM: SVM: Dont sync nested cr8 to lapic and back Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [184/200] KVM: s390: Fix possible memory leak of in kvm_arch_vcpu_create() Greg KH ` (17 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> The nested_svm_intr() function does not execute the vmexit anymore. Therefore we may still be in the nested state after that function ran. This patch changes the nested_svm_intr() function to return wether the irq window could be enabled. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit 8fe546547cf6857a9d984bfe2f2194910f3fc5d0) --- arch/x86/kvm/svm.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1402,16 +1402,17 @@ static int nested_svm_check_exception(st return vmexit; } -static inline int nested_svm_intr(struct vcpu_svm *svm) +/* This function returns true if it is save to enable the irq window */ +static inline bool nested_svm_intr(struct vcpu_svm *svm) { if (!is_nested(svm)) - return 0; + return true; if (!(svm->vcpu.arch.hflags & HF_VINTR_MASK)) - return 0; + return true; if (!(svm->vcpu.arch.hflags & HF_HIF_MASK)) - return 0; + return false; svm->vmcb->control.exit_code = SVM_EXIT_INTR; @@ -1424,10 +1425,10 @@ static inline int nested_svm_intr(struct */ svm->nested.exit_required = true; trace_kvm_nested_intr_vmexit(svm->vmcb->save.rip); - return 1; + return false; } - return 0; + return true; } static void *nested_svm_map(struct vcpu_svm *svm, u64 gpa, struct page **_page) @@ -2591,13 +2592,11 @@ static void enable_irq_window(struct kvm { struct vcpu_svm *svm = to_svm(vcpu); - nested_svm_intr(svm); - /* In case GIF=0 we can't rely on the CPU to tell us when * GIF becomes 1, because that's a separate STGI/VMRUN intercept. * The next time we get that intercept, this function will be * called again though and we'll get the vintr intercept. */ - if (gif_set(svm)) { + if (gif_set(svm) && nested_svm_intr(svm)) { svm_set_vintr(svm); svm_inject_irq(svm, 0x0); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [184/200] KVM: s390: Fix possible memory leak of in kvm_arch_vcpu_create() 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (181 preceding siblings ...) 2010-07-01 17:44 ` [183/200] KVM: SVM: Fix wrong interrupt injection in enable_irq_windows Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [185/200] KVM: PPC: Do not create debugfs if fail to create vcpu Greg KH ` (16 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Wei Yongjun, Carsten Otte, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wei Yongjun <yjwei@cn.fujitsu.com> This patch fixed possible memory leak in kvm_arch_vcpu_create() under s390, which would happen when kvm_arch_vcpu_create() fails. Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Acked-by: Carsten Otte <cotte@de.ibm.com> Cc: stable@kernel.org Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit 7b06bf2ffa15e119c7439ed0b024d44f66d7b605) --- arch/s390/kvm/kvm-s390.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -341,11 +341,13 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st rc = kvm_vcpu_init(vcpu, kvm, id); if (rc) - goto out_free_cpu; + goto out_free_sie_block; VM_EVENT(kvm, 3, "create cpu %d at %p, sie block at %p", id, vcpu, vcpu->arch.sie_block); return vcpu; +out_free_sie_block: + free_page((unsigned long)(vcpu->arch.sie_block)); out_free_cpu: kfree(vcpu); out_nomem: ^ permalink raw reply [flat|nested] 666+ messages in thread
* [185/200] KVM: PPC: Do not create debugfs if fail to create vcpu 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (182 preceding siblings ...) 2010-07-01 17:44 ` [184/200] KVM: s390: Fix possible memory leak of in kvm_arch_vcpu_create() Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [186/200] KVM: x86: Add callback to let modules decide over some supported cpuid bits Greg KH ` (15 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Wei Yongjun, Alexander Graf, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wei Yongjun <yjwei@cn.fujitsu.com> If fail to create the vcpu, we should not create the debugfs for it. Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Acked-by: Alexander Graf <agraf@suse.de> Cc: stable@kernel.org Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit 06056bfb944a0302a8f22eb45f09123de7fb417b) --- arch/powerpc/kvm/powerpc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/arch/powerpc/kvm/powerpc.c +++ b/arch/powerpc/kvm/powerpc.c @@ -193,7 +193,8 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st { struct kvm_vcpu *vcpu; vcpu = kvmppc_core_vcpu_create(kvm, id); - kvmppc_create_vcpu_debugfs(vcpu, id); + if (!IS_ERR(vcpu)) + kvmppc_create_vcpu_debugfs(vcpu, id); return vcpu; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [186/200] KVM: x86: Add callback to let modules decide over some supported cpuid bits 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (183 preceding siblings ...) 2010-07-01 17:44 ` [185/200] KVM: PPC: Do not create debugfs if fail to create vcpu Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [187/200] KVM: SVM: Report emulated SVM features to userspace Greg KH ` (14 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> This patch adds the get_supported_cpuid callback to kvm_x86_ops. It will be used in do_cpuid_ent to delegate the decission about some supported cpuid bits to the architecture modules. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit d4330ef2fb2236a1e3a176f0f68360f4c0a8661b) --- arch/x86/include/asm/kvm_host.h | 2 ++ arch/x86/kvm/svm.c | 6 ++++++ arch/x86/kvm/vmx.c | 6 ++++++ arch/x86/kvm/x86.c | 3 +++ 4 files changed, 17 insertions(+) --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -541,6 +541,8 @@ struct kvm_x86_ops { int (*get_lpage_level)(void); bool (*rdtscp_supported)(void); + void (*set_supported_cpuid)(u32 func, struct kvm_cpuid_entry2 *entry); + const struct trace_print_flags *exit_reasons_str; }; --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -2907,6 +2907,10 @@ static void svm_cpuid_update(struct kvm_ { } +static void svm_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry) +{ +} + static const struct trace_print_flags svm_exit_reasons_str[] = { { SVM_EXIT_READ_CR0, "read_cr0" }, { SVM_EXIT_READ_CR3, "read_cr3" }, @@ -3051,6 +3055,8 @@ static struct kvm_x86_ops svm_x86_ops = .cpuid_update = svm_cpuid_update, .rdtscp_supported = svm_rdtscp_supported, + + .set_supported_cpuid = svm_set_supported_cpuid, }; static int __init svm_init(void) --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -4115,6 +4115,10 @@ static void vmx_cpuid_update(struct kvm_ } } +static void vmx_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry) +{ +} + static struct kvm_x86_ops vmx_x86_ops = { .cpu_has_kvm_support = cpu_has_kvm_support, .disabled_by_bios = vmx_disabled_by_bios, @@ -4186,6 +4190,8 @@ static struct kvm_x86_ops vmx_x86_ops = .cpuid_update = vmx_cpuid_update, .rdtscp_supported = vmx_rdtscp_supported, + + .set_supported_cpuid = vmx_set_supported_cpuid, }; static int __init vmx_init(void) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1917,6 +1917,9 @@ static void do_cpuid_ent(struct kvm_cpui entry->ecx &= kvm_supported_word6_x86_features; break; } + + kvm_x86_ops->set_supported_cpuid(function, entry); + put_cpu(); } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [187/200] KVM: SVM: Report emulated SVM features to userspace 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (184 preceding siblings ...) 2010-07-01 17:44 ` [186/200] KVM: x86: Add callback to let modules decide over some supported cpuid bits Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [188/200] x86, paravirt: Add a global synchronization point for pvclock Greg KH ` (13 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> This patch implements the reporting of the emulated SVM features to userspace instead of the real hardware capabilities. Every real hardware capability needs emulation in nested svm so the old behavior was broken. Cc: stable@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit c2c63a493924e09a1984d1374a0e60dfd54fc0b0) --- arch/x86/kvm/svm.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -2909,6 +2909,16 @@ static void svm_cpuid_update(struct kvm_ static void svm_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry) { + switch (func) { + case 0x8000000A: + entry->eax = 1; /* SVM revision 1 */ + entry->ebx = 8; /* Lets support 8 ASIDs in case we add proper + ASID emulation to nested SVM */ + entry->ecx = 0; /* Reserved */ + entry->edx = 0; /* Do not support any additional features */ + + break; + } } static const struct trace_print_flags svm_exit_reasons_str[] = { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [188/200] x86, paravirt: Add a global synchronization point for pvclock 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (185 preceding siblings ...) 2010-07-01 17:44 ` [187/200] KVM: SVM: Report emulated SVM features to userspace Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [189/200] KVM: Dont allow lmsw to clear cr0.pe Greg KH ` (12 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Glauber Costa, Zachary Amsden, Jeremy Fitzhardinge, Avi Kivity, Marcelo Tosatti 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Glauber Costa <glommer@redhat.com> In recent stress tests, it was found that pvclock-based systems could seriously warp in smp systems. Using ingo's time-warp-test.c, I could trigger a scenario as bad as 1.5mi warps a minute in some systems. (to be fair, it wasn't that bad in most of them). Investigating further, I found out that such warps were caused by the very offset-based calculation pvclock is based on. This happens even on some machines that report constant_tsc in its tsc flags, specially on multi-socket ones. Two reads of the same kernel timestamp at approx the same time, will likely have tsc timestamped in different occasions too. This means the delta we calculate is unpredictable at best, and can probably be smaller in a cpu that is legitimately reading clock in a forward ocasion. Some adjustments on the host could make this window less likely to happen, but still, it pretty much poses as an intrinsic problem of the mechanism. A while ago, I though about using a shared variable anyway, to hold clock last state, but gave up due to the high contention locking was likely to introduce, possibly rendering the thing useless on big machines. I argue, however, that locking is not necessary. We do a read-and-return sequence in pvclock, and between read and return, the global value can have changed. However, it can only have changed by means of an addition of a positive value. So if we detected that our clock timestamp is less than the current global, we know that we need to return a higher one, even though it is not exactly the one we compared to. OTOH, if we detect we're greater than the current time source, we atomically replace the value with our new readings. This do causes contention on big boxes (but big here means *BIG*), but it seems like a good trade off, since it provide us with a time source guaranteed to be stable wrt time warps. After this patch is applied, I don't see a single warp in time during 5 days of execution, in any of the machines I saw them before. Signed-off-by: Glauber Costa <glommer@redhat.com> Acked-by: Zachary Amsden <zamsden@redhat.com> CC: Jeremy Fitzhardinge <jeremy@goop.org> CC: Avi Kivity <avi@redhat.com> CC: Marcelo Tosatti <mtosatti@redhat.com> CC: Zachary Amsden <zamsden@redhat.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit 489fb490dbf8dab0249ad82b56688ae3842a79e8) --- arch/x86/kernel/pvclock.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) --- a/arch/x86/kernel/pvclock.c +++ b/arch/x86/kernel/pvclock.c @@ -109,11 +109,14 @@ unsigned long pvclock_tsc_khz(struct pvc return pv_tsc_khz; } +static atomic64_t last_value = ATOMIC64_INIT(0); + cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src) { struct pvclock_shadow_time shadow; unsigned version; cycle_t ret, offset; + u64 last; do { version = pvclock_get_time_values(&shadow, src); @@ -123,6 +126,27 @@ cycle_t pvclock_clocksource_read(struct barrier(); } while (version != src->version); + /* + * Assumption here is that last_value, a global accumulator, always goes + * forward. If we are less than that, we should not be much smaller. + * We assume there is an error marging we're inside, and then the correction + * does not sacrifice accuracy. + * + * For reads: global may have changed between test and return, + * but this means someone else updated poked the clock at a later time. + * We just need to make sure we are not seeing a backwards event. + * + * For updates: last_value = ret is not enough, since two vcpus could be + * updating at the same time, and one of them could be slightly behind, + * making the assumption that last_value always go forward fail to hold. + */ + last = atomic64_read(&last_value); + do { + if (ret < last) + return last; + last = atomic64_cmpxchg(&last_value, last, ret); + } while (unlikely(last != ret)); + return ret; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [189/200] KVM: Dont allow lmsw to clear cr0.pe 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (186 preceding siblings ...) 2010-07-01 17:44 ` [188/200] x86, paravirt: Add a global synchronization point for pvclock Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [190/200] KVM: x86: Check LMA bit before set_efer Greg KH ` (11 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Avi Kivity, Marcelo Tosatti 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Avi Kivity <avi@redhat.com> The current lmsw implementation allows the guest to clear cr0.pe, contrary to the manual, which breaks EMM386.EXE. Fix by ORing the old cr0.pe with lmsw's operand. Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit f78e917688edbf1f14c318d2e50dc8e7dad20445) --- arch/x86/kvm/x86.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -484,7 +484,7 @@ EXPORT_SYMBOL_GPL(kvm_set_cr0); void kvm_lmsw(struct kvm_vcpu *vcpu, unsigned long msw) { - kvm_set_cr0(vcpu, kvm_read_cr0_bits(vcpu, ~0x0ful) | (msw & 0x0f)); + kvm_set_cr0(vcpu, kvm_read_cr0_bits(vcpu, ~0x0eul) | (msw & 0x0f)); } EXPORT_SYMBOL_GPL(kvm_lmsw); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [190/200] KVM: x86: Check LMA bit before set_efer 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (187 preceding siblings ...) 2010-07-01 17:44 ` [189/200] KVM: Dont allow lmsw to clear cr0.pe Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [191/200] KVM: MMU: Segregate shadow pages with different cr0.wp Greg KH ` (10 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Sheng Yang, Marcelo Tosatti 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sheng Yang <sheng@linux.intel.com> kvm_x86_ops->set_efer() would execute vcpu->arch.efer = efer, so the checking of LMA bit didn't work. Signed-off-by: Sheng Yang <sheng@linux.intel.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit a3d204e28579427609c3d15d2310127ebaa47d94) --- arch/x86/kvm/x86.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -657,11 +657,11 @@ static void set_efer(struct kvm_vcpu *vc } } - kvm_x86_ops->set_efer(vcpu, efer); - efer &= ~EFER_LMA; efer |= vcpu->arch.efer & EFER_LMA; + kvm_x86_ops->set_efer(vcpu, efer); + vcpu->arch.efer = efer; vcpu->arch.mmu.base_role.nxe = (efer & EFER_NX) && !tdp_enabled; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [191/200] KVM: MMU: Segregate shadow pages with different cr0.wp 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (188 preceding siblings ...) 2010-07-01 17:44 ` [190/200] KVM: x86: Check LMA bit before set_efer Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [192/200] KVM: VMX: enable VMXON check with SMX enabled (Intel TXT) Greg KH ` (9 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Avi Kivity, Marcelo Tosatti 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Avi Kivity <avi@redhat.com> When cr0.wp=0, we may shadow a gpte having u/s=1 and r/w=0 with an spte having u/s=0 and r/w=1. This allows excessive access if the guest sets cr0.wp=1 and accesses through this spte. Fix by making cr0.wp part of the base role; we'll have different sptes for the two cases and the problem disappears. Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit 3dbe141595faa48a067add3e47bba3205b79d33c) --- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/mmu.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -180,6 +180,7 @@ union kvm_mmu_page_role { unsigned invalid:1; unsigned cr4_pge:1; unsigned nxe:1; + unsigned cr0_wp:1; }; }; --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -223,7 +223,7 @@ void kvm_mmu_set_mask_ptes(u64 user_mask } EXPORT_SYMBOL_GPL(kvm_mmu_set_mask_ptes); -static int is_write_protection(struct kvm_vcpu *vcpu) +static bool is_write_protection(struct kvm_vcpu *vcpu) { return kvm_read_cr0_bits(vcpu, X86_CR0_WP); } @@ -2439,6 +2439,7 @@ static int init_kvm_softmmu(struct kvm_v r = paging32_init_context(vcpu); vcpu->arch.mmu.base_role.glevels = vcpu->arch.mmu.root_level; + vcpu->arch.mmu.base_role.cr0_wp = is_write_protection(vcpu); return r; } ^ permalink raw reply [flat|nested] 666+ messages in thread
* [192/200] KVM: VMX: enable VMXON check with SMX enabled (Intel TXT) 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (189 preceding siblings ...) 2010-07-01 17:44 ` [191/200] KVM: MMU: Segregate shadow pages with different cr0.wp Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [193/200] KVM: MMU: Dont read pdptrs with mmu spinlock held in mmu_alloc_roots Greg KH ` (8 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Shane Wang, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shane Wang <shane.wang@intel.com> Per document, for feature control MSR: Bit 1 enables VMXON in SMX operation. If the bit is clear, execution of VMXON in SMX operation causes a general-protection exception. Bit 2 enables VMXON outside SMX operation. If the bit is clear, execution of VMXON outside SMX operation causes a general-protection exception. This patch is to enable this kind of check with SMX for VMXON in KVM. Signed-off-by: Shane Wang <shane.wang@intel.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit cafd66595d92591e4bd25c3904e004fc6f897e2d) --- arch/x86/include/asm/msr-index.h | 5 +++-- arch/x86/kernel/tboot.c | 1 + arch/x86/kvm/vmx.c | 32 +++++++++++++++++++++----------- include/linux/tboot.h | 1 + 4 files changed, 26 insertions(+), 13 deletions(-) --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -199,8 +199,9 @@ #define MSR_IA32_EBL_CR_POWERON 0x0000002a #define MSR_IA32_FEATURE_CONTROL 0x0000003a -#define FEATURE_CONTROL_LOCKED (1<<0) -#define FEATURE_CONTROL_VMXON_ENABLED (1<<2) +#define FEATURE_CONTROL_LOCKED (1<<0) +#define FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX (1<<1) +#define FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX (1<<2) #define MSR_IA32_APICBASE 0x0000001b #define MSR_IA32_APICBASE_BSP (1<<8) --- a/arch/x86/kernel/tboot.c +++ b/arch/x86/kernel/tboot.c @@ -46,6 +46,7 @@ /* Global pointer to shared data; NULL means no measured launch. */ struct tboot *tboot __read_mostly; +EXPORT_SYMBOL(tboot); /* timeout for APs (in secs) to enter wait-for-SIPI state during shutdown */ #define AP_WAIT_TIMEOUT 1 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -27,6 +27,7 @@ #include <linux/moduleparam.h> #include <linux/ftrace_event.h> #include <linux/slab.h> +#include <linux/tboot.h> #include "kvm_cache_regs.h" #include "x86.h" @@ -1176,9 +1177,16 @@ static __init int vmx_disabled_by_bios(v u64 msr; rdmsrl(MSR_IA32_FEATURE_CONTROL, msr); - return (msr & (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) - == FEATURE_CONTROL_LOCKED; + if (msr & FEATURE_CONTROL_LOCKED) { + if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX) + && tboot_enabled()) + return 1; + if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX) + && !tboot_enabled()) + return 1; + } + + return 0; /* locked but not enabled */ } @@ -1186,21 +1194,23 @@ static int hardware_enable(void *garbage { int cpu = raw_smp_processor_id(); u64 phys_addr = __pa(per_cpu(vmxarea, cpu)); - u64 old; + u64 old, test_bits; if (read_cr4() & X86_CR4_VMXE) return -EBUSY; INIT_LIST_HEAD(&per_cpu(vcpus_on_cpu, cpu)); rdmsrl(MSR_IA32_FEATURE_CONTROL, old); - if ((old & (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) - != (FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED)) + + test_bits = FEATURE_CONTROL_LOCKED; + test_bits |= FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX; + if (tboot_enabled()) + test_bits |= FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX; + + if ((old & test_bits) != test_bits) { /* enable and lock */ - wrmsrl(MSR_IA32_FEATURE_CONTROL, old | - FEATURE_CONTROL_LOCKED | - FEATURE_CONTROL_VMXON_ENABLED); + wrmsrl(MSR_IA32_FEATURE_CONTROL, old | test_bits); + } write_cr4(read_cr4() | X86_CR4_VMXE); /* FIXME: not cpu hotplug safe */ asm volatile (ASM_VMX_VMXON_RAX : : "a"(&phys_addr), "m"(phys_addr) --- a/include/linux/tboot.h +++ b/include/linux/tboot.h @@ -150,6 +150,7 @@ extern int tboot_force_iommu(void); #else +#define tboot_enabled() 0 #define tboot_probe() do { } while (0) #define tboot_shutdown(shutdown_type) do { } while (0) #define tboot_sleep(sleep_state, pm1a_control, pm1b_control) \ ^ permalink raw reply [flat|nested] 666+ messages in thread
* [193/200] KVM: MMU: Dont read pdptrs with mmu spinlock held in mmu_alloc_roots 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (190 preceding siblings ...) 2010-07-01 17:44 ` [192/200] KVM: VMX: enable VMXON check with SMX enabled (Intel TXT) Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [194/200] KVM: Fix wallclock version writing race Greg KH ` (7 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Avi Kivity <avi@redhat.com> On svm, kvm_read_pdptr() may require reading guest memory, which can sleep. Push the spinlock into mmu_alloc_roots(), and only take it after we've read the pdptr. Tested-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit 8facbbff071ff2b19268d3732e31badc60471e21) --- arch/x86/kvm/mmu.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -2085,11 +2085,13 @@ static int mmu_alloc_roots(struct kvm_vc direct = 1; if (mmu_check_root(vcpu, root_gfn)) return 1; + spin_lock(&vcpu->kvm->mmu_lock); sp = kvm_mmu_get_page(vcpu, root_gfn, 0, PT64_ROOT_LEVEL, direct, ACC_ALL, NULL); root = __pa(sp->spt); ++sp->root_count; + spin_unlock(&vcpu->kvm->mmu_lock); vcpu->arch.mmu.root_hpa = root; return 0; } @@ -2111,11 +2113,14 @@ static int mmu_alloc_roots(struct kvm_vc root_gfn = 0; if (mmu_check_root(vcpu, root_gfn)) return 1; + spin_lock(&vcpu->kvm->mmu_lock); sp = kvm_mmu_get_page(vcpu, root_gfn, i << 30, PT32_ROOT_LEVEL, direct, ACC_ALL, NULL); root = __pa(sp->spt); ++sp->root_count; + spin_unlock(&vcpu->kvm->mmu_lock); + vcpu->arch.mmu.pae_root[i] = root | PT_PRESENT_MASK; } vcpu->arch.mmu.root_hpa = __pa(vcpu->arch.mmu.pae_root); @@ -2479,7 +2484,9 @@ int kvm_mmu_load(struct kvm_vcpu *vcpu) goto out; spin_lock(&vcpu->kvm->mmu_lock); kvm_mmu_free_some_pages(vcpu); + spin_unlock(&vcpu->kvm->mmu_lock); r = mmu_alloc_roots(vcpu); + spin_lock(&vcpu->kvm->mmu_lock); mmu_sync_roots(vcpu); spin_unlock(&vcpu->kvm->mmu_lock); if (r) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [194/200] KVM: Fix wallclock version writing race 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (191 preceding siblings ...) 2010-07-01 17:44 ` [193/200] KVM: MMU: Dont read pdptrs with mmu spinlock held in mmu_alloc_roots Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [195/200] KVM: PPC: Add missing vcpu_load()/vcpu_put() in vcpu ioctls Greg KH ` (6 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Glauber Costa, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Avi Kivity <avi@redhat.com> Wallclock writing uses an unprotected global variable to hold the version; this can cause one guest to interfere with another if both write their wallclock at the same time. Acked-by: Glauber Costa <glommer@redhat.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit 9ed3c444ab8987c7b219173a2f7807e3f71e234e) --- arch/x86/kvm/x86.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -695,14 +695,22 @@ static int do_set_msr(struct kvm_vcpu *v static void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock) { - static int version; + int version; + int r; struct pvclock_wall_clock wc; struct timespec boot; if (!wall_clock) return; - version++; + r = kvm_read_guest(kvm, wall_clock, &version, sizeof(version)); + if (r) + return; + + if (version & 1) + ++version; /* first time write, random junk */ + + ++version; kvm_write_guest(kvm, wall_clock, &version, sizeof(version)); ^ permalink raw reply [flat|nested] 666+ messages in thread
* [195/200] KVM: PPC: Add missing vcpu_load()/vcpu_put() in vcpu ioctls 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (192 preceding siblings ...) 2010-07-01 17:44 ` [194/200] KVM: Fix wallclock version writing race Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [196/200] KVM: x86: Add missing locking to arch specific " Greg KH ` (5 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Avi Kivity <avi@redhat.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit 98001d8d017cea1ee0f9f35c6227bbd63ef5005b) --- arch/powerpc/kvm/book3s.c | 10 ++++++++++ arch/powerpc/kvm/booke.c | 15 ++++++++++++++- 2 files changed, 24 insertions(+), 1 deletion(-) --- a/arch/powerpc/kvm/book3s.c +++ b/arch/powerpc/kvm/book3s.c @@ -922,6 +922,8 @@ int kvm_arch_vcpu_ioctl_get_sregs(struct struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu); int i; + vcpu_load(vcpu); + sregs->pvr = vcpu->arch.pvr; sregs->u.s.sdr1 = to_book3s(vcpu)->sdr1; @@ -940,6 +942,9 @@ int kvm_arch_vcpu_ioctl_get_sregs(struct sregs->u.s.ppc32.dbat[i] = vcpu3s->dbat[i].raw; } } + + vcpu_put(vcpu); + return 0; } @@ -949,6 +954,8 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct struct kvmppc_vcpu_book3s *vcpu3s = to_book3s(vcpu); int i; + vcpu_load(vcpu); + kvmppc_set_pvr(vcpu, sregs->pvr); vcpu3s->sdr1 = sregs->u.s.sdr1; @@ -975,6 +982,9 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct /* Flush the MMU after messing with the segments */ kvmppc_mmu_pte_flush(vcpu, 0, 0); + + vcpu_put(vcpu); + return 0; } --- a/arch/powerpc/kvm/booke.c +++ b/arch/powerpc/kvm/booke.c @@ -479,6 +479,8 @@ int kvm_arch_vcpu_ioctl_get_regs(struct { int i; + vcpu_load(vcpu); + regs->pc = vcpu->arch.pc; regs->cr = kvmppc_get_cr(vcpu); regs->ctr = vcpu->arch.ctr; @@ -499,6 +501,8 @@ int kvm_arch_vcpu_ioctl_get_regs(struct for (i = 0; i < ARRAY_SIZE(regs->gpr); i++) regs->gpr[i] = kvmppc_get_gpr(vcpu, i); + vcpu_put(vcpu); + return 0; } @@ -506,6 +510,8 @@ int kvm_arch_vcpu_ioctl_set_regs(struct { int i; + vcpu_load(vcpu); + vcpu->arch.pc = regs->pc; kvmppc_set_cr(vcpu, regs->cr); vcpu->arch.ctr = regs->ctr; @@ -525,6 +531,8 @@ int kvm_arch_vcpu_ioctl_set_regs(struct for (i = 0; i < ARRAY_SIZE(regs->gpr); i++) kvmppc_set_gpr(vcpu, i, regs->gpr[i]); + vcpu_put(vcpu); + return 0; } @@ -553,7 +561,12 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct k int kvm_arch_vcpu_ioctl_translate(struct kvm_vcpu *vcpu, struct kvm_translation *tr) { - return kvmppc_core_vcpu_translate(vcpu, tr); + int r; + + vcpu_load(vcpu); + r = kvmppc_core_vcpu_translate(vcpu, tr); + vcpu_put(vcpu); + return r; } int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm, struct kvm_dirty_log *log) ^ permalink raw reply [flat|nested] 666+ messages in thread
* [196/200] KVM: x86: Add missing locking to arch specific vcpu ioctls 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (193 preceding siblings ...) 2010-07-01 17:44 ` [195/200] KVM: PPC: Add missing vcpu_load()/vcpu_put() in vcpu ioctls Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [197/200] KVM: x86: Inject #GP with the right rip on efer writes Greg KH ` (4 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable; +Cc: stable-review, torvalds, akpm, alan, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Avi Kivity <avi@redhat.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit 8fbf065d625617bbbf6b72d5f78f84ad13c8b547) --- arch/x86/kvm/x86.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1776,6 +1776,7 @@ static int kvm_vcpu_ioctl_get_cpuid2(str { int r; + vcpu_load(vcpu); r = -E2BIG; if (cpuid->nent < vcpu->arch.cpuid_nent) goto out; @@ -1787,6 +1788,7 @@ static int kvm_vcpu_ioctl_get_cpuid2(str out: cpuid->nent = vcpu->arch.cpuid_nent; + vcpu_put(vcpu); return r; } @@ -2042,6 +2044,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce( int r; unsigned bank_num = mcg_cap & 0xff, bank; + vcpu_load(vcpu); r = -EINVAL; if (!bank_num || bank_num >= KVM_MAX_MCE_BANKS) goto out; @@ -2056,6 +2059,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce( for (bank = 0; bank < bank_num; bank++) vcpu->arch.mce_banks[bank*4] = ~(u64)0; out: + vcpu_put(vcpu); return r; } @@ -2323,7 +2327,9 @@ long kvm_arch_vcpu_ioctl(struct file *fi r = -EFAULT; if (copy_from_user(&mce, argp, sizeof mce)) goto out; + vcpu_load(vcpu); r = kvm_vcpu_ioctl_x86_set_mce(vcpu, &mce); + vcpu_put(vcpu); break; } case KVM_GET_VCPU_EVENTS: { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [197/200] KVM: x86: Inject #GP with the right rip on efer writes 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (194 preceding siblings ...) 2010-07-01 17:44 ` [196/200] KVM: x86: Add missing locking to arch specific " Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [198/200] KVM: SVM: Dont allow nested guest to VMMCALL into host Greg KH ` (3 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> This patch fixes a bug in the KVM efer-msr write path. If a guest writes to a reserved efer bit the set_efer function injects the #GP directly. The architecture dependent wrmsr function does not see this, assumes success and advances the rip. This results in a #GP in the guest with the wrong rip. This patch fixes this by reporting efer write errors back to the architectural wrmsr function. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit b69e8caef5b190af48c525f6d715e7b7728a77f6) --- arch/x86/kvm/x86.c | 31 ++++++++++++------------------- 1 file changed, 12 insertions(+), 19 deletions(-) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -624,37 +624,29 @@ static u32 emulated_msrs[] = { MSR_IA32_MISC_ENABLE, }; -static void set_efer(struct kvm_vcpu *vcpu, u64 efer) +static int set_efer(struct kvm_vcpu *vcpu, u64 efer) { - if (efer & efer_reserved_bits) { - kvm_inject_gp(vcpu, 0); - return; - } + if (efer & efer_reserved_bits) + return 1; if (is_paging(vcpu) - && (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME)) { - kvm_inject_gp(vcpu, 0); - return; - } + && (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME)) + return 1; if (efer & EFER_FFXSR) { struct kvm_cpuid_entry2 *feat; feat = kvm_find_cpuid_entry(vcpu, 0x80000001, 0); - if (!feat || !(feat->edx & bit(X86_FEATURE_FXSR_OPT))) { - kvm_inject_gp(vcpu, 0); - return; - } + if (!feat || !(feat->edx & bit(X86_FEATURE_FXSR_OPT))) + return 1; } if (efer & EFER_SVME) { struct kvm_cpuid_entry2 *feat; feat = kvm_find_cpuid_entry(vcpu, 0x80000001, 0); - if (!feat || !(feat->ecx & bit(X86_FEATURE_SVM))) { - kvm_inject_gp(vcpu, 0); - return; - } + if (!feat || !(feat->ecx & bit(X86_FEATURE_SVM))) + return 1; } efer &= ~EFER_LMA; @@ -666,6 +658,8 @@ static void set_efer(struct kvm_vcpu *vc vcpu->arch.mmu.base_role.nxe = (efer & EFER_NX) && !tdp_enabled; kvm_mmu_reset_context(vcpu); + + return 0; } void kvm_enable_efer_bits(u64 mask) @@ -1094,8 +1088,7 @@ int kvm_set_msr_common(struct kvm_vcpu * { switch (msr) { case MSR_EFER: - set_efer(vcpu, data); - break; + return set_efer(vcpu, data); case MSR_K7_HWCR: data &= ~(u64)0x40; /* ignore flush filter disable */ if (data != 0) { ^ permalink raw reply [flat|nested] 666+ messages in thread
* [198/200] KVM: SVM: Dont allow nested guest to VMMCALL into host 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (195 preceding siblings ...) 2010-07-01 17:44 ` [197/200] KVM: x86: Inject #GP with the right rip on efer writes Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [199/200] drm/i915: Dont touch PORT_HOTPLUG_EN in intel_dp_detect() Greg KH ` (2 subsequent siblings) 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Joerg Roedel, Avi Kivity 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joerg Roedel <joerg.roedel@amd.com> This patch disables the possibility for a l2-guest to do a VMMCALL directly into the host. This would happen if the l1-hypervisor doesn't intercept VMMCALL and the l2-guest executes this instruction. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> (Cherry-picked from commit 0d945bd9351199744c1e89d57a70615b6ee9f394) --- arch/x86/kvm/svm.c | 3 +++ 1 file changed, 3 insertions(+) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1854,6 +1854,9 @@ static bool nested_svm_vmrun(struct vcpu svm->vmcb->control.intercept_cr_write &= ~INTERCEPT_CR8_MASK; } + /* We don't want to see VMMCALLs from a nested guest */ + svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_VMMCALL); + /* We don't want a nested guest to be more powerful than the guest, so all intercepts are ORed */ svm->vmcb->control.intercept_cr_read |= ^ permalink raw reply [flat|nested] 666+ messages in thread
* [199/200] drm/i915: Dont touch PORT_HOTPLUG_EN in intel_dp_detect() 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (196 preceding siblings ...) 2010-07-01 17:44 ` [198/200] KVM: SVM: Dont allow nested guest to VMMCALL into host Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 17:44 ` [200/200] parisc: clear floating point exception flag on SIGFPE signal Greg KH 2010-07-01 21:40 ` [000/200] 2.6.34.1 stable review Rafael J. Wysocki 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Karsten Wiese, Eric Anholt 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Karsten Wiese <fzuuzf@googlemail.com> commit 6e0032f0ae4440e75256bee11b163552cae21962 upstream. PORT_HOTPLUG_EN has allready been setup in i915_driver_irq_postinstall(), when intel_dp_detect() runs. Delete the DP[BCD]_HOTPLUG_INT_EN defines, they are not referenced anymore. I found this while searching for a fix for https://bugzilla.redhat.com/show_bug.cgi?id=528312 Signed-off-by: Karsten Wiese <fzu@wemgehoertderstaat.de> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/gpu/drm/i915/intel_dp.c | 10 ---------- 1 file changed, 10 deletions(-) --- a/drivers/gpu/drm/i915/intel_dp.c +++ b/drivers/gpu/drm/i915/intel_dp.c @@ -1180,16 +1180,6 @@ intel_dp_detect(struct drm_connector *co if (HAS_PCH_SPLIT(dev)) return ironlake_dp_detect(connector); - temp = I915_READ(PORT_HOTPLUG_EN); - - I915_WRITE(PORT_HOTPLUG_EN, - temp | - DPB_HOTPLUG_INT_EN | - DPC_HOTPLUG_INT_EN | - DPD_HOTPLUG_INT_EN); - - POSTING_READ(PORT_HOTPLUG_EN); - switch (dp_priv->output_reg) { case DP_B: bit = DPB_HOTPLUG_INT_STATUS; ^ permalink raw reply [flat|nested] 666+ messages in thread
* [200/200] parisc: clear floating point exception flag on SIGFPE signal 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (197 preceding siblings ...) 2010-07-01 17:44 ` [199/200] drm/i915: Dont touch PORT_HOTPLUG_EN in intel_dp_detect() Greg KH @ 2010-07-01 17:44 ` Greg KH 2010-07-01 21:40 ` [000/200] 2.6.34.1 stable review Rafael J. Wysocki 199 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 17:44 UTC (permalink / raw) To: linux-kernel, stable Cc: stable-review, torvalds, akpm, alan, Helge Deller, Kyle McMartin 2.6.34-stable review patch. If anyone has any objections, please let me know. ------------------ From: Helge Deller <deller@gmx.de> commit 550f0d922286556c7ea43974bb7921effb5a5278 upstream. Clear the floating point exception flag before returning to user space. This is needed, else the libc trampoline handler may hit the same SIGFPE again while building up a trampoline to a signal handler. Fixes debian bug #559406. Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Kyle McMartin <kyle@mcmartin.ca> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- arch/parisc/math-emu/decode_exc.c | 1 + 1 file changed, 1 insertion(+) --- a/arch/parisc/math-emu/decode_exc.c +++ b/arch/parisc/math-emu/decode_exc.c @@ -342,6 +342,7 @@ decode_fpu(unsigned int Fpu_register[], return SIGNALCODE(SIGFPE, FPE_FLTINV); case DIVISIONBYZEROEXCEPTION: update_trap_counts(Fpu_register, aflags, bflags, trap_counts); + Clear_excp_register(exception_index); return SIGNALCODE(SIGFPE, FPE_FLTDIV); case INEXACTEXCEPTION: update_trap_counts(Fpu_register, aflags, bflags, trap_counts); ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [000/200] 2.6.34.1 stable review 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH ` (198 preceding siblings ...) 2010-07-01 17:44 ` [200/200] parisc: clear floating point exception flag on SIGFPE signal Greg KH @ 2010-07-01 21:40 ` Rafael J. Wysocki 2010-07-01 22:09 ` Greg KH 199 siblings, 1 reply; 666+ messages in thread From: Rafael J. Wysocki @ 2010-07-01 21:40 UTC (permalink / raw) To: Greg KH; +Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan On Thursday, July 01, 2010, Greg KH wrote: > This is the start of the stable review cycle for the 2.6.34.1 release. > There are 200 patches in this series, all will be posted as a response > to this one. If anyone has any issues with these being applied, please > let me know. If anyone is a maintainer of the proper subsystem, and > wants to add a Signed-off-by: line to the patch, please respond with it. > > Responses should be made by Sat, July 3, 17:00:00 UTC UTC. > Anything received after that time might be too late. It looks like the requests I sent earlier this week have not been taken into account. Was it too late already or didn't you get them? Rafael ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [000/200] 2.6.34.1 stable review 2010-07-01 21:40 ` [000/200] 2.6.34.1 stable review Rafael J. Wysocki @ 2010-07-01 22:09 ` Greg KH 2010-07-01 22:17 ` Rafael J. Wysocki 0 siblings, 1 reply; 666+ messages in thread From: Greg KH @ 2010-07-01 22:09 UTC (permalink / raw) To: Rafael J. Wysocki Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan On Thu, Jul 01, 2010 at 11:40:10PM +0200, Rafael J. Wysocki wrote: > On Thursday, July 01, 2010, Greg KH wrote: > > This is the start of the stable review cycle for the 2.6.34.1 release. > > There are 200 patches in this series, all will be posted as a response > > to this one. If anyone has any issues with these being applied, please > > let me know. If anyone is a maintainer of the proper subsystem, and > > wants to add a Signed-off-by: line to the patch, please respond with it. > > > > Responses should be made by Sat, July 3, 17:00:00 UTC UTC. > > Anything received after that time might be too late. > > It looks like the requests I sent earlier this week have not been taken into > account. Was it too late already or didn't you get them? You missed the email above this where I explained why not everything people have sent in is in this release: http://thread.gmane.org/gmane.linux.kernel/1005055 Don't worry, it's in my to-apply queue and is not lost. thanks, greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [000/200] 2.6.34.1 stable review 2010-07-01 22:09 ` Greg KH @ 2010-07-01 22:17 ` Rafael J. Wysocki 0 siblings, 0 replies; 666+ messages in thread From: Rafael J. Wysocki @ 2010-07-01 22:17 UTC (permalink / raw) To: Greg KH; +Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan On Friday, July 02, 2010, Greg KH wrote: > On Thu, Jul 01, 2010 at 11:40:10PM +0200, Rafael J. Wysocki wrote: > > On Thursday, July 01, 2010, Greg KH wrote: > > > This is the start of the stable review cycle for the 2.6.34.1 release. > > > There are 200 patches in this series, all will be posted as a response > > > to this one. If anyone has any issues with these being applied, please > > > let me know. If anyone is a maintainer of the proper subsystem, and > > > wants to add a Signed-off-by: line to the patch, please respond with it. > > > > > > Responses should be made by Sat, July 3, 17:00:00 UTC UTC. > > > Anything received after that time might be too late. > > > > It looks like the requests I sent earlier this week have not been taken into > > account. Was it too late already or didn't you get them? > > You missed the email above this where I explained why not everything > people have sent in is in this release: > http://thread.gmane.org/gmane.linux.kernel/1005055 Well, yes, I did. > Don't worry, it's in my to-apply queue and is not lost. OK, thanks! Rafael ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: 4 -stable kernel review cycles starting 2010-07-01 17:51 4 -stable kernel review cycles starting Greg KH ` (3 preceding siblings ...) 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH @ 2010-07-01 21:55 ` Florian Fainelli 2010-07-01 22:10 ` Greg KH 4 siblings, 1 reply; 666+ messages in thread From: Florian Fainelli @ 2010-07-01 21:55 UTC (permalink / raw) To: Greg KH; +Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan Hi, Le Thursday 1 July 2010 19:51:00, Greg KH a écrit : > First off, sorry for the long delay in the -stable kernel releases, they > got pushed to the back-burner for other things recently ("Hey look, is > that the sun finally here in the Pacific Northwest?") > > Please note that there are still a large number of patches that have > been submitted to the -stable trees for inclusion, that I have not > included yet. Do not worry, they are still in my queue, but due to the > large number of patches that I already have queued up, I figured it was > better to get what I have applied already out for a release and then > work on catching up after this. > > If anyone has any questions about this, please let me know. Looks like this cpmac patch was not included in this -stable series: http://www.spinics.net/lists/netdev/msg133317.html Can you queue it for future -stable releases or this one? Thank you. -- Florian ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: 4 -stable kernel review cycles starting 2010-07-01 21:55 ` 4 -stable kernel review cycles starting Florian Fainelli @ 2010-07-01 22:10 ` Greg KH 2010-07-01 22:36 ` Randy Dunlap 0 siblings, 1 reply; 666+ messages in thread From: Greg KH @ 2010-07-01 22:10 UTC (permalink / raw) To: Florian Fainelli Cc: linux-kernel, stable, stable-review, torvalds, akpm, alan On Thu, Jul 01, 2010 at 11:55:02PM +0200, Florian Fainelli wrote: > Hi, > > Le Thursday 1 July 2010 19:51:00, Greg KH a écrit : > > First off, sorry for the long delay in the -stable kernel releases, they > > got pushed to the back-burner for other things recently ("Hey look, is > > that the sun finally here in the Pacific Northwest?") > > > > Please note that there are still a large number of patches that have > > been submitted to the -stable trees for inclusion, that I have not > > included yet. Do not worry, they are still in my queue, but due to the > > large number of patches that I already have queued up, I figured it was > > better to get what I have applied already out for a release and then > > work on catching up after this. > > > > If anyone has any questions about this, please let me know. > > Looks like this cpmac patch was not included in this -stable series: > http://www.spinics.net/lists/netdev/msg133317.html > > Can you queue it for future -stable releases or this one? {sigh} Did you see the second paragraph above as to why it isn't in this release? And yes, it will be in future ones. thanks, greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: 4 -stable kernel review cycles starting 2010-07-01 22:10 ` Greg KH @ 2010-07-01 22:36 ` Randy Dunlap 2010-07-01 22:51 ` Greg KH 0 siblings, 1 reply; 666+ messages in thread From: Randy Dunlap @ 2010-07-01 22:36 UTC (permalink / raw) To: Greg KH Cc: Florian Fainelli, linux-kernel, stable, stable-review, torvalds, akpm, alan On Thu, 1 Jul 2010 15:10:59 -0700 Greg KH wrote: > On Thu, Jul 01, 2010 at 11:55:02PM +0200, Florian Fainelli wrote: > > Hi, > > > > Le Thursday 1 July 2010 19:51:00, Greg KH a écrit : > > > First off, sorry for the long delay in the -stable kernel releases, they > > > got pushed to the back-burner for other things recently ("Hey look, is > > > that the sun finally here in the Pacific Northwest?") > > > > > > Please note that there are still a large number of patches that have > > > been submitted to the -stable trees for inclusion, that I have not > > > included yet. Do not worry, they are still in my queue, but due to the > > > large number of patches that I already have queued up, I figured it was > > > better to get what I have applied already out for a release and then > > > work on catching up after this. > > > > > > If anyone has any questions about this, please let me know. > > > > Looks like this cpmac patch was not included in this -stable series: > > http://www.spinics.net/lists/netdev/msg133317.html > > > > Can you queue it for future -stable releases or this one? > > {sigh} > > Did you see the second paragraph above as to why it isn't in this > release? I did. :) and I saw the third paragraph above. ["If anyone has any questions about this, please let me know."] > And yes, it will be in future ones. Unfortunately, I don't find it feasible to review several hundred patches in the next 3 days. I think that I understand how your stable & staging cycles (workloads) work, but I also think that it would help if you wouldn't batch all stable reviews together like this. --- ~Randy *** Remember to use Documentation/SubmitChecklist when testing your code *** ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: 4 -stable kernel review cycles starting 2010-07-01 22:36 ` Randy Dunlap @ 2010-07-01 22:51 ` Greg KH 2010-07-01 23:09 ` Randy Dunlap 0 siblings, 1 reply; 666+ messages in thread From: Greg KH @ 2010-07-01 22:51 UTC (permalink / raw) To: Randy Dunlap Cc: Florian Fainelli, linux-kernel, stable, stable-review, torvalds, akpm, alan On Thu, Jul 01, 2010 at 03:36:00PM -0700, Randy Dunlap wrote: > On Thu, 1 Jul 2010 15:10:59 -0700 Greg KH wrote: > > > On Thu, Jul 01, 2010 at 11:55:02PM +0200, Florian Fainelli wrote: > > > Hi, > > > > > > Le Thursday 1 July 2010 19:51:00, Greg KH a écrit : > > > > First off, sorry for the long delay in the -stable kernel releases, they > > > > got pushed to the back-burner for other things recently ("Hey look, is > > > > that the sun finally here in the Pacific Northwest?") > > > > > > > > Please note that there are still a large number of patches that have > > > > been submitted to the -stable trees for inclusion, that I have not > > > > included yet. Do not worry, they are still in my queue, but due to the > > > > large number of patches that I already have queued up, I figured it was > > > > better to get what I have applied already out for a release and then > > > > work on catching up after this. > > > > > > > > If anyone has any questions about this, please let me know. > > > > > > Looks like this cpmac patch was not included in this -stable series: > > > http://www.spinics.net/lists/netdev/msg133317.html > > > > > > Can you queue it for future -stable releases or this one? > > > > {sigh} > > > > Did you see the second paragraph above as to why it isn't in this > > release? > > I did. :) > and I saw the third paragraph above. > ["If anyone has any questions about this, please let me know."] Well, if the question could be answered by reading the second paragraph... :) > > And yes, it will be in future ones. > > Unfortunately, I don't find it feasible to review several hundred patches > in the next 3 days. I think that I understand how your stable & staging > cycles (workloads) work, but I also think that it would help if you > wouldn't batch all stable reviews together like this. If you look closely, almost all of the patches in all of the trees are in other trees, so the number of unique patches is much less than the whole total of all of the different patches in 4 trees. If you don't like this type of review cycle, what would you prefer? thanks, greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: 4 -stable kernel review cycles starting 2010-07-01 22:51 ` Greg KH @ 2010-07-01 23:09 ` Randy Dunlap 2010-07-01 23:17 ` [stable] " Greg KH 0 siblings, 1 reply; 666+ messages in thread From: Randy Dunlap @ 2010-07-01 23:09 UTC (permalink / raw) To: Greg KH Cc: Florian Fainelli, linux-kernel, stable, stable-review, torvalds, akpm, alan On Thu, 1 Jul 2010 15:51:29 -0700 Greg KH wrote: > On Thu, Jul 01, 2010 at 03:36:00PM -0700, Randy Dunlap wrote: > > On Thu, 1 Jul 2010 15:10:59 -0700 Greg KH wrote: > > > > > On Thu, Jul 01, 2010 at 11:55:02PM +0200, Florian Fainelli wrote: > > > > Hi, > > > > > > > > Le Thursday 1 July 2010 19:51:00, Greg KH a écrit : > > > > > First off, sorry for the long delay in the -stable kernel releases, they > > > > > got pushed to the back-burner for other things recently ("Hey look, is > > > > > that the sun finally here in the Pacific Northwest?") > > > > > > > > > > Please note that there are still a large number of patches that have > > > > > been submitted to the -stable trees for inclusion, that I have not > > > > > included yet. Do not worry, they are still in my queue, but due to the > > > > > large number of patches that I already have queued up, I figured it was > > > > > better to get what I have applied already out for a release and then > > > > > work on catching up after this. > > > > > > > > > > If anyone has any questions about this, please let me know. > > > > > > > > Looks like this cpmac patch was not included in this -stable series: > > > > http://www.spinics.net/lists/netdev/msg133317.html > > > > > > > > Can you queue it for future -stable releases or this one? > > > > > > {sigh} > > > > > > Did you see the second paragraph above as to why it isn't in this > > > release? > > > > I did. :) > > and I saw the third paragraph above. > > ["If anyone has any questions about this, please let me know."] > > Well, if the question could be answered by reading the second > paragraph... :) > > > > And yes, it will be in future ones. > > > > Unfortunately, I don't find it feasible to review several hundred patches > > in the next 3 days. I think that I understand how your stable & staging > > cycles (workloads) work, but I also think that it would help if you > > wouldn't batch all stable reviews together like this. > > If you look closely, almost all of the patches in all of the trees are > in other trees, so the number of unique patches is much less than the > whole total of all of the different patches in 4 trees. Yes, that's a good point. > If you don't like this type of review cycle, what would you prefer? I don't see a magic bullet answer here. I think that it would help somewhat for the stable maintainer(s) to have only one -stable review cycle (new posting) per day, but someone may not like that either, since it would have the effect of delaying some stable kernel releases (not to mention muck up your workload). thanks, --- ~Randy *** Remember to use Documentation/SubmitChecklist when testing your code *** ^ permalink raw reply [flat|nested] 666+ messages in thread
* Re: [stable] 4 -stable kernel review cycles starting 2010-07-01 23:09 ` Randy Dunlap @ 2010-07-01 23:17 ` Greg KH 0 siblings, 0 replies; 666+ messages in thread From: Greg KH @ 2010-07-01 23:17 UTC (permalink / raw) To: Randy Dunlap Cc: linux-kernel, Florian Fainelli, stable-review, akpm, torvalds, stable, alan On Thu, Jul 01, 2010 at 04:09:01PM -0700, Randy Dunlap wrote: > On Thu, 1 Jul 2010 15:51:29 -0700 Greg KH wrote: > > If you don't like this type of review cycle, what would you prefer? > > I don't see a magic bullet answer here. I think that it would help > somewhat for the stable maintainer(s) to have only one -stable review > cycle (new posting) per day, but someone may not like that either, > since it would have the effect of delaying some stable kernel releases > (not to mention muck up your workload). Yeah, that would mess with the workload management a lot. And I don't see the benifit of doing a different release on different days. Just because they are different kernels, the same patches are usually being applied to all of them, so they are very much alike usually. thanks, greg k-h ^ permalink raw reply [flat|nested] 666+ messages in thread
end of thread, other threads:[~2010-09-24 16:03 UTC | newest] Thread overview: 666+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2010-07-01 17:51 4 -stable kernel review cycles starting Greg KH 2010-07-01 17:51 ` [00/23] 2.6.27.48 stable review Greg KH 2010-07-01 17:26 ` [01/23] libata: disable ATAPI AN by default Greg KH 2010-07-01 17:26 ` [02/23] NFSD: dont report compiled-out versions as present Greg KH 2010-07-01 17:26 ` [03/23] ARCNET: Limit com20020 PCI ID matches for SOHARD cards Greg KH 2010-07-01 17:26 ` [04/23] powerpc: Fix handling of strncmp with zero len Greg KH 2010-07-01 17:26 ` [05/23] powerpc/pseries: Only call start-cpu when a CPU is stopped Greg KH 2010-07-02 0:02 ` Michael Neuling 2010-07-03 1:56 ` Greg KH 2010-07-03 7:55 ` Michael Neuling 2010-07-05 17:05 ` Greg KH 2010-07-01 17:26 ` [06/23] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c Greg KH 2010-07-01 17:26 ` [07/23] md/raid1: fix counting of write targets Greg KH 2010-07-01 17:26 ` [08/23] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB Greg KH 2010-07-01 17:26 ` [09/23] md: set mddev readonly flag on blkdev BLKROSET ioctl Greg KH 2010-07-01 17:26 ` [10/23] do_generic_file_read: clear page errors when issuing a fresh read of the page Greg KH 2010-07-01 17:27 ` [11/23] ipmi: handle run_to_completion properly in deliver_recv_msg() Greg KH 2010-07-01 17:27 ` [12/23] gconfig: fix build failure on fedora 13 Greg KH 2010-07-01 17:27 ` [13/23] ext4: check s_log_groups_per_flex in online resize code Greg KH 2010-07-01 17:27 ` [14/23] ext4: Use our own write_cache_pages() Greg KH 2010-07-01 17:27 ` [15/23] ext4: Fix file fragmentation during large file write Greg KH 2010-07-01 17:27 ` [16/23] ext4: Implement range_cyclic in ext4_da_writepages instead of write_cache_pages Greg KH 2010-07-01 17:27 ` [17/23] sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4) Greg KH 2010-07-01 17:27 ` [18/23] vfs: add NOFOLLOW flag to umount(2) Greg KH 2010-07-01 17:27 ` [19/23] tipc: Fix oops on send prior to entering networked mode (v3) Greg KH 2010-07-01 17:27 ` [20/23] parisc: clear floating point exception flag on SIGFPE signal Greg KH 2010-07-01 17:27 ` [21/23] KEYS: Return more accurate error codes Greg KH 2010-07-01 17:27 ` [22/23] KEYS: find_keyring_by_name() can gain access to a freed keyring Greg KH 2010-07-01 17:27 ` [23/23] sctp: fix append error cause to ERROR chunk correctly Greg KH 2010-07-01 17:51 ` [patch 000/149] 2.6.32.16 stable review Greg KH 2010-07-01 17:30 ` [patch 001/149] oprofile/x86: fix uninitialized counter usage during cpu hotplug Greg KH 2010-07-01 17:30 ` [patch 002/149] oprofile: remove double ring buffering Greg KH 2010-07-01 17:30 ` [patch 003/149] cpumask: fix compat getaffinity Greg KH 2010-07-01 17:30 ` [patch 004/149] NFSD: dont report compiled-out versions as present Greg KH 2010-07-01 17:30 ` [patch 005/149] sata_nv: use ata_pci_sff_activate_host() instead of ata_host_activate() Greg KH 2010-07-01 17:30 ` [patch 006/149] ARCNET: Limit com20020 PCI ID matches for SOHARD cards Greg KH 2010-07-01 17:30 ` [patch 007/149] rtl8180: fix tx status reporting Greg KH 2010-07-01 17:30 ` [patch 008/149] Staging: add Add Sitecom WL-349 to rtl8192su Greg KH 2010-07-01 17:30 ` [patch 009/149] staging: vt6655: Fix kernel BUG on driver wpa initialization Greg KH 2010-07-01 17:30 ` [patch 010/149] Fix racy use of anon_inode_getfd() in perf_event.c Greg KH 2010-07-01 17:30 ` [patch 011/149] posix_timer: Fix error path in timer_create Greg KH 2010-07-01 17:30 ` [patch 012/149] libata: disable ATAPI AN by default Greg KH 2010-07-01 17:30 ` [patch 013/149] libata: dont flush dcache on slab pages Greg KH 2010-07-01 17:30 ` [patch 014/149] mutex: Fix optimistic spinning vs. BKL Greg KH 2010-07-01 17:30 ` [patch 015/149] ALSA: hda: Fix model quirk for Dell M1730 Greg KH 2010-07-01 17:30 ` [patch 016/149] ALSA: hda: Use LPIB for Toshiba A100-259 Greg KH 2010-07-01 17:30 ` [patch 017/149] ALSA: hda: Use LPIB for Acer Aspire 5110 Greg KH 2010-07-01 17:30 ` [patch 018/149] ALSA: hda: Use LPIB for Sony VPCS11V9E Greg KH 2010-07-01 17:30 ` [patch 019/149] ALSA: hda: Use LPIB for a Shuttle device Greg KH 2010-07-01 17:30 ` [patch 020/149] ACPI: video: fix acpi_backlight=video Greg KH 2010-07-01 17:30 ` [patch 021/149] V4L/DVB: gspca - stv06xx: Remove the 046d:08da from the stv06xx driver Greg KH 2010-07-01 17:30 ` [patch 022/149] HID: Add the GYR4101US USB ID to hid-gyration Greg KH 2010-07-01 17:30 ` [patch 023/149] ar9170usb: add a couple more USB IDs Greg KH 2010-07-01 17:30 ` [patch 024/149] ar9170usb: fix panic triggered by undersized rxstream buffer Greg KH 2010-07-01 17:30 ` [patch 025/149] USB: visor: fix memory leak Greg KH 2010-07-01 17:30 ` [patch 026/149] USB: CP210x New Device IDs 11 New device IDs Greg KH 2010-07-01 17:30 ` [patch 027/149] USB: kobil: fix memory leak Greg KH 2010-07-01 17:30 ` [patch 028/149] USB: option: add PID for ZTE product Greg KH 2010-07-01 17:30 ` [patch 029/149] USB: option.c: Add Pirelli VID/PID and indicate Pirellis modem interface is 0xff Greg KH 2010-07-01 17:30 ` [patch 030/149] USB: serial: option: add cinterion device id Greg KH 2010-07-01 17:30 ` [patch 031/149] USB: option.c: OLIVETTI OLICARD100 support Greg KH 2010-07-01 17:30 ` [patch 032/149] USB: ir-usb: fix double free Greg KH 2010-07-01 17:30 ` [patch 033/149] USB: kl5usb105: fix memory leak Greg KH 2010-07-01 17:31 ` [patch 034/149] USB: mxc: gadget: Fix bitfield for calculating maximum packet size Greg KH 2010-07-01 17:31 ` [patch 035/149] USB: unusual-dev: Add bad sense flag for Appotech ax203 based picture frames Greg KH 2010-07-01 17:31 ` [patch 036/149] USB: EHCI: clear PHCD before resuming Greg KH 2010-07-01 17:31 ` [patch 037/149] USB: xhci: Fix issue with set interface after stall Greg KH 2010-07-01 17:31 ` [patch 038/149] USB: xhci: Fix check for room on the ring Greg KH 2010-07-01 17:31 ` [patch 039/149] USB: xHCI: Fix wrong usage of macro TRB_TYPE Greg KH 2010-07-01 17:31 ` [patch 040/149] mac80211: give warning if building w/out rate ctrl algorithm Greg KH 2010-07-01 17:31 ` [patch 041/149] mac80211: Fix robust management frame handling (MFP) Greg KH 2010-07-01 17:31 ` [patch 042/149] mac80211: fix rts threshold check Greg KH 2010-07-01 17:31 ` [patch 043/149] drm/i915: Reject bind_to_gtt() early if object > aperture Greg KH 2010-07-01 17:31 ` [patch 044/149] drivers/base/cpu.c: fix the output from /sys/devices/system/cpu/offline Greg KH 2010-07-01 17:31 ` [patch 045/149] can: Fix SJA1000 command register writes on SMP systems Greg KH 2010-07-01 17:31 ` [patch 046/149] PCI quirk: Disable MSI on VIA K8T890 systems Greg KH 2010-07-01 17:31 ` [patch 047/149] PCI quirks: disable msi on AMD rs4xx internal gfx bridges Greg KH 2010-07-01 17:31 ` [patch 048/149] PCI: Disable MSI for MCP55 on P5N32-E SLI Greg KH 2010-07-01 17:31 ` [patch 049/149] virtio_net: Make delayed refill more reliable Greg KH 2010-07-01 17:31 ` [patch 050/149] mm: hugetlb: fix clear_huge_page() Greg KH 2010-07-01 17:31 ` [patch 051/149] drm/edid: Fix 1024x768@85Hz Greg KH 2010-07-01 17:31 ` [patch 052/149] drm/radeon/kms/atom: fix typo in LVDS panel info parsing Greg KH 2010-07-01 17:31 ` [patch 053/149] powerpc: Fix handling of strncmp with zero len Greg KH 2010-07-01 17:31 ` [patch 054/149] powerpc/pseries: Only call start-cpu when a CPU is stopped Greg KH 2010-07-02 0:03 ` Michael Neuling 2010-07-03 1:57 ` Greg KH 2010-07-03 7:54 ` Michael Neuling 2010-07-05 17:03 ` Greg KH 2010-07-01 17:31 ` [patch 055/149] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c Greg KH 2010-07-01 17:31 ` [patch 056/149] writeback: disable periodic old data writeback for !dirty_writeback_centisecs Greg KH 2010-07-01 17:31 ` [patch 057/149] md/raid1: fix counting of write targets Greg KH 2010-07-01 17:31 ` [patch 058/149] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB Greg KH 2010-07-01 17:31 ` [patch 059/149] md: set mddev readonly flag on blkdev BLKROSET ioctl Greg KH 2010-07-01 17:31 ` [patch 060/149] x86/amd-iommu: Fix suspend/resume with IOMMU Greg KH 2010-07-01 17:31 ` [patch 061/149] exofs: confusion between kmap() and kmap_atomic() api Greg KH 2010-07-01 17:31 ` [patch 062/149] mn10300: set ARCH_KMALLOC_MINALIGN Greg KH 2010-07-01 17:31 ` [patch 063/149] m68k: " Greg KH 2010-07-01 17:31 ` [patch 064/149] rtc-cmos: do dev_set_drvdata() earlier in the initialization Greg KH 2010-07-01 17:31 ` [patch 065/149] rtc: s3c: initialize driver data before using it Greg KH 2010-07-01 17:31 ` [patch 066/149] frv: set ARCH_KMALLOC_MINALIGN Greg KH 2010-07-01 17:31 ` [patch 067/149] xtensa: " Greg KH 2010-07-01 17:31 ` [patch 068/149] Blackfin: " Greg KH 2010-07-01 17:31 ` [patch 069/149] tmpfs: insert tmpfs cache pages to inactive list at first Greg KH 2010-07-01 17:31 ` [patch 070/149] mlx4_core: Fix possible chunk sg list overflow in mlx4_alloc_icm() Greg KH 2010-07-01 17:31 ` [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 Greg KH 2010-07-01 22:14 ` Kirill A. Shutemov 2010-07-01 22:17 ` Greg KH 2010-07-01 22:25 ` Kirill A. Shutemov 2010-07-01 22:48 ` Russell King 2010-07-01 22:59 ` Kirill A. Shutemov 2010-07-01 23:12 ` Russell King 2010-07-02 6:29 ` Kirill A. Shutemov 2010-07-06 13:06 ` Kirill A. Shutemov 2010-07-06 22:58 ` Russell King 2010-07-07 8:56 ` Kirill A. Shutemov 2010-07-07 8:56 ` Kirill A. Shutemov 2010-07-07 8:56 ` Kirill A. Shutemov 2010-07-07 22:34 ` Russell King - ARM Linux 2010-07-07 22:34 ` Russell King - ARM Linux 2010-07-07 22:34 ` Russell King - ARM Linux 2010-07-08 11:31 ` Kirill A. Shutemov 2010-07-08 11:31 ` Kirill A. Shutemov 2010-07-08 11:31 ` Kirill A. Shutemov 2010-07-12 22:08 ` Kirill A. Shutemov 2010-07-12 22:08 ` Kirill A. Shutemov 2010-07-12 22:08 ` Kirill A. Shutemov 2010-07-01 17:31 ` [patch 072/149] ARM: 6164/1: Add kto and kfrom to input operands list Greg KH 2010-07-01 17:31 ` [patch 073/149] ARM: 6146/1: sa1111: Prevent deadlock in resume path Greg KH 2010-07-01 17:31 ` [patch 074/149] ARM: 6144/1: TCM memory bug freeing bug Greg KH 2010-07-01 17:31 ` [patch 075/149] ARM: VFP: Fix vfp_put_double() for d16-d31 Greg KH 2010-07-01 17:31 ` [patch 076/149] ASoC: Fix dB scales for WM835x Greg KH 2010-07-01 17:31 ` [patch 077/149] ASoC: Fix dB scales for WM8400 Greg KH 2010-07-01 17:31 ` [patch 078/149] ASoC: Fix dB scales for WM8990 Greg KH 2010-07-01 17:31 ` [patch 079/149] drm/radeon: r100/r200 ums: block ability for userspace app to trash 0 page and beyond Greg KH 2010-07-01 17:31 ` [patch 080/149] drm/radeon: fix the r100/r200 ums block 0 page fix Greg KH 2010-07-01 17:31 ` [patch 081/149] hwmon: (ltc4245) Read only one GPIO pin Greg KH 2010-07-01 17:31 ` [patch 082/149] signals: check_kill_permission(): dont check creds if same_thread_group() Greg KH 2010-07-01 17:31 ` [patch 083/149] do_generic_file_read: clear page errors when issuing a fresh read of the page Greg KH 2010-07-01 17:31 ` [patch 084/149] ipmi: handle run_to_completion properly in deliver_recv_msg() Greg KH 2010-07-01 17:31 ` [patch 085/149] x86, setup: Phoenix BIOS fixup is needed on Dell Inspiron Mini 1012 Greg KH 2010-07-01 17:31 ` [patch 086/149] xen: ensure timer tick is resumed even on CPU driving the resume Greg KH 2010-07-01 17:31 ` [patch 087/149] xen: avoid allocation causing potential swap activity on the resume path Greg KH 2010-07-01 17:31 ` [patch 088/149] ALSA: hda: Use LPIB for an ASUS device Greg KH 2010-07-01 17:31 ` [patch 089/149] ALSA: hda: Use mb31 quirk for an iMac model Greg KH 2010-07-01 17:31 ` [patch 090/149] ALSA: hda: Use LPIB for another mainboard Greg KH 2010-07-01 17:31 ` [patch 091/149] ALSA: hda: Use LPIB for ASUS M2V Greg KH 2010-07-01 17:31 ` [patch 092/149] Staging: comedi - correct parameter gainlkup for DAQCard-6024E in driver ni_mio_cs.c Greg KH 2010-07-01 17:31 ` [patch 093/149] clocksource: sh_cmt: compute mult and shift before registration Greg KH 2010-07-01 17:32 ` [patch 094/149] ath5k: retain promiscuous setting Greg KH 2010-07-01 17:32 ` [patch 095/149] ahci: add pci quirk for JMB362 Greg KH 2010-07-01 17:32 ` [patch 096/149] firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder Greg KH 2010-07-01 17:32 ` [patch 097/149] perf_events: Fix resource leak in x86 __hw_perf_event_init() Greg KH 2010-07-01 17:32 ` [patch 098/149] sata_nv: dont diddle with nIEN on mcp55 Greg KH 2010-07-01 17:32 ` [patch 099/149] sata_via: magic vt6421 fix for transmission problems w/ WD drives Greg KH 2010-07-01 17:32 ` [patch 100/149] drm/i915: Rebind bo if currently bound with incorrect alignment Greg KH 2010-07-01 17:32 ` [patch 101/149] USB: mos7840: fix null-pointer dereference Greg KH 2010-07-01 17:32 ` [patch 102/149] USB: xhci: Wait for host to start running Greg KH 2010-07-01 17:32 ` [patch 103/149] USB: xhci: Wait for controller to be ready after reset Greg KH 2010-07-01 17:32 ` [patch 104/149] USB: ftdi_sio: fix DTR/RTS line modes Greg KH 2010-07-01 17:32 ` [patch 105/149] USB: cdc-acm: fix resource reclaim in error path of acm_probe Greg KH 2010-07-01 17:32 ` [patch 106/149] p54usb: Add device ID for Dell WLA3310 USB Greg KH 2010-07-01 17:32 ` [patch 107/149] atl1e: Allow TX checksum offload and TSO to be disabled and reenabled Greg KH 2010-07-01 17:32 ` [patch 108/149] via-velocity: Give RX descriptors to the NIC later on open or MTU change Greg KH 2010-07-01 17:32 ` [patch 109/149] dmfe/tulip: Let dmfe handle DM910x except for SPARC on-board chips Greg KH 2010-07-01 17:32 ` [patch 110/149] Documentation/3c509: document ethtool support Greg KH 2010-07-01 17:32 ` [patch 111/149] wireless: report reasonable bitrate for MCS rates through wext Greg KH 2010-07-01 17:32 ` [patch 112/149] ath9k: add support for 802.11n bonded out AR2427 Greg KH 2010-07-01 17:32 ` [patch 113/149] drm/i915: give up on 8xx lid status Greg KH 2010-07-01 17:32 ` [patch 114/149] wrong type for magic argument in simple_fill_super() Greg KH 2010-07-01 17:32 ` [patch 115/149] iwlwifi: check for aggregation frame and queue Greg KH 2010-07-01 17:32 ` [patch 116/149] iwlwifi: recalculate average tpt if not current Greg KH 2010-07-01 17:32 ` [patch 117/149] iwlwifi: update supported PCI_ID list for 5xx0 series Greg KH 2010-07-01 17:32 ` [patch 118/149] wl1251: fix a memory leak in probe Greg KH 2010-07-01 17:32 ` [patch 119/149] ext4: check s_log_groups_per_flex in online resize code Greg KH 2010-07-02 4:11 ` tytso 2010-07-03 1:55 ` Greg KH 2010-07-01 17:32 ` [patch 120/149] ext4: Make sure the MOVE_EXT ioctl cant overwrite append-only files Greg KH 2010-07-01 17:32 ` [patch 121/149] GFS2: Fix permissions checking for setflags ioctl() Greg KH 2010-07-01 17:32 ` [patch 122/149] sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4) Greg KH 2010-07-01 17:32 ` [patch 123/149] CIFS: Allow null nd (as nfs server uses) on create Greg KH 2010-07-01 17:32 ` [patch 124/149] vfs: add NOFOLLOW flag to umount(2) Greg KH 2010-07-01 17:32 ` [patch 125/149] l2tp: Fix oops in pppol2tp_xmit Greg KH 2010-07-01 17:32 ` [patch 126/149] Btrfs: should add a permission check for setfacl Greg KH 2010-07-01 17:32 ` [patch 127/149] ucc_geth: Fix empty TX queue processing Greg KH 2010-07-01 17:32 ` [patch 128/149] ucc_geth: Fix netdev watchdog triggering on link changes Greg KH 2010-07-01 17:32 ` [patch 129/149] ucc_geth: Fix full TX queue processing Greg KH 2010-07-01 17:32 ` [patch 130/149] tipc: Fix oops on send prior to entering networked mode (v3) Greg KH 2010-07-01 17:32 ` [patch 131/149] Input: psmouse - reset all types of mice before reconnecting Greg KH 2010-07-01 17:32 ` [patch 132/149] KVM: s390: Fix possible memory leak of in kvm_arch_vcpu_create() Greg KH 2010-07-01 17:32 ` [patch 133/149] KVM: PPC: Do not create debugfs if fail to create vcpu Greg KH 2010-07-01 17:32 ` [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock Greg KH 2010-07-07 12:47 ` Peter Palfrader 2010-07-07 13:51 ` Glauber Costa 2010-07-07 14:33 ` Peter Palfrader 2010-07-07 15:15 ` Gleb Natapov 2010-07-07 20:05 ` Peter Palfrader 2010-07-08 5:31 ` Gleb Natapov 2010-07-08 8:51 ` Peter Palfrader 2010-07-08 11:03 ` Gleb Natapov 2010-07-07 18:15 ` Glauber Costa 2010-07-07 20:11 ` Zachary Amsden 2010-07-07 21:08 ` Glauber Costa 2010-07-08 9:41 ` Avi Kivity 2010-07-13 10:23 ` Peter Palfrader 2010-07-13 13:23 ` Avi Kivity 2010-07-13 14:19 ` Peter Palfrader 2010-07-13 15:57 ` Avi Kivity 2010-07-13 16:22 ` Peter Palfrader 2010-07-13 16:34 ` Avi Kivity 2010-07-13 16:40 ` Avi Kivity 2010-07-13 16:45 ` Avi Kivity 2010-07-13 17:25 ` Peter Palfrader 2010-07-13 17:50 ` Linus Torvalds 2010-07-13 17:59 ` Linus Torvalds 2010-07-13 18:21 ` Jeremy Fitzhardinge 2010-07-13 22:14 ` H. Peter Anvin 2010-07-13 23:49 ` Jeremy Fitzhardinge 2010-07-14 0:15 ` Linus Torvalds 2010-07-14 17:19 ` Jeremy Fitzhardinge 2010-07-14 17:30 ` H. Peter Anvin 2010-07-14 17:34 ` Jeremy Fitzhardinge 2010-07-14 17:45 ` H. Peter Anvin 2010-07-14 17:57 ` Jeremy Fitzhardinge 2010-07-14 18:08 ` H. Peter Anvin 2010-07-14 18:15 ` Jeremy Fitzhardinge 2010-07-14 18:19 ` H. Peter Anvin 2010-07-14 20:58 ` Jeremy Fitzhardinge 2010-07-14 18:23 ` Linus Torvalds 2010-07-14 18:18 ` H.J. Lu 2010-07-14 19:00 ` H. Peter Anvin 2010-07-14 19:32 ` H.J. Lu 2010-07-14 19:36 ` H. Peter Anvin 2010-07-14 19:40 ` H.J. Lu 2010-07-14 21:11 ` Jeremy Fitzhardinge 2010-07-14 19:58 ` H. Peter Anvin 2010-07-14 20:33 ` H. Peter Anvin 2010-07-14 20:16 ` Avi Kivity 2010-07-14 20:40 ` Jeremy Fitzhardinge 2010-07-14 20:45 ` Zachary Amsden 2010-07-14 20:54 ` Zachary Amsden 2010-07-14 21:11 ` Jeremy Fitzhardinge 2010-07-16 4:48 ` H. Peter Anvin 2010-07-14 20:50 ` H. Peter Anvin 2010-07-14 21:11 ` Jeremy Fitzhardinge 2010-07-13 18:23 ` Peter Palfrader 2010-07-13 16:53 ` Peter Palfrader 2010-07-13 16:34 ` Linus Torvalds 2010-07-13 18:04 ` Avi Kivity 2010-07-13 18:15 ` Linus Torvalds 2010-07-27 17:46 ` Jeremy Fitzhardinge 2010-07-27 17:52 ` H. Peter Anvin 2010-07-27 23:57 ` xchg() and cmpxchg() H. Peter Anvin 2010-07-28 5:33 ` [tip:x86/urgent] x86: Add memory modify constraints to " tip-bot for H. Peter Anvin 2010-07-28 15:45 ` Linus Torvalds 2010-07-28 15:59 ` H. Peter Anvin 2010-07-28 23:00 ` H. Peter Anvin 2010-07-28 23:28 ` [tip:x86/asm] x86, asm: Clean up and simplify <asm/cmpxchg.h> tip-bot for H. Peter Anvin 2010-07-29 20:12 ` [tip:x86/asm] x86, asm: Move cmpxchg emulation code to arch/x86/lib tip-bot for H. Peter Anvin 2010-07-29 20:13 ` [tip:x86/asm] x86, asm: Merge cmpxchg_486_u64() and cmpxchg8b_emu() tip-bot for H. Peter Anvin 2010-08-02 23:51 ` [tip:x86/urgent] x86: Add memory modify constraints to xchg() and cmpxchg() Jeremy Fitzhardinge 2010-08-02 23:59 ` [stable] " Greg KH 2010-09-09 19:53 ` Tomáš Janoušek 2010-09-09 21:00 ` H. Peter Anvin 2010-09-09 21:09 ` Tomáš Janoušek 2010-09-09 21:15 ` H. Peter Anvin 2010-09-10 13:10 ` Tomáš Janoušek 2010-09-23 18:37 ` Greg KH 2010-09-24 7:17 ` Tomáš Janoušek 2010-09-24 15:52 ` Greg KH 2010-08-03 12:43 ` Peter Palfrader 2010-08-10 22:33 ` Greg KH 2010-07-13 18:25 ` [patch 134/149] x86, paravirt: Add a global synchronization point for pvclock Peter Palfrader 2010-07-13 23:53 ` [Stable-review] " Ben Hutchings 2010-07-01 17:32 ` [patch 135/149] KVM: Dont allow lmsw to clear cr0.pe Greg KH 2010-07-01 17:32 ` [patch 136/149] KVM: x86: Check LMA bit before set_efer Greg KH 2010-07-01 17:32 ` [patch 137/149] KVM: MMU: Segregate shadow pages with different cr0.wp Greg KH 2010-07-01 17:32 ` [patch 138/149] KVM: VMX: enable VMXON check with SMX enabled (Intel TXT) Greg KH 2010-07-01 17:32 ` [patch 139/149] KVM: MMU: Dont read pdptrs with mmu spinlock held in mmu_alloc_roots Greg KH 2010-07-01 17:32 ` [patch 140/149] KVM: Fix wallclock version writing race Greg KH 2010-07-01 17:32 ` [patch 141/149] KVM: x86: Add missing locking to arch specific vcpu ioctls Greg KH 2010-07-01 17:32 ` [patch 142/149] KVM: x86: Inject #GP with the right rip on efer writes Greg KH 2010-07-01 17:32 ` [patch 143/149] jbd: jbd-debug and jbd2-debug should be writable Greg KH 2010-07-01 17:32 ` [patch 144/149] parisc: clear floating point exception flag on SIGFPE signal Greg KH 2010-07-01 17:32 ` [patch 145/149] dm snapshot: simplify sector_to_chunk expression Greg KH 2010-07-01 17:32 ` [patch 146/149] KEYS: Return more accurate error codes Greg KH 2010-07-01 17:32 ` [patch 147/149] KEYS: find_keyring_by_name() can gain access to a freed keyring Greg KH 2010-07-01 17:32 ` [patch 148/149] [SCSI] qla2xxx: Disable MSI on qla24xx chips other than QLA2432 Greg KH 2010-07-01 17:32 ` [patch 149/149] sctp: fix append error cause to ERROR chunk correctly Greg KH 2010-07-01 17:51 ` [patch 000/164] 2.6.33.6 stable review Greg KH 2010-07-01 17:33 ` [patch 001/164] Fix racy use of anon_inode_getfd() in perf_event.c Greg KH 2010-07-01 17:33 ` [patch 002/164] posix_timer: Fix error path in timer_create Greg KH 2010-07-01 17:33 ` [patch 003/164] libata: disable ATAPI AN by default Greg KH 2010-07-01 17:33 ` [patch 004/164] libata: dont flush dcache on slab pages Greg KH 2010-07-01 17:33 ` [patch 005/164] oprofile/x86: fix uninitialized counter usage during cpu hotplug Greg KH 2010-07-01 17:33 ` [patch 006/164] oprofile: remove double ring buffering Greg KH 2010-07-01 17:33 ` [patch 007/164] cpumask: fix compat getaffinity Greg KH 2010-07-01 17:33 ` [patch 008/164] NFSD: dont report compiled-out versions as present Greg KH 2010-07-01 17:33 ` [patch 009/164] sata_nv: use ata_pci_sff_activate_host() instead of ata_host_activate() Greg KH 2010-07-01 17:33 ` [patch 010/164] ARCNET: Limit com20020 PCI ID matches for SOHARD cards Greg KH 2010-07-01 17:33 ` [patch 011/164] rtl8180: fix tx status reporting Greg KH 2010-07-01 17:33 ` [patch 012/164] Staging: add Add Sitecom WL-349 to rtl8192su Greg KH 2010-07-01 17:33 ` [patch 013/164] staging: vt6655: Fix kernel BUG on driver wpa initialization Greg KH 2010-07-01 17:33 ` [patch 014/164] Staging: rt2870: add device ID of MelCo.,Inc. WLI-UC-G301N Greg KH 2010-07-01 17:33 ` [patch 015/164] mutex: Fix optimistic spinning vs. BKL Greg KH 2010-07-01 17:33 ` [patch 016/164] ALSA: hda: Fix model quirk for Dell M1730 Greg KH 2010-07-01 17:33 ` [patch 017/164] ALSA: hda: Use LPIB for Toshiba A100-259 Greg KH 2010-07-01 17:33 ` [patch 018/164] ALSA: hda: Use LPIB for Acer Aspire 5110 Greg KH 2010-07-01 17:33 ` [patch 019/164] ALSA: hda: Use LPIB for Sony VPCS11V9E Greg KH 2010-07-01 17:33 ` [patch 020/164] ALSA: hda: Use LPIB for a Shuttle device Greg KH 2010-07-01 17:33 ` [patch 021/164] ACPI: video: fix acpi_backlight=video Greg KH 2010-07-01 17:33 ` [patch 022/164] V4L/DVB: gspca - stv06xx: Remove the 046d:08da from the stv06xx driver Greg KH 2010-07-01 17:33 ` [patch 023/164] HID: Add the GYR4101US USB ID to hid-gyration Greg KH 2010-07-01 17:33 ` [patch 024/164] ar9170usb: add a couple more USB IDs Greg KH 2010-07-01 17:33 ` [patch 025/164] ar9170usb: fix panic triggered by undersized rxstream buffer Greg KH 2010-07-01 17:33 ` [patch 026/164] USB: visor: fix memory leak Greg KH 2010-07-01 17:33 ` [patch 027/164] USB: CP210x New Device IDs 11 New device IDs Greg KH 2010-07-01 17:33 ` [patch 028/164] USB: kobil: fix memory leak Greg KH 2010-07-01 17:33 ` [patch 029/164] USB: option: add PID for ZTE product Greg KH 2010-07-01 17:33 ` [patch 030/164] USB: option.c: Add Pirelli VID/PID and indicate Pirellis modem interface is 0xff Greg KH 2010-07-01 17:33 ` [patch 031/164] USB: serial: option: add cinterion device id Greg KH 2010-07-01 17:33 ` [patch 032/164] USB: option.c: OLIVETTI OLICARD100 support Greg KH 2010-07-01 17:33 ` [patch 033/164] USB: ir-usb: fix double free Greg KH 2010-07-01 17:33 ` [patch 034/164] USB: kl5usb105: fix memory leak Greg KH 2010-07-01 17:33 ` [patch 035/164] USB: mxc: gadget: Fix bitfield for calculating maximum packet size Greg KH 2010-07-01 17:33 ` [patch 036/164] USB: unusual-dev: Add bad sense flag for Appotech ax203 based picture frames Greg KH 2010-07-01 17:33 ` [patch 037/164] USB: FHCI: cq_get() should check kfifo_out()s return value Greg KH 2010-07-01 17:33 ` [patch 038/164] USB: EHCI: clear PHCD before resuming Greg KH 2010-07-01 17:33 ` [patch 039/164] USB: xhci: Fix issue with set interface after stall Greg KH 2010-07-01 17:33 ` [patch 040/164] USB: xhci: Limit bus sg_tablesize to 62 TRBs Greg KH 2010-07-01 17:33 ` [patch 041/164] USB: xhci: Fix check for room on the ring Greg KH 2010-07-01 17:33 ` [patch 042/164] USB: xHCI: Fix wrong usage of macro TRB_TYPE Greg KH 2010-07-01 17:33 ` [patch 043/164] ath5k: consistently use rx_bufsize for RX DMA Greg KH 2010-07-01 17:33 ` [patch 044/164] mac80211: give warning if building w/out rate ctrl algorithm Greg KH 2010-07-01 17:33 ` [patch 045/164] mac80211: Fix robust management frame handling (MFP) Greg KH 2010-07-01 17:33 ` [patch 046/164] mac80211: fix rts threshold check Greg KH 2010-07-01 17:33 ` [patch 047/164] mac80211: fix handling of 4-address-mode in ieee80211_change_iface Greg KH 2010-07-01 17:33 ` [patch 048/164] drm/i915: Fix 82854 PCI ID, and treat it like other 85X Greg KH 2010-07-01 17:33 ` [patch 049/164] drm/i915: Reject bind_to_gtt() early if object > aperture Greg KH 2010-07-01 17:33 ` [patch 050/164] drivers/base/cpu.c: fix the output from /sys/devices/system/cpu/offline Greg KH 2010-07-01 17:33 ` [patch 051/164] can: Fix SJA1000 command register writes on SMP systems Greg KH 2010-07-01 17:33 ` [patch 052/164] PCI quirk: Disable MSI on VIA K8T890 systems Greg KH 2010-07-01 17:33 ` [patch 053/164] PCI quirks: disable msi on AMD rs4xx internal gfx bridges Greg KH 2010-07-01 17:34 ` [patch 054/164] PCI: Disable MSI for MCP55 on P5N32-E SLI Greg KH 2010-07-01 17:34 ` [patch 055/164] drm/edid: Fix 1024x768@85Hz Greg KH 2010-07-01 17:34 ` [patch 056/164] drm/radeon/kms: reset ddc_bus in object header parsing Greg KH 2010-07-01 17:34 ` [patch 057/164] drm/radeon/kms/atom: fix typo in LVDS panel info parsing Greg KH 2010-07-01 17:34 ` [patch 058/164] powerpc: Fix handling of strncmp with zero len Greg KH 2010-07-01 17:34 ` [patch 059/164] powerpc/pseries: Only call start-cpu when a CPU is stopped Greg KH 2010-07-01 17:34 ` [patch 060/164] powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu Greg KH 2010-07-01 17:34 ` [patch 061/164] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c Greg KH 2010-07-01 17:34 ` [patch 062/164] writeback: disable periodic old data writeback for !dirty_writeback_centisecs Greg KH 2010-07-01 17:34 ` [patch 063/164] md/raid1: fix counting of write targets Greg KH 2010-07-01 17:34 ` [patch 064/164] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB Greg KH 2010-07-01 17:34 ` [patch 065/164] md/linear: avoid possible oops and array stop Greg KH 2010-07-01 17:34 ` [patch 066/164] md: remove unneeded sysfs files more promptly Greg KH 2010-07-01 17:34 ` [patch 067/164] md: set mddev readonly flag on blkdev BLKROSET ioctl Greg KH 2010-07-01 17:34 ` [patch 068/164] x86/amd-iommu: Fix crash when request_mem_region fails Greg KH 2010-07-01 17:34 ` [patch 069/164] x86/amd-iommu: Fall back to GART if initialization fails Greg KH 2010-07-01 17:34 ` [patch 070/164] exofs: confusion between kmap() and kmap_atomic() api Greg KH 2010-07-01 17:34 ` [patch 071/164] mn10300: set ARCH_KMALLOC_MINALIGN Greg KH 2010-07-01 17:34 ` [patch 072/164] m68k: " Greg KH 2010-07-01 17:34 ` [patch 073/164] rtc-cmos: do dev_set_drvdata() earlier in the initialization Greg KH 2010-07-01 17:34 ` [patch 074/164] rtc: s3c: initialize driver data before using it Greg KH 2010-07-01 17:34 ` [patch 075/164] frv: set ARCH_KMALLOC_MINALIGN Greg KH 2010-07-01 17:34 ` [patch 076/164] xtensa: " Greg KH 2010-07-01 17:34 ` [patch 077/164] Blackfin: " Greg KH 2010-07-01 17:34 ` [patch 078/164] tmpfs: insert tmpfs cache pages to inactive list at first Greg KH 2010-07-01 17:34 ` [patch 079/164] md: manage redundancy group in sysfs when changing level Greg KH 2010-07-01 17:34 ` [patch 080/164] mlx4_core: Fix possible chunk sg list overflow in mlx4_alloc_icm() Greg KH 2010-07-01 17:34 ` [patch 081/164] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 Greg KH 2010-07-01 17:34 ` [patch 082/164] ARM: 6164/1: Add kto and kfrom to input operands list Greg KH 2010-07-01 17:34 ` [patch 083/164] ARM: 6146/1: sa1111: Prevent deadlock in resume path Greg KH 2010-07-01 17:34 ` [patch 084/164] ARM: 6144/1: TCM memory bug freeing bug Greg KH 2010-07-01 17:34 ` [patch 085/164] ARM: VFP: Fix vfp_put_double() for d16-d31 Greg KH 2010-07-01 17:34 ` [patch 086/164] ASoC: Fix dB scales for WM835x Greg KH 2010-07-01 17:34 ` [patch 087/164] ASoC: Fix dB scales for WM8400 Greg KH 2010-07-01 17:34 ` [patch 088/164] ASoC: Fix dB scales for WM8990 Greg KH 2010-07-01 17:34 ` [patch 089/164] drm/radeon: r100/r200 ums: block ability for userspace app to trash 0 page and beyond Greg KH 2010-07-01 17:34 ` [patch 090/164] drm/radeon: fix the r100/r200 ums block 0 page fix Greg KH 2010-07-01 17:34 ` [patch 091/164] hwmon: (ltc4245) Read only one GPIO pin Greg KH 2010-07-01 17:34 ` [patch 092/164] signals: check_kill_permission(): dont check creds if same_thread_group() Greg KH 2010-07-01 17:34 ` [patch 093/164] do_generic_file_read: clear page errors when issuing a fresh read of the page Greg KH 2010-07-01 17:34 ` [patch 094/164] ipmi: handle run_to_completion properly in deliver_recv_msg() Greg KH 2010-07-01 17:34 ` [patch 095/164] x86, setup: Phoenix BIOS fixup is needed on Dell Inspiron Mini 1012 Greg KH 2010-07-01 17:34 ` [patch 096/164] xen: ensure timer tick is resumed even on CPU driving the resume Greg KH 2010-07-01 17:34 ` [patch 097/164] xen: avoid allocation causing potential swap activity on the resume path Greg KH 2010-07-01 17:34 ` [patch 098/164] ALSA: hda: Use LPIB for an ASUS device Greg KH 2010-07-01 17:34 ` [patch 099/164] ALSA: hda: Use mb31 quirk for an iMac model Greg KH 2010-07-01 17:34 ` [patch 100/164] ALSA: hda: Use LPIB for another mainboard Greg KH 2010-07-01 17:34 ` [patch 101/164] ALSA: hda: Use LPIB for ASUS M2V Greg KH 2010-07-01 17:34 ` [patch 102/164] Staging: comedi - correct parameter gainlkup for DAQCard-6024E in driver ni_mio_cs.c Greg KH 2010-07-01 17:34 ` [patch 103/164] clocksource: sh_tmu: compute mult and shift before registration Greg KH 2010-07-01 17:34 ` [patch 104/164] clocksource: sh_cmt: " Greg KH 2010-07-01 17:34 ` [patch 105/164] gconfig: fix build failure on fedora 13 Greg KH 2010-07-01 17:34 ` [patch 106/164] arch/x86/kernel: Add missing spin_unlock Greg KH 2010-07-01 17:34 ` [patch 107/164] ath5k: retain promiscuous setting Greg KH 2010-07-01 17:34 ` [patch 108/164] ahci: add pci quirk for JMB362 Greg KH 2010-07-01 17:34 ` [patch 109/164] firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder Greg KH 2010-07-01 17:34 ` [patch 110/164] perf_events: Fix resource leak in x86 __hw_perf_event_init() Greg KH 2010-07-01 17:34 ` [patch 111/164] sata_nv: dont diddle with nIEN on mcp55 Greg KH 2010-07-01 17:34 ` [patch 112/164] sata_via: magic vt6421 fix for transmission problems w/ WD drives Greg KH 2010-07-01 17:34 ` [patch 113/164] drm/i915: Rebind bo if currently bound with incorrect alignment Greg KH 2010-07-01 17:35 ` [patch 114/164] USB: mos7840: fix null-pointer dereference Greg KH 2010-07-01 17:35 ` [patch 115/164] USB: xhci: Wait for host to start running Greg KH 2010-07-01 17:35 ` [patch 116/164] USB: xhci: Wait for controller to be ready after reset Greg KH 2010-07-01 17:35 ` [patch 117/164] USB: ftdi_sio: fix DTR/RTS line modes Greg KH 2010-07-01 17:35 ` [patch 118/164] USB: cdc-acm: fix resource reclaim in error path of acm_probe Greg KH 2010-07-01 17:35 ` [patch 119/164] p54usb: Add device ID for Dell WLA3310 USB Greg KH 2010-07-01 17:35 ` [patch 120/164] wireless: report reasonable bitrate for MCS rates through wext Greg KH 2010-07-01 17:35 ` [patch 121/164] wrong type for magic argument in simple_fill_super() Greg KH 2010-07-01 17:35 ` [patch 122/164] cfq-iosched: fix an oops caused by slab leak Greg KH 2010-07-01 17:35 ` [patch 123/164] iwlwifi: reset card during probe Greg KH 2010-07-01 17:35 ` [patch 124/164] iwlwifi: recalculate average tpt if not current Greg KH 2010-07-01 17:35 ` [patch 125/164] perf: Fix signed comparison in perf_adjust_period() Greg KH 2010-07-01 17:35 ` [patch 126/164] tracing: Fix null pointer deref with SEND_SIG_FORCED Greg KH 2010-07-01 17:35 ` [patch 127/164] wl1251: fix a memory leak in probe Greg KH 2010-07-01 17:35 ` [patch 128/164] ext4: check s_log_groups_per_flex in online resize code Greg KH 2010-07-01 17:35 ` [patch 129/164] ext4: Make sure the MOVE_EXT ioctl cant overwrite append-only files Greg KH 2010-07-01 17:35 ` [patch 130/164] GFS2: Fix permissions checking for setflags ioctl() Greg KH 2010-07-01 17:35 ` [patch 131/164] sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4) Greg KH 2010-07-01 17:35 ` [patch 132/164] CIFS: Allow null nd (as nfs server uses) on create Greg KH 2010-07-01 17:35 ` [patch 133/164] vfs: add NOFOLLOW flag to umount(2) Greg KH 2010-07-01 17:35 ` [patch 134/164] l2tp: Fix oops in pppol2tp_xmit Greg KH 2010-07-01 17:35 ` [patch 135/164] Btrfs: should add a permission check for setfacl Greg KH 2010-07-01 17:35 ` [patch 136/164] eeepc-laptop: check wireless hotplug events Greg KH 2010-07-01 17:35 ` [patch 137/164] tracing: Consolidate protection of reader access to the ring buffer Greg KH 2010-07-01 17:35 ` [patch 138/164] Input: psmouse - reset all types of mice before reconnecting Greg KH 2010-07-01 17:35 ` [patch 139/164] KVM: SVM: Dont use kmap_atomic in nested_svm_map Greg KH 2010-07-01 17:35 ` [patch 140/164] KVM: SVM: Fix schedule-while-atomic on nested exception handling Greg KH 2010-07-01 17:35 ` [patch 141/164] KVM: SVM: Sync all control registers on nested vmexit Greg KH 2010-07-01 17:35 ` [patch 142/164] KVM: SVM: Fix nested msr intercept handling Greg KH 2010-07-01 17:35 ` [patch 143/164] KVM: SVM: Dont sync nested cr8 to lapic and back Greg KH 2010-07-01 17:35 ` [patch 144/164] KVM: SVM: Fix wrong interrupt injection in enable_irq_windows Greg KH 2010-07-01 17:35 ` [patch 145/164] KVM: s390: Fix possible memory leak of in kvm_arch_vcpu_create() Greg KH 2010-07-01 17:35 ` [patch 146/164] KVM: PPC: Do not create debugfs if fail to create vcpu Greg KH 2010-07-01 17:35 ` [patch 147/164] KVM: x86: Add callback to let modules decide over some supported cpuid bits Greg KH 2010-07-01 17:35 ` [patch 148/164] KVM: SVM: Report emulated SVM features to userspace Greg KH 2010-07-01 17:35 ` [patch 149/164] x86, paravirt: Add a global synchronization point for pvclock Greg KH 2010-07-01 17:35 ` [patch 150/164] KVM: Dont allow lmsw to clear cr0.pe Greg KH 2010-07-01 17:35 ` [patch 151/164] KVM: x86: Check LMA bit before set_efer Greg KH 2010-07-01 17:35 ` [patch 152/164] KVM: MMU: Segregate shadow pages with different cr0.wp Greg KH 2010-07-01 17:35 ` [patch 153/164] KVM: VMX: enable VMXON check with SMX enabled (Intel TXT) Greg KH 2010-07-01 17:35 ` [patch 154/164] KVM: MMU: Dont read pdptrs with mmu spinlock held in mmu_alloc_roots Greg KH 2010-07-01 17:35 ` [patch 155/164] KVM: Fix wallclock version writing race Greg KH 2010-07-01 17:35 ` [patch 156/164] KVM: PPC: Add missing vcpu_load()/vcpu_put() in vcpu ioctls Greg KH 2010-07-01 17:35 ` [patch 157/164] KVM: x86: Add missing locking to arch specific " Greg KH 2010-07-01 17:35 ` [patch 158/164] KVM: x86: Inject #GP with the right rip on efer writes Greg KH 2010-07-01 17:35 ` [patch 159/164] KVM: SVM: Dont allow nested guest to VMMCALL into host Greg KH 2010-07-01 17:35 ` [patch 160/164] parisc: clear floating point exception flag on SIGFPE signal Greg KH 2010-07-01 17:35 ` [patch 161/164] KEYS: Return more accurate error codes Greg KH 2010-07-01 17:35 ` [patch 162/164] KEYS: find_keyring_by_name() can gain access to a freed keyring Greg KH 2010-07-01 17:35 ` [patch 163/164] [SCSI] qla2xxx: Disable MSI on qla24xx chips other than QLA2432 Greg KH 2010-07-01 17:35 ` [patch 164/164] sctp: fix append error cause to ERROR chunk correctly Greg KH 2010-07-01 17:52 ` [000/200] 2.6.34.1 stable review Greg KH 2010-07-01 17:41 ` [001/200] oprofile/x86: fix uninitialized counter usage during cpu hotplug Greg KH 2010-07-01 17:41 ` [002/200] oprofile: remove double ring buffering Greg KH 2010-07-01 17:41 ` [004/200] perf: Fix exit() vs PERF_FORMAT_GROUP Greg KH 2010-07-01 17:41 ` [005/200] perf top: Properly notify the user that vmlinux is missing Greg KH 2010-07-01 17:41 ` [006/200] perf: Fix exit() vs event-groups Greg KH 2010-07-01 17:41 ` [007/200] Fix racy use of anon_inode_getfd() in perf_event.c Greg KH 2010-07-01 17:41 ` [008/200] VFS: fix recent breakage of FS_REVAL_DOT Greg KH 2010-07-01 17:41 ` [009/200] posix_timer: Fix error path in timer_create Greg KH 2010-07-01 17:41 ` [010/200] libata: disable ATAPI AN by default Greg KH 2010-07-01 17:41 ` [011/200] libata: dont flush dcache on slab pages Greg KH 2010-07-01 17:41 ` [012/200] cpumask: fix compat getaffinity Greg KH 2010-07-01 17:41 ` [013/200] NFSD: dont report compiled-out versions as present Greg KH 2010-07-01 17:41 ` [014/200] nfsd: dont break lease while servicing a COMMIT Greg KH 2010-07-01 17:41 ` [015/200] sata_nv: use ata_pci_sff_activate_host() instead of ata_host_activate() Greg KH 2010-07-01 17:41 ` [016/200] ARCNET: Limit com20020 PCI ID matches for SOHARD cards Greg KH 2010-07-01 17:41 ` [017/200] rtl8180: fix tx status reporting Greg KH 2010-07-01 17:41 ` [018/200] staging: vt6655: Fix kernel BUG on driver wpa initialization Greg KH 2010-07-01 17:41 ` [019/200] Staging: rt2870: add device ID of MelCo.,Inc. WLI-UC-G301N Greg KH 2010-07-01 17:41 ` [020/200] Staging: batman-adv: dont have interrupts disabled while sending Greg KH 2010-07-01 17:41 ` [021/200] Staging: batman-adv: Fix VIS output bug for secondary interfaces Greg KH 2010-07-01 17:41 ` [022/200] Staging: batman-adv: Fixing wrap-around bug in vis Greg KH 2010-07-01 17:41 ` [023/200] mutex: Fix optimistic spinning vs. BKL Greg KH 2010-07-01 17:41 ` [024/200] ALSA: pcm: fix delta calculation at boundary wraparound Greg KH 2010-07-01 17:41 ` [025/200] ALSA: pcm: fix the fix of the runtime->boundary calculation Greg KH 2010-07-01 17:41 ` [026/200] ALSA: hda: Fix model quirk for Dell M1730 Greg KH 2010-07-01 17:41 ` [027/200] ALSA: hda: Use LPIB for Toshiba A100-259 Greg KH 2010-07-01 17:41 ` [028/200] ALSA: hda: Use LPIB for Acer Aspire 5110 Greg KH 2010-07-01 17:41 ` [029/200] ALSA: hda: Use LPIB for Sony VPCS11V9E Greg KH 2010-07-01 17:42 ` [030/200] ALSA: hda: Use LPIB for a Shuttle device Greg KH 2010-07-01 17:42 ` [031/200] ACPI: video: fix acpi_backlight=video Greg KH 2010-07-01 17:42 ` [032/200] HID: Add the GYR4101US USB ID to hid-gyration Greg KH 2010-07-01 17:42 ` [033/200] ar9170usb: add a couple more USB IDs Greg KH 2010-07-01 17:42 ` [034/200] ar9170usb: fix panic triggered by undersized rxstream buffer Greg KH 2010-07-01 17:42 ` [035/200] ARM: 6135/1: mx21/devices: fix USBOTG resource Greg KH 2010-07-01 17:42 ` [036/200] USB: visor: fix memory leak Greg KH 2010-07-01 17:42 ` [037/200] USB: CP210x New Device IDs 11 New device IDs Greg KH 2010-07-01 17:42 ` [038/200] USB: kobil: fix memory leak Greg KH 2010-07-01 17:42 ` [039/200] USB: tty: fix incorrect use of tty_insert_flip_string_fixed_flag Greg KH 2010-07-01 17:42 ` [040/200] USB: option: add PID for ZTE product Greg KH 2010-07-01 17:42 ` [041/200] USB: option.c: OLIVETTI OLICARD100 support Greg KH 2010-07-01 17:42 ` [042/200] USB: ir-usb: fix double free Greg KH 2010-07-01 17:42 ` [043/200] USB: kl5usb105: fix memory leak Greg KH 2010-07-01 17:42 ` [044/200] USB: qcaux: add Samsung U520 device ID Greg KH 2010-07-01 17:42 ` [045/200] USB: mxc: gadget: Fix bitfield for calculating maximum packet size Greg KH 2010-07-01 17:42 ` [046/200] USB: unusual-dev: Add bad sense flag for Appotech ax203 based picture frames Greg KH 2010-07-01 17:42 ` [047/200] USB: fix usbmon and DMA mapping for scatter-gather URBs Greg KH 2010-07-01 17:42 ` [048/200] USB: FHCI: cq_get() should check kfifo_out()s return value Greg KH 2010-07-01 17:42 ` [049/200] USB: EHCI: clear PHCD before resuming Greg KH 2010-07-01 17:42 ` [050/200] USB: EHCI: fix controller wakeup flag settings during suspend Greg KH 2010-07-01 17:42 ` [051/200] USB: xhci: Fix issue with set interface after stall Greg KH 2010-07-01 17:42 ` [052/200] USB: xhci: Limit bus sg_tablesize to 62 TRBs Greg KH 2010-07-01 17:42 ` [053/200] USB: xhci: Fix check for room on the ring Greg KH 2010-07-01 17:42 ` [054/200] USB: xHCI: Fix wrong usage of macro TRB_TYPE Greg KH 2010-07-01 17:42 ` [055/200] ath5k: consistently use rx_bufsize for RX DMA Greg KH 2010-07-01 17:42 ` [056/200] fbdev: section cleanup in hgafb Greg KH 2010-07-01 17:42 ` [057/200] fbdev: section cleanup in vfb Greg KH 2010-07-01 17:42 ` [058/200] fbdev: section cleanup in vga16fb Greg KH 2010-07-01 17:42 ` [059/200] fbdev: section cleanup in arcfb Greg KH 2010-07-01 17:42 ` [060/200] fbdev: section cleanup in w100fb Greg KH 2010-07-01 17:42 ` [061/200] mac80211: give warning if building w/out rate ctrl algorithm Greg KH 2010-07-01 17:42 ` [062/200] mac80211: Fix robust management frame handling (MFP) Greg KH 2010-07-01 17:42 ` [063/200] mac80211: fix rts threshold check Greg KH 2010-07-01 17:42 ` [064/200] mac80211: fix handling of 4-address-mode in ieee80211_change_iface Greg KH 2010-07-01 17:42 ` [065/200] ath9k_hw: fix hardware deinit Greg KH 2010-07-01 17:42 ` [066/200] drm/i915: Reject bind_to_gtt() early if object > aperture Greg KH 2010-07-01 17:42 ` [067/200] [SCSI] libsas: fix deref before check in commit 70b25f890ce Greg KH 2010-07-01 17:42 ` [068/200] drivers/base/cpu.c: fix the output from /sys/devices/system/cpu/offline Greg KH 2010-07-01 17:42 ` [069/200] can: Fix SJA1000 command register writes on SMP systems Greg KH 2010-07-01 17:42 ` [070/200] PCI quirks: disable msi on AMD rs4xx internal gfx bridges Greg KH 2010-07-01 17:42 ` [071/200] PCI: Disable MSI for MCP55 on P5N32-E SLI Greg KH 2010-07-01 17:42 ` [072/200] drm/radeon/kms: dont default display priority to high on rs4xx Greg KH 2010-07-01 17:42 ` [073/200] drm/edid: Fix 1024x768@85Hz Greg KH 2010-07-01 17:42 ` [074/200] drm/radeon/kms: reset ddc_bus in object header parsing Greg KH 2010-07-01 17:42 ` [075/200] drm/radeon/kms/atom: fix typo in LVDS panel info parsing Greg KH 2010-07-01 17:42 ` [076/200] drm/radeon/kms: release AGP bridge at suspend Greg KH 2010-07-01 17:42 ` [077/200] powerpc: Fix handling of strncmp with zero len Greg KH 2010-07-01 17:42 ` [078/200] powerpc/pseries: Only call start-cpu when a CPU is stopped Greg KH 2010-07-01 17:42 ` [079/200] powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpu Greg KH 2010-07-02 0:15 ` Michael Neuling 2010-07-03 1:58 ` Greg KH 2010-07-03 7:55 ` Michael Neuling 2010-07-05 17:04 ` Greg KH 2010-07-01 17:42 ` [080/200] powerpc: Fix ioremap_flags() with book3e pte definition Greg KH 2010-07-01 17:42 ` [081/200] powerpc/fsl-booke: Fix InstructionTLBError execute permission check Greg KH 2010-07-01 17:42 ` [082/200] powerpc/fsl-booke: Move loadcam_entry back to asm code to fix SMP ftrace Greg KH 2010-07-01 17:42 ` [083/200] powerpc/oprofile: fix potential buffer overrun in op_model_cell.c Greg KH 2010-07-01 17:42 ` [084/200] writeback: disable periodic old data writeback for !dirty_writeback_centisecs Greg KH 2010-07-01 17:42 ` [085/200] md/raid1: fix counting of write targets Greg KH 2010-07-01 17:42 ` [086/200] md: Fix read balancing in RAID1 and RAID10 on drives > 2TB Greg KH 2010-07-01 17:42 ` [087/200] md/linear: avoid possible oops and array stop Greg KH 2010-07-01 17:42 ` [088/200] md: remove unneeded sysfs files more promptly Greg KH 2010-07-01 17:42 ` [089/200] md: set mddev readonly flag on blkdev BLKROSET ioctl Greg KH 2010-07-01 17:43 ` [090/200] x86/amd-iommu: Fix crash when request_mem_region fails Greg KH 2010-07-01 17:43 ` [091/200] x86/amd-iommu: Fall back to GART if initialization fails Greg KH 2010-07-01 17:43 ` [092/200] eeepc-wmi: depends on BACKLIGHT_CLASS_DEVICE Greg KH 2010-07-01 17:43 ` [093/200] clean DCACHE_CANT_MOUNT in d_delete() Greg KH 2010-07-01 17:43 ` [094/200] exofs: confusion between kmap() and kmap_atomic() api Greg KH 2010-07-01 17:43 ` [095/200] mn10300: set ARCH_KMALLOC_MINALIGN Greg KH 2010-07-01 17:43 ` [096/200] m68knommu: fix broken use of BUAD_TABLE_SIZE in 68328serial driver Greg KH 2010-07-01 17:43 ` [097/200] m68k: set ARCH_KMALLOC_MINALIGN Greg KH 2010-07-01 17:43 ` [098/200] rtc-cmos: do dev_set_drvdata() earlier in the initialization Greg KH 2010-07-01 17:43 ` [099/200] rtc: s3c: initialize driver data before using it Greg KH 2010-07-01 17:43 ` [100/200] frv: set ARCH_KMALLOC_MINALIGN Greg KH 2010-07-01 17:43 ` [101/200] xtensa: " Greg KH 2010-07-01 17:43 ` [102/200] Blackfin: " Greg KH 2010-07-01 17:43 ` [103/200] tmpfs: insert tmpfs cache pages to inactive list at first Greg KH 2010-07-01 17:43 ` [104/200] md: manage redundancy group in sysfs when changing level Greg KH 2010-07-01 17:43 ` [105/200] mlx4_core: Fix possible chunk sg list overflow in mlx4_alloc_icm() Greg KH 2010-07-01 17:43 ` [106/200] ARM: 6139/1: ARMv7: Use the Inner Shareable I-cache on MP Greg KH 2010-07-01 17:43 ` [107/200] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6 Greg KH 2010-07-01 17:43 ` [108/200] ARM: 6164/1: Add kto and kfrom to input operands list Greg KH 2010-07-01 17:43 ` [109/200] ARM: 6146/1: sa1111: Prevent deadlock in resume path Greg KH 2010-07-01 17:43 ` [110/200] ARM: 6144/1: TCM memory bug freeing bug Greg KH 2010-07-01 17:43 ` [111/200] ARM: VFP: Fix vfp_put_double() for d16-d31 Greg KH 2010-07-01 17:43 ` [112/200] aio: fix the compat vectored operations Greg KH 2010-07-01 17:43 ` [113/200] idr: fix backtrack logic in idr_remove_all Greg KH 2010-07-01 17:43 ` [114/200] ASoC: Update Freescale i.MX SSI driver DMA parameter handling Greg KH 2010-07-01 17:43 ` [115/200] ASoC: Fix dB scales for WM835x Greg KH 2010-07-01 17:43 ` [116/200] ASoC: Fix dB scales for WM8400 Greg KH 2010-07-01 17:43 ` [117/200] ASoC: Fix dB scales for WM8990 Greg KH 2010-07-01 17:43 ` [118/200] drm/radeon: fix the r100/r200 ums block 0 page fix Greg KH 2010-07-01 17:43 ` [119/200] SLUB: Allow full duplication of kmalloc array for 390 Greg KH 2010-07-01 17:43 ` [120/200] slub: move kmem_cache_node into its own cacheline Greg KH 2010-07-01 17:43 ` [121/200] hwmon: (ltc4245) Read only one GPIO pin Greg KH 2010-07-01 17:43 ` [122/200] signals: check_kill_permission(): dont check creds if same_thread_group() Greg KH 2010-07-01 17:43 ` [123/200] compat: factor out compat_rw_copy_check_uvector from compat_do_readv_writev Greg KH 2010-07-01 17:43 ` [124/200] fs/compat_rw_copy_check_uvector: add missing compat_ptr call Greg KH 2010-07-01 17:43 ` [125/200] do_generic_file_read: clear page errors when issuing a fresh read of the page Greg KH 2010-07-01 17:43 ` [126/200] ipmi: handle run_to_completion properly in deliver_recv_msg() Greg KH 2010-07-01 17:43 ` [127/200] x86, setup: Phoenix BIOS fixup is needed on Dell Inspiron Mini 1012 Greg KH 2010-07-01 17:43 ` [128/200] xen: ensure timer tick is resumed even on CPU driving the resume Greg KH 2010-07-01 17:43 ` [129/200] xen: avoid allocation causing potential swap activity on the resume path Greg KH 2010-07-01 17:43 ` [130/200] ALSA: hda: Use LPIB for an ASUS device Greg KH 2010-07-01 17:43 ` [131/200] ALSA: hda: Use mb31 quirk for an iMac model Greg KH 2010-07-01 17:43 ` [132/200] ALSA: hda: Use LPIB for another mainboard Greg KH 2010-07-01 17:43 ` [133/200] ALSA: hda: Use LPIB for ASUS M2V Greg KH 2010-07-01 17:43 ` [134/200] vmware balloon: clamp number of collected non-balloonable pages Greg KH 2010-07-01 17:43 ` [135/200] Staging: comedi - correct parameter gainlkup for DAQCard-6024E in driver ni_mio_cs.c Greg KH 2010-07-01 17:43 ` [136/200] clocksource: sh_tmu: compute mult and shift before registration Greg KH 2010-07-01 17:43 ` [137/200] clocksource: sh_cmt: " Greg KH 2010-07-01 17:43 ` [138/200] gconfig: fix build failure on fedora 13 Greg KH 2010-07-01 17:43 ` [139/200] arch/x86/kernel: Add missing spin_unlock Greg KH 2010-07-01 17:43 ` [140/200] pcmcia: only keep saved I365_CSCINT flag if there is no PCI irq Greg KH 2010-07-01 17:43 ` [141/200] pcmcia: avoid validate_cis failure on CIS override Greg KH 2010-07-01 17:43 ` [142/200] mac80211: fix deauth before assoc Greg KH 2010-07-01 17:43 ` [143/200] ath5k: retain promiscuous setting Greg KH 2010-07-01 17:43 ` [144/200] ahci: add pci quirk for JMB362 Greg KH 2010-07-01 17:43 ` [145/200] firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder Greg KH 2010-07-01 17:43 ` [146/200] misc: Fix allocation borrowed by vhost_net Greg KH 2010-07-01 17:43 ` [147/200] cgroups: alloc_css_id() increments hierarchy depth Greg KH 2010-07-01 17:43 ` [148/200] perf_events: Fix resource leak in x86 __hw_perf_event_init() Greg KH 2010-07-01 17:43 ` [149/200] sata_nv: dont diddle with nIEN on mcp55 Greg KH 2010-07-01 17:44 ` [150/200] sata_via: magic vt6421 fix for transmission problems w/ WD drives Greg KH 2010-07-01 17:44 ` [151/200] drm/i915: Rebind bo if currently bound with incorrect alignment Greg KH 2010-07-01 17:44 ` [152/200] drm/i915: Kill dangerous pending-flip debugging Greg KH 2010-07-01 17:44 ` [153/200] USB: mos7840: fix null-pointer dereference Greg KH 2010-07-01 17:44 ` [154/200] USB: xhci: Wait for host to start running Greg KH 2010-07-01 17:44 ` [155/200] USB: xhci: Wait for controller to be ready after reset Greg KH 2010-07-01 17:44 ` [156/200] USB: ftdi_sio: fix DTR/RTS line modes Greg KH 2010-07-01 17:44 ` [157/200] USB: cdc-acm: fix resource reclaim in error path of acm_probe Greg KH 2010-07-01 17:44 ` [158/200] USB: unbind all interfaces before rebinding them Greg KH 2010-07-01 17:44 ` [159/200] p54usb: Add device ID for Dell WLA3310 USB Greg KH 2010-07-01 17:44 ` [160/200] wrong type for magic argument in simple_fill_super() Greg KH 2010-07-01 17:44 ` [161/200] cfq-iosched: fix an oops caused by slab leak Greg KH 2010-07-01 17:44 ` [162/200] iwlwifi: fix internal scan race Greg KH 2010-07-01 17:44 ` [163/200] iwlwifi: recalculate average tpt if not current Greg KH 2010-07-01 17:44 ` [164/200] perf: Fix signed comparison in perf_adjust_period() Greg KH 2010-07-01 17:44 ` [165/200] tracing: Fix null pointer deref with SEND_SIG_FORCED Greg KH 2010-07-01 17:44 ` [166/200] nfsd: nfsd_setattr needs to call commit_metadata Greg KH 2010-07-01 17:44 ` [167/200] wl1251: fix a memory leak in probe Greg KH 2010-07-01 17:44 ` [168/200] iwlwifi: add missing rcu_read_lock Greg KH 2010-07-01 17:44 ` [169/200] perf_events: Fix races and clean up perf_event and perf_mmap_data interaction Greg KH 2010-07-01 17:44 ` [170/200] ext4: check s_log_groups_per_flex in online resize code Greg KH 2010-07-01 17:44 ` [171/200] ext4: Make sure the MOVE_EXT ioctl cant overwrite append-only files Greg KH 2010-07-01 17:44 ` [172/200] GFS2: Fix permissions checking for setflags ioctl() Greg KH 2010-07-01 17:44 ` [173/200] CIFS: Allow null nd (as nfs server uses) on create Greg KH 2010-07-01 17:44 ` [174/200] Btrfs: should add a permission check for setfacl Greg KH 2010-07-01 17:44 ` [175/200] NFS: Ensure that we mark the inode as dirty if we exit early from commit Greg KH 2010-07-01 17:44 ` [176/200] NFS: Fix another nfs_wb_page() deadlock Greg KH 2010-07-01 17:44 ` [177/200] V4L/DVB: uvcvideo: Prevent division by 0 when control step value is 0 Greg KH 2010-07-01 17:44 ` [178/200] KVM: SVM: Dont use kmap_atomic in nested_svm_map Greg KH 2010-07-01 17:44 ` [179/200] KVM: SVM: Fix schedule-while-atomic on nested exception handling Greg KH 2010-07-01 17:44 ` [180/200] KVM: SVM: Sync all control registers on nested vmexit Greg KH 2010-07-01 17:44 ` [181/200] KVM: SVM: Fix nested msr intercept handling Greg KH 2010-07-01 17:44 ` [182/200] KVM: SVM: Dont sync nested cr8 to lapic and back Greg KH 2010-07-01 17:44 ` [183/200] KVM: SVM: Fix wrong interrupt injection in enable_irq_windows Greg KH 2010-07-01 17:44 ` [184/200] KVM: s390: Fix possible memory leak of in kvm_arch_vcpu_create() Greg KH 2010-07-01 17:44 ` [185/200] KVM: PPC: Do not create debugfs if fail to create vcpu Greg KH 2010-07-01 17:44 ` [186/200] KVM: x86: Add callback to let modules decide over some supported cpuid bits Greg KH 2010-07-01 17:44 ` [187/200] KVM: SVM: Report emulated SVM features to userspace Greg KH 2010-07-01 17:44 ` [188/200] x86, paravirt: Add a global synchronization point for pvclock Greg KH 2010-07-01 17:44 ` [189/200] KVM: Dont allow lmsw to clear cr0.pe Greg KH 2010-07-01 17:44 ` [190/200] KVM: x86: Check LMA bit before set_efer Greg KH 2010-07-01 17:44 ` [191/200] KVM: MMU: Segregate shadow pages with different cr0.wp Greg KH 2010-07-01 17:44 ` [192/200] KVM: VMX: enable VMXON check with SMX enabled (Intel TXT) Greg KH 2010-07-01 17:44 ` [193/200] KVM: MMU: Dont read pdptrs with mmu spinlock held in mmu_alloc_roots Greg KH 2010-07-01 17:44 ` [194/200] KVM: Fix wallclock version writing race Greg KH 2010-07-01 17:44 ` [195/200] KVM: PPC: Add missing vcpu_load()/vcpu_put() in vcpu ioctls Greg KH 2010-07-01 17:44 ` [196/200] KVM: x86: Add missing locking to arch specific " Greg KH 2010-07-01 17:44 ` [197/200] KVM: x86: Inject #GP with the right rip on efer writes Greg KH 2010-07-01 17:44 ` [198/200] KVM: SVM: Dont allow nested guest to VMMCALL into host Greg KH 2010-07-01 17:44 ` [199/200] drm/i915: Dont touch PORT_HOTPLUG_EN in intel_dp_detect() Greg KH 2010-07-01 17:44 ` [200/200] parisc: clear floating point exception flag on SIGFPE signal Greg KH 2010-07-01 21:40 ` [000/200] 2.6.34.1 stable review Rafael J. Wysocki 2010-07-01 22:09 ` Greg KH 2010-07-01 22:17 ` Rafael J. Wysocki 2010-07-01 21:55 ` 4 -stable kernel review cycles starting Florian Fainelli 2010-07-01 22:10 ` Greg KH 2010-07-01 22:36 ` Randy Dunlap 2010-07-01 22:51 ` Greg KH 2010-07-01 23:09 ` Randy Dunlap 2010-07-01 23:17 ` [stable] " Greg KH
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.