* [ 006/187] powerpc/ftrace: Do not trace restore_interrupts()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 007/187] powerpc: Fix uninitialised error in numa.c Greg Kroah-Hartman
` (179 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Steven Rostedt, Benjamin Herrenschmidt
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
commit 2d773aa4810d4a612d1c879faacc38594cc3f841 upstream.
As I was adding code that affects all archs, I started testing function
tracer against PPC64 and found that it currently locks up with 3.4
kernel. I figured it was due to tracing a function that shouldn't be, so
I went through the following process to bisect to find the culprit:
cat /debug/tracing/available_filter_functions > t
num=`wc -l t`
sed -ne "1,${num}p" t > t1
let num=num+1
sed -ne "${num},$p" t > t2
cat t1 > /debug/tracing/set_ftrace_filter
echo function /debug/tracing/current_tracer
<failed? bisect t1, if not bisect t2>
It finally came down to this function: restore_interrupts()
I'm not sure why this locks up the system. It just seems to prevent
scheduling from occurring. Interrupts seem to still work, as I can ping
the box. But all user processes freeze.
When restore_interrupts() is not traced, function tracing works fine.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/irq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -277,7 +277,7 @@ EXPORT_SYMBOL(arch_local_irq_restore);
* NOTE: This is called with interrupts hard disabled but not marked
* as such in paca->irq_happened, so we need to resync this.
*/
-void restore_interrupts(void)
+void notrace restore_interrupts(void)
{
if (irqs_disabled()) {
local_paca->irq_happened |= PACA_IRQ_HARD_DIS;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 007/187] powerpc: Fix uninitialised error in numa.c
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
2012-07-12 22:32 ` [ 006/187] powerpc/ftrace: Do not trace restore_interrupts() Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 008/187] powerpc/pseries: Fix software invalidate TCE Greg Kroah-Hartman
` (178 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Michael Neuling, Benjamin Herrenschmidt
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <mikey@neuling.org>
commit 82b2521d257b5c0efd51821cf5fa306e53bbb6ba upstream.
chroma_defconfig currently gives me this with gcc 4.6:
arch/powerpc/mm/numa.c:638:13: error: 'dm' may be used uninitialized in this function [-Werror=uninitialized]
It's a bogus warning/error since of_get_drconf_memory() only writes it
anyway.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/mm/numa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -635,7 +635,7 @@ static inline int __init read_usm_ranges
*/
static void __init parse_drconf_memory(struct device_node *memory)
{
- const u32 *dm, *usm;
+ const u32 *uninitialized_var(dm), *usm;
unsigned int n, rc, ranges, is_kexec_kdump = 0;
unsigned long lmb_size, base, size, sz;
int nid;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 008/187] powerpc/pseries: Fix software invalidate TCE
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
2012-07-12 22:32 ` [ 006/187] powerpc/ftrace: Do not trace restore_interrupts() Greg Kroah-Hartman
2012-07-12 22:32 ` [ 007/187] powerpc: Fix uninitialised error in numa.c Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 009/187] powerpc: check_and_cede_processor() never cedes Greg Kroah-Hartman
` (177 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Michael Neuling, Benjamin Herrenschmidt
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <mikey@neuling.org>
commit bc6dc752f35488160ffac07ae91bed1bddaea32a upstream.
The following added support for powernv but broke pseries/BML:
1f1616e powerpc/powernv: Add TCE SW invalidation support
TCE_PCI_SW_INVAL was split into FREE and CREATE flags but the tests in
the pseries code were not updated to reflect this.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/iommu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -106,7 +106,7 @@ static int tce_build_pSeries(struct iomm
tcep++;
}
- if (tbl->it_type == TCE_PCI_SWINV_CREATE)
+ if (tbl->it_type & TCE_PCI_SWINV_CREATE)
tce_invalidate_pSeries_sw(tbl, tces, tcep - 1);
return 0;
}
@@ -121,7 +121,7 @@ static void tce_free_pSeries(struct iomm
while (npages--)
*(tcep++) = 0;
- if (tbl->it_type == TCE_PCI_SWINV_FREE)
+ if (tbl->it_type & TCE_PCI_SWINV_FREE)
tce_invalidate_pSeries_sw(tbl, tces, tcep - 1);
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 009/187] powerpc: check_and_cede_processor() never cedes
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (2 preceding siblings ...)
2012-07-12 22:32 ` [ 008/187] powerpc/pseries: Fix software invalidate TCE Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 010/187] ARM: SAMSUNG: Fix for S3C2412 EBI memory mapping Greg Kroah-Hartman
` (176 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Anton Blanchard, Benjamin Herrenschmidt
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <anton@samba.org>
commit 0b17ba7258db83cd02da560884e053b85de371f2 upstream.
Commit f948501b36c6 ("Make hard_irq_disable() actually hard-disable
interrupts") caused check_and_cede_processor to stop working.
->irq_happened will never be zero right after a hard_irq_disable
so the compiler removes the call to cede_processor completely.
The bug was introduced back in the lazy interrupt handling rework
of 3.4 but was hidden until recently because hard_irq_disable did
nothing.
This issue will eventually appear in 3.4 stable since the
hard_irq_disable fix is marked stable, so mark this one for stable
too.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/hw_irq.h | 5 +++++
arch/powerpc/platforms/pseries/processor_idle.c | 2 +-
2 files changed, 6 insertions(+), 1 deletion(-)
--- a/arch/powerpc/include/asm/hw_irq.h
+++ b/arch/powerpc/include/asm/hw_irq.h
@@ -102,6 +102,11 @@ static inline void hard_irq_disable(void
/* include/linux/interrupt.h needs hard_irq_disable to be a macro */
#define hard_irq_disable hard_irq_disable
+static inline bool lazy_irq_pending(void)
+{
+ return !!(get_paca()->irq_happened & ~PACA_IRQ_HARD_DIS);
+}
+
/*
* This is called by asynchronous interrupts to conditionally
* re-enable hard interrupts when soft-disabled after having
--- a/arch/powerpc/platforms/pseries/processor_idle.c
+++ b/arch/powerpc/platforms/pseries/processor_idle.c
@@ -106,7 +106,7 @@ static void check_and_cede_processor(voi
* we first hard disable then check.
*/
hard_irq_disable();
- if (get_paca()->irq_happened == 0)
+ if (!lazy_irq_pending())
cede_processor();
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 010/187] ARM: SAMSUNG: Fix for S3C2412 EBI memory mapping
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (3 preceding siblings ...)
2012-07-12 22:32 ` [ 009/187] powerpc: check_and_cede_processor() never cedes Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 011/187] ARM: SAMSUNG: Should check for IS_ERR(clk) instead of NULL Greg Kroah-Hartman
` (175 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Jose Miguel Goncalves, Kukjin Kim
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Miguel Goncalves <jose.goncalves@inov.pt>
commit 3dca938656c7b0ff6b0717a5dde0f5f45e592be5 upstream.
While upgrading the kernel on a S3C2412 based board I've noted
that it was impossible to boot the board with a 2.6.32 or upper
kernel. I've tracked down the problem to the EBI virtual memory
mapping that is in conflict with the IO mapping definition in
arch/arm/mach-s3c24xx/s3c2412.c.
Signed-off-by: Jose Miguel Goncalves <jose.goncalves@inov.pt>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/plat-samsung/include/plat/map-s3c.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/plat-samsung/include/plat/map-s3c.h
+++ b/arch/arm/plat-samsung/include/plat/map-s3c.h
@@ -22,7 +22,7 @@
#define S3C24XX_VA_WATCHDOG S3C_VA_WATCHDOG
#define S3C2412_VA_SSMC S3C_ADDR_CPU(0x00000000)
-#define S3C2412_VA_EBI S3C_ADDR_CPU(0x00010000)
+#define S3C2412_VA_EBI S3C_ADDR_CPU(0x00100000)
#define S3C2410_PA_UART (0x50000000)
#define S3C24XX_PA_UART S3C2410_PA_UART
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 011/187] ARM: SAMSUNG: Should check for IS_ERR(clk) instead of NULL
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (4 preceding siblings ...)
2012-07-12 22:32 ` [ 010/187] ARM: SAMSUNG: Fix for S3C2412 EBI memory mapping Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 012/187] ARM: 7438/1: fill possible PMD empty section gaps Greg Kroah-Hartman
` (174 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Jonghwan Choi, Kukjin Kim
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonghwan Choi <jhbird.choi@samsung.com>
commit a5d8f4765f0e92ef027492a8cb979c5b8d45f2c3 upstream.
On the error condition clk_get() returns ERR_PTR().
Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/plat-samsung/include/plat/watchdog-reset.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/plat-samsung/include/plat/watchdog-reset.h
+++ b/arch/arm/plat-samsung/include/plat/watchdog-reset.h
@@ -25,7 +25,7 @@ static inline void arch_wdt_reset(void)
__raw_writel(0, S3C2410_WTCON); /* disable watchdog, to be safe */
- if (s3c2410_wdtclk)
+ if (!IS_ERR(s3c2410_wdtclk))
clk_enable(s3c2410_wdtclk);
/* put initial values into count and data */
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 012/187] ARM: 7438/1: fill possible PMD empty section gaps
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (5 preceding siblings ...)
2012-07-12 22:32 ` [ 011/187] ARM: SAMSUNG: Should check for IS_ERR(clk) instead of NULL Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 013/187] powerpc/kvm: sldi should be sld Greg Kroah-Hartman
` (173 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Nicolas Pitre, Santosh Shilimkar,
R, Sricharan, Catalin Marinas, Russell King
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Pitre <nicolas.pitre@linaro.org>
commit 19b52abe3c5d759661500a1dc810924369b2ad46 upstream.
On ARM with the 2-level page table format, a PMD entry is represented by
two consecutive section entries covering 2MB of virtual space.
However, static mappings always were allowed to use separate 1MB section
entries. This means in practice that a static mapping may create half
populated PMDs via create_mapping().
Since commit 0536bdf33f (ARM: move iotable mappings within the vmalloc
region) those static mappings are located in the vmalloc area. We must
ensure no such half populated PMDs are accessible once vmalloc() or
ioremap() start looking at the vmalloc area for nearby free virtual
address ranges, or various things leading to a kernel crash will happen.
Signed-off-by: Nicolas Pitre <nico@linaro.org>
Reported-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Tested-by: "R, Sricharan" <r.sricharan@ti.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mm/mmu.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 74 insertions(+)
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -783,6 +783,79 @@ void __init iotable_init(struct map_desc
}
}
+#ifndef CONFIG_ARM_LPAE
+
+/*
+ * The Linux PMD is made of two consecutive section entries covering 2MB
+ * (see definition in include/asm/pgtable-2level.h). However a call to
+ * create_mapping() may optimize static mappings by using individual
+ * 1MB section mappings. This leaves the actual PMD potentially half
+ * initialized if the top or bottom section entry isn't used, leaving it
+ * open to problems if a subsequent ioremap() or vmalloc() tries to use
+ * the virtual space left free by that unused section entry.
+ *
+ * Let's avoid the issue by inserting dummy vm entries covering the unused
+ * PMD halves once the static mappings are in place.
+ */
+
+static void __init pmd_empty_section_gap(unsigned long addr)
+{
+ struct vm_struct *vm;
+
+ vm = early_alloc_aligned(sizeof(*vm), __alignof__(*vm));
+ vm->addr = (void *)addr;
+ vm->size = SECTION_SIZE;
+ vm->flags = VM_IOREMAP | VM_ARM_STATIC_MAPPING;
+ vm->caller = pmd_empty_section_gap;
+ vm_area_add_early(vm);
+}
+
+static void __init fill_pmd_gaps(void)
+{
+ struct vm_struct *vm;
+ unsigned long addr, next = 0;
+ pmd_t *pmd;
+
+ /* we're still single threaded hence no lock needed here */
+ for (vm = vmlist; vm; vm = vm->next) {
+ if (!(vm->flags & VM_ARM_STATIC_MAPPING))
+ continue;
+ addr = (unsigned long)vm->addr;
+ if (addr < next)
+ continue;
+
+ /*
+ * Check if this vm starts on an odd section boundary.
+ * If so and the first section entry for this PMD is free
+ * then we block the corresponding virtual address.
+ */
+ if ((addr & ~PMD_MASK) == SECTION_SIZE) {
+ pmd = pmd_off_k(addr);
+ if (pmd_none(*pmd))
+ pmd_empty_section_gap(addr & PMD_MASK);
+ }
+
+ /*
+ * Then check if this vm ends on an odd section boundary.
+ * If so and the second section entry for this PMD is empty
+ * then we block the corresponding virtual address.
+ */
+ addr += vm->size;
+ if ((addr & ~PMD_MASK) == SECTION_SIZE) {
+ pmd = pmd_off_k(addr) + 1;
+ if (pmd_none(*pmd))
+ pmd_empty_section_gap(addr);
+ }
+
+ /* no need to look at any vm entry until we hit the next PMD */
+ next = (addr + PMD_SIZE - 1) & PMD_MASK;
+ }
+}
+
+#else
+#define fill_pmd_gaps() do { } while (0)
+#endif
+
static void * __initdata vmalloc_min =
(void *)(VMALLOC_END - (240 << 20) - VMALLOC_OFFSET);
@@ -1064,6 +1137,7 @@ static void __init devicemaps_init(struc
*/
if (mdesc->map_io)
mdesc->map_io();
+ fill_pmd_gaps();
/*
* Finally flush the caches and tlb to ensure that we're in a
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 013/187] powerpc/kvm: sldi should be sld
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (6 preceding siblings ...)
2012-07-12 22:32 ` [ 012/187] ARM: 7438/1: fill possible PMD empty section gaps Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 014/187] powerpc/xmon: Use cpumask iterator to avoid warning Greg Kroah-Hartman
` (172 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Michael Neuling, Benjamin Herrenschmidt
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <mikey@neuling.org>
commit 2f584a146a2965b82fce89b8d2f95dc5cfe468d0 upstream.
Since we are taking a registers, this should never have been an sldi.
Talking to paulus offline, this is the correct fix.
Was introduced by:
commit 19ccb76a1938ab364a412253daec64613acbf3df
Author: Paul Mackerras <paulus@samba.org>
Date: Sat Jul 23 17:42:46 2011 +1000
Talking to paulus, this shouldn't be a literal.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kvm/book3s_hv_rmhandlers.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -776,7 +776,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_201)
lwz r3,VCORE_NAPPING_THREADS(r5)
lwz r4,VCPU_PTID(r9)
li r0,1
- sldi r0,r0,r4
+ sld r0,r0,r4
andc. r3,r3,r0 /* no sense IPI'ing ourselves */
beq 43f
mulli r4,r4,PACA_SIZE /* get paca for thread 0 */
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 014/187] powerpc/xmon: Use cpumask iterator to avoid warning
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (7 preceding siblings ...)
2012-07-12 22:32 ` [ 013/187] powerpc/kvm: sldi should be sld Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 015/187] media: smsusb: add autodetection support for USB ID 2040:f5a0 Greg Kroah-Hartman
` (171 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Anton Blanchard, Benjamin Herrenschmidt
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <anton@samba.org>
commit bc1d7702910c7c7e88eb60b58429dbfe293683ce upstream.
We have a bug report where the kernel hits a warning in the cpumask
code:
WARNING: at include/linux/cpumask.h:107
Which is:
WARN_ON_ONCE(cpu >= nr_cpumask_bits);
The backtrace is:
cpu_cmd
cmds
xmon_core
xmon
die
xmon is iterating through 0 to NR_CPUS. I'm not sure why we are still
open coding this but iterating above nr_cpu_ids is definitely a bug.
This patch iterates through all possible cpus, in case we issue a
system reset and CPUs in an offline state call in.
Perhaps the old code was trying to handle CPUs that were in the
partition but were never started (eg kexec into a kernel with an
nr_cpus= boot option). They are going to die way before we get into
xmon since we haven't set any kernel state up for them.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/xmon/xmon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -971,7 +971,7 @@ static int cpu_cmd(void)
/* print cpus waiting or in xmon */
printf("cpus stopped:");
count = 0;
- for (cpu = 0; cpu < NR_CPUS; ++cpu) {
+ for_each_possible_cpu(cpu) {
if (cpumask_test_cpu(cpu, &cpus_in_xmon)) {
if (count == 0)
printf(" %x", cpu);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 015/187] media: smsusb: add autodetection support for USB ID 2040:f5a0
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (8 preceding siblings ...)
2012-07-12 22:32 ` [ 014/187] powerpc/xmon: Use cpumask iterator to avoid warning Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 016/187] bql: Fix POSDIFF() to integer overflow aware Greg Kroah-Hartman
` (170 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Michael Krufky, Mauro Carvalho Chehab
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Krufky <mkrufky@linuxtv.org>
commit 3e1141e2ce5667301a74ca2ef396d9bd5e995f7f upstream.
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb/siano/smsusb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/media/dvb/siano/smsusb.c
+++ b/drivers/media/dvb/siano/smsusb.c
@@ -544,6 +544,8 @@ static const struct usb_device_id smsusb
.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
{ USB_DEVICE(0x2040, 0xc0a0),
.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+ { USB_DEVICE(0x2040, 0xf5a0),
+ .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
{ } /* Terminating entry */
};
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 016/187] bql: Fix POSDIFF() to integer overflow aware.
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (9 preceding siblings ...)
2012-07-12 22:32 ` [ 015/187] media: smsusb: add autodetection support for USB ID 2040:f5a0 Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 017/187] bql: Avoid unneeded limit decrement Greg Kroah-Hartman
` (169 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Hiroaki SHIMODA, Tom Herbert,
Eric Dumazet, Denys Fedoryshchenko, Eric Dumazet,
David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
[ Upstream commit 0cfd32b736ae0c36b42697584811042726c07cba ]
POSDIFF() fails to take into account integer overflow case.
Signed-off-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
Cc: Tom Herbert <therbert@google.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Denys Fedoryshchenko <denys@visp.net.lb>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/dynamic_queue_limits.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/dynamic_queue_limits.c
+++ b/lib/dynamic_queue_limits.c
@@ -10,7 +10,7 @@
#include <linux/jiffies.h>
#include <linux/dynamic_queue_limits.h>
-#define POSDIFF(A, B) ((A) > (B) ? (A) - (B) : 0)
+#define POSDIFF(A, B) ((int)((A) - (B)) > 0 ? (A) - (B) : 0)
/* Records completed count and recalculates the queue limit */
void dql_completed(struct dql *dql, unsigned int count)
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 017/187] bql: Avoid unneeded limit decrement.
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (10 preceding siblings ...)
2012-07-12 22:32 ` [ 016/187] bql: Fix POSDIFF() to integer overflow aware Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 018/187] bql: Avoid possible inconsistent calculation Greg Kroah-Hartman
` (168 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Hiroaki SHIMODA, Tom Herbert,
Eric Dumazet, Denys Fedoryshchenko, Eric Dumazet,
David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
[ Upstream commit 25426b794efdc70dde7fd3134dc56fac3e7d562d ]
When below pattern is observed,
TIME
dql_queued() dql_completed() |
a) initial state |
|
b) X bytes queued V
c) Y bytes queued
d) X bytes completed
e) Z bytes queued
f) Y bytes completed
a) dql->limit has already some value and there is no in-flight packet.
b) X bytes queued.
c) Y bytes queued and excess limit.
d) X bytes completed and dql->prev_ovlimit is set and also
dql->prev_num_queued is set Y.
e) Z bytes queued.
f) Y bytes completed. inprogress and prev_inprogress are true.
At f), according to the comment, all_prev_completed becomes
true and limit should be increased. But POSDIFF() ignores
(completed == dql->prev_num_queued) case, so limit is decreased.
Signed-off-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
Cc: Tom Herbert <therbert@google.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Denys Fedoryshchenko <denys@visp.net.lb>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/dynamic_queue_limits.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/lib/dynamic_queue_limits.c
+++ b/lib/dynamic_queue_limits.c
@@ -11,12 +11,14 @@
#include <linux/dynamic_queue_limits.h>
#define POSDIFF(A, B) ((int)((A) - (B)) > 0 ? (A) - (B) : 0)
+#define AFTER_EQ(A, B) ((int)((A) - (B)) >= 0)
/* Records completed count and recalculates the queue limit */
void dql_completed(struct dql *dql, unsigned int count)
{
unsigned int inprogress, prev_inprogress, limit;
- unsigned int ovlimit, all_prev_completed, completed;
+ unsigned int ovlimit, completed;
+ bool all_prev_completed;
/* Can't complete more than what's in queue */
BUG_ON(count > dql->num_queued - dql->num_completed);
@@ -26,7 +28,7 @@ void dql_completed(struct dql *dql, unsi
ovlimit = POSDIFF(dql->num_queued - dql->num_completed, limit);
inprogress = dql->num_queued - completed;
prev_inprogress = dql->prev_num_queued - dql->num_completed;
- all_prev_completed = POSDIFF(completed, dql->prev_num_queued);
+ all_prev_completed = AFTER_EQ(completed, dql->prev_num_queued);
if ((ovlimit && !inprogress) ||
(dql->prev_ovlimit && all_prev_completed)) {
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 018/187] bql: Avoid possible inconsistent calculation.
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (11 preceding siblings ...)
2012-07-12 22:32 ` [ 017/187] bql: Avoid unneeded limit decrement Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 019/187] net: sock: validate data_len before allocating skb in sock_alloc_send_pskb() Greg Kroah-Hartman
` (167 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Hiroaki SHIMODA, Tom Herbert,
Eric Dumazet, Denys Fedoryshchenko, Eric Dumazet,
David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
[ Upstream commit 914bec1011a25f65cdc94988a6f974bfb9a3c10d ]
dql->num_queued could change while processing dql_completed().
To provide consistent calculation, added an on stack variable.
Signed-off-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
Cc: Tom Herbert <therbert@google.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Denys Fedoryshchenko <denys@visp.net.lb>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/dynamic_queue_limits.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/lib/dynamic_queue_limits.c
+++ b/lib/dynamic_queue_limits.c
@@ -17,16 +17,18 @@
void dql_completed(struct dql *dql, unsigned int count)
{
unsigned int inprogress, prev_inprogress, limit;
- unsigned int ovlimit, completed;
+ unsigned int ovlimit, completed, num_queued;
bool all_prev_completed;
+ num_queued = ACCESS_ONCE(dql->num_queued);
+
/* Can't complete more than what's in queue */
- BUG_ON(count > dql->num_queued - dql->num_completed);
+ BUG_ON(count > num_queued - dql->num_completed);
completed = dql->num_completed + count;
limit = dql->limit;
- ovlimit = POSDIFF(dql->num_queued - dql->num_completed, limit);
- inprogress = dql->num_queued - completed;
+ ovlimit = POSDIFF(num_queued - dql->num_completed, limit);
+ inprogress = num_queued - completed;
prev_inprogress = dql->prev_num_queued - dql->num_completed;
all_prev_completed = AFTER_EQ(completed, dql->prev_num_queued);
@@ -106,7 +108,7 @@ void dql_completed(struct dql *dql, unsi
dql->prev_ovlimit = ovlimit;
dql->prev_last_obj_cnt = dql->last_obj_cnt;
dql->num_completed = completed;
- dql->prev_num_queued = dql->num_queued;
+ dql->prev_num_queued = num_queued;
}
EXPORT_SYMBOL(dql_completed);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 019/187] net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (12 preceding siblings ...)
2012-07-12 22:32 ` [ 018/187] bql: Avoid possible inconsistent calculation Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 020/187] cipso: handle CIPSO options correctly when NetLabel is disabled Greg Kroah-Hartman
` (166 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Jason Wang, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <jasowang@redhat.com>
[ Upstream commit cc9b17ad29ecaa20bfe426a8d4dbfb94b13ff1cc ]
We need to validate the number of pages consumed by data_len, otherwise frags
array could be overflowed by userspace. So this patch validate data_len and
return -EMSGSIZE when data_len may occupies more frags than MAX_SKB_FRAGS.
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/sock.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1600,6 +1600,11 @@ struct sk_buff *sock_alloc_send_pskb(str
gfp_t gfp_mask;
long timeo;
int err;
+ int npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+
+ err = -EMSGSIZE;
+ if (npages > MAX_SKB_FRAGS)
+ goto failure;
gfp_mask = sk->sk_allocation;
if (gfp_mask & __GFP_WAIT)
@@ -1618,14 +1623,12 @@ struct sk_buff *sock_alloc_send_pskb(str
if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
skb = alloc_skb(header_len, gfp_mask);
if (skb) {
- int npages;
int i;
/* No pages, we're done... */
if (!data_len)
break;
- npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
skb->truesize += data_len;
skb_shinfo(skb)->nr_frags = npages;
for (i = 0; i < npages; i++) {
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 020/187] cipso: handle CIPSO options correctly when NetLabel is disabled
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (13 preceding siblings ...)
2012-07-12 22:32 ` [ 019/187] net: sock: validate data_len before allocating skb in sock_alloc_send_pskb() Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 021/187] r8169: call netif_napi_del at errpaths and at driver unload Greg Kroah-Hartman
` (165 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Paul Moore, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moore <pmoore@redhat.com>
[ Upstream commit 20e2a86485967c385d7c7befc1646e4d1d39362e ]
When NetLabel is not enabled, e.g. CONFIG_NETLABEL=n, and the system
receives a CIPSO tagged packet it is dropped (cipso_v4_validate()
returns non-zero). In most cases this is the correct and desired
behavior, however, in the case where we are simply forwarding the
traffic, e.g. acting as a network bridge, this becomes a problem.
This patch fixes the forwarding problem by providing the basic CIPSO
validation code directly in ip_options_compile() without the need for
the NetLabel or CIPSO code. The new validation code can not perform
any of the CIPSO option label/value verification that
cipso_v4_validate() does, but it can verify the basic CIPSO option
format.
The behavior when NetLabel is enabled is unchanged.
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/cipso_ipv4.h | 29 ++++++++++++++++++++++++++++-
1 file changed, 28 insertions(+), 1 deletion(-)
--- a/include/net/cipso_ipv4.h
+++ b/include/net/cipso_ipv4.h
@@ -42,6 +42,7 @@
#include <net/netlabel.h>
#include <net/request_sock.h>
#include <linux/atomic.h>
+#include <asm/unaligned.h>
/* known doi values */
#define CIPSO_V4_DOI_UNKNOWN 0x00000000
@@ -285,7 +286,33 @@ static inline int cipso_v4_skbuff_getatt
static inline int cipso_v4_validate(const struct sk_buff *skb,
unsigned char **option)
{
- return -ENOSYS;
+ unsigned char *opt = *option;
+ unsigned char err_offset = 0;
+ u8 opt_len = opt[1];
+ u8 opt_iter;
+
+ if (opt_len < 8) {
+ err_offset = 1;
+ goto out;
+ }
+
+ if (get_unaligned_be32(&opt[2]) == 0) {
+ err_offset = 2;
+ goto out;
+ }
+
+ for (opt_iter = 6; opt_iter < opt_len;) {
+ if (opt[opt_iter + 1] > (opt_len - opt_iter)) {
+ err_offset = opt_iter + 1;
+ goto out;
+ }
+ opt_iter += opt[opt_iter + 1];
+ }
+
+out:
+ *option = opt + err_offset;
+ return err_offset;
+
}
#endif /* CONFIG_NETLABEL */
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 021/187] r8169: call netif_napi_del at errpaths and at driver unload
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (14 preceding siblings ...)
2012-07-12 22:32 ` [ 020/187] cipso: handle CIPSO options correctly when NetLabel is disabled Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 022/187] drop_monitor: dont sleep in atomic context Greg Kroah-Hartman
` (164 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Devendra Naga, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devendra Naga <devendra.aaru@gmail.com>
[ Upstream commit ad1be8d345416a794dea39761a374032aa471a76 ]
when register_netdev fails, the init'ed NAPIs by netif_napi_add must be
deleted with netif_napi_del, and also when driver unloads, it should
delete the NAPI before unregistering netdevice using unregister_netdev.
Signed-off-by: Devendra Naga <devendra.aaru@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/realtek/r8169.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -5966,6 +5966,8 @@ static void __devexit rtl_remove_one(str
cancel_work_sync(&tp->wk.work);
+ netif_napi_del(&tp->napi);
+
unregister_netdev(dev);
rtl_release_firmware(tp);
@@ -6288,6 +6290,7 @@ out:
return rc;
err_out_msi_4:
+ netif_napi_del(&tp->napi);
rtl_disable_msi(pdev, tp);
iounmap(ioaddr);
err_out_free_res_3:
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 022/187] drop_monitor: dont sleep in atomic context
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (15 preceding siblings ...)
2012-07-12 22:32 ` [ 021/187] r8169: call netif_napi_del at errpaths and at driver unload Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:32 ` [ 023/187] inetpeer: fix a race in inetpeer_gc_worker() Greg Kroah-Hartman
` (163 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Eric Dumazet, Neil Horman,
David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit bec4596b4e6770c7037f21f6bd27567b152dc0d6 ]
drop_monitor calls several sleeping functions while in atomic context.
BUG: sleeping function called from invalid context at mm/slub.c:943
in_atomic(): 1, irqs_disabled(): 0, pid: 2103, name: kworker/0:2
Pid: 2103, comm: kworker/0:2 Not tainted 3.5.0-rc1+ #55
Call Trace:
[<ffffffff810697ca>] __might_sleep+0xca/0xf0
[<ffffffff811345a3>] kmem_cache_alloc_node+0x1b3/0x1c0
[<ffffffff8105578c>] ? queue_delayed_work_on+0x11c/0x130
[<ffffffff815343fb>] __alloc_skb+0x4b/0x230
[<ffffffffa00b0360>] ? reset_per_cpu_data+0x160/0x160 [drop_monitor]
[<ffffffffa00b022f>] reset_per_cpu_data+0x2f/0x160 [drop_monitor]
[<ffffffffa00b03ab>] send_dm_alert+0x4b/0xb0 [drop_monitor]
[<ffffffff810568e0>] process_one_work+0x130/0x4c0
[<ffffffff81058249>] worker_thread+0x159/0x360
[<ffffffff810580f0>] ? manage_workers.isra.27+0x240/0x240
[<ffffffff8105d403>] kthread+0x93/0xa0
[<ffffffff816be6d4>] kernel_thread_helper+0x4/0x10
[<ffffffff8105d370>] ? kthread_freezable_should_stop+0x80/0x80
[<ffffffff816be6d0>] ? gs_change+0xb/0xb
Rework the logic to call the sleeping functions in right context.
Use standard timer/workqueue api to let system chose any cpu to perform
the allocation and netlink send.
Also avoid a loop if reset_per_cpu_data() cannot allocate memory :
use mod_timer() to wait 1/10 second before next try.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Neil Horman <nhorman@tuxdriver.com>
Reviewed-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/drop_monitor.c | 102 +++++++++++++++---------------------------------
1 file changed, 33 insertions(+), 69 deletions(-)
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -33,9 +33,6 @@
#define TRACE_ON 1
#define TRACE_OFF 0
-static void send_dm_alert(struct work_struct *unused);
-
-
/*
* Globals, our netlink socket pointer
* and the work handle that will send up
@@ -45,11 +42,10 @@ static int trace_state = TRACE_OFF;
static DEFINE_MUTEX(trace_state_mutex);
struct per_cpu_dm_data {
- struct work_struct dm_alert_work;
- struct sk_buff __rcu *skb;
- atomic_t dm_hit_count;
- struct timer_list send_timer;
- int cpu;
+ spinlock_t lock;
+ struct sk_buff *skb;
+ struct work_struct dm_alert_work;
+ struct timer_list send_timer;
};
struct dm_hw_stat_delta {
@@ -75,13 +71,13 @@ static int dm_delay = 1;
static unsigned long dm_hw_check_delta = 2*HZ;
static LIST_HEAD(hw_stats_list);
-static void reset_per_cpu_data(struct per_cpu_dm_data *data)
+static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
{
size_t al;
struct net_dm_alert_msg *msg;
struct nlattr *nla;
struct sk_buff *skb;
- struct sk_buff *oskb = rcu_dereference_protected(data->skb, 1);
+ unsigned long flags;
al = sizeof(struct net_dm_alert_msg);
al += dm_hit_limit * sizeof(struct net_dm_drop_point);
@@ -96,65 +92,40 @@ static void reset_per_cpu_data(struct pe
sizeof(struct net_dm_alert_msg));
msg = nla_data(nla);
memset(msg, 0, al);
- } else
- schedule_work_on(data->cpu, &data->dm_alert_work);
-
- /*
- * Don't need to lock this, since we are guaranteed to only
- * run this on a single cpu at a time.
- * Note also that we only update data->skb if the old and new skb
- * pointers don't match. This ensures that we don't continually call
- * synchornize_rcu if we repeatedly fail to alloc a new netlink message.
- */
- if (skb != oskb) {
- rcu_assign_pointer(data->skb, skb);
-
- synchronize_rcu();
-
- atomic_set(&data->dm_hit_count, dm_hit_limit);
+ } else {
+ mod_timer(&data->send_timer, jiffies + HZ / 10);
}
+ spin_lock_irqsave(&data->lock, flags);
+ swap(data->skb, skb);
+ spin_unlock_irqrestore(&data->lock, flags);
+
+ return skb;
}
-static void send_dm_alert(struct work_struct *unused)
+static void send_dm_alert(struct work_struct *work)
{
struct sk_buff *skb;
- struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data);
+ struct per_cpu_dm_data *data;
- WARN_ON_ONCE(data->cpu != smp_processor_id());
+ data = container_of(work, struct per_cpu_dm_data, dm_alert_work);
- /*
- * Grab the skb we're about to send
- */
- skb = rcu_dereference_protected(data->skb, 1);
+ skb = reset_per_cpu_data(data);
- /*
- * Replace it with a new one
- */
- reset_per_cpu_data(data);
-
- /*
- * Ship it!
- */
if (skb)
genlmsg_multicast(skb, 0, NET_DM_GRP_ALERT, GFP_KERNEL);
-
- put_cpu_var(dm_cpu_data);
}
/*
* This is the timer function to delay the sending of an alert
* in the event that more drops will arrive during the
- * hysteresis period. Note that it operates under the timer interrupt
- * so we don't need to disable preemption here
+ * hysteresis period.
*/
-static void sched_send_work(unsigned long unused)
+static void sched_send_work(unsigned long _data)
{
- struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data);
+ struct per_cpu_dm_data *data = (struct per_cpu_dm_data *)_data;
- schedule_work_on(smp_processor_id(), &data->dm_alert_work);
-
- put_cpu_var(dm_cpu_data);
+ schedule_work(&data->dm_alert_work);
}
static void trace_drop_common(struct sk_buff *skb, void *location)
@@ -164,33 +135,28 @@ static void trace_drop_common(struct sk_
struct nlattr *nla;
int i;
struct sk_buff *dskb;
- struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data);
-
+ struct per_cpu_dm_data *data;
+ unsigned long flags;
- rcu_read_lock();
- dskb = rcu_dereference(data->skb);
+ local_irq_save(flags);
+ data = &__get_cpu_var(dm_cpu_data);
+ spin_lock(&data->lock);
+ dskb = data->skb;
if (!dskb)
goto out;
- if (!atomic_add_unless(&data->dm_hit_count, -1, 0)) {
- /*
- * we're already at zero, discard this hit
- */
- goto out;
- }
-
nlh = (struct nlmsghdr *)dskb->data;
nla = genlmsg_data(nlmsg_data(nlh));
msg = nla_data(nla);
for (i = 0; i < msg->entries; i++) {
if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) {
msg->points[i].count++;
- atomic_inc(&data->dm_hit_count);
goto out;
}
}
-
+ if (msg->entries == dm_hit_limit)
+ goto out;
/*
* We need to create a new entry
*/
@@ -202,13 +168,11 @@ static void trace_drop_common(struct sk_
if (!timer_pending(&data->send_timer)) {
data->send_timer.expires = jiffies + dm_delay * HZ;
- add_timer_on(&data->send_timer, smp_processor_id());
+ add_timer(&data->send_timer);
}
out:
- rcu_read_unlock();
- put_cpu_var(dm_cpu_data);
- return;
+ spin_unlock_irqrestore(&data->lock, flags);
}
static void trace_kfree_skb_hit(void *ignore, struct sk_buff *skb, void *location)
@@ -406,11 +370,11 @@ static int __init init_net_drop_monitor(
for_each_present_cpu(cpu) {
data = &per_cpu(dm_cpu_data, cpu);
- data->cpu = cpu;
INIT_WORK(&data->dm_alert_work, send_dm_alert);
init_timer(&data->send_timer);
- data->send_timer.data = cpu;
+ data->send_timer.data = (unsigned long)data;
data->send_timer.function = sched_send_work;
+ spin_lock_init(&data->lock);
reset_per_cpu_data(data);
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 023/187] inetpeer: fix a race in inetpeer_gc_worker()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (16 preceding siblings ...)
2012-07-12 22:32 ` [ 022/187] drop_monitor: dont sleep in atomic context Greg Kroah-Hartman
@ 2012-07-12 22:32 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 024/187] net: l2tp_eth: fix kernel panic on rmmod l2tp_eth Greg Kroah-Hartman
` (162 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Eric Dumazet, Steffen Klassert,
David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 55432d2b543a4b6dfae54f5c432a566877a85d90 ]
commit 5faa5df1fa2024 (inetpeer: Invalidate the inetpeer tree along with
the routing cache) added a race :
Before freeing an inetpeer, we must respect a RCU grace period, and make
sure no user will attempt to increase refcnt.
inetpeer_invalidate_tree() waits for a RCU grace period before inserting
inetpeer tree into gc_list and waking the worker. At that time, no
concurrent lookup can find a inetpeer in this tree.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/inetpeer.h | 5 ++++-
net/ipv4/inetpeer.c | 16 ++++++++++++----
2 files changed, 16 insertions(+), 5 deletions(-)
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -40,7 +40,10 @@ struct inet_peer {
u32 pmtu_orig;
u32 pmtu_learned;
struct inetpeer_addr_base redirect_learned;
- struct list_head gc_list;
+ union {
+ struct list_head gc_list;
+ struct rcu_head gc_rcu;
+ };
/*
* Once inet_peer is queued for deletion (refcnt == -1), following fields
* are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -560,6 +560,17 @@ bool inet_peer_xrlim_allow(struct inet_p
}
EXPORT_SYMBOL(inet_peer_xrlim_allow);
+static void inetpeer_inval_rcu(struct rcu_head *head)
+{
+ struct inet_peer *p = container_of(head, struct inet_peer, gc_rcu);
+
+ spin_lock_bh(&gc_lock);
+ list_add_tail(&p->gc_list, &gc_list);
+ spin_unlock_bh(&gc_lock);
+
+ schedule_delayed_work(&gc_work, gc_delay);
+}
+
void inetpeer_invalidate_tree(int family)
{
struct inet_peer *old, *new, *prev;
@@ -576,10 +587,7 @@ void inetpeer_invalidate_tree(int family
prev = cmpxchg(&base->root, old, new);
if (prev == old) {
base->total = 0;
- spin_lock(&gc_lock);
- list_add_tail(&prev->gc_list, &gc_list);
- spin_unlock(&gc_lock);
- schedule_delayed_work(&gc_work, gc_delay);
+ call_rcu(&prev->gc_rcu, inetpeer_inval_rcu);
}
out:
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 024/187] net: l2tp_eth: fix kernel panic on rmmod l2tp_eth
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (17 preceding siblings ...)
2012-07-12 22:32 ` [ 023/187] inetpeer: fix a race in inetpeer_gc_worker() Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 025/187] l2tp: fix a race in l2tp_ip_sendmsg() Greg Kroah-Hartman
` (161 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Eric Dumazet,
Denys Fedoryshchenko, James Chapman, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit a06998b88b1651c5f71c0e35f528bf2057188ead ]
We must prevent module unloading if some devices are still attached to
l2tp_eth driver.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Denys Fedoryshchenko <denys@visp.net.lb>
Tested-by: Denys Fedoryshchenko <denys@visp.net.lb>
Cc: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/l2tp/l2tp_eth.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -167,6 +167,7 @@ static void l2tp_eth_delete(struct l2tp_
if (dev) {
unregister_netdev(dev);
spriv->dev = NULL;
+ module_put(THIS_MODULE);
}
}
}
@@ -254,6 +255,7 @@ static int l2tp_eth_create(struct net *n
if (rc < 0)
goto out_del_dev;
+ __module_get(THIS_MODULE);
/* Must be done after register_netdev() */
strlcpy(session->ifname, dev->name, IFNAMSIZ);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 025/187] l2tp: fix a race in l2tp_ip_sendmsg()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (18 preceding siblings ...)
2012-07-12 22:33 ` [ 024/187] net: l2tp_eth: fix kernel panic on rmmod l2tp_eth Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 026/187] lpc_eth: add missing ndo_change_mtu() Greg Kroah-Hartman
` (160 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Eric Dumazet, James Chapman,
Denys Fedoryshchenko, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 4399a4df98a63e30fd16e9d0cecc46ea92269e8f ]
Commit 081b1b1bb27f (l2tp: fix l2tp_ip_sendmsg() route handling) added
a race, in case IP route cache is disabled.
In this case, we should not do the dst_release(&rt->dst), since it'll
free the dst immediately, instead of waiting a RCU grace period.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: James Chapman <jchapman@katalix.com>
Cc: Denys Fedoryshchenko <denys@visp.net.lb>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/l2tp/l2tp_ip.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -516,10 +516,12 @@ static int l2tp_ip_sendmsg(struct kiocb
sk->sk_bound_dev_if);
if (IS_ERR(rt))
goto no_route;
- if (connected)
+ if (connected) {
sk_setup_caps(sk, &rt->dst);
- else
- dst_release(&rt->dst); /* safe since we hold rcu_read_lock */
+ } else {
+ skb_dst_set(skb, &rt->dst);
+ goto xmit;
+ }
}
/* We dont need to clone dst here, it is guaranteed to not disappear.
@@ -527,6 +529,7 @@ static int l2tp_ip_sendmsg(struct kiocb
*/
skb_dst_set_noref(skb, &rt->dst);
+xmit:
/* Queue the packet to IP for output */
rc = ip_queue_xmit(skb, &inet->cork.fl);
rcu_read_unlock();
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 026/187] lpc_eth: add missing ndo_change_mtu()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (19 preceding siblings ...)
2012-07-12 22:33 ` [ 025/187] l2tp: fix a race in l2tp_ip_sendmsg() Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 027/187] lpc_eth: fix tx completion Greg Kroah-Hartman
` (159 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Eric Dumazet, Roland Stigge,
Kevin Wells, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit e30478598a8476d02e3b00caa89ce1a3b1dad54b ]
lpc_eth does a copy of transmitted skbs to DMA area, without checking
skb lengths, so can trigger buffer overflows :
memcpy(pldat->tx_buff_v + txidx * ENET_MAXF_SIZE, skb->data, len);
One way to get bigger skbs is to allow MTU changes above the 1500 limit.
Calling eth_change_mtu() in ndo_change_mtu() makes sure this cannot
happen.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Roland Stigge <stigge@antcom.de>
Cc: Kevin Wells <kevin.wells@nxp.com>
Acked-by: Roland Stigge <stigge@antcom.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/nxp/lpc_eth.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -1310,6 +1310,7 @@ static const struct net_device_ops lpc_n
.ndo_set_rx_mode = lpc_eth_set_multicast_list,
.ndo_do_ioctl = lpc_eth_ioctl,
.ndo_set_mac_address = lpc_set_mac_address,
+ .ndo_change_mtu = eth_change_mtu,
};
static int lpc_eth_drv_probe(struct platform_device *pdev)
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 027/187] lpc_eth: fix tx completion
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (20 preceding siblings ...)
2012-07-12 22:33 ` [ 026/187] lpc_eth: add missing ndo_change_mtu() Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 028/187] net: neighbour: fix neigh_dump_info() Greg Kroah-Hartman
` (158 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Eric Dumazet, Roland Stigge,
Kevin Wells, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 3f16da51b0e533871d22a29682f3c3969d4f7e22 ]
__lpc_handle_xmit() has two bugs :
1) It can leak skbs in case TXSTATUS_ERROR is set
2) It can wake up txqueue while no slot was freed.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Roland Stigge <stigge@antcom.de>
Tested-by: Roland Stigge <stigge@antcom.de>
Cc: Kevin Wells <kevin.wells@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/nxp/lpc_eth.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -936,16 +936,16 @@ static void __lpc_handle_xmit(struct net
/* Update stats */
ndev->stats.tx_packets++;
ndev->stats.tx_bytes += skb->len;
-
- /* Free buffer */
- dev_kfree_skb_irq(skb);
}
+ dev_kfree_skb_irq(skb);
txcidx = readl(LPC_ENET_TXCONSUMEINDEX(pldat->net_base));
}
- if (netif_queue_stopped(ndev))
- netif_wake_queue(ndev);
+ if (pldat->num_used_tx_buffs <= ENET_TX_DESC/2) {
+ if (netif_queue_stopped(ndev))
+ netif_wake_queue(ndev);
+ }
}
static int __lpc_handle_recv(struct net_device *ndev, int budget)
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 028/187] net: neighbour: fix neigh_dump_info()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (21 preceding siblings ...)
2012-07-12 22:33 ` [ 027/187] lpc_eth: fix tx completion Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 029/187] ipv6: fib: Restore NTF_ROUTER exception in fib6_age() Greg Kroah-Hartman
` (157 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Eric Dumazet,
Denys Fedoryshchenko, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 4bd6683bd400c8b1d2ad544bb155d86a5d10f91c ]
Denys found out "ip neigh" output was truncated to
about 54 neighbours.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Denys Fedoryshchenko <denys@visp.net.lb>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/neighbour.c | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2214,9 +2214,7 @@ static int neigh_dump_table(struct neigh
rcu_read_lock_bh();
nht = rcu_dereference_bh(tbl->nht);
- for (h = 0; h < (1 << nht->hash_shift); h++) {
- if (h < s_h)
- continue;
+ for (h = s_h; h < (1 << nht->hash_shift); h++) {
if (h > s_h)
s_idx = 0;
for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
@@ -2255,9 +2253,7 @@ static int pneigh_dump_table(struct neig
read_lock_bh(&tbl->lock);
- for (h = 0; h <= PNEIGH_HASHMASK; h++) {
- if (h < s_h)
- continue;
+ for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
if (h > s_h)
s_idx = 0;
for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
@@ -2292,7 +2288,7 @@ static int neigh_dump_info(struct sk_buf
struct neigh_table *tbl;
int t, family, s_t;
int proxy = 0;
- int err = 0;
+ int err;
read_lock(&neigh_tbl_lock);
family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
@@ -2306,7 +2302,7 @@ static int neigh_dump_info(struct sk_buf
s_t = cb->args[0];
- for (tbl = neigh_tables, t = 0; tbl && (err >= 0);
+ for (tbl = neigh_tables, t = 0; tbl;
tbl = tbl->next, t++) {
if (t < s_t || (family && tbl->family != family))
continue;
@@ -2317,6 +2313,8 @@ static int neigh_dump_info(struct sk_buf
err = pneigh_dump_table(tbl, skb, cb);
else
err = neigh_dump_table(tbl, skb, cb);
+ if (err < 0)
+ break;
}
read_unlock(&neigh_tbl_lock);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 029/187] ipv6: fib: Restore NTF_ROUTER exception in fib6_age()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (22 preceding siblings ...)
2012-07-12 22:33 ` [ 028/187] net: neighbour: fix neigh_dump_info() Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 030/187] ipv6: Move ipv6 proc file registration to end of init order Greg Kroah-Hartman
` (156 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Thomas Graf, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Graf <tgraf@suug.ch>
[ Upstream commit 8bd74516b1bd9308c17f67583134d93f777203ca ]
Commit 5339ab8b1dd82 (ipv6: fib: Convert fib6_age() to
dst_neigh_lookup().) seems to have mistakenly inverted the
exception for cached NTF_ROUTER routes.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_fib.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1560,7 +1560,7 @@ static int fib6_age(struct rt6_info *rt,
neigh_flags = neigh->flags;
neigh_release(neigh);
}
- if (neigh_flags & NTF_ROUTER) {
+ if (!(neigh_flags & NTF_ROUTER)) {
RT6_TRACE("purging route %p via non-router but gateway\n",
rt);
return -1;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 030/187] ipv6: Move ipv6 proc file registration to end of init order
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (23 preceding siblings ...)
2012-07-12 22:33 ` [ 029/187] ipv6: fib: Restore NTF_ROUTER exception in fib6_age() Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 031/187] sky2: fix checksum bit management on some chips Greg Kroah-Hartman
` (155 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Thomas Graf, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Graf <tgraf@suug.ch>
[ Upstream commit d189634ecab947c10f6f832258b103d0bbfe73cc ]
/proc/net/ipv6_route reflects the contents of fib_table_hash. The proc
handler is installed in ip6_route_net_init() whereas fib_table_hash is
allocated in fib6_net_init() _after_ the proc handler has been installed.
This opens up a short time frame to access fib_table_hash with its pants
down.
Move the registration of the proc files to a later point in the init
order to avoid the race.
Tested :-)
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/route.c | 41 +++++++++++++++++++++++++++++++----------
1 file changed, 31 insertions(+), 10 deletions(-)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2953,10 +2953,6 @@ static int __net_init ip6_route_net_init
net->ipv6.sysctl.ip6_rt_mtu_expires = 10*60*HZ;
net->ipv6.sysctl.ip6_rt_min_advmss = IPV6_MIN_MTU - 20 - 40;
-#ifdef CONFIG_PROC_FS
- proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
- proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
-#endif
net->ipv6.ip6_rt_gc_expire = 30*HZ;
ret = 0;
@@ -2977,10 +2973,6 @@ out_ip6_dst_ops:
static void __net_exit ip6_route_net_exit(struct net *net)
{
-#ifdef CONFIG_PROC_FS
- proc_net_remove(net, "ipv6_route");
- proc_net_remove(net, "rt6_stats");
-#endif
kfree(net->ipv6.ip6_null_entry);
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
kfree(net->ipv6.ip6_prohibit_entry);
@@ -2989,11 +2981,33 @@ static void __net_exit ip6_route_net_exi
dst_entries_destroy(&net->ipv6.ip6_dst_ops);
}
+static int __net_init ip6_route_net_init_late(struct net *net)
+{
+#ifdef CONFIG_PROC_FS
+ proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
+ proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
+#endif
+ return 0;
+}
+
+static void __net_exit ip6_route_net_exit_late(struct net *net)
+{
+#ifdef CONFIG_PROC_FS
+ proc_net_remove(net, "ipv6_route");
+ proc_net_remove(net, "rt6_stats");
+#endif
+}
+
static struct pernet_operations ip6_route_net_ops = {
.init = ip6_route_net_init,
.exit = ip6_route_net_exit,
};
+static struct pernet_operations ip6_route_net_late_ops = {
+ .init = ip6_route_net_init_late,
+ .exit = ip6_route_net_exit_late,
+};
+
static struct notifier_block ip6_route_dev_notifier = {
.notifier_call = ip6_route_dev_notify,
.priority = 0,
@@ -3043,19 +3057,25 @@ int __init ip6_route_init(void)
if (ret)
goto xfrm6_init;
+ ret = register_pernet_subsys(&ip6_route_net_late_ops);
+ if (ret)
+ goto fib6_rules_init;
+
ret = -ENOBUFS;
if (__rtnl_register(PF_INET6, RTM_NEWROUTE, inet6_rtm_newroute, NULL, NULL) ||
__rtnl_register(PF_INET6, RTM_DELROUTE, inet6_rtm_delroute, NULL, NULL) ||
__rtnl_register(PF_INET6, RTM_GETROUTE, inet6_rtm_getroute, NULL, NULL))
- goto fib6_rules_init;
+ goto out_register_late_subsys;
ret = register_netdevice_notifier(&ip6_route_dev_notifier);
if (ret)
- goto fib6_rules_init;
+ goto out_register_late_subsys;
out:
return ret;
+out_register_late_subsys:
+ unregister_pernet_subsys(&ip6_route_net_late_ops);
fib6_rules_init:
fib6_rules_cleanup();
xfrm6_init:
@@ -3074,6 +3094,7 @@ out_kmem_cache:
void ip6_route_cleanup(void)
{
unregister_netdevice_notifier(&ip6_route_dev_notifier);
+ unregister_pernet_subsys(&ip6_route_net_late_ops);
fib6_rules_cleanup();
xfrm6_fini();
fib6_gc_cleanup();
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 031/187] sky2: fix checksum bit management on some chips
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (24 preceding siblings ...)
2012-07-12 22:33 ` [ 030/187] ipv6: Move ipv6 proc file registration to end of init order Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 032/187] Revert "niu: Add support for byte queue limits." Greg Kroah-Hartman
` (154 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Kirill Smelkov, Stephen Hemminger,
David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: stephen hemminger <shemminger@vyatta.com>
[ Upstream commit 5ff0feac88ced864f44adb145142269196fa79d9 ]
The newer flavors of Yukon II use a different method for receive
checksum offload. This is indicated in the driver by the SKY2_HW_NEW_LE
flag. On these newer chips, the BMU_ENA_RX_CHKSUM should not be set.
The driver would get incorrectly toggle the bit, enabling the old
checksum logic on these chips and cause a BUG_ON() assertion. If
receive checksum was toggled via ethtool.
Reported-by: Kirill Smelkov <kirr@mns.spb.ru>
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/marvell/sky2.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -4381,10 +4381,12 @@ static int sky2_set_features(struct net_
struct sky2_port *sky2 = netdev_priv(dev);
netdev_features_t changed = dev->features ^ features;
- if (changed & NETIF_F_RXCSUM) {
- bool on = features & NETIF_F_RXCSUM;
- sky2_write32(sky2->hw, Q_ADDR(rxqaddr[sky2->port], Q_CSR),
- on ? BMU_ENA_RX_CHKSUM : BMU_DIS_RX_CHKSUM);
+ if ((changed & NETIF_F_RXCSUM) &&
+ !(sky2->hw->flags & SKY2_HW_NEW_LE)) {
+ sky2_write32(sky2->hw,
+ Q_ADDR(rxqaddr[sky2->port], Q_CSR),
+ (features & NETIF_F_RXCSUM)
+ ? BMU_ENA_RX_CHKSUM : BMU_DIS_RX_CHKSUM);
}
if (changed & NETIF_F_RXHASH)
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 032/187] Revert "niu: Add support for byte queue limits."
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (25 preceding siblings ...)
2012-07-12 22:33 ` [ 031/187] sky2: fix checksum bit management on some chips Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 033/187] be2net: fix a race in be_xmit() Greg Kroah-Hartman
` (153 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "David S. Miller" <davem@davemloft.net>
[ Upstream commit 6a2b28ef036ab5c66fdc606fe97d9e5cb34ea409 ]
This reverts commit efa230f2c68abab817f13473077f8d0cc74f43f3.
BQL doesn't work with how this driver currently only takes TX
interrupts every 1/4 of the TX ring. That behavior needs to be fixed,
but that's a larger non-trivial task and for now we have to revert
BQL support as this makes the device currently completely unusable.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/sun/niu.c | 12 +-----------
1 file changed, 1 insertion(+), 11 deletions(-)
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -3598,7 +3598,6 @@ static int release_tx_packet(struct niu
static void niu_tx_work(struct niu *np, struct tx_ring_info *rp)
{
struct netdev_queue *txq;
- unsigned int tx_bytes;
u16 pkt_cnt, tmp;
int cons, index;
u64 cs;
@@ -3621,18 +3620,12 @@ static void niu_tx_work(struct niu *np,
netif_printk(np, tx_done, KERN_DEBUG, np->dev,
"%s() pkt_cnt[%u] cons[%d]\n", __func__, pkt_cnt, cons);
- tx_bytes = 0;
- tmp = pkt_cnt;
- while (tmp--) {
- tx_bytes += rp->tx_buffs[cons].skb->len;
+ while (pkt_cnt--)
cons = release_tx_packet(np, rp, cons);
- }
rp->cons = cons;
smp_mb();
- netdev_tx_completed_queue(txq, pkt_cnt, tx_bytes);
-
out:
if (unlikely(netif_tx_queue_stopped(txq) &&
(niu_tx_avail(rp) > NIU_TX_WAKEUP_THRESH(rp)))) {
@@ -4333,7 +4326,6 @@ static void niu_free_channels(struct niu
struct tx_ring_info *rp = &np->tx_rings[i];
niu_free_tx_ring_info(np, rp);
- netdev_tx_reset_queue(netdev_get_tx_queue(np->dev, i));
}
kfree(np->tx_rings);
np->tx_rings = NULL;
@@ -6739,8 +6731,6 @@ static netdev_tx_t niu_start_xmit(struct
prod = NEXT_TX(rp, prod);
}
- netdev_tx_sent_queue(txq, skb->len);
-
if (prod < rp->prod)
rp->wrap_bit ^= TX_RING_KICK_WRAP;
rp->prod = prod;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 033/187] be2net: fix a race in be_xmit()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (26 preceding siblings ...)
2012-07-12 22:33 ` [ 032/187] Revert "niu: Add support for byte queue limits." Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 034/187] dummy: fix rcu_sched self-detected stalls Greg Kroah-Hartman
` (152 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Eric Dumazet, Sathya Perla,
David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit cd8f76c0a0c6fce0b2cf23c9bd0123f91453f46d ]
As soon as hardware is notified of a transmit, we no longer can assume
skb can be dereferenced, as TX completion might have freed the packet.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Sathya Perla <sathya.perla@emulex.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/emulex/benet/be_main.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -731,6 +731,8 @@ static netdev_tx_t be_xmit(struct sk_buf
copied = make_tx_wrbs(adapter, txq, skb, wrb_cnt, dummy_wrb);
if (copied) {
+ int gso_segs = skb_shinfo(skb)->gso_segs;
+
/* record the sent skb in the sent_skb table */
BUG_ON(txo->sent_skb_list[start]);
txo->sent_skb_list[start] = skb;
@@ -748,8 +750,7 @@ static netdev_tx_t be_xmit(struct sk_buf
be_txq_notify(adapter, txq->id, wrb_cnt);
- be_tx_stats_update(txo, wrb_cnt, copied,
- skb_shinfo(skb)->gso_segs, stopped);
+ be_tx_stats_update(txo, wrb_cnt, copied, gso_segs, stopped);
} else {
txq->head = start;
dev_kfree_skb_any(skb);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 034/187] dummy: fix rcu_sched self-detected stalls
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (27 preceding siblings ...)
2012-07-12 22:33 ` [ 033/187] be2net: fix a race in be_xmit() Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 035/187] bonding: Fix corrupted queue_mapping Greg Kroah-Hartman
` (151 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Eric Dumazet, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 16b0dc29c1af9df341428f4c49ada4f626258082 ]
Trying to "modprobe dummy numdummies=30000" triggers :
INFO: rcu_sched self-detected stall on CPU { 8} (t=60000 jiffies)
After this splat, RTNL is locked and reboot is needed.
We must call cond_resched() to avoid this, even holding RTNL.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/dummy.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
@@ -187,8 +187,10 @@ static int __init dummy_init_module(void
rtnl_lock();
err = __rtnl_link_register(&dummy_link_ops);
- for (i = 0; i < numdummies && !err; i++)
+ for (i = 0; i < numdummies && !err; i++) {
err = dummy_init_one();
+ cond_resched();
+ }
if (err < 0)
__rtnl_link_unregister(&dummy_link_ops);
rtnl_unlock();
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 035/187] bonding: Fix corrupted queue_mapping
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (28 preceding siblings ...)
2012-07-12 22:33 ` [ 034/187] dummy: fix rcu_sched self-detected stalls Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 036/187] netpoll: fix netpoll_send_udp() bugs Greg Kroah-Hartman
` (150 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Eric Dumazet, Tom Herbert,
John Fastabend, Roland Dreier, Neil Horman, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 5ee31c6898ea5537fcea160999d60dc63bc0c305 ]
In the transmit path of the bonding driver, skb->cb is used to
stash the skb->queue_mapping so that the bonding device can set its
own queue mapping. This value becomes corrupted since the skb->cb is
also used in __dev_xmit_skb.
When transmitting through bonding driver, bond_select_queue is
called from dev_queue_xmit. In bond_select_queue the original
skb->queue_mapping is copied into skb->cb (via bond_queue_mapping)
and skb->queue_mapping is overwritten with the bond driver queue.
Subsequently in dev_queue_xmit, __dev_xmit_skb is called which writes
the packet length into skb->cb, thereby overwriting the stashed
queue mappping. In bond_dev_queue_xmit (called from hard_start_xmit),
the queue mapping for the skb is set to the stashed value which is now
the skb length and hence is an invalid queue for the slave device.
If we want to save skb->queue_mapping into skb->cb[], best place is to
add a field in struct qdisc_skb_cb, to make sure it wont conflict with
other layers (eg : Qdiscc, Infiniband...)
This patchs also makes sure (struct qdisc_skb_cb)->data is aligned on 8
bytes :
netem qdisc for example assumes it can store an u64 in it, without
misalignment penalty.
Note : we only have 20 bytes left in (struct qdisc_skb_cb)->data[].
The largest user is CHOKe and it fills it.
Based on a previous patch from Tom Herbert.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Tom Herbert <therbert@google.com>
Cc: John Fastabend <john.r.fastabend@intel.com>
Cc: Roland Dreier <roland@kernel.org>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/bonding/bond_main.c | 9 +++++----
include/net/sch_generic.h | 7 +++++--
2 files changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -76,6 +76,7 @@
#include <net/route.h>
#include <net/net_namespace.h>
#include <net/netns/generic.h>
+#include <net/pkt_sched.h>
#include "bonding.h"
#include "bond_3ad.h"
#include "bond_alb.h"
@@ -381,8 +382,6 @@ struct vlan_entry *bond_next_vlan(struct
return next;
}
-#define bond_queue_mapping(skb) (*(u16 *)((skb)->cb))
-
/**
* bond_dev_queue_xmit - Prepare skb for xmit.
*
@@ -395,7 +394,9 @@ int bond_dev_queue_xmit(struct bonding *
{
skb->dev = slave_dev;
- skb->queue_mapping = bond_queue_mapping(skb);
+ BUILD_BUG_ON(sizeof(skb->queue_mapping) !=
+ sizeof(qdisc_skb_cb(skb)->bond_queue_mapping));
+ skb->queue_mapping = qdisc_skb_cb(skb)->bond_queue_mapping;
if (unlikely(netpoll_tx_running(slave_dev)))
bond_netpoll_send_skb(bond_get_slave_by_dev(bond, slave_dev), skb);
@@ -4162,7 +4163,7 @@ static u16 bond_select_queue(struct net_
/*
* Save the original txq to restore before passing to the driver
*/
- bond_queue_mapping(skb) = skb->queue_mapping;
+ qdisc_skb_cb(skb)->bond_queue_mapping = skb->queue_mapping;
if (unlikely(txq >= dev->real_num_tx_queues)) {
do {
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -220,13 +220,16 @@ struct tcf_proto {
struct qdisc_skb_cb {
unsigned int pkt_len;
- unsigned char data[24];
+ u16 bond_queue_mapping;
+ u16 _pad;
+ unsigned char data[20];
};
static inline void qdisc_cb_private_validate(const struct sk_buff *skb, int sz)
{
struct qdisc_skb_cb *qcb;
- BUILD_BUG_ON(sizeof(skb->cb) < sizeof(unsigned int) + sz);
+
+ BUILD_BUG_ON(sizeof(skb->cb) < offsetof(struct qdisc_skb_cb, data) + sz);
BUILD_BUG_ON(sizeof(qcb->data) < sz);
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 036/187] netpoll: fix netpoll_send_udp() bugs
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (29 preceding siblings ...)
2012-07-12 22:33 ` [ 035/187] bonding: Fix corrupted queue_mapping Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 037/187] bnx2x: fix checksum validation Greg Kroah-Hartman
` (149 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Bogdan Hamciuc, Eric Dumazet,
Herbert Xu, Neil Horman, Cong Wang, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 954fba0274058d27c7c07b5ea07c41b3b7477894 ]
Bogdan Hamciuc diagnosed and fixed following bug in netpoll_send_udp() :
"skb->len += len;" instead of "skb_put(skb, len);"
Meaning that _if_ a network driver needs to call skb_realloc_headroom(),
only packet headers would be copied, leaving garbage in the payload.
However the skb_realloc_headroom() must be avoided as much as possible
since it requires memory and netpoll tries hard to work even if memory
is exhausted (using a pool of preallocated skbs)
It appears netpoll_send_udp() reserved 16 bytes for the ethernet header,
which happens to work for typicall drivers but not all.
Right thing is to use LL_RESERVED_SPACE(dev)
(And also add dev->needed_tailroom of tailroom)
This patch combines both fixes.
Many thanks to Bogdan for raising this issue.
Reported-by: Bogdan Hamciuc <bogdan.hamciuc@freescale.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Bogdan Hamciuc <bogdan.hamciuc@freescale.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Neil Horman <nhorman@tuxdriver.com>
Reviewed-by: Neil Horman <nhorman@tuxdriver.com>
Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/netpoll.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -362,22 +362,23 @@ EXPORT_SYMBOL(netpoll_send_skb_on_dev);
void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
{
- int total_len, eth_len, ip_len, udp_len;
+ int total_len, ip_len, udp_len;
struct sk_buff *skb;
struct udphdr *udph;
struct iphdr *iph;
struct ethhdr *eth;
udp_len = len + sizeof(*udph);
- ip_len = eth_len = udp_len + sizeof(*iph);
- total_len = eth_len + ETH_HLEN + NET_IP_ALIGN;
+ ip_len = udp_len + sizeof(*iph);
+ total_len = ip_len + LL_RESERVED_SPACE(np->dev);
- skb = find_skb(np, total_len, total_len - len);
+ skb = find_skb(np, total_len + np->dev->needed_tailroom,
+ total_len - len);
if (!skb)
return;
skb_copy_to_linear_data(skb, msg, len);
- skb->len += len;
+ skb_put(skb, len);
skb_push(skb, sizeof(*udph));
skb_reset_transport_header(skb);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 037/187] bnx2x: fix checksum validation
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (30 preceding siblings ...)
2012-07-12 22:33 ` [ 036/187] netpoll: fix netpoll_send_udp() bugs Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 038/187] bnx2x: fix panic when TX ring is full Greg Kroah-Hartman
` (148 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Eric Dumazet, Eilon Greenstein,
Yaniv Rosner, Merav Sicron, Tom Herbert, Robert Evans,
Willem de Bruijn, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit d6cb3e41386f20fb0777d0b59a2def82c65d37f7 ]
bnx2x driver incorrectly sets ip_summed to CHECKSUM_UNNECESSARY on
encapsulated segments. TCP stack happily accepts frames with bad
checksums, if they are inside a GRE or IPIP encapsulation.
Our understanding is that if no IP or L4 csum validation was done by the
hardware, we should leave ip_summed as is (CHECKSUM_NONE), since
hardware doesn't provide CHECKSUM_COMPLETE support in its cqe.
Then, if IP/L4 checksumming was done by the hardware, set
CHECKSUM_UNNECESSARY if no error was flagged.
Patch based on findings and analysis from Robert Evans
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Eilon Greenstein <eilong@broadcom.com>
Cc: Yaniv Rosner <yanivr@broadcom.com>
Cc: Merav Sicron <meravs@broadcom.com>
Cc: Tom Herbert <therbert@google.com>
Cc: Robert Evans <evansr@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Acked-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 15 -------------
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 27 ++++++++++++++++++------
2 files changed, 21 insertions(+), 21 deletions(-)
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -744,21 +744,6 @@ struct bnx2x_fastpath {
#define ETH_RX_ERROR_FALGS ETH_FAST_PATH_RX_CQE_PHY_DECODE_ERR_FLG
-#define BNX2X_IP_CSUM_ERR(cqe) \
- (!((cqe)->fast_path_cqe.status_flags & \
- ETH_FAST_PATH_RX_CQE_IP_XSUM_NO_VALIDATION_FLG) && \
- ((cqe)->fast_path_cqe.type_error_flags & \
- ETH_FAST_PATH_RX_CQE_IP_BAD_XSUM_FLG))
-
-#define BNX2X_L4_CSUM_ERR(cqe) \
- (!((cqe)->fast_path_cqe.status_flags & \
- ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG) && \
- ((cqe)->fast_path_cqe.type_error_flags & \
- ETH_FAST_PATH_RX_CQE_L4_BAD_XSUM_FLG))
-
-#define BNX2X_RX_CSUM_OK(cqe) \
- (!(BNX2X_L4_CSUM_ERR(cqe) || BNX2X_IP_CSUM_ERR(cqe)))
-
#define BNX2X_PRS_FLAG_OVERETH_IPV4(flags) \
(((le16_to_cpu(flags) & \
PARSING_FLAGS_OVER_ETHERNET_PROTOCOL) >> \
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -568,6 +568,25 @@ drop:
fp->eth_q_stats.rx_skb_alloc_failed++;
}
+static void bnx2x_csum_validate(struct sk_buff *skb, union eth_rx_cqe *cqe,
+ struct bnx2x_fastpath *fp)
+{
+ /* Do nothing if no IP/L4 csum validation was done */
+
+ if (cqe->fast_path_cqe.status_flags &
+ (ETH_FAST_PATH_RX_CQE_IP_XSUM_NO_VALIDATION_FLG |
+ ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG))
+ return;
+
+ /* If both IP/L4 validation were done, check if an error was found. */
+
+ if (cqe->fast_path_cqe.type_error_flags &
+ (ETH_FAST_PATH_RX_CQE_IP_BAD_XSUM_FLG |
+ ETH_FAST_PATH_RX_CQE_L4_BAD_XSUM_FLG))
+ fp->eth_q_stats.hw_csum_err++;
+ else
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+}
int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
{
@@ -757,13 +776,9 @@ reuse_rx:
skb_checksum_none_assert(skb);
- if (bp->dev->features & NETIF_F_RXCSUM) {
+ if (bp->dev->features & NETIF_F_RXCSUM)
+ bnx2x_csum_validate(skb, cqe, fp);
- if (likely(BNX2X_RX_CSUM_OK(cqe)))
- skb->ip_summed = CHECKSUM_UNNECESSARY;
- else
- fp->eth_q_stats.hw_csum_err++;
- }
skb_record_rx_queue(skb, fp->rx_queue);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 038/187] bnx2x: fix panic when TX ring is full
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (31 preceding siblings ...)
2012-07-12 22:33 ` [ 037/187] bnx2x: fix checksum validation Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 039/187] net: remove skb_orphan_try() Greg Kroah-Hartman
` (147 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Tomas Hruby, Eric Dumazet,
Eilon Greenstein, Yaniv Rosner, Merav Sicron, Tom Herbert,
Robert Evans, Willem de Bruijn, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit bc14786a100cc6a81cd060e8031ec481241b418c ]
There is a off by one error in the minimal number of BD in
bnx2x_start_xmit() and bnx2x_tx_int() before stopping/resuming tx queue.
A full size GSO packet, with data included in skb->head really needs
(MAX_SKB_FRAGS + 4) BDs, because of bnx2x_tx_split()
This error triggers if BQL is disabled and heavy TCP transmit traffic
occurs.
bnx2x_tx_split() definitely can be called, remove a wrong comment.
Reported-by: Tomas Hruby <thruby@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Eilon Greenstein <eilong@broadcom.com>
Cc: Yaniv Rosner <yanivr@broadcom.com>
Cc: Merav Sicron <meravs@broadcom.com>
Cc: Tom Herbert <therbert@google.com>
Cc: Robert Evans <evansr@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -191,7 +191,7 @@ int bnx2x_tx_int(struct bnx2x *bp, struc
if ((netif_tx_queue_stopped(txq)) &&
(bp->state == BNX2X_STATE_OPEN) &&
- (bnx2x_tx_avail(bp, txdata) >= MAX_SKB_FRAGS + 3))
+ (bnx2x_tx_avail(bp, txdata) >= MAX_SKB_FRAGS + 4))
netif_tx_wake_queue(txq);
__netif_tx_unlock(txq);
@@ -2349,8 +2349,6 @@ int bnx2x_poll(struct napi_struct *napi,
/* we split the first BD into headers and data BDs
* to ease the pain of our fellow microcode engineers
* we use one mapping for both BDs
- * So far this has only been observed to happen
- * in Other Operating Systems(TM)
*/
static noinline u16 bnx2x_tx_split(struct bnx2x *bp,
struct bnx2x_fp_txdata *txdata,
@@ -3002,7 +3000,7 @@ netdev_tx_t bnx2x_start_xmit(struct sk_b
txdata->tx_bd_prod += nbd;
- if (unlikely(bnx2x_tx_avail(bp, txdata) < MAX_SKB_FRAGS + 3)) {
+ if (unlikely(bnx2x_tx_avail(bp, txdata) < MAX_SKB_FRAGS + 4)) {
netif_tx_stop_queue(txq);
/* paired memory barrier is in bnx2x_tx_int(), we have to keep
@@ -3011,7 +3009,7 @@ netdev_tx_t bnx2x_start_xmit(struct sk_b
smp_mb();
fp->eth_q_stats.driver_xoff++;
- if (bnx2x_tx_avail(bp, txdata) >= MAX_SKB_FRAGS + 3)
+ if (bnx2x_tx_avail(bp, txdata) >= MAX_SKB_FRAGS + 4)
netif_tx_wake_queue(txq);
}
txdata->tx_pkt++;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 039/187] net: remove skb_orphan_try()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (32 preceding siblings ...)
2012-07-12 22:33 ` [ 038/187] bnx2x: fix panic when TX ring is full Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 040/187] bridge: Assign rtnl_link_ops to bridge devices created via ioctl (v2) Greg Kroah-Hartman
` (146 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Eric Dumazet, Oliver Hartkopp,
David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 62b1a8ab9b3660bb820d8dfe23148ed6cda38574 ]
Orphaning skb in dev_hard_start_xmit() makes bonding behavior
unfriendly for applications sending big UDP bursts : Once packets
pass the bonding device and come to real device, they might hit a full
qdisc and be dropped. Without orphaning, the sender is automatically
throttled because sk->sk_wmemalloc reaches sk->sk_sndbuf (assuming
sk_sndbuf is not too big)
We could try to defer the orphaning adding another test in
dev_hard_start_xmit(), but all this seems of little gain,
now that BQL tends to make packets more likely to be parked
in Qdisc queues instead of NIC TX ring, in cases where performance
matters.
Reverts commits :
fc6055a5ba31 net: Introduce skb_orphan_try()
87fd308cfc6b net: skb_tx_hash() fix relative to skb_orphan_try()
and removes SKBTX_DRV_NEEDS_SK_REF flag
Reported-and-bisected-by: Jean-Michel Hautbois <jhautbois@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Oliver Hartkopp <socketcan@hartkopp.net>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/skbuff.h | 7 ++-----
net/can/raw.c | 3 ---
net/core/dev.c | 23 +----------------------
net/iucv/af_iucv.c | 1 -
4 files changed, 3 insertions(+), 31 deletions(-)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -225,14 +225,11 @@ enum {
/* device driver is going to provide hardware time stamp */
SKBTX_IN_PROGRESS = 1 << 2,
- /* ensure the originating sk reference is available on driver level */
- SKBTX_DRV_NEEDS_SK_REF = 1 << 3,
-
/* device driver supports TX zero-copy buffers */
- SKBTX_DEV_ZEROCOPY = 1 << 4,
+ SKBTX_DEV_ZEROCOPY = 1 << 3,
/* generate wifi status information (where possible) */
- SKBTX_WIFI_STATUS = 1 << 5,
+ SKBTX_WIFI_STATUS = 1 << 4,
};
/*
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -681,9 +681,6 @@ static int raw_sendmsg(struct kiocb *ioc
if (err < 0)
goto free_skb;
- /* to be able to check the received tx sock reference in raw_rcv() */
- skb_shinfo(skb)->tx_flags |= SKBTX_DRV_NEEDS_SK_REF;
-
skb->dev = dev;
skb->sk = sk;
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2091,25 +2091,6 @@ static int dev_gso_segment(struct sk_buf
return 0;
}
-/*
- * Try to orphan skb early, right before transmission by the device.
- * We cannot orphan skb if tx timestamp is requested or the sk-reference
- * is needed on driver level for other reasons, e.g. see net/can/raw.c
- */
-static inline void skb_orphan_try(struct sk_buff *skb)
-{
- struct sock *sk = skb->sk;
-
- if (sk && !skb_shinfo(skb)->tx_flags) {
- /* skb_tx_hash() wont be able to get sk.
- * We copy sk_hash into skb->rxhash
- */
- if (!skb->rxhash)
- skb->rxhash = sk->sk_hash;
- skb_orphan(skb);
- }
-}
-
static bool can_checksum_protocol(netdev_features_t features, __be16 protocol)
{
return ((features & NETIF_F_GEN_CSUM) ||
@@ -2195,8 +2176,6 @@ int dev_hard_start_xmit(struct sk_buff *
if (!list_empty(&ptype_all))
dev_queue_xmit_nit(skb, dev);
- skb_orphan_try(skb);
-
features = netif_skb_features(skb);
if (vlan_tx_tag_present(skb) &&
@@ -2306,7 +2285,7 @@ u16 __skb_tx_hash(const struct net_devic
if (skb->sk && skb->sk->sk_hash)
hash = skb->sk->sk_hash;
else
- hash = (__force u16) skb->protocol ^ skb->rxhash;
+ hash = (__force u16) skb->protocol;
hash = jhash_1word(hash, hashrnd);
return (u16) (((u64) hash * qcount) >> 32) + qoffset;
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -372,7 +372,6 @@ static int afiucv_hs_send(struct iucv_me
skb_trim(skb, skb->dev->mtu);
}
skb->protocol = ETH_P_AF_IUCV;
- skb_shinfo(skb)->tx_flags |= SKBTX_DRV_NEEDS_SK_REF;
nskb = skb_clone(skb, GFP_ATOMIC);
if (!nskb)
return -ENOMEM;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 040/187] bridge: Assign rtnl_link_ops to bridge devices created via ioctl (v2)
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (33 preceding siblings ...)
2012-07-12 22:33 ` [ 039/187] net: remove skb_orphan_try() Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 041/187] xen/netfront: teardown the device before unregistering it Greg Kroah-Hartman
` (145 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Thomas Graf, Stephen Hemminger,
David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: stephen hemminger <shemminger@vyatta.com>
[ Upstream commit 149ddd83a92b02c658d6c61f3276eb6500d585e8 ]
This ensures that bridges created with brctl(8) or ioctl(2) directly
also carry IFLA_LINKINFO when dumped over netlink. This also allows
to create a bridge with ioctl(2) and delete it with RTM_DELLINK.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/br_if.c | 1 +
net/bridge/br_netlink.c | 2 +-
net/bridge/br_private.h | 1 +
3 files changed, 3 insertions(+), 1 deletion(-)
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -240,6 +240,7 @@ int br_add_bridge(struct net *net, const
return -ENOMEM;
dev_net_set(dev, net);
+ dev->rtnl_link_ops = &br_link_ops;
res = register_netdev(dev);
if (res)
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -211,7 +211,7 @@ static int br_validate(struct nlattr *tb
return 0;
}
-static struct rtnl_link_ops br_link_ops __read_mostly = {
+struct rtnl_link_ops br_link_ops __read_mostly = {
.kind = "bridge",
.priv_size = sizeof(struct net_bridge),
.setup = br_dev_setup,
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -538,6 +538,7 @@ extern int (*br_fdb_test_addr_hook)(stru
#endif
/* br_netlink.c */
+extern struct rtnl_link_ops br_link_ops;
extern int br_netlink_init(void);
extern void br_netlink_fini(void);
extern void br_ifinfo_notify(int event, struct net_bridge_port *port);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 041/187] xen/netfront: teardown the device before unregistering it.
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (34 preceding siblings ...)
2012-07-12 22:33 ` [ 040/187] bridge: Assign rtnl_link_ops to bridge devices created via ioctl (v2) Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 042/187] mm: fix slab->page _count corruption when using slub Greg Kroah-Hartman
` (144 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, George Shuklin, Ian Campbell,
William Dauchy, David S. Miller, stable, 675190
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Campbell <Ian.Campbell@citrix.com>
[ Upstream commit 6bc96d047fe32d76ef79f3195c52a542edf7c705 ]
Fixes:
[ 15.470311] WARNING: at /local/scratch/ianc/devel/kernels/linux/fs/sysfs/file.c:498 sysfs_attr_ns+0x95/0xa0()
[ 15.470326] sysfs: kobject eth0 without dirent
[ 15.470333] Modules linked in:
[ 15.470342] Pid: 12, comm: xenwatch Not tainted 3.4.0-x86_32p-xenU #93
and
[ 9.150554] BUG: unable to handle kernel paging request at 2b359000
[ 9.150577] IP: [<c1279561>] linkwatch_do_dev+0x81/0xc0
[ 9.150592] *pdpt = 000000002c3c9027 *pde = 0000000000000000
[ 9.150604] Oops: 0002 [#1] SMP
[ 9.150613] Modules linked in:
This is http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=675190
Reported-by: George Shuklin <george.shuklin@gmail.com>
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Tested-by: William Dauchy <wdauchy@gmail.com>
Cc: stable@kernel.org
Cc: 675190@bugs.debian.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/xen-netfront.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1935,14 +1935,14 @@ static int __devexit xennet_remove(struc
dev_dbg(&dev->dev, "%s\n", dev->nodename);
- unregister_netdev(info->netdev);
-
xennet_disconnect_backend(info);
- del_timer_sync(&info->rx_refill_timer);
-
xennet_sysfs_delif(info->netdev);
+ unregister_netdev(info->netdev);
+
+ del_timer_sync(&info->rx_refill_timer);
+
free_percpu(info->stats);
free_netdev(info->netdev);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 042/187] mm: fix slab->page _count corruption when using slub
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (35 preceding siblings ...)
2012-07-12 22:33 ` [ 041/187] xen/netfront: teardown the device before unregistering it Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 043/187] powerpc: More fixes for lazy IRQ vs. idle Greg Kroah-Hartman
` (143 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Amey Bhide, Pravin B Shelar,
Christoph Lameter, Pekka Enberg, Andrea Arcangeli
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pravin B Shelar <pshelar@nicira.com>
commit abca7c4965845924f65d40e0aa1092bdd895e314 upstream.
On arches that do not support this_cpu_cmpxchg_double() slab_lock is used
to do atomic cmpxchg() on double word which contains page->_count. The
page count can be changed from get_page() or put_page() without taking
slab_lock. That corrupts page counter.
Fix it by moving page->_count out of cmpxchg_double data. So that slub
does no change it while updating slub meta-data in struct page.
[akpm@linux-foundation.org: use standard comment layout, tweak comment text]
Reported-by: Amey Bhide <abhide@nicira.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Acked-by: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@cs.helsinki.fi>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/mm_types.h | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -56,8 +56,18 @@ struct page {
};
union {
+#if defined(CONFIG_HAVE_CMPXCHG_DOUBLE) && \
+ defined(CONFIG_HAVE_ALIGNED_STRUCT_PAGE)
/* Used for cmpxchg_double in slub */
unsigned long counters;
+#else
+ /*
+ * Keep _count separate from slub cmpxchg_double data.
+ * As the rest of the double word is protected by
+ * slab_lock but _count is not.
+ */
+ unsigned counters;
+#endif
struct {
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 043/187] powerpc: More fixes for lazy IRQ vs. idle
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (36 preceding siblings ...)
2012-07-12 22:33 ` [ 042/187] mm: fix slab->page _count corruption when using slub Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 044/187] powerpc: Fix build of some debug irq code Greg Kroah-Hartman
` (142 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Benjamin Herrenschmidt
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
commit be2cf20a5ad31ebb13562c1c866ecc626fbd721e upstream.
Looks like we still have issues with pSeries and Cell idle code
vs. the lazy irq state. In fact, the reset fixes that went upstream
are exposing the problem more by causing BUG_ON() to trigger (which
this patch turns into a WARN_ON instead).
We need to be careful when using a variant of low power state that
has the side effect of turning interrupts back on, to properly set
all the SW & lazy state to look as if everything is enabled before
we enter the low power state with MSR:EE off as we will return with
MSR:EE on. If not, we have a discrepancy of state which can cause
things to go very wrong later on.
This patch moves the logic into a helper and uses it from the
pseries and cell idle code. The power4/970 idle code already got
things right (in assembly even !) so I'm not touching it. The power7
"bare metal" idle code is subtly different and correct. Remains PA6T
and some hypervisor based Cell platforms which have questionable
code in there, but they are mostly dead platforms so I'll fix them
when I manage to get final answers from the respective maintainers
about how the low power state actually works on them.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/hw_irq.h | 2 +
arch/powerpc/kernel/irq.c | 46 ++++++++++++++++++++++++
arch/powerpc/platforms/cell/pervasive.c | 11 +++--
arch/powerpc/platforms/pseries/processor_idle.c | 17 +++++---
4 files changed, 64 insertions(+), 12 deletions(-)
--- a/arch/powerpc/include/asm/hw_irq.h
+++ b/arch/powerpc/include/asm/hw_irq.h
@@ -124,6 +124,8 @@ static inline bool arch_irq_disabled_reg
return !regs->softe;
}
+extern bool prep_irq_for_idle(void);
+
#else /* CONFIG_PPC64 */
#define SET_MSR_EE(x) mtmsr(x)
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -286,6 +286,52 @@ void notrace restore_interrupts(void)
__hard_irq_enable();
}
+/*
+ * This is a helper to use when about to go into idle low-power
+ * when the latter has the side effect of re-enabling interrupts
+ * (such as calling H_CEDE under pHyp).
+ *
+ * You call this function with interrupts soft-disabled (this is
+ * already the case when ppc_md.power_save is called). The function
+ * will return whether to enter power save or just return.
+ *
+ * In the former case, it will have notified lockdep of interrupts
+ * being re-enabled and generally sanitized the lazy irq state,
+ * and in the latter case it will leave with interrupts hard
+ * disabled and marked as such, so the local_irq_enable() call
+ * in cpu_idle() will properly re-enable everything.
+ */
+bool prep_irq_for_idle(void)
+{
+ /*
+ * First we need to hard disable to ensure no interrupt
+ * occurs before we effectively enter the low power state
+ */
+ hard_irq_disable();
+
+ /*
+ * If anything happened while we were soft-disabled,
+ * we return now and do not enter the low power state.
+ */
+ if (lazy_irq_pending())
+ return false;
+
+ /* Tell lockdep we are about to re-enable */
+ trace_hardirqs_on();
+
+ /*
+ * Mark interrupts as soft-enabled and clear the
+ * PACA_IRQ_HARD_DIS from the pending mask since we
+ * are about to hard enable as well as a side effect
+ * of entering the low power state.
+ */
+ local_paca->irq_happened &= ~PACA_IRQ_HARD_DIS;
+ local_paca->soft_enabled = 1;
+
+ /* Tell the caller to enter the low power state */
+ return true;
+}
+
#endif /* CONFIG_PPC64 */
int arch_show_interrupts(struct seq_file *p, int prec)
--- a/arch/powerpc/platforms/cell/pervasive.c
+++ b/arch/powerpc/platforms/cell/pervasive.c
@@ -42,11 +42,9 @@ static void cbe_power_save(void)
{
unsigned long ctrl, thread_switch_control;
- /*
- * We need to hard disable interrupts, the local_irq_enable() done by
- * our caller upon return will hard re-enable.
- */
- hard_irq_disable();
+ /* Ensure our interrupt state is properly tracked */
+ if (!prep_irq_for_idle())
+ return;
ctrl = mfspr(SPRN_CTRLF);
@@ -81,6 +79,9 @@ static void cbe_power_save(void)
*/
ctrl &= ~(CTRL_RUNLATCH | CTRL_TE);
mtspr(SPRN_CTRLT, ctrl);
+
+ /* Re-enable interrupts in MSR */
+ __hard_irq_enable();
}
static int cbe_system_reset_exception(struct pt_regs *regs)
--- a/arch/powerpc/platforms/pseries/processor_idle.c
+++ b/arch/powerpc/platforms/pseries/processor_idle.c
@@ -99,15 +99,18 @@ out:
static void check_and_cede_processor(void)
{
/*
- * Interrupts are soft-disabled at this point,
- * but not hard disabled. So an interrupt might have
- * occurred before entering NAP, and would be potentially
- * lost (edge events, decrementer events, etc...) unless
- * we first hard disable then check.
+ * Ensure our interrupt state is properly tracked,
+ * also checks if no interrupt has occurred while we
+ * were soft-disabled
*/
- hard_irq_disable();
- if (!lazy_irq_pending())
+ if (prep_irq_for_idle()) {
cede_processor();
+#ifdef CONFIG_TRACE_IRQFLAGS
+ /* Ensure that H_CEDE returns with IRQs on */
+ if (WARN_ON(!(mfmsr() & MSR_EE)))
+ __hard_irq_enable();
+#endif
+ }
}
static int dedicated_cede_loop(struct cpuidle_device *dev,
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 044/187] powerpc: Fix build of some debug irq code
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (37 preceding siblings ...)
2012-07-12 22:33 ` [ 043/187] powerpc: More fixes for lazy IRQ vs. idle Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 045/187] NFC: Return from rawsock_release when sk is NULL Greg Kroah-Hartman
` (141 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Benjamin Herrenschmidt
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
commit 21b2de341270bd7bb7a811027ffe63276d9b3b75 upstream.
There was a typo, checking for CONFIG_TRACE_IRQFLAG instead of
CONFIG_TRACE_IRQFLAGS causing some useful debug code to not be
built
This in turns causes a build error on BookE 64-bit due to incorrect
semicolons at the end of a couple of macros, so let's fix that too
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/hw_irq.h | 4 ++--
arch/powerpc/kernel/irq.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
--- a/arch/powerpc/include/asm/hw_irq.h
+++ b/arch/powerpc/include/asm/hw_irq.h
@@ -85,8 +85,8 @@ static inline bool arch_irqs_disabled(vo
}
#ifdef CONFIG_PPC_BOOK3E
-#define __hard_irq_enable() asm volatile("wrteei 1" : : : "memory");
-#define __hard_irq_disable() asm volatile("wrteei 0" : : : "memory");
+#define __hard_irq_enable() asm volatile("wrteei 1" : : : "memory")
+#define __hard_irq_disable() asm volatile("wrteei 0" : : : "memory")
#else
#define __hard_irq_enable() __mtmsrd(local_paca->kernel_msr | MSR_EE, 1)
#define __hard_irq_disable() __mtmsrd(local_paca->kernel_msr, 1)
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -229,7 +229,7 @@ notrace void arch_local_irq_restore(unsi
*/
if (unlikely(irq_happened != PACA_IRQ_HARD_DIS))
__hard_irq_disable();
-#ifdef CONFIG_TRACE_IRQFLAG
+#ifdef CONFIG_TRACE_IRQFLAGS
else {
/*
* We should already be hard disabled here. We had bugs
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 045/187] NFC: Return from rawsock_release when sk is NULL
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (38 preceding siblings ...)
2012-07-12 22:33 ` [ 044/187] powerpc: Fix build of some debug irq code Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 046/187] NFC: Prevent multiple buffer overflows in NCI Greg Kroah-Hartman
` (140 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Sasha Levin, Eric Dumazet, Samuel Ortiz
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 03e934f620101ca2cfc9383bd76172dd3e1f8567 upstream.
Sasha Levin reported following panic :
[ 2136.383310] BUG: unable to handle kernel NULL pointer dereference at
00000000000003b0
[ 2136.384022] IP: [<ffffffff8114e400>] __lock_acquire+0xc0/0x4b0
[ 2136.384022] PGD 131c4067 PUD 11c0c067 PMD 0
[ 2136.388106] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 2136.388106] CPU 1
[ 2136.388106] Pid: 24855, comm: trinity-child1 Tainted: G W
3.5.0-rc2-sasha-00015-g7b268f7 #374
[ 2136.388106] RIP: 0010:[<ffffffff8114e400>] [<ffffffff8114e400>]
__lock_acquire+0xc0/0x4b0
[ 2136.388106] RSP: 0018:ffff8800130b3ca8 EFLAGS: 00010046
[ 2136.388106] RAX: 0000000000000086 RBX: ffff88001186b000 RCX:
0000000000000000
[ 2136.388106] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
0000000000000000
[ 2136.388106] RBP: ffff8800130b3d08 R08: 0000000000000001 R09:
0000000000000000
[ 2136.388106] R10: 0000000000000000 R11: 0000000000000001 R12:
0000000000000002
[ 2136.388106] R13: 00000000000003b0 R14: 0000000000000000 R15:
0000000000000000
[ 2136.388106] FS: 00007fa5b1bd4700(0000) GS:ffff88001b800000(0000)
knlGS:0000000000000000
[ 2136.388106] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2136.388106] CR2: 00000000000003b0 CR3: 0000000011d1f000 CR4:
00000000000406e0
[ 2136.388106] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[ 2136.388106] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7:
0000000000000400
[ 2136.388106] Process trinity-child1 (pid: 24855, threadinfo
ffff8800130b2000, task ffff88001186b000)
[ 2136.388106] Stack:
[ 2136.388106] ffff8800130b3cd8 ffffffff81121785 ffffffff81236774
000080d000000001
[ 2136.388106] ffff88001b9d6c00 00000000001d6c00 ffffffff130b3d08
ffff88001186b000
[ 2136.388106] 0000000000000000 0000000000000002 0000000000000000
0000000000000000
[ 2136.388106] Call Trace:
[ 2136.388106] [<ffffffff81121785>] ? sched_clock_local+0x25/0x90
[ 2136.388106] [<ffffffff81236774>] ? get_empty_filp+0x74/0x220
[ 2136.388106] [<ffffffff8114e97a>] lock_acquire+0x18a/0x1e0
[ 2136.388106] [<ffffffff836b37df>] ? rawsock_release+0x4f/0xa0
[ 2136.388106] [<ffffffff837c0ef0>] _raw_write_lock_bh+0x40/0x80
[ 2136.388106] [<ffffffff836b37df>] ? rawsock_release+0x4f/0xa0
[ 2136.388106] [<ffffffff836b37df>] rawsock_release+0x4f/0xa0
[ 2136.388106] [<ffffffff8321cfe8>] sock_release+0x18/0x70
[ 2136.388106] [<ffffffff8321d069>] sock_close+0x29/0x30
[ 2136.388106] [<ffffffff81236bca>] __fput+0x11a/0x2c0
[ 2136.388106] [<ffffffff81236d85>] fput+0x15/0x20
[ 2136.388106] [<ffffffff8321de34>] sys_accept4+0x1b4/0x200
[ 2136.388106] [<ffffffff837c165c>] ? _raw_spin_unlock_irq+0x4c/0x80
[ 2136.388106] [<ffffffff837c1669>] ? _raw_spin_unlock_irq+0x59/0x80
[ 2136.388106] [<ffffffff837c2565>] ? sysret_check+0x22/0x5d
[ 2136.388106] [<ffffffff8321de8b>] sys_accept+0xb/0x10
[ 2136.388106] [<ffffffff837c2539>] system_call_fastpath+0x16/0x1b
[ 2136.388106] Code: ec 04 00 0f 85 ea 03 00 00 be d5 0b 00 00 48 c7 c7
8a c1 40 84 e8 b1 a5 f8 ff 31 c0 e9 d4 03 00 00 66 2e 0f 1f 84 00 00 00
00 00 <49> 81 7d 00 60 73 5e 85 b8 01 00 00 00 44 0f 44 e0 83 fe 01 77
[ 2136.388106] RIP [<ffffffff8114e400>] __lock_acquire+0xc0/0x4b0
[ 2136.388106] RSP <ffff8800130b3ca8>
[ 2136.388106] CR2: 00000000000003b0
[ 2136.388106] ---[ end trace 6d450e935ee18982 ]---
[ 2136.388106] Kernel panic - not syncing: Fatal exception in interrupt
rawsock_release() should test if sock->sk is NULL before calling
sock_orphan()/sock_put()
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Tested-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/nfc/rawsock.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -54,7 +54,10 @@ static int rawsock_release(struct socket
{
struct sock *sk = sock->sk;
- pr_debug("sock=%p\n", sock);
+ pr_debug("sock=%p sk=%p\n", sock, sk);
+
+ if (!sk)
+ return 0;
sock_orphan(sk);
sock_put(sk);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 046/187] NFC: Prevent multiple buffer overflows in NCI
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (39 preceding siblings ...)
2012-07-12 22:33 ` [ 045/187] NFC: Return from rawsock_release when sk is NULL Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 047/187] hwmon: (applesmc) Limit key length in warning messages Greg Kroah-Hartman
` (139 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Dan Rosenberg,
Lauro Ramos Venancio, Aloisio Almeida Jr, Samuel Ortiz,
David S. Miller, Ilan Elias, security
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Rosenberg <dan.j.rosenberg@gmail.com>
commit 67de956ff5dc1d4f321e16cfbd63f5be3b691b43 upstream.
Fix multiple remotely-exploitable stack-based buffer overflows due to
the NCI code pulling length fields directly from incoming frames and
copying too much data into statically-sized arrays.
Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Cc: security@kernel.org
Cc: Lauro Ramos Venancio <lauro.venancio@openbossa.org>
Cc: Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
Cc: Samuel Ortiz <sameo@linux.intel.com>
Cc: David S. Miller <davem@davemloft.net>
Acked-by: Ilan Elias <ilane@ti.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/nfc/nci/ntf.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/net/nfc/nci/ntf.c
+++ b/net/nfc/nci/ntf.c
@@ -106,7 +106,7 @@ static __u8 *nci_extract_rf_params_nfca_
nfca_poll->sens_res = __le16_to_cpu(*((__u16 *)data));
data += 2;
- nfca_poll->nfcid1_len = *data++;
+ nfca_poll->nfcid1_len = min_t(__u8, *data++, NFC_NFCID1_MAXSIZE);
pr_debug("sens_res 0x%x, nfcid1_len %d\n",
nfca_poll->sens_res, nfca_poll->nfcid1_len);
@@ -130,7 +130,7 @@ static __u8 *nci_extract_rf_params_nfcb_
struct rf_tech_specific_params_nfcb_poll *nfcb_poll,
__u8 *data)
{
- nfcb_poll->sensb_res_len = *data++;
+ nfcb_poll->sensb_res_len = min_t(__u8, *data++, NFC_SENSB_RES_MAXSIZE);
pr_debug("sensb_res_len %d\n", nfcb_poll->sensb_res_len);
@@ -145,7 +145,7 @@ static __u8 *nci_extract_rf_params_nfcf_
__u8 *data)
{
nfcf_poll->bit_rate = *data++;
- nfcf_poll->sensf_res_len = *data++;
+ nfcf_poll->sensf_res_len = min_t(__u8, *data++, NFC_SENSF_RES_MAXSIZE);
pr_debug("bit_rate %d, sensf_res_len %d\n",
nfcf_poll->bit_rate, nfcf_poll->sensf_res_len);
@@ -331,7 +331,7 @@ static int nci_extract_activation_params
switch (ntf->activation_rf_tech_and_mode) {
case NCI_NFC_A_PASSIVE_POLL_MODE:
nfca_poll = &ntf->activation_params.nfca_poll_iso_dep;
- nfca_poll->rats_res_len = *data++;
+ nfca_poll->rats_res_len = min_t(__u8, *data++, 20);
pr_debug("rats_res_len %d\n", nfca_poll->rats_res_len);
if (nfca_poll->rats_res_len > 0) {
memcpy(nfca_poll->rats_res,
@@ -341,7 +341,7 @@ static int nci_extract_activation_params
case NCI_NFC_B_PASSIVE_POLL_MODE:
nfcb_poll = &ntf->activation_params.nfcb_poll_iso_dep;
- nfcb_poll->attrib_res_len = *data++;
+ nfcb_poll->attrib_res_len = min_t(__u8, *data++, 50);
pr_debug("attrib_res_len %d\n", nfcb_poll->attrib_res_len);
if (nfcb_poll->attrib_res_len > 0) {
memcpy(nfcb_poll->attrib_res,
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 047/187] hwmon: (applesmc) Limit key length in warning messages
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (40 preceding siblings ...)
2012-07-12 22:33 ` [ 046/187] NFC: Prevent multiple buffer overflows in NCI Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 048/187] staging: r8712u: Add new USB IDs Greg Kroah-Hartman
` (138 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Henrik Rydberg, Guenter Roeck
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Henrik Rydberg <rydberg@euromail.se>
commit ac852edb47b15900886ba2564eeeb13b3b526e3e upstream.
Key lookups may call read_smc() with a fixed-length key string,
and if the lookup fails, trailing stack content may appear in the
kernel log. Fixed with this patch.
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/applesmc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -215,7 +215,7 @@ static int read_smc(u8 cmd, const char *
int i;
if (send_command(cmd) || send_argument(key)) {
- pr_warn("%s: read arg fail\n", key);
+ pr_warn("%.4s: read arg fail\n", key);
return -EIO;
}
@@ -223,7 +223,7 @@ static int read_smc(u8 cmd, const char *
for (i = 0; i < len; i++) {
if (__wait_status(0x05)) {
- pr_warn("%s: read data fail\n", key);
+ pr_warn("%.4s: read data fail\n", key);
return -EIO;
}
buffer[i] = inb(APPLESMC_DATA_PORT);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 048/187] staging: r8712u: Add new USB IDs
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (41 preceding siblings ...)
2012-07-12 22:33 ` [ 047/187] hwmon: (applesmc) Limit key length in warning messages Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 049/187] nilfs2: ensure proper cache clearing for gc-inodes Greg Kroah-Hartman
` (137 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Larry Finger
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lubomir Schmidt <gentoo.lubomir@googlemail.com>
commit 3026b0e942c65c65c8fc80d391d004228b52b916 upstream.
There are two new devices for this driver.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8712/usb_intf.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/staging/rtl8712/usb_intf.c
+++ b/drivers/staging/rtl8712/usb_intf.c
@@ -102,6 +102,8 @@ static struct usb_device_id rtl871x_usb_
/* - */
{USB_DEVICE(0x20F4, 0x646B)},
{USB_DEVICE(0x083A, 0xC512)},
+ {USB_DEVICE(0x25D4, 0x4CA1)},
+ {USB_DEVICE(0x25D4, 0x4CAB)},
/* RTL8191SU */
/* Realtek */
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 049/187] nilfs2: ensure proper cache clearing for gc-inodes
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (42 preceding siblings ...)
2012-07-12 22:33 ` [ 048/187] staging: r8712u: Add new USB IDs Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 050/187] udf: Use ret instead of abusing i in udf_load_logicalvol() Greg Kroah-Hartman
` (136 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Ryusuke Konishi
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
commit fbb24a3a915f105016f1c828476be11aceac8504 upstream.
A gc-inode is a pseudo inode used to buffer the blocks to be moved by
garbage collection.
Block caches of gc-inodes must be cleared every time a garbage collection
function (nilfs_clean_segments) completes. Otherwise, stale blocks
buffered in the caches may be wrongly reused in successive calls of the GC
function.
For user files, this is not a problem because their gc-inodes are
distinguished by a checkpoint number as well as an inode number. They
never buffer different blocks if either an inode number, a checkpoint
number, or a block offset differs.
However, gc-inodes of sufile, cpfile and DAT file can store different data
for the same block offset. Thus, the nilfs_clean_segments function can
move incorrect block for these meta-data files if an old block is cached.
I found this is really causing meta-data corruption in nilfs.
This fixes the issue by ensuring cache clear of gc-inodes and resolves
reported GC problems including checkpoint file corruption, b-tree
corruption, and the following warning during GC.
nilfs_palloc_freev: entry number 307234 already freed.
...
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/gcinode.c | 2 ++
fs/nilfs2/segment.c | 2 ++
2 files changed, 4 insertions(+)
--- a/fs/nilfs2/gcinode.c
+++ b/fs/nilfs2/gcinode.c
@@ -191,6 +191,8 @@ void nilfs_remove_all_gcinodes(struct th
while (!list_empty(head)) {
ii = list_first_entry(head, struct nilfs_inode_info, i_dirty);
list_del_init(&ii->i_dirty);
+ truncate_inode_pages(&ii->vfs_inode.i_data, 0);
+ nilfs_btnode_cache_clear(&ii->i_btnode_cache);
iput(&ii->vfs_inode);
}
}
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2309,6 +2309,8 @@ nilfs_remove_written_gcinodes(struct the
if (!test_bit(NILFS_I_UPDATED, &ii->i_state))
continue;
list_del_init(&ii->i_dirty);
+ truncate_inode_pages(&ii->vfs_inode.i_data, 0);
+ nilfs_btnode_cache_clear(&ii->i_btnode_cache);
iput(&ii->vfs_inode);
}
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 050/187] udf: Use ret instead of abusing i in udf_load_logicalvol()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (43 preceding siblings ...)
2012-07-12 22:33 ` [ 049/187] nilfs2: ensure proper cache clearing for gc-inodes Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 051/187] udf: Avoid run away loop when partition table length is corrupted Greg Kroah-Hartman
` (135 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Jan Kara
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit cb14d340ef1737c24125dd663eff77734a482d47 upstream.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/super.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1233,11 +1233,9 @@ static int udf_load_logicalvol(struct su
BUG_ON(ident != TAG_IDENT_LVD);
lvd = (struct logicalVolDesc *)bh->b_data;
- i = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
- if (i != 0) {
- ret = i;
+ ret = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
+ if (ret)
goto out_bh;
- }
for (i = 0, offset = 0;
i < sbi->s_partitions && offset < le32_to_cpu(lvd->mapTableLength);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 051/187] udf: Avoid run away loop when partition table length is corrupted
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (44 preceding siblings ...)
2012-07-12 22:33 ` [ 050/187] udf: Use ret instead of abusing i in udf_load_logicalvol() Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 052/187] udf: Fortify loading of sparing table Greg Kroah-Hartman
` (134 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Jan Kara
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit adee11b2085bee90bd8f4f52123ffb07882d6256 upstream.
Check provided length of partition table so that (possibly maliciously)
corrupted partition table cannot cause accessing data beyond current buffer.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/super.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1225,6 +1225,7 @@ static int udf_load_logicalvol(struct su
struct genericPartitionMap *gpm;
uint16_t ident;
struct buffer_head *bh;
+ unsigned int table_len;
int ret = 0;
bh = udf_read_tagged(sb, block, block, &ident);
@@ -1232,13 +1233,20 @@ static int udf_load_logicalvol(struct su
return 1;
BUG_ON(ident != TAG_IDENT_LVD);
lvd = (struct logicalVolDesc *)bh->b_data;
+ table_len = le32_to_cpu(lvd->mapTableLength);
+ if (sizeof(*lvd) + table_len > sb->s_blocksize) {
+ udf_err(sb, "error loading logical volume descriptor: "
+ "Partition table too long (%u > %lu)\n", table_len,
+ sb->s_blocksize - sizeof(*lvd));
+ goto out_bh;
+ }
ret = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
if (ret)
goto out_bh;
for (i = 0, offset = 0;
- i < sbi->s_partitions && offset < le32_to_cpu(lvd->mapTableLength);
+ i < sbi->s_partitions && offset < table_len;
i++, offset += gpm->partitionMapLength) {
struct udf_part_map *map = &sbi->s_partmaps[i];
gpm = (struct genericPartitionMap *)
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 052/187] udf: Fortify loading of sparing table
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (45 preceding siblings ...)
2012-07-12 22:33 ` [ 051/187] udf: Avoid run away loop when partition table length is corrupted Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 053/187] iommu/amd: Fix missing iommu_shutdown initialization in passthrough mode Greg Kroah-Hartman
` (133 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Jan Kara
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 upstream.
Add sanity checks when loading sparing table from disk to avoid accessing
unallocated memory or writing to it.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/super.c | 86 +++++++++++++++++++++++++++++++++++----------------------
1 file changed, 53 insertions(+), 33 deletions(-)
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -56,6 +56,7 @@
#include <linux/seq_file.h>
#include <linux/bitmap.h>
#include <linux/crc-itu-t.h>
+#include <linux/log2.h>
#include <asm/byteorder.h>
#include "udf_sb.h"
@@ -1215,11 +1216,59 @@ out_bh:
return ret;
}
+static int udf_load_sparable_map(struct super_block *sb,
+ struct udf_part_map *map,
+ struct sparablePartitionMap *spm)
+{
+ uint32_t loc;
+ uint16_t ident;
+ struct sparingTable *st;
+ struct udf_sparing_data *sdata = &map->s_type_specific.s_sparing;
+ int i;
+ struct buffer_head *bh;
+
+ map->s_partition_type = UDF_SPARABLE_MAP15;
+ sdata->s_packet_len = le16_to_cpu(spm->packetLength);
+ if (!is_power_of_2(sdata->s_packet_len)) {
+ udf_err(sb, "error loading logical volume descriptor: "
+ "Invalid packet length %u\n",
+ (unsigned)sdata->s_packet_len);
+ return -EIO;
+ }
+ if (spm->numSparingTables > 4) {
+ udf_err(sb, "error loading logical volume descriptor: "
+ "Too many sparing tables (%d)\n",
+ (int)spm->numSparingTables);
+ return -EIO;
+ }
+
+ for (i = 0; i < spm->numSparingTables; i++) {
+ loc = le32_to_cpu(spm->locSparingTable[i]);
+ bh = udf_read_tagged(sb, loc, loc, &ident);
+ if (!bh)
+ continue;
+
+ st = (struct sparingTable *)bh->b_data;
+ if (ident != 0 ||
+ strncmp(st->sparingIdent.ident, UDF_ID_SPARING,
+ strlen(UDF_ID_SPARING)) ||
+ sizeof(*st) + le16_to_cpu(st->reallocationTableLen) >
+ sb->s_blocksize) {
+ brelse(bh);
+ continue;
+ }
+
+ sdata->s_spar_map[i] = bh;
+ }
+ map->s_partition_func = udf_get_pblock_spar15;
+ return 0;
+}
+
static int udf_load_logicalvol(struct super_block *sb, sector_t block,
struct kernel_lb_addr *fileset)
{
struct logicalVolDesc *lvd;
- int i, j, offset;
+ int i, offset;
uint8_t type;
struct udf_sb_info *sbi = UDF_SB(sb);
struct genericPartitionMap *gpm;
@@ -1281,38 +1330,9 @@ static int udf_load_logicalvol(struct su
} else if (!strncmp(upm2->partIdent.ident,
UDF_ID_SPARABLE,
strlen(UDF_ID_SPARABLE))) {
- uint32_t loc;
- struct sparingTable *st;
- struct sparablePartitionMap *spm =
- (struct sparablePartitionMap *)gpm;
-
- map->s_partition_type = UDF_SPARABLE_MAP15;
- map->s_type_specific.s_sparing.s_packet_len =
- le16_to_cpu(spm->packetLength);
- for (j = 0; j < spm->numSparingTables; j++) {
- struct buffer_head *bh2;
-
- loc = le32_to_cpu(
- spm->locSparingTable[j]);
- bh2 = udf_read_tagged(sb, loc, loc,
- &ident);
- map->s_type_specific.s_sparing.
- s_spar_map[j] = bh2;
-
- if (bh2 == NULL)
- continue;
-
- st = (struct sparingTable *)bh2->b_data;
- if (ident != 0 || strncmp(
- st->sparingIdent.ident,
- UDF_ID_SPARING,
- strlen(UDF_ID_SPARING))) {
- brelse(bh2);
- map->s_type_specific.s_sparing.
- s_spar_map[j] = NULL;
- }
- }
- map->s_partition_func = udf_get_pblock_spar15;
+ if (udf_load_sparable_map(sb, map,
+ (struct sparablePartitionMap *)gpm) < 0)
+ goto out_bh;
} else if (!strncmp(upm2->partIdent.ident,
UDF_ID_METADATA,
strlen(UDF_ID_METADATA))) {
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 053/187] iommu/amd: Fix missing iommu_shutdown initialization in passthrough mode
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (46 preceding siblings ...)
2012-07-12 22:33 ` [ 052/187] udf: Fortify loading of sparing table Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 054/187] iommu/amd: Initialize dma_ops for hotplug and sriov devices Greg Kroah-Hartman
` (132 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Shuah Khan, Joerg Roedel
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuah Khan <shuah.khan@hp.com>
commit f2f12b6fc032c7b1419fd6db84e2868b5f05a878 upstream.
The iommu_shutdown callback is not initialized when the AMD
IOMMU driver runs in passthrough mode. Fix that by moving
the callback initialization before the check for
passthrough mode.
Signed-off-by: Shuah Khan <shuah.khan@hp.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/amd_iommu_init.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -1641,6 +1641,8 @@ static int __init amd_iommu_init(void)
amd_iommu_init_api();
+ x86_platform.iommu_shutdown = disable_iommus;
+
if (iommu_pass_through)
goto out;
@@ -1649,8 +1651,6 @@ static int __init amd_iommu_init(void)
else
printk(KERN_INFO "AMD-Vi: Lazy IO/TLB flushing enabled\n");
- x86_platform.iommu_shutdown = disable_iommus;
-
out:
return ret;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 054/187] iommu/amd: Initialize dma_ops for hotplug and sriov devices
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (47 preceding siblings ...)
2012-07-12 22:33 ` [ 053/187] iommu/amd: Fix missing iommu_shutdown initialization in passthrough mode Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 055/187] iommu/tegra: smmu: Fix unsleepable memory allocation Greg Kroah-Hartman
` (131 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Stefan Assmann, Joerg Roedel
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <joerg.roedel@amd.com>
commit ac1534a55d1e87d59a21c09c570605933b551480 upstream.
When a device is added to the system at runtime the AMD
IOMMU driver initializes the necessary data structures to
handle translation for it. But it forgets to change the
per-device dma_ops to point to the AMD IOMMU driver. So
mapping actually never happens and all DMA accesses end in
an IO_PAGE_FAULT. Fix this.
Reported-by: Stefan Assmann <sassmann@redhat.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/amd_iommu.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -83,6 +83,8 @@ static struct iommu_ops amd_iommu_ops;
static ATOMIC_NOTIFIER_HEAD(ppr_notifier);
int amd_iommu_max_glx_val = -1;
+static struct dma_map_ops amd_iommu_dma_ops;
+
/*
* general struct to manage commands send to an IOMMU
*/
@@ -2267,6 +2269,13 @@ static int device_change_notifier(struct
list_add_tail(&dma_domain->list, &iommu_pd_list);
spin_unlock_irqrestore(&iommu_pd_list_lock, flags);
+ dev_data = get_dev_data(dev);
+
+ if (!dev_data->passthrough)
+ dev->archdata.dma_ops = &amd_iommu_dma_ops;
+ else
+ dev->archdata.dma_ops = &nommu_dma_ops;
+
break;
case BUS_NOTIFY_DEL_DEVICE:
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 055/187] iommu/tegra: smmu: Fix unsleepable memory allocation
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (48 preceding siblings ...)
2012-07-12 22:33 ` [ 054/187] iommu/amd: Initialize dma_ops for hotplug and sriov devices Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 056/187] rpmsg: avoid premature deallocation of endpoints Greg Kroah-Hartman
` (130 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Hiroshi DOYU, Chris Wright, Joerg Roedel
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hiroshi DOYU <hdoyu@nvidia.com>
commit 8f53dc724a83a0082184fa27df80c25c7df47340 upstream.
allo_pdir() is called in smmu_iommu_domain_init() with spin_lock
held. memory allocations in it have to be atomic/unsleepable.
Signed-off-by: Hiroshi DOYU <hdoyu@nvidia.com>
Reported-by: Chris Wright <chrisw@sous-sol.org>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/tegra-smmu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iommu/tegra-smmu.c
+++ b/drivers/iommu/tegra-smmu.c
@@ -550,13 +550,13 @@ static int alloc_pdir(struct smmu_as *as
return 0;
as->pte_count = devm_kzalloc(smmu->dev,
- sizeof(as->pte_count[0]) * SMMU_PDIR_COUNT, GFP_KERNEL);
+ sizeof(as->pte_count[0]) * SMMU_PDIR_COUNT, GFP_ATOMIC);
if (!as->pte_count) {
dev_err(smmu->dev,
"failed to allocate smmu_device PTE cunters\n");
return -ENOMEM;
}
- as->pdir_page = alloc_page(GFP_KERNEL | __GFP_DMA);
+ as->pdir_page = alloc_page(GFP_ATOMIC | __GFP_DMA);
if (!as->pdir_page) {
dev_err(smmu->dev,
"failed to allocate smmu_device page directory\n");
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 056/187] rpmsg: avoid premature deallocation of endpoints
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (49 preceding siblings ...)
2012-07-12 22:33 ` [ 055/187] iommu/tegra: smmu: Fix unsleepable memory allocation Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 057/187] rpmsg: make sure inflight messages dont invoke just-removed callbacks Greg Kroah-Hartman
` (129 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Fernando Guzman Lugo, Ohad Ben-Cohen
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ohad Ben-Cohen <ohad@wizery.com>
commit 5a081caa0414b9bbb82c17ffab9d6fe66edbb72f upstream.
When an inbound message arrives, the rpmsg core looks up its
associated endpoint and invokes the registered callback.
If a message arrives while its endpoint is being removed (because
the rpmsg driver was removed, or a recovery of a remote processor
has kicked in) we must ensure atomicity, i.e.:
- Either the ept is removed before it is found
or
- The ept is found but will not be freed until the callback returns
This is achieved by maintaining a per-ept reference count, which,
when drops to zero, will trigger deallocation of the ept.
With this in hand, it is now forbidden to directly deallocate
epts once they have been added to the endpoints idr.
Reported-by: Fernando Guzman Lugo <fernando.lugo@ti.com>
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rpmsg/virtio_rpmsg_bus.c | 36 ++++++++++++++++++++++++++++++++++--
include/linux/rpmsg.h | 3 +++
2 files changed, 37 insertions(+), 2 deletions(-)
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -188,6 +188,26 @@ static int rpmsg_uevent(struct device *d
rpdev->id.name);
}
+/**
+ * __ept_release() - deallocate an rpmsg endpoint
+ * @kref: the ept's reference count
+ *
+ * This function deallocates an ept, and is invoked when its @kref refcount
+ * drops to zero.
+ *
+ * Never invoke this function directly!
+ */
+static void __ept_release(struct kref *kref)
+{
+ struct rpmsg_endpoint *ept = container_of(kref, struct rpmsg_endpoint,
+ refcount);
+ /*
+ * At this point no one holds a reference to ept anymore,
+ * so we can directly free it
+ */
+ kfree(ept);
+}
+
/* for more info, see below documentation of rpmsg_create_ept() */
static struct rpmsg_endpoint *__rpmsg_create_ept(struct virtproc_info *vrp,
struct rpmsg_channel *rpdev, rpmsg_rx_cb_t cb,
@@ -206,6 +226,8 @@ static struct rpmsg_endpoint *__rpmsg_cr
return NULL;
}
+ kref_init(&ept->refcount);
+
ept->rpdev = rpdev;
ept->cb = cb;
ept->priv = priv;
@@ -238,7 +260,7 @@ rem_idr:
idr_remove(&vrp->endpoints, request);
free_ept:
mutex_unlock(&vrp->endpoints_lock);
- kfree(ept);
+ kref_put(&ept->refcount, __ept_release);
return NULL;
}
@@ -306,7 +328,7 @@ __rpmsg_destroy_ept(struct virtproc_info
idr_remove(&vrp->endpoints, ept->addr);
mutex_unlock(&vrp->endpoints_lock);
- kfree(ept);
+ kref_put(&ept->refcount, __ept_release);
}
/**
@@ -790,7 +812,13 @@ static void rpmsg_recv_done(struct virtq
/* use the dst addr to fetch the callback of the appropriate user */
mutex_lock(&vrp->endpoints_lock);
+
ept = idr_find(&vrp->endpoints, msg->dst);
+
+ /* let's make sure no one deallocates ept while we use it */
+ if (ept)
+ kref_get(&ept->refcount);
+
mutex_unlock(&vrp->endpoints_lock);
if (ept && ept->cb)
@@ -798,6 +826,10 @@ static void rpmsg_recv_done(struct virtq
else
dev_warn(dev, "msg received with no recepient\n");
+ /* farewell, ept, we don't need you anymore */
+ if (ept)
+ kref_put(&ept->refcount, __ept_release);
+
/* publish the real size of the buffer */
sg_init_one(&sg, msg, RPMSG_BUF_SIZE);
--- a/include/linux/rpmsg.h
+++ b/include/linux/rpmsg.h
@@ -38,6 +38,7 @@
#include <linux/types.h>
#include <linux/device.h>
#include <linux/mod_devicetable.h>
+#include <linux/kref.h>
/* The feature bitmap for virtio rpmsg */
#define VIRTIO_RPMSG_F_NS 0 /* RP supports name service notifications */
@@ -120,6 +121,7 @@ typedef void (*rpmsg_rx_cb_t)(struct rpm
/**
* struct rpmsg_endpoint - binds a local rpmsg address to its user
* @rpdev: rpmsg channel device
+ * @refcount: when this drops to zero, the ept is deallocated
* @cb: rx callback handler
* @addr: local rpmsg address
* @priv: private data for the driver's use
@@ -140,6 +142,7 @@ typedef void (*rpmsg_rx_cb_t)(struct rpm
*/
struct rpmsg_endpoint {
struct rpmsg_channel *rpdev;
+ struct kref refcount;
rpmsg_rx_cb_t cb;
u32 addr;
void *priv;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 057/187] rpmsg: make sure inflight messages dont invoke just-removed callbacks
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (50 preceding siblings ...)
2012-07-12 22:33 ` [ 056/187] rpmsg: avoid premature deallocation of endpoints Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 058/187] cifs: fix parsing of password mount option Greg Kroah-Hartman
` (128 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Fernando Guzman Lugo, Ohad Ben-Cohen
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ohad Ben-Cohen <ohad@wizery.com>
commit 15fd943af50dbc5f7f4de33835795c72595f7bf4 upstream.
When inbound messages arrive, rpmsg core looks up their associated
endpoint (by destination address) and then invokes their callback.
We've made sure that endpoints will never be de-allocated after they
were found by rpmsg core, but we also need to protect against the
(rare) scenario where the rpmsg driver was just removed, and its
callback function isn't available anymore.
This is achieved by introducing a callback mutex, which must be taken
before the callback is invoked, and, obviously, before it is removed.
Reported-by: Fernando Guzman Lugo <fernando.lugo@ti.com>
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rpmsg/virtio_rpmsg_bus.c | 25 +++++++++++++++++++------
include/linux/rpmsg.h | 3 +++
2 files changed, 22 insertions(+), 6 deletions(-)
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -227,6 +227,7 @@ static struct rpmsg_endpoint *__rpmsg_cr
}
kref_init(&ept->refcount);
+ mutex_init(&ept->cb_lock);
ept->rpdev = rpdev;
ept->cb = cb;
@@ -324,10 +325,16 @@ EXPORT_SYMBOL(rpmsg_create_ept);
static void
__rpmsg_destroy_ept(struct virtproc_info *vrp, struct rpmsg_endpoint *ept)
{
+ /* make sure new inbound messages can't find this ept anymore */
mutex_lock(&vrp->endpoints_lock);
idr_remove(&vrp->endpoints, ept->addr);
mutex_unlock(&vrp->endpoints_lock);
+ /* make sure in-flight inbound messages won't invoke cb anymore */
+ mutex_lock(&ept->cb_lock);
+ ept->cb = NULL;
+ mutex_unlock(&ept->cb_lock);
+
kref_put(&ept->refcount, __ept_release);
}
@@ -821,14 +828,20 @@ static void rpmsg_recv_done(struct virtq
mutex_unlock(&vrp->endpoints_lock);
- if (ept && ept->cb)
- ept->cb(ept->rpdev, msg->data, msg->len, ept->priv, msg->src);
- else
- dev_warn(dev, "msg received with no recepient\n");
+ if (ept) {
+ /* make sure ept->cb doesn't go away while we use it */
+ mutex_lock(&ept->cb_lock);
- /* farewell, ept, we don't need you anymore */
- if (ept)
+ if (ept->cb)
+ ept->cb(ept->rpdev, msg->data, msg->len, ept->priv,
+ msg->src);
+
+ mutex_unlock(&ept->cb_lock);
+
+ /* farewell, ept, we don't need you anymore */
kref_put(&ept->refcount, __ept_release);
+ } else
+ dev_warn(dev, "msg received with no recepient\n");
/* publish the real size of the buffer */
sg_init_one(&sg, msg, RPMSG_BUF_SIZE);
--- a/include/linux/rpmsg.h
+++ b/include/linux/rpmsg.h
@@ -39,6 +39,7 @@
#include <linux/device.h>
#include <linux/mod_devicetable.h>
#include <linux/kref.h>
+#include <linux/mutex.h>
/* The feature bitmap for virtio rpmsg */
#define VIRTIO_RPMSG_F_NS 0 /* RP supports name service notifications */
@@ -123,6 +124,7 @@ typedef void (*rpmsg_rx_cb_t)(struct rpm
* @rpdev: rpmsg channel device
* @refcount: when this drops to zero, the ept is deallocated
* @cb: rx callback handler
+ * @cb_lock: must be taken before accessing/changing @cb
* @addr: local rpmsg address
* @priv: private data for the driver's use
*
@@ -144,6 +146,7 @@ struct rpmsg_endpoint {
struct rpmsg_channel *rpdev;
struct kref refcount;
rpmsg_rx_cb_t cb;
+ struct mutex cb_lock;
u32 addr;
void *priv;
};
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 058/187] cifs: fix parsing of password mount option
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (51 preceding siblings ...)
2012-07-12 22:33 ` [ 057/187] rpmsg: make sure inflight messages dont invoke just-removed callbacks Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 060/187] ath9k: Fix a WARNING on suspend/resume with IBSS Greg Kroah-Hartman
` (127 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Suresh Jayaraman, Sachin Prabhu,
Steve French
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suresh Jayaraman <sjayaraman@suse.com>
commit e73f843a3235a19de38359c91586e9eadef12238 upstream.
The double delimiter check that allows a comma in the password parsing code is
unconditional. We set "tmp_end" to the end of the string and we continue to
check for double delimiter. In the case where the password doesn't contain a
comma we end up setting tmp_end to NULL and eventually setting "options" to
"end". This results in the premature termination of the options string and hence
the values of UNCip and UNC are being set to NULL. This results in mount failure
with "Connecting to DFS root not implemented yet" error.
This error is usually not noticable as we have password as the last option in
the superblock mountdata. But when we call expand_dfs_referral() from
cifs_mount() and try to compose mount options for the submount, the resulting
mountdata will be of the form
",ver=1,user=foo,pass=bar,ip=x.x.x.x,unc=\\server\share"
and hence results in the above error. This bug has been seen with older NAS
servers running Samba 3.0.24.
Fix this by moving the double delimiter check inside the conditional loop.
Changes since -v1
- removed the wrong strlen() micro optimization.
Signed-off-by: Suresh Jayaraman <sjayaraman@suse.com>
Acked-by: Sachin Prabhu <sprabhu@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/connect.c | 32 +++++++++++++++++---------------
1 file changed, 17 insertions(+), 15 deletions(-)
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1585,24 +1585,26 @@ cifs_parse_mount_options(const char *mou
* If yes, we have encountered a double deliminator
* reset the NULL character to the deliminator
*/
- if (tmp_end < end && tmp_end[1] == delim)
+ if (tmp_end < end && tmp_end[1] == delim) {
tmp_end[0] = delim;
- /* Keep iterating until we get to a single deliminator
- * OR the end
- */
- while ((tmp_end = strchr(tmp_end, delim)) != NULL &&
- (tmp_end[1] == delim)) {
- tmp_end = (char *) &tmp_end[2];
- }
+ /* Keep iterating until we get to a single
+ * deliminator OR the end
+ */
+ while ((tmp_end = strchr(tmp_end, delim))
+ != NULL && (tmp_end[1] == delim)) {
+ tmp_end = (char *) &tmp_end[2];
+ }
- /* Reset var options to point to next element */
- if (tmp_end) {
- tmp_end[0] = '\0';
- options = (char *) &tmp_end[1];
- } else
- /* Reached the end of the mount option string */
- options = end;
+ /* Reset var options to point to next element */
+ if (tmp_end) {
+ tmp_end[0] = '\0';
+ options = (char *) &tmp_end[1];
+ } else
+ /* Reached the end of the mount option
+ * string */
+ options = end;
+ }
/* Now build new password string */
temp_len = strlen(value);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 060/187] ath9k: Fix a WARNING on suspend/resume with IBSS
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (52 preceding siblings ...)
2012-07-12 22:33 ` [ 058/187] cifs: fix parsing of password mount option Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 061/187] ath9k: Fix softlockup in AR9485 Greg Kroah-Hartman
` (126 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Rajkumar Manoharan,
Mohammed Shafi Shajakhan, John W. Linville
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
commit 2031b4c2b4904f7448ab9e4bc6b9bf16e32709f5 upstream.
this patch is dependent on the patch "cfg80211: fix interface
combinations"
In ath9k currently we have ADHOC interface as a single incompatible
interface. when drv_add_interface is called during resume we got to
consider number of vifs already present in addition to checking the
drivers 'opmode' information about ADHOC. we incorrectly assume
an ADHOC interface is already present. Then we may miss some driver
specific data for the ADHOC interface after resume.
The above mentioned checks can be removed from the driver,
as the patch 'cfg80211: fix interface combinations' ensures that
if an interface type is not advertised by the driver in any of the
interface combinations(via ieee80211_iface_combination) then it shall
be treated as a single incompatible interface. Fixes the following
warning on suspend/resume with ibss interface.
ath: phy0: Cannot create ADHOC interface when other
interfaces already exist.
WARNING: at net/mac80211/driver-ops.h:12
ieee80211_reconfig+0x1882/0x1ca0 [mac80211]()
Hardware name: 2842RK1
wlan2: Failed check-sdata-in-driver check, flags: 0x0
Call Trace:
[<c01361b2>] warn_slowpath_common+0x72/0xa0
[<f8aaa7c2>] ? ieee80211_reconfig+0x1882/0x1ca0
[mac80211]
[<f8aaa7c2>] ? ieee80211_reconfig+0x1882/0x1ca0
[mac80211]
[<c0136283>] warn_slowpath_fmt+0x33/0x40
[<f8aaa7c2>] ieee80211_reconfig+0x1882/0x1ca0 [mac80211]
[<c06c1d1a>] ? mutex_lock_nested+0x23a/0x2f0
[<f8a95097>] ieee80211_resume+0x27/0x70 [mac80211]
[<fd177edf>] wiphy_resume+0x8f/0xa0 [cfg80211]
Cc: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/main.c | 9 ---------
1 file changed, 9 deletions(-)
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1419,15 +1419,6 @@ static int ath9k_add_interface(struct ie
}
}
- if ((ah->opmode == NL80211_IFTYPE_ADHOC) ||
- ((vif->type == NL80211_IFTYPE_ADHOC) &&
- sc->nvifs > 0)) {
- ath_err(common, "Cannot create ADHOC interface when other"
- " interfaces already exist.\n");
- ret = -EINVAL;
- goto out;
- }
-
ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
sc->nvifs++;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 061/187] ath9k: Fix softlockup in AR9485
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (53 preceding siblings ...)
2012-07-12 22:33 ` [ 060/187] ath9k: Fix a WARNING on suspend/resume with IBSS Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 062/187] ath9k: fix a tx rate duration calculation bug Greg Kroah-Hartman
` (125 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Rolf Offermanns,
Mohammed Shafi Shajakhan, John W. Linville
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
commit bcb7ad7bcbef030e6ba71ede1f9866368aca7c99 upstream.
steps to recreate:
load latest ath9k driver with AR9485
stop the network-manager and wpa_supplicant
bring the interface up
Call Trace:
[<ffffffffa0517490>] ? ath_hw_check+0xe0/0xe0 [ath9k]
[<ffffffff812cd1e8>] __const_udelay+0x28/0x30
[<ffffffffa03bae7a>] ar9003_get_pll_sqsum_dvc+0x4a/0x80 [ath9k_hw]
[<ffffffffa05174eb>] ath_hw_pll_work+0x5b/0xe0 [ath9k]
[<ffffffff810744fe>] process_one_work+0x11e/0x470
[<ffffffff8107530f>] worker_thread+0x15f/0x360
[<ffffffff810751b0>] ? manage_workers+0x230/0x230
[<ffffffff81079af3>] kthread+0x93/0xa0
[<ffffffff815fd3a4>] kernel_thread_helper+0x4/0x10
[<ffffffff81079a60>] ? kthread_freezable_should_stop+0x70/0x70
[<ffffffff815fd3a0>] ? gs_change+0x13/0x13
ensure that the PLL-WAR for AR9485/AR9340 is executed only if the STA is
associated (or) IBSS/AP mode had started beaconing. Ideally this WAR
is needed to recover from some rare beacon stuck during stress testing.
Before the STA is associated/IBSS had started beaconing, PLL4(0x1618c)
always seem to have zero even though we had configured PLL3(0x16188) to
query about PLL's locking status. When we keep on polling infinitely PLL4's
8th bit(ie check for PLL locking measurements is done), machine hangs
due to softlockup.
fixes https://bugzilla.redhat.com/show_bug.cgi?id=811142
Reported-by: Rolf Offermanns <rolf.offermanns@gmx.net>
Tested-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/main.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -960,6 +960,15 @@ void ath_hw_pll_work(struct work_struct
hw_pll_work.work);
u32 pll_sqsum;
+ /*
+ * ensure that the PLL WAR is executed only
+ * after the STA is associated (or) if the
+ * beaconing had started in interfaces that
+ * uses beacons.
+ */
+ if (!(sc->sc_flags & SC_OP_BEACONS))
+ return;
+
if (AR_SREV_9485(sc->sc_ah)) {
ath9k_ps_wakeup(sc);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 062/187] ath9k: fix a tx rate duration calculation bug
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (54 preceding siblings ...)
2012-07-12 22:33 ` [ 061/187] ath9k: Fix softlockup in AR9485 Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` =?y?q?=5B=20063/187=5D=20ath9k=3A=20fix=20invalid=20pointer=20access=20in=20the=20tx=20path?= Greg Kroah-Hartman
` (124 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Felix Fietkau, John W. Linville
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@openwrt.org>
commit 76591bea9714a58d8924154068c78d702eb2cb17 upstream.
The rate pointer variable for a rate series is used in a loop before it is
initialized. This went unnoticed because it was used earlier for the RTS/CTS
rate. This bug can lead to the wrong PHY type being passed to the
duration calculation function.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/xmit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1001,13 +1001,13 @@ static void ath_buf_set_rate(struct ath_
}
/* legacy rates */
+ rate = &sc->sbands[tx_info->band].bitrates[rates[i].idx];
if ((tx_info->band == IEEE80211_BAND_2GHZ) &&
!(rate->flags & IEEE80211_RATE_ERP_G))
phy = WLAN_RC_PHY_CCK;
else
phy = WLAN_RC_PHY_OFDM;
- rate = &sc->sbands[tx_info->band].bitrates[rates[i].idx];
info->rates[i].Rate = rate->hw_value;
if (rate->hw_value_short) {
if (rates[i].flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
^ permalink raw reply [flat|nested] 191+ messages in thread* =?y?q?=5B=20063/187=5D=20ath9k=3A=20fix=20invalid=20pointer=20access=20in=20the=20tx=20path?=
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (55 preceding siblings ...)
2012-07-12 22:33 ` [ 062/187] ath9k: fix a tx rate duration calculation bug Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 064/187] ath9k_hw: avoid possible infinite loop in ar9003_get_pll_sqsum_dvc Greg Kroah-Hartman
` (123 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Felix Fietkau, Thomas Hühn,
Sujith Manoharan, John W. Linville
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=y, Size: 3520 bytes --]
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@openwrt.org>
commit 80b08a8d8829a58b5db14b1417151094cc28face upstream.
After setup_frame_info has been called, only info->control.rates is still
valid, other control fields have been overwritten by the ath_frame_info
data. Move the access to info->control.vif for checking short preamble
to setup_frame_info before it gets overwritten.
This regression was introduced in commit d47a61aa
"ath9k: Fix multi-VIF BSS handling"
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Reported-by: Thomas Hühn <thomas@net.t-labs.tu-berlin.de>
Acked-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/ath9k.h | 1 +
drivers/net/wireless/ath/ath9k/xmit.c | 29 +++++++++++++++++------------
2 files changed, 18 insertions(+), 12 deletions(-)
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -213,6 +213,7 @@ struct ath_frame_info {
enum ath9k_key_type keytype;
u8 keyix;
u8 retries;
+ u8 rtscts_rate;
};
struct ath_buf_state {
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -938,6 +938,7 @@ static void ath_buf_set_rate(struct ath_
struct ieee80211_tx_rate *rates;
const struct ieee80211_rate *rate;
struct ieee80211_hdr *hdr;
+ struct ath_frame_info *fi = get_frame_info(bf->bf_mpdu);
int i;
u8 rix = 0;
@@ -948,18 +949,7 @@ static void ath_buf_set_rate(struct ath_
/* set dur_update_en for l-sig computation except for PS-Poll frames */
info->dur_update = !ieee80211_is_pspoll(hdr->frame_control);
-
- /*
- * We check if Short Preamble is needed for the CTS rate by
- * checking the BSS's global flag.
- * But for the rate series, IEEE80211_TX_RC_USE_SHORT_PREAMBLE is used.
- */
- rate = ieee80211_get_rts_cts_rate(sc->hw, tx_info);
- info->rtscts_rate = rate->hw_value;
-
- if (tx_info->control.vif &&
- tx_info->control.vif->bss_conf.use_short_preamble)
- info->rtscts_rate |= rate->hw_value_short;
+ info->rtscts_rate = fi->rtscts_rate;
for (i = 0; i < 4; i++) {
bool is_40, is_sgi, is_sp;
@@ -1776,10 +1766,22 @@ static void setup_frame_info(struct ieee
struct ieee80211_sta *sta = tx_info->control.sta;
struct ieee80211_key_conf *hw_key = tx_info->control.hw_key;
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ const struct ieee80211_rate *rate;
struct ath_frame_info *fi = get_frame_info(skb);
struct ath_node *an = NULL;
enum ath9k_key_type keytype;
+ bool short_preamble = false;
+
+ /*
+ * We check if Short Preamble is needed for the CTS rate by
+ * checking the BSS's global flag.
+ * But for the rate series, IEEE80211_TX_RC_USE_SHORT_PREAMBLE is used.
+ */
+ if (tx_info->control.vif &&
+ tx_info->control.vif->bss_conf.use_short_preamble)
+ short_preamble = true;
+ rate = ieee80211_get_rts_cts_rate(hw, tx_info);
keytype = ath9k_cmn_get_hw_crypto_keytype(skb);
if (sta)
@@ -1794,6 +1796,9 @@ static void setup_frame_info(struct ieee
fi->keyix = ATH9K_TXKEYIX_INVALID;
fi->keytype = keytype;
fi->framelen = framelen;
+ fi->rtscts_rate = rate->hw_value;
+ if (short_preamble)
+ fi->rtscts_rate |= rate->hw_value_short;
}
u8 ath_txchainmask_reduction(struct ath_softc *sc, u8 chainmask, u32 rate)
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 064/187] ath9k_hw: avoid possible infinite loop in ar9003_get_pll_sqsum_dvc
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (56 preceding siblings ...)
2012-07-12 22:33 ` =?y?q?=5B=20063/187=5D=20ath9k=3A=20fix=20invalid=20pointer=20access=20in=20the=20tx=20path?= Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 065/187] ath9k_htc: configure bssid on ASSOC/IBSS change Greg Kroah-Hartman
` (122 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Rolf Offermanns, Sujith Manoharan,
Senthil Balasubramanian, Mohammed Shafi Shajakhan,
John W. Linville
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
commit f18e3c6b67f448ec47b3a5b242789bd3d5644879 upstream.
"ath9k: Fix softlockup in AR9485" with commit id
64bc1239c790e051ff677e023435d770d2ffa174 fixed the reported
issue, yet its better to avoid the possible infinite loop
in ar9003_get_pll_sqsum_dvc by having a timeout as suggested
by ath9k maintainers.
http://www.spinics.net/lists/linux-wireless/msg92126.html.
Based on my testing PLL's locking measurement is done in
~200us (2 iterations).
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 065/187] ath9k_htc: configure bssid on ASSOC/IBSS change
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (57 preceding siblings ...)
2012-07-12 22:33 ` [ 064/187] ath9k_hw: avoid possible infinite loop in ar9003_get_pll_sqsum_dvc Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 066/187] ath9k: fix dynamic WEP related regression Greg Kroah-Hartman
` (121 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Michael Leun, Rajkumar Manoharan,
John W. Linville
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
commit 931cb03afed7b541392295f3afc4638da32f08a0 upstream.
After the change "mac80211: remove spurious BSSID change flag",
BSS_CHANGED_BSSID will not be passed on association or IBSS
status changes. So it could be better to program bssid on ASSOC
or IBSS change notification. Not doing so, is affecting the
packet transmission.
Reported-by: Michael Leun <lkml20120218@newton.leun.net>
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/htc_drv_main.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -1496,6 +1496,7 @@ static void ath9k_htc_bss_info_changed(s
priv->num_sta_assoc_vif++ : priv->num_sta_assoc_vif--;
if (priv->ah->opmode == NL80211_IFTYPE_STATION) {
+ ath9k_htc_choose_set_bssid(priv);
if (bss_conf->assoc && (priv->num_sta_assoc_vif == 1))
ath9k_htc_start_ani(priv);
else if (priv->num_sta_assoc_vif == 0)
@@ -1503,13 +1504,11 @@ static void ath9k_htc_bss_info_changed(s
}
}
- if (changed & BSS_CHANGED_BSSID) {
+ if (changed & BSS_CHANGED_IBSS) {
if (priv->ah->opmode == NL80211_IFTYPE_ADHOC) {
common->curaid = bss_conf->aid;
memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
ath9k_htc_set_bssid(priv);
- } else if (priv->ah->opmode == NL80211_IFTYPE_STATION) {
- ath9k_htc_choose_set_bssid(priv);
}
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 066/187] ath9k: fix dynamic WEP related regression
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (58 preceding siblings ...)
2012-07-12 22:33 ` [ 065/187] ath9k_htc: configure bssid on ASSOC/IBSS change Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 067/187] ath9k: enable serialize_regmode for non-PCIE AR9287 Greg Kroah-Hartman
` (120 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Stanislaw Gruszka, Felix Fietkau,
John W. Linville
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@openwrt.org>
commit bed3d9c0b71f9afbfec905cb6db3b9f16be29d4d upstream.
commit 7a532fe7131216a02c81a6c1b1f8632da1195a58
ath9k_hw: fix interpretation of the rx KeyMiss flag
This commit used the rx key miss indication to detect packets that were
passed from the hardware without being decrypted, however it seems that
this bit is not only undefined in the static WEP case, but also for
dynamically allocated WEP keys. This caused a regression when using
WEP-LEAP.
This patch fixes the regression by keeping track of which key indexes
refer to CCMP keys and only using the key miss indication for those.
Reported-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath.h | 1 +
drivers/net/wireless/ath/ath9k/recv.c | 3 ++-
drivers/net/wireless/ath/key.c | 4 ++++
3 files changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -143,6 +143,7 @@ struct ath_common {
u32 keymax;
DECLARE_BITMAP(keymap, ATH_KEYMAX);
DECLARE_BITMAP(tkip_keymap, ATH_KEYMAX);
+ DECLARE_BITMAP(ccmp_keymap, ATH_KEYMAX);
enum ath_crypt_caps crypt_caps;
unsigned int clockrate;
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -821,7 +821,8 @@ static bool ath9k_rx_accept(struct ath_c
* descriptor does contain a valid key index. This has been observed
* mostly with CCMP encryption.
*/
- if (rx_stats->rs_keyix == ATH9K_RXKEYIX_INVALID)
+ if (rx_stats->rs_keyix == ATH9K_RXKEYIX_INVALID ||
+ !test_bit(rx_stats->rs_keyix, common->ccmp_keymap))
rx_stats->rs_status &= ~ATH9K_RXERR_KEYMISS;
if (!rx_stats->rs_datalen)
--- a/drivers/net/wireless/ath/key.c
+++ b/drivers/net/wireless/ath/key.c
@@ -556,6 +556,9 @@ int ath_key_config(struct ath_common *co
return -EIO;
set_bit(idx, common->keymap);
+ if (key->cipher == WLAN_CIPHER_SUITE_CCMP)
+ set_bit(idx, common->ccmp_keymap);
+
if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
set_bit(idx + 64, common->keymap);
set_bit(idx, common->tkip_keymap);
@@ -582,6 +585,7 @@ void ath_key_delete(struct ath_common *c
return;
clear_bit(key->hw_key_idx, common->keymap);
+ clear_bit(key->hw_key_idx, common->ccmp_keymap);
if (key->cipher != WLAN_CIPHER_SUITE_TKIP)
return;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 067/187] ath9k: enable serialize_regmode for non-PCIE AR9287
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (59 preceding siblings ...)
2012-07-12 22:33 ` [ 066/187] ath9k: fix dynamic WEP related regression Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 068/187] ASoC: wm2200: Add missing BCLK rate Greg Kroah-Hartman
` (119 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Panayiotis Karabassis, John W. Linville
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Panayiotis Karabassis <panayk@gmail.com>
commit 7508b657967cf664b5aa0f6367d05016e7e3bc2a upstream.
https://bugzilla.kernel.org/show_bug.cgi?id=42903
Based on the work of <fynivx@gmail.com>
Signed-off-by: Panayiotis Karabassis <panayk@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/hw.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -558,7 +558,7 @@ static int __ath9k_hw_init(struct ath_hw
if (NR_CPUS > 1 && ah->config.serialize_regmode == SER_REG_MODE_AUTO) {
if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCI ||
- ((AR_SREV_9160(ah) || AR_SREV_9280(ah)) &&
+ ((AR_SREV_9160(ah) || AR_SREV_9280(ah) || AR_SREV_9287(ah)) &&
!ah->is_pciexpress)) {
ah->config.serialize_regmode =
SER_REG_MODE_ON;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 068/187] ASoC: wm2200: Add missing BCLK rate
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (60 preceding siblings ...)
2012-07-12 22:33 ` [ 067/187] ath9k: enable serialize_regmode for non-PCIE AR9287 Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 069/187] ASoC: tlv320aic3x: Fix codec pll configure bug Greg Kroah-Hartman
` (118 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Axel Lin, Mark Brown
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <broonie@opensource.wolfsonmicro.com>
commit b0dfa4541e48ac4cc5f017285432c89923ad0f58 upstream.
Without this very high BCLKs will be configured incorrectly.
Reported-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/wm2200.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/soc/codecs/wm2200.c
+++ b/sound/soc/codecs/wm2200.c
@@ -1491,6 +1491,7 @@ static int wm2200_bclk_rates_dat[WM2200_
static int wm2200_bclk_rates_cd[WM2200_NUM_BCLK_RATES] = {
5644800,
+ 3763200,
2882400,
1881600,
1411200,
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 069/187] ASoC: tlv320aic3x: Fix codec pll configure bug
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (61 preceding siblings ...)
2012-07-12 22:33 ` [ 068/187] ASoC: wm2200: Add missing BCLK rate Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 070/187] Btrfs: run delayed directory updates during log replay Greg Kroah-Hartman
` (117 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Hebbar, Gururaja, Mark Brown
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Hebbar, Gururaja" <gururaja.hebbar@ti.com>
commit c9fe573a6584034670c1a55ee8162d623519cbbf upstream.
In sound/soc/codecs/tlv320aic3x.c
data = snd_soc_read(codec, AIC3X_PLL_PROGA_REG);
snd_soc_write(codec, AIC3X_PLL_PROGA_REG,
data | (pll_p << PLLP_SHIFT));
In the above code, pll-p value is OR'ed with previous value without
clearing it. Bug is not seen if pll-p value doesn't change across
Sampling frequency.
However on some platforms (like AM335x EVM-SK), pll-p may have different
values across different sampling frequencies. In such case, above code
configures the pll with a wrong value.
Because of this bug, when a audio stream is played with pll value
different from previous stream, audio is heard as differently(like its
stretched).
Signed-off-by: Hebbar, Gururaja <gururaja.hebbar@ti.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/tlv320aic3x.c | 4 +---
sound/soc/codecs/tlv320aic3x.h | 1 +
2 files changed, 2 insertions(+), 3 deletions(-)
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -936,9 +936,7 @@ static int aic3x_hw_params(struct snd_pc
}
found:
- data = snd_soc_read(codec, AIC3X_PLL_PROGA_REG);
- snd_soc_write(codec, AIC3X_PLL_PROGA_REG,
- data | (pll_p << PLLP_SHIFT));
+ snd_soc_update_bits(codec, AIC3X_PLL_PROGA_REG, PLLP_MASK, pll_p);
snd_soc_write(codec, AIC3X_OVRF_STATUS_AND_PLLR_REG,
pll_r << PLLR_SHIFT);
snd_soc_write(codec, AIC3X_PLL_PROGB_REG, pll_j << PLLJ_SHIFT);
--- a/sound/soc/codecs/tlv320aic3x.h
+++ b/sound/soc/codecs/tlv320aic3x.h
@@ -166,6 +166,7 @@
/* PLL registers bitfields */
#define PLLP_SHIFT 0
+#define PLLP_MASK 7
#define PLLQ_SHIFT 3
#define PLLR_SHIFT 0
#define PLLJ_SHIFT 2
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 070/187] Btrfs: run delayed directory updates during log replay
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (62 preceding siblings ...)
2012-07-12 22:33 ` [ 069/187] ASoC: tlv320aic3x: Fix codec pll configure bug Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 071/187] drm/edid: dont return stack garbage from supports_rb Greg Kroah-Hartman
` (116 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Chris Mason
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <chris.mason@fusionio.com>
commit b6305567e7d31b0bec1b8cb9ec0cadd7f7086f5f upstream.
While we are resolving directory modifications in the
tree log, we are triggering delayed metadata updates to
the filesystem btrees.
This commit forces the delayed updates to run so the
replay code can find any modifications done. It stops
us from crashing because the directory deleltion replay
expects items to be removed immediately from the tree.
Signed-off-by: Chris Mason <chris.mason@fusionio.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/tree-log.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -690,6 +690,8 @@ static noinline int drop_one_dir_item(st
kfree(name);
iput(inode);
+
+ btrfs_run_delayed_items(trans, root);
return ret;
}
@@ -895,6 +897,7 @@ again:
ret = btrfs_unlink_inode(trans, root, dir,
inode, victim_name,
victim_name_len);
+ btrfs_run_delayed_items(trans, root);
}
kfree(victim_name);
ptr = (unsigned long)(victim_ref + 1) + victim_name_len;
@@ -1475,6 +1478,9 @@ again:
ret = btrfs_unlink_inode(trans, root, dir, inode,
name, name_len);
BUG_ON(ret);
+
+ btrfs_run_delayed_items(trans, root);
+
kfree(name);
iput(inode);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 071/187] drm/edid: dont return stack garbage from supports_rb
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (63 preceding siblings ...)
2012-07-12 22:33 ` [ 070/187] Btrfs: run delayed directory updates during log replay Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 072/187] drm/nouveau/fbcon: using nv_two_heads is not a good idea Greg Kroah-Hartman
` (115 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Daniel Vetter, Adam Jackson, Dave Airlie
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <daniel.vetter@ffwll.ch>
commit b196a4980ff7bb54db478e2a408dc8b12be15304 upstream.
We need to initialize this to false, because the is_rb callback only
ever sets it to true.
Noticed while reading through the code.
Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_edid.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -574,7 +574,7 @@ static bool
drm_monitor_supports_rb(struct edid *edid)
{
if (edid->revision >= 4) {
- bool ret;
+ bool ret = false;
drm_for_each_detailed_block((u8 *)edid, is_rb, &ret);
return ret;
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 072/187] drm/nouveau/fbcon: using nv_two_heads is not a good idea
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (64 preceding siblings ...)
2012-07-12 22:33 ` [ 071/187] drm/edid: dont return stack garbage from supports_rb Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 073/187] drm/i915: Fix eDP blank screen after S3 resume on HP desktops Greg Kroah-Hartman
` (114 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Ben Skeggs, Dave Airlie
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <bskeggs@redhat.com>
commit 9bd0c15fcfb42f6245447c53347d65ad9e72080b upstream.
nv_two_heads() was never meant to be used outside of pre-nv50 code. The
code checks for >= NV_10 for 2 CRTCs, then downgrades a few specific
chipsets to 1 CRTC based on (pci_device & 0x0ff0).
The breakage example seen is on GTX 560Ti, with a pciid of 0x1200, which
gets detected as an NV20 (0x020x) with 1 CRTC by nv_two_heads(), causing
memory corruption because there's actually 2 CRTCs..
This switches fbcon to use the CRTC count directly from the mode_config
structure, which will also fix the same issue on Kepler boards which have
4 CRTCs.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_fbcon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -497,7 +497,7 @@ int nouveau_fbcon_init(struct drm_device
nfbdev->helper.funcs = &nouveau_fbcon_helper_funcs;
ret = drm_fb_helper_init(dev, &nfbdev->helper,
- nv_two_heads(dev) ? 2 : 1, 4);
+ dev->mode_config.num_crtc, 4);
if (ret) {
kfree(nfbdev);
return ret;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 073/187] drm/i915: Fix eDP blank screen after S3 resume on HP desktops
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (65 preceding siblings ...)
2012-07-12 22:33 ` [ 072/187] drm/nouveau/fbcon: using nv_two_heads is not a good idea Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 074/187] drm/radeon: fix VM page table setup on SI Greg Kroah-Hartman
` (113 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Takashi Iwai, Daniel Vetter
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 6db65cbb941f9d433659bdad02b307f6d94465df upstream.
This patch fixes the problem on some HP desktop machines with eDP
which give blank screens after S3 resume.
It turned out that BLC_PWM_CPU_CTL must be written after
BLC_PWM_CPU_CTL2. Otherwise it doesn't take effect on these
SNB machines.
Tested with 3.5-rc3 kernel.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=49233
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_suspend.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -740,8 +740,11 @@ static void i915_restore_display(struct
if (HAS_PCH_SPLIT(dev)) {
I915_WRITE(BLC_PWM_PCH_CTL1, dev_priv->saveBLC_PWM_CTL);
I915_WRITE(BLC_PWM_PCH_CTL2, dev_priv->saveBLC_PWM_CTL2);
- I915_WRITE(BLC_PWM_CPU_CTL, dev_priv->saveBLC_CPU_PWM_CTL);
+ /* NOTE: BLC_PWM_CPU_CTL must be written after BLC_PWM_CPU_CTL2;
+ * otherwise we get blank eDP screen after S3 on some machines
+ */
I915_WRITE(BLC_PWM_CPU_CTL2, dev_priv->saveBLC_CPU_PWM_CTL2);
+ I915_WRITE(BLC_PWM_CPU_CTL, dev_priv->saveBLC_CPU_PWM_CTL);
I915_WRITE(PCH_PP_ON_DELAYS, dev_priv->savePP_ON_DELAYS);
I915_WRITE(PCH_PP_OFF_DELAYS, dev_priv->savePP_OFF_DELAYS);
I915_WRITE(PCH_PP_DIVISOR, dev_priv->savePP_DIVISOR);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 074/187] drm/radeon: fix VM page table setup on SI
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (66 preceding siblings ...)
2012-07-12 22:33 ` [ 073/187] drm/i915: Fix eDP blank screen after S3 resume on HP desktops Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 075/187] ACPI video: Still use ACPI backlight control if _DOS doesnt exist Greg Kroah-Hartman
` (112 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Alex Deucher, Jerome Glisse, Dave Airlie
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit c21b328ea8c7c71cd2daf50557db440bbaa7ef55 upstream.
Cayman and trinity allow for variable sized VM page
tables, but SI requires that all page tables be the
same size. The current code assumes variablely sized
VM page tables so SI may end up with part of each page
table overlapping with other memory which could end
up being interpreted by the VM hw as garbage.
Change the code to better accomodate SI. Allocate enough
space for at least 2 full page tables and always set
last_pfn to max_pfn on SI so each VM is backed by a full
page table. This limits us to only 2 VMs active at any
given time on SI. This will be rectified and the code can
be reunified once we move to two level page tables.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_gart.c | 13 +++++++++++--
drivers/gpu/drm/radeon/si.c | 4 ++--
2 files changed, 13 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -289,8 +289,9 @@ int radeon_vm_manager_init(struct radeon
rdev->vm_manager.enabled = false;
/* mark first vm as always in use, it's the system one */
+ /* allocate enough for 2 full VM pts */
r = radeon_sa_bo_manager_init(rdev, &rdev->vm_manager.sa_manager,
- rdev->vm_manager.max_pfn * 8,
+ rdev->vm_manager.max_pfn * 8 * 2,
RADEON_GEM_DOMAIN_VRAM);
if (r) {
dev_err(rdev->dev, "failed to allocate vm bo (%dKB)\n",
@@ -635,7 +636,15 @@ int radeon_vm_init(struct radeon_device
mutex_init(&vm->mutex);
INIT_LIST_HEAD(&vm->list);
INIT_LIST_HEAD(&vm->va);
- vm->last_pfn = 0;
+ /* SI requires equal sized PTs for all VMs, so always set
+ * last_pfn to max_pfn. cayman allows variable sized
+ * pts so we can grow then as needed. Once we switch
+ * to two level pts we can unify this again.
+ */
+ if (rdev->family >= CHIP_TAHITI)
+ vm->last_pfn = rdev->vm_manager.max_pfn;
+ else
+ vm->last_pfn = 0;
/* map the ib pool buffer at 0 in virtual address space, set
* read only
*/
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2527,12 +2527,12 @@ int si_pcie_gart_enable(struct radeon_de
WREG32(0x15DC, 0);
/* empty context1-15 */
- /* FIXME start with 1G, once using 2 level pt switch to full
+ /* FIXME start with 4G, once using 2 level pt switch to full
* vm size space
*/
/* set vm size, must be a multiple of 4 */
WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, (1 << 30) / RADEON_GPU_PAGE_SIZE);
+ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
for (i = 1; i < 16; i++) {
if (i < 8)
WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 075/187] ACPI video: Still use ACPI backlight control if _DOS doesnt exist
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (67 preceding siblings ...)
2012-07-12 22:33 ` [ 074/187] drm/radeon: fix VM page table setup on SI Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 076/187] acpi_pad: fix power_saving thread deadlock Greg Kroah-Hartman
` (111 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Igor Murzov, Zhang Rui, Len Brown
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <rui.zhang@intel.com>
commit b03738430c7537d5f87948e0b35d8aaf2688c6b4 upstream.
This fixes a regression in 3.4-rc1 caused by commit
ea9f8856bd6d4ed45885b06a338f7362cd6c60e5
(ACPI video: Harden video bus adding.)
Some platforms don't have _DOS control method, but the ACPI
backlight still works.
We should not invoke _DOS for these platforms.
https://bugzilla.kernel.org/show_bug.cgi?id=43168
Cc: Igor Murzov <intergalactic.anonymous@gmail.com>
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/video.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -558,6 +558,8 @@ acpi_video_bus_DOS(struct acpi_video_bus
union acpi_object arg0 = { ACPI_TYPE_INTEGER };
struct acpi_object_list args = { 1, &arg0 };
+ if (!video->cap._DOS)
+ return 0;
if (bios_flag < 0 || bios_flag > 3 || lcd_flag < 0 || lcd_flag > 1)
return -EINVAL;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 076/187] acpi_pad: fix power_saving thread deadlock
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (68 preceding siblings ...)
2012-07-12 22:33 ` [ 075/187] ACPI video: Still use ACPI backlight control if _DOS doesnt exist Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 077/187] ACPI, APEI, Avoid too much error reporting in runtime Greg Kroah-Hartman
` (110 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Stuart Hayes, Len Brown
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stuart Hayes <Stuart_Hayes@Dell.com>
commit 5f1601261050251a5ca293378b492a69d590dacb upstream.
The acpi_pad driver can get stuck in destroy_power_saving_task()
waiting for kthread_stop() to stop a power_saving thread. The problem
is that the isolated_cpus_lock mutex is owned when
destroy_power_saving_task() calls kthread_stop(), which waits for a
power_saving thread to end, and the power_saving thread tries to
acquire the isolated_cpus_lock when it calls round_robin_cpu(). This
patch fixes the issue by making round_robin_cpu() use its own mutex.
https://bugzilla.kernel.org/show_bug.cgi?id=42981
Signed-off-by: Stuart Hayes <Stuart_Hayes@Dell.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/acpi_pad.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/acpi/acpi_pad.c
+++ b/drivers/acpi/acpi_pad.c
@@ -36,6 +36,7 @@
#define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"
#define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80
static DEFINE_MUTEX(isolated_cpus_lock);
+static DEFINE_MUTEX(round_robin_lock);
static unsigned long power_saving_mwait_eax;
@@ -107,7 +108,7 @@ static void round_robin_cpu(unsigned int
if (!alloc_cpumask_var(&tmp, GFP_KERNEL))
return;
- mutex_lock(&isolated_cpus_lock);
+ mutex_lock(&round_robin_lock);
cpumask_clear(tmp);
for_each_cpu(cpu, pad_busy_cpus)
cpumask_or(tmp, tmp, topology_thread_cpumask(cpu));
@@ -116,7 +117,7 @@ static void round_robin_cpu(unsigned int
if (cpumask_empty(tmp))
cpumask_andnot(tmp, cpu_online_mask, pad_busy_cpus);
if (cpumask_empty(tmp)) {
- mutex_unlock(&isolated_cpus_lock);
+ mutex_unlock(&round_robin_lock);
return;
}
for_each_cpu(cpu, tmp) {
@@ -131,7 +132,7 @@ static void round_robin_cpu(unsigned int
tsk_in_cpu[tsk_index] = preferred_cpu;
cpumask_set_cpu(preferred_cpu, pad_busy_cpus);
cpu_weight[preferred_cpu]++;
- mutex_unlock(&isolated_cpus_lock);
+ mutex_unlock(&round_robin_lock);
set_cpus_allowed_ptr(current, cpumask_of(preferred_cpu));
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 077/187] ACPI, APEI, Avoid too much error reporting in runtime
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (69 preceding siblings ...)
2012-07-12 22:33 ` [ 076/187] acpi_pad: fix power_saving thread deadlock Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 078/187] ACPI: Make acpi_skip_timer_override cover all source_irq==0 cases Greg Kroah-Hartman
` (109 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Pawel Sikora, Huang Ying,
Jean Delvare, Len Brown
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Ying <ying.huang@intel.com>
commit 34ddeb035d704eafdcdb3cbc781894300136c3c4 upstream.
This patch fixed the following bug.
https://bugzilla.kernel.org/show_bug.cgi?id=43282
This is caused by a firmware bug checking (checking generic address
register provided by firmware) in runtime. The checking should be
done in address mapping time instead of runtime to avoid too much
error reporting in runtime.
Reported-by: Pawel Sikora <pluto@agmk.net>
Signed-off-by: Huang Ying <ying.huang@intel.com>
Tested-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/apei/apei-base.c | 17 +++++++++++++++--
drivers/acpi/apei/apei-internal.h | 9 +++++++++
drivers/acpi/apei/ghes.c | 6 +++---
3 files changed, 27 insertions(+), 5 deletions(-)
--- a/drivers/acpi/apei/apei-base.c
+++ b/drivers/acpi/apei/apei-base.c
@@ -243,7 +243,7 @@ static int pre_map_gar_callback(struct a
u8 ins = entry->instruction;
if (ctx->ins_table[ins].flags & APEI_EXEC_INS_ACCESS_REGISTER)
- return acpi_os_map_generic_address(&entry->register_region);
+ return apei_map_generic_address(&entry->register_region);
return 0;
}
@@ -276,7 +276,7 @@ static int post_unmap_gar_callback(struc
u8 ins = entry->instruction;
if (ctx->ins_table[ins].flags & APEI_EXEC_INS_ACCESS_REGISTER)
- acpi_os_unmap_generic_address(&entry->register_region);
+ apei_unmap_generic_address(&entry->register_region);
return 0;
}
@@ -606,6 +606,19 @@ static int apei_check_gar(struct acpi_ge
return 0;
}
+int apei_map_generic_address(struct acpi_generic_address *reg)
+{
+ int rc;
+ u32 access_bit_width;
+ u64 address;
+
+ rc = apei_check_gar(reg, &address, &access_bit_width);
+ if (rc)
+ return rc;
+ return acpi_os_map_generic_address(reg);
+}
+EXPORT_SYMBOL_GPL(apei_map_generic_address);
+
/* read GAR in interrupt (including NMI) or process context */
int apei_read(u64 *val, struct acpi_generic_address *reg)
{
--- a/drivers/acpi/apei/apei-internal.h
+++ b/drivers/acpi/apei/apei-internal.h
@@ -7,6 +7,8 @@
#define APEI_INTERNAL_H
#include <linux/cper.h>
+#include <linux/acpi.h>
+#include <linux/acpi_io.h>
struct apei_exec_context;
@@ -68,6 +70,13 @@ static inline int apei_exec_run_optional
/* IP has been set in instruction function */
#define APEI_EXEC_SET_IP 1
+int apei_map_generic_address(struct acpi_generic_address *reg);
+
+static inline void apei_unmap_generic_address(struct acpi_generic_address *reg)
+{
+ acpi_os_unmap_generic_address(reg);
+}
+
int apei_read(u64 *val, struct acpi_generic_address *reg);
int apei_write(u64 val, struct acpi_generic_address *reg);
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -301,7 +301,7 @@ static struct ghes *ghes_new(struct acpi
if (!ghes)
return ERR_PTR(-ENOMEM);
ghes->generic = generic;
- rc = acpi_os_map_generic_address(&generic->error_status_address);
+ rc = apei_map_generic_address(&generic->error_status_address);
if (rc)
goto err_free;
error_block_length = generic->error_block_length;
@@ -321,7 +321,7 @@ static struct ghes *ghes_new(struct acpi
return ghes;
err_unmap:
- acpi_os_unmap_generic_address(&generic->error_status_address);
+ apei_unmap_generic_address(&generic->error_status_address);
err_free:
kfree(ghes);
return ERR_PTR(rc);
@@ -330,7 +330,7 @@ err_free:
static void ghes_fini(struct ghes *ghes)
{
kfree(ghes->estatus);
- acpi_os_unmap_generic_address(&ghes->generic->error_status_address);
+ apei_unmap_generic_address(&ghes->generic->error_status_address);
}
enum {
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 078/187] ACPI: Make acpi_skip_timer_override cover all source_irq==0 cases
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (70 preceding siblings ...)
2012-07-12 22:33 ` [ 077/187] ACPI, APEI, Avoid too much error reporting in runtime Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 079/187] ACPI: Remove one board specific WARN when ignoring timer overriding Greg Kroah-Hartman
` (108 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Feng Tang, Len Brown
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Tang <feng.tang@intel.com>
commit ae10ccdc3093486f8c2369d227583f9d79f628e5 upstream.
Currently when acpi_skip_timer_override is set, it only cover the
(source_irq == 0 && global_irq == 2) cases. While there is also
platform which need use this option and its global_irq is not 2.
This patch will extend acpi_skip_timer_override to cover all
timer overriding cases as long as the source irq is 0.
This is the first part of a fix to kernel bug bugzilla 40002:
"IRQ 0 assigned to VGA"
https://bugzilla.kernel.org/show_bug.cgi?id=40002
Reported-and-tested-by: Szymon Kowalczyk <fazerxlo@o2.pl>
Signed-off-by: Feng Tang <feng.tang@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/acpi/boot.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -422,12 +422,14 @@ acpi_parse_int_src_ovr(struct acpi_subta
return 0;
}
- if (intsrc->source_irq == 0 && intsrc->global_irq == 2) {
+ if (intsrc->source_irq == 0) {
if (acpi_skip_timer_override) {
- printk(PREFIX "BIOS IRQ0 pin2 override ignored.\n");
+ printk(PREFIX "BIOS IRQ0 override ignored.\n");
return 0;
}
- if (acpi_fix_pin2_polarity && (intsrc->inti_flags & ACPI_MADT_POLARITY_MASK)) {
+
+ if ((intsrc->global_irq == 2) && acpi_fix_pin2_polarity
+ && (intsrc->inti_flags & ACPI_MADT_POLARITY_MASK)) {
intsrc->inti_flags &= ~ACPI_MADT_POLARITY_MASK;
printk(PREFIX "BIOS IRQ0 pin2 override: forcing polarity to high active.\n");
}
@@ -1334,7 +1336,7 @@ static int __init dmi_disable_acpi(const
}
/*
- * Force ignoring BIOS IRQ0 pin2 override
+ * Force ignoring BIOS IRQ0 override
*/
static int __init dmi_ignore_irq0_timer_override(const struct dmi_system_id *d)
{
@@ -1344,7 +1346,7 @@ static int __init dmi_ignore_irq0_timer_
*/
if (!acpi_skip_timer_override) {
WARN(1, KERN_ERR "ati_ixp4x0 quirk not complete.\n");
- pr_notice("%s detected: Ignoring BIOS IRQ0 pin2 override\n",
+ pr_notice("%s detected: Ignoring BIOS IRQ0 override\n",
d->ident);
acpi_skip_timer_override = 1;
}
@@ -1438,7 +1440,7 @@ static struct dmi_system_id __initdata a
* is enabled. This input is incorrectly designated the
* ISA IRQ 0 via an interrupt source override even though
* it is wired to the output of the master 8259A and INTIN0
- * is not connected at all. Force ignoring BIOS IRQ0 pin2
+ * is not connected at all. Force ignoring BIOS IRQ0
* override in that cases.
*/
{
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 079/187] ACPI: Remove one board specific WARN when ignoring timer overriding
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (71 preceding siblings ...)
2012-07-12 22:33 ` [ 078/187] ACPI: Make acpi_skip_timer_override cover all source_irq==0 cases Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 080/187] ACPI: Add a quirk for "AMILO PRO V2030" to ignore the " Greg Kroah-Hartman
` (107 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Feng Tang, Len Brown
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Tang <feng.tang@intel.com>
commit 7f68b4c2e158019c2ec494b5cfbd9c83b4e5b253 upstream.
Current WARN msg is only for the ati_ixp4x0 board, while this function
is used by mulitple platforms. So this one board specific warning
is not appropriate any more.
Signed-off-by: Feng Tang <feng.tang@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/acpi/boot.c | 5 -----
1 file changed, 5 deletions(-)
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -1340,12 +1340,7 @@ static int __init dmi_disable_acpi(const
*/
static int __init dmi_ignore_irq0_timer_override(const struct dmi_system_id *d)
{
- /*
- * The ati_ixp4x0_rev() early PCI quirk should have set
- * the acpi_skip_timer_override flag already:
- */
if (!acpi_skip_timer_override) {
- WARN(1, KERN_ERR "ati_ixp4x0 quirk not complete.\n");
pr_notice("%s detected: Ignoring BIOS IRQ0 override\n",
d->ident);
acpi_skip_timer_override = 1;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 080/187] ACPI: Add a quirk for "AMILO PRO V2030" to ignore the timer overriding
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (72 preceding siblings ...)
2012-07-12 22:33 ` [ 079/187] ACPI: Remove one board specific WARN when ignoring timer overriding Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 081/187] ACPI, x86: fix Dell M6600 ACPI reboot regression via DMI Greg Kroah-Hartman
` (106 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Feng Tang, Len Brown
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Tang <feng.tang@intel.com>
commit f6b54f083cc66cf9b11d2120d8df3c2ad4e0836d upstream.
This is the 2nd part of fix for kernel bugzilla 40002:
"IRQ 0 assigned to VGA"
https://bugzilla.kernel.org/show_bug.cgi?id=40002
The root cause is the buggy FW, whose ACPI tables assign the GSI 16
to 2 irqs 0 and 16(VGA), and the VGA is the right owner of GSI 16.
So add a quirk to ignore the irq0 overriding GSI 16 for the
FUJITSU SIEMENS AMILO PRO V2030 platform will solve this issue.
Reported-and-tested-by: Szymon Kowalczyk <fazerxlo@o2.pl>
Signed-off-by: Feng Tang <feng.tang@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/acpi/boot.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -1470,6 +1470,14 @@ static struct dmi_system_id __initdata a
DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq 6715b"),
},
},
+ {
+ .callback = dmi_ignore_irq0_timer_override,
+ .ident = "FUJITSU SIEMENS",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO PRO V2030"),
+ },
+ },
{}
};
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 081/187] ACPI, x86: fix Dell M6600 ACPI reboot regression via DMI
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (73 preceding siblings ...)
2012-07-12 22:33 ` [ 080/187] ACPI: Add a quirk for "AMILO PRO V2030" to ignore the " Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 082/187] ACPI sysfs.c strlen fix Greg Kroah-Hartman
` (105 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Zhang Rui, Len Brown, x86
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <rui.zhang@intel.com>
commit 76eb9a30db4bc8fd172f9155247264b5f2686d7b upstream.
Dell Precision M6600 is known to require PCI reboot, so add it to
the reboot blacklist in pci_reboot_dmi_table[].
https://bugzilla.kernel.org/show_bug.cgi?id=42749
cc: x86@kernel.org
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/reboot.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -471,6 +471,14 @@ static struct dmi_system_id __initdata p
DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 990"),
},
},
+ { /* Handle problems with rebooting on the Precision M6600. */
+ .callback = set_pci_reboot,
+ .ident = "Dell OptiPlex 990",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Precision M6600"),
+ },
+ },
{ }
};
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 082/187] ACPI sysfs.c strlen fix
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (74 preceding siblings ...)
2012-07-12 22:33 ` [ 081/187] ACPI, x86: fix Dell M6600 ACPI reboot regression via DMI Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:33 ` [ 083/187] ARM: Orion: Fix Virtual/Physical mixup with watchdog Greg Kroah-Hartman
` (104 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Len Brown
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Vasilyev <pavel@pavlinux.ru>
commit 9f132652d94c96476b0b0a8caf0c10e96ab10fa8 upstream.
Current code is ignoring the last character of "enable" and "disable"
in comparisons.
https://bugzilla.kernel.org/show_bug.cgi?id=33732
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/sysfs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -173,7 +173,7 @@ static int param_set_trace_state(const c
{
int result = 0;
- if (!strncmp(val, "enable", strlen("enable") - 1)) {
+ if (!strncmp(val, "enable", strlen("enable"))) {
result = acpi_debug_trace(trace_method_name, trace_debug_level,
trace_debug_layer, 0);
if (result)
@@ -181,7 +181,7 @@ static int param_set_trace_state(const c
goto exit;
}
- if (!strncmp(val, "disable", strlen("disable") - 1)) {
+ if (!strncmp(val, "disable", strlen("disable"))) {
int name = 0;
result = acpi_debug_trace((char *)&name, trace_debug_level,
trace_debug_layer, 0);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 083/187] ARM: Orion: Fix Virtual/Physical mixup with watchdog
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (75 preceding siblings ...)
2012-07-12 22:33 ` [ 082/187] ACPI sysfs.c strlen fix Greg Kroah-Hartman
@ 2012-07-12 22:33 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 084/187] ARM: Orion: Fix WDT compile for Dove and MV78xx0 Greg Kroah-Hartman
` (103 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Andrew Lunn, Olof Johansson
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <andrew@lunn.ch>
commit 0fa1f0609a0c1fe8b2be3c0089a2cb48f7fda521 upstream.
The orion watchdog is expecting to be passed the physcial address of
the hardware, and will ioremap() it to give a virtual address it will
use as the base address for the hardware. However, when creating the
platform resource record, a virtual address was being used.
Add the necassary #define's so we can pass the physical address as
expected.
Tested on Kirkwood and Orion5x.
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-kirkwood/include/mach/bridge-regs.h | 1 +
arch/arm/mach-kirkwood/include/mach/kirkwood.h | 1 +
arch/arm/mach-orion5x/include/mach/bridge-regs.h | 2 +-
arch/arm/mach-orion5x/include/mach/orion5x.h | 1 +
arch/arm/plat-orion/common.c | 2 +-
5 files changed, 5 insertions(+), 2 deletions(-)
--- a/arch/arm/mach-kirkwood/include/mach/bridge-regs.h
+++ b/arch/arm/mach-kirkwood/include/mach/bridge-regs.h
@@ -38,6 +38,7 @@
#define IRQ_MASK_HIGH_OFF 0x0014
#define TIMER_VIRT_BASE (BRIDGE_VIRT_BASE | 0x0300)
+#define TIMER_PHYS_BASE (BRIDGE_PHYS_BASE | 0x0300)
#define L2_CONFIG_REG (BRIDGE_VIRT_BASE | 0x0128)
#define L2_WRITETHROUGH 0x00000010
--- a/arch/arm/mach-kirkwood/include/mach/kirkwood.h
+++ b/arch/arm/mach-kirkwood/include/mach/kirkwood.h
@@ -80,6 +80,7 @@
#define UART1_VIRT_BASE (DEV_BUS_VIRT_BASE | 0x2100)
#define BRIDGE_VIRT_BASE (KIRKWOOD_REGS_VIRT_BASE | 0x20000)
+#define BRIDGE_PHYS_BASE (KIRKWOOD_REGS_PHYS_BASE | 0x20000)
#define CRYPTO_PHYS_BASE (KIRKWOOD_REGS_PHYS_BASE | 0x30000)
--- a/arch/arm/mach-orion5x/include/mach/bridge-regs.h
+++ b/arch/arm/mach-orion5x/include/mach/bridge-regs.h
@@ -35,5 +35,5 @@
#define MAIN_IRQ_MASK (ORION5X_BRIDGE_VIRT_BASE | 0x204)
#define TIMER_VIRT_BASE (ORION5X_BRIDGE_VIRT_BASE | 0x300)
-
+#define TIMER_PHYS_BASE (ORION5X_BRIDGE_PHYS_BASE | 0x300)
#endif
--- a/arch/arm/mach-orion5x/include/mach/orion5x.h
+++ b/arch/arm/mach-orion5x/include/mach/orion5x.h
@@ -82,6 +82,7 @@
#define UART1_VIRT_BASE (ORION5X_DEV_BUS_VIRT_BASE | 0x2100)
#define ORION5X_BRIDGE_VIRT_BASE (ORION5X_REGS_VIRT_BASE | 0x20000)
+#define ORION5X_BRIDGE_PHYS_BASE (ORION5X_REGS_PHYS_BASE | 0x20000)
#define ORION5X_PCI_VIRT_BASE (ORION5X_REGS_VIRT_BASE | 0x30000)
--- a/arch/arm/plat-orion/common.c
+++ b/arch/arm/plat-orion/common.c
@@ -570,7 +570,7 @@ void __init orion_spi_1_init(unsigned lo
static struct orion_wdt_platform_data orion_wdt_data;
static struct resource orion_wdt_resource =
- DEFINE_RES_MEM(TIMER_VIRT_BASE, 0x28);
+ DEFINE_RES_MEM(TIMER_PHYS_BASE, 0x28);
static struct platform_device orion_wdt_device = {
.name = "orion_wdt",
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 084/187] ARM: Orion: Fix WDT compile for Dove and MV78xx0
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (76 preceding siblings ...)
2012-07-12 22:33 ` [ 083/187] ARM: Orion: Fix Virtual/Physical mixup with watchdog Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 085/187] xen/blkback: Copy id field when doing BLKIF_DISCARD Greg Kroah-Hartman
` (102 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Nicolas Pitre, Andrew Lunn, Arnd Bergmann
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <andrew@lunn.ch>
commit 1e0c1ce00d83834d03f4d8d039734ca4703298df upstream.
Commit 0fa1f0609a0c1fe8b2be3c0089a2cb48f7fda521 (ARM: Orion: Fix
Virtual/Physical mixup with watchdog) broke the Dove & MV78xx0
build. Although these two SoC don't use the watchdog, the shared
platform code still needs to build. Add the necessary defines.
Reported-by: Nicolas Pitre <nico@fluxnic.net>
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Tested-by: Nicolas Pitre <nico@fluxnic.net>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-dove/include/mach/bridge-regs.h | 1 +
arch/arm/mach-dove/include/mach/dove.h | 1 +
arch/arm/mach-mv78xx0/include/mach/bridge-regs.h | 1 +
arch/arm/mach-mv78xx0/include/mach/mv78xx0.h | 2 ++
4 files changed, 5 insertions(+)
--- a/arch/arm/mach-dove/include/mach/bridge-regs.h
+++ b/arch/arm/mach-dove/include/mach/bridge-regs.h
@@ -50,5 +50,6 @@
#define POWER_MANAGEMENT (BRIDGE_VIRT_BASE | 0x011c)
#define TIMER_VIRT_BASE (BRIDGE_VIRT_BASE | 0x0300)
+#define TIMER_PHYS_BASE (BRIDGE_PHYS_BASE | 0x0300)
#endif
--- a/arch/arm/mach-dove/include/mach/dove.h
+++ b/arch/arm/mach-dove/include/mach/dove.h
@@ -78,6 +78,7 @@
/* North-South Bridge */
#define BRIDGE_VIRT_BASE (DOVE_SB_REGS_VIRT_BASE | 0x20000)
+#define BRIDGE_PHYS_BASE (DOVE_SB_REGS_PHYS_BASE | 0x20000)
/* Cryptographic Engine */
#define DOVE_CRYPT_PHYS_BASE (DOVE_SB_REGS_PHYS_BASE | 0x30000)
--- a/arch/arm/mach-mv78xx0/include/mach/bridge-regs.h
+++ b/arch/arm/mach-mv78xx0/include/mach/bridge-regs.h
@@ -31,5 +31,6 @@
#define IRQ_MASK_HIGH_OFF 0x0014
#define TIMER_VIRT_BASE (BRIDGE_VIRT_BASE | 0x0300)
+#define TIMER_PHYS_BASE (BRIDGE_PHYS_BASE | 0x0300)
#endif
--- a/arch/arm/mach-mv78xx0/include/mach/mv78xx0.h
+++ b/arch/arm/mach-mv78xx0/include/mach/mv78xx0.h
@@ -42,6 +42,7 @@
#define MV78XX0_CORE0_REGS_PHYS_BASE 0xf1020000
#define MV78XX0_CORE1_REGS_PHYS_BASE 0xf1024000
#define MV78XX0_CORE_REGS_VIRT_BASE 0xfe400000
+#define MV78XX0_CORE_REGS_PHYS_BASE 0xfe400000
#define MV78XX0_CORE_REGS_SIZE SZ_16K
#define MV78XX0_PCIE_IO_PHYS_BASE(i) (0xf0800000 + ((i) << 20))
@@ -59,6 +60,7 @@
* Core-specific peripheral registers.
*/
#define BRIDGE_VIRT_BASE (MV78XX0_CORE_REGS_VIRT_BASE)
+#define BRIDGE_PHYS_BASE (MV78XX0_CORE_REGS_PHYS_BASE)
/*
* Register Map
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 085/187] xen/blkback: Copy id field when doing BLKIF_DISCARD.
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (77 preceding siblings ...)
2012-07-12 22:34 ` [ 084/187] ARM: Orion: Fix WDT compile for Dove and MV78xx0 Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 086/187] umem: fix up unplugging Greg Kroah-Hartman
` (101 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, William Dauchy,
Stefano Stabellini, Konrad Rzeszutek Wilk
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 8c9ce606a60e4a0cb447bdc082ce383b96b227b4 upstream.
We weren't copying the id field so when we sent the response
back to the frontend (especially with a 64-bit host and 32-bit
guest), we ended up using a random value. This lead to the
frontend crashing as it would try to pass to __blk_end_request_all
a NULL 'struct request' (b/c it would use the 'id' to find the
proper 'struct request' in its shadow array) and end up crashing:
BUG: unable to handle kernel NULL pointer dereference at 000000e4
IP: [<c0646d4c>] __blk_end_request_all+0xc/0x40
.. snip..
EIP is at __blk_end_request_all+0xc/0x40
.. snip..
[<ed95db72>] blkif_interrupt+0x172/0x330 [xen_blkfront]
This fixes the bug by passing in the proper id for the response.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=824641
Tested-by: William Dauchy <wdauchy@gmail.com>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/xen-blkback/common.h | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -257,6 +257,7 @@ static inline void blkif_get_x86_32_req(
break;
case BLKIF_OP_DISCARD:
dst->u.discard.flag = src->u.discard.flag;
+ dst->u.discard.id = src->u.discard.id;
dst->u.discard.sector_number = src->u.discard.sector_number;
dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
break;
@@ -287,6 +288,7 @@ static inline void blkif_get_x86_64_req(
break;
case BLKIF_OP_DISCARD:
dst->u.discard.flag = src->u.discard.flag;
+ dst->u.discard.id = src->u.discard.id;
dst->u.discard.sector_number = src->u.discard.sector_number;
dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
break;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 086/187] umem: fix up unplugging
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (78 preceding siblings ...)
2012-07-12 22:34 ` [ 085/187] xen/blkback: Copy id field when doing BLKIF_DISCARD Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 087/187] stable: Allow merging of backports for serious user-visible performance issues Greg Kroah-Hartman
` (100 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Tao Guo, Neil Brown, Jens Axboe,
Shaohua Li
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Guo <glorioustao@gmail.com>
commit 32587371ad3db2f9d335de10dbd8cffd4fff5669 upstream.
Fix a regression introduced by 7eaceaccab5f40 ("block: remove per-queue
plugging"). In that patch, Jens removed the whole mm_unplug_device()
function, which used to be the trigger to make umem start to work.
We need to implement unplugging to make umem start to work, or I/O will
never be triggered.
Signed-off-by: Tao Guo <Tao.Guo@emc.com>
Cc: Neil Brown <neilb@suse.de>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Shaohua Li <shli@kernel.org>
Acked-by: NeilBrown <neilb@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/umem.c | 40 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 40 insertions(+)
--- a/drivers/block/umem.c
+++ b/drivers/block/umem.c
@@ -513,6 +513,44 @@ static void process_page(unsigned long d
}
}
+struct mm_plug_cb {
+ struct blk_plug_cb cb;
+ struct cardinfo *card;
+};
+
+static void mm_unplug(struct blk_plug_cb *cb)
+{
+ struct mm_plug_cb *mmcb = container_of(cb, struct mm_plug_cb, cb);
+
+ spin_lock_irq(&mmcb->card->lock);
+ activate(mmcb->card);
+ spin_unlock_irq(&mmcb->card->lock);
+ kfree(mmcb);
+}
+
+static int mm_check_plugged(struct cardinfo *card)
+{
+ struct blk_plug *plug = current->plug;
+ struct mm_plug_cb *mmcb;
+
+ if (!plug)
+ return 0;
+
+ list_for_each_entry(mmcb, &plug->cb_list, cb.list) {
+ if (mmcb->cb.callback == mm_unplug && mmcb->card == card)
+ return 1;
+ }
+ /* Not currently on the callback list */
+ mmcb = kmalloc(sizeof(*mmcb), GFP_ATOMIC);
+ if (!mmcb)
+ return 0;
+
+ mmcb->card = card;
+ mmcb->cb.callback = mm_unplug;
+ list_add(&mmcb->cb.list, &plug->cb_list);
+ return 1;
+}
+
static void mm_make_request(struct request_queue *q, struct bio *bio)
{
struct cardinfo *card = q->queuedata;
@@ -523,6 +561,8 @@ static void mm_make_request(struct reque
*card->biotail = bio;
bio->bi_next = NULL;
card->biotail = &bio->bi_next;
+ if (bio->bi_rw & REQ_SYNC || !mm_check_plugged(card))
+ activate(card);
spin_unlock_irq(&card->lock);
return;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 087/187] stable: Allow merging of backports for serious user-visible performance issues
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (79 preceding siblings ...)
2012-07-12 22:34 ` [ 086/187] umem: fix up unplugging Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 088/187] mm: correctly synchronize rss-counters at exit/exec Greg Kroah-Hartman
` (99 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Mel Gorman
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <mgorman@suse.de>
commit eb3979f64d25120d60b9e761a4c58f70b1a02f86 upstream.
Distribution kernel maintainers routinely backport fixes for users that
were deemed important but not "something critical" as defined by the
rules. To users of these kernels they are very serious and failing to fix
them reduces the value of -stable.
The problem is that the patches fixing these issues are often subtle and
prone to regressions in other ways and need greater care and attention.
To combat this, these "serious" backports should have a higher barrier
to entry.
This patch relaxes the rules to allow a distribution maintainer to merge
to -stable a backported patch or small series that fixes a "serious"
user-visible performance issue. They should include additional information on
the user-visible bug affected and a link to the bugzilla entry if available.
The same rules about the patch being already in mainline still apply.
Signed-off-by: Mel Gorman <mgorman@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/stable_kernel_rules.txt | 6 ++++++
1 file changed, 6 insertions(+)
--- a/Documentation/stable_kernel_rules.txt
+++ b/Documentation/stable_kernel_rules.txt
@@ -12,6 +12,12 @@ Rules on what kind of patches are accept
marked CONFIG_BROKEN), an oops, a hang, data corruption, a real
security issue, or some "oh, that's not good" issue. In short, something
critical.
+ - Serious issues as reported by a user of a distribution kernel may also
+ be considered if they fix a notable performance or interactivity issue.
+ As these fixes are not as obvious and have a higher risk of a subtle
+ regression they should only be submitted by a distribution kernel
+ maintainer and include an addendum linking to a bugzilla entry if it
+ exists and additional information on the user-visible impact.
- New device IDs and quirks are also accepted.
- No "theoretical race condition" issues, unless an explanation of how the
race can be exploited is also provided.
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 088/187] mm: correctly synchronize rss-counters at exit/exec
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (80 preceding siblings ...)
2012-07-12 22:34 ` [ 087/187] stable: Allow merging of backports for serious user-visible performance issues Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 089/187] PM / Sleep: Prevent waiting forever on asynchronous suspend after abort Greg Kroah-Hartman
` (98 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Markus Trippelsdorf,
Konstantin Khlebnikov, Oleg Nesterov, KAMEZAWA Hiroyuki,
Hugh Dickins
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <khlebnikov@openvz.org>
commit 4fe7efdbdfb1c7e7a7f31decfd831c0f31d37091 upstream.
do_exit() and exec_mmap() call sync_mm_rss() before mm_release() does
put_user(clear_child_tid) which can update task->rss_stat and thus make
mm->rss_stat inconsistent. This triggers the "BUG:" printk in check_mm().
Let's fix this bug in the safest way, and optimize/cleanup this later.
Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
Signed-off-by: Konstantin Khlebnikov <khlebnikov@openvz.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/exec.c | 2 +-
kernel/exit.c | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -823,10 +823,10 @@ static int exec_mmap(struct mm_struct *m
/* Notify parent that we're no longer interested in the old VM */
tsk = current;
old_mm = current->mm;
- sync_mm_rss(old_mm);
mm_release(tsk, old_mm);
if (old_mm) {
+ sync_mm_rss(old_mm);
/*
* Make sure that if there is a core dump in progress
* for the old mm, we get out and die instead of going
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -643,6 +643,7 @@ static void exit_mm(struct task_struct *
mm_release(tsk, mm);
if (!mm)
return;
+ sync_mm_rss(mm);
/*
* Serialize with any possible pending coredump.
* We must hold mmap_sem around checking core_state
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 089/187] PM / Sleep: Prevent waiting forever on asynchronous suspend after abort
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (81 preceding siblings ...)
2012-07-12 22:34 ` [ 088/187] mm: correctly synchronize rss-counters at exit/exec Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 090/187] dmaengine: pl330: dont complete descriptor for cyclic dma Greg Kroah-Hartman
` (97 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Mandeep Singh Baines, Rafael J. Wysocki
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mandeep Singh Baines <msb@chromium.org>
commit 1f758b23177d588a71b96ad02990e715949bb82f upstream.
__device_suspend() must always send a completion. Otherwise, parent
devices will wait forever.
Commit 1e2ef05b, "PM: Limit race conditions between runtime PM and
system sleep (v2)", introduced a regression by short-circuiting the
complete_all() for certain error cases.
This patch fixes the bug by always signalling a completion.
Addresses http://crosbug.com/31972
Tested by injecting an abort.
Signed-off-by: Mandeep Singh Baines <msb@chromium.org>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/power/main.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1021,7 +1021,7 @@ static int __device_suspend(struct devic
dpm_wait_for_children(dev, async);
if (async_error)
- return 0;
+ goto Complete;
pm_runtime_get_noresume(dev);
if (pm_runtime_barrier(dev) && device_may_wakeup(dev))
@@ -1030,7 +1030,7 @@ static int __device_suspend(struct devic
if (pm_wakeup_pending()) {
pm_runtime_put_sync(dev);
async_error = -EBUSY;
- return 0;
+ goto Complete;
}
device_lock(dev);
@@ -1087,6 +1087,8 @@ static int __device_suspend(struct devic
}
device_unlock(dev);
+
+ Complete:
complete_all(&dev->power.completion);
if (error) {
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 090/187] dmaengine: pl330: dont complete descriptor for cyclic dma
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (82 preceding siblings ...)
2012-07-12 22:34 ` [ 089/187] PM / Sleep: Prevent waiting forever on asynchronous suspend after abort Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 091/187] NFS: Force the legacy idmapper to be single threaded Greg Kroah-Hartman
` (96 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Tushar Behera, Jassi Brar, Vinod Koul
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tushar Behera <tushar.behera@linaro.org>
commit 30c1dc0ff30b5552e8af555265dbeac5637cbb48 upstream.
Commit eab215855803 ("dmaengine: pl330: dont complete descriptor for
cyclic dma") wrongly completes descriptor for cyclic dma, hence following
BUG_ON is still hit with cyclic DMA operations.
kernel BUG at drivers/dma/dmaengine.h:53!
Signed-off-by: Tushar Behera <tushar.behera@linaro.org>
Acked-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/pl330.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2322,7 +2322,7 @@ static void pl330_tasklet(unsigned long
/* Pick up ripe tomatoes */
list_for_each_entry_safe(desc, _dt, &pch->work_list, node)
if (desc->status == DONE) {
- if (pch->cyclic)
+ if (!pch->cyclic)
dma_cookie_complete(&desc->txd);
list_move_tail(&desc->node, &list);
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 091/187] NFS: Force the legacy idmapper to be single threaded
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (83 preceding siblings ...)
2012-07-12 22:34 ` [ 090/187] dmaengine: pl330: dont complete descriptor for cyclic dma Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 092/187] clk: Allow late cache allocation for clk->parents Greg Kroah-Hartman
` (95 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Bryan Schumaker, Trond Myklebust
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryan Schumaker <bjschuma@netapp.com>
commit b1027439dff844675f6c0df97a1b1d190791a699 upstream.
It was initially coded under the assumption that there would only be one
request at a time, so use a lock to enforce this requirement..
Signed-off-by: Bryan Schumaker <bjschuma@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/idmap.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/fs/nfs/idmap.c
+++ b/fs/nfs/idmap.c
@@ -57,6 +57,11 @@ unsigned int nfs_idmap_cache_timeout = 6
static const struct cred *id_resolver_cache;
static struct key_type key_type_id_resolver_legacy;
+struct idmap {
+ struct rpc_pipe *idmap_pipe;
+ struct key_construction *idmap_key_cons;
+ struct mutex idmap_mutex;
+};
/**
* nfs_fattr_init_names - initialise the nfs_fattr owner_name/group_name fields
@@ -310,9 +315,11 @@ static ssize_t nfs_idmap_get_key(const c
name, namelen, type, data,
data_size, NULL);
if (ret < 0) {
+ mutex_lock(&idmap->idmap_mutex);
ret = nfs_idmap_request_key(&key_type_id_resolver_legacy,
name, namelen, type, data,
data_size, idmap);
+ mutex_unlock(&idmap->idmap_mutex);
}
return ret;
}
@@ -354,11 +361,6 @@ static int nfs_idmap_lookup_id(const cha
/* idmap classic begins here */
module_param(nfs_idmap_cache_timeout, int, 0644);
-struct idmap {
- struct rpc_pipe *idmap_pipe;
- struct key_construction *idmap_key_cons;
-};
-
enum {
Opt_find_uid, Opt_find_gid, Opt_find_user, Opt_find_group, Opt_find_err
};
@@ -469,6 +471,7 @@ nfs_idmap_new(struct nfs_client *clp)
return error;
}
idmap->idmap_pipe = pipe;
+ mutex_init(&idmap->idmap_mutex);
clp->cl_idmap = idmap;
return 0;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 092/187] clk: Allow late cache allocation for clk->parents
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (84 preceding siblings ...)
2012-07-12 22:34 ` [ 091/187] NFS: Force the legacy idmapper to be single threaded Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 093/187] clk: fix parent validation in __clk_set_parent() Greg Kroah-Hartman
` (94 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Rajendra Nayak, Mike Turquette
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajendra Nayak <rnayak@ti.com>
commit 7975059db572eb47f0fb272a62afeae272a4b209 upstream.
Parent clocks for muxes are cached in clk->parents to
avoid frequent lookups, however the cache allocation happens
only during clock registeration and later clk_set_parent()
assumes a cache space available and allocated.
This is not entirely true for platforms which do early clock
registerations wherein the cache allocation using kzalloc
could fail during clock registeration.
Allow cache allocation to happen later as part of clk_set_parent()
to help such cases and avoid crashes assuming a cache being
available.
While here also replace existing kmalloc() with kzalloc()
in the file.
Signed-off-by: Rajendra Nayak <rnayak@ti.com>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/clk.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -997,7 +997,7 @@ static struct clk *__clk_init_parent(str
if (!clk->parents)
clk->parents =
- kmalloc((sizeof(struct clk*) * clk->num_parents),
+ kzalloc((sizeof(struct clk*) * clk->num_parents),
GFP_KERNEL);
if (!clk->parents)
@@ -1063,9 +1063,13 @@ static int __clk_set_parent(struct clk *
old_parent = clk->parent;
/* find index of new parent clock using cached parent ptrs */
- for (i = 0; i < clk->num_parents; i++)
- if (clk->parents[i] == parent)
- break;
+ if (clk->parents)
+ for (i = 0; i < clk->num_parents; i++)
+ if (clk->parents[i] == parent)
+ break;
+ else
+ clk->parents = kzalloc((sizeof(struct clk*) * clk->num_parents),
+ GFP_KERNEL);
/*
* find index of new parent clock using string name comparison
@@ -1074,7 +1078,8 @@ static int __clk_set_parent(struct clk *
if (i == clk->num_parents)
for (i = 0; i < clk->num_parents; i++)
if (!strcmp(clk->parent_names[i], parent->name)) {
- clk->parents[i] = __clk_lookup(parent->name);
+ if (clk->parents)
+ clk->parents[i] = __clk_lookup(parent->name);
break;
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 093/187] clk: fix parent validation in __clk_set_parent()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (85 preceding siblings ...)
2012-07-12 22:34 ` [ 092/187] clk: Allow late cache allocation for clk->parents Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 094/187] gpiolib: wm8994: Pay attention to the value set when enabling as output Greg Kroah-Hartman
` (93 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Marc Kleine-Budde, Rajendra Nayak,
Mike Turquette
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajendra Nayak <rnayak@ti.com>
commit 863b13271f1608ab3af6f7a371047d9a66693e38 upstream.
The below commit introduced a bug in __clk_set_parent()
which could cause it to *skip* the parent validation
which makes sure the parent passed to the api is a valid
one.
commit 7975059db572eb47f0fb272a62afeae272a4b209
Author: Rajendra Nayak <rnayak@ti.com>
Date: Wed Jun 6 14:41:31 2012 +0530
clk: Allow late cache allocation for clk->parents
This was identified by the following compiler warning..
drivers/clk/clk.c: In function '__clk_set_parent':
drivers/clk/clk.c:1083:5: warning: 'i' may be used uninitialized in this function [-Wuninitialized]
.. as reported by Marc Kleine-Budde.
There were various options discussed on how to fix this, one
being initing 'i' to clk->num_parents, but the below approach
was found to be more appropriate as it also makes the 'parent
validation' code simpler to read.
Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Rajendra Nayak <rnayak@ti.com>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/clk.c | 28 +++++++++++++---------------
1 file changed, 13 insertions(+), 15 deletions(-)
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1062,26 +1062,24 @@ static int __clk_set_parent(struct clk *
old_parent = clk->parent;
- /* find index of new parent clock using cached parent ptrs */
- if (clk->parents)
- for (i = 0; i < clk->num_parents; i++)
- if (clk->parents[i] == parent)
- break;
- else
+ if (!clk->parents)
clk->parents = kzalloc((sizeof(struct clk*) * clk->num_parents),
GFP_KERNEL);
/*
- * find index of new parent clock using string name comparison
- * also try to cache the parent to avoid future calls to __clk_lookup
+ * find index of new parent clock using cached parent ptrs,
+ * or if not yet cached, use string name comparison and cache
+ * them now to avoid future calls to __clk_lookup.
*/
- if (i == clk->num_parents)
- for (i = 0; i < clk->num_parents; i++)
- if (!strcmp(clk->parent_names[i], parent->name)) {
- if (clk->parents)
- clk->parents[i] = __clk_lookup(parent->name);
- break;
- }
+ for (i = 0; i < clk->num_parents; i++) {
+ if (clk->parents && clk->parents[i] == parent)
+ break;
+ else if (!strcmp(clk->parent_names[i], parent->name)) {
+ if (clk->parents)
+ clk->parents[i] = __clk_lookup(parent->name);
+ break;
+ }
+ }
if (i == clk->num_parents) {
pr_debug("%s: clock %s is not a possible parent of clock %s\n",
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 094/187] gpiolib: wm8994: Pay attention to the value set when enabling as output
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (86 preceding siblings ...)
2012-07-12 22:34 ` [ 093/187] clk: fix parent validation in __clk_set_parent() Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 095/187] USB: option: add id for Cellient MEN-200 Greg Kroah-Hartman
` (92 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Mark Brown, Linus Walleij
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <broonie@opensource.wolfsonmicro.com>
commit 8cd578b6e28693f357867a77598a88ef3deb6b39 upstream.
Not paying attention to the value being set is a bad thing because it
means that we'll not set the hardware up to reflect what was requested.
Not setting the hardware up to reflect what was requested means that the
caller won't get the results they wanted.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpio-wm8994.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/gpio/gpio-wm8994.c
+++ b/drivers/gpio/gpio-wm8994.c
@@ -89,8 +89,11 @@ static int wm8994_gpio_direction_out(str
struct wm8994_gpio *wm8994_gpio = to_wm8994_gpio(chip);
struct wm8994 *wm8994 = wm8994_gpio->wm8994;
+ if (value)
+ value = WM8994_GPN_LVL;
+
return wm8994_set_bits(wm8994, WM8994_GPIO_1 + offset,
- WM8994_GPN_DIR, 0);
+ WM8994_GPN_DIR | WM8994_GPN_LVL, value);
}
static void wm8994_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 095/187] USB: option: add id for Cellient MEN-200
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (87 preceding siblings ...)
2012-07-12 22:34 ` [ 094/187] gpiolib: wm8994: Pay attention to the value set when enabling as output Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 096/187] USB: option: Add USB ID for Novatel Ovation MC551 Greg Kroah-Hartman
` (91 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Dmitry Shmygov
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Shmygov <shmygov@rambler.ru>
commit 1e2c4e59d2b8797973471b4a287a43eac12a0f40 upstream.
Add vendor and product ID to option.c driver
for Cellient MEN-200 EVDO Rev.B 450MHz data module.
http://cellient.com
Signed-off-by: Dmitry Shmygov <shmygov@rambler.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -497,6 +497,10 @@ static void option_instat_callback(struc
/* MediaTek products */
#define MEDIATEK_VENDOR_ID 0x0e8d
+/* Cellient products */
+#define CELLIENT_VENDOR_ID 0x2692
+#define CELLIENT_PRODUCT_MEN200 0x9005
+
/* some devices interfaces need special handling due to a number of reasons */
enum option_blacklist_reason {
OPTION_BLACKLIST_NONE = 0,
@@ -1233,6 +1237,7 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a1, 0xff, 0x02, 0x01) },
{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a2, 0xff, 0x00, 0x00) },
{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a2, 0xff, 0x02, 0x01) }, /* MediaTek MT6276M modem & app port */
+ { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
{ } /* Terminating entry */
};
MODULE_DEVICE_TABLE(usb, option_ids);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 096/187] USB: option: Add USB ID for Novatel Ovation MC551
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (88 preceding siblings ...)
2012-07-12 22:34 ` [ 095/187] USB: option: add id for Cellient MEN-200 Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 097/187] USB: CP210x Add 10 Device IDs Greg Kroah-Hartman
` (90 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Forest Bond, Dan Williams
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Forest Bond <forest.bond@rapidrollout.com>
commit 065b07e7a14676f4138ce4619d229c0be5a74230 upstream.
This device is also known as the Verizon USB551L.
Signed-off-by: Forest Bond <forest.bond@rapidrollout.com>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -236,6 +236,7 @@ static void option_instat_callback(struc
#define NOVATELWIRELESS_PRODUCT_G1 0xA001
#define NOVATELWIRELESS_PRODUCT_G1_M 0xA002
#define NOVATELWIRELESS_PRODUCT_G2 0xA010
+#define NOVATELWIRELESS_PRODUCT_MC551 0xB001
/* AMOI PRODUCTS */
#define AMOI_VENDOR_ID 0x1614
@@ -738,6 +739,8 @@ static const struct usb_device_id option
{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1) },
{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1_M) },
{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G2) },
+ /* Novatel Ovation MC551 a.k.a. Verizon USB551L */
+ { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) },
{ USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
{ USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 097/187] USB: CP210x Add 10 Device IDs
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (89 preceding siblings ...)
2012-07-12 22:34 ` [ 096/187] USB: option: Add USB ID for Novatel Ovation MC551 Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 098/187] SCSI & usb-storage: add try_rc_10_first flag Greg Kroah-Hartman
` (89 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Craig Shelley
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Craig Shelley <craig@microtron.org.uk>
commit 3fcc8f96829776cf181918461923d1e3bbb831a2 upstream.
This patch adds 10 device IDs for CP210x based devices from the following manufacturers:
Timewave
Clipsal
Festo
Link Instruments
Signed-off-by: Craig Shelley <craig@microtron.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/cp210x.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -93,6 +93,7 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */
{ USB_DEVICE(0x10C4, 0x8156) }, /* B&G H3000 link cable */
{ USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */
+ { USB_DEVICE(0x10C4, 0x815F) }, /* Timewave HamLinkUSB */
{ USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */
{ USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */
{ USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */
@@ -134,7 +135,13 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */
{ USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */
{ USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */
+ { USB_DEVICE(0x166A, 0x0201) }, /* Clipsal 5500PACA C-Bus Pascal Automation Controller */
+ { USB_DEVICE(0x166A, 0x0301) }, /* Clipsal 5800PC C-Bus Wireless PC Interface */
{ USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */
+ { USB_DEVICE(0x166A, 0x0304) }, /* Clipsal 5000CT2 C-Bus Black and White Touchscreen */
+ { USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */
+ { USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */
+ { USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */
{ USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
{ USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */
{ USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
@@ -146,7 +153,11 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
{ USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
{ USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
+ { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
+ { USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */
{ USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
+ { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
+ { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
{ USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
{ } /* Terminating Entry */
};
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 098/187] SCSI & usb-storage: add try_rc_10_first flag
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (90 preceding siblings ...)
2012-07-12 22:34 ` [ 097/187] USB: CP210x Add 10 Device IDs Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 099/187] usb-storage: revert commit afff07e61a52 (Add 090c:1000 to unusal-devs) Greg Kroah-Hartman
` (88 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Alan Stern, Hans de Goede,
James E.J. Bottomley, Matthew Dharm
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 6a0bdffa0073857870a4ed1b4489762146359eb4 upstream.
Several bug reports have been received recently for USB mass-storage
devices that don't handle READ CAPACITY(16) commands properly. They
report bogus sizes, in some cases becoming unusable as a result.
The bugs were triggered by commit
09b6b51b0b6c1b9bb61815baf205e4d74c89ff04 (SCSI & usb-storage: add
flags for VPD pages and REPORT LUNS), which caused usb-storage to stop
overriding the SCSI level reported by devices. By default, the sd
driver will try READ CAPACITY(16) first for any device whose level is
above SCSI_SPC_2.
It seems likely that any device large enough to require the use of
READ CAPACITY(16) (i.e., 2 TB or more) would be able to handle READ
CAPACITY(10) commands properly. Indeed, I don't know of any devices
that don't handle READ CAPACITY(10) properly.
Therefore this patch (as1559) adds a new flag telling the sd driver
to try READ CAPACITY(10) before READ CAPACITY(16), and sets this flag
for every USB mass-storage device. If a device really is larger than
2 TB, sd will fall back to READ CAPACITY(16) just as it used to.
This fixes Bugzilla #43391.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Hans de Goede <hdegoede@redhat.com>
CC: "James E.J. Bottomley" <JBottomley@parallels.com>
CC: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/sd.c | 2 ++
drivers/usb/storage/scsiglue.c | 6 ++++++
include/scsi/scsi_device.h | 1 +
3 files changed, 9 insertions(+)
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1898,6 +1898,8 @@ static int sd_try_rc16_first(struct scsi
{
if (sdp->host->max_cmd_len < 16)
return 0;
+ if (sdp->try_rc_10_first)
+ return 0;
if (sdp->scsi_level > SCSI_SPC_2)
return 1;
if (scsi_device_protection(sdp))
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -202,6 +202,12 @@ static int slave_configure(struct scsi_d
if (us->fflags & US_FL_NO_READ_CAPACITY_16)
sdev->no_read_capacity_16 = 1;
+ /*
+ * Many devices do not respond properly to READ_CAPACITY_16.
+ * Tell the SCSI layer to try READ_CAPACITY_10 first.
+ */
+ sdev->try_rc_10_first = 1;
+
/* assume SPC3 or latter devices support sense size > 18 */
if (sdev->scsi_level > SCSI_SPC_2)
us->fflags |= US_FL_SANE_SENSE;
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -151,6 +151,7 @@ struct scsi_device {
SD_LAST_BUGGY_SECTORS */
unsigned no_read_disc_info:1; /* Avoid READ_DISC_INFO cmds */
unsigned no_read_capacity_16:1; /* Avoid READ_CAPACITY_16 cmds */
+ unsigned try_rc_10_first:1; /* Try READ_CAPACACITY_10 first */
unsigned is_visible:1; /* is the device visible in sysfs */
DECLARE_BITMAP(supported_events, SDEV_EVT_MAXBITS); /* supported events */
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 099/187] usb-storage: revert commit afff07e61a52 (Add 090c:1000 to unusal-devs)
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (91 preceding siblings ...)
2012-07-12 22:34 ` [ 098/187] SCSI & usb-storage: add try_rc_10_first flag Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 100/187] cfg80211: fix potential deadlock in regulatory Greg Kroah-Hartman
` (87 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Alan Stern, Hans de Goede, Matthew Dharm
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 0070513b5e005161a7a7fd9a3f48f982b41eb094 upstream.
This patch (as1560) reverts commit
afff07e61a5243e14ee3f0a272a0380cd744a8a3 (usb-storage: Add 090c:1000
to unusal-devs). It is no longer needed, because usb-storage now
tells the sd driver to try READ CAPACITY(10) before READ CAPACITY(16)
for every USB mass-storage device.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Hans de Goede <hdegoede@redhat.com>
CC: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 7 -------
1 file changed, 7 deletions(-)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1107,13 +1107,6 @@ UNUSUAL_DEV( 0x090a, 0x1200, 0x0000, 0x9
USB_SC_RBC, USB_PR_BULK, NULL,
0 ),
-/* Feiya QDI U2 DISK, reported by Hans de Goede <hdegoede@redhat.com> */
-UNUSUAL_DEV( 0x090c, 0x1000, 0x0000, 0xffff,
- "Feiya",
- "QDI U2 DISK",
- USB_SC_DEVICE, USB_PR_DEVICE, NULL,
- US_FL_NO_READ_CAPACITY_16 ),
-
/* aeb */
UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff,
"Feiya",
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 100/187] cfg80211: fix potential deadlock in regulatory
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (92 preceding siblings ...)
2012-07-12 22:34 ` [ 099/187] usb-storage: revert commit afff07e61a52 (Add 090c:1000 to unusal-devs) Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 101/187] batman-adv: fix skb->data assignment Greg Kroah-Hartman
` (86 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Eliad Peller, Johannes Berg
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliad Peller <eliad@wizery.com>
commit fe20b39ec32e975f1054c0b7866c873a954adf05 upstream.
reg_timeout_work() calls restore_regulatory_settings() which
takes cfg80211_mutex.
reg_set_request_processed() already holds cfg80211_mutex
before calling cancel_delayed_work_sync(reg_timeout),
so it might deadlock.
Call the async cancel_delayed_work instead, in order
to avoid the potential deadlock.
This is the relevant lockdep warning:
cfg80211: Calling CRDA for country: XX
======================================================
[ INFO: possible circular locking dependency detected ]
3.4.0-rc5-wl+ #26 Not tainted
-------------------------------------------------------
kworker/0:2/1391 is trying to acquire lock:
(cfg80211_mutex){+.+.+.}, at: [<bf28ae00>] restore_regulatory_settings+0x34/0x418 [cfg80211]
but task is already holding lock:
((reg_timeout).work){+.+...}, at: [<c0059e94>] process_one_work+0x1f0/0x480
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 ((reg_timeout).work){+.+...}:
[<c008fd44>] validate_chain+0xb94/0x10f0
[<c0090b68>] __lock_acquire+0x8c8/0x9b0
[<c0090d40>] lock_acquire+0xf0/0x114
[<c005b600>] wait_on_work+0x4c/0x154
[<c005c000>] __cancel_work_timer+0xd4/0x11c
[<c005c064>] cancel_delayed_work_sync+0x1c/0x20
[<bf28b274>] reg_set_request_processed+0x50/0x78 [cfg80211]
[<bf28bd84>] set_regdom+0x550/0x600 [cfg80211]
[<bf294cd8>] nl80211_set_reg+0x218/0x258 [cfg80211]
[<c03c7738>] genl_rcv_msg+0x1a8/0x1e8
[<c03c6a00>] netlink_rcv_skb+0x5c/0xc0
[<c03c7584>] genl_rcv+0x28/0x34
[<c03c6720>] netlink_unicast+0x15c/0x228
[<c03c6c7c>] netlink_sendmsg+0x218/0x298
[<c03933c8>] sock_sendmsg+0xa4/0xc0
[<c039406c>] __sys_sendmsg+0x1e4/0x268
[<c0394228>] sys_sendmsg+0x4c/0x70
[<c0013840>] ret_fast_syscall+0x0/0x3c
-> #1 (reg_mutex){+.+.+.}:
[<c008fd44>] validate_chain+0xb94/0x10f0
[<c0090b68>] __lock_acquire+0x8c8/0x9b0
[<c0090d40>] lock_acquire+0xf0/0x114
[<c04734dc>] mutex_lock_nested+0x48/0x320
[<bf28b2cc>] reg_todo+0x30/0x538 [cfg80211]
[<c0059f44>] process_one_work+0x2a0/0x480
[<c005a4b4>] worker_thread+0x1bc/0x2bc
[<c0061148>] kthread+0x98/0xa4
[<c0014af4>] kernel_thread_exit+0x0/0x8
-> #0 (cfg80211_mutex){+.+.+.}:
[<c008ed58>] print_circular_bug+0x68/0x2cc
[<c008fb28>] validate_chain+0x978/0x10f0
[<c0090b68>] __lock_acquire+0x8c8/0x9b0
[<c0090d40>] lock_acquire+0xf0/0x114
[<c04734dc>] mutex_lock_nested+0x48/0x320
[<bf28ae00>] restore_regulatory_settings+0x34/0x418 [cfg80211]
[<bf28b200>] reg_timeout_work+0x1c/0x20 [cfg80211]
[<c0059f44>] process_one_work+0x2a0/0x480
[<c005a4b4>] worker_thread+0x1bc/0x2bc
[<c0061148>] kthread+0x98/0xa4
[<c0014af4>] kernel_thread_exit+0x0/0x8
other info that might help us debug this:
Chain exists of:
cfg80211_mutex --> reg_mutex --> (reg_timeout).work
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock((reg_timeout).work);
lock(reg_mutex);
lock((reg_timeout).work);
lock(cfg80211_mutex);
*** DEADLOCK ***
2 locks held by kworker/0:2/1391:
#0: (events){.+.+.+}, at: [<c0059e94>] process_one_work+0x1f0/0x480
#1: ((reg_timeout).work){+.+...}, at: [<c0059e94>] process_one_work+0x1f0/0x480
stack backtrace:
[<c001b928>] (unwind_backtrace+0x0/0x12c) from [<c0471d3c>] (dump_stack+0x20/0x24)
[<c0471d3c>] (dump_stack+0x20/0x24) from [<c008ef70>] (print_circular_bug+0x280/0x2cc)
[<c008ef70>] (print_circular_bug+0x280/0x2cc) from [<c008fb28>] (validate_chain+0x978/0x10f0)
[<c008fb28>] (validate_chain+0x978/0x10f0) from [<c0090b68>] (__lock_acquire+0x8c8/0x9b0)
[<c0090b68>] (__lock_acquire+0x8c8/0x9b0) from [<c0090d40>] (lock_acquire+0xf0/0x114)
[<c0090d40>] (lock_acquire+0xf0/0x114) from [<c04734dc>] (mutex_lock_nested+0x48/0x320)
[<c04734dc>] (mutex_lock_nested+0x48/0x320) from [<bf28ae00>] (restore_regulatory_settings+0x34/0x418 [cfg80211])
[<bf28ae00>] (restore_regulatory_settings+0x34/0x418 [cfg80211]) from [<bf28b200>] (reg_timeout_work+0x1c/0x20 [cfg80211])
[<bf28b200>] (reg_timeout_work+0x1c/0x20 [cfg80211]) from [<c0059f44>] (process_one_work+0x2a0/0x480)
[<c0059f44>] (process_one_work+0x2a0/0x480) from [<c005a4b4>] (worker_thread+0x1bc/0x2bc)
[<c005a4b4>] (worker_thread+0x1bc/0x2bc) from [<c0061148>] (kthread+0x98/0xa4)
[<c0061148>] (kthread+0x98/0xa4) from [<c0014af4>] (kernel_thread_exit+0x0/0x8)
cfg80211: Calling CRDA to update world regulatory domain
cfg80211: World regulatory domain updated:
cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/reg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1389,7 +1389,7 @@ static void reg_set_request_processed(vo
spin_unlock(®_requests_lock);
if (last_request->initiator == NL80211_REGDOM_SET_BY_USER)
- cancel_delayed_work_sync(®_timeout);
+ cancel_delayed_work(®_timeout);
if (need_more_processing)
schedule_work(®_work);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 101/187] batman-adv: fix skb->data assignment
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (93 preceding siblings ...)
2012-07-12 22:34 ` [ 100/187] cfg80211: fix potential deadlock in regulatory Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 102/187] batman-adv: only drop packets of known wifi clients Greg Kroah-Hartman
` (85 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Antonio Quartulli, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Quartulli <ordex@autistici.org>
commit 2c995ff892313009e336ecc8ec3411022f5b1c39 upstream.
skb_linearize(skb) possibly rearranges the skb internal data and then changes
the skb->data pointer value. For this reason any other pointer in the code that
was assigned skb->data before invoking skb_linearise(skb) must be re-assigned.
In the current tt_query message handling code this is not done and therefore, in
case of skb linearization, the pointer used to handle the packet header ends up
in pointing to free'd memory.
This bug was introduced by a73105b8d4c765d9ebfb664d0a66802127d8e4c7
(batman-adv: improved client announcement mechanism)
Signed-off-by: Antonio Quartulli <ordex@autistici.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/routing.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -618,6 +618,8 @@ int recv_tt_query(struct sk_buff *skb, s
* changes */
if (skb_linearize(skb) < 0)
goto out;
+ /* skb_linearize() possibly changed skb->data */
+ tt_query = (struct tt_query_packet *)skb->data;
tt_len = tt_query->tt_data * sizeof(struct tt_change);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 102/187] batman-adv: only drop packets of known wifi clients
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (94 preceding siblings ...)
2012-07-12 22:34 ` [ 101/187] batman-adv: fix skb->data assignment Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 103/187] ixgbe: Do not pad FCoE frames as this can cause issues with FCoE DDP Greg Kroah-Hartman
` (84 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Marek Lindner, Antonio Quartulli
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Lindner <lindner_marek@yahoo.de>
commit 5870adc68fc39d81089f1e80efdf64b97e5c37a1 upstream.
bug introduced with 59b699cdee039d75915c354da06937102d1f9a84
If the source or destination mac address of an ethernet packet
could not be found in the translation table the packet was
dropped if AP isolation was turned on. This behavior would
make it impossible to send broadcast packets over the mesh as
the broadcast address will never enter the translation table.
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Acked-by: Antonio Quartulli <ordex@autistici.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/translation-table.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -1803,10 +1803,10 @@ bool is_ap_isolated(struct bat_priv *bat
{
struct tt_local_entry *tt_local_entry = NULL;
struct tt_global_entry *tt_global_entry = NULL;
- bool ret = true;
+ bool ret = false;
if (!atomic_read(&bat_priv->ap_isolation))
- return false;
+ goto out;
tt_local_entry = tt_local_hash_find(bat_priv, dst);
if (!tt_local_entry)
@@ -1816,10 +1816,10 @@ bool is_ap_isolated(struct bat_priv *bat
if (!tt_global_entry)
goto out;
- if (_is_ap_isolated(tt_local_entry, tt_global_entry))
+ if (!_is_ap_isolated(tt_local_entry, tt_global_entry))
goto out;
- ret = false;
+ ret = true;
out:
if (tt_global_entry)
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 103/187] ixgbe: Do not pad FCoE frames as this can cause issues with FCoE DDP
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (95 preceding siblings ...)
2012-07-12 22:34 ` [ 102/187] batman-adv: only drop packets of known wifi clients Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 104/187] can: c_can: precedence error in c_can_chip_config() Greg Kroah-Hartman
` (83 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Alexander Duyck, Phil Schmitt,
Ross Brattain, Jeff Kirsher, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Duyck <alexander.h.duyck@intel.com>
commit 57efd44c8cad440fb00ef8078cb018ab2f221373 upstream.
FCoE target mode was experiencing issues due to the fact that we were
sending up data frames that were padded to 60 bytes after the DDP logic had
already stripped the frame down to 52 or 56 depending on the use of VLANs.
This was resulting in the FCoE DDP logic having issues since it thought the
frame still had data in it due to the padding.
To resolve this, adding code so that we do not pad FCoE frames prior to
handling them to the stack.
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com>
Tested-by: Ross Brattain <ross.b.brattain@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/ixgbe/ixgbe.h | 4 ++--
drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c | 2 +-
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 14 ++++++++++----
3 files changed, 13 insertions(+), 7 deletions(-)
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
@@ -189,7 +189,7 @@ enum ixgbe_ring_state_t {
__IXGBE_HANG_CHECK_ARMED,
__IXGBE_RX_RSC_ENABLED,
__IXGBE_RX_CSUM_UDP_ZERO_ERR,
- __IXGBE_RX_FCOE_BUFSZ,
+ __IXGBE_RX_FCOE,
};
#define check_for_tx_hang(ring) \
@@ -283,7 +283,7 @@ struct ixgbe_ring_feature {
#if defined(IXGBE_FCOE) && (PAGE_SIZE < 8192)
static inline unsigned int ixgbe_rx_pg_order(struct ixgbe_ring *ring)
{
- return test_bit(__IXGBE_RX_FCOE_BUFSZ, &ring->state) ? 1 : 0;
+ return test_bit(__IXGBE_RX_FCOE, &ring->state) ? 1 : 0;
}
#else
#define ixgbe_rx_pg_order(_ring) 0
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
@@ -628,7 +628,7 @@ static int ixgbe_alloc_q_vector(struct i
f = &adapter->ring_feature[RING_F_FCOE];
if ((rxr_idx >= f->mask) &&
(rxr_idx < f->mask + f->indices))
- set_bit(__IXGBE_RX_FCOE_BUFSZ, &ring->state);
+ set_bit(__IXGBE_RX_FCOE, &ring->state);
}
#endif /* IXGBE_FCOE */
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1036,17 +1036,17 @@ static inline void ixgbe_rx_hash(struct
#ifdef IXGBE_FCOE
/**
* ixgbe_rx_is_fcoe - check the rx desc for incoming pkt type
- * @adapter: address of board private structure
+ * @ring: structure containing ring specific data
* @rx_desc: advanced rx descriptor
*
* Returns : true if it is FCoE pkt
*/
-static inline bool ixgbe_rx_is_fcoe(struct ixgbe_adapter *adapter,
+static inline bool ixgbe_rx_is_fcoe(struct ixgbe_ring *ring,
union ixgbe_adv_rx_desc *rx_desc)
{
__le16 pkt_info = rx_desc->wb.lower.lo_dword.hs_rss.pkt_info;
- return (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) &&
+ return test_bit(__IXGBE_RX_FCOE, &ring->state) &&
((pkt_info & cpu_to_le16(IXGBE_RXDADV_PKTTYPE_ETQF_MASK)) ==
(cpu_to_le16(IXGBE_ETQF_FILTER_FCOE <<
IXGBE_RXDADV_PKTTYPE_ETQF_SHIFT)));
@@ -1519,6 +1519,12 @@ static bool ixgbe_cleanup_headers(struct
skb->truesize -= ixgbe_rx_bufsz(rx_ring);
}
+#ifdef IXGBE_FCOE
+ /* do not attempt to pad FCoE Frames as this will disrupt DDP */
+ if (ixgbe_rx_is_fcoe(rx_ring, rx_desc))
+ return false;
+
+#endif
/* if skb_pad returns an error the skb was freed */
if (unlikely(skb->len < 60)) {
int pad_len = 60 - skb->len;
@@ -1745,7 +1751,7 @@ static bool ixgbe_clean_rx_irq(struct ix
#ifdef IXGBE_FCOE
/* if ddp, not passing to ULD unless for FCP_RSP or error */
- if (ixgbe_rx_is_fcoe(adapter, rx_desc)) {
+ if (ixgbe_rx_is_fcoe(rx_ring, rx_desc)) {
ddp_bytes = ixgbe_fcoe_ddp(adapter, rx_desc, skb);
if (!ddp_bytes) {
dev_kfree_skb_any(skb);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 104/187] can: c_can: precedence error in c_can_chip_config()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (96 preceding siblings ...)
2012-07-12 22:34 ` [ 103/187] ixgbe: Do not pad FCoE frames as this can cause issues with FCoE DDP Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 105/187] can: flexcan: use be32_to_cpup to handle the value of dt entry Greg Kroah-Hartman
` (82 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Dan Carpenter, Oliver Hartkopp,
Marc Kleine-Budde, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit d9cb9bd63eb27ac19f26a8547128c053f43a5da8 upstream.
(CAN_CTRLMODE_LISTENONLY & CAN_CTRLMODE_LOOPBACK) is (0x02 & 0x01) which
is zero so the condition is never true. The intent here was to test
that both flags were set.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/c_can/c_can.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -590,8 +590,8 @@ static void c_can_chip_config(struct net
priv->write_reg(priv, &priv->regs->control,
CONTROL_ENABLE_AR);
- if (priv->can.ctrlmode & (CAN_CTRLMODE_LISTENONLY &
- CAN_CTRLMODE_LOOPBACK)) {
+ if ((priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) &&
+ (priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK)) {
/* loopback + silent mode : useful for hot self-test */
priv->write_reg(priv, &priv->regs->control, CONTROL_EIE |
CONTROL_SIE | CONTROL_IE | CONTROL_TEST);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 105/187] can: flexcan: use be32_to_cpup to handle the value of dt entry
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (97 preceding siblings ...)
2012-07-12 22:34 ` [ 104/187] can: c_can: precedence error in c_can_chip_config() Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` =?y?q?=5B=20106/187=5D=20USB=3A=20qmi=5Fwwan=3A=20Make=20forced=20int=204=20whitelist=20generic?= Greg Kroah-Hartman
` (81 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Shawn Guo, Hui Wang, Marc Kleine-Budde
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <jason77.wang@gmail.com>
commit 85f2f834e85517307f13e30e630a5fc86f757cb5 upstream.
The freescale arm i.MX series platform can support this driver, and
usually the arm cpu works in the little endian mode by default, while
device tree entry value is stored in big endian format, we should use
be32_to_cpup() to handle them, after modification, it can work well
both on the le cpu and be cpu.
Cc: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Hui Wang <jason77.wang@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/flexcan.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -933,12 +933,12 @@ static int __devinit flexcan_probe(struc
u32 clock_freq = 0;
if (pdev->dev.of_node) {
- const u32 *clock_freq_p;
+ const __be32 *clock_freq_p;
clock_freq_p = of_get_property(pdev->dev.of_node,
"clock-frequency", NULL);
if (clock_freq_p)
- clock_freq = *clock_freq_p;
+ clock_freq = be32_to_cpup(clock_freq_p);
}
if (!clock_freq) {
^ permalink raw reply [flat|nested] 191+ messages in thread* =?y?q?=5B=20106/187=5D=20USB=3A=20qmi=5Fwwan=3A=20Make=20forced=20int=204=20whitelist=20generic?=
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (98 preceding siblings ...)
2012-07-12 22:34 ` [ 105/187] can: flexcan: use be32_to_cpup to handle the value of dt entry Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` =?y?q?=5B=20107/187=5D=20USB=3A=20qmi=5Fwwan=3A=20Add=20ZTE=20=28Vodafone=29=20K3520-Z?= Greg Kroah-Hartman
` (80 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Andrew Bird, Bjørn Mork,
David S. Miller
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=y, Size: 1622 bytes --]
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Andrew Bird (Sphere Systems)" <ajb@spheresystems.co.uk>
commit 00001880cd8faaa349fe2ebb158f7e0cd8026048 upstream.
Change the forced interface 4 whitelist to use the generic shared
binder instead of the Gobi specific one. Certain ZTE devices
(K3520-Z & K3765-Z) don't work with the Gobi version, but function
quite happily with the generic. This has been tested with the following
devices:
K3520-Z
K3565-Z
K3765-Z
K4505-Z
It hasn't been tested with the ZTE MF820D, which is the only other
device that uses this whitelist at present. Although Bjorn doesn't
expect any problems, any testing with that device would be appreciated.
Signed-off-by: Andrew Bird <ajb@spheresystems.co.uk>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/qmi_wwan.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -357,9 +357,9 @@ static const struct driver_info qmi_wwan
/* ZTE suck at making USB descriptors */
static const struct driver_info qmi_wwan_force_int4 = {
- .description = "Qualcomm Gobi wwan/QMI device",
+ .description = "Qualcomm WWAN/QMI device",
.flags = FLAG_WWAN,
- .bind = qmi_wwan_bind_gobi,
+ .bind = qmi_wwan_bind_shared,
.unbind = qmi_wwan_unbind_shared,
.manage_power = qmi_wwan_manage_power,
.data = BIT(4), /* interface whitelist bitmap */
^ permalink raw reply [flat|nested] 191+ messages in thread* =?y?q?=5B=20107/187=5D=20USB=3A=20qmi=5Fwwan=3A=20Add=20ZTE=20=28Vodafone=29=20K3520-Z?=
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (99 preceding siblings ...)
2012-07-12 22:34 ` =?y?q?=5B=20106/187=5D=20USB=3A=20qmi=5Fwwan=3A=20Make=20forced=20int=204=20whitelist=20generic?= Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` =?y?q?=5B=20108/187=5D=20net=3A=20qmi=5Fwwan=3A=20fix=20Gobi=20device=20probing?= Greg Kroah-Hartman
` (79 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Andrew Bird, Bjørn Mork,
David S. Miller
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=y, Size: 1809 bytes --]
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Andrew Bird (Sphere Systems)" <ajb@spheresystems.co.uk>
commit f7142e6c226076fd40c2ebaad9fb0c9a631b790e upstream.
Signed-off-by: Andrew Bird <ajb@spheresystems.co.uk>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/qmi_wwan.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -356,6 +356,15 @@ static const struct driver_info qmi_wwan
};
/* ZTE suck at making USB descriptors */
+static const struct driver_info qmi_wwan_force_int1 = {
+ .description = "Qualcomm WWAN/QMI device",
+ .flags = FLAG_WWAN,
+ .bind = qmi_wwan_bind_shared,
+ .unbind = qmi_wwan_unbind_shared,
+ .manage_power = qmi_wwan_manage_power,
+ .data = BIT(1), /* interface whitelist bitmap */
+};
+
static const struct driver_info qmi_wwan_force_int4 = {
.description = "Qualcomm WWAN/QMI device",
.flags = FLAG_WWAN,
@@ -430,6 +439,15 @@ static const struct usb_device_id produc
.bInterfaceProtocol = 0xff,
.driver_info = (unsigned long)&qmi_wwan_force_int4,
},
+ { /* ZTE (Vodafone) K3520-Z */
+ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+ .idVendor = 0x19d2,
+ .idProduct = 0x0055,
+ .bInterfaceClass = 0xff,
+ .bInterfaceSubClass = 0xff,
+ .bInterfaceProtocol = 0xff,
+ .driver_info = (unsigned long)&qmi_wwan_force_int1,
+ },
{ /* ZTE (Vodafone) K3565-Z */
.match_flags = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
.idVendor = 0x19d2,
^ permalink raw reply [flat|nested] 191+ messages in thread* =?y?q?=5B=20108/187=5D=20net=3A=20qmi=5Fwwan=3A=20fix=20Gobi=20device=20probing?=
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (100 preceding siblings ...)
2012-07-12 22:34 ` =?y?q?=5B=20107/187=5D=20USB=3A=20qmi=5Fwwan=3A=20Add=20ZTE=20=28Vodafone=29=20K3520-Z?= Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` =?y?q?=5B=20109/187=5D=20net=3A=20qmi=5Fwwan=3A=20fix=20Oops=20while=20disconnecting?= Greg Kroah-Hartman
` (78 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Heinrich Siebmanns (Harvey),
Bjørn Mork, David S. Miller
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=y, Size: 8071 bytes --]
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
commit b9f90eb2740203ff2592efe640409ad48335d1c2 upstream.
Ignoring interfaces with additional descriptors is not a reliable
method for locating the correct interface on Gobi devices. There
is at least one device where this method fails:
https://bbs.archlinux.org/viewtopic.php?id=143506
The result is that the AT command port (interface #2) is hidden
from qcserial, preventing traditional serial modem usage:
[ 15.562552] qmi_wwan 4-1.6:1.0: cdc-wdm0: USB WDM device
[ 15.562691] qmi_wwan 4-1.6:1.0: wwan0: register 'qmi_wwan' at usb-0000:00:1d.0-1.6, Qualcomm Gobi wwan/QMI device, 1e:df:3c:3a:4e:3b
[ 15.563383] qmi_wwan: probe of 4-1.6:1.1 failed with error -22
[ 15.564189] qmi_wwan 4-1.6:1.2: cdc-wdm1: USB WDM device
[ 15.564302] qmi_wwan 4-1.6:1.2: wwan1: register 'qmi_wwan' at usb-0000:00:1d.0-1.6, Qualcomm Gobi wwan/QMI device, 1e:df:3c:3a:4e:3b
[ 15.564328] qmi_wwan: probe of 4-1.6:1.3 failed with error -22
[ 15.569376] qcserial 4-1.6:1.1: Qualcomm USB modem converter detected
[ 15.569440] usb 4-1.6: Qualcomm USB modem converter now attached to ttyUSB0
[ 15.570372] qcserial 4-1.6:1.3: Qualcomm USB modem converter detected
[ 15.570430] usb 4-1.6: Qualcomm USB modem converter now attached to ttyUSB1
Use static interface numbers taken from the interface map in
qcserial for all Gobi devices instead:
Gobi 1K USB layout:
0: serial port (doesn't respond)
1: serial port (doesn't respond)
2: AT-capable modem port
3: QMI/net
Gobi 2K+ USB layout:
0: QMI/net
1: DM/DIAG (use libqcdm from ModemManager for communication)
2: AT-capable modem port
3: NMEA
This should be more reliable over all, and will also prevent the
noisy "probe failed" messages. The whitelisting logic is expected
to be replaced by direct interface number matching in 3.6.
Reported-by: Heinrich Siebmanns (Harvey) <H.Siebmanns@t-online.de>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/qmi_wwan.c | 83 +++++++++++++++++++++------------------------
1 file changed, 40 insertions(+), 43 deletions(-)
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -257,29 +257,6 @@ err:
return rv;
}
-/* Gobi devices uses identical class/protocol codes for all interfaces regardless
- * of function. Some of these are CDC ACM like and have the exact same endpoints
- * we are looking for. This leaves two possible strategies for identifying the
- * correct interface:
- * a) hardcoding interface number, or
- * b) use the fact that the wwan interface is the only one lacking additional
- * (CDC functional) descriptors
- *
- * Let's see if we can get away with the generic b) solution.
- */
-static int qmi_wwan_bind_gobi(struct usbnet *dev, struct usb_interface *intf)
-{
- int rv = -EINVAL;
-
- /* ignore any interface with additional descriptors */
- if (intf->cur_altsetting->extralen)
- goto err;
-
- rv = qmi_wwan_bind_shared(dev, intf);
-err:
- return rv;
-}
-
static void qmi_wwan_unbind_shared(struct usbnet *dev, struct usb_interface *intf)
{
struct usb_driver *subdriver = (void *)dev->data[0];
@@ -347,15 +324,15 @@ static const struct driver_info qmi_wwan
.manage_power = qmi_wwan_manage_power,
};
-static const struct driver_info qmi_wwan_gobi = {
- .description = "Qualcomm Gobi wwan/QMI device",
+static const struct driver_info qmi_wwan_force_int0 = {
+ .description = "Qualcomm WWAN/QMI device",
.flags = FLAG_WWAN,
- .bind = qmi_wwan_bind_gobi,
+ .bind = qmi_wwan_bind_shared,
.unbind = qmi_wwan_unbind_shared,
.manage_power = qmi_wwan_manage_power,
+ .data = BIT(0), /* interface whitelist bitmap */
};
-/* ZTE suck at making USB descriptors */
static const struct driver_info qmi_wwan_force_int1 = {
.description = "Qualcomm WWAN/QMI device",
.flags = FLAG_WWAN,
@@ -365,6 +342,15 @@ static const struct driver_info qmi_wwan
.data = BIT(1), /* interface whitelist bitmap */
};
+static const struct driver_info qmi_wwan_force_int3 = {
+ .description = "Qualcomm WWAN/QMI device",
+ .flags = FLAG_WWAN,
+ .bind = qmi_wwan_bind_shared,
+ .unbind = qmi_wwan_unbind_shared,
+ .manage_power = qmi_wwan_manage_power,
+ .data = BIT(3), /* interface whitelist bitmap */
+};
+
static const struct driver_info qmi_wwan_force_int4 = {
.description = "Qualcomm WWAN/QMI device",
.flags = FLAG_WWAN,
@@ -390,16 +376,23 @@ static const struct driver_info qmi_wwan
static const struct driver_info qmi_wwan_sierra = {
.description = "Sierra Wireless wwan/QMI device",
.flags = FLAG_WWAN,
- .bind = qmi_wwan_bind_gobi,
+ .bind = qmi_wwan_bind_shared,
.unbind = qmi_wwan_unbind_shared,
.manage_power = qmi_wwan_manage_power,
.data = BIT(8) | BIT(19), /* interface whitelist bitmap */
};
#define HUAWEI_VENDOR_ID 0x12D1
+
+/* Gobi 1000 QMI/wwan interface number is 3 according to qcserial */
+#define QMI_GOBI1K_DEVICE(vend, prod) \
+ USB_DEVICE(vend, prod), \
+ .driver_info = (unsigned long)&qmi_wwan_force_int3
+
+/* Gobi 2000 and Gobi 3000 QMI/wwan interface number is 0 according to qcserial */
#define QMI_GOBI_DEVICE(vend, prod) \
USB_DEVICE(vend, prod), \
- .driver_info = (unsigned long)&qmi_wwan_gobi
+ .driver_info = (unsigned long)&qmi_wwan_force_int0
static const struct usb_device_id products[] = {
{ /* Huawei E392, E398 and possibly others sharing both device id and more... */
@@ -493,20 +486,24 @@ static const struct usb_device_id produc
.bInterfaceProtocol = 0xff,
.driver_info = (unsigned long)&qmi_wwan_sierra,
},
- {QMI_GOBI_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
- {QMI_GOBI_DEVICE(0x03f0, 0x1f1d)}, /* HP un2400 Gobi Modem Device */
- {QMI_GOBI_DEVICE(0x03f0, 0x371d)}, /* HP un2430 Mobile Broadband Module */
- {QMI_GOBI_DEVICE(0x04da, 0x250d)}, /* Panasonic Gobi Modem device */
- {QMI_GOBI_DEVICE(0x413c, 0x8172)}, /* Dell Gobi Modem device */
- {QMI_GOBI_DEVICE(0x1410, 0xa001)}, /* Novatel Gobi Modem device */
- {QMI_GOBI_DEVICE(0x0b05, 0x1776)}, /* Asus Gobi Modem device */
- {QMI_GOBI_DEVICE(0x19d2, 0xfff3)}, /* ONDA Gobi Modem device */
- {QMI_GOBI_DEVICE(0x05c6, 0x9001)}, /* Generic Gobi Modem device */
- {QMI_GOBI_DEVICE(0x05c6, 0x9002)}, /* Generic Gobi Modem device */
- {QMI_GOBI_DEVICE(0x05c6, 0x9202)}, /* Generic Gobi Modem device */
- {QMI_GOBI_DEVICE(0x05c6, 0x9203)}, /* Generic Gobi Modem device */
- {QMI_GOBI_DEVICE(0x05c6, 0x9222)}, /* Generic Gobi Modem device */
- {QMI_GOBI_DEVICE(0x05c6, 0x9009)}, /* Generic Gobi Modem device */
+
+ /* Gobi 1000 devices */
+ {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
+ {QMI_GOBI1K_DEVICE(0x03f0, 0x1f1d)}, /* HP un2400 Gobi Modem Device */
+ {QMI_GOBI1K_DEVICE(0x03f0, 0x371d)}, /* HP un2430 Mobile Broadband Module */
+ {QMI_GOBI1K_DEVICE(0x04da, 0x250d)}, /* Panasonic Gobi Modem device */
+ {QMI_GOBI1K_DEVICE(0x413c, 0x8172)}, /* Dell Gobi Modem device */
+ {QMI_GOBI1K_DEVICE(0x1410, 0xa001)}, /* Novatel Gobi Modem device */
+ {QMI_GOBI1K_DEVICE(0x0b05, 0x1776)}, /* Asus Gobi Modem device */
+ {QMI_GOBI1K_DEVICE(0x19d2, 0xfff3)}, /* ONDA Gobi Modem device */
+ {QMI_GOBI1K_DEVICE(0x05c6, 0x9001)}, /* Generic Gobi Modem device */
+ {QMI_GOBI1K_DEVICE(0x05c6, 0x9002)}, /* Generic Gobi Modem device */
+ {QMI_GOBI1K_DEVICE(0x05c6, 0x9202)}, /* Generic Gobi Modem device */
+ {QMI_GOBI1K_DEVICE(0x05c6, 0x9203)}, /* Generic Gobi Modem device */
+ {QMI_GOBI1K_DEVICE(0x05c6, 0x9222)}, /* Generic Gobi Modem device */
+ {QMI_GOBI1K_DEVICE(0x05c6, 0x9009)}, /* Generic Gobi Modem device */
+
+ /* Gobi 2000 and 3000 devices */
{QMI_GOBI_DEVICE(0x413c, 0x8186)}, /* Dell Gobi 2000 Modem device (N0218, VU936) */
{QMI_GOBI_DEVICE(0x05c6, 0x920b)}, /* Generic Gobi 2000 Modem device */
{QMI_GOBI_DEVICE(0x05c6, 0x9225)}, /* Sony Gobi 2000 Modem device (N0279, VU730) */
^ permalink raw reply [flat|nested] 191+ messages in thread* =?y?q?=5B=20109/187=5D=20net=3A=20qmi=5Fwwan=3A=20fix=20Oops=20while=20disconnecting?=
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (101 preceding siblings ...)
2012-07-12 22:34 ` =?y?q?=5B=20108/187=5D=20net=3A=20qmi=5Fwwan=3A=20fix=20Gobi=20device=20probing?= Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 110/187] oprofile: perf: use NR_CPUS instead or nr_cpumask_bits for static array Greg Kroah-Hartman
` (77 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Marius Bjørnstad Kotsbak,
Bjørn Mork, David S. Miller
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=y, Size: 4932 bytes --]
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
commit d9b8706843a501034d09bea63ca6723a2ed02b11 upstream.
usbnet_disconnect() will set intfdata to NULL before calling
the minidriver unbind function. The cdc_wdm subdriver cannot
know that it is disconnecting until the qmi_wwan unbind
function has called its disconnect function. This means that
we must be able to support the cdc_wdm subdriver operating
normally while usbnet_disconnect() is running, and in
particular that intfdata may be NULL.
The only place this matters is in qmi_wwan_cdc_wdm_manage_power
which is called from cdc_wdm. Simply testing for NULL
intfdata there is sufficient to allow it to continue working
at all times.
Fixes this Oops where a cdc-wdm device was closed while the
USB device was disconnecting, causing wdm_release to call
qmi_wwan_cdc_wdm_manage_power after intfdata was set to
NULL by usbnet_disconnect:
[41819.087460] BUG: unable to handle kernel NULL pointer dereference at 00000080
[41819.087815] IP: [<f8640458>] qmi_wwan_manage_power+0x68/0x90 [qmi_wwan]
[41819.088028] *pdpt = 000000000314f001 *pde = 0000000000000000
[41819.088028] Oops: 0002 [#1] SMP
[41819.088028] Modules linked in: qmi_wwan option usb_wwan usbserial usbnet
cdc_wdm nls_iso8859_1 nls_cp437 vfat fat usb_storage bnep rfcomm bluetooth
parport_pc ppdev binfmt_misc iptable_nat nf_nat nf_conntrack_ipv4
nf_conntrack nf_defrag_ipv4 iptable_mangle iptable_filter ip_tables
x_tables dm_crypt uvcvideo snd_hda_codec_realtek snd_hda_intel
videobuf2_core snd_hda_codec joydev videodev videobuf2_vmalloc
hid_multitouch snd_hwdep arc4 videobuf2_memops snd_pcm snd_seq_midi
snd_rawmidi snd_seq_midi_event ath9k mac80211 snd_seq ath9k_common ath9k_hw
ath snd_timer snd_seq_device sparse_keymap dm_multipath scsi_dh coretemp
mac_hid snd soundcore cfg80211 snd_page_alloc psmouse serio_raw microcode
lp parport dm_mirror dm_region_hash dm_log usbhid hid i915 drm_kms_helper
drm r8169 i2c_algo_bit wmi video [last unloaded: qmi_wwan]
[41819.088028]
[41819.088028] Pid: 23292, comm: qmicli Not tainted 3.4.0-5-generic #11-Ubuntu GIGABYTE T1005/T1005
[41819.088028] EIP: 0060:[<f8640458>] EFLAGS: 00010246 CPU: 1
[41819.088028] EIP is at qmi_wwan_manage_power+0x68/0x90 [qmi_wwan]
[41819.088028] EAX: 00000000 EBX: 00000000 ECX: 000000c3 EDX: 00000000
[41819.088028] ESI: c3b27658 EDI: 00000000 EBP: c298bea4 ESP: c298be98
[41819.088028] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[41819.088028] CR0: 8005003b CR2: 00000080 CR3: 3605e000 CR4: 000007f0
[41819.088028] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[41819.088028] DR6: ffff0ff0 DR7: 00000400
[41819.088028] Process qmicli (pid: 23292, ti=c298a000 task=f343b280 task.ti=c298a000)
[41819.088028] Stack:
[41819.088028] 00000000 c3b27658 e2a80d00 c298beb0 f864051a c3b27600 c298bec0 f9027099
[41819.088028] c2fd6000 00000008 c298bef0 c1147f96 00000001 00000000 00000000 f4e54790
[41819.088028] ecf43a00 ecf43a00 c2fd6008 c2fd6000 ebbd7600 ffffffb9 c298bf08 c1144474
[41819.088028] Call Trace:
[41819.088028] [<f864051a>] qmi_wwan_cdc_wdm_manage_power+0x1a/0x20 [qmi_wwan]
[41819.088028] [<f9027099>] wdm_release+0x69/0x70 [cdc_wdm]
[41819.088028] [<c1147f96>] fput+0xe6/0x210
[41819.088028] [<c1144474>] filp_close+0x54/0x80
[41819.088028] [<c1046a65>] put_files_struct+0x75/0xc0
[41819.088028] [<c1046b56>] exit_files+0x46/0x60
[41819.088028] [<c1046f81>] do_exit+0x141/0x780
[41819.088028] [<c107248f>] ? wake_up_state+0xf/0x20
[41819.088028] [<c1053f48>] ? signal_wake_up+0x28/0x40
[41819.088028] [<c1054f3b>] ? zap_other_threads+0x6b/0x80
[41819.088028] [<c1047864>] do_group_exit+0x34/0xa0
[41819.088028] [<c10478e8>] sys_exit_group+0x18/0x20
[41819.088028] [<c15bb7df>] sysenter_do_call+0x12/0x28
[41819.088028] Code: 04 83 e7 01 c1 e7 03 0f b6 42 18 83 e0 f7 09 f8 88 42
18 8b 43 04 e8 48 9a dd c8 89 f0 8b 5d f4 8b 75 f8 8b 7d fc 89 ec 5d c3 90
<f0> ff 88 80 00 00 00 0f 94 c0 84 c0 75 b7 31 f6 8b 5d f4 89 f0
[41819.088028] EIP: [<f8640458>] qmi_wwan_manage_power+0x68/0x90 [qmi_wwan] SS:ESP 0068:c298be98
[41819.088028] CR2: 0000000000000080
[41819.149492] ---[ end trace 0944479ff8257f55 ]---
Reported-by: Marius Bjørnstad Kotsbak <marius.kotsbak@gmail.com>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/qmi_wwan.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -197,6 +197,10 @@ err:
static int qmi_wwan_cdc_wdm_manage_power(struct usb_interface *intf, int on)
{
struct usbnet *dev = usb_get_intfdata(intf);
+
+ /* can be called while disconnecting */
+ if (!dev)
+ return 0;
return qmi_wwan_manage_power(dev, on);
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 110/187] oprofile: perf: use NR_CPUS instead or nr_cpumask_bits for static array
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (102 preceding siblings ...)
2012-07-12 22:34 ` =?y?q?=5B=20109/187=5D=20net=3A=20qmi=5Fwwan=3A=20fix=20Oops=20while=20disconnecting?= Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 111/187] x86, compat: Use test_thread_flag(TIF_IA32) in compat signal delivery Greg Kroah-Hartman
` (76 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Matt Fleming,
Russell King - ARM Linux, Will Deacon, Robert Richter
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit e734568b675c985db2026848fefaac01c22977a5 upstream.
The OProfile perf backend uses a static array to keep track of the
perf events on the system. When compiling with CONFIG_CPUMASK_OFFSTACK=y
&& SMP, nr_cpumask_bits is not a compile-time constant and the build
will fail with:
oprofile_perf.c:28: error: variably modified 'perf_events' at file scope
This patch uses NR_CPUs instead of nr_cpumask_bits for the array
initialisation. If this causes space problems in the future, we can
always move to dynamic allocation for the events array.
Cc: Matt Fleming <matt@console-pimps.org>
Reported-by: Russell King - ARM Linux <linux@arm.linux.org.uk>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Robert Richter <robert.richter@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/oprofile/oprofile_perf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/oprofile/oprofile_perf.c
+++ b/drivers/oprofile/oprofile_perf.c
@@ -25,7 +25,7 @@ static int oprofile_perf_enabled;
static DEFINE_MUTEX(oprofile_perf_mutex);
static struct op_counter_config *counter_config;
-static struct perf_event **perf_events[nr_cpumask_bits];
+static struct perf_event **perf_events[NR_CPUS];
static int num_counters;
/*
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 111/187] x86, compat: Use test_thread_flag(TIF_IA32) in compat signal delivery
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (103 preceding siblings ...)
2012-07-12 22:34 ` [ 110/187] oprofile: perf: use NR_CPUS instead or nr_cpumask_bits for static array Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 112/187] x86, cpufeature: Rename X86_FEATURE_DTS to X86_FEATURE_DTHERM Greg Kroah-Hartman
` (75 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Suresh Siddha, H. Peter Anvin
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suresh Siddha <suresh.b.siddha@intel.com>
commit 0b91f45b23cb73ce11acdc3cf4c6efd4441e3b3e upstream.
Signal delivery compat path may not have the 'TS_COMPAT' flag (that
flag indicates how we entered the kernel). So use
test_thread_flag(TIF_IA32) instead of is_ia32_task(): one of the
functions of TIF_IA32 is just what kind of signal frame we want.
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Link: http://lkml.kernel.org/r/1339722435.3475.57.camel@sbsiddha-desk.sc.intel.com
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/ia32/ia32_signal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/ia32/ia32_signal.c
+++ b/arch/x86/ia32/ia32_signal.c
@@ -38,7 +38,7 @@
int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
{
int err = 0;
- bool ia32 = is_ia32_task();
+ bool ia32 = test_thread_flag(TIF_IA32);
if (!access_ok(VERIFY_WRITE, to, sizeof(compat_siginfo_t)))
return -EFAULT;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 112/187] x86, cpufeature: Rename X86_FEATURE_DTS to X86_FEATURE_DTHERM
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (104 preceding siblings ...)
2012-07-12 22:34 ` [ 111/187] x86, compat: Use test_thread_flag(TIF_IA32) in compat signal delivery Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 113/187] igbvf: fix divide by zero Greg Kroah-Hartman
` (74 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Jean Delvare, Jan Beulich, H. Peter Anvin
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "H. Peter Anvin" <hpa@linux.intel.com>
commit 4ad33411308596f2f918603509729922a1ec4411 upstream.
It makes sense to label "Digital Thermal Sensor" as "DTS", but
unfortunately the string "dts" was already used for "Debug Store", and
/proc/cpuinfo is a user space ABI.
Therefore, rename this to "dtherm".
This conflict went into mainline via the hwmon tree without any x86
maintainer ack, and without any kind of hint in the subject.
a4659053 x86/hwmon: fix initialization of coretemp
Reported-by: Jean Delvare <khali@linux-fr.org>
Link: http://lkml.kernel.org/r/4FE34BCB.5050305@linux.intel.com
Cc: Jan Beulich <JBeulich@suse.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/cpufeature.h | 2 +-
arch/x86/kernel/cpu/scattered.c | 2 +-
drivers/hwmon/coretemp.c | 4 ++--
3 files changed, 4 insertions(+), 4 deletions(-)
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -176,7 +176,7 @@
#define X86_FEATURE_XSAVEOPT (7*32+ 4) /* Optimized Xsave */
#define X86_FEATURE_PLN (7*32+ 5) /* Intel Power Limit Notification */
#define X86_FEATURE_PTS (7*32+ 6) /* Intel Package Thermal Status */
-#define X86_FEATURE_DTS (7*32+ 7) /* Digital Thermal Sensor */
+#define X86_FEATURE_DTHERM (7*32+ 7) /* Digital Thermal Sensor */
#define X86_FEATURE_HW_PSTATE (7*32+ 8) /* AMD HW-PState */
/* Virtualization flags: Linux defined, word 8 */
--- a/arch/x86/kernel/cpu/scattered.c
+++ b/arch/x86/kernel/cpu/scattered.c
@@ -31,7 +31,7 @@ void __cpuinit init_scattered_cpuid_feat
const struct cpuid_bit *cb;
static const struct cpuid_bit __cpuinitconst cpuid_bits[] = {
- { X86_FEATURE_DTS, CR_EAX, 0, 0x00000006, 0 },
+ { X86_FEATURE_DTHERM, CR_EAX, 0, 0x00000006, 0 },
{ X86_FEATURE_IDA, CR_EAX, 1, 0x00000006, 0 },
{ X86_FEATURE_ARAT, CR_EAX, 2, 0x00000006, 0 },
{ X86_FEATURE_PLN, CR_EAX, 4, 0x00000006, 0 },
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -664,7 +664,7 @@ static void __cpuinit get_core_online(un
* sensors. We check this bit only, all the early CPUs
* without thermal sensors will be filtered out.
*/
- if (!cpu_has(c, X86_FEATURE_DTS))
+ if (!cpu_has(c, X86_FEATURE_DTHERM))
return;
if (!pdev) {
@@ -765,7 +765,7 @@ static struct notifier_block coretemp_cp
};
static const struct x86_cpu_id coretemp_ids[] = {
- { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_DTS },
+ { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_DTHERM },
{}
};
MODULE_DEVICE_TABLE(x86cpu, coretemp_ids);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 113/187] igbvf: fix divide by zero
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (105 preceding siblings ...)
2012-07-12 22:34 ` [ 112/187] x86, cpufeature: Rename X86_FEATURE_DTS to X86_FEATURE_DTHERM Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 114/187] rtlwifi: rtl8192cu: New USB IDs Greg Kroah-Hartman
` (73 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, David Ahern, Mitch Williams,
Aaron Brown, Jeff Kirsher, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mitch A Williams <mitch.a.williams@intel.com>
commit 0e90b49ca4b891f085b57559a3071a4feefb496c upstream.
Using ethtool -C ethX rx-usecs 0 crashes with a divide by zero.
Refactor this function to fix this issue and make it more clear
what the intent of each conditional is. Add comment regarding
using a setting of zero.
CC: David Ahern <daahern@cisco.com>
Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/igbvf/ethtool.c | 29 ++++++++++++++++++-----------
1 file changed, 18 insertions(+), 11 deletions(-)
--- a/drivers/net/ethernet/intel/igbvf/ethtool.c
+++ b/drivers/net/ethernet/intel/igbvf/ethtool.c
@@ -357,21 +357,28 @@ static int igbvf_set_coalesce(struct net
struct igbvf_adapter *adapter = netdev_priv(netdev);
struct e1000_hw *hw = &adapter->hw;
- if ((ec->rx_coalesce_usecs > IGBVF_MAX_ITR_USECS) ||
- ((ec->rx_coalesce_usecs > 3) &&
- (ec->rx_coalesce_usecs < IGBVF_MIN_ITR_USECS)) ||
- (ec->rx_coalesce_usecs == 2))
- return -EINVAL;
-
- /* convert to rate of irq's per second */
- if (ec->rx_coalesce_usecs && ec->rx_coalesce_usecs <= 3) {
+ if ((ec->rx_coalesce_usecs >= IGBVF_MIN_ITR_USECS) &&
+ (ec->rx_coalesce_usecs <= IGBVF_MAX_ITR_USECS)) {
+ adapter->current_itr = ec->rx_coalesce_usecs << 2;
+ adapter->requested_itr = 1000000000 /
+ (adapter->current_itr * 256);
+ } else if ((ec->rx_coalesce_usecs == 3) ||
+ (ec->rx_coalesce_usecs == 2)) {
adapter->current_itr = IGBVF_START_ITR;
adapter->requested_itr = ec->rx_coalesce_usecs;
- } else {
- adapter->current_itr = ec->rx_coalesce_usecs << 2;
+ } else if (ec->rx_coalesce_usecs == 0) {
+ /*
+ * The user's desire is to turn off interrupt throttling
+ * altogether, but due to HW limitations, we can't do that.
+ * Instead we set a very small value in EITR, which would
+ * allow ~967k interrupts per second, but allow the adapter's
+ * internal clocking to still function properly.
+ */
+ adapter->current_itr = 4;
adapter->requested_itr = 1000000000 /
(adapter->current_itr * 256);
- }
+ } else
+ return -EINVAL;
writel(adapter->current_itr,
hw->hw_addr + adapter->rx_ring->itr_register);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 114/187] rtlwifi: rtl8192cu: New USB IDs
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (106 preceding siblings ...)
2012-07-12 22:34 ` [ 113/187] igbvf: fix divide by zero Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 115/187] mac80211: clear ifmgd->bssid only after building DELBA Greg Kroah-Hartman
` (72 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Xose Vazquez Perez, Larry Finger,
John W. Linville
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <Larry.Finger@lwfinger.net>
commit f63d7dabd5da9ef41f28f6d69b29bc084db0ca5a upstream.
The latest Realtek driver for the RTL8188CU and RTL8192CU chips adds three
new USB IDs.
Reported-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -301,9 +301,11 @@ static struct usb_device_id rtl8192c_usb
{RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
{RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
{RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
+ {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
{RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
{RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
{RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+ {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
/* HP - Lite-On ,8188CUS Slim Combo */
{RTL_USB_DEVICE(0x103c, 0x1629, rtl92cu_hal_cfg)},
{RTL_USB_DEVICE(0x13d3, 0x3357, rtl92cu_hal_cfg)}, /* AzureWave */
@@ -345,6 +347,7 @@ static struct usb_device_id rtl8192c_usb
{RTL_USB_DEVICE(0x07b8, 0x8178, rtl92cu_hal_cfg)}, /*Funai -Abocom*/
{RTL_USB_DEVICE(0x0846, 0x9021, rtl92cu_hal_cfg)}, /*Netgear-Sercomm*/
{RTL_USB_DEVICE(0x0b05, 0x17ab, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/
+ {RTL_USB_DEVICE(0x0bda, 0x8186, rtl92cu_hal_cfg)}, /*Realtek 92CE-VAU*/
{RTL_USB_DEVICE(0x0df6, 0x0061, rtl92cu_hal_cfg)}, /*Sitecom-Edimax*/
{RTL_USB_DEVICE(0x0e66, 0x0019, rtl92cu_hal_cfg)}, /*Hawking-Edimax*/
{RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 115/187] mac80211: clear ifmgd->bssid only after building DELBA
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (107 preceding siblings ...)
2012-07-12 22:34 ` [ 114/187] rtlwifi: rtl8192cu: New USB IDs Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 116/187] mac80211: correct behaviour on unrecognised action frames Greg Kroah-Hartman
` (71 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Ido Yariv, Eliad Peller, Johannes Berg
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eliad Peller <eliad@wizery.com>
commit 88a9e31c506c00c8b7a2f1611406d0e38dcb33b3 upstream.
ieee80211_set_disassoc() clears ifmgd->bssid before
building DELBA frames, resulting in frames with invalid
bssid ("00:00:00:00:00:00").
Fix it by clearing ifmgd->bssid only after building
all the needed frames.
After this change, we no longer need to save the
bssid (before clearing it), so remove the local array.
Reported-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/mlme.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1375,7 +1375,6 @@ static void ieee80211_set_disassoc(struc
struct ieee80211_local *local = sdata->local;
struct sta_info *sta;
u32 changed = 0;
- u8 bssid[ETH_ALEN];
ASSERT_MGD_MTX(ifmgd);
@@ -1385,10 +1384,7 @@ static void ieee80211_set_disassoc(struc
if (WARN_ON(!ifmgd->associated))
return;
- memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
-
ifmgd->associated = NULL;
- memset(ifmgd->bssid, 0, ETH_ALEN);
/*
* we need to commit the associated = NULL change because the
@@ -1408,7 +1404,7 @@ static void ieee80211_set_disassoc(struc
netif_carrier_off(sdata->dev);
mutex_lock(&local->sta_mtx);
- sta = sta_info_get(sdata, bssid);
+ sta = sta_info_get(sdata, ifmgd->bssid);
if (sta) {
set_sta_flag(sta, WLAN_STA_BLOCK_BA);
ieee80211_sta_tear_down_BA_sessions(sta, tx);
@@ -1417,13 +1413,16 @@ static void ieee80211_set_disassoc(struc
/* deauthenticate/disassociate now */
if (tx || frame_buf)
- ieee80211_send_deauth_disassoc(sdata, bssid, stype, reason,
- tx, frame_buf);
+ ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
+ reason, tx, frame_buf);
/* flush out frame */
if (tx)
drv_flush(local, false);
+ /* clear bssid only after building the needed mgmt frames */
+ memset(ifmgd->bssid, 0, ETH_ALEN);
+
/* remove AP and TDLS peers */
sta_info_flush(local, sdata);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 116/187] mac80211: correct behaviour on unrecognised action frames
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (108 preceding siblings ...)
2012-07-12 22:34 ` [ 115/187] mac80211: clear ifmgd->bssid only after building DELBA Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 117/187] mwifiex: fix 11n rx packet drop issue Greg Kroah-Hartman
` (70 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Johannes Berg, John W. Linville
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit 4b5ebccc40843104d980f0714bc86bfcd5568941 upstream.
When receiving an "individually addressed" action frame, the
receiver is required to return it to the sender. mac80211
gets this wrong as it also returns group addressed (mcast)
frames to the sender. Fix this and update the reference to
the new 802.11 standards version since things were shuffled
around significantly.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/rx.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2459,7 +2459,7 @@ ieee80211_rx_h_action_return(struct ieee
* frames that we didn't handle, including returning unknown
* ones. For all other modes we will return them to the sender,
* setting the 0x80 bit in the action category, as required by
- * 802.11-2007 7.3.1.11.
+ * 802.11-2012 9.24.4.
* Newer versions of hostapd shall also use the management frame
* registration mechanisms, but older ones still use cooked
* monitor interfaces so push all frames there.
@@ -2469,6 +2469,9 @@ ieee80211_rx_h_action_return(struct ieee
sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
return RX_DROP_MONITOR;
+ if (is_multicast_ether_addr(mgmt->da))
+ return RX_DROP_MONITOR;
+
/* do not return rejected action frames */
if (mgmt->u.action.category & 0x80)
return RX_DROP_UNUSABLE;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 117/187] mwifiex: fix 11n rx packet drop issue
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (109 preceding siblings ...)
2012-07-12 22:34 ` [ 116/187] mac80211: correct behaviour on unrecognised action frames Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 118/187] mwifiex: fix WPS eapol handshake failure Greg Kroah-Hartman
` (69 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Stone Piao, Avinash Patil,
Kiran Divekar, Bing Zhao, John W. Linville
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stone Piao <piaoyun@marvell.com>
commit 925839243dc9aa4ef25305f5afd10ed18258a4ac upstream.
Currently we check the sequence number of last packet received
against start_win. If a sequence hole is detected, start_win is
updated to next sequence number.
Since the rx sequence number is initialized to 0, a corner case
exists when BA setup happens immediately after association. As
0 is a valid sequence number, start_win gets increased to 1
incorrectly. This causes the first packet with sequence number 0
being dropped.
Initialize rx sequence number as 0xffff and skip adjusting
start_win if the sequence number remains 0xffff. The sequence
number will be updated once the first packet is received.
Signed-off-by: Stone Piao <piaoyun@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Kiran Divekar <dkiran@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mwifiex/11n_rxreorder.c | 5 +++--
drivers/net/wireless/mwifiex/11n_rxreorder.h | 7 +++++++
drivers/net/wireless/mwifiex/wmm.c | 2 ++
3 files changed, 12 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -256,7 +256,8 @@ mwifiex_11n_create_rx_reorder_tbl(struct
else
last_seq = priv->rx_seq[tid];
- if (last_seq >= new_node->start_win)
+ if (last_seq != MWIFIEX_DEF_11N_RX_SEQ_NUM &&
+ last_seq >= new_node->start_win)
new_node->start_win = last_seq + 1;
new_node->win_size = win_size;
@@ -596,5 +597,5 @@ void mwifiex_11n_cleanup_reorder_tbl(str
spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
INIT_LIST_HEAD(&priv->rx_reorder_tbl_ptr);
- memset(priv->rx_seq, 0, sizeof(priv->rx_seq));
+ mwifiex_reset_11n_rx_seq_num(priv);
}
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.h
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.h
@@ -37,6 +37,13 @@
#define ADDBA_RSP_STATUS_ACCEPT 0
+#define MWIFIEX_DEF_11N_RX_SEQ_NUM 0xffff
+
+static inline void mwifiex_reset_11n_rx_seq_num(struct mwifiex_private *priv)
+{
+ memset(priv->rx_seq, 0xff, sizeof(priv->rx_seq));
+}
+
int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *,
u16 seqNum,
u16 tid, u8 *ta,
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -404,6 +404,8 @@ mwifiex_wmm_init(struct mwifiex_adapter
priv->add_ba_param.tx_win_size = MWIFIEX_AMPDU_DEF_TXWINSIZE;
priv->add_ba_param.rx_win_size = MWIFIEX_AMPDU_DEF_RXWINSIZE;
+ mwifiex_reset_11n_rx_seq_num(priv);
+
atomic_set(&priv->wmm.tx_pkts_queued, 0);
atomic_set(&priv->wmm.highest_queued_prio, HIGH_PRIO_TID);
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 118/187] mwifiex: fix WPS eapol handshake failure
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (110 preceding siblings ...)
2012-07-12 22:34 ` [ 117/187] mwifiex: fix 11n rx packet drop issue Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` =?y?q?=5B=20119/187=5D=20vfs=3A=20make=20O=5FPATH=20file=20descriptors=20usable=20for=20fchdir=28=29?= Greg Kroah-Hartman
` (68 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Stone Piao, Avinash Patil,
Bing Zhao, John W. Linville
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stone Piao <piaoyun@marvell.com>
commit f03ba7e9a24e5e9efaad56bd1713b994ea556b16 upstream.
After association, STA will go through eapol handshake with WPS
enabled AP. It's observed that WPS handshake fails with some 11n
AP. The reason for the failure is that the eapol packet is sent
via 11n frame aggregation.
The eapol packet should be sent directly without 11n aggregation.
This patch fixes the problem by adding WPS session control while
dequeuing Tx packets for transmission.
Signed-off-by: Stone Piao <piaoyun@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mwifiex/wmm.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -1211,6 +1211,7 @@ mwifiex_dequeue_tx_packet(struct mwifiex
if (!ptr->is_11n_enabled ||
mwifiex_is_ba_stream_setup(priv, ptr, tid) ||
+ priv->wps.session_enable ||
((priv->sec_info.wpa_enabled ||
priv->sec_info.wpa2_enabled) &&
!priv->wpa_is_gtk_set)) {
^ permalink raw reply [flat|nested] 191+ messages in thread* =?y?q?=5B=20119/187=5D=20vfs=3A=20make=20O=5FPATH=20file=20descriptors=20usable=20for=20fchdir=28=29?=
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (111 preceding siblings ...)
2012-07-12 22:34 ` [ 118/187] mwifiex: fix WPS eapol handshake failure Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 120/187] mtd: cafe_nand: fix an & vs | mistake Greg Kroah-Hartman
` (67 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan,
ольга
крыжановская,
Al Viro
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=y, Size: 1440 bytes --]
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit 332a2e1244bd08b9e3ecd378028513396a004a24 upstream.
We already use them for openat() and friends, but fchdir() also wants to
be able to use O_PATH file descriptors. This should make it comparable
to the O_SEARCH of Solaris. In particular, O_PATH allows you to access
(not-quite-open) a directory you don't have read persmission to, only
execute permission.
Noticed during development of multithread support for ksh93.
Reported-by: ольга крыжановская <olga.kryzhanovska@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/open.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/open.c
+++ b/fs/open.c
@@ -396,10 +396,10 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
{
struct file *file;
struct inode *inode;
- int error;
+ int error, fput_needed;
error = -EBADF;
- file = fget(fd);
+ file = fget_raw_light(fd, &fput_needed);
if (!file)
goto out;
@@ -413,7 +413,7 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
if (!error)
set_fs_pwd(current->fs, &file->f_path);
out_putf:
- fput(file);
+ fput_light(file, fput_needed);
out:
return error;
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 120/187] mtd: cafe_nand: fix an & vs | mistake
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (112 preceding siblings ...)
2012-07-12 22:34 ` =?y?q?=5B=20119/187=5D=20vfs=3A=20make=20O=5FPATH=20file=20descriptors=20usable=20for=20fchdir=28=29?= Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 121/187] aio: make kiocb->private NUll in init_sync_kiocb() Greg Kroah-Hartman
` (66 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Dan Carpenter, Artem Bityutskiy,
David Woodhouse
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 48f8b641297df49021093763a3271119a84990a2 upstream.
The intent here was clearly to set result to true if the 0x40000000 flag
was set. But instead there was a | vs & typo and we always set result
to true.
Artem: check the spec at
wiki.laptop.org/images/5/5c/88ALP01_Datasheet_July_2007.pdf
and this fix looks correct.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/cafe_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/nand/cafe_nand.c
+++ b/drivers/mtd/nand/cafe_nand.c
@@ -102,7 +102,7 @@ static const char *part_probes[] = { "cm
static int cafe_device_ready(struct mtd_info *mtd)
{
struct cafe_priv *cafe = mtd->priv;
- int result = !!(cafe_readl(cafe, NAND_STATUS) | 0x40000000);
+ int result = !!(cafe_readl(cafe, NAND_STATUS) & 0x40000000);
uint32_t irqs = cafe_readl(cafe, NAND_IRQ);
cafe_writel(cafe, irqs, NAND_IRQ);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 121/187] aio: make kiocb->private NUll in init_sync_kiocb()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (113 preceding siblings ...)
2012-07-12 22:34 ` [ 120/187] mtd: cafe_nand: fix an & vs | mistake Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 122/187] ocfs2: clear unaligned io flag when dio fails Greg Kroah-Hartman
` (65 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Junxiao Bi, Jeff Moyer, Joel Becker
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxiao Bi <junxiao.bi@oracle.com>
commit 2dfd06036ba7ae8e7be2daf5a2fff1dac42390bf upstream.
Ocfs2 uses kiocb.*private as a flag of unsigned long size. In
commit a11f7e6 ocfs2: serialize unaligned aio, the unaligned
io flag is involved in it to serialize the unaligned aio. As
*private is not initialized in init_sync_kiocb() of do_sync_write(),
this unaligned io flag may be unexpectly set in an aligned dio.
And this will cause OCFS2_I(inode)->ip_unaligned_aio decreased
to -1 in ocfs2_dio_end_io(), thus the following unaligned dio
will hang forever at ocfs2_aiodio_wait() in ocfs2_file_aio_write().
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Acked-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/aio.h | 1 +
1 file changed, 1 insertion(+)
--- a/include/linux/aio.h
+++ b/include/linux/aio.h
@@ -140,6 +140,7 @@ struct kiocb {
(x)->ki_dtor = NULL; \
(x)->ki_obj.tsk = tsk; \
(x)->ki_user_data = 0; \
+ (x)->private = NULL; \
} while (0)
#define AIO_RING_MAGIC 0xa10a10a1
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 122/187] ocfs2: clear unaligned io flag when dio fails
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (114 preceding siblings ...)
2012-07-12 22:34 ` [ 121/187] aio: make kiocb->private NUll in init_sync_kiocb() Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 123/187] iwlwifi: fix activating inactive stations Greg Kroah-Hartman
` (64 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Junxiao Bi, Joel Becker
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxiao Bi <junxiao.bi@oracle.com>
commit 3e5d3c35a68c9a933bdbdd8685bd1a205b57e806 upstream.
The unaligned io flag is set in the kiocb when an unaligned
dio is issued, it should be cleared even when the dio fails,
or it may affect the following io which are using the same
kiocb.
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Signed-off-by: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/file.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -2422,8 +2422,10 @@ out_dio:
unaligned_dio = 0;
}
- if (unaligned_dio)
+ if (unaligned_dio) {
+ ocfs2_iocb_clear_unaligned_aio(iocb);
atomic_dec(&OCFS2_I(inode)->ip_unaligned_aio);
+ }
out:
if (rw_level != -1)
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 123/187] iwlwifi: fix activating inactive stations
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (115 preceding siblings ...)
2012-07-12 22:34 ` [ 122/187] ocfs2: clear unaligned io flag when dio fails Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 124/187] tcm_fc: Resolve suspicious RCU usage warnings Greg Kroah-Hartman
` (63 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Meenakshi Venkataraman,
Emmanuel Grumbach, Johannes Berg, John W. Linville
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit eac9ac6d1f5d0e9d33e4ded682187b630e7606cd upstream.
When authentication/association timed out, the driver would
complain bitterly, printing the message
ACTIVATE a non DRIVER active station id ... addr ...
The cause turns out to be that when the AP station is added
but we don't associate, the IWL_STA_UCODE_INPROGRESS is set
but never cleared. This then causes iwl_restore_stations()
to attempt to resend it because it uses the flag internally
and uploads even if it didn't set it itself.
To fix this issue and not upload the station again when it
has already been removed by mac80211, clear the flag after
adding it in case we add it only for association.
Reviewed-by: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/iwl-mac80211.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/net/wireless/iwlwifi/iwl-mac80211.c
+++ b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
@@ -788,6 +788,18 @@ static int iwlagn_mac_sta_state(struct i
switch (op) {
case ADD:
ret = iwlagn_mac_sta_add(hw, vif, sta);
+ if (ret)
+ break;
+ /*
+ * Clear the in-progress flag, the AP station entry was added
+ * but we'll initialize LQ only when we've associated (which
+ * would also clear the in-progress flag). This is necessary
+ * in case we never initialize LQ because association fails.
+ */
+ spin_lock_bh(&priv->sta_lock);
+ priv->stations[iwl_sta_id(sta)].used &=
+ ~IWL_STA_UCODE_INPROGRESS;
+ spin_unlock_bh(&priv->sta_lock);
break;
case REMOVE:
ret = iwlagn_mac_sta_remove(hw, vif, sta);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 124/187] tcm_fc: Resolve suspicious RCU usage warnings
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (116 preceding siblings ...)
2012-07-12 22:34 ` [ 123/187] iwlwifi: fix activating inactive stations Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 125/187] e1000e: remove use of IP payload checksum Greg Kroah-Hartman
` (62 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Mark Rustad, Ross Brattain,
Nicholas Bellinger
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rustad <mark.d.rustad@intel.com>
commit 863555be0c81558b1af277addcf68acb8f778860 upstream.
Use rcu_dereference_protected to tell rcu that the ft_lport_lock
is held during ft_lport_create. This resolved "suspicious RCU usage"
warnings when debugging options are turned on.
Signed-off-by: Mark Rustad <mark.d.rustad@intel.com>
Tested-by: Ross Brattain <ross.b.brattain@intel.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/tcm_fc/tfc_sess.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -58,7 +58,8 @@ static struct ft_tport *ft_tport_create(
struct ft_tport *tport;
int i;
- tport = rcu_dereference(lport->prov[FC_TYPE_FCP]);
+ tport = rcu_dereference_protected(lport->prov[FC_TYPE_FCP],
+ lockdep_is_held(&ft_lport_lock));
if (tport && tport->tpg)
return tport;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 125/187] e1000e: remove use of IP payload checksum
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (117 preceding siblings ...)
2012-07-12 22:34 ` [ 124/187] tcm_fc: Resolve suspicious RCU usage warnings Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 126/187] remoteproc/omap: fix randconfig unmet direct dependencies Greg Kroah-Hartman
` (61 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Bruce Allan, Aaron Brown,
Jeff Kirsher, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bruce Allan <bruce.w.allan@intel.com>
commit 2e1706f234f86ff71056ef69683d734fbf7e9e40 upstream.
Currently only used when packet split mode is enabled with jumbo frames,
IP payload checksum (for fragmented UDP packets) is mutually exclusive with
receive hashing offload since the hardware uses the same space in the
receive descriptor for the hardware-provided packet checksum and the RSS
hash, respectively. Users currently must disable jumbos when receive
hashing offload is enabled, or vice versa, because of this incompatibility.
Since testing has shown that IP payload checksum does not provide any real
benefit, just remove it so that there is no longer a choice between jumbos
or receive hashing offload but not both as done in other Intel GbE drivers
(e.g. e1000, igb).
Also, add a missing check for IP checksum error reported by the hardware;
let the stack verify the checksum when this happens.
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/e1000e/defines.h | 1
drivers/net/ethernet/intel/e1000e/netdev.c | 75 +++++-----------------------
2 files changed, 15 insertions(+), 61 deletions(-)
--- a/drivers/net/ethernet/intel/e1000e/defines.h
+++ b/drivers/net/ethernet/intel/e1000e/defines.h
@@ -101,6 +101,7 @@
#define E1000_RXD_ERR_SEQ 0x04 /* Sequence Error */
#define E1000_RXD_ERR_CXE 0x10 /* Carrier Extension Error */
#define E1000_RXD_ERR_TCPE 0x20 /* TCP/UDP Checksum Error */
+#define E1000_RXD_ERR_IPE 0x40 /* IP Checksum Error */
#define E1000_RXD_ERR_RXE 0x80 /* Rx Data Error */
#define E1000_RXD_SPC_VLAN_MASK 0x0FFF /* VLAN ID is in lower 12 bits */
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -495,7 +495,7 @@ static void e1000_receive_skb(struct e10
* @sk_buff: socket buffer with received data
**/
static void e1000_rx_checksum(struct e1000_adapter *adapter, u32 status_err,
- __le16 csum, struct sk_buff *skb)
+ struct sk_buff *skb)
{
u16 status = (u16)status_err;
u8 errors = (u8)(status_err >> 24);
@@ -510,8 +510,8 @@ static void e1000_rx_checksum(struct e10
if (status & E1000_RXD_STAT_IXSM)
return;
- /* TCP/UDP checksum error bit is set */
- if (errors & E1000_RXD_ERR_TCPE) {
+ /* TCP/UDP checksum error bit or IP checksum error bit is set */
+ if (errors & (E1000_RXD_ERR_TCPE | E1000_RXD_ERR_IPE)) {
/* let the stack verify checksum errors */
adapter->hw_csum_err++;
return;
@@ -522,19 +522,7 @@ static void e1000_rx_checksum(struct e10
return;
/* It must be a TCP or UDP packet with a valid checksum */
- if (status & E1000_RXD_STAT_TCPCS) {
- /* TCP checksum is good */
- skb->ip_summed = CHECKSUM_UNNECESSARY;
- } else {
- /*
- * IP fragment with UDP payload
- * Hardware complements the payload checksum, so we undo it
- * and then put the value in host order for further stack use.
- */
- __sum16 sum = (__force __sum16)swab16((__force u16)csum);
- skb->csum = csum_unfold(~sum);
- skb->ip_summed = CHECKSUM_COMPLETE;
- }
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
adapter->hw_csum_good++;
}
@@ -978,8 +966,7 @@ static bool e1000_clean_rx_irq(struct e1
skb_put(skb, length);
/* Receive Checksum Offload */
- e1000_rx_checksum(adapter, staterr,
- rx_desc->wb.lower.hi_dword.csum_ip.csum, skb);
+ e1000_rx_checksum(adapter, staterr, skb);
e1000_rx_hash(netdev, rx_desc->wb.lower.hi_dword.rss, skb);
@@ -1360,8 +1347,7 @@ copydone:
total_rx_bytes += skb->len;
total_rx_packets++;
- e1000_rx_checksum(adapter, staterr,
- rx_desc->wb.lower.hi_dword.csum_ip.csum, skb);
+ e1000_rx_checksum(adapter, staterr, skb);
e1000_rx_hash(netdev, rx_desc->wb.lower.hi_dword.rss, skb);
@@ -1531,9 +1517,8 @@ static bool e1000_clean_jumbo_rx_irq(str
}
}
- /* Receive Checksum Offload XXX recompute due to CRC strip? */
- e1000_rx_checksum(adapter, staterr,
- rx_desc->wb.lower.hi_dword.csum_ip.csum, skb);
+ /* Receive Checksum Offload */
+ e1000_rx_checksum(adapter, staterr, skb);
e1000_rx_hash(netdev, rx_desc->wb.lower.hi_dword.rss, skb);
@@ -3120,19 +3105,10 @@ static void e1000_configure_rx(struct e1
/* Enable Receive Checksum Offload for TCP and UDP */
rxcsum = er32(RXCSUM);
- if (adapter->netdev->features & NETIF_F_RXCSUM) {
+ if (adapter->netdev->features & NETIF_F_RXCSUM)
rxcsum |= E1000_RXCSUM_TUOFL;
-
- /*
- * IPv4 payload checksum for UDP fragments must be
- * used in conjunction with packet-split.
- */
- if (adapter->rx_ps_pages)
- rxcsum |= E1000_RXCSUM_IPPCSE;
- } else {
+ else
rxcsum &= ~E1000_RXCSUM_TUOFL;
- /* no need to clear IPPCSE as it defaults to 0 */
- }
ew32(RXCSUM, rxcsum);
if (adapter->hw.mac.type == e1000_pch2lan) {
@@ -5260,22 +5236,10 @@ static int e1000_change_mtu(struct net_d
int max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN;
/* Jumbo frame support */
- if (max_frame > ETH_FRAME_LEN + ETH_FCS_LEN) {
- if (!(adapter->flags & FLAG_HAS_JUMBO_FRAMES)) {
- e_err("Jumbo Frames not supported.\n");
- return -EINVAL;
- }
-
- /*
- * IP payload checksum (enabled with jumbos/packet-split when
- * Rx checksum is enabled) and generation of RSS hash is
- * mutually exclusive in the hardware.
- */
- if ((netdev->features & NETIF_F_RXCSUM) &&
- (netdev->features & NETIF_F_RXHASH)) {
- e_err("Jumbo frames cannot be enabled when both receive checksum offload and receive hashing are enabled. Disable one of the receive offload features before enabling jumbos.\n");
- return -EINVAL;
- }
+ if ((max_frame > ETH_FRAME_LEN + ETH_FCS_LEN) &&
+ !(adapter->flags & FLAG_HAS_JUMBO_FRAMES)) {
+ e_err("Jumbo Frames not supported.\n");
+ return -EINVAL;
}
/* Supported frame sizes */
@@ -6049,17 +6013,6 @@ static int e1000_set_features(struct net
NETIF_F_RXALL)))
return 0;
- /*
- * IP payload checksum (enabled with jumbos/packet-split when Rx
- * checksum is enabled) and generation of RSS hash is mutually
- * exclusive in the hardware.
- */
- if (adapter->rx_ps_pages &&
- (features & NETIF_F_RXCSUM) && (features & NETIF_F_RXHASH)) {
- e_err("Enabling both receive checksum offload and receive hashing is not possible with jumbo frames. Disable jumbos or enable only one of the receive offload features.\n");
- return -EINVAL;
- }
-
if (changed & NETIF_F_RXFCS) {
if (features & NETIF_F_RXFCS) {
adapter->flags2 &= ~FLAG2_CRC_STRIPPING;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 126/187] remoteproc/omap: fix randconfig unmet direct dependencies
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (118 preceding siblings ...)
2012-07-12 22:34 ` [ 125/187] e1000e: remove use of IP payload checksum Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 127/187] remoteproc: fix missing CONFIG_FW_LOADER configurations Greg Kroah-Hartman
` (60 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Tony Lindgren, Ohad Ben-Cohen
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ohad Ben-Cohen <ohad@wizery.com>
commit d50394266b340d930a7458fa669d36e99670f200 upstream.
OMAP_REMOTEPROC selects REMOTEPROC and RPMSG, both of which depend
on EXPERIMENTAL, so let's have OMAP_REMOTEPROC depend on EXPERIMENTAL
too, in order to avoid the below randconfig warnings.
warning: (OMAP_REMOTEPROC) selects REMOTEPROC which has unmet direct dependencies (EXPERIMENTAL)
warning: (OMAP_REMOTEPROC) selects RPMSG which has unmet direct dependencies (EXPERIMENTAL)
Reported-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/remoteproc/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/remoteproc/Kconfig
+++ b/drivers/remoteproc/Kconfig
@@ -7,6 +7,7 @@ config REMOTEPROC
config OMAP_REMOTEPROC
tristate "OMAP remoteproc support"
+ depends on EXPERIMENTAL
depends on ARCH_OMAP4
depends on OMAP_IOMMU
select REMOTEPROC
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 127/187] remoteproc: fix missing CONFIG_FW_LOADER configurations
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (119 preceding siblings ...)
2012-07-12 22:34 ` [ 126/187] remoteproc/omap: fix randconfig unmet direct dependencies Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 128/187] hwspinlock/core: use global ID to register hwspinlocks on multiple devices Greg Kroah-Hartman
` (59 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Mark Grosen, Ohad Ben-Cohen
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ohad Ben-Cohen <ohad@wizery.com>
commit e121aefa7d9f10eee5cf26ed47129237a05d940b upstream.
Remoteproc requires user space firmware loading support, so
let's select FW_LOADER explicitly to avoid painful misconfigurations
(which only show up in runtime).
Reported-by: Mark Grosen <mgrosen@ti.com>
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/remoteproc/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/remoteproc/Kconfig
+++ b/drivers/remoteproc/Kconfig
@@ -4,6 +4,7 @@ menu "Remoteproc drivers (EXPERIMENTAL)"
config REMOTEPROC
tristate
depends on EXPERIMENTAL
+ select FW_CONFIG
config OMAP_REMOTEPROC
tristate "OMAP remoteproc support"
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 128/187] hwspinlock/core: use global ID to register hwspinlocks on multiple devices
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (120 preceding siblings ...)
2012-07-12 22:34 ` [ 127/187] remoteproc: fix missing CONFIG_FW_LOADER configurations Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 129/187] md/raid10: Dont try to recovery unmatched (and unused) chunks Greg Kroah-Hartman
` (58 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Shinya Kuribayashi, Ohad Ben-Cohen
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shinya Kuribayashi <shinya.kuribayashi.px@renesas.com>
commit 476a7eeb60e70ddab138e7cb4bc44ef5ac20782e upstream.
Commit 300bab9770 (hwspinlock/core: register a bank of hwspinlocks in a
single API call, 2011-09-06) introduced 'hwspin_lock_register_single()'
to register numerous (a bank of) hwspinlock instances in a single API,
'hwspin_lock_register()'.
At which time, 'hwspin_lock_register()' accidentally passes 'local IDs'
to 'hwspin_lock_register_single()', despite that ..._single() requires
'global IDs' to register hwspinlocks.
We have to convert into global IDs by supplying the missing 'base_id'.
Signed-off-by: Shinya Kuribayashi <shinya.kuribayashi.px@renesas.com>
[ohad: fix error path of hwspin_lock_register, too]
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwspinlock/hwspinlock_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/hwspinlock/hwspinlock_core.c
+++ b/drivers/hwspinlock/hwspinlock_core.c
@@ -345,7 +345,7 @@ int hwspin_lock_register(struct hwspinlo
spin_lock_init(&hwlock->lock);
hwlock->bank = bank;
- ret = hwspin_lock_register_single(hwlock, i);
+ ret = hwspin_lock_register_single(hwlock, base_id + i);
if (ret)
goto reg_failed;
}
@@ -354,7 +354,7 @@ int hwspin_lock_register(struct hwspinlo
reg_failed:
while (--i >= 0)
- hwspin_lock_unregister_single(i);
+ hwspin_lock_unregister_single(base_id + i);
return ret;
}
EXPORT_SYMBOL_GPL(hwspin_lock_register);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 129/187] md/raid10: Dont try to recovery unmatched (and unused) chunks.
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (121 preceding siblings ...)
2012-07-12 22:34 ` [ 128/187] hwspinlock/core: use global ID to register hwspinlocks on multiple devices Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 130/187] md/raid10: fix failure when trying to repair a read error Greg Kroah-Hartman
` (57 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Christian Balzer, NeilBrown
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.de>
commit fc448a18ae6219af9a73257b1fbcd009efab4a81 upstream.
If a RAID10 has an odd number of chunks - as might happen when there
are an odd number of devices - the last chunk has no pair and so is
not mirrored. We don't store data there, but when recovering the last
device in an array we retry to recover that last chunk from a
non-existent location. This results in an error, and the recovery
aborts.
When we get to that last chunk we should just stop - there is nothing
more to do anyway.
This bug has been present since the introduction of RAID10, so the
patch is appropriate for any -stable kernel.
Reported-by: Christian Balzer <chibi@gol.com>
Tested-by: Christian Balzer <chibi@gol.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid10.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2772,6 +2772,12 @@ static sector_t sync_request(struct mdde
/* want to reconstruct this device */
rb2 = r10_bio;
sect = raid10_find_virt(conf, sector_nr, i);
+ if (sect >= mddev->resync_max_sectors) {
+ /* last stripe is not complete - don't
+ * try to recover this sector.
+ */
+ continue;
+ }
/* Unless we are doing a full sync, or a replacement
* we only need to recover the block if it is set in
* the bitmap
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 130/187] md/raid10: fix failure when trying to repair a read error.
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (122 preceding siblings ...)
2012-07-12 22:34 ` [ 129/187] md/raid10: Dont try to recovery unmatched (and unused) chunks Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 131/187] md/raid5: In ops_run_io, inc nr_pending before calling md_wait_for_blocked_rdev Greg Kroah-Hartman
` (56 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Christian Balzer, NeilBrown
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.de>
commit 055d3747dbf00ce85c6872ecca4d466638e80c22 upstream.
commit 58c54fcca3bac5bf9290cfed31c76e4c4bfbabaf
md/raid10: handle further errors during fix_read_error better.
in 3.1 added "r10_sync_page_io" which takes an IO size in sectors.
But we were passing the IO size in bytes!!!
This resulting in bio_add_page failing, and empty request being sent
down, and a consequent BUG_ON in scsi_lib.
[fix missing space in error message at same time]
This fix is suitable for 3.1.y and later.
Reported-by: Christian Balzer <chibi@gol.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid10.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2209,7 +2209,7 @@ static void fix_read_error(struct r10con
if (r10_sync_page_io(rdev,
r10_bio->devs[sl].addr +
sect,
- s<<9, conf->tmppage, WRITE)
+ s, conf->tmppage, WRITE)
== 0) {
/* Well, this device is dead */
printk(KERN_NOTICE
@@ -2246,7 +2246,7 @@ static void fix_read_error(struct r10con
switch (r10_sync_page_io(rdev,
r10_bio->devs[sl].addr +
sect,
- s<<9, conf->tmppage,
+ s, conf->tmppage,
READ)) {
case 0:
/* Well, this device is dead */
@@ -2407,7 +2407,7 @@ read_more:
slot = r10_bio->read_slot;
printk_ratelimited(
KERN_ERR
- "md/raid10:%s: %s: redirecting"
+ "md/raid10:%s: %s: redirecting "
"sector %llu to another mirror\n",
mdname(mddev),
bdevname(rdev->bdev, b),
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 131/187] md/raid5: In ops_run_io, inc nr_pending before calling md_wait_for_blocked_rdev
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (123 preceding siblings ...)
2012-07-12 22:34 ` [ 130/187] md/raid10: fix failure when trying to repair a read error Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 132/187] dm: verity fix documentation Greg Kroah-Hartman
` (55 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, majianpeng, NeilBrown
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: majianpeng <majianpeng@gmail.com>
commit 1850753d2e6d9ca7856581ca5d3cf09521e6a5d7 upstream.
In ops_run_io(), the call to md_wait_for_blocked_rdev will decrement
nr_pending so we lose the reference we hold on the rdev.
So atomic_inc it first to maintain the reference.
This bug was introduced by commit 73e92e51b7969ef5477d
md/raid5. Don't write to known bad block on doubtful devices.
which appeared in 3.0, so patch is suitable for stable kernels since
then.
Signed-off-by: majianpeng <majianpeng@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid5.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -583,6 +583,12 @@ static void ops_run_io(struct stripe_hea
* a chance*/
md_check_recovery(conf->mddev);
}
+ /*
+ * Because md_wait_for_blocked_rdev
+ * will dec nr_pending, we must
+ * increment it first.
+ */
+ atomic_inc(&rdev->nr_pending);
md_wait_for_blocked_rdev(rdev, conf->mddev);
} else {
/* Acknowledged bad block - skip the write */
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 132/187] dm: verity fix documentation
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (124 preceding siblings ...)
2012-07-12 22:34 ` [ 131/187] md/raid5: In ops_run_io, inc nr_pending before calling md_wait_for_blocked_rdev Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 133/187] dm persistent data: fix shadow_info_leak on dm_tm_destroy Greg Kroah-Hartman
` (54 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Milan Broz, Alasdair G Kergon
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Milan Broz <mbroz@redhat.com>
commit 18068bdd5f59229623b2fa518a6389e346642b0d upstream.
Veritysetup is now part of cryptsetup package.
Remove on-disk header description (which is not parsed in kernel)
and point users to cryptsetup where it the format is documented.
Mention units for block size paramaters.
Fix target line specification and dmsetup parameters.
Signed-off-by: Milan Broz <mbroz@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/device-mapper/verity.txt | 133 +++++++++++----------------------
1 file changed, 47 insertions(+), 86 deletions(-)
--- a/Documentation/device-mapper/verity.txt
+++ b/Documentation/device-mapper/verity.txt
@@ -7,39 +7,39 @@ This target is read-only.
Construction Parameters
=======================
- <version> <dev> <hash_dev> <hash_start>
+ <version> <dev> <hash_dev>
<data_block_size> <hash_block_size>
<num_data_blocks> <hash_start_block>
<algorithm> <digest> <salt>
<version>
- This is the version number of the on-disk format.
+ This is the type of the on-disk hash format.
0 is the original format used in the Chromium OS.
- The salt is appended when hashing, digests are stored continuously and
- the rest of the block is padded with zeros.
+ The salt is appended when hashing, digests are stored continuously and
+ the rest of the block is padded with zeros.
1 is the current format that should be used for new devices.
- The salt is prepended when hashing and each digest is
- padded with zeros to the power of two.
+ The salt is prepended when hashing and each digest is
+ padded with zeros to the power of two.
<dev>
- This is the device containing the data the integrity of which needs to be
+ This is the device containing data, the integrity of which needs to be
checked. It may be specified as a path, like /dev/sdaX, or a device number,
<major>:<minor>.
<hash_dev>
- This is the device that that supplies the hash tree data. It may be
+ This is the device that supplies the hash tree data. It may be
specified similarly to the device path and may be the same device. If the
- same device is used, the hash_start should be outside of the dm-verity
- configured device size.
+ same device is used, the hash_start should be outside the configured
+ dm-verity device.
<data_block_size>
- The block size on a data device. Each block corresponds to one digest on
- the hash device.
+ The block size on a data device in bytes.
+ Each block corresponds to one digest on the hash device.
<hash_block_size>
- The size of a hash block.
+ The size of a hash block in bytes.
<num_data_blocks>
The number of data blocks on the data device. Additional blocks are
@@ -65,7 +65,7 @@ Construction Parameters
Theory of operation
===================
-dm-verity is meant to be setup as part of a verified boot path. This
+dm-verity is meant to be set up as part of a verified boot path. This
may be anything ranging from a boot using tboot or trustedgrub to just
booting from a known-good device (like a USB drive or CD).
@@ -73,20 +73,20 @@ When a dm-verity device is configured, i
has been authenticated in some way (cryptographic signatures, etc).
After instantiation, all hashes will be verified on-demand during
disk access. If they cannot be verified up to the root node of the
-tree, the root hash, then the I/O will fail. This should identify
+tree, the root hash, then the I/O will fail. This should detect
tampering with any data on the device and the hash data.
Cryptographic hashes are used to assert the integrity of the device on a
-per-block basis. This allows for a lightweight hash computation on first read
-into the page cache. Block hashes are stored linearly-aligned to the nearest
-block the size of a page.
+per-block basis. This allows for a lightweight hash computation on first read
+into the page cache. Block hashes are stored linearly, aligned to the nearest
+block size.
Hash Tree
---------
Each node in the tree is a cryptographic hash. If it is a leaf node, the hash
-is of some block data on disk. If it is an intermediary node, then the hash is
-of a number of child nodes.
+of some data block on disk is calculated. If it is an intermediary node,
+the hash of a number of child nodes is calculated.
Each entry in the tree is a collection of neighboring nodes that fit in one
block. The number is determined based on block_size and the size of the
@@ -110,63 +110,23 @@ alg = sha256, num_blocks = 32768, block_
On-disk format
==============
-Below is the recommended on-disk format. The verity kernel code does not
-read the on-disk header. It only reads the hash blocks which directly
-follow the header. It is expected that a user-space tool will verify the
-integrity of the verity_header and then call dmsetup with the correct
-parameters. Alternatively, the header can be omitted and the dmsetup
-parameters can be passed via the kernel command-line in a rooted chain
-of trust where the command-line is verified.
-
-The on-disk format is especially useful in cases where the hash blocks
-are on a separate partition. The magic number allows easy identification
-of the partition contents. Alternatively, the hash blocks can be stored
-in the same partition as the data to be verified. In such a configuration
-the filesystem on the partition would be sized a little smaller than
-the full-partition, leaving room for the hash blocks.
-
-struct superblock {
- uint8_t signature[8]
- "verity\0\0";
-
- uint8_t version;
- 1 - current format
-
- uint8_t data_block_bits;
- log2(data block size)
-
- uint8_t hash_block_bits;
- log2(hash block size)
-
- uint8_t pad1[1];
- zero padding
-
- uint16_t salt_size;
- big-endian salt size
-
- uint8_t pad2[2];
- zero padding
-
- uint32_t data_blocks_hi;
- big-endian high 32 bits of the 64-bit number of data blocks
-
- uint32_t data_blocks_lo;
- big-endian low 32 bits of the 64-bit number of data blocks
-
- uint8_t algorithm[16];
- cryptographic algorithm
-
- uint8_t salt[384];
- salt (the salt size is specified above)
-
- uint8_t pad3[88];
- zero padding to 512-byte boundary
-}
+The verity kernel code does not read the verity metadata on-disk header.
+It only reads the hash blocks which directly follow the header.
+It is expected that a user-space tool will verify the integrity of the
+verity header.
+
+Alternatively, the header can be omitted and the dmsetup parameters can
+be passed via the kernel command-line in a rooted chain of trust where
+the command-line is verified.
Directly following the header (and with sector number padded to the next hash
block boundary) are the hash blocks which are stored a depth at a time
(starting from the root), sorted in order of increasing index.
+The full specification of kernel parameters and on-disk metadata format
+is available at the cryptsetup project's wiki page
+ http://code.google.com/p/cryptsetup/wiki/DMVerity
+
Status
======
V (for Valid) is returned if every check performed so far was valid.
@@ -174,21 +134,22 @@ If any check failed, C (for Corruption)
Example
=======
-
-Setup a device:
- dmsetup create vroot --table \
- "0 2097152 "\
- "verity 1 /dev/sda1 /dev/sda2 4096 4096 2097152 1 "\
+Set up a device:
+ # dmsetup create vroot --readonly --table \
+ "0 2097152 verity 1 /dev/sda1 /dev/sda2 4096 4096 262144 1 sha256 "\
"4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076 "\
"1234000000000000000000000000000000000000000000000000000000000000"
A command line tool veritysetup is available to compute or verify
-the hash tree or activate the kernel driver. This is available from
-the LVM2 upstream repository and may be supplied as a package called
-device-mapper-verity-tools:
- git://sources.redhat.com/git/lvm2
- http://sourceware.org/git/?p=lvm2.git
- http://sourceware.org/cgi-bin/cvsweb.cgi/LVM2/verity?cvsroot=lvm2
-
-veritysetup -a vroot /dev/sda1 /dev/sda2 \
- 4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076
+the hash tree or activate the kernel device. This is available from
+the cryptsetup upstream repository http://code.google.com/p/cryptsetup/
+(as a libcryptsetup extension).
+
+Create hash on the device:
+ # veritysetup format /dev/sda1 /dev/sda2
+ ...
+ Root hash: 4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076
+
+Activate the device:
+ # veritysetup create vroot /dev/sda1 /dev/sda2 \
+ 4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 133/187] dm persistent data: fix shadow_info_leak on dm_tm_destroy
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (125 preceding siblings ...)
2012-07-12 22:34 ` [ 132/187] dm: verity fix documentation Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 134/187] dm persistent data: handle space map checker creation failure Greg Kroah-Hartman
` (53 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Mike Snitzer, Alasdair G Kergon
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@redhat.com>
commit 25d7cd6faa7ae6ed2565617c3ee2500ccb8a9f7f upstream.
Cleanup the shadow table before destroying the transaction manager.
Reference: leak was identified with kmemleak when running
test_discard_random_sectors in the thinp-test-suite.
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/persistent-data/dm-transaction-manager.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/md/persistent-data/dm-transaction-manager.c
+++ b/drivers/md/persistent-data/dm-transaction-manager.c
@@ -138,6 +138,9 @@ EXPORT_SYMBOL_GPL(dm_tm_create_non_block
void dm_tm_destroy(struct dm_transaction_manager *tm)
{
+ if (!tm->is_clone)
+ wipe_shadow_table(tm);
+
kfree(tm);
}
EXPORT_SYMBOL_GPL(dm_tm_destroy);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 134/187] dm persistent data: handle space map checker creation failure
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (126 preceding siblings ...)
2012-07-12 22:34 ` [ 133/187] dm persistent data: fix shadow_info_leak on dm_tm_destroy Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 135/187] dm persistent data: fix allocation failure in space map checker init Greg Kroah-Hartman
` (52 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Vivek Goyal, Mike Snitzer,
Alasdair G Kergon
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@redhat.com>
commit 62662303e7f590fdfbb0070ab820a0ad4267c119 upstream.
If CONFIG_DM_DEBUG_SPACE_MAPS is enabled and dm_sm_checker_create()
fails, dm_tm_create_internal() would still return success even though it
cleaned up all resources it was supposed to have created. This will
lead to a kernel crash:
general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
...
RIP: 0010:[<ffffffff81593659>] [<ffffffff81593659>] dm_bufio_get_block_size+0x9/0x20
Call Trace:
[<ffffffff81599bae>] dm_bm_block_size+0xe/0x10
[<ffffffff8159b8b8>] sm_ll_init+0x78/0xd0
[<ffffffff8159c1a6>] sm_ll_new_disk+0x16/0xa0
[<ffffffff8159c98e>] dm_sm_disk_create+0xfe/0x160
[<ffffffff815abf6e>] dm_pool_metadata_open+0x16e/0x6a0
[<ffffffff815aa010>] pool_ctr+0x3f0/0x900
[<ffffffff8158d565>] dm_table_add_target+0x195/0x450
[<ffffffff815904c4>] table_load+0xe4/0x330
[<ffffffff815917ea>] ctl_ioctl+0x15a/0x2c0
[<ffffffff81591963>] dm_ctl_ioctl+0x13/0x20
[<ffffffff8116a4f8>] do_vfs_ioctl+0x98/0x560
[<ffffffff8116aa51>] sys_ioctl+0x91/0xa0
[<ffffffff81869f52>] system_call_fastpath+0x16/0x1b
Fix the space map checker code to return an appropriate ERR_PTR and have
dm_sm_disk_create() and dm_tm_create_internal() check for it with
IS_ERR.
Reported-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/persistent-data/dm-space-map-checker.c | 24 ++++++++++----------
drivers/md/persistent-data/dm-space-map-disk.c | 11 ++++++++-
drivers/md/persistent-data/dm-transaction-manager.c | 8 +++++-
3 files changed, 28 insertions(+), 15 deletions(-)
--- a/drivers/md/persistent-data/dm-space-map-checker.c
+++ b/drivers/md/persistent-data/dm-space-map-checker.c
@@ -343,25 +343,25 @@ struct dm_space_map *dm_sm_checker_creat
int r;
struct sm_checker *smc;
- if (!sm)
- return NULL;
+ if (IS_ERR_OR_NULL(sm))
+ return ERR_PTR(-EINVAL);
smc = kmalloc(sizeof(*smc), GFP_KERNEL);
if (!smc)
- return NULL;
+ return ERR_PTR(-ENOMEM);
memcpy(&smc->sm, &ops_, sizeof(smc->sm));
r = ca_create(&smc->old_counts, sm);
if (r) {
kfree(smc);
- return NULL;
+ return ERR_PTR(r);
}
r = ca_create(&smc->counts, sm);
if (r) {
ca_destroy(&smc->old_counts);
kfree(smc);
- return NULL;
+ return ERR_PTR(r);
}
smc->real_sm = sm;
@@ -371,7 +371,7 @@ struct dm_space_map *dm_sm_checker_creat
ca_destroy(&smc->counts);
ca_destroy(&smc->old_counts);
kfree(smc);
- return NULL;
+ return ERR_PTR(r);
}
r = ca_commit(&smc->old_counts, &smc->counts);
@@ -379,7 +379,7 @@ struct dm_space_map *dm_sm_checker_creat
ca_destroy(&smc->counts);
ca_destroy(&smc->old_counts);
kfree(smc);
- return NULL;
+ return ERR_PTR(r);
}
return &smc->sm;
@@ -391,25 +391,25 @@ struct dm_space_map *dm_sm_checker_creat
int r;
struct sm_checker *smc;
- if (!sm)
- return NULL;
+ if (IS_ERR_OR_NULL(sm))
+ return ERR_PTR(-EINVAL);
smc = kmalloc(sizeof(*smc), GFP_KERNEL);
if (!smc)
- return NULL;
+ return ERR_PTR(-ENOMEM);
memcpy(&smc->sm, &ops_, sizeof(smc->sm));
r = ca_create(&smc->old_counts, sm);
if (r) {
kfree(smc);
- return NULL;
+ return ERR_PTR(r);
}
r = ca_create(&smc->counts, sm);
if (r) {
ca_destroy(&smc->old_counts);
kfree(smc);
- return NULL;
+ return ERR_PTR(r);
}
smc->real_sm = sm;
--- a/drivers/md/persistent-data/dm-space-map-disk.c
+++ b/drivers/md/persistent-data/dm-space-map-disk.c
@@ -290,7 +290,16 @@ struct dm_space_map *dm_sm_disk_create(s
dm_block_t nr_blocks)
{
struct dm_space_map *sm = dm_sm_disk_create_real(tm, nr_blocks);
- return dm_sm_checker_create_fresh(sm);
+ struct dm_space_map *smc;
+
+ if (IS_ERR_OR_NULL(sm))
+ return sm;
+
+ smc = dm_sm_checker_create_fresh(sm);
+ if (IS_ERR(smc))
+ dm_sm_destroy(sm);
+
+ return smc;
}
EXPORT_SYMBOL_GPL(dm_sm_disk_create);
--- a/drivers/md/persistent-data/dm-transaction-manager.c
+++ b/drivers/md/persistent-data/dm-transaction-manager.c
@@ -345,8 +345,10 @@ static int dm_tm_create_internal(struct
}
*sm = dm_sm_checker_create(inner);
- if (!*sm)
+ if (IS_ERR(*sm)) {
+ r = PTR_ERR(*sm);
goto bad2;
+ }
} else {
r = dm_bm_write_lock(dm_tm_get_bm(*tm), sb_location,
@@ -365,8 +367,10 @@ static int dm_tm_create_internal(struct
}
*sm = dm_sm_checker_create(inner);
- if (!*sm)
+ if (IS_ERR(*sm)) {
+ r = PTR_ERR(*sm);
goto bad2;
+ }
}
return 0;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 135/187] dm persistent data: fix allocation failure in space map checker init
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (127 preceding siblings ...)
2012-07-12 22:34 ` [ 134/187] dm persistent data: handle space map checker creation failure Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 136/187] eCryptfs: Gracefully refuse miscdev file ops on inherited/passed files Greg Kroah-Hartman
` (51 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Vivek Goyal, Mike Snitzer,
Alasdair G Kergon
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@redhat.com>
commit b0239faaf87c38bb419c9264bf20817438ddc3a9 upstream.
If CONFIG_DM_DEBUG_SPACE_MAPS is enabled and memory is fragmented and a
sufficiently-large metadata device is used in a thin pool then the space
map checker will fail to allocate the memory it requires.
Switch from kmalloc to vmalloc to allow larger virtually contiguous
allocations for the space map checker's internal count arrays.
Reported-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/persistent-data/dm-space-map-checker.c | 30 +++++++++++++---------
1 file changed, 19 insertions(+), 11 deletions(-)
--- a/drivers/md/persistent-data/dm-space-map-checker.c
+++ b/drivers/md/persistent-data/dm-space-map-checker.c
@@ -8,6 +8,7 @@
#include <linux/device-mapper.h>
#include <linux/export.h>
+#include <linux/vmalloc.h>
#ifdef CONFIG_DM_DEBUG_SPACE_MAPS
@@ -89,13 +90,23 @@ static int ca_create(struct count_array
ca->nr = nr_blocks;
ca->nr_free = nr_blocks;
- ca->counts = kzalloc(sizeof(*ca->counts) * nr_blocks, GFP_KERNEL);
- if (!ca->counts)
- return -ENOMEM;
+
+ if (!nr_blocks)
+ ca->counts = NULL;
+ else {
+ ca->counts = vzalloc(sizeof(*ca->counts) * nr_blocks);
+ if (!ca->counts)
+ return -ENOMEM;
+ }
return 0;
}
+static void ca_destroy(struct count_array *ca)
+{
+ vfree(ca->counts);
+}
+
static int ca_load(struct count_array *ca, struct dm_space_map *sm)
{
int r;
@@ -126,12 +137,14 @@ static int ca_load(struct count_array *c
static int ca_extend(struct count_array *ca, dm_block_t extra_blocks)
{
dm_block_t nr_blocks = ca->nr + extra_blocks;
- uint32_t *counts = kzalloc(sizeof(*counts) * nr_blocks, GFP_KERNEL);
+ uint32_t *counts = vzalloc(sizeof(*counts) * nr_blocks);
if (!counts)
return -ENOMEM;
- memcpy(counts, ca->counts, sizeof(*counts) * ca->nr);
- kfree(ca->counts);
+ if (ca->counts) {
+ memcpy(counts, ca->counts, sizeof(*counts) * ca->nr);
+ ca_destroy(ca);
+ }
ca->nr = nr_blocks;
ca->nr_free += extra_blocks;
ca->counts = counts;
@@ -151,11 +164,6 @@ static int ca_commit(struct count_array
return 0;
}
-static void ca_destroy(struct count_array *ca)
-{
- kfree(ca->counts);
-}
-
/*----------------------------------------------------------------*/
struct sm_checker {
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 136/187] eCryptfs: Gracefully refuse miscdev file ops on inherited/passed files
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (128 preceding siblings ...)
2012-07-12 22:34 ` [ 135/187] dm persistent data: fix allocation failure in space map checker init Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 137/187] eCryptfs: Fix lockdep warning in miscdev operations Greg Kroah-Hartman
` (50 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Tyler Hicks, Sasha Levin
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyler Hicks <tyhicks@canonical.com>
commit 8dc6780587c99286c0d3de747a2946a76989414a upstream.
File operations on /dev/ecryptfs would BUG() when the operations were
performed by processes other than the process that originally opened the
file. This could happen with open files inherited after fork() or file
descriptors passed through IPC mechanisms. Rather than calling BUG(), an
error code can be safely returned in most situations.
In ecryptfs_miscdev_release(), eCryptfs still needs to handle the
release even if the last file reference is being held by a process that
didn't originally open the file. ecryptfs_find_daemon_by_euid() will not
be successful, so a pointer to the daemon is stored in the file's
private_data. The private_data pointer is initialized when the miscdev
file is opened and only used when the file is released.
https://launchpad.net/bugs/994247
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Tested-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/miscdev.c | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -49,7 +49,10 @@ ecryptfs_miscdev_poll(struct file *file,
mutex_lock(&ecryptfs_daemon_hash_mux);
/* TODO: Just use file->private_data? */
rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
- BUG_ON(rc || !daemon);
+ if (rc || !daemon) {
+ mutex_unlock(&ecryptfs_daemon_hash_mux);
+ return -EINVAL;
+ }
mutex_lock(&daemon->mux);
mutex_unlock(&ecryptfs_daemon_hash_mux);
if (daemon->flags & ECRYPTFS_DAEMON_ZOMBIE) {
@@ -122,6 +125,7 @@ ecryptfs_miscdev_open(struct inode *inod
goto out_unlock_daemon;
}
daemon->flags |= ECRYPTFS_DAEMON_MISCDEV_OPEN;
+ file->private_data = daemon;
atomic_inc(&ecryptfs_num_miscdev_opens);
out_unlock_daemon:
mutex_unlock(&daemon->mux);
@@ -152,9 +156,9 @@ ecryptfs_miscdev_release(struct inode *i
mutex_lock(&ecryptfs_daemon_hash_mux);
rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
- BUG_ON(rc || !daemon);
+ if (rc || !daemon)
+ daemon = file->private_data;
mutex_lock(&daemon->mux);
- BUG_ON(daemon->pid != task_pid(current));
BUG_ON(!(daemon->flags & ECRYPTFS_DAEMON_MISCDEV_OPEN));
daemon->flags &= ~ECRYPTFS_DAEMON_MISCDEV_OPEN;
atomic_dec(&ecryptfs_num_miscdev_opens);
@@ -269,8 +273,16 @@ ecryptfs_miscdev_read(struct file *file,
mutex_lock(&ecryptfs_daemon_hash_mux);
/* TODO: Just use file->private_data? */
rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
- BUG_ON(rc || !daemon);
+ if (rc || !daemon) {
+ mutex_unlock(&ecryptfs_daemon_hash_mux);
+ return -EINVAL;
+ }
mutex_lock(&daemon->mux);
+ if (task_pid(current) != daemon->pid) {
+ mutex_unlock(&daemon->mux);
+ mutex_unlock(&ecryptfs_daemon_hash_mux);
+ return -EPERM;
+ }
if (daemon->flags & ECRYPTFS_DAEMON_ZOMBIE) {
rc = 0;
mutex_unlock(&ecryptfs_daemon_hash_mux);
@@ -307,9 +319,6 @@ check_list:
* message from the queue; try again */
goto check_list;
}
- BUG_ON(euid != daemon->euid);
- BUG_ON(current_user_ns() != daemon->user_ns);
- BUG_ON(task_pid(current) != daemon->pid);
msg_ctx = list_first_entry(&daemon->msg_ctx_out_queue,
struct ecryptfs_msg_ctx, daemon_out_list);
BUG_ON(!msg_ctx);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 137/187] eCryptfs: Fix lockdep warning in miscdev operations
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (129 preceding siblings ...)
2012-07-12 22:34 ` [ 136/187] eCryptfs: Gracefully refuse miscdev file ops on inherited/passed files Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 138/187] eCryptfs: Properly check for O_RDONLY flag before doing privileged open Greg Kroah-Hartman
` (49 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Tyler Hicks
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyler Hicks <tyhicks@canonical.com>
commit 60d65f1f07a7d81d3eb3b91fc13fca80f2fdbb12 upstream.
Don't grab the daemon mutex while holding the message context mutex.
Addresses this lockdep warning:
ecryptfsd/2141 is trying to acquire lock:
(&ecryptfs_msg_ctx_arr[i].mux){+.+.+.}, at: [<ffffffffa029c213>] ecryptfs_miscdev_read+0x143/0x470 [ecryptfs]
but task is already holding lock:
(&(*daemon)->mux){+.+...}, at: [<ffffffffa029c2ec>] ecryptfs_miscdev_read+0x21c/0x470 [ecryptfs]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&(*daemon)->mux){+.+...}:
[<ffffffff810a3b8d>] lock_acquire+0x9d/0x220
[<ffffffff8151c6da>] __mutex_lock_common+0x5a/0x4b0
[<ffffffff8151cc64>] mutex_lock_nested+0x44/0x50
[<ffffffffa029c5d7>] ecryptfs_send_miscdev+0x97/0x120 [ecryptfs]
[<ffffffffa029b744>] ecryptfs_send_message+0x134/0x1e0 [ecryptfs]
[<ffffffffa029a24e>] ecryptfs_generate_key_packet_set+0x2fe/0xa80 [ecryptfs]
[<ffffffffa02960f8>] ecryptfs_write_metadata+0x108/0x250 [ecryptfs]
[<ffffffffa0290f80>] ecryptfs_create+0x130/0x250 [ecryptfs]
[<ffffffff811963a4>] vfs_create+0xb4/0x120
[<ffffffff81197865>] do_last+0x8c5/0xa10
[<ffffffff811998f9>] path_openat+0xd9/0x460
[<ffffffff81199da2>] do_filp_open+0x42/0xa0
[<ffffffff81187998>] do_sys_open+0xf8/0x1d0
[<ffffffff81187a91>] sys_open+0x21/0x30
[<ffffffff81527d69>] system_call_fastpath+0x16/0x1b
-> #0 (&ecryptfs_msg_ctx_arr[i].mux){+.+.+.}:
[<ffffffff810a3418>] __lock_acquire+0x1bf8/0x1c50
[<ffffffff810a3b8d>] lock_acquire+0x9d/0x220
[<ffffffff8151c6da>] __mutex_lock_common+0x5a/0x4b0
[<ffffffff8151cc64>] mutex_lock_nested+0x44/0x50
[<ffffffffa029c213>] ecryptfs_miscdev_read+0x143/0x470 [ecryptfs]
[<ffffffff811887d3>] vfs_read+0xb3/0x180
[<ffffffff811888ed>] sys_read+0x4d/0x90
[<ffffffff81527d69>] system_call_fastpath+0x16/0x1b
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/miscdev.c | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -195,31 +195,32 @@ int ecryptfs_send_miscdev(char *data, si
struct ecryptfs_msg_ctx *msg_ctx, u8 msg_type,
u16 msg_flags, struct ecryptfs_daemon *daemon)
{
- int rc = 0;
+ struct ecryptfs_message *msg;
- mutex_lock(&msg_ctx->mux);
- msg_ctx->msg = kmalloc((sizeof(*msg_ctx->msg) + data_size),
- GFP_KERNEL);
- if (!msg_ctx->msg) {
- rc = -ENOMEM;
+ msg = kmalloc((sizeof(*msg) + data_size), GFP_KERNEL);
+ if (!msg) {
printk(KERN_ERR "%s: Out of memory whilst attempting "
"to kmalloc(%zd, GFP_KERNEL)\n", __func__,
- (sizeof(*msg_ctx->msg) + data_size));
- goto out_unlock;
+ (sizeof(*msg) + data_size));
+ return -ENOMEM;
}
+
+ mutex_lock(&msg_ctx->mux);
+ msg_ctx->msg = msg;
msg_ctx->msg->index = msg_ctx->index;
msg_ctx->msg->data_len = data_size;
msg_ctx->type = msg_type;
memcpy(msg_ctx->msg->data, data, data_size);
msg_ctx->msg_size = (sizeof(*msg_ctx->msg) + data_size);
- mutex_lock(&daemon->mux);
list_add_tail(&msg_ctx->daemon_out_list, &daemon->msg_ctx_out_queue);
+ mutex_unlock(&msg_ctx->mux);
+
+ mutex_lock(&daemon->mux);
daemon->num_queued_msg_ctx++;
wake_up_interruptible(&daemon->wait);
mutex_unlock(&daemon->mux);
-out_unlock:
- mutex_unlock(&msg_ctx->mux);
- return rc;
+
+ return 0;
}
/*
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 138/187] eCryptfs: Properly check for O_RDONLY flag before doing privileged open
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (130 preceding siblings ...)
2012-07-12 22:34 ` [ 137/187] eCryptfs: Fix lockdep warning in miscdev operations Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 139/187] mm/memblock: cleanup on duplicate VA/PA conversion Greg Kroah-Hartman
` (48 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Tyler Hicks, Dan Carpenter
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyler Hicks <tyhicks@canonical.com>
commit 9fe79d7600497ed8a95c3981cbe5b73ab98222f0 upstream.
If the first attempt at opening the lower file read/write fails,
eCryptfs will retry using a privileged kthread. However, the privileged
retry should not happen if the lower file's inode is read-only because a
read/write open will still be unsuccessful.
The check for determining if the open should be retried was intended to
be based on the access mode of the lower file's open flags being
O_RDONLY, but the check was incorrectly performed. This would cause the
open to be retried by the privileged kthread, resulting in a second
failed open of the lower file. This patch corrects the check to
determine if the open request should be handled by the privileged
kthread.
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/kthread.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ecryptfs/kthread.c
+++ b/fs/ecryptfs/kthread.c
@@ -149,7 +149,7 @@ int ecryptfs_privileged_open(struct file
(*lower_file) = dentry_open(lower_dentry, lower_mnt, flags, cred);
if (!IS_ERR(*lower_file))
goto out;
- if (flags & O_RDONLY) {
+ if ((flags & O_ACCMODE) == O_RDONLY) {
rc = PTR_ERR((*lower_file));
goto out;
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 139/187] mm/memblock: cleanup on duplicate VA/PA conversion
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (131 preceding siblings ...)
2012-07-12 22:34 ` [ 138/187] eCryptfs: Properly check for O_RDONLY flag before doing privileged open Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 140/187] mm/memblock: fix memory leak on extending regions Greg Kroah-Hartman
` (47 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Gavin Shan, Johannes Weiner
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavin Shan <shangw@linux.vnet.ibm.com>
commit 4e2f07750d9a94e8f23e86408df5ab95be88bf11 upstream.
The overall memblock has been organized into the memory regions and
reserved regions. Initially, the memory regions and reserved regions are
stored in the predetermined arrays of "struct memblock _region". It's
possible for the arrays to be enlarged when we have newly added regions
for them, but no enough space there. Under the situation, We will created
double-sized array to meet the requirement. However, the original
implementation converted the VA (Virtual Address) of the newly allocated
array of regions to PA (Physical Address), then translate back when we
allocates the new array from slab. That's actually unnecessary.
The patch removes the duplicate VA/PA conversion.
Signed-off-by: Gavin Shan <shangw@linux.vnet.ibm.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memblock.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -212,14 +212,15 @@ static int __init_memblock memblock_doub
if (use_slab) {
new_array = kmalloc(new_size, GFP_KERNEL);
addr = new_array ? __pa(new_array) : 0;
- } else
+ } else {
addr = memblock_find_in_range(0, MEMBLOCK_ALLOC_ACCESSIBLE, new_size, sizeof(phys_addr_t));
+ new_array = addr ? __va(addr) : 0;
+ }
if (!addr) {
pr_err("memblock: Failed to double %s array from %ld to %ld entries !\n",
memblock_type_name(type), type->max, type->max * 2);
return -1;
}
- new_array = __va(addr);
memblock_dbg("memblock: %s array is doubled to %ld at [%#010llx-%#010llx]",
memblock_type_name(type), type->max * 2, (u64)addr, (u64)addr + new_size - 1);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 140/187] mm/memblock: fix memory leak on extending regions
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (132 preceding siblings ...)
2012-07-12 22:34 ` [ 139/187] mm/memblock: cleanup on duplicate VA/PA conversion Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 141/187] mm/memblock: fix overlapping allocation when doubling reserved array Greg Kroah-Hartman
` (46 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Gavin Shan, Johannes Weiner
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavin Shan <shangw@linux.vnet.ibm.com>
commit 181eb39425f2b9275afcb015eaa547d11f71a02f upstream.
The overall memblock has been organized into the memory regions and
reserved regions. Initially, the memory regions and reserved regions are
stored in the predetermined arrays of "struct memblock _region". It's
possible for the arrays to be enlarged when we have newly added regions,
but no free space left there. The policy here is to create double-sized
array either by slab allocator or memblock allocator. Unfortunately, we
didn't free the old array, which might be allocated through slab allocator
before. That would cause memory leak.
The patch introduces 2 variables to trace where (slab or memblock) the
memory and reserved regions come from. The memory for the memory or
reserved regions will be deallocated by kfree() if that was allocated by
slab allocator. Thus to fix the memory leak issue.
Signed-off-by: Gavin Shan <shangw@linux.vnet.ibm.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memblock.c | 37 ++++++++++++++++++++++++-------------
1 file changed, 24 insertions(+), 13 deletions(-)
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -37,6 +37,8 @@ struct memblock memblock __initdata_memb
int memblock_debug __initdata_memblock;
static int memblock_can_resize __initdata_memblock;
+static int memblock_memory_in_slab __initdata_memblock = 0;
+static int memblock_reserved_in_slab __initdata_memblock = 0;
/* inline so we don't get a warning when pr_debug is compiled out */
static inline const char *memblock_type_name(struct memblock_type *type)
@@ -187,6 +189,7 @@ static int __init_memblock memblock_doub
struct memblock_region *new_array, *old_array;
phys_addr_t old_size, new_size, addr;
int use_slab = slab_is_available();
+ int *in_slab;
/* We don't allow resizing until we know about the reserved regions
* of memory that aren't suitable for allocation
@@ -198,6 +201,12 @@ static int __init_memblock memblock_doub
old_size = type->max * sizeof(struct memblock_region);
new_size = old_size << 1;
+ /* Retrieve the slab flag */
+ if (type == &memblock.memory)
+ in_slab = &memblock_memory_in_slab;
+ else
+ in_slab = &memblock_reserved_in_slab;
+
/* Try to find some space for it.
*
* WARNING: We assume that either slab_is_available() and we use it or
@@ -235,22 +244,24 @@ static int __init_memblock memblock_doub
type->regions = new_array;
type->max <<= 1;
- /* If we use SLAB that's it, we are done */
- if (use_slab)
- return 0;
-
- /* Add the new reserved region now. Should not fail ! */
- BUG_ON(memblock_reserve(addr, new_size));
-
- /* If the array wasn't our static init one, then free it. We only do
- * that before SLAB is available as later on, we don't know whether
- * to use kfree or free_bootmem_pages(). Shouldn't be a big deal
- * anyways
+ /* Free old array. We needn't free it if the array is the
+ * static one
*/
- if (old_array != memblock_memory_init_regions &&
- old_array != memblock_reserved_init_regions)
+ if (*in_slab)
+ kfree(old_array);
+ else if (old_array != memblock_memory_init_regions &&
+ old_array != memblock_reserved_init_regions)
memblock_free(__pa(old_array), old_size);
+ /* Reserve the new array if that comes from the memblock.
+ * Otherwise, we needn't do it
+ */
+ if (!use_slab)
+ BUG_ON(memblock_reserve(addr, new_size));
+
+ /* Update slab flag */
+ *in_slab = use_slab;
+
return 0;
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 141/187] mm/memblock: fix overlapping allocation when doubling reserved array
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (133 preceding siblings ...)
2012-07-12 22:34 ` [ 140/187] mm/memblock: fix memory leak on extending regions Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 142/187] OMAPDSS: use DSI_FIFO_BUG workaround only for manual update displays Greg Kroah-Hartman
` (45 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Greg Pearson, Yinghai Lu,
Tejun Heo, Benjamin Herrenschmidt
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Pearson <greg.pearson@hp.com>
commit 48c3b583bbddad2220ca4c22319ca5d1f78b2090 upstream.
__alloc_memory_core_early() asks memblock for a range of memory then try
to reserve it. If the reserved region array lacks space for the new
range, memblock_double_array() is called to allocate more space for the
array. If memblock is used to allocate memory for the new array it can
end up using a range that overlaps with the range originally allocated in
__alloc_memory_core_early(), leading to possible data corruption.
With this patch memblock_double_array() now calls memblock_find_in_range()
with a narrowed candidate range (in cases where the reserved.regions array
is being doubled) so any memory allocated will not overlap with the
original range that was being reserved. The range is narrowed by passing
in the starting address and size of the previously allocated range. Then
the range above the ending address is searched and if a candidate is not
found, the range below the starting address is searched.
Signed-off-by: Greg Pearson <greg.pearson@hp.com>
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
Acked-by: Tejun Heo <tj@kernel.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memblock.c | 36 ++++++++++++++++++++++++++++++++----
1 file changed, 32 insertions(+), 4 deletions(-)
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -184,7 +184,24 @@ static void __init_memblock memblock_rem
}
}
-static int __init_memblock memblock_double_array(struct memblock_type *type)
+/**
+ * memblock_double_array - double the size of the memblock regions array
+ * @type: memblock type of the regions array being doubled
+ * @new_area_start: starting address of memory range to avoid overlap with
+ * @new_area_size: size of memory range to avoid overlap with
+ *
+ * Double the size of the @type regions array. If memblock is being used to
+ * allocate memory for a new reserved regions array and there is a previously
+ * allocated memory range [@new_area_start,@new_area_start+@new_area_size]
+ * waiting to be reserved, ensure the memory used by the new array does
+ * not overlap.
+ *
+ * RETURNS:
+ * 0 on success, -1 on failure.
+ */
+static int __init_memblock memblock_double_array(struct memblock_type *type,
+ phys_addr_t new_area_start,
+ phys_addr_t new_area_size)
{
struct memblock_region *new_array, *old_array;
phys_addr_t old_size, new_size, addr;
@@ -222,7 +239,18 @@ static int __init_memblock memblock_doub
new_array = kmalloc(new_size, GFP_KERNEL);
addr = new_array ? __pa(new_array) : 0;
} else {
- addr = memblock_find_in_range(0, MEMBLOCK_ALLOC_ACCESSIBLE, new_size, sizeof(phys_addr_t));
+ /* only exclude range when trying to double reserved.regions */
+ if (type != &memblock.reserved)
+ new_area_start = new_area_size = 0;
+
+ addr = memblock_find_in_range(new_area_start + new_area_size,
+ memblock.current_limit,
+ new_size, sizeof(phys_addr_t));
+ if (!addr && new_area_size)
+ addr = memblock_find_in_range(0,
+ min(new_area_start, memblock.current_limit),
+ new_size, sizeof(phys_addr_t));
+
new_array = addr ? __va(addr) : 0;
}
if (!addr) {
@@ -399,7 +427,7 @@ repeat:
*/
if (!insert) {
while (type->cnt + nr_new > type->max)
- if (memblock_double_array(type) < 0)
+ if (memblock_double_array(type, obase, size) < 0)
return -ENOMEM;
insert = true;
goto repeat;
@@ -450,7 +478,7 @@ static int __init_memblock memblock_isol
/* we'll create at most two more regions */
while (type->cnt + 2 > type->max)
- if (memblock_double_array(type) < 0)
+ if (memblock_double_array(type, base, size) < 0)
return -ENOMEM;
for (i = 0; i < type->cnt; i++) {
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 142/187] OMAPDSS: use DSI_FIFO_BUG workaround only for manual update displays
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (134 preceding siblings ...)
2012-07-12 22:34 ` [ 141/187] mm/memblock: fix overlapping allocation when doubling reserved array Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:34 ` [ 143/187] e1000e: test for valid check_reset_block function pointer Greg Kroah-Hartman
` (44 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Tomi Valkeinen, Joe Woodward
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ti.com>
commit 3568f2a46f2a73bab18c914df06afd98a97e0e0e upstream.
There is a problem related to DSS FIFO thresholds and power management
on OMAP3. It seems that when the full PM hits in, we get underflows. The
core reason is unknown, but after experiments it looks like only
particular FIFO thresholds work correctly.
This bug is related to an earlier patch, which added special FIFO
threshold configuration for OMAP3, because DSI command mode output
didn't work with the normal threshold configuration.
However, as the above work-around worked fine for other output types
also, we currently always configure thresholds in this special way on
OMAP3. In theory there should be negligible difference with this special
way and the standard way. The first paragraph explains what happens in
practice.
This patch changes the driver to use the special threshold configuration
only when the output is a manual update display on OMAP3. This does
include RFBI displays also, and although it hasn't been tested (no
boards using RFBI) I suspect the similar behaviour is present there
also, as the DISPC side should work similarly for DSI command mode and
RFBI.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Joe Woodward <jw@terrafix.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/omap2/dss/apply.c | 2 +-
drivers/video/omap2/dss/dispc.c | 5 +++--
drivers/video/omap2/dss/dss.h | 3 ++-
3 files changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/video/omap2/dss/apply.c
+++ b/drivers/video/omap2/dss/apply.c
@@ -927,7 +927,7 @@ static void dss_ovl_setup_fifo(struct om
dssdev = ovl->manager->device;
dispc_ovl_compute_fifo_thresholds(ovl->id, &fifo_low, &fifo_high,
- use_fifo_merge);
+ use_fifo_merge, ovl_manual_update(ovl));
dss_apply_ovl_fifo_thresholds(ovl, fifo_low, fifo_high);
}
--- a/drivers/video/omap2/dss/dispc.c
+++ b/drivers/video/omap2/dss/dispc.c
@@ -1063,7 +1063,8 @@ void dispc_enable_fifomerge(bool enable)
}
void dispc_ovl_compute_fifo_thresholds(enum omap_plane plane,
- u32 *fifo_low, u32 *fifo_high, bool use_fifomerge)
+ u32 *fifo_low, u32 *fifo_high, bool use_fifomerge,
+ bool manual_update)
{
/*
* All sizes are in bytes. Both the buffer and burst are made of
@@ -1091,7 +1092,7 @@ void dispc_ovl_compute_fifo_thresholds(e
* combined fifo size
*/
- if (dss_has_feature(FEAT_OMAP3_DSI_FIFO_BUG)) {
+ if (manual_update && dss_has_feature(FEAT_OMAP3_DSI_FIFO_BUG)) {
*fifo_low = ovl_fifo_size - burst_size * 2;
*fifo_high = total_fifo_size - burst_size;
} else {
--- a/drivers/video/omap2/dss/dss.h
+++ b/drivers/video/omap2/dss/dss.h
@@ -424,7 +424,8 @@ int dispc_calc_clock_rates(unsigned long
void dispc_ovl_set_fifo_threshold(enum omap_plane plane, u32 low, u32 high);
void dispc_ovl_compute_fifo_thresholds(enum omap_plane plane,
- u32 *fifo_low, u32 *fifo_high, bool use_fifomerge);
+ u32 *fifo_low, u32 *fifo_high, bool use_fifomerge,
+ bool manual_update);
int dispc_ovl_setup(enum omap_plane plane, struct omap_overlay_info *oi,
bool ilace, bool replication);
int dispc_ovl_enable(enum omap_plane plane, bool enable);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 143/187] e1000e: test for valid check_reset_block function pointer
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (135 preceding siblings ...)
2012-07-12 22:34 ` [ 142/187] OMAPDSS: use DSI_FIFO_BUG workaround only for manual update displays Greg Kroah-Hartman
@ 2012-07-12 22:34 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 144/187] HID: hid-multitouch: fix wrong protocol detection Greg Kroah-Hartman
` (43 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Bruce Allan, Jeff Pieper,
Jeff Kirsher, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bruce Allan <bruce.w.allan@intel.com>
commit 470a54207ccf7045a59df727573bd9d148988582 upstream.
commit 44abd5c12767a8c567dc4e45fd9aec3b13ca85e0 introduced NULL pointer
dereferences when attempting to access the check_reset_block function
pointer on 8257x and 80003es2lan non-copper devices.
This fix should be applied back through 3.4.
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/e1000e/ethtool.c | 6 ++++--
drivers/net/ethernet/intel/e1000e/mac.c | 2 +-
drivers/net/ethernet/intel/e1000e/netdev.c | 4 ++--
drivers/net/ethernet/intel/e1000e/phy.c | 8 +++++---
4 files changed, 12 insertions(+), 8 deletions(-)
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -258,7 +258,8 @@ static int e1000_set_settings(struct net
* When SoL/IDER sessions are active, autoneg/speed/duplex
* cannot be changed
*/
- if (hw->phy.ops.check_reset_block(hw)) {
+ if (hw->phy.ops.check_reset_block &&
+ hw->phy.ops.check_reset_block(hw)) {
e_err("Cannot change link characteristics when SoL/IDER is "
"active.\n");
return -EINVAL;
@@ -1604,7 +1605,8 @@ static int e1000_loopback_test(struct e1
* PHY loopback cannot be performed if SoL/IDER
* sessions are active
*/
- if (hw->phy.ops.check_reset_block(hw)) {
+ if (hw->phy.ops.check_reset_block &&
+ hw->phy.ops.check_reset_block(hw)) {
e_err("Cannot do PHY loopback test when SoL/IDER is active.\n");
*data = 0;
goto out;
--- a/drivers/net/ethernet/intel/e1000e/mac.c
+++ b/drivers/net/ethernet/intel/e1000e/mac.c
@@ -709,7 +709,7 @@ s32 e1000e_setup_link_generic(struct e10
* In the case of the phy reset being blocked, we already have a link.
* We do not need to set it up again.
*/
- if (hw->phy.ops.check_reset_block(hw))
+ if (hw->phy.ops.check_reset_block && hw->phy.ops.check_reset_block(hw))
return 0;
/*
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -6209,7 +6209,7 @@ static int __devinit e1000_probe(struct
adapter->hw.phy.ms_type = e1000_ms_hw_default;
}
- if (hw->phy.ops.check_reset_block(hw))
+ if (hw->phy.ops.check_reset_block && hw->phy.ops.check_reset_block(hw))
e_info("PHY reset is blocked due to SOL/IDER session.\n");
/* Set initial default active device features */
@@ -6376,7 +6376,7 @@ err_register:
if (!(adapter->flags & FLAG_HAS_AMT))
e1000e_release_hw_control(adapter);
err_eeprom:
- if (!hw->phy.ops.check_reset_block(hw))
+ if (hw->phy.ops.check_reset_block && !hw->phy.ops.check_reset_block(hw))
e1000_phy_hw_reset(&adapter->hw);
err_hw_init:
kfree(adapter->tx_ring);
--- a/drivers/net/ethernet/intel/e1000e/phy.c
+++ b/drivers/net/ethernet/intel/e1000e/phy.c
@@ -2121,9 +2121,11 @@ s32 e1000e_phy_hw_reset_generic(struct e
s32 ret_val;
u32 ctrl;
- ret_val = phy->ops.check_reset_block(hw);
- if (ret_val)
- return 0;
+ if (phy->ops.check_reset_block) {
+ ret_val = phy->ops.check_reset_block(hw);
+ if (ret_val)
+ return 0;
+ }
ret_val = phy->ops.acquire(hw);
if (ret_val)
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 144/187] HID: hid-multitouch: fix wrong protocol detection
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (136 preceding siblings ...)
2012-07-12 22:34 ` [ 143/187] e1000e: test for valid check_reset_block function pointer Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 145/187] ACPI / PM: Make acpi_pm_device_sleep_state() follow the specification Greg Kroah-Hartman
` (42 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Benjamin Tissoires,
Henrik Rydberg, Jiri Kosina
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <benjamin.tissoires@enac.fr>
commit 3ac36d15557d1bedfb1151d9911b9587b2d40759 upstream.
The previous implementation introduced a randomness in the splitting
of the different touches reported by the device. This version is more
robust as we don't rely on hi->input->absbit, but on our own structure.
This also prepares hid-multitouch to better support Win8 devices.
[Jiri Kosina <jkosina@suse.cz>: fix build]
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@enac.fr>
Acked-by: Henrik Rydberg <rydberg@euromail.se>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-multitouch.c | 58 ++++++++++++++++++++++++++++++++++---------
1 file changed, 46 insertions(+), 12 deletions(-)
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -70,9 +70,16 @@ struct mt_class {
bool is_indirect; /* true for touchpads */
};
+struct mt_fields {
+ unsigned usages[HID_MAX_FIELDS];
+ unsigned int length;
+};
+
struct mt_device {
struct mt_slot curdata; /* placeholder of incoming data */
struct mt_class mtclass; /* our mt device class */
+ struct mt_fields *fields; /* temporary placeholder for storing the
+ multitouch fields */
unsigned last_field_index; /* last field index of the report */
unsigned last_slot_field; /* the last field of a slot */
__s8 inputmode; /* InputMode HID feature, -1 if non-existent */
@@ -275,11 +282,15 @@ static void set_abs(struct input_dev *in
input_set_abs_params(input, code, fmin, fmax, fuzz, 0);
}
-static void set_last_slot_field(struct hid_usage *usage, struct mt_device *td,
+static void mt_store_field(struct hid_usage *usage, struct mt_device *td,
struct hid_input *hi)
{
- if (!test_bit(usage->hid, hi->input->absbit))
- td->last_slot_field = usage->hid;
+ struct mt_fields *f = td->fields;
+
+ if (f->length >= HID_MAX_FIELDS)
+ return;
+
+ f->usages[f->length++] = usage->hid;
}
static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
@@ -330,7 +341,7 @@ static int mt_input_mapping(struct hid_d
cls->sn_move);
/* touchscreen emulation */
set_abs(hi->input, ABS_X, field, cls->sn_move);
- set_last_slot_field(usage, td, hi);
+ mt_store_field(usage, td, hi);
td->last_field_index = field->index;
return 1;
case HID_GD_Y:
@@ -340,7 +351,7 @@ static int mt_input_mapping(struct hid_d
cls->sn_move);
/* touchscreen emulation */
set_abs(hi->input, ABS_Y, field, cls->sn_move);
- set_last_slot_field(usage, td, hi);
+ mt_store_field(usage, td, hi);
td->last_field_index = field->index;
return 1;
}
@@ -349,24 +360,24 @@ static int mt_input_mapping(struct hid_d
case HID_UP_DIGITIZER:
switch (usage->hid) {
case HID_DG_INRANGE:
- set_last_slot_field(usage, td, hi);
+ mt_store_field(usage, td, hi);
td->last_field_index = field->index;
return 1;
case HID_DG_CONFIDENCE:
- set_last_slot_field(usage, td, hi);
+ mt_store_field(usage, td, hi);
td->last_field_index = field->index;
return 1;
case HID_DG_TIPSWITCH:
hid_map_usage(hi, usage, bit, max, EV_KEY, BTN_TOUCH);
input_set_capability(hi->input, EV_KEY, BTN_TOUCH);
- set_last_slot_field(usage, td, hi);
+ mt_store_field(usage, td, hi);
td->last_field_index = field->index;
return 1;
case HID_DG_CONTACTID:
if (!td->maxcontacts)
td->maxcontacts = MT_DEFAULT_MAXCONTACT;
input_mt_init_slots(hi->input, td->maxcontacts);
- td->last_slot_field = usage->hid;
+ mt_store_field(usage, td, hi);
td->last_field_index = field->index;
td->touches_by_report++;
return 1;
@@ -375,7 +386,7 @@ static int mt_input_mapping(struct hid_d
EV_ABS, ABS_MT_TOUCH_MAJOR);
set_abs(hi->input, ABS_MT_TOUCH_MAJOR, field,
cls->sn_width);
- set_last_slot_field(usage, td, hi);
+ mt_store_field(usage, td, hi);
td->last_field_index = field->index;
return 1;
case HID_DG_HEIGHT:
@@ -385,7 +396,7 @@ static int mt_input_mapping(struct hid_d
cls->sn_height);
input_set_abs_params(hi->input,
ABS_MT_ORIENTATION, 0, 1, 0, 0);
- set_last_slot_field(usage, td, hi);
+ mt_store_field(usage, td, hi);
td->last_field_index = field->index;
return 1;
case HID_DG_TIPPRESSURE:
@@ -396,7 +407,7 @@ static int mt_input_mapping(struct hid_d
/* touchscreen emulation */
set_abs(hi->input, ABS_PRESSURE, field,
cls->sn_pressure);
- set_last_slot_field(usage, td, hi);
+ mt_store_field(usage, td, hi);
td->last_field_index = field->index;
return 1;
case HID_DG_CONTACTCOUNT:
@@ -635,6 +646,16 @@ static void mt_set_maxcontacts(struct hi
}
}
+static void mt_post_parse(struct mt_device *td)
+{
+ struct mt_fields *f = td->fields;
+
+ if (td->touches_by_report > 0) {
+ int field_count_per_touch = f->length / td->touches_by_report;
+ td->last_slot_field = f->usages[field_count_per_touch - 1];
+ }
+}
+
static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
{
int ret, i;
@@ -666,6 +687,13 @@ static int mt_probe(struct hid_device *h
td->maxcontact_report_id = -1;
hid_set_drvdata(hdev, td);
+ td->fields = kzalloc(sizeof(struct mt_fields), GFP_KERNEL);
+ if (!td->fields) {
+ dev_err(&hdev->dev, "cannot allocate multitouch fields data\n");
+ ret = -ENOMEM;
+ goto fail;
+ }
+
ret = hid_parse(hdev);
if (ret != 0)
goto fail;
@@ -674,6 +702,8 @@ static int mt_probe(struct hid_device *h
if (ret)
goto fail;
+ mt_post_parse(td);
+
if (!id && td->touches_by_report == 1) {
/* the device has been sent by hid-generic */
mtclass = &td->mtclass;
@@ -697,9 +727,13 @@ static int mt_probe(struct hid_device *h
mt_set_maxcontacts(hdev);
mt_set_input_mode(hdev);
+ kfree(td->fields);
+ td->fields = NULL;
+
return 0;
fail:
+ kfree(td->fields);
kfree(td);
return ret;
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 145/187] ACPI / PM: Make acpi_pm_device_sleep_state() follow the specification
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (137 preceding siblings ...)
2012-07-12 22:35 ` [ 144/187] HID: hid-multitouch: fix wrong protocol detection Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 146/187] SCSI: Fix NULL dereferences in scsi_cmd_to_driver Greg Kroah-Hartman
` (41 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Rafael J. Wysocki
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <rjw@sisk.pl>
commit dbe9a2edd17d843d80faf2b99f20a691c1853418 upstream.
The comparison between the system sleep state being entered
and the lowest system sleep state the given device may wake up
from in acpi_pm_device_sleep_state() is reversed, because the
specification (ACPI 5.0) says that for wakeup to work:
"The sleeping state being entered must be less than or equal to the
power state declared in element 1 of the _PRW object."
In other words, the state returned by _PRW is the deepest
(lowest-power) system sleep state the device is capable of waking up
the system from.
Moreover, acpi_pm_device_sleep_state() also should check if the
wakeup capability is supported through ACPI, because in principle it
may be done via native PCIe PME, for example, in which case _SxW
should not be evaluated.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/sleep.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -732,8 +732,8 @@ int acpi_pm_device_sleep_state(struct de
* can wake the system. _S0W may be valid, too.
*/
if (acpi_target_sleep_state == ACPI_STATE_S0 ||
- (device_may_wakeup(dev) &&
- adev->wakeup.sleep_state <= acpi_target_sleep_state)) {
+ (device_may_wakeup(dev) && adev->wakeup.flags.valid &&
+ adev->wakeup.sleep_state >= acpi_target_sleep_state)) {
acpi_status status;
acpi_method[3] = 'W';
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 146/187] SCSI: Fix NULL dereferences in scsi_cmd_to_driver
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (138 preceding siblings ...)
2012-07-12 22:35 ` [ 145/187] ACPI / PM: Make acpi_pm_device_sleep_state() follow the specification Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 147/187] SCSI: libsas: fix taskfile corruption in sas_ata_qc_fill_rtf Greg Kroah-Hartman
` (40 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Mark Rustad, Marcus Dennis,
James Bottomley
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rustad <mark.d.rustad@intel.com>
commit 222a806af830fda34ad1f6bc991cd226916de060 upstream.
Avoid crashing if the private_data pointer happens to be NULL. This has
been seen sometimes when a host reset happens, notably when there are
many LUNs:
host3: Assigned Port ID 0c1601
scsi host3: libfc: Host reset succeeded on port (0c1601)
BUG: unable to handle kernel NULL pointer dereference at 0000000000000350
IP: [<ffffffff81352bb8>] scsi_send_eh_cmnd+0x58/0x3a0
<snip>
Process scsi_eh_3 (pid: 4144, threadinfo ffff88030920c000, task ffff880326b160c0)
Stack:
000000010372e6ba 0000000000000282 000027100920dca0 ffffffffa0038ee0
0000000000000000 0000000000030003 ffff88030920dc80 ffff88030920dc80
00000002000e0000 0000000a00004000 ffff8803242f7760 ffff88031326ed80
Call Trace:
[<ffffffff8105b590>] ? lock_timer_base+0x70/0x70
[<ffffffff81352fbe>] scsi_eh_tur+0x3e/0xc0
[<ffffffff81353a36>] scsi_eh_test_devices+0x76/0x170
[<ffffffff81354125>] scsi_eh_host_reset+0x85/0x160
[<ffffffff81354291>] scsi_eh_ready_devs+0x91/0x110
[<ffffffff813543fd>] scsi_unjam_host+0xed/0x1f0
[<ffffffff813546a8>] scsi_error_handler+0x1a8/0x200
[<ffffffff81354500>] ? scsi_unjam_host+0x1f0/0x1f0
[<ffffffff8106ec3e>] kthread+0x9e/0xb0
[<ffffffff81509264>] kernel_thread_helper+0x4/0x10
[<ffffffff8106eba0>] ? kthread_freezable_should_stop+0x70/0x70
[<ffffffff81509260>] ? gs_change+0x13/0x13
Code: 25 28 00 00 00 48 89 45 c8 31 c0 48 8b 87 80 00 00 00 48 8d b5 60 ff ff ff 89 d1 48 89 fb 41 89 d6 4c 89 fa 48 8b 80 b8 00 00 00
<48> 8b 80 50 03 00 00 48 8b 00 48 89 85 38 ff ff ff 48 8b 07 4c
RIP [<ffffffff81352bb8>] scsi_send_eh_cmnd+0x58/0x3a0
RSP <ffff88030920dc50>
CR2: 0000000000000350
Signed-off-by: Mark Rustad <mark.d.rustad@intel.com>
Tested-by: Marcus Dennis <marcusx.e.dennis@intel.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/scsi/scsi_cmnd.h | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -134,10 +134,16 @@ struct scsi_cmnd {
static inline struct scsi_driver *scsi_cmd_to_driver(struct scsi_cmnd *cmd)
{
+ struct scsi_driver **sdp;
+
if (!cmd->request->rq_disk)
return NULL;
- return *(struct scsi_driver **)cmd->request->rq_disk->private_data;
+ sdp = (struct scsi_driver **)cmd->request->rq_disk->private_data;
+ if (!sdp)
+ return NULL;
+
+ return *sdp;
}
extern struct scsi_cmnd *scsi_get_command(struct scsi_device *, gfp_t);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 147/187] SCSI: libsas: fix taskfile corruption in sas_ata_qc_fill_rtf
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (139 preceding siblings ...)
2012-07-12 22:35 ` [ 146/187] SCSI: Fix NULL dereferences in scsi_cmd_to_driver Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 148/187] ACPI / PM: Leave Bus Master Arbitration enabled for suspend/resume Greg Kroah-Hartman
` (39 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Praveen Murali, Dan Williams,
James Bottomley
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <dan.j.williams@intel.com>
commit 6ef1b512f4e6f936d89aa20be3d97a7ec7c290ac upstream.
fill_result_tf() grabs the taskfile flags from the originating qc which
sas_ata_qc_fill_rtf() promptly overwrites. The presence of an
ata_taskfile in the sata_device makes it tempting to just copy the full
contents in sas_ata_qc_fill_rtf(). However, libata really only wants
the fis contents and expects the other portions of the taskfile to not
be touched by ->qc_fill_rtf. To that end store a fis buffer in the
sata_device and use ata_tf_from_fis() like every other ->qc_fill_rtf()
implementation.
Reported-by: Praveen Murali <pmurali@logicube.com>
Tested-by: Praveen Murali <pmurali@logicube.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/aic94xx/aic94xx_task.c | 2 +-
drivers/scsi/libsas/sas_ata.c | 12 ++++++------
include/scsi/libsas.h | 6 ++++--
3 files changed, 11 insertions(+), 9 deletions(-)
--- a/drivers/scsi/aic94xx/aic94xx_task.c
+++ b/drivers/scsi/aic94xx/aic94xx_task.c
@@ -201,7 +201,7 @@ static void asd_get_response_tasklet(str
if (SAS_STATUS_BUF_SIZE >= sizeof(*resp)) {
resp->frame_len = le16_to_cpu(*(__le16 *)(r+6));
- memcpy(&resp->ending_fis[0], r+16, 24);
+ memcpy(&resp->ending_fis[0], r+16, ATA_RESP_FIS_SIZE);
ts->buf_valid_size = sizeof(*resp);
}
}
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -139,12 +139,12 @@ static void sas_ata_task_done(struct sas
if (stat->stat == SAS_PROTO_RESPONSE || stat->stat == SAM_STAT_GOOD ||
((stat->stat == SAM_STAT_CHECK_CONDITION &&
dev->sata_dev.command_set == ATAPI_COMMAND_SET))) {
- ata_tf_from_fis(resp->ending_fis, &dev->sata_dev.tf);
+ memcpy(dev->sata_dev.fis, resp->ending_fis, ATA_RESP_FIS_SIZE);
if (!link->sactive) {
- qc->err_mask |= ac_err_mask(dev->sata_dev.tf.command);
+ qc->err_mask |= ac_err_mask(dev->sata_dev.fis[2]);
} else {
- link->eh_info.err_mask |= ac_err_mask(dev->sata_dev.tf.command);
+ link->eh_info.err_mask |= ac_err_mask(dev->sata_dev.fis[2]);
if (unlikely(link->eh_info.err_mask))
qc->flags |= ATA_QCFLAG_FAILED;
}
@@ -161,8 +161,8 @@ static void sas_ata_task_done(struct sas
qc->flags |= ATA_QCFLAG_FAILED;
}
- dev->sata_dev.tf.feature = 0x04; /* status err */
- dev->sata_dev.tf.command = ATA_ERR;
+ dev->sata_dev.fis[3] = 0x04; /* status err */
+ dev->sata_dev.fis[2] = ATA_ERR;
}
}
@@ -269,7 +269,7 @@ static bool sas_ata_qc_fill_rtf(struct a
{
struct domain_device *dev = qc->ap->private_data;
- memcpy(&qc->result_tf, &dev->sata_dev.tf, sizeof(qc->result_tf));
+ ata_tf_from_fis(dev->sata_dev.fis, &qc->result_tf);
return true;
}
--- a/include/scsi/libsas.h
+++ b/include/scsi/libsas.h
@@ -163,6 +163,8 @@ enum ata_command_set {
ATAPI_COMMAND_SET = 1,
};
+#define ATA_RESP_FIS_SIZE 24
+
struct sata_device {
enum ata_command_set command_set;
struct smp_resp rps_resp; /* report_phy_sata_resp */
@@ -171,7 +173,7 @@ struct sata_device {
struct ata_port *ap;
struct ata_host ata_host;
- struct ata_taskfile tf;
+ u8 fis[ATA_RESP_FIS_SIZE];
};
enum {
@@ -537,7 +539,7 @@ enum exec_status {
*/
struct ata_task_resp {
u16 frame_len;
- u8 ending_fis[24]; /* dev to host or data-in */
+ u8 ending_fis[ATA_RESP_FIS_SIZE]; /* dev to host or data-in */
};
#define SAS_STATUS_BUF_SIZE 96
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 148/187] ACPI / PM: Leave Bus Master Arbitration enabled for suspend/resume
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (140 preceding siblings ...)
2012-07-12 22:35 ` [ 147/187] SCSI: libsas: fix taskfile corruption in sas_ata_qc_fill_rtf Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 149/187] USB: metro-usb: fix tty_flip_buffer_push use Greg Kroah-Hartman
` (38 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Adrian Knoth, Jonathan Nieder,
Rafael J. Wysocki
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Nieder <jrnieder@gmail.com>
commit dc332fdf9f373a87b1e2f423b5b004b2a3c37e1a upstream.
This is an old suspend/resume lockup fix:
commit 2780cc4660e1
Author: Len Brown <len.brown@intel.com>
Date: Thu Dec 23 13:43:30 2004 -0500
[ACPI] Fix suspend/resume lockup issue
by leaving Bus Master Arbitration enabled.
The ACPI spec mandates it be disabled only for C3.
http://bugzilla.kernel.org/show_bug.cgi?id=3599
Signed-off-by: David Shaohua Li <shaohua.li@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
The bug snuck back in in commit 2feec47d4c5f (ACPICA: ACPI 5: Support
for new FADT SleepStatus, SleepControl registers, 2012-02-14),
presumably by copy/pasting a copy of the code without that fix for the
legacy case.
On affected machines, after that commit, the machine locks up hard on
resume from suspend. The same fix as seven years ago still works.
Addresses <https://bugzilla.kernel.org/show_bug.cgi?id=43641>.
Reported-bisected-and-tested-by: Octavio Alvarez <alvarezp@alvarezp.com>
Reported-by: Adrian Knoth <adi@drcomp.erfurt.thur.de>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/acpica/hwsleep.c | 22 ----------------------
1 file changed, 22 deletions(-)
--- a/drivers/acpi/acpica/hwsleep.c
+++ b/drivers/acpi/acpica/hwsleep.c
@@ -95,18 +95,6 @@ acpi_status acpi_hw_legacy_sleep(u8 slee
return_ACPI_STATUS(status);
}
- if (sleep_state != ACPI_STATE_S5) {
- /*
- * Disable BM arbitration. This feature is contained within an
- * optional register (PM2 Control), so ignore a BAD_ADDRESS
- * exception.
- */
- status = acpi_write_bit_register(ACPI_BITREG_ARB_DISABLE, 1);
- if (ACPI_FAILURE(status) && (status != AE_BAD_ADDRESS)) {
- return_ACPI_STATUS(status);
- }
- }
-
/*
* 1) Disable/Clear all GPEs
* 2) Enable all wakeup GPEs
@@ -364,16 +352,6 @@ acpi_status acpi_hw_legacy_wake(u8 sleep
[ACPI_EVENT_POWER_BUTTON].
status_register_id, ACPI_CLEAR_STATUS);
- /*
- * Enable BM arbitration. This feature is contained within an
- * optional register (PM2 Control), so ignore a BAD_ADDRESS
- * exception.
- */
- status = acpi_write_bit_register(ACPI_BITREG_ARB_DISABLE, 0);
- if (ACPI_FAILURE(status) && (status != AE_BAD_ADDRESS)) {
- return_ACPI_STATUS(status);
- }
-
acpi_hw_execute_sleep_method(METHOD_PATHNAME__SST, ACPI_SST_WORKING);
return_ACPI_STATUS(status);
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 149/187] USB: metro-usb: fix tty_flip_buffer_push use
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (141 preceding siblings ...)
2012-07-12 22:35 ` [ 148/187] ACPI / PM: Leave Bus Master Arbitration enabled for suspend/resume Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` =?y?q?=5B=20150/187=5D=20USB=3A=20cdc-wdm=3A=20fix=20lockup=20on=20error=20in=20wdm=5Fread?= Greg Kroah-Hartman
` (37 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Johan Hovold
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit b7d28e32c93801d60c1a7a817f774a02b7bdde43 upstream.
Do not set low_latency flag at open as tty_flip_buffer_push must not be
called in IRQ context with low_latency set.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/metro-usb.c | 8 --------
1 file changed, 8 deletions(-)
--- a/drivers/usb/serial/metro-usb.c
+++ b/drivers/usb/serial/metro-usb.c
@@ -171,14 +171,6 @@ static int metrousb_open(struct tty_stru
metro_priv->throttled = 0;
spin_unlock_irqrestore(&metro_priv->lock, flags);
- /*
- * Force low_latency on so that our tty_push actually forces the data
- * through, otherwise it is scheduled, and with high data rates (like
- * with OHCI) data can get lost.
- */
- if (tty)
- tty->low_latency = 1;
-
/* Clear the urb pipe. */
usb_clear_halt(serial->dev, port->interrupt_in_urb->pipe);
^ permalink raw reply [flat|nested] 191+ messages in thread* =?y?q?=5B=20150/187=5D=20USB=3A=20cdc-wdm=3A=20fix=20lockup=20on=20error=20in=20wdm=5Fread?=
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (142 preceding siblings ...)
2012-07-12 22:35 ` [ 149/187] USB: metro-usb: fix tty_flip_buffer_push use Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` =?y?q?=5B=20151/187=5D=20USB=3A=20option=3A=20add=20ZTE=20MF60?= Greg Kroah-Hartman
` (36 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Bjørn Mork, Oliver Neukum
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=y, Size: 4289 bytes --]
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
commit b086b6b10d9f182cd8d2f0dcfd7fd11edba93fc9 upstream.
Clear the WDM_READ flag on empty reads to avoid running
forever in an infinite tight loop, causing lockups:
Jul 1 21:58:11 nemi kernel: [ 3658.898647] qmi_wwan 2-1:1.2: Unexpected error -71
Jul 1 21:58:36 nemi kernel: [ 3684.072021] BUG: soft lockup - CPU#0 stuck for 23s! [qmi.pl:12235]
Jul 1 21:58:36 nemi kernel: [ 3684.072212] CPU 0
Jul 1 21:58:36 nemi kernel: [ 3684.072355]
Jul 1 21:58:36 nemi kernel: [ 3684.072367] Pid: 12235, comm: qmi.pl Tainted: P O 3.5.0-rc2+ #13 LENOVO 2776LEG/2776LEG
Jul 1 21:58:36 nemi kernel: [ 3684.072383] RIP: 0010:[<ffffffffa0635008>] [<ffffffffa0635008>] spin_unlock_irq+0x8/0xc [cdc_wdm]
Jul 1 21:58:36 nemi kernel: [ 3684.072388] RSP: 0018:ffff88022dca1e70 EFLAGS: 00000282
Jul 1 21:58:36 nemi kernel: [ 3684.072393] RAX: ffff88022fc3f650 RBX: ffffffff811c56f7 RCX: 00000001000ce8c1
Jul 1 21:58:36 nemi kernel: [ 3684.072398] RDX: 0000000000000010 RSI: 000000000267d810 RDI: ffff88022fc3f650
Jul 1 21:58:36 nemi kernel: [ 3684.072403] RBP: ffff88022dca1eb0 R08: ffffffffa063578e R09: 0000000000000000
Jul 1 21:58:36 nemi kernel: [ 3684.072407] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000002
Jul 1 21:58:36 nemi kernel: [ 3684.072412] R13: 0000000000000246 R14: ffffffff00000002 R15: ffff8802281d8c88
Jul 1 21:58:36 nemi kernel: [ 3684.072418] FS: 00007f666a260700(0000) GS:ffff88023bc00000(0000) knlGS:0000000000000000
Jul 1 21:58:36 nemi kernel: [ 3684.072423] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Jul 1 21:58:36 nemi kernel: [ 3684.072428] CR2: 000000000270d9d8 CR3: 000000022e865000 CR4: 00000000000007f0
Jul 1 21:58:36 nemi kernel: [ 3684.072433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Jul 1 21:58:36 nemi kernel: [ 3684.072438] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Jul 1 21:58:36 nemi kernel: [ 3684.072444] Process qmi.pl (pid: 12235, threadinfo ffff88022dca0000, task ffff88022ff76380)
Jul 1 21:58:36 nemi kernel: [ 3684.072448] Stack:
Jul 1 21:58:36 nemi kernel: [ 3684.072458] ffffffffa063592e 0000000100020000 ffff88022fc3f650 ffff88022fc3f6a8
Jul 1 21:58:36 nemi kernel: [ 3684.072466] 0000000000000200 0000000100000000 000000000267d810 0000000000000000
Jul 1 21:58:36 nemi kernel: [ 3684.072475] 0000000000000000 ffff880212cfb6d0 0000000000000200 ffff880212cfb6c0
Jul 1 21:58:36 nemi kernel: [ 3684.072479] Call Trace:
Jul 1 21:58:36 nemi kernel: [ 3684.072489] [<ffffffffa063592e>] ? wdm_read+0x1a0/0x263 [cdc_wdm]
Jul 1 21:58:36 nemi kernel: [ 3684.072500] [<ffffffff8110adb7>] ? vfs_read+0xa1/0xfb
Jul 1 21:58:36 nemi kernel: [ 3684.072509] [<ffffffff81040589>] ? alarm_setitimer+0x35/0x64
Jul 1 21:58:36 nemi kernel: [ 3684.072517] [<ffffffff8110aec7>] ? sys_read+0x45/0x6e
Jul 1 21:58:36 nemi kernel: [ 3684.072525] [<ffffffff813725f9>] ? system_call_fastpath+0x16/0x1b
Jul 1 21:58:36 nemi kernel: [ 3684.072557] Code: <66> 66 90 c3 83 ff ed 89 f8 74 16 7f 06 83 ff a1 75 0a c3 83 ff f4
The WDM_READ flag is normally cleared by wdm_int_callback
before resubmitting the read urb, and set by wdm_in_callback
when this urb returns with data or an error. But a crashing
device may cause both a read error and cancelling all urbs.
Make sure that the flag is cleared by wdm_read if the buffer
is empty.
We don't clear the flag on errors, as there may be pending
data in the buffer which should be processed. The flag will
instead be cleared on the next wdm_read call.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Acked-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-wdm.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -497,6 +497,8 @@ retry:
goto retry;
}
if (!desc->reslength) { /* zero length read */
+ dev_dbg(&desc->intf->dev, "%s: zero length - clearing WDM_READ\n", __func__);
+ clear_bit(WDM_READ, &desc->flags);
spin_unlock_irq(&desc->iuspin);
goto retry;
}
^ permalink raw reply [flat|nested] 191+ messages in thread* =?y?q?=5B=20151/187=5D=20USB=3A=20option=3A=20add=20ZTE=20MF60?=
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (143 preceding siblings ...)
2012-07-12 22:35 ` =?y?q?=5B=20150/187=5D=20USB=3A=20cdc-wdm=3A=20fix=20lockup=20on=20error=20in=20wdm=5Fread?= Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 152/187] USB: option: Add MEDIATEK product ids Greg Kroah-Hartman
` (35 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Bjørn Mork
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=y, Size: 2599 bytes --]
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
commit 8e16e33c168a6efd0c9f7fa9dd4c1e1db9a74553 upstream.
Switches into a composite device by ejecting the initial
driver CD. The four interfaces are: QCDM, AT, QMI/wwan
and mass storage. Let this driver manage the two serial
interfaces:
T: Bus=02 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 28 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=19d2 ProdID=1402 Rev= 0.00
S: Manufacturer=ZTE,Incorporated
S: Product=ZTE WCDMA Technologies MSM
S: SerialNumber=xxxxx
C:* #Ifs= 4 Cfg#= 1 Atr=c0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 3 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -554,6 +554,10 @@ static const struct option_blacklist_inf
.reserved = BIT(1),
};
+static const struct option_blacklist_info net_intf2_blacklist = {
+ .reserved = BIT(2),
+};
+
static const struct option_blacklist_info net_intf3_blacklist = {
.reserved = BIT(3),
};
@@ -1099,6 +1103,8 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1402, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 152/187] USB: option: Add MEDIATEK product ids
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (144 preceding siblings ...)
2012-07-12 22:35 ` =?y?q?=5B=20151/187=5D=20USB=3A=20option=3A=20add=20ZTE=20MF60?= Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 153/187] usb: Add support for root hub port status CAS Greg Kroah-Hartman
` (34 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Gaosen Zhang
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaosen Zhang <gaosen.zhang@mediatek.com>
commit aacef9c561a693341566a6850c451ce3df68cb9a upstream.
Signed-off-by: Gaosen Zhang <gaosen.zhang@mediatek.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -497,6 +497,15 @@ static void option_instat_callback(struc
/* MediaTek products */
#define MEDIATEK_VENDOR_ID 0x0e8d
+#define MEDIATEK_PRODUCT_DC_1COM 0x00a0
+#define MEDIATEK_PRODUCT_DC_4COM 0x00a5
+#define MEDIATEK_PRODUCT_DC_5COM 0x00a4
+#define MEDIATEK_PRODUCT_7208_1COM 0x7101
+#define MEDIATEK_PRODUCT_7208_2COM 0x7102
+#define MEDIATEK_PRODUCT_FP_1COM 0x0003
+#define MEDIATEK_PRODUCT_FP_2COM 0x0023
+#define MEDIATEK_PRODUCT_FPDC_1COM 0x0043
+#define MEDIATEK_PRODUCT_FPDC_2COM 0x0033
/* Cellient products */
#define CELLIENT_VENDOR_ID 0x2692
@@ -1246,6 +1255,17 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a1, 0xff, 0x02, 0x01) },
{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a2, 0xff, 0x00, 0x00) },
{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a2, 0xff, 0x02, 0x01) }, /* MediaTek MT6276M modem & app port */
+ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_1COM, 0x0a, 0x00, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_5COM, 0xff, 0x02, 0x01) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_5COM, 0xff, 0x00, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM, 0xff, 0x02, 0x01) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM, 0xff, 0x00, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7208_1COM, 0x02, 0x00, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7208_2COM, 0x02, 0x02, 0x01) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FP_1COM, 0x0a, 0x00, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FP_2COM, 0x0a, 0x00, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FPDC_1COM, 0x0a, 0x00, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FPDC_2COM, 0x0a, 0x00, 0x00) },
{ USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
{ } /* Terminating entry */
};
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 153/187] usb: Add support for root hub port status CAS
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (145 preceding siblings ...)
2012-07-12 22:35 ` [ 152/187] USB: option: Add MEDIATEK product ids Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 154/187] xhci: Fix hang on back-to-back Set TR Deq Ptr commands Greg Kroah-Hartman
` (33 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Stanislaw Ledwon, Sarah Sharp, Andiry Xu
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Ledwon <staszek.ledwon@linux.jf.intel.com>
commit 8bea2bd37df08aaa599aa361a9f8b836ba98e554 upstream.
The host controller port status register supports CAS (Cold Attach
Status) bit. This bit could be set when USB3.0 device is connected
when system is in Sx state. When the system wakes to S0 this port
status with CAS bit is reported and this port can't be used by any
device.
When CAS bit is set the port should be reset by warm reset. This
was not supported by xhci driver.
The issue was found when pendrive was connected to suspended
platform. The link state of "Compliance Mode" was reported together
with CAS bit. This link state was also not supported by xhci and
core/hub.c.
The CAS bit is defined only for xhci root hub port and it is
not supported on regular hubs. The link status is used to force
warm reset on port. Make the USB core issue a warm reset when port
is in ether the 'inactive' or 'compliance mode'. Change the xHCI driver
to report 'compliance mode' when the CAS is set. This force warm reset
on the root hub port.
This patch should be backported to stable kernels as old as 3.2, that
contain the commit 10d674a82e553cb8a1f41027bb3c3e309b3f6804 "USB: When
hot reset for USB3 fails, try warm reset."
Signed-off-by: Stanislaw Ledwon <staszek.ledwon@linux.intel.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Acked-by: Andiry Xu <andiry.xu@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hub.c | 18 ++++++++++--------
drivers/usb/host/xhci-hub.c | 44 ++++++++++++++++++++++++++++++++++++++------
drivers/usb/host/xhci.h | 6 +++++-
3 files changed, 53 insertions(+), 15 deletions(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2102,12 +2102,16 @@ static unsigned hub_is_wusb(struct usb_h
static int hub_port_reset(struct usb_hub *hub, int port1,
struct usb_device *udev, unsigned int delay, bool warm);
-/* Is a USB 3.0 port in the Inactive state? */
-static bool hub_port_inactive(struct usb_hub *hub, u16 portstatus)
+/* Is a USB 3.0 port in the Inactive or Complinance Mode state?
+ * Port worm reset is required to recover
+ */
+static bool hub_port_warm_reset_required(struct usb_hub *hub, u16 portstatus)
{
return hub_is_superspeed(hub->hdev) &&
- (portstatus & USB_PORT_STAT_LINK_STATE) ==
- USB_SS_PORT_LS_SS_INACTIVE;
+ (((portstatus & USB_PORT_STAT_LINK_STATE) ==
+ USB_SS_PORT_LS_SS_INACTIVE) ||
+ ((portstatus & USB_PORT_STAT_LINK_STATE) ==
+ USB_SS_PORT_LS_COMP_MOD)) ;
}
static int hub_port_wait_reset(struct usb_hub *hub, int port1,
@@ -2143,7 +2147,7 @@ static int hub_port_wait_reset(struct us
*
* See https://bugzilla.kernel.org/show_bug.cgi?id=41752
*/
- if (hub_port_inactive(hub, portstatus)) {
+ if (hub_port_warm_reset_required(hub, portstatus)) {
int ret;
if ((portchange & USB_PORT_STAT_C_CONNECTION))
@@ -3757,9 +3761,7 @@ static void hub_events(void)
/* Warm reset a USB3 protocol port if it's in
* SS.Inactive state.
*/
- if (hub_is_superspeed(hub->hdev) &&
- (portstatus & USB_PORT_STAT_LINK_STATE)
- == USB_SS_PORT_LS_SS_INACTIVE) {
+ if (hub_port_warm_reset_required(hub, portstatus)) {
dev_dbg(hub_dev, "warm reset port %d\n", i);
hub_port_reset(hub, i, NULL,
HUB_BH_RESET_TIME, true);
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -462,6 +462,42 @@ void xhci_test_and_clear_bit(struct xhci
}
}
+/* Updates Link Status for super Speed port */
+static void xhci_hub_report_link_state(u32 *status, u32 status_reg)
+{
+ u32 pls = status_reg & PORT_PLS_MASK;
+
+ /* resume state is a xHCI internal state.
+ * Do not report it to usb core.
+ */
+ if (pls == XDEV_RESUME)
+ return;
+
+ /* When the CAS bit is set then warm reset
+ * should be performed on port
+ */
+ if (status_reg & PORT_CAS) {
+ /* The CAS bit can be set while the port is
+ * in any link state.
+ * Only roothubs have CAS bit, so we
+ * pretend to be in compliance mode
+ * unless we're already in compliance
+ * or the inactive state.
+ */
+ if (pls != USB_SS_PORT_LS_COMP_MOD &&
+ pls != USB_SS_PORT_LS_SS_INACTIVE) {
+ pls = USB_SS_PORT_LS_COMP_MOD;
+ }
+ /* Return also connection bit -
+ * hub state machine resets port
+ * when this bit is set.
+ */
+ pls |= USB_PORT_STAT_CONNECTION;
+ }
+ /* update status field */
+ *status |= pls;
+}
+
int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
u16 wIndex, char *buf, u16 wLength)
{
@@ -605,13 +641,9 @@ int xhci_hub_control(struct usb_hcd *hcd
else
status |= USB_PORT_STAT_POWER;
}
- /* Port Link State */
+ /* Update Port Link State for super speed ports*/
if (hcd->speed == HCD_USB3) {
- /* resume state is a xHCI internal state.
- * Do not report it to usb core.
- */
- if ((temp & PORT_PLS_MASK) != XDEV_RESUME)
- status |= (temp & PORT_PLS_MASK);
+ xhci_hub_report_link_state(&status, temp);
}
if (bus_state->port_c_suspend & (1 << wIndex))
status |= 1 << USB_PORT_FEAT_C_SUSPEND;
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -341,7 +341,11 @@ struct xhci_op_regs {
#define PORT_PLC (1 << 22)
/* port configure error change - port failed to configure its link partner */
#define PORT_CEC (1 << 23)
-/* bit 24 reserved */
+/* Cold Attach Status - xHC can set this bit to report device attached during
+ * Sx state. Warm port reset should be perfomed to clear this bit and move port
+ * to connected state.
+ */
+#define PORT_CAS (1 << 24)
/* wake on connect (enable) */
#define PORT_WKCONN_E (1 << 25)
/* wake on disconnect (enable) */
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 154/187] xhci: Fix hang on back-to-back Set TR Deq Ptr commands.
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (146 preceding siblings ...)
2012-07-12 22:35 ` [ 153/187] usb: Add support for root hub port status CAS Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 155/187] PCI: EHCI: fix crash during suspend on ASUS computers Greg Kroah-Hartman
` (32 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Sarah Sharp, Andiry Xu
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
commit 0d9f78a92ef5e97d9fe51d9215ebe22f6f0d289d upstream.
The Microsoft LifeChat 3000 USB headset was causing a very reproducible
hang whenever it was plugged in. At first, I thought the host
controller was producing bad transfer events, because the log was filled
with errors like:
xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD
However, it turned out to be an xHCI driver bug in the ring expansion
patches. The bug is triggered When there are two ring segments, and a
TD that ends just before a link TRB, like so:
______________ _____________
| | ---> | setup TRB B |
______________ | _____________
| | | | data TRB B |
______________ | _____________
| setup TRB A | <-- deq | | data TRB B |
______________ | _____________
| data TRB A | | | | <-- enq, deq''
______________ | _____________
| status TRB A | | | |
______________ | _____________
| link TRB |--------------- | link TRB |
_____________ <--- deq' _____________
TD A (the first control transfer) stalls on the data phase. That halts
the ring. The xHCI driver moves the hardware dequeue pointer to the
first TRB after the stalled transfer, which happens to be the link TRB.
Once the Set TR dequeue pointer command completes, the function
update_ring_for_set_deq_completion runs. That function is supposed to
update the xHCI driver's dequeue pointer to match the internal hardware
dequeue pointer. On the first call this would work fine, and the
software dequeue pointer would move to deq'.
However, if the transfer immediately after that stalled (TD B in this
case), another Set TR Dequeue command would be issued. That would move
the hardware dequeue pointer to deq''. Once that command completed,
update_ring_for_set_deq_completion would run again.
The original code would unconditionally increment the software dequeue
pointer, which moved the pointer off the ring segment into la-la-land.
The while loop would happy increment the dequeue pointer (possibly
wrapping it) until it matched the hardware pointer value.
The while loop would also access all the memory in between the first
ring segment and the second ring segment to determine if it was a link
TRB. This could cause general protection faults, although it was
unlikely because the ring segments came from a DMA pool, and would often
have consecutive memory addresses.
If nothing in that space looked like a link TRB, the deq_seg pointer for
the ring would remain on the first segment. Thus, the deq_seg and the
software dequeue pointer would get out of sync.
When the next transfer event came in after the stalled transfer, the
xHCI driver code would attempt to convert the software dequeue pointer
into a DMA address in order to compare the DMA address for the completed
transfer. Since the deq_seg and the dequeue pointer were out of sync,
xhci_trb_virt_to_dma would return NULL.
The transfer event would get ignored, the transfer would eventually
timeout, and we would mistakenly convert the finished transfer to no-op
TRBs. Some kernel driver (maybe xHCI?) would then get stuck in an
infinite loop in interrupt context, and the whole machine would hang.
This patch should be backported to kernels as old as 3.4, that contain
the commit b008df60c6369ba0290fa7daa177375407a12e07 "xHCI: count free
TRBs on transfer ring"
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: Andiry Xu <andiry.xu@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-ring.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -885,6 +885,17 @@ static void update_ring_for_set_deq_comp
num_trbs_free_temp = ep_ring->num_trbs_free;
dequeue_temp = ep_ring->dequeue;
+ /* If we get two back-to-back stalls, and the first stalled transfer
+ * ends just before a link TRB, the dequeue pointer will be left on
+ * the link TRB by the code in the while loop. So we have to update
+ * the dequeue pointer one segment further, or we'll jump off
+ * the segment into la-la-land.
+ */
+ if (last_trb(xhci, ep_ring, ep_ring->deq_seg, ep_ring->dequeue)) {
+ ep_ring->deq_seg = ep_ring->deq_seg->next;
+ ep_ring->dequeue = ep_ring->deq_seg->trbs;
+ }
+
while (ep_ring->dequeue != dev->eps[ep_index].queued_deq_ptr) {
/* We have more usable TRBs */
ep_ring->num_trbs_free++;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 155/187] PCI: EHCI: fix crash during suspend on ASUS computers
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (147 preceding siblings ...)
2012-07-12 22:35 ` [ 154/187] xhci: Fix hang on back-to-back Set TR Deq Ptr commands Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 156/187] ipheth: add support for iPad Greg Kroah-Hartman
` (31 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Alan Stern, Dâniel Fraga,
Javier Marcet, Andrey Rahmatullin, Oleksij Rempel, Pavel Pisa,
Bjorn Helgaas, Rafael J. Wysocki
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit dbf0e4c7257f8d684ec1a3c919853464293de66e upstream.
Quite a few ASUS computers experience a nasty problem, related to the
EHCI controllers, when going into system suspend. It was observed
that the problem didn't occur if the controllers were not put into the
D3 power state before starting the suspend, and commit
151b61284776be2d6f02d48c23c3625678960b97 (USB: EHCI: fix crash during
suspend on ASUS computers) was created to do this.
It turned out this approach messed up other computers that didn't have
the problem -- it prevented USB wakeup from working. Consequently
commit c2fb8a3fa25513de8fedb38509b1f15a5bbee47b (USB: add
NO_D3_DURING_SLEEP flag and revert 151b61284776be2) was merged; it
reverted the earlier commit and added a whitelist of known good board
names.
Now we know the actual cause of the problem. Thanks to AceLan Kao for
tracking it down.
According to him, an engineer at ASUS explained that some of their
BIOSes contain a bug that was added in an attempt to work around a
problem in early versions of Windows. When the computer goes into S3
suspend, the BIOS tries to verify that the EHCI controllers were first
quiesced by the OS. Nothing's wrong with this, but the BIOS does it
by checking that the PCI COMMAND registers contain 0 without checking
the controllers' power state. If the register isn't 0, the BIOS
assumes the controller needs to be quiesced and tries to do so. This
involves making various MMIO accesses to the controller, which don't
work very well if the controller is already in D3. The end result is
a system hang or memory corruption.
Since the value in the PCI COMMAND register doesn't matter once the
controller has been suspended, and since the value will be restored
anyway when the controller is resumed, we can work around the BIOS bug
simply by setting the register to 0 during system suspend. This patch
(as1590) does so and also reverts the second commit mentioned above,
which is now unnecessary.
In theory we could do this for every PCI device. However to avoid
introducing new problems, the patch restricts itself to EHCI host
controllers.
Finally the affected systems can suspend with USB wakeup working
properly.
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 156/187] ipheth: add support for iPad
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (148 preceding siblings ...)
2012-07-12 22:35 ` [ 155/187] PCI: EHCI: fix crash during suspend on ASUS computers Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 157/187] Lockd: pass network namespace to creation and destruction routines Greg Kroah-Hartman
` (30 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Davide Gerhard, David S. Miller
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davide Gerhard <rainbow@irh.it>
commit 6de0298ec9c1edaf330b71b57346241ece8f3346 upstream.
This adds support for the iPad to the ipheth driver.
(product id = 0x129a)
Signed-off-by: Davide Gerhard <rainbow@irh.it>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/ipheth.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -59,6 +59,7 @@
#define USB_PRODUCT_IPHONE_3G 0x1292
#define USB_PRODUCT_IPHONE_3GS 0x1294
#define USB_PRODUCT_IPHONE_4 0x1297
+#define USB_PRODUCT_IPAD 0x129a
#define USB_PRODUCT_IPHONE_4_VZW 0x129c
#define USB_PRODUCT_IPHONE_4S 0x12a0
@@ -101,6 +102,10 @@ static struct usb_device_id ipheth_table
IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
IPHETH_USBINTF_PROTO) },
{ USB_DEVICE_AND_INTERFACE_INFO(
+ USB_VENDOR_APPLE, USB_PRODUCT_IPAD,
+ IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+ IPHETH_USBINTF_PROTO) },
+ { USB_DEVICE_AND_INTERFACE_INFO(
USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4_VZW,
IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
IPHETH_USBINTF_PROTO) },
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 157/187] Lockd: pass network namespace to creation and destruction routines
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (149 preceding siblings ...)
2012-07-12 22:35 ` [ 156/187] ipheth: add support for iPad Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 158/187] SUNRPC: new svc_bind() routine introduced Greg Kroah-Hartman
` (29 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Stanislav Kinsbursky, J. Bruce Fields
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Kinsbursky <skinsbursky@parallels.com>
upstream commit e3f70eadb7dddfb5a2bb9afff7abfc6ee17a29d0.
v2: dereference of most probably already released nlm_host removed in
nlmclnt_done() and reclaimer().
These routines are called from locks reclaimer() kernel thread. This thread
works in "init_net" network context and currently relays on persence on lockd
thread and it's per-net resources. Thus lockd_up() and lockd_down() can't relay
on current network context. So let's pass corrent one into them.
Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/clntlock.c | 13 ++++++++-----
fs/lockd/svc.c | 7 +++----
fs/nfsd/nfssvc.c | 6 +++---
include/linux/lockd/bind.h | 4 ++--
4 files changed, 16 insertions(+), 14 deletions(-)
--- a/fs/lockd/clntlock.c
+++ b/fs/lockd/clntlock.c
@@ -56,7 +56,7 @@ struct nlm_host *nlmclnt_init(const stru
u32 nlm_version = (nlm_init->nfs_version == 2) ? 1 : 4;
int status;
- status = lockd_up();
+ status = lockd_up(nlm_init->net);
if (status < 0)
return ERR_PTR(status);
@@ -65,7 +65,7 @@ struct nlm_host *nlmclnt_init(const stru
nlm_init->hostname, nlm_init->noresvport,
nlm_init->net);
if (host == NULL) {
- lockd_down();
+ lockd_down(nlm_init->net);
return ERR_PTR(-ENOLCK);
}
@@ -80,8 +80,10 @@ EXPORT_SYMBOL_GPL(nlmclnt_init);
*/
void nlmclnt_done(struct nlm_host *host)
{
+ struct net *net = host->net;
+
nlmclnt_release_host(host);
- lockd_down();
+ lockd_down(net);
}
EXPORT_SYMBOL_GPL(nlmclnt_done);
@@ -220,11 +222,12 @@ reclaimer(void *ptr)
struct nlm_wait *block;
struct file_lock *fl, *next;
u32 nsmstate;
+ struct net *net = host->net;
allow_signal(SIGKILL);
down_write(&host->h_rwsem);
- lockd_up(); /* note: this cannot fail as lockd is already running */
+ lockd_up(net); /* note: this cannot fail as lockd is already running */
dprintk("lockd: reclaiming locks for host %s\n", host->h_name);
@@ -275,6 +278,6 @@ restart:
/* Release host handle after use */
nlmclnt_release_host(host);
- lockd_down();
+ lockd_down(net);
return 0;
}
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -295,11 +295,10 @@ static void lockd_down_net(struct net *n
/*
* Bring up the lockd process if it's not already up.
*/
-int lockd_up(void)
+int lockd_up(struct net *net)
{
struct svc_serv *serv;
int error = 0;
- struct net *net = current->nsproxy->net_ns;
mutex_lock(&nlmsvc_mutex);
/*
@@ -378,12 +377,12 @@ EXPORT_SYMBOL_GPL(lockd_up);
* Decrement the user count and bring down lockd if we're the last.
*/
void
-lockd_down(void)
+lockd_down(struct net *net)
{
mutex_lock(&nlmsvc_mutex);
if (nlmsvc_users) {
if (--nlmsvc_users) {
- lockd_down_net(current->nsproxy->net_ns);
+ lockd_down_net(net);
goto out;
}
} else {
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -220,7 +220,7 @@ static int nfsd_startup(unsigned short p
ret = nfsd_init_socks(port);
if (ret)
goto out_racache;
- ret = lockd_up();
+ ret = lockd_up(&init_net);
if (ret)
goto out_racache;
ret = nfs4_state_start();
@@ -229,7 +229,7 @@ static int nfsd_startup(unsigned short p
nfsd_up = true;
return 0;
out_lockd:
- lockd_down();
+ lockd_down(&init_net);
out_racache:
nfsd_racache_shutdown();
return ret;
@@ -246,7 +246,7 @@ static void nfsd_shutdown(void)
if (!nfsd_up)
return;
nfs4_state_shutdown();
- lockd_down();
+ lockd_down(&init_net);
nfsd_racache_shutdown();
nfsd_up = false;
}
--- a/include/linux/lockd/bind.h
+++ b/include/linux/lockd/bind.h
@@ -54,7 +54,7 @@ extern void nlmclnt_done(struct nlm_host
extern int nlmclnt_proc(struct nlm_host *host, int cmd,
struct file_lock *fl);
-extern int lockd_up(void);
-extern void lockd_down(void);
+extern int lockd_up(struct net *net);
+extern void lockd_down(struct net *net);
#endif /* LINUX_LOCKD_BIND_H */
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 158/187] SUNRPC: new svc_bind() routine introduced
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (150 preceding siblings ...)
2012-07-12 22:35 ` [ 157/187] Lockd: pass network namespace to creation and destruction routines Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 159/187] SUNRPC: move per-net operations from svc_destroy() Greg Kroah-Hartman
` (28 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Stanislav Kinsbursky, J. Bruce Fields
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Kinsbursky <skinsbursky@parallels.com>
upstream commit 9793f7c88937e7ac07305ab1af1a519225836823.
This new routine is responsible for service registration in a specified
network context.
The idea is to separate service creation from per-net operations.
Note also: since registering service with svc_bind() can fail, the
service will be destroyed and during destruction it will try to
unregister itself from rpcbind. In this case unregistration has to be
skipped.
Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/svc.c | 6 ++++++
fs/nfs/callback.c | 8 ++++++++
fs/nfsd/nfssvc.c | 9 +++++++++
include/linux/sunrpc/svc.h | 1 +
net/sunrpc/rpcb_clnt.c | 12 +++++++-----
net/sunrpc/svc.c | 19 ++++++++++---------
6 files changed, 41 insertions(+), 14 deletions(-)
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -324,6 +324,12 @@ int lockd_up(struct net *net)
goto out;
}
+ error = svc_bind(serv, net);
+ if (error < 0) {
+ printk(KERN_WARNING "lockd_up: bind service failed\n");
+ goto destroy_and_out;
+ }
+
error = make_socks(serv, net);
if (error < 0)
goto destroy_and_out;
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -17,6 +17,7 @@
#include <linux/kthread.h>
#include <linux/sunrpc/svcauth_gss.h>
#include <linux/sunrpc/bc_xprt.h>
+#include <linux/nsproxy.h>
#include <net/inet_sock.h>
@@ -253,6 +254,7 @@ int nfs_callback_up(u32 minorversion, st
char svc_name[12];
int ret = 0;
int minorversion_setup;
+ struct net *net = current->nsproxy->net_ns;
mutex_lock(&nfs_callback_mutex);
if (cb_info->users++ || cb_info->task != NULL) {
@@ -265,6 +267,12 @@ int nfs_callback_up(u32 minorversion, st
goto out_err;
}
+ ret = svc_bind(serv, net);
+ if (ret < 0) {
+ printk(KERN_WARNING "NFS: bind callback service failed\n");
+ goto out_err;
+ }
+
minorversion_setup = nfs_minorversion_callback_svc_setup(minorversion,
serv, xprt, &rqstp, &callback_svc);
if (!minorversion_setup) {
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -11,6 +11,7 @@
#include <linux/module.h>
#include <linux/fs_struct.h>
#include <linux/swap.h>
+#include <linux/nsproxy.h>
#include <linux/sunrpc/stats.h>
#include <linux/sunrpc/svcsock.h>
@@ -330,6 +331,8 @@ static int nfsd_get_default_max_blksize(
int nfsd_create_serv(void)
{
+ int error;
+
WARN_ON(!mutex_is_locked(&nfsd_mutex));
if (nfsd_serv) {
svc_get(nfsd_serv);
@@ -343,6 +346,12 @@ int nfsd_create_serv(void)
if (nfsd_serv == NULL)
return -ENOMEM;
+ error = svc_bind(nfsd_serv, current->nsproxy->net_ns);
+ if (error < 0) {
+ svc_destroy(nfsd_serv);
+ return error;
+ }
+
set_max_drc();
do_gettimeofday(&nfssvc_boot); /* record boot time */
return 0;
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -416,6 +416,7 @@ struct svc_procedure {
*/
int svc_rpcb_setup(struct svc_serv *serv, struct net *net);
void svc_rpcb_cleanup(struct svc_serv *serv, struct net *net);
+int svc_bind(struct svc_serv *serv, struct net *net);
struct svc_serv *svc_create(struct svc_program *, unsigned int,
void (*shutdown)(struct svc_serv *, struct net *net));
struct svc_rqst *svc_prepare_thread(struct svc_serv *serv,
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -180,14 +180,16 @@ void rpcb_put_local(struct net *net)
struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
struct rpc_clnt *clnt = sn->rpcb_local_clnt;
struct rpc_clnt *clnt4 = sn->rpcb_local_clnt4;
- int shutdown;
+ int shutdown = 0;
spin_lock(&sn->rpcb_clnt_lock);
- if (--sn->rpcb_users == 0) {
- sn->rpcb_local_clnt = NULL;
- sn->rpcb_local_clnt4 = NULL;
+ if (sn->rpcb_users) {
+ if (--sn->rpcb_users == 0) {
+ sn->rpcb_local_clnt = NULL;
+ sn->rpcb_local_clnt4 = NULL;
+ }
+ shutdown = !sn->rpcb_users;
}
- shutdown = !sn->rpcb_users;
spin_unlock(&sn->rpcb_clnt_lock);
if (shutdown) {
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -407,6 +407,14 @@ static int svc_uses_rpcbind(struct svc_s
return 0;
}
+int svc_bind(struct svc_serv *serv, struct net *net)
+{
+ if (!svc_uses_rpcbind(serv))
+ return 0;
+ return svc_rpcb_setup(serv, net);
+}
+EXPORT_SYMBOL_GPL(svc_bind);
+
/*
* Create an RPC service
*/
@@ -471,15 +479,8 @@ __svc_create(struct svc_program *prog, u
spin_lock_init(&pool->sp_lock);
}
- if (svc_uses_rpcbind(serv)) {
- if (svc_rpcb_setup(serv, current->nsproxy->net_ns) < 0) {
- kfree(serv->sv_pools);
- kfree(serv);
- return NULL;
- }
- if (!serv->sv_shutdown)
- serv->sv_shutdown = svc_rpcb_cleanup;
- }
+ if (svc_uses_rpcbind(serv) && (!serv->sv_shutdown))
+ serv->sv_shutdown = svc_rpcb_cleanup;
return serv;
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 159/187] SUNRPC: move per-net operations from svc_destroy()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (151 preceding siblings ...)
2012-07-12 22:35 ` [ 158/187] SUNRPC: new svc_bind() routine introduced Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 160/187] NFS: hard-code init_net for NFS callback transports Greg Kroah-Hartman
` (27 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Stanislav Kinsbursky, J. Bruce Fields
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Kinsbursky <skinsbursky@parallels.com>
upstream commit 786185b5f8abefa6a8a16695bb4a59c164d5a071.
The idea is to separate service destruction and per-net operations,
because these are two different things and the mix looks ugly.
Notes:
1) For NFS server this patch looks ugly (sorry for that). But these
place will be rewritten soon during NFSd containerization.
2) LockD per-net counter increase int lockd_up() was moved prior to
make_socks() to make lockd_down_net() call safe in case of error.
Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/svc.c | 27 +++++++++++++++------------
fs/nfs/callback.c | 3 +++
fs/nfsd/nfsctl.c | 12 +++++++++---
fs/nfsd/nfssvc.c | 14 ++++++++++++++
net/sunrpc/svc.c | 4 ----
5 files changed, 41 insertions(+), 19 deletions(-)
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -257,7 +257,7 @@ static int lockd_up_net(struct net *net)
struct svc_serv *serv = nlmsvc_rqst->rq_server;
int error;
- if (ln->nlmsvc_users)
+ if (ln->nlmsvc_users++)
return 0;
error = svc_rpcb_setup(serv, net);
@@ -272,6 +272,7 @@ static int lockd_up_net(struct net *net)
err_socks:
svc_rpcb_cleanup(serv, net);
err_rpcb:
+ ln->nlmsvc_users--;
return error;
}
@@ -299,6 +300,7 @@ int lockd_up(struct net *net)
{
struct svc_serv *serv;
int error = 0;
+ struct lockd_net *ln = net_generic(net, lockd_net_id);
mutex_lock(&nlmsvc_mutex);
/*
@@ -330,9 +332,11 @@ int lockd_up(struct net *net)
goto destroy_and_out;
}
+ ln->nlmsvc_users++;
+
error = make_socks(serv, net);
if (error < 0)
- goto destroy_and_out;
+ goto err_start;
/*
* Create the kernel thread and wait for it to start.
@@ -344,7 +348,7 @@ int lockd_up(struct net *net)
printk(KERN_WARNING
"lockd_up: svc_rqst allocation failed, error=%d\n",
error);
- goto destroy_and_out;
+ goto err_start;
}
svc_sock_update_bufs(serv);
@@ -358,7 +362,7 @@ int lockd_up(struct net *net)
nlmsvc_rqst = NULL;
printk(KERN_WARNING
"lockd_up: kthread_run failed, error=%d\n", error);
- goto destroy_and_out;
+ goto err_start;
}
/*
@@ -368,14 +372,14 @@ int lockd_up(struct net *net)
destroy_and_out:
svc_destroy(serv);
out:
- if (!error) {
- struct lockd_net *ln = net_generic(net, lockd_net_id);
-
- ln->nlmsvc_users++;
+ if (!error)
nlmsvc_users++;
- }
mutex_unlock(&nlmsvc_mutex);
return error;
+
+err_start:
+ lockd_down_net(net);
+ goto destroy_and_out;
}
EXPORT_SYMBOL_GPL(lockd_up);
@@ -386,11 +390,10 @@ void
lockd_down(struct net *net)
{
mutex_lock(&nlmsvc_mutex);
+ lockd_down_net(net);
if (nlmsvc_users) {
- if (--nlmsvc_users) {
- lockd_down_net(net);
+ if (--nlmsvc_users)
goto out;
- }
} else {
printk(KERN_ERR "lockd_down: no users! task=%p\n",
nlmsvc_task);
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -314,6 +314,8 @@ out_err:
dprintk("NFS: Couldn't create callback socket or server thread; "
"err = %d\n", ret);
cb_info->users--;
+ if (serv)
+ svc_shutdown_net(serv, net);
goto out;
}
@@ -328,6 +330,7 @@ void nfs_callback_down(int minorversion)
cb_info->users--;
if (cb_info->users == 0 && cb_info->task != NULL) {
kthread_stop(cb_info->task);
+ svc_shutdown_net(cb_info->serv, current->nsproxy->net_ns);
svc_exit_thread(cb_info->rqst);
cb_info->serv = NULL;
cb_info->rqst = NULL;
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -651,6 +651,7 @@ static ssize_t __write_ports_addfd(char
{
char *mesg = buf;
int fd, err;
+ struct net *net = &init_net;
err = get_int(&mesg, &fd);
if (err != 0 || fd < 0)
@@ -662,6 +663,8 @@ static ssize_t __write_ports_addfd(char
err = svc_addsock(nfsd_serv, fd, buf, SIMPLE_TRANSACTION_LIMIT);
if (err < 0) {
+ if (nfsd_serv->sv_nrthreads == 1)
+ svc_shutdown_net(nfsd_serv, net);
svc_destroy(nfsd_serv);
return err;
}
@@ -699,6 +702,7 @@ static ssize_t __write_ports_addxprt(cha
char transport[16];
struct svc_xprt *xprt;
int port, err;
+ struct net *net = &init_net;
if (sscanf(buf, "%15s %4u", transport, &port) != 2)
return -EINVAL;
@@ -710,12 +714,12 @@ static ssize_t __write_ports_addxprt(cha
if (err != 0)
return err;
- err = svc_create_xprt(nfsd_serv, transport, &init_net,
+ err = svc_create_xprt(nfsd_serv, transport, net,
PF_INET, port, SVC_SOCK_ANONYMOUS);
if (err < 0)
goto out_err;
- err = svc_create_xprt(nfsd_serv, transport, &init_net,
+ err = svc_create_xprt(nfsd_serv, transport, net,
PF_INET6, port, SVC_SOCK_ANONYMOUS);
if (err < 0 && err != -EAFNOSUPPORT)
goto out_close;
@@ -724,12 +728,14 @@ static ssize_t __write_ports_addxprt(cha
nfsd_serv->sv_nrthreads--;
return 0;
out_close:
- xprt = svc_find_xprt(nfsd_serv, transport, &init_net, PF_INET, port);
+ xprt = svc_find_xprt(nfsd_serv, transport, net, PF_INET, port);
if (xprt != NULL) {
svc_close_xprt(xprt);
svc_xprt_put(xprt);
}
out_err:
+ if (nfsd_serv->sv_nrthreads == 1)
+ svc_shutdown_net(nfsd_serv, net);
svc_destroy(nfsd_serv);
return err;
}
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -382,6 +382,7 @@ int nfsd_set_nrthreads(int n, int *nthre
int i = 0;
int tot = 0;
int err = 0;
+ struct net *net = &init_net;
WARN_ON(!mutex_is_locked(&nfsd_mutex));
@@ -426,6 +427,9 @@ int nfsd_set_nrthreads(int n, int *nthre
if (err)
break;
}
+
+ if (nfsd_serv->sv_nrthreads == 1)
+ svc_shutdown_net(nfsd_serv, net);
svc_destroy(nfsd_serv);
return err;
@@ -441,6 +445,7 @@ nfsd_svc(unsigned short port, int nrserv
{
int error;
bool nfsd_up_before;
+ struct net *net = &init_net;
mutex_lock(&nfsd_mutex);
dprintk("nfsd: creating service\n");
@@ -473,6 +478,8 @@ out_shutdown:
if (error < 0 && !nfsd_up_before)
nfsd_shutdown();
out_destroy:
+ if (nfsd_serv->sv_nrthreads == 1)
+ svc_shutdown_net(nfsd_serv, net);
svc_destroy(nfsd_serv); /* Release server */
out:
mutex_unlock(&nfsd_mutex);
@@ -556,6 +563,9 @@ nfsd(void *vrqstp)
nfsdstats.th_cnt --;
out:
+ if (rqstp->rq_server->sv_nrthreads == 1)
+ svc_shutdown_net(rqstp->rq_server, &init_net);
+
/* Release the thread */
svc_exit_thread(rqstp);
@@ -668,8 +678,12 @@ int nfsd_pool_stats_open(struct inode *i
int nfsd_pool_stats_release(struct inode *inode, struct file *file)
{
int ret = seq_release(inode, file);
+ struct net *net = &init_net;
+
mutex_lock(&nfsd_mutex);
/* this function really, really should have been called svc_put() */
+ if (nfsd_serv->sv_nrthreads == 1)
+ svc_shutdown_net(nfsd_serv, net);
svc_destroy(nfsd_serv);
mutex_unlock(&nfsd_mutex);
return ret;
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -537,8 +537,6 @@ EXPORT_SYMBOL_GPL(svc_shutdown_net);
void
svc_destroy(struct svc_serv *serv)
{
- struct net *net = current->nsproxy->net_ns;
-
dprintk("svc: svc_destroy(%s, %d)\n",
serv->sv_program->pg_name,
serv->sv_nrthreads);
@@ -553,8 +551,6 @@ svc_destroy(struct svc_serv *serv)
del_timer_sync(&serv->sv_temptimer);
- svc_shutdown_net(serv, net);
-
/*
* The last user is gone and thus all sockets have to be destroyed to
* the point. Check this.
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 160/187] NFS: hard-code init_net for NFS callback transports
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (152 preceding siblings ...)
2012-07-12 22:35 ` [ 159/187] SUNRPC: move per-net operations from svc_destroy() Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 161/187] mac80211: fix queues stuck issue with HT bandwidth change Greg Kroah-Hartman
` (26 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Stanislav Kinsbursky, J. Bruce Fields
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Kinsbursky <skinsbursky@parallels.com>
upstream commit 12918b10d59e975fd5241eef03ef9e6d5ea3dcfe.
In case of destroying mount namespace on child reaper exit, nsproxy is zeroed
to the point already. So, dereferencing of it is invalid.
This patch hard-code "init_net" for all network namespace references for NFS
callback services. This will be fixed with proper NFS callback
containerization.
Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/callback.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -17,7 +17,6 @@
#include <linux/kthread.h>
#include <linux/sunrpc/svcauth_gss.h>
#include <linux/sunrpc/bc_xprt.h>
-#include <linux/nsproxy.h>
#include <net/inet_sock.h>
@@ -107,7 +106,7 @@ nfs4_callback_up(struct svc_serv *serv,
{
int ret;
- ret = svc_create_xprt(serv, "tcp", xprt->xprt_net, PF_INET,
+ ret = svc_create_xprt(serv, "tcp", &init_net, PF_INET,
nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS);
if (ret <= 0)
goto out_err;
@@ -115,7 +114,7 @@ nfs4_callback_up(struct svc_serv *serv,
dprintk("NFS: Callback listener port = %u (af %u)\n",
nfs_callback_tcpport, PF_INET);
- ret = svc_create_xprt(serv, "tcp", xprt->xprt_net, PF_INET6,
+ ret = svc_create_xprt(serv, "tcp", &init_net, PF_INET6,
nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS);
if (ret > 0) {
nfs_callback_tcpport6 = ret;
@@ -184,7 +183,7 @@ nfs41_callback_up(struct svc_serv *serv,
* fore channel connection.
* Returns the input port (0) and sets the svc_serv bc_xprt on success
*/
- ret = svc_create_xprt(serv, "tcp-bc", xprt->xprt_net, PF_INET, 0,
+ ret = svc_create_xprt(serv, "tcp-bc", &init_net, PF_INET, 0,
SVC_SOCK_ANONYMOUS);
if (ret < 0) {
rqstp = ERR_PTR(ret);
@@ -254,7 +253,7 @@ int nfs_callback_up(u32 minorversion, st
char svc_name[12];
int ret = 0;
int minorversion_setup;
- struct net *net = current->nsproxy->net_ns;
+ struct net *net = &init_net;
mutex_lock(&nfs_callback_mutex);
if (cb_info->users++ || cb_info->task != NULL) {
@@ -330,7 +329,7 @@ void nfs_callback_down(int minorversion)
cb_info->users--;
if (cb_info->users == 0 && cb_info->task != NULL) {
kthread_stop(cb_info->task);
- svc_shutdown_net(cb_info->serv, current->nsproxy->net_ns);
+ svc_shutdown_net(cb_info->serv, &init_net);
svc_exit_thread(cb_info->rqst);
cb_info->serv = NULL;
cb_info->rqst = NULL;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 161/187] mac80211: fix queues stuck issue with HT bandwidth change
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (153 preceding siblings ...)
2012-07-12 22:35 ` [ 160/187] NFS: hard-code init_net for NFS callback transports Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 162/187] iwlwifi: remove log_event debugfs file debugging is disabled Greg Kroah-Hartman
` (25 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Florian Manschwetus, Johannes Berg
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
No upstream commit, the buggy code was removed in 3.5 in commit
7213cf2cb0dfbb4d6b55a1da000d34338f76c0e3 and others.
Rajkumar changed code for handling channel switching in
mac80211 to stop the queues in
commit 7cc44ed48d0ec0937c1f098642540b6c9ca38de5
Author: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Date: Fri Sep 16 15:32:34 2011 +0530
mac80211: Fix regression on queue stop during 2040 bss change
which went into 3.2. In the 3.4 cycle, Paul's change
commit 3117bbdb7899d43927c8ce4fe885ab7c1231c121
Author: Paul Stewart <pstew@chromium.org>
Date: Tue Mar 13 07:46:18 2012 -0700
mac80211: Don't let regulatory make us deaf
went in and changed the TX/RX enable logic, but now
the conditions for stopping and restarting the queues
were different so that now, if the AP changes between
20/40 MHz bandwidth, it can happen that we stop but
never restart the queues. This breaks the connection
and the module actually has to be reloaded to get it
back to work.
Fix this by making sure the queues are always started
when they were stopped.
Reported-by: Florian Manschwetus <manschwetus@googlemail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/mlme.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -187,7 +187,7 @@ static u32 ieee80211_enable_ht(struct ie
u32 changed = 0;
int hti_cfreq;
u16 ht_opmode;
- bool enable_ht = true;
+ bool enable_ht = true, queues_stopped = false;
enum nl80211_channel_type prev_chantype;
enum nl80211_channel_type rx_channel_type = NL80211_CHAN_NO_HT;
enum nl80211_channel_type tx_channel_type;
@@ -254,6 +254,7 @@ static u32 ieee80211_enable_ht(struct ie
*/
ieee80211_stop_queues_by_reason(&sdata->local->hw,
IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE);
+ queues_stopped = true;
/* flush out all packets */
synchronize_net();
@@ -272,12 +273,12 @@ static u32 ieee80211_enable_ht(struct ie
IEEE80211_RC_HT_CHANGED,
tx_channel_type);
rcu_read_unlock();
-
- if (beacon_htcap_ie)
- ieee80211_wake_queues_by_reason(&sdata->local->hw,
- IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE);
}
+ if (queues_stopped)
+ ieee80211_wake_queues_by_reason(&sdata->local->hw,
+ IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE);
+
ht_opmode = le16_to_cpu(hti->operation_mode);
/* if bss configuration changed store the new one */
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 162/187] iwlwifi: remove log_event debugfs file debugging is disabled
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (154 preceding siblings ...)
2012-07-12 22:35 ` [ 161/187] mac80211: fix queues stuck issue with HT bandwidth change Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 163/187] tracing: change CPU ring buffer state from tracing_cpumask Greg Kroah-Hartman
` (24 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Lekensteyn, Emmanuel Grumbach,
Johannes Berg, John W. Linville, Ben Hutchings
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit 882b7b7d11d65e8eccce738f1ce97cdfdb998f9f upstream.
When debugging is disabled, the event log functions aren't
functional in the way that the debugfs file expects. This
leads to the debugfs access crashing. Since the event log
functions aren't functional then, remove the debugfs file
when CONFIG_IWLWIFI_DEBUG is not set.
Reported-by: Lekensteyn <lekensteyn@gmail.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/iwl-trans-pcie.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
@@ -2000,6 +2000,7 @@ static ssize_t iwl_dbgfs_rx_queue_read(s
return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
}
+#ifdef CONFIG_IWLWIFI_DEBUG
static ssize_t iwl_dbgfs_log_event_read(struct file *file,
char __user *user_buf,
size_t count, loff_t *ppos)
@@ -2037,6 +2038,7 @@ static ssize_t iwl_dbgfs_log_event_write
return count;
}
+#endif
static ssize_t iwl_dbgfs_interrupt_read(struct file *file,
char __user *user_buf,
@@ -2164,7 +2166,9 @@ static ssize_t iwl_dbgfs_fh_reg_read(str
return ret;
}
+#ifdef CONFIG_IWLWIFI_DEBUG
DEBUGFS_READ_WRITE_FILE_OPS(log_event);
+#endif
DEBUGFS_READ_WRITE_FILE_OPS(interrupt);
DEBUGFS_READ_FILE_OPS(fh_reg);
DEBUGFS_READ_FILE_OPS(rx_queue);
@@ -2180,7 +2184,9 @@ static int iwl_trans_pcie_dbgfs_register
{
DEBUGFS_ADD_FILE(rx_queue, dir, S_IRUSR);
DEBUGFS_ADD_FILE(tx_queue, dir, S_IRUSR);
+#ifdef CONFIG_IWLWIFI_DEBUG
DEBUGFS_ADD_FILE(log_event, dir, S_IWUSR | S_IRUSR);
+#endif
DEBUGFS_ADD_FILE(interrupt, dir, S_IWUSR | S_IRUSR);
DEBUGFS_ADD_FILE(csr, dir, S_IWUSR);
DEBUGFS_ADD_FILE(fh_reg, dir, S_IRUSR);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 163/187] tracing: change CPU ring buffer state from tracing_cpumask
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (155 preceding siblings ...)
2012-07-12 22:35 ` [ 162/187] iwlwifi: remove log_event debugfs file debugging is disabled Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 164/187] mwifiex: fix wrong return values in add_virtual_intf() error cases Greg Kroah-Hartman
` (23 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Frederic Weisbecker, Ingo Molnar,
Laurent Chavey, Justin Teravest, David Sharp, Vaibhav Nagarnaik,
Steven Rostedt
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vaibhav Nagarnaik <vnagarnaik@google.com>
commit 71babb2705e2203a64c27ede13ae3508a0d2c16c upstream.
According to Documentation/trace/ftrace.txt:
tracing_cpumask:
This is a mask that lets the user only trace
on specified CPUS. The format is a hex string
representing the CPUS.
The tracing_cpumask currently doesn't affect the tracing state of
per-CPU ring buffers.
This patch enables/disables CPU recording as its corresponding bit in
tracing_cpumask is set/unset.
Link: http://lkml.kernel.org/r/1336096792-25373-3-git-send-email-vnagarnaik@google.com
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 164/187] mwifiex: fix wrong return values in add_virtual_intf() error cases
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (156 preceding siblings ...)
2012-07-12 22:35 ` [ 163/187] tracing: change CPU ring buffer state from tracing_cpumask Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 165/187] gspca-core: Fix buffers staying in queued state after a stream_off Greg Kroah-Hartman
` (22 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Johannes Berg, Bing Zhao,
John W. Linville
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bing Zhao <bzhao@marvell.com>
commit 858faa57dd9e2b91f3f870fbb1185982e42f5a2b upstream
add_virtual_intf() needs to return an ERR_PTR(), instead of NULL,
on errors, otherwise cfg80211 will crash.
Reported-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mwifiex/cfg80211.c | 21 +++++++++------------
1 file changed, 9 insertions(+), 12 deletions(-)
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1214,11 +1214,11 @@ struct net_device *mwifiex_add_virtual_i
void *mdev_priv;
if (!priv)
- return NULL;
+ return ERR_PTR(-EFAULT);
adapter = priv->adapter;
if (!adapter)
- return NULL;
+ return ERR_PTR(-EFAULT);
switch (type) {
case NL80211_IFTYPE_UNSPECIFIED:
@@ -1227,7 +1227,7 @@ struct net_device *mwifiex_add_virtual_i
if (priv->bss_mode) {
wiphy_err(wiphy, "cannot create multiple"
" station/adhoc interfaces\n");
- return NULL;
+ return ERR_PTR(-EINVAL);
}
if (type == NL80211_IFTYPE_UNSPECIFIED)
@@ -1244,14 +1244,15 @@ struct net_device *mwifiex_add_virtual_i
break;
default:
wiphy_err(wiphy, "type not supported\n");
- return NULL;
+ return ERR_PTR(-EINVAL);
}
dev = alloc_netdev_mq(sizeof(struct mwifiex_private *), name,
ether_setup, 1);
if (!dev) {
wiphy_err(wiphy, "no memory available for netdevice\n");
- goto error;
+ priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
+ return ERR_PTR(-ENOMEM);
}
dev_net_set(dev, wiphy_net(wiphy));
@@ -1276,7 +1277,9 @@ struct net_device *mwifiex_add_virtual_i
/* Register network device */
if (register_netdevice(dev)) {
wiphy_err(wiphy, "cannot register virtual network device\n");
- goto error;
+ free_netdev(dev);
+ priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
+ return ERR_PTR(-EFAULT);
}
sema_init(&priv->async_sem, 1);
@@ -1288,12 +1291,6 @@ struct net_device *mwifiex_add_virtual_i
mwifiex_dev_debugfs_init(priv);
#endif
return dev;
-error:
- if (dev && (dev->reg_state == NETREG_UNREGISTERED))
- free_netdev(dev);
- priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
-
- return NULL;
}
EXPORT_SYMBOL_GPL(mwifiex_add_virtual_intf);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 165/187] gspca-core: Fix buffers staying in queued state after a stream_off
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (157 preceding siblings ...)
2012-07-12 22:35 ` [ 164/187] mwifiex: fix wrong return values in add_virtual_intf() error cases Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 166/187] raid5: delayed stripe fix Greg Kroah-Hartman
` (21 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Antonio Ospite, Hans de Goede,
Mauro Carvalho Chehab
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit af05ef01e9cde84620c6855a8d8ab9c8a1db9009 upstream.
[Backport to linux-stable by Antonio Ospite <ospite@studenti.unina.it>]
This fixes a regression introduced by commit f7059ea and should be
backported to all supported stable kernels which have this commit.
Signed-off-by: Antonio Ospite <ospite@studenti.unina.it>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Tested-by: Antonio Ospite <ospite@studenti.unina.it>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/video/gspca/gspca.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -1723,7 +1723,7 @@ static int vidioc_streamoff(struct file
enum v4l2_buf_type buf_type)
{
struct gspca_dev *gspca_dev = priv;
- int ret;
+ int i, ret;
if (buf_type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
return -EINVAL;
@@ -1754,6 +1754,8 @@ static int vidioc_streamoff(struct file
wake_up_interruptible(&gspca_dev->wq);
/* empty the transfer queues */
+ for (i = 0; i < gspca_dev->nframes; i++)
+ gspca_dev->frame[i].v4l2_buf.flags &= ~BUF_ALL_FLAGS;
atomic_set(&gspca_dev->fr_q, 0);
atomic_set(&gspca_dev->fr_i, 0);
gspca_dev->fr_o = 0;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 166/187] raid5: delayed stripe fix
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (158 preceding siblings ...)
2012-07-12 22:35 ` [ 165/187] gspca-core: Fix buffers staying in queued state after a stream_off Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 167/187] tg3: Apply short DMA frag workaround to 5906 Greg Kroah-Hartman
` (20 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg KH, torvalds, akpm, alan, Shaohua Li, NeilBrown
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaohua Li <shli@kernel.org>
commit fab363b5ff502d1b39ddcfec04271f5858d9f26e upstream.
There isn't locking setting STRIPE_DELAYED and STRIPE_PREREAD_ACTIVE bits, but
the two bits have relationship. A delayed stripe can be moved to hold list only
when preread active stripe count is below IO_THRESHOLD. If a stripe has both
the bits set, such stripe will be in delayed list and preread count not 0,
which will make such stripe never leave delayed list.
Signed-off-by: Shaohua Li <shli@fusionio.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid5.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -196,12 +196,14 @@ static void __release_stripe(struct r5co
BUG_ON(!list_empty(&sh->lru));
BUG_ON(atomic_read(&conf->active_stripes)==0);
if (test_bit(STRIPE_HANDLE, &sh->state)) {
- if (test_bit(STRIPE_DELAYED, &sh->state))
+ if (test_bit(STRIPE_DELAYED, &sh->state) &&
+ !test_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
list_add_tail(&sh->lru, &conf->delayed_list);
else if (test_bit(STRIPE_BIT_DELAY, &sh->state) &&
sh->bm_seq - conf->seq_write > 0)
list_add_tail(&sh->lru, &conf->bitmap_list);
else {
+ clear_bit(STRIPE_DELAYED, &sh->state);
clear_bit(STRIPE_BIT_DELAY, &sh->state);
list_add_tail(&sh->lru, &conf->handle_list);
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 167/187] tg3: Apply short DMA frag workaround to 5906
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (159 preceding siblings ...)
2012-07-12 22:35 ` [ 166/187] raid5: delayed stripe fix Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 168/187] ath9k: fix panic caused by returning a descriptor we have queued for reuse Greg Kroah-Hartman
` (19 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Matt Carlson, Christian Kujau,
David S. Miller, Josh Boyer
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Carlson <mcarlson@broadcom.com>
commit b7abee6ef888117f92db370620ebf116a38e3f4d upstream.
5906 devices also need the short DMA fragment workaround. This patch
makes the necessary change.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Tested-by: Christian Kujau <lists@nerdbynature.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/tg3.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -14248,7 +14248,8 @@ static int __devinit tg3_get_invariants(
}
}
- if (tg3_flag(tp, 5755_PLUS))
+ if (tg3_flag(tp, 5755_PLUS) ||
+ GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906)
tg3_flag_set(tp, SHORT_DMA_BUG);
if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719)
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 168/187] ath9k: fix panic caused by returning a descriptor we have queued for reuse
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (160 preceding siblings ...)
2012-07-12 22:35 ` [ 167/187] tg3: Apply short DMA frag workaround to 5906 Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 169/187] mm: pmd_read_atomic: fix 32bit PAE pmd walk vs pmd_populate SMP race condition Greg Kroah-Hartman
` (18 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Tom Hughes, John W. Linville, Josh Boyer
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Hughes <tom@compton.nu>
commit 6bb51c70cabaadddc54a6454844eceba91a56083 upstream.
Commit 3a2923e83c introduced a bug when a corrupt descriptor
is encountered - although the following descriptor is discarded
and returned to the queue for reuse the associated frame is
also returned for processing. This leads to a panic:
BUG: unable to handle kernel NULL pointer dereference at 000000000000003a
IP: [<ffffffffa02599a5>] ath_rx_tasklet+0x165/0x1b00 [ath9k]
Call Trace:
<IRQ>
[<ffffffff812d7fa0>] ? map_single+0x60/0x60
[<ffffffffa028f044>] ? ath9k_ioread32+0x34/0x90 [ath9k]
[<ffffffffa0292eec>] athk9k_tasklet+0xdc/0x160 [ath9k]
[<ffffffff8105e133>] tasklet_action+0x63/0xd0
[<ffffffff8105dbc0>] __do_softirq+0xc0/0x1e0
[<ffffffff8101a873>] ? native_sched_clock+0x13/0x80
[<ffffffff815f9d5c>] call_softirq+0x1c/0x30
[<ffffffff810151f5>] do_softirq+0x75/0xb0
[<ffffffff8105df95>] irq_exit+0xb5/0xc0
[<ffffffff815fa5b3>] do_IRQ+0x63/0xe0
[<ffffffff815f0cea>] common_interrupt+0x6a/0x6a
<EOI>
[<ffffffff8131840a>] ? intel_idle+0xea/0x150
[<ffffffff813183eb>] ? intel_idle+0xcb/0x150
[<ffffffff814a1db9>] cpuidle_enter+0x19/0x20
[<ffffffff814a23d9>] cpuidle_idle_call+0xa9/0x240
[<ffffffff8101c4bf>] cpu_idle+0xaf/0x120
[<ffffffff815cda8e>] rest_init+0x72/0x74
[<ffffffff81cf4c1a>] start_kernel+0x3b7/0x3c4
[<ffffffff81cf4662>] ? repair_env_string+0x5e/0x5e
[<ffffffff81cf4346>] x86_64_start_reservations+0x131/0x135
[<ffffffff81cf444a>] x86_64_start_kernel+0x100/0x10f
Making sure bf is cleared to NULL in this case restores the
old behaviour.
Signed-off-by: Tom Hughes <tom@compton.nu>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Cc: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/recv.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -695,9 +695,9 @@ static bool ath_edma_get_buffers(struct
__skb_unlink(skb, &rx_edma->rx_fifo);
list_add_tail(&bf->list, &sc->rx.rxbuf);
ath_rx_edma_buf_link(sc, qtype);
- } else {
- bf = NULL;
}
+
+ bf = NULL;
}
*dest = bf;
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 169/187] mm: pmd_read_atomic: fix 32bit PAE pmd walk vs pmd_populate SMP race condition
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (161 preceding siblings ...)
2012-07-12 22:35 ` [ 168/187] ath9k: fix panic caused by returning a descriptor we have queued for reuse Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 170/187] thp: avoid atomic64_read in pmd_read_atomic for 32bit PAE Greg Kroah-Hartman
` (17 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Ulrich Obergfell,
Andrea Arcangeli, Mel Gorman, Hugh Dickins, Larry Woodman,
Petr Matousek, Rik van Riel
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Arcangeli <aarcange@redhat.com>
commit 26c191788f18129af0eb32a358cdaea0c7479626 upstream.
When holding the mmap_sem for reading, pmd_offset_map_lock should only
run on a pmd_t that has been read atomically from the pmdp pointer,
otherwise we may read only half of it leading to this crash.
PID: 11679 TASK: f06e8000 CPU: 3 COMMAND: "do_race_2_panic"
#0 [f06a9dd8] crash_kexec at c049b5ec
#1 [f06a9e2c] oops_end at c083d1c2
#2 [f06a9e40] no_context at c0433ded
#3 [f06a9e64] bad_area_nosemaphore at c043401a
#4 [f06a9e6c] __do_page_fault at c0434493
#5 [f06a9eec] do_page_fault at c083eb45
#6 [f06a9f04] error_code (via page_fault) at c083c5d5
EAX: 01fb470c EBX: fff35000 ECX: 00000003 EDX: 00000100 EBP:
00000000
DS: 007b ESI: 9e201000 ES: 007b EDI: 01fb4700 GS: 00e0
CS: 0060 EIP: c083bc14 ERR: ffffffff EFLAGS: 00010246
#7 [f06a9f38] _spin_lock at c083bc14
#8 [f06a9f44] sys_mincore at c0507b7d
#9 [f06a9fb0] system_call at c083becd
start len
EAX: ffffffda EBX: 9e200000 ECX: 00001000 EDX: 6228537f
DS: 007b ESI: 00000000 ES: 007b EDI: 003d0f00
SS: 007b ESP: 62285354 EBP: 62285388 GS: 0033
CS: 0073 EIP: 00291416 ERR: 000000da EFLAGS: 00000286
This should be a longstanding bug affecting x86 32bit PAE without THP.
Only archs with 64bit large pmd_t and 32bit unsigned long should be
affected.
With THP enabled the barrier() in pmd_none_or_trans_huge_or_clear_bad()
would partly hide the bug when the pmd transition from none to stable,
by forcing a re-read of the *pmd in pmd_offset_map_lock, but when THP is
enabled a new set of problem arises by the fact could then transition
freely in any of the none, pmd_trans_huge or pmd_trans_stable states.
So making the barrier in pmd_none_or_trans_huge_or_clear_bad()
unconditional isn't good idea and it would be a flakey solution.
This should be fully fixed by introducing a pmd_read_atomic that reads
the pmd in order with THP disabled, or by reading the pmd atomically
with cmpxchg8b with THP enabled.
Luckily this new race condition only triggers in the places that must
already be covered by pmd_none_or_trans_huge_or_clear_bad() so the fix
is localized there but this bug is not related to THP.
NOTE: this can trigger on x86 32bit systems with PAE enabled with more
than 4G of ram, otherwise the high part of the pmd will never risk to be
truncated because it would be zero at all times, in turn so hiding the
SMP race.
This bug was discovered and fully debugged by Ulrich, quote:
----
[..]
pmd_none_or_trans_huge_or_clear_bad() loads the content of edx and
eax.
496 static inline int pmd_none_or_trans_huge_or_clear_bad(pmd_t
*pmd)
497 {
498 /* depend on compiler for an atomic pmd read */
499 pmd_t pmdval = *pmd;
// edi = pmd pointer
0xc0507a74 <sys_mincore+548>: mov 0x8(%esp),%edi
...
// edx = PTE page table high address
0xc0507a84 <sys_mincore+564>: mov 0x4(%edi),%edx
...
// eax = PTE page table low address
0xc0507a8e <sys_mincore+574>: mov (%edi),%eax
[..]
Please note that the PMD is not read atomically. These are two "mov"
instructions where the high order bits of the PMD entry are fetched
first. Hence, the above machine code is prone to the following race.
- The PMD entry {high|low} is 0x0000000000000000.
The "mov" at 0xc0507a84 loads 0x00000000 into edx.
- A page fault (on another CPU) sneaks in between the two "mov"
instructions and instantiates the PMD.
- The PMD entry {high|low} is now 0x00000003fda38067.
The "mov" at 0xc0507a8e loads 0xfda38067 into eax.
----
Reported-by: Ulrich Obergfell <uobergfe@redhat.com>
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Hugh Dickins <hughd@google.com>
Cc: Larry Woodman <lwoodman@redhat.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Cc: Rik van Riel <riel@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/pgtable-3level.h | 50 ++++++++++++++++++++++++++++++++++
include/asm-generic/pgtable.h | 22 +++++++++++++-
2 files changed, 70 insertions(+), 2 deletions(-)
--- a/arch/x86/include/asm/pgtable-3level.h
+++ b/arch/x86/include/asm/pgtable-3level.h
@@ -31,6 +31,56 @@ static inline void native_set_pte(pte_t
ptep->pte_low = pte.pte_low;
}
+#define pmd_read_atomic pmd_read_atomic
+/*
+ * pte_offset_map_lock on 32bit PAE kernels was reading the pmd_t with
+ * a "*pmdp" dereference done by gcc. Problem is, in certain places
+ * where pte_offset_map_lock is called, concurrent page faults are
+ * allowed, if the mmap_sem is hold for reading. An example is mincore
+ * vs page faults vs MADV_DONTNEED. On the page fault side
+ * pmd_populate rightfully does a set_64bit, but if we're reading the
+ * pmd_t with a "*pmdp" on the mincore side, a SMP race can happen
+ * because gcc will not read the 64bit of the pmd atomically. To fix
+ * this all places running pmd_offset_map_lock() while holding the
+ * mmap_sem in read mode, shall read the pmdp pointer using this
+ * function to know if the pmd is null nor not, and in turn to know if
+ * they can run pmd_offset_map_lock or pmd_trans_huge or other pmd
+ * operations.
+ *
+ * Without THP if the mmap_sem is hold for reading, the
+ * pmd can only transition from null to not null while pmd_read_atomic runs.
+ * So there's no need of literally reading it atomically.
+ *
+ * With THP if the mmap_sem is hold for reading, the pmd can become
+ * THP or null or point to a pte (and in turn become "stable") at any
+ * time under pmd_read_atomic, so it's mandatory to read it atomically
+ * with cmpxchg8b.
+ */
+#ifndef CONFIG_TRANSPARENT_HUGEPAGE
+static inline pmd_t pmd_read_atomic(pmd_t *pmdp)
+{
+ pmdval_t ret;
+ u32 *tmp = (u32 *)pmdp;
+
+ ret = (pmdval_t) (*tmp);
+ if (ret) {
+ /*
+ * If the low part is null, we must not read the high part
+ * or we can end up with a partial pmd.
+ */
+ smp_rmb();
+ ret |= ((pmdval_t)*(tmp + 1)) << 32;
+ }
+
+ return (pmd_t) { ret };
+}
+#else /* CONFIG_TRANSPARENT_HUGEPAGE */
+static inline pmd_t pmd_read_atomic(pmd_t *pmdp)
+{
+ return (pmd_t) { atomic64_read((atomic64_t *)pmdp) };
+}
+#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+
static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
{
set_64bit((unsigned long long *)(ptep), native_pte_val(pte));
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -446,6 +446,18 @@ static inline int pmd_write(pmd_t pmd)
#endif /* __HAVE_ARCH_PMD_WRITE */
#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+#ifndef pmd_read_atomic
+static inline pmd_t pmd_read_atomic(pmd_t *pmdp)
+{
+ /*
+ * Depend on compiler for an atomic pmd read. NOTE: this is
+ * only going to work, if the pmdval_t isn't larger than
+ * an unsigned long.
+ */
+ return *pmdp;
+}
+#endif
+
/*
* This function is meant to be used by sites walking pagetables with
* the mmap_sem hold in read mode to protect against MADV_DONTNEED and
@@ -459,11 +471,17 @@ static inline int pmd_write(pmd_t pmd)
* undefined so behaving like if the pmd was none is safe (because it
* can return none anyway). The compiler level barrier() is critically
* important to compute the two checks atomically on the same pmdval.
+ *
+ * For 32bit kernels with a 64bit large pmd_t this automatically takes
+ * care of reading the pmd atomically to avoid SMP race conditions
+ * against pmd_populate() when the mmap_sem is hold for reading by the
+ * caller (a special atomic read not done by "gcc" as in the generic
+ * version above, is also needed when THP is disabled because the page
+ * fault can populate the pmd from under us).
*/
static inline int pmd_none_or_trans_huge_or_clear_bad(pmd_t *pmd)
{
- /* depend on compiler for an atomic pmd read */
- pmd_t pmdval = *pmd;
+ pmd_t pmdval = pmd_read_atomic(pmd);
/*
* The barrier will stabilize the pmdval in a register or on
* the stack so that it will stop changing under the code.
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 170/187] thp: avoid atomic64_read in pmd_read_atomic for 32bit PAE
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (162 preceding siblings ...)
2012-07-12 22:35 ` [ 169/187] mm: pmd_read_atomic: fix 32bit PAE pmd walk vs pmd_populate SMP race condition Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 171/187] rtl8187: ->brightness_set can not sleep Greg Kroah-Hartman
` (16 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Andrea Arcangeli, Jonathan Nieder,
Ulrich Obergfell, Mel Gorman, Hugh Dickins, Larry Woodman,
Petr Matousek, Rik van Riel, Jan Beulich, KOSAKI Motohiro,
Andrew Jones
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Arcangeli <aarcange@redhat.com>
commit e4eed03fd06578571c01d4f1478c874bb432c815 upstream.
In the x86 32bit PAE CONFIG_TRANSPARENT_HUGEPAGE=y case while holding the
mmap_sem for reading, cmpxchg8b cannot be used to read pmd contents under
Xen.
So instead of dealing only with "consistent" pmdvals in
pmd_none_or_trans_huge_or_clear_bad() (which would be conceptually
simpler) we let pmd_none_or_trans_huge_or_clear_bad() deal with pmdvals
where the low 32bit and high 32bit could be inconsistent (to avoid having
to use cmpxchg8b).
The only guarantee we get from pmd_read_atomic is that if the low part of
the pmd was found null, the high part will be null too (so the pmd will be
considered unstable). And if the low part of the pmd is found "stable"
later, then it means the whole pmd was read atomically (because after a
pmd is stable, neither MADV_DONTNEED nor page faults can alter it anymore,
and we read the high part after the low part).
In the 32bit PAE x86 case, it is enough to read the low part of the pmdval
atomically to declare the pmd as "stable" and that's true for THP and no
THP, furthermore in the THP case we also have a barrier() that will
prevent any inconsistent pmdvals to be cached by a later re-read of the
*pmd.
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Cc: Jonathan Nieder <jrnieder@gmail.com>
Cc: Ulrich Obergfell <uobergfe@redhat.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Hugh Dickins <hughd@google.com>
Cc: Larry Woodman <lwoodman@redhat.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Jan Beulich <jbeulich@suse.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@gmail.com>
Tested-by: Andrew Jones <drjones@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/pgtable-3level.h | 30 +++++++++++++++++-------------
include/asm-generic/pgtable.h | 10 ++++++++++
2 files changed, 27 insertions(+), 13 deletions(-)
--- a/arch/x86/include/asm/pgtable-3level.h
+++ b/arch/x86/include/asm/pgtable-3level.h
@@ -47,16 +47,26 @@ static inline void native_set_pte(pte_t
* they can run pmd_offset_map_lock or pmd_trans_huge or other pmd
* operations.
*
- * Without THP if the mmap_sem is hold for reading, the
- * pmd can only transition from null to not null while pmd_read_atomic runs.
- * So there's no need of literally reading it atomically.
+ * Without THP if the mmap_sem is hold for reading, the pmd can only
+ * transition from null to not null while pmd_read_atomic runs. So
+ * we can always return atomic pmd values with this function.
*
* With THP if the mmap_sem is hold for reading, the pmd can become
- * THP or null or point to a pte (and in turn become "stable") at any
- * time under pmd_read_atomic, so it's mandatory to read it atomically
- * with cmpxchg8b.
+ * trans_huge or none or point to a pte (and in turn become "stable")
+ * at any time under pmd_read_atomic. We could read it really
+ * atomically here with a atomic64_read for the THP enabled case (and
+ * it would be a whole lot simpler), but to avoid using cmpxchg8b we
+ * only return an atomic pmdval if the low part of the pmdval is later
+ * found stable (i.e. pointing to a pte). And we're returning a none
+ * pmdval if the low part of the pmd is none. In some cases the high
+ * and low part of the pmdval returned may not be consistent if THP is
+ * enabled (the low part may point to previously mapped hugepage,
+ * while the high part may point to a more recently mapped hugepage),
+ * but pmd_none_or_trans_huge_or_clear_bad() only needs the low part
+ * of the pmd to be read atomically to decide if the pmd is unstable
+ * or not, with the only exception of when the low part of the pmd is
+ * zero in which case we return a none pmd.
*/
-#ifndef CONFIG_TRANSPARENT_HUGEPAGE
static inline pmd_t pmd_read_atomic(pmd_t *pmdp)
{
pmdval_t ret;
@@ -74,12 +84,6 @@ static inline pmd_t pmd_read_atomic(pmd_
return (pmd_t) { ret };
}
-#else /* CONFIG_TRANSPARENT_HUGEPAGE */
-static inline pmd_t pmd_read_atomic(pmd_t *pmdp)
-{
- return (pmd_t) { atomic64_read((atomic64_t *)pmdp) };
-}
-#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
{
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -485,6 +485,16 @@ static inline int pmd_none_or_trans_huge
/*
* The barrier will stabilize the pmdval in a register or on
* the stack so that it will stop changing under the code.
+ *
+ * When CONFIG_TRANSPARENT_HUGEPAGE=y on x86 32bit PAE,
+ * pmd_read_atomic is allowed to return a not atomic pmdval
+ * (for example pointing to an hugepage that has never been
+ * mapped in the pmd). The below checks will only care about
+ * the low part of the pmd with 32bit PAE x86 anyway, with the
+ * exception of pmd_none(). So the important thing is that if
+ * the low part of the pmd is found null, the high part will
+ * be also null or the pmd_none() check below would be
+ * confused.
*/
#ifdef CONFIG_TRANSPARENT_HUGEPAGE
barrier();
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 171/187] rtl8187: ->brightness_set can not sleep
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (163 preceding siblings ...)
2012-07-12 22:35 ` [ 170/187] thp: avoid atomic64_read in pmd_read_atomic for 32bit PAE Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 172/187] macvtap: zerocopy: validate vectors before building skb Greg Kroah-Hartman
` (15 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Stanislaw Gruszka, Larry Finger,
Hin-Tak Leung, John W. Linville, Josh Boyer
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <sgruszka@redhat.com>
commit 0fde0a8cfd0ede7f310d6a681c8e5a7cb3e32406 upstream.
Fix:
BUG: sleeping function called from invalid context at kernel/workqueue.c:2547
in_atomic(): 1, irqs_disabled(): 0, pid: 629, name: wpa_supplicant
2 locks held by wpa_supplicant/629:
#0: (rtnl_mutex){+.+.+.}, at: [<c08b2b84>] rtnl_lock+0x14/0x20
#1: (&trigger->leddev_list_lock){.+.?..}, at: [<c0867f41>] led_trigger_event+0x21/0x80
Pid: 629, comm: wpa_supplicant Not tainted 3.3.0-0.rc3.git5.1.fc17.i686
Call Trace:
[<c046a9f6>] __might_sleep+0x126/0x1d0
[<c0457d6c>] wait_on_work+0x2c/0x1d0
[<c045a09a>] __cancel_work_timer+0x6a/0x120
[<c045a160>] cancel_delayed_work_sync+0x10/0x20
[<f7dd3c22>] rtl8187_led_brightness_set+0x82/0xf0 [rtl8187]
[<c0867f7c>] led_trigger_event+0x5c/0x80
[<f7ff5e6d>] ieee80211_led_radio+0x1d/0x40 [mac80211]
[<f7ff3583>] ieee80211_stop_device+0x13/0x230 [mac80211]
Removing _sync is ok, because if led_on work is currently running
it will be finished before led_off work start to perform, since
they are always queued on the same mac80211 local->workqueue.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=795176
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Acked-by: Hin-Tak Leung <htl10@users.sourceforge.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Cc: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rtl818x/rtl8187/leds.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/rtl818x/rtl8187/leds.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/leds.c
@@ -117,7 +117,7 @@ static void rtl8187_led_brightness_set(s
radio_on = true;
} else if (radio_on) {
radio_on = false;
- cancel_delayed_work_sync(&priv->led_on);
+ cancel_delayed_work(&priv->led_on);
ieee80211_queue_delayed_work(hw, &priv->led_off, 0);
}
} else if (radio_on) {
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 172/187] macvtap: zerocopy: validate vectors before building skb
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (164 preceding siblings ...)
2012-07-12 22:35 ` [ 171/187] rtl8187: ->brightness_set can not sleep Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 173/187] net/wireless: ipw2x00: add supported cipher suites to wiphy initialization Greg Kroah-Hartman
` (14 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Jason Wang, Michael S. Tsirkin,
Josh Boyer
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <jasowang@redhat.com>
commit b92946e2919134ebe2a4083e4302236295ea2a73 upstream.
There're several reasons that the vectors need to be validated:
- Return error when caller provides vectors whose num is greater than UIO_MAXIOV.
- Linearize part of skb when userspace provides vectors grater than MAX_SKB_FRAGS.
- Return error when userspace provides vectors whose total length may exceed
- MAX_SKB_FRAGS * PAGE_SIZE.
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Cc: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/macvtap.c | 25 +++++++++++++++++++++----
1 file changed, 21 insertions(+), 4 deletions(-)
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -528,9 +528,10 @@ static int zerocopy_sg_from_iovec(struct
}
base = (unsigned long)from->iov_base + offset1;
size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
+ if (i + size > MAX_SKB_FRAGS)
+ return -EMSGSIZE;
num_pages = get_user_pages_fast(base, size, 0, &page[i]);
- if ((num_pages != size) ||
- (num_pages > MAX_SKB_FRAGS - skb_shinfo(skb)->nr_frags))
+ if (num_pages != size)
/* put_page is in skb free */
return -EFAULT;
skb->data_len += len;
@@ -647,7 +648,7 @@ static ssize_t macvtap_get_user(struct m
int err;
struct virtio_net_hdr vnet_hdr = { 0 };
int vnet_hdr_len = 0;
- int copylen;
+ int copylen = 0;
bool zerocopy = false;
if (q->flags & IFF_VNET_HDR) {
@@ -676,15 +677,31 @@ static ssize_t macvtap_get_user(struct m
if (unlikely(len < ETH_HLEN))
goto err;
+ err = -EMSGSIZE;
+ if (unlikely(count > UIO_MAXIOV))
+ goto err;
+
if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY))
zerocopy = true;
if (zerocopy) {
+ /* Userspace may produce vectors with count greater than
+ * MAX_SKB_FRAGS, so we need to linearize parts of the skb
+ * to let the rest of data to be fit in the frags.
+ */
+ if (count > MAX_SKB_FRAGS) {
+ copylen = iov_length(iv, count - MAX_SKB_FRAGS);
+ if (copylen < vnet_hdr_len)
+ copylen = 0;
+ else
+ copylen -= vnet_hdr_len;
+ }
/* There are 256 bytes to be copied in skb, so there is enough
* room for skb expand head in case it is used.
* The rest buffer is mapped from userspace.
*/
- copylen = vnet_hdr.hdr_len;
+ if (copylen < vnet_hdr.hdr_len)
+ copylen = vnet_hdr.hdr_len;
if (!copylen)
copylen = GOODCOPY_LEN;
} else
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 173/187] net/wireless: ipw2x00: add supported cipher suites to wiphy initialization
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (165 preceding siblings ...)
2012-07-12 22:35 ` [ 172/187] macvtap: zerocopy: validate vectors before building skb Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 174/187] splice: fix racy pipe->buffers uses Greg Kroah-Hartman
` (13 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Stanislav Yakovlev,
John W. Linville, Josh Boyer
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Yakovlev <stas.yakovlev@gmail.com>
commit a141e6a0097118bb35024485f1faffc0d9042f5c upstream.
Driver doesn't report its supported cipher suites through cfg80211
interface. It still uses wext interface and probably will not work
through nl80211, but will at least correctly advertise supported
features.
Bug was reported by Omar Siam.
https://bugzilla.kernel.org/show_bug.cgi?id=43049
Signed-off-by: Stanislav Yakovlev <stas.yakovlev@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Cc: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ipw2x00/ipw.h | 23 +++++++++++++++++++++++
drivers/net/wireless/ipw2x00/ipw2100.c | 4 ++++
drivers/net/wireless/ipw2x00/ipw2200.c | 4 ++++
3 files changed, 31 insertions(+)
--- /dev/null
+++ b/drivers/net/wireless/ipw2x00/ipw.h
@@ -0,0 +1,23 @@
+/*
+ * Intel Pro/Wireless 2100, 2200BG, 2915ABG network connection driver
+ *
+ * Copyright 2012 Stanislav Yakovlev <stas.yakovlev@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __IPW_H__
+#define __IPW_H__
+
+#include <linux/ieee80211.h>
+
+static const u32 ipw_cipher_suites[] = {
+ WLAN_CIPHER_SUITE_WEP40,
+ WLAN_CIPHER_SUITE_WEP104,
+ WLAN_CIPHER_SUITE_TKIP,
+ WLAN_CIPHER_SUITE_CCMP,
+};
+
+#endif
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -166,6 +166,7 @@ that only one external action is invoked
#include <net/lib80211.h>
#include "ipw2100.h"
+#include "ipw.h"
#define IPW2100_VERSION "git-1.2.2"
@@ -1946,6 +1947,9 @@ static int ipw2100_wdev_init(struct net_
wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = bg_band;
}
+ wdev->wiphy->cipher_suites = ipw_cipher_suites;
+ wdev->wiphy->n_cipher_suites = ARRAY_SIZE(ipw_cipher_suites);
+
set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
if (wiphy_register(wdev->wiphy)) {
ipw2100_down(priv);
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -34,6 +34,7 @@
#include <linux/slab.h>
#include <net/cfg80211-wext.h>
#include "ipw2200.h"
+#include "ipw.h"
#ifndef KBUILD_EXTMOD
@@ -11544,6 +11545,9 @@ static int ipw_wdev_init(struct net_devi
wdev->wiphy->bands[IEEE80211_BAND_5GHZ] = a_band;
}
+ wdev->wiphy->cipher_suites = ipw_cipher_suites;
+ wdev->wiphy->n_cipher_suites = ARRAY_SIZE(ipw_cipher_suites);
+
set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
/* With that information in place, we can now register the wiphy... */
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 174/187] splice: fix racy pipe->buffers uses
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (166 preceding siblings ...)
2012-07-12 22:35 ` [ 173/187] net/wireless: ipw2x00: add supported cipher suites to wiphy initialization Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 175/187] drm/i915: Refactor the deferred PM_IIR handling into a single function Greg Kroah-Hartman
` (12 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Dave Jones, Eric Dumazet,
Jens Axboe, Alexander Viro, Tom Herbert, Ben Hutchings
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 047fe3605235888f3ebcda0c728cb31937eadfe6 upstream.
Dave Jones reported a kernel BUG at mm/slub.c:3474! triggered
by splice_shrink_spd() called from vmsplice_to_pipe()
commit 35f3d14dbbc5 (pipe: add support for shrinking and growing pipes)
added capability to adjust pipe->buffers.
Problem is some paths don't hold pipe mutex and assume pipe->buffers
doesn't change for their duration.
Fix this by adding nr_pages_max field in struct splice_pipe_desc, and
use it in place of pipe->buffers where appropriate.
splice_shrink_spd() loses its struct pipe_inode_info argument.
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Tom Herbert <therbert@google.com>
Tested-by: Dave Jones <davej@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[bwh: Backported to 3.2:
- Adjust context in vmsplice_to_pipe()
- Update one more call to splice_shrink_spd(), from skb_splice_bits()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/splice.c | 35 ++++++++++++++++++++---------------
include/linux/splice.h | 8 ++++----
kernel/relay.c | 5 +++--
kernel/trace/trace.c | 6 ++++--
mm/shmem.c | 3 ++-
net/core/skbuff.c | 3 ++-
6 files changed, 35 insertions(+), 25 deletions(-)
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -273,13 +273,16 @@ void spd_release_page(struct splice_pipe
* Check if we need to grow the arrays holding pages and partial page
* descriptions.
*/
-int splice_grow_spd(struct pipe_inode_info *pipe, struct splice_pipe_desc *spd)
+int splice_grow_spd(const struct pipe_inode_info *pipe, struct splice_pipe_desc *spd)
{
- if (pipe->buffers <= PIPE_DEF_BUFFERS)
+ unsigned int buffers = ACCESS_ONCE(pipe->buffers);
+
+ spd->nr_pages_max = buffers;
+ if (buffers <= PIPE_DEF_BUFFERS)
return 0;
- spd->pages = kmalloc(pipe->buffers * sizeof(struct page *), GFP_KERNEL);
- spd->partial = kmalloc(pipe->buffers * sizeof(struct partial_page), GFP_KERNEL);
+ spd->pages = kmalloc(buffers * sizeof(struct page *), GFP_KERNEL);
+ spd->partial = kmalloc(buffers * sizeof(struct partial_page), GFP_KERNEL);
if (spd->pages && spd->partial)
return 0;
@@ -289,10 +292,9 @@ int splice_grow_spd(struct pipe_inode_in
return -ENOMEM;
}
-void splice_shrink_spd(struct pipe_inode_info *pipe,
- struct splice_pipe_desc *spd)
+void splice_shrink_spd(struct splice_pipe_desc *spd)
{
- if (pipe->buffers <= PIPE_DEF_BUFFERS)
+ if (spd->nr_pages_max <= PIPE_DEF_BUFFERS)
return;
kfree(spd->pages);
@@ -315,6 +317,7 @@ __generic_file_splice_read(struct file *
struct splice_pipe_desc spd = {
.pages = pages,
.partial = partial,
+ .nr_pages_max = PIPE_DEF_BUFFERS,
.flags = flags,
.ops = &page_cache_pipe_buf_ops,
.spd_release = spd_release_page,
@@ -326,7 +329,7 @@ __generic_file_splice_read(struct file *
index = *ppos >> PAGE_CACHE_SHIFT;
loff = *ppos & ~PAGE_CACHE_MASK;
req_pages = (len + loff + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
- nr_pages = min(req_pages, pipe->buffers);
+ nr_pages = min(req_pages, spd.nr_pages_max);
/*
* Lookup the (hopefully) full range of pages we need.
@@ -497,7 +500,7 @@ fill_it:
if (spd.nr_pages)
error = splice_to_pipe(pipe, &spd);
- splice_shrink_spd(pipe, &spd);
+ splice_shrink_spd(&spd);
return error;
}
@@ -598,6 +601,7 @@ ssize_t default_file_splice_read(struct
struct splice_pipe_desc spd = {
.pages = pages,
.partial = partial,
+ .nr_pages_max = PIPE_DEF_BUFFERS,
.flags = flags,
.ops = &default_pipe_buf_ops,
.spd_release = spd_release_page,
@@ -608,8 +612,8 @@ ssize_t default_file_splice_read(struct
res = -ENOMEM;
vec = __vec;
- if (pipe->buffers > PIPE_DEF_BUFFERS) {
- vec = kmalloc(pipe->buffers * sizeof(struct iovec), GFP_KERNEL);
+ if (spd.nr_pages_max > PIPE_DEF_BUFFERS) {
+ vec = kmalloc(spd.nr_pages_max * sizeof(struct iovec), GFP_KERNEL);
if (!vec)
goto shrink_ret;
}
@@ -617,7 +621,7 @@ ssize_t default_file_splice_read(struct
offset = *ppos & ~PAGE_CACHE_MASK;
nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
- for (i = 0; i < nr_pages && i < pipe->buffers && len; i++) {
+ for (i = 0; i < nr_pages && i < spd.nr_pages_max && len; i++) {
struct page *page;
page = alloc_page(GFP_USER);
@@ -665,7 +669,7 @@ ssize_t default_file_splice_read(struct
shrink_ret:
if (vec != __vec)
kfree(vec);
- splice_shrink_spd(pipe, &spd);
+ splice_shrink_spd(&spd);
return res;
err:
@@ -1612,6 +1616,7 @@ static long vmsplice_to_pipe(struct file
struct splice_pipe_desc spd = {
.pages = pages,
.partial = partial,
+ .nr_pages_max = PIPE_DEF_BUFFERS,
.flags = flags,
.ops = &user_page_pipe_buf_ops,
.spd_release = spd_release_page,
@@ -1627,13 +1632,13 @@ static long vmsplice_to_pipe(struct file
spd.nr_pages = get_iovec_page_array(iov, nr_segs, spd.pages,
spd.partial, flags & SPLICE_F_GIFT,
- pipe->buffers);
+ spd.nr_pages_max);
if (spd.nr_pages <= 0)
ret = spd.nr_pages;
else
ret = splice_to_pipe(pipe, &spd);
- splice_shrink_spd(pipe, &spd);
+ splice_shrink_spd(&spd);
return ret;
}
--- a/include/linux/splice.h
+++ b/include/linux/splice.h
@@ -51,7 +51,8 @@ struct partial_page {
struct splice_pipe_desc {
struct page **pages; /* page map */
struct partial_page *partial; /* pages[] may not be contig */
- int nr_pages; /* number of pages in map */
+ int nr_pages; /* number of populated pages in map */
+ unsigned int nr_pages_max; /* pages[] & partial[] arrays size */
unsigned int flags; /* splice flags */
const struct pipe_buf_operations *ops;/* ops associated with output pipe */
void (*spd_release)(struct splice_pipe_desc *, unsigned int);
@@ -85,9 +86,8 @@ extern ssize_t splice_direct_to_actor(st
/*
* for dynamic pipe sizing
*/
-extern int splice_grow_spd(struct pipe_inode_info *, struct splice_pipe_desc *);
-extern void splice_shrink_spd(struct pipe_inode_info *,
- struct splice_pipe_desc *);
+extern int splice_grow_spd(const struct pipe_inode_info *, struct splice_pipe_desc *);
+extern void splice_shrink_spd(struct splice_pipe_desc *);
extern void spd_release_page(struct splice_pipe_desc *, unsigned int);
extern const struct pipe_buf_operations page_cache_pipe_buf_ops;
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -1235,6 +1235,7 @@ static ssize_t subbuf_splice_actor(struc
struct splice_pipe_desc spd = {
.pages = pages,
.nr_pages = 0,
+ .nr_pages_max = PIPE_DEF_BUFFERS,
.partial = partial,
.flags = flags,
.ops = &relay_pipe_buf_ops,
@@ -1302,8 +1303,8 @@ static ssize_t subbuf_splice_actor(struc
ret += padding;
out:
- splice_shrink_spd(pipe, &spd);
- return ret;
+ splice_shrink_spd(&spd);
+ return ret;
}
static ssize_t relay_file_splice_read(struct file *in,
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3565,6 +3565,7 @@ static ssize_t tracing_splice_read_pipe(
.pages = pages_def,
.partial = partial_def,
.nr_pages = 0, /* This gets updated below. */
+ .nr_pages_max = PIPE_DEF_BUFFERS,
.flags = flags,
.ops = &tracing_pipe_buf_ops,
.spd_release = tracing_spd_release_pipe,
@@ -3636,7 +3637,7 @@ static ssize_t tracing_splice_read_pipe(
ret = splice_to_pipe(pipe, &spd);
out:
- splice_shrink_spd(pipe, &spd);
+ splice_shrink_spd(&spd);
return ret;
out_err:
@@ -4126,6 +4127,7 @@ tracing_buffers_splice_read(struct file
struct splice_pipe_desc spd = {
.pages = pages_def,
.partial = partial_def,
+ .nr_pages_max = PIPE_DEF_BUFFERS,
.flags = flags,
.ops = &buffer_pipe_buf_ops,
.spd_release = buffer_spd_release,
@@ -4213,7 +4215,7 @@ tracing_buffers_splice_read(struct file
}
ret = splice_to_pipe(pipe, &spd);
- splice_shrink_spd(pipe, &spd);
+ splice_shrink_spd(&spd);
out:
return ret;
}
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1365,6 +1365,7 @@ static ssize_t shmem_file_splice_read(st
struct splice_pipe_desc spd = {
.pages = pages,
.partial = partial,
+ .nr_pages_max = PIPE_DEF_BUFFERS,
.flags = flags,
.ops = &page_cache_pipe_buf_ops,
.spd_release = spd_release_page,
@@ -1453,7 +1454,7 @@ static ssize_t shmem_file_splice_read(st
if (spd.nr_pages)
error = splice_to_pipe(pipe, &spd);
- splice_shrink_spd(pipe, &spd);
+ splice_shrink_spd(&spd);
if (error > 0) {
*ppos += error;
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1712,6 +1712,7 @@ int skb_splice_bits(struct sk_buff *skb,
struct splice_pipe_desc spd = {
.pages = pages,
.partial = partial,
+ .nr_pages_max = MAX_SKB_FRAGS,
.flags = flags,
.ops = &sock_pipe_buf_ops,
.spd_release = sock_spd_release,
@@ -1758,7 +1759,7 @@ done:
lock_sock(sk);
}
- splice_shrink_spd(pipe, &spd);
+ splice_shrink_spd(&spd);
return ret;
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 175/187] drm/i915: Refactor the deferred PM_IIR handling into a single function
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (167 preceding siblings ...)
2012-07-12 22:35 ` [ 174/187] splice: fix racy pipe->buffers uses Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 176/187] drm/i915: rip out the PM_IIR WARN Greg Kroah-Hartman
` (11 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Chris Wilson, Ben Widawsky,
Daniel Vetter, Ben Hutchings
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit fc6826d1dcd65f3d1e9a5377678882e4e08f02be upstream.
This function, along with the registers and deferred work hander, are
all shared with SandyBridge, IvyBridge and their variants. So remove the
duplicate code into a single function.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Ben Widawsky <ben@bwidawsk.net>
Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
[bwh: Backported to 3.2: adjust context; drop changes for Valley View]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_irq.c | 58 ++++++++++++++++++++--------------------
1 file changed, 29 insertions(+), 29 deletions(-)
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -424,6 +424,31 @@ static void gen6_pm_rps_work(struct work
mutex_unlock(&dev_priv->dev->struct_mutex);
}
+static void gen6_queue_rps_work(struct drm_i915_private *dev_priv,
+ u32 pm_iir)
+{
+ unsigned long flags;
+
+ /*
+ * IIR bits should never already be set because IMR should
+ * prevent an interrupt from being shown in IIR. The warning
+ * displays a case where we've unsafely cleared
+ * dev_priv->pm_iir. Although missing an interrupt of the same
+ * type is not a problem, it displays a problem in the logic.
+ *
+ * The mask bit in IMR is cleared by rps_work.
+ */
+
+ spin_lock_irqsave(&dev_priv->rps_lock, flags);
+ WARN(dev_priv->pm_iir & pm_iir, "Missed a PM interrupt\n");
+ dev_priv->pm_iir |= pm_iir;
+ I915_WRITE(GEN6_PMIMR, dev_priv->pm_iir);
+ POSTING_READ(GEN6_PMIMR);
+ spin_unlock_irqrestore(&dev_priv->rps_lock, flags);
+
+ queue_work(dev_priv->wq, &dev_priv->rps_work);
+}
+
static void pch_irq_handler(struct drm_device *dev, u32 pch_iir)
{
drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
@@ -529,16 +554,8 @@ static irqreturn_t ivybridge_irq_handler
pch_irq_handler(dev, pch_iir);
}
- if (pm_iir & GEN6_PM_DEFERRED_EVENTS) {
- unsigned long flags;
- spin_lock_irqsave(&dev_priv->rps_lock, flags);
- WARN(dev_priv->pm_iir & pm_iir, "Missed a PM interrupt\n");
- dev_priv->pm_iir |= pm_iir;
- I915_WRITE(GEN6_PMIMR, dev_priv->pm_iir);
- POSTING_READ(GEN6_PMIMR);
- spin_unlock_irqrestore(&dev_priv->rps_lock, flags);
- queue_work(dev_priv->wq, &dev_priv->rps_work);
- }
+ if (pm_iir & GEN6_PM_DEFERRED_EVENTS)
+ gen6_queue_rps_work(dev_priv, pm_iir);
/* should clear PCH hotplug event before clear CPU irq */
I915_WRITE(SDEIIR, pch_iir);
@@ -634,25 +651,8 @@ static irqreturn_t ironlake_irq_handler(
i915_handle_rps_change(dev);
}
- if (IS_GEN6(dev) && pm_iir & GEN6_PM_DEFERRED_EVENTS) {
- /*
- * IIR bits should never already be set because IMR should
- * prevent an interrupt from being shown in IIR. The warning
- * displays a case where we've unsafely cleared
- * dev_priv->pm_iir. Although missing an interrupt of the same
- * type is not a problem, it displays a problem in the logic.
- *
- * The mask bit in IMR is cleared by rps_work.
- */
- unsigned long flags;
- spin_lock_irqsave(&dev_priv->rps_lock, flags);
- WARN(dev_priv->pm_iir & pm_iir, "Missed a PM interrupt\n");
- dev_priv->pm_iir |= pm_iir;
- I915_WRITE(GEN6_PMIMR, dev_priv->pm_iir);
- POSTING_READ(GEN6_PMIMR);
- spin_unlock_irqrestore(&dev_priv->rps_lock, flags);
- queue_work(dev_priv->wq, &dev_priv->rps_work);
- }
+ if (IS_GEN6(dev) && pm_iir & GEN6_PM_DEFERRED_EVENTS)
+ gen6_queue_rps_work(dev_priv, pm_iir);
/* should clear PCH hotplug event before clear CPU irq */
I915_WRITE(SDEIIR, pch_iir);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 176/187] drm/i915: rip out the PM_IIR WARN
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (168 preceding siblings ...)
2012-07-12 22:35 ` [ 175/187] drm/i915: Refactor the deferred PM_IIR handling into a single function Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 177/187] mm: Hold a file reference in madvise_remove Greg Kroah-Hartman
` (10 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Chris Wilson, Daniel Vetter
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <daniel.vetter@ffwll.ch>
commit 58bf8062d0b293b8e1028e5b0342082002886bd4 upstream.
After banging my head against this for the past few months, I still
don't see how this could possible race under the premise that once an
irq bit is masked in PM_IMR and reset in PM_IIR it won't show up again
until we unmask it in PM_IMR.
Still, we have reports of this being seen in the wild. Now Bspec has
this little bit of lovely language in the PMIIR register:
Public SNB Docs, Vol3Part2, 2.5.14 "PMIIR":
"For each bit, the IIR can store a second pending interrupt if two or
more of the same interrupt conditions occur before the first condition
is cleared. Upon clearing the interrupt, the IIR bit will momentarily
go low, then return high to indicate there is another interrupt
pending."
Now if we presume that PMIMR only prevent new interrupts from being
queued, we could easily end up masking an interrupt and clearing it,
but the 2nd pending interrupt setting the bit in PMIIR right away
again. Which leads, the next time the irq handler runs, to hitting the
WARN.
Also, no bad side effects of this have ever been reported. And we've
tracked down our issues with the gpu turbo getting stuck to bogus
interrupt generation limits in th RPLIMIT register.
So let's just rip out this WARN as bogus and call it a day. The only
shallow thing here is that this 2-deep irq queue in the hw makes you
wonder how racy the windows irq handler is ...
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42907
Acked-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_irq.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -440,7 +440,6 @@ static void gen6_queue_rps_work(struct d
*/
spin_lock_irqsave(&dev_priv->rps_lock, flags);
- WARN(dev_priv->pm_iir & pm_iir, "Missed a PM interrupt\n");
dev_priv->pm_iir |= pm_iir;
I915_WRITE(GEN6_PMIMR, dev_priv->pm_iir);
POSTING_READ(GEN6_PMIMR);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 177/187] mm: Hold a file reference in madvise_remove
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (169 preceding siblings ...)
2012-07-12 22:35 ` [ 176/187] drm/i915: rip out the PM_IIR WARN Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 178/187] md/raid5: Do not add data_offset before call to is_badblock Greg Kroah-Hartman
` (9 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Hugh Dickins, Miklos Szeredi,
Badari Pulavarty, Nick Piggin, Andy Lutomirski, Ben Hutchings
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@amacapital.net>
commit 9ab4233dd08036fe34a89c7dc6f47a8bf2eb29eb upstream.
Otherwise the code races with munmap (causing a use-after-free
of the vma) or with close (causing a use-after-free of the struct
file).
The bug was introduced by commit 90ed52ebe481 ("[PATCH] holepunch: fix
mmap_sem i_mutex deadlock")
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 178/187] md/raid5: Do not add data_offset before call to is_badblock
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (170 preceding siblings ...)
2012-07-12 22:35 ` [ 177/187] mm: Hold a file reference in madvise_remove Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 179/187] staging:iio:ad7606: Re-add missing scale attribute Greg Kroah-Hartman
` (8 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, majianpeng, NeilBrown, Ben Hutchings
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: majianpeng <majianpeng@gmail.com>
commit 6c0544e255dd6582a9899572e120fb55d9f672a4 upstream.
In chunk_aligned_read() we are adding data_offset before calling
is_badblock. But is_badblock also adds data_offset, so that is bad.
So move the addition of data_offset to after the call to
is_badblock.
This bug was introduced by commit 31c176ecdf3563140e639
md/raid5: avoid reading from known bad blocks.
which first appeared in 3.0. So that patch is suitable for any
-stable kernel from 3.0.y onwards. However it will need minor
revision for most of those (as the comment didn't appear until
recently).
Signed-off-by: majianpeng <majianpeng@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
[bwh: Backported to 3.2: ignored missing comment]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid5.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3850,7 +3850,6 @@ static int chunk_aligned_read(struct mdd
raid_bio->bi_next = (void*)rdev;
align_bi->bi_bdev = rdev->bdev;
align_bi->bi_flags &= ~(1 << BIO_SEG_VALID);
- align_bi->bi_sector += rdev->data_offset;
if (!bio_fits_rdev(align_bi) ||
is_badblock(rdev, align_bi->bi_sector, align_bi->bi_size>>9,
@@ -3861,6 +3860,9 @@ static int chunk_aligned_read(struct mdd
return 0;
}
+ /* No reshape active, so we can trust rdev->data_offset */
+ align_bi->bi_sector += rdev->data_offset;
+
spin_lock_irq(&conf->device_lock);
wait_event_lock_irq(conf->wait_for_stripe,
conf->quiesce == 0,
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 179/187] staging:iio:ad7606: Re-add missing scale attribute
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (171 preceding siblings ...)
2012-07-12 22:35 ` [ 178/187] md/raid5: Do not add data_offset before call to is_badblock Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 180/187] memory hotplug: fix invalid memory access caused by stale kswapd pointer Greg Kroah-Hartman
` (7 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Lars-Peter Clausen,
Jonathan Cameron, Herton R. Krzesinski
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit 279bf2e57c30c9a4482b2b6ede11b31c41e35e78 upstream.
Commit 50ac23be ("staging:iio:adc:ad7606 add local define for chan_spec
structures.") accidentally removed the scale info_mask flag. This patch
adds it back again.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[herton: Backported to 3.4: info_mask was not used yet with another flag]
Signed-off-by: Herton R. Krzesinski <herton@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/iio/adc/ad7606_core.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/staging/iio/adc/ad7606_core.c
+++ b/drivers/staging/iio/adc/ad7606_core.c
@@ -235,6 +235,7 @@ static const struct attribute_group ad76
.indexed = 1, \
.channel = num, \
.address = num, \
+ .info_mask = IIO_CHAN_INFO_SCALE_SHARED_BIT, \
.scan_index = num, \
.scan_type = IIO_ST('s', 16, 16, 0), \
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 180/187] memory hotplug: fix invalid memory access caused by stale kswapd pointer
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (172 preceding siblings ...)
2012-07-12 22:35 ` [ 179/187] staging:iio:ad7606: Re-add missing scale attribute Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 181/187] drivers/rtc/rtc-spear.c: fix use-after-free in spear_rtc_remove() Greg Kroah-Hartman
` (6 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Xishi Qiu, Jiang Liu,
KAMEZAWA Hiroyuki, KOSAKI Motohiro, Mel Gorman, David Rientjes,
Minchan Kim
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiang Liu <jiang.liu@huawei.com>
commit d8adde17e5f858427504725218c56aef90e90fc7 upstream.
kswapd_stop() is called to destroy the kswapd work thread when all memory
of a NUMA node has been offlined. But kswapd_stop() only terminates the
work thread without resetting NODE_DATA(nid)->kswapd to NULL. The stale
pointer will prevent kswapd_run() from creating a new work thread when
adding memory to the memory-less NUMA node again. Eventually the stale
pointer may cause invalid memory access.
An example stack dump as below. It's reproduced with 2.6.32, but latest
kernel has the same issue.
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffff81051a94>] exit_creds+0x12/0x78
PGD 0
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/system/memory/memory391/state
CPU 11
Modules linked in: cpufreq_conservative cpufreq_userspace cpufreq_powersave acpi_cpufreq microcode fuse loop dm_mod tpm_tis rtc_cmos i2c_i801 rtc_core tpm serio_raw pcspkr sg tpm_bios igb i2c_core iTCO_wdt rtc_lib mptctl iTCO_vendor_support button dca bnx2 usbhid hid uhci_hcd ehci_hcd usbcore sd_mod crc_t10dif edd ext3 mbcache jbd fan ide_pci_generic ide_core ata_generic ata_piix libata thermal processor thermal_sys hwmon mptsas mptscsih mptbase scsi_transport_sas scsi_mod
Pid: 7949, comm: sh Not tainted 2.6.32.12-qiuxishi-5-default #92 Tecal RH2285
RIP: 0010:exit_creds+0x12/0x78
RSP: 0018:ffff8806044f1d78 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff880604f22140 RCX: 0000000000019502
RDX: 0000000000000000 RSI: 0000000000000202 RDI: 0000000000000000
RBP: ffff880604f22150 R08: 0000000000000000 R09: ffffffff81a4dc10
R10: 00000000000032a0 R11: ffff880006202500 R12: 0000000000000000
R13: 0000000000c40000 R14: 0000000000008000 R15: 0000000000000001
FS: 00007fbc03d066f0(0000) GS:ffff8800282e0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000000 CR3: 000000060f029000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process sh (pid: 7949, threadinfo ffff8806044f0000, task ffff880603d7c600)
Stack:
ffff880604f22140 ffffffff8103aac5 ffff880604f22140 ffffffff8104d21e
ffff880006202500 0000000000008000 0000000000c38000 ffffffff810bd5b1
0000000000000000 ffff880603d7c600 00000000ffffdd29 0000000000000003
Call Trace:
__put_task_struct+0x5d/0x97
kthread_stop+0x50/0x58
offline_pages+0x324/0x3da
memory_block_change_state+0x179/0x1db
store_mem_state+0x9e/0xbb
sysfs_write_file+0xd0/0x107
vfs_write+0xad/0x169
sys_write+0x45/0x6e
system_call_fastpath+0x16/0x1b
Code: ff 4d 00 0f 94 c0 84 c0 74 08 48 89 ef e8 1f fd ff ff 5b 5d 31 c0 41 5c c3 53 48 8b 87 20 06 00 00 48 89 fb 48 8b bf 18 06 00 00 <8b> 00 48 c7 83 18 06 00 00 00 00 00 00 f0 ff 0f 0f 94 c0 84 c0
RIP exit_creds+0x12/0x78
RSP <ffff8806044f1d78>
CR2: 0000000000000000
[akpm@linux-foundation.org: add pglist_data.kswapd locking comments]
Signed-off-by: Xishi Qiu <qiuxishi@huawei.com>
Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Acked-by: Mel Gorman <mgorman@suse.de>
Acked-by: David Rientjes <rientjes@google.com>
Reviewed-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/mmzone.h | 2 +-
mm/vmscan.c | 7 +++++--
2 files changed, 6 insertions(+), 3 deletions(-)
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -663,7 +663,7 @@ typedef struct pglist_data {
range, including holes */
int node_id;
wait_queue_head_t kswapd_wait;
- struct task_struct *kswapd;
+ struct task_struct *kswapd; /* Protected by lock_memory_hotplug() */
int kswapd_max_order;
enum zone_type classzone_idx;
} pg_data_t;
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -3279,14 +3279,17 @@ int kswapd_run(int nid)
}
/*
- * Called by memory hotplug when all memory in a node is offlined.
+ * Called by memory hotplug when all memory in a node is offlined. Caller must
+ * hold lock_memory_hotplug().
*/
void kswapd_stop(int nid)
{
struct task_struct *kswapd = NODE_DATA(nid)->kswapd;
- if (kswapd)
+ if (kswapd) {
kthread_stop(kswapd);
+ NODE_DATA(nid)->kswapd = NULL;
+ }
}
static int __init kswapd_init(void)
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 181/187] drivers/rtc/rtc-spear.c: fix use-after-free in spear_rtc_remove()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (173 preceding siblings ...)
2012-07-12 22:35 ` [ 180/187] memory hotplug: fix invalid memory access caused by stale kswapd pointer Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 182/187] drivers/rtc/rtc-ab8500.c: use IRQF_ONESHOT when requesting a threaded IRQ Greg Kroah-Hartman
` (5 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Devendra Naga, Viresh Kumar,
Alessandro Zummo
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devendra Naga <devendra.aaru@gmail.com>
commit 2a643893e50fde71d7ba84b5592ec61b467b9ab6 upstream.
`config' is freed and is then used in the rtc_device_unregister() call,
causing a kernel panic.
Signed-off-by: Devendra Naga <devendra.aaru@gmail.com>
Reviewed-by: Viresh Kumar <viresh.linux@gmail.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-spear.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/rtc/rtc-spear.c
+++ b/drivers/rtc/rtc-spear.c
@@ -457,12 +457,12 @@ static int __devexit spear_rtc_remove(st
clk_disable(config->clk);
clk_put(config->clk);
iounmap(config->ioaddr);
- kfree(config);
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (res)
release_mem_region(res->start, resource_size(res));
platform_set_drvdata(pdev, NULL);
rtc_device_unregister(config->rtc);
+ kfree(config);
return 0;
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 182/187] drivers/rtc/rtc-ab8500.c: use IRQF_ONESHOT when requesting a threaded IRQ
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (174 preceding siblings ...)
2012-07-12 22:35 ` [ 181/187] drivers/rtc/rtc-spear.c: fix use-after-free in spear_rtc_remove() Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` =?y?q?=5B=20183/187=5D=20drivers/rtc/rtc-mxc=2Ec=3A=20fix=20irq=20enabled=20interrupts=20warning?= Greg Kroah-Hartman
` (4 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Lee Jones, Alessandro Zummo
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <lee.jones@linaro.org>
commit 3cfd16a551dc0c188160e1765168a04baf2d3198 upstream.
This driver's IRQ registration is failing because the kernel now forces
IRQs to be ONESHOT if no IRQ handler is passed.
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-ab8500.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/rtc/rtc-ab8500.c
+++ b/drivers/rtc/rtc-ab8500.c
@@ -422,7 +422,7 @@ static int __devinit ab8500_rtc_probe(st
}
err = request_threaded_irq(irq, NULL, rtc_alarm_handler,
- IRQF_NO_SUSPEND, "ab8500-rtc", rtc);
+ IRQF_NO_SUSPEND | IRQF_ONESHOT, "ab8500-rtc", rtc);
if (err < 0) {
rtc_device_unregister(rtc);
return err;
^ permalink raw reply [flat|nested] 191+ messages in thread* =?y?q?=5B=20183/187=5D=20drivers/rtc/rtc-mxc=2Ec=3A=20fix=20irq=20enabled=20interrupts=20warning?=
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (175 preceding siblings ...)
2012-07-12 22:35 ` [ 182/187] drivers/rtc/rtc-ab8500.c: use IRQF_ONESHOT when requesting a threaded IRQ Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 184/187] mm, thp: abort compaction if migration page cannot be charged to memcg Greg Kroah-Hartman
` (3 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Benoît Thébaudeau,
Alessandro Zummo, Sascha Hauer, Uwe Kleine-König
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=y, Size: 2709 bytes --]
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Beno=C3=AEt=20Th=C3=A9baudeau?=
commit b59f6d1febd6cbe9fae4589bf72da0ed32bc69e0 upstream.
Fixes
WARNING: at irq/handle.c:146 handle_irq_event_percpu+0x19c/0x1b8()
irq 25 handler mxc_rtc_interrupt+0x0/0xac enabled interrupts
Modules linked in:
(unwind_backtrace+0x0/0xf0) from (warn_slowpath_common+0x4c/0x64)
(warn_slowpath_common+0x4c/0x64) from (warn_slowpath_fmt+0x30/0x40)
(warn_slowpath_fmt+0x30/0x40) from (handle_irq_event_percpu+0x19c/0x1b8)
(handle_irq_event_percpu+0x19c/0x1b8) from (handle_irq_event+0x28/0x38)
(handle_irq_event+0x28/0x38) from (handle_level_irq+0x80/0xc4)
(handle_level_irq+0x80/0xc4) from (generic_handle_irq+0x24/0x38)
(generic_handle_irq+0x24/0x38) from (handle_IRQ+0x30/0x84)
(handle_IRQ+0x30/0x84) from (avic_handle_irq+0x2c/0x4c)
(avic_handle_irq+0x2c/0x4c) from (__irq_svc+0x40/0x60)
Exception stack(0xc050bf60 to 0xc050bfa8)
bf60: 00000001 00000000 003c4208 c0018e20 c050a000 c050a000 c054a4c8 c050a000
bf80: c05157a8 4117b363 80503bb4 00000000 01000000 c050bfa8 c0018e2c c000e808
bfa0: 60000013 ffffffff
(__irq_svc+0x40/0x60) from (default_idle+0x1c/0x30)
(default_idle+0x1c/0x30) from (cpu_idle+0x68/0xa8)
(cpu_idle+0x68/0xa8) from (start_kernel+0x22c/0x26c)
Signed-off-by: Benoît Thébaudeau <benoit.thebaudeau@advansee.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Sascha Hauer <kernel@pengutronix.de>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-mxc.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/rtc/rtc-mxc.c
+++ b/drivers/rtc/rtc-mxc.c
@@ -202,10 +202,11 @@ static irqreturn_t mxc_rtc_interrupt(int
struct platform_device *pdev = dev_id;
struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
void __iomem *ioaddr = pdata->ioaddr;
+ unsigned long flags;
u32 status;
u32 events = 0;
- spin_lock_irq(&pdata->rtc->irq_lock);
+ spin_lock_irqsave(&pdata->rtc->irq_lock, flags);
status = readw(ioaddr + RTC_RTCISR) & readw(ioaddr + RTC_RTCIENR);
/* clear interrupt sources */
writew(status, ioaddr + RTC_RTCISR);
@@ -224,7 +225,7 @@ static irqreturn_t mxc_rtc_interrupt(int
events |= (RTC_PF | RTC_IRQF);
rtc_update_irq(pdata->rtc, 1, events);
- spin_unlock_irq(&pdata->rtc->irq_lock);
+ spin_unlock_irqrestore(&pdata->rtc->irq_lock, flags);
return IRQ_HANDLED;
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 184/187] mm, thp: abort compaction if migration page cannot be charged to memcg
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (176 preceding siblings ...)
2012-07-12 22:35 ` =?y?q?=5B=20183/187=5D=20drivers/rtc/rtc-mxc=2Ec=3A=20fix=20irq=20enabled=20interrupts=20warning?= Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 185/187] fs: ramfs: file-nommu: add SetPageUptodate() Greg Kroah-Hartman
` (2 subsequent siblings)
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, David Rientjes, Mel Gorman,
Minchan Kim, Kamezawa Hiroyuki, Rik van Riel, Andrea Arcangeli
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rientjes <rientjes@google.com>
commit 4bf2bba3750f10aa9e62e6949bc7e8329990f01b upstream.
If page migration cannot charge the temporary page to the memcg,
migrate_pages() will return -ENOMEM. This isn't considered in memory
compaction however, and the loop continues to iterate over all
pageblocks trying to isolate and migrate pages. If a small number of
very large memcgs happen to be oom, however, these attempts will mostly
be futile leading to an enormous amout of cpu consumption due to the
page migration failures.
This patch will short circuit and fail memory compaction if
migrate_pages() returns -ENOMEM. COMPACT_PARTIAL is returned in case
some migrations were successful so that the page allocator will retry.
Signed-off-by: David Rientjes <rientjes@google.com>
Acked-by: Mel Gorman <mgorman@suse.de>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Kamezawa Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/compaction.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -594,8 +594,11 @@ static int compact_zone(struct zone *zon
if (err) {
putback_lru_pages(&cc->migratepages);
cc->nr_migratepages = 0;
+ if (err == -ENOMEM) {
+ ret = COMPACT_PARTIAL;
+ goto out;
+ }
}
-
}
out:
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 185/187] fs: ramfs: file-nommu: add SetPageUptodate()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (177 preceding siblings ...)
2012-07-12 22:35 ` [ 184/187] mm, thp: abort compaction if migration page cannot be charged to memcg Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 186/187] memblock: free allocated memblock_reserved_regions later Greg Kroah-Hartman
2012-07-12 22:35 ` [ 187/187] ocfs2: fix NULL pointer dereference in __ocfs2_change_file_space() Greg Kroah-Hartman
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Bob Liu, Hugh Dickins,
David Howells, Geert Uytterhoeven, Greg Ungerer
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Liu <lliubbo@gmail.com>
commit fea9f718b3d68147f162ed2d870183ce5e0ad8d8 upstream.
There is a bug in the below scenario for !CONFIG_MMU:
1. create a new file
2. mmap the file and write to it
3. read the file can't get the correct value
Because
sys_read() -> generic_file_aio_read() -> simple_readpage() -> clear_page()
which causes the page to be zeroed.
Add SetPageUptodate() to ramfs_nommu_expand_for_mapping() so that
generic_file_aio_read() do not call simple_readpage().
Signed-off-by: Bob Liu <lliubbo@gmail.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ramfs/file-nommu.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/ramfs/file-nommu.c
+++ b/fs/ramfs/file-nommu.c
@@ -110,6 +110,7 @@ int ramfs_nommu_expand_for_mapping(struc
/* prevent the page from being discarded on memory pressure */
SetPageDirty(page);
+ SetPageUptodate(page);
unlock_page(page);
put_page(page);
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 186/187] memblock: free allocated memblock_reserved_regions later
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (178 preceding siblings ...)
2012-07-12 22:35 ` [ 185/187] fs: ramfs: file-nommu: add SetPageUptodate() Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
2012-07-12 22:35 ` [ 187/187] ocfs2: fix NULL pointer dereference in __ocfs2_change_file_space() Greg Kroah-Hartman
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Sasha Levin, Tejun Heo,
Benjamin Herrenschmidt, Yinghai Lu
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yinghai Lu <yinghai@kernel.org>
commit 29f6738609e40227dabcc63bfb3b84b3726a75bd upstream.
memblock_free_reserved_regions() calls memblock_free(), but
memblock_free() would double reserved.regions too, so we could free the
old range for reserved.regions.
Also tj said there is another bug which could be related to this.
| I don't think we're saving any noticeable
| amount by doing this "free - give it to page allocator - reserve
| again" dancing. We should just allocate regions aligned to page
| boundaries and free them later when memblock is no longer in use.
in that case, when DEBUG_PAGEALLOC, will get panic:
memblock_free: [0x0000102febc080-0x0000102febf080] memblock_free_reserved_regions+0x37/0x39
BUG: unable to handle kernel paging request at ffff88102febd948
IP: [<ffffffff836a5774>] __next_free_mem_range+0x9b/0x155
PGD 4826063 PUD cf67a067 PMD cf7fa067 PTE 800000102febd160
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
CPU 0
Pid: 0, comm: swapper Not tainted 3.5.0-rc2-next-20120614-sasha #447
RIP: 0010:[<ffffffff836a5774>] [<ffffffff836a5774>] __next_free_mem_range+0x9b/0x155
See the discussion at https://lkml.org/lkml/2012/6/13/469
So try to allocate with PAGE_SIZE alignment and free it later.
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Acked-by: Tejun Heo <tj@kernel.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/memblock.h | 4 ---
mm/memblock.c | 51 +++++++++++++++++++++--------------------------
mm/nobootmem.c | 36 ++++++++++++++++++++-------------
3 files changed, 46 insertions(+), 45 deletions(-)
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -50,9 +50,7 @@ phys_addr_t memblock_find_in_range_node(
phys_addr_t size, phys_addr_t align, int nid);
phys_addr_t memblock_find_in_range(phys_addr_t start, phys_addr_t end,
phys_addr_t size, phys_addr_t align);
-int memblock_free_reserved_regions(void);
-int memblock_reserve_reserved_regions(void);
-
+phys_addr_t get_allocated_memblock_reserved_regions_info(phys_addr_t *addr);
void memblock_allow_resize(void);
int memblock_add_node(phys_addr_t base, phys_addr_t size, int nid);
int memblock_add(phys_addr_t base, phys_addr_t size);
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -143,30 +143,6 @@ phys_addr_t __init_memblock memblock_fin
MAX_NUMNODES);
}
-/*
- * Free memblock.reserved.regions
- */
-int __init_memblock memblock_free_reserved_regions(void)
-{
- if (memblock.reserved.regions == memblock_reserved_init_regions)
- return 0;
-
- return memblock_free(__pa(memblock.reserved.regions),
- sizeof(struct memblock_region) * memblock.reserved.max);
-}
-
-/*
- * Reserve memblock.reserved.regions
- */
-int __init_memblock memblock_reserve_reserved_regions(void)
-{
- if (memblock.reserved.regions == memblock_reserved_init_regions)
- return 0;
-
- return memblock_reserve(__pa(memblock.reserved.regions),
- sizeof(struct memblock_region) * memblock.reserved.max);
-}
-
static void __init_memblock memblock_remove_region(struct memblock_type *type, unsigned long r)
{
type->total_size -= type->regions[r].size;
@@ -184,6 +160,18 @@ static void __init_memblock memblock_rem
}
}
+phys_addr_t __init_memblock get_allocated_memblock_reserved_regions_info(
+ phys_addr_t *addr)
+{
+ if (memblock.reserved.regions == memblock_reserved_init_regions)
+ return 0;
+
+ *addr = __pa(memblock.reserved.regions);
+
+ return PAGE_ALIGN(sizeof(struct memblock_region) *
+ memblock.reserved.max);
+}
+
/**
* memblock_double_array - double the size of the memblock regions array
* @type: memblock type of the regions array being doubled
@@ -204,6 +192,7 @@ static int __init_memblock memblock_doub
phys_addr_t new_area_size)
{
struct memblock_region *new_array, *old_array;
+ phys_addr_t old_alloc_size, new_alloc_size;
phys_addr_t old_size, new_size, addr;
int use_slab = slab_is_available();
int *in_slab;
@@ -217,6 +206,12 @@ static int __init_memblock memblock_doub
/* Calculate new doubled size */
old_size = type->max * sizeof(struct memblock_region);
new_size = old_size << 1;
+ /*
+ * We need to allocated new one align to PAGE_SIZE,
+ * so we can free them completely later.
+ */
+ old_alloc_size = PAGE_ALIGN(old_size);
+ new_alloc_size = PAGE_ALIGN(new_size);
/* Retrieve the slab flag */
if (type == &memblock.memory)
@@ -245,11 +240,11 @@ static int __init_memblock memblock_doub
addr = memblock_find_in_range(new_area_start + new_area_size,
memblock.current_limit,
- new_size, sizeof(phys_addr_t));
+ new_alloc_size, PAGE_SIZE);
if (!addr && new_area_size)
addr = memblock_find_in_range(0,
min(new_area_start, memblock.current_limit),
- new_size, sizeof(phys_addr_t));
+ new_alloc_size, PAGE_SIZE);
new_array = addr ? __va(addr) : 0;
}
@@ -279,13 +274,13 @@ static int __init_memblock memblock_doub
kfree(old_array);
else if (old_array != memblock_memory_init_regions &&
old_array != memblock_reserved_init_regions)
- memblock_free(__pa(old_array), old_size);
+ memblock_free(__pa(old_array), old_alloc_size);
/* Reserve the new array if that comes from the memblock.
* Otherwise, we needn't do it
*/
if (!use_slab)
- BUG_ON(memblock_reserve(addr, new_size));
+ BUG_ON(memblock_reserve(addr, new_alloc_size));
/* Update slab flag */
*in_slab = use_slab;
--- a/mm/nobootmem.c
+++ b/mm/nobootmem.c
@@ -105,27 +105,35 @@ static void __init __free_pages_memory(u
__free_pages_bootmem(pfn_to_page(i), 0);
}
+static unsigned long __init __free_memory_core(phys_addr_t start,
+ phys_addr_t end)
+{
+ unsigned long start_pfn = PFN_UP(start);
+ unsigned long end_pfn = min_t(unsigned long,
+ PFN_DOWN(end), max_low_pfn);
+
+ if (start_pfn > end_pfn)
+ return 0;
+
+ __free_pages_memory(start_pfn, end_pfn);
+
+ return end_pfn - start_pfn;
+}
+
unsigned long __init free_low_memory_core_early(int nodeid)
{
unsigned long count = 0;
- phys_addr_t start, end;
+ phys_addr_t start, end, size;
u64 i;
- /* free reserved array temporarily so that it's treated as free area */
- memblock_free_reserved_regions();
+ for_each_free_mem_range(i, MAX_NUMNODES, &start, &end, NULL)
+ count += __free_memory_core(start, end);
- for_each_free_mem_range(i, MAX_NUMNODES, &start, &end, NULL) {
- unsigned long start_pfn = PFN_UP(start);
- unsigned long end_pfn = min_t(unsigned long,
- PFN_DOWN(end), max_low_pfn);
- if (start_pfn < end_pfn) {
- __free_pages_memory(start_pfn, end_pfn);
- count += end_pfn - start_pfn;
- }
- }
+ /* free range that is used for reserved array if we allocate it */
+ size = get_allocated_memblock_reserved_regions_info(&start);
+ if (size)
+ count += __free_memory_core(start, start + size);
- /* put region array back? */
- memblock_reserve_reserved_regions();
return count;
}
^ permalink raw reply [flat|nested] 191+ messages in thread* [ 187/187] ocfs2: fix NULL pointer dereference in __ocfs2_change_file_space()
2012-07-12 22:32 ` [ 005/187] ALSA: hda - Fix power-map regression for HP dv6 & co Greg Kroah-Hartman
` (179 preceding siblings ...)
2012-07-12 22:35 ` [ 186/187] memblock: free allocated memblock_reserved_regions later Greg Kroah-Hartman
@ 2012-07-12 22:35 ` Greg Kroah-Hartman
180 siblings, 0 replies; 191+ messages in thread
From: Greg Kroah-Hartman @ 2012-07-12 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg KH, torvalds, akpm, alan, Luis Henriques, Bret Towe,
Sunil Mushran, Joel Becker, Mark Fasheh
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Henriques <luis.henriques@canonical.com>
commit a4e08d001f2e50bb8b3c4eebadcf08e5535f02ee upstream.
As ocfs2_fallocate() will invoke __ocfs2_change_file_space() with a NULL
as the first parameter (file), it may trigger a NULL pointer dereferrence
due to a missing check.
Addresses http://bugs.launchpad.net/bugs/1006012
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Reported-by: Bret Towe <magnade@gmail.com>
Tested-by: Bret Towe <magnade@gmail.com>
Cc: Sunil Mushran <sunil.mushran@oracle.com>
Acked-by: Joel Becker <jlbec@evilplan.org>
Acked-by: Mark Fasheh <mfasheh@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1950,7 +1950,7 @@ static int __ocfs2_change_file_space(str
if (ret < 0)
mlog_errno(ret);
- if (file->f_flags & O_SYNC)
+ if (file && (file->f_flags & O_SYNC))
handle->h_sync = 1;
ocfs2_commit_trans(osb, handle);
^ permalink raw reply [flat|nested] 191+ messages in thread