* [PATCH 3.4 001/214] parisc: fix epoll_pwait syscall on compat kernel
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 002/214] mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages() Greg Kroah-Hartman
` (215 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Helge Deller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@gmx.de>
commit ab3e55b119c9653b19ea4edffb86f04db867ac98 upstream.
This bug was detected with the libio-epoll-perl debian package where the
test case IO-Ppoll-compat.t failed.
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/kernel/syscall_table.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -395,7 +395,7 @@
ENTRY_COMP(vmsplice)
ENTRY_COMP(move_pages) /* 295 */
ENTRY_SAME(getcpu)
- ENTRY_SAME(epoll_pwait)
+ ENTRY_COMP(epoll_pwait)
ENTRY_COMP(statfs64)
ENTRY_COMP(fstatfs64)
ENTRY_COMP(kexec_load) /* 300 */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 002/214] mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 001/214] parisc: fix epoll_pwait syscall on compat kernel Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 003/214] USB: cdc-acm: Remove Motorola/Telit H24 serial interfaces from ACM driver Greg Kroah-Hartman
` (214 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Masayoshi Mizuma, Naoya Horiguchi,
Joonsoo Kim, Michal Hocko, Aneesh Kumar, KOSAKI Motohiro,
Andrew Morton, Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Mizuma, Masayoshi" <m.mizuma@jp.fujitsu.com>
commit 7848a4bf51b34f41fcc9bd77e837126d99ae84e3 upstream.
soft lockup in freeing gigantic hugepage fixed in commit 55f67141a892 "mm:
hugetlb: fix softlockup when a large number of hugepages are freed." can
happen in return_unused_surplus_pages(), so let's fix it.
Signed-off-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Aneesh Kumar <aneesh.kumar@linux.vnet.ibm.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 1 +
1 file changed, 1 insertion(+)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1082,6 +1082,7 @@ static void return_unused_surplus_pages(
while (nr_pages--) {
if (!free_pool_huge_page(h, &node_states[N_HIGH_MEMORY], 1))
break;
+ cond_resched_lock(&hugetlb_lock);
}
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 003/214] USB: cdc-acm: Remove Motorola/Telit H24 serial interfaces from ACM driver
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 001/214] parisc: fix epoll_pwait syscall on compat kernel Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 002/214] mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages() Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 004/214] USB: cp210x: Add 8281 (Nanotec Plug & Drive) Greg Kroah-Hartman
` (213 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Ulbricht, Alexander Stein,
Oliver Neukum
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ulbricht <michael.ulbricht@systec-electronic.com>
commit 895d240d1db0b2736d779200788e4c4aea28a0c6 upstream.
By specifying NO_UNION_NORMAL the ACM driver does only use the first two
USB interfaces (modem data & control). The AT Port, Diagnostic and NMEA
interfaces are left to the USB serial driver.
Signed-off-by: Michael Ulbricht <michael.ulbricht@systec-electronic.com>
Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com>
Signed-off-by: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 28 +++++++++++++++++++++-------
1 file changed, 21 insertions(+), 7 deletions(-)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1587,13 +1587,27 @@ static const struct usb_device_id acm_id
},
/* Motorola H24 HSPA module: */
{ USB_DEVICE(0x22b8, 0x2d91) }, /* modem */
- { USB_DEVICE(0x22b8, 0x2d92) }, /* modem + diagnostics */
- { USB_DEVICE(0x22b8, 0x2d93) }, /* modem + AT port */
- { USB_DEVICE(0x22b8, 0x2d95) }, /* modem + AT port + diagnostics */
- { USB_DEVICE(0x22b8, 0x2d96) }, /* modem + NMEA */
- { USB_DEVICE(0x22b8, 0x2d97) }, /* modem + diagnostics + NMEA */
- { USB_DEVICE(0x22b8, 0x2d99) }, /* modem + AT port + NMEA */
- { USB_DEVICE(0x22b8, 0x2d9a) }, /* modem + AT port + diagnostics + NMEA */
+ { USB_DEVICE(0x22b8, 0x2d92), /* modem + diagnostics */
+ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */
+ },
+ { USB_DEVICE(0x22b8, 0x2d93), /* modem + AT port */
+ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */
+ },
+ { USB_DEVICE(0x22b8, 0x2d95), /* modem + AT port + diagnostics */
+ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */
+ },
+ { USB_DEVICE(0x22b8, 0x2d96), /* modem + NMEA */
+ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */
+ },
+ { USB_DEVICE(0x22b8, 0x2d97), /* modem + diagnostics + NMEA */
+ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */
+ },
+ { USB_DEVICE(0x22b8, 0x2d99), /* modem + AT port + NMEA */
+ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */
+ },
+ { USB_DEVICE(0x22b8, 0x2d9a), /* modem + AT port + diagnostics + NMEA */
+ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */
+ },
{ USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
.driver_info = NO_UNION_NORMAL, /* union descriptor misplaced on
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 004/214] USB: cp210x: Add 8281 (Nanotec Plug & Drive)
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 003/214] USB: cdc-acm: Remove Motorola/Telit H24 serial interfaces from ACM driver Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 005/214] USB: serial: ftdi_sio: add id for Brainboxes serial cards Greg Kroah-Hartman
` (212 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tristan Bruns, Johan Hovold
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Bruns <tristan@tristanbruns.de>
commit 72b3007951010ce1bbf950e23b19d9839fa905a5 upstream.
Signed-off-by: Tristan Bruns <tristan@tristanbruns.de>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/cp210x.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -110,6 +110,7 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */
{ USB_DEVICE(0x10C4, 0x822B) }, /* Modem EDGE(GSM) Comander 2 */
{ USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */
+ { USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */
{ USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */
{ USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */
{ USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 005/214] USB: serial: ftdi_sio: add id for Brainboxes serial cards
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 004/214] USB: cp210x: Add 8281 (Nanotec Plug & Drive) Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 006/214] usb: option driver, add support for Telit UE910v2 Greg Kroah-Hartman
` (211 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michele Baldessari, Johan Hovold
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michele Baldessari <michele@acksyn.org>
commit efe26e16b1d93ac0085e69178cc18811629e8fc5 upstream.
Custom VID/PIDs for Brainboxes cards as reported in
https://bugzilla.redhat.com/show_bug.cgi?id=1071914
Signed-off-by: Michele Baldessari <michele@acksyn.org>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 33 +++++++++++++++++++++++++++++++++
drivers/usb/serial/ftdi_sio_ids.h | 37 +++++++++++++++++++++++++++++++++++++
2 files changed, 70 insertions(+)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -920,6 +920,39 @@ static struct usb_device_id id_table_com
{ USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
/* Cressi Devices */
{ USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) },
+ /* Brainboxes Devices */
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_001_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_012_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_4_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_5_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_357_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_1_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_2_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_3_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_1_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_2_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_1_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
{ }, /* Optional parameter entry */
{ } /* Terminating entry */
};
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1326,3 +1326,40 @@
* Manufacturer: Cressi
*/
#define FTDI_CRESSI_PID 0x87d0
+
+/*
+ * Brainboxes devices
+ */
+#define BRAINBOXES_VID 0x05d1
+#define BRAINBOXES_VX_001_PID 0x1001 /* VX-001 ExpressCard 1 Port RS232 */
+#define BRAINBOXES_VX_012_PID 0x1002 /* VX-012 ExpressCard 2 Port RS232 */
+#define BRAINBOXES_VX_023_PID 0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */
+#define BRAINBOXES_VX_034_PID 0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */
+#define BRAINBOXES_US_101_PID 0x1011 /* US-101 1xRS232 */
+#define BRAINBOXES_US_324_PID 0x1013 /* US-324 1xRS422/485 1Mbaud */
+#define BRAINBOXES_US_606_1_PID 0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */
+#define BRAINBOXES_US_606_2_PID 0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */
+#define BRAINBOXES_US_606_3_PID 0x2003 /* US-606 6 Port RS232 Serial Port 4 and 6 */
+#define BRAINBOXES_US_701_1_PID 0x2011 /* US-701 4xRS232 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_701_2_PID 0x2012 /* US-701 4xRS422 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_279_1_PID 0x2021 /* US-279 8xRS422 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_279_2_PID 0x2022 /* US-279 8xRS422 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_279_3_PID 0x2023 /* US-279 8xRS422 1Mbaud Port 5 and 6 */
+#define BRAINBOXES_US_279_4_PID 0x2024 /* US-279 8xRS422 1Mbaud Port 7 and 8 */
+#define BRAINBOXES_US_346_1_PID 0x3011 /* US-346 4xRS422/485 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_346_2_PID 0x3012 /* US-346 4xRS422/485 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_257_PID 0x5001 /* US-257 2xRS232 1Mbaud */
+#define BRAINBOXES_US_313_PID 0x6001 /* US-313 2xRS422/485 1Mbaud */
+#define BRAINBOXES_US_357_PID 0x7001 /* US_357 1xRS232/422/485 */
+#define BRAINBOXES_US_842_1_PID 0x8001 /* US-842 8xRS422/485 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_842_2_PID 0x8002 /* US-842 8xRS422/485 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_842_3_PID 0x8003 /* US-842 8xRS422/485 1Mbaud Port 5 and 6 */
+#define BRAINBOXES_US_842_4_PID 0x8004 /* US-842 8xRS422/485 1Mbaud Port 7 and 8 */
+#define BRAINBOXES_US_160_1_PID 0x9001 /* US-160 16xRS232 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_160_2_PID 0x9002 /* US-160 16xRS232 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_160_3_PID 0x9003 /* US-160 16xRS232 1Mbaud Port 5 and 6 */
+#define BRAINBOXES_US_160_4_PID 0x9004 /* US-160 16xRS232 1Mbaud Port 7 and 8 */
+#define BRAINBOXES_US_160_5_PID 0x9005 /* US-160 16xRS232 1Mbaud Port 9 and 10 */
+#define BRAINBOXES_US_160_6_PID 0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */
+#define BRAINBOXES_US_160_7_PID 0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */
+#define BRAINBOXES_US_160_8_PID 0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 006/214] usb: option driver, add support for Telit UE910v2
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 005/214] USB: serial: ftdi_sio: add id for Brainboxes serial cards Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 007/214] Revert "USB: serial: add usbid for dell wwan card to sierra.c" Greg Kroah-Hartman
` (210 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Daniele Palmas, Johan Hovold
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <dnlplm@gmail.com>
commit d6de486bc22255779bd54b0fceb4c240962bf146 upstream.
option driver, added VID/PID for Telit UE910v2 modem
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -243,6 +243,7 @@ static void option_instat_callback(struc
#define TELIT_PRODUCT_CC864_DUAL 0x1005
#define TELIT_PRODUCT_CC864_SINGLE 0x1006
#define TELIT_PRODUCT_DE910_DUAL 0x1010
+#define TELIT_PRODUCT_UE910_V2 0x1012
#define TELIT_PRODUCT_LE920 0x1200
/* ZTE PRODUCTS */
@@ -1055,6 +1056,7 @@ static const struct usb_device_id option
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
.driver_info = (kernel_ulong_t)&telit_le920_blacklist },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 007/214] Revert "USB: serial: add usbid for dell wwan card to sierra.c"
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 006/214] usb: option driver, add support for Telit UE910v2 Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 008/214] USB: io_ti: fix firmware download on big-endian machines Greg Kroah-Hartman
` (209 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Richard Farina, Johan Hovold
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit 2e01280d2801c72878cf3a7119eac30077b463d5 upstream.
This reverts commit 1ebca9dad5abe8b2ed4dbd186cd657fb47c1f321.
This device was erroneously added to the sierra driver even though it's
not a Sierra device and was already handled by the option driver.
Cc: Richard Farina <sidhayn@gmail.com>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/sierra.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -305,7 +305,6 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(0x0f3d, 0x68A3), /* Airprime/Sierra Wireless Direct IP modems */
.driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
},
- { USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */
{ }
};
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 008/214] USB: io_ti: fix firmware download on big-endian machines
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 007/214] Revert "USB: serial: add usbid for dell wwan card to sierra.c" Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 009/214] usb: option: add Olivetti Olicard 500 Greg Kroah-Hartman
` (208 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ludovic Drolez, Johan Hovold
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit 5509076d1b4485ce9fb07705fcbcd2695907ab5b upstream.
During firmware download the device expects memory addresses in
big-endian byte order. As the wIndex parameter which hold the address is
sent in little-endian byte order regardless of host byte order, we need
to use swab16 rather than cpu_to_be16.
Also make sure to handle the struct ti_i2c_desc size parameter which is
returned in little-endian byte order.
Reported-by: Ludovic Drolez <ldrolez@debian.org>
Tested-by: Ludovic Drolez <ldrolez@debian.org>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/io_ti.c | 50 +++++++++++++++++++++++++++++----------------
1 file changed, 33 insertions(+), 17 deletions(-)
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -29,6 +29,7 @@
#include <linux/spinlock.h>
#include <linux/mutex.h>
#include <linux/serial.h>
+#include <linux/swab.h>
#include <linux/kfifo.h>
#include <linux/ioctl.h>
#include <linux/firmware.h>
@@ -298,7 +299,7 @@ static int read_download_mem(struct usb_
{
int status = 0;
__u8 read_length;
- __be16 be_start_address;
+ u16 be_start_address;
dbg("%s - @ %x for %d", __func__, start_address, length);
@@ -315,10 +316,14 @@ static int read_download_mem(struct usb_
dbg("%s - @ %x for %d", __func__,
start_address, read_length);
}
- be_start_address = cpu_to_be16(start_address);
+ /*
+ * NOTE: Must use swab as wIndex is sent in little-endian
+ * byte order regardless of host byte order.
+ */
+ be_start_address = swab16((u16)start_address);
status = ti_vread_sync(dev, UMPC_MEMORY_READ,
(__u16)address_type,
- (__force __u16)be_start_address,
+ be_start_address,
buffer, read_length);
if (status) {
@@ -418,7 +423,7 @@ static int write_i2c_mem(struct edgeport
{
int status = 0;
int write_length;
- __be16 be_start_address;
+ u16 be_start_address;
/* We can only send a maximum of 1 aligned byte page at a time */
@@ -434,11 +439,16 @@ static int write_i2c_mem(struct edgeport
usb_serial_debug_data(debug, &serial->serial->dev->dev,
__func__, write_length, buffer);
- /* Write first page */
- be_start_address = cpu_to_be16(start_address);
+ /*
+ * Write first page.
+ *
+ * NOTE: Must use swab as wIndex is sent in little-endian byte order
+ * regardless of host byte order.
+ */
+ be_start_address = swab16((u16)start_address);
status = ti_vsend_sync(serial->serial->dev,
UMPC_MEMORY_WRITE, (__u16)address_type,
- (__force __u16)be_start_address,
+ be_start_address,
buffer, write_length);
if (status) {
dbg("%s - ERROR %d", __func__, status);
@@ -462,11 +472,16 @@ static int write_i2c_mem(struct edgeport
usb_serial_debug_data(debug, &serial->serial->dev->dev,
__func__, write_length, buffer);
- /* Write next page */
- be_start_address = cpu_to_be16(start_address);
+ /*
+ * Write next page.
+ *
+ * NOTE: Must use swab as wIndex is sent in little-endian byte
+ * order regardless of host byte order.
+ */
+ be_start_address = swab16((u16)start_address);
status = ti_vsend_sync(serial->serial->dev, UMPC_MEMORY_WRITE,
(__u16)address_type,
- (__force __u16)be_start_address,
+ be_start_address,
buffer, write_length);
if (status) {
dev_err(&serial->serial->dev->dev, "%s - ERROR %d\n",
@@ -673,8 +688,8 @@ static int get_descriptor_addr(struct ed
if (rom_desc->Type == desc_type)
return start_address;
- start_address = start_address + sizeof(struct ti_i2c_desc)
- + rom_desc->Size;
+ start_address = start_address + sizeof(struct ti_i2c_desc) +
+ le16_to_cpu(rom_desc->Size);
} while ((start_address < TI_MAX_I2C_SIZE) && rom_desc->Type);
@@ -687,7 +702,7 @@ static int valid_csum(struct ti_i2c_desc
__u16 i;
__u8 cs = 0;
- for (i = 0; i < rom_desc->Size; i++)
+ for (i = 0; i < le16_to_cpu(rom_desc->Size); i++)
cs = (__u8)(cs + buffer[i]);
if (cs != rom_desc->CheckSum) {
@@ -741,7 +756,7 @@ static int check_i2c_image(struct edgepo
break;
if ((start_address + sizeof(struct ti_i2c_desc) +
- rom_desc->Size) > TI_MAX_I2C_SIZE) {
+ le16_to_cpu(rom_desc->Size)) > TI_MAX_I2C_SIZE) {
status = -ENODEV;
dbg("%s - structure too big, erroring out.", __func__);
break;
@@ -756,7 +771,8 @@ static int check_i2c_image(struct edgepo
/* Read the descriptor data */
status = read_rom(serial, start_address +
sizeof(struct ti_i2c_desc),
- rom_desc->Size, buffer);
+ le16_to_cpu(rom_desc->Size),
+ buffer);
if (status)
break;
@@ -765,7 +781,7 @@ static int check_i2c_image(struct edgepo
break;
}
start_address = start_address + sizeof(struct ti_i2c_desc) +
- rom_desc->Size;
+ le16_to_cpu(rom_desc->Size);
} while ((rom_desc->Type != I2C_DESC_TYPE_ION) &&
(start_address < TI_MAX_I2C_SIZE));
@@ -804,7 +820,7 @@ static int get_manuf_info(struct edgepor
/* Read the descriptor data */
status = read_rom(serial, start_address+sizeof(struct ti_i2c_desc),
- rom_desc->Size, buffer);
+ le16_to_cpu(rom_desc->Size), buffer);
if (status)
goto exit;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 009/214] usb: option: add Olivetti Olicard 500
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 008/214] USB: io_ti: fix firmware download on big-endian machines Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 010/214] usb: option: add Alcatel L800MA Greg Kroah-Hartman
` (207 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Julio Araujo, Bjørn Mork
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <bjorn@mork.no>
commit 533b3994610f316e5cd61b56d0c4daa15c830f89 upstream.
Device interface layout:
0: ff/ff/ff - serial
1: ff/ff/ff - serial AT+PPP
2: 08/06/50 - storage
3: ff/ff/ff - serial
4: ff/ff/ff - QMI/wwan
Reported-by: Julio Araujo <julio.araujo@wllctel.com.br>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -354,6 +354,7 @@ static void option_instat_callback(struc
#define OLIVETTI_PRODUCT_OLICARD100 0xc000
#define OLIVETTI_PRODUCT_OLICARD145 0xc003
#define OLIVETTI_PRODUCT_OLICARD200 0xc005
+#define OLIVETTI_PRODUCT_OLICARD500 0xc00b
/* Celot products */
#define CELOT_VENDOR_ID 0x211f
@@ -1565,6 +1566,9 @@ static const struct usb_device_id option
{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
.driver_info = (kernel_ulong_t)&net_intf6_blacklist
},
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist
+ },
{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
{ USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 010/214] usb: option: add Alcatel L800MA
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 009/214] usb: option: add Olivetti Olicard 500 Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 011/214] usb: option: add and update a number of CMOTech devices Greg Kroah-Hartman
` (206 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bjørn Mork
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <bjorn@mork.no>
commit dd6b48ecec2ea7d15f28d5e5474388681899a5e1 upstream.
Device interface layout:
0: ff/ff/ff - serial
1: ff/00/00 - serial AT+PPP
2: ff/ff/ff - QMI/wwan
3: 08/06/50 - storage
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -292,6 +292,7 @@ static void option_instat_callback(struc
#define ALCATEL_PRODUCT_X060S_X200 0x0000
#define ALCATEL_PRODUCT_X220_X500D 0x0017
#define ALCATEL_PRODUCT_L100V 0x011e
+#define ALCATEL_PRODUCT_L800MA 0x0203
#define PIRELLI_VENDOR_ID 0x1266
#define PIRELLI_PRODUCT_C100_1 0x1002
@@ -1521,6 +1522,8 @@ static const struct usb_device_id option
.driver_info = (kernel_ulong_t)&net_intf5_blacklist },
{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V),
.driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L800MA),
+ .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
{ USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
{ USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
{ USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 011/214] usb: option: add and update a number of CMOTech devices
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 010/214] usb: option: add Alcatel L800MA Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 012/214] drm/vmwgfx: correct fb_fix_screeninfo.line_length Greg Kroah-Hartman
` (205 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lars Melin, Bjørn Mork
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <bjorn@mork.no>
commit 34f972d6156fe9eea2ab7bb418c71f9d1d5c8e7b upstream.
A number of older CMOTech modems are based on Qualcomm
chips. The blacklisted interfaces are QMI/wwan.
Reported-by: Lars Melin <larsm17@gmail.com>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 74 +++++++++++++++++++++++++++++++++++++++++---
1 file changed, 70 insertions(+), 4 deletions(-)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -234,8 +234,31 @@ static void option_instat_callback(struc
#define QUALCOMM_VENDOR_ID 0x05C6
#define CMOTECH_VENDOR_ID 0x16d8
-#define CMOTECH_PRODUCT_6008 0x6008
-#define CMOTECH_PRODUCT_6280 0x6280
+#define CMOTECH_PRODUCT_6001 0x6001
+#define CMOTECH_PRODUCT_CMU_300 0x6002
+#define CMOTECH_PRODUCT_6003 0x6003
+#define CMOTECH_PRODUCT_6004 0x6004
+#define CMOTECH_PRODUCT_6005 0x6005
+#define CMOTECH_PRODUCT_CGU_628A 0x6006
+#define CMOTECH_PRODUCT_CHE_628S 0x6007
+#define CMOTECH_PRODUCT_CMU_301 0x6008
+#define CMOTECH_PRODUCT_CHU_628 0x6280
+#define CMOTECH_PRODUCT_CHU_628S 0x6281
+#define CMOTECH_PRODUCT_CDU_680 0x6803
+#define CMOTECH_PRODUCT_CDU_685A 0x6804
+#define CMOTECH_PRODUCT_CHU_720S 0x7001
+#define CMOTECH_PRODUCT_7002 0x7002
+#define CMOTECH_PRODUCT_CHU_629K 0x7003
+#define CMOTECH_PRODUCT_7004 0x7004
+#define CMOTECH_PRODUCT_7005 0x7005
+#define CMOTECH_PRODUCT_CGU_629 0x7006
+#define CMOTECH_PRODUCT_CHU_629S 0x700a
+#define CMOTECH_PRODUCT_CHU_720I 0x7211
+#define CMOTECH_PRODUCT_7212 0x7212
+#define CMOTECH_PRODUCT_7213 0x7213
+#define CMOTECH_PRODUCT_7251 0x7251
+#define CMOTECH_PRODUCT_7252 0x7252
+#define CMOTECH_PRODUCT_7253 0x7253
#define TELIT_VENDOR_ID 0x1bc7
#define TELIT_PRODUCT_UC864E 0x1003
@@ -517,6 +540,10 @@ static const struct option_blacklist_inf
.reserved = BIT(1) | BIT(2),
};
+static const struct option_blacklist_info net_intf0_blacklist = {
+ .reserved = BIT(0),
+};
+
static const struct option_blacklist_info net_intf1_blacklist = {
.reserved = BIT(1),
};
@@ -1051,8 +1078,47 @@ static const struct usb_device_id option
{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
- { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
- { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
+ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6004) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6005) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_628A) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHE_628S),
+ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_301),
+ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628),
+ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628S) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_680) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_685A) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720S),
+ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7002),
+ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629K),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7004),
+ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7005) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_629),
+ .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629S),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720I),
+ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7212),
+ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7213),
+ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7251),
+ .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7252),
+ .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7253),
+ .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 012/214] drm/vmwgfx: correct fb_fix_screeninfo.line_length
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 011/214] usb: option: add and update a number of CMOTech devices Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 013/214] drm/radeon: call drm_edid_to_eld when we update the edid Greg Kroah-Hartman
` (204 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christopher Friedt, Thomas Hellstrom
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher Friedt <chrisfriedt@gmail.com>
commit aa6de142c901cd2d90ef08db30ae87da214bedcc upstream.
Previously, the vmwgfx_fb driver would allow users to call FBIOSET_VINFO, but it would not adjust
the FINFO properly, resulting in distorted screen rendering. The patch corrects that behaviour.
See https://bugs.gentoo.org/show_bug.cgi?id=494794 for examples.
Signed-off-by: Christopher Friedt <chrisfriedt@gmail.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -147,7 +147,7 @@ static int vmw_fb_check_var(struct fb_va
}
if (!vmw_kms_validate_mode_vram(vmw_priv,
- info->fix.line_length,
+ var->xres * var->bits_per_pixel/8,
var->yoffset + var->yres)) {
DRM_ERROR("Requested geom can not fit in framebuffer\n");
return -EINVAL;
@@ -162,6 +162,8 @@ static int vmw_fb_set_par(struct fb_info
struct vmw_private *vmw_priv = par->vmw_priv;
int ret;
+ info->fix.line_length = info->var.xres * info->var.bits_per_pixel/8;
+
ret = vmw_kms_write_svga(vmw_priv, info->var.xres, info->var.yres,
info->fix.line_length,
par->bpp, par->depth);
@@ -177,6 +179,7 @@ static int vmw_fb_set_par(struct fb_info
vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset);
vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
+ vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length);
vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 013/214] drm/radeon: call drm_edid_to_eld when we update the edid
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 012/214] drm/vmwgfx: correct fb_fix_screeninfo.line_length Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 014/214] list: introduce list_next_entry() and list_prev_entry() Greg Kroah-Hartman
` (203 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Deucher, Christian König
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexdeucher@gmail.com>
commit 16086279353cbfecbb3ead474072dced17b97ddc upstream.
This needs to be done to update some of the fields in
the connector structure used by the audio code.
Noticed by several users on irc.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_display.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -750,6 +750,7 @@ int radeon_ddc_get_modes(struct radeon_c
if (radeon_connector->edid) {
drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid);
ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid);
+ drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid);
return ret;
}
drm_mode_connector_update_edid_property(&radeon_connector->base, NULL);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 014/214] list: introduce list_next_entry() and list_prev_entry()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 013/214] drm/radeon: call drm_edid_to_eld when we update the edid Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 015/214] net: sctp: wake up all assocs if sndbuf policy is per socket Greg Kroah-Hartman
` (202 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleg Nesterov, Eilon Greenstein,
Peter Zijlstra, Andrew Morton, Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
[ Upstream commit 008208c6b26f21c2648c250a09c55e737c02c5f8 ]
Add two trivial helpers list_next_entry() and list_prev_entry(), they
can have a lot of users including list.h itself. In fact the 1st one is
already defined in events/core.c and bnx2x_sp.c, so the patch simply
moves the definition to list.h.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: Eilon Greenstein <eilong@broadcom.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c | 3 ---
include/linux/list.h | 16 ++++++++++++++++
kernel/events/core.c | 3 ---
3 files changed, 16 insertions(+), 6 deletions(-)
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -1030,9 +1030,6 @@ static void bnx2x_set_one_vlan_mac_e1h(s
ETH_VLAN_FILTER_CLASSIFY, config);
}
-#define list_next_entry(pos, member) \
- list_entry((pos)->member.next, typeof(*(pos)), member)
-
/**
* bnx2x_vlan_mac_restore - reconfigure next MAC/VLAN/VLAN-MAC element
*
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -362,6 +362,22 @@ static inline void list_splice_tail_init
list_entry((ptr)->next, type, member)
/**
+ * list_next_entry - get the next element in list
+ * @pos: the type * to cursor
+ * @member: the name of the list_struct within the struct.
+ */
+#define list_next_entry(pos, member) \
+ list_entry((pos)->member.next, typeof(*(pos)), member)
+
+/**
+ * list_prev_entry - get the prev element in list
+ * @pos: the type * to cursor
+ * @member: the name of the list_struct within the struct.
+ */
+#define list_prev_entry(pos, member) \
+ list_entry((pos)->member.prev, typeof(*(pos)), member)
+
+/**
* list_for_each - iterate over a list
* @pos: the &struct list_head to use as a loop cursor.
* @head: the head for your list.
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1973,9 +1973,6 @@ static void __perf_event_sync_stat(struc
perf_event_update_userpage(next_event);
}
-#define list_next_entry(pos, member) \
- list_entry(pos->member.next, typeof(*pos), member)
-
static void perf_event_sync_stat(struct perf_event_context *ctx,
struct perf_event_context *next_ctx)
{
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 015/214] net: sctp: wake up all assocs if sndbuf policy is per socket
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 014/214] list: introduce list_next_entry() and list_prev_entry() Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 016/214] net: sctp: test if association is dead in sctp_wake_up_waiters Greg Kroah-Hartman
` (201 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Borkmann, Thomas Graf,
Neil Horman, Vlad Yasevich, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <dborkman@redhat.com>
[ Upstream commit 52c35befb69b005c3fc5afdaae3a5717ad013411 ]
SCTP charges chunks for wmem accounting via skb->truesize in
sctp_set_owner_w(), and sctp_wfree() respectively as the
reverse operation. If a sender runs out of wmem, it needs to
wait via sctp_wait_for_sndbuf(), and gets woken up by a call
to __sctp_write_space() mostly via sctp_wfree().
__sctp_write_space() is being called per association. Although
we assign sk->sk_write_space() to sctp_write_space(), which
is then being done per socket, it is only used if send space
is increased per socket option (SO_SNDBUF), as SOCK_USE_WRITE_QUEUE
is set and therefore not invoked in sock_wfree().
Commit 4c3a5bdae293 ("sctp: Don't charge for data in sndbuf
again when transmitting packet") fixed an issue where in case
sctp_packet_transmit() manages to queue up more than sndbuf
bytes, sctp_wait_for_sndbuf() will never be woken up again
unless it is interrupted by a signal. However, a still
remaining issue is that if net.sctp.sndbuf_policy=0, that is
accounting per socket, and one-to-many sockets are in use,
the reclaimed write space from sctp_wfree() is 'unfairly'
handed back on the server to the association that is the lucky
one to be woken up again via __sctp_write_space(), while
the remaining associations are never be woken up again
(unless by a signal).
The effect disappears with net.sctp.sndbuf_policy=1, that
is wmem accounting per association, as it guarantees a fair
share of wmem among associations.
Therefore, if we have reclaimed memory in case of per socket
accounting, wake all related associations to a socket in a
fair manner, that is, traverse the socket association list
starting from the current neighbour of the association and
issue a __sctp_write_space() to everyone until we end up
waking ourselves. This guarantees that no association is
preferred over another and even if more associations are
taken into the one-to-many session, all receivers will get
messages from the server and are not stalled forever on
high load. This setting still leaves the advantage of per
socket accounting in touch as an association can still use
up global limits if unused by others.
Fixes: 4eb701dfc618 ("[SCTP] Fix SCTP sendbuffer accouting.")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Thomas Graf <tgraf@suug.ch>
Cc: Neil Horman <nhorman@tuxdriver.com>
Cc: Vlad Yasevich <vyasevic@redhat.com>
Acked-by: Vlad Yasevich <vyasevic@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/socket.c | 36 +++++++++++++++++++++++++++++++++++-
1 file changed, 35 insertions(+), 1 deletion(-)
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6369,6 +6369,40 @@ static void __sctp_write_space(struct sc
}
}
+static void sctp_wake_up_waiters(struct sock *sk,
+ struct sctp_association *asoc)
+{
+ struct sctp_association *tmp = asoc;
+
+ /* We do accounting for the sndbuf space per association,
+ * so we only need to wake our own association.
+ */
+ if (asoc->ep->sndbuf_policy)
+ return __sctp_write_space(asoc);
+
+ /* Accounting for the sndbuf space is per socket, so we
+ * need to wake up others, try to be fair and in case of
+ * other associations, let them have a go first instead
+ * of just doing a sctp_write_space() call.
+ *
+ * Note that we reach sctp_wake_up_waiters() only when
+ * associations free up queued chunks, thus we are under
+ * lock and the list of associations on a socket is
+ * guaranteed not to change.
+ */
+ for (tmp = list_next_entry(tmp, asocs); 1;
+ tmp = list_next_entry(tmp, asocs)) {
+ /* Manually skip the head element. */
+ if (&tmp->asocs == &((sctp_sk(sk))->ep->asocs))
+ continue;
+ /* Wake up association. */
+ __sctp_write_space(tmp);
+ /* We've reached the end. */
+ if (tmp == asoc)
+ break;
+ }
+}
+
/* Do accounting for the sndbuf space.
* Decrement the used sndbuf space of the corresponding association by the
* data size which was just transmitted(freed).
@@ -6396,7 +6430,7 @@ static void sctp_wfree(struct sk_buff *s
sk_mem_uncharge(sk, skb->truesize);
sock_wfree(skb);
- __sctp_write_space(asoc);
+ sctp_wake_up_waiters(sk, asoc);
sctp_association_put(asoc);
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 016/214] net: sctp: test if association is dead in sctp_wake_up_waiters
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 015/214] net: sctp: wake up all assocs if sndbuf policy is per socket Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 017/214] l2tp: take PMTU from tunnel UDP socket Greg Kroah-Hartman
` (200 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Borkmann, Vlad Yasevich,
Neil Horman, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <dborkman@redhat.com>
[ Upstream commit 1e1cdf8ac78793e0875465e98a648df64694a8d0 ]
In function sctp_wake_up_waiters(), we need to involve a test
if the association is declared dead. If so, we don't have any
reference to a possible sibling association anymore and need
to invoke sctp_write_space() instead, and normally walk the
socket's associations and notify them of new wmem space. The
reason for special casing is that otherwise, we could run
into the following issue when a sctp_primitive_SEND() call
from sctp_sendmsg() fails, and tries to flush an association's
outq, i.e. in the following way:
sctp_association_free()
`-> list_del(&asoc->asocs) <-- poisons list pointer
asoc->base.dead = true
sctp_outq_free(&asoc->outqueue)
`-> __sctp_outq_teardown()
`-> sctp_chunk_free()
`-> consume_skb()
`-> sctp_wfree()
`-> sctp_wake_up_waiters() <-- dereferences poisoned pointers
if asoc->ep->sndbuf_policy=0
Therefore, only walk the list in an 'optimized' way if we find
that the current association is still active. We could also use
list_del_init() in addition when we call sctp_association_free(),
but as Vlad suggests, we want to trap such bugs and thus leave
it poisoned as is.
Why is it safe to resolve the issue by testing for asoc->base.dead?
Parallel calls to sctp_sendmsg() are protected under socket lock,
that is lock_sock()/release_sock(). Only within that path under
lock held, we're setting skb/chunk owner via sctp_set_owner_w().
Eventually, chunks are freed directly by an association still
under that lock. So when traversing association list on destruction
time from sctp_wake_up_waiters() via sctp_wfree(), a different
CPU can't be running sctp_wfree() while another one calls
sctp_association_free() as both happens under the same lock.
Therefore, this can also not race with setting/testing against
asoc->base.dead as we are guaranteed for this to happen in order,
under lock. Further, Vlad says: the times we check asoc->base.dead
is when we've cached an association pointer for later processing.
In between cache and processing, the association may have been
freed and is simply still around due to reference counts. We check
asoc->base.dead under a lock, so it should always be safe to check
and not race against sctp_association_free(). Stress-testing seems
fine now, too.
Fixes: cd253f9f357d ("net: sctp: wake up all assocs if sndbuf policy is per socket")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Vlad Yasevich <vyasevic@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Vlad Yasevich <vyasevic@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/socket.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6380,6 +6380,12 @@ static void sctp_wake_up_waiters(struct
if (asoc->ep->sndbuf_policy)
return __sctp_write_space(asoc);
+ /* If association goes down and is just flushing its
+ * outq, then just normally notify others.
+ */
+ if (asoc->base.dead)
+ return sctp_write_space(sk);
+
/* Accounting for the sndbuf space is per socket, so we
* need to wake up others, try to be fair and in case of
* other associations, let them have a go first instead
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 017/214] l2tp: take PMTU from tunnel UDP socket
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 016/214] net: sctp: test if association is dead in sctp_wake_up_waiters Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 018/214] net: core: dont account for udp header size when computing seglen Greg Kroah-Hartman
` (199 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Petukhov, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Petukhov <dmgenp@gmail.com>
[ Upstream commit f34c4a35d87949fbb0e0f31eba3c054e9f8199ba ]
When l2tp driver tries to get PMTU for the tunnel destination, it uses
the pointer to struct sock that represents PPPoX socket, while it
should use the pointer that represents UDP socket of the tunnel.
Signed-off-by: Dmitry Petukhov <dmgenp@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/l2tp/l2tp_ppp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -772,9 +772,9 @@ static int pppol2tp_connect(struct socke
session->deref = pppol2tp_session_sock_put;
/* If PMTU discovery was enabled, use the MTU that was discovered */
- dst = sk_dst_get(sk);
+ dst = sk_dst_get(tunnel->sock);
if (dst != NULL) {
- u32 pmtu = dst_mtu(__sk_dst_get(sk));
+ u32 pmtu = dst_mtu(__sk_dst_get(tunnel->sock));
if (pmtu != 0)
session->mtu = session->mru = pmtu -
PPPOL2TP_HEADER_OVERHEAD;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 018/214] net: core: dont account for udp header size when computing seglen
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 017/214] l2tp: take PMTU from tunnel UDP socket Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 019/214] bonding: Remove debug_fs files when module init fails Greg Kroah-Hartman
` (198 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Tobias Brunner,
Florian Westphal, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 6d39d589bb76ee8a1c6cde6822006ae0053decff ]
In case of tcp, gso_size contains the tcpmss.
For UFO (udp fragmentation offloading) skbs, gso_size is the fragment
payload size, i.e. we must not account for udp header size.
Otherwise, when using virtio drivers, a to-be-forwarded UFO GSO packet
will be needlessly fragmented in the forward path, because we think its
individual segments are too large for the outgoing link.
Fixes: fe6cc55f3a9a053 ("net: ip, ipv6: handle gso skbs in forwarding path")
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Reported-by: Tobias Brunner <tobias@strongswan.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/skbuff.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3297,12 +3297,14 @@ EXPORT_SYMBOL(__skb_warn_lro_forwarding)
unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
{
const struct skb_shared_info *shinfo = skb_shinfo(skb);
- unsigned int hdr_len;
if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
- hdr_len = tcp_hdrlen(skb);
- else
- hdr_len = sizeof(struct udphdr);
- return hdr_len + shinfo->gso_size;
+ return tcp_hdrlen(skb) + shinfo->gso_size;
+
+ /* UFO sets gso_size to the size of the fragmentation
+ * payload, i.e. the size of the L4 (UDP) header is already
+ * accounted for.
+ */
+ return shinfo->gso_size;
}
EXPORT_SYMBOL_GPL(skb_gso_transport_seglen);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 019/214] bonding: Remove debug_fs files when module init fails
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 018/214] net: core: dont account for udp header size when computing seglen Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 020/214] ipv6: Limit mtu to 65575 bytes Greg Kroah-Hartman
` (197 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Richter, Jay Vosburgh,
David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <tmricht@linux.vnet.ibm.com>
[ Upstream commit db29868653394937037d71dc3545768302dda643 ]
Remove the bonding debug_fs entries when the
module initialization fails. The debug_fs
entries should be removed together with all other
already allocated resources.
Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com>
Signed-off-by: Jay Vosburgh <j.vosburgh@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/bonding/bond_main.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4930,6 +4930,7 @@ static int __init bonding_init(void)
out:
return res;
err:
+ bond_destroy_debugfs();
rtnl_link_unregister(&bond_link_ops);
err_link:
unregister_pernet_subsys(&bond_net_ops);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 020/214] ipv6: Limit mtu to 65575 bytes
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 019/214] bonding: Remove debug_fs files when module init fails Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 021/214] net: ipv4: current group_info should be put after using Greg Kroah-Hartman
` (196 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Francois WELLENREITER, Eric Dumazet,
YOSHIFUJI Hideaki, Hannes Frederic Sowa, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 30f78d8ebf7f514801e71b88a10c948275168518 ]
Francois reported that setting big mtu on loopback device could prevent
tcp sessions making progress.
We do not support (yet ?) IPv6 Jumbograms and cook corrupted packets.
We must limit the IPv6 MTU to (65535 + 40) bytes in theory.
Tested:
ifconfig lo mtu 70000
netperf -H ::1
Before patch : Throughput : 0.05 Mbits
After patch : Throughput : 35484 Mbits
Reported-by: Francois WELLENREITER <f.wellenreiter@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/ip6_route.h | 5 +++++
net/ipv6/route.c | 5 +++--
2 files changed, 8 insertions(+), 2 deletions(-)
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -34,6 +34,11 @@ struct route_info {
#define RT6_LOOKUP_F_SRCPREF_PUBLIC 0x00000010
#define RT6_LOOKUP_F_SRCPREF_COA 0x00000020
+/* We do not (yet ?) support IPv6 jumbograms (RFC 2675)
+ * Unlike IPv4, hdr->seg_len doesn't include the IPv6 header
+ */
+#define IP6_MAX_MTU (0xFFFF + sizeof(struct ipv6hdr))
+
/*
* rt6_srcprefs2flags() and rt6_flags2srcprefs() translate
* between IPV6_ADDR_PREFERENCES socket option values
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1092,7 +1092,7 @@ static unsigned int ip6_mtu(const struct
unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
if (mtu)
- return mtu;
+ goto out;
mtu = IPV6_MIN_MTU;
@@ -1102,7 +1102,8 @@ static unsigned int ip6_mtu(const struct
mtu = idev->cnf.mtu6;
rcu_read_unlock();
- return mtu;
+out:
+ return min_t(unsigned int, mtu, IP6_MAX_MTU);
}
static struct dst_entry *icmp6_dst_gc_list;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 021/214] net: ipv4: current group_info should be put after using.
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 020/214] ipv6: Limit mtu to 65575 bytes Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 022/214] filter: prevent nla extensions to peek beyond the end of the message Greg Kroah-Hartman
` (195 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chuansheng Liu, Zhang Dongxing,
xiaoming wang, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Wang, Xiaoming" <xiaoming.wang@intel.com>
[ Upstream commit b04c46190219a4f845e46a459e3102137b7f6cac ]
Plug a group_info refcount leak in ping_init.
group_info is only needed during initialization and
the code failed to release the reference on exit.
While here move grabbing the reference to a place
where it is actually needed.
Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ping.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -203,26 +203,33 @@ static int ping_init_sock(struct sock *s
struct net *net = sock_net(sk);
gid_t group = current_egid();
gid_t range[2];
- struct group_info *group_info = get_current_groups();
- int i, j, count = group_info->ngroups;
+ struct group_info *group_info;
+ int i, j, count;
+ int ret = 0;
inet_get_ping_group_range_net(net, range, range+1);
if (range[0] <= group && group <= range[1])
return 0;
+ group_info = get_current_groups();
+ count = group_info->ngroups;
for (i = 0; i < group_info->nblocks; i++) {
int cp_count = min_t(int, NGROUPS_PER_BLOCK, count);
for (j = 0; j < cp_count; j++) {
group = group_info->blocks[i][j];
if (range[0] <= group && group <= range[1])
- return 0;
+ goto out_release_group;
}
count -= cp_count;
}
- return -EACCES;
+ ret = -EACCES;
+
+out_release_group:
+ put_group_info(group_info);
+ return ret;
}
static void ping_close(struct sock *sk, long timeout)
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 022/214] filter: prevent nla extensions to peek beyond the end of the message
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 021/214] net: ipv4: current group_info should be put after using Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 13:33 ` Luis Henriques
2014-06-05 4:16 ` [PATCH 3.4 023/214] tg3: update rx_jumbo_pending ring param only when jumbo frames are enabled Greg Kroah-Hartman
` (194 subsequent siblings)
216 siblings, 1 reply; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Patrick McHardy, Pablo Neira Ayuso,
Mathias Krause, Daniel Borkmann, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <minipli@googlemail.com>
[ Upstream commit 05ab8f2647e4221cbdb3856dd7d32bd5407316b3 ]
The BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extensions fail to check
for a minimal message length before testing the supplied offset to be
within the bounds of the message. This allows the subtraction of the nla
header to underflow and therefore -- as the data type is unsigned --
allowing far to big offset and length values for the search of the
netlink attribute.
The remainder calculation for the BPF_S_ANC_NLATTR_NEST extension is
also wrong. It has the minuend and subtrahend mixed up, therefore
calculates a huge length value, allowing to overrun the end of the
message while looking for the netlink attribute.
The following three BPF snippets will trigger the bugs when attached to
a UNIX datagram socket and parsing a message with length 1, 2 or 3.
,-[ PoC for missing size check in BPF_S_ANC_NLATTR ]--
| ld #0x87654321
| ldx #42
| ld #nla
| ret a
`---
,-[ PoC for the same bug in BPF_S_ANC_NLATTR_NEST ]--
| ld #0x87654321
| ldx #42
| ld #nlan
| ret a
`---
,-[ PoC for wrong remainder calculation in BPF_S_ANC_NLATTR_NEST ]--
| ; (needs a fake netlink header at offset 0)
| ld #0
| ldx #42
| ld #nlan
| ret a
`---
Fix the first issue by ensuring the message length fulfills the minimal
size constrains of a nla header. Fix the second bug by getting the math
for the remainder calculation right.
Fixes: 4738c1db15 ("[SKFILTER]: Add SKF_ADF_NLATTR instruction")
Fixes: d214c7537b ("filter: add SKF_AD_NLATTR_NEST to look for nested..")
Cc: Patrick McHardy <kaber@trash.net>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/filter.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -338,11 +338,15 @@ load_b:
if (skb_is_nonlinear(skb))
return 0;
+ if (skb->len < sizeof(struct nlattr))
+ return 0;
+ if (skb->len < sizeof(struct nlattr))
+ return 0;
if (A > skb->len - sizeof(struct nlattr))
return 0;
nla = (struct nlattr *)&skb->data[A];
- if (nla->nla_len > A - skb->len)
+ if (nla->nla_len > skb->len - A)
return 0;
nla = nla_find_nested(nla, X);
^ permalink raw reply [flat|nested] 234+ messages in thread* Re: [PATCH 3.4 022/214] filter: prevent nla extensions to peek beyond the end of the message
2014-06-05 4:16 ` [PATCH 3.4 022/214] filter: prevent nla extensions to peek beyond the end of the message Greg Kroah-Hartman
@ 2014-06-05 13:33 ` Luis Henriques
0 siblings, 0 replies; 234+ messages in thread
From: Luis Henriques @ 2014-06-05 13:33 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Patrick McHardy, Pablo Neira Ayuso,
Mathias Krause, Daniel Borkmann, David S. Miller, Ben Hutchings
On Wed, Jun 04, 2014 at 09:16:25PM -0700, Greg Kroah-Hartman wrote:
> 3.4-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Mathias Krause <minipli@googlemail.com>
>
> [ Upstream commit 05ab8f2647e4221cbdb3856dd7d32bd5407316b3 ]
>
> The BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extensions fail to check
> for a minimal message length before testing the supplied offset to be
> within the bounds of the message. This allows the subtraction of the nla
> header to underflow and therefore -- as the data type is unsigned --
> allowing far to big offset and length values for the search of the
> netlink attribute.
>
> The remainder calculation for the BPF_S_ANC_NLATTR_NEST extension is
> also wrong. It has the minuend and subtrahend mixed up, therefore
> calculates a huge length value, allowing to overrun the end of the
> message while looking for the netlink attribute.
>
> The following three BPF snippets will trigger the bugs when attached to
> a UNIX datagram socket and parsing a message with length 1, 2 or 3.
>
> ,-[ PoC for missing size check in BPF_S_ANC_NLATTR ]--
> | ld #0x87654321
> | ldx #42
> | ld #nla
> | ret a
> `---
>
> ,-[ PoC for the same bug in BPF_S_ANC_NLATTR_NEST ]--
> | ld #0x87654321
> | ldx #42
> | ld #nlan
> | ret a
> `---
>
> ,-[ PoC for wrong remainder calculation in BPF_S_ANC_NLATTR_NEST ]--
> | ; (needs a fake netlink header at offset 0)
> | ld #0
> | ldx #42
> | ld #nlan
> | ret a
> `---
>
> Fix the first issue by ensuring the message length fulfills the minimal
> size constrains of a nla header. Fix the second bug by getting the math
> for the remainder calculation right.
>
> Fixes: 4738c1db15 ("[SKFILTER]: Add SKF_ADF_NLATTR instruction")
> Fixes: d214c7537b ("filter: add SKF_AD_NLATTR_NEST to look for nested..")
> Cc: Patrick McHardy <kaber@trash.net>
> Cc: Pablo Neira Ayuso <pablo@netfilter.org>
> Signed-off-by: Mathias Krause <minipli@googlemail.com>
> Acked-by: Daniel Borkmann <dborkman@redhat.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> net/core/filter.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -338,11 +338,15 @@ load_b:
>
> if (skb_is_nonlinear(skb))
> return 0;
> + if (skb->len < sizeof(struct nlattr))
> + return 0;
> + if (skb->len < sizeof(struct nlattr))
> + return 0;
There above code is duplicated this backport. The same comment
applies to the 3.2.y backport (I've added Ben to the CC list).
Cheers,
--
Luís
> if (A > skb->len - sizeof(struct nlattr))
> return 0;
>
> nla = (struct nlattr *)&skb->data[A];
> - if (nla->nla_len > A - skb->len)
> + if (nla->nla_len > skb->len - A)
> return 0;
>
> nla = nla_find_nested(nla, X);
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe stable" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 234+ messages in thread* Re: [PATCH 3.4 022/214] filter: prevent nla extensions to peek beyond the end of the message
@ 2014-06-05 13:33 ` Luis Henriques
0 siblings, 0 replies; 234+ messages in thread
From: Luis Henriques @ 2014-06-05 13:33 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Patrick McHardy, Pablo Neira Ayuso,
Mathias Krause, Daniel Borkmann, David S. Miller, Ben Hutchings
On Wed, Jun 04, 2014 at 09:16:25PM -0700, Greg Kroah-Hartman wrote:
> 3.4-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Mathias Krause <minipli@googlemail.com>
>
> [ Upstream commit 05ab8f2647e4221cbdb3856dd7d32bd5407316b3 ]
>
> The BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extensions fail to check
> for a minimal message length before testing the supplied offset to be
> within the bounds of the message. This allows the subtraction of the nla
> header to underflow and therefore -- as the data type is unsigned --
> allowing far to big offset and length values for the search of the
> netlink attribute.
>
> The remainder calculation for the BPF_S_ANC_NLATTR_NEST extension is
> also wrong. It has the minuend and subtrahend mixed up, therefore
> calculates a huge length value, allowing to overrun the end of the
> message while looking for the netlink attribute.
>
> The following three BPF snippets will trigger the bugs when attached to
> a UNIX datagram socket and parsing a message with length 1, 2 or 3.
>
> ,-[ PoC for missing size check in BPF_S_ANC_NLATTR ]--
> | ld #0x87654321
> | ldx #42
> | ld #nla
> | ret a
> `---
>
> ,-[ PoC for the same bug in BPF_S_ANC_NLATTR_NEST ]--
> | ld #0x87654321
> | ldx #42
> | ld #nlan
> | ret a
> `---
>
> ,-[ PoC for wrong remainder calculation in BPF_S_ANC_NLATTR_NEST ]--
> | ; (needs a fake netlink header at offset 0)
> | ld #0
> | ldx #42
> | ld #nlan
> | ret a
> `---
>
> Fix the first issue by ensuring the message length fulfills the minimal
> size constrains of a nla header. Fix the second bug by getting the math
> for the remainder calculation right.
>
> Fixes: 4738c1db15 ("[SKFILTER]: Add SKF_ADF_NLATTR instruction")
> Fixes: d214c7537b ("filter: add SKF_AD_NLATTR_NEST to look for nested..")
> Cc: Patrick McHardy <kaber@trash.net>
> Cc: Pablo Neira Ayuso <pablo@netfilter.org>
> Signed-off-by: Mathias Krause <minipli@googlemail.com>
> Acked-by: Daniel Borkmann <dborkman@redhat.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> net/core/filter.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -338,11 +338,15 @@ load_b:
>
> if (skb_is_nonlinear(skb))
> return 0;
> + if (skb->len < sizeof(struct nlattr))
> + return 0;
> + if (skb->len < sizeof(struct nlattr))
> + return 0;
There above code is duplicated this backport. The same comment
applies to the 3.2.y backport (I've added Ben to the CC list).
Cheers,
--
Lu�s
> if (A > skb->len - sizeof(struct nlattr))
> return 0;
>
> nla = (struct nlattr *)&skb->data[A];
> - if (nla->nla_len > A - skb->len)
> + if (nla->nla_len > skb->len - A)
> return 0;
>
> nla = nla_find_nested(nla, X);
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe stable" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 234+ messages in thread* Re: [PATCH 3.4 022/214] filter: prevent nla extensions to peek beyond the end of the message
2014-06-05 13:33 ` Luis Henriques
(?)
@ 2014-06-05 13:49 ` Mathias Krause
2014-06-05 18:15 ` Greg Kroah-Hartman
-1 siblings, 1 reply; 234+ messages in thread
From: Mathias Krause @ 2014-06-05 13:49 UTC (permalink / raw)
To: Luis Henriques, Greg Kroah-Hartman
Cc: linux-kernel, stable, Patrick McHardy, Pablo Neira Ayuso,
Daniel Borkmann, David S. Miller, Ben Hutchings
[-- Attachment #1: Type: text/plain, Size: 937 bytes --]
On 5 June 2014 15:33, Luis Henriques <luis.henriques@canonical.com> wrote:
> On Wed, Jun 04, 2014 at 09:16:25PM -0700, Greg Kroah-Hartman wrote:
>> 3.4-stable review patch. If anyone has any objections, please let me know.
>> [...]
>> --- a/net/core/filter.c
>> +++ b/net/core/filter.c
>> @@ -338,11 +338,15 @@ load_b:
>>
>> if (skb_is_nonlinear(skb))
>> return 0;
>> + if (skb->len < sizeof(struct nlattr))
>> + return 0;
>> + if (skb->len < sizeof(struct nlattr))
>> + return 0;
>
> There above code is duplicated this backport. The same comment
> applies to the 3.2.y backport (I've added Ben to the CC list).
>
Good catch! The diff should look more like the the one in the
attachment. I guess patch(1) just failed here to find the right place
to apply the hunk to.
Thanks,
Mathias
[-- Attachment #2: filter-prevent-nla-extensions-to-peek-beyond-the-end-of-the-message-v3.4.patch --]
[-- Type: text/x-patch, Size: 691 bytes --]
diff --git a/net/core/filter.c b/net/core/filter.c
index 6f755cc..3b7398a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -322,6 +322,8 @@ load_b:
if (skb_is_nonlinear(skb))
return 0;
+ if (skb->len < sizeof(struct nlattr))
+ return 0;
if (A > skb->len - sizeof(struct nlattr))
return 0;
@@ -338,11 +340,13 @@ load_b:
if (skb_is_nonlinear(skb))
return 0;
+ if (skb->len < sizeof(struct nlattr))
+ return 0;
if (A > skb->len - sizeof(struct nlattr))
return 0;
nla = (struct nlattr *)&skb->data[A];
- if (nla->nla_len > A - skb->len)
+ if (nla->nla_len > skb->len - A)
return 0;
nla = nla_find_nested(nla, X);
^ permalink raw reply related [flat|nested] 234+ messages in thread
* Re: [PATCH 3.4 022/214] filter: prevent nla extensions to peek beyond the end of the message
2014-06-05 13:49 ` Mathias Krause
@ 2014-06-05 18:15 ` Greg Kroah-Hartman
0 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 18:15 UTC (permalink / raw)
To: Mathias Krause
Cc: Luis Henriques, linux-kernel, stable, Patrick McHardy,
Pablo Neira Ayuso, Daniel Borkmann, David S. Miller,
Ben Hutchings
On Thu, Jun 05, 2014 at 03:49:48PM +0200, Mathias Krause wrote:
> On 5 June 2014 15:33, Luis Henriques <luis.henriques@canonical.com> wrote:
> > On Wed, Jun 04, 2014 at 09:16:25PM -0700, Greg Kroah-Hartman wrote:
> >> 3.4-stable review patch. If anyone has any objections, please let me know.
> >> [...]
> >> --- a/net/core/filter.c
> >> +++ b/net/core/filter.c
> >> @@ -338,11 +338,15 @@ load_b:
> >>
> >> if (skb_is_nonlinear(skb))
> >> return 0;
> >> + if (skb->len < sizeof(struct nlattr))
> >> + return 0;
> >> + if (skb->len < sizeof(struct nlattr))
> >> + return 0;
> >
> > There above code is duplicated this backport. The same comment
> > applies to the 3.2.y backport (I've added Ben to the CC list).
> >
>
> Good catch! The diff should look more like the the one in the
> attachment. I guess patch(1) just failed here to find the right place
> to apply the hunk to.
>
> Thanks,
> Mathias
> diff --git a/net/core/filter.c b/net/core/filter.c
> index 6f755cc..3b7398a 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -322,6 +322,8 @@ load_b:
>
> if (skb_is_nonlinear(skb))
> return 0;
> + if (skb->len < sizeof(struct nlattr))
> + return 0;
> if (A > skb->len - sizeof(struct nlattr))
> return 0;
>
> @@ -338,11 +340,13 @@ load_b:
>
> if (skb_is_nonlinear(skb))
> return 0;
> + if (skb->len < sizeof(struct nlattr))
> + return 0;
> if (A > skb->len - sizeof(struct nlattr))
> return 0;
>
> nla = (struct nlattr *)&skb->data[A];
> - if (nla->nla_len > A - skb->len)
> + if (nla->nla_len > skb->len - A)
> return 0;
>
> nla = nla_find_nested(nla, X);
Thanks, I've fixed up the patch in the 3.4-stable queue to match this
version instead.
greg k-h
^ permalink raw reply [flat|nested] 234+ messages in thread
* Re: [PATCH 3.4 022/214] filter: prevent nla extensions to peek beyond the end of the message
2014-06-05 13:33 ` Luis Henriques
(?)
(?)
@ 2014-06-05 13:50 ` Ben Hutchings
2014-06-05 14:05 ` Luis Henriques
-1 siblings, 1 reply; 234+ messages in thread
From: Ben Hutchings @ 2014-06-05 13:50 UTC (permalink / raw)
To: Luis Henriques
Cc: Greg Kroah-Hartman, linux-kernel, stable, Patrick McHardy,
Pablo Neira Ayuso, Mathias Krause, Daniel Borkmann,
David S. Miller
[-- Attachment #1: Type: text/plain, Size: 3240 bytes --]
On Thu, 2014-06-05 at 14:33 +0100, Luis Henriques wrote:
> On Wed, Jun 04, 2014 at 09:16:25PM -0700, Greg Kroah-Hartman wrote:
> > 3.4-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Mathias Krause <minipli@googlemail.com>
> >
> > [ Upstream commit 05ab8f2647e4221cbdb3856dd7d32bd5407316b3 ]
> >
> > The BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extensions fail to check
> > for a minimal message length before testing the supplied offset to be
> > within the bounds of the message. This allows the subtraction of the nla
> > header to underflow and therefore -- as the data type is unsigned --
> > allowing far to big offset and length values for the search of the
> > netlink attribute.
> >
> > The remainder calculation for the BPF_S_ANC_NLATTR_NEST extension is
> > also wrong. It has the minuend and subtrahend mixed up, therefore
> > calculates a huge length value, allowing to overrun the end of the
> > message while looking for the netlink attribute.
> >
> > The following three BPF snippets will trigger the bugs when attached to
> > a UNIX datagram socket and parsing a message with length 1, 2 or 3.
> >
> > ,-[ PoC for missing size check in BPF_S_ANC_NLATTR ]--
> > | ld #0x87654321
> > | ldx #42
> > | ld #nla
> > | ret a
> > `---
> >
> > ,-[ PoC for the same bug in BPF_S_ANC_NLATTR_NEST ]--
> > | ld #0x87654321
> > | ldx #42
> > | ld #nlan
> > | ret a
> > `---
> >
> > ,-[ PoC for wrong remainder calculation in BPF_S_ANC_NLATTR_NEST ]--
> > | ; (needs a fake netlink header at offset 0)
> > | ld #0
> > | ldx #42
> > | ld #nlan
> > | ret a
> > `---
> >
> > Fix the first issue by ensuring the message length fulfills the minimal
> > size constrains of a nla header. Fix the second bug by getting the math
> > for the remainder calculation right.
> >
> > Fixes: 4738c1db15 ("[SKFILTER]: Add SKF_ADF_NLATTR instruction")
> > Fixes: d214c7537b ("filter: add SKF_AD_NLATTR_NEST to look for nested..")
> > Cc: Patrick McHardy <kaber@trash.net>
> > Cc: Pablo Neira Ayuso <pablo@netfilter.org>
> > Signed-off-by: Mathias Krause <minipli@googlemail.com>
> > Acked-by: Daniel Borkmann <dborkman@redhat.com>
> > Signed-off-by: David S. Miller <davem@davemloft.net>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > ---
> > net/core/filter.c | 6 +++++-
> > 1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > --- a/net/core/filter.c
> > +++ b/net/core/filter.c
> > @@ -338,11 +338,15 @@ load_b:
> >
> > if (skb_is_nonlinear(skb))
> > return 0;
> > + if (skb->len < sizeof(struct nlattr))
> > + return 0;
> > + if (skb->len < sizeof(struct nlattr))
> > + return 0;
>
> There above code is duplicated this backport. The same comment
> applies to the 3.2.y backport (I've added Ben to the CC list).
This seems to be due to a bug in patch <https://bugs.debian.org/717782>.
I had the same problem when initially trying to fix this in 3.14. The
first two inserted lines should be 16 lines further up.
Ben.
--
Ben Hutchings
I say we take off; nuke the site from orbit. It's the only way to be sure.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]
^ permalink raw reply [flat|nested] 234+ messages in thread* Re: [PATCH 3.4 022/214] filter: prevent nla extensions to peek beyond the end of the message
2014-06-05 13:50 ` Ben Hutchings
@ 2014-06-05 14:05 ` Luis Henriques
0 siblings, 0 replies; 234+ messages in thread
From: Luis Henriques @ 2014-06-05 14:05 UTC (permalink / raw)
To: Ben Hutchings
Cc: Greg Kroah-Hartman, linux-kernel, stable, Patrick McHardy,
Pablo Neira Ayuso, Mathias Krause, Daniel Borkmann,
David S. Miller
On Thu, Jun 05, 2014 at 02:50:24PM +0100, Ben Hutchings wrote:
> On Thu, 2014-06-05 at 14:33 +0100, Luis Henriques wrote:
> > On Wed, Jun 04, 2014 at 09:16:25PM -0700, Greg Kroah-Hartman wrote:
> > > 3.4-stable review patch. If anyone has any objections, please let me know.
> > >
> > > ------------------
> > >
> > > From: Mathias Krause <minipli@googlemail.com>
> > >
> > > [ Upstream commit 05ab8f2647e4221cbdb3856dd7d32bd5407316b3 ]
> > >
> > > The BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extensions fail to check
> > > for a minimal message length before testing the supplied offset to be
> > > within the bounds of the message. This allows the subtraction of the nla
> > > header to underflow and therefore -- as the data type is unsigned --
> > > allowing far to big offset and length values for the search of the
> > > netlink attribute.
> > >
> > > The remainder calculation for the BPF_S_ANC_NLATTR_NEST extension is
> > > also wrong. It has the minuend and subtrahend mixed up, therefore
> > > calculates a huge length value, allowing to overrun the end of the
> > > message while looking for the netlink attribute.
> > >
> > > The following three BPF snippets will trigger the bugs when attached to
> > > a UNIX datagram socket and parsing a message with length 1, 2 or 3.
> > >
> > > ,-[ PoC for missing size check in BPF_S_ANC_NLATTR ]--
> > > | ld #0x87654321
> > > | ldx #42
> > > | ld #nla
> > > | ret a
> > > `---
> > >
> > > ,-[ PoC for the same bug in BPF_S_ANC_NLATTR_NEST ]--
> > > | ld #0x87654321
> > > | ldx #42
> > > | ld #nlan
> > > | ret a
> > > `---
> > >
> > > ,-[ PoC for wrong remainder calculation in BPF_S_ANC_NLATTR_NEST ]--
> > > | ; (needs a fake netlink header at offset 0)
> > > | ld #0
> > > | ldx #42
> > > | ld #nlan
> > > | ret a
> > > `---
> > >
> > > Fix the first issue by ensuring the message length fulfills the minimal
> > > size constrains of a nla header. Fix the second bug by getting the math
> > > for the remainder calculation right.
> > >
> > > Fixes: 4738c1db15 ("[SKFILTER]: Add SKF_ADF_NLATTR instruction")
> > > Fixes: d214c7537b ("filter: add SKF_AD_NLATTR_NEST to look for nested..")
> > > Cc: Patrick McHardy <kaber@trash.net>
> > > Cc: Pablo Neira Ayuso <pablo@netfilter.org>
> > > Signed-off-by: Mathias Krause <minipli@googlemail.com>
> > > Acked-by: Daniel Borkmann <dborkman@redhat.com>
> > > Signed-off-by: David S. Miller <davem@davemloft.net>
> > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > > ---
> > > net/core/filter.c | 6 +++++-
> > > 1 file changed, 5 insertions(+), 1 deletion(-)
> > >
> > > --- a/net/core/filter.c
> > > +++ b/net/core/filter.c
> > > @@ -338,11 +338,15 @@ load_b:
> > >
> > > if (skb_is_nonlinear(skb))
> > > return 0;
> > > + if (skb->len < sizeof(struct nlattr))
> > > + return 0;
> > > + if (skb->len < sizeof(struct nlattr))
> > > + return 0;
> >
> > There above code is duplicated this backport. The same comment
> > applies to the 3.2.y backport (I've added Ben to the CC list).
>
> This seems to be due to a bug in patch <https://bugs.debian.org/717782>.
> I had the same problem when initially trying to fix this in 3.14. The
> first two inserted lines should be 16 lines further up.
>
> Ben.
>
> --
> Ben Hutchings
> I say we take off; nuke the site from orbit. It's the only way to be sure.
Awesome! Thank you both for clarifying that.
Cheers,
--
Luís
^ permalink raw reply [flat|nested] 234+ messages in thread* Re: [PATCH 3.4 022/214] filter: prevent nla extensions to peek beyond the end of the message
@ 2014-06-05 14:05 ` Luis Henriques
0 siblings, 0 replies; 234+ messages in thread
From: Luis Henriques @ 2014-06-05 14:05 UTC (permalink / raw)
To: Ben Hutchings
Cc: Greg Kroah-Hartman, linux-kernel, stable, Patrick McHardy,
Pablo Neira Ayuso, Mathias Krause, Daniel Borkmann,
David S. Miller
On Thu, Jun 05, 2014 at 02:50:24PM +0100, Ben Hutchings wrote:
> On Thu, 2014-06-05 at 14:33 +0100, Luis Henriques wrote:
> > On Wed, Jun 04, 2014 at 09:16:25PM -0700, Greg Kroah-Hartman wrote:
> > > 3.4-stable review patch. If anyone has any objections, please let me know.
> > >
> > > ------------------
> > >
> > > From: Mathias Krause <minipli@googlemail.com>
> > >
> > > [ Upstream commit 05ab8f2647e4221cbdb3856dd7d32bd5407316b3 ]
> > >
> > > The BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extensions fail to check
> > > for a minimal message length before testing the supplied offset to be
> > > within the bounds of the message. This allows the subtraction of the nla
> > > header to underflow and therefore -- as the data type is unsigned --
> > > allowing far to big offset and length values for the search of the
> > > netlink attribute.
> > >
> > > The remainder calculation for the BPF_S_ANC_NLATTR_NEST extension is
> > > also wrong. It has the minuend and subtrahend mixed up, therefore
> > > calculates a huge length value, allowing to overrun the end of the
> > > message while looking for the netlink attribute.
> > >
> > > The following three BPF snippets will trigger the bugs when attached to
> > > a UNIX datagram socket and parsing a message with length 1, 2 or 3.
> > >
> > > ,-[ PoC for missing size check in BPF_S_ANC_NLATTR ]--
> > > | ld #0x87654321
> > > | ldx #42
> > > | ld #nla
> > > | ret a
> > > `---
> > >
> > > ,-[ PoC for the same bug in BPF_S_ANC_NLATTR_NEST ]--
> > > | ld #0x87654321
> > > | ldx #42
> > > | ld #nlan
> > > | ret a
> > > `---
> > >
> > > ,-[ PoC for wrong remainder calculation in BPF_S_ANC_NLATTR_NEST ]--
> > > | ; (needs a fake netlink header at offset 0)
> > > | ld #0
> > > | ldx #42
> > > | ld #nlan
> > > | ret a
> > > `---
> > >
> > > Fix the first issue by ensuring the message length fulfills the minimal
> > > size constrains of a nla header. Fix the second bug by getting the math
> > > for the remainder calculation right.
> > >
> > > Fixes: 4738c1db15 ("[SKFILTER]: Add SKF_ADF_NLATTR instruction")
> > > Fixes: d214c7537b ("filter: add SKF_AD_NLATTR_NEST to look for nested..")
> > > Cc: Patrick McHardy <kaber@trash.net>
> > > Cc: Pablo Neira Ayuso <pablo@netfilter.org>
> > > Signed-off-by: Mathias Krause <minipli@googlemail.com>
> > > Acked-by: Daniel Borkmann <dborkman@redhat.com>
> > > Signed-off-by: David S. Miller <davem@davemloft.net>
> > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > > ---
> > > net/core/filter.c | 6 +++++-
> > > 1 file changed, 5 insertions(+), 1 deletion(-)
> > >
> > > --- a/net/core/filter.c
> > > +++ b/net/core/filter.c
> > > @@ -338,11 +338,15 @@ load_b:
> > >
> > > if (skb_is_nonlinear(skb))
> > > return 0;
> > > + if (skb->len < sizeof(struct nlattr))
> > > + return 0;
> > > + if (skb->len < sizeof(struct nlattr))
> > > + return 0;
> >
> > There above code is duplicated this backport. The same comment
> > applies to the 3.2.y backport (I've added Ben to the CC list).
>
> This seems to be due to a bug in patch <https://bugs.debian.org/717782>.
> I had the same problem when initially trying to fix this in 3.14. The
> first two inserted lines should be 16 lines further up.
>
> Ben.
>
> --
> Ben Hutchings
> I say we take off; nuke the site from orbit. It's the only way to be sure.
Awesome! Thank you both for clarifying that.
Cheers,
--
Lu�s
^ permalink raw reply [flat|nested] 234+ messages in thread
* [PATCH 3.4 023/214] tg3: update rx_jumbo_pending ring param only when jumbo frames are enabled
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 022/214] filter: prevent nla extensions to peek beyond the end of the message Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 024/214] rtnetlink: Warn when interfaces information wont fit in our packet Greg Kroah-Hartman
` (193 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ivan Vecera, Michael Chan, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Vecera <ivecera@redhat.com>
The patch fixes a problem with dropped jumbo frames after usage of
'ethtool -G ... rx'.
Scenario:
1. ip link set eth0 up
2. ethtool -G eth0 rx N # <- This zeroes rx-jumbo
3. ip link set mtu 9000 dev eth0
The ethtool command set rx_jumbo_pending to zero so any received jumbo
packets are dropped and you need to use 'ethtool -G eth0 rx-jumbo N'
to workaround the issue.
The patch changes the logic so rx_jumbo_pending value is changed only if
jumbo frames are enabled (MTU > 1500).
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Acked-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/tg3.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -10861,7 +10861,9 @@ static int tg3_set_ringparam(struct net_
if (tg3_flag(tp, MAX_RXPEND_64) &&
tp->rx_pending > 63)
tp->rx_pending = 63;
- tp->rx_jumbo_pending = ering->rx_jumbo_pending;
+
+ if (tg3_flag(tp, JUMBO_RING_ENABLE))
+ tp->rx_jumbo_pending = ering->rx_jumbo_pending;
for (i = 0; i < tp->irq_max; i++)
tp->napi[i].tx_pending = ering->tx_pending;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 024/214] rtnetlink: Warn when interfaces information wont fit in our packet
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 023/214] tg3: update rx_jumbo_pending ring param only when jumbo frames are enabled Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 025/214] rtnetlink: Only supply IFLA_VF_PORTS information when RTEXT_FILTER_VF is set Greg Kroah-Hartman
` (192 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Gibson, Jiri Pirko, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Gibson <david@gibson.dropbear.id.au>
[ Upstream commit 973462bbde79bb827824c73b59027a0aed5c9ca6 ]
Without IFLA_EXT_MASK specified, the information reported for a single
interface in response to RTM_GETLINK is expected to fit within a netlink
packet of NLMSG_GOODSIZE.
If it doesn't, however, things will go badly wrong, When listing all
interfaces, netlink_dump() will incorrectly treat -EMSGSIZE on the first
message in a packet as the end of the listing and omit information for
that interface and all subsequent ones. This can cause getifaddrs(3) to
enter an infinite loop.
This patch won't fix the problem, but it will WARN_ON() making it easier to
track down what's going wrong.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Jiri Pirko <jpirko@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/rtnetlink.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1059,6 +1059,7 @@ static int rtnl_dump_ifinfo(struct sk_bu
struct hlist_node *node;
struct nlattr *tb[IFLA_MAX+1];
u32 ext_filter_mask = 0;
+ int err;
s_h = cb->args[0];
s_idx = cb->args[1];
@@ -1079,11 +1080,17 @@ static int rtnl_dump_ifinfo(struct sk_bu
hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
if (idx < s_idx)
goto cont;
- if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
- NETLINK_CB(cb->skb).pid,
- cb->nlh->nlmsg_seq, 0,
- NLM_F_MULTI,
- ext_filter_mask) <= 0)
+ err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
+ NETLINK_CB(cb->skb).pid,
+ cb->nlh->nlmsg_seq, 0,
+ NLM_F_MULTI,
+ ext_filter_mask);
+ /* If we ran out of room on the first message,
+ * we're in trouble
+ */
+ WARN_ON((err == -EMSGSIZE) && (skb->len == 0));
+
+ if (err <= 0)
goto out;
nl_dump_check_consistent(cb, nlmsg_hdr(skb));
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 025/214] rtnetlink: Only supply IFLA_VF_PORTS information when RTEXT_FILTER_VF is set
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 024/214] rtnetlink: Warn when interfaces information wont fit in our packet Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 026/214] Revert "macvlan : fix checksums error when we are in bridge mode" Greg Kroah-Hartman
` (191 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Gibson, Jiri Pirko, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Gibson <david@gibson.dropbear.id.au>
[ Upstream commit c53864fd60227de025cb79e05493b13f69843971 ]
Since 115c9b81928360d769a76c632bae62d15206a94a (rtnetlink: Fix problem with
buffer allocation), RTM_NEWLINK messages only contain the IFLA_VFINFO_LIST
attribute if they were solicited by a GETLINK message containing an
IFLA_EXT_MASK attribute with the RTEXT_FILTER_VF flag.
That was done because some user programs broke when they received more data
than expected - because IFLA_VFINFO_LIST contains information for each VF
it can become large if there are many VFs.
However, the IFLA_VF_PORTS attribute, supplied for devices which implement
ndo_get_vf_port (currently the 'enic' driver only), has the same problem.
It supplies per-VF information and can therefore become large, but it is
not currently conditional on the IFLA_EXT_MASK value.
Worse, it interacts badly with the existing EXT_MASK handling. When
IFLA_EXT_MASK is not supplied, the buffer for netlink replies is fixed at
NLMSG_GOODSIZE. If the information for IFLA_VF_PORTS exceeds this, then
rtnl_fill_ifinfo() returns -EMSGSIZE on the first message in a packet.
netlink_dump() will misinterpret this as having finished the listing and
omit data for this interface and all subsequent ones. That can cause
getifaddrs(3) to enter an infinite loop.
This patch addresses the problem by only supplying IFLA_VF_PORTS when
IFLA_EXT_MASK is supplied with the RTEXT_FILTER_VF flag set.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/rtnetlink.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -746,7 +746,8 @@ static inline int rtnl_vfinfo_size(const
return 0;
}
-static size_t rtnl_port_size(const struct net_device *dev)
+static size_t rtnl_port_size(const struct net_device *dev,
+ u32 ext_filter_mask)
{
size_t port_size = nla_total_size(4) /* PORT_VF */
+ nla_total_size(PORT_PROFILE_MAX) /* PORT_PROFILE */
@@ -762,7 +763,8 @@ static size_t rtnl_port_size(const struc
size_t port_self_size = nla_total_size(sizeof(struct nlattr))
+ port_size;
- if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
+ if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
+ !(ext_filter_mask & RTEXT_FILTER_VF))
return 0;
if (dev_num_vf(dev->dev.parent))
return port_self_size + vf_ports_size +
@@ -793,7 +795,7 @@ static noinline size_t if_nlmsg_size(con
+ nla_total_size(ext_filter_mask
& RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
+ rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
- + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
+ + rtnl_port_size(dev, ext_filter_mask) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
+ rtnl_link_get_size(dev) /* IFLA_LINKINFO */
+ rtnl_link_get_af_size(dev); /* IFLA_AF_SPEC */
}
@@ -853,11 +855,13 @@ static int rtnl_port_self_fill(struct sk
return 0;
}
-static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev)
+static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev,
+ u32 ext_filter_mask)
{
int err;
- if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
+ if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
+ !(ext_filter_mask & RTEXT_FILTER_VF))
return 0;
err = rtnl_port_self_fill(skb, dev);
@@ -1004,7 +1008,7 @@ static int rtnl_fill_ifinfo(struct sk_bu
nla_nest_end(skb, vfinfo);
}
- if (rtnl_port_fill(skb, dev))
+ if (rtnl_port_fill(skb, dev, ext_filter_mask))
goto nla_put_failure;
if (dev->rtnl_link_ops) {
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 026/214] Revert "macvlan : fix checksums error when we are in bridge mode"
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 025/214] rtnetlink: Only supply IFLA_VF_PORTS information when RTEXT_FILTER_VF is set Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 027/214] tcp_cubic: fix the range of delayed_ack Greg Kroah-Hartman
` (190 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Lezcano, Patrick McHardy,
Andrian Nord, Eric Dumazet, Michael S. Tsirkin, Jason Wang,
Vlad Yasevich, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Yasevich <vyasevic@redhat.com>
[ Upstream commit f114890cdf84d753f6b41cd0cc44ba51d16313da ]
This reverts commit 12a2856b604476c27d85a5f9a57ae1661fc46019.
The commit above doesn't appear to be necessary any more as the
checksums appear to be correctly computed/validated.
Additionally the above commit breaks kvm configurations where
one VM is using a device that support checksum offload (virtio) and
the other VM does not.
In this case, packets leaving virtio device will have CHECKSUM_PARTIAL
set. The packets is forwarded to a macvtap that has offload features
turned off. Since we use CHECKSUM_UNNECESSARY, the host does does not
update the checksum and thus a bad checksum is passed up to
the guest.
CC: Daniel Lezcano <daniel.lezcano@free.fr>
CC: Patrick McHardy <kaber@trash.net>
CC: Andrian Nord <nightnord@gmail.com>
CC: Eric Dumazet <eric.dumazet@gmail.com>
CC: Michael S. Tsirkin <mst@redhat.com>
CC: Jason Wang <jasowang@redhat.com>
Signed-off-by: Vlad Yasevich <vyasevic@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/macvlan.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -237,11 +237,9 @@ static int macvlan_queue_xmit(struct sk_
const struct macvlan_dev *vlan = netdev_priv(dev);
const struct macvlan_port *port = vlan->port;
const struct macvlan_dev *dest;
- __u8 ip_summed = skb->ip_summed;
if (vlan->mode == MACVLAN_MODE_BRIDGE) {
const struct ethhdr *eth = (void *)skb->data;
- skb->ip_summed = CHECKSUM_UNNECESSARY;
/* send to other bridge ports directly */
if (is_multicast_ether_addr(eth->h_dest)) {
@@ -259,7 +257,6 @@ static int macvlan_queue_xmit(struct sk_
}
xmit_world:
- skb->ip_summed = ip_summed;
skb->dev = vlan->lowerdev;
return dev_queue_xmit(skb);
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 027/214] tcp_cubic: fix the range of delayed_ack
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 026/214] Revert "macvlan : fix checksums error when we are in bridge mode" Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 028/214] net: ipv4: ip_forward: fix inverted local_df test Greg Kroah-Hartman
` (189 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stephen Hemminger, Liu Yu,
Eric Dumazet, Neal Cardwell, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Yu <allanyuliu@tencent.com>
[ Upstream commit 0cda345d1b2201dd15591b163e3c92bad5191745 ]
commit b9f47a3aaeab (tcp_cubic: limit delayed_ack ratio to prevent
divide error) try to prevent divide error, but there is still a little
chance that delayed_ack can reach zero. In case the param cnt get
negative value, then ratio+cnt would overflow and may happen to be zero.
As a result, min(ratio, ACK_RATIO_LIMIT) will calculate to be zero.
In some old kernels, such as 2.6.32, there is a bug that would
pass negative param, which then ultimately leads to this divide error.
commit 5b35e1e6e9c (tcp: fix tcp_trim_head() to adjust segment count
with skb MSS) fixed the negative param issue. However,
it's safe that we fix the range of delayed_ack as well,
to make sure we do not hit a divide by zero.
CC: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: Liu Yu <allanyuliu@tencent.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_cubic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -408,7 +408,7 @@ static void bictcp_acked(struct sock *sk
ratio -= ca->delayed_ack >> ACK_RATIO_SHIFT;
ratio += cnt;
- ca->delayed_ack = min(ratio, ACK_RATIO_LIMIT);
+ ca->delayed_ack = clamp(ratio, 1U, ACK_RATIO_LIMIT);
}
/* Some calls are for duplicates without timetamps */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 028/214] net: ipv4: ip_forward: fix inverted local_df test
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 027/214] tcp_cubic: fix the range of delayed_ack Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 029/214] ipv4: fib_semantics: increment fib_info_cnt after fib_info allocation Greg Kroah-Hartman
` (188 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Westphal, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit ca6c5d4ad216d5942ae544bbf02503041bd802aa ]
local_df means 'ignore DF bit if set', so if its set we're
allowed to perform ip fragmentation.
This wasn't noticed earlier because the output path also drops such skbs
(and emits needed icmp error) and because netfilter ip defrag did not
set local_df until couple of days ago.
Only difference is that DF-packets-larger-than MTU now discarded
earlier (f.e. we avoid pointless netfilter postrouting trip).
While at it, drop the repeated test ip_exceeds_mtu, checking it once
is enough...
Fixes: fe6cc55f3a9 ("net: ip, ipv6: handle gso skbs in forwarding path")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ip_forward.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -42,12 +42,12 @@
static bool ip_may_fragment(const struct sk_buff *skb)
{
return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ||
- !skb->local_df;
+ skb->local_df;
}
static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
{
- if (skb->len <= mtu || skb->local_df)
+ if (skb->len <= mtu)
return false;
if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 029/214] ipv4: fib_semantics: increment fib_info_cnt after fib_info allocation
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 028/214] net: ipv4: ip_forward: fix inverted local_df test Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 030/214] act_mirred: do not drop packets when fails to mirror it Greg Kroah-Hartman
` (187 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sergey Popovich, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Popovich <popovich_sergei@mail.ru>
[ Upstream commit aeefa1ecfc799b0ea2c4979617f14cecd5cccbfd ]
Increment fib_info_cnt in fib_create_info() right after successfuly
alllocating fib_info structure, overwise fib_metrics allocation failure
leads to fib_info_cnt incorrectly decremented in free_fib_info(), called
on error path from fib_create_info().
Signed-off-by: Sergey Popovich <popovich_sergei@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/fib_semantics.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -751,13 +751,13 @@ struct fib_info *fib_create_info(struct
fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
if (fi == NULL)
goto failure;
+ fib_info_cnt++;
if (cfg->fc_mx) {
fi->fib_metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
if (!fi->fib_metrics)
goto failure;
} else
fi->fib_metrics = (u32 *) dst_default_metrics;
- fib_info_cnt++;
fi->fib_net = hold_net(net);
fi->fib_protocol = cfg->fc_protocol;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 030/214] act_mirred: do not drop packets when fails to mirror it
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 029/214] ipv4: fib_semantics: increment fib_info_cnt after fib_info allocation Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 031/214] ipv4: initialise the itag variable in __mkroute_input Greg Kroah-Hartman
` (186 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Wang, Jamal Hadi Salim,
David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <jasowang@redhat.com>
[ Upstream commit 16c0b164bd24d44db137693a36b428ba28970c62 ]
We drop packet unconditionally when we fail to mirror it. This is not intended
in some cases. Consdier for kvm guest, we may mirror the traffic of the bridge
to a tap device used by a VM. When kernel fails to mirror the packet in
conditions such as when qemu crashes or stop polling the tap, it's hard for the
management software to detect such condition and clean the the mirroring
before. This would lead all packets to the bridge to be dropped and break the
netowrk of other virtual machines.
To solve the issue, the patch does not drop packets when kernel fails to mirror
it, and only drop the redirected packets.
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/act_mirred.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -201,13 +201,12 @@ static int tcf_mirred(struct sk_buff *sk
out:
if (err) {
m->tcf_qstats.overlimits++;
- /* should we be asking for packet to be dropped?
- * may make sense for redirect case only
- */
- retval = TC_ACT_SHOT;
- } else {
+ if (m->tcfm_eaction != TCA_EGRESS_MIRROR)
+ retval = TC_ACT_SHOT;
+ else
+ retval = m->tcf_action;
+ } else
retval = m->tcf_action;
- }
spin_unlock(&m->tcf_lock);
return retval;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 031/214] ipv4: initialise the itag variable in __mkroute_input
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 030/214] act_mirred: do not drop packets when fails to mirror it Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 032/214] skb: Add inline helper for getting the skb end offset from head Greg Kroah-Hartman
` (185 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Li RongQing, Alexei Starovoitov,
David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <roy.qing.li@gmail.com>
[ Upstream commit fbdc0ad095c0a299e9abf5d8ac8f58374951149a ]
the value of itag is a random value from stack, and may not be initiated by
fib_validate_source, which called fib_combine_itag if CONFIG_IP_ROUTE_CLASSID
is not set
This will make the cached dst uncertainty
Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/route.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2129,7 +2129,7 @@ static int __mkroute_input(struct sk_buf
struct in_device *out_dev;
unsigned int flags = 0;
__be32 spec_dst;
- u32 itag;
+ u32 itag = 0;
/* get a working reference to the output device */
out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 032/214] skb: Add inline helper for getting the skb end offset from head
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 031/214] ipv4: initialise the itag variable in __mkroute_input Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 033/214] net-gro: reset skb->truesize in napi_reuse_skb() Greg Kroah-Hartman
` (184 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Duyck, Eric Dumazet,
David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Duyck <alexander.h.duyck@intel.com>
[ Upstream commit ec47ea82477404631d49b8e568c71826c9b663ac ]
With the recent changes for how we compute the skb truesize it occurs to me
we are probably going to have a lot of calls to skb_end_pointer -
skb->head. Instead of running all over the place doing that it would make
more sense to just make it a separate inline skb_end_offset(skb) that way
we can return the correct value without having gcc having to do all the
optimization to cancel out skb->head - skb->head.
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/atm/ambassador.c | 2 +-
drivers/atm/idt77252.c | 2 +-
drivers/net/wimax/i2400m/usb-rx.c | 2 +-
drivers/staging/octeon/ethernet-tx.c | 2 +-
include/linux/skbuff.h | 12 +++++++++++-
net/core/skbuff.c | 9 ++++-----
6 files changed, 19 insertions(+), 10 deletions(-)
--- a/drivers/atm/ambassador.c
+++ b/drivers/atm/ambassador.c
@@ -802,7 +802,7 @@ static void fill_rx_pool (amb_dev * dev,
}
// cast needed as there is no %? for pointer differences
PRINTD (DBG_SKB, "allocated skb at %p, head %p, area %li",
- skb, skb->head, (long) (skb_end_pointer(skb) - skb->head));
+ skb, skb->head, (long) skb_end_offset(skb));
rx.handle = virt_to_bus (skb);
rx.host_address = cpu_to_be32 (virt_to_bus (skb->data));
if (rx_give (dev, &rx, pool))
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -1258,7 +1258,7 @@ idt77252_rx_raw(struct idt77252_dev *car
tail = readl(SAR_REG_RAWCT);
pci_dma_sync_single_for_cpu(card->pcidev, IDT77252_PRV_PADDR(queue),
- skb_end_pointer(queue) - queue->head - 16,
+ skb_end_offset(queue) - 16,
PCI_DMA_FROMDEVICE);
while (head != tail) {
--- a/drivers/net/wimax/i2400m/usb-rx.c
+++ b/drivers/net/wimax/i2400m/usb-rx.c
@@ -277,7 +277,7 @@ retry:
d_printf(1, dev, "RX: size changed to %d, received %d, "
"copied %d, capacity %ld\n",
rx_size, read_size, rx_skb->len,
- (long) (skb_end_pointer(new_skb) - new_skb->head));
+ (long) skb_end_offset(new_skb));
goto retry;
}
/* In most cases, it happens due to the hardware scheduling a
--- a/drivers/staging/octeon/ethernet-tx.c
+++ b/drivers/staging/octeon/ethernet-tx.c
@@ -345,7 +345,7 @@ int cvm_oct_xmit(struct sk_buff *skb, st
}
if (unlikely
(skb->truesize !=
- sizeof(*skb) + skb_end_pointer(skb) - skb->head)) {
+ sizeof(*skb) + skb_end_offset(skb))) {
/*
printk("TX buffer truesize has been changed\n");
*/
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -640,11 +640,21 @@ static inline unsigned char *skb_end_poi
{
return skb->head + skb->end;
}
+
+static inline unsigned int skb_end_offset(const struct sk_buff *skb)
+{
+ return skb->end;
+}
#else
static inline unsigned char *skb_end_pointer(const struct sk_buff *skb)
{
return skb->end;
}
+
+static inline unsigned int skb_end_offset(const struct sk_buff *skb)
+{
+ return skb->end - skb->head;
+}
#endif
/* Internal */
@@ -2574,7 +2584,7 @@ static inline bool skb_is_recycleable(co
return false;
skb_size = SKB_DATA_ALIGN(skb_size + NET_SKB_PAD);
- if (skb_end_pointer(skb) - skb->head < skb_size)
+ if (skb_end_offset(skb) < skb_size)
return false;
if (skb_shared(skb) || skb_cloned(skb))
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -821,7 +821,7 @@ static void copy_skb_header(struct sk_bu
struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t gfp_mask)
{
int headerlen = skb_headroom(skb);
- unsigned int size = (skb_end_pointer(skb) - skb->head) + skb->data_len;
+ unsigned int size = skb_end_offset(skb) + skb->data_len;
struct sk_buff *n = alloc_skb(size, gfp_mask);
if (!n)
@@ -922,7 +922,7 @@ int pskb_expand_head(struct sk_buff *skb
{
int i;
u8 *data;
- int size = nhead + (skb_end_pointer(skb) - skb->head) + ntail;
+ int size = nhead + skb_end_offset(skb) + ntail;
long off;
bool fastpath;
@@ -2721,14 +2721,13 @@ struct sk_buff *skb_segment(struct sk_bu
if (unlikely(!nskb))
goto err;
- hsize = skb_end_pointer(nskb) - nskb->head;
+ hsize = skb_end_offset(nskb);
if (skb_cow_head(nskb, doffset + headroom)) {
kfree_skb(nskb);
goto err;
}
- nskb->truesize += skb_end_pointer(nskb) - nskb->head -
- hsize;
+ nskb->truesize += skb_end_offset(nskb) - hsize;
skb_release_head_state(nskb);
__skb_push(nskb, doffset);
} else {
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 033/214] net-gro: reset skb->truesize in napi_reuse_skb()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 032/214] skb: Add inline helper for getting the skb end offset from head Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 034/214] futex: Add another early deadlock detection check Greg Kroah-Hartman
` (183 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Dumazet, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit e33d0ba8047b049c9262fdb1fcafb93cb52ceceb ]
Recycling skb always had been very tough...
This time it appears GRO layer can accumulate skb->truesize
adjustments made by drivers when they attach a fragment to skb.
skb_gro_receive() can only subtract from skb->truesize the used part
of a fragment.
I spotted this problem seeing TcpExtPruneCalled and
TcpExtTCPRcvCollapsed that were unexpected with a recent kernel, where
TCP receive window should be sized properly to accept traffic coming
from a driver not overshooting skb->truesize.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/dev.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3574,6 +3574,7 @@ static void napi_reuse_skb(struct napi_s
skb->vlan_tci = 0;
skb->dev = napi->dev;
skb->skb_iif = 0;
+ skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
napi->skb = skb;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 034/214] futex: Add another early deadlock detection check
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 033/214] net-gro: reset skb->truesize in napi_reuse_skb() Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 035/214] futex: Prevent attaching to kernel threads Greg Kroah-Hartman
` (182 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Dave Jones,
Linus Torvalds, Peter Zijlstra, Darren Hart, Davidlohr Bueso,
Steven Rostedt, Clark Williams, Paul McKenney, Lai Jiangshan,
Roland McGrath, Carlos ODonell, Jakub Jelinek, Michael Kerrisk,
Sebastian Andrzej Siewior
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 866293ee54227584ffcb4a42f69c1f365974ba7f upstream.
Dave Jones trinity syscall fuzzer exposed an issue in the deadlock
detection code of rtmutex:
http://lkml.kernel.org/r/20140429151655.GA14277@redhat.com
That underlying issue has been fixed with a patch to the rtmutex code,
but the futex code must not call into rtmutex in that case because
- it can detect that issue early
- it avoids a different and more complex fixup for backing out
If the user space variable got manipulated to 0x80000000 which means
no lock holder, but the waiters bit set and an active pi_state in the
kernel is found we can figure out the recursive locking issue by
looking at the pi_state owner. If that is the current task, then we
can safely return -EDEADLK.
The check should have been added in commit 59fa62451 (futex: Handle
futex_pi OWNER_DIED take over correctly) already, but I did not see
the above issue caused by user space manipulation back then.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Dave Jones <davej@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Darren Hart <darren@dvhart.com>
Cc: Davidlohr Bueso <davidlohr@hp.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Clark Williams <williams@redhat.com>
Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
Cc: Roland McGrath <roland@hack.frob.com>
Cc: Carlos ODonell <carlos@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: http://lkml.kernel.org/r/20140512201701.097349971@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/futex.c | 47 ++++++++++++++++++++++++++++++++++-------------
1 file changed, 34 insertions(+), 13 deletions(-)
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -590,7 +590,8 @@ void exit_pi_state_list(struct task_stru
static int
lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
- union futex_key *key, struct futex_pi_state **ps)
+ union futex_key *key, struct futex_pi_state **ps,
+ struct task_struct *task)
{
struct futex_pi_state *pi_state = NULL;
struct futex_q *this, *next;
@@ -634,6 +635,16 @@ lookup_pi_state(u32 uval, struct futex_h
return -EINVAL;
}
+ /*
+ * Protect against a corrupted uval. If uval
+ * is 0x80000000 then pid is 0 and the waiter
+ * bit is set. So the deadlock check in the
+ * calling code has failed and we did not fall
+ * into the check above due to !pid.
+ */
+ if (task && pi_state->owner == task)
+ return -EDEADLK;
+
atomic_inc(&pi_state->refcount);
*ps = pi_state;
@@ -783,7 +794,7 @@ retry:
* We dont have the lock. Look up the PI state (or create it if
* we are the first waiter):
*/
- ret = lookup_pi_state(uval, hb, key, ps);
+ ret = lookup_pi_state(uval, hb, key, ps, task);
if (unlikely(ret)) {
switch (ret) {
@@ -1193,7 +1204,7 @@ void requeue_pi_wake_futex(struct futex_
*
* Returns:
* 0 - failed to acquire the lock atomicly
- * 1 - acquired the lock
+ * >0 - acquired the lock, return value is vpid of the top_waiter
* <0 - error
*/
static int futex_proxy_trylock_atomic(u32 __user *pifutex,
@@ -1204,7 +1215,7 @@ static int futex_proxy_trylock_atomic(u3
{
struct futex_q *top_waiter = NULL;
u32 curval;
- int ret;
+ int ret, vpid;
if (get_futex_value_locked(&curval, pifutex))
return -EFAULT;
@@ -1232,11 +1243,13 @@ static int futex_proxy_trylock_atomic(u3
* the contended case or if set_waiters is 1. The pi_state is returned
* in ps in contended cases.
*/
+ vpid = task_pid_vnr(top_waiter->task);
ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
set_waiters);
- if (ret == 1)
+ if (ret == 1) {
requeue_pi_wake_futex(top_waiter, key2, hb2);
-
+ return vpid;
+ }
return ret;
}
@@ -1268,7 +1281,6 @@ static int futex_requeue(u32 __user *uad
struct futex_hash_bucket *hb1, *hb2;
struct plist_head *head1;
struct futex_q *this, *next;
- u32 curval2;
if (requeue_pi) {
/*
@@ -1354,16 +1366,25 @@ retry_private:
* At this point the top_waiter has either taken uaddr2 or is
* waiting on it. If the former, then the pi_state will not
* exist yet, look it up one more time to ensure we have a
- * reference to it.
+ * reference to it. If the lock was taken, ret contains the
+ * vpid of the top waiter task.
*/
- if (ret == 1) {
+ if (ret > 0) {
WARN_ON(pi_state);
drop_count++;
task_count++;
- ret = get_futex_value_locked(&curval2, uaddr2);
- if (!ret)
- ret = lookup_pi_state(curval2, hb2, &key2,
- &pi_state);
+ /*
+ * If we acquired the lock, then the user
+ * space value of uaddr2 should be vpid. It
+ * cannot be changed by the top waiter as it
+ * is blocked on hb2 lock if it tries to do
+ * so. If something fiddled with it behind our
+ * back the pi state lookup might unearth
+ * it. So we rather use the known value than
+ * rereading and handing potential crap to
+ * lookup_pi_state.
+ */
+ ret = lookup_pi_state(ret, hb2, &key2, &pi_state, NULL);
}
switch (ret) {
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 035/214] futex: Prevent attaching to kernel threads
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 034/214] futex: Add another early deadlock detection check Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 036/214] ftrace/module: Hardcode ftrace_module_init() call into load_module() Greg Kroah-Hartman
` (181 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Dave Jones,
Linus Torvalds, Peter Zijlstra, Darren Hart, Davidlohr Bueso,
Steven Rostedt, Clark Williams, Paul McKenney, Lai Jiangshan,
Roland McGrath, Carlos ODonell, Jakub Jelinek, Michael Kerrisk,
Sebastian Andrzej Siewior
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit f0d71b3dcb8332f7971b5f2363632573e6d9486a upstream.
We happily allow userspace to declare a random kernel thread to be the
owner of a user space PI futex.
Found while analysing the fallout of Dave Jones syscall fuzzer.
We also should validate the thread group for private futexes and find
some fast way to validate whether the "alleged" owner has RW access on
the file which backs the SHM, but that's a separate issue.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Dave Jones <davej@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Darren Hart <darren@dvhart.com>
Cc: Davidlohr Bueso <davidlohr@hp.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Clark Williams <williams@redhat.com>
Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
Cc: Roland McGrath <roland@hack.frob.com>
Cc: Carlos ODonell <carlos@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/futex.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -662,6 +662,11 @@ lookup_pi_state(u32 uval, struct futex_h
if (!p)
return -ESRCH;
+ if (!p->mm) {
+ put_task_struct(p);
+ return -EPERM;
+ }
+
/*
* We need to look at the task state flags to figure out,
* whether the task is exiting. To protect against the do_exit
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 036/214] ftrace/module: Hardcode ftrace_module_init() call into load_module()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 035/214] futex: Prevent attaching to kernel threads Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 037/214] pata_at91: fix ata_host_activate() failure handling Greg Kroah-Hartman
` (180 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Takao Indoh, Rusty Russell, Steven Rostedt
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit a949ae560a511fe4e3adf48fa44fefded93e5c2b upstream.
A race exists between module loading and enabling of function tracer.
CPU 1 CPU 2
----- -----
load_module()
module->state = MODULE_STATE_COMING
register_ftrace_function()
mutex_lock(&ftrace_lock);
ftrace_startup()
update_ftrace_function();
ftrace_arch_code_modify_prepare()
set_all_module_text_rw();
<enables-ftrace>
ftrace_arch_code_modify_post_process()
set_all_module_text_ro();
[ here all module text is set to RO,
including the module that is
loading!! ]
blocking_notifier_call_chain(MODULE_STATE_COMING);
ftrace_init_module()
[ tries to modify code, but it's RO, and fails!
ftrace_bug() is called]
When this race happens, ftrace_bug() will produces a nasty warning and
all of the function tracing features will be disabled until reboot.
The simple solution is to treate module load the same way the core
kernel is treated at boot. To hardcode the ftrace function modification
of converting calls to mcount into nops. This is done in init/main.c
there's no reason it could not be done in load_module(). This gives
a better control of the changes and doesn't tie the state of the
module to its notifiers as much. Ftrace is special, it needs to be
treated as such.
The reason this would work, is that the ftrace_module_init() would be
called while the module is in MODULE_STATE_UNFORMED, which is ignored
by the set_all_module_text_ro() call.
Link: http://lkml.kernel.org/r/1395637826-3312-1-git-send-email-indou.takao@jp.fujitsu.com
Reported-by: Takao Indoh <indou.takao@jp.fujitsu.com>
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/ftrace.h | 2 ++
kernel/module.c | 3 +++
kernel/trace/ftrace.c | 27 ++++-----------------------
3 files changed, 9 insertions(+), 23 deletions(-)
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -374,6 +374,7 @@ extern int ftrace_make_call(struct dyn_f
extern int ftrace_arch_read_dyn_info(char *buf, int size);
extern int skip_trace(unsigned long ip);
+extern void ftrace_module_init(struct module *mod);
extern void ftrace_disable_daemon(void);
extern void ftrace_enable_daemon(void);
@@ -383,6 +384,7 @@ static inline int ftrace_force_update(vo
static inline void ftrace_disable_daemon(void) { }
static inline void ftrace_enable_daemon(void) { }
static inline void ftrace_release_mod(struct module *mod) {}
+static inline void ftrace_module_init(struct module *mod) {}
static inline int register_ftrace_command(struct ftrace_func_command *cmd)
{
return -EINVAL;
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2951,6 +2951,9 @@ static struct module *load_module(void _
/* This has to be done once we're sure module name is unique. */
dynamic_debug_setup(info.debug, info.num_debug);
+ /* Ftrace init must be called in the MODULE_STATE_UNFORMED state */
+ ftrace_module_init(mod);
+
/* Find duplicate symbols */
err = verify_export_symbols(mod);
if (err < 0)
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3880,16 +3880,11 @@ static void ftrace_init_module(struct mo
ftrace_process_locs(mod, start, end);
}
-static int ftrace_module_notify_enter(struct notifier_block *self,
- unsigned long val, void *data)
+void ftrace_module_init(struct module *mod)
{
- struct module *mod = data;
-
- if (val == MODULE_STATE_COMING)
- ftrace_init_module(mod, mod->ftrace_callsites,
- mod->ftrace_callsites +
- mod->num_ftrace_callsites);
- return 0;
+ ftrace_init_module(mod, mod->ftrace_callsites,
+ mod->ftrace_callsites +
+ mod->num_ftrace_callsites);
}
static int ftrace_module_notify_exit(struct notifier_block *self,
@@ -3903,11 +3898,6 @@ static int ftrace_module_notify_exit(str
return 0;
}
#else
-static int ftrace_module_notify_enter(struct notifier_block *self,
- unsigned long val, void *data)
-{
- return 0;
-}
static int ftrace_module_notify_exit(struct notifier_block *self,
unsigned long val, void *data)
{
@@ -3915,11 +3905,6 @@ static int ftrace_module_notify_exit(str
}
#endif /* CONFIG_MODULES */
-struct notifier_block ftrace_module_enter_nb = {
- .notifier_call = ftrace_module_notify_enter,
- .priority = INT_MAX, /* Run before anything that can use kprobes */
-};
-
struct notifier_block ftrace_module_exit_nb = {
.notifier_call = ftrace_module_notify_exit,
.priority = INT_MIN, /* Run after anything that can remove kprobes */
@@ -3956,10 +3941,6 @@ void __init ftrace_init(void)
__start_mcount_loc,
__stop_mcount_loc);
- ret = register_module_notifier(&ftrace_module_enter_nb);
- if (ret)
- pr_warning("Failed to register trace ftrace module enter notifier\n");
-
ret = register_module_notifier(&ftrace_module_exit_nb);
if (ret)
pr_warning("Failed to register trace ftrace module exit notifier\n");
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 037/214] pata_at91: fix ata_host_activate() failure handling
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 036/214] ftrace/module: Hardcode ftrace_module_init() call into load_module() Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 038/214] mm: make fixup_user_fault() check the vma access rights too Greg Kroah-Hartman
` (179 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrew Victor, Nicolas Ferre,
Jean-Christophe Plagniol-Villard, Sergei Shtylyov,
Bartlomiej Zolnierkiewicz, Tejun Heo
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
commit 27aa64b9d1bd0d23fd692c91763a48309b694311 upstream.
Add missing clk_put() call to ata_host_activate() failure path.
Sergei says,
"Hm, I have once fixed that (see that *if* (!ret)) but looks like a
later commit 477c87e90853d136b188c50c0e4a93d01cad872e (ARM:
at91/pata: use gpio_is_valid to check the gpio) broke it again. :-(
Would be good if the changelog did mention that..."
Cc: Andrew Victor <linux@maxim.org.za>
Cc: Nicolas Ferre <nicolas.ferre@atmel.com>
Cc: Jean-Christophe Plagniol-Villard <plagnioj@jcrosoft.com>
Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/pata_at91.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/drivers/ata/pata_at91.c
+++ b/drivers/ata/pata_at91.c
@@ -408,12 +408,13 @@ static int __devinit pata_at91_probe(str
host->private_data = info;
- return ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
- gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
- irq_flags, &pata_at91_sht);
+ ret = ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
+ gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
+ irq_flags, &pata_at91_sht);
+ if (ret)
+ goto err_put;
- if (!ret)
- return 0;
+ return 0;
err_put:
clk_put(info->mck);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 038/214] mm: make fixup_user_fault() check the vma access rights too
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 037/214] pata_at91: fix ata_host_activate() failure handling Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 039/214] timer: Prevent overflow in apply_slack Greg Kroah-Hartman
` (178 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Jones, Hugh Dickins, Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit 1b17844b29ae042576bea588164f2f1e9590a8bc upstream.
fixup_user_fault() is used by the futex code when the direct user access
fails, and the futex code wants it to either map in the page in a usable
form or return an error. It relied on handle_mm_fault() to map the
page, and correctly checked the error return from that, but while that
does map the page, it doesn't actually guarantee that the page will be
mapped with sufficient permissions to be then accessed.
So do the appropriate tests of the vma access rights by hand.
[ Side note: arguably handle_mm_fault() could just do that itself, but
we have traditionally done it in the caller, because some callers -
notably get_user_pages() - have been able to access pages even when
they are mapped with PROT_NONE. Maybe we should re-visit that design
decision, but in the meantime this is the minimal patch. ]
Found by Dave Jones running his trinity tool.
Reported-by: Dave Jones <davej@redhat.com>
Acked-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memory.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1872,12 +1872,17 @@ int fixup_user_fault(struct task_struct
unsigned long address, unsigned int fault_flags)
{
struct vm_area_struct *vma;
+ vm_flags_t vm_flags;
int ret;
vma = find_extend_vma(mm, address);
if (!vma || address < vma->vm_start)
return -EFAULT;
+ vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ;
+ if (!(vm_flags & vma->vm_flags))
+ return -EFAULT;
+
ret = handle_mm_fault(mm, vma, address, fault_flags);
if (ret & VM_FAULT_ERROR) {
if (ret & VM_FAULT_OOM)
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 039/214] timer: Prevent overflow in apply_slack
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 038/214] mm: make fixup_user_fault() check the vma access rights too Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 040/214] ipmi: Fix a race restarting the timer Greg Kroah-Hartman
` (177 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Deborah Townsend, Jiri Bohac,
Thomas Gleixner
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Bohac <jbohac@suse.cz>
commit 98a01e779f3c66b0b11cd7e64d531c0e41c95762 upstream.
On architectures with sizeof(int) < sizeof (long), the
computation of mask inside apply_slack() can be undefined if the
computed bit is > 32.
E.g. with: expires = 0xffffe6f5 and slack = 25, we get:
expires_limit = 0x20000000e
bit = 33
mask = (1 << 33) - 1 /* undefined */
On x86, mask becomes 1 and and the slack is not applied properly.
On s390, mask is -1, expires is set to 0 and the timer fires immediately.
Use 1UL << bit to solve that issue.
Suggested-by: Deborah Townsend <dstownse@us.ibm.com>
Signed-off-by: Jiri Bohac <jbohac@suse.cz>
Link: http://lkml.kernel.org/r/20140418152310.GA13654@midget.suse.cz
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/timer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -815,7 +815,7 @@ unsigned long apply_slack(struct timer_l
bit = find_last_bit(&mask, BITS_PER_LONG);
- mask = (1 << bit) - 1;
+ mask = (1UL << bit) - 1;
expires_limit = expires_limit & ~(mask);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 040/214] ipmi: Fix a race restarting the timer
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 039/214] timer: Prevent overflow in apply_slack Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 041/214] ipmi: Reset the KCS timeout when starting error recovery Greg Kroah-Hartman
` (176 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Corey Minyard, Bodo Stroesser,
Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bodo Stroesser <bstroesser@ts.fujitsu.com>
commit 48e8ac2979920ffa39117e2d725afa3a749bfe8d upstream.
With recent changes it is possible for the timer handler to detect an
idle interface and not start the timer, but the thread to start an
operation at the same time. The thread will not start the timer in that
instance, resulting in the timer not running.
Instead, move all timer operations under the lock and start the timer in
the thread if it detect non-idle and the timer is not already running.
Moving under locks allows the last timeout to be set in both the thread
and the timer. 'Timer is not running' means that the timer is not
pending and smi_timeout() is not running. So we need a flag to detect
this correctly.
Also fix a few other timeout bugs: setting the last timeout when the
interrupt has to be disabled and the timer started, and setting the last
timeout in check_start_timer_thread possibly racing with the timer
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Bodo Stroesser <bstroesser@ts.fujitsu.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/ipmi/ipmi_si_intf.c | 46 +++++++++++++++++++++++----------------
1 file changed, 28 insertions(+), 18 deletions(-)
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -244,6 +244,9 @@ struct smi_info {
/* The timer for this si. */
struct timer_list si_timer;
+ /* This flag is set, if the timer is running (timer_pending() isn't enough) */
+ bool timer_running;
+
/* The time (in jiffies) the last timeout occurred at. */
unsigned long last_timeout_jiffies;
@@ -427,6 +430,13 @@ static void start_clear_flags(struct smi
smi_info->si_state = SI_CLEARING_FLAGS;
}
+static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
+{
+ smi_info->last_timeout_jiffies = jiffies;
+ mod_timer(&smi_info->si_timer, new_val);
+ smi_info->timer_running = true;
+}
+
/*
* When we have a situtaion where we run out of memory and cannot
* allocate messages, we just leave them in the BMC and run the system
@@ -439,8 +449,7 @@ static inline void disable_si_irq(struct
start_disable_irq(smi_info);
smi_info->interrupt_disabled = 1;
if (!atomic_read(&smi_info->stop_operation))
- mod_timer(&smi_info->si_timer,
- jiffies + SI_TIMEOUT_JIFFIES);
+ smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
}
}
@@ -896,15 +905,7 @@ static void sender(void *
list_add_tail(&msg->link, &smi_info->xmit_msgs);
if (smi_info->si_state == SI_NORMAL && smi_info->curr_msg == NULL) {
- /*
- * last_timeout_jiffies is updated here to avoid
- * smi_timeout() handler passing very large time_diff
- * value to smi_event_handler() that causes
- * the send command to abort.
- */
- smi_info->last_timeout_jiffies = jiffies;
-
- mod_timer(&smi_info->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
+ smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
if (smi_info->thread)
wake_up_process(smi_info->thread);
@@ -993,6 +994,17 @@ static int ipmi_thread(void *data)
spin_lock_irqsave(&(smi_info->si_lock), flags);
smi_result = smi_event_handler(smi_info, 0);
+
+ /*
+ * If the driver is doing something, there is a possible
+ * race with the timer. If the timer handler see idle,
+ * and the thread here sees something else, the timer
+ * handler won't restart the timer even though it is
+ * required. So start it here if necessary.
+ */
+ if (smi_result != SI_SM_IDLE && !smi_info->timer_running)
+ smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
+
spin_unlock_irqrestore(&(smi_info->si_lock), flags);
busy_wait = ipmi_thread_busy_wait(smi_result, smi_info,
&busy_until);
@@ -1062,10 +1074,6 @@ static void smi_timeout(unsigned long da
* SI_USEC_PER_JIFFY);
smi_result = smi_event_handler(smi_info, time_diff);
- spin_unlock_irqrestore(&(smi_info->si_lock), flags);
-
- smi_info->last_timeout_jiffies = jiffies_now;
-
if ((smi_info->irq) && (!smi_info->interrupt_disabled)) {
/* Running with interrupts, only do long timeouts. */
timeout = jiffies + SI_TIMEOUT_JIFFIES;
@@ -1087,7 +1095,10 @@ static void smi_timeout(unsigned long da
do_mod_timer:
if (smi_result != SI_SM_IDLE)
- mod_timer(&(smi_info->si_timer), timeout);
+ smi_mod_timer(smi_info, timeout);
+ else
+ smi_info->timer_running = false;
+ spin_unlock_irqrestore(&(smi_info->si_lock), flags);
}
static irqreturn_t si_irq_handler(int irq, void *data)
@@ -1135,8 +1146,7 @@ static int smi_start_processing(void
/* Set up the timer that drives the interface. */
setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
- new_smi->last_timeout_jiffies = jiffies;
- mod_timer(&new_smi->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
+ smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
/*
* Check if the user forcefully enabled the daemon.
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 041/214] ipmi: Reset the KCS timeout when starting error recovery
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 040/214] ipmi: Fix a race restarting the timer Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 042/214] x86, mm, hugetlb: Add missing TLB page invalidation for hugetlb_cow() Greg Kroah-Hartman
` (175 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bodo Stroesser, Corey Minyard,
Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Minyard <cminyard@mvista.com>
commit eb6d78ec213e6938559b801421d64714dafcf4b2 upstream.
The OBF timer in KCS was not reset in one situation when error recovery
was started, resulting in an immediate timeout.
Reported-by: Bodo Stroesser <bstroesser@ts.fujitsu.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/ipmi/ipmi_kcs_sm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/char/ipmi/ipmi_kcs_sm.c
+++ b/drivers/char/ipmi/ipmi_kcs_sm.c
@@ -251,8 +251,9 @@ static inline int check_obf(struct si_sm
if (!GET_STATUS_OBF(status)) {
kcs->obf_timeout -= time;
if (kcs->obf_timeout < 0) {
- start_error_recovery(kcs, "OBF not ready in time");
- return 1;
+ kcs->obf_timeout = OBF_RETRY_TIMEOUT;
+ start_error_recovery(kcs, "OBF not ready in time");
+ return 1;
}
return 0;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 042/214] x86, mm, hugetlb: Add missing TLB page invalidation for hugetlb_cow()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 041/214] ipmi: Reset the KCS timeout when starting error recovery Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 043/214] hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage Greg Kroah-Hartman
` (174 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anthony Iliopoulos, Shay Goikhman,
Dave Hansen, H. Peter Anvin
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Iliopoulos <anthony.iliopoulos@huawei.com>
commit 9844f5462392b53824e8b86726e7c33b5ecbb676 upstream.
The invalidation is required in order to maintain proper semantics
under CoW conditions. In scenarios where a process clones several
threads, a thread operating on a core whose DTLB entry for a
particular hugepage has not been invalidated, will be reading from
the hugepage that belongs to the forked child process, even after
hugetlb_cow().
The thread will not see the updated page as long as the stale DTLB
entry remains cached, the thread attempts to write into the page,
the child process exits, or the thread gets migrated to a different
processor.
Signed-off-by: Anthony Iliopoulos <anthony.iliopoulos@huawei.com>
Link: http://lkml.kernel.org/r/20140514092948.GA17391@server-36.huawei.corp
Suggested-by: Shay Goikhman <shay.goikhman@huawei.com>
Acked-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/hugetlb.h | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/include/asm/hugetlb.h
+++ b/arch/x86/include/asm/hugetlb.h
@@ -51,6 +51,7 @@ static inline pte_t huge_ptep_get_and_cl
static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
unsigned long addr, pte_t *ptep)
{
+ ptep_clear_flush(vma, addr, ptep);
}
static inline int huge_pte_none(pte_t pte)
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 043/214] hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 042/214] x86, mm, hugetlb: Add missing TLB page invalidation for hugetlb_cow() Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 044/214] hwmon: (emc1403) fix inverted store_hyst() Greg Kroah-Hartman
` (173 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chen Yucong, Naoya Horiguchi,
Andi Kleen, Andrew Morton, Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Yucong <slaoub@gmail.com>
commit b985194c8c0a130ed155b71662e39f7eaea4876f upstream.
For handling a free hugepage in memory failure, the race will happen if
another thread hwpoisoned this hugepage concurrently. So we need to
check PageHWPoison instead of !PageHWPoison.
If hwpoison_filter(p) returns true or a race happens, then we need to
unlock_page(hpage).
Signed-off-by: Chen Yucong <slaoub@gmail.com>
Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Tested-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memory-failure.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1061,15 +1061,16 @@ int memory_failure(unsigned long pfn, in
return 0;
} else if (PageHuge(hpage)) {
/*
- * Check "just unpoisoned", "filter hit", and
- * "race with other subpage."
+ * Check "filter hit" and "race with other subpage."
*/
lock_page(hpage);
- if (!PageHWPoison(hpage)
- || (hwpoison_filter(p) && TestClearPageHWPoison(p))
- || (p != hpage && TestSetPageHWPoison(hpage))) {
- atomic_long_sub(nr_pages, &mce_bad_pages);
- return 0;
+ if (PageHWPoison(hpage)) {
+ if ((hwpoison_filter(p) && TestClearPageHWPoison(p))
+ || (p != hpage && TestSetPageHWPoison(hpage))) {
+ atomic_long_sub(nr_pages, &mce_bad_pages);
+ unlock_page(hpage);
+ return 0;
+ }
}
set_page_hwpoison_huge_page(hpage);
res = dequeue_hwpoisoned_huge_page(hpage);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 044/214] hwmon: (emc1403) fix inverted store_hyst()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 043/214] hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 045/214] hwmon: (emc1403) Support full range of known chip revision numbers Greg Kroah-Hartman
` (172 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josef Gajdusek, Jean Delvare, Guenter Roeck
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Gajdusek <atx@atx.name>
commit 17c048fc4bd95efea208a1920f169547d8588f1f upstream.
Attempts to set the hysteresis value to a temperature below the target
limit fails with "write error: Numerical result out of range" due to
an inverted comparison.
Signed-off-by: Josef Gajdusek <atx@atx.name>
Reviewed-by: Jean Delvare <jdelvare@suse.de>
[Guenter Roeck: Updated headline and description]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/emc1403.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hwmon/emc1403.c
+++ b/drivers/hwmon/emc1403.c
@@ -161,7 +161,7 @@ static ssize_t store_hyst(struct device
if (retval < 0)
goto fail;
- hyst = val - retval * 1000;
+ hyst = retval * 1000 - val;
hyst = DIV_ROUND_CLOSEST(hyst, 1000);
if (hyst < 0 || hyst > 255) {
retval = -ERANGE;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 045/214] hwmon: (emc1403) Support full range of known chip revision numbers
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 044/214] hwmon: (emc1403) fix inverted store_hyst() Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 046/214] drivercore: deferral race condition fix Greg Kroah-Hartman
` (171 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Josef Gajdusek, Guenter Roeck
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Gajdusek <atx@atx.name>
commit 3a18e1398fc2dc9c32bbdc50664da3a77959a8d1 upstream.
The datasheet for EMC1413/EMC1414, which is fully compatible to
EMC1403/1404 and uses the same chip identification, references revision
numbers 0x01, 0x03, and 0x04. Accept the full range of revision numbers
from 0x01 to 0x04 to make sure none are missed.
Signed-off-by: Josef Gajdusek <atx@atx.name>
[Guenter Roeck: Updated headline and description]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/emc1403.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hwmon/emc1403.c
+++ b/drivers/hwmon/emc1403.c
@@ -294,7 +294,7 @@ static int emc1403_detect(struct i2c_cli
}
id = i2c_smbus_read_byte_data(client, THERMAL_REVISION_REG);
- if (id != 0x01)
+ if (id < 0x01 || id > 0x04)
return -ENODEV;
return 0;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 046/214] drivercore: deferral race condition fix
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 045/214] hwmon: (emc1403) Support full range of known chip revision numbers Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 047/214] hrtimer: Prevent all reprogramming if hang detected Greg Kroah-Hartman
` (170 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Grant Likely, Peter Ujfalusi, Mark Brown
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grant Likely <grant.likely@linaro.org>
commit 58b116bce13612e5aa6fcd49ecbd4cf8bb59e835 upstream.
When the kernel is built with CONFIG_PREEMPT it is possible to reach a state
when all modules loaded but some driver still stuck in the deferred list
and there is a need for external event to kick the deferred queue to probe
these drivers.
The issue has been observed on embedded systems with CONFIG_PREEMPT enabled,
audio support built as modules and using nfsroot for root filesystem.
The following log fragment shows such sequence when all audio modules
were loaded but the sound card is not present since the machine driver has
failed to probe due to missing dependency during it's probe.
The board is am335x-evmsk (McASP<->tlv320aic3106 codec) with davinci-evm
machine driver:
...
[ 12.615118] davinci-mcasp 4803c000.mcasp: davinci_mcasp_probe: ENTER
[ 12.719969] davinci_evm sound.3: davinci_evm_probe: ENTER
[ 12.725753] davinci_evm sound.3: davinci_evm_probe: snd_soc_register_card
[ 12.753846] davinci-mcasp 4803c000.mcasp: davinci_mcasp_probe: snd_soc_register_component
[ 12.922051] davinci-mcasp 4803c000.mcasp: davinci_mcasp_probe: snd_soc_register_component DONE
[ 12.950839] davinci_evm sound.3: ASoC: platform (null) not registered
[ 12.957898] davinci_evm sound.3: davinci_evm_probe: snd_soc_register_card DONE (-517)
[ 13.099026] davinci-mcasp 4803c000.mcasp: Kicking the deferred list
[ 13.177838] davinci-mcasp 4803c000.mcasp: really_probe: probe_count = 2
[ 13.194130] davinci_evm sound.3: snd_soc_register_card failed (-517)
[ 13.346755] davinci_mcasp_driver_init: LEAVE
[ 13.377446] platform sound.3: Driver davinci_evm requests probe deferral
[ 13.592527] platform sound.3: really_probe: probe_count = 0
In the log the machine driver enters it's probe at 12.719969 (this point it
has been removed from the deferred lists). McASP driver already executing
it's probing (since 12.615118).
The machine driver tries to construct the sound card (12.950839) but did
not found one of the components so it fails. After this McASP driver
registers all the ASoC components (the machine driver still in it's probe
function after it failed to construct the card) and the deferred work is
prepared at 13.099026 (note that this time the machine driver is not in the
lists so it is not going to be handled when the work is executing).
Lastly the machine driver exit from it's probe and the core places it to
the deferred list but there will be no other driver going to load and the
deferred queue is not going to be kicked again - till we have external event
like connecting USB stick, etc.
The proposed solution is to try the deferred queue once more when the last
driver is asking for deferring and we had drivers loaded while this last
driver was probing.
This way we can avoid drivers stuck in the deferred queue.
Signed-off-by: Grant Likely <grant.likely@linaro.org>
Reviewed-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Tested-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/dd.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -51,6 +51,7 @@ static DEFINE_MUTEX(deferred_probe_mutex
static LIST_HEAD(deferred_probe_pending_list);
static LIST_HEAD(deferred_probe_active_list);
static struct workqueue_struct *deferred_wq;
+static atomic_t deferred_trigger_count = ATOMIC_INIT(0);
/**
* deferred_probe_work_func() - Retry probing devices in the active list.
@@ -122,6 +123,17 @@ static bool driver_deferred_probe_enable
* This functions moves all devices from the pending list to the active
* list and schedules the deferred probe workqueue to process them. It
* should be called anytime a driver is successfully bound to a device.
+ *
+ * Note, there is a race condition in multi-threaded probe. In the case where
+ * more than one device is probing at the same time, it is possible for one
+ * probe to complete successfully while another is about to defer. If the second
+ * depends on the first, then it will get put on the pending list after the
+ * trigger event has already occured and will be stuck there.
+ *
+ * The atomic 'deferred_trigger_count' is used to determine if a successful
+ * trigger has occurred in the midst of probing a driver. If the trigger count
+ * changes in the midst of a probe, then deferred processing should be triggered
+ * again.
*/
static void driver_deferred_probe_trigger(void)
{
@@ -134,6 +146,7 @@ static void driver_deferred_probe_trigge
* into the active list so they can be retried by the workqueue
*/
mutex_lock(&deferred_probe_mutex);
+ atomic_inc(&deferred_trigger_count);
list_splice_tail_init(&deferred_probe_pending_list,
&deferred_probe_active_list);
mutex_unlock(&deferred_probe_mutex);
@@ -252,6 +265,7 @@ static DECLARE_WAIT_QUEUE_HEAD(probe_wai
static int really_probe(struct device *dev, struct device_driver *drv)
{
int ret = 0;
+ int local_trigger_count = atomic_read(&deferred_trigger_count);
atomic_inc(&probe_count);
pr_debug("bus: '%s': %s: probing driver %s with device %s\n",
@@ -290,6 +304,9 @@ probe_failed:
/* Driver requested deferred probing */
dev_info(dev, "Driver %s requests probe deferral\n", drv->name);
driver_deferred_probe_add(dev);
+ /* Did a trigger occur while probing? Need to re-trigger if yes */
+ if (local_trigger_count != atomic_read(&deferred_trigger_count))
+ driver_deferred_probe_trigger();
} else if (ret != -ENODEV && ret != -ENXIO) {
/* driver matched but the probe failed */
printk(KERN_WARNING
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 047/214] hrtimer: Prevent all reprogramming if hang detected
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 046/214] drivercore: deferral race condition fix Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 048/214] hrtimer: Prevent remote enqueue of leftmost timers Greg Kroah-Hartman
` (169 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stuart Hayes, Thomas Gleixner
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stuart Hayes <stuart.w.hayes@gmail.com>
commit 6c6c0d5a1c949d2e084706f9e5fb1fccc175b265 upstream.
If the last hrtimer interrupt detected a hang it sets hang_detected=1
and programs the clock event device with a delay to let the system
make progress.
If hang_detected == 1, we prevent reprogramming of the clock event
device in hrtimer_reprogram() but not in hrtimer_force_reprogram().
This can lead to the following situation:
hrtimer_interrupt()
hang_detected = 1;
program ce device to Xms from now (hang delay)
We have two timers pending:
T1 expires 50ms from now
T2 expires 5s from now
Now T1 gets canceled, which causes hrtimer_force_reprogram() to be
invoked, which in turn programs the clock event device to T2 (5
seconds from now).
Any hrtimer_start after that will not reprogram the hardware due to
hang_detected still being set. So we effectivly block all timers until
the T2 event fires and cleans up the hang situation.
Add a check for hang_detected to hrtimer_force_reprogram() which
prevents the reprogramming of the hang delay in the hardware
timer. The subsequent hrtimer_interrupt will resolve all outstanding
issues.
[ tglx: Rewrote subject and changelog and fixed up the comment in
hrtimer_force_reprogram() ]
Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
Link: http://lkml.kernel.org/r/53602DC6.2060101@gmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/hrtimer.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -567,6 +567,23 @@ hrtimer_force_reprogram(struct hrtimer_c
cpu_base->expires_next.tv64 = expires_next.tv64;
+ /*
+ * If a hang was detected in the last timer interrupt then we
+ * leave the hang delay active in the hardware. We want the
+ * system to make progress. That also prevents the following
+ * scenario:
+ * T1 expires 50ms from now
+ * T2 expires 5s from now
+ *
+ * T1 is removed, so this code is called and would reprogram
+ * the hardware to 5s from now. Any hrtimer_start after that
+ * will not reprogram the hardware due to hang_detected being
+ * set. So we'd effectivly block all timers until the T2 event
+ * fires.
+ */
+ if (cpu_base->hang_detected)
+ return;
+
if (cpu_base->expires_next.tv64 != KTIME_MAX)
tick_program_event(cpu_base->expires_next, 1);
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 048/214] hrtimer: Prevent remote enqueue of leftmost timers
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 047/214] hrtimer: Prevent all reprogramming if hang detected Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 049/214] hrtimer: Set expiry time before switch_hrtimer_base() Greg Kroah-Hartman
` (168 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Leon Ma, Thomas Gleixner
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Ma <xindong.ma@intel.com>
commit 012a45e3f4af68e86d85cce060c6c2fed56498b2 upstream.
If a cpu is idle and starts an hrtimer which is not pinned on that
same cpu, the nohz code might target the timer to a different cpu.
In the case that we switch the cpu base of the timer we already have a
sanity check in place, which determines whether the timer is earlier
than the current leftmost timer on the target cpu. In that case we
enqueue the timer on the current cpu because we cannot reprogram the
clock event device on the target.
If the timers base is already the target CPU we do not have this
sanity check in place so we enqueue the timer as the leftmost timer in
the target cpus rb tree, but we cannot reprogram the clock event
device on the target cpu. So the timer expires late and subsequently
prevents the reprogramming of the target cpu clock event device until
the previously programmed event fires or a timer with an earlier
expiry time gets enqueued on the target cpu itself.
Add the same target check as we have for the switch base case and
start the timer on the current cpu if it would become the leftmost
timer on the target.
[ tglx: Rewrote subject and changelog ]
Signed-off-by: Leon Ma <xindong.ma@intel.com>
Link: http://lkml.kernel.org/r/1398847391-5994-1-git-send-email-xindong.ma@intel.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/hrtimer.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -232,6 +232,11 @@ again:
goto again;
}
timer->base = new_base;
+ } else {
+ if (cpu != this_cpu && hrtimer_check_target(timer, new_base)) {
+ cpu = this_cpu;
+ goto again;
+ }
}
return new_base;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 049/214] hrtimer: Set expiry time before switch_hrtimer_base()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 048/214] hrtimer: Prevent remote enqueue of leftmost timers Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 050/214] md: avoid possible spinning md thread at shutdown Greg Kroah-Hartman
` (167 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Viresh Kumar, Thomas Gleixner,
linaro-kernel, linaro-networking, fweisbec, arvind.chauhan
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <viresh.kumar@linaro.org>
commit 84ea7fe37908254c3bd90910921f6e1045c1747a upstream.
switch_hrtimer_base() calls hrtimer_check_target() which ensures that
we do not migrate a timer to a remote cpu if the timer expires before
the current programmed expiry time on that remote cpu.
But __hrtimer_start_range_ns() calls switch_hrtimer_base() before the
new expiry time is set. So the sanity check in hrtimer_check_target()
is operating on stale or even uninitialized data.
Update expiry time before calling switch_hrtimer_base().
[ tglx: Rewrote changelog once again ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Cc: linaro-kernel@lists.linaro.org
Cc: linaro-networking@linaro.org
Cc: fweisbec@gmail.com
Cc: arvind.chauhan@arm.com
Link: http://lkml.kernel.org/r/81999e148745fc51bbcd0615823fbab9b2e87e23.1399882253.git.viresh.kumar@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/hrtimer.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -985,11 +985,8 @@ int __hrtimer_start_range_ns(struct hrti
/* Remove an active timer from the queue: */
ret = remove_hrtimer(timer, base);
- /* Switch the timer base, if necessary: */
- new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
-
if (mode & HRTIMER_MODE_REL) {
- tim = ktime_add_safe(tim, new_base->get_time());
+ tim = ktime_add_safe(tim, base->get_time());
/*
* CONFIG_TIME_LOW_RES is a temporary way for architectures
* to signal that they simply return xtime in
@@ -1004,6 +1001,9 @@ int __hrtimer_start_range_ns(struct hrti
hrtimer_set_expires_range_ns(timer, tim, delta_ns);
+ /* Switch the timer base, if necessary: */
+ new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
+
timer_stats_hrtimer_set_start_info(timer);
leftmost = enqueue_hrtimer(timer, new_base);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 050/214] md: avoid possible spinning md thread at shutdown.
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 049/214] hrtimer: Set expiry time before switch_hrtimer_base() Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 051/214] drm/radeon: fix ATPX detection on non-VGA GPUs Greg Kroah-Hartman
` (166 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, NeilBrown
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.de>
commit 0f62fb220aa4ebabe8547d3a9ce4a16d3c045f21 upstream.
If an md array with externally managed metadata (e.g. DDF or IMSM)
is in use, then we should not set safemode==2 at shutdown because:
1/ this is ineffective: user-space need to be involved in any 'safemode' handling,
2/ The safemode management code doesn't cope with safemode==2 on external metadata
and md_check_recover enters an infinite loop.
Even at shutdown, an infinite-looping process can be problematic, so this
could cause shutdown to hang.
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/md.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8167,7 +8167,8 @@ static int md_notify_reboot(struct notif
if (mddev_trylock(mddev)) {
if (mddev->pers)
__md_stop_writes(mddev);
- mddev->safemode = 2;
+ if (mddev->persistent)
+ mddev->safemode = 2;
mddev_unlock(mddev);
}
need_delay = 1;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 051/214] drm/radeon: fix ATPX detection on non-VGA GPUs
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 050/214] md: avoid possible spinning md thread at shutdown Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 052/214] usb: gadget: at91-udc: fix irq and iomem resource retrieval Greg Kroah-Hartman
` (165 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher, airlied
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexdeucher@gmail.com>
commit e9a4099a59cc598a44006059dd775c25e422b772 upstream.
Some newer PX laptops have the pci device class
set to DISPLAY_OTHER rather than DISPLAY_VGA. This
properly detects ATPX on those laptops.
Based on a patch from: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: airlied@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_atpx_handler.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -202,6 +202,13 @@ static bool radeon_atpx_detect(void)
has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
}
+ /* some newer PX laptops mark the dGPU as a non-VGA display device */
+ while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
+ vga_count++;
+
+ has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
+ }
+
if (has_atpx && vga_count == 2) {
acpi_get_name(radeon_atpx_priv.atpx_handle, ACPI_FULL_PATHNAME, &buffer);
printk(KERN_INFO "VGA switcheroo: detected switching method %s handle\n",
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 052/214] usb: gadget: at91-udc: fix irq and iomem resource retrieval
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 051/214] drm/radeon: fix ATPX detection on non-VGA GPUs Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 053/214] usb: storage: shuttle_usbat: fix discs being detected twice Greg Kroah-Hartman
` (164 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jean-Jacques Hiblot, Boris BREZILLON,
Nicolas Ferre, Felipe Balbi
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
commit 886c7c426d465732ec9d1b2bbdda5642fc2e7e05 upstream.
When using dt resources retrieval (interrupts and reg properties) there is
no predefined order for these resources in the platform dev resource
table. Also don't expect the number of resource to be always 2.
Signed-off-by: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
Acked-by: Boris BREZILLON <b.brezillon@overkiz.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/at91_udc.c | 10 ----------
1 file changed, 10 deletions(-)
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -1741,16 +1741,6 @@ static int __devinit at91udc_probe(struc
return -ENODEV;
}
- if (pdev->num_resources != 2) {
- DBG("invalid num_resources\n");
- return -ENODEV;
- }
- if ((pdev->resource[0].flags != IORESOURCE_MEM)
- || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
- DBG("invalid resource type\n");
- return -ENODEV;
- }
-
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (!res)
return -ENXIO;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 053/214] usb: storage: shuttle_usbat: fix discs being detected twice
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 052/214] usb: gadget: at91-udc: fix irq and iomem resource retrieval Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 054/214] USB: Nokia 305 should be treated as unusual dev Greg Kroah-Hartman
` (163 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Daniele Forsi
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Forsi <dforsi@gmail.com>
commit df602c2d2358f02c6e49cffc5b49b9daa16db033 upstream.
Even if the USB-to-ATAPI converter supported multiple LUNs, this
driver would always detect the same physical device or media because
it doesn't use srb->device->lun in any way.
Tested with an Hewlett-Packard CD-Writer Plus 8200e.
Signed-off-by: Daniele Forsi <dforsi@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/shuttle_usbat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/storage/shuttle_usbat.c
+++ b/drivers/usb/storage/shuttle_usbat.c
@@ -1846,7 +1846,7 @@ static int usbat_probe(struct usb_interf
us->transport_name = "Shuttle USBAT";
us->transport = usbat_flash_transport;
us->transport_reset = usb_stor_CB_reset;
- us->max_lun = 1;
+ us->max_lun = 0;
result = usb_stor_probe2(us);
return result;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 054/214] USB: Nokia 305 should be treated as unusual dev
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 053/214] usb: storage: shuttle_usbat: fix discs being detected twice Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 055/214] USB: Nokia 5300 " Greg Kroah-Hartman
` (162 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Victor A. Santos
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Victor A. Santos" <victoraur.santos@gmail.com>
commit f0ef5d41792a46a1085dead9dfb0bdb2c574638e upstream.
Signed-off-by: Victor A. Santos <victoraur.santos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -226,6 +226,13 @@ UNUSUAL_DEV( 0x0421, 0x0495, 0x0370, 0x
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_MAX_SECTORS_64 ),
+/* Patch submitted by Victor A. Santos <victoraur.santos@gmail.com> */
+UNUSUAL_DEV( 0x0421, 0x05af, 0x0742, 0x0742,
+ "Nokia",
+ "305",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_MAX_SECTORS_64),
+
/* Patch submitted by Mikhail Zolotaryov <lebon@lebon.org.ua> */
UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x1110,
"Nokia",
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 055/214] USB: Nokia 5300 should be treated as unusual dev
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 054/214] USB: Nokia 305 should be treated as unusual dev Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 056/214] rt2x00: fix beaconing on USB Greg Kroah-Hartman
` (161 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Daniele Forsi
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Forsi <dforsi@gmail.com>
commit 6ed07d45d09bc2aa60e27b845543db9972e22a38 upstream.
Signed-off-by: Daniele Forsi <dforsi@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -226,6 +226,13 @@ UNUSUAL_DEV( 0x0421, 0x0495, 0x0370, 0x
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_MAX_SECTORS_64 ),
+/* Reported by Daniele Forsi <dforsi@gmail.com> */
+UNUSUAL_DEV( 0x0421, 0x04b9, 0x0350, 0x0350,
+ "Nokia",
+ "5300",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_MAX_SECTORS_64 ),
+
/* Patch submitted by Victor A. Santos <victoraur.santos@gmail.com> */
UNUSUAL_DEV( 0x0421, 0x05af, 0x0742, 0x0742,
"Nokia",
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 056/214] rt2x00: fix beaconing on USB
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 055/214] USB: Nokia 5300 " Greg Kroah-Hartman
@ 2014-06-05 4:16 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 057/214] posix_acl: handle NULL ACL in posix_acl_equiv_mode Greg Kroah-Hartman
` (160 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:16 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stanislaw Gruszka, John W. Linville
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <sgruszka@redhat.com>
commit 8834d3608cc516f13e2e510f4057c263f3d2ce42 upstream.
When disable beaconing we clear register with beacon and newer set it
back, what make we stop send beacons infinitely.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rt2x00/rt2x00mac.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -651,20 +651,18 @@ void rt2x00mac_bss_info_changed(struct i
bss_conf->bssid);
/*
- * Update the beacon. This is only required on USB devices. PCI
- * devices fetch beacons periodically.
- */
- if (changes & BSS_CHANGED_BEACON && rt2x00_is_usb(rt2x00dev))
- rt2x00queue_update_beacon(rt2x00dev, vif);
-
- /*
* Start/stop beaconing.
*/
if (changes & BSS_CHANGED_BEACON_ENABLED) {
if (!bss_conf->enable_beacon && intf->enable_beacon) {
- rt2x00queue_clear_beacon(rt2x00dev, vif);
rt2x00dev->intf_beaconing--;
intf->enable_beacon = false;
+ /*
+ * Clear beacon in the H/W for this vif. This is needed
+ * to disable beaconing on this particular interface
+ * and keep it running on other interfaces.
+ */
+ rt2x00queue_clear_beacon(rt2x00dev, vif);
if (rt2x00dev->intf_beaconing == 0) {
/*
@@ -675,11 +673,15 @@ void rt2x00mac_bss_info_changed(struct i
rt2x00queue_stop_queue(rt2x00dev->bcn);
mutex_unlock(&intf->beacon_skb_mutex);
}
-
-
} else if (bss_conf->enable_beacon && !intf->enable_beacon) {
rt2x00dev->intf_beaconing++;
intf->enable_beacon = true;
+ /*
+ * Upload beacon to the H/W. This is only required on
+ * USB devices. PCI devices fetch beacons periodically.
+ */
+ if (rt2x00_is_usb(rt2x00dev))
+ rt2x00queue_update_beacon(rt2x00dev, vif);
if (rt2x00dev->intf_beaconing == 1) {
/*
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 057/214] posix_acl: handle NULL ACL in posix_acl_equiv_mode
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2014-06-05 4:16 ` [PATCH 3.4 056/214] rt2x00: fix beaconing on USB Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 058/214] ARM: 8012/1: kdump: Avoid overflow when converting pfn to physaddr Greg Kroah-Hartman
` (159 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Ben Greear,
Chuck Lever, Al Viro
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
commit 50c6e282bdf5e8dabf8d7cf7b162545a55645fd9 upstream.
Various filesystems don't bother checking for a NULL ACL in
posix_acl_equiv_mode, and thus can dereference a NULL pointer when it
gets passed one. This usually happens from the NFS server, as the ACL tools
never pass a NULL ACL, but instead of one representing the mode bits.
Instead of adding boilerplat to all filesystems put this check into one place,
which will allow us to remove the check from other filesystems as well later
on.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reported-by: Ben Greear <greearb@candelatech.com>
Reported-by: Marco Munderloh <munderl@tnt.uni-hannover.de>,
Cc: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/posix_acl.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -155,6 +155,12 @@ posix_acl_equiv_mode(const struct posix_
umode_t mode = 0;
int not_equiv = 0;
+ /*
+ * A null ACL can always be presented as mode bits.
+ */
+ if (!acl)
+ return 0;
+
FOREACH_ACL_ENTRY(pa, acl, pe) {
switch (pa->e_tag) {
case ACL_USER_OBJ:
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 058/214] ARM: 8012/1: kdump: Avoid overflow when converting pfn to physaddr
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 057/214] posix_acl: handle NULL ACL in posix_acl_equiv_mode Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 059/214] rtl8192cu: Fix unbalanced irq enable in error path of rtl92cu_hw_init() Greg Kroah-Hartman
` (158 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Liu Hua, Russell King
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Hua <sdu.liu@huawei.com>
commit 8fad87bca7ac9737e413ba5f1656f1114a8c314d upstream.
When we configure CONFIG_ARM_LPAE=y, pfn << PAGE_SHIFT will
overflow if pfn >= 0x100000 in copy_oldmem_page.
So use __pfn_to_phys for converting.
Signed-off-by: Liu Hua <sdu.liu@huawei.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kernel/crash_dump.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/kernel/crash_dump.c
+++ b/arch/arm/kernel/crash_dump.c
@@ -39,7 +39,7 @@ ssize_t copy_oldmem_page(unsigned long p
if (!csize)
return 0;
- vaddr = ioremap(pfn << PAGE_SHIFT, PAGE_SIZE);
+ vaddr = ioremap(__pfn_to_phys(pfn), PAGE_SIZE);
if (!vaddr)
return -ENOMEM;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 059/214] rtl8192cu: Fix unbalanced irq enable in error path of rtl92cu_hw_init()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 058/214] ARM: 8012/1: kdump: Avoid overflow when converting pfn to physaddr Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 060/214] drm/nouveau/acpi: allow non-optimus setups to load vbios from acpi Greg Kroah-Hartman
` (157 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Hutchings, John W. Linville
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit 3234f5b06fc3094176a86772cc64baf3decc98fc upstream.
Fixes: a53268be0cb9 ('rtlwifi: rtl8192cu: Fix too long disable of IRQs')
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rtlwifi/rtl8192cu/hw.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1001,7 +1001,7 @@ int rtl92cu_hw_init(struct ieee80211_hw
err = _rtl92cu_init_mac(hw);
if (err) {
RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "init mac failed!\n");
- return err;
+ goto exit;
}
err = rtl92c_download_fw(hw);
if (err) {
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 060/214] drm/nouveau/acpi: allow non-optimus setups to load vbios from acpi
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 059/214] rtl8192cu: Fix unbalanced irq enable in error path of rtl92cu_hw_init() Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` Greg Kroah-Hartman
` (156 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ilia Mirkin, Ben Skeggs
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilia Mirkin <imirkin@alum.mit.edu>
commit a3d0b1218d351c6e6f3cea36abe22236a08cb246 upstream.
There appear to be a crop of new hardware where the vbios is not
available from PROM/PRAMIN, but there is a valid _ROM method in ACPI.
The data read from PCIROM almost invariably contains invalid
instructions (still has the x86 opcodes), which makes this a low-risk
way to try to obtain a valid vbios image.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=76475
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_acpi.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -375,9 +375,6 @@ bool nouveau_acpi_rom_supported(struct p
acpi_status status;
acpi_handle dhandle, rom_handle;
- if (!nouveau_dsm_priv.dsm_detected && !nouveau_dsm_priv.optimus_detected)
- return false;
-
dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
if (!dhandle)
return false;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 061/214] Documentation: Update stable address in Chinese and Japanese translations
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 002/214] mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages() Greg Kroah-Hartman
` (215 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=UTF-8, Size: 4234 bytes --]
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
commit 98b0f811aade1b7c6e7806c86aa0befd5919d65f upstream.
The English and Korean translations were updated, the Chinese and Japanese
weren't.
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/ja_JP/HOWTO | 2 +-
Documentation/ja_JP/stable_kernel_rules.txt | 6 +++---
Documentation/zh_CN/HOWTO | 2 +-
Documentation/zh_CN/stable_kernel_rules.txt | 2 +-
4 files changed, 6 insertions(+), 6 deletions(-)
--- a/Documentation/ja_JP/HOWTO
+++ b/Documentation/ja_JP/HOWTO
@@ -315,7 +315,7 @@ Andrew Morton ㌠Linux-kernel メーリ
ã‚‚ã—ã€2.6.x.y カーãƒãƒ«ãŒå˜åœ¨ã—ãªã„å ´åˆã«ã¯ã€ç•ªå·ãŒä¸€ç•ªå¤§ãã„ 2.6.x ãŒ
最新ã®å®‰å®šç‰ˆã‚«ãƒ¼ãƒãƒ«ã§ã™ã€‚
-2.6.x.y 㯠"stable" ãƒãƒ¼ãƒ <stable@kernel.org> ã§ãƒ¡ãƒ³ãƒ†ã•ã‚Œã¦ãŠã‚Šã€å¿…
+2.6.x.y 㯠"stable" ãƒãƒ¼ãƒ <stable@vger.kernel.org> ã§ãƒ¡ãƒ³ãƒ†ã•ã‚Œã¦ãŠã‚Šã€å¿…
è¦ã«å¿œã˜ã¦ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã™ã€‚通常ã®ãƒªãƒªãƒ¼ã‚¹æœŸé–“㯠2週間毎ã§ã™ãŒã€å·®ã—è¿«ã£
ãŸå•é¡ŒãŒãªã‘ã‚Œã°ã‚‚ã†å°‘ã—é•·ããªã‚‹ã“ã¨ã‚‚ã‚ã‚Šã¾ã™ã€‚ã‚»ã‚ュリティ関連ã®å•é¡Œ
ã®å ´åˆã¯ã“ã‚Œã«å¯¾ã—ã¦ã ã„ãŸã„ã®å ´åˆã€ã™ãã«ãƒªãƒªãƒ¼ã‚¹ãŒã•ã‚Œã¾ã™ã€‚
--- a/Documentation/ja_JP/stable_kernel_rules.txt
+++ b/Documentation/ja_JP/stable_kernel_rules.txt
@@ -50,16 +50,16 @@ linux-2.6.29/Documentation/stable_kernel
-stable ツリーã«ãƒ‘ッãƒã‚’é€ä»˜ã™ã‚‹æ‰‹ç¶šã-
- - 上記ã®è¦å‰‡ã«å¾“ã£ã¦ã„ã‚‹ã‹ã‚’確èªã—ãŸå¾Œã«ã€stable@kernel.org ã«ãƒ‘ッãƒ
+ - 上記ã®è¦å‰‡ã«å¾“ã£ã¦ã„ã‚‹ã‹ã‚’確èªã—ãŸå¾Œã«ã€stable@vger.kernel.org ã«ãƒ‘ッãƒ
ã‚’é€ã‚‹ã€‚
- é€ä¿¡è€…ã¯ãƒ‘ッãƒãŒã‚ューã«å—ã‘付ã‘られãŸéš›ã«ã¯ ACK ã‚’ã€å´ä¸‹ã•ã‚ŒãŸå ´åˆ
ã«ã¯ NAK ã‚’å—ã‘å–る。ã“ã®åå¿œã¯é–‹ç™ºè€…ãŸã¡ã®ã‚¹ã‚±ã‚¸ãƒ¥ãƒ¼ãƒ«ã«ã‚ˆã£ã¦ã€æ•°
æ—¥ã‹ã‹ã‚‹å ´åˆãŒã‚る。
- ã‚‚ã—å—ã‘å–られãŸã‚‰ã€ãƒ‘ッãƒã¯ä»–ã®é–‹ç™ºè€…ãŸã¡ã¨é–¢é€£ã™ã‚‹ã‚µãƒ–システムã®
メンテナーã«ã‚ˆã‚‹ãƒ¬ãƒ“ューã®ãŸã‚ã« -stable ã‚ューã«è¿½åŠ ã•ã‚Œã‚‹ã€‚
- - パッãƒã« stable@kernel.org ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ãŒä»˜åŠ ã•ã‚Œã¦ã„ã‚‹ã¨ãã«ã¯ã€ãã‚Œ
+ - パッãƒã« stable@vger.kernel.org ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ãŒä»˜åŠ ã•ã‚Œã¦ã„ã‚‹ã¨ãã«ã¯ã€ãã‚Œ
㌠Linus ã®ãƒ„リーã«å…¥ã‚‹æ™‚ã«è‡ªå‹•çš„ã« stable ãƒãƒ¼ãƒ ã« email ã•ã‚Œã‚‹ã€‚
- - ã‚»ã‚ュリティパッãƒã¯ã“ã®ã‚¨ã‚¤ãƒªã‚¢ã‚¹ (stable@kernel.org) ã«é€ã‚‰ã‚Œã‚‹ã¹
+ - ã‚»ã‚ュリティパッãƒã¯ã“ã®ã‚¨ã‚¤ãƒªã‚¢ã‚¹ (stable@vger.kernel.org) ã«é€ã‚‰ã‚Œã‚‹ã¹
ãã§ã¯ãªãã€ä»£ã‚ã‚Šã« security@kernel.org ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ã«é€ã‚‰ã‚Œã‚‹ã€‚
レビューサイクル-
--- a/Documentation/zh_CN/HOWTO
+++ b/Documentation/zh_CN/HOWTO
@@ -237,7 +237,7 @@ kernel.org网站的pub/linux/kernel/v2.6
如果没有2.6.x.yç‰ˆæœ¬å†…æ ¸å˜åœ¨ï¼Œé‚£ä¹ˆæœ€æ–°çš„2.6.xç‰ˆæœ¬å†…æ ¸å°±ç›¸å½“äºŽæ˜¯å½“å‰çš„稳定
ç‰ˆå†…æ ¸ã€‚
-2.6.x.y版本由“稳定版â€å°ç»„（邮件地å€<stable@kernel.org>）维护，一般隔周å‘
+2.6.x.y版本由“稳定版â€å°ç»„（邮件地å€<stable@vger.kernel.org>）维护，一般隔周å‘
布新版本。
å†…æ ¸æºç ä¸çš„Documentation/stable_kernel_rules.txt文件具体æ述了å¯è¢«ç¨³å®š
--- a/Documentation/zh_CN/stable_kernel_rules.txt
+++ b/Documentation/zh_CN/stable_kernel_rules.txt
@@ -42,7 +42,7 @@ Documentation/stable_kernel_rules.txt çš
å‘稳定版代ç æ ‘æ交补ä¸çš„过程：
- - 在确认了补ä¸ç¬¦åˆä»¥ä¸Šçš„规则åŽï¼Œå°†è¡¥ä¸å‘é€åˆ°stable@kernel.org。
+ - 在确认了补ä¸ç¬¦åˆä»¥ä¸Šçš„规则åŽï¼Œå°†è¡¥ä¸å‘é€åˆ°stable@vger.kernel.org。
- 如果补ä¸è¢«æŽ¥å—到队列里，å‘é€è€…会收到一个ACK回å¤ï¼Œå¦‚果没有被接å—，收
到的是NAK回å¤ã€‚回å¤éœ€è¦å‡ 天的时间，这å–决于开å‘者的时间安排。
- 被接å—çš„è¡¥ä¸ä¼šè¢«åŠ 到稳定版本队列里，ç‰å¾…其他开å‘者的审查。
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 061/214] Documentation: Update stable address in Chinese and Japanese translations
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
0 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
commit 98b0f811aade1b7c6e7806c86aa0befd5919d65f upstream.
The English and Korean translations were updated, the Chinese and Japanese
weren't.
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/ja_JP/HOWTO | 2 +-
Documentation/ja_JP/stable_kernel_rules.txt | 6 +++---
Documentation/zh_CN/HOWTO | 2 +-
Documentation/zh_CN/stable_kernel_rules.txt | 2 +-
4 files changed, 6 insertions(+), 6 deletions(-)
--- a/Documentation/ja_JP/HOWTO
+++ b/Documentation/ja_JP/HOWTO
@@ -315,7 +315,7 @@ Andrew Morton が Linux-kernel メーリ
もし、2.6.x.y カーネルが存在しない場合には、番号が一番大きい 2.6.x が
最新の安定版カーネルです。
-2.6.x.y は "stable" チーム <stable@kernel.org> でメンテされており、必
+2.6.x.y は "stable" チーム <stable@vger.kernel.org> でメンテされており、必
要に応じてリリースされます。通常のリリース期間は 2週間毎ですが、差し迫っ
た問題がなければもう少し長くなることもあります。セキュリティ関連の問題
の場合はこれに対してだいたいの場合、すぐにリリースがされます。
--- a/Documentation/ja_JP/stable_kernel_rules.txt
+++ b/Documentation/ja_JP/stable_kernel_rules.txt
@@ -50,16 +50,16 @@ linux-2.6.29/Documentation/stable_kernel
-stable ツリーにパッチを送付する手続き-
- - 上記の規則に従っているかを確認した後に、stable@kernel.org にパッチ
+ - 上記の規則に従っているかを確認した後に、stable@vger.kernel.org にパッチ
を送る。
- 送信者はパッチがキューに受け付けられた際には ACK を、却下された場合
には NAK を受け取る。この反応は開発者たちのスケジュールによって、数
日かかる場合がある。
- もし受け取られたら、パッチは他の開発者たちと関連するサブシステムの
メンテナーによるレビューのために -stable キューに追加される。
- - パッチに stable@kernel.org のアドレスが付加されているときには、それ
+ - パッチに stable@vger.kernel.org のアドレスが付加されているときには、それ
が Linus のツリーに入る時に自動的に stable チームに email される。
- - セキュリティパッチはこのエイリアス (stable@kernel.org) に送られるべ
+ - セキュリティパッチはこのエイリアス (stable@vger.kernel.org) に送られるべ
きではなく、代わりに security@kernel.org のアドレスに送られる。
レビューサイクル-
--- a/Documentation/zh_CN/HOWTO
+++ b/Documentation/zh_CN/HOWTO
@@ -237,7 +237,7 @@ kernel.org网站的pub/linux/kernel/v2.6
如果没有2.6.x.y版本内核存在，那么最新的2.6.x版本内核就相当于是当前的稳定
版内核。
-2.6.x.y版本由“稳定版”小组（邮件地址<stable@kernel.org>）维护，一般隔周发
+2.6.x.y版本由“稳定版”小组（邮件地址<stable@vger.kernel.org>）维护，一般隔周发
布新版本。
内核源码中的Documentation/stable_kernel_rules.txt文件具体描述了可被稳定
--- a/Documentation/zh_CN/stable_kernel_rules.txt
+++ b/Documentation/zh_CN/stable_kernel_rules.txt
@@ -42,7 +42,7 @@ Documentation/stable_kernel_rules.txt �
向稳定版代码树提交补丁的过程：
- - 在确认了补丁符合以上的规则后，将补丁发送到stable@kernel.org。
+ - 在确认了补丁符合以上的规则后，将补丁发送到stable@vger.kernel.org。
- 如果补丁被接受到队列里，发送者会收到一个ACK回复，如果没有被接受，收
到的是NAK回复。回复需要几天的时间，这取决于开发者的时间安排。
- 被接受的补丁会被加到稳定版本队列里，等待其他开发者的审查。
^ permalink raw reply [flat|nested] 234+ messages in thread
* [PATCH 3.4 062/214] crypto: crypto_wq - Fix late crypto work queue initialization
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2014-06-05 4:17 ` Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 063/214] media: media-device: fix infoleak in ioctl media_enum_entities() Greg Kroah-Hartman
` (154 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tim Chen, Herbert Xu
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Chen <tim.c.chen@linux.intel.com>
commit 130fa5bc81b44b6cc1fbdea3abf6db0da22964e0 upstream.
The crypto algorithm modules utilizing the crypto daemon could
be used early when the system start up. Using module_init
does not guarantee that the daemon's work queue is initialized
when the cypto alorithm depending on crypto_wq starts. It is necessary
to initialize the crypto work queue earlier at the subsystem
init time to make sure that it is initialized
when used.
Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/crypto_wq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/crypto/crypto_wq.c
+++ b/crypto/crypto_wq.c
@@ -33,7 +33,7 @@ static void __exit crypto_wq_exit(void)
destroy_workqueue(kcrypto_wq);
}
-module_init(crypto_wq_init);
+subsys_initcall(crypto_wq_init);
module_exit(crypto_wq_exit);
MODULE_LICENSE("GPL");
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 063/214] media: media-device: fix infoleak in ioctl media_enum_entities()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 062/214] crypto: crypto_wq - Fix late crypto work queue initialization Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 064/214] trace: module: Maintain a valid user count Greg Kroah-Hartman
` (153 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Salva Peiró,
Laurent Pinchart, Mauro Carvalho Chehab
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Salva=20Peir=C3=B3?= <speiro@ai2.upv.es>
commit e6a623460e5fc960ac3ee9f946d3106233fd28d8 upstream.
This fixes CVE-2014-1739.
Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/media-device.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -90,6 +90,7 @@ static long media_device_enum_entities(s
struct media_entity *ent;
struct media_entity_desc u_ent;
+ memset(&u_ent, 0, sizeof(u_ent));
if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id)))
return -EFAULT;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 064/214] trace: module: Maintain a valid user count
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 063/214] media: media-device: fix infoleak in ioctl media_enum_entities() Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 065/214] NFSD: Call ->set_acl with a NULL ACL structure if no entries Greg Kroah-Hartman
` (152 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ingo Molnar, Rusty Russell,
Frederic Weisbecker, Romain Izard, Steven Rostedt
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Romain Izard <romain.izard.pro@gmail.com>
commit 098507ae3ec2331476fb52e85d4040c1cc6d0ef4 upstream.
The replacement of the 'count' variable by two variables 'incs' and
'decs' to resolve some race conditions during module unloading was done
in parallel with some cleanup in the trace subsystem, and was integrated
as a merge.
Unfortunately, the formula for this replacement was wrong in the tracing
code, and the refcount in the traces was not usable as a result.
Use 'count = incs - decs' to compute the user count.
Link: http://lkml.kernel.org/p/1393924179-9147-1-git-send-email-romain.izard.pro@gmail.com
Acked-by: Ingo Molnar <mingo@kernel.org>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Fixes: c1ab9cab7509 "merge conflict resolution"
Signed-off-by: Romain Izard <romain.izard.pro@gmail.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/trace/events/module.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/trace/events/module.h
+++ b/include/trace/events/module.h
@@ -78,7 +78,7 @@ DECLARE_EVENT_CLASS(module_refcnt,
TP_fast_assign(
__entry->ip = ip;
- __entry->refcnt = __this_cpu_read(mod->refptr->incs) + __this_cpu_read(mod->refptr->decs);
+ __entry->refcnt = __this_cpu_read(mod->refptr->incs) - __this_cpu_read(mod->refptr->decs);
__assign_str(name, mod->name);
),
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 065/214] NFSD: Call ->set_acl with a NULL ACL structure if no entries
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 064/214] trace: module: Maintain a valid user count Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 066/214] nfsd4: warn on finding lockowner without stateids Greg Kroah-Hartman
` (151 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kinglong Mee, J. Bruce Fields
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kinglong Mee <kinglongmee@gmail.com>
commit aa07c713ecfc0522916f3cd57ac628ea6127c0ec upstream.
After setting ACL for directory, I got two problems that caused
by the cached zero-length default posix acl.
This patch make sure nfsd4_set_nfs4_acl calls ->set_acl
with a NULL ACL structure if there are no entries.
Thanks for Christoph Hellwig's advice.
First problem:
............ hang ...........
Second problem:
[ 1610.167668] ------------[ cut here ]------------
[ 1610.168320] kernel BUG at /root/nfs/linux/fs/nfsd/nfs4acl.c:239!
[ 1610.168320] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC
[ 1610.168320] Modules linked in: nfsv4(OE) nfs(OE) nfsd(OE)
rpcsec_gss_krb5 fscache ip6t_rpfilter ip6t_REJECT cfg80211 xt_conntrack
rfkill ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables
ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6
ip6table_mangle ip6table_security ip6table_raw ip6table_filter
ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4
nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw
auth_rpcgss nfs_acl snd_intel8x0 ppdev lockd snd_ac97_codec ac97_bus
snd_pcm snd_timer e1000 pcspkr parport_pc snd parport serio_raw joydev
i2c_piix4 sunrpc(OE) microcode soundcore i2c_core ata_generic pata_acpi
[last unloaded: nfsd]
[ 1610.168320] CPU: 0 PID: 27397 Comm: nfsd Tainted: G OE
3.15.0-rc1+ #15
[ 1610.168320] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
VirtualBox 12/01/2006
[ 1610.168320] task: ffff88005ab653d0 ti: ffff88005a944000 task.ti:
ffff88005a944000
[ 1610.168320] RIP: 0010:[<ffffffffa034d5ed>] [<ffffffffa034d5ed>]
_posix_to_nfsv4_one+0x3cd/0x3d0 [nfsd]
[ 1610.168320] RSP: 0018:ffff88005a945b00 EFLAGS: 00010293
[ 1610.168320] RAX: 0000000000000001 RBX: ffff88006700bac0 RCX:
0000000000000000
[ 1610.168320] RDX: 0000000000000000 RSI: ffff880067c83f00 RDI:
ffff880068233300
[ 1610.168320] RBP: ffff88005a945b48 R08: ffffffff81c64830 R09:
0000000000000000
[ 1610.168320] R10: ffff88004ea85be0 R11: 000000000000f475 R12:
ffff880068233300
[ 1610.168320] R13: 0000000000000003 R14: 0000000000000002 R15:
ffff880068233300
[ 1610.168320] FS: 0000000000000000(0000) GS:ffff880077800000(0000)
knlGS:0000000000000000
[ 1610.168320] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 1610.168320] CR2: 00007f5bcbd3b0b9 CR3: 0000000001c0f000 CR4:
00000000000006f0
[ 1610.168320] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[ 1610.168320] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[ 1610.168320] Stack:
[ 1610.168320] ffffffff00000000 0000000b67c83500 000000076700bac0
0000000000000000
[ 1610.168320] ffff88006700bac0 ffff880068233300 ffff88005a945c08
0000000000000002
[ 1610.168320] 0000000000000000 ffff88005a945b88 ffffffffa034e2d5
000000065a945b68
[ 1610.168320] Call Trace:
[ 1610.168320] [<ffffffffa034e2d5>] nfsd4_get_nfs4_acl+0x95/0x150 [nfsd]
[ 1610.168320] [<ffffffffa03400d6>] nfsd4_encode_fattr+0x646/0x1e70 [nfsd]
[ 1610.168320] [<ffffffff816a6e6e>] ? kmemleak_alloc+0x4e/0xb0
[ 1610.168320] [<ffffffffa0327962>] ?
nfsd_setuser_and_check_port+0x52/0x80 [nfsd]
[ 1610.168320] [<ffffffff812cd4bb>] ? selinux_cred_prepare+0x1b/0x30
[ 1610.168320] [<ffffffffa0341caa>] nfsd4_encode_getattr+0x5a/0x60 [nfsd]
[ 1610.168320] [<ffffffffa0341e07>] nfsd4_encode_operation+0x67/0x110
[nfsd]
[ 1610.168320] [<ffffffffa033844d>] nfsd4_proc_compound+0x21d/0x810 [nfsd]
[ 1610.168320] [<ffffffffa0324d9b>] nfsd_dispatch+0xbb/0x200 [nfsd]
[ 1610.168320] [<ffffffffa00850cd>] svc_process_common+0x46d/0x6d0 [sunrpc]
[ 1610.168320] [<ffffffffa0085433>] svc_process+0x103/0x170 [sunrpc]
[ 1610.168320] [<ffffffffa032472f>] nfsd+0xbf/0x130 [nfsd]
[ 1610.168320] [<ffffffffa0324670>] ? nfsd_destroy+0x80/0x80 [nfsd]
[ 1610.168320] [<ffffffff810a5202>] kthread+0xd2/0xf0
[ 1610.168320] [<ffffffff810a5130>] ? insert_kthread_work+0x40/0x40
[ 1610.168320] [<ffffffff816c1ebc>] ret_from_fork+0x7c/0xb0
[ 1610.168320] [<ffffffff810a5130>] ? insert_kthread_work+0x40/0x40
[ 1610.168320] Code: 78 02 e9 e7 fc ff ff 31 c0 31 d2 31 c9 66 89 45 ce
41 8b 04 24 66 89 55 d0 66 89 4d d2 48 8d 04 80 49 8d 5c 84 04 e9 37 fd
ff ff <0f> 0b 90 0f 1f 44 00 00 55 8b 56 08 c7 07 00 00 00 00 8b 46 0c
[ 1610.168320] RIP [<ffffffffa034d5ed>] _posix_to_nfsv4_one+0x3cd/0x3d0
[nfsd]
[ 1610.168320] RSP <ffff88005a945b00>
[ 1610.257313] ---[ end trace 838254e3e352285b ]---
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4acl.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -373,8 +373,10 @@ sort_pacl(struct posix_acl *pacl)
* by uid/gid. */
int i, j;
- if (pacl->a_count <= 4)
- return; /* no users or groups */
+ /* no users or groups */
+ if (!pacl || pacl->a_count <= 4)
+ return;
+
i = 1;
while (pacl->a_entries[i].e_tag == ACL_USER)
i++;
@@ -498,13 +500,12 @@ posix_state_to_acl(struct posix_acl_stat
/*
* ACLs with no ACEs are treated differently in the inheritable
- * and effective cases: when there are no inheritable ACEs, we
- * set a zero-length default posix acl:
+ * and effective cases: when there are no inheritable ACEs,
+ * calls ->set_acl with a NULL ACL structure.
*/
- if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT)) {
- pacl = posix_acl_alloc(0, GFP_KERNEL);
- return pacl ? pacl : ERR_PTR(-ENOMEM);
- }
+ if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT))
+ return NULL;
+
/*
* When there are no effective ACEs, the following will end
* up setting a 3-element effective posix ACL with all
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 066/214] nfsd4: warn on finding lockowner without stateids
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 065/214] NFSD: Call ->set_acl with a NULL ACL structure if no entries Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 067/214] nfsd4: remove lockowner when removing lock stateid Greg Kroah-Hartman
` (150 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, J. Bruce Fields
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit 27b11428b7de097c42f205beabb1764f4365443b upstream.
The current code assumes a one-to-one lockowner<->lock stateid
correspondance.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3918,6 +3918,10 @@ static bool same_lockowner_ino(struct nf
if (!same_owner_str(&lo->lo_owner, owner, clid))
return false;
+ if (list_empty(&lo->lo_owner.so_stateids)) {
+ WARN_ON_ONCE(1);
+ return false;
+ }
lst = list_first_entry(&lo->lo_owner.so_stateids,
struct nfs4_ol_stateid, st_perstateowner);
return lst->st_file->fi_inode == inode;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 067/214] nfsd4: remove lockowner when removing lock stateid
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 066/214] nfsd4: warn on finding lockowner without stateids Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 068/214] percpu: make pcpu_alloc_chunk() use pcpu_mem_free() instead of kfree() Greg Kroah-Hartman
` (149 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, J. Bruce Fields
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit a1b8ff4c97b4375d21b6d6c45d75877303f61b3b upstream.
The nfsv4 state code has always assumed a one-to-one correspondance
between lock stateid's and lockowners even if it appears not to in some
places.
We may actually change that, but for now when FREE_STATEID releases a
lock stateid it also needs to release the parent lockowner.
Symptoms were a subsequent LOCK crashing in find_lockowner_str when it
calls same_lockowner_ino on a lockowner that unexpectedly has an empty
so_stateids list.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3476,9 +3476,16 @@ out:
static __be32
nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp)
{
- if (check_for_locks(stp->st_file, lockowner(stp->st_stateowner)))
+ struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
+
+ if (check_for_locks(stp->st_file, lo))
return nfserr_locks_held;
- release_lock_stateid(stp);
+ /*
+ * Currently there's a 1-1 lock stateid<->lockowner
+ * correspondance, and we have to delete the lockowner when we
+ * delete the lock stateid:
+ */
+ unhash_lockowner(lo);
return nfs_ok;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 068/214] percpu: make pcpu_alloc_chunk() use pcpu_mem_free() instead of kfree()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 067/214] nfsd4: remove lockowner when removing lock stateid Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 069/214] ASoC: wm8962: Update register CLASS_D_CONTROL_1 to be non-volatile Greg Kroah-Hartman
` (148 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jianyu Zhan, Tejun Heo
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianyu Zhan <nasa4836@gmail.com>
commit 5a838c3b60e3a36ade764cf7751b8f17d7c9c2da upstream.
pcpu_chunk_struct_size = sizeof(struct pcpu_chunk) +
BITS_TO_LONGS(pcpu_unit_pages) * sizeof(unsigned long)
It hardly could be ever bigger than PAGE_SIZE even for large-scale machine,
but for consistency with its couterpart pcpu_mem_zalloc(),
use pcpu_mem_free() instead.
Commit b4916cb17c26 ("percpu: make pcpu_free_chunk() use
pcpu_mem_free() instead of kfree()") addressed this problem, but
missed this one.
tj: commit message updated
Signed-off-by: Jianyu Zhan <nasa4836@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Fixes: 099a19d91ca4 ("percpu: allow limited allocation before slab is online)
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/percpu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -612,7 +612,7 @@ static struct pcpu_chunk *pcpu_alloc_chu
chunk->map = pcpu_mem_zalloc(PCPU_DFL_MAP_ALLOC *
sizeof(chunk->map[0]));
if (!chunk->map) {
- kfree(chunk);
+ pcpu_mem_free(chunk, pcpu_chunk_struct_size);
return NULL;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 069/214] ASoC: wm8962: Update register CLASS_D_CONTROL_1 to be non-volatile
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 068/214] percpu: make pcpu_alloc_chunk() use pcpu_mem_free() instead of kfree() Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 070/214] x86-64, modify_ldt: Make support for 16-bit segments a runtime option Greg Kroah-Hartman
` (147 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shawn Guo, Charles Keepax, Mark Brown
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
commit 44330ab516c15dda8a1e660eeaf0003f84e43e3f upstream.
The register CLASS_D_CONTROL_1 is marked as volatile because it contains
a bit, DAC_MUTE, which is also mirrored in the ADC_DAC_CONTROL_1
register. This causes problems for the "Speaker Switch" control, which
will report an error if the CODEC is suspended because it relies on a
volatile register.
To resolve this issue mark CLASS_D_CONTROL_1 as non-volatile and
manually keep the register cache in sync by updating both bits when
changing the mute status.
Reported-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Tested-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/wm8962.c | 15 ++++++++++++---
sound/soc/codecs/wm8962.h | 4 ++++
2 files changed, 16 insertions(+), 3 deletions(-)
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -153,6 +153,7 @@ static struct reg_default wm8962_reg[] =
{ 40, 0x0000 }, /* R40 - SPKOUTL volume */
{ 41, 0x0000 }, /* R41 - SPKOUTR volume */
+ { 49, 0x0010 }, /* R49 - Class D Control 1 */
{ 51, 0x0003 }, /* R51 - Class D Control 2 */
{ 56, 0x0506 }, /* R56 - Clocking 4 */
@@ -794,7 +795,6 @@ static bool wm8962_volatile_register(str
case WM8962_ALC2:
case WM8962_THERMAL_SHUTDOWN_STATUS:
case WM8962_ADDITIONAL_CONTROL_4:
- case WM8962_CLASS_D_CONTROL_1:
case WM8962_DC_SERVO_6:
case WM8962_INTERRUPT_STATUS_1:
case WM8962_INTERRUPT_STATUS_2:
@@ -2888,13 +2888,22 @@ static int wm8962_set_fll(struct snd_soc
static int wm8962_mute(struct snd_soc_dai *dai, int mute)
{
struct snd_soc_codec *codec = dai->codec;
- int val;
+ int val, ret;
if (mute)
- val = WM8962_DAC_MUTE;
+ val = WM8962_DAC_MUTE | WM8962_DAC_MUTE_ALT;
else
val = 0;
+ /**
+ * The DAC mute bit is mirrored in two registers, update both to keep
+ * the register cache consistent.
+ */
+ ret = snd_soc_update_bits(codec, WM8962_CLASS_D_CONTROL_1,
+ WM8962_DAC_MUTE_ALT, val);
+ if (ret < 0)
+ return ret;
+
return snd_soc_update_bits(codec, WM8962_ADC_DAC_CONTROL_1,
WM8962_DAC_MUTE, val);
}
--- a/sound/soc/codecs/wm8962.h
+++ b/sound/soc/codecs/wm8962.h
@@ -1954,6 +1954,10 @@
#define WM8962_SPKOUTL_ENA_MASK 0x0040 /* SPKOUTL_ENA */
#define WM8962_SPKOUTL_ENA_SHIFT 6 /* SPKOUTL_ENA */
#define WM8962_SPKOUTL_ENA_WIDTH 1 /* SPKOUTL_ENA */
+#define WM8962_DAC_MUTE_ALT 0x0010 /* DAC_MUTE */
+#define WM8962_DAC_MUTE_ALT_MASK 0x0010 /* DAC_MUTE */
+#define WM8962_DAC_MUTE_ALT_SHIFT 4 /* DAC_MUTE */
+#define WM8962_DAC_MUTE_ALT_WIDTH 1 /* DAC_MUTE */
#define WM8962_SPKOUTL_PGA_MUTE 0x0002 /* SPKOUTL_PGA_MUTE */
#define WM8962_SPKOUTL_PGA_MUTE_MASK 0x0002 /* SPKOUTL_PGA_MUTE */
#define WM8962_SPKOUTL_PGA_MUTE_SHIFT 1 /* SPKOUTL_PGA_MUTE */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 070/214] x86-64, modify_ldt: Make support for 16-bit segments a runtime option
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 069/214] ASoC: wm8962: Update register CLASS_D_CONTROL_1 to be non-volatile Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 071/214] PCI: shpchp: Check bridges secondary (not primary) bus speed Greg Kroah-Hartman
` (146 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, H. Peter Anvin
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit fa81511bb0bbb2b1aace3695ce869da9762624ff upstream.
Checkin:
b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
disabled 16-bit segments on 64-bit kernels due to an information
leak. However, it does seem that people are genuinely using Wine to
run old 16-bit Windows programs on Linux.
A proper fix for this ("espfix64") is coming in the upcoming merge
window, but as a temporary fix, create a sysctl to allow the
administrator to re-enable support for 16-bit segments.
It adds a "/proc/sys/abi/ldt16" sysctl that defaults to zero (off). If
you hit this issue and care about your old Windows program more than
you care about a kernel stack address information leak, you can do
echo 1 > /proc/sys/abi/ldt16
as root (add it to your startup scripts), and you should be ok.
The sysctl table is only added if you have COMPAT support enabled on
x86-64, but I assume anybody who runs old windows binaries very much
does that ;)
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/CA%2B55aFw9BPoD10U1LfHbOMpHWZkvJTkMcfCs9s3urPr1YyWBxw@mail.gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/ldt.c | 4 +++-
arch/x86/vdso/vdso32-setup.c | 8 ++++++++
2 files changed, 11 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -20,6 +20,8 @@
#include <asm/mmu_context.h>
#include <asm/syscalls.h>
+int sysctl_ldt16 = 0;
+
#ifdef CONFIG_SMP
static void flush_ldt(void *current_mm)
{
@@ -234,7 +236,7 @@ static int write_ldt(void __user *ptr, u
* IRET leaking the high bits of the kernel stack address.
*/
#ifdef CONFIG_X86_64
- if (!ldt_info.seg_32bit) {
+ if (!ldt_info.seg_32bit && !sysctl_ldt16) {
error = -EINVAL;
goto out_unlock;
}
--- a/arch/x86/vdso/vdso32-setup.c
+++ b/arch/x86/vdso/vdso32-setup.c
@@ -41,6 +41,7 @@ enum {
#ifdef CONFIG_X86_64
#define vdso_enabled sysctl_vsyscall32
#define arch_setup_additional_pages syscall32_setup_pages
+extern int sysctl_ldt16;
#endif
/*
@@ -379,6 +380,13 @@ static ctl_table abi_table2[] = {
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = proc_dointvec
+ },
+ {
+ .procname = "ldt16",
+ .data = &sysctl_ldt16,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec
},
{}
};
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 071/214] PCI: shpchp: Check bridges secondary (not primary) bus speed
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 070/214] x86-64, modify_ldt: Make support for 16-bit segments a runtime option Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 072/214] ACPI / blacklist: Add dmi_enable_osi_linux quirk for Asus EEE PC 1015PX Greg Kroah-Hartman
` (145 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marcel Apfelbaum, Bjorn Helgaas,
Michael S. Tsirkin
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcel Apfelbaum <marcel.a@redhat.com>
commit 93fa9d32670f5592c8e56abc9928fc194e1e72fc upstream.
When a new device is added below a hotplug bridge, the bridge's secondary
bus speed and the device's bus speed must match. The shpchp driver
previously checked the bridge's *primary* bus speed, not the secondary bus
speed.
This caused hot-add errors like:
shpchp 0000:00:03.0: Speed of bus ff and adapter 0 mismatch
Check the secondary bus speed instead.
[bhelgaas: changelog]
Link: https://bugzilla.kernel.org/show_bug.cgi?id=75251
Fixes: 3749c51ac6c1 ("PCI: Make current and maximum bus speeds part of the PCI core")
Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/hotplug/shpchp_ctrl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/pci/hotplug/shpchp_ctrl.c
+++ b/drivers/pci/hotplug/shpchp_ctrl.c
@@ -285,8 +285,8 @@ static int board_added(struct slot *p_sl
return WRONG_BUS_FREQUENCY;
}
- bsp = ctrl->pci_dev->bus->cur_bus_speed;
- msp = ctrl->pci_dev->bus->max_bus_speed;
+ bsp = ctrl->pci_dev->subordinate->cur_bus_speed;
+ msp = ctrl->pci_dev->subordinate->max_bus_speed;
/* Check if there are other slots or devices on the same bus */
if (!list_empty(&ctrl->pci_dev->subordinate->devices))
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 072/214] ACPI / blacklist: Add dmi_enable_osi_linux quirk for Asus EEE PC 1015PX
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 071/214] PCI: shpchp: Check bridges secondary (not primary) bus speed Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 073/214] i2c: designware: Mask all interrupts during i2c controller enable Greg Kroah-Hartman
` (144 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hans de Goede, Rafael J. Wysocki
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit f6e6e1b9fee88c90586787b71dc49bb3ce62bb89 upstream.
Without this this EEE PC exports a non working WMI interface, with this it
exports a working "good old" eeepc_laptop interface, fixing brightness control
not working as well as rfkill being stuck in a permanent wireless blocked
state.
This is not an ideal way to fix this, but various attempts to fix this
otherwise have failed, see:
References: https://bugzilla.redhat.com/show_bug.cgi?id=1067181
Reported-and-tested-by: lou.cardone@gmail.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/blacklist.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -327,6 +327,19 @@ static struct dmi_system_id acpi_osi_dmi
DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T500"),
},
},
+ /*
+ * Without this this EEEpc exports a non working WMI interface, with
+ * this it exports a working "good old" eeepc_laptop interface, fixing
+ * both brightness control, and rfkill not working.
+ */
+ {
+ .callback = dmi_enable_osi_linux,
+ .ident = "Asus EEE PC 1015PX",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "1015PX"),
+ },
+ },
{}
};
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 073/214] i2c: designware: Mask all interrupts during i2c controller enable
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 072/214] ACPI / blacklist: Add dmi_enable_osi_linux quirk for Asus EEE PC 1015PX Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 074/214] crypto: caam - add allocation failure handling in SPRINTFCAT macro Greg Kroah-Hartman
` (143 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wenkai Du, Mika Westerberg, Wolfram Sang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Du, Wenkai" <wenkai.du@intel.com>
commit 47bb27e78867997040a228328f2a631c3c7f2c82 upstream.
There have been "i2c_designware 80860F41:00: controller timed out" errors
on a number of Baytrail platforms. The issue is caused by incorrect value in
Interrupt Mask Register (DW_IC_INTR_MASK) when i2c core is being enabled.
This causes call to __i2c_dw_enable() to immediately start the transfer which
leads to timeout. There are 3 failure modes observed:
1. Failure in S0 to S3 resume path
The default value after reset for DW_IC_INTR_MASK is 0x8ff. When we start
the first transaction after resuming from system sleep, TX_EMPTY interrupt
is already unmasked because of the hardware default.
2. Failure in normal operational path
This failure happens rarely and is hard to reproduce. Debug trace showed that
DW_IC_INTR_MASK had value of 0x254 when failure occurred, which meant
TX_EMPTY was unmasked.
3. Failure in S3 to S0 suspend path
This failure also happens rarely and is hard to reproduce. Adding debug trace
that read DW_IC_INTR_MASK made this failure not reproducible. But from ISR
call trace we could conclude TX_EMPTY was unmasked when problem occurred.
The patch masks all interrupts before the controller is enabled to resolve the
faulty DW_IC_INTR_MASK conditions.
Signed-off-by: Wenkai Du <wenkai.du@intel.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
[wsa: improved the comment and removed typo in commit msg]
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-designware-core.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -346,6 +346,9 @@ static void i2c_dw_xfer_init(struct dw_i
ic_con &= ~DW_IC_CON_10BITADDR_MASTER;
dw_writel(dev, ic_con, DW_IC_CON);
+ /* enforce disabled interrupts (due to HW issues) */
+ i2c_dw_disable_int(dev);
+
/* Enable the adapter */
dw_writel(dev, 1, DW_IC_ENABLE);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 074/214] crypto: caam - add allocation failure handling in SPRINTFCAT macro
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 073/214] i2c: designware: Mask all interrupts during i2c controller enable Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 075/214] setfacl removes part of ACL when setting POSIX ACLs to Samba Greg Kroah-Hartman
` (142 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kim Phillips, Horia Geanta, Herbert Xu
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horia Geanta <horia.geanta@freescale.com>
commit 27c5fb7a84242b66bf1e0b2fe6bf40d19bcc5c04 upstream.
GFP_ATOMIC memory allocation could fail.
In this case, avoid NULL pointer dereference and notify user.
Cc: Kim Phillips <kim.phillips@freescale.com>
Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/caam/error.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/crypto/caam/error.c
+++ b/drivers/crypto/caam/error.c
@@ -16,9 +16,13 @@
char *tmp; \
\
tmp = kmalloc(sizeof(format) + max_alloc, GFP_ATOMIC); \
- sprintf(tmp, format, param); \
- strcat(str, tmp); \
- kfree(tmp); \
+ if (likely(tmp)) { \
+ sprintf(tmp, format, param); \
+ strcat(str, tmp); \
+ kfree(tmp); \
+ } else { \
+ strcat(str, "kmalloc failure in SPRINTFCAT"); \
+ } \
}
static void report_jump_idx(u32 status, char *outstr)
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 075/214] setfacl removes part of ACL when setting POSIX ACLs to Samba
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 074/214] crypto: caam - add allocation failure handling in SPRINTFCAT macro Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 076/214] CIFS: Fix error handling in cifs_push_mandatory_locks Greg Kroah-Hartman
` (141 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Steve French, Jeremy Allison,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <smfrench@gmail.com>
commit b1d93356427be6f050dc55c86eb019d173700af6 upstream.
setfacl over cifs mounts can remove the default ACL when setting the
(non-default part of) the ACL and vice versa (we were leaving at 0
rather than setting to -1 the count field for the unaffected
half of the ACL. For example notice the setfacl removed
the default ACL in this sequence:
steven@steven-GA-970A-DS3:~/cifs-2.6$ getfacl /mnt/test-dir ; setfacl
-m default:user:test:rwx,user:test:rwx /mnt/test-dir
getfacl: Removing leading '/' from absolute path names
user::rwx
group::r-x
other::r-x
default:user::rwx
default:user:test:rwx
default:group::r-x
default:mask::rwx
default:other::r-x
steven@steven-GA-970A-DS3:~/cifs-2.6$ getfacl /mnt/test-dir
getfacl: Removing leading '/' from absolute path names
user::rwx
user:test:rwx
group::r-x
mask::rwx
other::r-x
Signed-off-by: Steve French <smfrench@gmail.com>
Acked-by: Jeremy Allison <jra@samba.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/cifssmb.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -3454,11 +3454,13 @@ static __u16 ACL_to_cifs_posix(char *par
return 0;
}
cifs_acl->version = cpu_to_le16(1);
- if (acl_type == ACL_TYPE_ACCESS)
+ if (acl_type == ACL_TYPE_ACCESS) {
cifs_acl->access_entry_count = cpu_to_le16(count);
- else if (acl_type == ACL_TYPE_DEFAULT)
+ cifs_acl->default_entry_count = __constant_cpu_to_le16(0xFFFF);
+ } else if (acl_type == ACL_TYPE_DEFAULT) {
cifs_acl->default_entry_count = cpu_to_le16(count);
- else {
+ cifs_acl->access_entry_count = __constant_cpu_to_le16(0xFFFF);
+ } else {
cFYI(1, "unknown ACL type %d", acl_type);
return 0;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 076/214] CIFS: Fix error handling in cifs_push_mandatory_locks
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 075/214] setfacl removes part of ACL when setting POSIX ACLs to Samba Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 077/214] ecryptfs: Fix memory leakage in keystore.c Greg Kroah-Hartman
` (140 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Shilovsky, Steve French,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <pshilovsky@etersoft.ru>
commit e2f2886a824ff0a56da1eaa13019fde86aa89fa6 upstream.
Signed-off-by: Pavel Shilovsky <pshilovsky@etersoft.ru>
Signed-off-by: Steve French <smfrench@gmail.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -882,7 +882,7 @@ cifs_push_mandatory_locks(struct cifsFil
if (!buf) {
mutex_unlock(&cinode->lock_mutex);
FreeXid(xid);
- return rc;
+ return -ENOMEM;
}
for (i = 0; i < 2; i++) {
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 077/214] ecryptfs: Fix memory leakage in keystore.c
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 076/214] CIFS: Fix error handling in cifs_push_mandatory_locks Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 078/214] fs: cachefiles: add support for large files in filesystem caching Greg Kroah-Hartman
` (139 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Geyslan G. Bem, Tyler Hicks,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Geyslan G. Bem" <geyslan@gmail.com>
commit 3edc8376c06133e3386265a824869cad03a4efd4 upstream.
In 'decrypt_pki_encrypted_session_key' function:
Initializes 'payload' pointer and releases it on exit.
Signed-off-by: Geyslan G. Bem <geyslan@gmail.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/keystore.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1149,7 +1149,7 @@ decrypt_pki_encrypted_session_key(struct
struct ecryptfs_msg_ctx *msg_ctx;
struct ecryptfs_message *msg = NULL;
char *auth_tok_sig;
- char *payload;
+ char *payload = NULL;
size_t payload_len;
int rc;
@@ -1204,6 +1204,7 @@ decrypt_pki_encrypted_session_key(struct
out:
if (msg)
kfree(msg);
+ kfree(payload);
return rc;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 078/214] fs: cachefiles: add support for large files in filesystem caching
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 077/214] ecryptfs: Fix memory leakage in keystore.c Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 079/214] perf: Fix perf ring buffer memory ordering Greg Kroah-Hartman
` (138 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Justin Lecher, Suresh Jayaraman,
David Howells, Andrew Morton, Linus Torvalds, Ben Hutchings,
Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Lecher <jlec@gentoo.org>
commit 98c350cda2c14a343d34ea01a3d9c24fea5ec66d upstream.
Support the caching of large files.
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=31182
Signed-off-by: Justin Lecher <jlec@gentoo.org>
Signed-off-by: Suresh Jayaraman <sjayaraman@suse.com>
Tested-by: Suresh Jayaraman <sjayaraman@suse.com>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2:
- Adjust context
- dentry_open() takes dentry and vfsmount pointers, not a path pointer]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cachefiles/rdwr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -918,7 +918,7 @@ int cachefiles_write_page(struct fscache
* own time */
dget(object->backer);
mntget(cache->mnt);
- file = dentry_open(object->backer, cache->mnt, O_RDWR,
+ file = dentry_open(object->backer, cache->mnt, O_RDWR | O_LARGEFILE,
cache->cache_cred);
if (IS_ERR(file)) {
ret = PTR_ERR(file);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 079/214] perf: Fix perf ring buffer memory ordering
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 078/214] fs: cachefiles: add support for large files in filesystem caching Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 080/214] ftrace: Check module functions being traced on reload Greg Kroah-Hartman
` (137 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Victor Kaplansky, Peter Zijlstra,
Mathieu Desnoyers, Paul McKenney, Michael Neuling,
Frederic Weisbecker, Ingo Molnar, Ben Hutchings, Rui Xiang,
michael, anton, benh
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit bf378d341e4873ed928dc3c636252e6895a21f50 upstream.
The PPC64 people noticed a missing memory barrier and crufty old
comments in the perf ring buffer code. So update all the comments and
add the missing barrier.
When the architecture implements local_t using atomic_long_t there
will be double barriers issued; but short of introducing more
conditional barrier primitives this is the best we can do.
Reported-by: Victor Kaplansky <victork@il.ibm.com>
Tested-by: Victor Kaplansky <victork@il.ibm.com>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
Cc: michael@ellerman.id.au
Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
Cc: Michael Neuling <mikey@neuling.org>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: anton@samba.org
Cc: benh@kernel.crashing.org
Link: http://lkml.kernel.org/r/20131025173749.GG19466@laptop.lan
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/perf_event.h | 12 +++++++-----
kernel/events/ring_buffer.c | 31 +++++++++++++++++++++++++++----
2 files changed, 34 insertions(+), 9 deletions(-)
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -391,13 +391,15 @@ struct perf_event_mmap_page {
/*
* Control data for the mmap() data buffer.
*
- * User-space reading the @data_head value should issue an rmb(), on
- * SMP capable platforms, after reading this value -- see
- * perf_event_wakeup().
+ * User-space reading the @data_head value should issue an smp_rmb(),
+ * after reading this value.
*
* When the mapping is PROT_WRITE the @data_tail value should be
- * written by userspace to reflect the last read data. In this case
- * the kernel will not over-write unread data.
+ * written by userspace to reflect the last read data, after issueing
+ * an smp_mb() to separate the data read from the ->data_tail store.
+ * In this case the kernel will not over-write unread data.
+ *
+ * See perf_output_put_handle() for the data ordering.
*/
__u64 data_head; /* head in the data section */
__u64 data_tail; /* user-space written tail */
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -75,10 +75,31 @@ again:
goto out;
/*
- * Publish the known good head. Rely on the full barrier implied
- * by atomic_dec_and_test() order the rb->head read and this
- * write.
+ * Since the mmap() consumer (userspace) can run on a different CPU:
+ *
+ * kernel user
+ *
+ * READ ->data_tail READ ->data_head
+ * smp_mb() (A) smp_rmb() (C)
+ * WRITE $data READ $data
+ * smp_wmb() (B) smp_mb() (D)
+ * STORE ->data_head WRITE ->data_tail
+ *
+ * Where A pairs with D, and B pairs with C.
+ *
+ * I don't think A needs to be a full barrier because we won't in fact
+ * write data until we see the store from userspace. So we simply don't
+ * issue the data WRITE until we observe it. Be conservative for now.
+ *
+ * OTOH, D needs to be a full barrier since it separates the data READ
+ * from the tail WRITE.
+ *
+ * For B a WMB is sufficient since it separates two WRITEs, and for C
+ * an RMB is sufficient since it separates two READs.
+ *
+ * See perf_output_begin().
*/
+ smp_wmb();
rb->user_page->data_head = head;
/*
@@ -142,9 +163,11 @@ int perf_output_begin(struct perf_output
* Userspace could choose to issue a mb() before updating the
* tail pointer. So that all reads will be completed before the
* write is issued.
+ *
+ * See perf_output_put_handle().
*/
tail = ACCESS_ONCE(rb->user_page->data_tail);
- smp_rmb();
+ smp_mb();
offset = head = local_read(&rb->head);
head += size;
if (unlikely(!perf_output_space(rb, tail, offset, head)))
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 080/214] ftrace: Check module functions being traced on reload
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 079/214] perf: Fix perf ring buffer memory ordering Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 081/214] sched/debug: Limit sd->*_idx range on sysctl Greg Kroah-Hartman
` (136 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jörn Engel, Dave Jones,
Steve Hodgson, Steven Rostedt, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 8c4f3c3fa9681dc549cd35419b259496082fef8b upstream.
There's been a nasty bug that would show up and not give much info.
The bug displayed the following warning:
WARNING: at kernel/trace/ftrace.c:1529 __ftrace_hash_rec_update+0x1e3/0x230()
Pid: 20903, comm: bash Tainted: G O 3.6.11+ #38405.trunk
Call Trace:
[<ffffffff8103e5ff>] warn_slowpath_common+0x7f/0xc0
[<ffffffff8103e65a>] warn_slowpath_null+0x1a/0x20
[<ffffffff810c2ee3>] __ftrace_hash_rec_update+0x1e3/0x230
[<ffffffff810c4f28>] ftrace_hash_move+0x28/0x1d0
[<ffffffff811401cc>] ? kfree+0x2c/0x110
[<ffffffff810c68ee>] ftrace_regex_release+0x8e/0x150
[<ffffffff81149f1e>] __fput+0xae/0x220
[<ffffffff8114a09e>] ____fput+0xe/0x10
[<ffffffff8105fa22>] task_work_run+0x72/0x90
[<ffffffff810028ec>] do_notify_resume+0x6c/0xc0
[<ffffffff8126596e>] ? trace_hardirqs_on_thunk+0x3a/0x3c
[<ffffffff815c0f88>] int_signal+0x12/0x17
---[ end trace 793179526ee09b2c ]---
It was finally narrowed down to unloading a module that was being traced.
It was actually more than that. When functions are being traced, there's
a table of all functions that have a ref count of the number of active
tracers attached to that function. When a function trace callback is
registered to a function, the function's record ref count is incremented.
When it is unregistered, the function's record ref count is decremented.
If an inconsistency is detected (ref count goes below zero) the above
warning is shown and the function tracing is permanently disabled until
reboot.
The ftrace callback ops holds a hash of functions that it filters on
(and/or filters off). If the hash is empty, the default means to filter
all functions (for the filter_hash) or to disable no functions (for the
notrace_hash).
When a module is unloaded, it frees the function records that represent
the module functions. These records exist on their own pages, that is
function records for one module will not exist on the same page as
function records for other modules or even the core kernel.
Now when a module unloads, the records that represents its functions are
freed. When the module is loaded again, the records are recreated with
a default ref count of zero (unless there's a callback that traces all
functions, then they will also be traced, and the ref count will be
incremented).
The problem is that if an ftrace callback hash includes functions of the
module being unloaded, those hash entries will not be removed. If the
module is reloaded in the same location, the hash entries still point
to the functions of the module but the module's ref counts do not reflect
that.
With the help of Steve and Joern, we found a reproducer:
Using uinput module and uinput_release function.
cd /sys/kernel/debug/tracing
modprobe uinput
echo uinput_release > set_ftrace_filter
echo function > current_tracer
rmmod uinput
modprobe uinput
# check /proc/modules to see if loaded in same addr, otherwise try again
echo nop > current_tracer
[BOOM]
The above loads the uinput module, which creates a table of functions that
can be traced within the module.
We add uinput_release to the filter_hash to trace just that function.
Enable function tracincg, which increments the ref count of the record
associated to uinput_release.
Remove uinput, which frees the records including the one that represents
uinput_release.
Load the uinput module again (and make sure it's at the same address).
This recreates the function records all with a ref count of zero,
including uinput_release.
Disable function tracing, which will decrement the ref count for uinput_release
which is now zero because of the module removal and reload, and we have
a mismatch (below zero ref count).
The solution is to check all currently tracing ftrace callbacks to see if any
are tracing any of the module's functions when a module is loaded (it already does
that with callbacks that trace all functions). If a callback happens to have
a module function being traced, it increments that records ref count and starts
tracing that function.
There may be a strange side effect with this, where tracing module functions
on unload and then reloading a new module may have that new module's functions
being traced. This may be something that confuses the user, but it's not
a big deal. Another approach is to disable all callback hashes on module unload,
but this leaves some ftrace callbacks that may not be registered, but can
still have hashes tracing the module's function where ftrace doesn't know about
it. That situation can cause the same bug. This solution solves that case too.
Another benefit of this solution, is it is possible to trace a module's
function on unload and load.
Link: http://lkml.kernel.org/r/20130705142629.GA325@redhat.com
Reported-by: Jörn Engel <joern@logfs.org>
Reported-by: Dave Jones <davej@redhat.com>
Reported-by: Steve Hodgson <steve@purestorage.com>
Tested-by: Steve Hodgson <steve@purestorage.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ftrace.c | 71 +++++++++++++++++++++++++++++++++++++++++++-------
1 file changed, 62 insertions(+), 9 deletions(-)
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -2080,12 +2080,57 @@ static cycle_t ftrace_update_time;
static unsigned long ftrace_update_cnt;
unsigned long ftrace_update_tot_cnt;
-static int ops_traces_mod(struct ftrace_ops *ops)
+static inline int ops_traces_mod(struct ftrace_ops *ops)
{
- struct ftrace_hash *hash;
+ /*
+ * Filter_hash being empty will default to trace module.
+ * But notrace hash requires a test of individual module functions.
+ */
+ return ftrace_hash_empty(ops->filter_hash) &&
+ ftrace_hash_empty(ops->notrace_hash);
+}
+
+/*
+ * Check if the current ops references the record.
+ *
+ * If the ops traces all functions, then it was already accounted for.
+ * If the ops does not trace the current record function, skip it.
+ * If the ops ignores the function via notrace filter, skip it.
+ */
+static inline bool
+ops_references_rec(struct ftrace_ops *ops, struct dyn_ftrace *rec)
+{
+ /* If ops isn't enabled, ignore it */
+ if (!(ops->flags & FTRACE_OPS_FL_ENABLED))
+ return 0;
+
+ /* If ops traces all mods, we already accounted for it */
+ if (ops_traces_mod(ops))
+ return 0;
+
+ /* The function must be in the filter */
+ if (!ftrace_hash_empty(ops->filter_hash) &&
+ !ftrace_lookup_ip(ops->filter_hash, rec->ip))
+ return 0;
+
+ /* If in notrace hash, we ignore it too */
+ if (ftrace_lookup_ip(ops->notrace_hash, rec->ip))
+ return 0;
+
+ return 1;
+}
+
+static int referenced_filters(struct dyn_ftrace *rec)
+{
+ struct ftrace_ops *ops;
+ int cnt = 0;
- hash = ops->filter_hash;
- return ftrace_hash_empty(hash);
+ for (ops = ftrace_ops_list; ops != &ftrace_list_end; ops = ops->next) {
+ if (ops_references_rec(ops, rec))
+ cnt++;
+ }
+
+ return cnt;
}
static int ftrace_update_code(struct module *mod)
@@ -2094,6 +2139,7 @@ static int ftrace_update_code(struct mod
struct dyn_ftrace *p;
cycle_t start, stop;
unsigned long ref = 0;
+ bool test = false;
int i;
/*
@@ -2107,9 +2153,12 @@ static int ftrace_update_code(struct mod
for (ops = ftrace_ops_list;
ops != &ftrace_list_end; ops = ops->next) {
- if (ops->flags & FTRACE_OPS_FL_ENABLED &&
- ops_traces_mod(ops))
- ref++;
+ if (ops->flags & FTRACE_OPS_FL_ENABLED) {
+ if (ops_traces_mod(ops))
+ ref++;
+ else
+ test = true;
+ }
}
}
@@ -2119,12 +2168,16 @@ static int ftrace_update_code(struct mod
for (pg = ftrace_new_pgs; pg; pg = pg->next) {
for (i = 0; i < pg->index; i++) {
+ int cnt = ref;
+
/* If something went wrong, bail without enabling anything */
if (unlikely(ftrace_disabled))
return -1;
p = &pg->records[i];
- p->flags = ref;
+ if (test)
+ cnt += referenced_filters(p);
+ p->flags = cnt;
/*
* Do the initial record conversion from mcount jump
@@ -2144,7 +2197,7 @@ static int ftrace_update_code(struct mod
* conversion puts the module to the correct state, thus
* passing the ftrace_make_call check.
*/
- if (ftrace_start_up && ref) {
+ if (ftrace_start_up && cnt) {
int failed = __ftrace_replace_code(p, 1);
if (failed)
ftrace_bug(failed, p->ip);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 081/214] sched/debug: Limit sd->*_idx range on sysctl
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 080/214] ftrace: Check module functions being traced on reload Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 082/214] sched/debug: Fix sd->*_idx limit range avoiding overflow Greg Kroah-Hartman
` (135 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Namhyung Kim, Peter Zijlstra,
Ingo Molnar, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung.kim@lge.com>
commit 201c373e8e4823700d3160d5c28e1ab18fd1193e upstream.
Various sd->*_idx's are used for refering the rq's load average table
when selecting a cpu to run. However they can be set to any number
with sysctl knobs so that it can crash the kernel if something bad is
given. Fix it by limiting them into the actual range.
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/1345104204-8317-1-git-send-email-namhyung@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/core.c | 35 ++++++++++++++++++++++-------------
1 file changed, 22 insertions(+), 13 deletions(-)
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5433,16 +5433,25 @@ static void sd_free_ctl_entry(struct ctl
*tablep = NULL;
}
+static int min_load_idx = 0;
+static int max_load_idx = CPU_LOAD_IDX_MAX;
+
static void
set_table_entry(struct ctl_table *entry,
const char *procname, void *data, int maxlen,
- umode_t mode, proc_handler *proc_handler)
+ umode_t mode, proc_handler *proc_handler,
+ bool load_idx)
{
entry->procname = procname;
entry->data = data;
entry->maxlen = maxlen;
entry->mode = mode;
entry->proc_handler = proc_handler;
+
+ if (load_idx) {
+ entry->extra1 = &min_load_idx;
+ entry->extra2 = &max_load_idx;
+ }
}
static struct ctl_table *
@@ -5454,30 +5463,30 @@ sd_alloc_ctl_domain_table(struct sched_d
return NULL;
set_table_entry(&table[0], "min_interval", &sd->min_interval,
- sizeof(long), 0644, proc_doulongvec_minmax);
+ sizeof(long), 0644, proc_doulongvec_minmax, false);
set_table_entry(&table[1], "max_interval", &sd->max_interval,
- sizeof(long), 0644, proc_doulongvec_minmax);
+ sizeof(long), 0644, proc_doulongvec_minmax, false);
set_table_entry(&table[2], "busy_idx", &sd->busy_idx,
- sizeof(int), 0644, proc_dointvec_minmax);
+ sizeof(int), 0644, proc_dointvec_minmax, true);
set_table_entry(&table[3], "idle_idx", &sd->idle_idx,
- sizeof(int), 0644, proc_dointvec_minmax);
+ sizeof(int), 0644, proc_dointvec_minmax, true);
set_table_entry(&table[4], "newidle_idx", &sd->newidle_idx,
- sizeof(int), 0644, proc_dointvec_minmax);
+ sizeof(int), 0644, proc_dointvec_minmax, true);
set_table_entry(&table[5], "wake_idx", &sd->wake_idx,
- sizeof(int), 0644, proc_dointvec_minmax);
+ sizeof(int), 0644, proc_dointvec_minmax, true);
set_table_entry(&table[6], "forkexec_idx", &sd->forkexec_idx,
- sizeof(int), 0644, proc_dointvec_minmax);
+ sizeof(int), 0644, proc_dointvec_minmax, true);
set_table_entry(&table[7], "busy_factor", &sd->busy_factor,
- sizeof(int), 0644, proc_dointvec_minmax);
+ sizeof(int), 0644, proc_dointvec_minmax, false);
set_table_entry(&table[8], "imbalance_pct", &sd->imbalance_pct,
- sizeof(int), 0644, proc_dointvec_minmax);
+ sizeof(int), 0644, proc_dointvec_minmax, false);
set_table_entry(&table[9], "cache_nice_tries",
&sd->cache_nice_tries,
- sizeof(int), 0644, proc_dointvec_minmax);
+ sizeof(int), 0644, proc_dointvec_minmax, false);
set_table_entry(&table[10], "flags", &sd->flags,
- sizeof(int), 0644, proc_dointvec_minmax);
+ sizeof(int), 0644, proc_dointvec_minmax, false);
set_table_entry(&table[11], "name", sd->name,
- CORENAME_MAX_SIZE, 0444, proc_dostring);
+ CORENAME_MAX_SIZE, 0444, proc_dostring, false);
/* &table[12] is terminator */
return table;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 082/214] sched/debug: Fix sd->*_idx limit range avoiding overflow
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 081/214] sched/debug: Limit sd->*_idx range on sysctl Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 083/214] perf: Fix error return code Greg Kroah-Hartman
` (134 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Libin, jiang.liu, guohanjun,
Peter Zijlstra, Ingo Molnar, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: libin <huawei.libin@huawei.com>
commit fd9b86d37a600488dbd80fe60cca46b822bff1cd upstream.
Commit 201c373e8e ("sched/debug: Limit sd->*_idx range on
sysctl") was an incomplete bug fix.
This patch fixes sd->*_idx limit range to [0 ~ CPU_LOAD_IDX_MAX-1]
avoiding array overflow caused by setting sd->*_idx to CPU_LOAD_IDX_MAX
on sysctl.
Signed-off-by: Libin <huawei.libin@huawei.com>
Cc: <jiang.liu@huawei.com>
Cc: <guohanjun@huawei.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/51626610.2040607@huawei.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5434,7 +5434,7 @@ static void sd_free_ctl_entry(struct ctl
}
static int min_load_idx = 0;
-static int max_load_idx = CPU_LOAD_IDX_MAX;
+static int max_load_idx = CPU_LOAD_IDX_MAX-1;
static void
set_table_entry(struct ctl_table *entry,
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 083/214] perf: Fix error return code
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 082/214] sched/debug: Fix sd->*_idx limit range avoiding overflow Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 084/214] tracing: Keep overwrite in sync between regular and snapshot buffers Greg Kroah-Hartman
` (133 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wei Yongjun, Ingo Molnar, Rui Xiang,
a.p.zijlstra, paulus, acme
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
commit c481420248c6730246d2a1b1773d5d7007ae0835 upstream.
Fix to return -ENOMEM in the allocation error case instead of 0
(if pmu_bus_running == 1), as done elsewhere in this function.
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Cc: a.p.zijlstra@chello.nl
Cc: paulus@samba.org
Cc: acme@ghostprotocols.net
Link: http://lkml.kernel.org/r/CAPgLHd8j_fWcgqe%3DKLWjpBj%2B%3Do0Pw6Z-SEq%3DNTPU08c2w1tngQ@mail.gmail.com
[ Tweaked the error code setting placement and the changelog. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/events/core.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5871,6 +5871,7 @@ skip_type:
if (pmu->pmu_cpu_context)
goto got_cpu_context;
+ ret = -ENOMEM;
pmu->pmu_cpu_context = alloc_percpu(struct perf_cpu_context);
if (!pmu->pmu_cpu_context)
goto free_dev;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 084/214] tracing: Keep overwrite in sync between regular and snapshot buffers
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 083/214] perf: Fix error return code Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 085/214] VFS: make vfs_fstat() use f[get|put]_light() Greg Kroah-Hartman
` (132 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steven Rostedt, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 80902822658aab18330569587cdb69ac1dfdcea8 upstream.
Changing the overwrite mode for the ring buffer via the trace
option only sets the normal buffer. But the snapshot buffer could
swap with it, and then the snapshot would be in non overwrite mode
and the normal buffer would be in overwrite mode, even though the
option flag states otherwise.
Keep the two buffers overwrite modes in sync.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2782,8 +2782,12 @@ int set_tracer_flag(unsigned int mask, i
if (mask == TRACE_ITER_RECORD_CMD)
trace_event_enable_cmd_record(enabled);
- if (mask == TRACE_ITER_OVERWRITE)
+ if (mask == TRACE_ITER_OVERWRITE) {
ring_buffer_change_overwrite(global_trace.buffer, enabled);
+#ifdef CONFIG_TRACER_MAX_TRACE
+ ring_buffer_change_overwrite(max_tr.buffer, enabled);
+#endif
+ }
return 0;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 085/214] VFS: make vfs_fstat() use f[get|put]_light()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 084/214] tracing: Keep overwrite in sync between regular and snapshot buffers Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 086/214] cifs: delay super block destruction until all cifsFileInfo objects are gone Greg Kroah-Hartman
` (131 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Linus Torvalds, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit e994defb7b6813ba6fa7a2a36e86d2455ad1dc35 upstream.
Use the *_light() versions that properly avoid doing the file user count
updates when they are unnecessary.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[xr: Backported to 3.4: adjust function name]
Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/stat.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -57,12 +57,13 @@ EXPORT_SYMBOL(vfs_getattr);
int vfs_fstat(unsigned int fd, struct kstat *stat)
{
- struct file *f = fget_raw(fd);
+ int fput_needed;
+ struct file *f = fget_light(fd, &fput_needed);
int error = -EBADF;
if (f) {
error = vfs_getattr(f->f_path.mnt, f->f_path.dentry, stat);
- fput(f);
+ fput_light(f, fput_needed);
}
return error;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 086/214] cifs: delay super block destruction until all cifsFileInfo objects are gone
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 085/214] VFS: make vfs_fstat() use f[get|put]_light() Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 087/214] NFSv4 wait on recovery for async session errors Greg Kroah-Hartman
` (130 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mateusz Guzik, Jeff Layton,
Steve French, Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mateusz Guzik <mguzik@redhat.com>
commit 24261fc23db950951760d00c188ba63cc756b932 upstream.
cifsFileInfo objects hold references to dentries and it is possible that
these will still be around in workqueues when VFS decides to kill super
block during unmount.
This results in panics like this one:
BUG: Dentry ffff88001f5e76c0{i=66b4a,n=1M-2} still in use (1) [unmount of cifs cifs]
------------[ cut here ]------------
kernel BUG at fs/dcache.c:943!
[..]
Process umount (pid: 1781, threadinfo ffff88003d6e8000, task ffff880035eeaec0)
[..]
Call Trace:
[<ffffffff811b44f3>] shrink_dcache_for_umount+0x33/0x60
[<ffffffff8119f7fc>] generic_shutdown_super+0x2c/0xe0
[<ffffffff8119f946>] kill_anon_super+0x16/0x30
[<ffffffffa036623a>] cifs_kill_sb+0x1a/0x30 [cifs]
[<ffffffff8119fcc7>] deactivate_locked_super+0x57/0x80
[<ffffffff811a085e>] deactivate_super+0x4e/0x70
[<ffffffff811bb417>] mntput_no_expire+0xd7/0x130
[<ffffffff811bc30c>] sys_umount+0x9c/0x3c0
[<ffffffff81657c19>] system_call_fastpath+0x16/0x1b
Fix this by making each cifsFileInfo object hold a reference to cifs
super block, which implicitly keeps VFS super block around as well.
Signed-off-by: Mateusz Guzik <mguzik@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Reported-and-Tested-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[xr: Backported to 3.4: adjust context]
Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/cifsfs.c | 24 ++++++++++++++++++++++++
fs/cifs/cifsfs.h | 4 ++++
fs/cifs/file.c | 6 +++++-
3 files changed, 33 insertions(+), 1 deletion(-)
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -87,6 +87,30 @@ extern mempool_t *cifs_mid_poolp;
struct workqueue_struct *cifsiod_wq;
+/*
+ * Bumps refcount for cifs super block.
+ * Note that it should be only called if a referece to VFS super block is
+ * already held, e.g. in open-type syscalls context. Otherwise it can race with
+ * atomic_dec_and_test in deactivate_locked_super.
+ */
+void
+cifs_sb_active(struct super_block *sb)
+{
+ struct cifs_sb_info *server = CIFS_SB(sb);
+
+ if (atomic_inc_return(&server->active) == 1)
+ atomic_inc(&sb->s_active);
+}
+
+void
+cifs_sb_deactive(struct super_block *sb)
+{
+ struct cifs_sb_info *server = CIFS_SB(sb);
+
+ if (atomic_dec_and_test(&server->active))
+ deactivate_super(sb);
+}
+
static int
cifs_read_super(struct super_block *sb)
{
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -41,6 +41,10 @@ extern struct file_system_type cifs_fs_t
extern const struct address_space_operations cifs_addr_ops;
extern const struct address_space_operations cifs_addr_ops_smallbuf;
+/* Functions related to super block operations */
+extern void cifs_sb_active(struct super_block *sb);
+extern void cifs_sb_deactive(struct super_block *sb);
+
/* Functions related to inodes */
extern const struct inode_operations cifs_dir_inode_ops;
extern struct inode *cifs_root_iget(struct super_block *);
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -265,6 +265,8 @@ cifs_new_fileinfo(__u16 fileHandle, stru
mutex_init(&pCifsFile->fh_mutex);
INIT_WORK(&pCifsFile->oplock_break, cifs_oplock_break);
+ cifs_sb_active(inode->i_sb);
+
spin_lock(&cifs_file_list_lock);
list_add(&pCifsFile->tlist, &(tlink_tcon(tlink)->openFileList));
/* if readable file instance put first in list*/
@@ -293,7 +295,8 @@ void cifsFileInfo_put(struct cifsFileInf
struct inode *inode = cifs_file->dentry->d_inode;
struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink);
struct cifsInodeInfo *cifsi = CIFS_I(inode);
- struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+ struct super_block *sb = inode->i_sb;
+ struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
struct cifsLockInfo *li, *tmp;
spin_lock(&cifs_file_list_lock);
@@ -345,6 +348,7 @@ void cifsFileInfo_put(struct cifsFileInf
cifs_put_tlink(cifs_file->tlink);
dput(cifs_file->dentry);
+ cifs_sb_deactive(sb);
kfree(cifs_file);
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 087/214] NFSv4 wait on recovery for async session errors
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 086/214] cifs: delay super block destruction until all cifsFileInfo objects are gone Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 088/214] nfsd4: fix xdr decoding of large non-write compounds Greg Kroah-Hartman
` (129 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Adamson, Trond Myklebust,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Adamson <andros@netapp.com>
commit 4a82fd7c4e78a1b7a224f9ae8bb7e1fd95f670e0 upstream.
When the state manager is processing the NFS4CLNT_DELEGRETURN flag, session
draining is off, but DELEGRETURN can still get a session error.
The async handler calls nfs4_schedule_session_recovery returns -EAGAIN, and
the DELEGRETURN done then restarts the RPC task in the prepare state.
With the state manager still processing the NFS4CLNT_DELEGRETURN flag with
session draining off, these DELEGRETURNs will cycle with errors filling up the
session slots.
This prevents OPEN reclaims (from nfs_delegation_claim_opens) required by the
NFS4CLNT_DELEGRETURN state manager processing from completing, hanging the
state manager in the __rpc_wait_for_completion_task in nfs4_run_open_task
as seen in this kernel thread dump:
kernel: 4.12.32.53-ma D 0000000000000000 0 3393 2 0x00000000
kernel: ffff88013995fb60 0000000000000046 ffff880138cc5400 ffff88013a9df140
kernel: ffff8800000265c0 ffffffff8116eef0 ffff88013fc10080 0000000300000001
kernel: ffff88013a4ad058 ffff88013995ffd8 000000000000fbc8 ffff88013a4ad058
kernel: Call Trace:
kernel: [<ffffffff8116eef0>] ? cache_alloc_refill+0x1c0/0x240
kernel: [<ffffffffa0358110>] ? rpc_wait_bit_killable+0x0/0xa0 [sunrpc]
kernel: [<ffffffffa0358152>] rpc_wait_bit_killable+0x42/0xa0 [sunrpc]
kernel: [<ffffffff8152914f>] __wait_on_bit+0x5f/0x90
kernel: [<ffffffffa0358110>] ? rpc_wait_bit_killable+0x0/0xa0 [sunrpc]
kernel: [<ffffffff815291f8>] out_of_line_wait_on_bit+0x78/0x90
kernel: [<ffffffff8109b520>] ? wake_bit_function+0x0/0x50
kernel: [<ffffffffa035810d>] __rpc_wait_for_completion_task+0x2d/0x30 [sunrpc]
kernel: [<ffffffffa040d44c>] nfs4_run_open_task+0x11c/0x160 [nfs]
kernel: [<ffffffffa04114e7>] nfs4_open_recover_helper+0x87/0x120 [nfs]
kernel: [<ffffffffa0411646>] nfs4_open_recover+0xc6/0x150 [nfs]
kernel: [<ffffffffa040cc6f>] ? nfs4_open_recoverdata_alloc+0x2f/0x60 [nfs]
kernel: [<ffffffffa0414e1a>] nfs4_open_delegation_recall+0x6a/0xa0 [nfs]
kernel: [<ffffffffa0424020>] nfs_end_delegation_return+0x120/0x2e0 [nfs]
kernel: [<ffffffff8109580f>] ? queue_work+0x1f/0x30
kernel: [<ffffffffa0424347>] nfs_client_return_marked_delegations+0xd7/0x110 [nfs]
kernel: [<ffffffffa04225d8>] nfs4_run_state_manager+0x548/0x620 [nfs]
kernel: [<ffffffffa0422090>] ? nfs4_run_state_manager+0x0/0x620 [nfs]
kernel: [<ffffffff8109b0f6>] kthread+0x96/0xa0
kernel: [<ffffffff8100c20a>] child_rip+0xa/0x20
kernel: [<ffffffff8109b060>] ? kthread+0x0/0xa0
kernel: [<ffffffff8100c200>] ? child_rip+0x0/0x20
The state manager can not therefore process the DELEGRETURN session errors.
Change the async handler to wait for recovery on session errors.
Signed-off-by: Andy Adamson <andros@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
[bwh: Backported to 3.2:
- Adjust context
- There's no restart_call label]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3910,8 +3910,7 @@ nfs4_async_handle_error(struct rpc_task
dprintk("%s ERROR %d, Reset session\n", __func__,
task->tk_status);
nfs4_schedule_session_recovery(clp->cl_session);
- task->tk_status = 0;
- return -EAGAIN;
+ goto wait_on_recovery;
#endif /* CONFIG_NFS_V4_1 */
case -NFS4ERR_DELAY:
nfs_inc_server_stats(server, NFSIOS_DELAY);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 088/214] nfsd4: fix xdr decoding of large non-write compounds
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 087/214] NFSv4 wait on recovery for async session errors Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 089/214] NFSv4.1: integer overflow in decode_cb_sequence_args() Greg Kroah-Hartman
` (128 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, J. Bruce Fields, Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit 365da4adebb1c012febf81019ad3dc5bb52e2a13 upstream.
This fixes a regression from 247500820ebd02ad87525db5d9b199e5b66f6636
"nfsd4: fix decoding of compounds across page boundaries". The previous
code was correct: argp->pagelist is initialized in
nfs4svc_deocde_compoundargs to rqstp->rq_arg.pages, and is therefore a
pointer to the page *after* the page we are currently decoding.
The reason that patch nevertheless fixed a problem with decoding
compounds containing write was a bug in the write decoding introduced by
5a80a54d21c96590d013378d8c5f65f879451ab4 "nfsd4: reorganize write
decoding", after which write decoding no longer adhered to the rule that
argp->pagelist point to the next page.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
[bwh: Backported to 3.2: adjust context; there is only one instance to fix]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -161,8 +161,8 @@ static __be32 *read_buf(struct nfsd4_com
*/
memcpy(p, argp->p, avail);
/* step to next page */
- argp->pagelist++;
argp->p = page_address(argp->pagelist[0]);
+ argp->pagelist++;
if (argp->pagelen < PAGE_SIZE) {
argp->end = argp->p + (argp->pagelen>>2);
argp->pagelen = 0;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 089/214] NFSv4.1: integer overflow in decode_cb_sequence_args()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 088/214] nfsd4: fix xdr decoding of large non-write compounds Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 090/214] nfsd: dont run get_file if nfs4_preprocess_stateid_op return error Greg Kroah-Hartman
` (127 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Trond Myklebust,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 0439f31c35d1da0b28988b308ea455e38e6a350d upstream.
This seems like it could overflow on 32 bits. Use kmalloc_array() which
has overflow protection built in.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/callback_xdr.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -455,9 +455,9 @@ static __be32 decode_cb_sequence_args(st
args->csa_nrclists = ntohl(*p++);
args->csa_rclists = NULL;
if (args->csa_nrclists) {
- args->csa_rclists = kmalloc(args->csa_nrclists *
- sizeof(*args->csa_rclists),
- GFP_KERNEL);
+ args->csa_rclists = kmalloc_array(args->csa_nrclists,
+ sizeof(*args->csa_rclists),
+ GFP_KERNEL);
if (unlikely(args->csa_rclists == NULL))
goto out;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 090/214] nfsd: dont run get_file if nfs4_preprocess_stateid_op return error
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 089/214] NFSv4.1: integer overflow in decode_cb_sequence_args() Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 091/214] NFS: nfs_getaclargs.acl_len is a size_t Greg Kroah-Hartman
` (126 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, fanchaoting, J. Bruce Fields,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: fanchaoting <fanchaoting@cn.fujitsu.com>
commit b022032e195ffca83d7002d6b84297d796ed443b upstream.
we should return error status directly when nfs4_preprocess_stateid_op
return error.
Signed-off-by: fanchaoting <fanchaoting@cn.fujitsu.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -904,14 +904,14 @@ nfsd4_write(struct svc_rqst *rqstp, stru
nfs4_lock_state();
status = nfs4_preprocess_stateid_op(cstate, stateid, WR_STATE, &filp);
- if (filp)
- get_file(filp);
- nfs4_unlock_state();
-
if (status) {
+ nfs4_unlock_state();
dprintk("NFSD: nfsd4_write: couldn't process stateid!\n");
return status;
}
+ if (filp)
+ get_file(filp);
+ nfs4_unlock_state();
cnt = write->wr_buflen;
write->wr_how_written = write->wr_stable_how;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 091/214] NFS: nfs_getaclargs.acl_len is a size_t
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 090/214] nfsd: dont run get_file if nfs4_preprocess_stateid_op return error Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 092/214] NFSv4.1: Fix a race in pNFS layoutcommit Greg Kroah-Hartman
` (125 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chuck Lever, Trond Myklebust,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 56d08fef2369d5ca9ad2e1fc697f5379fd8af751 upstream.
Squelch compiler warnings:
fs/nfs/nfs4proc.c: In function ‘__nfs4_get_acl_uncached’:
fs/nfs/nfs4proc.c:3811:14: warning: comparison between signed and
unsigned integer expressions [-Wsign-compare]
fs/nfs/nfs4proc.c:3818:15: warning: comparison between signed and
unsigned integer expressions [-Wsign-compare]
Introduced by commit bf118a34 "NFSv4: include bitmap in nfsv4 get
acl data", Dec 7, 2011.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3724,7 +3724,8 @@ static ssize_t __nfs4_get_acl_uncached(s
.rpc_argp = &args,
.rpc_resp = &res,
};
- int ret = -ENOMEM, npages, i, acl_len = 0;
+ int ret = -ENOMEM, npages, i;
+ size_t acl_len = 0;
npages = (buflen + PAGE_SIZE - 1) >> PAGE_SHIFT;
/* As long as we're doing a round trip to the server anyway,
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 092/214] NFSv4.1: Fix a race in pNFS layoutcommit
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 091/214] NFS: nfs_getaclargs.acl_len is a size_t Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 093/214] NFSv4.1: Dont decode skipped layoutgets Greg Kroah-Hartman
` (124 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Benny Halevy,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <Trond.Myklebust@netapp.com>
commit a073dbff359f4741013ae4b8395f5364c5e00b48 upstream.
We need to clear the NFS_LSEG_LAYOUTCOMMIT bits atomically with the
NFS_INO_LAYOUTCOMMIT bit, otherwise we may end up with situations
where the two are out of sync.
The first half of the problem is to ensure that pnfs_layoutcommit_inode
clears the NFS_LSEG_LAYOUTCOMMIT bit through pnfs_list_write_lseg.
We still need to keep the reference to those segments until the RPC call
is finished, so in order to make it clear _where_ those references come
from, we add a helper pnfs_list_write_lseg_done() that cleans up after
pnfs_list_write_lseg.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Acked-by: Benny Halevy <bhalevy@tonian.com>
[bwh: Backported to 3.2: s/pnfs_put_lseg/put_lseg/]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 14 --------------
fs/nfs/pnfs.c | 19 ++++++++++++++++++-
2 files changed, 18 insertions(+), 15 deletions(-)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -6297,22 +6297,8 @@ nfs4_layoutcommit_done(struct rpc_task *
static void nfs4_layoutcommit_release(void *calldata)
{
struct nfs4_layoutcommit_data *data = calldata;
- struct pnfs_layout_segment *lseg, *tmp;
- unsigned long *bitlock = &NFS_I(data->args.inode)->flags;
pnfs_cleanup_layoutcommit(data);
- /* Matched by references in pnfs_set_layoutcommit */
- list_for_each_entry_safe(lseg, tmp, &data->lseg_list, pls_lc_list) {
- list_del_init(&lseg->pls_lc_list);
- if (test_and_clear_bit(NFS_LSEG_LAYOUTCOMMIT,
- &lseg->pls_flags))
- put_lseg(lseg);
- }
-
- clear_bit_unlock(NFS_INO_LAYOUTCOMMITTING, bitlock);
- smp_mb__after_clear_bit();
- wake_up_bit(bitlock, NFS_INO_LAYOUTCOMMITTING);
-
put_rpccred(data->cred);
kfree(data);
}
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1381,11 +1381,27 @@ static void pnfs_list_write_lseg(struct
list_for_each_entry(lseg, &NFS_I(inode)->layout->plh_segs, pls_list) {
if (lseg->pls_range.iomode == IOMODE_RW &&
- test_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
+ test_and_clear_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
list_add(&lseg->pls_lc_list, listp);
}
}
+static void pnfs_list_write_lseg_done(struct inode *inode, struct list_head *listp)
+{
+ struct pnfs_layout_segment *lseg, *tmp;
+ unsigned long *bitlock = &NFS_I(inode)->flags;
+
+ /* Matched by references in pnfs_set_layoutcommit */
+ list_for_each_entry_safe(lseg, tmp, listp, pls_lc_list) {
+ list_del_init(&lseg->pls_lc_list);
+ put_lseg(lseg);
+ }
+
+ clear_bit_unlock(NFS_INO_LAYOUTCOMMITTING, bitlock);
+ smp_mb__after_clear_bit();
+ wake_up_bit(bitlock, NFS_INO_LAYOUTCOMMITTING);
+}
+
void pnfs_set_lo_fail(struct pnfs_layout_segment *lseg)
{
if (lseg->pls_range.iomode == IOMODE_RW) {
@@ -1434,6 +1450,7 @@ void pnfs_cleanup_layoutcommit(struct nf
if (nfss->pnfs_curr_ld->cleanup_layoutcommit)
nfss->pnfs_curr_ld->cleanup_layoutcommit(data);
+ pnfs_list_write_lseg_done(data->args.inode, &data->lseg_list);
}
/*
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 093/214] NFSv4.1: Dont decode skipped layoutgets
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 092/214] NFSv4.1: Fix a race in pNFS layoutcommit Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 094/214] NFSv4.1: Handle NFS4ERR_DELAY when resetting the NFSv4.1 session Greg Kroah-Hartman
` (123 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Weston Andros Adamson,
Trond Myklebust, Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weston Andros Adamson <dros@netapp.com>
commit 085b7a45c63d3da5be155faab9249a5cab224561 upstream.
layoutget's prepare hook can call rpc_exit with status = NFS4_OK (0).
Because of this, nfs4_proc_layoutget can't depend on a 0 status to mean
that the RPC was successfully sent, received and parsed.
To fix this, use the result's len member to see if parsing took place.
This fixes the following OOPS -- calling xdr_init_decode() with a buffer length
0 doesn't set the stream's 'p' member and ends up using uninitialized memory
in filelayout_decode_layout.
BUG: unable to handle kernel paging request at 0000000000008050
IP: [<ffffffff81282e78>] memcpy+0x18/0x120
PGD 0
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:11.0/0000:02:01.0/irq
CPU 1
Modules linked in: nfs_layout_nfsv41_files nfs lockd fscache auth_rpcgss nfs_acl autofs4 sunrpc ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 dm_mirror dm_region_hash dm_log dm_mod ppdev parport_pc parport snd_ens1371 snd_rawmidi snd_ac97_codec ac97_bus snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc e1000 microcode vmware_balloon i2c_piix4 i2c_core sg shpchp ext4 mbcache jbd2 sr_mod cdrom sd_mod crc_t10dif pata_acpi ata_generic ata_piix mptspi mptscsih mptbase scsi_transport_spi [last unloaded: speedstep_lib]
Pid: 1665, comm: flush-0:22 Not tainted 2.6.32-356-test-2 #2 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform
RIP: 0010:[<ffffffff81282e78>] [<ffffffff81282e78>] memcpy+0x18/0x120
RSP: 0018:ffff88003dfab588 EFLAGS: 00010206
RAX: ffff88003dc42000 RBX: ffff88003dfab610 RCX: 0000000000000009
RDX: 000000003f807ff0 RSI: 0000000000008050 RDI: ffff88003dc42000
RBP: ffff88003dfab5b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000080 R12: 0000000000000024
R13: ffff88003dc42000 R14: ffff88003f808030 R15: ffff88003dfab6a0
FS: 0000000000000000(0000) GS:ffff880003420000(0000) knlGS:0000000000000000
CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000008050 CR3: 000000003bc92000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process flush-0:22 (pid: 1665, threadinfo ffff88003dfaa000, task ffff880037f77540)
Stack:
ffffffffa0398ac1 ffff8800397c5940 ffff88003dfab610 ffff88003dfab6a0
<d> ffff88003dfab5d0 ffff88003dfab680 ffffffffa01c150b ffffea0000d82e70
<d> 000000508116713b 0000000000000000 0000000000000000 0000000000000000
Call Trace:
[<ffffffffa0398ac1>] ? xdr_inline_decode+0xb1/0x120 [sunrpc]
[<ffffffffa01c150b>] filelayout_decode_layout+0xeb/0x350 [nfs_layout_nfsv41_files]
[<ffffffffa01c17fc>] filelayout_alloc_lseg+0x8c/0x3c0 [nfs_layout_nfsv41_files]
[<ffffffff8150e6ce>] ? __wait_on_bit+0x7e/0x90
Signed-off-by: Weston Andros Adamson <dros@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -6084,7 +6084,8 @@ int nfs4_proc_layoutget(struct nfs4_layo
status = nfs4_wait_for_completion_rpc_task(task);
if (status == 0)
status = task->tk_status;
- if (status == 0)
+ /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
+ if (status == 0 && lgp->res.layoutp->len)
status = pnfs_layout_process(lgp);
rpc_put_task(task);
dprintk("<-- %s status=%d\n", __func__, status);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 094/214] NFSv4.1: Handle NFS4ERR_DELAY when resetting the NFSv4.1 session
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 093/214] NFSv4.1: Dont decode skipped layoutgets Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 095/214] dm bufio: avoid a possible __vmalloc deadlock Greg Kroah-Hartman
` (122 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <Trond.Myklebust@netapp.com>
commit c489ee290bdbbace6bb63ebe6ebd4dd605819495 upstream.
NFS4ERR_DELAY is a legal reply when we call DESTROY_SESSION. It
usually means that the server is busy handling an unfinished RPC
request. Just sleep for a second and then retry.
We also need to be able to handle the NFS4ERR_BACK_CHAN_BUSY return
value. If the NFS server has outstanding callbacks, we just want to
similarly sleep & retry.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4state.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1651,8 +1651,18 @@ static int nfs4_reset_session(struct nfs
nfs4_begin_drain_session(clp);
status = nfs4_proc_destroy_session(clp->cl_session);
- if (status && status != -NFS4ERR_BADSESSION &&
- status != -NFS4ERR_DEADSESSION) {
+ switch (status) {
+ case 0:
+ case -NFS4ERR_BADSESSION:
+ case -NFS4ERR_DEADSESSION:
+ break;
+ case -NFS4ERR_BACK_CHAN_BUSY:
+ case -NFS4ERR_DELAY:
+ set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
+ status = 0;
+ ssleep(1);
+ goto out;
+ default:
status = nfs4_recovery_handle_error(clp, status);
goto out;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 095/214] dm bufio: avoid a possible __vmalloc deadlock
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (93 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 094/214] NFSv4.1: Handle NFS4ERR_DELAY when resetting the NFSv4.1 session Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 096/214] dm snapshot: add missing module aliases Greg Kroah-Hartman
` (121 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mikulas Patocka, Alasdair G Kergon,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 502624bdad3dba45dfaacaf36b7d83e39e74b2d2 upstream.
This patch uses memalloc_noio_save to avoid a possible deadlock in
dm-bufio. (it could happen only with large block size, at most
PAGE_SIZE << MAX_ORDER (typically 8MiB).
__vmalloc doesn't fully respect gfp flags. The specified gfp flags are
used for allocation of requested pages, structures vmap_area, vmap_block
and vm_struct and the radix tree nodes.
However, the kernel pagetables are allocated always with GFP_KERNEL.
Thus the allocation of pagetables can recurse back to the I/O layer and
cause a deadlock.
This patch uses the function memalloc_noio_save to set per-process
PF_MEMALLOC_NOIO flag and the function memalloc_noio_restore to restore
it. When this flag is set, all allocations in the process are done with
implied GFP_NOIO flag, thus the deadlock can't happen.
This should be backported to stable kernels, but they don't have the
PF_MEMALLOC_NOIO flag and memalloc_noio_save/memalloc_noio_restore
functions. So, PF_MEMALLOC should be set and restored instead.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
[bwh: Backported to 3.2 as recommended]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-bufio.c | 26 +++++++++++++++++++++++++-
1 file changed, 25 insertions(+), 1 deletion(-)
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -321,6 +321,9 @@ static void __cache_size_refresh(void)
static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask,
enum data_mode *data_mode)
{
+ unsigned noio_flag;
+ void *ptr;
+
if (c->block_size <= DM_BUFIO_BLOCK_SIZE_SLAB_LIMIT) {
*data_mode = DATA_MODE_SLAB;
return kmem_cache_alloc(DM_BUFIO_CACHE(c), gfp_mask);
@@ -334,7 +337,28 @@ static void *alloc_buffer_data(struct dm
}
*data_mode = DATA_MODE_VMALLOC;
- return __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
+
+ /*
+ * __vmalloc allocates the data pages and auxiliary structures with
+ * gfp_flags that were specified, but pagetables are always allocated
+ * with GFP_KERNEL, no matter what was specified as gfp_mask.
+ *
+ * Consequently, we must set per-process flag PF_MEMALLOC_NOIO so that
+ * all allocations done by this process (including pagetables) are done
+ * as if GFP_NOIO was specified.
+ */
+
+ if (gfp_mask & __GFP_NORETRY) {
+ noio_flag = current->flags & PF_MEMALLOC;
+ current->flags |= PF_MEMALLOC;
+ }
+
+ ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
+
+ if (gfp_mask & __GFP_NORETRY)
+ current->flags = (current->flags & ~PF_MEMALLOC) | noio_flag;
+
+ return ptr;
}
/*
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 096/214] dm snapshot: add missing module aliases
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (94 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 095/214] dm bufio: avoid a possible __vmalloc deadlock Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 097/214] md/raid10: fix "enough" function for detecting if array is failed Greg Kroah-Hartman
` (120 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chao Yang, Mikulas Patocka,
Alasdair G Kergon, Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 23cb21092eb9dcec9d3604b68d95192b79915890 upstream.
Add module aliases so that autoloading works correctly if the user
tries to activate "snapshot-origin" or "snapshot-merge" targets.
Reference: https://bugzilla.redhat.com/889973
Reported-by: Chao Yang <chyang@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-snap.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -2323,3 +2323,5 @@ module_exit(dm_snapshot_exit);
MODULE_DESCRIPTION(DM_NAME " snapshot target");
MODULE_AUTHOR("Joe Thornber");
MODULE_LICENSE("GPL");
+MODULE_ALIAS("dm-snapshot-origin");
+MODULE_ALIAS("dm-snapshot-merge");
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 097/214] md/raid10: fix "enough" function for detecting if array is failed.
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (95 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 096/214] dm snapshot: add missing module aliases Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 098/214] nfsd: nfsd_open: when dentry_open returns an error do not propagate as struct file Greg Kroah-Hartman
` (119 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jakub Husák, NeilBrown,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.de>
commit 80b4812407c6b1f66a4f2430e69747a13f010839 upstream.
The 'enough' function is written to work with 'near' arrays only
in that is implicitly assumes that the offset from one 'group' of
devices to the next is the same as the number of copies.
In reality it is the number of 'near' copies.
So change it to make this number explicit.
This bug makes it possible to run arrays without enough drives
present, which is dangerous.
It is appropriate for an -stable kernel, but will almost certainly
need to be modified for some of them.
Reported-by: Jakub Husák <jakub@gooseman.cz>
Signed-off-by: NeilBrown <neilb@suse.de>
[bwh: Backported to 3.2: s/geo->/conf->/]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid10.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1419,14 +1419,16 @@ static int enough(struct r10conf *conf,
do {
int n = conf->copies;
int cnt = 0;
+ int this = first;
while (n--) {
- if (conf->mirrors[first].rdev &&
- first != ignore)
+ if (conf->mirrors[this].rdev &&
+ this != ignore)
cnt++;
- first = (first+1) % conf->raid_disks;
+ this = (this+1) % conf->raid_disks;
}
if (cnt == 0)
return 0;
+ first = (first + conf->near_copies) % conf->raid_disks;
} while (first != 0);
return 1;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 098/214] nfsd: nfsd_open: when dentry_open returns an error do not propagate as struct file
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (96 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 097/214] md/raid10: fix "enough" function for detecting if array is failed Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 099/214] dm snapshot: avoid snapshot space leak on crash Greg Kroah-Hartman
` (118 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Harshula Jayasuriya, J. Bruce Fields,
Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshula Jayasuriya <harshula@redhat.com>
commit e4daf1ffbe6cc3b12aab4d604e627829e93e9914 upstream.
The following call chain:
------------------------------------------------------------
nfs4_get_vfs_file
- nfsd_open
- dentry_open
- do_dentry_open
- __get_file_write_access
- get_write_access
- return atomic_inc_unless_negative(&inode->i_writecount) ? 0 : -ETXTBSY;
------------------------------------------------------------
can result in the following state:
------------------------------------------------------------
struct nfs4_file {
...
fi_fds = {0xffff880c1fa65c80, 0xffffffffffffffe6, 0x0},
fi_access = {{
counter = 0x1
}, {
counter = 0x0
}},
...
------------------------------------------------------------
1) First time around, in nfs4_get_vfs_file() fp->fi_fds[O_WRONLY] is
NULL, hence nfsd_open() is called where we get status set to an error
and fp->fi_fds[O_WRONLY] to -ETXTBSY. Thus we do not reach
nfs4_file_get_access() and fi_access[O_WRONLY] is not incremented.
2) Second time around, in nfs4_get_vfs_file() fp->fi_fds[O_WRONLY] is
NOT NULL (-ETXTBSY), so nfsd_open() is NOT called, but
nfs4_file_get_access() IS called and fi_access[O_WRONLY] is incremented.
Thus we leave a landmine in the form of the nfs4_file data structure in
an incorrect state.
3) Eventually, when __nfs4_file_put_access() is called it finds
fi_access[O_WRONLY] being non-zero, it decrements it and calls
nfs4_file_put_fd() which tries to fput -ETXTBSY.
------------------------------------------------------------
...
[exception RIP: fput+0x9]
RIP: ffffffff81177fa9 RSP: ffff88062e365c90 RFLAGS: 00010282
RAX: ffff880c2b3d99cc RBX: ffff880c2b3d9978 RCX: 0000000000000002
RDX: dead000000100101 RSI: 0000000000000001 RDI: ffffffffffffffe6
RBP: ffff88062e365c90 R8: ffff88041fe797d8 R9: ffff88062e365d58
R10: 0000000000000008 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000007 R14: 0000000000000000 R15: 0000000000000000
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
#9 [ffff88062e365c98] __nfs4_file_put_access at ffffffffa0562334 [nfsd]
#10 [ffff88062e365cc8] nfs4_file_put_access at ffffffffa05623ab [nfsd]
#11 [ffff88062e365ce8] free_generic_stateid at ffffffffa056634d [nfsd]
#12 [ffff88062e365d18] release_open_stateid at ffffffffa0566e4b [nfsd]
#13 [ffff88062e365d38] nfsd4_close at ffffffffa0567401 [nfsd]
#14 [ffff88062e365d88] nfsd4_proc_compound at ffffffffa0557f28 [nfsd]
#15 [ffff88062e365dd8] nfsd_dispatch at ffffffffa054543e [nfsd]
#16 [ffff88062e365e18] svc_process_common at ffffffffa04ba5a4 [sunrpc]
#17 [ffff88062e365e98] svc_process at ffffffffa04babe0 [sunrpc]
#18 [ffff88062e365eb8] nfsd at ffffffffa0545b62 [nfsd]
#19 [ffff88062e365ee8] kthread at ffffffff81090886
#20 [ffff88062e365f48] kernel_thread at ffffffff8100c14a
------------------------------------------------------------
Signed-off-by: Harshula Jayasuriya <harshula@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
[xr: Backported to 3.4: adjust context]
Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/vfs.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -828,9 +828,10 @@ nfsd_open(struct svc_rqst *rqstp, struct
}
*filp = dentry_open(dget(dentry), mntget(fhp->fh_export->ex_path.mnt),
flags, current_cred());
- if (IS_ERR(*filp))
+ if (IS_ERR(*filp)) {
host_err = PTR_ERR(*filp);
- else {
+ *filp = NULL;
+ } else {
host_err = ima_file_check(*filp, may_flags);
if (may_flags & NFSD_MAY_64BIT_COOKIE)
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 099/214] dm snapshot: avoid snapshot space leak on crash
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (97 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 098/214] nfsd: nfsd_open: when dentry_open returns an error do not propagate as struct file Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 100/214] dm mpath: fix race condition between multipath_dtr and pg_init_done Greg Kroah-Hartman
` (117 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mikulas Patocka, Mike Snitzer, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 230c83afdd9cd384348475bea1e14b80b3b6b1b8 upstream.
There is a possible leak of snapshot space in case of crash.
The reason for space leaking is that chunks in the snapshot device are
allocated sequentially, but they are finished (and stored in the metadata)
out of order, depending on the order in which copying finished.
For example, supposed that the metadata contains the following records
SUPERBLOCK
METADATA (blocks 0 ... 250)
DATA 0
DATA 1
DATA 2
...
DATA 250
Now suppose that you allocate 10 new data blocks 251-260. Suppose that
copying of these blocks finish out of order (block 260 finished first
and the block 251 finished last). Now, the snapshot device looks like
this:
SUPERBLOCK
METADATA (blocks 0 ... 250, 260, 259, 258, 257, 256)
DATA 0
DATA 1
DATA 2
...
DATA 250
DATA 251
DATA 252
DATA 253
DATA 254
DATA 255
METADATA (blocks 255, 254, 253, 252, 251)
DATA 256
DATA 257
DATA 258
DATA 259
DATA 260
Now, if the machine crashes after writing the first metadata block but
before writing the second metadata block, the space for areas DATA 250-255
is leaked, it contains no valid data and it will never be used in the
future.
This patch makes dm-snapshot complete exceptions in the same order they
were allocated, thus fixing this bug.
Note: when backporting this patch to the stable kernel, change the version
field in the following way:
* if version in the stable kernel is {1, 11, 1}, change it to {1, 12, 0}
* if version in the stable kernel is {1, 10, 0} or {1, 10, 1}, change it
to {1, 10, 2}
Userspace reads the version to determine if the bug was fixed, so the
version change is needed.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
[xr: Backported to 3.4: adjust version]
Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-snap.c | 71 +++++++++++++++++++++++++++++++++++++++++++++------
1 file changed, 64 insertions(+), 7 deletions(-)
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -66,6 +66,18 @@ struct dm_snapshot {
atomic_t pending_exceptions_count;
+ /* Protected by "lock" */
+ sector_t exception_start_sequence;
+
+ /* Protected by kcopyd single-threaded callback */
+ sector_t exception_complete_sequence;
+
+ /*
+ * A list of pending exceptions that completed out of order.
+ * Protected by kcopyd single-threaded callback.
+ */
+ struct list_head out_of_order_list;
+
mempool_t *pending_pool;
struct dm_exception_table pending;
@@ -171,6 +183,14 @@ struct dm_snap_pending_exception {
*/
int started;
+ /* There was copying error. */
+ int copy_error;
+
+ /* A sequence number, it is used for in-order completion. */
+ sector_t exception_sequence;
+
+ struct list_head out_of_order_entry;
+
/*
* For writing a complete chunk, bypassing the copy.
*/
@@ -1090,6 +1110,9 @@ static int snapshot_ctr(struct dm_target
s->valid = 1;
s->active = 0;
atomic_set(&s->pending_exceptions_count, 0);
+ s->exception_start_sequence = 0;
+ s->exception_complete_sequence = 0;
+ INIT_LIST_HEAD(&s->out_of_order_list);
init_rwsem(&s->lock);
INIT_LIST_HEAD(&s->list);
spin_lock_init(&s->pe_lock);
@@ -1448,6 +1471,19 @@ static void commit_callback(void *contex
pending_complete(pe, success);
}
+static void complete_exception(struct dm_snap_pending_exception *pe)
+{
+ struct dm_snapshot *s = pe->snap;
+
+ if (unlikely(pe->copy_error))
+ pending_complete(pe, 0);
+
+ else
+ /* Update the metadata if we are persistent */
+ s->store->type->commit_exception(s->store, &pe->e,
+ commit_callback, pe);
+}
+
/*
* Called when the copy I/O has finished. kcopyd actually runs
* this code so don't block.
@@ -1457,13 +1493,32 @@ static void copy_callback(int read_err,
struct dm_snap_pending_exception *pe = context;
struct dm_snapshot *s = pe->snap;
- if (read_err || write_err)
- pending_complete(pe, 0);
+ pe->copy_error = read_err || write_err;
- else
- /* Update the metadata if we are persistent */
- s->store->type->commit_exception(s->store, &pe->e,
- commit_callback, pe);
+ if (pe->exception_sequence == s->exception_complete_sequence) {
+ s->exception_complete_sequence++;
+ complete_exception(pe);
+
+ while (!list_empty(&s->out_of_order_list)) {
+ pe = list_entry(s->out_of_order_list.next,
+ struct dm_snap_pending_exception, out_of_order_entry);
+ if (pe->exception_sequence != s->exception_complete_sequence)
+ break;
+ s->exception_complete_sequence++;
+ list_del(&pe->out_of_order_entry);
+ complete_exception(pe);
+ }
+ } else {
+ struct list_head *lh;
+ struct dm_snap_pending_exception *pe2;
+
+ list_for_each_prev(lh, &s->out_of_order_list) {
+ pe2 = list_entry(lh, struct dm_snap_pending_exception, out_of_order_entry);
+ if (pe2->exception_sequence < pe->exception_sequence)
+ break;
+ }
+ list_add(&pe->out_of_order_entry, lh);
+ }
}
/*
@@ -1558,6 +1613,8 @@ __find_pending_exception(struct dm_snaps
return NULL;
}
+ pe->exception_sequence = s->exception_start_sequence++;
+
dm_insert_exception(&s->pending, &pe->e);
return pe;
@@ -2200,7 +2257,7 @@ static struct target_type origin_target
static struct target_type snapshot_target = {
.name = "snapshot",
- .version = {1, 10, 0},
+ .version = {1, 10, 2},
.module = THIS_MODULE,
.ctr = snapshot_ctr,
.dtr = snapshot_dtr,
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 100/214] dm mpath: fix race condition between multipath_dtr and pg_init_done
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (98 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 099/214] dm snapshot: avoid snapshot space leak on crash Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 101/214] dm thin: fix discard corruption Greg Kroah-Hartman
` (116 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shiva Krishna Merla,
Krishnasamy Somasundaram, Speagle Andy, Junichi Nomura,
Mike Snitzer, Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiva Krishna Merla <shivakrishna.merla@netapp.com>
commit 954a73d5d3073df2231820c718fdd2f18b0fe4c9 upstream.
Whenever multipath_dtr() is happening we must prevent queueing any
further path activation work. Implement this by adding a new
'pg_init_disabled' flag to the multipath structure that denotes future
path activation work should be skipped if it is set. By disabling
pg_init and then re-enabling in flush_multipath_work() we also avoid the
potential for pg_init to be initiated while suspending an mpath device.
Without this patch a race condition exists that may result in a kernel
panic:
1) If after pg_init_done() decrements pg_init_in_progress to 0, a call
to wait_for_pg_init_completion() assumes there are no more pending path
management commands.
2) If pg_init_required is set by pg_init_done(), due to retryable
mode_select errors, then process_queued_ios() will again queue the
path activation work.
3) If free_multipath() completes before activate_path() work is called a
NULL pointer dereference like the following can be seen when
accessing members of the recently destructed multipath:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000090
RIP: 0010:[<ffffffffa003db1b>] [<ffffffffa003db1b>] activate_path+0x1b/0x30 [dm_multipath]
[<ffffffff81090ac0>] worker_thread+0x170/0x2a0
[<ffffffff81096c80>] ? autoremove_wake_function+0x0/0x40
[switch to disabling pg_init in flush_multipath_work & header edits by Mike Snitzer]
Signed-off-by: Shiva Krishna Merla <shivakrishna.merla@netapp.com>
Reviewed-by: Krishnasamy Somasundaram <somasundaram.krishnasamy@netapp.com>
Tested-by: Speagle Andy <Andy.Speagle@netapp.com>
Acked-by: Junichi Nomura <j-nomura@ce.jp.nec.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
[bwh: Backported to 3.2:
- Adjust context
- Bump version to 1.3.2 not 1.6.0]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[xr: Backported to 3.4: Adjust context]
Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-mpath.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -84,6 +84,7 @@ struct multipath {
unsigned queue_io; /* Must we queue all I/O? */
unsigned queue_if_no_path; /* Queue I/O if last path fails? */
unsigned saved_queue_if_no_path;/* Saved state during suspension */
+ unsigned pg_init_disabled:1; /* pg_init is not currently allowed */
unsigned pg_init_retries; /* Number of times to retry pg_init */
unsigned pg_init_count; /* Number of times pg_init called */
unsigned pg_init_delay_msecs; /* Number of msecs before pg_init retry */
@@ -493,7 +494,8 @@ static void process_queued_ios(struct wo
(!pgpath && !m->queue_if_no_path))
must_queue = 0;
- if (m->pg_init_required && !m->pg_init_in_progress && pgpath)
+ if (m->pg_init_required && !m->pg_init_in_progress && pgpath &&
+ !m->pg_init_disabled)
__pg_init_all_paths(m);
out:
@@ -907,10 +909,20 @@ static void multipath_wait_for_pg_init_c
static void flush_multipath_work(struct multipath *m)
{
+ unsigned long flags;
+
+ spin_lock_irqsave(&m->lock, flags);
+ m->pg_init_disabled = 1;
+ spin_unlock_irqrestore(&m->lock, flags);
+
flush_workqueue(kmpath_handlerd);
multipath_wait_for_pg_init_completion(m);
flush_workqueue(kmultipathd);
flush_work_sync(&m->trigger_event);
+
+ spin_lock_irqsave(&m->lock, flags);
+ m->pg_init_disabled = 0;
+ spin_unlock_irqrestore(&m->lock, flags);
}
static void multipath_dtr(struct dm_target *ti)
@@ -1129,7 +1141,7 @@ static int pg_init_limit_reached(struct
spin_lock_irqsave(&m->lock, flags);
- if (m->pg_init_count <= m->pg_init_retries)
+ if (m->pg_init_count <= m->pg_init_retries && !m->pg_init_disabled)
m->pg_init_required = 1;
else
limit_reached = 1;
@@ -1644,7 +1656,7 @@ out:
*---------------------------------------------------------------*/
static struct target_type multipath_target = {
.name = "multipath",
- .version = {1, 3, 0},
+ .version = {1, 3, 2},
.module = THIS_MODULE,
.ctr = multipath_ctr,
.dtr = multipath_dtr,
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 101/214] dm thin: fix discard corruption
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (99 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 100/214] dm mpath: fix race condition between multipath_dtr and pg_init_done Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 102/214] zram: Fix deadlock bug in partial read/write Greg Kroah-Hartman
` (115 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joe Thornber, Alasdair G Kergon,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <ejt@redhat.com>
commit f046f89a99ccfd9408b94c653374ff3065c7edb3 upstream.
Fix a bug in dm_btree_remove that could leave leaf values with incorrect
reference counts. The effect of this was that removal of a shared block
could result in the space maps thinking the block was no longer used.
More concretely, if you have a thin device and a snapshot of it, sending
a discard to a shared region of the thin could corrupt the snapshot.
Thinp uses a 2-level nested btree to store it's mappings. This first
level is indexed by thin device, and the second level by logical
block.
Often when we're removing an entry in this mapping tree we need to
rebalance nodes, which can involve shadowing them, possibly creating a
copy if the block is shared. If we do create a copy then children of
that node need to have their reference counts incremented. In this
way reference counts percolate down the tree as shared trees diverge.
The rebalance functions were incrementing the children at the
appropriate time, but they were always assuming the children were
internal nodes. This meant the leaf values (in our case packed
block/flags entries) were not being incremented.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
[bwh: Backported to 3.2: bump target version numbers from 1.0.1 to 1.0.2]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[xr: Backported to 3.4: bump target version numbers to 1.1.1]
Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-thin.c | 4 +-
drivers/md/persistent-data/dm-btree-remove.c | 46 ++++++++++++++-------------
2 files changed, 26 insertions(+), 24 deletions(-)
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2472,7 +2472,7 @@ static struct target_type pool_target =
.name = "thin-pool",
.features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
DM_TARGET_IMMUTABLE,
- .version = {1, 1, 0},
+ .version = {1, 1, 1},
.module = THIS_MODULE,
.ctr = pool_ctr,
.dtr = pool_dtr,
@@ -2752,7 +2752,7 @@ static void thin_io_hints(struct dm_targ
static struct target_type thin_target = {
.name = "thin",
- .version = {1, 1, 0},
+ .version = {1, 1, 1},
.module = THIS_MODULE,
.ctr = thin_ctr,
.dtr = thin_dtr,
--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -139,15 +139,8 @@ struct child {
struct btree_node *n;
};
-static struct dm_btree_value_type le64_type = {
- .context = NULL,
- .size = sizeof(__le64),
- .inc = NULL,
- .dec = NULL,
- .equal = NULL
-};
-
-static int init_child(struct dm_btree_info *info, struct btree_node *parent,
+static int init_child(struct dm_btree_info *info, struct dm_btree_value_type *vt,
+ struct btree_node *parent,
unsigned index, struct child *result)
{
int r, inc;
@@ -164,7 +157,7 @@ static int init_child(struct dm_btree_in
result->n = dm_block_data(result->block);
if (inc)
- inc_children(info->tm, result->n, &le64_type);
+ inc_children(info->tm, result->n, vt);
*((__le64 *) value_ptr(parent, index)) =
cpu_to_le64(dm_block_location(result->block));
@@ -236,7 +229,7 @@ static void __rebalance2(struct dm_btree
}
static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info,
- unsigned left_index)
+ struct dm_btree_value_type *vt, unsigned left_index)
{
int r;
struct btree_node *parent;
@@ -244,11 +237,11 @@ static int rebalance2(struct shadow_spin
parent = dm_block_data(shadow_current(s));
- r = init_child(info, parent, left_index, &left);
+ r = init_child(info, vt, parent, left_index, &left);
if (r)
return r;
- r = init_child(info, parent, left_index + 1, &right);
+ r = init_child(info, vt, parent, left_index + 1, &right);
if (r) {
exit_child(info, &left);
return r;
@@ -368,7 +361,7 @@ static void __rebalance3(struct dm_btree
}
static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info,
- unsigned left_index)
+ struct dm_btree_value_type *vt, unsigned left_index)
{
int r;
struct btree_node *parent = dm_block_data(shadow_current(s));
@@ -377,17 +370,17 @@ static int rebalance3(struct shadow_spin
/*
* FIXME: fill out an array?
*/
- r = init_child(info, parent, left_index, &left);
+ r = init_child(info, vt, parent, left_index, &left);
if (r)
return r;
- r = init_child(info, parent, left_index + 1, ¢er);
+ r = init_child(info, vt, parent, left_index + 1, ¢er);
if (r) {
exit_child(info, &left);
return r;
}
- r = init_child(info, parent, left_index + 2, &right);
+ r = init_child(info, vt, parent, left_index + 2, &right);
if (r) {
exit_child(info, &left);
exit_child(info, ¢er);
@@ -434,7 +427,8 @@ static int get_nr_entries(struct dm_tran
}
static int rebalance_children(struct shadow_spine *s,
- struct dm_btree_info *info, uint64_t key)
+ struct dm_btree_info *info,
+ struct dm_btree_value_type *vt, uint64_t key)
{
int i, r, has_left_sibling, has_right_sibling;
uint32_t child_entries;
@@ -472,13 +466,13 @@ static int rebalance_children(struct sha
has_right_sibling = i < (le32_to_cpu(n->header.nr_entries) - 1);
if (!has_left_sibling)
- r = rebalance2(s, info, i);
+ r = rebalance2(s, info, vt, i);
else if (!has_right_sibling)
- r = rebalance2(s, info, i - 1);
+ r = rebalance2(s, info, vt, i - 1);
else
- r = rebalance3(s, info, i - 1);
+ r = rebalance3(s, info, vt, i - 1);
return r;
}
@@ -529,7 +523,7 @@ static int remove_raw(struct shadow_spin
if (le32_to_cpu(n->header.flags) & LEAF_NODE)
return do_leaf(n, key, index);
- r = rebalance_children(s, info, key);
+ r = rebalance_children(s, info, vt, key);
if (r)
break;
@@ -550,6 +544,14 @@ static int remove_raw(struct shadow_spin
return r;
}
+static struct dm_btree_value_type le64_type = {
+ .context = NULL,
+ .size = sizeof(__le64),
+ .inc = NULL,
+ .dec = NULL,
+ .equal = NULL
+};
+
int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
uint64_t *keys, dm_block_t *new_root)
{
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 102/214] zram: Fix deadlock bug in partial read/write
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (100 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 101/214] dm thin: fix discard corruption Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 103/214] zram: avoid invalid memory access in zram_exit() Greg Kroah-Hartman
` (114 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jerome Marchand, Nitin Gupta,
Pekka Enberg, Minchan Kim, Ben Hutchings, Jianguo Wu
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minchan Kim <minchan@kernel.org>
commit 7e5a5104c6af709a8d97d5f4711e7c917761d464 upstream.
Now zram allocates new page with GFP_KERNEL in zram I/O path
if IO is partial. Unfortunately, It may cause deadlock with
reclaim path like below.
write_page from fs
fs_lock
allocation(GFP_KERNEL)
reclaim
pageout
write_page from fs
fs_lock <-- deadlock
This patch fixes it by using GFP_NOIO. In read path, we
reorganize code flow so that kmap_atomic is called after the
GFP_NOIO allocation.
Acked-by: Jerome Marchand <jmarchand@redhat.com>
Acked-by: Nitin Gupta <ngupta@vflare.org>
[ penberg@kernel.org: don't use GFP_ATOMIC ]
Signed-off-by: Pekka Enberg <penberg@kernel.org>
Signed-off-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: no reordering is needed in the read path]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Jianguo Wu <wujianguo@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/zram/zram_drv.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -235,7 +235,7 @@ static int zram_bvec_read(struct zram *z
if (is_partial_io(bvec)) {
/* Use a temporary buffer to decompress the page */
- uncmem = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ uncmem = kmalloc(PAGE_SIZE, GFP_NOIO);
if (!uncmem) {
pr_info("Error allocating temp memory!\n");
return -ENOMEM;
@@ -330,7 +330,7 @@ static int zram_bvec_write(struct zram *
* This is a partial IO. We need to read the full page
* before to write the changes.
*/
- uncmem = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ uncmem = kmalloc(PAGE_SIZE, GFP_NOIO);
if (!uncmem) {
pr_info("Error allocating temp memory!\n");
ret = -ENOMEM;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 103/214] zram: avoid invalid memory access in zram_exit()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (101 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 102/214] zram: Fix deadlock bug in partial read/write Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 104/214] zram: destroy all devices on error recovery path in zram_init() Greg Kroah-Hartman
` (113 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiang Liu, Ben Hutchings, Jianguo Wu
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiang Liu <liuj97@gmail.com>
commit 6030ea9b35971a4200062f010341ab832e878ac9 upstream.
Memory for zram->disk object may have already been freed after returning
from destroy_device(zram), then it's unsafe for zram_reset_device(zram)
to access zram->disk again.
We can't solve this bug by flipping the order of destroy_device(zram)
and zram_reset_device(zram), that will cause deadlock issues to the
zram sysfs handler.
So fix it by holding an extra reference to zram->disk before calling
destroy_device(zram).
Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Jianguo Wu <wujianguo@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/zram/zram_drv.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -841,9 +841,11 @@ static void __exit zram_exit(void)
for (i = 0; i < num_devices; i++) {
zram = &zram_devices[i];
+ get_disk(zram->disk);
destroy_device(zram);
if (zram->init_done)
zram_reset_device(zram);
+ put_disk(zram->disk);
}
unregister_blkdev(zram_major, "zram");
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 104/214] zram: destroy all devices on error recovery path in zram_init()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (102 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 103/214] zram: avoid invalid memory access in zram_exit() Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 105/214] zram: avoid access beyond the zram device Greg Kroah-Hartman
` (112 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiang Liu, Minchan Kim,
Jerome Marchand, Ben Hutchings, Jianguo Wu
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiang Liu <liuj97@gmail.com>
commit 39a9b8ac9333e4268ecff7da6c9d1ab3823ff243 upstream.
On error recovery path of zram_init(), it leaks the zram device object
causing the failure. So change create_device() to free allocated
resources on error path.
Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
Acked-by: Minchan Kim <minchan@kernel.org>
Acked-by: Jerome Marchand <jmarchan@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Jianguo Wu <wujianguo@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/zram/zram_drv.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -703,7 +703,7 @@ static const struct block_device_operati
static int create_device(struct zram *zram, int device_id)
{
- int ret = 0;
+ int ret = -ENOMEM;
init_rwsem(&zram->lock);
init_rwsem(&zram->init_lock);
@@ -713,7 +713,6 @@ static int create_device(struct zram *zr
if (!zram->queue) {
pr_err("Error allocating disk queue for device %d\n",
device_id);
- ret = -ENOMEM;
goto out;
}
@@ -723,11 +722,9 @@ static int create_device(struct zram *zr
/* gendisk structure */
zram->disk = alloc_disk(1);
if (!zram->disk) {
- blk_cleanup_queue(zram->queue);
pr_warning("Error allocating disk structure for device %d\n",
device_id);
- ret = -ENOMEM;
- goto out;
+ goto out_free_queue;
}
zram->disk->major = zram_major;
@@ -756,11 +753,17 @@ static int create_device(struct zram *zr
&zram_disk_attr_group);
if (ret < 0) {
pr_warning("Error creating sysfs group");
- goto out;
+ goto out_free_disk;
}
zram->init_done = 0;
+ return 0;
+out_free_disk:
+ del_gendisk(zram->disk);
+ put_disk(zram->disk);
+out_free_queue:
+ blk_cleanup_queue(zram->queue);
out:
return ret;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 105/214] zram: avoid access beyond the zram device
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (103 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 104/214] zram: destroy all devices on error recovery path in zram_init() Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 106/214] zram: allow request end to coincide with disksize Greg Kroah-Hartman
` (111 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiang Liu, Ben Hutchings, Jianguo Wu
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiang Liu <liuj97@gmail.com>
commit 12a7ad3b810e77137d0caf97a6dd97591e075b30 upstream.
Function valid_io_request() should verify the entire request are within
the zram device address range. Otherwise it may cause invalid memory
access when accessing/modifying zram->meta->table[index] because the
'index' is out of range. Then it may access non-exist memory, randomly
modify memory belong to other subsystems, which is hard to track down.
Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Jianguo Wu <wujianguo@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/zram/zram_drv.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -535,13 +535,20 @@ out:
*/
static inline int valid_io_request(struct zram *zram, struct bio *bio)
{
- if (unlikely(
- (bio->bi_sector >= (zram->disksize >> SECTOR_SHIFT)) ||
- (bio->bi_sector & (ZRAM_SECTOR_PER_LOGICAL_BLOCK - 1)) ||
- (bio->bi_size & (ZRAM_LOGICAL_BLOCK_SIZE - 1)))) {
+ u64 start, end, bound;
+ /* unaligned request */
+ if (unlikely(bio->bi_sector & (ZRAM_SECTOR_PER_LOGICAL_BLOCK - 1)))
+ return 0;
+ if (unlikely(bio->bi_size & (ZRAM_LOGICAL_BLOCK_SIZE - 1)))
+ return 0;
+
+ start = bio->bi_sector;
+ end = start + (bio->bi_size >> SECTOR_SHIFT);
+ bound = zram->disksize >> SECTOR_SHIFT;
+ /* out of range range */
+ if (unlikely(start >= bound || end >= bound || start > end))
return 0;
- }
/* I/O request is valid */
return 1;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 106/214] zram: allow request end to coincide with disksize
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (104 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 105/214] zram: avoid access beyond the zram device Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 107/214] Staging: zram: Fix access of NULL pointer Greg Kroah-Hartman
` (110 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sergey Senozhatsky, Ben Hutchings,
Jianguo Wu
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
commit 75c7caf5a052ffd8db3312fa7864ee2d142890c4 upstream.
Pass valid_io_request() checks if request end coincides with disksize
(end equals bound), only fail if we attempt to read beyond the bound.
mkfs.ext2 produces numerous errors:
[ 2164.632747] quiet_error: 1 callbacks suppressed
[ 2164.633260] Buffer I/O error on device zram0, logical block 153599
[ 2164.633265] lost page write due to I/O error on zram0
Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Jianguo Wu <wujianguo@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/zram/zram_drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -547,7 +547,7 @@ static inline int valid_io_request(struc
end = start + (bio->bi_size >> SECTOR_SHIFT);
bound = zram->disksize >> SECTOR_SHIFT;
/* out of range range */
- if (unlikely(start >= bound || end >= bound || start > end))
+ if (unlikely(start >= bound || end > bound || start > end))
return 0;
/* I/O request is valid */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 107/214] Staging: zram: Fix access of NULL pointer
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (105 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 106/214] zram: allow request end to coincide with disksize Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 108/214] UBI: erase free PEB with bitflip in EC header Greg Kroah-Hartman
` (109 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jerome Marchand, Rashika Kheria,
Minchan Kim, Ben Hutchings, Jianguo Wu
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rashika Kheria <rashika.kheria@gmail.com>
commit 46a51c80216cb891f271ad021f59009f34677499 upstream.
This patch fixes the bug in reset_store caused by accessing NULL pointer.
The bdev gets its value from bdget_disk() which could fail when memory
pressure is severe and hence can return NULL because allocation of
inode in bdget could fail.
Hence, this patch introduces a check for bdev to prevent reference to a
NULL pointer in the later part of the code. It also removes unnecessary
check of bdev for fsync_bdev().
Acked-by: Jerome Marchand <jmarchan@redhat.com>
Signed-off-by: Rashika Kheria <rashika.kheria@gmail.com>
Acked-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Jianguo Wu <wujianguo@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/zram/zram_sysfs.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/staging/zram/zram_sysfs.c
+++ b/drivers/staging/zram/zram_sysfs.c
@@ -95,6 +95,9 @@ static ssize_t reset_store(struct device
zram = dev_to_zram(dev);
bdev = bdget_disk(zram->disk, 0);
+ if (!bdev)
+ return -ENOMEM;
+
/* Do not reset an active device! */
if (bdev->bd_holders)
return -EBUSY;
@@ -107,8 +110,7 @@ static ssize_t reset_store(struct device
return -EINVAL;
/* Make sure all pending I/O is finished */
- if (bdev)
- fsync_bdev(bdev);
+ fsync_bdev(bdev);
down_write(&zram->init_lock);
if (zram->init_done)
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 108/214] UBI: erase free PEB with bitflip in EC header
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (106 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 107/214] Staging: zram: Fix access of NULL pointer Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 109/214] Input: synaptics - adjust threshold for treating position values as negative Greg Kroah-Hartman
` (108 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Matthieu Castet, Artem Bityutskiy,
Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu CASTET <matthieu.castet@parrot.com>
commit 193819cf2e6e395b1e1be2d36785dc5563a6edca upstream.
Without this patch, these PEB are not scrubbed until we put data in them.
Bitflip can accumulate latter and we can loose the EC header (but VID header
should be intact and allow to recover data).
Signed-off-by: Matthieu Castet <matthieu.castet@parrot.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/ubi/scan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/ubi/scan.c
+++ b/drivers/mtd/ubi/scan.c
@@ -997,7 +997,7 @@ static int process_eb(struct ubi_device
return err;
goto adjust_mean_ec;
case UBI_IO_FF:
- if (ec_err)
+ if (ec_err || bitflips)
err = add_to_list(si, pnum, ec, 1, &si->erase);
else
err = add_to_list(si, pnum, ec, 0, &si->free);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 109/214] Input: synaptics - adjust threshold for treating position values as negative
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (107 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 108/214] UBI: erase free PEB with bitflip in EC header Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 110/214] floppy: properly handle failure on add_disk loop Greg Kroah-Hartman
` (107 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Seth Forshee, Daniel Kurtz,
Alan Swanson, Arteom, Dmitry Torokhov, Ben Hutchings,
Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Forshee <seth.forshee@canonical.com>
commit 824efd37415961d38821ecbd9694e213fb2e8b32 upstream.
Commit c039450 (Input: synaptics - handle out of bounds values from the
hardware) caused any hardware reported values over 7167 to be treated as
a wrapped-around negative value. It turns out that some firmware uses
the value 8176 to indicate a finger near the edge of the touchpad whose
actual position cannot be determined. This value now gets treated as
negative, which can cause pointer jumps and broken edge scrolling on
these machines.
I only know of one touchpad which reports negative values, and this
hardware never reports any value lower than -8 (i.e. 8184). Moving the
threshold for treating a value as negative up to 8176 should work fine
then for any hardware we currently know about, and since we're dealing
with unspecified behavior it's probably the best we can do. The special
8176 value is also likely to result in sudden jumps in position, so
let's also clamp this to the maximum specified value for the axis.
BugLink: http://bugs.launchpad.net/bugs/1046512
https://bugzilla.kernel.org/show_bug.cgi?id=46371
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Reviewed-by: Daniel Kurtz <djkurtz@chromium.org>
Tested-by: Alan Swanson <swanson@ukfsn.org>
Tested-by: Arteom <arutemus@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/synaptics.c | 31 +++++++++++++++++++++++--------
1 file changed, 23 insertions(+), 8 deletions(-)
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -53,14 +53,19 @@
#define ABS_POS_BITS 13
/*
- * Any position values from the hardware above the following limits are
- * treated as "wrapped around negative" values that have been truncated to
- * the 13-bit reporting range of the hardware. These are just reasonable
- * guesses and can be adjusted if hardware is found that operates outside
- * of these parameters.
+ * These values should represent the absolute maximum value that will
+ * be reported for a positive position value. Some Synaptics firmware
+ * uses this value to indicate a finger near the edge of the touchpad
+ * whose precise position cannot be determined.
+ *
+ * At least one touchpad is known to report positions in excess of this
+ * value which are actually negative values truncated to the 13-bit
+ * reporting range. These values have never been observed to be lower
+ * than 8184 (i.e. -8), so we treat all values greater than 8176 as
+ * negative and any other value as positive.
*/
-#define X_MAX_POSITIVE (((1 << ABS_POS_BITS) + XMAX) / 2)
-#define Y_MAX_POSITIVE (((1 << ABS_POS_BITS) + YMAX) / 2)
+#define X_MAX_POSITIVE 8176
+#define Y_MAX_POSITIVE 8176
/*
* Synaptics touchpads report the y coordinate from bottom to top, which is
@@ -583,11 +588,21 @@ static int synaptics_parse_hw_state(cons
hw->right = (buf[0] & 0x02) ? 1 : 0;
}
- /* Convert wrap-around values to negative */
+ /*
+ * Convert wrap-around values to negative. (X|Y)_MAX_POSITIVE
+ * is used by some firmware to indicate a finger at the edge of
+ * the touchpad whose precise position cannot be determined, so
+ * convert these values to the maximum axis value.
+ */
if (hw->x > X_MAX_POSITIVE)
hw->x -= 1 << ABS_POS_BITS;
+ else if (hw->x == X_MAX_POSITIVE)
+ hw->x = XMAX;
+
if (hw->y > Y_MAX_POSITIVE)
hw->y -= 1 << ABS_POS_BITS;
+ else if (hw->y == Y_MAX_POSITIVE)
+ hw->y = YMAX;
return 0;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 110/214] floppy: properly handle failure on add_disk loop
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (108 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 109/214] Input: synaptics - adjust threshold for treating position values as negative Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 111/214] MISC: hpilo, remove pci_disable_device Greg Kroah-Hartman
` (106 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Herton Ronaldo Krzesinski,
Jiri Kosina, Jens Axboe, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
commit d60e7ec18c3fb2cbf90969ccd42889eb2d03aef9 upstream.
On floppy initialization, if something failed inside the loop we call
add_disk, there was no cleanup of previous iterations in the error
handling.
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/floppy.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4306,7 +4306,7 @@ static int __init floppy_init(void)
err = platform_device_register(&floppy_device[drive]);
if (err)
- goto out_flush_work;
+ goto out_remove_drives;
err = device_create_file(&floppy_device[drive].dev,
&dev_attr_cmos);
@@ -4324,6 +4324,15 @@ static int __init floppy_init(void)
out_unreg_platform_dev:
platform_device_unregister(&floppy_device[drive]);
+out_remove_drives:
+ while (drive--) {
+ if ((allowed_drive_mask & (1 << drive)) &&
+ fdc_state[FDC(drive)].version != FDC_NONE) {
+ del_gendisk(disks[drive]);
+ device_remove_file(&floppy_device[drive].dev, &dev_attr_cmos);
+ platform_device_unregister(&floppy_device[drive]);
+ }
+ }
out_flush_work:
flush_work_sync(&floppy_work);
if (atomic_read(&usage_count))
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 111/214] MISC: hpilo, remove pci_disable_device
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (109 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 110/214] floppy: properly handle failure on add_disk loop Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 112/214] i82975x_edac: Fix dimm label initialization Greg Kroah-Hartman
` (105 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiri Slaby, Grant Grundler,
Nobin Mathew, Robert Hancock, Arnd Bergmann, David Altobelli,
Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby <jslaby@suse.cz>
commit bcdee04ea7ae0406ae69094f6df1aacb66a69a0b upstream.
pci_disable_device(pdev) used to be in pci remove function. But this
PCI device has two functions with interrupt lines connected to a
single pin. The other one is a USB host controller. So when we disable
the PIN there e.g. by rmmod hpilo, the controller stops working. It is
because the interrupt link is disabled in ACPI since it is not
refcounted yet. See acpi_pci_link_free_irq called from
acpi_pci_irq_disable.
It is not the best solution whatsoever, but as a workaround until the
ACPI irq link refcounting is sorted out this should fix the reported
errors.
References: https://lkml.org/lkml/2008/11/4/535
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Grant Grundler <grundler@parisc-linux.org>
Cc: Nobin Mathew <nobin.mathew@gmail.com>
Cc: Robert Hancock <hancockr@shaw.ca>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: David Altobelli <david.altobelli@hp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/hpilo.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/drivers/misc/hpilo.c
+++ b/drivers/misc/hpilo.c
@@ -735,7 +735,14 @@ static void ilo_remove(struct pci_dev *p
free_irq(pdev->irq, ilo_hw);
ilo_unmap_device(pdev, ilo_hw);
pci_release_regions(pdev);
- pci_disable_device(pdev);
+ /*
+ * pci_disable_device(pdev) used to be here. But this PCI device has
+ * two functions with interrupt lines connected to a single pin. The
+ * other one is a USB host controller. So when we disable the PIN here
+ * e.g. by rmmod hpilo, the controller stops working. It is because
+ * the interrupt link is disabled in ACPI since it is not refcounted
+ * yet. See acpi_pci_link_free_irq called from acpi_pci_irq_disable.
+ */
kfree(ilo_hw);
ilo_hwdev[(minor / MAX_CCB)] = 0;
}
@@ -820,7 +827,7 @@ unmap:
free_regions:
pci_release_regions(pdev);
disable:
- pci_disable_device(pdev);
+/* pci_disable_device(pdev); see comment in ilo_remove */
free:
kfree(ilo_hw);
out:
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 112/214] i82975x_edac: Fix dimm label initialization
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (110 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 111/214] MISC: hpilo, remove pci_disable_device Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 113/214] i915: ensure that VGA plane is disabled Greg Kroah-Hartman
` (104 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alan Cox, Mauro Carvalho Chehab,
Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@redhat.com>
commit 479696840239e0cc43efb3c917bdcad2174d2215 upstream.
The driver has only 4 hardcoded labels, but allows much more memory.
Fix it by removing the hardcoded logic, using snprintf() instead.
[ 19.833972] general protection fault: 0000 [#1] SMP
[ 19.837733] Modules linked in: i82975x_edac(+) edac_core firewire_ohci firewire_core crc_itu_t nouveau mxm_wmi wmi video i2c_algo_bit drm_kms_helper ttm drm i2c_core
[ 19.837733] CPU 0
[ 19.837733] Pid: 390, comm: udevd Not tainted 3.6.1-1.fc17.x86_64.debug #1 Dell Inc. Precision WorkStation 390 /0MY510
[ 19.837733] RIP: 0010:[<ffffffff813463a8>] [<ffffffff813463a8>] strncpy+0x18/0x30
[ 19.837733] RSP: 0018:ffff880078535b68 EFLAGS: 00010202
[ 19.837733] RAX: ffff880069fa9708 RBX: ffff880078588000 RCX: ffff880069fa9708
[ 19.837733] RDX: 000000000000001f RSI: 5f706f5f63616465 RDI: ffff880069fa9708
[ 19.837733] RBP: ffff880078535b68 R08: ffff880069fa9727 R09: 000000000000fffe
[ 19.837733] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003
[ 19.837733] R13: 0000000000000000 R14: ffff880069fa9290 R15: ffff880079624a80
[ 19.837733] FS: 00007f3de01ee840(0000) GS:ffff88007c400000(0000) knlGS:0000000000000000
[ 19.837733] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 19.837733] CR2: 00007f3de00b9000 CR3: 0000000078dbc000 CR4: 00000000000007f0
[ 19.837733] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 19.837733] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 19.837733] Process udevd (pid: 390, threadinfo ffff880078534000, task ffff880079642450)
[ 19.837733] Stack:
[ 19.837733] ffff880078535c18 ffffffffa017c6b8 00040000816d627f ffff880079624a88
[ 19.837733] ffffc90004cd6000 ffff880079624520 ffff88007ac21148 0000000000000000
[ 19.837733] 0000000000000000 0004000000000000 feda000078535bc8 ffffffff810d696d
[ 19.837733] Call Trace:
[ 19.837733] [<ffffffffa017c6b8>] i82975x_init_one+0x2e6/0x3e6 [i82975x_edac]
...
Fix bug reported at:
https://bugzilla.redhat.com/show_bug.cgi?id=848149
And, very likely:
https://bbs.archlinux.org/viewtopic.php?id=148033
https://bugzilla.kernel.org/show_bug.cgi?id=47171
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
[bwh: Backported to 3.2:
- Adjust context
- Use csrow->channels[chan].label not csrow->channels[chan]->dimm->label]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/i82975x_edac.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
--- a/drivers/edac/i82975x_edac.c
+++ b/drivers/edac/i82975x_edac.c
@@ -363,10 +363,6 @@ static enum dev_type i82975x_dram_type(v
static void i82975x_init_csrows(struct mem_ctl_info *mci,
struct pci_dev *pdev, void __iomem *mch_window)
{
- static const char *labels[4] = {
- "DIMM A1", "DIMM A2",
- "DIMM B1", "DIMM B2"
- };
struct csrow_info *csrow;
unsigned long last_cumul_size;
u8 value;
@@ -407,9 +403,10 @@ static void i82975x_init_csrows(struct m
* [0-3] for dual-channel; i.e. csrow->nr_channels = 2
*/
for (chan = 0; chan < csrow->nr_channels; chan++)
- strncpy(csrow->channels[chan].label,
- labels[(index >> 1) + (chan * 2)],
- EDAC_MC_LABEL_LEN);
+
+ snprintf(csrow->channels[chan].label, EDAC_MC_LABEL_LEN, "DIMM %c%d",
+ (chan == 0) ? 'A' : 'B',
+ index);
if (cumul_size == last_cumul_size)
continue; /* not populated */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 113/214] i915: ensure that VGA plane is disabled
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (111 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 112/214] i82975x_edac: Fix dimm label initialization Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 114/214] regulator: max8997: Use uV in voltage_map_desc Greg Kroah-Hartman
` (103 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Mazur, Daniel Vetter,
Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Mazur <krzysiek@podlesie.net>
commit 0fde901f1ddd2ce0e380a6444f1fb7ca555859e9 upstream.
Some broken systems (like HP nc6120) in some cases, usually after LID
close/open, enable VGA plane, making display unusable (black screen on LVDS,
some strange mode on VGA output). We used to disable VGA plane only once at
startup. Now we also check, if VGA plane is still disabled while changing
mode, and fix that if something changed it.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=57434
Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
[bwh: Backported to 3.2: intel_modeset_setup_hw_state() does not
exist, so call i915_redisable_vga() directly from intel_lid_notify()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_drv.h | 1 +
drivers/gpu/drm/i915/intel_display.c | 17 +++++++++++++++++
drivers/gpu/drm/i915/intel_lvds.c | 1 +
3 files changed, 19 insertions(+)
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1397,6 +1397,7 @@ static inline void intel_unregister_dsm_
#endif /* CONFIG_ACPI */
/* modesetting */
+extern void i915_redisable_vga(struct drm_device *dev);
extern void intel_modeset_init(struct drm_device *dev);
extern void intel_modeset_gem_init(struct drm_device *dev);
extern void intel_modeset_cleanup(struct drm_device *dev);
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9254,6 +9254,23 @@ static void i915_disable_vga(struct drm_
POSTING_READ(vga_reg);
}
+void i915_redisable_vga(struct drm_device *dev)
+{
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ u32 vga_reg;
+
+ if (HAS_PCH_SPLIT(dev))
+ vga_reg = CPU_VGACNTRL;
+ else
+ vga_reg = VGACNTRL;
+
+ if (I915_READ(vga_reg) != VGA_DISP_DISABLE) {
+ DRM_DEBUG_KMS("Something enabled VGA plane, disabling it\n");
+ I915_WRITE(vga_reg, VGA_DISP_DISABLE);
+ POSTING_READ(vga_reg);
+ }
+}
+
void intel_modeset_init(struct drm_device *dev)
{
struct drm_i915_private *dev_priv = dev->dev_private;
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -535,6 +535,7 @@ static int intel_lid_notify(struct notif
mutex_lock(&dev->mode_config.mutex);
drm_helper_resume_force_mode(dev);
+ i915_redisable_vga(dev);
mutex_unlock(&dev->mode_config.mutex);
return NOTIFY_OK;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 114/214] regulator: max8997: Use uV in voltage_map_desc
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (112 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 113/214] i915: ensure that VGA plane is disabled Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 115/214] regulator: max8998: Ensure enough delay time for max8998_set_voltage_buck_time_sel Greg Kroah-Hartman
` (102 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Axel Lin, Mark Brown, Ben Hutchings,
Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <axel.lin@ingics.com>
commit bc3b7756b5ff66828acf7bc24f148d28b8d61108 upstream.
Current code does integer division (min_vol = min_uV / 1000) before pass
min_vol to max8997_get_voltage_proper_val().
So it is possible min_vol is truncated to a smaller value.
For example, if the request min_uV is 800900 for ldo.
min_vol = 800900 / 1000 = 800 (mV)
Then max8997_get_voltage_proper_val returns 800 mV for this case which is lower
than the requested voltage.
Use uV rather than mV in voltage_map_desc to prevent truncation by integer
division.
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
[bwh: Backported to 3.2:
- Adjust context
- voltage_map_desc also has an n_bits field]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/max8997.c | 36 +++++++++++++++++-------------------
1 file changed, 17 insertions(+), 19 deletions(-)
--- a/drivers/regulator/max8997.c
+++ b/drivers/regulator/max8997.c
@@ -71,26 +71,26 @@ struct voltage_map_desc {
unsigned int n_bits;
};
-/* Voltage maps in mV */
+/* Voltage maps in uV */
static const struct voltage_map_desc ldo_voltage_map_desc = {
- .min = 800, .max = 3950, .step = 50, .n_bits = 6,
+ .min = 800000, .max = 3950000, .step = 50000, .n_bits = 6,
}; /* LDO1 ~ 18, 21 all */
static const struct voltage_map_desc buck1245_voltage_map_desc = {
- .min = 650, .max = 2225, .step = 25, .n_bits = 6,
+ .min = 650000, .max = 2225000, .step = 25000, .n_bits = 6,
}; /* Buck1, 2, 4, 5 */
static const struct voltage_map_desc buck37_voltage_map_desc = {
- .min = 750, .max = 3900, .step = 50, .n_bits = 6,
+ .min = 750000, .max = 3900000, .step = 50000, .n_bits = 6,
}; /* Buck3, 7 */
-/* current map in mA */
+/* current map in uA */
static const struct voltage_map_desc charger_current_map_desc = {
- .min = 200, .max = 950, .step = 50, .n_bits = 4,
+ .min = 200000, .max = 950000, .step = 50000, .n_bits = 4,
};
static const struct voltage_map_desc topoff_current_map_desc = {
- .min = 50, .max = 200, .step = 10, .n_bits = 4,
+ .min = 50000, .max = 200000, .step = 10000, .n_bits = 4,
};
static const struct voltage_map_desc *reg_voltage_map[] = {
@@ -194,7 +194,7 @@ static int max8997_list_voltage(struct r
if (val > desc->max)
return -EINVAL;
- return val * 1000;
+ return val;
}
static int max8997_get_enable_register(struct regulator_dev *rdev,
@@ -496,7 +496,6 @@ static int max8997_set_voltage_ldobuck(s
{
struct max8997_data *max8997 = rdev_get_drvdata(rdev);
struct i2c_client *i2c = max8997->iodev->i2c;
- int min_vol = min_uV / 1000, max_vol = max_uV / 1000;
const struct voltage_map_desc *desc;
int rid = rdev_get_id(rdev);
int reg, shift = 0, mask, ret;
@@ -522,7 +521,7 @@ static int max8997_set_voltage_ldobuck(s
desc = reg_voltage_map[rid];
- i = max8997_get_voltage_proper_val(desc, min_vol, max_vol);
+ i = max8997_get_voltage_proper_val(desc, min_uV, max_uV);
if (i < 0)
return i;
@@ -541,7 +540,7 @@ static int max8997_set_voltage_ldobuck(s
/* If the voltage is increasing */
if (org < i)
udelay(DIV_ROUND_UP(desc->step * (i - org),
- max8997->ramp_delay));
+ max8997->ramp_delay * 1000));
}
return ret;
@@ -640,7 +639,6 @@ static int max8997_set_voltage_buck(stru
const struct voltage_map_desc *desc;
int new_val, new_idx, damage, tmp_val, tmp_idx, tmp_dmg;
bool gpio_dvs_mode = false;
- int min_vol = min_uV / 1000, max_vol = max_uV / 1000;
if (rid < MAX8997_BUCK1 || rid > MAX8997_BUCK7)
return -EINVAL;
@@ -665,7 +663,7 @@ static int max8997_set_voltage_buck(stru
selector);
desc = reg_voltage_map[rid];
- new_val = max8997_get_voltage_proper_val(desc, min_vol, max_vol);
+ new_val = max8997_get_voltage_proper_val(desc, min_uV, max_uV);
if (new_val < 0)
return new_val;
@@ -997,8 +995,8 @@ static __devinit int max8997_pmic_probe(
max8997->buck1_vol[i] = ret =
max8997_get_voltage_proper_val(
&buck1245_voltage_map_desc,
- pdata->buck1_voltage[i] / 1000,
- pdata->buck1_voltage[i] / 1000 +
+ pdata->buck1_voltage[i],
+ pdata->buck1_voltage[i] +
buck1245_voltage_map_desc.step);
if (ret < 0)
goto err_alloc;
@@ -1006,8 +1004,8 @@ static __devinit int max8997_pmic_probe(
max8997->buck2_vol[i] = ret =
max8997_get_voltage_proper_val(
&buck1245_voltage_map_desc,
- pdata->buck2_voltage[i] / 1000,
- pdata->buck2_voltage[i] / 1000 +
+ pdata->buck2_voltage[i],
+ pdata->buck2_voltage[i] +
buck1245_voltage_map_desc.step);
if (ret < 0)
goto err_alloc;
@@ -1015,8 +1013,8 @@ static __devinit int max8997_pmic_probe(
max8997->buck5_vol[i] = ret =
max8997_get_voltage_proper_val(
&buck1245_voltage_map_desc,
- pdata->buck5_voltage[i] / 1000,
- pdata->buck5_voltage[i] / 1000 +
+ pdata->buck5_voltage[i],
+ pdata->buck5_voltage[i] +
buck1245_voltage_map_desc.step);
if (ret < 0)
goto err_alloc;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 115/214] regulator: max8998: Ensure enough delay time for max8998_set_voltage_buck_time_sel
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (113 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 114/214] regulator: max8997: Use uV in voltage_map_desc Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:17 ` [PATCH 3.4 116/214] intel_idle: Dont register CPU notifier if we are not running Greg Kroah-Hartman
` (101 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Axel Lin, Mark Brown, Ben Hutchings,
Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <axel.lin@ingics.com>
commit e8d9897ff064b1683c11c15ea1296a67a45d77b0 upstream.
commit 81d0a6ae7befb24c06f4aa4856af7f8d1f612171 upstream.
Use DIV_ROUND_UP to prevent truncation by integer division issue.
This ensures we return enough delay time.
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
[bwh: Backported to 3.2: delay is done by driver, not returned to the caller]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/max8998.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/regulator/max8998.c
+++ b/drivers/regulator/max8998.c
@@ -492,7 +492,7 @@ buck2_exit:
difference = desc->min + desc->step*i - previous_vol/1000;
if (difference > 0)
- udelay(difference / ((val & 0x0f) + 1));
+ udelay(DIV_ROUND_UP(difference, (val & 0x0f) + 1));
return ret;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 116/214] intel_idle: Dont register CPU notifier if we are not running.
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (114 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 115/214] regulator: max8998: Ensure enough delay time for max8998_set_voltage_buck_time_sel Greg Kroah-Hartman
@ 2014-06-05 4:17 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 117/214] can: c_can: Set reserved bit in IFx_MASK2 to 1 on write Greg Kroah-Hartman
` (100 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:17 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konrad Rzeszutek Wilk,
Srivatsa S. Bhat, Rafael J. Wysocki, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
commit 6f8c2e7933679f54b6478945dc72e59ef9a3d5e0 upstream.
The 'intel_idle_probe' probes the CPU and sets the CPU notifier.
But if later on during the module initialization we fail (say
in cpuidle_register_driver), we stop loading, but we neglect
to unregister the CPU notifier. This means that during CPU
hotplug events the system will fail:
calling intel_idle_init+0x0/0x326 @ 1
intel_idle: MWAIT substates: 0x1120
intel_idle: v0.4 model 0x2A
intel_idle: lapic_timer_reliable_states 0xffffffff
intel_idle: intel_idle yielding to none
initcall intel_idle_init+0x0/0x326 returned -19 after 14 usecs
... some time later, offlining and onlining a CPU:
cpu 3 spinlock event irq 62
BUG: unable to ] __cpuidle_register_device+0x1c/0x120
PGD 99b8b067 PUD 99b95067 PMD 0
Oops: 0000 [#1] SMP
Modules linked in: xen_evtchn nouveau mxm_wmi wmi radeon ttm i915 fbcon tileblit font atl1c bitblit softcursor drm_kms_helper video xen_blkfront xen_netfront fb_sys_fops sysimgblt sysfillrect syscopyarea xenfs xen_privcmd mperf
CPU 0
Pid: 2302, comm: udevd Not tainted 3.8.0-rc3upstream-00249-g09ad159 #1 MSI MS-7680/H61M-P23 (MS-7680)
RIP: e030:[<ffffffff814d956c>] [<ffffffff814d956c>] __cpuidle_register_device+0x1c/0x120
RSP: e02b:ffff88009dacfcb8 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff880105380000 RCX: 000000000000001c
RDX: 0000000000000000 RSI: 0000000000000055 RDI: ffff880105380000
RBP: ffff88009dacfce8 R08: ffffffff81a4f048 R09: 0000000000000008
R10: 0000000000000008 R11: 0000000000000000 R12: ffff880105380000
R13: 00000000ffffffdd R14: 0000000000000000 R15: ffffffff81a523d0
FS: 00007f37bd83b7a0(0000) GS:ffff880105200000(0000) knlGS:0000000000000000
CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000008 CR3: 00000000a09ea000 CR4: 0000000000042660
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process udevd (pid: 2302, threadinfo ffff88009dace000, task ffff88009afb47f0)
Stack:
ffffffff8107f2d0 ffffffff810c2fb7 ffff88009dacfce8 00000000ffffffea
ffff880105380000 00000000ffffffdd ffff88009dacfd08 ffffffff814d9882
0000000000000003 ffff880105380000 ffff88009dacfd28 ffffffff81340afd
Call Trace:
[<ffffffff8107f2d0>] ? collect_cpu_info_local+0x30/0x30
[<ffffffff810c2fb7>] ? __might_sleep+0xe7/0x100
[<ffffffff814d9882>] cpuidle_register_device+0x32/0x70
[<ffffffff81340afd>] intel_idle_cpu_init+0xad/0x110
[<ffffffff81340bc8>] cpu_hotplug_notify+0x68/0x80
[<ffffffff8166023d>] notifier_call_chain+0x4d/0x70
[<ffffffff810bc369>] __raw_notifier_call_chain+0x9/0x10
[<ffffffff81094a4b>] __cpu_notify+0x1b/0x30
[<ffffffff81652cf7>] _cpu_up+0x103/0x14b
[<ffffffff81652e18>] cpu_up+0xd9/0xec
[<ffffffff8164a254>] store_online+0x94/0xd0
[<ffffffff814122fb>] dev_attr_store+0x1b/0x20
[<ffffffff81216404>] sysfs_write_file+0xf4/0x170
[<ffffffff811a1024>] vfs_write+0xb4/0x130
[<ffffffff811a17ea>] sys_write+0x5a/0xa0
[<ffffffff816643a9>] system_call_fastpath+0x16/0x1b
Code: 03 18 00 c9 c3 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 48 83 ec 30 48 89 5d e8 4c 89 65 f0 48 89 fb 4c 89 6d f8 e8 84 08 00 00 <48> 8b 78 08 49 89 c4 e8 f8 7f c1 ff 89 c2 b8 ea ff ff ff 84 d2
RIP [<ffffffff814d956c>] __cpuidle_register_device+0x1c/0x120
RSP <ffff88009dacfcb8>
This patch fixes that by moving the CPU notifier registration
as the last item to be done by the module.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[bwh: Backported to 3.2: notifier is registered only if we do not have ARAT]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/idle/intel_idle.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -443,10 +443,8 @@ static int intel_idle_probe(void)
if (boot_cpu_has(X86_FEATURE_ARAT)) /* Always Reliable APIC Timer */
lapic_timer_reliable_states = LAPIC_TIMER_ALWAYS_RELIABLE;
- else {
+ else
on_each_cpu(__setup_broadcast_timer, (void *)true, 1);
- register_cpu_notifier(&setup_broadcast_notifier);
- }
pr_debug(PREFIX "v" INTEL_IDLE_VERSION
" model 0x%X\n", boot_cpu_data.x86_model);
@@ -612,6 +610,9 @@ static int __init intel_idle_init(void)
}
}
+ if (lapic_timer_reliable_states != LAPIC_TIMER_ALWAYS_RELIABLE)
+ register_cpu_notifier(&setup_broadcast_notifier);
+
return 0;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 117/214] can: c_can: Set reserved bit in IFx_MASK2 to 1 on write
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (115 preceding siblings ...)
2014-06-05 4:17 ` [PATCH 3.4 116/214] intel_idle: Dont register CPU notifier if we are not running Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 118/214] e1000e: DoS while TSO enabled caused by link partner with small MSS Greg Kroah-Hartman
` (99 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Stein, Marc Kleine-Budde,
Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <alexander.stein@systec-electronic.com>
commit 2bd3bc4e8472424f1a6009825397639a8968920a upstream.
According to C_CAN documentation, the reserved bit in IFx_MASK2 register is
fixed 1.
Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/c_can/c_can.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -446,8 +446,12 @@ static void c_can_setup_receive_object(s
priv->write_reg(priv, &priv->regs->ifregs[iface].mask1,
IFX_WRITE_LOW_16BIT(mask));
+
+ /* According to C_CAN documentation, the reserved bit
+ * in IFx_MASK2 register is fixed 1
+ */
priv->write_reg(priv, &priv->regs->ifregs[iface].mask2,
- IFX_WRITE_HIGH_16BIT(mask));
+ IFX_WRITE_HIGH_16BIT(mask) | BIT(13));
priv->write_reg(priv, &priv->regs->ifregs[iface].arb1,
IFX_WRITE_LOW_16BIT(id));
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 118/214] e1000e: DoS while TSO enabled caused by link partner with small MSS
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (116 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 117/214] can: c_can: Set reserved bit in IFx_MASK2 to 1 on write Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 119/214] mac80211: introduce IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL Greg Kroah-Hartman
` (98 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Bruce Allan,
Aaron Brown, Jeff Kirsher, David S. Miller, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bruce Allan <bruce.w.allan@intel.com>
commit d821a4c4d11ad160925dab2bb009b8444beff484 upstream.
With a low enough MSS on the link partner and TSO enabled locally, the
networking stack can periodically send a very large (e.g. 64KB) TCP
message for which the driver will attempt to use more Tx descriptors than
are available by default in the Tx ring. This is due to a workaround in
the code that imposes a limit of only 4 MSS-sized segments per descriptor
which appears to be a carry-over from the older e1000 driver and may be
applicable only to some older PCI or PCIx parts which are not supported in
e1000e. When the driver gets a message that is too large to fit across the
configured number of Tx descriptors, it stops the upper stack from queueing
any more and gets stuck in this state. After a timeout, the upper stack
assumes the adapter is hung and calls the driver to reset it.
Remove the unnecessary limitation of using up to only 4 MSS-sized segments
per Tx descriptor, and put in a hard failure test to catch when attempting
to check for message sizes larger than would fit in the whole Tx ring.
Refactor the remaining logic that limits the size of data per Tx descriptor
from a seemingly arbitrary 8KB to a limit based on the dynamic size of the
Tx packet buffer as described in the hardware specification.
Also, fix the logic in the check for space in the Tx ring for the next
largest possible packet after the current one has been successfully queued
for transmit, and use the appropriate defines for default ring sizes in
e1000_probe instead of magic values.
This issue goes back to the introduction of e1000e in 2.6.24 when it was
split off from e1000.
Reported-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/e1000e/e1000.h | 1
drivers/net/ethernet/intel/e1000e/netdev.c | 48 +++++++++++++----------------
2 files changed, 24 insertions(+), 25 deletions(-)
--- a/drivers/net/ethernet/intel/e1000e/e1000.h
+++ b/drivers/net/ethernet/intel/e1000e/e1000.h
@@ -309,6 +309,7 @@ struct e1000_adapter {
*/
struct e1000_ring *tx_ring /* One per active queue */
____cacheline_aligned_in_smp;
+ u32 tx_fifo_limit;
struct napi_struct napi;
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -3498,6 +3498,15 @@ void e1000e_reset(struct e1000_adapter *
}
/*
+ * Alignment of Tx data is on an arbitrary byte boundary with the
+ * maximum size per Tx descriptor limited only to the transmit
+ * allocation of the packet buffer minus 96 bytes with an upper
+ * limit of 24KB due to receive synchronization limitations.
+ */
+ adapter->tx_fifo_limit = min_t(u32, ((er32(PBA) >> 16) << 10) - 96,
+ 24 << 10);
+
+ /*
* Disable Adaptive Interrupt Moderation if 2 full packets cannot
* fit in receive buffer.
*/
@@ -4766,12 +4775,9 @@ static bool e1000_tx_csum(struct e1000_r
return 1;
}
-#define E1000_MAX_PER_TXD 8192
-#define E1000_MAX_TXD_PWR 12
-
static int e1000_tx_map(struct e1000_ring *tx_ring, struct sk_buff *skb,
unsigned int first, unsigned int max_per_txd,
- unsigned int nr_frags, unsigned int mss)
+ unsigned int nr_frags)
{
struct e1000_adapter *adapter = tx_ring->adapter;
struct pci_dev *pdev = adapter->pdev;
@@ -5004,20 +5010,19 @@ static int __e1000_maybe_stop_tx(struct
static int e1000_maybe_stop_tx(struct e1000_ring *tx_ring, int size)
{
+ BUG_ON(size > tx_ring->count);
+
if (e1000_desc_unused(tx_ring) >= size)
return 0;
return __e1000_maybe_stop_tx(tx_ring, size);
}
-#define TXD_USE_COUNT(S, X) (((S) >> (X)) + 1)
static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
struct net_device *netdev)
{
struct e1000_adapter *adapter = netdev_priv(netdev);
struct e1000_ring *tx_ring = adapter->tx_ring;
unsigned int first;
- unsigned int max_per_txd = E1000_MAX_PER_TXD;
- unsigned int max_txd_pwr = E1000_MAX_TXD_PWR;
unsigned int tx_flags = 0;
unsigned int len = skb_headlen(skb);
unsigned int nr_frags;
@@ -5037,18 +5042,8 @@ static netdev_tx_t e1000_xmit_frame(stru
}
mss = skb_shinfo(skb)->gso_size;
- /*
- * The controller does a simple calculation to
- * make sure there is enough room in the FIFO before
- * initiating the DMA for each buffer. The calc is:
- * 4 = ceil(buffer len/mss). To make sure we don't
- * overrun the FIFO, adjust the max buffer len if mss
- * drops.
- */
if (mss) {
u8 hdr_len;
- max_per_txd = min(mss << 2, max_per_txd);
- max_txd_pwr = fls(max_per_txd) - 1;
/*
* TSO Workaround for 82571/2/3 Controllers -- if skb->data
@@ -5078,12 +5073,12 @@ static netdev_tx_t e1000_xmit_frame(stru
count++;
count++;
- count += TXD_USE_COUNT(len, max_txd_pwr);
+ count += DIV_ROUND_UP(len, adapter->tx_fifo_limit);
nr_frags = skb_shinfo(skb)->nr_frags;
for (f = 0; f < nr_frags; f++)
- count += TXD_USE_COUNT(skb_frag_size(&skb_shinfo(skb)->frags[f]),
- max_txd_pwr);
+ count += DIV_ROUND_UP(skb_frag_size(&skb_shinfo(skb)->frags[f]),
+ adapter->tx_fifo_limit);
if (adapter->hw.mac.tx_pkt_filtering)
e1000_transfer_dhcp_info(adapter, skb);
@@ -5125,13 +5120,16 @@ static netdev_tx_t e1000_xmit_frame(stru
tx_flags |= E1000_TX_FLAGS_NO_FCS;
/* if count is 0 then mapping error has occurred */
- count = e1000_tx_map(tx_ring, skb, first, max_per_txd, nr_frags, mss);
+ count = e1000_tx_map(tx_ring, skb, first, adapter->tx_fifo_limit,
+ nr_frags);
if (count) {
netdev_sent_queue(netdev, skb->len);
e1000_tx_queue(tx_ring, tx_flags, count);
/* Make sure there is space in the ring for the next send. */
- e1000_maybe_stop_tx(tx_ring, MAX_SKB_FRAGS + 2);
-
+ e1000_maybe_stop_tx(tx_ring,
+ (MAX_SKB_FRAGS *
+ DIV_ROUND_UP(PAGE_SIZE,
+ adapter->tx_fifo_limit) + 2));
} else {
dev_kfree_skb_any(skb);
tx_ring->buffer_info[first].time_stamp = 0;
@@ -6303,8 +6301,8 @@ static int __devinit e1000_probe(struct
adapter->hw.phy.autoneg_advertised = 0x2f;
/* ring size defaults */
- adapter->rx_ring->count = 256;
- adapter->tx_ring->count = 256;
+ adapter->rx_ring->count = E1000_DEFAULT_RXD;
+ adapter->tx_ring->count = E1000_DEFAULT_TXD;
/*
* Initial Wake on LAN setting - If APM wake is enabled in
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 119/214] mac80211: introduce IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (117 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 118/214] e1000e: DoS while TSO enabled caused by link partner with small MSS Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 120/214] PCI: shpchp: Use per-slot workqueues to avoid deadlock Greg Kroah-Hartman
` (97 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stanislaw Gruszka, Johannes Berg,
Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <sgruszka@redhat.com>
commit 5b632fe85ec82e5c43740b52e74c66df50a37db3 upstream.
Commit f0425beda4d404a6e751439b562100b902ba9c98 "mac80211: retry sending
failed BAR frames later instead of tearing down aggr" caused regression
on rt2x00 hardware (connection hangs). This regression was fixed by
commit be03d4a45c09ee5100d3aaaedd087f19bc20d01 "rt2x00: Don't let
mac80211 send a BAR when an AMPDU subframe fails". But the latter
commit caused yet another problem reported in
https://bugzilla.kernel.org/show_bug.cgi?id=42828#c22
After long discussion in this thread:
http://mid.gmane.org/20121018075615.GA18212@redhat.com
and testing various alternative solutions, which failed on one or other
setup, we have no other good fix for the issues like just revert both
mentioned earlier commits.
To do not affect other hardware which benefit from commit
f0425beda4d404a6e751439b562100b902ba9c98, instead of reverting it,
introduce flag that when used will restore mac80211 behaviour before
the commit.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
[replaced link with mid.gmane.org that has message-id]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[hq: Backported to 3.4: adjust context]
Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/mac80211.h | 5 +++++
net/mac80211/status.c | 6 +++++-
2 files changed, 10 insertions(+), 1 deletion(-)
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1174,6 +1174,10 @@ enum sta_notify_cmd {
* @IEEE80211_HW_SCAN_WHILE_IDLE: The device can do hw scan while
* being idle (i.e. mac80211 doesn't have to go idle-off during the
* the scan).
+ *
+ * @IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL: On this hardware TX BA session
+ * should be tear down once BAR frame will not be acked.
+ *
*/
enum ieee80211_hw_flags {
IEEE80211_HW_HAS_RATE_CONTROL = 1<<0,
@@ -1201,6 +1205,7 @@ enum ieee80211_hw_flags {
IEEE80211_HW_AP_LINK_PS = 1<<22,
IEEE80211_HW_TX_AMPDU_SETUP_IN_HW = 1<<23,
IEEE80211_HW_SCAN_WHILE_IDLE = 1<<24,
+ IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL = 1<<26,
};
/**
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -432,7 +432,11 @@ void ieee80211_tx_status(struct ieee8021
IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
- ieee80211_set_bar_pending(sta, tid, ssn);
+ if (local->hw.flags &
+ IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL)
+ ieee80211_stop_tx_ba_session(&sta->sta, tid);
+ else
+ ieee80211_set_bar_pending(sta, tid, ssn);
}
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 120/214] PCI: shpchp: Use per-slot workqueues to avoid deadlock
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (118 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 119/214] mac80211: introduce IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 121/214] thinkpad-acpi: fix issuing duplicated key events for brightness up/down Greg Kroah-Hartman
` (96 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bjorn Helgaas, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <bhelgaas@google.com>
commit f652e7d2916fe2fcf9e7d709aa5b7476b431e2dd upstream.
When we have an SHPC-capable bridge with a second SHPC-capable bridge
below it, pushing the upstream bridge's attention button causes a
deadlock.
The deadlock happens because we use the shpchp_wq workqueue to run
shpchp_pushbutton_thread(), which uses shpchp_disable_slot() to remove
devices below the upstream bridge. When we remove the downstream bridge,
we call shpc_remove(), the shpchp driver's .remove() method. That calls
flush_workqueue(shpchp_wq), which deadlocks because the
shpchp_pushbutton_thread() work item is still running.
This patch avoids the deadlock by creating a workqueue for every slot
and removing the single shared workqueue.
Here's the call path that leads to the deadlock:
shpchp_queue_pushbutton_work
queue_work(shpchp_wq) # shpchp_pushbutton_thread
...
shpchp_pushbutton_thread
shpchp_disable_slot
remove_board
shpchp_unconfigure_device
pci_stop_and_remove_bus_device
...
shpc_remove # shpchp driver .remove method
hpc_release_ctlr
cleanup_slots
flush_workqueue(shpchp_wq)
This change is based on code inspection, since we don't have hardware
with this topology.
Based-on-patch-by: Yijing Wang <wangyijing@huawei.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[hq: Backported to 3.4: adjust context]
Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/hotplug/shpchp.h | 2 +-
drivers/pci/hotplug/shpchp_core.c | 26 ++++++++++++++------------
drivers/pci/hotplug/shpchp_ctrl.c | 6 +++---
3 files changed, 18 insertions(+), 16 deletions(-)
--- a/drivers/pci/hotplug/shpchp.h
+++ b/drivers/pci/hotplug/shpchp.h
@@ -46,7 +46,6 @@
extern bool shpchp_poll_mode;
extern int shpchp_poll_time;
extern bool shpchp_debug;
-extern struct workqueue_struct *shpchp_wq;
#define dbg(format, arg...) \
do { \
@@ -90,6 +89,7 @@ struct slot {
struct list_head slot_list;
struct delayed_work work; /* work for button event */
struct mutex lock;
+ struct workqueue_struct *wq;
u8 hp_slot;
};
--- a/drivers/pci/hotplug/shpchp_core.c
+++ b/drivers/pci/hotplug/shpchp_core.c
@@ -39,7 +39,6 @@
bool shpchp_debug;
bool shpchp_poll_mode;
int shpchp_poll_time;
-struct workqueue_struct *shpchp_wq;
#define DRIVER_VERSION "0.4"
#define DRIVER_AUTHOR "Dan Zink <dan.zink@compaq.com>, Greg Kroah-Hartman <greg@kroah.com>, Dely Sy <dely.l.sy@intel.com>"
@@ -122,6 +121,14 @@ static int init_slots(struct controller
slot->device = ctrl->slot_device_offset + i;
slot->hpc_ops = ctrl->hpc_ops;
slot->number = ctrl->first_slot + (ctrl->slot_num_inc * i);
+
+ snprintf(name, sizeof(name), "shpchp-%d", slot->number);
+ slot->wq = alloc_workqueue(name, 0, 0);
+ if (!slot->wq) {
+ retval = -ENOMEM;
+ goto error_info;
+ }
+
mutex_init(&slot->lock);
INIT_DELAYED_WORK(&slot->work, shpchp_queue_pushbutton_work);
@@ -141,7 +148,7 @@ static int init_slots(struct controller
if (retval) {
ctrl_err(ctrl, "pci_hp_register failed with error %d\n",
retval);
- goto error_info;
+ goto error_slotwq;
}
get_power_status(hotplug_slot, &info->power_status);
@@ -153,6 +160,8 @@ static int init_slots(struct controller
}
return 0;
+error_slotwq:
+ destroy_workqueue(slot->wq);
error_info:
kfree(info);
error_hpslot:
@@ -173,7 +182,7 @@ void cleanup_slots(struct controller *ct
slot = list_entry(tmp, struct slot, slot_list);
list_del(&slot->slot_list);
cancel_delayed_work(&slot->work);
- flush_workqueue(shpchp_wq);
+ destroy_workqueue(slot->wq);
pci_hp_deregister(slot->hotplug_slot);
}
}
@@ -356,18 +365,12 @@ static struct pci_driver shpc_driver = {
static int __init shpcd_init(void)
{
- int retval = 0;
-
- shpchp_wq = alloc_ordered_workqueue("shpchp", 0);
- if (!shpchp_wq)
- return -ENOMEM;
+ int retval;
retval = pci_register_driver(&shpc_driver);
dbg("%s: pci_register_driver = %d\n", __func__, retval);
info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
- if (retval) {
- destroy_workqueue(shpchp_wq);
- }
+
return retval;
}
@@ -375,7 +378,6 @@ static void __exit shpcd_cleanup(void)
{
dbg("unload_shpchpd()\n");
pci_unregister_driver(&shpc_driver);
- destroy_workqueue(shpchp_wq);
info(DRIVER_DESC " version: " DRIVER_VERSION " unloaded\n");
}
--- a/drivers/pci/hotplug/shpchp_ctrl.c
+++ b/drivers/pci/hotplug/shpchp_ctrl.c
@@ -51,7 +51,7 @@ static int queue_interrupt_event(struct
info->p_slot = p_slot;
INIT_WORK(&info->work, interrupt_event_handler);
- queue_work(shpchp_wq, &info->work);
+ queue_work(p_slot->wq, &info->work);
return 0;
}
@@ -456,7 +456,7 @@ void shpchp_queue_pushbutton_work(struct
kfree(info);
goto out;
}
- queue_work(shpchp_wq, &info->work);
+ queue_work(p_slot->wq, &info->work);
out:
mutex_unlock(&p_slot->lock);
}
@@ -504,7 +504,7 @@ static void handle_button_press_event(st
p_slot->hpc_ops->green_led_blink(p_slot);
p_slot->hpc_ops->set_attention_status(p_slot, 0);
- queue_delayed_work(shpchp_wq, &p_slot->work, 5*HZ);
+ queue_delayed_work(p_slot->wq, &p_slot->work, 5*HZ);
break;
case BLINKINGOFF_STATE:
case BLINKINGON_STATE:
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 121/214] thinkpad-acpi: fix issuing duplicated key events for brightness up/down
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (119 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 120/214] PCI: shpchp: Use per-slot workqueues to avoid deadlock Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 122/214] ALSA: HDA: Add inverted internal mic quirk for Lenovo S205 Greg Kroah-Hartman
` (95 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Hung, Matthew Garrett,
Andreas Sturmlechner
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <alex.hung@canonical.com>
commit ff413195e830541afeae469fc866ecd0319abd7e upstream.
The tp_features.bright_acpimode will not be set correctly for brightness
control because ACPI_VIDEO_HID will not be located in ACPI. As a result,
a duplicated key event will always be sent. acpi_video_backlight_support()
is sufficient to detect standard ACPI brightness control.
Signed-off-by: Alex Hung <alex.hung@canonical.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Cc: Andreas Sturmlechner <andreas.sturmlechner@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/thinkpad_acpi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -3402,7 +3402,7 @@ static int __init hotkey_init(struct ibm
/* Do not issue duplicate brightness change events to
* userspace. tpacpi_detect_brightness_capabilities() must have
* been called before this point */
- if (tp_features.bright_acpimode && acpi_video_backlight_support()) {
+ if (acpi_video_backlight_support()) {
pr_info("This ThinkPad has standard ACPI backlight "
"brightness control, supported by the ACPI "
"video driver\n");
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 122/214] ALSA: HDA: Add inverted internal mic quirk for Lenovo S205
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (120 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 121/214] thinkpad-acpi: fix issuing duplicated key events for brightness up/down Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 123/214] ALSA: hda - Add inverted internal mic quirk for Lenovo IdeaPad U310 Greg Kroah-Hartman
` (94 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Henningsson, Takashi Iwai,
Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Henningsson <david.henningsson@canonical.com>
commit b3c5dce81584391af8b6dedb0647e65c17aab3a2 upstream.
The Lenovo Ideapad S205 has an internal mic where the right channel
is phase inverted.
BugLink: https://bugs.launchpad.net/bugs/884652
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_conexant.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -4477,6 +4477,7 @@ static const struct snd_pci_quirk cxt506
SND_PCI_QUIRK(0x17aa, 0x21ce, "Lenovo T420", CXT_PINCFG_LENOVO_TP410),
SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
{}
};
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 123/214] ALSA: hda - Add inverted internal mic quirk for Lenovo IdeaPad U310
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (121 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 122/214] ALSA: HDA: Add inverted internal mic quirk for Lenovo S205 Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 124/214] ALSA: hda - Fix oops caused by recent commit "Fix internal mic for Lenovo Ideapad U300s" Greg Kroah-Hartman
` (93 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Felix Kaechele, Takashi Iwai,
Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Kaechele <felix@fetzig.org>
commit e4db0952e542090c605fd41d31d761f1b4624f4a upstream.
The Lenovo IdeaPad U310 has an internal mic where the right channel
is phase inverted.
Signed-off-by: Felix Kaechele <felix@fetzig.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_conexant.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -4477,6 +4477,7 @@ static const struct snd_pci_quirk cxt506
SND_PCI_QUIRK(0x17aa, 0x21ce, "Lenovo T420", CXT_PINCFG_LENOVO_TP410),
SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
{}
};
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 124/214] ALSA: hda - Fix oops caused by recent commit "Fix internal mic for Lenovo Ideapad U300s"
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (122 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 123/214] ALSA: hda - Add inverted internal mic quirk for Lenovo IdeaPad U310 Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 125/214] ALSA: hda - Add stereo-dmic fixup for Acer Aspire One 522 Greg Kroah-Hartman
` (92 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David Henningsson,
Takashi Iwai, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Henningsson <david.henningsson@canonical.com>
commit 83b0c6ba999643ee8ad6329f26e1cdc870e1a920 upstream.
Make sure we don't dereference the "quirk" pointer when it is null.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_conexant.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -4430,7 +4430,9 @@ static void apply_fixup(struct hda_codec
struct conexant_spec *spec = codec->spec;
quirk = snd_pci_quirk_lookup(codec->bus->pci, quirk);
- if (quirk && table[quirk->value]) {
+ if (!quirk)
+ return;
+ if (table[quirk->value]) {
snd_printdd(KERN_INFO "hda_codec: applying pincfg for %s\n",
quirk->name);
apply_pincfg(codec, table[quirk->value]);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 125/214] ALSA: hda - Add stereo-dmic fixup for Acer Aspire One 522
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (123 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 124/214] ALSA: hda - Fix oops caused by recent commit "Fix internal mic for Lenovo Ideapad U300s" Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 126/214] ALSA: hda/conexant - Correct vendor IDs for new codecs Greg Kroah-Hartman
` (91 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 63a077e27648b4043b1ca1b4e29f0c42d99616b6 upstream.
Acer Aspire One 522 has the infamous digital mic unit that needs the
phase inversion fixup for stereo.
Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=715737
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_conexant.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -4473,6 +4473,7 @@ static const struct snd_pci_quirk cxt505
};
static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC),
SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410),
SND_PCI_QUIRK(0x17aa, 0x215f, "Lenovo T510", CXT_PINCFG_LENOVO_TP410),
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 126/214] ALSA: hda/conexant - Correct vendor IDs for new codecs
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (124 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 125/214] ALSA: hda - Add stereo-dmic fixup for Acer Aspire One 522 Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 127/214] ALSA: hda - Add Conexant CX20755/20756/20757 codec IDs Greg Kroah-Hartman
` (90 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 2d825fd82eb765412a558a56e193b77117d56699 upstream.
Never trust datasheet...
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_conexant.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -4572,10 +4572,6 @@ static int patch_conexant_auto(struct hd
*/
static const struct hda_codec_preset snd_hda_preset_conexant[] = {
- { .id = 0x14f11510, .name = "CX20751/2",
- .patch = patch_conexant_auto },
- { .id = 0x14f11511, .name = "CX20753/4",
- .patch = patch_conexant_auto },
{ .id = 0x14f15045, .name = "CX20549 (Venice)",
.patch = patch_cxt5045 },
{ .id = 0x14f15047, .name = "CX20551 (Waikiki)",
@@ -4610,11 +4606,15 @@ static const struct hda_codec_preset snd
.patch = patch_conexant_auto },
{ .id = 0x14f150b9, .name = "CX20665",
.patch = patch_conexant_auto },
+ { .id = 0x14f1510f, .name = "CX20751/2",
+ .patch = patch_conexant_auto },
+ { .id = 0x14f15110, .name = "CX20751/2",
+ .patch = patch_conexant_auto },
+ { .id = 0x14f15111, .name = "CX20753/4",
+ .patch = patch_conexant_auto },
{} /* terminator */
};
-MODULE_ALIAS("snd-hda-codec-id:14f11510");
-MODULE_ALIAS("snd-hda-codec-id:14f11511");
MODULE_ALIAS("snd-hda-codec-id:14f15045");
MODULE_ALIAS("snd-hda-codec-id:14f15047");
MODULE_ALIAS("snd-hda-codec-id:14f15051");
@@ -4632,6 +4632,9 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab"
MODULE_ALIAS("snd-hda-codec-id:14f150ac");
MODULE_ALIAS("snd-hda-codec-id:14f150b8");
MODULE_ALIAS("snd-hda-codec-id:14f150b9");
+MODULE_ALIAS("snd-hda-codec-id:14f1510f");
+MODULE_ALIAS("snd-hda-codec-id:14f15110");
+MODULE_ALIAS("snd-hda-codec-id:14f15111");
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Conexant HD-audio codec");
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 127/214] ALSA: hda - Add Conexant CX20755/20756/20757 codec IDs
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (125 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 126/214] ALSA: hda/conexant - Correct vendor IDs for new codecs Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 128/214] ALSA: hda - Add support for CX20952 Greg Kroah-Hartman
` (89 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 42c364ace52ae6b4699105b39f2559c256b6cd4c upstream.
These are just compatible with other CX2075x codecs.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_conexant.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -4612,6 +4612,12 @@ static const struct hda_codec_preset snd
.patch = patch_conexant_auto },
{ .id = 0x14f15111, .name = "CX20753/4",
.patch = patch_conexant_auto },
+ { .id = 0x14f15113, .name = "CX20755",
+ .patch = patch_conexant_auto },
+ { .id = 0x14f15114, .name = "CX20756",
+ .patch = patch_conexant_auto },
+ { .id = 0x14f15115, .name = "CX20757",
+ .patch = patch_conexant_auto },
{} /* terminator */
};
@@ -4635,6 +4641,9 @@ MODULE_ALIAS("snd-hda-codec-id:14f150b9"
MODULE_ALIAS("snd-hda-codec-id:14f1510f");
MODULE_ALIAS("snd-hda-codec-id:14f15110");
MODULE_ALIAS("snd-hda-codec-id:14f15111");
+MODULE_ALIAS("snd-hda-codec-id:14f15113");
+MODULE_ALIAS("snd-hda-codec-id:14f15114");
+MODULE_ALIAS("snd-hda-codec-id:14f15115");
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Conexant HD-audio codec");
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 128/214] ALSA: hda - Add support for CX20952
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (126 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 127/214] ALSA: hda - Add Conexant CX20755/20756/20757 codec IDs Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 129/214] tty: serial: imx: dont reinit clock in imx_setup_ufcr() Greg Kroah-Hartman
` (88 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 8f42d7698751a45cd9f7134a5da49bc5b6206179 upstream.
It's a superset of the existing CX2075x codecs, so we can reuse the
existing parser code.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_conexant.c | 3 +++
1 file changed, 3 insertions(+)
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -4618,6 +4618,8 @@ static const struct hda_codec_preset snd
.patch = patch_conexant_auto },
{ .id = 0x14f15115, .name = "CX20757",
.patch = patch_conexant_auto },
+ { .id = 0x14f151d7, .name = "CX20952",
+ .patch = patch_conexant_auto },
{} /* terminator */
};
@@ -4644,6 +4646,7 @@ MODULE_ALIAS("snd-hda-codec-id:14f15111"
MODULE_ALIAS("snd-hda-codec-id:14f15113");
MODULE_ALIAS("snd-hda-codec-id:14f15114");
MODULE_ALIAS("snd-hda-codec-id:14f15115");
+MODULE_ALIAS("snd-hda-codec-id:14f151d7");
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Conexant HD-audio codec");
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 129/214] tty: serial: imx: dont reinit clock in imx_setup_ufcr()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (127 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 128/214] ALSA: hda - Add support for CX20952 Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 130/214] x86, build, icc: Remove uninitialized_var() from compiler-intel.h Greg Kroah-Hartman
` (87 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dirk Behme, Shawn Guo, Sascha Hauer,
Troy Kisky, Xinyu Chen, Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dirk Behme <dirk.behme@de.bosch.com>
commit 7be0670f7b9198382938a03ff3db7f47ef6b4780 upstream.
Remove the clock configuration from imx_setup_ufcr(). This
isn't needed here and will cause garbage output if done.
To be be sure that we only touch the bits we want (TXTL and RXTL)
we have to mask out all other bits of the UFCR register. Add
one non-existing bit macro for this, too (bit 6, DCEDTE on i.MX6).
Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
CC: Shawn Guo <shawn.guo@linaro.org>
CC: Sascha Hauer <s.hauer@pengutronix.de>
CC: Troy Kisky <troy.kisky@boundarydevices.com>
CC: Xinyu Chen <xinyu.chen@freescale.com>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: deleted code in imx_setup_ufcr() refers to
sport->clk not sport->clk_per]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/imx.c | 18 ++++--------------
1 file changed, 4 insertions(+), 14 deletions(-)
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -131,6 +131,7 @@
#define UCR4_OREN (1<<1) /* Receiver overrun interrupt enable */
#define UCR4_DREN (1<<0) /* Recv data ready interrupt enable */
#define UFCR_RXTL_SHF 0 /* Receiver trigger level shift */
+#define UFCR_DCEDTE (1<<6) /* DCE/DTE mode select */
#define UFCR_RFDIV (7<<7) /* Reference freq divider mask */
#define UFCR_RFDIV_REG(x) (((x) < 7 ? 6 - (x) : 6) << 7)
#define UFCR_TXTL_SHF 10 /* Transmitter trigger level shift */
@@ -666,22 +667,11 @@ static void imx_break_ctl(struct uart_po
static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
{
unsigned int val;
- unsigned int ufcr_rfdiv;
-
- /* set receiver / transmitter trigger level.
- * RFDIV is set such way to satisfy requested uartclk value
- */
- val = TXTL << 10 | RXTL;
- ufcr_rfdiv = (clk_get_rate(sport->clk) + sport->port.uartclk / 2)
- / sport->port.uartclk;
-
- if(!ufcr_rfdiv)
- ufcr_rfdiv = 1;
-
- val |= UFCR_RFDIV_REG(ufcr_rfdiv);
+ /* set receiver / transmitter trigger level */
+ val = readl(sport->port.membase + UFCR) & (UFCR_RFDIV | UFCR_DCEDTE);
+ val |= TXTL << UFCR_TXTL_SHF | RXTL;
writel(val, sport->port.membase + UFCR);
-
return 0;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 130/214] x86, build, icc: Remove uninitialized_var() from compiler-intel.h
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (128 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 129/214] tty: serial: imx: dont reinit clock in imx_setup_ufcr() Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 131/214] x86, build: Pass in additional -mno-mmx, -mno-sse options Greg Kroah-Hartman
` (86 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sunil K. Pandey, Kevin B. Smith,
H. Peter Anvin, Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "H. Peter Anvin" <hpa@linux.intel.com>
commit 503cf95c061a0551eb684da364509297efbe55d9 upstream.
When compiling with icc, <linux/compiler-gcc.h> ends up included
because the icc environment defines __GNUC__. Thus, we neither need
nor want to have this macro defined in both compiler-gcc.h and
compiler-intel.h, and the fact that they are inconsistent just makes
the compiler spew warnings.
Reported-by: Sunil K. Pandey <sunil.k.pandey@intel.com>
Cc: Kevin B. Smith <kevin.b.smith@intel.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/n/tip-0mbwou1zt7pafij09b897lg3@git.kernel.org
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/compiler-intel.h | 2 --
1 file changed, 2 deletions(-)
--- a/include/linux/compiler-intel.h
+++ b/include/linux/compiler-intel.h
@@ -27,5 +27,3 @@
#define __must_be_array(a) 0
#endif
-
-#define uninitialized_var(x) x
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 131/214] x86, build: Pass in additional -mno-mmx, -mno-sse options
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (129 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 130/214] x86, build, icc: Remove uninitialized_var() from compiler-intel.h Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 132/214] x86/apic: Disable I/O APIC before shutdown of the local APIC Greg Kroah-Hartman
` (85 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kevin B. Smith, Sunil K. Pandey,
H. Peter Anvin, H. J. Lu, Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "H. Peter Anvin" <hpa@linux.intel.com>
commit 8b3b005d675726e38bc504d2e35a991e55819155 upstream.
In checkin
5551a34e5aea x86-64, build: Always pass in -mno-sse
we unconditionally added -mno-sse to the main build, to keep newer
compilers from generating SSE instructions from autovectorization.
However, this did not extend to the special environments
(arch/x86/boot, arch/x86/boot/compressed, and arch/x86/realmode/rm).
Add -mno-sse to the compiler command line for these environments, and
add -mno-mmx to all the environments as well, as we don't want a
compiler to generate MMX code either.
This patch also removes a $(cc-option) call for -m32, since we have
long since stopped supporting compilers too old for the -m32 option,
and in fact hardcode it in other places in the Makefiles.
Reported-by: Kevin B. Smith <kevin.b.smith@intel.com>
Cc: Sunil K. Pandey <sunil.k.pandey@intel.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: H. J. Lu <hjl.tools@gmail.com>
Link: http://lkml.kernel.org/n/tip-j21wzqv790q834n7yc6g80j1@git.kernel.org
[bwh: Backported to 3.2:
- Drop changes to arch/x86/Makefile, which sets these flags earlier
- Adjust context
- Drop changes to arch/x86/realmode/rm/Makefile which doesn't exist]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/boot/Makefile | 6 +++---
arch/x86/boot/compressed/Makefile | 1 +
2 files changed, 4 insertions(+), 3 deletions(-)
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -52,18 +52,18 @@ $(obj)/cpustr.h: $(obj)/mkcpustr FORCE
# How to compile the 16-bit code. Note we always compile for -march=i386,
# that way we can complain to the user if the CPU is insufficient.
-KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D__KERNEL__ \
+KBUILD_CFLAGS := $(LINUXINCLUDE) -m32 -g -Os -D_SETUP -D__KERNEL__ \
-DDISABLE_BRANCH_PROFILING \
-Wall -Wstrict-prototypes \
-march=i386 -mregparm=3 \
-include $(srctree)/$(src)/code16gcc.h \
-fno-strict-aliasing -fomit-frame-pointer \
+ -mno-mmx -mno-sse \
$(call cc-option, -ffreestanding) \
$(call cc-option, -fno-toplevel-reorder,\
- $(call cc-option, -fno-unit-at-a-time)) \
+ $(call cc-option, -fno-unit-at-a-time)) \
$(call cc-option, -fno-stack-protector) \
$(call cc-option, -mpreferred-stack-boundary=2)
-KBUILD_CFLAGS += $(call cc-option, -m32)
KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
GCOV_PROFILE := n
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -12,6 +12,7 @@ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFIL
cflags-$(CONFIG_X86_32) := -march=i386
cflags-$(CONFIG_X86_64) := -mcmodel=small
KBUILD_CFLAGS += $(cflags-y)
+KBUILD_CFLAGS += -mno-mmx -mno-sse
KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 132/214] x86/apic: Disable I/O APIC before shutdown of the local APIC
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (130 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 131/214] x86, build: Pass in additional -mno-mmx, -mno-sse options Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 133/214] x86: fix build error and kconfig for ia32_emulation and binfmt Greg Kroah-Hartman
` (84 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fenghua Yu, Ingo Molnar,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fenghua Yu <fenghua.yu@intel.com>
commit 522e66464467543c0d88d023336eec4df03ad40b upstream.
In reboot and crash path, when we shut down the local APIC, the I/O APIC is
still active. This may cause issues because external interrupts
can still come in and disturb the local APIC during shutdown process.
To quiet external interrupts, disable I/O APIC before shutdown local APIC.
Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
Link: http://lkml.kernel.org/r/1382578212-4677-1-git-send-email-fenghua.yu@intel.com
[ I suppose the 'issue' is a hang during shutdown. It's a fine change nevertheless. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/crash.c | 2 +-
arch/x86/kernel/reboot.c | 11 +++++++----
2 files changed, 8 insertions(+), 5 deletions(-)
--- a/arch/x86/kernel/crash.c
+++ b/arch/x86/kernel/crash.c
@@ -95,10 +95,10 @@ void native_machine_crash_shutdown(struc
cpu_emergency_vmxoff();
cpu_emergency_svm_disable();
- lapic_shutdown();
#if defined(CONFIG_X86_IO_APIC)
disable_IO_APIC();
#endif
+ lapic_shutdown();
#ifdef CONFIG_HPET_TIMER
hpet_disable();
#endif
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -668,6 +668,13 @@ void native_machine_shutdown(void)
/* The boot cpu is always logical cpu 0 */
int reboot_cpu_id = 0;
+#endif
+
+#ifdef CONFIG_X86_IO_APIC
+ disable_IO_APIC();
+#endif
+
+#ifdef CONFIG_SMP
#ifdef CONFIG_X86_32
/* See if there has been given a command line override */
@@ -691,10 +698,6 @@ void native_machine_shutdown(void)
lapic_shutdown();
-#ifdef CONFIG_X86_IO_APIC
- disable_IO_APIC();
-#endif
-
#ifdef CONFIG_HPET_TIMER
hpet_disable();
#endif
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 133/214] x86: fix build error and kconfig for ia32_emulation and binfmt
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (131 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 132/214] x86/apic: Disable I/O APIC before shutdown of the local APIC Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 134/214] n_gsm : Flow control handling in Mux driver Greg Kroah-Hartman
` (83 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, H. Peter Anvin,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
commit d1603990ea626668c78527376d9ec084d634202d upstream.
Fix kconfig warning and build errors on x86_64 by selecting BINFMT_ELF
when COMPAT_BINFMT_ELF is being selected.
warning: (IA32_EMULATION) selects COMPAT_BINFMT_ELF which has unmet direct dependencies (COMPAT && BINFMT_ELF)
fs/built-in.o: In function `elf_core_dump':
compat_binfmt_elf.c:(.text+0x3e093): undefined reference to `elf_core_extra_phdrs'
compat_binfmt_elf.c:(.text+0x3ebcd): undefined reference to `elf_core_extra_data_size'
compat_binfmt_elf.c:(.text+0x3eddd): undefined reference to `elf_core_write_extra_phdrs'
compat_binfmt_elf.c:(.text+0x3f004): undefined reference to `elf_core_write_extra_data'
[ hpa: This was sent to me for -next but it is a low risk build fix ]
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: http://lkml.kernel.org/r/51C0B614.5000708@infradead.org
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2157,6 +2157,7 @@ source "fs/Kconfig.binfmt"
config IA32_EMULATION
bool "IA32 Emulation"
depends on X86_64
+ select BINFMT_ELF
select COMPAT_BINFMT_ELF
---help---
Include code to run legacy 32-bit programs under a
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 134/214] n_gsm : Flow control handling in Mux driver
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (132 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 133/214] x86: fix build error and kconfig for ia32_emulation and binfmt Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 135/214] char: n_gsm: remove message filtering for contipated DLCI Greg Kroah-Hartman
` (82 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Frederic Berat, Russ Gorby, Alan Cox,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Berat <fredericx.berat@intel.com>
commit c01af4fec2c8f303d6b3354d44308d9e6bef8026 upstream.
- Correcting handling of FCon/FCoff in order to respect 27.010 spec
- Consider FCon/off will overide all dlci flow control except for
dlci0 as we must be able to send control frames.
- Dlci constipated handling according to FC, RTC and RTR values.
- Modifying gsm_dlci_data_kick and gsm_dlci_data_sweep according
to dlci constipated value
Signed-off-by: Frederic Berat <fredericx.berat@intel.com>
Signed-off-by: Russ Gorby <russ.gorby@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/n_gsm.c | 79 +++++++++++++++++++++++++++++++++++++---------------
1 file changed, 57 insertions(+), 22 deletions(-)
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -673,6 +673,8 @@ static struct gsm_msg *gsm_data_alloc(st
*
* The tty device has called us to indicate that room has appeared in
* the transmit queue. Ram more data into the pipe if we have any
+ * If we have been flow-stopped by a CMD_FCOFF, then we can only
+ * send messages on DLCI0 until CMD_FCON
*
* FIXME: lock against link layer control transmissions
*/
@@ -680,15 +682,19 @@ static struct gsm_msg *gsm_data_alloc(st
static void gsm_data_kick(struct gsm_mux *gsm)
{
struct gsm_msg *msg = gsm->tx_head;
+ struct gsm_msg *free_msg;
int len;
int skip_sof = 0;
- /* FIXME: We need to apply this solely to data messages */
- if (gsm->constipated)
- return;
-
- while (gsm->tx_head != NULL) {
- msg = gsm->tx_head;
+ while (msg) {
+ if (gsm->constipated && msg->addr) {
+ msg = msg->next;
+ continue;
+ }
+ if (gsm->dlci[msg->addr]->constipated) {
+ msg = msg->next;
+ continue;
+ }
if (gsm->encoding != 0) {
gsm->txframe[0] = GSM1_SOF;
len = gsm_stuff_frame(msg->data,
@@ -711,15 +717,19 @@ static void gsm_data_kick(struct gsm_mux
len - skip_sof) < 0)
break;
/* FIXME: Can eliminate one SOF in many more cases */
- gsm->tx_head = msg->next;
- if (gsm->tx_head == NULL)
- gsm->tx_tail = NULL;
gsm->tx_bytes -= msg->len;
- kfree(msg);
/* For a burst of frames skip the extra SOF within the
burst */
skip_sof = 1;
+
+ if (gsm->tx_head == msg)
+ gsm->tx_head = msg->next;
+ free_msg = msg;
+ msg = msg->next;
+ kfree(free_msg);
}
+ if (!gsm->tx_head)
+ gsm->tx_tail = NULL;
}
/**
@@ -738,6 +748,8 @@ static void __gsm_data_queue(struct gsm_
u8 *dp = msg->data;
u8 *fcs = dp + msg->len;
+ WARN_ONCE(dlci->constipated, "%s: queueing from a constipated DLCI",
+ __func__);
/* Fill in the header */
if (gsm->encoding == 0) {
if (msg->len < 128)
@@ -947,6 +959,9 @@ static void gsm_dlci_data_sweep(struct g
break;
dlci = gsm->dlci[i];
if (dlci == NULL || dlci->constipated) {
+ if (dlci && (debug & 0x20))
+ pr_info("%s: DLCI %d is constipated",
+ __func__, i);
i++;
continue;
}
@@ -976,6 +991,13 @@ static void gsm_dlci_data_kick(struct gs
unsigned long flags;
int sweep;
+ if (dlci->constipated) {
+ if (debug & 0x20)
+ pr_info("%s: DLCI %d is constipated",
+ __func__, dlci->addr);
+ return;
+ }
+
spin_lock_irqsave(&dlci->gsm->tx_lock, flags);
/* If we have nothing running then we need to fire up */
sweep = (dlci->gsm->tx_bytes < TX_THRESH_LO);
@@ -1033,6 +1055,7 @@ static void gsm_process_modem(struct tty
{
int mlines = 0;
u8 brk = 0;
+ int fc;
/* The modem status command can either contain one octet (v.24 signals)
or two octets (v.24 signals + break signals). The length field will
@@ -1044,19 +1067,27 @@ static void gsm_process_modem(struct tty
else {
brk = modem & 0x7f;
modem = (modem >> 7) & 0x7f;
- };
+ }
/* Flow control/ready to communicate */
- if (modem & MDM_FC) {
+ fc = (modem & MDM_FC) || !(modem & MDM_RTR);
+ if (fc && !dlci->constipated) {
+ if (debug & 0x20)
+ pr_info("%s: DLCI %d START constipated (tx_bytes=%d)",
+ __func__, dlci->addr, dlci->gsm->tx_bytes);
/* Need to throttle our output on this device */
dlci->constipated = 1;
- }
- if (modem & MDM_RTC) {
- mlines |= TIOCM_DSR | TIOCM_DTR;
+ } else if (!fc && dlci->constipated) {
+ if (debug & 0x20)
+ pr_info("%s: DLCI %d END constipated (tx_bytes=%d)",
+ __func__, dlci->addr, dlci->gsm->tx_bytes);
dlci->constipated = 0;
gsm_dlci_data_kick(dlci);
}
+
/* Map modem bits */
+ if (modem & MDM_RTC)
+ mlines |= TIOCM_DSR | TIOCM_DTR;
if (modem & MDM_RTR)
mlines |= TIOCM_RTS | TIOCM_CTS;
if (modem & MDM_IC)
@@ -1225,19 +1256,23 @@ static void gsm_control_message(struct g
gsm_control_reply(gsm, CMD_TEST, data, clen);
break;
case CMD_FCON:
- /* Modem wants us to STFU */
- gsm->constipated = 1;
- gsm_control_reply(gsm, CMD_FCON, NULL, 0);
- break;
- case CMD_FCOFF:
/* Modem can accept data again */
+ if (debug & 0x20)
+ pr_info("%s: GSM END constipation", __func__);
gsm->constipated = 0;
- gsm_control_reply(gsm, CMD_FCOFF, NULL, 0);
+ gsm_control_reply(gsm, CMD_FCON, NULL, 0);
/* Kick the link in case it is idling */
spin_lock_irqsave(&gsm->tx_lock, flags);
gsm_data_kick(gsm);
spin_unlock_irqrestore(&gsm->tx_lock, flags);
break;
+ case CMD_FCOFF:
+ /* Modem wants us to STFU */
+ if (debug & 0x20)
+ pr_info("%s: GSM START constipation", __func__);
+ gsm->constipated = 1;
+ gsm_control_reply(gsm, CMD_FCOFF, NULL, 0);
+ break;
case CMD_MSC:
/* Out of band modem line change indicator for a DLCI */
gsm_control_modem(gsm, data, clen);
@@ -2306,7 +2341,7 @@ static void gsmld_receive_buf(struct tty
gsm->error(gsm, *dp, flags);
break;
default:
- WARN_ONCE("%s: unknown flag %d\n",
+ WARN_ONCE(1, "%s: unknown flag %d\n",
tty_name(tty, buf), flags);
break;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 135/214] char: n_gsm: remove message filtering for contipated DLCI
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (133 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 134/214] n_gsm : Flow control handling in Mux driver Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 136/214] n_gsm: avoid accessing freed memory during CMD_FCOFF condition Greg Kroah-Hartman
` (81 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, samix.lebsir, Alan Cox,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "samix.lebsir" <samix.lebsir@intel.com>
commit 10c6c383e43565c9c6ec07ff8eb2825f8091bdf0 upstream.
The design of uplink flow control in the mux driver is
that for constipated channels data will backup into the
per-channel fifos, and any messages that make it to the
outbound message queue will still go out.
Code was added to also stop messages that were in the outbound
queue but this requires filtering through all the messages on the
queue for stopped dlcis and changes some of the mux logic unneccessarily.
The message fiiltering was removed to be in line w/ the original design
as the message filtering does not provide any solution.
Extra debug messages used during investigation were also removed.
Signed-off-by: samix.lebsir <samix.lebsir@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/n_gsm.c | 25 +------------------------
1 file changed, 1 insertion(+), 24 deletions(-)
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -691,10 +691,6 @@ static void gsm_data_kick(struct gsm_mux
msg = msg->next;
continue;
}
- if (gsm->dlci[msg->addr]->constipated) {
- msg = msg->next;
- continue;
- }
if (gsm->encoding != 0) {
gsm->txframe[0] = GSM1_SOF;
len = gsm_stuff_frame(msg->data,
@@ -748,8 +744,6 @@ static void __gsm_data_queue(struct gsm_
u8 *dp = msg->data;
u8 *fcs = dp + msg->len;
- WARN_ONCE(dlci->constipated, "%s: queueing from a constipated DLCI",
- __func__);
/* Fill in the header */
if (gsm->encoding == 0) {
if (msg->len < 128)
@@ -959,9 +953,6 @@ static void gsm_dlci_data_sweep(struct g
break;
dlci = gsm->dlci[i];
if (dlci == NULL || dlci->constipated) {
- if (dlci && (debug & 0x20))
- pr_info("%s: DLCI %d is constipated",
- __func__, i);
i++;
continue;
}
@@ -991,12 +982,8 @@ static void gsm_dlci_data_kick(struct gs
unsigned long flags;
int sweep;
- if (dlci->constipated) {
- if (debug & 0x20)
- pr_info("%s: DLCI %d is constipated",
- __func__, dlci->addr);
+ if (dlci->constipated)
return;
- }
spin_lock_irqsave(&dlci->gsm->tx_lock, flags);
/* If we have nothing running then we need to fire up */
@@ -1072,15 +1059,9 @@ static void gsm_process_modem(struct tty
/* Flow control/ready to communicate */
fc = (modem & MDM_FC) || !(modem & MDM_RTR);
if (fc && !dlci->constipated) {
- if (debug & 0x20)
- pr_info("%s: DLCI %d START constipated (tx_bytes=%d)",
- __func__, dlci->addr, dlci->gsm->tx_bytes);
/* Need to throttle our output on this device */
dlci->constipated = 1;
} else if (!fc && dlci->constipated) {
- if (debug & 0x20)
- pr_info("%s: DLCI %d END constipated (tx_bytes=%d)",
- __func__, dlci->addr, dlci->gsm->tx_bytes);
dlci->constipated = 0;
gsm_dlci_data_kick(dlci);
}
@@ -1257,8 +1238,6 @@ static void gsm_control_message(struct g
break;
case CMD_FCON:
/* Modem can accept data again */
- if (debug & 0x20)
- pr_info("%s: GSM END constipation", __func__);
gsm->constipated = 0;
gsm_control_reply(gsm, CMD_FCON, NULL, 0);
/* Kick the link in case it is idling */
@@ -1268,8 +1247,6 @@ static void gsm_control_message(struct g
break;
case CMD_FCOFF:
/* Modem wants us to STFU */
- if (debug & 0x20)
- pr_info("%s: GSM START constipation", __func__);
gsm->constipated = 1;
gsm_control_reply(gsm, CMD_FCOFF, NULL, 0);
break;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 136/214] n_gsm: avoid accessing freed memory during CMD_FCOFF condition
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (134 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 135/214] char: n_gsm: remove message filtering for contipated DLCI Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 137/214] n_gsm: replace kfree_skb w/ appropriate dev_* versions Greg Kroah-Hartman
` (80 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Russ Gorby, Yin, Fengwei, Alan Cox,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russ Gorby <russ.gorby@intel.com>
commit b4338e1efc339986cf6c0a3652906e914a86e2d3 upstream.
gsm_data_kick was recently modified to allow messages on the
tx queue bound for DLCI0 to flow even during FCOFF conditions.
Unfortunately we introduced a bug discovered by code inspection
where subsequent list traversers can access freed memory if
the DLCI0 messages were not all at the head of the list.
Replaced singly linked tx list w/ a list_head and used
provided interfaces for traversing and deleting members.
Signed-off-by: Russ Gorby <russ.gorby@intel.com>
Tested-by: Yin, Fengwei <fengwei.yin@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/n_gsm.c | 40 +++++++++++++---------------------------
1 file changed, 13 insertions(+), 27 deletions(-)
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -108,7 +108,7 @@ struct gsm_mux_net {
*/
struct gsm_msg {
- struct gsm_msg *next;
+ struct list_head list;
u8 addr; /* DLCI address + flags */
u8 ctrl; /* Control byte + flags */
unsigned int len; /* Length of data block (can be zero) */
@@ -245,8 +245,7 @@ struct gsm_mux {
unsigned int tx_bytes; /* TX data outstanding */
#define TX_THRESH_HI 8192
#define TX_THRESH_LO 2048
- struct gsm_msg *tx_head; /* Pending data packets */
- struct gsm_msg *tx_tail;
+ struct list_head tx_list; /* Pending data packets */
/* Control messages */
struct timer_list t2_timer; /* Retransmit timer for commands */
@@ -663,7 +662,7 @@ static struct gsm_msg *gsm_data_alloc(st
m->len = len;
m->addr = addr;
m->ctrl = ctrl;
- m->next = NULL;
+ INIT_LIST_HEAD(&m->list);
return m;
}
@@ -681,16 +680,13 @@ static struct gsm_msg *gsm_data_alloc(st
static void gsm_data_kick(struct gsm_mux *gsm)
{
- struct gsm_msg *msg = gsm->tx_head;
- struct gsm_msg *free_msg;
+ struct gsm_msg *msg, *nmsg;
int len;
int skip_sof = 0;
- while (msg) {
- if (gsm->constipated && msg->addr) {
- msg = msg->next;
+ list_for_each_entry_safe(msg, nmsg, &gsm->tx_list, list) {
+ if (gsm->constipated && msg->addr)
continue;
- }
if (gsm->encoding != 0) {
gsm->txframe[0] = GSM1_SOF;
len = gsm_stuff_frame(msg->data,
@@ -718,14 +714,9 @@ static void gsm_data_kick(struct gsm_mux
burst */
skip_sof = 1;
- if (gsm->tx_head == msg)
- gsm->tx_head = msg->next;
- free_msg = msg;
- msg = msg->next;
- kfree(free_msg);
+ list_del(&msg->list);
+ kfree(msg);
}
- if (!gsm->tx_head)
- gsm->tx_tail = NULL;
}
/**
@@ -774,11 +765,7 @@ static void __gsm_data_queue(struct gsm_
msg->data = dp;
/* Add to the actual output queue */
- if (gsm->tx_tail)
- gsm->tx_tail->next = msg;
- else
- gsm->tx_head = msg;
- gsm->tx_tail = msg;
+ list_add_tail(&msg->list, &gsm->tx_list);
gsm->tx_bytes += msg->len;
gsm_data_kick(gsm);
}
@@ -2052,7 +2039,7 @@ void gsm_cleanup_mux(struct gsm_mux *gsm
{
int i;
struct gsm_dlci *dlci = gsm->dlci[0];
- struct gsm_msg *txq;
+ struct gsm_msg *txq, *utxq;
struct gsm_control *gc;
gsm->dead = 1;
@@ -2087,11 +2074,9 @@ void gsm_cleanup_mux(struct gsm_mux *gsm
if (gsm->dlci[i])
gsm_dlci_release(gsm->dlci[i]);
/* Now wipe the queues */
- for (txq = gsm->tx_head; txq != NULL; txq = gsm->tx_head) {
- gsm->tx_head = txq->next;
+ list_for_each_entry_safe(txq, ntxq, &gsm->tx_list, list)
kfree(txq);
- }
- gsm->tx_tail = NULL;
+ INIT_LIST_HEAD(&gsm->tx_list);
}
EXPORT_SYMBOL_GPL(gsm_cleanup_mux);
@@ -2202,6 +2187,7 @@ struct gsm_mux *gsm_alloc_mux(void)
}
spin_lock_init(&gsm->lock);
kref_init(&gsm->ref);
+ INIT_LIST_HEAD(&gsm->tx_list);
gsm->t1 = T1;
gsm->t2 = T2;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 137/214] n_gsm: replace kfree_skb w/ appropriate dev_* versions
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (135 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 136/214] n_gsm: avoid accessing freed memory during CMD_FCOFF condition Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 138/214] x86 get_unmapped_area: Access mmap_legacy_base through mm_struct member Greg Kroah-Hartman
` (79 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Russ Gorby, Yin, Fengwei, Alan Cox,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russ Gorby <russ.gorby@intel.com>
commit 329e56780e514a7ab607bcb51a52ab0dc2669414 upstream.
Drivers are supposed to use the dev_* versions of the kfree_skb
interfaces. In a couple of cases we were called with IRQs
disabled as well which kfree_skb() does not expect.
Replaced kfree_skb calls w/ dev_kfree_skb and dev_kfree_skb_any
Signed-off-by: Russ Gorby <russ.gorby@intel.com>
Tested-by: Yin, Fengwei <fengwei.yin@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/n_gsm.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -879,7 +879,7 @@ static int gsm_dlci_data_output_framed(s
if (len > gsm->mtu) {
if (dlci->adaption == 3) {
/* Over long frame, bin it */
- kfree_skb(dlci->skb);
+ dev_kfree_skb_any(dlci->skb);
dlci->skb = NULL;
return 0;
}
@@ -908,7 +908,7 @@ static int gsm_dlci_data_output_framed(s
skb_pull(dlci->skb, len);
__gsm_data_queue(dlci, msg);
if (last) {
- kfree_skb(dlci->skb);
+ dev_kfree_skb_any(dlci->skb);
dlci->skb = NULL;
}
return size;
@@ -1688,7 +1688,7 @@ static void gsm_dlci_free(struct kref *r
dlci->gsm->dlci[dlci->addr] = NULL;
kfifo_free(dlci->fifo);
while ((dlci->skb = skb_dequeue(&dlci->skb_list)))
- kfree_skb(dlci->skb);
+ dev_kfree_skb(dlci->skb);
kfree(dlci);
}
@@ -2039,7 +2039,7 @@ void gsm_cleanup_mux(struct gsm_mux *gsm
{
int i;
struct gsm_dlci *dlci = gsm->dlci[0];
- struct gsm_msg *txq, *utxq;
+ struct gsm_msg *txq, *ntxq;
struct gsm_control *gc;
gsm->dead = 1;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 138/214] x86 get_unmapped_area: Access mmap_legacy_base through mm_struct member
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (136 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 137/214] n_gsm: replace kfree_skb w/ appropriate dev_* versions Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 139/214] ptrace/x86: Introduce set_task_blockstep() helper Greg Kroah-Hartman
` (78 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Radu Caragea, Andrew Morton,
Michel Lespinasse, Oleg Nesterov, Rik van Riel, Ingo Molnar,
Adrian Sendroiu, Greg KH, Kamal Mostafa, Linus Torvalds,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radu Caragea <sinaelgl@gmail.com>
commit 41aacc1eea645c99edbe8fbcf78a97dc9b862adc upstream.
This is the updated version of df54d6fa5427 ("x86 get_unmapped_area():
use proper mmap base for bottom-up direction") that only randomizes the
mmap base address once.
Signed-off-by: Radu Caragea <sinaelgl@gmail.com>
Reported-and-tested-by: Jeff Shorey <shoreyjeff@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Michel Lespinasse <walken@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Adrian Sendroiu <molecula2788@gmail.com>
Cc: Greg KH <greg@kroah.com>
Cc: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/sys_x86_64.c | 2 +-
arch/x86/mm/mmap.c | 6 ++++--
include/linux/mm_types.h | 1 +
3 files changed, 6 insertions(+), 3 deletions(-)
--- a/arch/x86/kernel/sys_x86_64.c
+++ b/arch/x86/kernel/sys_x86_64.c
@@ -115,7 +115,7 @@ static void find_start_end(unsigned long
*begin = new_begin;
}
} else {
- *begin = TASK_UNMAPPED_BASE;
+ *begin = current->mm->mmap_legacy_base;
*end = TASK_SIZE;
}
}
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -112,12 +112,14 @@ static unsigned long mmap_legacy_base(vo
*/
void arch_pick_mmap_layout(struct mm_struct *mm)
{
+ mm->mmap_legacy_base = mmap_legacy_base();
+ mm->mmap_base = mmap_base();
+
if (mmap_is_legacy()) {
- mm->mmap_base = mmap_legacy_base();
+ mm->mmap_base = mm->mmap_legacy_base;
mm->get_unmapped_area = arch_get_unmapped_area;
mm->unmap_area = arch_unmap_area;
} else {
- mm->mmap_base = mmap_base();
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
mm->unmap_area = arch_unmap_area_topdown;
}
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -306,6 +306,7 @@ struct mm_struct {
void (*unmap_area) (struct mm_struct *mm, unsigned long addr);
#endif
unsigned long mmap_base; /* base of mmap area */
+ unsigned long mmap_legacy_base; /* base of mmap area in bottom-up allocations */
unsigned long task_size; /* size of task vm space */
unsigned long cached_hole_size; /* if non-zero, the largest hole below free_area_cache */
unsigned long free_area_cache; /* first hole of size cached_hole_size or larger */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 139/214] ptrace/x86: Introduce set_task_blockstep() helper
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (137 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 138/214] x86 get_unmapped_area: Access mmap_legacy_base through mm_struct member Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 140/214] ptrace/x86: Partly fix set_task_blockstep()->update_debugctlmsr() logic Greg Kroah-Hartman
` (77 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleg Nesterov, Srikar Dronamraju,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit 848e8f5f0ad3169560c516fff6471be65f76e69f upstream.
No functional changes, preparation for the next fix and for uprobes
single-step fixes.
Move the code playing with TIF_BLOCKSTEP/DEBUGCTLMSR_BTF into the
new helper, set_task_blockstep().
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/step.c | 41 +++++++++++++++++++++--------------------
1 file changed, 21 insertions(+), 20 deletions(-)
--- a/arch/x86/kernel/step.c
+++ b/arch/x86/kernel/step.c
@@ -157,6 +157,21 @@ static int enable_single_step(struct tas
return 1;
}
+static void set_task_blockstep(struct task_struct *task, bool on)
+{
+ unsigned long debugctl;
+
+ debugctl = get_debugctlmsr();
+ if (on) {
+ debugctl |= DEBUGCTLMSR_BTF;
+ set_tsk_thread_flag(task, TIF_BLOCKSTEP);
+ } else {
+ debugctl &= ~DEBUGCTLMSR_BTF;
+ clear_tsk_thread_flag(task, TIF_BLOCKSTEP);
+ }
+ update_debugctlmsr(debugctl);
+}
+
/*
* Enable single or block step.
*/
@@ -169,19 +184,10 @@ static void enable_step(struct task_stru
* So no one should try to use debugger block stepping in a program
* that uses user-mode single stepping itself.
*/
- if (enable_single_step(child) && block) {
- unsigned long debugctl = get_debugctlmsr();
-
- debugctl |= DEBUGCTLMSR_BTF;
- update_debugctlmsr(debugctl);
- set_tsk_thread_flag(child, TIF_BLOCKSTEP);
- } else if (test_tsk_thread_flag(child, TIF_BLOCKSTEP)) {
- unsigned long debugctl = get_debugctlmsr();
-
- debugctl &= ~DEBUGCTLMSR_BTF;
- update_debugctlmsr(debugctl);
- clear_tsk_thread_flag(child, TIF_BLOCKSTEP);
- }
+ if (enable_single_step(child) && block)
+ set_task_blockstep(child, true);
+ else if (test_tsk_thread_flag(child, TIF_BLOCKSTEP))
+ set_task_blockstep(child, false);
}
void user_enable_single_step(struct task_struct *child)
@@ -199,13 +205,8 @@ void user_disable_single_step(struct tas
/*
* Make sure block stepping (BTF) is disabled.
*/
- if (test_tsk_thread_flag(child, TIF_BLOCKSTEP)) {
- unsigned long debugctl = get_debugctlmsr();
-
- debugctl &= ~DEBUGCTLMSR_BTF;
- update_debugctlmsr(debugctl);
- clear_tsk_thread_flag(child, TIF_BLOCKSTEP);
- }
+ if (test_tsk_thread_flag(child, TIF_BLOCKSTEP))
+ set_task_blockstep(child, false);
/* Always clear TIF_SINGLESTEP... */
clear_tsk_thread_flag(child, TIF_SINGLESTEP);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 140/214] ptrace/x86: Partly fix set_task_blockstep()->update_debugctlmsr() logic
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (138 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 139/214] ptrace/x86: Introduce set_task_blockstep() helper Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 141/214] x86/Sandy Bridge: mark arrays in __init functions as __initconst Greg Kroah-Hartman
` (76 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleg Nesterov, Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit 95cf00fa5d5e2a200a2c044c84bde8389a237e02 upstream.
Afaics the usage of update_debugctlmsr() and TIF_BLOCKSTEP in
step.c was always very wrong.
1. update_debugctlmsr() was simply unneeded. The child sleeps
TASK_TRACED, __switch_to_xtra(next_p => child) should notice
TIF_BLOCKSTEP and set/clear DEBUGCTLMSR_BTF after resume if
needed.
2. It is wrong. The state of DEBUGCTLMSR_BTF bit in CPU register
should always match the state of current's TIF_BLOCKSTEP bit.
3. Even get_debugctlmsr() + update_debugctlmsr() itself does not
look right. Irq can change other bits in MSR_IA32_DEBUGCTLMSR
register or the caller can be preempted in between.
4. It is not safe to play with TIF_BLOCKSTEP if task != current.
DEBUGCTLMSR_BTF and TIF_BLOCKSTEP should always match each
other if the task is running. The tracee is stopped but it
can be SIGKILL'ed right before set/clear_tsk_thread_flag().
However, now that uprobes uses user_enable_single_step(current)
we can't simply remove update_debugctlmsr(). So this patch adds
the additional "task == current" check and disables irqs to avoid
the race with interrupts/preemption.
Unfortunately this patch doesn't solve the last problem, we need
another fix. Probably we should teach ptrace_stop() to set/clear
single/block stepping after resume.
And afaics there is yet another problem: perf can play with
MSR_IA32_DEBUGCTLMSR from nmi, this obviously means that even
__switch_to_xtra() has problems.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/step.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/step.c
+++ b/arch/x86/kernel/step.c
@@ -161,6 +161,16 @@ static void set_task_blockstep(struct ta
{
unsigned long debugctl;
+ /*
+ * Ensure irq/preemption can't change debugctl in between.
+ * Note also that both TIF_BLOCKSTEP and debugctl should
+ * be changed atomically wrt preemption.
+ * FIXME: this means that set/clear TIF_BLOCKSTEP is simply
+ * wrong if task != current, SIGKILL can wakeup the stopped
+ * tracee and set/clear can play with the running task, this
+ * can confuse the next __switch_to_xtra().
+ */
+ local_irq_disable();
debugctl = get_debugctlmsr();
if (on) {
debugctl |= DEBUGCTLMSR_BTF;
@@ -169,7 +179,9 @@ static void set_task_blockstep(struct ta
debugctl &= ~DEBUGCTLMSR_BTF;
clear_tsk_thread_flag(task, TIF_BLOCKSTEP);
}
- update_debugctlmsr(debugctl);
+ if (task == current)
+ update_debugctlmsr(debugctl);
+ local_irq_enable();
}
/*
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 141/214] x86/Sandy Bridge: mark arrays in __init functions as __initconst
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (139 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 140/214] ptrace/x86: Partly fix set_task_blockstep()->update_debugctlmsr() logic Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 142/214] efi_pstore: Check remaining space with QueryVariableInfo() before writing data Greg Kroah-Hartman
` (75 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mathias Krause, H. Peter Anvin,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "H. Peter Anvin" <hpa@linux.intel.com>
commit 91c90db1aa92a50fa1d7f289502b49ddb46a90d3 upstream.
commit ab3cd8670e0b3fcde7f029e1503ed3c5138e9571 upstream.
Mark static arrays as __initconst so they get removed when the init
sections are flushed.
Reported-by: Mathias Krause <minipli@googlemail.com>
Link: http://lkml.kernel.org/r/75F4BEE6-CB0E-4426-B40B-697451677738@googlemail.com
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/setup.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -625,7 +625,7 @@ static bool __init snb_gfx_workaround_ne
#ifdef CONFIG_PCI
int i;
u16 vendor, devid;
- static const u16 snb_ids[] = {
+ static const __initconst u16 snb_ids[] = {
0x0102,
0x0112,
0x0122,
@@ -658,7 +658,7 @@ static bool __init snb_gfx_workaround_ne
*/
static void __init trim_snb_memory(void)
{
- static const unsigned long bad_pages[] = {
+ static const __initconst unsigned long bad_pages[] = {
0x20050000,
0x20110000,
0x20130000,
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 142/214] efi_pstore: Check remaining space with QueryVariableInfo() before writing data
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (140 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 141/214] x86/Sandy Bridge: mark arrays in __init functions as __initconst Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 143/214] efivars: Disable external interrupt while holding efivars->lock Greg Kroah-Hartman
` (74 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Seiji Aguchi, Mike Waychison,
Tony Luck, Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seiji Aguchi <seiji.aguchi@hds.com>
commit d80a361d779a9f19498943d1ca84243209cd5647 upstream.
[Issue]
As discussed in a thread below, Running out of space in EFI isn't a well-tested scenario.
And we wouldn't expect all firmware to handle it gracefully.
http://marc.info/?l=linux-kernel&m=134305325801789&w=2
On the other hand, current efi_pstore doesn't check a remaining space of storage at writing time.
Therefore, efi_pstore may not work if it tries to write a large amount of data.
[Patch Description]
To avoid handling the situation above, this patch checks if there is a space enough to log with
QueryVariableInfo() before writing data.
Signed-off-by: Seiji Aguchi <seiji.aguchi@hds.com>
Acked-by: Mike Waychison <mikew@google.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/efivars.c | 18 ++++++++++++++++++
include/linux/efi.h | 1 +
2 files changed, 19 insertions(+)
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -710,12 +710,29 @@ static int efi_pstore_write(enum pstore_
struct efivars *efivars = psi->data;
struct efivar_entry *entry, *found = NULL;
int i, ret = 0;
+ u64 storage_space, remaining_space, max_variable_size;
+ efi_status_t status = EFI_NOT_FOUND;
sprintf(stub_name, "dump-type%u-%u-", type, part);
sprintf(name, "%s%lu", stub_name, get_seconds());
spin_lock(&efivars->lock);
+ /*
+ * Check if there is a space enough to log.
+ * size: a size of logging data
+ * DUMP_NAME_LEN * 2: a maximum size of variable name
+ */
+ status = efivars->ops->query_variable_info(PSTORE_EFI_ATTRIBUTES,
+ &storage_space,
+ &remaining_space,
+ &max_variable_size);
+ if (status || remaining_space < size + DUMP_NAME_LEN * 2) {
+ spin_unlock(&efivars->lock);
+ *id = part;
+ return -ENOSPC;
+ }
+
for (i = 0; i < DUMP_NAME_LEN; i++)
efi_name[i] = stub_name[i];
@@ -1324,6 +1341,7 @@ efivars_init(void)
ops.get_variable = efi.get_variable;
ops.set_variable = efi.set_variable;
ops.get_next_variable = efi.get_next_variable;
+ ops.query_variable_info = efi.query_variable_info;
error = register_efivars(&__efivars, &ops, efi_kobj);
if (error)
goto err_put;
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -652,6 +652,7 @@ struct efivar_operations {
efi_get_variable_t *get_variable;
efi_get_next_variable_t *get_next_variable;
efi_set_variable_t *set_variable;
+ efi_query_variable_info_t *query_variable_info;
};
struct efivars {
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 143/214] efivars: Disable external interrupt while holding efivars->lock
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (141 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 142/214] efi_pstore: Check remaining space with QueryVariableInfo() before writing data Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 144/214] efi: be more paranoid about available space when creating variables Greg Kroah-Hartman
` (73 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Seiji Aguchi, Mike Waychison,
Matt Fleming, Tony Luck, Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Boyer <jwboyer@redhat.com>
commit 81fa4e581d9283f7992a0d8c534bb141eb840a14 upstream.
[Problem]
There is a scenario which efi_pstore fails to log messages in a panic case.
- CPUA holds an efi_var->lock in either efivarfs parts
or efi_pstore with interrupt enabled.
- CPUB panics and sends IPI to CPUA in smp_send_stop().
- CPUA stops with holding the lock.
- CPUB kicks efi_pstore_write() via kmsg_dump(KSMG_DUMP_PANIC)
but it returns without logging messages.
[Patch Description]
This patch disables an external interruption while holding efivars->lock
as follows.
In efi_pstore_write() and get_var_data(), spin_lock/spin_unlock is
replaced by spin_lock_irqsave/spin_unlock_irqrestore because they may
be called in an interrupt context.
In other functions, they are replaced by spin_lock_irq/spin_unlock_irq.
because they are all called from a process context.
By applying this patch, we can avoid the problem above with
a following senario.
- CPUA holds an efi_var->lock with interrupt disabled.
- CPUB panics and sends IPI to CPUA in smp_send_stop().
- CPUA receives the IPI after releasing the lock because it is
disabling interrupt while holding the lock.
- CPUB waits for one sec until CPUA releases the lock.
- CPUB kicks efi_pstore_write() via kmsg_dump(KSMG_DUMP_PANIC)
And it can hold the lock successfully.
Signed-off-by: Seiji Aguchi <seiji.aguchi@hds.com>
Acked-by: Mike Waychison <mikew@google.com>
Acked-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
[bwh: Backported to 3.2:
- Drop efivarfs changes
- Adjust context
- Drop change to efi_pstore_erase(), which is implemented using
efi_pstore_write() here]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/efivars.c | 44 +++++++++++++++++++++++---------------------
1 file changed, 23 insertions(+), 21 deletions(-)
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -396,10 +396,11 @@ static efi_status_t
get_var_data(struct efivars *efivars, struct efi_variable *var)
{
efi_status_t status;
+ unsigned long flags;
- spin_lock(&efivars->lock);
+ spin_lock_irqsave(&efivars->lock, flags);
status = get_var_data_locked(efivars, var);
- spin_unlock(&efivars->lock);
+ spin_unlock_irqrestore(&efivars->lock, flags);
if (status != EFI_SUCCESS) {
printk(KERN_WARNING "efivars: get_variable() failed 0x%lx!\n",
@@ -528,14 +529,14 @@ efivar_store_raw(struct efivar_entry *en
return -EINVAL;
}
- spin_lock(&efivars->lock);
+ spin_lock_irq(&efivars->lock);
status = efivars->ops->set_variable(new_var->VariableName,
&new_var->VendorGuid,
new_var->Attributes,
new_var->DataSize,
new_var->Data);
- spin_unlock(&efivars->lock);
+ spin_unlock_irq(&efivars->lock);
if (status != EFI_SUCCESS) {
printk(KERN_WARNING "efivars: set_variable() failed: status=%lx\n",
@@ -646,7 +647,7 @@ static int efi_pstore_open(struct pstore
{
struct efivars *efivars = psi->data;
- spin_lock(&efivars->lock);
+ spin_lock_irq(&efivars->lock);
efivars->walk_entry = list_first_entry(&efivars->list,
struct efivar_entry, list);
return 0;
@@ -656,7 +657,7 @@ static int efi_pstore_close(struct pstor
{
struct efivars *efivars = psi->data;
- spin_unlock(&efivars->lock);
+ spin_unlock_irq(&efivars->lock);
return 0;
}
@@ -712,11 +713,12 @@ static int efi_pstore_write(enum pstore_
int i, ret = 0;
u64 storage_space, remaining_space, max_variable_size;
efi_status_t status = EFI_NOT_FOUND;
+ unsigned long flags;
sprintf(stub_name, "dump-type%u-%u-", type, part);
sprintf(name, "%s%lu", stub_name, get_seconds());
- spin_lock(&efivars->lock);
+ spin_lock_irqsave(&efivars->lock, flags);
/*
* Check if there is a space enough to log.
@@ -728,7 +730,7 @@ static int efi_pstore_write(enum pstore_
&remaining_space,
&max_variable_size);
if (status || remaining_space < size + DUMP_NAME_LEN * 2) {
- spin_unlock(&efivars->lock);
+ spin_unlock_irqrestore(&efivars->lock, flags);
*id = part;
return -ENOSPC;
}
@@ -769,7 +771,7 @@ static int efi_pstore_write(enum pstore_
efivars->ops->set_variable(efi_name, &vendor, PSTORE_EFI_ATTRIBUTES,
size, psi->buf);
- spin_unlock(&efivars->lock);
+ spin_unlock_irqrestore(&efivars->lock, flags);
if (found)
efivar_unregister(found);
@@ -853,7 +855,7 @@ static ssize_t efivar_create(struct file
return -EINVAL;
}
- spin_lock(&efivars->lock);
+ spin_lock_irq(&efivars->lock);
/*
* Does this variable already exist?
@@ -871,7 +873,7 @@ static ssize_t efivar_create(struct file
}
}
if (found) {
- spin_unlock(&efivars->lock);
+ spin_unlock_irq(&efivars->lock);
return -EINVAL;
}
@@ -885,10 +887,10 @@ static ssize_t efivar_create(struct file
if (status != EFI_SUCCESS) {
printk(KERN_WARNING "efivars: set_variable() failed: status=%lx\n",
status);
- spin_unlock(&efivars->lock);
+ spin_unlock_irq(&efivars->lock);
return -EIO;
}
- spin_unlock(&efivars->lock);
+ spin_unlock_irq(&efivars->lock);
/* Create the entry in sysfs. Locking is not required here */
status = efivar_create_sysfs_entry(efivars,
@@ -916,7 +918,7 @@ static ssize_t efivar_delete(struct file
if (!capable(CAP_SYS_ADMIN))
return -EACCES;
- spin_lock(&efivars->lock);
+ spin_lock_irq(&efivars->lock);
/*
* Does this variable already exist?
@@ -934,7 +936,7 @@ static ssize_t efivar_delete(struct file
}
}
if (!found) {
- spin_unlock(&efivars->lock);
+ spin_unlock_irq(&efivars->lock);
return -EINVAL;
}
/* force the Attributes/DataSize to 0 to ensure deletion */
@@ -950,12 +952,12 @@ static ssize_t efivar_delete(struct file
if (status != EFI_SUCCESS) {
printk(KERN_WARNING "efivars: set_variable() failed: status=%lx\n",
status);
- spin_unlock(&efivars->lock);
+ spin_unlock_irq(&efivars->lock);
return -EIO;
}
list_del(&search_efivar->list);
/* We need to release this lock before unregistering. */
- spin_unlock(&efivars->lock);
+ spin_unlock_irq(&efivars->lock);
efivar_unregister(search_efivar);
/* It's dead Jim.... */
@@ -1110,9 +1112,9 @@ efivar_create_sysfs_entry(struct efivars
kfree(short_name);
short_name = NULL;
- spin_lock(&efivars->lock);
+ spin_lock_irq(&efivars->lock);
list_add(&new_efivar->list, &efivars->list);
- spin_unlock(&efivars->lock);
+ spin_unlock_irq(&efivars->lock);
return 0;
}
@@ -1181,9 +1183,9 @@ void unregister_efivars(struct efivars *
struct efivar_entry *entry, *n;
list_for_each_entry_safe(entry, n, &efivars->list, list) {
- spin_lock(&efivars->lock);
+ spin_lock_irq(&efivars->lock);
list_del(&entry->list);
- spin_unlock(&efivars->lock);
+ spin_unlock_irq(&efivars->lock);
efivar_unregister(entry);
}
if (efivars->new_var)
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 144/214] efi: be more paranoid about available space when creating variables
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (142 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 143/214] efivars: Disable external interrupt while holding efivars->lock Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 145/214] efivars: pstore: Do not check size when erasing variable Greg Kroah-Hartman
` (72 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Matthew Garrett, Matt Fleming,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Boyer <jwboyer@redhat.com>
commit 68d929862e29a8b52a7f2f2f86a0600423b093cd upstream.
UEFI variables are typically stored in flash. For various reasons, avaiable
space is typically not reclaimed immediately upon the deletion of a
variable - instead, the system will garbage collect during initialisation
after a reboot.
Some systems appear to handle this garbage collection extremely poorly,
failing if more than 50% of the system flash is in use. This can result in
the machine refusing to boot. The safest thing to do for the moment is to
forbid writes if they'd end up using more than half of the storage space.
We can make this more finegrained later if we come up with a method for
identifying the broken machines.
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
[bwh: Backported to 3.2:
- Drop efivarfs changes and unused check_var_size()
- Add error codes to include/linux/efi.h, added upstream by
commit 5d9db883761a ('efi: Add support for a UEFI variable filesystem')
- Add efi_status_to_err(), added upstream by commit 7253eaba7b17
('efivarfs: Return an error if we fail to read a variable')]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/efivars.c | 88 +++++++++++++++++++++++++++++++++++++++------
include/linux/efi.h | 5 ++
2 files changed, 82 insertions(+), 11 deletions(-)
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -409,6 +409,30 @@ get_var_data(struct efivars *efivars, st
return status;
}
+static efi_status_t
+check_var_size_locked(struct efivars *efivars, u32 attributes,
+ unsigned long size)
+{
+ u64 storage_size, remaining_size, max_size;
+ efi_status_t status;
+ const struct efivar_operations *fops = efivars->ops;
+
+ if (!efivars->ops->query_variable_info)
+ return EFI_UNSUPPORTED;
+
+ status = fops->query_variable_info(attributes, &storage_size,
+ &remaining_size, &max_size);
+
+ if (status != EFI_SUCCESS)
+ return status;
+
+ if (!storage_size || size > remaining_size || size > max_size ||
+ (remaining_size - size) < (storage_size / 2))
+ return EFI_OUT_OF_RESOURCES;
+
+ return status;
+}
+
static ssize_t
efivar_guid_read(struct efivar_entry *entry, char *buf)
{
@@ -530,11 +554,16 @@ efivar_store_raw(struct efivar_entry *en
}
spin_lock_irq(&efivars->lock);
- status = efivars->ops->set_variable(new_var->VariableName,
- &new_var->VendorGuid,
- new_var->Attributes,
- new_var->DataSize,
- new_var->Data);
+
+ status = check_var_size_locked(efivars, new_var->Attributes,
+ new_var->DataSize + utf16_strsize(new_var->VariableName, 1024));
+
+ if (status == EFI_SUCCESS || status == EFI_UNSUPPORTED)
+ status = efivars->ops->set_variable(new_var->VariableName,
+ &new_var->VendorGuid,
+ new_var->Attributes,
+ new_var->DataSize,
+ new_var->Data);
spin_unlock_irq(&efivars->lock);
@@ -641,6 +670,36 @@ efivar_unregister(struct efivar_entry *v
kobject_put(&var->kobj);
}
+static int efi_status_to_err(efi_status_t status)
+{
+ int err;
+
+ switch (status) {
+ case EFI_INVALID_PARAMETER:
+ err = -EINVAL;
+ break;
+ case EFI_OUT_OF_RESOURCES:
+ err = -ENOSPC;
+ break;
+ case EFI_DEVICE_ERROR:
+ err = -EIO;
+ break;
+ case EFI_WRITE_PROTECTED:
+ err = -EROFS;
+ break;
+ case EFI_SECURITY_VIOLATION:
+ err = -EACCES;
+ break;
+ case EFI_NOT_FOUND:
+ err = -ENOENT;
+ break;
+ default:
+ err = -EINVAL;
+ }
+
+ return err;
+}
+
#ifdef CONFIG_PSTORE
static int efi_pstore_open(struct pstore_info *psi)
@@ -711,7 +770,6 @@ static int efi_pstore_write(enum pstore_
struct efivars *efivars = psi->data;
struct efivar_entry *entry, *found = NULL;
int i, ret = 0;
- u64 storage_space, remaining_space, max_variable_size;
efi_status_t status = EFI_NOT_FOUND;
unsigned long flags;
@@ -725,11 +783,11 @@ static int efi_pstore_write(enum pstore_
* size: a size of logging data
* DUMP_NAME_LEN * 2: a maximum size of variable name
*/
- status = efivars->ops->query_variable_info(PSTORE_EFI_ATTRIBUTES,
- &storage_space,
- &remaining_space,
- &max_variable_size);
- if (status || remaining_space < size + DUMP_NAME_LEN * 2) {
+
+ status = check_var_size_locked(efivars, PSTORE_EFI_ATTRIBUTES,
+ size + DUMP_NAME_LEN * 2);
+
+ if (status) {
spin_unlock_irqrestore(&efivars->lock, flags);
*id = part;
return -ENOSPC;
@@ -877,6 +935,14 @@ static ssize_t efivar_create(struct file
return -EINVAL;
}
+ status = check_var_size_locked(efivars, new_var->Attributes,
+ new_var->DataSize + utf16_strsize(new_var->VariableName, 1024));
+
+ if (status && status != EFI_UNSUPPORTED) {
+ spin_unlock_irq(&efivars->lock);
+ return efi_status_to_err(status);
+ }
+
/* now *really* create the variable via EFI */
status = efivars->ops->set_variable(new_var->VariableName,
&new_var->VendorGuid,
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -29,7 +29,12 @@
#define EFI_UNSUPPORTED ( 3 | (1UL << (BITS_PER_LONG-1)))
#define EFI_BAD_BUFFER_SIZE ( 4 | (1UL << (BITS_PER_LONG-1)))
#define EFI_BUFFER_TOO_SMALL ( 5 | (1UL << (BITS_PER_LONG-1)))
+#define EFI_NOT_READY ( 6 | (1UL << (BITS_PER_LONG-1)))
+#define EFI_DEVICE_ERROR ( 7 | (1UL << (BITS_PER_LONG-1)))
+#define EFI_WRITE_PROTECTED ( 8 | (1UL << (BITS_PER_LONG-1)))
+#define EFI_OUT_OF_RESOURCES ( 9 | (1UL << (BITS_PER_LONG-1)))
#define EFI_NOT_FOUND (14 | (1UL << (BITS_PER_LONG-1)))
+#define EFI_SECURITY_VIOLATION (26 | (1UL << (BITS_PER_LONG-1)))
typedef unsigned long efi_status_t;
typedef u8 efi_bool_t;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 145/214] efivars: pstore: Do not check size when erasing variable
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (143 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 144/214] efi: be more paranoid about available space when creating variables Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 146/214] efivars: Allow disabling use as a pstore backend Greg Kroah-Hartman
` (71 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit 80a19debc2f2d398cfa57fae97bc99826748a602 upstream.
In 3.2, unlike mainline, efi_pstore_erase() calls efi_pstore_write()
with a size of 0, as the underlying EFI interface treats a size of 0
as meaning deletion.
This was not taken into account in my backport of commit d80a361d779a
'efi_pstore: Check remaining space with QueryVariableInfo() before
writing data'. The size check should be omitted when erasing.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/efivars.c | 24 +++++++++++++-----------
1 file changed, 13 insertions(+), 11 deletions(-)
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -778,19 +778,21 @@ static int efi_pstore_write(enum pstore_
spin_lock_irqsave(&efivars->lock, flags);
- /*
- * Check if there is a space enough to log.
- * size: a size of logging data
- * DUMP_NAME_LEN * 2: a maximum size of variable name
- */
+ if (size) {
+ /*
+ * Check if there is a space enough to log.
+ * size: a size of logging data
+ * DUMP_NAME_LEN * 2: a maximum size of variable name
+ */
- status = check_var_size_locked(efivars, PSTORE_EFI_ATTRIBUTES,
- size + DUMP_NAME_LEN * 2);
+ status = check_var_size_locked(efivars, PSTORE_EFI_ATTRIBUTES,
+ size + DUMP_NAME_LEN * 2);
- if (status) {
- spin_unlock_irqrestore(&efivars->lock, flags);
- *id = part;
- return -ENOSPC;
+ if (status) {
+ spin_unlock_irqrestore(&efivars->lock, flags);
+ *id = part;
+ return -ENOSPC;
+ }
}
for (i = 0; i < DUMP_NAME_LEN; i++)
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 146/214] efivars: Allow disabling use as a pstore backend
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (144 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 145/214] efivars: pstore: Do not check size when erasing variable Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 147/214] efivars: Add module parameter to disable " Greg Kroah-Hartman
` (70 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Seth Forshee, Josh Boyer,
Matthew Garrett, Seiji Aguchi, Tony Luck, Matt Fleming,
Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Forshee <seth.forshee@canonical.com>
commit ed9dc8ce7a1c8115dba9483a9b51df8b63a2e0ef upstream.
Add a new option, CONFIG_EFI_VARS_PSTORE, which can be set to N to
avoid using efivars as a backend to pstore, as some users may want to
compile out the code completely.
Set the default to Y to maintain backwards compatability, since this
feature has always been enabled until now.
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Cc: Josh Boyer <jwboyer@redhat.com>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>
Cc: Seiji Aguchi <seiji.aguchi@hds.com>
Cc: Tony Luck <tony.luck@intel.com>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
[xr: Backported to 3.4: adjust context]
Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/Kconfig | 9 ++++++
drivers/firmware/efivars.c | 63 ++++++++++++++-------------------------------
2 files changed, 29 insertions(+), 43 deletions(-)
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -53,6 +53,15 @@ config EFI_VARS
Subsequent efibootmgr releases may be found at:
<http://linux.dell.com/efibootmgr>
+config EFI_VARS_PSTORE
+ bool "Register efivars backend for pstore"
+ depends on EFI_VARS && PSTORE
+ default y
+ help
+ Say Y here to enable use efivars as a backend to pstore. This
+ will allow writing console messages, crash dumps, or anything
+ else supported by pstore to EFI variables.
+
config EFI_PCDP
bool "Console device selection via EFI PCDP or HCDP table"
depends on ACPI && EFI && IA64
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -662,8 +662,6 @@ static struct kobj_type efivar_ktype = {
.default_attrs = def_attrs,
};
-static struct pstore_info efi_pstore_info;
-
static inline void
efivar_unregister(struct efivar_entry *var)
{
@@ -700,7 +698,7 @@ static int efi_status_to_err(efi_status_
return err;
}
-#ifdef CONFIG_PSTORE
+#ifdef CONFIG_EFI_VARS_PSTORE
static int efi_pstore_open(struct pstore_info *psi)
{
@@ -853,37 +851,6 @@ static int efi_pstore_erase(enum pstore_
return 0;
}
-#else
-static int efi_pstore_open(struct pstore_info *psi)
-{
- return 0;
-}
-
-static int efi_pstore_close(struct pstore_info *psi)
-{
- return 0;
-}
-
-static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
- struct timespec *timespec,
- char **buf, struct pstore_info *psi)
-{
- return -1;
-}
-
-static int efi_pstore_write(enum pstore_type_id type,
- enum kmsg_dump_reason reason, u64 *id,
- unsigned int part, size_t size, struct pstore_info *psi)
-{
- return 0;
-}
-
-static int efi_pstore_erase(enum pstore_type_id type, u64 id,
- struct pstore_info *psi)
-{
- return 0;
-}
-#endif
static struct pstore_info efi_pstore_info = {
.owner = THIS_MODULE,
@@ -895,6 +862,24 @@ static struct pstore_info efi_pstore_inf
.erase = efi_pstore_erase,
};
+static void efivar_pstore_register(struct efivars *efivars)
+{
+ efivars->efi_pstore_info = efi_pstore_info;
+ efivars->efi_pstore_info.buf = kmalloc(4096, GFP_KERNEL);
+ if (efivars->efi_pstore_info.buf) {
+ efivars->efi_pstore_info.bufsize = 1024;
+ efivars->efi_pstore_info.data = efivars;
+ spin_lock_init(&efivars->efi_pstore_info.buf_lock);
+ pstore_register(&efivars->efi_pstore_info);
+ }
+}
+#else
+static void efivar_pstore_register(struct efivars *efivars)
+{
+ return;
+}
+#endif
+
static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
struct bin_attribute *bin_attr,
char *buf, loff_t pos, size_t count)
@@ -1365,15 +1350,7 @@ int register_efivars(struct efivars *efi
if (error)
unregister_efivars(efivars);
- efivars->efi_pstore_info = efi_pstore_info;
-
- efivars->efi_pstore_info.buf = kmalloc(4096, GFP_KERNEL);
- if (efivars->efi_pstore_info.buf) {
- efivars->efi_pstore_info.bufsize = 1024;
- efivars->efi_pstore_info.data = efivars;
- spin_lock_init(&efivars->efi_pstore_info.buf_lock);
- pstore_register(&efivars->efi_pstore_info);
- }
+ efivar_pstore_register(efivars);
out:
kfree(variable_name);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 147/214] efivars: Add module parameter to disable use as a pstore backend
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (145 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 146/214] efivars: Allow disabling use as a pstore backend Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 148/214] efivars: Fix check for CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE Greg Kroah-Hartman
` (69 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Seth Forshee, Josh Boyer,
Matthew Garrett, Seiji Aguchi, Tony Luck, Matt Fleming,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Forshee <seth.forshee@canonical.com>
commit ec0971ba5372a4dfa753f232449d23a8fd98490e upstream.
We know that with some firmware implementations writing too much data to
UEFI variables can lead to bricking machines. Recent changes attempt to
address this issue, but for some it may still be prudent to avoid
writing large amounts of data until the solution has been proven on a
wide variety of hardware.
Crash dumps or other data from pstore can potentially be a large data
source. Add a pstore_module parameter to efivars to allow disabling its
use as a backend for pstore. Also add a config option,
CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE, to allow setting the default
value of this paramter to true (i.e. disabled by default).
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Cc: Josh Boyer <jwboyer@redhat.com>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>
Cc: Seiji Aguchi <seiji.aguchi@hds.com>
Cc: Tony Luck <tony.luck@intel.com>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/Kconfig | 9 +++++++++
drivers/firmware/efivars.c | 8 +++++++-
2 files changed, 16 insertions(+), 1 deletion(-)
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -62,6 +62,15 @@ config EFI_VARS_PSTORE
will allow writing console messages, crash dumps, or anything
else supported by pstore to EFI variables.
+config EFI_VARS_PSTORE_DEFAULT_DISABLE
+ bool "Disable using efivars as a pstore backend by default"
+ depends on EFI_VARS_PSTORE
+ default n
+ help
+ Saying Y here will disable the use of efivars as a storage
+ backend for pstore by default. This setting can be overridden
+ using the efivars module's pstore_disable parameter.
+
config EFI_PCDP
bool "Console device selection via EFI PCDP or HCDP table"
depends on ACPI && EFI && IA64
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -92,6 +92,11 @@ MODULE_VERSION(EFIVARS_VERSION);
#define DUMP_NAME_LEN 52
+static bool efivars_pstore_disable =
+ IS_ENABLED(EFI_VARS_PSTORE_DEFAULT_DISABLE);
+
+module_param_named(pstore_disable, efivars_pstore_disable, bool, 0644);
+
/*
* The maximum size of VariableName + Data = 1024
* Therefore, it's reasonable to save that much
@@ -1350,7 +1355,8 @@ int register_efivars(struct efivars *efi
if (error)
unregister_efivars(efivars);
- efivar_pstore_register(efivars);
+ if (!efivars_pstore_disable)
+ efivar_pstore_register(efivars);
out:
kfree(variable_name);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 148/214] efivars: Fix check for CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (146 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 147/214] efivars: Add module parameter to disable " Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 149/214] efi_pstore: Introducing workqueue updating sysfs Greg Kroah-Hartman
` (68 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Seth Forshee,
Matt Fleming, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit ca0ba26fbbd2d81c43085df49ce0abfe34535a90 upstream.
The 'CONFIG_' prefix is not implicit in IS_ENABLED().
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/efivars.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -93,7 +93,7 @@ MODULE_VERSION(EFIVARS_VERSION);
#define DUMP_NAME_LEN 52
static bool efivars_pstore_disable =
- IS_ENABLED(EFI_VARS_PSTORE_DEFAULT_DISABLE);
+ IS_ENABLED(CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE);
module_param_named(pstore_disable, efivars_pstore_disable, bool, 0644);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 149/214] efi_pstore: Introducing workqueue updating sysfs
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (147 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 148/214] efivars: Fix check for CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 150/214] x86, efivars: firmware bug workarounds should be in platform code Greg Kroah-Hartman
` (67 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Seiji Aguchi, Matt Fleming,
Tony Luck, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seiji Aguchi <seiji.aguchi@hds.com>
commit a93bc0c6e07ed9bac44700280e65e2945d864fd4 upstream.
[Problem]
efi_pstore creates sysfs entries, which enable users to access to NVRAM,
in a write callback. If a kernel panic happens in an interrupt context,
it may fail because it could sleep due to dynamic memory allocations during
creating sysfs entries.
[Patch Description]
This patch removes sysfs operations from a write callback by introducing
a workqueue updating sysfs entries which is scheduled after the write
callback is called.
Also, the workqueue is kicked in a just oops case.
A system will go down in other cases such as panic, clean shutdown and emergency
restart. And we don't need to create sysfs entries because there is no chance for
users to access to them.
efi_pstore will be robust against a kernel panic in an interrupt context with this patch.
Signed-off-by: Seiji Aguchi <seiji.aguchi@hds.com>
Acked-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
[xr: Backported to 3.4:
- Adjust contest
- Remove repeated definition of helper function variable_is_present]
Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/efivars.c | 61 +++++++++++++++++++++++++++++++++++++++++----
include/linux/efi.h | 3 +-
2 files changed, 58 insertions(+), 6 deletions(-)
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -154,6 +154,13 @@ efivar_create_sysfs_entry(struct efivars
efi_char16_t *variable_name,
efi_guid_t *vendor_guid);
+/*
+ * Prototype for workqueue functions updating sysfs entry
+ */
+
+static void efivar_update_sysfs_entries(struct work_struct *);
+static DECLARE_WORK(efivar_work, efivar_update_sysfs_entries);
+
/* Return the number of unicode characters in data */
static unsigned long
utf16_strnlen(efi_char16_t *s, size_t maxlength)
@@ -839,11 +846,8 @@ static int efi_pstore_write(enum pstore_
if (found)
efivar_unregister(found);
- if (size)
- ret = efivar_create_sysfs_entry(efivars,
- utf16_strsize(efi_name,
- DUMP_NAME_LEN * 2),
- efi_name, &vendor);
+ if (reason == KMSG_DUMP_OOPS)
+ schedule_work(&efivar_work);
*id = part;
return ret;
@@ -1044,6 +1048,53 @@ static bool variable_is_present(efi_char
return found;
}
+static void efivar_update_sysfs_entries(struct work_struct *work)
+{
+ struct efivars *efivars = &__efivars;
+ efi_guid_t vendor;
+ efi_char16_t *variable_name;
+ unsigned long variable_name_size = 1024;
+ efi_status_t status = EFI_NOT_FOUND;
+ bool found;
+
+ /* Add new sysfs entries */
+ while (1) {
+ variable_name = kzalloc(variable_name_size, GFP_KERNEL);
+ if (!variable_name) {
+ pr_err("efivars: Memory allocation failed.\n");
+ return;
+ }
+
+ spin_lock_irq(&efivars->lock);
+ found = false;
+ while (1) {
+ variable_name_size = 1024;
+ status = efivars->ops->get_next_variable(
+ &variable_name_size,
+ variable_name,
+ &vendor);
+ if (status != EFI_SUCCESS) {
+ break;
+ } else {
+ if (!variable_is_present(variable_name,
+ &vendor)) {
+ found = true;
+ break;
+ }
+ }
+ }
+ spin_unlock_irq(&efivars->lock);
+
+ if (!found) {
+ kfree(variable_name);
+ break;
+ } else
+ efivar_create_sysfs_entry(efivars,
+ variable_name_size,
+ variable_name, &vendor);
+ }
+}
+
/*
* Returns the size of variable_name, in bytes, including the
* terminating NULL character, or variable_name_size if no NULL
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -666,7 +666,8 @@ struct efivars {
* 1) ->list - adds, removals, reads, writes
* 2) ops.[gs]et_variable() calls.
* It must not be held when creating sysfs entries or calling kmalloc.
- * ops.get_next_variable() is only called from register_efivars(),
+ * ops.get_next_variable() is only called from register_efivars()
+ * or efivar_update_sysfs_entries(),
* which is protected by the BKL, so that path is safe.
*/
spinlock_t lock;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 150/214] x86, efivars: firmware bug workarounds should be in platform code
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (148 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 149/214] efi_pstore: Introducing workqueue updating sysfs Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 151/214] x86,efi: Check max_size only if it is non-zero Greg Kroah-Hartman
` (66 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, H. Peter Anvin, Matthew Garrett,
Matt Fleming, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fleming <matt.fleming@intel.com>
commit a6e4d5a03e9e3587e88aba687d8f225f4f04c792 upstream.
Let's not burden ia64 with checks in the common efivars code that we're not
writing too much data to the variable store. That kind of thing is an x86
firmware bug, plain and simple.
efi_query_variable_store() provides platforms with a wrapper in which they can
perform checks and workarounds for EFI variable storage bugs.
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
[xr: Backported to 3.4: adjust context]
Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/platform/efi/efi.c | 25 +++++++++++++++++++++++++
drivers/firmware/efivars.c | 18 +++---------------
include/linux/efi.h | 9 ++++++++-
3 files changed, 36 insertions(+), 16 deletions(-)
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -960,3 +960,28 @@ u64 efi_mem_attributes(unsigned long phy
}
return 0;
}
+
+/*
+ * Some firmware has serious problems when using more than 50% of the EFI
+ * variable store, i.e. it triggers bugs that can brick machines. Ensure that
+ * we never use more than this safe limit.
+ *
+ * Return EFI_SUCCESS if it is safe to write 'size' bytes to the variable
+ * store.
+ */
+efi_status_t efi_query_variable_store(u32 attributes, unsigned long size)
+{
+ efi_status_t status;
+ u64 storage_size, remaining_size, max_size;
+
+ status = efi.query_variable_info(attributes, &storage_size,
+ &remaining_size, &max_size);
+ if (status != EFI_SUCCESS)
+ return status;
+
+ if (!storage_size || size > remaining_size || size > max_size ||
+ (remaining_size - size) < (storage_size / 2))
+ return EFI_OUT_OF_RESOURCES;
+
+ return EFI_SUCCESS;
+}
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -425,24 +425,12 @@ static efi_status_t
check_var_size_locked(struct efivars *efivars, u32 attributes,
unsigned long size)
{
- u64 storage_size, remaining_size, max_size;
- efi_status_t status;
const struct efivar_operations *fops = efivars->ops;
- if (!efivars->ops->query_variable_info)
+ if (!efivars->ops->query_variable_store)
return EFI_UNSUPPORTED;
- status = fops->query_variable_info(attributes, &storage_size,
- &remaining_size, &max_size);
-
- if (status != EFI_SUCCESS)
- return status;
-
- if (!storage_size || size > remaining_size || size > max_size ||
- (remaining_size - size) < (storage_size / 2))
- return EFI_OUT_OF_RESOURCES;
-
- return status;
+ return fops->query_variable_store(attributes, size);
}
static ssize_t
@@ -1445,7 +1433,7 @@ efivars_init(void)
ops.get_variable = efi.get_variable;
ops.set_variable = efi.set_variable;
ops.get_next_variable = efi.get_next_variable;
- ops.query_variable_info = efi.query_variable_info;
+ ops.query_variable_store = efi_query_variable_store;
error = register_efivars(&__efivars, &ops, efi_kobj);
if (error)
goto err_put;
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -262,6 +262,7 @@ typedef efi_status_t efi_query_capsule_c
unsigned long count,
u64 *max_size,
int *reset_type);
+typedef efi_status_t efi_query_variable_store_t(u32 attributes, unsigned long size);
/*
* EFI Configuration Table and GUID definitions
@@ -503,8 +504,14 @@ extern void efi_gettimeofday (struct tim
extern void efi_enter_virtual_mode (void); /* switch EFI to virtual mode, if possible */
#ifdef CONFIG_X86
extern void efi_free_boot_services(void);
+extern efi_status_t efi_query_variable_store(u32 attributes, unsigned long size);
#else
static inline void efi_free_boot_services(void) {}
+
+static inline efi_status_t efi_query_variable_store(u32 attributes, unsigned long size)
+{
+ return EFI_SUCCESS;
+}
#endif
extern u64 efi_get_iobase (void);
extern u32 efi_mem_type (unsigned long phys_addr);
@@ -657,7 +664,7 @@ struct efivar_operations {
efi_get_variable_t *get_variable;
efi_get_next_variable_t *get_next_variable;
efi_set_variable_t *set_variable;
- efi_query_variable_info_t *query_variable_info;
+ efi_query_variable_store_t *query_variable_store;
};
struct efivars {
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 151/214] x86,efi: Check max_size only if it is non-zero.
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (149 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 150/214] x86, efivars: firmware bug workarounds should be in platform code Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 152/214] efi: Export efi_query_variable_store() for efivars.ko Greg Kroah-Hartman
` (65 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Richard Weinberger, Matt Fleming,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <richard@nod.at>
commit 7791c8423f1f7f4dad94e753bae67461d5b80be8 upstream.
Some EFI implementations return always a MaximumVariableSize of 0,
check against max_size only if it is non-zero.
My Intel DQ67SW desktop board has such an implementation.
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/platform/efi/efi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -979,7 +979,12 @@ efi_status_t efi_query_variable_store(u3
if (status != EFI_SUCCESS)
return status;
- if (!storage_size || size > remaining_size || size > max_size ||
+ if (!max_size && remaining_size > size)
+ printk_once(KERN_ERR FW_BUG "Broken EFI implementation"
+ " is returning MaxVariableSize=0\n");
+
+ if (!storage_size || size > remaining_size ||
+ (max_size && size > max_size) ||
(remaining_size - size) < (storage_size / 2))
return EFI_OUT_OF_RESOURCES;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 152/214] efi: Export efi_query_variable_store() for efivars.ko
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (150 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 151/214] x86,efi: Check max_size only if it is non-zero Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 153/214] x86,efi: Implement efi_no_storage_paranoia parameter Greg Kroah-Hartman
` (64 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sergey Vlasov, Matt Fleming,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Vlasov <vsu@altlinux.ru>
commit 3668011d4ad556224f7c012c1e870a6eaa0e59da upstream.
Fixes build with CONFIG_EFI_VARS=m which was broken after the commit
"x86, efivars: firmware bug workarounds should be in platform code".
Signed-off-by: Sergey Vlasov <vsu@altlinux.ru>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/platform/efi/efi.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -990,3 +990,4 @@ efi_status_t efi_query_variable_store(u3
return EFI_SUCCESS;
}
+EXPORT_SYMBOL_GPL(efi_query_variable_store);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 153/214] x86,efi: Implement efi_no_storage_paranoia parameter
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (151 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 152/214] efi: Export efi_query_variable_store() for efivars.ko Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 154/214] Modify UEFI anti-bricking code Greg Kroah-Hartman
` (63 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Richard Weinberger, Matt Fleming,
Ben Hutchings, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <richard@nod.at>
commit 8c58bf3eec3b8fc8162fe557e9361891c20758f2 upstream.
Using this parameter one can disable the storage_size/2 check if
he is really sure that the UEFI does sane gc and fulfills the spec.
This parameter is useful if a devices uses more than 50% of the
storage by default.
The Intel DQSW67 desktop board is such a sucker for exmaple.
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/kernel-parameters.txt | 6 ++++++
arch/x86/platform/efi/efi.c | 14 +++++++++++++-
2 files changed, 19 insertions(+), 1 deletion(-)
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -773,6 +773,12 @@ bytes respectively. Such letter suffixes
edd= [EDD]
Format: {"off" | "on" | "skip[mbr]"}
+ efi_no_storage_paranoia [EFI; X86]
+ Using this parameter you can use more than 50% of
+ your efi variable storage. Use this parameter only if
+ you are really sure that your UEFI does sane gc and
+ fulfills the spec otherwise your board may brick.
+
eisa_irq_edge= [PARISC,HW]
See header of drivers/parisc/eisa.c.
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -102,6 +102,15 @@ static int __init setup_add_efi_memmap(c
}
early_param("add_efi_memmap", setup_add_efi_memmap);
+static bool efi_no_storage_paranoia;
+
+static int __init setup_storage_paranoia(char *arg)
+{
+ efi_no_storage_paranoia = true;
+ return 0;
+}
+early_param("efi_no_storage_paranoia", setup_storage_paranoia);
+
static efi_status_t virt_efi_get_time(efi_time_t *tm, efi_time_cap_t *tc)
{
@@ -984,7 +993,10 @@ efi_status_t efi_query_variable_store(u3
" is returning MaxVariableSize=0\n");
if (!storage_size || size > remaining_size ||
- (max_size && size > max_size) ||
+ (max_size && size > max_size))
+ return EFI_OUT_OF_RESOURCES;
+
+ if (!efi_no_storage_paranoia &&
(remaining_size - size) < (storage_size / 2))
return EFI_OUT_OF_RESOURCES;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 154/214] Modify UEFI anti-bricking code
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (152 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 153/214] x86,efi: Implement efi_no_storage_paranoia parameter Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 155/214] x86/efi: Fix dummy variable buffer allocation Greg Kroah-Hartman
` (62 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Matthew Garrett, Matt Fleming,
Ben Hutchings, Rui Xiang, Lee, Chun-Y
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Garrett <matthew.garrett@nebula.com>
commit f8b8404337de4e2466e2e1139ea68b1f8295974f upstream.
This patch reworks the UEFI anti-bricking code, including an effective
reversion of cc5a080c and 31ff2f20. It turns out that calling
QueryVariableInfo() from boot services results in some firmware
implementations jumping to physical addresses even after entering virtual
mode, so until we have 1:1 mappings for UEFI runtime space this isn't
going to work so well.
Reverting these gets us back to the situation where we'd refuse to create
variables on some systems because they classify deleted variables as "used"
until the firmware triggers a garbage collection run, which they won't do
until they reach a lower threshold. This results in it being impossible to
install a bootloader, which is unhelpful.
Feedback from Samsung indicates that the firmware doesn't need more than
5KB of storage space for its own purposes, so that seems like a reasonable
threshold. However, there's still no guarantee that a platform will attempt
garbage collection merely because it drops below this threshold. It seems
that this is often only triggered if an attempt to write generates a
genuine EFI_OUT_OF_RESOURCES error. We can force that by attempting to
create a variable larger than the remaining space. This should fail, but if
it somehow succeeds we can then immediately delete it.
I've tested this on the UEFI machines I have available, but I don't have
a Samsung and so can't verify that it avoids the bricking problem.
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Signed-off-by: Lee, Chun-Y <jlee@suse.com> [ dummy variable cleanup ]
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
[bwh: Backported to 3.2: the reverted changes were never applied here]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/platform/efi/efi.c | 79 +++++++++++++++++++++++++++++++++++++-------
1 file changed, 68 insertions(+), 11 deletions(-)
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -50,6 +50,13 @@
#define EFI_DEBUG 1
+#define EFI_MIN_RESERVE 5120
+
+#define EFI_DUMMY_GUID \
+ EFI_GUID(0x4424ac57, 0xbe4b, 0x47dd, 0x9e, 0x97, 0xed, 0x50, 0xf0, 0x9f, 0x92, 0xa9)
+
+static efi_char16_t efi_dummy_name[6] = { 'D', 'U', 'M', 'M', 'Y', 0 };
+
struct efi __read_mostly efi = {
.mps = EFI_INVALID_TABLE_ADDR,
.acpi = EFI_INVALID_TABLE_ADDR,
@@ -932,6 +939,13 @@ void __init efi_enter_virtual_mode(void)
runtime_code_page_mkexec();
kfree(new_memmap);
+
+ /* clean DUMMY object */
+ efi.set_variable(efi_dummy_name, &EFI_DUMMY_GUID,
+ EFI_VARIABLE_NON_VOLATILE |
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS,
+ 0, NULL);
}
/*
@@ -983,22 +997,65 @@ efi_status_t efi_query_variable_store(u3
efi_status_t status;
u64 storage_size, remaining_size, max_size;
+ if (!(attributes & EFI_VARIABLE_NON_VOLATILE))
+ return 0;
+
status = efi.query_variable_info(attributes, &storage_size,
&remaining_size, &max_size);
if (status != EFI_SUCCESS)
return status;
- if (!max_size && remaining_size > size)
- printk_once(KERN_ERR FW_BUG "Broken EFI implementation"
- " is returning MaxVariableSize=0\n");
-
- if (!storage_size || size > remaining_size ||
- (max_size && size > max_size))
- return EFI_OUT_OF_RESOURCES;
-
- if (!efi_no_storage_paranoia &&
- (remaining_size - size) < (storage_size / 2))
- return EFI_OUT_OF_RESOURCES;
+ /*
+ * Some firmware implementations refuse to boot if there's insufficient
+ * space in the variable store. We account for that by refusing the
+ * write if permitting it would reduce the available space to under
+ * 5KB. This figure was provided by Samsung, so should be safe.
+ */
+ if ((remaining_size - size < EFI_MIN_RESERVE) &&
+ !efi_no_storage_paranoia) {
+
+ /*
+ * Triggering garbage collection may require that the firmware
+ * generate a real EFI_OUT_OF_RESOURCES error. We can force
+ * that by attempting to use more space than is available.
+ */
+ unsigned long dummy_size = remaining_size + 1024;
+ void *dummy = kmalloc(dummy_size, GFP_ATOMIC);
+
+ status = efi.set_variable(efi_dummy_name, &EFI_DUMMY_GUID,
+ EFI_VARIABLE_NON_VOLATILE |
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS,
+ dummy_size, dummy);
+
+ if (status == EFI_SUCCESS) {
+ /*
+ * This should have failed, so if it didn't make sure
+ * that we delete it...
+ */
+ efi.set_variable(efi_dummy_name, &EFI_DUMMY_GUID,
+ EFI_VARIABLE_NON_VOLATILE |
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS,
+ 0, dummy);
+ }
+
+ /*
+ * The runtime code may now have triggered a garbage collection
+ * run, so check the variable info again
+ */
+ status = efi.query_variable_info(attributes, &storage_size,
+ &remaining_size, &max_size);
+
+ if (status != EFI_SUCCESS)
+ return status;
+
+ /*
+ * There still isn't enough room, so return an error
+ */
+ if (remaining_size - size < EFI_MIN_RESERVE)
+ return EFI_OUT_OF_RESOURCES;
+ }
return EFI_SUCCESS;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 155/214] x86/efi: Fix dummy variable buffer allocation
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (153 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 154/214] Modify UEFI anti-bricking code Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 156/214] nbd: fsync and kill block device on shutdown Greg Kroah-Hartman
` (61 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Matt Fleming, Rui Xiang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit b8cb62f82103083a6e8fa5470bfe634a2c06514d upstream.
1. Check for allocation failure
2. Clear the buffer contents, as they may actually be written to flash
3. Don't leak the buffer
Compile-tested only.
[ Tested successfully on my buggy ASUS machine - Matt ]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/platform/efi/efi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -1020,7 +1020,10 @@ efi_status_t efi_query_variable_store(u3
* that by attempting to use more space than is available.
*/
unsigned long dummy_size = remaining_size + 1024;
- void *dummy = kmalloc(dummy_size, GFP_ATOMIC);
+ void *dummy = kzalloc(dummy_size, GFP_ATOMIC);
+
+ if (!dummy)
+ return EFI_OUT_OF_RESOURCES;
status = efi.set_variable(efi_dummy_name, &EFI_DUMMY_GUID,
EFI_VARIABLE_NON_VOLATILE |
@@ -1040,6 +1043,8 @@ efi_status_t efi_query_variable_store(u3
0, dummy);
}
+ kfree(dummy);
+
/*
* The runtime code may now have triggered a garbage collection
* run, so check the variable info again
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 156/214] nbd: fsync and kill block device on shutdown
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (154 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 155/214] x86/efi: Fix dummy variable buffer allocation Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 157/214] drivers: hv: switch to use mb() instead of smp_mb() Greg Kroah-Hartman
` (60 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paolo Bonzini, Paul Clements,
Alex Bligh, Andrew Morton, Linus Torvalds, Ben Hutchings,
Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit 3a2d63f87989e01437ba994df5f297528c353d7d upstream.
There are two problems with shutdown in the NBD driver.
1: Receiving the NBD_DISCONNECT ioctl does not sync the filesystem.
This patch adds the sync operation into __nbd_ioctl()'s
NBD_DISCONNECT handler. This is useful because BLKFLSBUF is restricted
to processes that have CAP_SYS_ADMIN, and the NBD client may not
possess it (fsync of the block device does not sync the filesystem,
either).
2: Once we clear the socket we have no guarantee that later reads will
come from the same backing storage.
The patch adds calls to kill_bdev() in __nbd_ioctl()'s socket
clearing code so the page cache is cleaned, lest reads that hit on the
page cache will return stale data from the previously-accessible disk.
Example:
# qemu-nbd -r -c/dev/nbd0 /dev/sr0
# file -s /dev/nbd0
/dev/stdin: # UDF filesystem data (version 1.5) etc.
# qemu-nbd -d /dev/nbd0
# qemu-nbd -r -c/dev/nbd0 /dev/sda
# file -s /dev/nbd0
/dev/stdin: # UDF filesystem data (version 1.5) etc.
While /dev/sda has:
# file -s /dev/sda
/dev/sda: x86 boot sector; etc.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Acked-by: Paul Clements <Paul.Clements@steeleye.com>
Cc: Alex Bligh <alex@alex.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2:
- Adjusted context
- s/\bnbd\b/lo/
- Incorporate export of kill_bdev() from commit ff01bb483265
('fs: move code out of buffer.c')]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[hq: Backported to 3.4: Adjusted context]
Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/nbd.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -584,10 +584,17 @@ static int __nbd_ioctl(struct block_devi
struct request sreq;
dev_info(disk_to_dev(nbd->disk), "NBD_DISCONNECT\n");
+ if (!nbd->sock)
+ return -EINVAL;
+ mutex_unlock(&nbd->tx_lock);
+ fsync_bdev(bdev);
+ mutex_lock(&nbd->tx_lock);
blk_rq_init(NULL, &sreq);
sreq.cmd_type = REQ_TYPE_SPECIAL;
nbd_cmd(&sreq) = NBD_CMD_DISC;
+
+ /* Check again after getting mutex back. */
if (!nbd->sock)
return -EINVAL;
@@ -606,6 +613,7 @@ static int __nbd_ioctl(struct block_devi
nbd_clear_que(nbd);
BUG_ON(!list_empty(&nbd->queue_head));
BUG_ON(!list_empty(&nbd->waiting_queue));
+ kill_bdev(bdev);
if (file)
fput(file);
return 0;
@@ -688,6 +696,7 @@ static int __nbd_ioctl(struct block_devi
nbd->file = NULL;
nbd_clear_que(nbd);
dev_warn(disk_to_dev(nbd->disk), "queue cleared\n");
+ kill_bdev(bdev);
if (file)
fput(file);
nbd->bytesize = 0;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 157/214] drivers: hv: switch to use mb() instead of smp_mb()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (155 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 156/214] nbd: fsync and kill block device on shutdown Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 158/214] drm/i915/sdvo: clean up connectors on intel_sdvo_init() failures Greg Kroah-Hartman
` (59 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Wang, Haiyang Zhang,
K. Y. Srinivasan, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <jasowang@redhat.com>
commit 35848f68b07df3f917cb13fc3c134718669f569b upstream.
Even if guest were compiled without SMP support, it could not assume that host
wasn't. So switch to use mb() instead of smp_mb() to force memory barriers for
UP guest.
Signed-off-by: Jason Wang <jasowang@redhat.com>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2:
- Drop changes to functions that don't exist here
- hv_ringbuffer_write() has only a write memory barrier]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[hq: Backported to 3.4:
- Add the change in hv_ringbuffer_read]
Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hv/ring_buffer.c | 4 ++--
drivers/hv/vmbus_drv.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -383,7 +383,7 @@ int hv_ringbuffer_write(struct hv_ring_b
sizeof(u64));
/* Make sure we flush all writes before updating the writeIndex */
- smp_wmb();
+ wmb();
/* Now, update the write location */
hv_set_next_write_location(outring_info, next_write_location);
@@ -485,7 +485,7 @@ int hv_ringbuffer_read(struct hv_ring_bu
/* Make sure all reads are done before we update the read index since */
/* the writer may start writing to the read area once the read index */
/*is updated */
- smp_mb();
+ mb();
/* Update the read index */
hv_set_next_read_location(inring_info, next_read_location);
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -466,7 +466,7 @@ static void vmbus_on_msg_dpc(unsigned lo
* will not deliver any more messages since there is
* no empty slot
*/
- smp_mb();
+ mb();
if (msg->header.message_flags.msg_pending) {
/*
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 158/214] drm/i915/sdvo: clean up connectors on intel_sdvo_init() failures
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (156 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 157/214] drivers: hv: switch to use mb() instead of smp_mb() Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 159/214] drm: fix documentation for drm_crtc_set_mode() Greg Kroah-Hartman
` (58 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Wilson, Jani Nikula,
Daniel Vetter, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
commit d0ddfbd3d1346c1f481ec2289eef350cdba64b42 upstream.
Any failures in intel_sdvo_init() after the intel_sdvo_setup_output() call
left behind ghost connectors, attached (with a dangling pointer) to the
sdvo that has been cleaned up and freed. Properly destroy any connectors
attached to the encoder.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=46381
CC: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Tested-by: bjo@nord-west.org
[danvet: added a comment to explain why we need to clean up connectors
even when sdvo_output_setup fails.]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_sdvo.c | 22 +++++++++++++++++++---
1 file changed, 19 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -2265,6 +2265,18 @@ intel_sdvo_output_setup(struct intel_sdv
return true;
}
+static void intel_sdvo_output_cleanup(struct intel_sdvo *intel_sdvo)
+{
+ struct drm_device *dev = intel_sdvo->base.base.dev;
+ struct drm_connector *connector, *tmp;
+
+ list_for_each_entry_safe(connector, tmp,
+ &dev->mode_config.connector_list, head) {
+ if (intel_attached_encoder(connector) == &intel_sdvo->base)
+ intel_sdvo_destroy(connector);
+ }
+}
+
static bool intel_sdvo_tv_create_property(struct intel_sdvo *intel_sdvo,
struct intel_sdvo_connector *intel_sdvo_connector,
int type)
@@ -2583,7 +2595,8 @@ bool intel_sdvo_init(struct drm_device *
intel_sdvo->caps.output_flags) != true) {
DRM_DEBUG_KMS("SDVO output failed to setup on SDVO%c\n",
IS_SDVOB(sdvo_reg) ? 'B' : 'C');
- goto err;
+ /* Output_setup can leave behind connectors! */
+ goto err_output;
}
/* Only enable the hotplug irq if we need it, to work around noisy
@@ -2596,12 +2609,12 @@ bool intel_sdvo_init(struct drm_device *
/* Set the input timing to the screen. Assume always input 0. */
if (!intel_sdvo_set_target_input(intel_sdvo))
- goto err;
+ goto err_output;
if (!intel_sdvo_get_input_pixel_clock_range(intel_sdvo,
&intel_sdvo->pixel_clock_min,
&intel_sdvo->pixel_clock_max))
- goto err;
+ goto err_output;
DRM_DEBUG_KMS("%s device VID/DID: %02X:%02X.%02X, "
"clock range %dMHz - %dMHz, "
@@ -2621,6 +2634,9 @@ bool intel_sdvo_init(struct drm_device *
(SDVO_OUTPUT_TMDS1 | SDVO_OUTPUT_RGB1) ? 'Y' : 'N');
return true;
+err_output:
+ intel_sdvo_output_cleanup(intel_sdvo);
+
err:
drm_encoder_cleanup(&intel_encoder->base);
i2c_del_adapter(&intel_sdvo->ddc);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 159/214] drm: fix documentation for drm_crtc_set_mode()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (157 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 158/214] drm/i915/sdvo: clean up connectors on intel_sdvo_init() failures Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 160/214] drm/radeon/dce32+: use fractional fb dividers for high clocks Greg Kroah-Hartman
` (57 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Deucher, Dave Airlie,
Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 4c9287c6009b37754c42e0ba73a4cc79de92d8f8 upstream.
x and y parameters are offsets, not width/height
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_crtc_helper.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -328,8 +328,8 @@ drm_crtc_prepare_encoders(struct drm_dev
* drm_crtc_set_mode - set a mode
* @crtc: CRTC to program
* @mode: mode to use
- * @x: width of mode
- * @y: height of mode
+ * @x: horizontal offset into the surface
+ * @y: vertical offset into the surface
*
* LOCKING:
* Caller must hold mode config lock.
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 160/214] drm/radeon/dce32+: use fractional fb dividers for high clocks
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (158 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 159/214] drm: fix documentation for drm_crtc_set_mode() Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 161/214] drm/radeon: fix amd afusion gpu setup aka sumo v2 Greg Kroah-Hartman
` (56 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Deucher, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit a02dc74b317d78298cb0587b9b1f6f741fd5c139 upstream.
Fixes flickering with some high res montiors.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[bwh: Backported to 3.2: use pll->flags instead of radeon_crtc->pll_flags]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/atombios_crtc.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -573,6 +573,8 @@ static u32 atombios_adjust_pll(struct dr
/* use frac fb div on APUs */
if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev))
pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
+ if (ASIC_IS_DCE32(rdev) && mode->clock > 165000)
+ pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
} else {
pll->flags |= RADEON_PLL_LEGACY;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 161/214] drm/radeon: fix amd afusion gpu setup aka sumo v2
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (159 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 160/214] drm/radeon/dce32+: use fractional fb dividers for high clocks Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 162/214] drm/radeon: add connector table for SAM440ep embedded board Greg Kroah-Hartman
` (55 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jerome Glisse, Alex Deucher,
Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Glisse <jglisse@redhat.com>
commit bd25f0783dc3fb72e1e2779c2b99b2d34b67fa8a upstream.
Set the proper number of tile pipe that should be a multiple of
pipe depending on the number of se engine.
Fix:
https://bugs.freedesktop.org/show_bug.cgi?id=56405
https://bugs.freedesktop.org/show_bug.cgi?id=56720
v2: Don't change sumo2
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
[bwh: Backported to 3.2: don't define/use *_GB_ADDR_CONFIG_GOLDEN]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/evergreen.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1874,7 +1874,7 @@ static void evergreen_gpu_init(struct ra
case CHIP_SUMO:
rdev->config.evergreen.num_ses = 1;
rdev->config.evergreen.max_pipes = 4;
- rdev->config.evergreen.max_tile_pipes = 2;
+ rdev->config.evergreen.max_tile_pipes = 4;
if (rdev->pdev->device == 0x9648)
rdev->config.evergreen.max_simds = 3;
else if ((rdev->pdev->device == 0x9647) ||
@@ -1963,7 +1963,7 @@ static void evergreen_gpu_init(struct ra
break;
case CHIP_CAICOS:
rdev->config.evergreen.num_ses = 1;
- rdev->config.evergreen.max_pipes = 4;
+ rdev->config.evergreen.max_pipes = 2;
rdev->config.evergreen.max_tile_pipes = 2;
rdev->config.evergreen.max_simds = 2;
rdev->config.evergreen.max_backends = 1 * rdev->config.evergreen.num_ses;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 162/214] drm/radeon: add connector table for SAM440ep embedded board
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (160 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 161/214] drm/radeon: fix amd afusion gpu setup aka sumo v2 Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 163/214] drm/radeon: add connector table for Mac G4 Silver Greg Kroah-Hartman
` (54 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Alex Deucher,
Dave Airlie, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 6a556039e7823d27a0a7f7724d4d455053ea9253 upstream.
RV250 found on ppc embedded boards.
Cc: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_combios.c | 66 ++++++++++++++++++++++++++++++++
drivers/gpu/drm/radeon/radeon_mode.h | 1
2 files changed, 67 insertions(+)
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -1509,6 +1509,11 @@ bool radeon_get_legacy_connector_info_fr
(rdev->pdev->subsystem_device == 0x4150)) {
/* Mac G5 tower 9600 */
rdev->mode_info.connector_table = CT_MAC_G5_9600;
+ } else if ((rdev->pdev->device == 0x4c66) &&
+ (rdev->pdev->subsystem_vendor == 0x1002) &&
+ (rdev->pdev->subsystem_device == 0x4c66)) {
+ /* SAM440ep RV250 embedded board */
+ rdev->mode_info.connector_table = CT_SAM440EP;
} else
#endif /* CONFIG_PPC_PMAC */
#ifdef CONFIG_PPC64
@@ -2080,6 +2085,67 @@ bool radeon_get_legacy_connector_info_fr
DRM_MODE_CONNECTOR_SVIDEO,
&ddc_i2c,
CONNECTOR_OBJECT_ID_SVIDEO,
+ &hpd);
+ break;
+ case CT_SAM440EP:
+ DRM_INFO("Connector Table: %d (SAM440ep embedded board)\n",
+ rdev->mode_info.connector_table);
+ /* LVDS */
+ ddc_i2c = combios_setup_i2c_bus(rdev, DDC_NONE_DETECTED, 0, 0);
+ hpd.hpd = RADEON_HPD_NONE;
+ radeon_add_legacy_encoder(dev,
+ radeon_get_encoder_enum(dev,
+ ATOM_DEVICE_LCD1_SUPPORT,
+ 0),
+ ATOM_DEVICE_LCD1_SUPPORT);
+ radeon_add_legacy_connector(dev, 0, ATOM_DEVICE_LCD1_SUPPORT,
+ DRM_MODE_CONNECTOR_LVDS, &ddc_i2c,
+ CONNECTOR_OBJECT_ID_LVDS,
+ &hpd);
+ /* DVI-I - secondary dac, int tmds */
+ ddc_i2c = combios_setup_i2c_bus(rdev, DDC_DVI, 0, 0);
+ hpd.hpd = RADEON_HPD_1; /* ??? */
+ radeon_add_legacy_encoder(dev,
+ radeon_get_encoder_enum(dev,
+ ATOM_DEVICE_DFP1_SUPPORT,
+ 0),
+ ATOM_DEVICE_DFP1_SUPPORT);
+ radeon_add_legacy_encoder(dev,
+ radeon_get_encoder_enum(dev,
+ ATOM_DEVICE_CRT2_SUPPORT,
+ 2),
+ ATOM_DEVICE_CRT2_SUPPORT);
+ radeon_add_legacy_connector(dev, 1,
+ ATOM_DEVICE_DFP1_SUPPORT |
+ ATOM_DEVICE_CRT2_SUPPORT,
+ DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
+ CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
+ &hpd);
+ /* VGA - primary dac */
+ ddc_i2c = combios_setup_i2c_bus(rdev, DDC_VGA, 0, 0);
+ hpd.hpd = RADEON_HPD_NONE;
+ radeon_add_legacy_encoder(dev,
+ radeon_get_encoder_enum(dev,
+ ATOM_DEVICE_CRT1_SUPPORT,
+ 1),
+ ATOM_DEVICE_CRT1_SUPPORT);
+ radeon_add_legacy_connector(dev, 2,
+ ATOM_DEVICE_CRT1_SUPPORT,
+ DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
+ CONNECTOR_OBJECT_ID_VGA,
+ &hpd);
+ /* TV - TV DAC */
+ ddc_i2c.valid = false;
+ hpd.hpd = RADEON_HPD_NONE;
+ radeon_add_legacy_encoder(dev,
+ radeon_get_encoder_enum(dev,
+ ATOM_DEVICE_TV1_SUPPORT,
+ 2),
+ ATOM_DEVICE_TV1_SUPPORT);
+ radeon_add_legacy_connector(dev, 3, ATOM_DEVICE_TV1_SUPPORT,
+ DRM_MODE_CONNECTOR_SVIDEO,
+ &ddc_i2c,
+ CONNECTOR_OBJECT_ID_SVIDEO,
&hpd);
break;
default:
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -210,6 +210,7 @@ enum radeon_connector_table {
CT_RN50_POWER,
CT_MAC_X800,
CT_MAC_G5_9600,
+ CT_SAM440EP
};
enum radeon_dvo_chip {
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 163/214] drm/radeon: add connector table for Mac G4 Silver
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (161 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 162/214] drm/radeon: add connector table for SAM440ep embedded board Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 164/214] drm/nouveau: fix init with agpgart-uninorth Greg Kroah-Hartman
` (53 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Albrecht Dreß,
Alex Deucher, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit cafa59b9011a7790be4ddd5979419259844a165d upstream.
Apple cards do not provide data tables in the vbios
so we have to hard code the connector parameters
in the driver.
Reported-by: Albrecht Dreß <albrecht.dress@arcor.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_combios.c | 51 ++++++++++++++++++++++++++++++++
drivers/gpu/drm/radeon/radeon_mode.h | 3 +
2 files changed, 53 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -1484,6 +1484,9 @@ bool radeon_get_legacy_connector_info_fr
of_machine_is_compatible("PowerBook6,7")) {
/* ibook */
rdev->mode_info.connector_table = CT_IBOOK;
+ } else if (of_machine_is_compatible("PowerMac3,5")) {
+ /* PowerMac G4 Silver radeon 7500 */
+ rdev->mode_info.connector_table = CT_MAC_G4_SILVER;
} else if (of_machine_is_compatible("PowerMac4,4")) {
/* emac */
rdev->mode_info.connector_table = CT_EMAC;
@@ -2146,6 +2149,54 @@ bool radeon_get_legacy_connector_info_fr
DRM_MODE_CONNECTOR_SVIDEO,
&ddc_i2c,
CONNECTOR_OBJECT_ID_SVIDEO,
+ &hpd);
+ break;
+ case CT_MAC_G4_SILVER:
+ DRM_INFO("Connector Table: %d (mac g4 silver)\n",
+ rdev->mode_info.connector_table);
+ /* DVI-I - tv dac, int tmds */
+ ddc_i2c = combios_setup_i2c_bus(rdev, DDC_DVI, 0, 0);
+ hpd.hpd = RADEON_HPD_1; /* ??? */
+ radeon_add_legacy_encoder(dev,
+ radeon_get_encoder_enum(dev,
+ ATOM_DEVICE_DFP1_SUPPORT,
+ 0),
+ ATOM_DEVICE_DFP1_SUPPORT);
+ radeon_add_legacy_encoder(dev,
+ radeon_get_encoder_enum(dev,
+ ATOM_DEVICE_CRT2_SUPPORT,
+ 2),
+ ATOM_DEVICE_CRT2_SUPPORT);
+ radeon_add_legacy_connector(dev, 0,
+ ATOM_DEVICE_DFP1_SUPPORT |
+ ATOM_DEVICE_CRT2_SUPPORT,
+ DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
+ CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
+ &hpd);
+ /* VGA - primary dac */
+ ddc_i2c = combios_setup_i2c_bus(rdev, DDC_VGA, 0, 0);
+ hpd.hpd = RADEON_HPD_NONE;
+ radeon_add_legacy_encoder(dev,
+ radeon_get_encoder_enum(dev,
+ ATOM_DEVICE_CRT1_SUPPORT,
+ 1),
+ ATOM_DEVICE_CRT1_SUPPORT);
+ radeon_add_legacy_connector(dev, 1, ATOM_DEVICE_CRT1_SUPPORT,
+ DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
+ CONNECTOR_OBJECT_ID_VGA,
+ &hpd);
+ /* TV - TV DAC */
+ ddc_i2c.valid = false;
+ hpd.hpd = RADEON_HPD_NONE;
+ radeon_add_legacy_encoder(dev,
+ radeon_get_encoder_enum(dev,
+ ATOM_DEVICE_TV1_SUPPORT,
+ 2),
+ ATOM_DEVICE_TV1_SUPPORT);
+ radeon_add_legacy_connector(dev, 2, ATOM_DEVICE_TV1_SUPPORT,
+ DRM_MODE_CONNECTOR_SVIDEO,
+ &ddc_i2c,
+ CONNECTOR_OBJECT_ID_SVIDEO,
&hpd);
break;
default:
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -210,7 +210,8 @@ enum radeon_connector_table {
CT_RN50_POWER,
CT_MAC_X800,
CT_MAC_G5_9600,
- CT_SAM440EP
+ CT_SAM440EP,
+ CT_MAC_G4_SILVER
};
enum radeon_dvo_chip {
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 164/214] drm/nouveau: fix init with agpgart-uninorth
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (162 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 163/214] drm/radeon: add connector table for Mac G4 Silver Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 165/214] drm/radeon: fix typo in evergreen_mc_resume() Greg Kroah-Hartman
` (52 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michel Dänzer, Aaro Koskinen,
Dave Airlie, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaro Koskinen <aaro.koskinen@iki.fi>
commit eda85d6ad490923152544fba0473798b6cc0edf6 upstream.
Check that the AGP aperture can be mapped. This follows a similar change
done for Radeon (commit 365048ff, drm/radeon: AGP memory is only I/O if
the aperture can be mapped by the CPU.).
The patch fixes the following error seen on G5 iMac:
nouveau E[ DRM] failed to create kernel channel, -12
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=58806
Reviewed-by: Michel Dänzer <michel@daenzer.net>
Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Dave Airlie <airlied@redhat.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -946,7 +946,7 @@ nouveau_ttm_io_mem_reserve(struct ttm_bo
if (dev_priv->gart_info.type == NOUVEAU_GART_AGP) {
mem->bus.offset = mem->start << PAGE_SHIFT;
mem->bus.base = dev_priv->gart_info.aper_base;
- mem->bus.is_iomem = true;
+ mem->bus.is_iomem = !dev->agp->cant_use_aperture;
}
#endif
break;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 165/214] drm/radeon: fix typo in evergreen_mc_resume()
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (163 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 164/214] drm/nouveau: fix init with agpgart-uninorth Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 166/214] drm/i915: Close race between processing unpin task and queueing the flip Greg Kroah-Hartman
` (51 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Deucher, Michel Dänzer,
Dave Airlie, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 695ddeb457584a602f2ba117d08ce37cf6ec1589 upstream.
Add missing index that may have led us to enabling
more crtcs than necessary.
May also fix:
https://bugs.freedesktop.org/show_bug.cgi?id=56139
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/evergreen.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1292,7 +1292,7 @@ void evergreen_mc_resume(struct radeon_d
WREG32(BIF_FB_EN, FB_READ_EN | FB_WRITE_EN);
for (i = 0; i < rdev->num_crtc; i++) {
- if (save->crtc_enabled) {
+ if (save->crtc_enabled[i]) {
if (ASIC_IS_DCE6(rdev)) {
tmp = RREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i]);
tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 166/214] drm/i915: Close race between processing unpin task and queueing the flip
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (164 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 165/214] drm/radeon: fix typo in evergreen_mc_resume() Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 167/214] drm/i915; Only increment the user-pin-count after successfully pinning the bo Greg Kroah-Hartman
` (50 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Wilson, Daniel Vetter, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit e7d841ca03b7ab668620045cd7b428eda9f41601 upstream.
Before queuing the flip but crucially after attaching the unpin-work to
the crtc, we continue to setup the unpin-work. However, should the
hardware fire early, we see the connected unpin-work and queue the task.
The task then promptly runs and unpins the fb before we finish taking
the required references or even pinning it... Havoc.
To close the race, we use the flip-pending atomic to indicate when the
flip is finally setup and enqueued. So during the flip-done processing,
we can check more accurately whether the flip was expected.
v2: Add the appropriate mb() to ensure that the writes to the page-flip
worker are complete prior to marking it active and emitting the MI_FLIP.
On the read side, the mb should be enforced by the spinlocks.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@vger.kernel.org
[danvet: Review the barriers a bit, we need a write barrier both
before and after updating ->pending. Similarly we need a read barrier
in the interrupt handler both before and after reading ->pending. With
well-ordered irqs only one barrier in each place should be required,
but since this patch explicitly sets out to combat spurious interrupts
with is staged activation of the unpin work we need to go full-bore on
the barriers, too. Discussed with Chris Wilson on irc and changes
acked by him.]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
[wml: Backported to 3.4: adjust context]
Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_debugfs.c | 4 +--
drivers/gpu/drm/i915/i915_irq.c | 4 ++-
drivers/gpu/drm/i915/intel_display.c | 39 ++++++++++++++++++++++++++++-------
drivers/gpu/drm/i915/intel_drv.h | 5 +++-
4 files changed, 41 insertions(+), 11 deletions(-)
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -340,7 +340,7 @@ static int i915_gem_pageflip_info(struct
seq_printf(m, "No flip due on pipe %c (plane %c)\n",
pipe, plane);
} else {
- if (!work->pending) {
+ if (atomic_read(&work->pending) < INTEL_FLIP_COMPLETE) {
seq_printf(m, "Flip queued on pipe %c (plane %c)\n",
pipe, plane);
} else {
@@ -351,7 +351,7 @@ static int i915_gem_pageflip_info(struct
seq_printf(m, "Stall check enabled, ");
else
seq_printf(m, "Stall check waiting for page flip ioctl, ");
- seq_printf(m, "%d prepares\n", work->pending);
+ seq_printf(m, "%d prepares\n", atomic_read(&work->pending));
if (work->old_fb_obj) {
struct drm_i915_gem_object *obj = work->old_fb_obj;
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1251,7 +1251,9 @@ static void i915_pageflip_stall_check(st
spin_lock_irqsave(&dev->event_lock, flags);
work = intel_crtc->unpin_work;
- if (work == NULL || work->pending || !work->enable_stall_check) {
+ if (work == NULL ||
+ atomic_read(&work->pending) >= INTEL_FLIP_COMPLETE ||
+ !work->enable_stall_check) {
/* Either the pending flip IRQ arrived, or we're too early. Don't check */
spin_unlock_irqrestore(&dev->event_lock, flags);
return;
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -7245,11 +7245,18 @@ static void do_intel_finish_page_flip(st
spin_lock_irqsave(&dev->event_lock, flags);
work = intel_crtc->unpin_work;
- if (work == NULL || !work->pending) {
+
+ /* Ensure we don't miss a work->pending update ... */
+ smp_rmb();
+
+ if (work == NULL || atomic_read(&work->pending) < INTEL_FLIP_COMPLETE) {
spin_unlock_irqrestore(&dev->event_lock, flags);
return;
}
+ /* and that the unpin work is consistent wrt ->pending. */
+ smp_rmb();
+
intel_crtc->unpin_work = NULL;
if (work->event) {
@@ -7321,16 +7328,25 @@ void intel_prepare_page_flip(struct drm_
to_intel_crtc(dev_priv->plane_to_crtc_mapping[plane]);
unsigned long flags;
+ /* NB: An MMIO update of the plane base pointer will also
+ * generate a page-flip completion irq, i.e. every modeset
+ * is also accompanied by a spurious intel_prepare_page_flip().
+ */
spin_lock_irqsave(&dev->event_lock, flags);
- if (intel_crtc->unpin_work) {
- if ((++intel_crtc->unpin_work->pending) > 1)
- DRM_ERROR("Prepared flip multiple times\n");
- } else {
- DRM_DEBUG_DRIVER("preparing flip with no unpin work?\n");
- }
+ if (intel_crtc->unpin_work)
+ atomic_inc_not_zero(&intel_crtc->unpin_work->pending);
spin_unlock_irqrestore(&dev->event_lock, flags);
}
+inline static void intel_mark_page_flip_active(struct intel_crtc *intel_crtc)
+{
+ /* Ensure that the work item is consistent when activating it ... */
+ smp_wmb();
+ atomic_set(&intel_crtc->unpin_work->pending, INTEL_FLIP_PENDING);
+ /* and that it is marked active as soon as the irq could fire. */
+ smp_wmb();
+}
+
static int intel_gen2_queue_flip(struct drm_device *dev,
struct drm_crtc *crtc,
struct drm_framebuffer *fb,
@@ -7367,6 +7383,8 @@ static int intel_gen2_queue_flip(struct
OUT_RING(fb->pitches[0]);
OUT_RING(obj->gtt_offset + offset);
OUT_RING(0); /* aux display base address, unused */
+
+ intel_mark_page_flip_active(intel_crtc);
ADVANCE_LP_RING();
return 0;
@@ -7410,6 +7428,7 @@ static int intel_gen3_queue_flip(struct
OUT_RING(obj->gtt_offset + offset);
OUT_RING(MI_NOOP);
+ intel_mark_page_flip_active(intel_crtc);
ADVANCE_LP_RING();
return 0;
@@ -7453,6 +7472,8 @@ static int intel_gen4_queue_flip(struct
pf = 0;
pipesrc = I915_READ(PIPESRC(intel_crtc->pipe)) & 0x0fff0fff;
OUT_RING(pf | pipesrc);
+
+ intel_mark_page_flip_active(intel_crtc);
ADVANCE_LP_RING();
return 0;
@@ -7494,6 +7515,8 @@ static int intel_gen6_queue_flip(struct
pf = 0;
pipesrc = I915_READ(PIPESRC(intel_crtc->pipe)) & 0x0fff0fff;
OUT_RING(pf | pipesrc);
+
+ intel_mark_page_flip_active(intel_crtc);
ADVANCE_LP_RING();
return 0;
@@ -7548,6 +7571,8 @@ static int intel_gen7_queue_flip(struct
intel_ring_emit(ring, (fb->pitches[0] | obj->tiling_mode));
intel_ring_emit(ring, (obj->gtt_offset));
intel_ring_emit(ring, (MI_NOOP));
+
+ intel_mark_page_flip_active(intel_crtc);
intel_ring_advance(ring);
return 0;
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -277,7 +277,10 @@ struct intel_unpin_work {
struct drm_i915_gem_object *old_fb_obj;
struct drm_i915_gem_object *pending_flip_obj;
struct drm_pending_vblank_event *event;
- int pending;
+ atomic_t pending;
+#define INTEL_FLIP_INACTIVE 0
+#define INTEL_FLIP_PENDING 1
+#define INTEL_FLIP_COMPLETE 2
bool enable_stall_check;
};
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 167/214] drm/i915; Only increment the user-pin-count after successfully pinning the bo
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (165 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 166/214] drm/i915: Close race between processing unpin task and queueing the flip Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 168/214] drm/i915: dump UTS_RELEASE into the error_state Greg Kroah-Hartman
` (49 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Wilson, Daniel Vetter,
Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit 93be8788e648817d62fda33e2998eb6ca6ebf3a3 upstream.
As along the error path we do not correct the user pin-count for the
failure, we may end up with userspace believing that it has a pinned
object at offset 0 (when interrupted by a signal for example).
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_gem.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3411,14 +3411,15 @@ i915_gem_pin_ioctl(struct drm_device *de
goto out;
}
- obj->user_pin_count++;
- obj->pin_filp = file;
- if (obj->user_pin_count == 1) {
+ if (obj->user_pin_count == 0) {
ret = i915_gem_object_pin(obj, args->alignment, true);
if (ret)
goto out;
}
+ obj->user_pin_count++;
+ obj->pin_filp = file;
+
/* XXX - flush the CPU caches for pinned objects
* as the X server doesn't manage domains yet
*/
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 168/214] drm/i915: dump UTS_RELEASE into the error_state
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (166 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 167/214] drm/i915; Only increment the user-pin-count after successfully pinning the bo Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 169/214] drm/i915: add missing \n to UTS_RELEASE in " Greg Kroah-Hartman
` (48 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Wilson, Daniel Vetter,
Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <daniel.vetter@ffwll.ch>
commit 4518f611ba21ba165ea3714055938a8984a44ff9 upstream.
Useful for statistics or on overflowing bug reports to keep things all
lined up.
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_debugfs.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -30,6 +30,7 @@
#include <linux/debugfs.h>
#include <linux/slab.h>
#include <linux/export.h>
+#include <generated/utsrelease.h>
#include "drmP.h"
#include "drm.h"
#include "intel_drv.h"
@@ -750,6 +751,7 @@ static int i915_error_state(struct seq_f
seq_printf(m, "Time: %ld s %ld us\n", error->time.tv_sec,
error->time.tv_usec);
+ seq_printf(m, "Kernel: " UTS_RELEASE);
seq_printf(m, "PCI ID: 0x%04x\n", dev->pci_device);
seq_printf(m, "EIR: 0x%08x\n", error->eir);
seq_printf(m, "PGTBL_ER: 0x%08x\n", error->pgtbl_er);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 169/214] drm/i915: add missing \n to UTS_RELEASE in the error_state
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (167 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 168/214] drm/i915: dump UTS_RELEASE into the error_state Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 170/214] drm/i915: panel: invert brightness via parameter Greg Kroah-Hartman
` (47 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jani Nikula, Chris Wilson,
Daniel Vetter, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
commit fdfa175d0a9cfa2082ce24e67e284e5acbba452a upstream.
Amending
commit 4518f611ba21ba165ea3714055938a8984a44ff9
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date: Wed Jan 23 16:16:35 2013 +0100
drm/i915: dump UTS_RELEASE into the error_state
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -751,7 +751,7 @@ static int i915_error_state(struct seq_f
seq_printf(m, "Time: %ld s %ld us\n", error->time.tv_sec,
error->time.tv_usec);
- seq_printf(m, "Kernel: " UTS_RELEASE);
+ seq_printf(m, "Kernel: " UTS_RELEASE "\n");
seq_printf(m, "PCI ID: 0x%04x\n", dev->pci_device);
seq_printf(m, "EIR: 0x%08x\n", error->eir);
seq_printf(m, "PGTBL_ER: 0x%08x\n", error->pgtbl_er);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 170/214] drm/i915: panel: invert brightness via parameter
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (168 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 169/214] drm/i915: add missing \n to UTS_RELEASE in " Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 171/214] drm/i915: panel: invert brightness via quirk Greg Kroah-Hartman
` (46 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Carsten Emde, Chris Wilson,
Daniel Vetter, Jani Nikula, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carsten Emde <C.Emde@osadl.org>
commit 7bd90909bbf9ce7c40e1da3d72b97b93839c188a upstream.
Following the documentation of the Legacy Backlight Brightness (LBB)
Register in the configuration space of some Intel PCI graphics adapters,
setting the LBB register with the value 0x0 causes the backlight to be
turned off, and 0xFF causes the backlight to be set to 100% intensity
(http://download.intel.com/embedded/processors/Whitepaper/324567.pdf).
The Acer Aspire 5734Z, however, turns the backlight off at 0xFF and sets
it to maximum intensity at 0. In consequence, the screen of this systems
becomes dark at an early boot stage which makes it unusable. The same
inversion applies to the BLC_PWM_CTL I915 register. This problem was
introduced in kernel version 2.6.38 when the PCI device of this system
was first supported by the i915 KMS module.
This patch adds a parameter to the i915 module to enable inversion of
the brightness variable (i915.invert_brightness).
Signed-off-by: Carsten Emde <C.Emde@osadl.org>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/kernel-parameters.txt | 9 +++++++++
drivers/gpu/drm/i915/intel_panel.c | 17 +++++++++++++++++
2 files changed, 26 insertions(+)
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -993,6 +993,15 @@ bytes respectively. Such letter suffixes
i8k.restricted [HW] Allow controlling fans only if SYS_ADMIN
capability is set.
+ i915.invert_brightness
+ [DRM] Invert the sense of the variable that is used to
+ set the brightness of the panel backlight. Normally a
+ value of 0 indicates backlight switched off, and the
+ maximum value sets the backlight to maximum brightness.
+ If this parameter is specified, a value of 0 sets the
+ backlight to maximum brightness, and the maximum value
+ switches the backlight off.
+
icn= [HW,ISDN]
Format: <io>[,<membase>[,<icn_id>[,<icn_id2>]]]
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -28,6 +28,7 @@
* Chris Wilson <chris@chris-wilson.co.uk>
*/
+#include <linux/moduleparam.h>
#include "intel_drv.h"
#define PCI_LBPC 0xf4 /* legacy/combination backlight modes */
@@ -189,6 +190,20 @@ u32 intel_panel_get_max_backlight(struct
return max;
}
+static bool i915_panel_invert_brightness;
+MODULE_PARM_DESC(invert_brightness, "Invert backlight brightness, please "
+ "report PCI device ID, subsystem vendor and subsystem device ID "
+ "to dri-devel@lists.freedesktop.org, if your machine needs it. "
+ "It will then be included in an upcoming module version.");
+module_param_named(invert_brightness, i915_panel_invert_brightness, bool, 0600);
+static u32 intel_panel_compute_brightness(struct drm_device *dev, u32 val)
+{
+ if (i915_panel_invert_brightness)
+ return intel_panel_get_max_backlight(dev) - val;
+
+ return val;
+}
+
u32 intel_panel_get_backlight(struct drm_device *dev)
{
struct drm_i915_private *dev_priv = dev->dev_private;
@@ -209,6 +224,7 @@ u32 intel_panel_get_backlight(struct drm
}
}
+ val = intel_panel_compute_brightness(dev, val);
DRM_DEBUG_DRIVER("get backlight PWM = %d\n", val);
return val;
}
@@ -226,6 +242,7 @@ static void intel_panel_actually_set_bac
u32 tmp;
DRM_DEBUG_DRIVER("set backlight PWM = %d\n", level);
+ level = intel_panel_compute_brightness(dev, level);
if (HAS_PCH_SPLIT(dev))
return intel_pch_panel_set_backlight(dev, level);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 171/214] drm/i915: panel: invert brightness via quirk
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (169 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 170/214] drm/i915: panel: invert brightness via parameter Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 172/214] drm/i915: panel: invert brightness acer aspire 5734z Greg Kroah-Hartman
` (45 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Carsten Emde, Chris Wilson,
Daniel Vetter, Jani Nikula, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carsten Emde <C.Emde@osadl.org>
commit 4dca20efb1a9c2efefc28ad2867e5d6c3f5e1955 upstream.
A machine may need to invert the panel backlight brightness value. This
patch adds the infrastructure for a quirk to do so.
Signed-off-by: Carsten Emde <C.Emde@osadl.org>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[wml: Backported to 3.4:
- Adjust context
- one more flag QUIRK_NO_PCH_PWM_ENABLE]
Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/kernel-parameters.txt | 17 +++++++++++------
drivers/gpu/drm/i915/i915_drv.h | 3 ++-
drivers/gpu/drm/i915/intel_display.c | 9 +++++++++
drivers/gpu/drm/i915/intel_panel.c | 15 +++++++++++----
4 files changed, 33 insertions(+), 11 deletions(-)
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -993,14 +993,19 @@ bytes respectively. Such letter suffixes
i8k.restricted [HW] Allow controlling fans only if SYS_ADMIN
capability is set.
- i915.invert_brightness
+ i915.invert_brightness=
[DRM] Invert the sense of the variable that is used to
set the brightness of the panel backlight. Normally a
- value of 0 indicates backlight switched off, and the
- maximum value sets the backlight to maximum brightness.
- If this parameter is specified, a value of 0 sets the
- backlight to maximum brightness, and the maximum value
- switches the backlight off.
+ brightness value of 0 indicates backlight switched off,
+ and the maximum of the brightness value sets the backlight
+ to maximum brightness. If this parameter is set to 0
+ (default) and the machine requires it, or this parameter
+ is set to 1, a brightness value of 0 sets the backlight
+ to maximum brightness, and the maximum of the brightness
+ value switches the backlight off.
+ -1 -- never invert brightness
+ 0 -- machine default
+ 1 -- force brightness inversion
icn= [HW,ISDN]
Format: <io>[,<membase>[,<icn_id>[,<icn_id2>]]]
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -296,7 +296,8 @@ enum intel_pch {
#define QUIRK_PIPEA_FORCE (1<<0)
#define QUIRK_LVDS_SSC_DISABLE (1<<1)
-#define QUIRK_NO_PCH_PWM_ENABLE (1<<2)
+#define QUIRK_INVERT_BRIGHTNESS (1<<2)
+#define QUIRK_NO_PCH_PWM_ENABLE (1<<3)
struct intel_fbdev;
struct intel_fbc_work;
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9200,6 +9200,15 @@ static void quirk_no_pcm_pwm_enable(stru
DRM_INFO("applying no-PCH_PWM_ENABLE quirk\n");
}
+/*
+ * A machine may need to invert the panel backlight brightness value
+ */
+static void quirk_invert_brightness(struct drm_device *dev)
+{
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ dev_priv->quirks |= QUIRK_INVERT_BRIGHTNESS;
+}
+
struct intel_quirk {
int device;
int subsystem_vendor;
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -190,15 +190,22 @@ u32 intel_panel_get_max_backlight(struct
return max;
}
-static bool i915_panel_invert_brightness;
-MODULE_PARM_DESC(invert_brightness, "Invert backlight brightness, please "
+static int i915_panel_invert_brightness;
+MODULE_PARM_DESC(invert_brightness, "Invert backlight brightness "
+ "(-1 force normal, 0 machine defaults, 1 force inversion), please "
"report PCI device ID, subsystem vendor and subsystem device ID "
"to dri-devel@lists.freedesktop.org, if your machine needs it. "
"It will then be included in an upcoming module version.");
-module_param_named(invert_brightness, i915_panel_invert_brightness, bool, 0600);
+module_param_named(invert_brightness, i915_panel_invert_brightness, int, 0600);
static u32 intel_panel_compute_brightness(struct drm_device *dev, u32 val)
{
- if (i915_panel_invert_brightness)
+ struct drm_i915_private *dev_priv = dev->dev_private;
+
+ if (i915_panel_invert_brightness < 0)
+ return val;
+
+ if (i915_panel_invert_brightness > 0 ||
+ dev_priv->quirks & QUIRK_INVERT_BRIGHTNESS)
return intel_panel_get_max_backlight(dev) - val;
return val;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 172/214] drm/i915: panel: invert brightness acer aspire 5734z
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (170 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 171/214] drm/i915: panel: invert brightness via quirk Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 173/214] drm/i915: add quirk to invert brightness on eMachines G725 Greg Kroah-Hartman
` (44 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Carsten Emde, Chris Wilson,
Daniel Vetter, Jani Nikula, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
commit 5a15ab5b93e4a3ebcd4fa6c76cf646a45e9cf806 upstream.
Mark the Acer Aspire 5734Z that this machines requires the module to
invert the panel backlight brightness value after reading from and prior
to writing to the PCI configuration space.
Signed-off-by: Carsten Emde <C.Emde@osadl.org>
Acked-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[wml: Backported to 3.4: Adjust context]
Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_display.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9201,7 +9201,8 @@ static void quirk_no_pcm_pwm_enable(stru
}
/*
- * A machine may need to invert the panel backlight brightness value
+ * A machine (e.g. Acer Aspire 5734Z) may need to invert the panel backlight
+ * brightness value
*/
static void quirk_invert_brightness(struct drm_device *dev)
{
@@ -9242,6 +9243,9 @@ struct intel_quirk intel_quirks[] = {
/* Sony Vaio Y cannot use SSC on LVDS */
{ 0x0046, 0x104d, 0x9076, quirk_ssc_force_disable },
+ /* Acer Aspire 5734Z must invert backlight brightness */
+ { 0x2a42, 0x1025, 0x0459, quirk_invert_brightness },
+
/* Dell XPS13 HD Sandy Bridge */
{ 0x0116, 0x1028, 0x052e, quirk_no_pcm_pwm_enable },
/* Dell XPS13 HD and XPS13 FHD Ivy Bridge */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 173/214] drm/i915: add quirk to invert brightness on eMachines G725
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (171 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 172/214] drm/i915: panel: invert brightness acer aspire 5734z Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 174/214] drm/i915: add quirk to invert brightness on eMachines e725 Greg Kroah-Hartman
` (43 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Roland Gruber, Jani Nikula,
Daniel Vetter, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
commit 1ffff60320879830e469e26062c18f75236822ba upstream.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=59628
Reported-by: Roland Gruber <post@rolandgruber.de>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[wml: Backported to 3.4: Adjust context]
Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_display.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9246,6 +9246,9 @@ struct intel_quirk intel_quirks[] = {
/* Acer Aspire 5734Z must invert backlight brightness */
{ 0x2a42, 0x1025, 0x0459, quirk_invert_brightness },
+ /* Acer/eMachines G725 */
+ { 0x2a42, 0x1025, 0x0210, quirk_invert_brightness },
+
/* Dell XPS13 HD Sandy Bridge */
{ 0x0116, 0x1028, 0x052e, quirk_no_pcm_pwm_enable },
/* Dell XPS13 HD and XPS13 FHD Ivy Bridge */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 174/214] drm/i915: add quirk to invert brightness on eMachines e725
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (172 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 173/214] drm/i915: add quirk to invert brightness on eMachines G725 Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 175/214] drm/i915: add quirk to invert brightness on Packard Bell NCL20 Greg Kroah-Hartman
` (42 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martins, Jani Nikula, Daniel Vetter,
Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
commit 01e3a8feb40e54b962a20fa7eb595c5efef5e109 upstream.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=31522#c35
[Note: There are more than one broken setups in the bug. This fixes one.]
Reported-by: Martins <andrissr@inbox.lv>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[wml: Backported to 3.4: Adjust context]
Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_display.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9249,6 +9249,9 @@ struct intel_quirk intel_quirks[] = {
/* Acer/eMachines G725 */
{ 0x2a42, 0x1025, 0x0210, quirk_invert_brightness },
+ /* Acer/eMachines e725 */
+ { 0x2a42, 0x1025, 0x0212, quirk_invert_brightness },
+
/* Dell XPS13 HD Sandy Bridge */
{ 0x0116, 0x1028, 0x052e, quirk_no_pcm_pwm_enable },
/* Dell XPS13 HD and XPS13 FHD Ivy Bridge */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 175/214] drm/i915: add quirk to invert brightness on Packard Bell NCL20
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (173 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 174/214] drm/i915: add quirk to invert brightness on eMachines e725 Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:18 ` [PATCH 3.4 176/214] DRM/i915: Add QUIRK_INVERT_BRIGHTNESS for NCR machines Greg Kroah-Hartman
` (41 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alan Zimmerman, Jani Nikula,
Daniel Vetter, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
commit 5559ecadad5a73b27f863e92f4b4f369501dce6f upstream.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=44156
Reported-by: Alan Zimmerman <alan.zimm@gmail.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[wml: Backported to 3.4: Adjust context]
Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_display.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9252,6 +9252,9 @@ struct intel_quirk intel_quirks[] = {
/* Acer/eMachines e725 */
{ 0x2a42, 0x1025, 0x0212, quirk_invert_brightness },
+ /* Acer/Packard Bell NCL20 */
+ { 0x2a42, 0x1025, 0x034b, quirk_invert_brightness },
+
/* Dell XPS13 HD Sandy Bridge */
{ 0x0116, 0x1028, 0x052e, quirk_no_pcm_pwm_enable },
/* Dell XPS13 HD and XPS13 FHD Ivy Bridge */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 176/214] DRM/i915: Add QUIRK_INVERT_BRIGHTNESS for NCR machines.
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (174 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 175/214] drm/i915: add quirk to invert brightness on Packard Bell NCL20 Greg Kroah-Hartman
@ 2014-06-05 4:18 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 177/214] drm/radeon: use frac fb div on RS780/RS880 Greg Kroah-Hartman
` (40 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Egbert Eich, Daniel Vetter,
Jani Nikula, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Egbert Eich <eich@suse.de>
commit 5f85f176c2f1c9d2a23f60ca0b99e4d0aa5a26a7 upstream.
NCR machines with LVDS panels using Intel chipsets need to have the
QUIRK_INVERT_BRIGHTNESS bit set.
Unfortunately NCR doesn't set a meaningful subvendor/subdevice ID,
therefore we add a DMI dependent quirk list.
Signed-off-by: Egbert Eich <eich@suse.de>
[danvet: fixup whitespace fail.]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Jani Nikula <jani.nikula@intel.com>
[bwh: Backported to 3.2:
- Adjust context
- Add #include <linux/dmi.h>]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_display.c | 33 +++++++++++++++++++++++++++++++++
1 file changed, 33 insertions(+)
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -25,6 +25,7 @@
*/
#include <linux/cpufreq.h>
+#include <linux/dmi.h>
#include <linux/module.h>
#include <linux/input.h>
#include <linux/i2c.h>
@@ -9217,6 +9218,34 @@ struct intel_quirk {
void (*hook)(struct drm_device *dev);
};
+/* For systems that don't have a meaningful PCI subdevice/subvendor ID */
+struct intel_dmi_quirk {
+ void (*hook)(struct drm_device *dev);
+ const struct dmi_system_id (*dmi_id_list)[];
+};
+
+static int intel_dmi_reverse_brightness(const struct dmi_system_id *id)
+{
+ DRM_INFO("Backlight polarity reversed on %s\n", id->ident);
+ return 1;
+}
+
+static const struct intel_dmi_quirk intel_dmi_quirks[] = {
+ {
+ .dmi_id_list = &(const struct dmi_system_id[]) {
+ {
+ .callback = intel_dmi_reverse_brightness,
+ .ident = "NCR Corporation",
+ .matches = {DMI_MATCH(DMI_SYS_VENDOR, "NCR Corporation"),
+ DMI_MATCH(DMI_PRODUCT_NAME, ""),
+ },
+ },
+ { } /* terminating entry */
+ },
+ .hook = quirk_invert_brightness,
+ },
+};
+
struct intel_quirk intel_quirks[] = {
/* HP Mini needs pipe A force quirk (LP: #322104) */
{ 0x27ae, 0x103c, 0x361a, quirk_pipea_force },
@@ -9276,6 +9305,10 @@ static void intel_init_quirks(struct drm
q->subsystem_device == PCI_ANY_ID))
q->hook(dev);
}
+ for (i = 0; i < ARRAY_SIZE(intel_dmi_quirks); i++) {
+ if (dmi_check_system(*intel_dmi_quirks[i].dmi_id_list) != 0)
+ intel_dmi_quirks[i].hook(dev);
+ }
}
/* Disable the VGA plane that we never use */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 177/214] drm/radeon: use frac fb div on RS780/RS880
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (175 preceding siblings ...)
2014-06-05 4:18 ` [PATCH 3.4 176/214] DRM/i915: Add QUIRK_INVERT_BRIGHTNESS for NCR machines Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 178/214] drm/radeon: cleanup properly if mmio mapping fails Greg Kroah-Hartman
` (39 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Deucher, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 411678288d61ba17afe1f8afed92200be6bbc65d upstream.
Monitors seem to prefer it. Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=37696
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[bwh: Backported to 3.2:
- Adjust context
- Add to pll->flags, not radeon_crtc->pll_flags]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/atombios_crtc.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -573,6 +573,9 @@ static u32 atombios_adjust_pll(struct dr
/* use frac fb div on APUs */
if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev))
pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
+ /* use frac fb div on RS780/RS880 */
+ if ((rdev->family == CHIP_RS780) || (rdev->family == CHIP_RS880))
+ pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
if (ASIC_IS_DCE32(rdev) && mode->clock > 165000)
pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
} else {
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 178/214] drm/radeon: cleanup properly if mmio mapping fails
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (176 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 177/214] drm/radeon: use frac fb div on RS780/RS880 Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 179/214] drm/i915: Workaround incoherence between fences and LLC across multiple CPUs Greg Kroah-Hartman
` (38 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Deucher, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 0cd9cb76ae26a19df21abc6f94f5fff141e689c7 upstream.
If we fail to map the mmio BAR, skip driver tear down
that requires mmio.
Should fix:
https://bugzilla.kernel.org/show_bug.cgi?id=56541
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_kms.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -39,8 +39,12 @@ int radeon_driver_unload_kms(struct drm_
if (rdev == NULL)
return 0;
+ if (rdev->rmmio == NULL)
+ goto done_free;
radeon_modeset_fini(rdev);
radeon_device_fini(rdev);
+
+done_free:
kfree(rdev);
dev->dev_private = NULL;
return 0;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 179/214] drm/i915: Workaround incoherence between fences and LLC across multiple CPUs
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (177 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 178/214] drm/radeon: cleanup properly if mmio mapping fails Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 180/214] drm/i915: ensure single initialization and cleanup of backlight device Greg Kroah-Hartman
` (37 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Wilson, Jon Bloomfield,
Jesse Barnes, Daniel Vetter, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit 25ff1195f8a0b3724541ae7bbe331b4296de9c06 upstream.
In order to fully serialize access to the fenced region and the update
to the fence register we need to take extreme measures on SNB+, and
manually flush writes to memory prior to writing the fence register in
conjunction with the memory barriers placed around the register write.
Fixes i-g-t/gem_fence_thrash
v2: Bring a bigger gun
v3: Switch the bigger gun for heavier bullets (Arjan van de Ven)
v4: Remove changes for working generations.
v5: Reduce to a per-cpu wbinvd() call prior to updating the fences.
v6: Rewrite comments to ellide forgotten history.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=62191
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Jon Bloomfield <jon.bloomfield@intel.com>
Tested-by: Jon Bloomfield <jon.bloomfield@intel.com> (v2)
Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
[bwh: Backported to 3.2: insert the cache flush in i915_gem_object_get_fence()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_gem.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2468,6 +2468,11 @@ i915_find_fence_reg(struct drm_device *d
return avail;
}
+static void i915_gem_write_fence__ipi(void *data)
+{
+ wbinvd();
+}
+
/**
* i915_gem_object_get_fence - set up a fence reg for an object
* @obj: object to map through a fence reg
@@ -2589,6 +2594,17 @@ update:
switch (INTEL_INFO(dev)->gen) {
case 7:
case 6:
+ /* In order to fully serialize access to the fenced region and
+ * the update to the fence register we need to take extreme
+ * measures on SNB+. In theory, the write to the fence register
+ * flushes all memory transactions before, and coupled with the
+ * mb() placed around the register write we serialise all memory
+ * operations with respect to the changes in the tiler. Yet, on
+ * SNB+ we need to take a step further and emit an explicit wbinvd()
+ * on each processor in order to manually flush all memory
+ * transactions before updating the fence register.
+ */
+ on_each_cpu(i915_gem_write_fence__ipi, NULL, 1);
ret = sandybridge_write_fence_reg(obj, pipelined);
break;
case 5:
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 180/214] drm/i915: ensure single initialization and cleanup of backlight device
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (178 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 179/214] drm/i915: Workaround incoherence between fences and LLC across multiple CPUs Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 181/214] drm/radeon: Another card with wrong primary dac adj Greg Kroah-Hartman
` (36 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jani Nikula, Peter Verthez,
Daniel Vetter, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
commit dc652f90e088798bfa31f496ba994ddadd5d5680 upstream.
Backlight cleanup in the eDP connector destroy callback caused the
backlight device to be removed on some systems that first initialized LVDS
and then attempted to initialize eDP. Prevent multiple backlight
initializations, and ensure backlight cleanup is only done once by moving
it to modeset cleanup.
A small wrinkle is the introduced asymmetry in backlight
setup/cleanup. This could be solved by adding refcounting, but it seems
overkill considering that there should only ever be one backlight device.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=55701
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Tested-by: Peter Verthez <peter.verthez@skynet.be>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
[bwh: Backported to 3.2:
- Adjust context
- s/dev_priv->backlight\.device/dev_priv->backlight/]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_display.c | 3 +++
drivers/gpu/drm/i915/intel_dp.c | 5 -----
drivers/gpu/drm/i915/intel_lvds.c | 2 --
drivers/gpu/drm/i915/intel_panel.c | 7 ++++++-
4 files changed, 9 insertions(+), 8 deletions(-)
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9471,6 +9471,9 @@ void intel_modeset_cleanup(struct drm_de
del_timer_sync(&dev_priv->idle_timer);
cancel_work_sync(&dev_priv->idle_work);
+ /* destroy backlight, if any, before the connectors */
+ intel_panel_destroy_backlight(dev);
+
drm_mode_config_cleanup(dev);
}
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -2289,11 +2289,6 @@ done:
static void
intel_dp_destroy(struct drm_connector *connector)
{
- struct drm_device *dev = connector->dev;
-
- if (intel_dpd_is_edp(dev))
- intel_panel_destroy_backlight(dev);
-
drm_sysfs_connector_remove(connector);
drm_connector_cleanup(connector);
kfree(connector);
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -553,8 +553,6 @@ static void intel_lvds_destroy(struct dr
struct drm_device *dev = connector->dev;
struct drm_i915_private *dev_priv = dev->dev_private;
- intel_panel_destroy_backlight(dev);
-
if (dev_priv->lid_notifier.notifier_call)
acpi_lid_notifier_unregister(&dev_priv->lid_notifier);
drm_sysfs_connector_remove(connector);
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -359,6 +359,9 @@ int intel_panel_setup_backlight(struct d
intel_panel_init_backlight(dev);
+ if (WARN_ON(dev_priv->backlight))
+ return -ENODEV;
+
if (dev_priv->int_lvds_connector)
connector = dev_priv->int_lvds_connector;
else if (dev_priv->int_edp_connector)
@@ -386,8 +389,10 @@ int intel_panel_setup_backlight(struct d
void intel_panel_destroy_backlight(struct drm_device *dev)
{
struct drm_i915_private *dev_priv = dev->dev_private;
- if (dev_priv->backlight)
+ if (dev_priv->backlight) {
backlight_device_unregister(dev_priv->backlight);
+ dev_priv->backlight = NULL;
+ }
}
#else
int intel_panel_setup_backlight(struct drm_device *dev)
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 181/214] drm/radeon: Another card with wrong primary dac adj
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (179 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 180/214] drm/i915: ensure single initialization and cleanup of backlight device Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 182/214] drm/i915: try not to lose backlight CBLV precision Greg Kroah-Hartman
` (35 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ondrej Zary, Alex Deucher,
Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Zary <linux@rainbow-software.org>
commit f7929f34fa0e0bb6736a2484fdc07d77a1653081 upstream.
Hello,
got another card with "too bright" problem:
Sapphire Radeon VE 7000 DDR (VGA+S-Video)
lspci -vnn:
01:00.0 VGA compatible controller [0300]: Advanced Micro Devices [AMD] nee ATI RV100 QY [Radeon 7000/VE] [1002:5159] (prog-if 00 [VGA controller])
Subsystem: PC Partner Limited Sapphire Radeon VE 7000 DDR [174b:7c28]
The patch below fixes the problem for this card.
But I don't like the blacklist, couldn't some heuristic be used instead?
The interesting thing is that the manufacturer is the same as the other card
needing the same quirk. I wonder how many different types are broken this way.
The "wrong" ps2_pdac_adj value that comes from BIOS on this card is 0x300.
====================
drm/radeon: Add primary dac adj quirk for Sapphire Radeon VE 7000 DDR
Values from BIOS are wrong, causing too bright colors.
Use default values instead.
Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_combios.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -898,10 +898,14 @@ struct radeon_encoder_primary_dac *radeo
}
/* quirks */
+ /* Radeon 7000 (RV100) */
+ if (((dev->pdev->device == 0x5159) &&
+ (dev->pdev->subsystem_vendor == 0x174B) &&
+ (dev->pdev->subsystem_device == 0x7c28)) ||
/* Radeon 9100 (R200) */
- if ((dev->pdev->device == 0x514D) &&
+ ((dev->pdev->device == 0x514D) &&
(dev->pdev->subsystem_vendor == 0x174B) &&
- (dev->pdev->subsystem_device == 0x7149)) {
+ (dev->pdev->subsystem_device == 0x7149))) {
/* vbios value is bad, use the default */
found = 0;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 182/214] drm/i915: try not to lose backlight CBLV precision
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (180 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 181/214] drm/radeon: Another card with wrong primary dac adj Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 183/214] drm/radeon: fix panel scaling with eDP and LVDS bridges Greg Kroah-Hartman
` (34 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aaron Lu, Jani Nikula, Daniel Vetter,
Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
commit cac6a5ae0118832936eb162ec4cedb30f2422bcc upstream.
ACPI has _BCM and _BQC methods to set and query the backlight
brightness, respectively. The ACPI opregion has variables BCLP and CBLV
to hold the requested and current backlight brightness, respectively.
The BCLP variable has range 0..255 while the others have range
0..100. This means the _BCM method has to scale the brightness for BCLP,
and the gfx driver has to scale the requested value back for CBLV. If
the _BQC method uses the CBLV variable (apparently some implementations
do, some don't) for current backlight level reporting, there's room for
rounding errors.
Use DIV_ROUND_UP for scaling back to CBLV to get back to the same values
that were passed to _BCM, presuming the _BCM simply uses bclp = (in *
255) / 100 for scaling to BCLP.
Reference: https://gist.github.com/aaronlu/6314920
Reported-by: Aaron Lu <aaron.lu@intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Reviewed-by: Aaron Lu <aaron.lu@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
[bwh: Backported to 3.2:
- Adjust context
- ASLE region is treated as normal memory rather than __iomem]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_opregion.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -161,7 +161,7 @@ static u32 asle_set_backlight(struct drm
max = intel_panel_get_max_backlight(dev);
intel_panel_set_backlight(dev, bclp * max / 255);
- asle->cblv = (bclp*0x64)/0xff | ASLE_CBLV_VALID;
+ asle->cblv = DIV_ROUND_UP(bclp * 100, 255) | ASLE_CBLV_VALID;
return 0;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 183/214] drm/radeon: fix panel scaling with eDP and LVDS bridges
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (181 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 182/214] drm/i915: try not to lose backlight CBLV precision Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` Greg Kroah-Hartman
` (33 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Deucher, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 855f5f1d882a34e4e9dd27b299737cd3508a5624 upstream.
We were using the wrong set_properly callback so we always
ended up with Full scaling even if something else (Center or
Full aspect) was selected.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_connectors.c | 34 ++++++++++++++++++++++++++---
1 file changed, 31 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1423,6 +1423,24 @@ struct drm_connector_funcs radeon_dp_con
.force = radeon_dvi_force,
};
+static const struct drm_connector_funcs radeon_edp_connector_funcs = {
+ .dpms = drm_helper_connector_dpms,
+ .detect = radeon_dp_detect,
+ .fill_modes = drm_helper_probe_single_connector_modes,
+ .set_property = radeon_lvds_set_property,
+ .destroy = radeon_dp_connector_destroy,
+ .force = radeon_dvi_force,
+};
+
+static const struct drm_connector_funcs radeon_lvds_bridge_connector_funcs = {
+ .dpms = drm_helper_connector_dpms,
+ .detect = radeon_dp_detect,
+ .fill_modes = drm_helper_probe_single_connector_modes,
+ .set_property = radeon_lvds_set_property,
+ .destroy = radeon_dp_connector_destroy,
+ .force = radeon_dvi_force,
+};
+
void
radeon_add_atom_connector(struct drm_device *dev,
uint32_t connector_id,
@@ -1514,8 +1532,6 @@ radeon_add_atom_connector(struct drm_dev
goto failed;
radeon_dig_connector->igp_lane_info = igp_lane_info;
radeon_connector->con_priv = radeon_dig_connector;
- drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type);
- drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs);
if (i2c_bus->valid) {
/* add DP i2c bus */
if (connector_type == DRM_MODE_CONNECTOR_eDP)
@@ -1532,6 +1548,10 @@ radeon_add_atom_connector(struct drm_dev
case DRM_MODE_CONNECTOR_VGA:
case DRM_MODE_CONNECTOR_DVIA:
default:
+ drm_connector_init(dev, &radeon_connector->base,
+ &radeon_dp_connector_funcs, connector_type);
+ drm_connector_helper_add(&radeon_connector->base,
+ &radeon_dp_connector_helper_funcs);
connector->interlace_allowed = true;
connector->doublescan_allowed = true;
radeon_connector->dac_load_detect = true;
@@ -1544,6 +1564,10 @@ radeon_add_atom_connector(struct drm_dev
case DRM_MODE_CONNECTOR_HDMIA:
case DRM_MODE_CONNECTOR_HDMIB:
case DRM_MODE_CONNECTOR_DisplayPort:
+ drm_connector_init(dev, &radeon_connector->base,
+ &radeon_dp_connector_funcs, connector_type);
+ drm_connector_helper_add(&radeon_connector->base,
+ &radeon_dp_connector_helper_funcs);
drm_connector_attach_property(&radeon_connector->base,
rdev->mode_info.underscan_property,
UNDERSCAN_OFF);
@@ -1568,6 +1592,10 @@ radeon_add_atom_connector(struct drm_dev
break;
case DRM_MODE_CONNECTOR_LVDS:
case DRM_MODE_CONNECTOR_eDP:
+ drm_connector_init(dev, &radeon_connector->base,
+ &radeon_lvds_bridge_connector_funcs, connector_type);
+ drm_connector_helper_add(&radeon_connector->base,
+ &radeon_dp_connector_helper_funcs);
drm_connector_attach_property(&radeon_connector->base,
dev->mode_config.scaling_mode_property,
DRM_MODE_SCALE_FULLSCREEN);
@@ -1731,7 +1759,7 @@ radeon_add_atom_connector(struct drm_dev
goto failed;
radeon_dig_connector->igp_lane_info = igp_lane_info;
radeon_connector->con_priv = radeon_dig_connector;
- drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type);
+ drm_connector_init(dev, &radeon_connector->base, &radeon_edp_connector_funcs, connector_type);
drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs);
if (i2c_bus->valid) {
/* add DP i2c bus */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 184/214] drm: Pad drm_mode_get_connector to 64-bit boundary
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:16 ` [PATCH 3.4 002/214] mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages() Greg Kroah-Hartman
` (215 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Roskin, Chris Wilson,
Dave Airlie, Ben Hutchings, Weng Meiling, dri-devel
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit bc5bd37ce48c66e9192ad2e7231e9678880f6f8e upstream.
Pavel Roskin reported that DRM_IOCTL_MODE_GETCONNECTOR was overwritting
the 4 bytes beyond the end of its structure with a 32-bit userspace
running on a 64-bit kernel. This is due to the padding gcc inserts as
the drm_mode_get_connector struct includes a u64 and its size is not a
natural multiple of u64s.
64-bit kernel:
sizeof(drm_mode_get_connector)=80, alignof=8
sizeof(drm_mode_get_encoder)=20, alignof=4
sizeof(drm_mode_modeinfo)=68, alignof=4
32-bit userspace:
sizeof(drm_mode_get_connector)=76, alignof=4
sizeof(drm_mode_get_encoder)=20, alignof=4
sizeof(drm_mode_modeinfo)=68, alignof=4
Fortuituously we can insert explicit padding to the tail of our
structures without breaking ABI.
Reported-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Dave Airlie <airlied@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/drm/drm_mode.h | 2 ++
1 file changed, 2 insertions(+)
--- a/include/drm/drm_mode.h
+++ b/include/drm/drm_mode.h
@@ -223,6 +223,8 @@ struct drm_mode_get_connector {
__u32 connection;
__u32 mm_width, mm_height; /**< HxW in millimeters */
__u32 subpixel;
+
+ __u32 pad;
};
#define DRM_MODE_PROP_PENDING (1<<0)
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 184/214] drm: Pad drm_mode_get_connector to 64-bit boundary
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
0 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Pavel Roskin, Greg Kroah-Hartman, stable, Weng Meiling,
dri-devel, Dave Airlie, Ben Hutchings
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit bc5bd37ce48c66e9192ad2e7231e9678880f6f8e upstream.
Pavel Roskin reported that DRM_IOCTL_MODE_GETCONNECTOR was overwritting
the 4 bytes beyond the end of its structure with a 32-bit userspace
running on a 64-bit kernel. This is due to the padding gcc inserts as
the drm_mode_get_connector struct includes a u64 and its size is not a
natural multiple of u64s.
64-bit kernel:
sizeof(drm_mode_get_connector)=80, alignof=8
sizeof(drm_mode_get_encoder)=20, alignof=4
sizeof(drm_mode_modeinfo)=68, alignof=4
32-bit userspace:
sizeof(drm_mode_get_connector)=76, alignof=4
sizeof(drm_mode_get_encoder)=20, alignof=4
sizeof(drm_mode_modeinfo)=68, alignof=4
Fortuituously we can insert explicit padding to the tail of our
structures without breaking ABI.
Reported-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Dave Airlie <airlied@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/drm/drm_mode.h | 2 ++
1 file changed, 2 insertions(+)
--- a/include/drm/drm_mode.h
+++ b/include/drm/drm_mode.h
@@ -223,6 +223,8 @@ struct drm_mode_get_connector {
__u32 connection;
__u32 mm_width, mm_height; /**< HxW in millimeters */
__u32 subpixel;
+
+ __u32 pad;
};
#define DRM_MODE_PROP_PENDING (1<<0)
^ permalink raw reply [flat|nested] 234+ messages in thread
* [PATCH 3.4 185/214] drm/ttm: Fix memory type compatibility check
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (183 preceding siblings ...)
2014-06-05 4:19 ` Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 186/214] drm/radeon: fix hdmi mode enable on RS600/RS690/RS740 Greg Kroah-Hartman
` (31 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Hellstrom, Jakob Bornecrantz,
Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellstrom <thellstrom@vmware.com>
commit 59c8e66378fb78adbcd05f0d09783dde6fef282b upstream.
Also check the busy placements before deciding to move a buffer object.
Failing to do this may result in a completely unneccessary move within a
single memory type.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ttm/ttm_bo.c | 32 ++++++++++++++++++++------------
1 file changed, 20 insertions(+), 12 deletions(-)
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1091,24 +1091,32 @@ out_unlock:
return ret;
}
-static int ttm_bo_mem_compat(struct ttm_placement *placement,
- struct ttm_mem_reg *mem)
+static bool ttm_bo_mem_compat(struct ttm_placement *placement,
+ struct ttm_mem_reg *mem,
+ uint32_t *new_flags)
{
int i;
if (mem->mm_node && placement->lpfn != 0 &&
(mem->start < placement->fpfn ||
mem->start + mem->num_pages > placement->lpfn))
- return -1;
+ return false;
for (i = 0; i < placement->num_placement; i++) {
- if ((placement->placement[i] & mem->placement &
- TTM_PL_MASK_CACHING) &&
- (placement->placement[i] & mem->placement &
- TTM_PL_MASK_MEM))
- return i;
+ *new_flags = placement->placement[i];
+ if ((*new_flags & mem->placement & TTM_PL_MASK_CACHING) &&
+ (*new_flags & mem->placement & TTM_PL_MASK_MEM))
+ return true;
}
- return -1;
+
+ for (i = 0; i < placement->num_busy_placement; i++) {
+ *new_flags = placement->busy_placement[i];
+ if ((*new_flags & mem->placement & TTM_PL_MASK_CACHING) &&
+ (*new_flags & mem->placement & TTM_PL_MASK_MEM))
+ return true;
+ }
+
+ return false;
}
int ttm_bo_validate(struct ttm_buffer_object *bo,
@@ -1117,6 +1125,7 @@ int ttm_bo_validate(struct ttm_buffer_ob
bool no_wait_gpu)
{
int ret;
+ uint32_t new_flags;
BUG_ON(!atomic_read(&bo->reserved));
/* Check that range is valid */
@@ -1127,8 +1136,7 @@ int ttm_bo_validate(struct ttm_buffer_ob
/*
* Check whether we need to move buffer.
*/
- ret = ttm_bo_mem_compat(placement, &bo->mem);
- if (ret < 0) {
+ if (!ttm_bo_mem_compat(placement, &bo->mem, &new_flags)) {
ret = ttm_bo_move_buffer(bo, placement, interruptible, no_wait_reserve, no_wait_gpu);
if (ret)
return ret;
@@ -1137,7 +1145,7 @@ int ttm_bo_validate(struct ttm_buffer_ob
* Use the access and other non-mapping-related flag bits from
* the compatible memory placement flags to the active flags
*/
- ttm_flag_masked(&bo->mem.placement, placement->placement[ret],
+ ttm_flag_masked(&bo->mem.placement, new_flags,
~TTM_PL_MASK_MEMTYPE);
}
/*
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 186/214] drm/radeon: fix hdmi mode enable on RS600/RS690/RS740
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (184 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 185/214] drm/ttm: Fix memory type compatibility check Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 187/214] drm/radeon: always program the MC on startup Greg Kroah-Hartman
` (30 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Deucher, Ben Hutchings, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit dcb852905772416e322536ced5cb3c796d176af5 upstream.
These chips were previously skipped since they are
pre-R600.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[wml: Backported to 3.4:
- adjust context
- no !ASIC_IS_DCE3(rdev)]
Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/r600_hdmi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -530,7 +530,7 @@ void r600_hdmi_enable(struct drm_encoder
WREG32_P(radeon_encoder->hdmi_config_offset + 0x4, 0x1, ~0x1);
} else if (ASIC_IS_DCE3(rdev)) {
/* TODO */
- } else if (rdev->family >= CHIP_R600) {
+ } else if (ASIC_IS_DCE2(rdev)) {
switch (radeon_encoder->encoder_id) {
case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1:
WREG32_P(AVIVO_TMDSA_CNTL, AVIVO_TMDSA_CNTL_HDMI_EN,
@@ -602,7 +602,7 @@ void r600_hdmi_disable(struct drm_encode
WREG32_P(radeon_encoder->hdmi_config_offset + 0xc, 0, ~0x1);
} else if (ASIC_IS_DCE32(rdev)) {
WREG32_P(radeon_encoder->hdmi_config_offset + 0x4, 0, ~0x1);
- } else if (rdev->family >= CHIP_R600 && !ASIC_IS_DCE3(rdev)) {
+ } else if (ASIC_IS_DCE2(rdev) && !ASIC_IS_DCE3(rdev)) {
switch (radeon_encoder->encoder_id) {
case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1:
WREG32_P(AVIVO_TMDSA_CNTL, 0,
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 187/214] drm/radeon: always program the MC on startup
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (185 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 186/214] drm/radeon: fix hdmi mode enable on RS600/RS690/RS740 Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 188/214] drivers/rtc/rtc-pl031.c: fix the missing operation on enable Greg Kroah-Hartman
` (29 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher, Weng Meiling
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 6fab3febf6d949b0a12b1e4e73db38e4a177a79e upstream.
For r6xx+ asics. This mirrors the behavior of pre-r6xx
asics. We need to program the MC even if something
else in startup() fails. Failure to do so results in
an unusable GPU.
Based on a fix from: Mark Kettenis <kettenis@openbsd.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[wml: Backported to 3.4:
- adjust context
- drop changes to cik.c]
Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/evergreen.c | 3 ++-
drivers/gpu/drm/radeon/ni.c | 3 ++-
drivers/gpu/drm/radeon/r600.c | 3 ++-
drivers/gpu/drm/radeon/rv770.c | 3 ++-
drivers/gpu/drm/radeon/si.c | 3 ++-
5 files changed, 10 insertions(+), 5 deletions(-)
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -3219,6 +3219,8 @@ static int evergreen_startup(struct rade
/* enable pcie gen2 link */
evergreen_pcie_gen2_enable(rdev);
+ evergreen_mc_program(rdev);
+
if (ASIC_IS_DCE5(rdev)) {
if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw || !rdev->mc_fw) {
r = ni_init_microcode(rdev);
@@ -3246,7 +3248,6 @@ static int evergreen_startup(struct rade
if (r)
return r;
- evergreen_mc_program(rdev);
if (rdev->flags & RADEON_IS_AGP) {
evergreen_agp_enable(rdev);
} else {
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -1552,6 +1552,8 @@ static int cayman_startup(struct radeon_
/* enable pcie gen2 link */
evergreen_pcie_gen2_enable(rdev);
+ evergreen_mc_program(rdev);
+
if (rdev->flags & RADEON_IS_IGP) {
if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
r = ni_init_microcode(rdev);
@@ -1580,7 +1582,6 @@ static int cayman_startup(struct radeon_
if (r)
return r;
- evergreen_mc_program(rdev);
r = cayman_pcie_gart_enable(rdev);
if (r)
return r;
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2431,6 +2431,8 @@ int r600_startup(struct radeon_device *r
/* enable pcie gen2 link */
r600_pcie_gen2_enable(rdev);
+ r600_mc_program(rdev);
+
if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
r = r600_init_microcode(rdev);
if (r) {
@@ -2443,7 +2445,6 @@ int r600_startup(struct radeon_device *r
if (r)
return r;
- r600_mc_program(rdev);
if (rdev->flags & RADEON_IS_AGP) {
r600_agp_enable(rdev);
} else {
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -1058,6 +1058,8 @@ static int rv770_startup(struct radeon_d
/* enable pcie gen2 link */
rv770_pcie_gen2_enable(rdev);
+ rv770_mc_program(rdev);
+
if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
r = r600_init_microcode(rdev);
if (r) {
@@ -1070,7 +1072,6 @@ static int rv770_startup(struct radeon_d
if (r)
return r;
- rv770_mc_program(rdev);
if (rdev->flags & RADEON_IS_AGP) {
rv770_agp_enable(rdev);
} else {
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -3834,6 +3834,8 @@ static int si_startup(struct radeon_devi
struct radeon_ring *ring;
int r;
+ si_mc_program(rdev);
+
if (!rdev->me_fw || !rdev->pfp_fw || !rdev->ce_fw ||
!rdev->rlc_fw || !rdev->mc_fw) {
r = si_init_microcode(rdev);
@@ -3853,7 +3855,6 @@ static int si_startup(struct radeon_devi
if (r)
return r;
- si_mc_program(rdev);
r = si_pcie_gart_enable(rdev);
if (r)
return r;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 188/214] drivers/rtc/rtc-pl031.c: fix the missing operation on enable
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (186 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 187/214] drm/radeon: always program the MC on startup Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 189/214] wireless: rt2x00: rt{2500,73}usb.c put back duplicate id Greg Kroah-Hartman
` (28 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Haojian Zhuang, Srinidhi Kasagar,
Linus Walleij, Alessandro Zummo, Andrew Morton, Linus Torvalds,
Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haojian Zhuang <haojian.zhuang@linaro.org>
commit e7e034e18a0ab6bafb2425c3242cac311164f4d6 upstream.
The RTC control register should be enabled in the process of
initializing.
Without this patch, I failed to enable RTC in Hisilicon Hi3620 SoC. The
register mapping section in RTC is always read as zero. So I doubt that
ST guys may already enable this register in bootloader. So they won't
meet this issue.
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>
Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
Cc: Linus Walleij <linus.walleij@linaro.org>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-pl031.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/rtc/rtc-pl031.c
+++ b/drivers/rtc/rtc-pl031.c
@@ -44,6 +44,7 @@
#define RTC_YMR 0x34 /* Year match register */
#define RTC_YLR 0x38 /* Year data load register */
+#define RTC_CR_EN (1 << 0) /* counter enable bit */
#define RTC_CR_CWEN (1 << 26) /* Clockwatch enable bit */
#define RTC_TCR_EN (1 << 1) /* Periodic timer enable bit */
@@ -312,7 +313,7 @@ static int pl031_probe(struct amba_devic
int ret;
struct pl031_local *ldata;
struct rtc_class_ops *ops = id->data;
- unsigned long time;
+ unsigned long time, data;
ret = amba_request_regions(adev, NULL);
if (ret)
@@ -339,10 +340,11 @@ static int pl031_probe(struct amba_devic
dev_dbg(&adev->dev, "designer ID = 0x%02x\n", ldata->hw_designer);
dev_dbg(&adev->dev, "revision = 0x%01x\n", ldata->hw_revision);
+ data = readl(ldata->base + RTC_CR);
/* Enable the clockwatch on ST Variants */
if (ldata->hw_designer == AMBA_VENDOR_ST)
- writel(readl(ldata->base + RTC_CR) | RTC_CR_CWEN,
- ldata->base + RTC_CR);
+ data |= RTC_CR_CWEN;
+ writel(data | RTC_CR_EN, ldata->base + RTC_CR);
/*
* On ST PL031 variants, the RTC reset value does not provide correct
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 189/214] wireless: rt2x00: rt{2500,73}usb.c put back duplicate id
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (187 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 188/214] drivers/rtc/rtc-pl031.c: fix the missing operation on enable Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 190/214] Wireless: rt2x00: Add device id for Sweex LW323 to rt2800usb.c Greg Kroah-Hartman
` (27 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xose Vazquez Perez, John W. Linville,
Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xose Vazquez Perez <xose.vazquez@gmail.com>
commit 8f35f787b75e9b6435ea37dabcae2d40dc72d31c upstream.
put back 0x050d,0x7050 to rt73usb, same usb_id for two chips:
K7SF5D7050A ver 2xxx is rt2500
K7SF5D7050B ver 3xxx is rt73
<http://en-us-support.belkin.com/app/answers/detail/a_id/297/kw/K7SF5D7050>
Signed-off-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rt2x00/rt2500usb.c | 2 +-
drivers/net/wireless/rt2x00/rt73usb.c | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1921,7 +1921,7 @@ static struct usb_device_id rt2500usb_de
{ USB_DEVICE(0x0b05, 0x1706) },
{ USB_DEVICE(0x0b05, 0x1707) },
/* Belkin */
- { USB_DEVICE(0x050d, 0x7050) },
+ { USB_DEVICE(0x050d, 0x7050) }, /* FCC ID: K7SF5D7050A ver. 2.x */
{ USB_DEVICE(0x050d, 0x7051) },
/* Cisco Systems */
{ USB_DEVICE(0x13b1, 0x000d) },
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2422,6 +2422,7 @@ static struct usb_device_id rt73usb_devi
{ USB_DEVICE(0x0b05, 0x1723) },
{ USB_DEVICE(0x0b05, 0x1724) },
/* Belkin */
+ { USB_DEVICE(0x050d, 0x7050) }, /* FCC ID: K7SF5D7050B ver. 3.x */
{ USB_DEVICE(0x050d, 0x705a) },
{ USB_DEVICE(0x050d, 0x905b) },
{ USB_DEVICE(0x050d, 0x905c) },
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 190/214] Wireless: rt2x00: Add device id for Sweex LW323 to rt2800usb.c
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (188 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 189/214] wireless: rt2x00: rt{2500,73}usb.c put back duplicate id Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 191/214] rt2800usb: Add support for 2001:3c1e (D-Link DWA-125 rev B1) USB Wi-Fi adapter Greg Kroah-Hartman
` (26 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jaume Delclòs, John W. Linville,
Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Jaume=20Delcl=C3=B2s?= <jaume@delclos.com>
commit 36f318bb124b231c01db6965a009f46d5731f012 upstream.
This patch adds detection for the Sweex LW323 USB wireless network card
in the rt2x00 driver (just one line in rt2800usb.c).
It applies to linux-3.7-rc3.
Signed-off-by: Jaume Delclòs <jaume@delclos.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rt2x00/rt2800usb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1140,6 +1140,7 @@ static struct usb_device_id rt2800usb_de
{ USB_DEVICE(0x177f, 0x0153) },
{ USB_DEVICE(0x177f, 0x0302) },
{ USB_DEVICE(0x177f, 0x0313) },
+ { USB_DEVICE(0x177f, 0x0323) },
/* U-Media */
{ USB_DEVICE(0x157e, 0x300e) },
{ USB_DEVICE(0x157e, 0x3013) },
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 191/214] rt2800usb: Add support for 2001:3c1e (D-Link DWA-125 rev B1) USB Wi-Fi adapter
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (189 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 190/214] Wireless: rt2x00: Add device id for Sweex LW323 to rt2800usb.c Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 192/214] drivers/rtc/rtc-pl031.c: restore ST variant functionality Greg Kroah-Hartman
` (25 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maia Kozheva, John W. Linville,
Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maia Kozheva <sikon@ubuntu.com>
commit fd7b9270120ca7e53fbf0469febe0c68acf6a0a2 upstream.
D-Link DWA-125/B1 is a relatively new USB Wi-Fi adapter, using a
Ralink chipset supported by the rt2800usb driver. Currently, to work
around the problem (it's missing in all present kernel versions,
up to and including 3.7.x), I had to add this to /etc/rc.local:
echo 2001 3c1e >> /sys/bus/usb/drivers/rt2800usb/new_id
After that, the device works without problems. Been using it for over
a week with no bugs in sight.
The attached patch is trivial and simply adds the new USB ID to the
list of devices handled by rt2800usb.
Signed-off-by: Maia Kozheva <sikon@ubuntu.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rt2x00/rt2800usb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1009,6 +1009,7 @@ static struct usb_device_id rt2800usb_de
{ USB_DEVICE(0x07d1, 0x3c15) },
{ USB_DEVICE(0x07d1, 0x3c16) },
{ USB_DEVICE(0x2001, 0x3c1b) },
+ { USB_DEVICE(0x2001, 0x3c1e) },
/* Draytek */
{ USB_DEVICE(0x07fa, 0x7712) },
/* DVICO */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 192/214] drivers/rtc/rtc-pl031.c: restore ST variant functionality
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (190 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 191/214] rt2800usb: Add support for 2001:3c1e (D-Link DWA-125 rev B1) USB Wi-Fi adapter Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 193/214] ata_piix: Add Device IDs for Intel Lynx Point-LP PCH Greg Kroah-Hartman
` (24 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Linus Walleij, Haojian Zhuang,
Mian Yousaf KAUKAB, Srinidhi Kasagar, Alessandro Zummo,
Andrew Morton, Linus Torvalds, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linus.walleij@linaro.org>
commit 3399cfb5df9594495b876d1843a7165f77366b2b upstream.
Commit e7e034e18a0a ("drivers/rtc/rtc-pl031.c: fix the missing operation
on enable") accidentally broke the ST variants of PL031.
The bit that is being poked as "clockwatch" enable bit for the ST
variants does the work of bit 0 on this variant. Bit 0 is used for a
clock divider on the ST variants, and setting it to 1 will affect
timekeeping in a very bad way.
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Haojian Zhuang <haojian.zhuang@gmail.com>
Cc: Mian Yousaf KAUKAB <mian.yousaf.kaukab@stericsson.com>
Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-pl031.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/rtc/rtc-pl031.c
+++ b/drivers/rtc/rtc-pl031.c
@@ -344,7 +344,9 @@ static int pl031_probe(struct amba_devic
/* Enable the clockwatch on ST Variants */
if (ldata->hw_designer == AMBA_VENDOR_ST)
data |= RTC_CR_CWEN;
- writel(data | RTC_CR_EN, ldata->base + RTC_CR);
+ else
+ data |= RTC_CR_EN;
+ writel(data, ldata->base + RTC_CR);
/*
* On ST PL031 variants, the RTC reset value does not provide correct
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 193/214] ata_piix: Add Device IDs for Intel Lynx Point-LP PCH
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (191 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 192/214] drivers/rtc/rtc-pl031.c: restore ST variant functionality Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 194/214] speakup: lower default software speech rate Greg Kroah-Hartman
` (23 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Ralston, Jeff Garzik,
Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Ralston <james.d.ralston@intel.com>
commit 389cd784969e9148fedcde0608f15bd74d6b769e upstream.
This patch adds the IDE-mode SATA Device IDs for the Intel Lynx Point-LP PCH
Signed-off-by: James Ralston <james.d.ralston@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/ata_piix.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -331,6 +331,14 @@ static const struct pci_device_id piix_p
{ 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
/* SATA Controller IDE (Lynx Point) */
{ 0x8086, 0x8c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+ /* SATA Controller IDE (Lynx Point-LP) */
+ { 0x8086, 0x9c00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+ /* SATA Controller IDE (Lynx Point-LP) */
+ { 0x8086, 0x9c01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+ /* SATA Controller IDE (Lynx Point-LP) */
+ { 0x8086, 0x9c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+ /* SATA Controller IDE (Lynx Point-LP) */
+ { 0x8086, 0x9c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
/* SATA Controller IDE (DH89xxCC) */
{ 0x8086, 0x2326, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
/* SATA Controller IDE (Avoton) */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 194/214] speakup: lower default software speech rate
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (192 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 193/214] ata_piix: Add Device IDs for Intel Lynx Point-LP PCH Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 195/214] i2c: tegra: check the clk_prepare_enable() return value Greg Kroah-Hartman
` (22 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Samuel Thibault, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Thibault <samuel.thibault@ens-lyon.org>
commit cfd757010691eae4e17acc246f74e7622c3a2f05 upstream.
Speech synthesis beginners need a low speech rate, and trained people
want a high speech rate. A medium speech rate is thus actually not a
good default for neither. Since trained people will typically know how
to change the rate, better default for a low speech rate, which
beginners can grasp and learn how to increase it afterwards
This was agreed with users on the speakup mailing list.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/speakup/speakup_soft.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/speakup/speakup_soft.c
+++ b/drivers/staging/speakup/speakup_soft.c
@@ -46,7 +46,7 @@ static int misc_registered;
static struct var_t vars[] = {
{ CAPS_START, .u.s = {"\x01+3p" } },
{ CAPS_STOP, .u.s = {"\x01-3p" } },
- { RATE, .u.n = {"\x01%ds", 5, 0, 9, 0, 0, NULL } },
+ { RATE, .u.n = {"\x01%ds", 2, 0, 9, 0, 0, NULL } },
{ PITCH, .u.n = {"\x01%dp", 5, 0, 9, 0, 0, NULL } },
{ VOL, .u.n = {"\x01%dv", 5, 0, 9, 0, 0, NULL } },
{ TONE, .u.n = {"\x01%dx", 1, 0, 2, 0, 0, NULL } },
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 195/214] i2c: tegra: check the clk_prepare_enable() return value
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (193 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 194/214] speakup: lower default software speech rate Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 196/214] ixgbe: fix registration order of driver and DCA nofitication Greg Kroah-Hartman
` (21 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Laxman Dewangan, Stephen Warren,
Wolfram Sang, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Dewangan <ldewangan@nvidia.com>
commit 132c803f7b70b17322579f6f4f3f65cf68e55135 upstream.
NVIDIA's Tegra SoC allows read/write of controller register only
if controller clock is enabled. System hangs if read/write happens
to registers without enabling clock.
clk_prepare_enable() can be fail due to unknown reason and hence
adding check for return value of this function. If this function
success then only access register otherwise return to caller with
error.
Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Reviewed-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
[bwh: Backported to 3.2:
- Adjust context
- Keep calling clk_enable() directly]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-tegra.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/drivers/i2c/busses/i2c-tegra.c
+++ b/drivers/i2c/busses/i2c-tegra.c
@@ -341,7 +341,11 @@ static int tegra_i2c_init(struct tegra_i
u32 val;
int err = 0;
- clk_enable(i2c_dev->clk);
+ err = clk_enable(i2c_dev->clk);
+ if (err < 0) {
+ dev_err(i2c_dev->dev, "Clock enable failed %d\n", err);
+ return err;
+ }
tegra_periph_reset_assert(i2c_dev->clk);
udelay(2);
@@ -543,7 +547,12 @@ static int tegra_i2c_xfer(struct i2c_ada
if (i2c_dev->is_suspended)
return -EBUSY;
- clk_enable(i2c_dev->clk);
+ ret = clk_enable(i2c_dev->clk);
+ if (ret < 0) {
+ dev_err(i2c_dev->dev, "Clock enable failed %d\n", ret);
+ return ret;
+ }
+
for (i = 0; i < num; i++) {
int stop = (i == (num - 1)) ? 1 : 0;
ret = tegra_i2c_xfer_msg(i2c_dev, &msgs[i], stop);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 196/214] ixgbe: fix registration order of driver and DCA nofitication
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (194 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 195/214] i2c: tegra: check the clk_prepare_enable() return value Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 197/214] msi-wmi: Fix memory leak Greg Kroah-Hartman
` (20 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Phil Schmitt,
Jeff Kirsher, David S. Miller, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <jakub.kicinski@intel.com>
commit f01fc1a82c2ee68726b400fadb156bd623b5f2f1 upstream.
ixgbe_notify_dca cannot be called before driver registration
because it expects driver's klist_devices to be allocated and
initialized. While on it make sure debugfs files are removed
when registration fails.
Signed-off-by: Jakub Kicinski <jakub.kicinski@intel.com>
Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: no debugfs support]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -7464,12 +7464,15 @@ static int __init ixgbe_init_module(void
pr_info("%s - version %s\n", ixgbe_driver_string, ixgbe_driver_version);
pr_info("%s\n", ixgbe_copyright);
+ ret = pci_register_driver(&ixgbe_driver);
+ if (ret)
+ return ret;
+
#ifdef CONFIG_IXGBE_DCA
dca_register_notify(&dca_notifier);
#endif
- ret = pci_register_driver(&ixgbe_driver);
- return ret;
+ return 0;
}
module_init(ixgbe_init_module);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 197/214] msi-wmi: Fix memory leak
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (195 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 196/214] ixgbe: fix registration order of driver and DCA nofitication Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 198/214] rapidio/tsi721: fix bug in MSI interrupt handling Greg Kroah-Hartman
` (19 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxim Mikityanskiy, Anisse Astier,
Lee, Chun-Yi, Matthew Garrett, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Mikityanskiy <maxtram95@gmail.com>
commit 51c94491c82c3d9029f6e87a1a153db321d88e35 upstream.
Fix memory leak - don't forget to kfree ACPI object when returning from
msi_wmi_notify() after suppressing key event.
Signed-off-by: Maxim Mikityanskiy <maxtram95@gmail.com>
Acked-by: Anisse Astier <anisse@astier.eu>
Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/msi-wmi.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/platform/x86/msi-wmi.c
+++ b/drivers/platform/x86/msi-wmi.c
@@ -176,7 +176,7 @@ static void msi_wmi_notify(u32 value, vo
pr_debug("Suppressed key event 0x%X - "
"Last press was %lld us ago\n",
key->code, ktime_to_us(diff));
- return;
+ goto msi_wmi_notify_exit;
}
last_pressed[key->code - SCANCODE_BASE] = cur;
@@ -195,6 +195,8 @@ static void msi_wmi_notify(u32 value, vo
pr_info("Unknown key pressed - %x\n", eventcode);
} else
pr_info("Unknown event received\n");
+
+msi_wmi_notify_exit:
kfree(response.pointer);
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 198/214] rapidio/tsi721: fix bug in MSI interrupt handling
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (196 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 197/214] msi-wmi: Fix memory leak Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 199/214] rapidio/tsi721: Fix interrupt mask when handling MSI Greg Kroah-Hartman
` (18 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexandre Bounine, Matt Porter,
Andrew Morton, Linus Torvalds, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Bounine <alexandre.bounine@idt.com>
commit 1ccc819da6fda9bee10ab8b72e9adbb5ad3e4959 upstream.
Fix bug in MSI interrupt handling which causes loss of event
notifications.
Typical indication of lost MSI interrupts are stalled message and
doorbell transfers between RapidIO endpoints. To avoid loss of MSI
interrupts all interrupts from the device must be disabled on entering
the interrupt handler routine and re-enabled when exiting it.
Re-enabling device interrupts will trigger new MSI message(s) if Tsi721
registered new events since entering interrupt handler routine.
This patch is applicable to kernel versions starting from v3.2.
Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com>
Cc: Matt Porter <mporter@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rapidio/devices/tsi721.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -475,6 +475,10 @@ static irqreturn_t tsi721_irqhandler(int
u32 intval;
u32 ch_inte;
+ /* For MSI mode disable all device-level interrupts */
+ if (priv->flags & TSI721_USING_MSI)
+ iowrite32(0, priv->regs + TSI721_DEV_INTE);
+
dev_int = ioread32(priv->regs + TSI721_DEV_INT);
if (!dev_int)
return IRQ_NONE;
@@ -548,6 +552,13 @@ static irqreturn_t tsi721_irqhandler(int
tsi721_pw_handler(mport);
}
+ /* For MSI mode re-enable device-level interrupts */
+ if (priv->flags & TSI721_USING_MSI) {
+ dev_int = TSI721_DEV_INT_SR2PC_CH | TSI721_DEV_INT_SRIO |
+ TSI721_DEV_INT_SMSG_CH | TSI721_DEV_INT_BDMA_CH;
+ iowrite32(dev_int, priv->regs + TSI721_DEV_INTE);
+ }
+
return IRQ_HANDLED;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 199/214] rapidio/tsi721: Fix interrupt mask when handling MSI
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (197 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 198/214] rapidio/tsi721: fix bug in MSI interrupt handling Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 200/214] random: fix accounting race condition with lockless irq entropy_count update Greg Kroah-Hartman
` (17 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Steve Conklin, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit 94e0104bca7d6927e85119030b8e6e31fde88a7a upstream.
Commit 1619f441963e 'rapidio/tsi721: fix bug in MSI interrupt
handling' (commit 1ccc819da6fd upstream) makes the MSI handler disable
and re-enable interrupts. When re-enabling interrupts, we should set
the same flags as were originally set, but this changed in Linux 3.5 so
the flags are now inconsistent in 3.2. In fact, the extra flag isn't
even defined in 3.2. Remove the extra flag from the MSI handler.
Reported-by: Steve Conklin <steve.conklin@canonical.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rapidio/devices/tsi721.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -555,7 +555,7 @@ static irqreturn_t tsi721_irqhandler(int
/* For MSI mode re-enable device-level interrupts */
if (priv->flags & TSI721_USING_MSI) {
dev_int = TSI721_DEV_INT_SR2PC_CH | TSI721_DEV_INT_SRIO |
- TSI721_DEV_INT_SMSG_CH | TSI721_DEV_INT_BDMA_CH;
+ TSI721_DEV_INT_SMSG_CH;
iowrite32(dev_int, priv->regs + TSI721_DEV_INTE);
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 200/214] random: fix accounting race condition with lockless irq entropy_count update
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (198 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 199/214] rapidio/tsi721: Fix interrupt mask when handling MSI Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 201/214] cfg80211: check wdev->netdev in connection work Greg Kroah-Hartman
` (16 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiri Kosina, Theodore Tso, Greg KH,
Andrew Morton, Linus Torvalds, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <jkosina@suse.cz>
commit 10b3a32d292c21ea5b3ad5ca5975e88bb20b8d68 upstream.
Commit 902c098a3663 ("random: use lockless techniques in the interrupt
path") turned IRQ path from being spinlock protected into lockless
cmpxchg-retry update.
That commit removed r->lock serialization between crediting entropy bits
from IRQ context and accounting when extracting entropy on userspace
read path, but didn't turn the r->entropy_count reads/updates in
account() to use cmpxchg as well.
It has been observed, that under certain circumstances this leads to
read() on /dev/urandom to return 0 (EOF), as r->entropy_count gets
corrupted and becomes negative, which in turn results in propagating 0
all the way from account() to the actual read() call.
Convert the accounting code to be the proper lockless counterpart of
what has been partially done by 902c098a3663.
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/random.c | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -867,16 +867,24 @@ static size_t account(struct entropy_sto
if (r->entropy_count / 8 < min + reserved) {
nbytes = 0;
} else {
+ int entropy_count, orig;
+retry:
+ entropy_count = orig = ACCESS_ONCE(r->entropy_count);
/* If limited, never pull more than available */
- if (r->limit && nbytes + reserved >= r->entropy_count / 8)
- nbytes = r->entropy_count/8 - reserved;
+ if (r->limit && nbytes + reserved >= entropy_count / 8)
+ nbytes = entropy_count/8 - reserved;
- if (r->entropy_count / 8 >= nbytes + reserved)
- r->entropy_count -= nbytes*8;
- else
- r->entropy_count = reserved;
+ if (entropy_count / 8 >= nbytes + reserved) {
+ entropy_count -= nbytes*8;
+ if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
+ goto retry;
+ } else {
+ entropy_count = reserved;
+ if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
+ goto retry;
+ }
- if (r->entropy_count < random_write_wakeup_thresh) {
+ if (entropy_count < random_write_wakeup_thresh) {
wake_up_interruptible(&random_write_wait);
kill_fasync(&fasync, SIGIO, POLL_OUT);
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 201/214] cfg80211: check wdev->netdev in connection work
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (199 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 200/214] random: fix accounting race condition with lockless irq entropy_count update Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 202/214] i2c-piix4: Add AMD CZ SMBus device ID Greg Kroah-Hartman
` (15 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, YanBo, Johannes Berg, Ben Hutchings,
Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit c815797663b72e3ac1736f1886538152bc48e4af upstream.
If a P2P-Device is present and another virtual interface triggers
the connection work, the system crash because it tries to check
if the P2P-Device's netdev (which doesn't exist) is up. Skip any
wdevs that have no netdev to fix this.
Reported-by: YanBo <dreamfly281@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/sme.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -222,6 +222,9 @@ void cfg80211_conn_work(struct work_stru
mutex_lock(&rdev->devlist_mtx);
list_for_each_entry(wdev, &rdev->netdev_list, list) {
+ if (!wdev->netdev)
+ continue;
+
wdev_lock(wdev);
if (!netif_running(wdev->netdev)) {
wdev_unlock(wdev);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 202/214] i2c-piix4: Add AMD CZ SMBus device ID
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (200 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 201/214] cfg80211: check wdev->netdev in connection work Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 203/214] b43: ensue that BCMA is "y" when B43 is "y" Greg Kroah-Hartman
` (14 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shane Huang, Bjorn Helgaas,
Tejun Heo, Jean Delvare, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shane Huang <shane.huang@amd.com>
commit b996ac90f595dda271cbd858b136b45557fc1a57 upstream.
To add AMD CZ SMBus controller device ID.
[bhelgaas: drop pci_ids.h update]
Signed-off-by: Shane Huang <shane.huang@amd.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Jean Delvare <khali@linux-fr.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/i2c/busses/i2c-piix4 | 2 +-
drivers/i2c/busses/Kconfig | 1 +
drivers/i2c/busses/i2c-piix4.c | 3 ++-
3 files changed, 4 insertions(+), 2 deletions(-)
--- a/Documentation/i2c/busses/i2c-piix4
+++ b/Documentation/i2c/busses/i2c-piix4
@@ -8,7 +8,7 @@ Supported adapters:
Datasheet: Only available via NDA from ServerWorks
* ATI IXP200, IXP300, IXP400, SB600, SB700 and SB800 southbridges
Datasheet: Not publicly available
- * AMD Hudson-2
+ * AMD Hudson-2, CZ
Datasheet: Not publicly available
* Standard Microsystems (SMSC) SLC90E66 (Victory66) southbridge
Datasheet: Publicly available at the SMSC website http://www.smsc.com
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -138,6 +138,7 @@ config I2C_PIIX4
ATI SB700
ATI SB800
AMD Hudson-2
+ AMD CZ
Serverworks OSB4
Serverworks CSB5
Serverworks CSB6
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -22,7 +22,7 @@
Intel PIIX4, 440MX
Serverworks OSB4, CSB5, CSB6, HT-1000, HT-1100
ATI IXP200, IXP300, IXP400, SB600, SB700, SB800
- AMD Hudson-2
+ AMD Hudson-2, CZ
SMSC Victory66
Note: we assume there can only be one device, with one SMBus interface.
@@ -481,6 +481,7 @@ static DEFINE_PCI_DEVICE_TABLE(piix4_ids
{ PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP400_SMBUS) },
{ PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_SBX00_SMBUS) },
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, 0x790b) },
{ PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
PCI_DEVICE_ID_SERVERWORKS_OSB4) },
{ PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 203/214] b43: ensue that BCMA is "y" when B43 is "y"
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (201 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 202/214] i2c-piix4: Add AMD CZ SMBus device ID Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 204/214] vgacon.c: add cond reschedule points in vgacon_do_font_op Greg Kroah-Hartman
` (13 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Hauke Mehrtens,
John W. Linville, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hauke Mehrtens <hauke@hauke-m.de>
commit 693026ef2e751fd94d2e6c71028e68343cc875d5 upstream.
When b43 gets build into the kernel and it should use bcma we have to
ensure that bcma was also build into the kernel and not as a module.
In this patch this is also done for SSB, although you can not
build b43 without ssb support for now.
This fixes a build problem reported by Randy Dunlap in
5187EB95.2060605@infradead.org
Reported-By: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/b43/Kconfig | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -28,7 +28,7 @@ config B43
config B43_BCMA
bool "Support for BCMA bus"
- depends on B43 && BCMA
+ depends on B43 && (BCMA = y || BCMA = B43)
default y
config B43_BCMA_EXTRA
@@ -39,7 +39,7 @@ config B43_BCMA_EXTRA
config B43_SSB
bool
- depends on B43 && SSB
+ depends on B43 && (SSB = y || SSB = B43)
default y
# Auto-select SSB PCI-HOST support, if possible
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 204/214] vgacon.c: add cond reschedule points in vgacon_do_font_op
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (202 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 203/214] b43: ensue that BCMA is "y" when B43 is "y" Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 205/214] mac80211: drop spoofed packets in ad-hoc mode Greg Kroah-Hartman
` (12 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marcelo Tosatti, Dave Airlie,
Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcelo Tosatti <mtosatti@redhat.com>
commit 7e6d72c15ff4cc0c27573901bb05f9eddbd71ed4 upstream.
Booting a 64-vcpu KVM guest, with CONFIG_PREEMPT_VOLUNTARY,
can result in a soft lockup:
BUG: soft lockup - CPU#41 stuck for 67s! [setfont:1505]
RIP: 0010:[<ffffffff812c48da>]
[<ffffffff812c48da>] vgacon_do_font_op.clone.0+0x1ba/0x550
This is due to the 8192 (cmapsz) IO operations taking longer than expected
due to lock contention in QEMU.
Add conditional resched points in between writes allowing other tasks to
execute.
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
[bwh: Backported to 3.2: add #include <linux/sched.h>, already present
upstream]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/console/vgacon.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -42,6 +42,7 @@
#include <linux/kd.h>
#include <linux/slab.h>
#include <linux/vt_kern.h>
+#include <linux/sched.h>
#include <linux/selection.h>
#include <linux/spinlock.h>
#include <linux/ioport.h>
@@ -1124,11 +1125,15 @@ static int vgacon_do_font_op(struct vgas
if (arg) {
if (set)
- for (i = 0; i < cmapsz; i++)
+ for (i = 0; i < cmapsz; i++) {
vga_writeb(arg[i], charmap + i);
+ cond_resched();
+ }
else
- for (i = 0; i < cmapsz; i++)
+ for (i = 0; i < cmapsz; i++) {
arg[i] = vga_readb(charmap + i);
+ cond_resched();
+ }
/*
* In 512-character mode, the character map is not contiguous if
@@ -1139,11 +1144,15 @@ static int vgacon_do_font_op(struct vgas
charmap += 2 * cmapsz;
arg += cmapsz;
if (set)
- for (i = 0; i < cmapsz; i++)
+ for (i = 0; i < cmapsz; i++) {
vga_writeb(arg[i], charmap + i);
+ cond_resched();
+ }
else
- for (i = 0; i < cmapsz; i++)
+ for (i = 0; i < cmapsz; i++) {
arg[i] = vga_readb(charmap + i);
+ cond_resched();
+ }
}
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 205/214] mac80211: drop spoofed packets in ad-hoc mode
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (203 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 204/214] vgacon.c: add cond reschedule points in vgacon_do_font_op Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 206/214] crypto: s390 - Fix aes-cbc IV corruption Greg Kroah-Hartman
` (11 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Huehn, Felix Fietkau,
Johannes Berg, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@openwrt.org>
commit 6329b8d917adc077caa60c2447385554130853a3 upstream.
If an Ad-Hoc node receives packets with the Cell ID or its own MAC
address as source address, it hits a WARN_ON in sta_info_insert_check()
With many packets, this can massively spam the logs. One way that this
can easily happen is through having Cisco APs in the area with rouge AP
detection and countermeasures enabled.
Such Cisco APs will regularly send fake beacons, disassoc and deauth
packets that trigger these warnings.
To fix this issue, drop such spoofed packets early in the rx path.
Reported-by: Thomas Huehn <thomas@net.t-labs.tu-berlin.de>
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[bwh: Backported to 3.2: use compare_ether_addr() instead of ether_addr_equal()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/rx.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2828,6 +2828,9 @@ static int prepare_for_handlers(struct i
case NL80211_IFTYPE_ADHOC:
if (!bssid)
return 0;
+ if (compare_ether_addr(sdata->vif.addr, hdr->addr2) == 0 ||
+ compare_ether_addr(sdata->u.ibss.bssid, hdr->addr2) == 0)
+ return 0;
if (ieee80211_is_beacon(hdr->frame_control)) {
return 1;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 206/214] crypto: s390 - Fix aes-cbc IV corruption
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (204 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 205/214] mac80211: drop spoofed packets in ad-hoc mode Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 207/214] mtd: m25p80: fix allocation size Greg Kroah-Hartman
` (10 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Herbert Xu, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
commit f262f0f5cad0c9eca61d1d383e3b67b57dcbe5ea upstream.
The cbc-aes-s390 algorithm incorrectly places the IV in the tfm
data structure. As the tfm is shared between multiple threads,
this introduces a possibility of data corruption.
This patch fixes this by moving the parameter block containing
the IV and key onto the stack (the block is 48 bytes long).
The same bug exists elsewhere in the s390 crypto system and they
will be fixed in subsequent patches.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/crypto/aes_s390.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
--- a/arch/s390/crypto/aes_s390.c
+++ b/arch/s390/crypto/aes_s390.c
@@ -35,7 +35,6 @@ static u8 *ctrblk;
static char keylen_flag;
struct s390_aes_ctx {
- u8 iv[AES_BLOCK_SIZE];
u8 key[AES_MAX_KEY_SIZE];
long enc;
long dec;
@@ -442,29 +441,35 @@ static int cbc_aes_set_key(struct crypto
return aes_set_key(tfm, in_key, key_len);
}
-static int cbc_aes_crypt(struct blkcipher_desc *desc, long func, void *param,
+static int cbc_aes_crypt(struct blkcipher_desc *desc, long func,
struct blkcipher_walk *walk)
{
+ struct s390_aes_ctx *sctx = crypto_blkcipher_ctx(desc->tfm);
int ret = blkcipher_walk_virt(desc, walk);
unsigned int nbytes = walk->nbytes;
+ struct {
+ u8 iv[AES_BLOCK_SIZE];
+ u8 key[AES_MAX_KEY_SIZE];
+ } param;
if (!nbytes)
goto out;
- memcpy(param, walk->iv, AES_BLOCK_SIZE);
+ memcpy(param.iv, walk->iv, AES_BLOCK_SIZE);
+ memcpy(param.key, sctx->key, sctx->key_len);
do {
/* only use complete blocks */
unsigned int n = nbytes & ~(AES_BLOCK_SIZE - 1);
u8 *out = walk->dst.virt.addr;
u8 *in = walk->src.virt.addr;
- ret = crypt_s390_kmc(func, param, out, in, n);
+ ret = crypt_s390_kmc(func, ¶m, out, in, n);
BUG_ON((ret < 0) || (ret != n));
nbytes &= AES_BLOCK_SIZE - 1;
ret = blkcipher_walk_done(desc, walk, nbytes);
} while ((nbytes = walk->nbytes));
- memcpy(walk->iv, param, AES_BLOCK_SIZE);
+ memcpy(walk->iv, param.iv, AES_BLOCK_SIZE);
out:
return ret;
@@ -481,7 +486,7 @@ static int cbc_aes_encrypt(struct blkcip
return fallback_blk_enc(desc, dst, src, nbytes);
blkcipher_walk_init(&walk, dst, src, nbytes);
- return cbc_aes_crypt(desc, sctx->enc, sctx->iv, &walk);
+ return cbc_aes_crypt(desc, sctx->enc, &walk);
}
static int cbc_aes_decrypt(struct blkcipher_desc *desc,
@@ -495,7 +500,7 @@ static int cbc_aes_decrypt(struct blkcip
return fallback_blk_dec(desc, dst, src, nbytes);
blkcipher_walk_init(&walk, dst, src, nbytes);
- return cbc_aes_crypt(desc, sctx->dec, sctx->iv, &walk);
+ return cbc_aes_crypt(desc, sctx->dec, &walk);
}
static struct crypto_alg cbc_aes_alg = {
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 207/214] mtd: m25p80: fix allocation size
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (205 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 206/214] crypto: s390 - Fix aes-cbc IV corruption Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 208/214] backlight: atmel-pwm-bl: fix gpio polarity in remove Greg Kroah-Hartman
` (9 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian Norris, Yuhang Wang,
Sourav Poddar, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <computersforpeace@gmail.com>
commit 778d226a1462572b51d6777cdb1d611543410cb4 upstream.
This patch fixes two memory errors:
1. During a probe failure (in mtd_device_parse_register?) the command
buffer would not be freed.
2. The command buffer's size is determined based on the 'fast_read'
boolean, but the assignment of fast_read is made after this
allocation. Thus, the buffer may be allocated "too small".
To fix the first, just switch to the devres version of kzalloc.
To fix the second, increase MAX_CMD_SIZE unconditionally. It's not worth
saving a byte to fiddle around with the conditions here.
This problem was reported by Yuhang Wang a while back.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Reported-by: Yuhang Wang <wangyuhang2014@gmail.com>
Reviewed-by: Sourav Poddar <sourav.poddar@ti.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/devices/m25p80.c | 19 +++++++------------
1 file changed, 7 insertions(+), 12 deletions(-)
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -71,7 +71,7 @@
/* Define max times to check status register before we give up. */
#define MAX_READY_WAIT_JIFFIES (40 * HZ) /* M25P16 specs 40s max chip erase */
-#define MAX_CMD_SIZE 5
+#define MAX_CMD_SIZE 6
#ifdef CONFIG_M25PXX_USE_FAST_READ
#define OPCODE_READ OPCODE_FAST_READ
@@ -843,14 +843,13 @@ static int __devinit m25p_probe(struct s
}
}
- flash = kzalloc(sizeof *flash, GFP_KERNEL);
+ flash = devm_kzalloc(&spi->dev, sizeof(*flash), GFP_KERNEL);
if (!flash)
return -ENOMEM;
- flash->command = kmalloc(MAX_CMD_SIZE + FAST_READ_DUMMY_BYTE, GFP_KERNEL);
- if (!flash->command) {
- kfree(flash);
+
+ flash->command = devm_kzalloc(&spi->dev, MAX_CMD_SIZE, GFP_KERNEL);
+ if (!flash->command)
return -ENOMEM;
- }
flash->spi = spi;
mutex_init(&flash->lock);
@@ -947,14 +946,10 @@ static int __devinit m25p_probe(struct s
static int __devexit m25p_remove(struct spi_device *spi)
{
struct m25p *flash = dev_get_drvdata(&spi->dev);
- int status;
/* Clean up MTD stuff. */
- status = mtd_device_unregister(&flash->mtd);
- if (status == 0) {
- kfree(flash->command);
- kfree(flash);
- }
+ mtd_device_unregister(&flash->mtd);
+
return 0;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 208/214] backlight: atmel-pwm-bl: fix gpio polarity in remove
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (206 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 207/214] mtd: m25p80: fix allocation size Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 209/214] can: sja1000: fix {pre,post}_irq() handling and IRQ handler return value Greg Kroah-Hartman
` (8 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Jingoo Han,
Andrew Morton, Linus Torvalds, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit ad5066d4c2b1d696749f8d7816357c23b648c4d3 upstream.
Make sure to honour gpio polarity also at remove so that the backlight is
actually disabled on boards with active-low enable pin.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Acked-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/backlight/atmel-pwm-bl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/video/backlight/atmel-pwm-bl.c
+++ b/drivers/video/backlight/atmel-pwm-bl.c
@@ -211,7 +211,8 @@ static int __exit atmel_pwm_bl_remove(st
struct atmel_pwm_bl *pwmbl = platform_get_drvdata(pdev);
if (pwmbl->gpio_on != -1) {
- gpio_set_value(pwmbl->gpio_on, 0);
+ gpio_set_value(pwmbl->gpio_on,
+ 0 ^ pwmbl->pdata->on_active_low);
gpio_free(pwmbl->gpio_on);
}
pwm_channel_disable(&pwmbl->pwmc);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 209/214] can: sja1000: fix {pre,post}_irq() handling and IRQ handler return value
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (207 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 208/214] backlight: atmel-pwm-bl: fix gpio polarity in remove Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 210/214] crypto: s390 - Fix aes-xts parameter corruption Greg Kroah-Hartman
` (7 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wolfgang Grandegger, Oliver Hartkopp,
Marc Kleine-Budde, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit 2fea6cd303c0d0cd9067da31d873b6a6d5bd75e7 upstream.
This patch fixes the issue that the sja1000_interrupt() function may have
returned IRQ_NONE without processing the optional pre_irq() and post_irq()
function before. Further the irq processing counter 'n' is moved to the end of
the while statement to return correct IRQ_[NONE|HANDLED] values at error
conditions.
Reported-by: Wolfgang Grandegger <wg@grandegger.com>
Acked-by: Wolfgang Grandegger <wg@grandegger.com>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
[bwh: Backported to 3.2: s/SJA1000_IER/REG_IER/; s/SJA1000_IR/REG_IR/]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/sja1000/sja1000.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -487,19 +487,19 @@ irqreturn_t sja1000_interrupt(int irq, v
uint8_t isrc, status;
int n = 0;
- /* Shared interrupts and IRQ off? */
- if (priv->read_reg(priv, REG_IER) == IRQ_OFF)
- return IRQ_NONE;
-
if (priv->pre_irq)
priv->pre_irq(priv);
+ /* Shared interrupts and IRQ off? */
+ if (priv->read_reg(priv, REG_IER) == IRQ_OFF)
+ goto out;
+
while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
- n++;
+
status = priv->read_reg(priv, SJA1000_REG_SR);
/* check for absent controller due to hw unplug */
if (status == 0xFF && sja1000_is_absent(priv))
- return IRQ_NONE;
+ goto out;
if (isrc & IRQ_WUI)
netdev_warn(dev, "wakeup interrupt\n");
@@ -518,7 +518,7 @@ irqreturn_t sja1000_interrupt(int irq, v
status = priv->read_reg(priv, SJA1000_REG_SR);
/* check for absent controller */
if (status == 0xFF && sja1000_is_absent(priv))
- return IRQ_NONE;
+ goto out;
}
}
if (isrc & (IRQ_DOI | IRQ_EI | IRQ_BEI | IRQ_EPI | IRQ_ALI)) {
@@ -526,8 +526,9 @@ irqreturn_t sja1000_interrupt(int irq, v
if (sja1000_err(dev, isrc, status))
break;
}
+ n++;
}
-
+out:
if (priv->post_irq)
priv->post_irq(priv);
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 210/214] crypto: s390 - Fix aes-xts parameter corruption
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (208 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 209/214] can: sja1000: fix {pre,post}_irq() handling and IRQ handler return value Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 211/214] net: Add net_ratelimited_function and net_<level>_ratelimited macros Greg Kroah-Hartman
` (6 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gerald Schaefer, Herbert Xu,
Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerald Schaefer <gerald.schaefer@de.ibm.com>
commit 9dda2769af4f3f3093434648c409bb351120d9e8 upstream.
Some s390 crypto algorithms incorrectly use the crypto_tfm structure to
store private data. As the tfm can be shared among multiple threads, this
can result in data corruption.
This patch fixes aes-xts by moving the xts and pcc parameter blocks from
the tfm onto the stack (48 + 96 bytes).
Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/crypto/aes_s390.c | 31 +++++++++++++++++--------------
1 file changed, 17 insertions(+), 14 deletions(-)
--- a/arch/s390/crypto/aes_s390.c
+++ b/arch/s390/crypto/aes_s390.c
@@ -55,8 +55,7 @@ struct pcc_param {
struct s390_xts_ctx {
u8 key[32];
- u8 xts_param[16];
- struct pcc_param pcc;
+ u8 pcc_key[32];
long enc;
long dec;
int key_len;
@@ -592,7 +591,7 @@ static int xts_aes_set_key(struct crypto
xts_ctx->enc = KM_XTS_128_ENCRYPT;
xts_ctx->dec = KM_XTS_128_DECRYPT;
memcpy(xts_ctx->key + 16, in_key, 16);
- memcpy(xts_ctx->pcc.key + 16, in_key + 16, 16);
+ memcpy(xts_ctx->pcc_key + 16, in_key + 16, 16);
break;
case 48:
xts_ctx->enc = 0;
@@ -603,7 +602,7 @@ static int xts_aes_set_key(struct crypto
xts_ctx->enc = KM_XTS_256_ENCRYPT;
xts_ctx->dec = KM_XTS_256_DECRYPT;
memcpy(xts_ctx->key, in_key, 32);
- memcpy(xts_ctx->pcc.key, in_key + 32, 32);
+ memcpy(xts_ctx->pcc_key, in_key + 32, 32);
break;
default:
*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
@@ -622,28 +621,32 @@ static int xts_aes_crypt(struct blkciphe
unsigned int nbytes = walk->nbytes;
unsigned int n;
u8 *in, *out;
- void *param;
+ struct pcc_param pcc_param;
+ struct {
+ u8 key[32];
+ u8 init[16];
+ } xts_param;
if (!nbytes)
goto out;
- memset(xts_ctx->pcc.block, 0, sizeof(xts_ctx->pcc.block));
- memset(xts_ctx->pcc.bit, 0, sizeof(xts_ctx->pcc.bit));
- memset(xts_ctx->pcc.xts, 0, sizeof(xts_ctx->pcc.xts));
- memcpy(xts_ctx->pcc.tweak, walk->iv, sizeof(xts_ctx->pcc.tweak));
- param = xts_ctx->pcc.key + offset;
- ret = crypt_s390_pcc(func, param);
+ memset(pcc_param.block, 0, sizeof(pcc_param.block));
+ memset(pcc_param.bit, 0, sizeof(pcc_param.bit));
+ memset(pcc_param.xts, 0, sizeof(pcc_param.xts));
+ memcpy(pcc_param.tweak, walk->iv, sizeof(pcc_param.tweak));
+ memcpy(pcc_param.key, xts_ctx->pcc_key, 32);
+ ret = crypt_s390_pcc(func, &pcc_param.key[offset]);
BUG_ON(ret < 0);
- memcpy(xts_ctx->xts_param, xts_ctx->pcc.xts, 16);
- param = xts_ctx->key + offset;
+ memcpy(xts_param.key, xts_ctx->key, 32);
+ memcpy(xts_param.init, pcc_param.xts, 16);
do {
/* only use complete blocks */
n = nbytes & ~(AES_BLOCK_SIZE - 1);
out = walk->dst.virt.addr;
in = walk->src.virt.addr;
- ret = crypt_s390_km(func, param, out, in, n);
+ ret = crypt_s390_km(func, &xts_param.key[offset], out, in, n);
BUG_ON(ret < 0 || ret != n);
nbytes &= AES_BLOCK_SIZE - 1;
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 211/214] net: Add net_ratelimited_function and net_<level>_ratelimited macros
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (209 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 210/214] crypto: s390 - Fix aes-xts parameter corruption Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 212/214] xen-netfront: reduce gso_max_size to account for max TCP header Greg Kroah-Hartman
` (5 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joe Perches, David S. Miller,
Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Perches <joe@perches.com>
commit 3a3bfb61e64476ff1e4ac3122cb6dec9c79b795c upstream.
__ratelimit() can be considered an inverted bool test because
it returns true when not ratelimited. Several tests in the
kernel tree use this __ratelimit() function incorrectly.
No net_ratelimit uses are incorrect currently though.
Most uses of net_ratelimit are to log something via printk or
pr_<level>.
In order to minimize the uses of net_ratelimit, and to start
standardizing the code style used for __ratelimit() and net_ratelimit(),
add a net_ratelimited_function() macro and net_<level>_ratelimited()
logging macros similar to pr_<level>_ratelimited that use the global
net_ratelimit instead of a static per call site "struct ratelimit_state".
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/net.h | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -282,6 +282,29 @@ do { \
#define net_dbg_ratelimited(fmt, ...) \
net_ratelimited_function(pr_debug, fmt, ##__VA_ARGS__)
+#define net_ratelimited_function(function, ...) \
+do { \
+ if (net_ratelimit()) \
+ function(__VA_ARGS__); \
+} while (0)
+
+#define net_emerg_ratelimited(fmt, ...) \
+ net_ratelimited_function(pr_emerg, fmt, ##__VA_ARGS__)
+#define net_alert_ratelimited(fmt, ...) \
+ net_ratelimited_function(pr_alert, fmt, ##__VA_ARGS__)
+#define net_crit_ratelimited(fmt, ...) \
+ net_ratelimited_function(pr_crit, fmt, ##__VA_ARGS__)
+#define net_err_ratelimited(fmt, ...) \
+ net_ratelimited_function(pr_err, fmt, ##__VA_ARGS__)
+#define net_notice_ratelimited(fmt, ...) \
+ net_ratelimited_function(pr_notice, fmt, ##__VA_ARGS__)
+#define net_warn_ratelimited(fmt, ...) \
+ net_ratelimited_function(pr_warn, fmt, ##__VA_ARGS__)
+#define net_info_ratelimited(fmt, ...) \
+ net_ratelimited_function(pr_info, fmt, ##__VA_ARGS__)
+#define net_dbg_ratelimited(fmt, ...) \
+ net_ratelimited_function(pr_debug, fmt, ##__VA_ARGS__)
+
#define net_random() random32()
#define net_srandom(seed) srandom32((__force u32)seed)
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 212/214] xen-netfront: reduce gso_max_size to account for max TCP header
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (210 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 211/214] net: Add net_ratelimited_function and net_<level>_ratelimited macros Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 213/214] PCI/ASPM: Dont touch ASPM if forcibly disabled Greg Kroah-Hartman
` (4 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wei Liu, Ian Campbell,
David S. Miller, Ben Hutchings, Qiang Huang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Liu <wei.liu2@citrix.com>
commit 9ecd1a75d977e2e8c48139c7d3efed183f898d94 upstream.
The maximum packet including header that can be handled by netfront / netback
wire format is 65535. Reduce gso_max_size accordingly.
Drop skb and print warning when skb->len > 65535. This can 1) save the effort
to send malformed packet to netback, 2) help spotting misconfiguration of
netfront in the future.
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[hq: Backported to 3.4: adjust context]
Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/xen-netfront.c | 17 +++++++++++++++--
include/xen/interface/io/netif.h | 1 +
2 files changed, 16 insertions(+), 2 deletions(-)
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -36,7 +36,7 @@
#include <linux/skbuff.h>
#include <linux/ethtool.h>
#include <linux/if_ether.h>
-#include <linux/tcp.h>
+#include <net/tcp.h>
#include <linux/udp.h>
#include <linux/moduleparam.h>
#include <linux/mm.h>
@@ -492,6 +492,16 @@ static int xennet_start_xmit(struct sk_b
unsigned int len = skb_headlen(skb);
unsigned long flags;
+ /* If skb->len is too big for wire format, drop skb and alert
+ * user about misconfiguration.
+ */
+ if (unlikely(skb->len > XEN_NETIF_MAX_TX_SIZE)) {
+ net_alert_ratelimited(
+ "xennet: skb->len = %u, too big for wire format\n",
+ skb->len);
+ goto drop;
+ }
+
frags += DIV_ROUND_UP(offset + len, PAGE_SIZE);
if (unlikely(frags > MAX_SKB_FRAGS + 1)) {
printk(KERN_ALERT "xennet: skb rides the rocket: %d frags\n",
@@ -1045,7 +1055,8 @@ err:
static int xennet_change_mtu(struct net_device *dev, int mtu)
{
- int max = xennet_can_sg(dev) ? 65535 - ETH_HLEN : ETH_DATA_LEN;
+ int max = xennet_can_sg(dev) ?
+ XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER : ETH_DATA_LEN;
if (mtu > max)
return -EINVAL;
@@ -1349,6 +1360,8 @@ static struct net_device * __devinit xen
SET_ETHTOOL_OPS(netdev, &xennet_ethtool_ops);
SET_NETDEV_DEV(netdev, &dev->dev);
+ netif_set_gso_max_size(netdev, XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER);
+
np->netdev = netdev;
netif_carrier_off(netdev);
--- a/include/xen/interface/io/netif.h
+++ b/include/xen/interface/io/netif.h
@@ -65,6 +65,7 @@
#define _XEN_NETTXF_extra_info (3)
#define XEN_NETTXF_extra_info (1U<<_XEN_NETTXF_extra_info)
+#define XEN_NETIF_MAX_TX_SIZE 0xFFFF
struct xen_netif_tx_request {
grant_ref_t gref; /* Reference to buffer page */
uint16_t offset; /* Offset within buffer page */
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 213/214] PCI/ASPM: Dont touch ASPM if forcibly disabled
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (211 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 212/214] xen-netfront: reduce gso_max_size to account for max TCP header Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 4:19 ` [PATCH 3.4 214/214] HID: logitech: dont use stack based dj_report structures Greg Kroah-Hartman
` (3 subsequent siblings)
216 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joe Lawrence, Bjorn Helgaas,
David Bulkow, Myron Stowe, Yijing Wang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Lawrence <joe.lawrence@stratus.com>
commit a26d5ecb3201c11e03663a8f4a7dedc0c5f85c07 upstream.
Don't allocate and track PCIe ASPM state when "pcie_aspm=off" is specified
on the kernel command line.
Based-on-patch-from: Matthew Garrett <mjg59@srcf.ucam.org>
Signed-off-by: Joe Lawrence <joe.lawrence@stratus.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: David Bulkow <david.bulkow@stratus.com>
Acked-by: Myron Stowe <myron.stowe@redhat.com>
[wyj: Backported to 3.4: context adjust]
Signed-off-by: Yijing Wang <wangyijing@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pcie/aspm.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -583,6 +583,9 @@ void pcie_aspm_init_link_state(struct pc
struct pcie_link_state *link;
int blacklist = !!pcie_aspm_sanity_check(pdev);
+ if (!aspm_support_enabled)
+ return;
+
if (!pci_is_pcie(pdev) || pdev->link_state)
return;
if (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT &&
^ permalink raw reply [flat|nested] 234+ messages in thread* [PATCH 3.4 214/214] HID: logitech: dont use stack based dj_report structures
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (212 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 213/214] PCI/ASPM: Dont touch ASPM if forcibly disabled Greg Kroah-Hartman
@ 2014-06-05 4:19 ` Greg Kroah-Hartman
2014-06-05 11:30 ` Marc Dionne
2014-06-05 17:12 ` [PATCH 3.4 000/214] 3.4.92-stable review Guenter Roeck
` (2 subsequent siblings)
216 siblings, 1 reply; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 4:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marc Dionne, Jiri Kosina,
Ben Hutchings, Yijing Wang
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Dionne <marc.c.dionne@gmail.com>
commit d8dc3494f77a5cc3b274bae36f7e74e85cf8a407 upstream.
On a system with a logitech wireless keyboard/mouse and DMA-API debugging
enabled, this warning appears at boot:
kernel: WARNING: at lib/dma-debug.c:929 check_for_stack.part.12+0x70/0xa7()
kernel: Hardware name: MS-7593
kernel: uhci_hcd 0000:00:1d.1: DMA-API: device driver maps memory fromstack [addr=ffff8801b0079c29]
Make logi_dj_recv_query_paired_devices and logi_dj_recv_switch_to_dj_mode
use a structure allocated with kzalloc rather than a stack based one.
Signed-off-by: Marc Dionne <marc.c.dionne@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Yijing Wang <wangyijing@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-logitech-dj.c | 38 ++++++++++++++++++++++++--------------
1 file changed, 24 insertions(+), 14 deletions(-)
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -474,28 +474,38 @@ static int logi_dj_recv_send_report(stru
static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
{
- struct dj_report dj_report;
+ struct dj_report *dj_report;
+ int retval;
- memset(&dj_report, 0, sizeof(dj_report));
- dj_report.report_id = REPORT_ID_DJ_SHORT;
- dj_report.device_index = 0xFF;
- dj_report.report_type = REPORT_TYPE_CMD_GET_PAIRED_DEVICES;
- return logi_dj_recv_send_report(djrcv_dev, &dj_report);
+ dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
+ if (!dj_report)
+ return -ENOMEM;
+ dj_report->report_id = REPORT_ID_DJ_SHORT;
+ dj_report->device_index = 0xFF;
+ dj_report->report_type = REPORT_TYPE_CMD_GET_PAIRED_DEVICES;
+ retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
+ kfree(dj_report);
+ return retval;
}
static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
unsigned timeout)
{
- struct dj_report dj_report;
+ struct dj_report *dj_report;
+ int retval;
- memset(&dj_report, 0, sizeof(dj_report));
- dj_report.report_id = REPORT_ID_DJ_SHORT;
- dj_report.device_index = 0xFF;
- dj_report.report_type = REPORT_TYPE_CMD_SWITCH;
- dj_report.report_params[CMD_SWITCH_PARAM_DEVBITFIELD] = 0x3F;
- dj_report.report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS] = (u8)timeout;
- return logi_dj_recv_send_report(djrcv_dev, &dj_report);
+ dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
+ if (!dj_report)
+ return -ENOMEM;
+ dj_report->report_id = REPORT_ID_DJ_SHORT;
+ dj_report->device_index = 0xFF;
+ dj_report->report_type = REPORT_TYPE_CMD_SWITCH;
+ dj_report->report_params[CMD_SWITCH_PARAM_DEVBITFIELD] = 0x3F;
+ dj_report->report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS] = (u8)timeout;
+ retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
+ kfree(dj_report);
+ return retval;
}
^ permalink raw reply [flat|nested] 234+ messages in thread* Re: [PATCH 3.4 214/214] HID: logitech: dont use stack based dj_report structures
2014-06-05 4:19 ` [PATCH 3.4 214/214] HID: logitech: dont use stack based dj_report structures Greg Kroah-Hartman
@ 2014-06-05 11:30 ` Marc Dionne
2014-06-05 12:12 ` Yijing Wang
0 siblings, 1 reply; 234+ messages in thread
From: Marc Dionne @ 2014-06-05 11:30 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Linux Kernel Mailing List, stable, Jiri Kosina, Ben Hutchings,
Yijing Wang
On Thu, Jun 5, 2014 at 12:19 AM, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> 3.4-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Marc Dionne <marc.c.dionne@gmail.com>
>
> commit d8dc3494f77a5cc3b274bae36f7e74e85cf8a407 upstream.
>
> On a system with a logitech wireless keyboard/mouse and DMA-API debugging
> enabled, this warning appears at boot:
>
> kernel: WARNING: at lib/dma-debug.c:929 check_for_stack.part.12+0x70/0xa7()
> kernel: Hardware name: MS-7593
> kernel: uhci_hcd 0000:00:1d.1: DMA-API: device driver maps memory fromstack [addr=ffff8801b0079c29]
>
> Make logi_dj_recv_query_paired_devices and logi_dj_recv_switch_to_dj_mode
> use a structure allocated with kzalloc rather than a stack based one.
>
> Signed-off-by: Marc Dionne <marc.c.dionne@gmail.com>
> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> Cc: Yijing Wang <wangyijing@huawei.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> drivers/hid/hid-logitech-dj.c | 38 ++++++++++++++++++++++++--------------
> 1 file changed, 24 insertions(+), 14 deletions(-)
>
> --- a/drivers/hid/hid-logitech-dj.c
> +++ b/drivers/hid/hid-logitech-dj.c
> @@ -474,28 +474,38 @@ static int logi_dj_recv_send_report(stru
>
> static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
> {
> - struct dj_report dj_report;
> + struct dj_report *dj_report;
> + int retval;
>
> - memset(&dj_report, 0, sizeof(dj_report));
> - dj_report.report_id = REPORT_ID_DJ_SHORT;
> - dj_report.device_index = 0xFF;
> - dj_report.report_type = REPORT_TYPE_CMD_GET_PAIRED_DEVICES;
> - return logi_dj_recv_send_report(djrcv_dev, &dj_report);
> + dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
This patch was unfortunately incorrect as is - it needs to allocate
sizeof(struct dj_report) here and a little further down. This was
later fixed in mainline by 8a55ade7655, which should also be included
if you take this - I don't see it in the current set.
> + if (!dj_report)
> + return -ENOMEM;
> + dj_report->report_id = REPORT_ID_DJ_SHORT;
> + dj_report->device_index = 0xFF;
> + dj_report->report_type = REPORT_TYPE_CMD_GET_PAIRED_DEVICES;
> + retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
> + kfree(dj_report);
> + return retval;
> }
>
>
> static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
> unsigned timeout)
> {
> - struct dj_report dj_report;
> + struct dj_report *dj_report;
> + int retval;
>
> - memset(&dj_report, 0, sizeof(dj_report));
> - dj_report.report_id = REPORT_ID_DJ_SHORT;
> - dj_report.device_index = 0xFF;
> - dj_report.report_type = REPORT_TYPE_CMD_SWITCH;
> - dj_report.report_params[CMD_SWITCH_PARAM_DEVBITFIELD] = 0x3F;
> - dj_report.report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS] = (u8)timeout;
> - return logi_dj_recv_send_report(djrcv_dev, &dj_report);
> + dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
Same here.
> + if (!dj_report)
> + return -ENOMEM;
> + dj_report->report_id = REPORT_ID_DJ_SHORT;
> + dj_report->device_index = 0xFF;
> + dj_report->report_type = REPORT_TYPE_CMD_SWITCH;
> + dj_report->report_params[CMD_SWITCH_PARAM_DEVBITFIELD] = 0x3F;
> + dj_report->report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS] = (u8)timeout;
> + retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
> + kfree(dj_report);
> + return retval;
> }
Marc
^ permalink raw reply [flat|nested] 234+ messages in thread* Re: [PATCH 3.4 214/214] HID: logitech: dont use stack based dj_report structures
2014-06-05 11:30 ` Marc Dionne
@ 2014-06-05 12:12 ` Yijing Wang
2014-06-05 15:57 ` Greg Kroah-Hartman
0 siblings, 1 reply; 234+ messages in thread
From: Yijing Wang @ 2014-06-05 12:12 UTC (permalink / raw)
To: Marc Dionne, Greg Kroah-Hartman
Cc: Linux Kernel Mailing List, stable, Jiri Kosina, Ben Hutchings
>> - dj_report.report_type = REPORT_TYPE_CMD_GET_PAIRED_DEVICES;
>> - return logi_dj_recv_send_report(djrcv_dev, &dj_report);
>> + dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
>
> This patch was unfortunately incorrect as is - it needs to allocate
> sizeof(struct dj_report) here and a little further down. This was
> later fixed in mainline by 8a55ade7655, which should also be included
> if you take this - I don't see it in the current set.
Good catch, I'm so sorry, I missed this fix patch. Marc, thanks for your review.
Hi Greg, Can you cherry pick this fix patch? upstream commit id: 8a55ade7655(dj: memory scribble in logi_dj).
Thanks!
Yijing.
>
>> + if (!dj_report)
>> + return -ENOMEM;
>> + dj_report->report_id = REPORT_ID_DJ_SHORT;
>> + dj_report->device_index = 0xFF;
>> + dj_report->report_type = REPORT_TYPE_CMD_GET_PAIRED_DEVICES;
>> + retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
>> + kfree(dj_report);
>> + return retval;
>> }
>>
>>
>> static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
>> unsigned timeout)
>> {
>> - struct dj_report dj_report;
>> + struct dj_report *dj_report;
>> + int retval;
>>
>> - memset(&dj_report, 0, sizeof(dj_report));
>> - dj_report.report_id = REPORT_ID_DJ_SHORT;
>> - dj_report.device_index = 0xFF;
>> - dj_report.report_type = REPORT_TYPE_CMD_SWITCH;
>> - dj_report.report_params[CMD_SWITCH_PARAM_DEVBITFIELD] = 0x3F;
>> - dj_report.report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS] = (u8)timeout;
>> - return logi_dj_recv_send_report(djrcv_dev, &dj_report);
>> + dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
>
> Same here.
>
>> + if (!dj_report)
>> + return -ENOMEM;
>> + dj_report->report_id = REPORT_ID_DJ_SHORT;
>> + dj_report->device_index = 0xFF;
>> + dj_report->report_type = REPORT_TYPE_CMD_SWITCH;
>> + dj_report->report_params[CMD_SWITCH_PARAM_DEVBITFIELD] = 0x3F;
>> + dj_report->report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS] = (u8)timeout;
>> + retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
>> + kfree(dj_report);
>> + return retval;
>> }
>
> Marc
>
> .
>
--
Thanks!
Yijing
^ permalink raw reply [flat|nested] 234+ messages in thread* Re: [PATCH 3.4 214/214] HID: logitech: dont use stack based dj_report structures
2014-06-05 12:12 ` Yijing Wang
@ 2014-06-05 15:57 ` Greg Kroah-Hartman
0 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 15:57 UTC (permalink / raw)
To: Yijing Wang
Cc: Marc Dionne, Linux Kernel Mailing List, stable, Jiri Kosina,
Ben Hutchings
On Thu, Jun 05, 2014 at 08:12:08PM +0800, Yijing Wang wrote:
> >> - dj_report.report_type = REPORT_TYPE_CMD_GET_PAIRED_DEVICES;
> >> - return logi_dj_recv_send_report(djrcv_dev, &dj_report);
> >> + dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
> >
> > This patch was unfortunately incorrect as is - it needs to allocate
> > sizeof(struct dj_report) here and a little further down. This was
> > later fixed in mainline by 8a55ade7655, which should also be included
> > if you take this - I don't see it in the current set.
>
> Good catch, I'm so sorry, I missed this fix patch. Marc, thanks for your review.
>
> Hi Greg, Can you cherry pick this fix patch? upstream commit id: 8a55ade7655(dj: memory scribble in logi_dj).
Now applied, thanks.
greg k-h
^ permalink raw reply [flat|nested] 234+ messages in thread
* Re: [PATCH 3.4 000/214] 3.4.92-stable review
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (213 preceding siblings ...)
2014-06-05 4:19 ` [PATCH 3.4 214/214] HID: logitech: dont use stack based dj_report structures Greg Kroah-Hartman
@ 2014-06-05 17:12 ` Guenter Roeck
2014-06-05 18:01 ` Greg Kroah-Hartman
2014-06-05 17:56 ` Shuah Khan
2014-06-05 23:19 ` Greg Kroah-Hartman
216 siblings, 1 reply; 234+ messages in thread
From: Guenter Roeck @ 2014-06-05 17:12 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, satoru.takeuchi, shuah.kh, stable
On Wed, Jun 04, 2014 at 09:16:03PM -0700, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.4.92 release.
> There are 214 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat Jun 7 04:15:47 UTC 2014.
> Anything received after that time might be too late.
>
Build results:
total: 136 pass: 109 skipped: 20 fail: 7
Qemu tests all passed.
Results are as expected.
Details are available at server.roeck-us.net:8010/builders.
I see there is an update coming to fix one of the patches; I also see
that there is a second patch with potential problems, so maybe there will
be another update. I'll monitor and report if there are differences in
test results.
I also noticed that patch 7998eb3d (powerpc: Fix 64 bit builds with binutils
2.24) does not apply cleanly to 3.4; I'll send a backport of it to the -stable
mailing list after testing it.
Guenter
^ permalink raw reply [flat|nested] 234+ messages in thread* Re: [PATCH 3.4 000/214] 3.4.92-stable review
2014-06-05 17:12 ` [PATCH 3.4 000/214] 3.4.92-stable review Guenter Roeck
@ 2014-06-05 18:01 ` Greg Kroah-Hartman
0 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 18:01 UTC (permalink / raw)
To: Guenter Roeck
Cc: linux-kernel, torvalds, akpm, satoru.takeuchi, shuah.kh, stable
On Thu, Jun 05, 2014 at 10:12:02AM -0700, Guenter Roeck wrote:
> On Wed, Jun 04, 2014 at 09:16:03PM -0700, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.4.92 release.
> > There are 214 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sat Jun 7 04:15:47 UTC 2014.
> > Anything received after that time might be too late.
> >
> Build results:
> total: 136 pass: 109 skipped: 20 fail: 7
>
> Qemu tests all passed.
>
> Results are as expected.
> Details are available at server.roeck-us.net:8010/builders.
>
> I see there is an update coming to fix one of the patches; I also see
> that there is a second patch with potential problems, so maybe there will
> be another update. I'll monitor and report if there are differences in
> test results.
Thanks, that would be appreciated.
greg k-h
^ permalink raw reply [flat|nested] 234+ messages in thread
* Re: [PATCH 3.4 000/214] 3.4.92-stable review
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (214 preceding siblings ...)
2014-06-05 17:12 ` [PATCH 3.4 000/214] 3.4.92-stable review Guenter Roeck
@ 2014-06-05 17:56 ` Shuah Khan
2014-06-05 18:01 ` Greg Kroah-Hartman
2014-06-05 23:19 ` Greg Kroah-Hartman
216 siblings, 1 reply; 234+ messages in thread
From: Shuah Khan @ 2014-06-05 17:56 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, satoru.takeuchi, stable, Shuah Khan
On 06/04/2014 10:16 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.4.92 release.
> There are 214 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat Jun 7 04:15:47 UTC 2014.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.92-rc1.gz
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system with no dmesg regressions.
-- Shuah
--
Shuah Khan
Senior Linux Kernel Developer - Open Source Group
Samsung Research America(Silicon Valley)
shuah.kh@samsung.com | (970) 672-0658
^ permalink raw reply [flat|nested] 234+ messages in thread* Re: [PATCH 3.4 000/214] 3.4.92-stable review
2014-06-05 17:56 ` Shuah Khan
@ 2014-06-05 18:01 ` Greg Kroah-Hartman
0 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 18:01 UTC (permalink / raw)
To: Shuah Khan; +Cc: linux-kernel, torvalds, akpm, linux, satoru.takeuchi, stable
On Thu, Jun 05, 2014 at 11:56:16AM -0600, Shuah Khan wrote:
> On 06/04/2014 10:16 PM, Greg Kroah-Hartman wrote:
> >This is the start of the stable review cycle for the 3.4.92 release.
> >There are 214 patches in this series, all will be posted as a response
> >to this one. If anyone has any issues with these being applied, please
> >let me know.
> >
> >Responses should be made by Sat Jun 7 04:15:47 UTC 2014.
> >Anything received after that time might be too late.
> >
> >The whole patch series can be found in one patch at:
> > kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.92-rc1.gz
> >and the diffstat can be found below.
> >
> >thanks,
> >
> >greg k-h
> >
>
> Compiled and booted on my test system with no dmesg regressions.
Thanks for testing all of these and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 234+ messages in thread
* Re: [PATCH 3.4 000/214] 3.4.92-stable review
2014-06-05 4:16 [PATCH 3.4 000/214] 3.4.92-stable review Greg Kroah-Hartman
` (215 preceding siblings ...)
2014-06-05 17:56 ` Shuah Khan
@ 2014-06-05 23:19 ` Greg Kroah-Hartman
2014-06-06 4:42 ` Guenter Roeck
216 siblings, 1 reply; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-05 23:19 UTC (permalink / raw)
To: linux-kernel; +Cc: torvalds, akpm, linux, satoru.takeuchi, shuah.kh, stable
On Wed, Jun 04, 2014 at 09:16:03PM -0700, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.4.92 release.
> There are 214 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat Jun 7 04:15:47 UTC 2014.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.92-rc1.gz
> and the diffstat can be found below.
Given the recent changes in this tree, I've released a -rc2 to handle
all of the updates.:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.92-rc1.gz
thanks,
greg k-h
^ permalink raw reply [flat|nested] 234+ messages in thread* Re: [PATCH 3.4 000/214] 3.4.92-stable review
2014-06-05 23:19 ` Greg Kroah-Hartman
@ 2014-06-06 4:42 ` Guenter Roeck
2014-06-06 13:58 ` Greg Kroah-Hartman
0 siblings, 1 reply; 234+ messages in thread
From: Guenter Roeck @ 2014-06-06 4:42 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, satoru.takeuchi, shuah.kh, stable
On Thu, Jun 05, 2014 at 04:19:24PM -0700, Greg Kroah-Hartman wrote:
> On Wed, Jun 04, 2014 at 09:16:03PM -0700, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.4.92 release.
> > There are 214 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sat Jun 7 04:15:47 UTC 2014.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.92-rc1.gz
> > and the diffstat can be found below.
>
> Given the recent changes in this tree, I've released a -rc2 to handle
> all of the updates.:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.92-rc1.gz
>
Presumably you mean
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.92-rc2.gz
Same for 3.10 and 3.14.
Guenter
^ permalink raw reply [flat|nested] 234+ messages in thread
* Re: [PATCH 3.4 000/214] 3.4.92-stable review
2014-06-06 4:42 ` Guenter Roeck
@ 2014-06-06 13:58 ` Greg Kroah-Hartman
0 siblings, 0 replies; 234+ messages in thread
From: Greg Kroah-Hartman @ 2014-06-06 13:58 UTC (permalink / raw)
To: Guenter Roeck
Cc: linux-kernel, torvalds, akpm, satoru.takeuchi, shuah.kh, stable
On Thu, Jun 05, 2014 at 09:42:54PM -0700, Guenter Roeck wrote:
> On Thu, Jun 05, 2014 at 04:19:24PM -0700, Greg Kroah-Hartman wrote:
> > On Wed, Jun 04, 2014 at 09:16:03PM -0700, Greg Kroah-Hartman wrote:
> > > This is the start of the stable review cycle for the 3.4.92 release.
> > > There are 214 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Sat Jun 7 04:15:47 UTC 2014.
> > > Anything received after that time might be too late.
> > >
> > > The whole patch series can be found in one patch at:
> > > kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.92-rc1.gz
> > > and the diffstat can be found below.
> >
> > Given the recent changes in this tree, I've released a -rc2 to handle
> > all of the updates.:
> > kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.92-rc1.gz
> >
> Presumably you mean
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.92-rc2.gz
Doh, yes, cutting and pasting and not changing the number was dumb...
> Same for 3.10 and 3.14.
Yes.
Thanks for testing and verifying it's all good.
greg k-h
^ permalink raw reply [flat|nested] 234+ messages in thread