* [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review
@ 2015-07-15 9:09 Luis Henriques
2015-07-15 9:09 ` [PATCH 3.16.y-ckt 001/185] ARM: clk-imx6q: refine sata's parent Luis Henriques
` (184 more replies)
0 siblings, 185 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:09 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Luis Henriques
This is the start of the review cycle for the Linux 3.16.7-ckt15 stable kernel.
This version contains 185 new patches, summarized below. The new patches are
posted as replies to this message and also available in this git branch:
http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.16.y-review
git://kernel.ubuntu.com/ubuntu/linux.git linux-3.16.y-review
The review period for version 3.16.7-ckt15 will be open for the next three days.
To report a problem, please reply to the relevant follow-up patch message.
For more information about the Linux 3.16.y-ckt extended stable kernel version,
see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable .
-Luis
--
.../bindings/net/marvell-armada-370-neta.txt | 2 +-
.../pinctrl/marvell,armada-370-pinctrl.txt | 4 +-
.../pinctrl/marvell,armada-375-pinctrl.txt | 4 +-
.../pinctrl/marvell,armada-38x-pinctrl.txt | 38 ++--
.../bindings/pinctrl/marvell,armada-xp-pinctrl.txt | 32 ++--
arch/arc/include/asm/atomic.h | 205 +++++++++------------
arch/arc/include/asm/bitops.h | 19 ++
arch/arc/include/asm/cmpxchg.h | 26 ++-
arch/arc/include/asm/spinlock.h | 32 ++++
arch/arm/boot/dts/armada-370-xp.dtsi | 2 -
arch/arm/boot/dts/armada-370.dtsi | 8 +
arch/arm/boot/dts/armada-xp-mv78260.dtsi | 2 +-
arch/arm/boot/dts/armada-xp-mv78460.dtsi | 2 +-
arch/arm/boot/dts/armada-xp.dtsi | 10 +-
arch/arm/kvm/interrupts.S | 10 +-
arch/arm/kvm/interrupts_head.S | 20 +-
arch/arm/mach-imx/clk-imx6q.c | 2 +-
arch/arm64/kernel/vdso/Makefile | 4 +
arch/arm64/mm/context.c | 8 +
arch/arm64/mm/hugetlbpage.c | 4 +-
arch/arm64/mm/init.c | 2 +-
arch/mips/include/asm/mach-generic/spaces.h | 4 +
arch/mips/kvm/kvm_mips.c | 2 +-
arch/powerpc/perf/core-book3s.c | 11 +-
arch/powerpc/platforms/pseries/dlpar.c | 3 +-
arch/sparc/kernel/ldc.c | 2 +-
arch/x86/Kconfig | 14 +-
arch/x86/include/asm/kvm_host.h | 2 +-
arch/x86/kernel/cpu/mcheck/mce.c | 6 +-
arch/x86/kvm/i8254.c | 2 +-
arch/x86/kvm/lapic.c | 5 +-
arch/x86/kvm/lapic.h | 2 +-
arch/x86/kvm/svm.c | 8 +-
arch/x86/pci/acpi.c | 17 +-
drivers/acpi/acpica/aclocal.h | 1 +
drivers/acpi/acpica/tbfadt.c | 21 ++-
drivers/acpi/acpica/tbutils.c | 34 ++--
drivers/acpi/acpica/tbxfload.c | 3 +-
drivers/acpi/acpica/utxfinit.c | 10 +-
drivers/acpi/bus.c | 56 ++++--
drivers/acpi/device_pm.c | 1 +
drivers/acpi/osl.c | 6 +-
drivers/ata/libata-core.c | 2 +-
drivers/base/regmap/regmap.c | 5 +-
drivers/block/rbd.c | 4 +-
drivers/bluetooth/ath3k.c | 8 +
drivers/bluetooth/btusb.c | 6 +
drivers/char/agp/intel-gtt.c | 2 +-
drivers/char/tpm/tpm_ibmvtpm.c | 5 +-
drivers/clk/clk.c | 5 +-
drivers/clk/ti/clk-dra7-atl.c | 5 +
drivers/clocksource/exynos_mct.c | 43 +++--
drivers/cpufreq/intel_pstate.c | 2 +-
drivers/crypto/talitos.c | 4 +-
drivers/dma/mv_xor.c | 72 +++++---
drivers/dma/mv_xor.h | 1 +
drivers/gpu/drm/i915/i915_reg.h | 1 +
drivers/gpu/drm/i915/intel_panel.c | 8 +
drivers/gpu/drm/qxl/qxl_cmd.c | 1 +
drivers/gpu/drm/qxl/qxl_ioctl.c | 4 +-
drivers/gpu/drm/radeon/cik.c | 34 ++++
drivers/gpu/drm/radeon/cik_sdma.c | 11 ++
drivers/gpu/drm/radeon/radeon_irq_kms.c | 2 +
drivers/gpu/drm/tegra/dpaux.c | 18 +-
drivers/hid/hid-rmi.c | 6 +-
drivers/hid/i2c-hid/i2c-hid.c | 6 +-
drivers/hwmon/mcp3021.c | 14 +-
drivers/i2c/busses/i2c-at91.c | 70 +++++--
drivers/infiniband/hw/mlx4/mad.c | 11 +-
drivers/iommu/amd_iommu.c | 6 +
drivers/leds/led-class.c | 7 +-
drivers/md/dm-stats.c | 2 +
drivers/md/persistent-data/dm-space-map-metadata.c | 50 +++--
drivers/media/dvb-frontends/af9013.c | 4 +
drivers/media/dvb-frontends/cx24116.c | 8 +-
drivers/media/dvb-frontends/cx24117.c | 2 +-
drivers/media/dvb-frontends/s5h1420.c | 2 +-
drivers/mmc/card/block.c | 8 +-
drivers/mtd/maps/dc21285.c | 4 +-
drivers/mtd/mtd_blkdevs.c | 5 +
drivers/net/ethernet/intel/e1000e/82571.c | 2 +-
drivers/net/ethernet/intel/e1000e/ich8lan.c | 8 +-
drivers/net/ethernet/intel/e1000e/netdev.c | 18 +-
drivers/net/ethernet/marvell/mvneta.c | 27 ++-
drivers/net/ethernet/mellanox/mlx4/cmd.c | 10 +-
drivers/net/ethernet/stmicro/stmmac/descs.h | 2 +
drivers/net/ethernet/stmicro/stmmac/enh_desc.c | 3 +-
drivers/net/ethernet/stmicro/stmmac/norm_desc.c | 3 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 44 ++---
drivers/net/phy/phy_device.c | 5 +-
drivers/net/wireless/ath/ath9k/htc.h | 6 +-
drivers/net/wireless/ath/ath9k/main.c | 12 +-
drivers/net/wireless/b43/main.c | 4 +
drivers/net/wireless/rndis_wlan.c | 6 +-
drivers/of/base.c | 2 +-
drivers/pcmcia/topic.h | 16 ++
drivers/phy/phy-twl4030-usb.c | 1 -
drivers/pinctrl/mvebu/pinctrl-armada-370.c | 4 +-
drivers/pinctrl/mvebu/pinctrl-armada-375.c | 4 +-
drivers/pinctrl/mvebu/pinctrl-armada-38x.c | 51 +++--
drivers/pinctrl/mvebu/pinctrl-armada-xp.c | 37 ++--
drivers/platform/x86/dell-laptop.c | 8 +-
drivers/platform/x86/ideapad-laptop.c | 10 +-
drivers/regulator/core.c | 2 +-
drivers/s390/kvm/virtio_ccw.c | 11 +-
drivers/scsi/ipr.h | 2 +-
drivers/scsi/scsi_transport_srp.c | 58 +++---
drivers/spi/spi.c | 11 +-
drivers/staging/rtl8712/rtl8712_recv.c | 3 +-
drivers/staging/vt6655/device_main.c | 4 +
drivers/tty/sysrq.c | 19 +-
drivers/usb/class/cdc-acm.c | 9 +
drivers/usb/class/cdc-acm.h | 1 +
drivers/usb/core/devio.c | 2 +-
drivers/usb/core/hub.c | 81 ++++----
drivers/usb/dwc3/gadget.c | 8 +-
drivers/w1/slaves/w1_therm.c | 62 +++++--
drivers/watchdog/omap_wdt.c | 7 +
fs/btrfs/super.c | 2 +
fs/dcache.c | 11 --
fs/ext4/indirect.c | 2 +-
fs/ext4/inode.c | 23 ++-
fs/ext4/super.c | 1 +
fs/fuse/inode.c | 2 +-
fs/inode.c | 4 +-
fs/jbd2/checkpoint.c | 7 +-
fs/jbd2/journal.c | 38 +++-
fs/kernfs/dir.c | 38 +++-
fs/kernfs/inode.c | 2 +
fs/libfs.c | 96 ++++++++++
fs/namespace.c | 39 +++-
fs/nfs/nfs3xdr.c | 2 +-
fs/nfs/nfs4proc.c | 3 +
fs/nfs/nfs4state.c | 2 +
fs/nfs/pnfs.c | 2 +
fs/proc/generic.c | 24 +++
fs/proc/inode.c | 4 +
fs/proc/internal.h | 6 +
fs/proc/proc_sysctl.c | 37 ++++
fs/proc/root.c | 9 +-
fs/sysfs/dir.c | 34 ++++
fs/sysfs/mount.c | 5 +-
fs/ufs/balloc.c | 34 ++--
fs/ufs/ialloc.c | 16 +-
fs/ufs/inode.c | 5 +-
fs/ufs/namei.c | 14 +-
fs/ufs/super.c | 11 ++
fs/ufs/ufs.h | 1 +
fs/xfs/xfs_attr_inactive.c | 10 +-
fs/xfs/xfs_symlink.c | 2 +-
include/acpi/acpixf.h | 13 +-
include/acpi/actypes.h | 1 +
include/linux/acpi.h | 2 +
include/linux/dcache.h | 57 ++++++
include/linux/fs.h | 4 +-
include/linux/jbd2.h | 4 +-
include/linux/kernfs.h | 3 +
include/linux/nfs_xdr.h | 2 +-
include/linux/of.h | 5 +-
include/linux/sysctl.h | 3 +
include/linux/sysfs.h | 15 ++
include/net/netfilter/nf_queue.h | 2 +
include/net/netns/sctp.h | 1 +
include/net/sctp/structs.h | 4 +
init/main.c | 1 +
kernel/events/core.c | 14 +-
kernel/irq/devres.c | 4 +-
kernel/power/Kconfig | 2 +-
kernel/printk/printk.c | 11 +-
kernel/rcu/tiny.c | 5 +
kernel/sched/fair.c | 25 +--
kernel/sysctl.c | 8 +-
kernel/trace/trace_events_filter.c | 10 +-
lib/bitmap.c | 17 +-
lib/lz4/lz4_decompress.c | 15 +-
mm/hugetlb.c | 19 +-
mm/kmemleak.c | 19 +-
net/9p/client.c | 3 +-
net/bridge/br_ioctl.c | 2 -
net/bridge/br_multicast.c | 11 +-
net/bridge/br_stp_if.c | 4 +-
net/ceph/osdmap.c | 2 +-
net/core/neighbour.c | 13 ++
net/core/pktgen.c | 2 +-
net/core/skbuff.c | 4 +-
net/core/sock.c | 4 +-
net/ieee802154/dgram.c | 6 +
net/ipv4/af_inet.c | 2 +
net/ipv4/ipip.c | 3 +-
net/ipv4/tcp.c | 7 +-
net/ipv4/tcp_fastopen.c | 2 -
net/mac80211/main.c | 3 +
net/netfilter/core.c | 1 +
net/netfilter/nf_internals.h | 1 +
net/netfilter/nf_queue.c | 17 ++
net/netfilter/nfnetlink_queue_core.c | 24 ++-
net/packet/af_packet.c | 20 +-
net/rose/af_rose.c | 3 +-
net/sctp/output.c | 4 +-
net/sctp/socket.c | 43 +++--
net/sunrpc/backchannel_rqst.c | 2 +-
net/wireless/util.c | 2 +-
security/integrity/ima/ima.h | 2 +-
security/integrity/ima/ima_fs.c | 4 +-
security/integrity/ima/ima_template_lib.c | 3 +-
security/selinux/hooks.c | 3 +-
sound/pci/hda/patch_realtek.c | 25 +++
sound/soc/codecs/wm5102.c | 2 +-
sound/soc/codecs/wm5110.c | 2 +-
sound/soc/codecs/wm8737.c | 6 +-
sound/soc/codecs/wm8903.h | 2 +-
sound/soc/codecs/wm8955.c | 2 +-
sound/soc/codecs/wm8960.c | 2 +-
sound/soc/codecs/wm8997.c | 2 +-
sound/soc/fsl/imx-wm8962.c | 2 +-
215 files changed, 1821 insertions(+), 830 deletions(-)
Al Viro (1):
9p: forgetting to cancel request on interrupted zero-copy RPC
Alex Deucher (1):
drm/radeon: take the mode_config mutex when dealing with hpds (v2)
Alexander Duyck (1):
e1000e: Cleanup handling of VLAN_HLEN as a part of max frame size
Alexander Sverdlin (1):
sctp: Fix race between OOTB responce and route removal
Alexey Brodkin (1):
stmmac: troubleshoot unexpected bits in des0 & des1
Alexey Sokolov (1):
cdc-acm: Add support of ATOL FPrint fiscal printers
Anton Blanchard (1):
powerpc/perf: Fix book3s kernel to userspace backtraces
Arnd Bergmann (2):
ideapad: fix software rfkill setting
tty: remove platform_sysrq_reset_seq
Arun Chandran (1):
regmap: Fix regmap_bulk_read in BE mode
Axel Lin (4):
genirq: devres: Fix testing return value of request_any_context_irq()
ASoC: wm8737: Fixup setting VMID Impedance control register
ASoC: wm8903: Fix define for WM8903_VMID_RES_250K
ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits
Bandan Das (1):
KVM: nSVM: Check for NRIPS support before updating control field
Bart Van Assche (2):
scsi_transport_srp: Introduce srp_wait_for_queuecommand()
scsi_transport_srp: Fix a race condition
Ben Segall (1):
sched/fair: Prevent throttling in early pick_next_task_fair()
Bjorn Helgaas (2):
x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A
x86/PCI: Use host bridge _CRS info on systems with >32 bit addressing
Borislav Petkov (1):
x86/mce: Fix MCE severity messages
Brian Foster (1):
xfs: don't truncate attribute extents if no extents exist
Brian King (1):
ipr: Increase default adapter init stage change timeout
Brian Norris (1):
mtd: fix: avoid race condition when accessing mtd->usecount
Catalin Marinas (2):
arm64: Do not attempt to use init_mm in reset_context()
mm: kmemleak: allow safe memory scanning during kmemleak disabling
Chris Metcalf (1):
__bitmap_parselist: fix bug in empty string handling
Chris Wilson (1):
agp/intel: Fix typo in needs_ilk_vtd_wa()
Christoffer Dall (1):
arm64: Don't report clear pmds and puds as huge
Christoph Paasch (1):
tcp: Do not call tcp_fastopen_reset_cipher from interrupt context
Chuck Lever (1):
NFS: Fix size of NFSACL SETACL operations
Cornelia Huck (1):
KVM: s390: virtio-ccw: don't overwrite config space values
Cyrille Pitchen (1):
i2c: at91: fix a race condition when using the DMA controller
Damian Eppel (1):
clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier
Dan Carpenter (7):
ACPI / resources: free memory on error in add_region_before()
HID: rmi: fix some harmless BIT() mistakes
HID: i2c-hid: fix harmless test_bit() issue
USB: devio: fix a condition in async_completed()
ath9k_htc: memory corruption calling set_bit()
rndis_wlan: harmless issue calling set_bit()
ASoC: imx-wm8962: Add a missing error check
Darrick J. Wong (1):
ext4: don't retry file block mapping on bigalloc fs with non-extent file
Dave P Martin (1):
arm64: mm: Fix freeing of the wrong memmap entries with !SPARSEMEM_VMEMMAP
David E. Box (1):
x86/iosf: Add Kconfig prompt for IOSF_MBI selection
David Fries (1):
w1_therm reference count family data
David Henningsson (1):
ALSA: hda - Fix Dock Headphone on Thinkpad X250 seen as a Line Out
David Howells (1):
VFS: Introduce inode-getting helpers for layered/unioned fs environments
Ding Wang (1):
mmc: card: Fixup request missing in mmc_blk_issue_rw_rq
Dmitry Monakhov (1):
jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail()
Dmitry Tunin (5):
ideapad_laptop: Lenovo G50-30 fix rfkill reports wireless blocked
ath3k: Add support of 0489:e076 AR3012 device
ath3k: add support of 13d3:3474 AR3012 device
Bluetooth: ath3k: add support of 04ca:300f AR3012 device
Bluetooth: ath3k: Add support of 04ca:300d AR3012 device
Eric Dumazet (2):
packet: read num_members once in packet_rcv_fanout()
ipip: fix one sparse error
Eric Sandeen (1):
xfs: fix remote symlinks on V5/CRC filesystems
Eric W. Biederman (11):
mnt: Refactor the logic for mounting sysfs and proc in a user namespace
mnt: Modify fs_fully_visible to deal with locked ro nodev and atime
netfilter: nf_qeueue: Drop queue entries on nf_unregister_hook
vfs: Ignore unlocked mounts in fs_fully_visible
fs: Add helper functions for permanently empty directories.
sysctl: Allow creating permanently empty directories that serve as mountpoints.
proc: Allow creating permanently empty directories that serve as mount points
kernfs: Add support for always empty directories.
sysfs: Add support for permanently empty directories to serve as mount points.
mnt: Update fs_fully_visible to test for permanently empty directories
vfs: Remove incorrect debugging WARN in prepend_path
Fabian Frederick (3):
fs/ufs: revert "ufs: fix deadlocks introduced by sb mutex merge"
fs/ufs: restore s_lock mutex
fs/ufs: restore s_lock mutex_init()
Felipe Balbi (1):
usb: dwc3: gadget: don't clear EP_BUSY too early
Felix Fietkau (1):
ath9k: fix DMA stop sequence for AR9003+
Frediano Ziglio (2):
drm/qxl: Do not cause spice-server to clean our objects
drm/qxl: Do not leak memory if qxl_release_list_add fails
Grygorii Strashko (1):
leds / PM: fix hibernation on arm when gpio-led used with CPU led trigger
Haggai Eran (1):
staging: rtl8712: prevent buffer overrun in recvbuf2recvframe
Hon Ching \\(Vicky\\) Lo (1):
vTPM: set virtual device before passing to ibmvtpm_reset_crq
Horia Geant? (2):
crypto: talitos - avoid memleak in talitos_alg_alloc()
Revert "crypto: talitos - convert to use be16_add_cpu()"
Ilya Dryomov (2):
crush: fix a bug in tree bucket decode
rbd: use GFP_NOIO in rbd_obj_request_create()
J. Bruce Fields (1):
selinux: fix setting of security labels on NFS
James Hogan (1):
MIPS: Fix KVM guest fixmap address
Jan Kara (1):
fs: Fix S_NOSEC handling
Jani Nikula (1):
drm/i915: fix backlight after resume on 855gm
JeHyeon Yeon (1):
LZ4 : fix the data abort issue
Jeff Layton (2):
nfs: take extra reference to fl->fl_file when running a setlk
nfs: increase size of EXCHANGE_ID name string buffer
Jesper Dangaard Brouer (1):
pktgen: adjust spacing in proc file interface output
Joe Konno (1):
intel_pstate: set BYT MSR with wrmsrl_on_cpu()
Joe Thornber (1):
dm space map metadata: fix occasional leak of a metadata block on resize
Joerg Roedel (1):
iommu/amd: Handle large pages correctly in free_pagetable
Joseph Qi (1):
jbd2: fix ocfs2 corrupt when updating journal superblock fails
Julian Anastasov (1):
neigh: do not modify unlinked entries
Jérôme Glisse (2):
drm/radeon: compute ring fix hibernation (CI GPU family) v2.
drm/radeon: SDMA fix hibernation (CI GPU family).
Konstantin Khlebnikov (1):
of: return NUMA_NO_NODE from fallback of_node_to_nid()
Krzysztof Kolasa (1):
lz4: fix system halt at boot kernel on x86_64
Krzysztof Kozlowski (1):
clk: ti: dra7-atl-clock: Fix possible ERR_PTR dereference
Lennert Buytenhek (1):
ieee802154: Fix sockaddr_ieee802154 implicit padding information leak.
Lior Amsalem (1):
dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup
Lv Zheng (3):
ACPICA: Tables: Enable both 32-bit and 64-bit FACS
ACPICA: Tables: Fix an issue that FACS initialization is performed twice
ACPICA: Tables: Enable default 64-bit FADT addresses favor
Malcolm Priestley (1):
staging: vt6655: device_rx_srv check sk_buff is NULL
Marc Zyngier (1):
arm: KVM: force execution of HCPTR access on VM exit
Marcel Holtmann (1):
Bluetooth: btusb: Fix memory leak in Intel setup routine
Marcelo Ricardo Leitner (1):
sctp: fix ASCONF list handling
Martin K. Petersen (1):
libata: Do not blacklist Micron M500DC
Martin Sperl (1):
spi: fix race freeing dummy_tx/rx before it is unmapped
Mauro Carvalho Chehab (4):
[media] s5h1420: fix a buffer overflow when checking userspace params
[media] cx24116: fix a buffer overflow when checking userspace params
[media] af9013: Don't accept invalid bandwidth
[media] cx24117: fix a buffer overflow when checking userspace params
Maxime Coquelin (1):
regmap: Fix possible shift overflow in regmap_field_init()
Michal Kazior (2):
mac80211: prevent possible crypto tx tailroom corruption
cfg80211: ignore netif running state when changing iftype
Miklos Szeredi (1):
fuse: initialize fc->release before calling it
Mikulas Patocka (1):
dm stats: fix divide by zero if 'number_of_areas' arg is zero
Mimi Zohar (1):
ima: fix ima_show_template_data_ascii()
Mugunthan V N (1):
net: phy: fix phy link up when limiting speed via device tree
Naoya Horiguchi (1):
mm/hugetlb: introduce minimum hugepage order
Nathan Fontenot (1):
powerpc/pseries: Fix possible leaked device node reference
NeilBrown (1):
phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function.
Nikolay Aleksandrov (2):
bridge: fix multicast router rlist endless loop
bridge: fix br_stp_set_bridge_priority race conditions
Oleg Nesterov (1):
perf: Fix ring_buffer_attach() RCU sync, again
Olga Kornievskaia (1):
fixing infinite OPEN loop in 4.0 stateid recovery
Omar Sandoval (1):
Btrfs: lock superblock before remounting for rw subvol
Or Gerlitz (2):
net/mlx4_core: Enhance the MAD_IFC wrapper to convert VF port to physical
IB/mlx4: Convert slave port before building address-handle
Pali Rohár (1):
dell-laptop: Fix allocating & freeing SMI buffer page
Paolo Bonzini (2):
KVM: mips: use id_to_memslot correctly
kvm: x86: fix kvm_apic_has_events to check for NULL pointer
Paul E. McKenney (1):
rcu: Correctly handle non-empty Tiny RCU callback list with none ready
Peter Zijlstra (1):
locking,arch,arc: Fold atomic_ops
Radim Krčmář (2):
KVM: x86: make vapics_in_nmi_mode atomic
KVM: x86: properly restore LVT0
Rafael J. Wysocki (4):
ACPI / PM: Add missing pm_generic_complete() invocation
ACPI / PNP: Avoid conflicting resource reservations
ACPI / init: Switch over platform to the ACPI mode later
ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage
Rafał Miłecki (1):
b43: fix support for 14e4:4321 PCI dev with BCM4321 chipset
Ralf Baechle (1):
NET: ROSE: Don't dereference NULL neighbour pointer.
Richard Fitzgerald (1):
ASoC: arizona: Fix noise generator gain TLV
Robert Schlabbach (1):
usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset
Ryan Underwood (1):
Disable write buffering on Toshiba ToPIC95
Satish Ashok (1):
bridge: multicast: restore router configuration on port link down/up
Sebastien Szymanski (1):
ARM: clk-imx6q: refine sata's parent
Shaohua Li (1):
net: don't wait for order-3 page allocation
Simon Guinot (3):
net: mvneta: introduce compatible string "marvell, armada-xp-neta"
ARM: mvebu: update Ethernet compatible string for Armada XP
net: mvneta: disable IP checksum with jumbo frames for Armada 370
Sowmini Varadhan (1):
sparc: Use GFP_ATOMIC in ldc_alloc_exp_dring() as it can be called in softirq context
Stefan Wahren (2):
regulator: core: fix constraints output buffer
clk: Fix JSON output in debugfs
Steven Rostedt (Red Hat) (2):
tracing/filter: Do not WARN on operand count going below zero
tracing/filter: Do not allow infix to exceed end of string
Stevens, Nick (1):
hwmon: (mcp3021) Fix broken output scaling
Subbaraya Sundeep Bhatta (1):
usb: dwc3: gadget: return error if command sent to DGCMD register fails
Takashi Iwai (3):
PM / sleep: Increase default DPM watchdog timeout to 60
ALSA: hda - Add headset support to Acer Aspire V5
ALSA: hda - Fix the dock headphone output on Fujitsu Lifebook E780
Theodore Ts'o (2):
ext4: fix race between truncate and __ext4_journalled_writepage()
ext4: call sync_blockdev() before invalidate_bdev() in put_super()
Thierry Reding (1):
drm/tegra: dpaux: Fix transfers larger than 4 bytes
Thomas Petazzoni (8):
pinctrl: mvebu: armada-38x: fix PCIe functions
pinctrl: mvebu: armada-370: fix spi0 pin description
pinctrl: mvebu: armada-375: remove non-existing NAND re/we pins
pinctrl: mvebu: armada-xp: remove non-existing NAND pins
pinctrl: mvebu: armada-xp: remove non-existing VDD cpu_pd functions
pinctrl: mvebu: armada-xp: fix functions of MPP48
pinctrl: mvebu: armada-375: remove incorrect space in pin description
pinctrl: mvebu: armada-38x: fix incorrect total number of GPIOs
Trond Myklebust (2):
SUNRPC: Fix a memory leak in the backchannel code
pNFS: Fix a memory leak when attempted pnfs fails
Uwe Kleine-König (2):
mtd: dc21285: use raw spinlock functions for nw_gpio_lock
watchdog: omap: assert the counter being stopped before reprogramming
Vasily Averin (1):
security_syslog() should be called once only
Vineet Gupta (2):
ARC: add compiler barrier to LLSC based cmpxchg
ARC: add smp barriers around atomics per Documentation/atomic_ops.txt
Will Deacon (1):
arm64: vdso: work-around broken ELF toolchains in Makefile
Willem de Bruijn (1):
packet: avoid out of bounds read in round robin fanout
Zidan Wang (1):
ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1]
^ permalink raw reply [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 001/185] ARM: clk-imx6q: refine sata's parent
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
@ 2015-07-15 9:09 ` Luis Henriques
2015-07-15 9:09 ` [PATCH 3.16.y-ckt 002/185] KVM: nSVM: Check for NRIPS support before updating control field Luis Henriques
` (183 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:09 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Sebastien Szymanski, Shawn Guo, Dirk Behme, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastien Szymanski <sebastien.szymanski@armadeus.com>
commit da946aeaeadcd24ff0cda9984c6fb8ed2bfd462a upstream.
According to IMX6D/Q RM, table 18-3, sata clock's parent is ahb, not ipg.
Signed-off-by: Sebastien Szymanski <sebastien.szymanski@armadeus.com>
Reviewed-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
[dirk.behme: Adjust moved file and context]
Signed-off-by: Dirk Behme <dirk.behme@gmail.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arm/mach-imx/clk-imx6q.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
index 3433b10ca968..032d1b958889 100644
--- a/arch/arm/mach-imx/clk-imx6q.c
+++ b/arch/arm/mach-imx/clk-imx6q.c
@@ -413,7 +413,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
clk[gpmi_io] = imx_clk_gate2("gpmi_io", "enfc", base + 0x78, 28);
clk[gpmi_apb] = imx_clk_gate2("gpmi_apb", "usdhc3", base + 0x78, 30);
clk[rom] = imx_clk_gate2("rom", "ahb", base + 0x7c, 0);
- clk[sata] = imx_clk_gate2("sata", "ipg", base + 0x7c, 4);
+ clk[sata] = imx_clk_gate2("sata", "ahb", base + 0x7c, 4);
clk[sdma] = imx_clk_gate2("sdma", "ahb", base + 0x7c, 6);
clk[spba] = imx_clk_gate2("spba", "ipg", base + 0x7c, 12);
clk[spdif] = imx_clk_gate2("spdif", "spdif_podf", base + 0x7c, 14);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 002/185] KVM: nSVM: Check for NRIPS support before updating control field
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
2015-07-15 9:09 ` [PATCH 3.16.y-ckt 001/185] ARM: clk-imx6q: refine sata's parent Luis Henriques
@ 2015-07-15 9:09 ` Luis Henriques
2015-07-15 9:09 ` [PATCH 3.16.y-ckt 003/185] nfs: take extra reference to fl->fl_file when running a setlk Luis Henriques
` (182 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:09 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Bandan Das, Paolo Bonzini, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Bandan Das <bsd@redhat.com>
commit f104765b4f81fd74d69e0eb161e89096deade2db upstream.
If hardware doesn't support DecodeAssist - a feature that provides
more information about the intercept in the VMCB, KVM decodes the
instruction and then updates the next_rip vmcb control field.
However, NRIP support itself depends on cpuid Fn8000_000A_EDX[NRIPS].
Since skip_emulated_instruction() doesn't verify nrip support
before accepting control.next_rip as valid, avoid writing this
field if support isn't present.
Signed-off-by: Bandan Das <bsd@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/x86/kvm/svm.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 1c10d9071958..37e85d0a1940 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -511,8 +511,10 @@ static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
{
struct vcpu_svm *svm = to_svm(vcpu);
- if (svm->vmcb->control.next_rip != 0)
+ if (svm->vmcb->control.next_rip != 0) {
+ WARN_ON(!static_cpu_has(X86_FEATURE_NRIPS));
svm->next_rip = svm->vmcb->control.next_rip;
+ }
if (!svm->next_rip) {
if (emulate_instruction(vcpu, EMULTYPE_SKIP) !=
@@ -4282,7 +4284,9 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu,
break;
}
- vmcb->control.next_rip = info->next_rip;
+ /* TODO: Advertise NRIPS to guest hypervisor unconditionally */
+ if (static_cpu_has(X86_FEATURE_NRIPS))
+ vmcb->control.next_rip = info->next_rip;
vmcb->control.exit_code = icpt_info.exit_code;
vmexit = nested_svm_exit_handled(svm);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 003/185] nfs: take extra reference to fl->fl_file when running a setlk
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
2015-07-15 9:09 ` [PATCH 3.16.y-ckt 001/185] ARM: clk-imx6q: refine sata's parent Luis Henriques
2015-07-15 9:09 ` [PATCH 3.16.y-ckt 002/185] KVM: nSVM: Check for NRIPS support before updating control field Luis Henriques
@ 2015-07-15 9:09 ` Luis Henriques
2015-07-15 9:09 ` [PATCH 3.16.y-ckt 004/185] bridge: fix multicast router rlist endless loop Luis Henriques
` (181 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:09 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jeff Layton, Trond Myklebust, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@poochiereds.net>
commit feaff8e5b2cfc3eae02cf65db7a400b0b9ffc596 upstream.
We had a report of a crash while stress testing the NFS client:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000150
IP: [<ffffffff8127b698>] locks_get_lock_context+0x8/0x90
PGD 0
Oops: 0000 [#1] SMP
Modules linked in: rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_nat ebtable_filter ebtable_broute bridge stp llc ebtables ip6table_security ip6table_mangle ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_raw ip6table_filter ip6_tables iptable_security iptable_mangle iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_raw coretemp crct10dif_pclmul ppdev crc32_pclmul crc32c_intel ghash_clmulni_intel vmw_balloon serio_raw vmw_vmci i2c_piix4 shpchp parport_pc acpi_cpufreq parport nfsd auth_rpcgss nfs_acl lockd grace sunrpc vmwgfx drm_kms_helper ttm drm mptspi scsi_transport_spi mptscsih mptbase e1000 ata_generic pata_acpi
CPU: 1 PID: 399 Comm: kworker/1:1H Not tainted 4.1.0-0.rc1.git0.1.fc23.x86_64 #1
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/30/2013
Workqueue: rpciod rpc_async_schedule [sunrpc]
task: ffff880036aea7c0 ti: ffff8800791f4000 task.ti: ffff8800791f4000
RIP: 0010:[<ffffffff8127b698>] [<ffffffff8127b698>] locks_get_lock_context+0x8/0x90
RSP: 0018:ffff8800791f7c00 EFLAGS: 00010293
RAX: ffff8800791f7c40 RBX: ffff88001f2ad8c0 RCX: ffffe8ffffc80305
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8800791f7c88 R08: ffff88007fc971d8 R09: 279656d600000000
R10: 0000034a01000000 R11: 279656d600000000 R12: ffff88001f2ad918
R13: ffff88001f2ad8c0 R14: 0000000000000000 R15: 0000000100e73040
FS: 0000000000000000(0000) GS:ffff88007fc80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000150 CR3: 0000000001c0b000 CR4: 00000000000407e0
Stack:
ffffffff8127c5b0 ffff8800791f7c18 ffffffffa0171e29 ffff8800791f7c58
ffffffffa0171ef8 ffff8800791f7c78 0000000000000246 ffff88001ea0ba00
ffff8800791f7c40 ffff8800791f7c40 00000000ff5d86a3 ffff8800791f7ca8
Call Trace:
[<ffffffff8127c5b0>] ? __posix_lock_file+0x40/0x760
[<ffffffffa0171e29>] ? rpc_make_runnable+0x99/0xa0 [sunrpc]
[<ffffffffa0171ef8>] ? rpc_wake_up_task_queue_locked.part.35+0xc8/0x250 [sunrpc]
[<ffffffff8127cd3a>] posix_lock_file_wait+0x4a/0x120
[<ffffffffa03e4f12>] ? nfs41_wake_and_assign_slot+0x32/0x40 [nfsv4]
[<ffffffffa03bf108>] ? nfs41_sequence_done+0xd8/0x2d0 [nfsv4]
[<ffffffffa03c116d>] do_vfs_lock+0x2d/0x30 [nfsv4]
[<ffffffffa03c251d>] nfs4_lock_done+0x1ad/0x210 [nfsv4]
[<ffffffffa0171a30>] ? __rpc_sleep_on_priority+0x390/0x390 [sunrpc]
[<ffffffffa0171a30>] ? __rpc_sleep_on_priority+0x390/0x390 [sunrpc]
[<ffffffffa0171a5c>] rpc_exit_task+0x2c/0xa0 [sunrpc]
[<ffffffffa0167450>] ? call_refreshresult+0x150/0x150 [sunrpc]
[<ffffffffa0172640>] __rpc_execute+0x90/0x460 [sunrpc]
[<ffffffffa0172a25>] rpc_async_schedule+0x15/0x20 [sunrpc]
[<ffffffff810baa1b>] process_one_work+0x1bb/0x410
[<ffffffff810bacc3>] worker_thread+0x53/0x480
[<ffffffff810bac70>] ? process_one_work+0x410/0x410
[<ffffffff810bac70>] ? process_one_work+0x410/0x410
[<ffffffff810c0b38>] kthread+0xd8/0xf0
[<ffffffff810c0a60>] ? kthread_worker_fn+0x180/0x180
[<ffffffff817a1aa2>] ret_from_fork+0x42/0x70
[<ffffffff810c0a60>] ? kthread_worker_fn+0x180/0x180
Jean says:
"Running locktests with a large number of iterations resulted in a
client crash. The test run took a while and hasn't finished after close
to 2 hours. The crash happened right after I gave up and killed the test
(after 107m) with Ctrl+C."
The crash happened because a NULL inode pointer got passed into
locks_get_lock_context. The call chain indicates that file_inode(filp)
returned NULL, which means that f_inode was NULL. Since that's zeroed
out in __fput, that suggests that this filp pointer outlived the last
reference.
Looking at the code, that seems possible. We copy the struct file_lock
that's passed in, but if the task is signalled at an inopportune time we
can end up trying to use that file_lock in rpciod context after the process
that requested it has already returned (and possibly put its filp
reference).
Fix this by taking an extra reference to the filp when we allocate the
lock info, and put it in nfs4_lock_release.
Reported-by: Jean Spector <jean@primarydata.com>
Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/nfs/nfs4proc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index c401b4de6b01..dd15268c003c 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -38,6 +38,7 @@
#include <linux/mm.h>
#include <linux/delay.h>
#include <linux/errno.h>
+#include <linux/file.h>
#include <linux/string.h>
#include <linux/ratelimit.h>
#include <linux/printk.h>
@@ -5433,6 +5434,7 @@ static struct nfs4_lockdata *nfs4_alloc_lockdata(struct file_lock *fl,
p->server = server;
atomic_inc(&lsp->ls_count);
p->ctx = get_nfs_open_context(ctx);
+ get_file(fl->fl_file);
memcpy(&p->fl, fl, sizeof(p->fl));
return p;
out_free_seqid:
@@ -5522,6 +5524,7 @@ static void nfs4_lock_release(void *calldata)
nfs_free_seqid(data->arg.lock_seqid);
nfs4_put_lock_state(data->lsp);
put_nfs_open_context(data->ctx);
+ fput(data->fl.fl_file);
kfree(data);
dprintk("%s: done!\n", __func__);
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 004/185] bridge: fix multicast router rlist endless loop
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (2 preceding siblings ...)
2015-07-15 9:09 ` [PATCH 3.16.y-ckt 003/185] nfs: take extra reference to fl->fl_file when running a setlk Luis Henriques
@ 2015-07-15 9:09 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 005/185] net: don't wait for order-3 page allocation Luis Henriques
` (180 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:09 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Nikolay Aleksandrov, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <razor@blackwall.org>
commit 1a040eaca1a22f8da8285ceda6b5e4a2cb704867 upstream.
Since the addition of sysfs multicast router support if one set
multicast_router to "2" more than once, then the port would be added to
the hlist every time and could end up linking to itself and thus causing an
endless loop for rlist walkers.
So to reproduce just do:
echo 2 > multicast_router; echo 2 > multicast_router;
in a bridge port and let some igmp traffic flow, for me it hangs up
in br_multicast_flood().
Fix this by adding a check in br_multicast_add_router() if the port is
already linked.
The reason this didn't happen before the addition of multicast_router
sysfs entries is because there's a !hlist_unhashed check that prevents
it.
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Fixes: 0909e11758bd ("bridge: Add multicast_router sysfs entries")
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/bridge/br_multicast.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 799379e81264..32de99bf6e42 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1166,6 +1166,9 @@ static void br_multicast_add_router(struct net_bridge *br,
struct net_bridge_port *p;
struct hlist_node *slot = NULL;
+ if (!hlist_unhashed(&port->rlist))
+ return;
+
hlist_for_each_entry(p, &br->router_list, rlist) {
if ((unsigned long) port >= (unsigned long) p)
break;
@@ -1193,12 +1196,8 @@ static void br_multicast_mark_router(struct net_bridge *br,
if (port->multicast_router != 1)
return;
- if (!hlist_unhashed(&port->rlist))
- goto timer;
-
br_multicast_add_router(br, port);
-timer:
mod_timer(&port->multicast_router_timer,
now + br->multicast_querier_interval);
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 005/185] net: don't wait for order-3 page allocation
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (3 preceding siblings ...)
2015-07-15 9:09 ` [PATCH 3.16.y-ckt 004/185] bridge: fix multicast router rlist endless loop Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 006/185] sctp: fix ASCONF list handling Luis Henriques
` (179 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Eric Dumazet, Chris Mason, Debabrata Banerjee, Shaohua Li,
David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaohua Li <shli@fb.com>
commit fb05e7a89f500cfc06ae277bdc911b281928995d upstream.
We saw excessive direct memory compaction triggered by skb_page_frag_refill.
This causes performance issues and add latency. Commit 5640f7685831e0
introduces the order-3 allocation. According to the changelog, the order-3
allocation isn't a must-have but to improve performance. But direct memory
compaction has high overhead. The benefit of order-3 allocation can't
compensate the overhead of direct memory compaction.
This patch makes the order-3 page allocation atomic. If there is no memory
pressure and memory isn't fragmented, the alloction will still success, so we
don't sacrifice the order-3 benefit here. If the atomic allocation fails,
direct memory compaction will not be triggered, skb_page_frag_refill will
fallback to order-0 immediately, hence the direct memory compaction overhead is
avoided. In the allocation failure case, kswapd is waken up and doing
compaction, so chances are allocation could success next time.
alloc_skb_with_frags is the same.
The mellanox driver does similar thing, if this is accepted, we must fix
the driver too.
V3: fix the same issue in alloc_skb_with_frags as pointed out by Eric
V2: make the changelog clearer
Cc: Eric Dumazet <edumazet@google.com>
Cc: Chris Mason <clm@fb.com>
Cc: Debabrata Banerjee <dbavatar@gmail.com>
Signed-off-by: Shaohua Li <shli@fb.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: used davem's backport to 3.14 ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/core/skbuff.c | 4 +++-
net/core/sock.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index dc27721ece4d..167a92c896b9 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -368,9 +368,11 @@ refill:
for (order = NETDEV_FRAG_PAGE_MAX_ORDER; ;) {
gfp_t gfp = gfp_mask;
- if (order)
+ if (order) {
gfp |= __GFP_COMP | __GFP_NOWARN |
__GFP_NOMEMALLOC;
+ gfp &= ~__GFP_WAIT;
+ }
nc->frag.page = alloc_pages(gfp, order);
if (likely(nc->frag.page))
break;
diff --git a/net/core/sock.c b/net/core/sock.c
index a6ddd4ada315..9956e854d0e6 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1914,8 +1914,10 @@ bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t prio)
do {
gfp_t gfp = prio;
- if (order)
+ if (order) {
gfp |= __GFP_COMP | __GFP_NOWARN | __GFP_NORETRY;
+ gfp &= ~__GFP_WAIT;
+ }
pfrag->page = alloc_pages(gfp, order);
if (likely(pfrag->page)) {
pfrag->offset = 0;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 006/185] sctp: fix ASCONF list handling
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (4 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 005/185] net: don't wait for order-3 page allocation Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 007/185] bridge: fix br_stp_set_bridge_priority race conditions Luis Henriques
` (178 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Marcelo Ricardo Leitner, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
commit 2d45a02d0166caf2627fe91897c6ffc3b19514c4 upstream.
->auto_asconf_splist is per namespace and mangled by functions like
sctp_setsockopt_auto_asconf() which doesn't guarantee any serialization.
Also, the call to inet_sk_copy_descendant() was backuping
->auto_asconf_list through the copy but was not honoring
->do_auto_asconf, which could lead to list corruption if it was
different between both sockets.
This commit thus fixes the list handling by using ->addr_wq_lock
spinlock to protect the list. A special handling is done upon socket
creation and destruction for that. Error handlig on sctp_init_sock()
will never return an error after having initialized asconf, so
sctp_destroy_sock() can be called without addrq_wq_lock. The lock now
will be take on sctp_close_sock(), before locking the socket, so we
don't do it in inverse order compared to sctp_addr_wq_timeout_handler().
Instead of taking the lock on sctp_sock_migrate() for copying and
restoring the list values, it's preferred to avoid rewritting it by
implementing sctp_copy_descendant().
Issue was found with a test application that kept flipping sysctl
default_auto_asconf on and off, but one could trigger it by issuing
simultaneous setsockopt() calls on multiple sockets or by
creating/destroying sockets fast enough. This is only triggerable
locally.
Fixes: 9f7d653b67ae ("sctp: Add Auto-ASCONF support (core).")
Reported-by: Ji Jianwen <jiji@redhat.com>
Suggested-by: Neil Horman <nhorman@tuxdriver.com>
Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
include/net/netns/sctp.h | 1 +
include/net/sctp/structs.h | 4 ++++
net/sctp/socket.c | 43 ++++++++++++++++++++++++++++++++-----------
3 files changed, 37 insertions(+), 11 deletions(-)
diff --git a/include/net/netns/sctp.h b/include/net/netns/sctp.h
index 3573a81815ad..8ba379f9e467 100644
--- a/include/net/netns/sctp.h
+++ b/include/net/netns/sctp.h
@@ -31,6 +31,7 @@ struct netns_sctp {
struct list_head addr_waitq;
struct timer_list addr_wq_timer;
struct list_head auto_asconf_splist;
+ /* Lock that protects both addr_waitq and auto_asconf_splist */
spinlock_t addr_wq_lock;
/* Lock that protects the local_addr_list writers */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index f38588bf3462..2ba9fe6f9812 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -219,6 +219,10 @@ struct sctp_sock {
atomic_t pd_mode;
/* Receive to here while partial delivery is in effect. */
struct sk_buff_head pd_lobby;
+
+ /* These must be the last fields, as they will skipped on copies,
+ * like on accept and peeloff operations
+ */
struct list_head auto_asconf_list;
int do_auto_asconf;
};
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index e3528c40a6ea..16991386baa3 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1533,8 +1533,10 @@ static void sctp_close(struct sock *sk, long timeout)
/* Supposedly, no process has access to the socket, but
* the net layers still may.
+ * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
+ * held and that should be grabbed before socket lock.
*/
- local_bh_disable();
+ spin_lock_bh(&net->sctp.addr_wq_lock);
bh_lock_sock(sk);
/* Hold the sock, since sk_common_release() will put sock_put()
@@ -1544,7 +1546,7 @@ static void sctp_close(struct sock *sk, long timeout)
sk_common_release(sk);
bh_unlock_sock(sk);
- local_bh_enable();
+ spin_unlock_bh(&net->sctp.addr_wq_lock);
sock_put(sk);
@@ -3519,6 +3521,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
return 0;
+ spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock);
if (val == 0 && sp->do_auto_asconf) {
list_del(&sp->auto_asconf_list);
sp->do_auto_asconf = 0;
@@ -3527,6 +3530,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
&sock_net(sk)->sctp.auto_asconf_splist);
sp->do_auto_asconf = 1;
}
+ spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock);
return 0;
}
@@ -4017,18 +4021,28 @@ static int sctp_init_sock(struct sock *sk)
local_bh_disable();
percpu_counter_inc(&sctp_sockets_allocated);
sock_prot_inuse_add(net, sk->sk_prot, 1);
+
+ /* Nothing can fail after this block, otherwise
+ * sctp_destroy_sock() will be called without addr_wq_lock held
+ */
if (net->sctp.default_auto_asconf) {
+ spin_lock(&sock_net(sk)->sctp.addr_wq_lock);
list_add_tail(&sp->auto_asconf_list,
&net->sctp.auto_asconf_splist);
sp->do_auto_asconf = 1;
- } else
+ spin_unlock(&sock_net(sk)->sctp.addr_wq_lock);
+ } else {
sp->do_auto_asconf = 0;
+ }
+
local_bh_enable();
return 0;
}
-/* Cleanup any SCTP per socket resources. */
+/* Cleanup any SCTP per socket resources. Must be called with
+ * sock_net(sk)->sctp.addr_wq_lock held if sp->do_auto_asconf is true
+ */
static void sctp_destroy_sock(struct sock *sk)
{
struct sctp_sock *sp;
@@ -6987,6 +7001,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
newinet->mc_list = NULL;
}
+static inline void sctp_copy_descendant(struct sock *sk_to,
+ const struct sock *sk_from)
+{
+ int ancestor_size = sizeof(struct inet_sock) +
+ sizeof(struct sctp_sock) -
+ offsetof(struct sctp_sock, auto_asconf_list);
+
+ if (sk_from->sk_family == PF_INET6)
+ ancestor_size += sizeof(struct ipv6_pinfo);
+
+ __inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
+}
+
/* Populate the fields of the newsk from the oldsk and migrate the assoc
* and its messages to the newsk.
*/
@@ -7001,7 +7028,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
struct sk_buff *skb, *tmp;
struct sctp_ulpevent *event;
struct sctp_bind_hashbucket *head;
- struct list_head tmplist;
/* Migrate socket buffer sizes and all the socket level options to the
* new socket.
@@ -7009,12 +7035,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
newsk->sk_sndbuf = oldsk->sk_sndbuf;
newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
/* Brute force copy old sctp opt. */
- if (oldsp->do_auto_asconf) {
- memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist));
- inet_sk_copy_descendant(newsk, oldsk);
- memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist));
- } else
- inet_sk_copy_descendant(newsk, oldsk);
+ sctp_copy_descendant(newsk, oldsk);
/* Restore the ep value that was overwritten with the above structure
* copy.
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 007/185] bridge: fix br_stp_set_bridge_priority race conditions
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (5 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 006/185] sctp: fix ASCONF list handling Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 008/185] packet: read num_members once in packet_rcv_fanout() Luis Henriques
` (177 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Nikolay Aleksandrov, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <razor@blackwall.org>
commit 2dab80a8b486f02222a69daca6859519e05781d9 upstream.
After the ->set() spinlocks were removed br_stp_set_bridge_priority
was left running without any protection when used via sysfs. It can
race with port add/del and could result in use-after-free cases and
corrupted lists. Tested by running port add/del in a loop with stp
enabled while setting priority in a loop, crashes are easily
reproducible.
The spinlocks around sysfs ->set() were removed in commit:
14f98f258f19 ("bridge: range check STP parameters")
There's also a race condition in the netlink priority support that is
fixed by this change, but it was introduced recently and the fixes tag
covers it, just in case it's needed the commit is:
af615762e972 ("bridge: add ageing_time, stp_state, priority over netlink")
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Fixes: 14f98f258f19 ("bridge: range check STP parameters")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/bridge/br_ioctl.c | 2 --
net/bridge/br_stp_if.c | 4 +++-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
index a9a4a1b7863d..8d423bc649b9 100644
--- a/net/bridge/br_ioctl.c
+++ b/net/bridge/br_ioctl.c
@@ -247,9 +247,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
return -EPERM;
- spin_lock_bh(&br->lock);
br_stp_set_bridge_priority(br, args[1]);
- spin_unlock_bh(&br->lock);
return 0;
case BRCTL_SET_PORT_PRIORITY:
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 189ba1e7d851..9a0005aee9ad 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -243,12 +243,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
return true;
}
-/* called under bridge lock */
+/* Acquires and releases bridge lock */
void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
{
struct net_bridge_port *p;
int wasroot;
+ spin_lock_bh(&br->lock);
wasroot = br_is_root_bridge(br);
list_for_each_entry(p, &br->port_list, list) {
@@ -266,6 +267,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
br_port_state_selection(br);
if (br_is_root_bridge(br) && !wasroot)
br_become_root_bridge(br);
+ spin_unlock_bh(&br->lock);
}
/* called under bridge lock */
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 008/185] packet: read num_members once in packet_rcv_fanout()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (6 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 007/185] bridge: fix br_stp_set_bridge_priority race conditions Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 009/185] packet: avoid out of bounds read in round robin fanout Luis Henriques
` (176 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Eric Dumazet, Willem de Bruijn, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit f98f4514d07871da7a113dd9e3e330743fd70ae4 upstream.
We need to tell compiler it must not read f->num_members multiple
times. Otherwise testing if num is not zero is flaky, and we could
attempt an invalid divide by 0 in fanout_demux_cpu()
Note bug was present in packet_rcv_fanout_hash() and
packet_rcv_fanout_lb() but final 3.1 had a simple location
after commit 95ec3eb417115fb ("packet: Add 'cpu' fanout policy.")
Fixes: dc99f600698dc ("packet: Add fanout support.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: used davem's backport to 3.14 ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/packet/af_packet.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 3eb786fd3f22..5d2e8d651747 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1346,7 +1346,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
struct packet_type *pt, struct net_device *orig_dev)
{
struct packet_fanout *f = pt->af_packet_priv;
- unsigned int num = f->num_members;
+ unsigned int num = ACCESS_ONCE(f->num_members);
struct packet_sock *po;
unsigned int idx;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 009/185] packet: avoid out of bounds read in round robin fanout
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (7 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 008/185] packet: read num_members once in packet_rcv_fanout() Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 010/185] neigh: do not modify unlinked entries Luis Henriques
` (175 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Willem de Bruijn, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <willemb@google.com>
commit 468479e6043c84f5a65299cc07cb08a22a28c2b1 upstream.
PACKET_FANOUT_LB computes f->rr_cur such that it is modulo
f->num_members. It returns the old value unconditionally, but
f->num_members may have changed since the last store. Ensure
that the return value is always < num.
When modifying the logic, simplify it further by replacing the loop
with an unconditional atomic increment.
Fixes: dc99f600698d ("packet: Add fanout support.")
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/packet/af_packet.c | 18 ++----------------
1 file changed, 2 insertions(+), 16 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 5d2e8d651747..fb0c09f85ff2 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1265,16 +1265,6 @@ static void packet_sock_destruct(struct sock *sk)
sk_refcnt_debug_dec(sk);
}
-static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
-{
- int x = atomic_read(&f->rr_cur) + 1;
-
- if (x >= num)
- x = 0;
-
- return x;
-}
-
static unsigned int fanout_demux_hash(struct packet_fanout *f,
struct sk_buff *skb,
unsigned int num)
@@ -1286,13 +1276,9 @@ static unsigned int fanout_demux_lb(struct packet_fanout *f,
struct sk_buff *skb,
unsigned int num)
{
- int cur, old;
+ unsigned int val = atomic_inc_return(&f->rr_cur);
- cur = atomic_read(&f->rr_cur);
- while ((old = atomic_cmpxchg(&f->rr_cur, cur,
- fanout_rr_next(f, num))) != cur)
- cur = old;
- return cur;
+ return val % num;
}
static unsigned int fanout_demux_cpu(struct packet_fanout *f,
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 010/185] neigh: do not modify unlinked entries
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (8 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 009/185] packet: avoid out of bounds read in round robin fanout Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 011/185] tcp: Do not call tcp_fastopen_reset_cipher from interrupt context Luis Henriques
` (174 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Eric Dumazet, Ying Xue, Julian Anastasov, David S. Miller,
Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <ja@ssi.bg>
commit 2c51a97f76d20ebf1f50fef908b986cb051fdff9 upstream.
The lockless lookups can return entry that is unlinked.
Sometimes they get reference before last neigh_cleanup_and_release,
sometimes they do not need reference. Later, any
modification attempts may result in the following problems:
1. entry is not destroyed immediately because neigh_update
can start the timer for dead entry, eg. on change to NUD_REACHABLE
state. As result, entry lives for some time but is invisible
and out of control.
2. __neigh_event_send can run in parallel with neigh_destroy
while refcnt=0 but if timer is started and expired refcnt can
reach 0 for second time leading to second neigh_destroy and
possible crash.
Thanks to Eric Dumazet and Ying Xue for their work and analyze
on the __neigh_event_send change.
Fixes: 767e97e1e0db ("neigh: RCU conversion of struct neighbour")
Fixes: a263b3093641 ("ipv4: Make neigh lookups directly in output packet path.")
Fixes: 6fd6ce2056de ("ipv6: Do not depend on rt->n in ip6_finish_output2().")
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/core/neighbour.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index ef31fef25e5a..2b0d99dad8be 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -977,6 +977,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
rc = 0;
if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
goto out_unlock_bh;
+ if (neigh->dead)
+ goto out_dead;
if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
@@ -1033,6 +1035,13 @@ out_unlock_bh:
write_unlock(&neigh->lock);
local_bh_enable();
return rc;
+
+out_dead:
+ if (neigh->nud_state & NUD_STALE)
+ goto out_unlock_bh;
+ write_unlock_bh(&neigh->lock);
+ kfree_skb(skb);
+ return 1;
}
EXPORT_SYMBOL(__neigh_event_send);
@@ -1096,6 +1105,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
(old & (NUD_NOARP | NUD_PERMANENT)))
goto out;
+ if (neigh->dead)
+ goto out;
if (!(new & NUD_VALID)) {
neigh_del_timer(neigh);
@@ -1245,6 +1256,8 @@ EXPORT_SYMBOL(neigh_update);
*/
void __neigh_set_probe_once(struct neighbour *neigh)
{
+ if (neigh->dead)
+ return;
neigh->updated = jiffies;
if (!(neigh->nud_state & NUD_FAILED))
return;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 011/185] tcp: Do not call tcp_fastopen_reset_cipher from interrupt context
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (9 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 010/185] neigh: do not modify unlinked entries Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 012/185] net: phy: fix phy link up when limiting speed via device tree Luis Henriques
` (173 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Eric Dumazet, Hannes Frederic Sowa, Christoph Paasch,
David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Paasch <cpaasch@apple.com>
commit dfea2aa654243f70dc53b8648d0bbdeec55a7df1 upstream.
tcp_fastopen_reset_cipher really cannot be called from interrupt
context. It allocates the tcp_fastopen_context with GFP_KERNEL and
calls crypto_alloc_cipher, which allocates all kind of stuff with
GFP_KERNEL.
Thus, we might sleep when the key-generation is triggered by an
incoming TFO cookie-request which would then happen in interrupt-
context, as shown by enabling CONFIG_DEBUG_ATOMIC_SLEEP:
[ 36.001813] BUG: sleeping function called from invalid context at mm/slub.c:1266
[ 36.003624] in_atomic(): 1, irqs_disabled(): 0, pid: 1016, name: packetdrill
[ 36.004859] CPU: 1 PID: 1016 Comm: packetdrill Not tainted 4.1.0-rc7 #14
[ 36.006085] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
[ 36.008250] 00000000000004f2 ffff88007f8838a8 ffffffff8171d53a ffff880075a084a8
[ 36.009630] ffff880075a08000 ffff88007f8838c8 ffffffff810967d3 ffff88007f883928
[ 36.011076] 0000000000000000 ffff88007f8838f8 ffffffff81096892 ffff88007f89be00
[ 36.012494] Call Trace:
[ 36.012953] <IRQ> [<ffffffff8171d53a>] dump_stack+0x4f/0x6d
[ 36.014085] [<ffffffff810967d3>] ___might_sleep+0x103/0x170
[ 36.015117] [<ffffffff81096892>] __might_sleep+0x52/0x90
[ 36.016117] [<ffffffff8118e887>] kmem_cache_alloc_trace+0x47/0x190
[ 36.017266] [<ffffffff81680d82>] ? tcp_fastopen_reset_cipher+0x42/0x130
[ 36.018485] [<ffffffff81680d82>] tcp_fastopen_reset_cipher+0x42/0x130
[ 36.019679] [<ffffffff81680f01>] tcp_fastopen_init_key_once+0x61/0x70
[ 36.020884] [<ffffffff81680f2c>] __tcp_fastopen_cookie_gen+0x1c/0x60
[ 36.022058] [<ffffffff816814ff>] tcp_try_fastopen+0x58f/0x730
[ 36.023118] [<ffffffff81671788>] tcp_conn_request+0x3e8/0x7b0
[ 36.024185] [<ffffffff810e3872>] ? __module_text_address+0x12/0x60
[ 36.025327] [<ffffffff8167b2e1>] tcp_v4_conn_request+0x51/0x60
[ 36.026410] [<ffffffff816727e0>] tcp_rcv_state_process+0x190/0xda0
[ 36.027556] [<ffffffff81661f97>] ? __inet_lookup_established+0x47/0x170
[ 36.028784] [<ffffffff8167c2ad>] tcp_v4_do_rcv+0x16d/0x3d0
[ 36.029832] [<ffffffff812e6806>] ? security_sock_rcv_skb+0x16/0x20
[ 36.030936] [<ffffffff8167cc8a>] tcp_v4_rcv+0x77a/0x7b0
[ 36.031875] [<ffffffff816af8c3>] ? iptable_filter_hook+0x33/0x70
[ 36.032953] [<ffffffff81657d22>] ip_local_deliver_finish+0x92/0x1f0
[ 36.034065] [<ffffffff81657f1a>] ip_local_deliver+0x9a/0xb0
[ 36.035069] [<ffffffff81657c90>] ? ip_rcv+0x3d0/0x3d0
[ 36.035963] [<ffffffff81657569>] ip_rcv_finish+0x119/0x330
[ 36.036950] [<ffffffff81657ba7>] ip_rcv+0x2e7/0x3d0
[ 36.037847] [<ffffffff81610652>] __netif_receive_skb_core+0x552/0x930
[ 36.038994] [<ffffffff81610a57>] __netif_receive_skb+0x27/0x70
[ 36.040033] [<ffffffff81610b72>] process_backlog+0xd2/0x1f0
[ 36.041025] [<ffffffff81611482>] net_rx_action+0x122/0x310
[ 36.042007] [<ffffffff81076743>] __do_softirq+0x103/0x2f0
[ 36.042978] [<ffffffff81723e3c>] do_softirq_own_stack+0x1c/0x30
This patch moves the call to tcp_fastopen_init_key_once to the places
where a listener socket creates its TFO-state, which always happens in
user-context (either from the setsockopt, or implicitly during the
listen()-call)
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Fixes: 222e83d2e0ae ("tcp: switch tcp_fastopen key generation to net_get_random_once")
Signed-off-by: Christoph Paasch <cpaasch@apple.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/ipv4/af_inet.c | 2 ++
net/ipv4/tcp.c | 7 +++++--
net/ipv4/tcp_fastopen.c | 2 --
3 files changed, 7 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index d156b3c5f363..13fa803ff549 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -228,6 +228,8 @@ int inet_listen(struct socket *sock, int backlog)
err = 0;
if (err)
goto out;
+
+ tcp_fastopen_init_key_once(true);
}
err = inet_csk_listen_start(sk, backlog);
if (err)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 59b579683c1f..9c4f0d2f2892 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2684,10 +2684,13 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
case TCP_FASTOPEN:
if (val >= 0 && ((1 << sk->sk_state) & (TCPF_CLOSE |
- TCPF_LISTEN)))
+ TCPF_LISTEN))) {
+ tcp_fastopen_init_key_once(true);
+
err = fastopen_init_queue(sk, val);
- else
+ } else {
err = -EINVAL;
+ }
break;
case TCP_TIMESTAMP:
if (!tp->repair)
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 2d925f65c2cc..6088c58bc54c 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -78,8 +78,6 @@ static bool __tcp_fastopen_cookie_gen(const void *path,
struct tcp_fastopen_context *ctx;
bool ok = false;
- tcp_fastopen_init_key_once(true);
-
rcu_read_lock();
ctx = rcu_dereference(tcp_fastopen_ctx);
if (ctx) {
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 012/185] net: phy: fix phy link up when limiting speed via device tree
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (10 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 011/185] tcp: Do not call tcp_fastopen_reset_cipher from interrupt context Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 013/185] sctp: Fix race between OOTB responce and route removal Luis Henriques
` (172 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Mugunthan V N, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Mugunthan V N <mugunthanvnm@ti.com>
commit eb686231fce3770299760f24fdcf5ad041f44153 upstream.
When limiting phy link speed using "max-speed" to 100mbps or less on a
giga bit phy, phy never completes auto negotiation and phy state
machine is held in PHY_AN. Fixing this issue by comparing the giga
bit advertise though phydev->supported doesn't have it but phy has
BMSR_ESTATEN set. So that auto negotiation is restarted as old and
new advertise are different and link comes up fine.
Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/phy/phy_device.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 22c57be4dfa0..5a501bca344f 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -780,10 +780,11 @@ static int genphy_config_advert(struct phy_device *phydev)
if (phydev->supported & (SUPPORTED_1000baseT_Half |
SUPPORTED_1000baseT_Full)) {
adv |= ethtool_adv_to_mii_ctrl1000_t(advertise);
- if (adv != oldadv)
- changed = 1;
}
+ if (adv != oldadv)
+ changed = 1;
+
err = phy_write(phydev, MII_CTRL1000, adv);
if (err < 0)
return err;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 013/185] sctp: Fix race between OOTB responce and route removal
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (11 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 012/185] net: phy: fix phy link up when limiting speed via device tree Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 014/185] x86/mce: Fix MCE severity messages Luis Henriques
` (171 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Alexander Sverdlin, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
commit 29c4afc4e98f4dc0ea9df22c631841f9c220b944 upstream.
There is NULL pointer dereference possible during statistics update if the route
used for OOTB responce is removed at unfortunate time. If the route exists when
we receive OOTB packet and we finally jump into sctp_packet_transmit() to send
ABORT, but in the meantime route is removed under our feet, we take "no_route"
path and try to update stats with IP_INC_STATS(sock_net(asoc->base.sk), ...).
But sctp_ootb_pkt_new() used to prepare responce packet doesn't call
sctp_transport_set_owner() and therefore there is no asoc associated with this
packet. Probably temporary asoc just for OOTB responces is overkill, so just
introduce a check like in all other places in sctp_packet_transmit(), where
"asoc" is dereferenced.
To reproduce this, one needs to
0. ensure that sctp module is loaded (otherwise ABORT is not generated)
1. remove default route on the machine
2. while true; do
ip route del [interface-specific route]
ip route add [interface-specific route]
done
3. send enough OOTB packets (i.e. HB REQs) from another host to trigger ABORT
responce
On x86_64 the crash looks like this:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
IP: [<ffffffffa05ec9ac>] sctp_packet_transmit+0x63c/0x730 [sctp]
PGD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: ...
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 4.0.5-1-ARCH #1
Hardware name: ...
task: ffffffff818124c0 ti: ffffffff81800000 task.ti: ffffffff81800000
RIP: 0010:[<ffffffffa05ec9ac>] [<ffffffffa05ec9ac>] sctp_packet_transmit+0x63c/0x730 [sctp]
RSP: 0018:ffff880127c037b8 EFLAGS: 00010296
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000015ff66b480
RDX: 00000015ff66b400 RSI: ffff880127c17200 RDI: ffff880123403700
RBP: ffff880127c03888 R08: 0000000000017200 R09: ffffffff814625af
R10: ffffea00047e4680 R11: 00000000ffffff80 R12: ffff8800b0d38a28
R13: ffff8800b0d38a28 R14: ffff8800b3e88000 R15: ffffffffa05f24e0
FS: 0000000000000000(0000) GS:ffff880127c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000020 CR3: 00000000c855b000 CR4: 00000000000007f0
Stack:
ffff880127c03910 ffff8800b0d38a28 ffffffff8189d240 ffff88011f91b400
ffff880127c03828 ffffffffa05c94c5 0000000000000000 ffff8800baa1c520
0000000000000000 0000000000000001 0000000000000000 0000000000000000
Call Trace:
<IRQ>
[<ffffffffa05c94c5>] ? sctp_sf_tabort_8_4_8.isra.20+0x85/0x140 [sctp]
[<ffffffffa05d6b42>] ? sctp_transport_put+0x52/0x80 [sctp]
[<ffffffffa05d0bfc>] sctp_do_sm+0xb8c/0x19a0 [sctp]
[<ffffffff810b0e00>] ? trigger_load_balance+0x90/0x210
[<ffffffff810e0329>] ? update_process_times+0x59/0x60
[<ffffffff812c7a40>] ? timerqueue_add+0x60/0xb0
[<ffffffff810e0549>] ? enqueue_hrtimer+0x29/0xa0
[<ffffffff8101f599>] ? read_tsc+0x9/0x10
[<ffffffff8116d4b5>] ? put_page+0x55/0x60
[<ffffffff810ee1ad>] ? clockevents_program_event+0x6d/0x100
[<ffffffff81462b68>] ? skb_free_head+0x58/0x80
[<ffffffffa029a10b>] ? chksum_update+0x1b/0x27 [crc32c_generic]
[<ffffffff81283f3e>] ? crypto_shash_update+0xce/0xf0
[<ffffffffa05d3993>] sctp_endpoint_bh_rcv+0x113/0x280 [sctp]
[<ffffffffa05dd4e6>] sctp_inq_push+0x46/0x60 [sctp]
[<ffffffffa05ed7a0>] sctp_rcv+0x880/0x910 [sctp]
[<ffffffffa05ecb50>] ? sctp_packet_transmit_chunk+0xb0/0xb0 [sctp]
[<ffffffffa05ecb70>] ? sctp_csum_update+0x20/0x20 [sctp]
[<ffffffff814b05a5>] ? ip_route_input_noref+0x235/0xd30
[<ffffffff81051d6b>] ? ack_ioapic_level+0x7b/0x150
[<ffffffff814b27be>] ip_local_deliver_finish+0xae/0x210
[<ffffffff814b2e15>] ip_local_deliver+0x35/0x90
[<ffffffff814b2a15>] ip_rcv_finish+0xf5/0x370
[<ffffffff814b3128>] ip_rcv+0x2b8/0x3a0
[<ffffffff81474193>] __netif_receive_skb_core+0x763/0xa50
[<ffffffff81476c28>] __netif_receive_skb+0x18/0x60
[<ffffffff81476cb0>] netif_receive_skb_internal+0x40/0xd0
[<ffffffff814776c8>] napi_gro_receive+0xe8/0x120
[<ffffffffa03946aa>] rtl8169_poll+0x2da/0x660 [r8169]
[<ffffffff8147896a>] net_rx_action+0x21a/0x360
[<ffffffff81078dc1>] __do_softirq+0xe1/0x2d0
[<ffffffff8107912d>] irq_exit+0xad/0xb0
[<ffffffff8157d158>] do_IRQ+0x58/0xf0
[<ffffffff8157b06d>] common_interrupt+0x6d/0x6d
<EOI>
[<ffffffff810e1218>] ? hrtimer_start+0x18/0x20
[<ffffffffa05d65f9>] ? sctp_transport_destroy_rcu+0x29/0x30 [sctp]
[<ffffffff81020c50>] ? mwait_idle+0x60/0xa0
[<ffffffff810216ef>] arch_cpu_idle+0xf/0x20
[<ffffffff810b731c>] cpu_startup_entry+0x3ec/0x480
[<ffffffff8156b365>] rest_init+0x85/0x90
[<ffffffff818eb035>] start_kernel+0x48b/0x4ac
[<ffffffff818ea120>] ? early_idt_handlers+0x120/0x120
[<ffffffff818ea339>] x86_64_start_reservations+0x2a/0x2c
[<ffffffff818ea49c>] x86_64_start_kernel+0x161/0x184
Code: 90 48 8b 80 b8 00 00 00 48 89 85 70 ff ff ff 48 83 bd 70 ff ff ff 00 0f 85 cd fa ff ff 48 89 df 31 db e8 18 63 e7 e0 48 8b 45 80 <48> 8b 40 20 48 8b 40 30 48 8b 80 68 01 00 00 65 48 ff 40 78 e9
RIP [<ffffffffa05ec9ac>] sctp_packet_transmit+0x63c/0x730 [sctp]
RSP <ffff880127c037b8>
CR2: 0000000000000020
---[ end trace 5aec7fd2dc983574 ]---
Kernel panic - not syncing: Fatal exception in interrupt
Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff)
drm_kms_helper: panic occurred, switching back to text console
---[ end Kernel panic - not syncing: Fatal exception in interrupt
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/sctp/output.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 3f5b7221dda3..1cfa46bc60c6 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -599,7 +599,9 @@ out:
return err;
no_route:
kfree_skb(nskb);
- IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
+
+ if (asoc)
+ IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
/* FIXME: Returning the 'err' will effect all the associations
* associated with a socket, although only one of the paths of the
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 014/185] x86/mce: Fix MCE severity messages
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (12 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 013/185] sctp: Fix race between OOTB responce and route removal Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 015/185] [media] s5h1420: fix a buffer overflow when checking userspace params Luis Henriques
` (170 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Borislav Petkov, H. Peter Anvin, Linus Torvalds, Peter Zijlstra,
Thomas Gleixner, Tony Luck, Ingo Molnar, Kamal Mostafa,
Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <bp@suse.de>
commit 17fea54bf0ab34fa09a06bbde2f58ed7bbdf9299 upstream.
Derek noticed that a critical MCE gets reported with the wrong
error type description:
[Hardware Error]: CPU 34: Machine Check Exception: 5 Bank 9: f200003f000100b0
[Hardware Error]: RIP !INEXACT! 10:<ffffffff812e14c1> {intel_idle+0xb1/0x170}
[Hardware Error]: TSC 49587b8e321cb
[Hardware Error]: PROCESSOR 0:306e4 TIME 1431561296 SOCKET 1 APIC 29
[Hardware Error]: Some CPUs didn't answer in synchronization
[Hardware Error]: Machine check: Invalid
^^^^^^^
The last line with 'Invalid' should have printed the high level
MCE error type description we get from mce_severity, i.e.
something like:
[Hardware Error]: Machine check: Action required: data load error in a user process
this happens due to the fact that mce_no_way_out() iterates over
all MCA banks and possibly overwrites the @msg argument which is
used in the panic printing later.
Change behavior to take the message of only and the (last)
critical MCE it detects.
Reported-by: Derek <denc716@gmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Tony Luck <tony.luck@intel.com>
Link: http://lkml.kernel.org/r/1431936437-25286-3-git-send-email-bp@alien8.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[ kamal: backport to 3.13-stable: context ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/x86/kernel/cpu/mcheck/mce.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 9a79c8dbd8e8..5648b506f3ae 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -660,6 +660,7 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
struct pt_regs *regs)
{
int i, ret = 0;
+ char *tmp;
for (i = 0; i < mca_cfg.banks; i++) {
m->status = mce_rdmsrl(MSR_IA32_MCx_STATUS(i));
@@ -668,8 +669,11 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
if (quirk_no_way_out)
quirk_no_way_out(i, m, regs);
}
- if (mce_severity(m, mca_cfg.tolerant, msg) >= MCE_PANIC_SEVERITY)
+
+ if (mce_severity(m, mca_cfg.tolerant, &tmp) >= MCE_PANIC_SEVERITY) {
+ *msg = tmp;
ret = 1;
+ }
}
return ret;
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 015/185] [media] s5h1420: fix a buffer overflow when checking userspace params
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (13 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 014/185] x86/mce: Fix MCE severity messages Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 016/185] [media] cx24116: " Luis Henriques
` (169 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Mauro Carvalho Chehab, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
commit 12f4543f5d6811f864e6c4952eb27253c7466c02 upstream.
The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up to 7 values:
drivers/media/dvb-frontends/s5h1420.c:193 s5h1420_send_master_cmd() error: buffer overflow 'cmd->msg' 6 <= 7
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/media/dvb-frontends/s5h1420.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c
index 93eeaf7118fd..0b4f8fe6bf99 100644
--- a/drivers/media/dvb-frontends/s5h1420.c
+++ b/drivers/media/dvb-frontends/s5h1420.c
@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struct dvb_frontend* fe,
int result = 0;
dprintk("enter %s\n", __func__);
- if (cmd->msg_len > 8)
+ if (cmd->msg_len > sizeof(cmd->msg))
return -EINVAL;
/* setup for DISEQC */
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 016/185] [media] cx24116: fix a buffer overflow when checking userspace params
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (14 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 015/185] [media] s5h1420: fix a buffer overflow when checking userspace params Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 017/185] [media] af9013: Don't accept invalid bandwidth Luis Henriques
` (168 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Mauro Carvalho Chehab, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
commit 1fa2337a315a2448c5434f41e00d56b01a22283c upstream.
The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/media/dvb-frontends/cx24116.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c
index 2916d7c74a1d..7bc68b355c0b 100644
--- a/drivers/media/dvb-frontends/cx24116.c
+++ b/drivers/media/dvb-frontends/cx24116.c
@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
struct cx24116_state *state = fe->demodulator_priv;
int i, ret;
+ /* Validate length */
+ if (d->msg_len > sizeof(d->msg))
+ return -EINVAL;
+
/* Dump DiSEqC message */
if (debug) {
printk(KERN_INFO "cx24116: %s(", __func__);
@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
printk(") toneburst=%d\n", toneburst);
}
- /* Validate length */
- if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS))
- return -EINVAL;
-
/* DiSEqC message */
for (i = 0; i < d->msg_len; i++)
state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 017/185] [media] af9013: Don't accept invalid bandwidth
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (15 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 016/185] [media] cx24116: " Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 018/185] [media] cx24117: fix a buffer overflow when checking userspace params Luis Henriques
` (167 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Mauro Carvalho Chehab, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
commit d7b76c91f471413de9ded837bddeca2164786571 upstream.
If userspace sends an invalid bandwidth, it should either return
EINVAL or switch to auto mode.
This driver will go past an array and program the hardware on a
wrong way if this happens.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/media/dvb-frontends/af9013.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c
index fb504f1e9125..5930aee6b5d0 100644
--- a/drivers/media/dvb-frontends/af9013.c
+++ b/drivers/media/dvb-frontends/af9013.c
@@ -606,6 +606,10 @@ static int af9013_set_frontend(struct dvb_frontend *fe)
}
}
+ /* Return an error if can't find bandwidth or the right clock */
+ if (i == ARRAY_SIZE(coeff_lut))
+ return -EINVAL;
+
ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val,
sizeof(coeff_lut[i].val));
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 018/185] [media] cx24117: fix a buffer overflow when checking userspace params
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (16 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 017/185] [media] af9013: Don't accept invalid bandwidth Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 019/185] spi: fix race freeing dummy_tx/rx before it is unmapped Luis Henriques
` (166 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Mauro Carvalho Chehab, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
commit 82e3b88b679049f043fe9b03991d6d66fc0a43c8 upstream.
The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/media/dvb-frontends/cx24117.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/dvb-frontends/cx24117.c b/drivers/media/dvb-frontends/cx24117.c
index a6c3c9e2e897..d2eab0676d30 100644
--- a/drivers/media/dvb-frontends/cx24117.c
+++ b/drivers/media/dvb-frontends/cx24117.c
@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struct dvb_frontend *fe,
dev_dbg(&state->priv->i2c->dev, ")\n");
/* Validate length */
- if (d->msg_len > 15)
+ if (d->msg_len > sizeof(d->msg))
return -EINVAL;
/* DiSEqC message */
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 019/185] spi: fix race freeing dummy_tx/rx before it is unmapped
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (17 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 018/185] [media] cx24117: fix a buffer overflow when checking userspace params Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 020/185] mtd: fix: avoid race condition when accessing mtd->usecount Luis Henriques
` (165 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Martin Sperl, Mark Brown, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Sperl <kernel@martin.sperl.org>
commit 8e76ef88f607174082023f50b87fe12dcdbe5db5 upstream.
Fix a race (with some kernel configurations) where a queued
master->pump_messages runs and frees dummy_tx/rx before
spi_unmap_msg is running (or is finished).
This results in the following messages:
BUG: Bad page state in process
page:db7ba030 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0x200(arch_1)
page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set
...
Reported-by: Noralf Trønnes <noralf@tronnes.org>
Suggested-by: Noralf Trønnes <noralf@tronnes.org>
Tested-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/spi/spi.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 577605167be2..3950e4495093 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1039,9 +1039,6 @@ void spi_finalize_current_message(struct spi_master *master)
spin_lock_irqsave(&master->queue_lock, flags);
mesg = master->cur_msg;
- master->cur_msg = NULL;
-
- queue_kthread_work(&master->kworker, &master->pump_messages);
spin_unlock_irqrestore(&master->queue_lock, flags);
spi_unmap_msg(master, mesg);
@@ -1054,9 +1051,13 @@ void spi_finalize_current_message(struct spi_master *master)
}
}
- trace_spi_message_done(mesg);
-
+ spin_lock_irqsave(&master->queue_lock, flags);
+ master->cur_msg = NULL;
master->cur_msg_prepared = false;
+ queue_kthread_work(&master->kworker, &master->pump_messages);
+ spin_unlock_irqrestore(&master->queue_lock, flags);
+
+ trace_spi_message_done(mesg);
mesg->state = NULL;
if (mesg->complete)
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 020/185] mtd: fix: avoid race condition when accessing mtd->usecount
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (18 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 019/185] spi: fix race freeing dummy_tx/rx before it is unmapped Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 021/185] intel_pstate: set BYT MSR with wrmsrl_on_cpu() Luis Henriques
` (164 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Brian Norris, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <computersforpeace@gmail.com>
commit 073db4a51ee43ccb827f54a4261c0583b028d5ab upstream.
On A MIPS 32-cores machine a BUG_ON was triggered because some acesses to
mtd->usecount were done without taking mtd_table_mutex.
kernel: Call Trace:
kernel: [<ffffffff80401818>] __put_mtd_device+0x20/0x50
kernel: [<ffffffff804086f4>] blktrans_release+0x8c/0xd8
kernel: [<ffffffff802577e0>] __blkdev_put+0x1a8/0x200
kernel: [<ffffffff802579a4>] blkdev_close+0x1c/0x30
kernel: [<ffffffff8022006c>] __fput+0xac/0x250
kernel: [<ffffffff80171208>] task_work_run+0xd8/0x120
kernel: [<ffffffff8012c23c>] work_notifysig+0x10/0x18
kernel:
kernel:
Code: 2442ffff ac8202d8 000217fe <00020336> dc820128 10400003
00000000 0040f809 00000000
kernel: ---[ end trace 080fbb4579b47a73 ]---
Fixed by taking the mutex in blktrans_open and blktrans_release.
Note that this locking is already suggested in
include/linux/mtd/blktrans.h:
struct mtd_blktrans_ops {
...
/* Called with mtd_table_mutex held; no race with add/remove */
int (*open)(struct mtd_blktrans_dev *dev);
void (*release)(struct mtd_blktrans_dev *dev);
...
};
But we weren't following it.
Originally reported by (and patched by) Zhang and Giuseppe,
independently. Improved and rewritten.
Reported-by: Zhang Xingcai <zhangxingcai@huawei.com>
Reported-by: Giuseppe Cantavenera <giuseppe.cantavenera.ext@nokia.com>
Tested-by: Giuseppe Cantavenera <giuseppe.cantavenera.ext@nokia.com>
Acked-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/mtd/mtd_blkdevs.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index 43e30992a369..7266a318628c 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -200,6 +200,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/
mutex_lock(&dev->lock);
+ mutex_lock(&mtd_table_mutex);
if (dev->open)
goto unlock;
@@ -223,6 +224,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
unlock:
dev->open++;
+ mutex_unlock(&mtd_table_mutex);
mutex_unlock(&dev->lock);
blktrans_dev_put(dev);
return ret;
@@ -233,6 +235,7 @@ error_release:
error_put:
module_put(dev->tr->owner);
kref_put(&dev->ref, blktrans_dev_release);
+ mutex_unlock(&mtd_table_mutex);
mutex_unlock(&dev->lock);
blktrans_dev_put(dev);
return ret;
@@ -246,6 +249,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
return;
mutex_lock(&dev->lock);
+ mutex_lock(&mtd_table_mutex);
if (--dev->open)
goto unlock;
@@ -259,6 +263,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
__put_mtd_device(dev->mtd);
}
unlock:
+ mutex_unlock(&mtd_table_mutex);
mutex_unlock(&dev->lock);
blktrans_dev_put(dev);
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 021/185] intel_pstate: set BYT MSR with wrmsrl_on_cpu()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (19 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 020/185] mtd: fix: avoid race condition when accessing mtd->usecount Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 022/185] leds / PM: fix hibernation on arm when gpio-led used with CPU led trigger Luis Henriques
` (163 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Joe Konno, Rafael J. Wysocki, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Konno <joe.konno@intel.com>
commit 0dd23f94251f49da99a6cbfb22418b2d757d77d6 upstream.
Commit 007bea098b86 (intel_pstate: Add setting voltage value for
baytrail P states.) introduced byt_set_pstate() with the assumption that
it would always be run by the CPU whose MSR is to be written by it. It
turns out, however, that is not always the case in practice, so modify
byt_set_pstate() to enforce the MSR write done by it to always happen on
the right CPU.
Fixes: 007bea098b86 (intel_pstate: Add setting voltage value for baytrail P states.)
Signed-off-by: Joe Konno <joe.konno@intel.com>
Acked-by: Kristen Carlson Accardi <kristen@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/cpufreq/intel_pstate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index fafc7d05e1f9..0a91eea08198 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -442,7 +442,7 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate)
val |= vid;
- wrmsrl(MSR_IA32_PERF_CTL, val);
+ wrmsrl_on_cpu(cpudata->cpu, MSR_IA32_PERF_CTL, val);
}
#define BYT_BCLK_FREQS 5
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 022/185] leds / PM: fix hibernation on arm when gpio-led used with CPU led trigger
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (20 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 021/185] intel_pstate: set BYT MSR with wrmsrl_on_cpu() Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 023/185] crypto: talitos - avoid memleak in talitos_alg_alloc() Luis Henriques
` (162 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Grygorii Strashko, Rafael J. Wysocki, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Grygorii Strashko <Grygorii.Strashko@linaro.org>
commit 084609bf727981c7a2e6e69aefe0052c9d793300 upstream.
Setting a dev_pm_ops suspend/resume pair of callbacks but not a set of
hibernation callbacks means those pm functions will not be
called upon hibernation - that leads to system crash on ARM during
freezing if gpio-led is used in combination with CPU led trigger.
It may happen after freeze_noirq stage (GPIO is suspended)
and before syscore_suspend stage (CPU led trigger is suspended)
- usually when disable_nonboot_cpus() is called.
Log:
PM: noirq freeze of devices complete after 1.425 msecs
Disabling non-boot CPUs ...
^ system may crash or stuck here with message (TI AM572x)
WARNING: CPU: 0 PID: 3100 at drivers/bus/omap_l3_noc.c:148 l3_interrupt_handler+0x22c/0x370()
44000000.ocp:L3 Custom Error: MASTER MPU TARGET L4_PER1_P3 (Idle): Data Access in Supervisor mode during Functional access
CPU1: shutdown
^ or here
Fix this by using SIMPLE_DEV_PM_OPS, which appropriately
assigns the suspend and hibernation callbacks and move
led_suspend/led_resume under CONFIG_PM_SLEEP to avoid
build warnings.
Fixes: 73e1ab41a80d (leds: Convert led class driver from legacy pm ops to dev_pm_ops)
Signed-off-by: Grygorii Strashko <Grygorii.Strashko@linaro.org>
Acked-by: Jacek Anaszewski <j.anaszewski@samsung.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/leds/led-class.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
index f37d63cf726b..825545cdfb10 100644
--- a/drivers/leds/led-class.c
+++ b/drivers/leds/led-class.c
@@ -178,6 +178,7 @@ void led_classdev_resume(struct led_classdev *led_cdev)
}
EXPORT_SYMBOL_GPL(led_classdev_resume);
+#ifdef CONFIG_PM_SLEEP
static int led_suspend(struct device *dev)
{
struct led_classdev *led_cdev = dev_get_drvdata(dev);
@@ -197,11 +198,9 @@ static int led_resume(struct device *dev)
return 0;
}
+#endif
-static const struct dev_pm_ops leds_class_dev_pm_ops = {
- .suspend = led_suspend,
- .resume = led_resume,
-};
+static SIMPLE_DEV_PM_OPS(leds_class_dev_pm_ops, led_suspend, led_resume);
/**
* led_classdev_register - register a new object of led_classdev class.
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 023/185] crypto: talitos - avoid memleak in talitos_alg_alloc()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (21 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 022/185] leds / PM: fix hibernation on arm when gpio-led used with CPU led trigger Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 024/185] Revert "crypto: talitos - convert to use be16_add_cpu()" Luis Henriques
` (161 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Horia Geanta, Herbert Xu, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Horia Geant? <horia.geanta@freescale.com>
commit 5fa7dadc898567ce14d6d6d427e7bd8ce6eb5d39 upstream.
Fixes: 1d11911a8c57 ("crypto: talitos - fix warning: 'alg' may be used uninitialized in this function")
Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/crypto/talitos.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 624b8be0c365..eb12caa8e94a 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -2563,6 +2563,7 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
break;
default:
dev_err(dev, "unknown algorithm type %d\n", t_alg->algt.type);
+ kfree(t_alg);
return ERR_PTR(-EINVAL);
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 024/185] Revert "crypto: talitos - convert to use be16_add_cpu()"
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (22 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 023/185] crypto: talitos - avoid memleak in talitos_alg_alloc() Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 025/185] genirq: devres: Fix testing return value of request_any_context_irq() Luis Henriques
` (160 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Wei Yongjun, Horia Geanta, Herbert Xu, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Horia Geant? <horia.geanta@freescale.com>
commit 69d9cd8c592f1abce820dbce7181bbbf6812cfbd upstream.
This reverts commit 7291a932c6e27d9768e374e9d648086636daf61c.
The conversion to be16_add_cpu() is incorrect in case cryptlen is
negative due to premature (i.e. before addition / subtraction)
implicit conversion of cryptlen (int -> u16) leading to sign loss.
Cc: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/crypto/talitos.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index eb12caa8e94a..307931528eb2 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -927,7 +927,8 @@ static int sg_to_link_tbl(struct scatterlist *sg, int sg_count,
sg_count--;
link_tbl_ptr--;
}
- be16_add_cpu(&link_tbl_ptr->len, cryptlen);
+ link_tbl_ptr->len = cpu_to_be16(be16_to_cpu(link_tbl_ptr->len)
+ + cryptlen);
/* tag end of link table */
link_tbl_ptr->j_extent = DESC_PTR_LNKTBL_RETURN;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 025/185] genirq: devres: Fix testing return value of request_any_context_irq()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (23 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 024/185] Revert "crypto: talitos - convert to use be16_add_cpu()" Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 026/185] ASoC: wm8737: Fixup setting VMID Impedance control register Luis Henriques
` (159 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Axel Lin, Thomas Gleixner, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <axel.lin@ingics.com>
commit 63781394c540dd9e666a6b21d70b64dd52bce76e upstream.
request_any_context_irq() returns a negative value on failure.
It returns either IRQC_IS_HARDIRQ or IRQC_IS_NESTED on success.
So fix testing return value of request_any_context_irq().
Also fixup the return value of devm_request_any_context_irq() to make it
consistent with request_any_context_irq().
Fixes: 0668d3065128 ("genirq: Add devm_request_any_context_irq()")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
Link: http://lkml.kernel.org/r/1431334978.17783.4.camel@ingics.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
kernel/irq/devres.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c
index 1ef0606797c9..0296d6fd7d4e 100644
--- a/kernel/irq/devres.c
+++ b/kernel/irq/devres.c
@@ -104,7 +104,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq,
return -ENOMEM;
rc = request_any_context_irq(irq, handler, irqflags, devname, dev_id);
- if (rc) {
+ if (rc < 0) {
devres_free(dr);
return rc;
}
@@ -113,7 +113,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq,
dr->dev_id = dev_id;
devres_add(dev, dr);
- return 0;
+ return rc;
}
EXPORT_SYMBOL(devm_request_any_context_irq);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 026/185] ASoC: wm8737: Fixup setting VMID Impedance control register
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (24 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 025/185] genirq: devres: Fix testing return value of request_any_context_irq() Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 027/185] ASoC: wm8903: Fix define for WM8903_VMID_RES_250K Luis Henriques
` (158 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Axel Lin, Mark Brown, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <axel.lin@ingics.com>
commit 14ba3ec1de043260cecd9e828ea2e3a0ad302893 upstream.
According to the datasheet:
R10 (0Ah) VMID Impedance Control
BIT 3:2 VMIDSEL DEFAULT 00
DESCRIPTION: VMID impedance selection control
00: 75kΩ output
01: 300kΩ output
10: 2.5kΩ output
WM8737_VMIDSEL_MASK is 0xC (VMIDSEL - [3:2]),
so it needs to left shift WM8737_VMIDSEL_SHIFT bits for setting these bits.
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/soc/codecs/wm8737.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
index b27f26cdc049..daa8e70c41d8 100644
--- a/sound/soc/codecs/wm8737.c
+++ b/sound/soc/codecs/wm8737.c
@@ -494,7 +494,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
/* Fast VMID ramp at 2*2.5k */
snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
- WM8737_VMIDSEL_MASK, 0x4);
+ WM8737_VMIDSEL_MASK,
+ 2 << WM8737_VMIDSEL_SHIFT);
/* Bring VMID up */
snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT,
@@ -508,7 +509,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
/* VMID at 2*300k */
snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
- WM8737_VMIDSEL_MASK, 2);
+ WM8737_VMIDSEL_MASK,
+ 1 << WM8737_VMIDSEL_SHIFT);
break;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 027/185] ASoC: wm8903: Fix define for WM8903_VMID_RES_250K
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (25 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 026/185] ASoC: wm8737: Fixup setting VMID Impedance control register Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 028/185] mnt: Refactor the logic for mounting sysfs and proc in a user namespace Luis Henriques
` (157 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Axel Lin, Mark Brown, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <axel.lin@ingics.com>
commit ebb6ad73e645b8f2d098dd3c41d2ff0da4146a02 upstream.
VMID Control 0 BIT[2:1] is VMID Divider Enable and Select
00 = VMID disabled (for OFF mode)
01 = 2 x 50kΩ divider (for normal operation)
10 = 2 x 250kΩ divider (for low power standby)
11 = 2 x 5kΩ divider (for fast start-up)
So WM8903_VMID_RES_250K should be 2 << 1, which is 4.
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/soc/codecs/wm8903.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h
index db949311c0f2..0bb4a647755d 100644
--- a/sound/soc/codecs/wm8903.h
+++ b/sound/soc/codecs/wm8903.h
@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec,
#define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */
#define WM8903_VMID_RES_50K 2
-#define WM8903_VMID_RES_250K 3
+#define WM8903_VMID_RES_250K 4
#define WM8903_VMID_RES_5K 6
/*
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 028/185] mnt: Refactor the logic for mounting sysfs and proc in a user namespace
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (26 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 027/185] ASoC: wm8903: Fix define for WM8903_VMID_RES_250K Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 029/185] ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits Luis Henriques
` (156 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Eric W. Biederman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit 1b852bceb0d111e510d1a15826ecc4a19358d512 upstream.
Fresh mounts of proc and sysfs are a very special case that works very
much like a bind mount. Unfortunately the current structure can not
preserve the MNT_LOCK... mount flags. Therefore refactor the logic
into a form that can be modified to preserve those lock bits.
Add a new filesystem flag FS_USERNS_VISIBLE that requires some mount
of the filesystem be fully visible in the current mount namespace,
before the filesystem may be mounted.
Move the logic for calling fs_fully_visible from proc and sysfs into
fs/namespace.c where it has greater access to mount namespace state.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/namespace.c | 8 +++++++-
fs/proc/root.c | 5 +----
fs/sysfs/mount.c | 5 +----
include/linux/fs.h | 2 +-
4 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index 6dfb6fc34286..8d2384d12e32 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2172,6 +2172,8 @@ unlock:
return err;
}
+static bool fs_fully_visible(struct file_system_type *fs_type);
+
/*
* create a new mount for userspace and request it to be added into the
* namespace's tree
@@ -2203,6 +2205,10 @@ static int do_new_mount(struct path *path, const char *fstype, int flags,
flags |= MS_NODEV;
mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV;
}
+ if (type->fs_flags & FS_USERNS_VISIBLE) {
+ if (!fs_fully_visible(type))
+ return -EPERM;
+ }
}
mnt = vfs_kern_mount(type, flags, name, data);
@@ -3023,7 +3029,7 @@ bool current_chrooted(void)
return chrooted;
}
-bool fs_fully_visible(struct file_system_type *type)
+static bool fs_fully_visible(struct file_system_type *type)
{
struct mnt_namespace *ns = current->nsproxy->mnt_ns;
struct mount *mnt;
diff --git a/fs/proc/root.c b/fs/proc/root.c
index 5dbadecb234d..7fd8c1f1b1d9 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -112,9 +112,6 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
ns = task_active_pid_ns(current);
options = data;
- if (!capable(CAP_SYS_ADMIN) && !fs_fully_visible(fs_type))
- return ERR_PTR(-EPERM);
-
/* Does the mounter have privilege over the pid namespace? */
if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
return ERR_PTR(-EPERM);
@@ -157,7 +154,7 @@ static struct file_system_type proc_fs_type = {
.name = "proc",
.mount = proc_mount,
.kill_sb = proc_kill_sb,
- .fs_flags = FS_USERNS_MOUNT,
+ .fs_flags = FS_USERNS_VISIBLE | FS_USERNS_MOUNT,
};
void __init proc_root_init(void)
diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
index 8a49486bf30c..1c6ac6fcee9f 100644
--- a/fs/sysfs/mount.c
+++ b/fs/sysfs/mount.c
@@ -31,9 +31,6 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type,
bool new_sb;
if (!(flags & MS_KERNMOUNT)) {
- if (!capable(CAP_SYS_ADMIN) && !fs_fully_visible(fs_type))
- return ERR_PTR(-EPERM);
-
if (!kobj_ns_current_may_mount(KOBJ_NS_TYPE_NET))
return ERR_PTR(-EPERM);
}
@@ -58,7 +55,7 @@ static struct file_system_type sysfs_fs_type = {
.name = "sysfs",
.mount = sysfs_mount,
.kill_sb = sysfs_kill_sb,
- .fs_flags = FS_USERNS_MOUNT,
+ .fs_flags = FS_USERNS_VISIBLE | FS_USERNS_MOUNT,
};
int __init sysfs_init(void)
diff --git a/include/linux/fs.h b/include/linux/fs.h
index e11d60cc867b..abbd77a27f3d 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1755,6 +1755,7 @@ struct file_system_type {
#define FS_HAS_SUBTYPE 4
#define FS_USERNS_MOUNT 8 /* Can be mounted by userns root */
#define FS_USERNS_DEV_MOUNT 16 /* A userns mount does not imply MNT_NODEV */
+#define FS_USERNS_VISIBLE 32 /* FS must already be visible */
#define FS_RENAME_DOES_D_MOVE 32768 /* FS will handle d_move() during rename() internally. */
struct dentry *(*mount) (struct file_system_type *, int,
const char *, void *);
@@ -1841,7 +1842,6 @@ extern int vfs_ustat(dev_t, struct kstatfs *);
extern int freeze_super(struct super_block *super);
extern int thaw_super(struct super_block *super);
extern bool our_mnt(struct vfsmount *mnt);
-extern bool fs_fully_visible(struct file_system_type *);
extern int current_umask(void);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 029/185] ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (27 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 028/185] mnt: Refactor the logic for mounting sysfs and proc in a user namespace Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 030/185] scsi_transport_srp: Introduce srp_wait_for_queuecommand() Luis Henriques
` (155 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Axel Lin, Mark Brown, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <axel.lin@ingics.com>
commit 12c350050538c7dc779c083b7342bfd20f74949c upstream.
WM8955_K_8_0_MASK bits is controlled by WM8955_PLL_CONTROL_3 rather than
WM8955_PLL_CONTROL_2.
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/soc/codecs/wm8955.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
index b8a9f8c84b7c..559ee33ae709 100644
--- a/sound/soc/codecs/wm8955.c
+++ b/sound/soc/codecs/wm8955.c
@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec)
snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
WM8955_K_17_9_MASK,
(pll.k >> 9) & WM8955_K_17_9_MASK);
- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
+ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3,
WM8955_K_8_0_MASK,
pll.k & WM8955_K_8_0_MASK);
if (pll.k)
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 030/185] scsi_transport_srp: Introduce srp_wait_for_queuecommand()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (28 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 029/185] ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 031/185] scsi_transport_srp: Fix a race condition Luis Henriques
` (154 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Bart Van Assche, James Bottomley, Sagi Grimberg,
Sebastian Parschauer, Doug Ledford, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@sandisk.com>
commit be34c62ddf39d1931780b07a6f4241393e4ba2ee upstream.
Introduce the helper function srp_wait_for_queuecommand().
Move the definition of scsi_request_fn_active(). Add a comment
above srp_wait_for_queuecommand() that support for scsi-mq needs
to be added.
This patch does not change any functionality. A second call to
srp_wait_for_queuecommand() will be introduced in the next patch.
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Cc: James Bottomley <JBottomley@Odin.com>
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: Sebastian Parschauer <sebastian.riemer@profitbricks.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/scsi/scsi_transport_srp.c | 54 ++++++++++++++++++++++-----------------
1 file changed, 31 insertions(+), 23 deletions(-)
diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
index a0c5bfdc5366..62afa8f7e3b3 100644
--- a/drivers/scsi/scsi_transport_srp.c
+++ b/drivers/scsi/scsi_transport_srp.c
@@ -397,6 +397,36 @@ static void srp_reconnect_work(struct work_struct *work)
}
}
+/**
+ * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn()
+ * @shost: SCSI host for which to count the number of scsi_request_fn() callers.
+ *
+ * To do: add support for scsi-mq in this function.
+ */
+static int scsi_request_fn_active(struct Scsi_Host *shost)
+{
+ struct scsi_device *sdev;
+ struct request_queue *q;
+ int request_fn_active = 0;
+
+ shost_for_each_device(sdev, shost) {
+ q = sdev->request_queue;
+
+ spin_lock_irq(q->queue_lock);
+ request_fn_active += q->request_fn_active;
+ spin_unlock_irq(q->queue_lock);
+ }
+
+ return request_fn_active;
+}
+
+/* Wait until ongoing shost->hostt->queuecommand() calls have finished. */
+static void srp_wait_for_queuecommand(struct Scsi_Host *shost)
+{
+ while (scsi_request_fn_active(shost))
+ msleep(20);
+}
+
static void __rport_fail_io_fast(struct srp_rport *rport)
{
struct Scsi_Host *shost = rport_to_shost(rport);
@@ -505,27 +535,6 @@ void srp_start_tl_fail_timers(struct srp_rport *rport)
EXPORT_SYMBOL(srp_start_tl_fail_timers);
/**
- * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn()
- * @shost: SCSI host for which to count the number of scsi_request_fn() callers.
- */
-static int scsi_request_fn_active(struct Scsi_Host *shost)
-{
- struct scsi_device *sdev;
- struct request_queue *q;
- int request_fn_active = 0;
-
- shost_for_each_device(sdev, shost) {
- q = sdev->request_queue;
-
- spin_lock_irq(q->queue_lock);
- request_fn_active += q->request_fn_active;
- spin_unlock_irq(q->queue_lock);
- }
-
- return request_fn_active;
-}
-
-/**
* srp_reconnect_rport() - reconnect to an SRP target port
* @rport: SRP target port.
*
@@ -560,8 +569,7 @@ int srp_reconnect_rport(struct srp_rport *rport)
if (res)
goto out;
scsi_target_block(&shost->shost_gendev);
- while (scsi_request_fn_active(shost))
- msleep(20);
+ srp_wait_for_queuecommand(shost);
res = rport->state != SRP_RPORT_LOST ? i->f->reconnect(rport) : -ENODEV;
pr_debug("%s (state %d): transport.reconnect() returned %d\n",
dev_name(&shost->shost_gendev), rport->state, res);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 031/185] scsi_transport_srp: Fix a race condition
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (29 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 030/185] scsi_transport_srp: Introduce srp_wait_for_queuecommand() Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 032/185] KVM: mips: use id_to_memslot correctly Luis Henriques
` (153 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Bart Van Assche, James Bottomley, Sagi Grimberg,
Sebastian Parschauer, Doug Ledford, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@sandisk.com>
commit 535fb906225fb7436cb658144d0c0cea14a26f3e upstream.
Avoid that srp_terminate_io() can get invoked while srp_queuecommand()
is in progress. This patch avoids that an I/O timeout can trigger the
following kernel warning:
WARNING: at drivers/infiniband/ulp/srp/ib_srp.c:1447 srp_terminate_io+0xef/0x100 [ib_srp]()
Call Trace:
[<ffffffff814c65a2>] dump_stack+0x4e/0x68
[<ffffffff81051f71>] warn_slowpath_common+0x81/0xa0
[<ffffffff8105204a>] warn_slowpath_null+0x1a/0x20
[<ffffffffa075f51f>] srp_terminate_io+0xef/0x100 [ib_srp]
[<ffffffffa07495da>] __rport_fail_io_fast+0xba/0xc0 [scsi_transport_srp]
[<ffffffffa0749a90>] rport_fast_io_fail_timedout+0xe0/0xf0 [scsi_transport_srp]
[<ffffffff8106e09b>] process_one_work+0x1db/0x780
[<ffffffff8106e75b>] worker_thread+0x11b/0x450
[<ffffffff81073c64>] kthread+0xe4/0x100
[<ffffffff814cf26c>] ret_from_fork+0x7c/0xb0
See also patch "scsi_transport_srp: Add transport layer error
handling" (commit ID 29c17324803c).
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Cc: James Bottomley <JBottomley@Odin.com>
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: Sebastian Parschauer <sebastian.riemer@profitbricks.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/scsi/scsi_transport_srp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
index 62afa8f7e3b3..a68079d66d9e 100644
--- a/drivers/scsi/scsi_transport_srp.c
+++ b/drivers/scsi/scsi_transport_srp.c
@@ -440,8 +440,10 @@ static void __rport_fail_io_fast(struct srp_rport *rport)
/* Involve the LLD if possible to terminate all I/O on the rport. */
i = to_srp_internal(shost->transportt);
- if (i->f->terminate_rport_io)
+ if (i->f->terminate_rport_io) {
+ srp_wait_for_queuecommand(shost);
i->f->terminate_rport_io(rport);
+ }
}
/**
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 032/185] KVM: mips: use id_to_memslot correctly
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (30 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 031/185] scsi_transport_srp: Fix a race condition Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 033/185] w1_therm reference count family data Luis Henriques
` (152 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Paolo Bonzini, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit 69a1220060c1523fd0515216eaa29e22f133b894 upstream.
The argument to KVM_GET_DIRTY_LOG is a memslot id; it may not match the
position in the memslots array, which is sorted by gfn.
Reviewed-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[ luis: backported to 3.16:
- file rename: arch/mips/kvm/mips.c -> arch/mips/kvm/kvm_mips.c ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/mips/kvm/kvm_mips.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c
index 59298b97ac39..cc721a3c8996 100644
--- a/arch/mips/kvm/kvm_mips.c
+++ b/arch/mips/kvm/kvm_mips.c
@@ -813,7 +813,7 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm, struct kvm_dirty_log *log)
/* If nothing is dirty, don't bother messing with page tables. */
if (is_dirty) {
- memslot = &kvm->memslots->memslots[log->slot];
+ memslot = id_to_memslot(kvm->memslots, log->slot);
ga = memslot->base_gfn << PAGE_SHIFT;
ga_end = ga + (memslot->npages << PAGE_SHIFT);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 033/185] w1_therm reference count family data
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (31 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 032/185] KVM: mips: use id_to_memslot correctly Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 034/185] drm/radeon: take the mode_config mutex when dealing with hpds (v2) Luis Henriques
` (151 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: David Fries, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: David Fries <David@Fries.net>
commit f7134eea05b2fb4a2c0935f8a540539fff01f3eb upstream.
A temperature conversion can take 750 ms and when possible the
w1_therm slave driver drops the bus_mutex to allow other bus
operations, but that includes operations such as a periodic slave
search, which can remove this slave when it is no longer detected.
If that happens the sl->family_data will be freed and set to NULL
causing w1_slave_show to crash when it wakes up.
Signed-off-by: David Fries <David@Fries.net>
Reported-By: Thorsten Bschorr <thorsten@bschorr.de>
Tested-by: Thorsten Bschorr <thorsten@bschorr.de>
Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/w1/slaves/w1_therm.c | 62 +++++++++++++++++++++++++++++++++-----------
1 file changed, 47 insertions(+), 15 deletions(-)
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index 1f11a20a8ab9..55eb86c9e214 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -59,16 +59,32 @@ MODULE_ALIAS("w1-family-" __stringify(W1_THERM_DS28EA00));
static int w1_strong_pullup = 1;
module_param_named(strong_pullup, w1_strong_pullup, int, 0);
+struct w1_therm_family_data {
+ uint8_t rom[9];
+ atomic_t refcnt;
+};
+
+/* return the address of the refcnt in the family data */
+#define THERM_REFCNT(family_data) \
+ (&((struct w1_therm_family_data*)family_data)->refcnt)
+
static int w1_therm_add_slave(struct w1_slave *sl)
{
- sl->family_data = kzalloc(9, GFP_KERNEL);
+ sl->family_data = kzalloc(sizeof(struct w1_therm_family_data),
+ GFP_KERNEL);
if (!sl->family_data)
return -ENOMEM;
+ atomic_set(THERM_REFCNT(sl->family_data), 1);
return 0;
}
static void w1_therm_remove_slave(struct w1_slave *sl)
{
+ int refcnt = atomic_sub_return(1, THERM_REFCNT(sl->family_data));
+ while(refcnt) {
+ msleep(1000);
+ refcnt = atomic_read(THERM_REFCNT(sl->family_data));
+ }
kfree(sl->family_data);
sl->family_data = NULL;
}
@@ -194,13 +210,22 @@ static ssize_t w1_slave_show(struct device *device,
struct w1_slave *sl = dev_to_w1_slave(device);
struct w1_master *dev = sl->master;
u8 rom[9], crc, verdict, external_power;
- int i, max_trying = 10;
+ int i, ret, max_trying = 10;
ssize_t c = PAGE_SIZE;
+ u8 *family_data = sl->family_data;
+
+ ret = mutex_lock_interruptible(&dev->bus_mutex);
+ if (ret != 0)
+ goto post_unlock;
- i = mutex_lock_interruptible(&dev->bus_mutex);
- if (i != 0)
- return i;
+ if(!sl->family_data)
+ {
+ ret = -ENODEV;
+ goto pre_unlock;
+ }
+ /* prevent the slave from going away in sleep */
+ atomic_inc(THERM_REFCNT(family_data));
memset(rom, 0, sizeof(rom));
while (max_trying--) {
@@ -230,17 +255,19 @@ static ssize_t w1_slave_show(struct device *device,
mutex_unlock(&dev->bus_mutex);
sleep_rem = msleep_interruptible(tm);
- if (sleep_rem != 0)
- return -EINTR;
+ if (sleep_rem != 0) {
+ ret = -EINTR;
+ goto post_unlock;
+ }
- i = mutex_lock_interruptible(&dev->bus_mutex);
- if (i != 0)
- return i;
+ ret = mutex_lock_interruptible(&dev->bus_mutex);
+ if (ret != 0)
+ goto post_unlock;
} else if (!w1_strong_pullup) {
sleep_rem = msleep_interruptible(tm);
if (sleep_rem != 0) {
- mutex_unlock(&dev->bus_mutex);
- return -EINTR;
+ ret = -EINTR;
+ goto pre_unlock;
}
}
@@ -269,19 +296,24 @@ static ssize_t w1_slave_show(struct device *device,
c -= snprintf(buf + PAGE_SIZE - c, c, ": crc=%02x %s\n",
crc, (verdict) ? "YES" : "NO");
if (verdict)
- memcpy(sl->family_data, rom, sizeof(rom));
+ memcpy(family_data, rom, sizeof(rom));
else
dev_warn(device, "Read failed CRC check\n");
for (i = 0; i < 9; ++i)
c -= snprintf(buf + PAGE_SIZE - c, c, "%02x ",
- ((u8 *)sl->family_data)[i]);
+ ((u8 *)family_data)[i]);
c -= snprintf(buf + PAGE_SIZE - c, c, "t=%d\n",
w1_convert_temp(rom, sl->family->fid));
+ ret = PAGE_SIZE - c;
+
+pre_unlock:
mutex_unlock(&dev->bus_mutex);
- return PAGE_SIZE - c;
+post_unlock:
+ atomic_dec(THERM_REFCNT(family_data));
+ return ret;
}
static int __init w1_therm_init(void)
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 034/185] drm/radeon: take the mode_config mutex when dealing with hpds (v2)
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (32 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 033/185] w1_therm reference count family data Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 035/185] usb: dwc3: gadget: return error if command sent to DGCMD register fails Luis Henriques
` (150 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Alex Deucher, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 39fa10f7e21574a70cecf1fed0f9b36535aa68a0 upstream.
Since we are messing with state in the worker.
v2: drop the changes in the mst worker
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/gpu/drm/radeon/radeon_irq_kms.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
index c74f12d125f7..dd49f8c61878 100644
--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -79,10 +79,12 @@ static void radeon_hotplug_work_func(struct work_struct *work)
struct drm_mode_config *mode_config = &dev->mode_config;
struct drm_connector *connector;
+ mutex_lock(&mode_config->mutex);
if (mode_config->num_connector) {
list_for_each_entry(connector, &mode_config->connector_list, head)
radeon_connector_hotplug(connector);
}
+ mutex_unlock(&mode_config->mutex);
/* Just fire off a uevent and let userspace tell us what to do */
drm_helper_hpd_irq_event(dev);
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 035/185] usb: dwc3: gadget: return error if command sent to DGCMD register fails
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (33 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 034/185] drm/radeon: take the mode_config mutex when dealing with hpds (v2) Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 036/185] rcu: Correctly handle non-empty Tiny RCU callback list with none ready Luis Henriques
` (149 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Subbaraya Sundeep Bhatta, Felipe Balbi, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep Bhatta <subbaraya.sundeep.bhatta@xilinx.com>
commit 891b1dc022955d36cf4c0f42d383226a930db7ed upstream.
We need to return error to caller if command is not sent to
controller succesfully.
Signed-off-by: Subbaraya Sundeep Bhatta <sbhatta@xilinx.com>
Fixes: b09bb64239c8 (usb: dwc3: gadget: implement Global Command support)
Signed-off-by: Felipe Balbi <balbi@ti.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/dwc3/gadget.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index c24c0bb7f6f3..0c4a7aba42cb 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -376,6 +376,8 @@ int dwc3_send_gadget_generic_command(struct dwc3 *dwc, int cmd, u32 param)
if (!(reg & DWC3_DGCMD_CMDACT)) {
dev_vdbg(dwc->dev, "Command Complete --> %d\n",
DWC3_DGCMD_STATUS(reg));
+ if (DWC3_DGCMD_STATUS(reg))
+ return -EINVAL;
return 0;
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 036/185] rcu: Correctly handle non-empty Tiny RCU callback list with none ready
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (34 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 035/185] usb: dwc3: gadget: return error if command sent to DGCMD register fails Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 037/185] ASoC: arizona: Fix noise generator gain TLV Luis Henriques
` (148 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Paul E. McKenney, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
commit 6e91f8cb138625be96070b778d9ba71ce520ea7e upstream.
If, at the time __rcu_process_callbacks() is invoked, there are callbacks
in Tiny RCU's callback list, but none of them are ready to be invoked,
the current list-management code will knit the non-ready callbacks out
of the list. This can result in hangs and possibly worse. This commit
therefore inserts a check for there being no callbacks that can be
invoked immediately.
This bug is unlikely to occur -- you have to get a new callback between
the time rcu_sched_qs() or rcu_bh_qs() was called, but before we get to
__rcu_process_callbacks(). It was detected by the addition of RCU-bh
testing to rcutorture, which in turn was instigated by Iftekhar Ahmed's
mutation testing. Although this bug was made much more likely by
915e8a4fe45e (rcu: Remove fastpath from __rcu_process_callbacks()), this
did not cause the bug, but rather made it much more probable. That
said, it takes more than 40 hours of rcutorture testing, on average,
for this bug to appear, so this fix cannot be considered an emergency.
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reviewed-by: Josh Triplett <josh@joshtriplett.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
kernel/rcu/tiny.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
index d9efcc13008c..90fdef66aa4a 100644
--- a/kernel/rcu/tiny.c
+++ b/kernel/rcu/tiny.c
@@ -280,6 +280,11 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp)
/* Move the ready-to-invoke callbacks to a local list. */
local_irq_save(flags);
+ if (rcp->donetail == &rcp->rcucblist) {
+ /* No callbacks ready, so just leave. */
+ local_irq_restore(flags);
+ return;
+ }
RCU_TRACE(trace_rcu_batch_start(rcp->name, 0, rcp->qlen, -1));
list = rcp->rcucblist;
rcp->rcucblist = *rcp->donetail;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 037/185] ASoC: arizona: Fix noise generator gain TLV
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (35 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 036/185] rcu: Correctly handle non-empty Tiny RCU callback list with none ready Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 038/185] usb: dwc3: gadget: don't clear EP_BUSY too early Luis Henriques
` (147 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Richard Fitzgerald, Mark Brown, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
commit 15575ed544910464715df5c45a44b9732e415b93 upstream.
The Arizona codec drivers had an incorrect dB scaling for the
noise generator gain that started at 0dB and went upwards.
Actually the highest setting is 0dB.
Signed-off-by: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/soc/codecs/wm5102.c | 2 +-
sound/soc/codecs/wm5110.c | 2 +-
sound/soc/codecs/wm8997.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
index 289b64d89abd..62cfa74bf83b 100644
--- a/sound/soc/codecs/wm5102.c
+++ b/sound/soc/codecs/wm5102.c
@@ -41,7 +41,7 @@ struct wm5102_priv {
static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
static const struct wm_adsp_region wm5102_dsp1_regions[] = {
diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
index 2e5fcb559e90..8a0d9787a6fc 100644
--- a/sound/soc/codecs/wm5110.c
+++ b/sound/soc/codecs/wm5110.c
@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w,
static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
#define WM5110_NG_SRC(name, base) \
diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
index bb9b47b956aa..0de5960064e0 100644
--- a/sound/soc/codecs/wm8997.c
+++ b/sound/soc/codecs/wm8997.c
@@ -40,7 +40,7 @@ struct wm8997_priv {
static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
static const struct reg_default wm8997_sysclk_reva_patch[] = {
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 038/185] usb: dwc3: gadget: don't clear EP_BUSY too early
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (36 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 037/185] ASoC: arizona: Fix noise generator gain TLV Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 039/185] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe Luis Henriques
` (146 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Felipe Balbi, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <balbi@ti.com>
commit e18b7975c885bc3a938b9a76daf32957ea0235fa upstream.
In case of non-Isochronous transfers, we don't
want to clear DWC3_EP_BUSY flag until XferComplete
event. That's because XferInProgress was only enabled
so we can recycle TRBs and usb_requests quicker, but
there are still other pending requests being transferred.
In order to make sure we don't allow for another StartTransfer
command while the HW is still processing other transfers,
we must keep DWC3_EP_BUSY flag set and this what this patch
does.
Fixes: f3af36511e60 (usb: dwc3: gadget: always enable IOC on
bulk/interrupt transfers)
Reported-by: sundeep subbaraya <sundeep.lkml@gmail.com>
Tested-by: sundeep subbaraya <sundeep.lkml@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/dwc3/gadget.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 0c4a7aba42cb..18d2ffcc462b 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1987,12 +1987,16 @@ static void dwc3_endpoint_transfer_complete(struct dwc3 *dwc,
{
unsigned status = 0;
int clean_busy;
+ u32 is_xfer_complete;
+
+ is_xfer_complete = (event->endpoint_event == DWC3_DEPEVT_XFERCOMPLETE);
if (event->status & DEPEVT_STATUS_BUSERR)
status = -ECONNRESET;
clean_busy = dwc3_cleanup_done_reqs(dwc, dep, event, status);
- if (clean_busy)
+ if (clean_busy && (is_xfer_complete ||
+ usb_endpoint_xfer_isoc(dep->endpoint.desc)))
dep->flags &= ~DWC3_EP_BUSY;
/*
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 039/185] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (37 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 038/185] usb: dwc3: gadget: don't clear EP_BUSY too early Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 040/185] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset Luis Henriques
` (145 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Haggai Eran, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Haggai Eran <haggai.eran@gmail.com>
commit cab462140f8a183e3cca0b51c8b59ef715cb6148 upstream.
With an RTL8191SU USB adaptor, sometimes the hints for a fragmented
packet are set, but the packet length is too large. Allocate enough
space to prevent memory corruption and a resulting kernel panic [1].
[1] http://www.spinics.net/lists/linux-wireless/msg136546.html
Signed-off-by: Haggai Eran <haggai.eran@gmail.com>
ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/staging/rtl8712/rtl8712_recv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c
index 1f700171af13..6971ca67729f 100644
--- a/drivers/staging/rtl8712/rtl8712_recv.c
+++ b/drivers/staging/rtl8712/rtl8712_recv.c
@@ -1069,7 +1069,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb)
/* for first fragment packet, driver need allocate 1536 +
* drvinfo_sz + RXDESC_SIZE to defrag packet. */
if ((mf == 1) && (frag == 0))
- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/
+ /*1658+6=1664, 1664 is 128 alignment.*/
+ alloc_sz = max_t(u16, tmp_len, 1658);
else
alloc_sz = tmp_len;
/* 2 is for IP header 4 bytes alignment in QoS packet case.
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 040/185] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (38 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 039/185] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 041/185] staging: vt6655: device_rx_srv check sk_buff is NULL Luis Henriques
` (144 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Robert Schlabbach, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Schlabbach <Robert.Schlabbach@gmx.net>
commit fb6d1f7df5d25299fd7b3e84b72b8851d3634764 upstream.
Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset.
Dissolve the function hub_port_finish_reset() completely and divide the
actions to be taken into those which need to be done after each reset
attempt and those which need to be done after the full procedure is
complete, and place them in the appropriate places in hub_port_reset().
Also, remove an unneeded forward declaration of hub_port_reset().
Verbose Problem Description:
USB 3.0 devices may be "lost for good" during a hub port reset.
This makes Linux unable to boot from USB 3.0 devices in certain
constellations of host controllers and devices, because the USB device is
lost during initialization, preventing the rootfs from being mounted.
The underlying problem is that in the affected constellations, during the
processing inside hub_port_reset(), the hub link state goes from 0 to
SS.inactive after the initial reset, and back to 0 again only after the
following "warm" reset.
However, hub_port_finish_reset() is called after each reset attempt and
sets the state the connected USB device based on the "preliminary" status
of the hot reset to USB_STATE_NOTATTACHED due to SS.inactive, yet when
the following warm reset is complete and hub_port_finish_reset() is
called again, its call to set the device to USB_STATE_DEFAULT is blocked
by usb_set_device_state() which does not allow taking USB devices out of
USB_STATE_NOTATTACHED state.
Thanks to Alan Stern for guiding me to the proper solution and how to
submit it.
Link: http://lkml.kernel.org/r/trinity-25981484-72a9-4d46-bf17-9c1cf9301a31-1432073240136%20()%203capp-gmx-bs27
Signed-off-by: Robert Schlabbach <robert_s@gmx.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/core/hub.c | 81 ++++++++++++++++++++------------------------------
1 file changed, 32 insertions(+), 49 deletions(-)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 4209fc7d91c6..a3ab650a1f72 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2608,9 +2608,6 @@ static bool use_new_scheme(struct usb_device *udev, int retry)
return USE_NEW_SCHEME(retry);
}
-static int hub_port_reset(struct usb_hub *hub, int port1,
- struct usb_device *udev, unsigned int delay, bool warm);
-
/* Is a USB 3.0 port in the Inactive or Compliance Mode state?
* Port worm reset is required to recover
*/
@@ -2691,44 +2688,6 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
return 0;
}
-static void hub_port_finish_reset(struct usb_hub *hub, int port1,
- struct usb_device *udev, int *status)
-{
- switch (*status) {
- case 0:
- /* TRSTRCY = 10 ms; plus some extra */
- msleep(10 + 40);
- if (udev) {
- struct usb_hcd *hcd = bus_to_hcd(udev->bus);
-
- update_devnum(udev, 0);
- /* The xHC may think the device is already reset,
- * so ignore the status.
- */
- if (hcd->driver->reset_device)
- hcd->driver->reset_device(hcd, udev);
- }
- /* FALL THROUGH */
- case -ENOTCONN:
- case -ENODEV:
- usb_clear_port_feature(hub->hdev,
- port1, USB_PORT_FEAT_C_RESET);
- if (hub_is_superspeed(hub->hdev)) {
- usb_clear_port_feature(hub->hdev, port1,
- USB_PORT_FEAT_C_BH_PORT_RESET);
- usb_clear_port_feature(hub->hdev, port1,
- USB_PORT_FEAT_C_PORT_LINK_STATE);
- usb_clear_port_feature(hub->hdev, port1,
- USB_PORT_FEAT_C_CONNECTION);
- }
- if (udev)
- usb_set_device_state(udev, *status
- ? USB_STATE_NOTATTACHED
- : USB_STATE_DEFAULT);
- break;
- }
-}
-
/* Handle port reset and port warm(BH) reset (for USB3 protocol ports) */
static int hub_port_reset(struct usb_hub *hub, int port1,
struct usb_device *udev, unsigned int delay, bool warm)
@@ -2752,13 +2711,9 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
* If the caller hasn't explicitly requested a warm reset,
* double check and see if one is needed.
*/
- status = hub_port_status(hub, port1,
- &portstatus, &portchange);
- if (status < 0)
- goto done;
-
- if (hub_port_warm_reset_required(hub, portstatus))
- warm = true;
+ if (hub_port_status(hub, port1, &portstatus, &portchange) == 0)
+ if (hub_port_warm_reset_required(hub, portstatus))
+ warm = true;
}
/* Reset the port */
@@ -2783,11 +2738,19 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
/* Check for disconnect or reset */
if (status == 0 || status == -ENOTCONN || status == -ENODEV) {
- hub_port_finish_reset(hub, port1, udev, &status);
+ usb_clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_RESET);
if (!hub_is_superspeed(hub->hdev))
goto done;
+ usb_clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_BH_PORT_RESET);
+ usb_clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_PORT_LINK_STATE);
+ usb_clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_CONNECTION);
+
/*
* If a USB 3.0 device migrates from reset to an error
* state, re-issue the warm reset.
@@ -2819,6 +2782,26 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
dev_err(&port_dev->dev, "Cannot enable. Maybe the USB cable is bad?\n");
done:
+ if (status == 0) {
+ /* TRSTRCY = 10 ms; plus some extra */
+ msleep(10 + 40);
+ if (udev) {
+ struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+
+ update_devnum(udev, 0);
+ /* The xHC may think the device is already reset,
+ * so ignore the status.
+ */
+ if (hcd->driver->reset_device)
+ hcd->driver->reset_device(hcd, udev);
+
+ usb_set_device_state(udev, USB_STATE_DEFAULT);
+ }
+ } else {
+ if (udev)
+ usb_set_device_state(udev, USB_STATE_NOTATTACHED);
+ }
+
if (!hub_is_superspeed(hub->hdev))
up_read(&ehci_cf_port_reset_rwsem);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 041/185] staging: vt6655: device_rx_srv check sk_buff is NULL
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (39 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 040/185] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 042/185] fixing infinite OPEN loop in 4.0 stateid recovery Luis Henriques
` (143 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Malcolm Priestley, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <tvboxspy@gmail.com>
commit b5eeed8cb6097c8ea660b6598d36fdbb94065a22 upstream.
There is a small chance that pRD->pRDInfo->skb could go NULL
while the interrupt is processing.
Put NULL check on loop to break out.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/staging/vt6655/device_main.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index 5a5fd937a442..e3ae2599a2b7 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -1402,6 +1402,10 @@ static int device_rx_srv(PSDevice pDevice, unsigned int uIdx) {
pRD = pRD->next) {
if (works++ > 15)
break;
+
+ if (!pRD->pRDInfo->skb)
+ break;
+
if (device_receive_frame(pDevice, pRD)) {
if (!device_alloc_rx_buf(pDevice, pRD)) {
DBG_PRT(MSG_LEVEL_ERR, KERN_ERR
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 042/185] fixing infinite OPEN loop in 4.0 stateid recovery
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (40 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 041/185] staging: vt6655: device_rx_srv check sk_buff is NULL Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 043/185] ideapad_laptop: Lenovo G50-30 fix rfkill reports wireless blocked Luis Henriques
` (142 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Olga Kornievskaia, Trond Myklebust, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <kolga@netapp.com>
commit e8d975e73e5fa05f983fbf2723120edcf68e0b38 upstream.
Problem: When an operation like WRITE receives a BAD_STATEID, even though
recovery code clears the RECLAIM_NOGRACE recovery flag before recovering
the open state, because of clearing delegation state for the associated
inode, nfs_inode_find_state_and_recover() gets called and it makes the
same state with RECLAIM_NOGRACE flag again. As a results, when we restart
looking over the open states, we end up in the infinite loop instead of
breaking out in the next test of state flags.
Solution: unset the RECLAIM_NOGRACE set because of
calling of nfs_inode_find_state_and_recover() after returning from calling
recover_open() function.
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/nfs/nfs4state.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index db7792c30462..46d876487795 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1482,6 +1482,8 @@ restart:
spin_unlock(&state->state_lock);
}
nfs4_put_open_state(state);
+ clear_bit(NFS4CLNT_RECLAIM_NOGRACE,
+ &state->flags);
spin_lock(&sp->so_lock);
goto restart;
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 043/185] ideapad_laptop: Lenovo G50-30 fix rfkill reports wireless blocked
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (41 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 042/185] fixing infinite OPEN loop in 4.0 stateid recovery Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 044/185] powerpc/perf: Fix book3s kernel to userspace backtraces Luis Henriques
` (141 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dmitry Tunin, Philippe Coval, Darren Hart, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <hanipouspilot@gmail.com>
commit 4fa9dabcffc8e16601307d3d56b58c68d9716ba4 upstream.
Lenovo G30-50 does not have a hardware wireless switch and wireless
is always blocked.
BugLink: https://bugs.launchpad.net/bugs/1397021
Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Philippe Coval <philippe.coval@open.eurogiciel.org>
[dvhart@linux.intel.com: Reordered dmi id per Phillippe's later version]
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/platform/x86/ideapad-laptop.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 7fe7ed830d8d..11712d1dbd17 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -831,6 +831,13 @@ static void ideapad_acpi_notify(acpi_handle handle, u32 event, void *data)
*/
static struct dmi_system_id no_hw_rfkill_list[] = {
{
+ .ident = "Lenovo G50-30",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo G50-30"),
+ },
+ },
+ {
.ident = "Lenovo Yoga 2 11 / 13 / Pro",
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 044/185] powerpc/perf: Fix book3s kernel to userspace backtraces
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (42 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 043/185] ideapad_laptop: Lenovo G50-30 fix rfkill reports wireless blocked Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 045/185] SUNRPC: Fix a memory leak in the backchannel code Luis Henriques
` (140 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Anton Blanchard, Michael Ellerman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <anton@samba.org>
commit 72e349f1124a114435e599479c9b8d14bfd1ebcd upstream.
When we take a PMU exception or a software event we call
perf_read_regs(). This overloads regs->result with a boolean that
describes if we should use the sampled instruction address register
(SIAR) or the regs.
If the exception is in kernel, we start with the kernel regs and
backtrace through the kernel stack. At this point we switch to the
userspace regs and backtrace the user stack with perf_callchain_user().
Unfortunately these regs have not got the perf_read_regs() treatment,
so regs->result could be anything. If it is non zero,
perf_instruction_pointer() decides to use the SIAR, and we get issues
like this:
0.11% qemu-system-ppc [kernel.kallsyms] [k] _raw_spin_lock_irqsave
|
---_raw_spin_lock_irqsave
|
|--52.35%-- 0
| |
| |--46.39%-- __hrtimer_start_range_ns
| | kvmppc_run_core
| | kvmppc_vcpu_run_hv
| | kvmppc_vcpu_run
| | kvm_arch_vcpu_ioctl_run
| | kvm_vcpu_ioctl
| | do_vfs_ioctl
| | sys_ioctl
| | system_call
| | |
| | |--67.08%-- _raw_spin_lock_irqsave <--- hi mum
| | | |
| | | --100.00%-- 0x7e714
| | | 0x7e714
Notice the bogus _raw_spin_irqsave when we transition from kernel
(system_call) to userspace (0x7e714). We inserted what was in the SIAR.
Add a check in regs_use_siar() to check that the regs in question
are from a PMU exception. With this fix the backtrace makes sense:
0.47% qemu-system-ppc [kernel.vmlinux] [k] _raw_spin_lock_irqsave
|
---_raw_spin_lock_irqsave
|
|--53.83%-- 0
| |
| |--44.73%-- hrtimer_try_to_cancel
| | kvmppc_start_thread
| | kvmppc_run_core
| | kvmppc_vcpu_run_hv
| | kvmppc_vcpu_run
| | kvm_arch_vcpu_ioctl_run
| | kvm_vcpu_ioctl
| | do_vfs_ioctl
| | sys_ioctl
| | system_call
| | __ioctl
| | 0x7e714
| | 0x7e714
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/powerpc/perf/core-book3s.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index fe52db2eea6a..97579de6853b 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -126,7 +126,16 @@ static void pmao_restore_workaround(bool ebb) { }
static bool regs_use_siar(struct pt_regs *regs)
{
- return !!regs->result;
+ /*
+ * When we take a performance monitor exception the regs are setup
+ * using perf_read_regs() which overloads some fields, in particular
+ * regs->result to tell us whether to use SIAR.
+ *
+ * However if the regs are from another exception, eg. a syscall, then
+ * they have not been setup using perf_read_regs() and so regs->result
+ * is something random.
+ */
+ return ((TRAP(regs) == 0xf00) && regs->result);
}
/*
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 045/185] SUNRPC: Fix a memory leak in the backchannel code
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (43 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 044/185] powerpc/perf: Fix book3s kernel to userspace backtraces Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 046/185] ipr: Increase default adapter init stage change timeout Luis Henriques
` (139 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Trond Myklebust, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@primarydata.com>
commit 88de6af24f2b48b06c514d3c3d0a8f22fafe30bd upstream.
req->rq_private_buf isn't initialised when xprt_setup_backchannel calls
xprt_free_allocation.
Fixes: fb7a0b9addbdb ("nfs41: New backchannel helper routines")
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/sunrpc/backchannel_rqst.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 1bb4d26fbd6b..ca9ff71134f9 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req)
dprintk("RPC: free allocations for req= %p\n", req);
WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
- xbufp = &req->rq_private_buf;
+ xbufp = &req->rq_rcv_buf;
free_page((unsigned long)xbufp->head[0].iov_base);
xbufp = &req->rq_snd_buf;
free_page((unsigned long)xbufp->head[0].iov_base);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 046/185] ipr: Increase default adapter init stage change timeout
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (44 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 045/185] SUNRPC: Fix a memory leak in the backchannel code Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 047/185] ieee802154: Fix sockaddr_ieee802154 implicit padding information leak Luis Henriques
` (138 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Brian King, James Bottomley, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <brking@linux.vnet.ibm.com>
commit 45c44b5ff9caa743ed9c2bfd44307c536c9caf1e upstream.
Increase the default init stage change timeout from 15 seconds to 30 seconds.
This resolves issues we have seen with some adapters not transitioning
to the first init stage within 15 seconds, which results in adapter
initialization failures.
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/scsi/ipr.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index c24c747595ba..b22b23586f93 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -269,7 +269,7 @@
#define IPR_RUNTIME_RESET 0x40000000
#define IPR_IPL_INIT_MIN_STAGE_TIME 5
-#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 15
+#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 30
#define IPR_IPL_INIT_STAGE_UNKNOWN 0x0
#define IPR_IPL_INIT_STAGE_TRANSOP 0xB0000000
#define IPR_IPL_INIT_STAGE_MASK 0xff000000
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 047/185] ieee802154: Fix sockaddr_ieee802154 implicit padding information leak.
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (45 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 046/185] ipr: Increase default adapter init stage change timeout Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 048/185] mnt: Modify fs_fully_visible to deal with locked ro nodev and atime Luis Henriques
` (137 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Lennert Buytenhek, Marcel Holtmann, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Lennert Buytenhek <buytenh@wantstofly.org>
commit 8a70cefa3037d62e7c0b6068a66675def1a330c9 upstream.
The AF_IEEE802154 sockaddr looks like this:
struct sockaddr_ieee802154 {
sa_family_t family; /* AF_IEEE802154 */
struct ieee802154_addr_sa addr;
};
struct ieee802154_addr_sa {
int addr_type;
u16 pan_id;
union {
u8 hwaddr[IEEE802154_ADDR_LEN];
u16 short_addr;
};
};
On most architectures there will be implicit structure padding here,
in two different places:
* In struct sockaddr_ieee802154, two bytes of padding between 'family'
(unsigned short) and 'addr', so that 'addr' starts on a four byte
boundary.
* In struct ieee802154_addr_sa, two bytes at the end of the structure,
to make the structure 16 bytes.
When calling recvmsg(2) on a PF_IEEE802154 SOCK_DGRAM socket, the
ieee802154 stack constructs a struct sockaddr_ieee802154 on the
kernel stack without clearing these padding fields, and, depending
on the addr_type, between four and ten bytes of uncleared kernel
stack will be copied to userspace.
We can't just insert two 'u16 __pad's in the right places and zero
those before copying an address to userspace, as not all architectures
insert this implicit padding -- from a quick test it seems that avr32,
cris and m68k don't insert this padding, while every other architecture
that I have cross compilers for does insert this padding.
The easiest way to plug the leak is to just memset the whole struct
sockaddr_ieee802154 before filling in the fields we want to fill in,
and that's what this patch does.
Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>
Acked-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
[ luis: backported to 3.16:
- file rename: net/ieee802154/socket.c -> net/ieee802154/dgram.c ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/ieee802154/dgram.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 4f0ed8780194..9c9b27be78e7 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -330,6 +330,12 @@ static int dgram_recvmsg(struct kiocb *iocb, struct sock *sk,
sock_recv_ts_and_drops(msg, sk, skb);
if (saddr) {
+ /* Clear the implicit padding in struct sockaddr_ieee802154
+ * (16 bits between 'family' and 'addr') and in struct
+ * ieee802154_addr_sa (16 bits at the end of the structure).
+ */
+ memset(saddr, 0, sizeof(*saddr));
+
saddr->family = AF_IEEE802154;
ieee802154_addr_to_sa(&saddr->addr, &mac_cb(skb)->source);
*addr_len = sizeof(*saddr);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 048/185] mnt: Modify fs_fully_visible to deal with locked ro nodev and atime
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (46 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 047/185] ieee802154: Fix sockaddr_ieee802154 implicit padding information leak Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 049/185] drm/qxl: Do not cause spice-server to clean our objects Luis Henriques
` (136 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Eric W. Biederman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit 8c6cf9cc829fcd0b179b59f7fe288941d0e31108 upstream.
Ignore an existing mount if the locked readonly, nodev or atime
attributes are less permissive than the desired attributes
of the new mount.
On success ensure the new mount locks all of the same readonly, nodev and
atime attributes as the old mount.
The nosuid and noexec attributes are not checked here as this change
is destined for stable and enforcing those attributes causes a
regression in lxc and libvirt-lxc where those applications will not
start and there are no known executables on sysfs or proc and no known
way to create exectuables without code modifications
Fixes: e51db73532955 ("userns: Better restrictions on when proc and sysfs can be mounted")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/namespace.c | 24 +++++++++++++++++++++---
1 file changed, 21 insertions(+), 3 deletions(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index 8d2384d12e32..8f76be393012 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2172,7 +2172,7 @@ unlock:
return err;
}
-static bool fs_fully_visible(struct file_system_type *fs_type);
+static bool fs_fully_visible(struct file_system_type *fs_type, int *new_mnt_flags);
/*
* create a new mount for userspace and request it to be added into the
@@ -2206,7 +2206,7 @@ static int do_new_mount(struct path *path, const char *fstype, int flags,
mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV;
}
if (type->fs_flags & FS_USERNS_VISIBLE) {
- if (!fs_fully_visible(type))
+ if (!fs_fully_visible(type, &mnt_flags))
return -EPERM;
}
}
@@ -3029,9 +3029,10 @@ bool current_chrooted(void)
return chrooted;
}
-static bool fs_fully_visible(struct file_system_type *type)
+static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags)
{
struct mnt_namespace *ns = current->nsproxy->mnt_ns;
+ int new_flags = *new_mnt_flags;
struct mount *mnt;
bool visible = false;
@@ -3050,6 +3051,19 @@ static bool fs_fully_visible(struct file_system_type *type)
if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
continue;
+ /* Verify the mount flags are equal to or more permissive
+ * than the proposed new mount.
+ */
+ if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) &&
+ !(new_flags & MNT_READONLY))
+ continue;
+ if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) &&
+ !(new_flags & MNT_NODEV))
+ continue;
+ if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) &&
+ ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK)))
+ continue;
+
/* This mount is not fully visible if there are any child mounts
* that cover anything except for empty directories.
*/
@@ -3060,6 +3074,10 @@ static bool fs_fully_visible(struct file_system_type *type)
if (inode->i_nlink > 2)
goto next;
}
+ /* Preserve the locked attributes */
+ *new_mnt_flags |= mnt->mnt.mnt_flags & (MNT_LOCK_READONLY | \
+ MNT_LOCK_NODEV | \
+ MNT_LOCK_ATIME);
visible = true;
goto found;
next: ;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 049/185] drm/qxl: Do not cause spice-server to clean our objects
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (47 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 048/185] mnt: Modify fs_fully_visible to deal with locked ro nodev and atime Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 050/185] drm/qxl: Do not leak memory if qxl_release_list_add fails Luis Henriques
` (135 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Frediano Ziglio, Dave Airlie, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Frediano Ziglio <fziglio@redhat.com>
commit 2fa19535ca6abcbfd1ccc9ef694db52f49f77747 upstream.
If objects are moved back from system memory to VRAM (and spice id
created again) memory is already initialized so we need to set flag
to not clear memory.
If you don't do it after a while using desktop many images turns to
black or transparents.
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/gpu/drm/qxl/qxl_cmd.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
index eb89653a7a17..c5e96a38f859 100644
--- a/drivers/gpu/drm/qxl/qxl_cmd.c
+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
@@ -505,6 +505,7 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev,
cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);
cmd->type = QXL_SURFACE_CMD_CREATE;
+ cmd->flags = QXL_SURF_FLAG_KEEP_DATA;
cmd->u.surface_create.format = surf->surf.format;
cmd->u.surface_create.width = surf->surf.width;
cmd->u.surface_create.height = surf->surf.height;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 050/185] drm/qxl: Do not leak memory if qxl_release_list_add fails
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (48 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 049/185] drm/qxl: Do not cause spice-server to clean our objects Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 051/185] selinux: fix setting of security labels on NFS Luis Henriques
` (134 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Frediano Ziglio, Dave Airlie, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Frediano Ziglio <fziglio@redhat.com>
commit 8451cc964c1d193b989c41a44e5e77109cc696f8 upstream.
If the function fails reference counter to the object is not decremented
causing leaks.
This is hard to spot as it happens only on very low memory situations.
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/gpu/drm/qxl/qxl_ioctl.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index b110883f8253..7354a4cda59d 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
qobj = gem_to_qxl_bo(gobj);
ret = qxl_release_list_add(release, qobj);
- if (ret)
+ if (ret) {
+ drm_gem_object_unreference_unlocked(gobj);
return NULL;
+ }
return qobj;
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 051/185] selinux: fix setting of security labels on NFS
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (49 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 050/185] drm/qxl: Do not leak memory if qxl_release_list_add fails Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 052/185] ath3k: Add support of 0489:e076 AR3012 device Luis Henriques
` (133 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Eric Paris, David Quigley, J. Bruce Fields, Paul Moore, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit 9fc2b4b436cff7d8403034676014f1be9d534942 upstream.
Before calling into the filesystem, vfs_setxattr calls
security_inode_setxattr, which ends up calling selinux_inode_setxattr in
our case. That returns -EOPNOTSUPP whenever SBLABEL_MNT is not set.
SBLABEL_MNT was supposed to be set by sb_finish_set_opts, which sets it
only if selinux_is_sblabel_mnt returns true.
The selinux_is_sblabel_mnt logic was broken by eadcabc697e9 "SELinux: do
all flags twiddling in one place", which didn't take into the account
the SECURITY_FS_USE_NATIVE behavior that had been introduced for nfs
with eb9ae686507b "SELinux: Add new labeling type native labels".
This caused setxattr's of security labels over NFSv4.2 to fail.
Cc: Eric Paris <eparis@redhat.com>
Cc: David Quigley <dpquigl@davequigley.com>
Reported-by: Richard Chan <rc556677@outlook.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
[PM: added the stable dependency]
Signed-off-by: Paul Moore <pmoore@redhat.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
security/selinux/hooks.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index a2aa95ecd1d5..9a23a7cccdc4 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -394,7 +394,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
sbsec->behavior == SECURITY_FS_USE_TRANS ||
- sbsec->behavior == SECURITY_FS_USE_TASK)
+ sbsec->behavior == SECURITY_FS_USE_TASK ||
+ sbsec->behavior == SECURITY_FS_USE_NATIVE)
return 1;
/* Special handling for sysfs. Is genfs but also has setxattr handler*/
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 052/185] ath3k: Add support of 0489:e076 AR3012 device
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (50 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 051/185] selinux: fix setting of security labels on NFS Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 053/185] ath3k: add support of 13d3:3474 " Luis Henriques
` (132 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dmitry Tunin, Marcel Holtmann, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <hanipouspilot@gmail.com>
commit 692c062e7c282164fd7cda68077f79dafd176eaf upstream.
BugLink: https://bugs.launchpad.net/bugs/1462614
This device requires new firmware files
AthrBT_0x11020100.dfu and ramps_0x11020100_40.dfu added to
/lib/firmware/ar3k/ that are not included in linux-firmware yet.
T: Bus=03 Lev=01 Prnt=01 Port=09 Cnt=06 Dev#= 7 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0489 ProdID=e076 Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/bluetooth/ath3k.c | 2 ++
drivers/bluetooth/btusb.c | 1 +
2 files changed, 3 insertions(+)
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index b526e7c7b109..9fc08bd1495e 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -80,6 +80,7 @@ static const struct usb_device_id ath3k_table[] = {
{ USB_DEVICE(0x0489, 0xe057) },
{ USB_DEVICE(0x0489, 0xe056) },
{ USB_DEVICE(0x0489, 0xe05f) },
+ { USB_DEVICE(0x0489, 0xe076) },
{ USB_DEVICE(0x0489, 0xe078) },
{ USB_DEVICE(0x04c5, 0x1330) },
{ USB_DEVICE(0x04CA, 0x3004) },
@@ -135,6 +136,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index ae854bab7dfa..6f37775139f1 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -170,6 +170,7 @@ static const struct usb_device_id blacklist_table[] = {
{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 053/185] ath3k: add support of 13d3:3474 AR3012 device
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (51 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 052/185] ath3k: Add support of 0489:e076 AR3012 device Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 054/185] Bluetooth: btusb: Fix memory leak in Intel setup routine Luis Henriques
` (131 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dmitry Tunin, Marcel Holtmann, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <hanipouspilot@gmail.com>
commit 0d0cef6183aec0fb6d0c9f00a09ff51ee086bbe2 upstream.
BugLink: https://bugs.launchpad.net/bugs/1427680
This device requires new firmware files
AthrBT_0x11020100.dfu and ramps_0x11020100_40.dfu added to
/lib/firmware/ar3k/ that are not included in linux-firmware yet.
T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=13d3 ProdID=3474 Rev=00.01
C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/bluetooth/ath3k.c | 2 ++
drivers/bluetooth/btusb.c | 1 +
2 files changed, 3 insertions(+)
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 9fc08bd1495e..ecac55f124e8 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -112,6 +112,7 @@ static const struct usb_device_id ath3k_table[] = {
{ USB_DEVICE(0x13d3, 0x3408) },
{ USB_DEVICE(0x13d3, 0x3423) },
{ USB_DEVICE(0x13d3, 0x3432) },
+ { USB_DEVICE(0x13d3, 0x3474) },
/* Atheros AR5BBU12 with sflash firmware */
{ USB_DEVICE(0x0489, 0xE02C) },
@@ -168,6 +169,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
/* Atheros AR5BBU22 with sflash firmware */
{ USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 6f37775139f1..fbedcf61060f 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -202,6 +202,7 @@ static const struct usb_device_id blacklist_table[] = {
{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
/* Atheros AR5BBU12 with sflash firmware */
{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 054/185] Bluetooth: btusb: Fix memory leak in Intel setup routine
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (52 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 053/185] ath3k: add support of 13d3:3474 " Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 055/185] ath9k: fix DMA stop sequence for AR9003+ Luis Henriques
` (130 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Marcel Holtmann, Johan Hedberg, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcel Holtmann <marcel@holtmann.org>
commit ecffc80478cdce122f0ecb6a4e4f909132dd5c47 upstream.
The SKB returned from the Intel specific version information command is
missing a kfree_skb.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index fbedcf61060f..41c4a74d589f 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -1307,6 +1307,8 @@ static int btusb_setup_intel(struct hci_dev *hdev)
}
fw_ptr = fw->data;
+ kfree_skb(skb);
+
/* This Intel specific command enables the manufacturer mode of the
* controller.
*
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 055/185] ath9k: fix DMA stop sequence for AR9003+
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (53 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 054/185] Bluetooth: btusb: Fix memory leak in Intel setup routine Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 056/185] b43: fix support for 14e4:4321 PCI dev with BCM4321 chipset Luis Henriques
` (129 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Felix Fietkau, Kalle Valo, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@openwrt.org>
commit 300f77c08ded96d33f492aaa02549103852f0c12 upstream.
AR93xx and newer needs to stop rx before tx to avoid getting the DMA
engine or MAC into a stuck state.
This should reduce/fix the occurence of "Failed to stop Tx DMA" logspam.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/wireless/ath/ath9k/main.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 62ac95d6bb9d..bf6efbc2c9c0 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -205,11 +205,13 @@ static bool ath_prepare_reset(struct ath_softc *sc)
ath_stop_ani(sc);
ath9k_hw_disable_interrupts(ah);
- if (!ath_drain_all_txq(sc))
- ret = false;
-
- if (!ath_stoprecv(sc))
- ret = false;
+ if (AR_SREV_9300_20_OR_LATER(ah)) {
+ ret &= ath_stoprecv(sc);
+ ret &= ath_drain_all_txq(sc);
+ } else {
+ ret &= ath_drain_all_txq(sc);
+ ret &= ath_stoprecv(sc);
+ }
return ret;
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 056/185] b43: fix support for 14e4:4321 PCI dev with BCM4321 chipset
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (54 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 055/185] ath9k: fix DMA stop sequence for AR9003+ Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 057/185] cdc-acm: Add support of ATOL FPrint fiscal printers Luis Henriques
` (128 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Rafał Miłecki, Kalle Valo, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
commit 90f91b129810c3f169e443252be30ed7c0130326 upstream.
It seems Broadcom released two devices with conflicting device id. There
are for sure 14e4:4321 PCI devices with BCM4321 (N-PHY) chipset, they
can be found in routers, e.g. Netgear WNR834Bv2. However, according to
Broadcom public sources 0x4321 is also used for 5 GHz BCM4306 (G-PHY).
It's unsure if they meant PCI device id, or "virtual" id (from SPROM).
To distinguish these devices lets check PHY type (G vs. N).
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/wireless/b43/main.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 0d6a0bb1f876..8556325e98a3 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5130,6 +5130,10 @@ static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
*have_5ghz_phy = true;
return;
case 0x4321: /* BCM4306 */
+ /* There are 14e4:4321 PCI devs with 2.4 GHz BCM4321 (N-PHY) */
+ if (dev->phy.type != B43_PHYTYPE_G)
+ break;
+ /* fall through */
case 0x4313: /* BCM4311 */
case 0x431a: /* BCM4318 */
case 0x432a: /* BCM4321 */
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 057/185] cdc-acm: Add support of ATOL FPrint fiscal printers
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (55 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 056/185] b43: fix support for 14e4:4321 PCI dev with BCM4321 chipset Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 058/185] regulator: core: fix constraints output buffer Luis Henriques
` (127 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Alexey Sokolov, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Sokolov <sokolov@7pikes.com>
commit 15bf722e6f6c0b884521a0363204532e849deb7f upstream.
ATOL FPrint fiscal printers require usb_clear_halt to be executed
to work properly. Add quirk to fix the issue.
Signed-off-by: Alexey Sokolov <sokolov@7pikes.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/class/cdc-acm.c | 9 +++++++++
drivers/usb/class/cdc-acm.h | 1 +
2 files changed, 10 insertions(+)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index a8946e88978e..54c79f7fdaf5 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1480,6 +1480,11 @@ skip_countries:
goto alloc_fail8;
}
+ if (quirks & CLEAR_HALT_CONDITIONS) {
+ usb_clear_halt(usb_dev, usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress));
+ usb_clear_halt(usb_dev, usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress));
+ }
+
return 0;
alloc_fail8:
if (acm->country_codes) {
@@ -1759,6 +1764,10 @@ static const struct usb_device_id acm_ids[] = {
.driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
},
+ { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
+ .driver_info = CLEAR_HALT_CONDITIONS,
+ },
+
/* Nokia S60 phones expose two ACM channels. The first is
* a modem and is picked up by the standard AT-command
* information below. The second is 'vendor-specific' but
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index d3251ebd09e2..9cca2e7280bb 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -134,3 +134,4 @@ struct acm {
#define NO_DATA_INTERFACE BIT(4)
#define IGNORE_DEVICE BIT(5)
#define QUIRK_CONTROL_LINE_STATE BIT(6)
+#define CLEAR_HALT_CONDITIONS BIT(7)
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 058/185] regulator: core: fix constraints output buffer
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (56 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 057/185] cdc-acm: Add support of ATOL FPrint fiscal printers Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 059/185] ACPI / PM: Add missing pm_generic_complete() invocation Luis Henriques
` (126 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Stefan Wahren, Mark Brown, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <stefan.wahren@i2se.com>
commit a7068e3932eee8268c4ce4e080a338ee7b8a27bf upstream.
The buffer for condtraints debug isn't big enough to hold the output
in all cases. So fix this issue by increasing the buffer.
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/regulator/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index efeb4b42c5ed..a2e836478549 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -773,7 +773,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state)
static void print_constraints(struct regulator_dev *rdev)
{
struct regulation_constraints *constraints = rdev->constraints;
- char buf[80] = "";
+ char buf[160] = "";
int count = 0;
int ret;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 059/185] ACPI / PM: Add missing pm_generic_complete() invocation
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (57 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 058/185] regulator: core: fix constraints output buffer Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 060/185] x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A Luis Henriques
` (125 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Rafael J. Wysocki, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
commit 3d56402d3fa8d10749eeb36293dd1992bd5ad0c3 upstream.
Add missing invocation of pm_generic_complete() to
acpi_subsys_complete() to allow ->complete callbacks provided
by the drivers of devices using the ACPI PM domain to be executed
during system resume.
Fixes: f25c0ae2b4c4 (ACPI / PM: Avoid resuming devices in ACPI PM domain during system suspend)
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/acpi/device_pm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index f702dcef4df9..e9f44a210712 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -930,6 +930,7 @@ EXPORT_SYMBOL_GPL(acpi_subsys_prepare);
*/
void acpi_subsys_complete(struct device *dev)
{
+ pm_generic_complete(dev);
/*
* If the device had been runtime-suspended before the system went into
* the sleep state it is going out of and it has never been resumed till
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 060/185] x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (58 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 059/185] ACPI / PM: Add missing pm_generic_complete() invocation Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 061/185] pinctrl: mvebu: armada-38x: fix PCIe functions Luis Henriques
` (124 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Bjorn Helgaas, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <bhelgaas@google.com>
commit 1dace0116d0b05c967d94644fc4dfe96be2ecd3d upstream.
The Foxconn K8M890-8237A has two PCI host bridges, and we can't assign
resources correctly without the information from _CRS that tells us which
address ranges are claimed by which bridge. In the bugs mentioned below,
we incorrectly assign a sound card address (this example is from 1033299):
bus: 00 index 2 [mem 0x80000000-0xfcffffffff]
ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-7f])
pci_root PNP0A08:00: host bridge window [mem 0x80000000-0xbfefffff] (ignored)
pci_root PNP0A08:00: host bridge window [mem 0xc0000000-0xdfffffff] (ignored)
pci_root PNP0A08:00: host bridge window [mem 0xf0000000-0xfebfffff] (ignored)
ACPI: PCI Root Bridge [PCI1] (domain 0000 [bus 80-ff])
pci_root PNP0A08:01: host bridge window [mem 0xbff00000-0xbfffffff] (ignored)
pci 0000:80:01.0: [1106:3288] type 0 class 0x000403
pci 0000:80:01.0: reg 10: [mem 0xbfffc000-0xbfffffff 64bit]
pci 0000:80:01.0: address space collision: [mem 0xbfffc000-0xbfffffff 64bit] conflicts with PCI Bus #00 [mem 0x80000000-0xfcffffffff]
pci 0000:80:01.0: BAR 0: assigned [mem 0xfd00000000-0xfd00003fff 64bit]
BUG: unable to handle kernel paging request at ffffc90000378000
IP: [<ffffffffa0345f63>] azx_create+0x37c/0x822 [snd_hda_intel]
We assigned 0xfd_0000_0000, but that is not in any of the host bridge
windows, and the sound card doesn't work.
Turn on pci=use_crs automatically for this system.
Link: https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/931368
Link: https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1033299
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/x86/pci/acpi.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index 5075371ab593..46e6538a1a6a 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -84,6 +84,17 @@ static const struct dmi_system_id pci_crs_quirks[] __initconst = {
DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
},
},
+ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/931368 */
+ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1033299 */
+ {
+ .callback = set_use_crs,
+ .ident = "Foxconn K8M890-8237A",
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Foxconn"),
+ DMI_MATCH(DMI_BOARD_NAME, "K8M890-8237A"),
+ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
+ },
+ },
/* Now for the blacklist.. */
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 061/185] pinctrl: mvebu: armada-38x: fix PCIe functions
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (59 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 060/185] x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 062/185] pinctrl: mvebu: armada-370: fix spi0 pin description Luis Henriques
` (123 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Thomas Petazzoni, Linus Walleij, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit 331642fbf24a1c16b2669ca0a6479b5fcd6dd5b2 upstream.
A new revision of the Marvell Armada 38x hardware datasheet unveiled
that the definition of some of the PCIe functions were not
correct. This commit fixes the pinctrl driver accordingly.
Some PCIe functions simply do not exist, some of the PCIe functions in
fact were corresponding to other functions, and some PCIe functions
have been added.
Note: the seemingly unrelated removal of spi(cs2) on MPP47 is related:
this function is in fact implemented on MPP43, instead of a PCIe
function.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: ca6d9a084b56f ("pinctrl: mvebu: add pin-muxing driver for the Marvell Armada 380/385")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
.../pinctrl/marvell,armada-38x-pinctrl.txt | 38 ++++++++---------
drivers/pinctrl/mvebu/pinctrl-armada-38x.c | 49 +++++++++-------------
2 files changed, 39 insertions(+), 48 deletions(-)
diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
index b17c96849fc9..4ac138aaaf87 100644
--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
@@ -27,15 +27,15 @@ mpp8 8 gpio, ge0(txd1), dev(ad10)
mpp9 9 gpio, ge0(txd2), dev(ad11)
mpp10 10 gpio, ge0(txd3), dev(ad12)
mpp11 11 gpio, ge0(txctl), dev(ad13)
-mpp12 12 gpio, ge0(rxd0), pcie0(rstout), pcie1(rstout) [1], spi0(cs1), dev(ad14)
-mpp13 13 gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15)
-mpp14 14 gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1)
-mpp15 15 gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi), pcie1(rstout) [1]
-mpp16 16 gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq)
+mpp12 12 gpio, ge0(rxd0), pcie0(rstout), spi0(cs1), dev(ad14), pcie3(clkreq)
+mpp13 13 gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15), pcie2(clkreq)
+mpp14 14 gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1), pcie3(clkreq)
+mpp15 15 gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi)
+mpp16 16 gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq), pcie1(clkreq) [1]
mpp17 17 gpio, ge0(rxclk), ptp(clk), ua1(rxd), spi0(sck), sata1(prsnt)
-mpp18 18 gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0), pcie1(rstout) [1]
-mpp19 19 gpio, ge0(col), ptp(event_req), pcie0(clkreq), sata1(prsnt), ua0(cts)
-mpp20 20 gpio, ge0(txclk), ptp(clk), pcie1(rstout) [1], sata0(prsnt), ua0(rts)
+mpp18 18 gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0)
+mpp19 19 gpio, ge0(col), ptp(event_req), ge0(txerr), sata1(prsnt), ua0(cts)
+mpp20 20 gpio, ge0(txclk), ptp(clk), sata0(prsnt), ua0(rts)
mpp21 21 gpio, spi0(cs1), ge1(rxd0), sata0(prsnt), sd0(cmd), dev(bootcs)
mpp22 22 gpio, spi0(mosi), dev(ad0)
mpp23 23 gpio, spi0(sck), dev(ad2)
@@ -58,23 +58,23 @@ mpp39 39 gpio, i2c1(sck), ge1(rxd2), ua0(cts), sd0(d1), dev(a2)
mpp40 40 gpio, i2c1(sda), ge1(rxd3), ua0(rts), sd0(d2), dev(ad6)
mpp41 41 gpio, ua1(rxd), ge1(rxctl), ua0(cts), spi1(cs3), dev(burst/last)
mpp42 42 gpio, ua1(txd), ua0(rts), dev(ad7)
-mpp43 43 gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), pcie0(rstout), dev(clkout)
-mpp44 44 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3], pcie0(rstout)
-mpp45 45 gpio, ref(clk_out0), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout)
-mpp46 46 gpio, ref(clk_out1), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout)
-mpp47 47 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], spi1(cs2), sata3(prsnt) [2]
-mpp48 48 gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4)
-mpp49 49 gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5)
-mpp50 50 gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(drx), audio(extclk), sd0(cmd)
+mpp43 43 gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), spi1(cs2), dev(clkout)
+mpp44 44 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3]
+mpp45 45 gpio, ref(clk_out0), pcie0(rstout)
+mpp46 46 gpio, ref(clk_out1), pcie0(rstout)
+mpp47 47 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [2]
+mpp48 48 gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4), pcie0(clkreq)
+mpp49 49 gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5), pcie1(clkreq)
+mpp50 50 gpio, pcie0(rstout), tdm2c(drx), audio(extclk), sd0(cmd)
mpp51 51 gpio, tdm2c(dtx), audio(sdo), m(decc_err)
-mpp52 52 gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(intn), audio(sdi), sd0(d6)
+mpp52 52 gpio, pcie0(rstout), tdm2c(intn), audio(sdi), sd0(d6)
mpp53 53 gpio, sata1(prsnt), sata0(prsnt), tdm2c(rstn), audio(bclk), sd0(d7)
-mpp54 54 gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), pcie1(rstout) [1], sd0(d3)
+mpp54 54 gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), ge0(txerr), sd0(d3)
mpp55 55 gpio, ua1(cts), ge(mdio), pcie1(clkreq) [1], spi1(cs1), sd0(d0)
mpp56 56 gpio, ua1(rts), ge(mdc), m(decc_err), spi1(mosi)
mpp57 57 gpio, spi1(sck), sd0(clk)
mpp58 58 gpio, pcie1(clkreq) [1], i2c1(sck), pcie2(clkreq), spi1(miso), sd0(d1)
-mpp59 59 gpio, pcie0(rstout), i2c1(sda), pcie1(rstout) [1], spi1(cs0), sd0(d2)
+mpp59 59 gpio, pcie0(rstout), i2c1(sda), spi1(cs0), sd0(d2)
[1]: only available on 88F6820 and 88F6828
[2]: only available on 88F6828
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-38x.c b/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
index 1049f82fb62f..1ee8d698eb96 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
@@ -94,37 +94,39 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "ge0", "rxd0", V_88F6810_PLUS),
MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
MPP_VAR_FUNCTION(4, "spi0", "cs1", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "dev", "ad14", V_88F6810_PLUS)),
+ MPP_VAR_FUNCTION(5, "dev", "ad14", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(6, "pcie3", "clkreq", V_88F6810_PLUS)),
MPP_MODE(13,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "ge0", "rxd1", V_88F6810_PLUS),
MPP_VAR_FUNCTION(2, "pcie0", "clkreq", V_88F6810_PLUS),
MPP_VAR_FUNCTION(3, "pcie1", "clkreq", V_88F6820_PLUS),
MPP_VAR_FUNCTION(4, "spi0", "cs2", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "dev", "ad15", V_88F6810_PLUS)),
+ MPP_VAR_FUNCTION(5, "dev", "ad15", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(6, "pcie2", "clkreq", V_88F6810_PLUS)),
MPP_MODE(14,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "ge0", "rxd2", V_88F6810_PLUS),
MPP_VAR_FUNCTION(2, "ptp", "clk", V_88F6810_PLUS),
MPP_VAR_FUNCTION(3, "m", "vtt_ctrl", V_88F6810_PLUS),
MPP_VAR_FUNCTION(4, "spi0", "cs3", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "dev", "wen1", V_88F6810_PLUS)),
+ MPP_VAR_FUNCTION(5, "dev", "wen1", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(6, "pcie3", "clkreq", V_88F6810_PLUS)),
MPP_MODE(15,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "ge0", "rxd3", V_88F6810_PLUS),
MPP_VAR_FUNCTION(2, "ge", "mdc slave", V_88F6810_PLUS),
MPP_VAR_FUNCTION(3, "pcie0", "rstout", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(4, "spi0", "mosi", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "pcie1", "rstout", V_88F6820_PLUS)),
+ MPP_VAR_FUNCTION(4, "spi0", "mosi", V_88F6810_PLUS)),
MPP_MODE(16,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "ge0", "rxctl", V_88F6810_PLUS),
MPP_VAR_FUNCTION(2, "ge", "mdio slave", V_88F6810_PLUS),
MPP_VAR_FUNCTION(3, "m", "decc_err", V_88F6810_PLUS),
MPP_VAR_FUNCTION(4, "spi0", "miso", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "pcie0", "clkreq", V_88F6810_PLUS)),
+ MPP_VAR_FUNCTION(5, "pcie0", "clkreq", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(6, "pcie1", "clkreq", V_88F6820_PLUS)),
MPP_MODE(17,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "ge0", "rxclk", V_88F6810_PLUS),
@@ -137,20 +139,18 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
MPP_VAR_FUNCTION(1, "ge0", "rxerr", V_88F6810_PLUS),
MPP_VAR_FUNCTION(2, "ptp", "trig_gen", V_88F6810_PLUS),
MPP_VAR_FUNCTION(3, "ua1", "txd", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(4, "spi0", "cs0", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "pcie1", "rstout", V_88F6820_PLUS)),
+ MPP_VAR_FUNCTION(4, "spi0", "cs0", V_88F6810_PLUS)),
MPP_MODE(19,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "ge0", "col", V_88F6810_PLUS),
MPP_VAR_FUNCTION(2, "ptp", "event_req", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "pcie0", "clkreq", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(3, "ge0", "txerr", V_88F6810_PLUS),
MPP_VAR_FUNCTION(4, "sata1", "prsnt", V_88F6810_PLUS),
MPP_VAR_FUNCTION(5, "ua0", "cts", V_88F6810_PLUS)),
MPP_MODE(20,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "ge0", "txclk", V_88F6810_PLUS),
MPP_VAR_FUNCTION(2, "ptp", "clk", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
MPP_VAR_FUNCTION(4, "sata0", "prsnt", V_88F6810_PLUS),
MPP_VAR_FUNCTION(5, "ua0", "rts", V_88F6810_PLUS)),
MPP_MODE(21,
@@ -275,35 +275,27 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
MPP_VAR_FUNCTION(1, "pcie0", "clkreq", V_88F6810_PLUS),
MPP_VAR_FUNCTION(2, "m", "vtt_ctrl", V_88F6810_PLUS),
MPP_VAR_FUNCTION(3, "m", "decc_err", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(4, "pcie0", "rstout", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(4, "spi1", "cs2", V_88F6810_PLUS),
MPP_VAR_FUNCTION(5, "dev", "clkout", V_88F6810_PLUS)),
MPP_MODE(44,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "sata0", "prsnt", V_88F6810_PLUS),
MPP_VAR_FUNCTION(2, "sata1", "prsnt", V_88F6810_PLUS),
MPP_VAR_FUNCTION(3, "sata2", "prsnt", V_88F6828),
- MPP_VAR_FUNCTION(4, "sata3", "prsnt", V_88F6828),
- MPP_VAR_FUNCTION(5, "pcie0", "rstout", V_88F6810_PLUS)),
+ MPP_VAR_FUNCTION(4, "sata3", "prsnt", V_88F6828)),
MPP_MODE(45,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "ref", "clk_out0", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
- MPP_VAR_FUNCTION(4, "pcie2", "rstout", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "pcie3", "rstout", V_88F6810_PLUS)),
+ MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS)),
MPP_MODE(46,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "ref", "clk_out1", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
- MPP_VAR_FUNCTION(4, "pcie2", "rstout", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "pcie3", "rstout", V_88F6810_PLUS)),
+ MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS)),
MPP_MODE(47,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "sata0", "prsnt", V_88F6810_PLUS),
MPP_VAR_FUNCTION(2, "sata1", "prsnt", V_88F6810_PLUS),
MPP_VAR_FUNCTION(3, "sata2", "prsnt", V_88F6828),
- MPP_VAR_FUNCTION(4, "spi1", "cs2", V_88F6810_PLUS),
MPP_VAR_FUNCTION(5, "sata3", "prsnt", V_88F6828)),
MPP_MODE(48,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
@@ -311,18 +303,19 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
MPP_VAR_FUNCTION(2, "m", "vtt_ctrl", V_88F6810_PLUS),
MPP_VAR_FUNCTION(3, "tdm2c", "pclk", V_88F6810_PLUS),
MPP_VAR_FUNCTION(4, "audio", "mclk", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "sd0", "d4", V_88F6810_PLUS)),
+ MPP_VAR_FUNCTION(5, "sd0", "d4", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(6, "pcie0", "clkreq", V_88F6810_PLUS)),
MPP_MODE(49,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "sata2", "prsnt", V_88F6828),
MPP_VAR_FUNCTION(2, "sata3", "prsnt", V_88F6828),
MPP_VAR_FUNCTION(3, "tdm2c", "fsync", V_88F6810_PLUS),
MPP_VAR_FUNCTION(4, "audio", "lrclk", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "sd0", "d5", V_88F6810_PLUS)),
+ MPP_VAR_FUNCTION(5, "sd0", "d5", V_88F6810_PLUS),
+ MPP_VAR_FUNCTION(6, "pcie1", "clkreq", V_88F6820_PLUS)),
MPP_MODE(50,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "pcie0", "rstout", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "pcie1", "rstout", V_88F6820_PLUS),
MPP_VAR_FUNCTION(3, "tdm2c", "drx", V_88F6810_PLUS),
MPP_VAR_FUNCTION(4, "audio", "extclk", V_88F6810_PLUS),
MPP_VAR_FUNCTION(5, "sd0", "cmd", V_88F6810_PLUS)),
@@ -334,7 +327,6 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
MPP_MODE(52,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "pcie0", "rstout", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "pcie1", "rstout", V_88F6820_PLUS),
MPP_VAR_FUNCTION(3, "tdm2c", "intn", V_88F6810_PLUS),
MPP_VAR_FUNCTION(4, "audio", "sdi", V_88F6810_PLUS),
MPP_VAR_FUNCTION(5, "sd0", "d6", V_88F6810_PLUS)),
@@ -350,7 +342,7 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
MPP_VAR_FUNCTION(1, "sata0", "prsnt", V_88F6810_PLUS),
MPP_VAR_FUNCTION(2, "sata1", "prsnt", V_88F6810_PLUS),
MPP_VAR_FUNCTION(3, "pcie0", "rstout", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(4, "pcie1", "rstout", V_88F6820_PLUS),
+ MPP_VAR_FUNCTION(4, "ge0", "txerr", V_88F6810_PLUS),
MPP_VAR_FUNCTION(5, "sd0", "d3", V_88F6810_PLUS)),
MPP_MODE(55,
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
@@ -380,7 +372,6 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
MPP_VAR_FUNCTION(1, "pcie0", "rstout", V_88F6810_PLUS),
MPP_VAR_FUNCTION(2, "i2c1", "sda", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
MPP_VAR_FUNCTION(4, "spi1", "cs0", V_88F6810_PLUS),
MPP_VAR_FUNCTION(5, "sd0", "d2", V_88F6810_PLUS)),
};
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 062/185] pinctrl: mvebu: armada-370: fix spi0 pin description
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (60 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 061/185] pinctrl: mvebu: armada-38x: fix PCIe functions Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 063/185] pinctrl: mvebu: armada-375: remove non-existing NAND re/we pins Luis Henriques
` (122 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Thomas Petazzoni, Linus Walleij, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit 438881dfddb9107ef0eb30b49368e91e092f0b3e upstream.
Due to a mistake, the CS0 and CS1 SPI0 functions were incorrectly
named "spi0-1" instead of just "spi0". This commit fixes that.
This DT binding change does not affect any of the in-tree users.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: 5f597bb2be57 ("pinctrl: mvebu: add pinctrl driver for Armada 370")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
.../devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt | 4 ++--
drivers/pinctrl/mvebu/pinctrl-armada-370.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
index adda2a8d1d52..e357b020861d 100644
--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
@@ -92,5 +92,5 @@ mpp61 61 gpo, dev(wen1), uart1(txd), audio(rclk)
mpp62 62 gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0),
audio(mclk), uart0(cts)
mpp63 63 gpo, spi0(sck), tclk
-mpp64 64 gpio, spi0(miso), spi0-1(cs1)
-mpp65 65 gpio, spi0(mosi), spi0-1(cs2)
+mpp64 64 gpio, spi0(miso), spi0(cs1)
+mpp65 65 gpio, spi0(mosi), spi0(cs2)
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-370.c b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
index 670e5b01c678..5e423e0b0cb2 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-370.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
@@ -370,11 +370,11 @@ static struct mvebu_mpp_mode mv88f6710_mpp_modes[] = {
MPP_MODE(64,
MPP_FUNCTION(0x0, "gpio", NULL),
MPP_FUNCTION(0x1, "spi0", "miso"),
- MPP_FUNCTION(0x2, "spi0-1", "cs1")),
+ MPP_FUNCTION(0x2, "spi0", "cs1")),
MPP_MODE(65,
MPP_FUNCTION(0x0, "gpio", NULL),
MPP_FUNCTION(0x1, "spi0", "mosi"),
- MPP_FUNCTION(0x2, "spi0-1", "cs2")),
+ MPP_FUNCTION(0x2, "spi0", "cs2")),
};
static struct mvebu_pinctrl_soc_info armada_370_pinctrl_info;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 063/185] pinctrl: mvebu: armada-375: remove non-existing NAND re/we pins
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (61 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 062/185] pinctrl: mvebu: armada-370: fix spi0 pin description Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 064/185] pinctrl: mvebu: armada-xp: remove non-existing NAND pins Luis Henriques
` (121 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Thomas Petazzoni, Linus Walleij, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit e5447d26092c72ef3346615ee558c9112ef8063f upstream.
After updating to a more recent version of the Armada 375, we realized
that some of the pins documented as having a NAND-related
functionality in fact did not have such functionality. This commit
updates the pinctrl driver accordingly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: ce3ed59dcddd ("pinctrl: mvebu: add pin-muxing driver for the Marvell Armada 375")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
.../devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt | 4 ++--
drivers/pinctrl/mvebu/pinctrl-armada-375.c | 2 --
2 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
index 7de0cda4a379..bedbe42c8c0a 100644
--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
@@ -22,8 +22,8 @@ mpp5 5 gpio, dev(ad7), spi0(cs2), spi1(cs2)
mpp6 6 gpio, dev(ad0), led(p1), audio(rclk)
mpp7 7 gpio, dev(ad1), ptp(clk), led(p2), audio(extclk)
mpp8 8 gpio, dev (bootcs), spi0(cs0), spi1(cs0)
-mpp9 9 gpio, nf(wen), spi0(sck), spi1(sck)
-mpp10 10 gpio, nf(ren), dram(vttctrl), led(c1)
+mpp9 9 gpio, spi0(sck), spi1(sck), nand(we)
+mpp10 10 gpio, dram(vttctrl), led(c1), nand(re)
mpp11 11 gpio, dev(a0), led(c2), audio(sdo)
mpp12 12 gpio, dev(a1), audio(bclk)
mpp13 13 gpio, dev(readyn), pcie0(rstoutn), pcie1(rstoutn)
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-375.c b/drivers/pinctrl/mvebu/pinctrl-armada-375.c
index db078fe7ace6..a5089029ba6c 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-375.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-375.c
@@ -98,13 +98,11 @@ static struct mvebu_mpp_mode mv88f6720_mpp_modes[] = {
MPP_FUNCTION(0x5, "nand", "ce")),
MPP_MODE(9,
MPP_FUNCTION(0x0, "gpio", NULL),
- MPP_FUNCTION(0x1, "nf", "wen"),
MPP_FUNCTION(0x2, "spi0", "sck"),
MPP_FUNCTION(0x3, "spi1", "sck"),
MPP_FUNCTION(0x5, "nand", "we")),
MPP_MODE(10,
MPP_FUNCTION(0x0, "gpio", NULL),
- MPP_FUNCTION(0x1, "nf", "ren"),
MPP_FUNCTION(0x2, "dram", "vttctrl"),
MPP_FUNCTION(0x3, "led", "c1"),
MPP_FUNCTION(0x5, "nand", "re"),
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 064/185] pinctrl: mvebu: armada-xp: remove non-existing NAND pins
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (62 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 063/185] pinctrl: mvebu: armada-375: remove non-existing NAND re/we pins Luis Henriques
@ 2015-07-15 9:10 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 065/185] pinctrl: mvebu: armada-xp: remove non-existing VDD cpu_pd functions Luis Henriques
` (120 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:10 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Thomas Petazzoni, Linus Walleij, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit bc99357f3690c11817756adfee0ece811a3db2e7 upstream.
After updating to a more recent version of the Armada XP datasheet, we
realized that some of the pins documented as having a NAND-related
functionality in fact did not have such functionality. This commit
updates the pinctrl driver accordingly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: 463e270f766a ("pinctrl: mvebu: add pinctrl driver for Armada XP")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
.../devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt | 4 ++--
drivers/pinctrl/mvebu/pinctrl-armada-xp.c | 2 --
2 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
index 373dbccd7ab0..974168d854ba 100644
--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
@@ -42,8 +42,8 @@ mpp20 20 gpio, ge0(rxd4), ge1(rxd2), lcd(d20), ptp(clk)
mpp21 21 gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat)
mpp22 22 gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt)
mpp23 23 gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt)
-mpp24 24 gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst)
-mpp25 25 gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk)
+mpp24 24 gpio, lcd(hsync), sata1(prsnt), tdm(rst)
+mpp25 25 gpio, lcd(vsync), sata0(prsnt), tdm(pclk)
mpp26 26 gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd)
mpp27 27 gpio, lcd(e), tdm(dtx), ptp(trig)
mpp28 28 gpio, lcd(pwm), tdm(drx), ptp(evreq)
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
index de311129f7a0..26e19faf3dfd 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
@@ -171,13 +171,11 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
MPP_MODE(24,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x1, "sata1", "prsnt", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-re", V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x3, "tdm", "rst", V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x4, "lcd", "hsync", V_MV78230_PLUS)),
MPP_MODE(25,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x1, "sata0", "prsnt", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-we", V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x3, "tdm", "pclk", V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x4, "lcd", "vsync", V_MV78230_PLUS)),
MPP_MODE(26,
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 065/185] pinctrl: mvebu: armada-xp: remove non-existing VDD cpu_pd functions
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (63 preceding siblings ...)
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 064/185] pinctrl: mvebu: armada-xp: remove non-existing NAND pins Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 066/185] pinctrl: mvebu: armada-xp: fix functions of MPP48 Luis Henriques
` (119 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Thomas Petazzoni, Linus Walleij, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit 80b3d04feab5e69d51cb2375eb989a7165e43e3b upstream.
The latest version of the Armada XP datasheet no longer documents the
VDD cpu_pd functions, which might indicate they are not working and/or
not supported. This commit ensures the pinctrl driver matches the
datasheet.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: 463e270f766a ("pinctrl: mvebu: add pinctrl driver for Armada XP")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
.../bindings/pinctrl/marvell,armada-xp-pinctrl.txt | 26 +++++++----------
drivers/pinctrl/mvebu/pinctrl-armada-xp.c | 33 +++++++---------------
2 files changed, 20 insertions(+), 39 deletions(-)
diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
index 974168d854ba..b347b85aa22e 100644
--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
@@ -44,13 +44,13 @@ mpp22 22 gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt)
mpp23 23 gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt)
mpp24 24 gpio, lcd(hsync), sata1(prsnt), tdm(rst)
mpp25 25 gpio, lcd(vsync), sata0(prsnt), tdm(pclk)
-mpp26 26 gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd)
+mpp26 26 gpio, lcd(clk), tdm(fsync)
mpp27 27 gpio, lcd(e), tdm(dtx), ptp(trig)
mpp28 28 gpio, lcd(pwm), tdm(drx), ptp(evreq)
-mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd)
+mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk)
mpp30 30 gpio, tdm(int1), sd0(clk)
-mpp31 31 gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd)
-mpp32 32 gpio, tdm(int3), sd0(d0), vdd(cpu1-pd)
+mpp31 31 gpio, tdm(int2), sd0(cmd)
+mpp32 32 gpio, tdm(int3), sd0(d0)
mpp33 33 gpio, tdm(int4), sd0(d1), mem(bat)
mpp34 34 gpio, tdm(int5), sd0(d2), sata0(prsnt)
mpp35 35 gpio, tdm(int6), sd0(d3), sata1(prsnt)
@@ -58,14 +58,11 @@ mpp36 36 gpio, spi(mosi)
mpp37 37 gpio, spi(miso)
mpp38 38 gpio, spi(sck)
mpp39 39 gpio, spi(cs0)
-mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd),
- pcie(clkreq0)
+mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0)
mpp41 41 gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt),
pcie(clkreq1)
-mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer),
- vdd(cpu0-pd)
-mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout),
- vdd(cpu2-3-pd){1}
+mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer)
+mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout)
mpp44 44 gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2),
mem(bat)
mpp45 45 gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt)
@@ -84,9 +81,9 @@ mpp51 51 gpio, dev(ad16)
mpp52 52 gpio, dev(ad17)
mpp53 53 gpio, dev(ad18)
mpp54 54 gpio, dev(ad19)
-mpp55 55 gpio, dev(ad20), vdd(cpu0-pd)
-mpp56 56 gpio, dev(ad21), vdd(cpu1-pd)
-mpp57 57 gpio, dev(ad22), vdd(cpu2-3-pd){1}
+mpp55 55 gpio, dev(ad20)
+mpp56 56 gpio, dev(ad21)
+mpp57 57 gpio, dev(ad22)
mpp58 58 gpio, dev(ad23)
mpp59 59 gpio, dev(ad24)
mpp60 60 gpio, dev(ad25)
@@ -96,6 +93,3 @@ mpp63 63 gpio, dev(ad28)
mpp64 64 gpio, dev(ad29)
mpp65 65 gpio, dev(ad30)
mpp66 66 gpio, dev(ad31)
-
-Notes:
-* {1} vdd(cpu2-3-pd) only available on mv78460.
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
index 26e19faf3dfd..529ad9f4e1a6 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
@@ -14,10 +14,7 @@
* available: mv78230, mv78260 and mv78460. From a pin muxing
* perspective, the mv78230 has 49 MPP pins. The mv78260 and mv78460
* both have 67 MPP pins (more GPIOs and address lines for the memory
- * bus mainly). The only difference between the mv78260 and the
- * mv78460 in terms of pin muxing is the addition of two functions on
- * pins 43 and 56 to access the VDD of the CPU2 and 3 (mv78260 has two
- * cores, mv78460 has four cores).
+ * bus mainly).
*/
#include <linux/err.h>
@@ -181,8 +178,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
MPP_MODE(26,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x3, "tdm", "fsync", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)),
+ MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS)),
MPP_MODE(27,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x1, "ptp", "trig", V_MV78230_PLUS),
@@ -197,8 +193,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x1, "ptp", "clk", V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x3, "tdm", "int0", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
+ MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS)),
MPP_MODE(30,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x1, "sd0", "clk", V_MV78230_PLUS),
@@ -206,13 +201,11 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
MPP_MODE(31,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x1, "sd0", "cmd", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
+ MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS)),
MPP_MODE(32,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x1, "sd0", "d0", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)),
+ MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS)),
MPP_MODE(33,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x1, "sd0", "d1", V_MV78230_PLUS),
@@ -244,7 +237,6 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x1, "spi", "cs1", V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x2, "uart2", "cts", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "vdd", "cpu1-pd", V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x4, "lcd", "vga-hsync", V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x5, "pcie", "clkreq0", V_MV78230_PLUS)),
MPP_MODE(41,
@@ -259,15 +251,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
MPP_VAR_FUNCTION(0x1, "uart2", "rxd", V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x2, "uart0", "cts", V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x3, "tdm", "int7", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
+ MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS)),
MPP_MODE(43,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x1, "uart2", "txd", V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x2, "uart0", "rts", V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x3, "spi", "cs3", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x5, "vdd", "cpu2-3-pd", V_MV78460)),
+ MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS)),
MPP_MODE(44,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x1, "uart2", "cts", V_MV78230_PLUS),
@@ -318,16 +308,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
MPP_VAR_FUNCTION(0x1, "dev", "ad19", V_MV78260_PLUS)),
MPP_MODE(55,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
- MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS),
- MPP_VAR_FUNCTION(0x2, "vdd", "cpu0-pd", V_MV78260_PLUS)),
+ MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS)),
MPP_MODE(56,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
- MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS),
- MPP_VAR_FUNCTION(0x2, "vdd", "cpu1-pd", V_MV78260_PLUS)),
+ MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS)),
MPP_MODE(57,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
- MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS),
- MPP_VAR_FUNCTION(0x2, "vdd", "cpu2-3-pd", V_MV78460)),
+ MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS)),
MPP_MODE(58,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
MPP_VAR_FUNCTION(0x1, "dev", "ad23", V_MV78260_PLUS)),
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 066/185] pinctrl: mvebu: armada-xp: fix functions of MPP48
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (64 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 065/185] pinctrl: mvebu: armada-xp: remove non-existing VDD cpu_pd functions Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 067/185] pinctrl: mvebu: armada-375: remove incorrect space in pin description Luis Henriques
` (118 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Thomas Petazzoni, Linus Walleij, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit ea78b9511a54d0de026e04b5da86b30515072f31 upstream.
There was a mistake in the definition of the functions for MPP48 on
Marvell Armada XP. The second function is dev(clkout), and not tclk.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: 463e270f766a ("pinctrl: mvebu: add pinctrl driver for Armada XP")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt | 2 +-
drivers/pinctrl/mvebu/pinctrl-armada-xp.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
index b347b85aa22e..96e7744cab84 100644
--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
@@ -69,7 +69,7 @@ mpp45 45 gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt)
mpp46 46 gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt)
mpp47 47 gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3),
ref(clkout)
-mpp48 48 gpio, tclk, dev(burst/last)
+mpp48 48 gpio, dev(clkout), dev(burst/last)
* Marvell Armada XP (mv78260 and mv78460 only)
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
index 529ad9f4e1a6..cb06fd293fd2 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
@@ -286,7 +286,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
MPP_VAR_FUNCTION(0x5, "pcie", "clkreq3", V_MV78230_PLUS)),
MPP_MODE(48,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "tclk", NULL, V_MV78230_PLUS),
+ MPP_VAR_FUNCTION(0x1, "dev", "clkout", V_MV78230_PLUS),
MPP_VAR_FUNCTION(0x2, "dev", "burst/last", V_MV78230_PLUS)),
MPP_MODE(49,
MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 067/185] pinctrl: mvebu: armada-375: remove incorrect space in pin description
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (65 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 066/185] pinctrl: mvebu: armada-xp: fix functions of MPP48 Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 068/185] pinctrl: mvebu: armada-38x: fix incorrect total number of GPIOs Luis Henriques
` (117 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Thomas Petazzoni, Linus Walleij, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit d538990ee12b162f7ce6c0fcef3b643800102676 upstream.
There was an incorrect space in the definition of the function of one
pin in the Armada 375 pinctrl driver, which this commit fixes.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: ce3ed59dcddd ("pinctrl: mvebu: add pin-muxing driver for the Marvell Armada 375")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/pinctrl/mvebu/pinctrl-armada-375.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-375.c b/drivers/pinctrl/mvebu/pinctrl-armada-375.c
index a5089029ba6c..64cc1184ecc2 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-375.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-375.c
@@ -92,7 +92,7 @@ static struct mvebu_mpp_mode mv88f6720_mpp_modes[] = {
MPP_FUNCTION(0x5, "nand", "io1")),
MPP_MODE(8,
MPP_FUNCTION(0x0, "gpio", NULL),
- MPP_FUNCTION(0x1, "dev ", "bootcs"),
+ MPP_FUNCTION(0x1, "dev", "bootcs"),
MPP_FUNCTION(0x2, "spi0", "cs0"),
MPP_FUNCTION(0x3, "spi1", "cs0"),
MPP_FUNCTION(0x5, "nand", "ce")),
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 068/185] pinctrl: mvebu: armada-38x: fix incorrect total number of GPIOs
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (66 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 067/185] pinctrl: mvebu: armada-375: remove incorrect space in pin description Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 069/185] i2c: at91: fix a race condition when using the DMA controller Luis Henriques
` (116 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Thomas Petazzoni, Linus Walleij, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit 27e7cd016558bf787b128fd882cdd90409ae4036 upstream.
The pinctrl_gpio_range[] array described a first bank of 32 GPIOs and
a second one of 27 GPIOs. However, since there is a total of 60 MPP
pins that can be muxed as GPIOs, the second bank really has 28 GPIOs.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes: ca6d9a084b56f ("pinctrl: mvebu: add pin-muxing driver for the Marvell Armada 380/385")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/pinctrl/mvebu/pinctrl-armada-38x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-38x.c b/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
index 1ee8d698eb96..adb6c238f059 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
@@ -400,7 +400,7 @@ static struct mvebu_mpp_ctrl armada_38x_mpp_controls[] = {
static struct pinctrl_gpio_range armada_38x_mpp_gpio_ranges[] = {
MPP_GPIO_RANGE(0, 0, 0, 32),
- MPP_GPIO_RANGE(1, 32, 32, 27),
+ MPP_GPIO_RANGE(1, 32, 32, 28),
};
static int armada_38x_pinctrl_probe(struct platform_device *pdev)
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 069/185] i2c: at91: fix a race condition when using the DMA controller
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (67 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 068/185] pinctrl: mvebu: armada-38x: fix incorrect total number of GPIOs Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 070/185] dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup Luis Henriques
` (115 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Cyrille Pitchen, Wolfram Sang, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyrille Pitchen <cyrille.pitchen@atmel.com>
commit 93563a6a71bb69dd324fc7354c60fb05f84aae6b upstream.
For TX transactions, the TXCOMP bit in the Status Register is cleared
when the first data is written into the Transmit Holding Register.
In the lines from at91_do_twi_transfer():
at91_twi_write_data_dma(dev);
at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
the TXCOMP interrupt may be enabled before the DMA controller has
actually started to write into the THR. In such a case, the TXCOMP bit
is still set into the Status Register so the interrupt is triggered
immediately. The driver understands that a transaction completion has
occurred but this transaction hasn't started yet. Hence the TXCOMP
interrupt is no longer enabled by at91_do_twi_transfer() but instead
by at91_twi_write_data_dma_callback().
Also, the TXCOMP bit in the Status Register in not a clear on read flag
but a snapshot of the transmission state at the time the Status
Register is read.
When a NACK error is dectected by the I2C controller, the TXCOMP, NACK
and TXRDY bits are set together to 1 in the SR. If enabled, the TXCOMP
interrupt is triggered at the same time. Also setting the TXRDY to 1
triggers the DMA controller to write the next data into the THR. Such
a write resets the TXCOMP bit to 0 in the SR. So depending on when the
interrupt handler reads the SR, it may fail to detect the NACK error
if it relies on the TXCOMP bit. The NACK bit and its interrupt should
be used instead.
For RX transactions, the TXCOMP bit in the Status Register is cleared
when the START bit is set into the Control Register. However to unify
the management of the TXCOMP bit when the DMA controller is used, the
TXCOMP interrupt is now enabled by the DMA callbacks for both TX and
RX transfers.
Signed-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com>
Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/i2c/busses/i2c-at91.c | 70 ++++++++++++++++++++++++++++++++-----------
1 file changed, 53 insertions(+), 17 deletions(-)
diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
index 30c8c1e738e1..c8ec841cf705 100644
--- a/drivers/i2c/busses/i2c-at91.c
+++ b/drivers/i2c/busses/i2c-at91.c
@@ -62,6 +62,9 @@
#define AT91_TWI_UNRE 0x0080 /* Underrun Error */
#define AT91_TWI_NACK 0x0100 /* Not Acknowledged */
+#define AT91_TWI_INT_MASK \
+ (AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK)
+
#define AT91_TWI_IER 0x0024 /* Interrupt Enable Register */
#define AT91_TWI_IDR 0x0028 /* Interrupt Disable Register */
#define AT91_TWI_IMR 0x002c /* Interrupt Mask Register */
@@ -117,13 +120,12 @@ static void at91_twi_write(struct at91_twi_dev *dev, unsigned reg, unsigned val)
static void at91_disable_twi_interrupts(struct at91_twi_dev *dev)
{
- at91_twi_write(dev, AT91_TWI_IDR,
- AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY);
+ at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK);
}
static void at91_twi_irq_save(struct at91_twi_dev *dev)
{
- dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7;
+ dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK;
at91_disable_twi_interrupts(dev);
}
@@ -213,6 +215,14 @@ static void at91_twi_write_data_dma_callback(void *data)
dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg),
dev->buf_len, DMA_TO_DEVICE);
+ /*
+ * When this callback is called, THR/TX FIFO is likely not to be empty
+ * yet. So we have to wait for TXCOMP or NACK bits to be set into the
+ * Status Register to be sure that the STOP bit has been sent and the
+ * transfer is completed. The NACK interrupt has already been enabled,
+ * we just have to enable TXCOMP one.
+ */
+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
}
@@ -307,7 +317,7 @@ static void at91_twi_read_data_dma_callback(void *data)
/* The last two bytes have to be read without using dma */
dev->buf += dev->buf_len - 2;
dev->buf_len = 2;
- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY);
+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP);
}
static void at91_twi_read_data_dma(struct at91_twi_dev *dev)
@@ -368,7 +378,7 @@ static irqreturn_t atmel_twi_interrupt(int irq, void *dev_id)
/* catch error flags */
dev->transfer_status |= status;
- if (irqstatus & AT91_TWI_TXCOMP) {
+ if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) {
at91_disable_twi_interrupts(dev);
complete(&dev->cmd_complete);
}
@@ -381,6 +391,34 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
int ret;
bool has_unre_flag = dev->pdata->has_unre_flag;
+ /*
+ * WARNING: the TXCOMP bit in the Status Register is NOT a clear on
+ * read flag but shows the state of the transmission at the time the
+ * Status Register is read. According to the programmer datasheet,
+ * TXCOMP is set when both holding register and internal shifter are
+ * empty and STOP condition has been sent.
+ * Consequently, we should enable NACK interrupt rather than TXCOMP to
+ * detect transmission failure.
+ *
+ * Besides, the TXCOMP bit is already set before the i2c transaction
+ * has been started. For read transactions, this bit is cleared when
+ * writing the START bit into the Control Register. So the
+ * corresponding interrupt can safely be enabled just after.
+ * However for write transactions managed by the CPU, we first write
+ * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP
+ * interrupt. If TXCOMP interrupt were enabled before writing into THR,
+ * the interrupt handler would be called immediately and the i2c command
+ * would be reported as completed.
+ * Also when a write transaction is managed by the DMA controller,
+ * enabling the TXCOMP interrupt in this function may lead to a race
+ * condition since we don't know whether the TXCOMP interrupt is enabled
+ * before or after the DMA has started to write into THR. So the TXCOMP
+ * interrupt is enabled later by at91_twi_write_data_dma_callback().
+ * Immediately after in that DMA callback, we still need to send the
+ * STOP condition manually writing the corresponding bit into the
+ * Control Register.
+ */
+
dev_dbg(dev->dev, "transfer: %s %d bytes.\n",
(dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len);
@@ -411,26 +449,24 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
* seems to be the best solution.
*/
if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
at91_twi_read_data_dma(dev);
- /*
- * It is important to enable TXCOMP irq here because
- * doing it only when transferring the last two bytes
- * will mask NACK errors since TXCOMP is set when a
- * NACK occurs.
- */
- at91_twi_write(dev, AT91_TWI_IER,
- AT91_TWI_TXCOMP);
- } else
+ } else {
at91_twi_write(dev, AT91_TWI_IER,
- AT91_TWI_TXCOMP | AT91_TWI_RXRDY);
+ AT91_TWI_TXCOMP |
+ AT91_TWI_NACK |
+ AT91_TWI_RXRDY);
+ }
} else {
if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
at91_twi_write_data_dma(dev);
- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
} else {
at91_twi_write_next_byte(dev);
at91_twi_write(dev, AT91_TWI_IER,
- AT91_TWI_TXCOMP | AT91_TWI_TXRDY);
+ AT91_TWI_TXCOMP |
+ AT91_TWI_NACK |
+ AT91_TWI_TXRDY);
}
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 070/185] dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (68 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 069/185] i2c: at91: fix a race condition when using the DMA controller Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 071/185] ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1] Luis Henriques
` (114 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Lior Amsalem, Maxime Ripard, Vinod Koul, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Lior Amsalem <alior@marvell.com>
commit 9136291f1dbc1d4d1cacd2840fb35f4f3ce16c46 upstream.
This patch fixes a bug in the XOR driver where the cleanup function can be
called and free descriptors that never been processed by the engine (which
result in data errors).
The cleanup function will free descriptors based on the ownership bit in
the descriptors.
Fixes: ff7b04796d98 ("dmaengine: DMA engine driver for Marvell XOR engine")
Signed-off-by: Lior Amsalem <alior@marvell.com>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Reviewed-by: Ofer Heifetz <oferh@marvell.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
[ luis: backported to 3.16:
- function rename: mv_xor_slot_cleanup() -> __mv_xor_slot_cleanup()
- adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/dma/mv_xor.c | 72 +++++++++++++++++++++++++++++++++-------------------
drivers/dma/mv_xor.h | 1 +
2 files changed, 47 insertions(+), 26 deletions(-)
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 394cbc5c93e3..6b2f01d60527 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -316,7 +316,8 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
dma_cookie_t cookie = 0;
int busy = mv_chan_is_busy(mv_chan);
u32 current_desc = mv_chan_get_current_desc(mv_chan);
- int seen_current = 0;
+ int current_cleaned = 0;
+ struct mv_xor_desc *hw_desc;
dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__);
dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc);
@@ -328,38 +329,57 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
list_for_each_entry_safe(iter, _iter, &mv_chan->chain,
chain_node) {
- prefetch(_iter);
- prefetch(&_iter->async_tx);
- /* do not advance past the current descriptor loaded into the
- * hardware channel, subsequent descriptors are either in
- * process or have not been submitted
- */
- if (seen_current)
- break;
+ /* clean finished descriptors */
+ hw_desc = iter->hw_desc;
+ if (hw_desc->status & XOR_DESC_SUCCESS) {
+ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan,
+ cookie);
- /* stop the search if we reach the current descriptor and the
- * channel is busy
- */
- if (iter->async_tx.phys == current_desc) {
- seen_current = 1;
- if (busy)
+ /* done processing desc, clean slot */
+ mv_xor_clean_slot(iter, mv_chan);
+
+ /* break if we did cleaned the current */
+ if (iter->async_tx.phys == current_desc) {
+ current_cleaned = 1;
+ break;
+ }
+ } else {
+ if (iter->async_tx.phys == current_desc) {
+ current_cleaned = 0;
break;
+ }
}
-
- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie);
-
- if (mv_xor_clean_slot(iter, mv_chan))
- break;
}
if ((busy == 0) && !list_empty(&mv_chan->chain)) {
- struct mv_xor_desc_slot *chain_head;
- chain_head = list_entry(mv_chan->chain.next,
- struct mv_xor_desc_slot,
- chain_node);
-
- mv_xor_start_new_chain(mv_chan, chain_head);
+ if (current_cleaned) {
+ /*
+ * current descriptor cleaned and removed, run
+ * from list head
+ */
+ iter = list_entry(mv_chan->chain.next,
+ struct mv_xor_desc_slot,
+ chain_node);
+ mv_xor_start_new_chain(mv_chan, iter);
+ } else {
+ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) {
+ /*
+ * descriptors are still waiting after
+ * current, trigger them
+ */
+ iter = list_entry(iter->chain_node.next,
+ struct mv_xor_desc_slot,
+ chain_node);
+ mv_xor_start_new_chain(mv_chan, iter);
+ } else {
+ /*
+ * some descriptors are still waiting
+ * to be cleaned
+ */
+ tasklet_schedule(&mv_chan->irq_tasklet);
+ }
+ }
}
if (cookie > 0)
diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h
index d0749229c875..5d14e4b21692 100644
--- a/drivers/dma/mv_xor.h
+++ b/drivers/dma/mv_xor.h
@@ -33,6 +33,7 @@
#define XOR_OPERATION_MODE_XOR 0
#define XOR_OPERATION_MODE_MEMCPY 2
#define XOR_DESCRIPTOR_SWAP BIT(14)
+#define XOR_DESC_SUCCESS 0x40000000
#define XOR_CURR_DESC(chan) (chan->mmr_high_base + 0x10 + (chan->idx * 4))
#define XOR_NEXT_DESC(chan) (chan->mmr_high_base + 0x00 + (chan->idx * 4))
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 071/185] ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1]
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (69 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 070/185] dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 072/185] arm64: Do not attempt to use init_mm in reset_context() Luis Henriques
` (113 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Zidan Wang, Mark Brown, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Zidan Wang <zidan.wang@freescale.com>
commit a077e81ec61e07a7f86997d045109f06719fbffe upstream.
the enum of "DAC Polarity" should be wm8960_enum[1].
Signed-off-by: Zidan Wang <zidan.wang@freescale.com>
Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/soc/codecs/wm8960.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
index 1f5a5eebfd67..c2acb2fabf33 100644
--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -242,7 +242,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0),
SOC_ENUM("ADC Polarity", wm8960_enum[0]),
SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0),
-SOC_ENUM("DAC Polarity", wm8960_enum[2]),
+SOC_ENUM("DAC Polarity", wm8960_enum[1]),
SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0,
wm8960_get_deemph, wm8960_put_deemph),
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 072/185] arm64: Do not attempt to use init_mm in reset_context()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (70 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 071/185] ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1] Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 073/185] ext4: fix race between truncate and __ext4_journalled_writepage() Luis Henriques
` (112 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Catalin Marinas, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <catalin.marinas@arm.com>
commit 565630d503ef24e44c252bed55571b3a0d68455f upstream.
After secondary CPU boot or hotplug, the active_mm of the idle thread is
&init_mm. The init_mm.pgd (swapper_pg_dir) is only meant for TTBR1_EL1
and must not be set in TTBR0_EL1. Since when active_mm == &init_mm the
TTBR0_EL1 is already set to the reserved value, there is no need to
perform any context reset.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arm64/mm/context.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
index baa758d37021..76c1e6cd36fc 100644
--- a/arch/arm64/mm/context.c
+++ b/arch/arm64/mm/context.c
@@ -92,6 +92,14 @@ static void reset_context(void *info)
unsigned int cpu = smp_processor_id();
struct mm_struct *mm = current->active_mm;
+ /*
+ * current->active_mm could be init_mm for the idle thread immediately
+ * after secondary CPU boot or hotplug. TTBR0_EL1 is already set to
+ * the reserved value, so no need to reset any context.
+ */
+ if (mm == &init_mm)
+ return;
+
smp_rmb();
asid = cpu_last_asid + cpu;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 073/185] ext4: fix race between truncate and __ext4_journalled_writepage()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (71 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 072/185] arm64: Do not attempt to use init_mm in reset_context() Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 074/185] Disable write buffering on Toshiba ToPIC95 Luis Henriques
` (111 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Theodore Ts'o, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit bdf96838aea6a265f2ae6cbcfb12a778c84a0b8e upstream.
The commit cf108bca465d: "ext4: Invert the locking order of page_lock
and transaction start" caused __ext4_journalled_writepage() to drop
the page lock before the page was written back, as part of changing
the locking order to jbd2_journal_start -> page_lock. However, this
introduced a potential race if there was a truncate racing with the
data=journalled writeback mode.
Fix this by grabbing the page lock after starting the journal handle,
and then checking to see if page had gotten truncated out from under
us.
This fixes a number of different warnings or BUG_ON's when running
xfstests generic/086 in data=journalled mode, including:
jbd2_journal_dirty_metadata: vdc-8: bad jh for block 115643: transaction (ee3fe7
c0, 164), jh->b_transaction ( (null), 0), jh->b_next_transaction ( (null), 0), jlist 0
- and -
kernel BUG at /usr/projects/linux/ext4/fs/jbd2/transaction.c:2200!
...
Call Trace:
[<c02b2ded>] ? __ext4_journalled_invalidatepage+0x117/0x117
[<c02b2de5>] __ext4_journalled_invalidatepage+0x10f/0x117
[<c02b2ded>] ? __ext4_journalled_invalidatepage+0x117/0x117
[<c027d883>] ? lock_buffer+0x36/0x36
[<c02b2dfa>] ext4_journalled_invalidatepage+0xd/0x22
[<c0229139>] do_invalidatepage+0x22/0x26
[<c0229198>] truncate_inode_page+0x5b/0x85
[<c022934b>] truncate_inode_pages_range+0x156/0x38c
[<c0229592>] truncate_inode_pages+0x11/0x15
[<c022962d>] truncate_pagecache+0x55/0x71
[<c02b913b>] ext4_setattr+0x4a9/0x560
[<c01ca542>] ? current_kernel_time+0x10/0x44
[<c026c4d8>] notify_change+0x1c7/0x2be
[<c0256a00>] do_truncate+0x65/0x85
[<c0226f31>] ? file_ra_state_init+0x12/0x29
- and -
WARNING: CPU: 1 PID: 1331 at /usr/projects/linux/ext4/fs/jbd2/transaction.c:1396
irty_metadata+0x14a/0x1ae()
...
Call Trace:
[<c01b879f>] ? console_unlock+0x3a1/0x3ce
[<c082cbb4>] dump_stack+0x48/0x60
[<c0178b65>] warn_slowpath_common+0x89/0xa0
[<c02ef2cf>] ? jbd2_journal_dirty_metadata+0x14a/0x1ae
[<c0178bef>] warn_slowpath_null+0x14/0x18
[<c02ef2cf>] jbd2_journal_dirty_metadata+0x14a/0x1ae
[<c02d8615>] __ext4_handle_dirty_metadata+0xd4/0x19d
[<c02b2f44>] write_end_fn+0x40/0x53
[<c02b4a16>] ext4_walk_page_buffers+0x4e/0x6a
[<c02b59e7>] ext4_writepage+0x354/0x3b8
[<c02b2f04>] ? mpage_release_unused_pages+0xd4/0xd4
[<c02b1b21>] ? wait_on_buffer+0x2c/0x2c
[<c02b5a4b>] ? ext4_writepage+0x3b8/0x3b8
[<c02b5a5b>] __writepage+0x10/0x2e
[<c0225956>] write_cache_pages+0x22d/0x32c
[<c02b5a4b>] ? ext4_writepage+0x3b8/0x3b8
[<c02b6ee8>] ext4_writepages+0x102/0x607
[<c019adfe>] ? sched_clock_local+0x10/0x10e
[<c01a8a7c>] ? __lock_is_held+0x2e/0x44
[<c01a8ad5>] ? lock_is_held+0x43/0x51
[<c0226dff>] do_writepages+0x1c/0x29
[<c0276bed>] __writeback_single_inode+0xc3/0x545
[<c0277c07>] writeback_sb_inodes+0x21f/0x36d
...
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/ext4/inode.c | 23 +++++++++++++++++++----
1 file changed, 19 insertions(+), 4 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 6a37a1f51e56..fd3c9d5ac932 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1740,19 +1740,32 @@ static int __ext4_journalled_writepage(struct page *page,
ext4_walk_page_buffers(handle, page_bufs, 0, len,
NULL, bget_one);
}
- /* As soon as we unlock the page, it can go away, but we have
- * references to buffers so we are safe */
+ /*
+ * We need to release the page lock before we start the
+ * journal, so grab a reference so the page won't disappear
+ * out from under us.
+ */
+ get_page(page);
unlock_page(page);
handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE,
ext4_writepage_trans_blocks(inode));
if (IS_ERR(handle)) {
ret = PTR_ERR(handle);
- goto out;
+ put_page(page);
+ goto out_no_pagelock;
}
-
BUG_ON(!ext4_handle_valid(handle));
+ lock_page(page);
+ put_page(page);
+ if (page->mapping != mapping) {
+ /* The page got truncated from under us */
+ ext4_journal_stop(handle);
+ ret = 0;
+ goto out;
+ }
+
if (inline_data) {
BUFFER_TRACE(inode_bh, "get write access");
ret = ext4_journal_get_write_access(handle, inode_bh);
@@ -1778,6 +1791,8 @@ static int __ext4_journalled_writepage(struct page *page,
NULL, bput_one);
ext4_set_inode_state(inode, EXT4_STATE_JDATA);
out:
+ unlock_page(page);
+out_no_pagelock:
brelse(inode_bh);
return ret;
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 074/185] Disable write buffering on Toshiba ToPIC95
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (72 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 073/185] ext4: fix race between truncate and __ext4_journalled_writepage() Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 075/185] fs/ufs: revert "ufs: fix deadlocks introduced by sb mutex merge" Luis Henriques
` (110 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Ryan C. Underwood, Dominik Brodowski, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Underwood <nemesis@icequake.net>
commit 2fb22a8042fe96b4220843f79241c116d90922c4 upstream.
Disable write buffering on the Toshiba ToPIC95 if it is enabled by
somebody (it is not supposed to be a power-on default according to
the datasheet). On the ToPIC95, practically no 32-bit Cardbus card
will work under heavy load without locking up the whole system if
this is left enabled. I tried about a dozen. It does not affect
16-bit cards. This is similar to the O2 bugs in early controller
revisions it seems.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=55961
Signed-off-by: Ryan C. Underwood <nemesis@icequake.net>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/pcmcia/topic.h | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/pcmcia/topic.h b/drivers/pcmcia/topic.h
index 615a45a8fe86..582688fe7505 100644
--- a/drivers/pcmcia/topic.h
+++ b/drivers/pcmcia/topic.h
@@ -104,6 +104,9 @@
#define TOPIC_EXCA_IF_CONTROL 0x3e /* 8 bit */
#define TOPIC_EXCA_IFC_33V_ENA 0x01
+#define TOPIC_PCI_CFG_PPBCN 0x3e /* 16-bit */
+#define TOPIC_PCI_CFG_PPBCN_WBEN 0x0400
+
static void topic97_zoom_video(struct pcmcia_socket *sock, int onoff)
{
struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket);
@@ -138,6 +141,7 @@ static int topic97_override(struct yenta_socket *socket)
static int topic95_override(struct yenta_socket *socket)
{
u8 fctrl;
+ u16 ppbcn;
/* enable 3.3V support for 16bit cards */
fctrl = exca_readb(socket, TOPIC_EXCA_IF_CONTROL);
@@ -146,6 +150,18 @@ static int topic95_override(struct yenta_socket *socket)
/* tell yenta to use exca registers to power 16bit cards */
socket->flags |= YENTA_16BIT_POWER_EXCA | YENTA_16BIT_POWER_DF;
+ /* Disable write buffers to prevent lockups under load with numerous
+ Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the
+ net. This is not a power-on default according to the datasheet
+ but some BIOSes seem to set it. */
+ if (pci_read_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, &ppbcn) == 0
+ && socket->dev->revision <= 7
+ && (ppbcn & TOPIC_PCI_CFG_PPBCN_WBEN)) {
+ ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN;
+ pci_write_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, ppbcn);
+ dev_info(&socket->dev->dev, "Disabled ToPIC95 Cardbus write buffers.\n");
+ }
+
return 0;
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 075/185] fs/ufs: revert "ufs: fix deadlocks introduced by sb mutex merge"
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (73 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 074/185] Disable write buffering on Toshiba ToPIC95 Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 076/185] jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail() Luis Henriques
` (109 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Fabian Frederick, Ian Campbell, Evgeniy Dushistov,
Alexey Khoroshilov, Roger Pau Monne, Ian Jackson, Al Viro,
Andrew Morton, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabian Frederick <fabf@skynet.be>
commit 13b987ea275840d74d9df9a44326632fab1894da upstream.
This reverts commit 9ef7db7f38d0 ("ufs: fix deadlocks introduced by sb
mutex merge") That patch tried to solve commit 0244756edc4b98c ("ufs: sb
mutex merge + mutex_destroy") which is itself partially reverted due to
multiple deadlocks.
Signed-off-by: Fabian Frederick <fabf@skynet.be>
Suggested-by: Jan Kara <jack@suse.cz>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: Evgeniy Dushistov <dushistov@mail.ru>
Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: Roger Pau Monne <roger.pau@citrix.com>
Cc: Ian Jackson <Ian.Jackson@eu.citrix.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/ufs/inode.c | 5 ++++-
fs/ufs/namei.c | 14 ++++++++------
2 files changed, 12 insertions(+), 7 deletions(-)
diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index 42234a871b22..40d6423429cb 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -902,6 +902,9 @@ void ufs_evict_inode(struct inode * inode)
invalidate_inode_buffers(inode);
clear_inode(inode);
- if (want_delete)
+ if (want_delete) {
+ lock_ufs(inode->i_sb);
ufs_free_inode(inode);
+ unlock_ufs(inode->i_sb);
+ }
}
diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c
index 2df62a73f20c..90d74b8f8eba 100644
--- a/fs/ufs/namei.c
+++ b/fs/ufs/namei.c
@@ -126,12 +126,12 @@ static int ufs_symlink (struct inode * dir, struct dentry * dentry,
if (l > sb->s_blocksize)
goto out_notlocked;
+ lock_ufs(dir->i_sb);
inode = ufs_new_inode(dir, S_IFLNK | S_IRWXUGO);
err = PTR_ERR(inode);
if (IS_ERR(inode))
- goto out_notlocked;
+ goto out;
- lock_ufs(dir->i_sb);
if (l > UFS_SB(sb)->s_uspi->s_maxsymlinklen) {
/* slow symlink */
inode->i_op = &ufs_symlink_inode_operations;
@@ -181,9 +181,13 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode)
struct inode * inode;
int err;
+ lock_ufs(dir->i_sb);
+ inode_inc_link_count(dir);
+
inode = ufs_new_inode(dir, S_IFDIR|mode);
+ err = PTR_ERR(inode);
if (IS_ERR(inode))
- return PTR_ERR(inode);
+ goto out_dir;
inode->i_op = &ufs_dir_inode_operations;
inode->i_fop = &ufs_dir_operations;
@@ -191,9 +195,6 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode)
inode_inc_link_count(inode);
- lock_ufs(dir->i_sb);
- inode_inc_link_count(dir);
-
err = ufs_make_empty(inode, dir);
if (err)
goto out_fail;
@@ -211,6 +212,7 @@ out_fail:
inode_dec_link_count(inode);
inode_dec_link_count(inode);
iput (inode);
+out_dir:
inode_dec_link_count(dir);
unlock_ufs(dir->i_sb);
goto out;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 076/185] jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (74 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 075/185] fs/ufs: revert "ufs: fix deadlocks introduced by sb mutex merge" Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 077/185] regmap: Fix regmap_bulk_read in BE mode Luis Henriques
` (108 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dmitry Monakhov, Theodore Ts'o, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Monakhov <dmonakhov@openvz.org>
commit b4f1afcd068f6e533230dfed00782cd8a907f96b upstream.
jbd2_cleanup_journal_tail() can be invoked by jbd2__journal_start()
So allocations should be done with GFP_NOFS
[Full stack trace snipped from 3.10-rh7]
[<ffffffff815c4bd4>] dump_stack+0x19/0x1b
[<ffffffff8105dba1>] warn_slowpath_common+0x61/0x80
[<ffffffff8105dcca>] warn_slowpath_null+0x1a/0x20
[<ffffffff815c2142>] slab_pre_alloc_hook.isra.31.part.32+0x15/0x17
[<ffffffff8119c045>] kmem_cache_alloc+0x55/0x210
[<ffffffff811477f5>] ? mempool_alloc_slab+0x15/0x20
[<ffffffff811477f5>] mempool_alloc_slab+0x15/0x20
[<ffffffff81147939>] mempool_alloc+0x69/0x170
[<ffffffff815cb69e>] ? _raw_spin_unlock_irq+0xe/0x20
[<ffffffff8109160d>] ? finish_task_switch+0x5d/0x150
[<ffffffff811f1a8e>] bio_alloc_bioset+0x1be/0x2e0
[<ffffffff8127ee49>] blkdev_issue_flush+0x99/0x120
[<ffffffffa019a733>] jbd2_cleanup_journal_tail+0x93/0xa0 [jbd2] -->GFP_KERNEL
[<ffffffffa019aca1>] jbd2_log_do_checkpoint+0x221/0x4a0 [jbd2]
[<ffffffffa019afc7>] __jbd2_log_wait_for_space+0xa7/0x1e0 [jbd2]
[<ffffffffa01952d8>] start_this_handle+0x2d8/0x550 [jbd2]
[<ffffffff811b02a9>] ? __memcg_kmem_put_cache+0x29/0x30
[<ffffffff8119c120>] ? kmem_cache_alloc+0x130/0x210
[<ffffffffa019573a>] jbd2__journal_start+0xba/0x190 [jbd2]
[<ffffffff811532ce>] ? lru_cache_add+0xe/0x10
[<ffffffffa01c9549>] ? ext4_da_write_begin+0xf9/0x330 [ext4]
[<ffffffffa01f2c77>] __ext4_journal_start_sb+0x77/0x160 [ext4]
[<ffffffffa01c9549>] ext4_da_write_begin+0xf9/0x330 [ext4]
[<ffffffff811446ec>] generic_file_buffered_write_iter+0x10c/0x270
[<ffffffff81146918>] __generic_file_write_iter+0x178/0x390
[<ffffffff81146c6b>] __generic_file_aio_write+0x8b/0xb0
[<ffffffff81146ced>] generic_file_aio_write+0x5d/0xc0
[<ffffffffa01bf289>] ext4_file_write+0xa9/0x450 [ext4]
[<ffffffff811c31d9>] ? pipe_read+0x379/0x4f0
[<ffffffff811b93f0>] do_sync_write+0x90/0xe0
[<ffffffff811b9b6d>] vfs_write+0xbd/0x1e0
[<ffffffff811ba5b8>] SyS_write+0x58/0xb0
[<ffffffff815d4799>] system_call_fastpath+0x16/0x1b
Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/jbd2/checkpoint.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
index 7f34f4716165..8d09e756b675 100644
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -463,7 +463,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
* jbd2_cleanup_journal_tail() doesn't get called all that often.
*/
if (journal->j_flags & JBD2_BARRIER)
- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
+ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
__jbd2_update_log_tail(journal, first_tid, blocknr);
return 0;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 077/185] regmap: Fix regmap_bulk_read in BE mode
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (75 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 076/185] jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail() Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 078/185] jbd2: fix ocfs2 corrupt when updating journal superblock fails Luis Henriques
` (107 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Arun Chandran, Mark Brown, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Arun Chandran <achandran@mvista.com>
commit 15b8d2c41fe5839582029f65c5f7004db451cc2b upstream.
In big endian mode regmap_bulk_read gives incorrect data
for byte reads.
This is because memcpy of a single byte from an address
after full word read gives different results when
endianness differs. ie. we get little-end in LE and big-end in BE.
Signed-off-by: Arun Chandran <achandran@mvista.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/base/regmap/regmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 457d335f8495..09fe07b6e98b 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -2247,7 +2247,7 @@ int regmap_bulk_read(struct regmap *map, unsigned int reg, void *val,
&ival);
if (ret != 0)
return ret;
- memcpy(val + (i * val_bytes), &ival, val_bytes);
+ map->format.format_val(val + (i * val_bytes), ival, 0);
}
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 078/185] jbd2: fix ocfs2 corrupt when updating journal superblock fails
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (76 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 077/185] regmap: Fix regmap_bulk_read in BE mode Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 079/185] ideapad: fix software rfkill setting Luis Henriques
` (106 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Joseph Qi, Theodore Ts'o, Junxiao Bi, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@huawei.com>
commit 6f6a6fda294506dfe0e3e0a253bb2d2923f28f0a upstream.
If updating journal superblock fails after journal data has been
flushed, the error is omitted and this will mislead the caller as a
normal case. In ocfs2, the checkpoint will be treated successfully
and the other node can get the lock to update. Since the sb_start is
still pointing to the old log block, it will rewrite the journal data
during journal recovery by the other node. Thus the new updates will
be overwritten and ocfs2 corrupts. So in above case we have to return
the error, and ocfs2_commit_cache will take care of the error and
prevent the other node to do update first. And only after recovering
journal it can do the new updates.
The issue discussion mail can be found at:
https://oss.oracle.com/pipermail/ocfs2-devel/2015-June/010856.html
http://comments.gmane.org/gmane.comp.file-systems.ext4/48841
[ Fixed bug in patch which allowed a non-negative error return from
jbd2_cleanup_journal_tail() to leak out of jbd2_fjournal_flush(); this
was causing xfstests ext4/306 to fail. -- Ted ]
Reported-by: Yiwen Jiang <jiangyiwen@huawei.com>
Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Tested-by: Yiwen Jiang <jiangyiwen@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/jbd2/checkpoint.c | 5 ++---
fs/jbd2/journal.c | 38 +++++++++++++++++++++++++++++++-------
include/linux/jbd2.h | 4 ++--
3 files changed, 35 insertions(+), 12 deletions(-)
diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
index 8d09e756b675..b892355f1944 100644
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -448,7 +448,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
unsigned long blocknr;
if (is_journal_aborted(journal))
- return 1;
+ return -EIO;
if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
return 1;
@@ -465,8 +465,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
if (journal->j_flags & JBD2_BARRIER)
blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
- __jbd2_update_log_tail(journal, first_tid, blocknr);
- return 0;
+ return __jbd2_update_log_tail(journal, first_tid, blocknr);
}
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 19d74d86d99c..72e238b50ad1 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
*
* Requires j_checkpoint_mutex
*/
-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
{
unsigned long freed;
+ int ret;
BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
* space and if we lose sb update during power failure we'd replay
* old transaction with possibly newly overwritten data.
*/
- jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
+ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
+ if (ret)
+ goto out;
+
write_lock(&journal->j_state_lock);
freed = block - journal->j_tail;
if (block < journal->j_tail)
@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
journal->j_tail_sequence = tid;
journal->j_tail = block;
write_unlock(&journal->j_state_lock);
+
+out:
+ return ret;
}
/*
@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *journal)
return jbd2_journal_start_thread(journal);
}
-static void jbd2_write_superblock(journal_t *journal, int write_op)
+static int jbd2_write_superblock(journal_t *journal, int write_op)
{
struct buffer_head *bh = journal->j_sb_buffer;
journal_superblock_t *sb = journal->j_superblock;
@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
printk(KERN_ERR "JBD2: Error %d detected when updating "
"journal superblock for %s.\n", ret,
journal->j_devname);
+ jbd2_journal_abort(journal, ret);
}
+
+ return ret;
}
/**
@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
* Update a journal's superblock information about log tail and write it to
* disk, waiting for the IO to complete.
*/
-void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
+int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
unsigned long tail_block, int write_op)
{
journal_superblock_t *sb = journal->j_superblock;
+ int ret;
BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
sb->s_sequence = cpu_to_be32(tail_tid);
sb->s_start = cpu_to_be32(tail_block);
- jbd2_write_superblock(journal, write_op);
+ ret = jbd2_write_superblock(journal, write_op);
+ if (ret)
+ goto out;
/* Log is no longer empty */
write_lock(&journal->j_state_lock);
WARN_ON(!sb->s_sequence);
journal->j_flags &= ~JBD2_FLUSHED;
write_unlock(&journal->j_state_lock);
+
+out:
+ return ret;
}
/**
@@ -1952,7 +1968,14 @@ int jbd2_journal_flush(journal_t *journal)
return -EIO;
mutex_lock(&journal->j_checkpoint_mutex);
- jbd2_cleanup_journal_tail(journal);
+ if (!err) {
+ err = jbd2_cleanup_journal_tail(journal);
+ if (err < 0) {
+ mutex_unlock(&journal->j_checkpoint_mutex);
+ goto out;
+ }
+ err = 0;
+ }
/* Finally, mark the journal as really needing no recovery.
* This sets s_start==0 in the underlying superblock, which is
@@ -1968,7 +1991,8 @@ int jbd2_journal_flush(journal_t *journal)
J_ASSERT(journal->j_head == journal->j_tail);
J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
write_unlock(&journal->j_state_lock);
- return 0;
+out:
+ return err;
}
/**
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index 0dae71e9971c..e1fb0f613a99 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_descriptor_buffer(journal_t *journal);
int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
unsigned long *block);
-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
/* Commit management */
@@ -1157,7 +1157,7 @@ extern int jbd2_journal_recover (journal_t *journal);
extern int jbd2_journal_wipe (journal_t *, int);
extern int jbd2_journal_skip_recovery (journal_t *);
extern void jbd2_journal_update_sb_errno(journal_t *);
-extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
+extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
unsigned long, int);
extern void __jbd2_journal_abort_hard (journal_t *);
extern void jbd2_journal_abort (journal_t *, int);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 079/185] ideapad: fix software rfkill setting
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (77 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 078/185] jbd2: fix ocfs2 corrupt when updating journal superblock fails Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 080/185] fs/ufs: restore s_lock mutex Luis Henriques
` (105 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Arnd Bergmann, Darren Hart, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 4b200b4604bec3388426159f1656109d19fadf6e upstream.
This fixes a several year old regression that I found while trying
to get the Yoga 3 11 to work. The ideapad_rfk_set function is meant
to send a command to the embedded controller through ACPI, but
as of c1f73658ed, it sends the index of the rfkill device instead
of the command, and ignores the opcode field.
This changes it back to the original behavior, which indeed
flips the rfkill state as seen in the debugfs interface.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: c1f73658ed ("ideapad: pass ideapad_priv as argument (part 2)")
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/platform/x86/ideapad-laptop.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 11712d1dbd17..627d43f3f078 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -464,8 +464,9 @@ const struct ideapad_rfk_data ideapad_rfk_data[] = {
static int ideapad_rfk_set(void *data, bool blocked)
{
struct ideapad_rfk_priv *priv = data;
+ int opcode = ideapad_rfk_data[priv->dev].opcode;
- return write_ec_cmd(priv->priv->adev->handle, priv->dev, !blocked);
+ return write_ec_cmd(priv->priv->adev->handle, opcode, !blocked);
}
static struct rfkill_ops ideapad_rfk_ops = {
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 080/185] fs/ufs: restore s_lock mutex
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (78 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 079/185] ideapad: fix software rfkill setting Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 081/185] regmap: Fix possible shift overflow in regmap_field_init() Luis Henriques
` (104 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Fabian Frederick, Ian Campbell, Evgeniy Dushistov,
Alexey Khoroshilov, Roger Pau Monne, Ian Jackson, Al Viro,
Andrew Morton, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabian Frederick <fabf@skynet.be>
commit cdd9eefdf905e92e7fc6cc393314efe68dc6ff66 upstream.
Commit 0244756edc4b98c ("ufs: sb mutex merge + mutex_destroy") generated
deadlocks in read/write mode on mkdir.
This patch partially reverts it keeping fixes by Andrew Morton and
mutex_destroy()
[AV: fixed a missing bit in ufs_remount()]
Signed-off-by: Fabian Frederick <fabf@skynet.be>
Reported-by: Ian Campbell <ian.campbell@citrix.com>
Suggested-by: Jan Kara <jack@suse.cz>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: Evgeniy Dushistov <dushistov@mail.ru>
Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: Roger Pau Monne <roger.pau@citrix.com>
Cc: Ian Jackson <Ian.Jackson@eu.citrix.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/ufs/balloc.c | 34 +++++++++++++++++-----------------
fs/ufs/ialloc.c | 16 ++++++++--------
fs/ufs/super.c | 10 ++++++++++
fs/ufs/ufs.h | 1 +
4 files changed, 36 insertions(+), 25 deletions(-)
diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index 7bc20809c99e..fe1b53d441e0 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -51,8 +51,8 @@ void ufs_free_fragments(struct inode *inode, u64 fragment, unsigned count)
if (ufs_fragnum(fragment) + count > uspi->s_fpg)
ufs_error (sb, "ufs_free_fragments", "internal error");
-
- lock_ufs(sb);
+
+ mutex_lock(&UFS_SB(sb)->s_lock);
cgno = ufs_dtog(uspi, fragment);
bit = ufs_dtogd(uspi, fragment);
@@ -115,13 +115,13 @@ void ufs_free_fragments(struct inode *inode, u64 fragment, unsigned count)
if (sb->s_flags & MS_SYNCHRONOUS)
ubh_sync_block(UCPI_UBH(ucpi));
ufs_mark_sb_dirty(sb);
-
- unlock_ufs(sb);
+
+ mutex_unlock(&UFS_SB(sb)->s_lock);
UFSD("EXIT\n");
return;
failed:
- unlock_ufs(sb);
+ mutex_unlock(&UFS_SB(sb)->s_lock);
UFSD("EXIT (FAILED)\n");
return;
}
@@ -151,7 +151,7 @@ void ufs_free_blocks(struct inode *inode, u64 fragment, unsigned count)
goto failed;
}
- lock_ufs(sb);
+ mutex_lock(&UFS_SB(sb)->s_lock);
do_more:
overflow = 0;
@@ -211,12 +211,12 @@ do_more:
}
ufs_mark_sb_dirty(sb);
- unlock_ufs(sb);
+ mutex_unlock(&UFS_SB(sb)->s_lock);
UFSD("EXIT\n");
return;
failed_unlock:
- unlock_ufs(sb);
+ mutex_unlock(&UFS_SB(sb)->s_lock);
failed:
UFSD("EXIT (FAILED)\n");
return;
@@ -357,7 +357,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
usb1 = ubh_get_usb_first(uspi);
*err = -ENOSPC;
- lock_ufs(sb);
+ mutex_lock(&UFS_SB(sb)->s_lock);
tmp = ufs_data_ptr_to_cpu(sb, p);
if (count + ufs_fragnum(fragment) > uspi->s_fpb) {
@@ -378,19 +378,19 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
"fragment %llu, tmp %llu\n",
(unsigned long long)fragment,
(unsigned long long)tmp);
- unlock_ufs(sb);
+ mutex_unlock(&UFS_SB(sb)->s_lock);
return INVBLOCK;
}
if (fragment < UFS_I(inode)->i_lastfrag) {
UFSD("EXIT (ALREADY ALLOCATED)\n");
- unlock_ufs(sb);
+ mutex_unlock(&UFS_SB(sb)->s_lock);
return 0;
}
}
else {
if (tmp) {
UFSD("EXIT (ALREADY ALLOCATED)\n");
- unlock_ufs(sb);
+ mutex_unlock(&UFS_SB(sb)->s_lock);
return 0;
}
}
@@ -399,7 +399,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
* There is not enough space for user on the device
*/
if (!capable(CAP_SYS_RESOURCE) && ufs_freespace(uspi, UFS_MINFREE) <= 0) {
- unlock_ufs(sb);
+ mutex_unlock(&UFS_SB(sb)->s_lock);
UFSD("EXIT (FAILED)\n");
return 0;
}
@@ -424,7 +424,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
ufs_clear_frags(inode, result + oldcount,
newcount - oldcount, locked_page != NULL);
}
- unlock_ufs(sb);
+ mutex_unlock(&UFS_SB(sb)->s_lock);
UFSD("EXIT, result %llu\n", (unsigned long long)result);
return result;
}
@@ -439,7 +439,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
fragment + count);
ufs_clear_frags(inode, result + oldcount, newcount - oldcount,
locked_page != NULL);
- unlock_ufs(sb);
+ mutex_unlock(&UFS_SB(sb)->s_lock);
UFSD("EXIT, result %llu\n", (unsigned long long)result);
return result;
}
@@ -477,7 +477,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
*err = 0;
UFS_I(inode)->i_lastfrag = max(UFS_I(inode)->i_lastfrag,
fragment + count);
- unlock_ufs(sb);
+ mutex_unlock(&UFS_SB(sb)->s_lock);
if (newcount < request)
ufs_free_fragments (inode, result + newcount, request - newcount);
ufs_free_fragments (inode, tmp, oldcount);
@@ -485,7 +485,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
return result;
}
- unlock_ufs(sb);
+ mutex_unlock(&UFS_SB(sb)->s_lock);
UFSD("EXIT (FAILED)\n");
return 0;
}
diff --git a/fs/ufs/ialloc.c b/fs/ufs/ialloc.c
index a9cc75ffa925..758ab7c305a4 100644
--- a/fs/ufs/ialloc.c
+++ b/fs/ufs/ialloc.c
@@ -69,11 +69,11 @@ void ufs_free_inode (struct inode * inode)
ino = inode->i_ino;
- lock_ufs(sb);
+ mutex_lock(&UFS_SB(sb)->s_lock);
if (!((ino > 1) && (ino < (uspi->s_ncg * uspi->s_ipg )))) {
ufs_warning(sb, "ufs_free_inode", "reserved inode or nonexistent inode %u\n", ino);
- unlock_ufs(sb);
+ mutex_unlock(&UFS_SB(sb)->s_lock);
return;
}
@@ -81,7 +81,7 @@ void ufs_free_inode (struct inode * inode)
bit = ufs_inotocgoff (ino);
ucpi = ufs_load_cylinder (sb, cg);
if (!ucpi) {
- unlock_ufs(sb);
+ mutex_unlock(&UFS_SB(sb)->s_lock);
return;
}
ucg = ubh_get_ucg(UCPI_UBH(ucpi));
@@ -115,7 +115,7 @@ void ufs_free_inode (struct inode * inode)
ubh_sync_block(UCPI_UBH(ucpi));
ufs_mark_sb_dirty(sb);
- unlock_ufs(sb);
+ mutex_unlock(&UFS_SB(sb)->s_lock);
UFSD("EXIT\n");
}
@@ -193,7 +193,7 @@ struct inode *ufs_new_inode(struct inode *dir, umode_t mode)
sbi = UFS_SB(sb);
uspi = sbi->s_uspi;
- lock_ufs(sb);
+ mutex_lock(&sbi->s_lock);
/*
* Try to place the inode in its parent directory
@@ -328,20 +328,20 @@ cg_found:
sync_dirty_buffer(bh);
brelse(bh);
}
- unlock_ufs(sb);
+ mutex_unlock(&sbi->s_lock);
UFSD("allocating inode %lu\n", inode->i_ino);
UFSD("EXIT\n");
return inode;
fail_remove_inode:
- unlock_ufs(sb);
+ mutex_unlock(&sbi->s_lock);
clear_nlink(inode);
iput(inode);
UFSD("EXIT (FAILED): err %d\n", err);
return ERR_PTR(err);
failed:
- unlock_ufs(sb);
+ mutex_unlock(&sbi->s_lock);
make_bad_inode(inode);
iput (inode);
UFSD("EXIT (FAILED): err %d\n", err);
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index b879f1ba3439..c78e43342107 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -697,6 +697,7 @@ static int ufs_sync_fs(struct super_block *sb, int wait)
unsigned flags;
lock_ufs(sb);
+ mutex_lock(&UFS_SB(sb)->s_lock);
UFSD("ENTER\n");
@@ -714,6 +715,7 @@ static int ufs_sync_fs(struct super_block *sb, int wait)
ufs_put_cstotal(sb);
UFSD("EXIT\n");
+ mutex_unlock(&UFS_SB(sb)->s_lock);
unlock_ufs(sb);
return 0;
@@ -1280,6 +1282,7 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data)
sync_filesystem(sb);
lock_ufs(sb);
+ mutex_lock(&UFS_SB(sb)->s_lock);
uspi = UFS_SB(sb)->s_uspi;
flags = UFS_SB(sb)->s_flags;
usb1 = ubh_get_usb_first(uspi);
@@ -1293,6 +1296,7 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data)
new_mount_opt = 0;
ufs_set_opt (new_mount_opt, ONERROR_LOCK);
if (!ufs_parse_options (data, &new_mount_opt)) {
+ mutex_unlock(&UFS_SB(sb)->s_lock);
unlock_ufs(sb);
return -EINVAL;
}
@@ -1300,12 +1304,14 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data)
new_mount_opt |= ufstype;
} else if ((new_mount_opt & UFS_MOUNT_UFSTYPE) != ufstype) {
printk("ufstype can't be changed during remount\n");
+ mutex_unlock(&UFS_SB(sb)->s_lock);
unlock_ufs(sb);
return -EINVAL;
}
if ((*mount_flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY)) {
UFS_SB(sb)->s_mount_opt = new_mount_opt;
+ mutex_unlock(&UFS_SB(sb)->s_lock);
unlock_ufs(sb);
return 0;
}
@@ -1330,6 +1336,7 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data)
#ifndef CONFIG_UFS_FS_WRITE
printk("ufs was compiled with read-only support, "
"can't be mounted as read-write\n");
+ mutex_unlock(&UFS_SB(sb)->s_lock);
unlock_ufs(sb);
return -EINVAL;
#else
@@ -1339,11 +1346,13 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data)
ufstype != UFS_MOUNT_UFSTYPE_SUNx86 &&
ufstype != UFS_MOUNT_UFSTYPE_UFS2) {
printk("this ufstype is read-only supported\n");
+ mutex_unlock(&UFS_SB(sb)->s_lock);
unlock_ufs(sb);
return -EINVAL;
}
if (!ufs_read_cylinder_structures(sb)) {
printk("failed during remounting\n");
+ mutex_unlock(&UFS_SB(sb)->s_lock);
unlock_ufs(sb);
return -EPERM;
}
@@ -1351,6 +1360,7 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data)
#endif
}
UFS_SB(sb)->s_mount_opt = new_mount_opt;
+ mutex_unlock(&UFS_SB(sb)->s_lock);
unlock_ufs(sb);
return 0;
}
diff --git a/fs/ufs/ufs.h b/fs/ufs/ufs.h
index 343e6fc571e5..ff2c15ab81aa 100644
--- a/fs/ufs/ufs.h
+++ b/fs/ufs/ufs.h
@@ -24,6 +24,7 @@ struct ufs_sb_info {
int work_queued; /* non-zero if the delayed work is queued */
struct delayed_work sync_work; /* FS sync delayed work */
spinlock_t work_lock; /* protects sync_work and work_queued */
+ struct mutex s_lock;
};
struct ufs_inode_info {
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 081/185] regmap: Fix possible shift overflow in regmap_field_init()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (79 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 080/185] fs/ufs: restore s_lock mutex Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 082/185] ima: fix ima_show_template_data_ascii() Luis Henriques
` (103 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Maxime Coquelin, Mark Brown, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Coquelin <maxime.coquelin@st.com>
commit 921cc29473a0d7c109105c1876ddb432f4a4be7d upstream.
The way the mask is generated in regmap_field_init() is wrong.
Indeed, a field initialized with msb = 31 and lsb = 0 provokes a shift
overflow while calculating the mask field.
On some 32 bits architectures, such as x86, the generated mask is 0,
instead of the expected 0xffffffff.
This patch uses GENMASK() to fix the problem, as this macro is already safe
regarding shift overflow.
Signed-off-by: Maxime Coquelin <maxime.coquelin@st.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/base/regmap/regmap.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 09fe07b6e98b..27487c289ee0 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -887,11 +887,10 @@ EXPORT_SYMBOL_GPL(devm_regmap_init);
static void regmap_field_init(struct regmap_field *rm_field,
struct regmap *regmap, struct reg_field reg_field)
{
- int field_bits = reg_field.msb - reg_field.lsb + 1;
rm_field->regmap = regmap;
rm_field->reg = reg_field.reg;
rm_field->shift = reg_field.lsb;
- rm_field->mask = ((BIT(field_bits) - 1) << reg_field.lsb);
+ rm_field->mask = GENMASK(reg_field.msb, reg_field.lsb);
rm_field->id_size = reg_field.id_size;
rm_field->id_offset = reg_field.id_offset;
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 082/185] ima: fix ima_show_template_data_ascii()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (80 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 081/185] regmap: Fix possible shift overflow in regmap_field_init() Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 083/185] nfs: increase size of EXCHANGE_ID name string buffer Luis Henriques
` (102 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Mimi Zohar, Roberto Sassu, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
commit 45b26133b97871896b8c5241d59f4ff7839db7b2 upstream.
This patch fixes a bug introduced in "4d7aeee ima: define new template
ima-ng and template fields d-ng and n-ng".
Changelog:
- change int to uint32 (Roberto Sassu's suggestion)
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Roberto Sassu <rsassu@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
security/integrity/ima/ima.h | 2 +-
security/integrity/ima/ima_fs.c | 4 ++--
security/integrity/ima/ima_template_lib.c | 3 ++-
3 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index f79fa8be203c..5cb7de9046fa 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -106,7 +106,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
const char *op, const char *cause);
int ima_init_crypto(void);
void ima_putc(struct seq_file *m, void *data, int datalen);
-void ima_print_digest(struct seq_file *m, u8 *digest, int size);
+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
struct ima_template_desc *ima_template_desc_current(void);
int ima_init_template(void);
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index da92fcc08d15..d30afe461070 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -186,9 +186,9 @@ static const struct file_operations ima_measurements_ops = {
.release = seq_release,
};
-void ima_print_digest(struct seq_file *m, u8 *digest, int size)
+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size)
{
- int i;
+ u32 i;
for (i = 0; i < size; i++)
seq_printf(m, "%02x", *(digest + i));
diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c
index 1506f0248572..1eb173ddefd6 100644
--- a/security/integrity/ima/ima_template_lib.c
+++ b/security/integrity/ima/ima_template_lib.c
@@ -70,7 +70,8 @@ static void ima_show_template_data_ascii(struct seq_file *m,
enum data_formats datafmt,
struct ima_field_data *field_data)
{
- u8 *buf_ptr = field_data->data, buflen = field_data->len;
+ u8 *buf_ptr = field_data->data;
+ u32 buflen = field_data->len;
switch (datafmt) {
case DATA_FMT_DIGEST_WITH_ALGO:
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 083/185] nfs: increase size of EXCHANGE_ID name string buffer
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (81 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 082/185] ima: fix ima_show_template_data_ascii() Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 084/185] vTPM: set virtual device before passing to ibmvtpm_reset_crq Luis Henriques
` (101 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jeff Layton, Trond Myklebust, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@poochiereds.net>
commit 764ad8ba8cd4c6f836fca9378f8c5121aece0842 upstream.
The current buffer is much too small if you have a relatively long
hostname. Bring it up to the size of the one that SETCLIENTID has.
Reported-by: Michael Skralivetsky <michael.skralivetsky@primarydata.com>
Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
include/linux/nfs_xdr.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 6f2ca8976069..162a86b2c072 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -1139,7 +1139,7 @@ struct nfs41_state_protection {
struct nfs4_op_map allow;
};
-#define NFS4_EXCHANGE_ID_LEN (48)
+#define NFS4_EXCHANGE_ID_LEN (127)
struct nfs41_exchange_id_args {
struct nfs_client *client;
nfs4_verifier *verifier;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 084/185] vTPM: set virtual device before passing to ibmvtpm_reset_crq
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (82 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 083/185] nfs: increase size of EXCHANGE_ID name string buffer Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 085/185] arm: KVM: force execution of HCPTR access on VM exit Luis Henriques
` (100 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Hon Ching(Vicky) Lo, Joy Latten, Peter Huewe, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Hon Ching \\\\(Vicky\\\\) Lo" <honclo@linux.vnet.ibm.com>
commit 9d75f08946e8485109458ccf16f714697c207f41 upstream.
tpm_ibmvtpm_probe() calls ibmvtpm_reset_crq(ibmvtpm) without having yet
set the virtual device in the ibmvtpm structure. So in ibmvtpm_reset_crq,
the phype call contains empty unit addresses, ibmvtpm->vdev->unit_address.
Signed-off-by: Hon Ching(Vicky) Lo <honclo@linux.vnet.ibm.com>
Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
Reviewed-by: Ashley Lai <ashley@ahsleylai.com>
Fixes: 132f76294744 ("drivers/char/tpm: Add new device driver to support IBM vTPM")
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/char/tpm/tpm_ibmvtpm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
index 102463ba745d..643bba7d6f81 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c
@@ -579,6 +579,9 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
goto cleanup;
}
+ ibmvtpm->dev = dev;
+ ibmvtpm->vdev = vio_dev;
+
crq_q = &ibmvtpm->crq_queue;
crq_q->crq_addr = (struct ibmvtpm_crq *)get_zeroed_page(GFP_KERNEL);
if (!crq_q->crq_addr) {
@@ -623,8 +626,6 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
crq_q->index = 0;
- ibmvtpm->dev = dev;
- ibmvtpm->vdev = vio_dev;
TPM_VPRIV(chip) = (void *)ibmvtpm;
spin_lock_init(&ibmvtpm->rtce_lock);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 085/185] arm: KVM: force execution of HCPTR access on VM exit
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (83 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 084/185] vTPM: set virtual device before passing to ibmvtpm_reset_crq Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 086/185] arm64: mm: Fix freeing of the wrong memmap entries with !SPARSEMEM_VMEMMAP Luis Henriques
` (99 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Marc Zyngier, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <marc.zyngier@arm.com>
commit 85e84ba31039595995dae80b277378213602891b upstream.
On VM entry, we disable access to the VFP registers in order to
perform a lazy save/restore of these registers.
On VM exit, we restore access, test if we did enable them before,
and save/restore the guest/host registers if necessary. In this
sequence, the FPEXC register is always accessed, irrespective
of the trapping configuration.
If the guest didn't touch the VFP registers, then the HCPTR access
has now enabled such access, but we're missing a barrier to ensure
architectural execution of the new HCPTR configuration. If the HCPTR
access has been delayed/reordered, the subsequent access to FPEXC
will cause a trap, which we aren't prepared to handle at all.
The same condition exists when trapping to enable VFP for the guest.
The fix is to introduce a barrier after enabling VFP access. In the
vmexit case, it can be relaxed to only takes place if the guest hasn't
accessed its view of the VFP registers, making the access to FPEXC safe.
The set_hcptr macro is modified to deal with both vmenter/vmexit and
vmtrap operations, and now takes an optional label that is branched to
when the guest hasn't touched the VFP registers.
Reported-by: Vikram Sethi <vikrams@codeaurora.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arm/kvm/interrupts.S | 10 ++++------
arch/arm/kvm/interrupts_head.S | 20 ++++++++++++++++++--
2 files changed, 22 insertions(+), 8 deletions(-)
diff --git a/arch/arm/kvm/interrupts.S b/arch/arm/kvm/interrupts.S
index 0d68d4073068..a1467e7689f5 100644
--- a/arch/arm/kvm/interrupts.S
+++ b/arch/arm/kvm/interrupts.S
@@ -159,13 +159,9 @@ __kvm_vcpu_return:
@ Don't trap coprocessor accesses for host kernel
set_hstr vmexit
set_hdcr vmexit
- set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11))
+ set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11)), after_vfp_restore
#ifdef CONFIG_VFPv3
- @ Save floating point registers we if let guest use them.
- tst r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))
- bne after_vfp_restore
-
@ Switch VFP/NEON hardware state to the host's
add r7, vcpu, #VCPU_VFP_GUEST
store_vfp_state r7
@@ -177,6 +173,8 @@ after_vfp_restore:
@ Restore FPEXC_EN which we clobbered on entry
pop {r2}
VFPFMXR FPEXC, r2
+#else
+after_vfp_restore:
#endif
@ Reset Hyp-role
@@ -467,7 +465,7 @@ switch_to_guest_vfp:
push {r3-r7}
@ NEON/VFP used. Turn on VFP access.
- set_hcptr vmexit, (HCPTR_TCP(10) | HCPTR_TCP(11))
+ set_hcptr vmtrap, (HCPTR_TCP(10) | HCPTR_TCP(11))
@ Switch VFP/NEON hardware state to the guest's
add r7, r0, #VCPU_VFP_HOST
diff --git a/arch/arm/kvm/interrupts_head.S b/arch/arm/kvm/interrupts_head.S
index 76af93025574..2973b2d342fa 100644
--- a/arch/arm/kvm/interrupts_head.S
+++ b/arch/arm/kvm/interrupts_head.S
@@ -578,8 +578,13 @@ vcpu .req r0 @ vcpu pointer always in r0
.endm
/* Configures the HCPTR (Hyp Coprocessor Trap Register) on entry/return
- * (hardware reset value is 0). Keep previous value in r2. */
-.macro set_hcptr operation, mask
+ * (hardware reset value is 0). Keep previous value in r2.
+ * An ISB is emited on vmexit/vmtrap, but executed on vmexit only if
+ * VFP wasn't already enabled (always executed on vmtrap).
+ * If a label is specified with vmexit, it is branched to if VFP wasn't
+ * enabled.
+ */
+.macro set_hcptr operation, mask, label = none
mrc p15, 4, r2, c1, c1, 2
ldr r3, =\mask
.if \operation == vmentry
@@ -588,6 +593,17 @@ vcpu .req r0 @ vcpu pointer always in r0
bic r3, r2, r3 @ Don't trap defined coproc-accesses
.endif
mcr p15, 4, r3, c1, c1, 2
+ .if \operation != vmentry
+ .if \operation == vmexit
+ tst r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))
+ beq 1f
+ .endif
+ isb
+ .if \label != none
+ b \label
+ .endif
+1:
+ .endif
.endm
/* Configures the HDCR (Hyp Debug Configuration Register) on entry/return
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 086/185] arm64: mm: Fix freeing of the wrong memmap entries with !SPARSEMEM_VMEMMAP
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (84 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 085/185] arm: KVM: force execution of HCPTR access on VM exit Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 087/185] dm space map metadata: fix occasional leak of a metadata block on resize Luis Henriques
` (98 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dave Martin, Catalin Marinas, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave P Martin <Dave.Martin@arm.com>
commit b9bcc919931611498e856eae9bf66337330d04cc upstream.
The memmap freeing code in free_unused_memmap() computes the end of
each memblock by adding the memblock size onto the base. However,
if SPARSEMEM is enabled then the value (start) used for the base
may already have been rounded downwards to work out which memmap
entries to free after the previous memblock.
This may cause memmap entries that are in use to get freed.
In general, you're not likely to hit this problem unless there
are at least 2 memblocks and one of them is not aligned to a
sparsemem section boundary. Note that carve-outs can increase
the number of memblocks by splitting the regions listed in the
device tree.
This problem doesn't occur with SPARSEMEM_VMEMMAP, because the
vmemmap code deals with freeing the unused regions of the memmap
instead of requiring the arch code to do it.
This patch gets the memblock base out of the memblock directly when
computing the block end address to ensure the correct value is used.
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arm64/mm/init.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index e90c5426fe14..01bfca35b0aa 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -239,7 +239,7 @@ static void __init free_unused_memmap(void)
* memmap entries are valid from the bank end aligned to
* MAX_ORDER_NR_PAGES.
*/
- prev_end = ALIGN(start + __phys_to_pfn(reg->size),
+ prev_end = ALIGN(__phys_to_pfn(reg->base + reg->size),
MAX_ORDER_NR_PAGES);
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 087/185] dm space map metadata: fix occasional leak of a metadata block on resize
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (85 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 086/185] arm64: mm: Fix freeing of the wrong memmap entries with !SPARSEMEM_VMEMMAP Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 088/185] dm stats: fix divide by zero if 'number_of_areas' arg is zero Luis Henriques
` (97 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Joe Thornber, Mike Snitzer, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <ejt@redhat.com>
commit 6096d91af0b65a3967139b32d5adbb3647858a26 upstream.
The metadata space map has a simplified 'bootstrap' mode that is
operational when extending the space maps. Whilst in this mode it's
possible for some refcount decrement operations to become queued (eg, as
a result of shadowing one of the bitmap indexes). These decrements were
not being applied when switching out of bootstrap mode.
The effect of this bug was the leaking of a 4k metadata block. This is
detected by the latest version of thin_check as a non fatal error.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/md/persistent-data/dm-space-map-metadata.c | 50 +++++++++++++++-------
1 file changed, 35 insertions(+), 15 deletions(-)
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index f4e22bcc7fb8..199c9ccd1f5d 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm)
smm->recursion_count++;
}
+static int apply_bops(struct sm_metadata *smm)
+{
+ int r = 0;
+
+ while (!brb_empty(&smm->uncommitted)) {
+ struct block_op bop;
+
+ r = brb_pop(&smm->uncommitted, &bop);
+ if (r) {
+ DMERR("bug in bop ring buffer");
+ break;
+ }
+
+ r = commit_bop(smm, &bop);
+ if (r)
+ break;
+ }
+
+ return r;
+}
+
static int out(struct sm_metadata *smm)
{
int r = 0;
@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm)
return -ENOMEM;
}
- if (smm->recursion_count == 1) {
- while (!brb_empty(&smm->uncommitted)) {
- struct block_op bop;
-
- r = brb_pop(&smm->uncommitted, &bop);
- if (r) {
- DMERR("bug in bop ring buffer");
- break;
- }
-
- r = commit_bop(smm, &bop);
- if (r)
- break;
- }
- }
+ if (smm->recursion_count == 1)
+ apply_bops(smm);
smm->recursion_count--;
@@ -702,6 +710,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
}
old_len = smm->begin;
+ r = apply_bops(smm);
+ if (r) {
+ DMERR("%s: apply_bops failed", __func__);
+ goto out;
+ }
+
r = sm_ll_commit(&smm->ll);
if (r)
goto out;
@@ -771,6 +785,12 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
if (r)
return r;
+ r = apply_bops(smm);
+ if (r) {
+ DMERR("%s: apply_bops failed", __func__);
+ return r;
+ }
+
return sm_metadata_commit(sm);
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 088/185] dm stats: fix divide by zero if 'number_of_areas' arg is zero
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (86 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 087/185] dm space map metadata: fix occasional leak of a metadata block on resize Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 089/185] x86/PCI: Use host bridge _CRS info on systems with >32 bit addressing Luis Henriques
` (96 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Mikulas Patocka, Mike Snitzer, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit dd4c1b7d0c95be1c9245118a3accc41a16f1db67 upstream.
If the number_of_areas argument was zero the kernel would crash on
div-by-zero. Add better input validation.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/md/dm-stats.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
index 28a90122a5a8..b3b0697a9fd7 100644
--- a/drivers/md/dm-stats.c
+++ b/drivers/md/dm-stats.c
@@ -795,6 +795,8 @@ static int message_stats_create(struct mapped_device *md,
return -EINVAL;
if (sscanf(argv[2], "/%u%c", &divisor, &dummy) == 1) {
+ if (!divisor)
+ return -EINVAL;
step = end - start;
if (do_div(step, divisor))
step++;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 089/185] x86/PCI: Use host bridge _CRS info on systems with >32 bit addressing
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (87 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 088/185] dm stats: fix divide by zero if 'number_of_areas' arg is zero Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 090/185] pNFS: Fix a memory leak when attempted pnfs fails Luis Henriques
` (95 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Bjorn Helgaas, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <bhelgaas@google.com>
commit 3d9fecf6bfb8b12bc2f9a4c7109895a2a2bb9436 upstream.
We enable _CRS on all systems from 2008 and later. On older systems, we
ignore _CRS and assume the whole physical address space (excluding RAM and
other devices) is available for PCI devices, but on systems that support
physical address spaces larger than 4GB, it's doubtful that the area above
4GB is really available for PCI.
After d56dbf5bab8c ("PCI: Allocate 64-bit BARs above 4G when possible"), we
try to use that space above 4GB *first*, so we're more likely to put a
device there.
On Juan's Toshiba Satellite Pro U200, BIOS left the graphics, sound, 1394,
and card reader devices unassigned (but only after Windows had been
booted). Only the sound device had a 64-bit BAR, so it was the only device
placed above 4GB, and hence the only device that didn't work.
Keep _CRS enabled even on pre-2008 systems if they support physical address
space larger than 4GB.
Fixes: d56dbf5bab8c ("PCI: Allocate 64-bit BARs above 4G when possible")
Reported-and-tested-by: Juan Dayer <jdayer@outlook.com>
Reported-and-tested-by: Alan Horsfield <alan@hazelgarth.co.uk>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=99221
Link: https://bugzilla.opensuse.org/show_bug.cgi?id=907092
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/x86/pci/acpi.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index 46e6538a1a6a..0f8002ca2a5c 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -135,8 +135,10 @@ void __init pci_acpi_crs_quirks(void)
{
int year;
- if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008)
- pci_use_crs = false;
+ if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008) {
+ if (iomem_resource.end <= 0xffffffff)
+ pci_use_crs = false;
+ }
dmi_check_system(pci_crs_quirks);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 090/185] pNFS: Fix a memory leak when attempted pnfs fails
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (88 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 089/185] x86/PCI: Use host bridge _CRS info on systems with >32 bit addressing Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 091/185] ACPI / PNP: Avoid conflicting resource reservations Luis Henriques
` (94 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Trond Myklebust, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@primarydata.com>
commit 1ca018d28d96d07788474abf66a5f3e9594841f5 upstream.
pnfs_do_write() expects the call to pnfs_write_through_mds() to free the
pgio header and to release the layout segment before exiting. The problem
is that nfs_pgio_data_destroy() doesn't actually do this; it only frees
the memory allocated by nfs_generic_pgio().
Ditto for pnfs_do_read()...
Fix in both cases is to add a call to hdr->release(hdr).
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/nfs/pnfs.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index dea11c2c8c1e..77498f9ba554 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1558,6 +1558,7 @@ pnfs_write_through_mds(struct nfs_pageio_descriptor *desc,
desc->pg_recoalesce = 1;
}
nfs_pgio_data_destroy(hdr);
+ hdr->release(hdr);
}
static enum pnfs_try_status
@@ -1695,6 +1696,7 @@ pnfs_read_through_mds(struct nfs_pageio_descriptor *desc,
desc->pg_recoalesce = 1;
}
nfs_pgio_data_destroy(hdr);
+ hdr->release(hdr);
}
/*
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 091/185] ACPI / PNP: Avoid conflicting resource reservations
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (89 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 090/185] pNFS: Fix a memory leak when attempted pnfs fails Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 092/185] Bluetooth: ath3k: add support of 04ca:300f AR3012 device Luis Henriques
` (93 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Rafael J. Wysocki, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
commit 0f1b414d190724617eb1cdd615592fa8cd9d0b50 upstream.
Commit b9a5e5e18fbf "ACPI / init: Fix the ordering of
acpi_reserve_resources()" overlooked the fact that the memory
and/or I/O regions reserved by acpi_reserve_resources() may
conflict with those reserved by the PNP "system" driver.
If that conflict actually takes place, it causes the reservations
made by the "system" driver to fail while before commit b9a5e5e18fbf
all reservations made by it and by acpi_reserve_resources() would be
successful. In turn, that allows the resources that haven't been
reserved by the "system" driver to be used by others (e.g. PCI) which
sometimes leads to functional problems (up to and including boot
failures).
To fix that issue, introduce a common resource reservation routine,
acpi_reserve_region(), to be used by both acpi_reserve_resources()
and the "system" driver, that will track all resources reserved by
it and avoid making conflicting requests.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=99831
Link: http://marc.info/?t=143389402600001&r=1&w=2
Fixes: b9a5e5e18fbf "ACPI / init: Fix the ordering of acpi_reserve_resources()"
Reported-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/acpi/osl.c | 6 +-
drivers/acpi/resource.c | 160 ++++++++++++++++++++++++++++++++++++++++++++++++
drivers/pnp/system.c | 35 ++++++++---
include/linux/acpi.h | 10 +++
4 files changed, 197 insertions(+), 14 deletions(-)
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 1b2d872c7398..bbde6af69584 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -165,11 +165,7 @@ static void __init acpi_request_region (struct acpi_generic_address *gas,
if (!addr || !length)
return;
- /* Resources are never freed */
- if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO)
- request_region(addr, length, desc);
- else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
- request_mem_region(addr, length, desc);
+ acpi_reserve_region(addr, length, gas->space_id, 0, desc);
}
static void __init acpi_reserve_resources(void)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 2ba8f02ced36..28314ba82320 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -26,6 +26,7 @@
#include <linux/device.h>
#include <linux/export.h>
#include <linux/ioport.h>
+#include <linux/list.h>
#include <linux/slab.h>
#ifdef CONFIG_X86
@@ -538,3 +539,162 @@ int acpi_dev_get_resources(struct acpi_device *adev, struct list_head *list,
return c.count;
}
EXPORT_SYMBOL_GPL(acpi_dev_get_resources);
+
+struct reserved_region {
+ struct list_head node;
+ u64 start;
+ u64 end;
+};
+
+static LIST_HEAD(reserved_io_regions);
+static LIST_HEAD(reserved_mem_regions);
+
+static int request_range(u64 start, u64 end, u8 space_id, unsigned long flags,
+ char *desc)
+{
+ unsigned int length = end - start + 1;
+ struct resource *res;
+
+ res = space_id == ACPI_ADR_SPACE_SYSTEM_IO ?
+ request_region(start, length, desc) :
+ request_mem_region(start, length, desc);
+ if (!res)
+ return -EIO;
+
+ res->flags &= ~flags;
+ return 0;
+}
+
+static int add_region_before(u64 start, u64 end, u8 space_id,
+ unsigned long flags, char *desc,
+ struct list_head *head)
+{
+ struct reserved_region *reg;
+ int error;
+
+ reg = kmalloc(sizeof(*reg), GFP_KERNEL);
+ if (!reg)
+ return -ENOMEM;
+
+ error = request_range(start, end, space_id, flags, desc);
+ if (error)
+ return error;
+
+ reg->start = start;
+ reg->end = end;
+ list_add_tail(®->node, head);
+ return 0;
+}
+
+/**
+ * acpi_reserve_region - Reserve an I/O or memory region as a system resource.
+ * @start: Starting address of the region.
+ * @length: Length of the region.
+ * @space_id: Identifier of address space to reserve the region from.
+ * @flags: Resource flags to clear for the region after requesting it.
+ * @desc: Region description (for messages).
+ *
+ * Reserve an I/O or memory region as a system resource to prevent others from
+ * using it. If the new region overlaps with one of the regions (in the given
+ * address space) already reserved by this routine, only the non-overlapping
+ * parts of it will be reserved.
+ *
+ * Returned is either 0 (success) or a negative error code indicating a resource
+ * reservation problem. It is the code of the first encountered error, but the
+ * routine doesn't abort until it has attempted to request all of the parts of
+ * the new region that don't overlap with other regions reserved previously.
+ *
+ * The resources requested by this routine are never released.
+ */
+int acpi_reserve_region(u64 start, unsigned int length, u8 space_id,
+ unsigned long flags, char *desc)
+{
+ struct list_head *regions;
+ struct reserved_region *reg;
+ u64 end = start + length - 1;
+ int ret = 0, error = 0;
+
+ if (space_id == ACPI_ADR_SPACE_SYSTEM_IO)
+ regions = &reserved_io_regions;
+ else if (space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
+ regions = &reserved_mem_regions;
+ else
+ return -EINVAL;
+
+ if (list_empty(regions))
+ return add_region_before(start, end, space_id, flags, desc, regions);
+
+ list_for_each_entry(reg, regions, node)
+ if (reg->start == end + 1) {
+ /* The new region can be prepended to this one. */
+ ret = request_range(start, end, space_id, flags, desc);
+ if (!ret)
+ reg->start = start;
+
+ return ret;
+ } else if (reg->start > end) {
+ /* No overlap. Add the new region here and get out. */
+ return add_region_before(start, end, space_id, flags,
+ desc, ®->node);
+ } else if (reg->end == start - 1) {
+ goto combine;
+ } else if (reg->end >= start) {
+ goto overlap;
+ }
+
+ /* The new region goes after the last existing one. */
+ return add_region_before(start, end, space_id, flags, desc, regions);
+
+ overlap:
+ /*
+ * The new region overlaps an existing one.
+ *
+ * The head part of the new region immediately preceding the existing
+ * overlapping one can be combined with it right away.
+ */
+ if (reg->start > start) {
+ error = request_range(start, reg->start - 1, space_id, flags, desc);
+ if (error)
+ ret = error;
+ else
+ reg->start = start;
+ }
+
+ combine:
+ /*
+ * The new region is adjacent to an existing one. If it extends beyond
+ * that region all the way to the next one, it is possible to combine
+ * all three of them.
+ */
+ while (reg->end < end) {
+ struct reserved_region *next = NULL;
+ u64 a = reg->end + 1, b = end;
+
+ if (!list_is_last(®->node, regions)) {
+ next = list_next_entry(reg, node);
+ if (next->start <= end)
+ b = next->start - 1;
+ }
+ error = request_range(a, b, space_id, flags, desc);
+ if (!error) {
+ if (next && next->start == b + 1) {
+ reg->end = next->end;
+ list_del(&next->node);
+ kfree(next);
+ } else {
+ reg->end = end;
+ break;
+ }
+ } else if (next) {
+ if (!ret)
+ ret = error;
+
+ reg = next;
+ } else {
+ break;
+ }
+ }
+
+ return ret ? ret : error;
+}
+EXPORT_SYMBOL_GPL(acpi_reserve_region);
diff --git a/drivers/pnp/system.c b/drivers/pnp/system.c
index 49c1720df59a..515f33882ab8 100644
--- a/drivers/pnp/system.c
+++ b/drivers/pnp/system.c
@@ -7,6 +7,7 @@
* Bjorn Helgaas <bjorn.helgaas@hp.com>
*/
+#include <linux/acpi.h>
#include <linux/pnp.h>
#include <linux/device.h>
#include <linux/init.h>
@@ -22,25 +23,41 @@ static const struct pnp_device_id pnp_dev_table[] = {
{"", 0}
};
+#ifdef CONFIG_ACPI
+static bool __reserve_range(u64 start, unsigned int length, bool io, char *desc)
+{
+ u8 space_id = io ? ACPI_ADR_SPACE_SYSTEM_IO : ACPI_ADR_SPACE_SYSTEM_MEMORY;
+ return !acpi_reserve_region(start, length, space_id, IORESOURCE_BUSY, desc);
+}
+#else
+static bool __reserve_range(u64 start, unsigned int length, bool io, char *desc)
+{
+ struct resource *res;
+
+ res = io ? request_region(start, length, desc) :
+ request_mem_region(start, length, desc);
+ if (res) {
+ res->flags &= ~IORESOURCE_BUSY;
+ return true;
+ }
+ return false;
+}
+#endif
+
static void reserve_range(struct pnp_dev *dev, struct resource *r, int port)
{
char *regionid;
const char *pnpid = dev_name(&dev->dev);
resource_size_t start = r->start, end = r->end;
- struct resource *res;
+ bool reserved;
regionid = kmalloc(16, GFP_KERNEL);
if (!regionid)
return;
snprintf(regionid, 16, "pnp %s", pnpid);
- if (port)
- res = request_region(start, end - start + 1, regionid);
- else
- res = request_mem_region(start, end - start + 1, regionid);
- if (res)
- res->flags &= ~IORESOURCE_BUSY;
- else
+ reserved = __reserve_range(start, end - start + 1, !!port, regionid);
+ if (!reserved)
kfree(regionid);
/*
@@ -49,7 +66,7 @@ static void reserve_range(struct pnp_dev *dev, struct resource *r, int port)
* have double reservations.
*/
dev_info(&dev->dev, "%pR %s reserved\n", r,
- res ? "has been" : "could not be");
+ reserved ? "has been" : "could not be");
}
static void reserve_resources_of_dev(struct pnp_dev *dev)
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 358c01b971db..fa91beba3cd0 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -306,6 +306,9 @@ int acpi_check_region(resource_size_t start, resource_size_t n,
int acpi_resources_are_enforced(void);
+int acpi_reserve_region(u64 start, unsigned int length, u8 space_id,
+ unsigned long flags, char *desc);
+
#ifdef CONFIG_HIBERNATION
void __init acpi_no_s4_hw_signature(void);
#endif
@@ -468,6 +471,13 @@ static inline int acpi_check_region(resource_size_t start, resource_size_t n,
return 0;
}
+static inline int acpi_reserve_region(u64 start, unsigned int length,
+ u8 space_id, unsigned long flags,
+ char *desc)
+{
+ return -ENXIO;
+}
+
struct acpi_table_header;
static inline int acpi_table_parse(char *id,
int (*handler)(struct acpi_table_header *))
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 092/185] Bluetooth: ath3k: add support of 04ca:300f AR3012 device
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (90 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 091/185] ACPI / PNP: Avoid conflicting resource reservations Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 093/185] Bluetooth: ath3k: Add support of 04ca:300d " Luis Henriques
` (92 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dmitry Tunin, Marcel Holtmann, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <hanipouspilot@gmail.com>
commit ec0810d2ac1c932dad48f45da67e3adc5c5449a1 upstream.
BugLink: https://bugs.launchpad.net/bugs/1449730
T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#= 3 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=04ca ProdID=300f Rev=00.01
C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/bluetooth/ath3k.c | 2 ++
drivers/bluetooth/btusb.c | 1 +
2 files changed, 3 insertions(+)
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index ecac55f124e8..84e83b737e50 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -89,6 +89,7 @@ static const struct usb_device_id ath3k_table[] = {
{ USB_DEVICE(0x04CA, 0x3007) },
{ USB_DEVICE(0x04CA, 0x3008) },
{ USB_DEVICE(0x04CA, 0x300b) },
+ { USB_DEVICE(0x04CA, 0x300f) },
{ USB_DEVICE(0x04CA, 0x3010) },
{ USB_DEVICE(0x0930, 0x0219) },
{ USB_DEVICE(0x0930, 0x0220) },
@@ -146,6 +147,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 41c4a74d589f..57783a4e3ea9 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -179,6 +179,7 @@ static const struct usb_device_id blacklist_table[] = {
{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 093/185] Bluetooth: ath3k: Add support of 04ca:300d AR3012 device
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (91 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 092/185] Bluetooth: ath3k: add support of 04ca:300f AR3012 device Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 094/185] libata: Do not blacklist Micron M500DC Luis Henriques
` (91 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dmitry Tunin, Marcel Holtmann, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <hanipouspilot@gmail.com>
commit 7e730c7f3d1f39c25cf5f7cf70c0ff4c28d7bec7 upstream.
BugLink: https://bugs.launchpad.net/bugs/1394368
This device requires new firmware files
AthrBT_0x11020100.dfu and ramps_0x11020100_40.dfu added to
/lib/firmware/ar3k/ that are not included in linux-firmware yet.
T: Bus=02 Lev=01 Prnt=01 Port=04 Cnt=03 Dev#= 5 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=04ca ProdID=300d Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/bluetooth/ath3k.c | 2 ++
drivers/bluetooth/btusb.c | 1 +
2 files changed, 3 insertions(+)
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 84e83b737e50..5b19c4384ec5 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -89,6 +89,7 @@ static const struct usb_device_id ath3k_table[] = {
{ USB_DEVICE(0x04CA, 0x3007) },
{ USB_DEVICE(0x04CA, 0x3008) },
{ USB_DEVICE(0x04CA, 0x300b) },
+ { USB_DEVICE(0x04CA, 0x300d) },
{ USB_DEVICE(0x04CA, 0x300f) },
{ USB_DEVICE(0x04CA, 0x3010) },
{ USB_DEVICE(0x0930, 0x0219) },
@@ -147,6 +148,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 57783a4e3ea9..41abfa124c34 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -179,6 +179,7 @@ static const struct usb_device_id blacklist_table[] = {
{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 094/185] libata: Do not blacklist Micron M500DC
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (92 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 093/185] Bluetooth: ath3k: Add support of 04ca:300d " Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 095/185] arm64: vdso: work-around broken ELF toolchains in Makefile Luis Henriques
` (90 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Martin K. Petersen, Tejun Heo, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Martin K. Petersen" <martin.petersen@oracle.com>
commit 243918be6393f643e513a26e7882e6ae06ff7717 upstream.
Queued TRIM got disabled on Micron M500DC drives thanks to the
"Micron_M500*" pattern we had in place to accommodate the previous
generation of this drive family. Tweak the blacklist entry slightly so
we only disable queued TRIM for the non-DC variants of M500 drives.
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/ata/libata-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 29358ff3e05e..a554b2e17cd4 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4224,7 +4224,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
{ "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER },
/* devices that don't properly handle queued TRIM commands */
- { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
+ { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
{ "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
{ "Micron_M5[15]0*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM, },
{ "Crucial_CT*M550*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM, },
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 095/185] arm64: vdso: work-around broken ELF toolchains in Makefile
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (93 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 094/185] libata: Do not blacklist Micron M500DC Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 096/185] iommu/amd: Handle large pages correctly in free_pagetable Luis Henriques
` (89 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Will Deacon, Catalin Marinas, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit 6f1a6ae87c0c60d7c462ef8fd071f291aa7a9abb upstream.
When building the kernel with a bare-metal (ELF) toolchain, the -shared
option may not be passed down to collect2, resulting in silent corruption
of the vDSO image (in particular, the DYNAMIC section is omitted).
The effect of this corruption is that the dynamic linker fails to find
the vDSO symbols and libc is instead used for the syscalls that we
intended to optimise (e.g. gettimeofday). Functionally, there is no
issue as the sigreturn trampoline is still intact and located by the
kernel.
This patch fixes the problem by explicitly passing -shared to the linker
when building the vDSO.
Reported-by: Szabolcs Nagy <Szabolcs.Nagy@arm.com>
Reported-by: James Greenlaigh <james.greenhalgh@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arm64/kernel/vdso/Makefile | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile
index a268a9af0c2d..a622dd0be9c4 100644
--- a/arch/arm64/kernel/vdso/Makefile
+++ b/arch/arm64/kernel/vdso/Makefile
@@ -15,6 +15,10 @@ ccflags-y := -shared -fno-common -fno-builtin
ccflags-y += -nostdlib -Wl,-soname=linux-vdso.so.1 \
$(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
+# Workaround for bare-metal (ELF) toolchains that neglect to pass -shared
+# down to collect2, resulting in silent corruption of the vDSO image.
+ccflags-y += -Wl,-shared
+
obj-y += vdso.o
extra-y += vdso.lds vdso-offsets.h
CPPFLAGS_vdso.lds += -P -C -U$(ARCH)
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 096/185] iommu/amd: Handle large pages correctly in free_pagetable
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (94 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 095/185] arm64: vdso: work-around broken ELF toolchains in Makefile Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 097/185] ext4: call sync_blockdev() before invalidate_bdev() in put_super() Luis Henriques
` (88 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Joerg Roedel, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <jroedel@suse.de>
commit 0b3fff54bc01e8e6064d222a33e6fa7adabd94cd upstream.
Make sure that we are skipping over large PTEs while walking
the page-table tree.
Fixes: 5c34c403b723 ("iommu/amd: Fix memory leak in free_pagetable")
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/iommu/amd_iommu.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 710ffa1830ae..706cbc5bd5cc 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -1922,9 +1922,15 @@ static void free_pt_##LVL (unsigned long __pt) \
pt = (u64 *)__pt; \
\
for (i = 0; i < 512; ++i) { \
+ /* PTE present? */ \
if (!IOMMU_PTE_PRESENT(pt[i])) \
continue; \
\
+ /* Large PTE? */ \
+ if (PM_PTE_LEVEL(pt[i]) == 0 || \
+ PM_PTE_LEVEL(pt[i]) == 7) \
+ continue; \
+ \
p = (unsigned long)IOMMU_PTE_PAGE(pt[i]); \
FN(p); \
} \
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 097/185] ext4: call sync_blockdev() before invalidate_bdev() in put_super()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (95 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 096/185] iommu/amd: Handle large pages correctly in free_pagetable Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 098/185] MIPS: Fix KVM guest fixmap address Luis Henriques
` (87 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Theodore Ts'o, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit 89d96a6f8e6491f24fc8f99fd6ae66820e85c6c1 upstream.
Normally all of the buffers will have been forced out to disk before
we call invalidate_bdev(), but there will be some cases, where a file
system operation was aborted due to an ext4_error(), where there may
still be some dirty buffers in the buffer cache for the device. So
try to force them out to memory before calling invalidate_bdev().
This fixes a warning triggered by generic/081:
WARNING: CPU: 1 PID: 3473 at /usr/projects/linux/ext4/fs/block_dev.c:56 __blkdev_put+0xb5/0x16f()
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/ext4/super.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 447ccd4af707..cf977e2f8a6f 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -833,6 +833,7 @@ static void ext4_put_super(struct super_block *sb)
dump_orphan_list(sb, sbi);
J_ASSERT(list_empty(&sbi->s_orphan));
+ sync_blockdev(sb->s_bdev);
invalidate_bdev(sb->s_bdev);
if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {
/*
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 098/185] MIPS: Fix KVM guest fixmap address
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (96 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 097/185] ext4: call sync_blockdev() before invalidate_bdev() in put_super() Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 099/185] xfs: fix remote symlinks on V5/CRC filesystems Luis Henriques
` (86 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: James Hogan, linux-mips, Ralf Baechle, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <james.hogan@imgtec.com>
commit 8e748c8d09a9314eedb5c6367d9acfaacddcdc88 upstream.
KVM guest kernels for trap & emulate run in user mode, with a modified
set of kernel memory segments. However the fixmap address is still in
the normal KSeg3 region at 0xfffe0000 regardless, causing problems when
cache alias handling makes use of them when handling copy on write.
Therefore define FIXADDR_TOP as 0x7ffe0000 in the guest kernel mapped
region when CONFIG_KVM_GUEST is defined.
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/9887/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/mips/include/asm/mach-generic/spaces.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/mips/include/asm/mach-generic/spaces.h b/arch/mips/include/asm/mach-generic/spaces.h
index 9488fa5f8866..afc96ecb9004 100644
--- a/arch/mips/include/asm/mach-generic/spaces.h
+++ b/arch/mips/include/asm/mach-generic/spaces.h
@@ -94,7 +94,11 @@
#endif
#ifndef FIXADDR_TOP
+#ifdef CONFIG_KVM_GUEST
+#define FIXADDR_TOP ((unsigned long)(long)(int)0x7ffe0000)
+#else
#define FIXADDR_TOP ((unsigned long)(long)(int)0xfffe0000)
#endif
+#endif
#endif /* __ASM_MACH_GENERIC_SPACES_H */
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 099/185] xfs: fix remote symlinks on V5/CRC filesystems
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (97 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 098/185] MIPS: Fix KVM guest fixmap address Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 100/185] ext4: don't retry file block mapping on bigalloc fs with non-extent file Luis Henriques
` (85 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Eric Sandeen, Dave Chinner, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <sandeen@redhat.com>
commit 2ac56d3d4bd625450a54d4c3f9292d58f6b88232 upstream.
If we create a CRC filesystem, mount it, and create a symlink with
a path long enough that it can't live in the inode, we get a very
strange result upon remount:
# ls -l mnt
total 4
lrwxrwxrwx. 1 root root 929 Jun 15 16:58 link -> XSLM
XSLM is the V5 symlink block header magic (which happens to be
followed by a NUL, so the string looks terminated).
xfs_readlink_bmap() advanced cur_chunk by the size of the header
for CRC filesystems, but never actually used that pointer; it
kept reading from bp->b_addr, which is the start of the block,
rather than the start of the symlink data after the header.
Looks like this problem goes back to v3.10.
Fixing this gets us reading the proper link target, again.
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/xfs/xfs_symlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
index d69363c833e1..484583ef8821 100644
--- a/fs/xfs/xfs_symlink.c
+++ b/fs/xfs/xfs_symlink.c
@@ -107,7 +107,7 @@ xfs_readlink_bmap(
cur_chunk += sizeof(struct xfs_dsymlink_hdr);
}
- memcpy(link + offset, bp->b_addr, byte_cnt);
+ memcpy(link + offset, cur_chunk, byte_cnt);
pathlen -= byte_cnt;
offset += byte_cnt;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 100/185] ext4: don't retry file block mapping on bigalloc fs with non-extent file
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (98 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 099/185] xfs: fix remote symlinks on V5/CRC filesystems Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 101/185] xfs: don't truncate attribute extents if no extents exist Luis Henriques
` (84 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Darrick J. Wong, Theodore Ts'o, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Darrick J. Wong" <darrick.wong@oracle.com>
commit 292db1bc6c105d86111e858859456bcb11f90f91 upstream.
ext4 isn't willing to map clusters to a non-extent file. Don't signal
this with an out of space error, since the FS will retry the
allocation (which didn't fail) forever. Instead, return EUCLEAN so
that the operation will fail immediately all the way back to userspace.
(The fix is either to run e2fsck -E bmap2extent, or to chattr +e the file.)
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/ext4/indirect.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
index 944c49dd83e3..0c9ed67fe055 100644
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -576,7 +576,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
EXT4_ERROR_INODE(inode, "Can't allocate blocks for "
"non-extent mapped inodes with bigalloc");
- return -ENOSPC;
+ return -EUCLEAN;
}
goal = ext4_find_goal(inode, map->m_lblk, partial);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 101/185] xfs: don't truncate attribute extents if no extents exist
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (99 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 100/185] ext4: don't retry file block mapping on bigalloc fs with non-extent file Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 102/185] NET: ROSE: Don't dereference NULL neighbour pointer Luis Henriques
` (83 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Brian Foster, Dave Chinner, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Foster <bfoster@redhat.com>
commit f66bf042693b620133d39af8d2f13615f03eadfc upstream.
The xfs_attr3_root_inactive() call from xfs_attr_inactive() assumes that
attribute blocks exist to invalidate. It is possible to have an
attribute fork without extents, however. Consider the case where the
attribute fork is created towards the beginning of xfs_attr_set() but
some part of the subsequent attribute set fails.
If an inode in such a state hits xfs_attr_inactive(), it eventually
calls xfs_dabuf_map() and possibly xfs_bmapi_read(). The former emits a
filesystem corruption warning, returns an error that bubbles back up to
xfs_attr_inactive(), and leads to destruction of the in-core attribute
fork without an on-disk reset. If the inode happens to make it back
through xfs_inactive() in this state (e.g., via a concurrent bulkstat
that cycles the inode from the reclaim state and releases it), i_afp
might not exist when xfs_bmapi_read() is called and causes a NULL
dereference panic.
A '-p 2' fsstress run to ENOSPC on a relatively small fs (1GB)
reproduces these problems. The behavior is a regression caused by:
6dfe5a0 xfs: xfs_attr_inactive leaves inconsistent attr fork state behind
... which removed logic that avoided the attribute extent truncate when
no extents exist. Restore this logic to ensure the attribute fork is
destroyed and reset correctly if it exists without any allocated
extents.
Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/xfs/xfs_attr_inactive.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
index ced1dd9dd095..00f68393adf2 100644
--- a/fs/xfs/xfs_attr_inactive.c
+++ b/fs/xfs/xfs_attr_inactive.c
@@ -437,8 +437,14 @@ xfs_attr_inactive(
*/
xfs_trans_ijoin(trans, dp, 0);
- /* invalidate and truncate the attribute fork extents */
- if (dp->i_d.di_aformat != XFS_DINODE_FMT_LOCAL) {
+ /*
+ * Invalidate and truncate the attribute fork extents. Make sure the
+ * fork actually has attributes as otherwise the invalidation has no
+ * blocks to read and returns an error. In this case, just do the fork
+ * removal below.
+ */
+ if (xfs_inode_hasattr(dp) &&
+ dp->i_d.di_aformat != XFS_DINODE_FMT_LOCAL) {
error = xfs_attr3_root_inactive(&trans, dp);
if (error)
goto out_cancel;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 102/185] NET: ROSE: Don't dereference NULL neighbour pointer.
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (100 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 101/185] xfs: don't truncate attribute extents if no extents exist Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 103/185] netfilter: nf_qeueue: Drop queue entries on nf_unregister_hook Luis Henriques
` (82 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Ralf Baechle, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralf Baechle <ralf@linux-mips.org>
commit d496f7842aada20c61e6044b3395383fa972872c upstream.
A ROSE socket doesn't necessarily always have a neighbour pointer so check
if the neighbour pointer is valid before dereferencing it.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Tested-by: Bernard Pidoux <f6bvp@free.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/rose/af_rose.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 8451c8cdc9de..60823136dafb 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -192,7 +192,8 @@ static void rose_kill_by_device(struct net_device *dev)
if (rose->device == dev) {
rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
- rose->neighbour->use--;
+ if (rose->neighbour)
+ rose->neighbour->use--;
rose->device = NULL;
}
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 103/185] netfilter: nf_qeueue: Drop queue entries on nf_unregister_hook
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (101 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 102/185] NET: ROSE: Don't dereference NULL neighbour pointer Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 104/185] fs: Fix S_NOSEC handling Luis Henriques
` (81 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Eric W. Biederman, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit 8405a8fff3f8545c888a872d6e3c0c8eecd4d348 upstream.
Add code to nf_unregister_hook to flush the nf_queue when a hook is
unregistered. This guarantees that the pointer that the nf_queue code
retains into the nf_hook list will remain valid while a packet is
queued.
I tested what would happen if we do not flush queued packets and was
trivially able to obtain the oops below. All that was required was
to stop the nf_queue listening process, to delete all of the nf_tables,
and to awaken the nf_queue listening process.
> BUG: unable to handle kernel paging request at 0000000100000001
> IP: [<0000000100000001>] 0x100000001
> PGD b9c35067 PUD 0
> Oops: 0010 [#1] SMP
> Modules linked in:
> CPU: 0 PID: 519 Comm: lt-nfqnl_test Not tainted
> task: ffff8800b9c8c050 ti: ffff8800ba9d8000 task.ti: ffff8800ba9d8000
> RIP: 0010:[<0000000100000001>] [<0000000100000001>] 0x100000001
> RSP: 0018:ffff8800ba9dba40 EFLAGS: 00010a16
> RAX: ffff8800bab48a00 RBX: ffff8800ba9dba90 RCX: ffff8800ba9dba90
> RDX: ffff8800b9c10128 RSI: ffff8800ba940900 RDI: ffff8800bab48a00
> RBP: ffff8800b9c10128 R08: ffffffff82976660 R09: ffff8800ba9dbb28
> R10: dead000000100100 R11: dead000000200200 R12: ffff8800ba940900
> R13: ffffffff8313fd50 R14: ffff8800b9c95200 R15: 0000000000000000
> FS: 00007fb91fc34700(0000) GS:ffff8800bfa00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000100000001 CR3: 00000000babfb000 CR4: 00000000000007f0
> Stack:
> ffffffff8206ab0f ffffffff82982240 ffff8800bab48a00 ffff8800b9c100a8
> ffff8800b9c10100 0000000000000001 ffff8800ba940900 ffff8800b9c10128
> ffffffff8206bd65 ffff8800bfb0d5e0 ffff8800bab48a00 0000000000014dc0
> Call Trace:
> [<ffffffff8206ab0f>] ? nf_iterate+0x4f/0xa0
> [<ffffffff8206bd65>] ? nf_reinject+0x125/0x190
> [<ffffffff8206dee5>] ? nfqnl_recv_verdict+0x255/0x360
> [<ffffffff81386290>] ? nla_parse+0x80/0xf0
> [<ffffffff8206c42c>] ? nfnetlink_rcv_msg+0x13c/0x240
> [<ffffffff811b2fec>] ? __memcg_kmem_get_cache+0x4c/0x150
> [<ffffffff8206c2f0>] ? nfnl_lock+0x20/0x20
> [<ffffffff82068159>] ? netlink_rcv_skb+0xa9/0xc0
> [<ffffffff820677bf>] ? netlink_unicast+0x12f/0x1c0
> [<ffffffff82067ade>] ? netlink_sendmsg+0x28e/0x650
> [<ffffffff81fdd814>] ? sock_sendmsg+0x44/0x50
> [<ffffffff81fde07b>] ? ___sys_sendmsg+0x2ab/0x2c0
> [<ffffffff810e8f73>] ? __wake_up+0x43/0x70
> [<ffffffff8141a134>] ? tty_write+0x1c4/0x2a0
> [<ffffffff81fde9f4>] ? __sys_sendmsg+0x44/0x80
> [<ffffffff823ff8d7>] ? system_call_fastpath+0x12/0x6a
> Code: Bad RIP value.
> RIP [<0000000100000001>] 0x100000001
> RSP <ffff8800ba9dba40>
> CR2: 0000000100000001
> ---[ end trace 08eb65d42362793f ]---
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
include/net/netfilter/nf_queue.h | 2 ++
net/netfilter/core.c | 1 +
net/netfilter/nf_internals.h | 1 +
net/netfilter/nf_queue.c | 17 +++++++++++++++++
net/netfilter/nfnetlink_queue_core.c | 24 +++++++++++++++++++++++-
5 files changed, 44 insertions(+), 1 deletion(-)
diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
index 84a53d780306..1a91f979160e 100644
--- a/include/net/netfilter/nf_queue.h
+++ b/include/net/netfilter/nf_queue.h
@@ -28,6 +28,8 @@ struct nf_queue_entry {
struct nf_queue_handler {
int (*outfn)(struct nf_queue_entry *entry,
unsigned int queuenum);
+ void (*nf_hook_drop)(struct net *net,
+ struct nf_hook_ops *ops);
};
void nf_register_queue_handler(const struct nf_queue_handler *qh);
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 1fbab0cdd302..32c5db5a8569 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -95,6 +95,7 @@ void nf_unregister_hook(struct nf_hook_ops *reg)
static_key_slow_dec(&nf_hooks_needed[reg->pf][reg->hooknum]);
#endif
synchronize_net();
+ nf_queue_nf_hook_drop(reg);
}
EXPORT_SYMBOL(nf_unregister_hook);
diff --git a/net/netfilter/nf_internals.h b/net/netfilter/nf_internals.h
index 61a3c927e63c..aba1d7dac17c 100644
--- a/net/netfilter/nf_internals.h
+++ b/net/netfilter/nf_internals.h
@@ -24,6 +24,7 @@ int nf_queue(struct sk_buff *skb, struct nf_hook_ops *elem, u_int8_t pf,
unsigned int hook, struct net_device *indev,
struct net_device *outdev, int (*okfn)(struct sk_buff *),
unsigned int queuenum);
+void nf_queue_nf_hook_drop(struct nf_hook_ops *ops);
int __init netfilter_queue_init(void);
/* nf_log.c */
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 5d24b1fdb593..df046ed74f2b 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -95,6 +95,23 @@ bool nf_queue_entry_get_refs(struct nf_queue_entry *entry)
}
EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs);
+void nf_queue_nf_hook_drop(struct nf_hook_ops *ops)
+{
+ const struct nf_queue_handler *qh;
+ struct net *net;
+
+ rtnl_lock();
+ rcu_read_lock();
+ qh = rcu_dereference(queue_handler);
+ if (qh) {
+ for_each_net(net) {
+ qh->nf_hook_drop(net, ops);
+ }
+ }
+ rcu_read_unlock();
+ rtnl_unlock();
+}
+
/*
* Any packet that leaves via this function must come back
* through nf_reinject().
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index 5b169db2049a..219ccff2d71c 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -815,6 +815,27 @@ static struct notifier_block nfqnl_dev_notifier = {
.notifier_call = nfqnl_rcv_dev_event,
};
+static int nf_hook_cmp(struct nf_queue_entry *entry, unsigned long ops_ptr)
+{
+ return entry->elem == (struct nf_hook_ops *)ops_ptr;
+}
+
+static void nfqnl_nf_hook_drop(struct net *net, struct nf_hook_ops *hook)
+{
+ struct nfnl_queue_net *q = nfnl_queue_pernet(net);
+ int i;
+
+ rcu_read_lock();
+ for (i = 0; i < INSTANCE_BUCKETS; i++) {
+ struct nfqnl_instance *inst;
+ struct hlist_head *head = &q->instance_table[i];
+
+ hlist_for_each_entry_rcu(inst, head, hlist)
+ nfqnl_flush(inst, nf_hook_cmp, (unsigned long)hook);
+ }
+ rcu_read_unlock();
+}
+
static int
nfqnl_rcv_nl_event(struct notifier_block *this,
unsigned long event, void *ptr)
@@ -1022,7 +1043,8 @@ static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = {
};
static const struct nf_queue_handler nfqh = {
- .outfn = &nfqnl_enqueue_packet,
+ .outfn = &nfqnl_enqueue_packet,
+ .nf_hook_drop = &nfqnl_nf_hook_drop,
};
static int
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 104/185] fs: Fix S_NOSEC handling
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (102 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 103/185] netfilter: nf_qeueue: Drop queue entries on nf_unregister_hook Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 105/185] stmmac: troubleshoot unexpected bits in des0 & des1 Luis Henriques
` (80 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Jan Kara, Al Viro, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 2426f3910069ed47c0cc58559a6d088af7920201 upstream.
file_remove_suid() could mistakenly set S_NOSEC inode bit when root was
modifying the file. As a result following writes to the file by ordinary
user would avoid clearing suid or sgid bits.
Fix the bug by checking actual mode bits before setting S_NOSEC.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/inode.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/inode.c b/fs/inode.c
index 6eecb7ff0b9a..f5a842698580 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1630,8 +1630,8 @@ int file_remove_suid(struct file *file)
error = security_inode_killpriv(dentry);
if (!error && killsuid)
error = __remove_suid(dentry, killsuid);
- if (!error && (inode->i_sb->s_flags & MS_NOSEC))
- inode->i_flags |= S_NOSEC;
+ if (!error)
+ inode_has_no_xattr(inode);
return error;
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 105/185] stmmac: troubleshoot unexpected bits in des0 & des1
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (103 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 104/185] fs: Fix S_NOSEC handling Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 106/185] ACPI / resources: free memory on error in add_region_before() Luis Henriques
` (79 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Alexey Brodkin, Giuseppe Cavallaro, arc-linux-dev, David Miller,
Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
commit f1590670ce069eefeb93916391a67643e6ad1630 upstream.
Current implementation of descriptor init procedure only takes
care about setting/clearing ownership flag in "des0"/"des1"
fields while it is perfectly possible to get unexpected bits
set because of the following factors:
[1] On driver probe underlying memory allocated with
dma_alloc_coherent() might not be zeroed and so
it will be filled with garbage.
[2] During driver operation some bits could be set by SD/MMC
controller (for example error flags etc).
And unexpected and/or randomly set flags in "des0"/"des1"
fields may lead to unpredictable behavior of GMAC DMA block.
This change addresses both items above with:
[1] Use of dma_zalloc_coherent() instead of simple
dma_alloc_coherent() to make sure allocated memory is
zeroed. That shouldn't affect performance because
this allocation only happens once on driver probe.
[2] Do explicit zeroing of both "des0" and "des1" fields
of all buffer descriptors during initialization of
DMA transfer.
And while at it fixed identation of dma_free_coherent()
counterpart as well.
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
Cc: arc-linux-dev@synopsys.com
Cc: linux-kernel@vger.kernel.org
Cc: David Miller <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/ethernet/stmicro/stmmac/descs.h | 2 ++
drivers/net/ethernet/stmicro/stmmac/enh_desc.c | 3 +-
drivers/net/ethernet/stmicro/stmmac/norm_desc.c | 3 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 44 +++++++++++------------
4 files changed, 28 insertions(+), 24 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/descs.h b/drivers/net/ethernet/stmicro/stmmac/descs.h
index ad3996038018..799c2929c536 100644
--- a/drivers/net/ethernet/stmicro/stmmac/descs.h
+++ b/drivers/net/ethernet/stmicro/stmmac/descs.h
@@ -158,6 +158,8 @@ struct dma_desc {
u32 buffer2_size:13;
u32 reserved4:3;
} etx; /* -- enhanced -- */
+
+ u64 all_flags;
} des01;
unsigned int des2;
unsigned int des3;
diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
index 1e2bcf5f89e1..7d944449f5ef 100644
--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
@@ -240,6 +240,7 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
int mode, int end)
{
+ p->des01.all_flags = 0;
p->des01.erx.own = 1;
p->des01.erx.buffer1_size = BUF_SIZE_8KiB - 1;
@@ -254,7 +255,7 @@ static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
static void enh_desc_init_tx_desc(struct dma_desc *p, int mode, int end)
{
- p->des01.etx.own = 0;
+ p->des01.all_flags = 0;
if (mode == STMMAC_CHAIN_MODE)
ehn_desc_tx_set_on_chain(p, end);
else
diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
index 35ad4f427ae2..48c3456445b2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
@@ -123,6 +123,7 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x,
static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode,
int end)
{
+ p->des01.all_flags = 0;
p->des01.rx.own = 1;
p->des01.rx.buffer1_size = BUF_SIZE_2KiB - 1;
@@ -137,7 +138,7 @@ static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode,
static void ndesc_init_tx_desc(struct dma_desc *p, int mode, int end)
{
- p->des01.tx.own = 0;
+ p->des01.all_flags = 0;
if (mode == STMMAC_CHAIN_MODE)
ndesc_tx_set_on_chain(p, end);
else
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 057a1208e594..641086fc14b5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1142,41 +1142,41 @@ static int alloc_dma_desc_resources(struct stmmac_priv *priv)
goto err_tx_skbuff;
if (priv->extend_desc) {
- priv->dma_erx = dma_alloc_coherent(priv->device, rxsize *
- sizeof(struct
- dma_extended_desc),
- &priv->dma_rx_phy,
- GFP_KERNEL);
+ priv->dma_erx = dma_zalloc_coherent(priv->device, rxsize *
+ sizeof(struct
+ dma_extended_desc),
+ &priv->dma_rx_phy,
+ GFP_KERNEL);
if (!priv->dma_erx)
goto err_dma;
- priv->dma_etx = dma_alloc_coherent(priv->device, txsize *
- sizeof(struct
- dma_extended_desc),
- &priv->dma_tx_phy,
- GFP_KERNEL);
+ priv->dma_etx = dma_zalloc_coherent(priv->device, txsize *
+ sizeof(struct
+ dma_extended_desc),
+ &priv->dma_tx_phy,
+ GFP_KERNEL);
if (!priv->dma_etx) {
dma_free_coherent(priv->device, priv->dma_rx_size *
- sizeof(struct dma_extended_desc),
- priv->dma_erx, priv->dma_rx_phy);
+ sizeof(struct dma_extended_desc),
+ priv->dma_erx, priv->dma_rx_phy);
goto err_dma;
}
} else {
- priv->dma_rx = dma_alloc_coherent(priv->device, rxsize *
- sizeof(struct dma_desc),
- &priv->dma_rx_phy,
- GFP_KERNEL);
+ priv->dma_rx = dma_zalloc_coherent(priv->device, rxsize *
+ sizeof(struct dma_desc),
+ &priv->dma_rx_phy,
+ GFP_KERNEL);
if (!priv->dma_rx)
goto err_dma;
- priv->dma_tx = dma_alloc_coherent(priv->device, txsize *
- sizeof(struct dma_desc),
- &priv->dma_tx_phy,
- GFP_KERNEL);
+ priv->dma_tx = dma_zalloc_coherent(priv->device, txsize *
+ sizeof(struct dma_desc),
+ &priv->dma_tx_phy,
+ GFP_KERNEL);
if (!priv->dma_tx) {
dma_free_coherent(priv->device, priv->dma_rx_size *
- sizeof(struct dma_desc),
- priv->dma_rx, priv->dma_rx_phy);
+ sizeof(struct dma_desc),
+ priv->dma_rx, priv->dma_rx_phy);
goto err_dma;
}
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 106/185] ACPI / resources: free memory on error in add_region_before()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (104 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 105/185] stmmac: troubleshoot unexpected bits in des0 & des1 Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 107/185] PM / sleep: Increase default DPM watchdog timeout to 60 Luis Henriques
` (78 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dan Carpenter, Rafael J. Wysocki, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 7bc10388ccdd79b3d20463151a1f8e7a590a775b upstream.
There is a small memory leak on error.
Fixes: 0f1b414d1907 (ACPI / PNP: Avoid conflicting resource reservations)
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/acpi/resource.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 28314ba82320..3760e9635aea 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -577,8 +577,10 @@ static int add_region_before(u64 start, u64 end, u8 space_id,
return -ENOMEM;
error = request_range(start, end, space_id, flags, desc);
- if (error)
+ if (error) {
+ kfree(reg);
return error;
+ }
reg->start = start;
reg->end = end;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 107/185] PM / sleep: Increase default DPM watchdog timeout to 60
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (105 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 106/185] ACPI / resources: free memory on error in add_region_before() Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 108/185] ARC: add compiler barrier to LLSC based cmpxchg Luis Henriques
` (77 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Takashi Iwai, Rafael J. Wysocki, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit fff3b16d2754a061a3549c4307a186423a0128fd upstream.
Many harddisks (mostly WD ones) have firmware problems and take too
long, more than 10 seconds, to resume from suspend. And this often
exceeds the default DPM watchdog timeout (12 seconds), resulting in a
kernel panic out of sudden.
Since most distros just take the default as is, we should give a bit
more safer value. This patch increases the default value from 12
seconds to one minute, which has been confirmed to be long enough for
such problematic disks.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=91921
Fixes: 70fea60d888d (PM / Sleep: Detect device suspend/resume lockup and log event)
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
kernel/power/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index 9a83d780facd..ff6150d05e82 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -191,7 +191,7 @@ config DPM_WATCHDOG
config DPM_WATCHDOG_TIMEOUT
int "Watchdog timeout in seconds"
range 1 120
- default 12
+ default 60
depends on DPM_WATCHDOG
config PM_TRACE
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 108/185] ARC: add compiler barrier to LLSC based cmpxchg
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (106 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 107/185] PM / sleep: Increase default DPM watchdog timeout to 60 Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 109/185] locking,arch,arc: Fold atomic_ops Luis Henriques
` (76 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Vineet Gupta, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineet Gupta <vgupta@synopsys.com>
commit d57f727264f1425a94689bafc7e99e502cb135b5 upstream.
When auditing cmpxchg call sites, Chuck noted that gcc was optimizing
away some of the desired LDs.
| do {
| new = old = *ipi_data_ptr;
| new |= 1U << msg;
| } while (cmpxchg(ipi_data_ptr, old, new) != old);
was generating to below
| 8015cef8: ld r2,[r4,0] <-- First LD
| 8015cefc: bset r1,r2,r1
|
| 8015cf00: llock r3,[r4] <-- atomic op
| 8015cf04: brne r3,r2,8015cf10
| 8015cf08: scond r1,[r4]
| 8015cf0c: bnz 8015cf00
|
| 8015cf10: brne r3,r2,8015cf00 <-- Branch doesn't go to orig LD
Although this was fixed by adding a ACCESS_ONCE in this call site, it
seems safer (for now at least) to add compiler barrier to LLSC based
cmpxchg
Reported-by: Chuck Jordan <cjordan@synopsys,com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arc/include/asm/cmpxchg.h | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
index 03cd6894855d..90de5c528da2 100644
--- a/arch/arc/include/asm/cmpxchg.h
+++ b/arch/arc/include/asm/cmpxchg.h
@@ -25,10 +25,11 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new)
" scond %3, [%1] \n"
" bnz 1b \n"
"2: \n"
- : "=&r"(prev)
- : "r"(ptr), "ir"(expected),
- "r"(new) /* can't be "ir". scond can't take limm for "b" */
- : "cc");
+ : "=&r"(prev) /* Early clobber, to prevent reg reuse */
+ : "r"(ptr), /* Not "m": llock only supports reg direct addr mode */
+ "ir"(expected),
+ "r"(new) /* can't be "ir". scond can't take LIMM for "b" */
+ : "cc", "memory"); /* so that gcc knows memory is being written here */
return prev;
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 109/185] locking,arch,arc: Fold atomic_ops
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (107 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 108/185] ARC: add compiler barrier to LLSC based cmpxchg Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 110/185] ARC: add smp barriers around atomics per Documentation/atomic_ops.txt Luis Henriques
` (75 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Peter Zijlstra, Linus Torvalds, Paul E. McKenney, Vineet Gupta,
Ingo Molnar, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit f7d11e93ee97a37da1947b7c4e1794705a6f360c upstream.
Many of the atomic op implementations are the same except for one
instruction; fold the lot into a few CPP macros and reduce LoC.
This also prepares for easy addition of new ops.
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Vineet Gupta <vgupta@synopsys.com>
Link: http://lkml.kernel.org/r/20140508135851.886055622@infradead.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[ luis: 3.16 prereq for:
2576c28e3f62 "ARC: add smp barriers around atomics per Documentation/atomic_ops.txt"
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arc/include/asm/atomic.h | 184 +++++++++++++++---------------------------
1 file changed, 63 insertions(+), 121 deletions(-)
diff --git a/arch/arc/include/asm/atomic.h b/arch/arc/include/asm/atomic.h
index 83f03ca6caf6..173f303a868f 100644
--- a/arch/arc/include/asm/atomic.h
+++ b/arch/arc/include/asm/atomic.h
@@ -25,79 +25,36 @@
#define atomic_set(v, i) (((v)->counter) = (i))
-static inline void atomic_add(int i, atomic_t *v)
-{
- unsigned int temp;
-
- __asm__ __volatile__(
- "1: llock %0, [%1] \n"
- " add %0, %0, %2 \n"
- " scond %0, [%1] \n"
- " bnz 1b \n"
- : "=&r"(temp) /* Early clobber, to prevent reg reuse */
- : "r"(&v->counter), "ir"(i)
- : "cc");
-}
-
-static inline void atomic_sub(int i, atomic_t *v)
-{
- unsigned int temp;
-
- __asm__ __volatile__(
- "1: llock %0, [%1] \n"
- " sub %0, %0, %2 \n"
- " scond %0, [%1] \n"
- " bnz 1b \n"
- : "=&r"(temp)
- : "r"(&v->counter), "ir"(i)
- : "cc");
-}
-
-/* add and also return the new value */
-static inline int atomic_add_return(int i, atomic_t *v)
-{
- unsigned int temp;
-
- __asm__ __volatile__(
- "1: llock %0, [%1] \n"
- " add %0, %0, %2 \n"
- " scond %0, [%1] \n"
- " bnz 1b \n"
- : "=&r"(temp)
- : "r"(&v->counter), "ir"(i)
- : "cc");
-
- return temp;
-}
-
-static inline int atomic_sub_return(int i, atomic_t *v)
-{
- unsigned int temp;
-
- __asm__ __volatile__(
- "1: llock %0, [%1] \n"
- " sub %0, %0, %2 \n"
- " scond %0, [%1] \n"
- " bnz 1b \n"
- : "=&r"(temp)
- : "r"(&v->counter), "ir"(i)
- : "cc");
-
- return temp;
-}
-
-static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
-{
- unsigned int temp;
-
- __asm__ __volatile__(
- "1: llock %0, [%1] \n"
- " bic %0, %0, %2 \n"
- " scond %0, [%1] \n"
- " bnz 1b \n"
- : "=&r"(temp)
- : "r"(addr), "ir"(mask)
- : "cc");
+#define ATOMIC_OP(op, c_op, asm_op) \
+static inline void atomic_##op(int i, atomic_t *v) \
+{ \
+ unsigned int temp; \
+ \
+ __asm__ __volatile__( \
+ "1: llock %0, [%1] \n" \
+ " " #asm_op " %0, %0, %2 \n" \
+ " scond %0, [%1] \n" \
+ " bnz 1b \n" \
+ : "=&r"(temp) /* Early clobber, to prevent reg reuse */ \
+ : "r"(&v->counter), "ir"(i) \
+ : "cc"); \
+} \
+
+#define ATOMIC_OP_RETURN(op, c_op, asm_op) \
+static inline int atomic_##op##_return(int i, atomic_t *v) \
+{ \
+ unsigned int temp; \
+ \
+ __asm__ __volatile__( \
+ "1: llock %0, [%1] \n" \
+ " " #asm_op " %0, %0, %2 \n" \
+ " scond %0, [%1] \n" \
+ " bnz 1b \n" \
+ : "=&r"(temp) \
+ : "r"(&v->counter), "ir"(i) \
+ : "cc"); \
+ \
+ return temp; \
}
#else /* !CONFIG_ARC_HAS_LLSC */
@@ -126,6 +83,7 @@ static inline void atomic_set(atomic_t *v, int i)
v->counter = i;
atomic_ops_unlock(flags);
}
+
#endif
/*
@@ -133,62 +91,46 @@ static inline void atomic_set(atomic_t *v, int i)
* Locking would change to irq-disabling only (UP) and spinlocks (SMP)
*/
-static inline void atomic_add(int i, atomic_t *v)
-{
- unsigned long flags;
-
- atomic_ops_lock(flags);
- v->counter += i;
- atomic_ops_unlock(flags);
+#define ATOMIC_OP(op, c_op, asm_op) \
+static inline void atomic_##op(int i, atomic_t *v) \
+{ \
+ unsigned long flags; \
+ \
+ atomic_ops_lock(flags); \
+ v->counter c_op i; \
+ atomic_ops_unlock(flags); \
}
-static inline void atomic_sub(int i, atomic_t *v)
-{
- unsigned long flags;
-
- atomic_ops_lock(flags);
- v->counter -= i;
- atomic_ops_unlock(flags);
+#define ATOMIC_OP_RETURN(op, c_op) \
+static inline int atomic_##op##_return(int i, atomic_t *v) \
+{ \
+ unsigned long flags; \
+ unsigned long temp; \
+ \
+ atomic_ops_lock(flags); \
+ temp = v->counter; \
+ temp c_op i; \
+ v->counter = temp; \
+ atomic_ops_unlock(flags); \
+ \
+ return temp; \
}
-static inline int atomic_add_return(int i, atomic_t *v)
-{
- unsigned long flags;
- unsigned long temp;
-
- atomic_ops_lock(flags);
- temp = v->counter;
- temp += i;
- v->counter = temp;
- atomic_ops_unlock(flags);
-
- return temp;
-}
-
-static inline int atomic_sub_return(int i, atomic_t *v)
-{
- unsigned long flags;
- unsigned long temp;
-
- atomic_ops_lock(flags);
- temp = v->counter;
- temp -= i;
- v->counter = temp;
- atomic_ops_unlock(flags);
+#endif /* !CONFIG_ARC_HAS_LLSC */
- return temp;
-}
+#define ATOMIC_OPS(op, c_op, asm_op) \
+ ATOMIC_OP(op, c_op, asm_op) \
+ ATOMIC_OP_RETURN(op, c_op, asm_op)
-static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
-{
- unsigned long flags;
+ATOMIC_OPS(add, +=, add)
+ATOMIC_OPS(sub, -=, sub)
+ATOMIC_OP(and, &=, and)
- atomic_ops_lock(flags);
- *addr &= ~mask;
- atomic_ops_unlock(flags);
-}
+#define atomic_clear_mask(mask, v) atomic_and(~(mask), (v))
-#endif /* !CONFIG_ARC_HAS_LLSC */
+#undef ATOMIC_OPS
+#undef ATOMIC_OP_RETURN
+#undef ATOMIC_OP
/**
* __atomic_add_unless - add unless the number is a given value
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 110/185] ARC: add smp barriers around atomics per Documentation/atomic_ops.txt
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (108 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 109/185] locking,arch,arc: Fold atomic_ops Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 111/185] mm: kmemleak: allow safe memory scanning during kmemleak disabling Luis Henriques
` (74 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Paul E. McKenney, Vineet Gupta, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineet Gupta <vgupta@synopsys.com>
commit 2576c28e3f623ed401db7e6197241865328620ef upstream.
- arch_spin_lock/unlock were lacking the ACQUIRE/RELEASE barriers
Since ARCv2 only provides load/load, store/store and all/all, we need
the full barrier
- LLOCK/SCOND based atomics, bitops, cmpxchg, which return modified
values were lacking the explicit smp barriers.
- Non LLOCK/SCOND varaints don't need the explicit barriers since that
is implicity provided by the spin locks used to implement the
critical section (the spin lock barriers in turn are also fixed in
this commit as explained above
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arc/include/asm/atomic.h | 21 +++++++++++++++++++++
arch/arc/include/asm/bitops.h | 19 +++++++++++++++++++
arch/arc/include/asm/cmpxchg.h | 17 +++++++++++++++++
arch/arc/include/asm/spinlock.h | 32 ++++++++++++++++++++++++++++++++
4 files changed, 89 insertions(+)
diff --git a/arch/arc/include/asm/atomic.h b/arch/arc/include/asm/atomic.h
index 173f303a868f..223138716c2e 100644
--- a/arch/arc/include/asm/atomic.h
+++ b/arch/arc/include/asm/atomic.h
@@ -45,6 +45,12 @@ static inline int atomic_##op##_return(int i, atomic_t *v) \
{ \
unsigned int temp; \
\
+ /* \
+ * Explicit full memory barrier needed before/after as \
+ * LLOCK/SCOND thmeselves don't provide any such semantics \
+ */ \
+ smp_mb(); \
+ \
__asm__ __volatile__( \
"1: llock %0, [%1] \n" \
" " #asm_op " %0, %0, %2 \n" \
@@ -54,6 +60,8 @@ static inline int atomic_##op##_return(int i, atomic_t *v) \
: "r"(&v->counter), "ir"(i) \
: "cc"); \
\
+ smp_mb(); \
+ \
return temp; \
}
@@ -107,6 +115,9 @@ static inline int atomic_##op##_return(int i, atomic_t *v) \
unsigned long flags; \
unsigned long temp; \
\
+ /* \
+ * spin lock/unlock provides the needed smp_mb() before/after \
+ */ \
atomic_ops_lock(flags); \
temp = v->counter; \
temp c_op i; \
@@ -144,9 +155,19 @@ ATOMIC_OP(and, &=, and)
#define __atomic_add_unless(v, a, u) \
({ \
int c, old; \
+ \
+ /* \
+ * Explicit full memory barrier needed before/after as \
+ * LLOCK/SCOND thmeselves don't provide any such semantics \
+ */ \
+ smp_mb(); \
+ \
c = atomic_read(v); \
while (c != (u) && (old = atomic_cmpxchg((v), c, c + (a))) != c)\
c = old; \
+ \
+ smp_mb(); \
+ \
c; \
})
diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
index ebc0cf3164dc..72e50ec9d00b 100644
--- a/arch/arc/include/asm/bitops.h
+++ b/arch/arc/include/asm/bitops.h
@@ -105,6 +105,12 @@ static inline int test_and_set_bit(unsigned long nr, volatile unsigned long *m)
if (__builtin_constant_p(nr))
nr &= 0x1f;
+ /*
+ * Explicit full memory barrier needed before/after as
+ * LLOCK/SCOND themselves don't provide any such semantics
+ */
+ smp_mb();
+
__asm__ __volatile__(
"1: llock %0, [%2] \n"
" bset %1, %0, %3 \n"
@@ -114,6 +120,8 @@ static inline int test_and_set_bit(unsigned long nr, volatile unsigned long *m)
: "r"(m), "ir"(nr)
: "cc");
+ smp_mb();
+
return (old & (1 << nr)) != 0;
}
@@ -127,6 +135,8 @@ test_and_clear_bit(unsigned long nr, volatile unsigned long *m)
if (__builtin_constant_p(nr))
nr &= 0x1f;
+ smp_mb();
+
__asm__ __volatile__(
"1: llock %0, [%2] \n"
" bclr %1, %0, %3 \n"
@@ -136,6 +146,8 @@ test_and_clear_bit(unsigned long nr, volatile unsigned long *m)
: "r"(m), "ir"(nr)
: "cc");
+ smp_mb();
+
return (old & (1 << nr)) != 0;
}
@@ -149,6 +161,8 @@ test_and_change_bit(unsigned long nr, volatile unsigned long *m)
if (__builtin_constant_p(nr))
nr &= 0x1f;
+ smp_mb();
+
__asm__ __volatile__(
"1: llock %0, [%2] \n"
" bxor %1, %0, %3 \n"
@@ -158,6 +172,8 @@ test_and_change_bit(unsigned long nr, volatile unsigned long *m)
: "r"(m), "ir"(nr)
: "cc");
+ smp_mb();
+
return (old & (1 << nr)) != 0;
}
@@ -256,6 +272,9 @@ test_and_clear_bit(unsigned long nr, volatile unsigned long *m)
if (__builtin_constant_p(nr))
nr &= 0x1f;
+ /*
+ * spin lock/unlock provide the needed smp_mb() before/after
+ */
bitops_lock(flags);
old = *m;
diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
index 90de5c528da2..44fd531f4d7b 100644
--- a/arch/arc/include/asm/cmpxchg.h
+++ b/arch/arc/include/asm/cmpxchg.h
@@ -10,6 +10,8 @@
#define __ASM_ARC_CMPXCHG_H
#include <linux/types.h>
+
+#include <asm/barrier.h>
#include <asm/smp.h>
#ifdef CONFIG_ARC_HAS_LLSC
@@ -19,6 +21,12 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new)
{
unsigned long prev;
+ /*
+ * Explicit full memory barrier needed before/after as
+ * LLOCK/SCOND thmeselves don't provide any such semantics
+ */
+ smp_mb();
+
__asm__ __volatile__(
"1: llock %0, [%1] \n"
" brne %0, %2, 2f \n"
@@ -31,6 +39,8 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new)
"r"(new) /* can't be "ir". scond can't take LIMM for "b" */
: "cc", "memory"); /* so that gcc knows memory is being written here */
+ smp_mb();
+
return prev;
}
@@ -43,6 +53,9 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new)
int prev;
volatile unsigned long *p = ptr;
+ /*
+ * spin lock/unlock provide the needed smp_mb() before/after
+ */
atomic_ops_lock(flags);
prev = *p;
if (prev == expected)
@@ -78,12 +91,16 @@ static inline unsigned long __xchg(unsigned long val, volatile void *ptr,
switch (size) {
case 4:
+ smp_mb();
+
__asm__ __volatile__(
" ex %0, [%1] \n"
: "+r"(val)
: "r"(ptr)
: "memory");
+ smp_mb();
+
return val;
}
return __xchg_bad_pointer();
diff --git a/arch/arc/include/asm/spinlock.h b/arch/arc/include/asm/spinlock.h
index b6a8c2dfbe6e..e1651df6a93d 100644
--- a/arch/arc/include/asm/spinlock.h
+++ b/arch/arc/include/asm/spinlock.h
@@ -22,24 +22,46 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
{
unsigned int tmp = __ARCH_SPIN_LOCK_LOCKED__;
+ /*
+ * This smp_mb() is technically superfluous, we only need the one
+ * after the lock for providing the ACQUIRE semantics.
+ * However doing the "right" thing was regressing hackbench
+ * so keeping this, pending further investigation
+ */
+ smp_mb();
+
__asm__ __volatile__(
"1: ex %0, [%1] \n"
" breq %0, %2, 1b \n"
: "+&r" (tmp)
: "r"(&(lock->slock)), "ir"(__ARCH_SPIN_LOCK_LOCKED__)
: "memory");
+
+ /*
+ * ACQUIRE barrier to ensure load/store after taking the lock
+ * don't "bleed-up" out of the critical section (leak-in is allowed)
+ * http://www.spinics.net/lists/kernel/msg2010409.html
+ *
+ * ARCv2 only has load-load, store-store and all-all barrier
+ * thus need the full all-all barrier
+ */
+ smp_mb();
}
static inline int arch_spin_trylock(arch_spinlock_t *lock)
{
unsigned int tmp = __ARCH_SPIN_LOCK_LOCKED__;
+ smp_mb();
+
__asm__ __volatile__(
"1: ex %0, [%1] \n"
: "+r" (tmp)
: "r"(&(lock->slock))
: "memory");
+ smp_mb();
+
return (tmp == __ARCH_SPIN_LOCK_UNLOCKED__);
}
@@ -47,12 +69,22 @@ static inline void arch_spin_unlock(arch_spinlock_t *lock)
{
unsigned int tmp = __ARCH_SPIN_LOCK_UNLOCKED__;
+ /*
+ * RELEASE barrier: given the instructions avail on ARCv2, full barrier
+ * is the only option
+ */
+ smp_mb();
+
__asm__ __volatile__(
" ex %0, [%1] \n"
: "+r" (tmp)
: "r"(&(lock->slock))
: "memory");
+ /*
+ * superfluous, but keeping for now - see pairing version in
+ * arch_spin_lock above
+ */
smp_mb();
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 111/185] mm: kmemleak: allow safe memory scanning during kmemleak disabling
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (109 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 110/185] ARC: add smp barriers around atomics per Documentation/atomic_ops.txt Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 112/185] dell-laptop: Fix allocating & freeing SMI buffer page Luis Henriques
` (73 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Catalin Marinas, Andrew Morton, Linus Torvalds, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <catalin.marinas@arm.com>
commit c5f3b1a51a591c18c8b33983908e7fdda6ae417e upstream.
The kmemleak scanning thread can run for minutes. Callbacks like
kmemleak_free() are allowed during this time, the race being taken care
of by the object->lock spinlock. Such lock also prevents a memory block
from being freed or unmapped while it is being scanned by blocking the
kmemleak_free() -> ... -> __delete_object() function until the lock is
released in scan_object().
When a kmemleak error occurs (e.g. it fails to allocate its metadata),
kmemleak_enabled is set and __delete_object() is no longer called on
freed objects. If kmemleak_scan is running at the same time,
kmemleak_free() no longer waits for the object scanning to complete,
allowing the corresponding memory block to be freed or unmapped (in the
case of vfree()). This leads to kmemleak_scan potentially triggering a
page fault.
This patch separates the kmemleak_free() enabling/disabling from the
overall kmemleak_enabled nob so that we can defer the disabling of the
object freeing tracking until the scanning thread completed. The
kmemleak_free_part() is deliberately ignored by this patch since this is
only called during boot before the scanning thread started.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>
Tested-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
mm/kmemleak.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 3cda50c1e394..6691476a66fc 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -193,6 +193,8 @@ static struct kmem_cache *scan_area_cache;
/* set if tracing memory operations is enabled */
static int kmemleak_enabled;
+/* same as above but only for the kmemleak_free() callback */
+static int kmemleak_free_enabled;
/* set in the late_initcall if there were no errors */
static int kmemleak_initialized;
/* enables or disables early logging of the memory operations */
@@ -940,7 +942,7 @@ void __ref kmemleak_free(const void *ptr)
{
pr_debug("%s(0x%p)\n", __func__, ptr);
- if (kmemleak_enabled && ptr && !IS_ERR(ptr))
+ if (kmemleak_free_enabled && ptr && !IS_ERR(ptr))
delete_object_full((unsigned long)ptr);
else if (kmemleak_early_log)
log_early(KMEMLEAK_FREE, ptr, 0, 0);
@@ -980,7 +982,7 @@ void __ref kmemleak_free_percpu(const void __percpu *ptr)
pr_debug("%s(0x%p)\n", __func__, ptr);
- if (kmemleak_enabled && ptr && !IS_ERR(ptr))
+ if (kmemleak_free_enabled && ptr && !IS_ERR(ptr))
for_each_possible_cpu(cpu)
delete_object_full((unsigned long)per_cpu_ptr(ptr,
cpu));
@@ -1743,6 +1745,13 @@ static void kmemleak_do_cleanup(struct work_struct *work)
mutex_lock(&scan_mutex);
stop_scan_thread();
+ /*
+ * Once the scan thread has stopped, it is safe to no longer track
+ * object freeing. Ordering of the scan thread stopping and the memory
+ * accesses below is guaranteed by the kthread_stop() function.
+ */
+ kmemleak_free_enabled = 0;
+
if (!kmemleak_found_leaks)
__kmemleak_do_cleanup();
else
@@ -1769,6 +1778,8 @@ static void kmemleak_disable(void)
/* check whether it is too early for a kernel thread */
if (kmemleak_initialized)
schedule_work(&cleanup_work);
+ else
+ kmemleak_free_enabled = 0;
pr_info("Kernel memory leak detector disabled\n");
}
@@ -1833,8 +1844,10 @@ void __init kmemleak_init(void)
if (kmemleak_error) {
local_irq_restore(flags);
return;
- } else
+ } else {
kmemleak_enabled = 1;
+ kmemleak_free_enabled = 1;
+ }
local_irq_restore(flags);
/*
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 112/185] dell-laptop: Fix allocating & freeing SMI buffer page
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (110 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 111/185] mm: kmemleak: allow safe memory scanning during kmemleak disabling Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 113/185] ALSA: hda - Fix Dock Headphone on Thinkpad X250 seen as a Line Out Luis Henriques
` (72 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Pali Rohár, Darren Hart, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali.rohar@gmail.com>
commit b8830a4e71b15d0364ac8e6c55301eea73f211da upstream.
This commit fix kernel crash when probing for rfkill devices in dell-laptop
driver failed. Function free_page() was incorrectly used on struct page *
instead of virtual address of SMI buffer.
This commit also simplify allocating page for SMI buffer by using
__get_free_page() function instead of sequential call of functions
alloc_page() and page_address().
Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
Acked-by: Michal Hocko <mhocko@suse.cz>
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/platform/x86/dell-laptop.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index fed4111ac31a..1beb232ef03b 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -272,7 +272,6 @@ static struct dmi_system_id dell_quirks[] = {
};
static struct calling_interface_buffer *buffer;
-static struct page *bufferpage;
static DEFINE_MUTEX(buffer_mutex);
static int hwswitch_state;
@@ -825,12 +824,11 @@ static int __init dell_init(void)
* Allocate buffer below 4GB for SMI data--only 32-bit physical addr
* is passed to SMI handler.
*/
- bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32);
- if (!bufferpage) {
+ buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32);
+ if (!buffer) {
ret = -ENOMEM;
goto fail_buffer;
}
- buffer = page_address(bufferpage);
ret = dell_setup_rfkill();
@@ -892,7 +890,7 @@ fail_backlight:
cancel_delayed_work_sync(&dell_rfkill_work);
dell_cleanup_rfkill();
fail_rfkill:
- free_page((unsigned long)bufferpage);
+ free_page((unsigned long)buffer);
fail_buffer:
platform_device_del(platform_device);
fail_platform_device2:
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 113/185] ALSA: hda - Fix Dock Headphone on Thinkpad X250 seen as a Line Out
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (111 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 112/185] dell-laptop: Fix allocating & freeing SMI buffer page Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 114/185] tracing/filter: Do not WARN on operand count going below zero Luis Henriques
` (71 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: David Henningsson, Takashi Iwai, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: David Henningsson <david.henningsson@canonical.com>
commit ec56af67a10a0d82b79027878a81fce08d002d50 upstream.
Thinkpad X250, when attached to a dock, has two headphone outs but
no line out. Make sure we don't try to turn this into one headphone
and one line out (since that disables the headphone amp on the dock).
Alsa-info at http://www.alsa-project.org/db/?f=36f8764e1d782397928feec715d0ef90dfddd4c1
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/pci/hda/patch_realtek.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 9d2aedb84797..1115e8aed237 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4314,6 +4314,7 @@ enum {
ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC,
ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
ALC292_FIXUP_TPT440_DOCK,
+ ALC292_FIXUP_TPT440_DOCK2,
};
static const struct hda_fixup alc269_fixups[] = {
@@ -4738,6 +4739,12 @@ static const struct hda_fixup alc269_fixups[] = {
.chain_id = ALC269_FIXUP_HEADSET_MODE
},
[ALC292_FIXUP_TPT440_DOCK] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
+ .chained = true,
+ .chain_id = ALC292_FIXUP_TPT440_DOCK2
+ },
+ [ALC292_FIXUP_TPT440_DOCK2] = {
.type = HDA_FIXUP_PINS,
.v.pins = (const struct hda_pintbl[]) {
{ 0x16, 0x21211010 }, /* dock headphone */
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 114/185] tracing/filter: Do not WARN on operand count going below zero
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (112 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 113/185] ALSA: hda - Fix Dock Headphone on Thinkpad X250 seen as a Line Out Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 115/185] tracing/filter: Do not allow infix to exceed end of string Luis Henriques
` (70 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Steven Rostedt, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit b4875bbe7e68f139bd3383828ae8e994a0df6d28 upstream.
When testing the fix for the trace filter, I could not come up with
a scenario where the operand count goes below zero, so I added a
WARN_ON_ONCE(cnt < 0) to the logic. But there is legitimate case
that it can happen (although the filter would be wrong).
# echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter
That is, a single operation without any operands will hit the path
where the WARN_ON_ONCE() can trigger. Although this is harmless,
and the filter is reported as a error. But instead of spitting out
a warning to the kernel dmesg, just fail nicely and report it via
the proper channels.
Link: http://lkml.kernel.org/r/558C6082.90608@oracle.com
Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
kernel/trace/trace_events_filter.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index cb347e85f75e..61959fa704ed 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1413,7 +1413,9 @@ static int check_preds(struct filter_parse_state *ps)
continue;
}
n_normal_preds++;
- WARN_ON_ONCE(cnt < 0);
+ /* all ops should have operands */
+ if (cnt < 0)
+ break;
}
if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 115/185] tracing/filter: Do not allow infix to exceed end of string
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (113 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 114/185] tracing/filter: Do not WARN on operand count going below zero Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 116/185] clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier Luis Henriques
` (69 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Steven Rostedt, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 6b88f44e161b9ee2a803e5b2b1fbcf4e20e8b980 upstream.
While debugging a WARN_ON() for filtering, I found that it is possible
for the filter string to be referenced after its end. With the filter:
# echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter
The filter_parse() function can call infix_get_op() which calls
infix_advance() that updates the infix filter pointers for the cnt
and tail without checking if the filter is already at the end, which
will put the cnt to zero and the tail beyond the end. The loop then calls
infix_next() that has
ps->infix.cnt--;
return ps->infix.string[ps->infix.tail++];
The cnt will now be below zero, and the tail that is returned is
already passed the end of the filter string. So far the allocation
of the filter string usually has some buffer that is zeroed out, but
if the filter string is of the exact size of the allocated buffer
there's no guarantee that the charater after the nul terminating
character will be zero.
Luckily, only root can write to the filter.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
kernel/trace/trace_events_filter.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 61959fa704ed..7b244d004d68 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1086,6 +1086,9 @@ static void parse_init(struct filter_parse_state *ps,
static char infix_next(struct filter_parse_state *ps)
{
+ if (!ps->infix.cnt)
+ return 0;
+
ps->infix.cnt--;
return ps->infix.string[ps->infix.tail++];
@@ -1101,6 +1104,9 @@ static char infix_peek(struct filter_parse_state *ps)
static void infix_advance(struct filter_parse_state *ps)
{
+ if (!ps->infix.cnt)
+ return;
+
ps->infix.cnt--;
ps->infix.tail++;
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 116/185] clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (114 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 115/185] tracing/filter: Do not allow infix to exceed end of string Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 117/185] ALSA: hda - Add headset support to Acer Aspire V5 Luis Henriques
` (68 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Damian Eppel, m.szyprowski, kyungmin.park, daniel.lezcano, kgene,
linux-arm-kernel, Thomas Gleixner, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Damian Eppel <d.eppel@samsung.com>
commit 56a94f13919c0db5958611b388e1581b4852f3c9 upstream.
Whilst testing cpu hotplug events on kernel configured with
DEBUG_PREEMPT and DEBUG_ATOMIC_SLEEP we get following BUG message,
caused by calling request_irq() and free_irq() in the context of
hotplug notification (which is in this case atomic context).
[ 40.785859] CPU1: Software reset
[ 40.786660] BUG: sleeping function called from invalid context at mm/slub.c:1241
[ 40.786668] in_atomic(): 1, irqs_disabled(): 128, pid: 0, name: swapper/1
[ 40.786678] Preemption disabled at:[< (null)>] (null)
[ 40.786681]
[ 40.786692] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.19.0-rc4-00024-g7dca860 #36
[ 40.786698] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[ 40.786728] [<c0014a00>] (unwind_backtrace) from [<c0011980>] (show_stack+0x10/0x14)
[ 40.786747] [<c0011980>] (show_stack) from [<c0449ba0>] (dump_stack+0x70/0xbc)
[ 40.786767] [<c0449ba0>] (dump_stack) from [<c00c6124>] (kmem_cache_alloc+0xd8/0x170)
[ 40.786785] [<c00c6124>] (kmem_cache_alloc) from [<c005d6f8>] (request_threaded_irq+0x64/0x128)
[ 40.786804] [<c005d6f8>] (request_threaded_irq) from [<c0350b8c>] (exynos4_local_timer_setup+0xc0/0x13c)
[ 40.786820] [<c0350b8c>] (exynos4_local_timer_setup) from [<c0350ca8>] (exynos4_mct_cpu_notify+0x30/0xa8)
[ 40.786838] [<c0350ca8>] (exynos4_mct_cpu_notify) from [<c003b330>] (notifier_call_chain+0x44/0x84)
[ 40.786857] [<c003b330>] (notifier_call_chain) from [<c0022fd4>] (__cpu_notify+0x28/0x44)
[ 40.786873] [<c0022fd4>] (__cpu_notify) from [<c0013714>] (secondary_start_kernel+0xec/0x150)
[ 40.786886] [<c0013714>] (secondary_start_kernel) from [<40008764>] (0x40008764)
Interrupts cannot be requested/freed in the CPU_STARTING/CPU_DYING
notifications which run on the hotplugged cpu with interrupts and
preemption disabled.
To avoid the issue, request the interrupts for all possible cpus in
the boot code. The interrupts are marked NO_AUTOENABLE to avoid a racy
request_irq/disable_irq() sequence. The flag prevents the
request_irq() code from enabling the interrupt immediately.
The interrupt is then enabled in the CPU_STARTING notifier of the
hotplugged cpu and again disabled with disable_irq_nosync() in the
CPU_DYING notifier.
[ tglx: Massaged changelog to match the patch ]
Fixes: 7114cd749a12 ("clocksource: exynos_mct: use (request/free)_irq calls for local timer registration")
Reported-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Tested-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Tested-by: Marcin Jabrzyk <m.jabrzyk@samsung.com>
Signed-off-by: Damian Eppel <d.eppel@samsung.com>
Cc: m.szyprowski@samsung.com
Cc: kyungmin.park@samsung.com
Cc: daniel.lezcano@linaro.org
Cc: kgene@kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/1435324984-7328-1-git-send-email-d.eppel@samsung.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/clocksource/exynos_mct.c | 43 ++++++++++++++++++++++++++++------------
1 file changed, 30 insertions(+), 13 deletions(-)
diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index 336a60fbabf9..5d1b7f64947c 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -441,15 +441,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
if (mct_int_type == MCT_INT_SPI) {
- evt->irq = mct_irqs[MCT_L0_IRQ + cpu];
- if (request_irq(evt->irq, exynos4_mct_tick_isr,
- IRQF_TIMER | IRQF_NOBALANCING,
- evt->name, mevt)) {
- pr_err("exynos-mct: cannot register IRQ %d\n",
- evt->irq);
+
+ if (evt->irq == -1)
return -EIO;
- }
- irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu));
+
+ irq_force_affinity(evt->irq, cpumask_of(cpu));
+ enable_irq(evt->irq);
} else {
enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
}
@@ -462,10 +459,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
static void exynos4_local_timer_stop(struct clock_event_device *evt)
{
evt->set_mode(CLOCK_EVT_MODE_UNUSED, evt);
- if (mct_int_type == MCT_INT_SPI)
- free_irq(evt->irq, this_cpu_ptr(&percpu_mct_tick));
- else
+ if (mct_int_type == MCT_INT_SPI) {
+ if (evt->irq != -1)
+ disable_irq_nosync(evt->irq);
+ } else {
disable_percpu_irq(mct_irqs[MCT_L0_IRQ]);
+ }
}
static int exynos4_mct_cpu_notify(struct notifier_block *self,
@@ -497,7 +496,7 @@ static struct notifier_block exynos4_mct_cpu_nb = {
static void __init exynos4_timer_resources(struct device_node *np, void __iomem *base)
{
- int err;
+ int err, cpu;
struct mct_clock_event_device *mevt = this_cpu_ptr(&percpu_mct_tick);
struct clk *mct_clk, *tick_clk;
@@ -524,7 +523,25 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem
WARN(err, "MCT: can't request IRQ %d (%d)\n",
mct_irqs[MCT_L0_IRQ], err);
} else {
- irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0));
+ for_each_possible_cpu(cpu) {
+ int mct_irq = mct_irqs[MCT_L0_IRQ + cpu];
+ struct mct_clock_event_device *pcpu_mevt =
+ per_cpu_ptr(&percpu_mct_tick, cpu);
+
+ pcpu_mevt->evt.irq = -1;
+
+ irq_set_status_flags(mct_irq, IRQ_NOAUTOEN);
+ if (request_irq(mct_irq,
+ exynos4_mct_tick_isr,
+ IRQF_TIMER | IRQF_NOBALANCING,
+ pcpu_mevt->name, pcpu_mevt)) {
+ pr_err("exynos-mct: cannot register IRQ (cpu%d)\n",
+ cpu);
+
+ continue;
+ }
+ pcpu_mevt->evt.irq = mct_irq;
+ }
}
err = register_cpu_notifier(&exynos4_mct_cpu_nb);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 117/185] ALSA: hda - Add headset support to Acer Aspire V5
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (115 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 116/185] clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 118/185] ALSA: hda - Fix the dock headphone output on Fujitsu Lifebook E780 Luis Henriques
` (67 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Takashi Iwai, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 7819717b11346b8a5420b223b46600e394049c66 upstream.
Acer Aspire V5 with ALC282 codec needs the similar quirk like Dell
laptops to support the headset mic. The headset mic pin is 0x19 and
it's not exposed by BIOS, thus we need to fix the pincfg as well.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=96201
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/pci/hda/patch_realtek.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 1115e8aed237..1aa3bb74fe06 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4287,6 +4287,7 @@ enum {
ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
ALC269_FIXUP_HEADSET_MODE,
ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC,
+ ALC269_FIXUP_ASPIRE_HEADSET_MIC,
ALC269_FIXUP_ASUS_X101_FUNC,
ALC269_FIXUP_ASUS_X101_VERB,
ALC269_FIXUP_ASUS_X101,
@@ -4539,6 +4540,15 @@ static const struct hda_fixup alc269_fixups[] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc_fixup_headset_mode_no_hp_mic,
},
+ [ALC269_FIXUP_ASPIRE_HEADSET_MIC] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x19, 0x01a1913c }, /* headset mic w/o jack detect */
+ { }
+ },
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MODE,
+ },
[ALC286_FIXUP_SONY_MIC_NO_PRESENCE] = {
.type = HDA_FIXUP_PINS,
.v.pins = (const struct hda_pintbl[]) {
@@ -4761,6 +4771,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC),
SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
SND_PCI_QUIRK(0x1025, 0x047c, "Acer AC700", ALC269_FIXUP_ACER_AC700),
+ SND_PCI_QUIRK(0x1025, 0x072d, "Acer Aspire V5-571G", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK),
SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK),
SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 118/185] ALSA: hda - Fix the dock headphone output on Fujitsu Lifebook E780
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (116 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 117/185] ALSA: hda - Add headset support to Acer Aspire V5 Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 119/185] agp/intel: Fix typo in needs_ilk_vtd_wa() Luis Henriques
` (66 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Takashi Iwai, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 4df3fd1700abbb53bd874143dfd1f9ac9e7cbf4b upstream.
Fujitsu Lifebook E780 sets the sequence number 0x0f to only only of
the two headphones, thus the driver tries to assign another as the
line-out, and this results in the inconsistent mapping between the
created jack ctl and the actual I/O. Due to this, PulseAudio doesn't
handle it properly and gets the silent output.
The fix is to ignore the non-HP sequencer checks.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=99681
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/pci/hda/patch_realtek.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 1aa3bb74fe06..78d333c4a526 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4269,6 +4269,7 @@ enum {
ALC269_FIXUP_LIFEBOOK,
ALC269_FIXUP_LIFEBOOK_EXTMIC,
ALC269_FIXUP_LIFEBOOK_HP_PIN,
+ ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT,
ALC269_FIXUP_AMIC,
ALC269_FIXUP_DMIC,
ALC269VB_FIXUP_AMIC,
@@ -4422,6 +4423,10 @@ static const struct hda_fixup alc269_fixups[] = {
{ }
},
},
+ [ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
+ },
[ALC269_FIXUP_AMIC] = {
.type = HDA_FIXUP_PINS,
.v.pins = (const struct hda_pintbl[]) {
@@ -4898,6 +4903,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x104d, 0x9099, "Sony VAIO S13", ALC275_FIXUP_SONY_DISABLE_AAMIX),
SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
+ SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT),
SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 119/185] agp/intel: Fix typo in needs_ilk_vtd_wa()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (117 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 118/185] ALSA: hda - Fix the dock headphone output on Fujitsu Lifebook E780 Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 120/185] drm/i915: fix backlight after resume on 855gm Luis Henriques
` (65 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Chris Wilson, Daniel Vetter, Jani Nikula, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit 8b572a4200828b4e75cc22ed2f494b58d5372d65 upstream.
In needs_ilk_vtd_wa(), we pass in the GPU device but compared it against
the ids for the mobile GPU and the mobile host bridge. That latter is
impossible and so likely was just a typo for the desktop GPU device id
(which is also buggy).
Fixes commit da88a5f7f7d434e2cde1b3e19d952e6d84533662
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date: Wed Feb 13 09:31:53 2013 +0000
drm/i915: Disable WC PTE updates to w/a buggy IOMMU on ILK
Reported-by: Ting-Wei Lan <lantw44@gmail.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91127
References: https://bugzilla.freedesktop.org/show_bug.cgi?id=60391
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/char/agp/intel-gtt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index 9a024f899dd4..9a99d0a3ff08 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -585,7 +585,7 @@ static inline int needs_ilk_vtd_wa(void)
/* Query intel_iommu to see if we need the workaround. Presumably that
* was loaded first.
*/
- if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB ||
+ if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG ||
gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) &&
intel_iommu_gfx_mapped)
return 1;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 120/185] drm/i915: fix backlight after resume on 855gm
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (118 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 119/185] agp/intel: Fix typo in needs_ilk_vtd_wa() Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 121/185] drm/radeon: compute ring fix hibernation (CI GPU family) v2 Luis Henriques
` (64 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Ville Syrjälä, Jani Nikula, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
commit 2059ac3b1304cb6a82f9d90762dea9f556831627 upstream.
Some 855gm models (at least ThinkPad X40) regressed because of
commit b0cd324faed23d10d66ba6ade66579c681feef6f
Author: Jani Nikula <jani.nikula@intel.com>
Date: Wed Nov 12 16:25:43 2014 +0200
drm/i915: don't save/restore backlight hist ctl registers
which tried to make our driver more robust by not blindly saving and
restoring registers, but it failed to take into account
commit 0eb96d6ed38430b72897adde58f5477a6b71757a
Author: Jesse Barnes <jbarnes@virtuousgeek.org>
Date: Wed Oct 14 12:33:41 2009 -0700
drm/i915: save/restore BLC histogram control reg across suspend/resume
Fix the regression by enabling hist ctl on gen2.
v2: Improved the comment.
v3: Improved the comment, again.
Reported-and-tested-by: Philipp Gesang <phg@phi-gamma.net>
References: http://mid.gmane.org/20150623222648.GD12335@acheron
Fixes: b0cd324faed2 ("drm/i915: don't save/restore backlight hist ctl registers")
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Acked-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/gpu/drm/i915/i915_reg.h | 1 +
drivers/gpu/drm/i915/intel_panel.c | 8 ++++++++
2 files changed, 9 insertions(+)
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index dda970cb01c1..fa0ec5aed9ed 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -2898,6 +2898,7 @@ enum punit_power_well {
#define BLM_POLARITY_PNV (1 << 0) /* pnv only */
#define BLC_HIST_CTL (dev_priv->info.display_mmio_offset + 0x61260)
+#define BLM_HISTOGRAM_ENABLE (1 << 31)
/* New registers for PCH-split platforms. Safe where new bits show up, the
* register layout machtes with gen4 BLC_PWM_CTL[12]. */
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 59b294c5fe41..a25816cb3df1 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -774,6 +774,14 @@ static void i9xx_enable_backlight(struct intel_connector *connector)
/* XXX: combine this into above write? */
intel_panel_actually_set_backlight(connector, panel->backlight.level);
+
+ /*
+ * Needed to enable backlight on some 855gm models. BLC_HIST_CTL is
+ * 855gm only, but checking for gen2 is safe, as 855gm is the only gen2
+ * that has backlight.
+ */
+ if (IS_GEN2(dev))
+ I915_WRITE(BLC_HIST_CTL, BLM_HISTOGRAM_ENABLE);
}
static void i965_enable_backlight(struct intel_connector *connector)
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 121/185] drm/radeon: compute ring fix hibernation (CI GPU family) v2.
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (119 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 120/185] drm/i915: fix backlight after resume on 855gm Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 122/185] drm/radeon: SDMA fix hibernation (CI GPU family) Luis Henriques
` (63 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jérôme Glisse, Alex Deucher, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Glisse?= <jglisse@redhat.com>
commit 161569deaa03cf3c00ed63352006193f250b0648 upstream.
In order for hibernation to reliably work we need to cleanup more
thoroughly the compute ring. Hibernation is different from suspend
resume as when we resume from hibernation the hardware is first
fully initialize by regular kernel then freeze callback happens
(which correspond to a suspend inside the radeon kernel driver)
and turn off each of the block. It turns out we were not cleanly
shutting down the compute ring. This patch fix that.
Hibernation and suspend to ram were tested (several times) on :
Bonaire
Hawaii
Mullins
Kaveri
Kabini
Changed since v1:
- Factor the ring stop logic into a function taking ring as arg.
Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/gpu/drm/radeon/cik.c | 34 ++++++++++++++++++++++++++++++++++
1 file changed, 34 insertions(+)
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 0cf54a4b83bd..6bdaa9500f78 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -4245,6 +4245,31 @@ void cik_compute_set_wptr(struct radeon_device *rdev,
WDOORBELL32(ring->doorbell_index, ring->wptr);
}
+static void cik_compute_stop(struct radeon_device *rdev,
+ struct radeon_ring *ring)
+{
+ u32 j, tmp;
+
+ cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0);
+ /* Disable wptr polling. */
+ tmp = RREG32(CP_PQ_WPTR_POLL_CNTL);
+ tmp &= ~WPTR_POLL_EN;
+ WREG32(CP_PQ_WPTR_POLL_CNTL, tmp);
+ /* Disable HQD. */
+ if (RREG32(CP_HQD_ACTIVE) & 1) {
+ WREG32(CP_HQD_DEQUEUE_REQUEST, 1);
+ for (j = 0; j < rdev->usec_timeout; j++) {
+ if (!(RREG32(CP_HQD_ACTIVE) & 1))
+ break;
+ udelay(1);
+ }
+ WREG32(CP_HQD_DEQUEUE_REQUEST, 0);
+ WREG32(CP_HQD_PQ_RPTR, 0);
+ WREG32(CP_HQD_PQ_WPTR, 0);
+ }
+ cik_srbm_select(rdev, 0, 0, 0, 0);
+}
+
/**
* cik_cp_compute_enable - enable/disable the compute CP MEs
*
@@ -4258,6 +4283,15 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable)
if (enable)
WREG32(CP_MEC_CNTL, 0);
else {
+ /*
+ * To make hibernation reliable we need to clear compute ring
+ * configuration before halting the compute ring.
+ */
+ mutex_lock(&rdev->srbm_mutex);
+ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX]);
+ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX]);
+ mutex_unlock(&rdev->srbm_mutex);
+
WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT));
rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false;
rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 122/185] drm/radeon: SDMA fix hibernation (CI GPU family).
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (120 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 121/185] drm/radeon: compute ring fix hibernation (CI GPU family) v2 Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 123/185] net: mvneta: introduce compatible string "marvell, armada-xp-neta" Luis Henriques
` (62 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jérôme Glisse, Alex Deucher, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Glisse?= <jglisse@redhat.com>
commit 2ba8d1bb8f6b589037f7db1f01144fc80750e8f7 upstream.
In order for hibernation to reliably work we need to properly turn
off the SDMA block, sadly after numerous attemps i haven't not found
proper sequence for clean and full shutdown. So simply reset both
SDMA block, this makes hibernation works reliably on sea island GPU
family (CI)
Hibernation and suspend to ram were tested (several times) on :
Bonaire
Hawaii
Mullins
Kaveri
Kabini
Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/gpu/drm/radeon/cik_sdma.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index 4208ae639407..f3e0d00a2666 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -266,6 +266,17 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev)
}
rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false;
rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false;
+
+ /* FIXME use something else than big hammer but after few days can not
+ * seem to find good combination so reset SDMA blocks as it seems we
+ * do not shut them down properly. This fix hibernation and does not
+ * affect suspend to ram.
+ */
+ WREG32(SRBM_SOFT_RESET, SOFT_RESET_SDMA | SOFT_RESET_SDMA1);
+ (void)RREG32(SRBM_SOFT_RESET);
+ udelay(50);
+ WREG32(SRBM_SOFT_RESET, 0);
+ (void)RREG32(SRBM_SOFT_RESET);
}
/**
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 123/185] net: mvneta: introduce compatible string "marvell, armada-xp-neta"
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (121 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 122/185] drm/radeon: SDMA fix hibernation (CI GPU family) Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 124/185] ARM: mvebu: update Ethernet compatible string for Armada XP Luis Henriques
` (61 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Simon Guinot, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Guinot <simon.guinot@sequanux.org>
commit f522a975a8101895a85354b9c143f41b8248e71a upstream.
The mvneta driver supports the Ethernet IP found in the Armada 370, XP,
380 and 385 SoCs. Since at least one more hardware feature is available
for the Armada XP SoCs then a way to identify them is needed.
This patch introduces a new compatible string "marvell,armada-xp-neta".
Signed-off-by: Simon Guinot <simon.guinot@sequanux.org>
Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP network unit")
Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Acked-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
Documentation/devicetree/bindings/net/marvell-armada-370-neta.txt | 2 +-
drivers/net/ethernet/marvell/mvneta.c | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/Documentation/devicetree/bindings/net/marvell-armada-370-neta.txt b/Documentation/devicetree/bindings/net/marvell-armada-370-neta.txt
index 750d577e8083..f5a8ca29aff0 100644
--- a/Documentation/devicetree/bindings/net/marvell-armada-370-neta.txt
+++ b/Documentation/devicetree/bindings/net/marvell-armada-370-neta.txt
@@ -1,7 +1,7 @@
* Marvell Armada 370 / Armada XP Ethernet Controller (NETA)
Required properties:
-- compatible: should be "marvell,armada-370-neta".
+- compatible: "marvell,armada-370-neta" or "marvell,armada-xp-neta".
- reg: address and length of the register set for the device.
- interrupts: interrupt for the device
- phy: See ethernet.txt file in the same directory.
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 393d49202f23..4456171c885d 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -3096,6 +3096,7 @@ static int mvneta_remove(struct platform_device *pdev)
static const struct of_device_id mvneta_match[] = {
{ .compatible = "marvell,armada-370-neta" },
+ { .compatible = "marvell,armada-xp-neta" },
{ }
};
MODULE_DEVICE_TABLE(of, mvneta_match);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 124/185] ARM: mvebu: update Ethernet compatible string for Armada XP
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (122 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 123/185] net: mvneta: introduce compatible string "marvell, armada-xp-neta" Luis Henriques
@ 2015-07-15 9:11 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 125/185] net: mvneta: disable IP checksum with jumbo frames for Armada 370 Luis Henriques
` (60 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:11 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Simon Guinot, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Guinot <simon.guinot@sequanux.org>
commit ea3b55fe83b5fcede82d183164b9d6831b26e33b upstream.
This patch updates the Ethernet DT nodes for Armada XP SoCs with the
compatible string "marvell,armada-xp-neta".
Signed-off-by: Simon Guinot <simon.guinot@sequanux.org>
Fixes: 77916519cba3 ("arm: mvebu: Armada XP MV78230 has only three Ethernet interfaces")
Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Reviewed-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arm/boot/dts/armada-370-xp.dtsi | 2 --
arch/arm/boot/dts/armada-370.dtsi | 8 ++++++++
arch/arm/boot/dts/armada-xp-mv78260.dtsi | 2 +-
arch/arm/boot/dts/armada-xp-mv78460.dtsi | 2 +-
arch/arm/boot/dts/armada-xp.dtsi | 10 +++++++++-
5 files changed, 19 insertions(+), 5 deletions(-)
diff --git a/arch/arm/boot/dts/armada-370-xp.dtsi b/arch/arm/boot/dts/armada-370-xp.dtsi
index 23227e0027ec..c02e43adadae 100644
--- a/arch/arm/boot/dts/armada-370-xp.dtsi
+++ b/arch/arm/boot/dts/armada-370-xp.dtsi
@@ -225,7 +225,6 @@
};
eth0: ethernet@70000 {
- compatible = "marvell,armada-370-neta";
reg = <0x70000 0x4000>;
interrupts = <8>;
clocks = <&gateclk 4>;
@@ -241,7 +240,6 @@
};
eth1: ethernet@74000 {
- compatible = "marvell,armada-370-neta";
reg = <0x74000 0x4000>;
interrupts = <10>;
clocks = <&gateclk 3>;
diff --git a/arch/arm/boot/dts/armada-370.dtsi b/arch/arm/boot/dts/armada-370.dtsi
index 77d22d82faf5..adcc244b781e 100644
--- a/arch/arm/boot/dts/armada-370.dtsi
+++ b/arch/arm/boot/dts/armada-370.dtsi
@@ -279,6 +279,14 @@
dmacap,memset;
};
};
+
+ ethernet@70000 {
+ compatible = "marvell,armada-370-neta";
+ };
+
+ ethernet@74000 {
+ compatible = "marvell,armada-370-neta";
+ };
};
};
};
diff --git a/arch/arm/boot/dts/armada-xp-mv78260.dtsi b/arch/arm/boot/dts/armada-xp-mv78260.dtsi
index 3396b25b39e1..caae3310ed00 100644
--- a/arch/arm/boot/dts/armada-xp-mv78260.dtsi
+++ b/arch/arm/boot/dts/armada-xp-mv78260.dtsi
@@ -294,7 +294,7 @@
};
eth3: ethernet@34000 {
- compatible = "marvell,armada-370-neta";
+ compatible = "marvell,armada-xp-neta";
reg = <0x34000 0x4000>;
interrupts = <14>;
clocks = <&gateclk 1>;
diff --git a/arch/arm/boot/dts/armada-xp-mv78460.dtsi b/arch/arm/boot/dts/armada-xp-mv78460.dtsi
index 6da84bf40aaf..908d491b1b65 100644
--- a/arch/arm/boot/dts/armada-xp-mv78460.dtsi
+++ b/arch/arm/boot/dts/armada-xp-mv78460.dtsi
@@ -330,7 +330,7 @@
};
eth3: ethernet@34000 {
- compatible = "marvell,armada-370-neta";
+ compatible = "marvell,armada-xp-neta";
reg = <0x34000 0x4000>;
interrupts = <14>;
clocks = <&gateclk 1>;
diff --git a/arch/arm/boot/dts/armada-xp.dtsi b/arch/arm/boot/dts/armada-xp.dtsi
index 5902e8359c91..aa4dad7203b5 100644
--- a/arch/arm/boot/dts/armada-xp.dtsi
+++ b/arch/arm/boot/dts/armada-xp.dtsi
@@ -125,7 +125,7 @@
};
eth2: ethernet@30000 {
- compatible = "marvell,armada-370-neta";
+ compatible = "marvell,armada-xp-neta";
reg = <0x30000 0x4000>;
interrupts = <12>;
clocks = <&gateclk 2>;
@@ -168,6 +168,14 @@
};
};
+ ethernet@70000 {
+ compatible = "marvell,armada-xp-neta";
+ };
+
+ ethernet@74000 {
+ compatible = "marvell,armada-xp-neta";
+ };
+
xor@f0900 {
compatible = "marvell,orion-xor";
reg = <0xF0900 0x100
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 125/185] net: mvneta: disable IP checksum with jumbo frames for Armada 370
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (123 preceding siblings ...)
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 124/185] ARM: mvebu: update Ethernet compatible string for Armada XP Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 126/185] crush: fix a bug in tree bucket decode Luis Henriques
` (59 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Simon Guinot, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Guinot <simon.guinot@sequanux.org>
commit b65657fc240ae6c1d2a1e62db9a0e61ac9631d7a upstream.
The Ethernet controller found in the Armada 370, 380 and 385 SoCs don't
support TCP/IP checksumming with frame sizes larger than 1600 bytes.
This patch fixes the issue by disabling the features NETIF_F_IP_CSUM and
NETIF_F_TSO for the Armada 370 and compatibles SoCs when the MTU is set
to a value greater than 1600 bytes.
Signed-off-by: Simon Guinot <simon.guinot@sequanux.org>
Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP network unit")
Acked-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/ethernet/marvell/mvneta.c | 26 +++++++++++++++++++++++++-
1 file changed, 25 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 4456171c885d..807fbdc4b21b 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -303,6 +303,7 @@ struct mvneta_port {
unsigned int link;
unsigned int duplex;
unsigned int speed;
+ unsigned int tx_csum_limit;
};
/* The mvneta_tx_desc and mvneta_rx_desc structures describe the
@@ -2439,8 +2440,10 @@ static int mvneta_change_mtu(struct net_device *dev, int mtu)
dev->mtu = mtu;
- if (!netif_running(dev))
+ if (!netif_running(dev)) {
+ netdev_update_features(dev);
return 0;
+ }
/* The interface is running, so we have to force a
* reallocation of the queues
@@ -2469,9 +2472,26 @@ static int mvneta_change_mtu(struct net_device *dev, int mtu)
mvneta_start_dev(pp);
mvneta_port_up(pp);
+ netdev_update_features(dev);
+
return 0;
}
+static netdev_features_t mvneta_fix_features(struct net_device *dev,
+ netdev_features_t features)
+{
+ struct mvneta_port *pp = netdev_priv(dev);
+
+ if (pp->tx_csum_limit && dev->mtu > pp->tx_csum_limit) {
+ features &= ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
+ netdev_info(dev,
+ "Disable IP checksum for MTU greater than %dB\n",
+ pp->tx_csum_limit);
+ }
+
+ return features;
+}
+
/* Get mac address */
static void mvneta_get_mac_addr(struct mvneta_port *pp, unsigned char *addr)
{
@@ -2789,6 +2809,7 @@ static const struct net_device_ops mvneta_netdev_ops = {
.ndo_set_rx_mode = mvneta_set_rx_mode,
.ndo_set_mac_address = mvneta_set_mac_addr,
.ndo_change_mtu = mvneta_change_mtu,
+ .ndo_fix_features = mvneta_fix_features,
.ndo_get_stats64 = mvneta_get_stats64,
.ndo_do_ioctl = mvneta_ioctl,
};
@@ -3027,6 +3048,9 @@ static int mvneta_probe(struct platform_device *pdev)
}
}
+ if (of_device_is_compatible(dn, "marvell,armada-370-neta"))
+ pp->tx_csum_limit = 1600;
+
pp->tx_ring_size = MVNETA_MAX_TXD;
pp->rx_ring_size = MVNETA_MAX_RXD;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 126/185] crush: fix a bug in tree bucket decode
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (124 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 125/185] net: mvneta: disable IP checksum with jumbo frames for Armada 370 Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 127/185] rbd: use GFP_NOIO in rbd_obj_request_create() Luis Henriques
` (58 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Ilya Dryomov, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <idryomov@gmail.com>
commit 82cd003a77173c91b9acad8033fb7931dac8d751 upstream.
struct crush_bucket_tree::num_nodes is u8, so ceph_decode_8_safe()
should be used. -Wconversion catches this, but I guess it went
unnoticed in all the noise it spews. The actual problem (at least for
common crushmaps) isn't the u32 -> u8 truncation though - it's the
advancement by 4 bytes instead of 1 in the crushmap buffer.
Fixes: http://tracker.ceph.com/issues/2759
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Josh Durgin <jdurgin@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/ceph/osdmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index c547e46084d3..5740f71b609d 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void **p, void *end,
{
int j;
dout("crush_decode_tree_bucket %p to %p\n", *p, end);
- ceph_decode_32_safe(p, end, b->num_nodes, bad);
+ ceph_decode_8_safe(p, end, b->num_nodes, bad);
b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
if (b->node_weights == NULL)
return -ENOMEM;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 127/185] rbd: use GFP_NOIO in rbd_obj_request_create()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (125 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 126/185] crush: fix a bug in tree bucket decode Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 128/185] arm64: Don't report clear pmds and puds as huge Luis Henriques
` (57 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Ilya Dryomov, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <idryomov@gmail.com>
commit 5a60e87603c4c533492c515b7f62578189b03c9c upstream.
rbd_obj_request_create() is called on the main I/O path, so we need to
use GFP_NOIO to make sure allocation doesn't blow back on us. Not all
callers need this, but I'm still hardcoding the flag inside rather than
making it a parameter because a) this is going to stable, and b) those
callers shouldn't really use rbd_obj_request_create() and will be fixed
in the future.
More memory allocation fixes will follow.
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/block/rbd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index f017d1964eb6..b3fdc1b7ea76 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -1909,11 +1909,11 @@ static struct rbd_obj_request *rbd_obj_request_create(const char *object_name,
rbd_assert(obj_request_type_valid(type));
size = strlen(object_name) + 1;
- name = kmalloc(size, GFP_KERNEL);
+ name = kmalloc(size, GFP_NOIO);
if (!name)
return NULL;
- obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_KERNEL);
+ obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_NOIO);
if (!obj_request) {
kfree(name);
return NULL;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 128/185] arm64: Don't report clear pmds and puds as huge
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (126 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 127/185] rbd: use GFP_NOIO in rbd_obj_request_create() Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 129/185] fuse: initialize fc->release before calling it Luis Henriques
` (56 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Christoffer Dall, Catalin Marinas, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Dall <christoffer.dall@linaro.org>
commit fd28f5d439fca77348c129d5b73043a56f8a0296 upstream.
The current pmd_huge() and pud_huge() functions simply check if the table
bit is not set and reports the entries as huge in that case. This is
counter-intuitive as a clear pmd/pud cannot also be a huge pmd/pud, and
it is inconsistent with at least arm and x86.
To prevent others from making the same mistake as me in looking at code
that calls these functions and to fix an issue with KVM on arm64 that
causes memory corruption due to incorrect page reference counting
resulting from this mistake, let's change the behavior.
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Reviewed-by: Steve Capper <steve.capper@linaro.org>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Fixes: 084bd29810a5 ("ARM64: mm: HugeTLB support.")
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arm64/mm/hugetlbpage.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 023747bf4dd7..e3a24b75e53c 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -46,13 +46,13 @@ struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
int pmd_huge(pmd_t pmd)
{
- return !(pmd_val(pmd) & PMD_TABLE_BIT);
+ return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
}
int pud_huge(pud_t pud)
{
#ifndef __PAGETABLE_PMD_FOLDED
- return !(pud_val(pud) & PUD_TABLE_BIT);
+ return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
#else
return 0;
#endif
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 129/185] fuse: initialize fc->release before calling it
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (127 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 128/185] arm64: Don't report clear pmds and puds as huge Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 130/185] vfs: Ignore unlocked mounts in fs_fully_visible Luis Henriques
` (55 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Miklos Szeredi, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@suse.cz>
commit 0ad0b3255a08020eaf50e34ef0d6df5bdf5e09ed upstream.
fc->release is called from fuse_conn_put() which was used in the error
cleanup before fc->release was initialized.
[Jeremiah Mahler <jmmahler@gmail.com>: assign fc->release after calling
fuse_conn_init(fc) instead of before.]
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Fixes: a325f9b92273 ("fuse: update fuse_conn_init() and separate out fuse_conn_kill()")
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/fuse/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 03246cd9d47a..9e3f6cfee2fb 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -1049,6 +1049,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
goto err_fput;
fuse_conn_init(fc);
+ fc->release = fuse_free_conn;
fc->dev = sb->s_dev;
fc->sb = sb;
@@ -1063,7 +1064,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
fc->dont_mask = 1;
sb->s_flags |= MS_POSIXACL;
- fc->release = fuse_free_conn;
fc->flags = d.flags;
fc->user_id = d.user_id;
fc->group_id = d.group_id;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 130/185] vfs: Ignore unlocked mounts in fs_fully_visible
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (128 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 129/185] fuse: initialize fc->release before calling it Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 131/185] VFS: Introduce inode-getting helpers for layered/unioned fs environments Luis Henriques
` (54 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Eric W. Biederman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit ceeb0e5d39fcdf4dca2c997bf225c7fc49200b37 upstream.
Limit the mounts fs_fully_visible considers to locked mounts.
Unlocked can always be unmounted so considering them adds hassle
but no security benefit.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/namespace.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index 8f76be393012..efd13c26ad9c 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3064,11 +3064,15 @@ static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags)
((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK)))
continue;
- /* This mount is not fully visible if there are any child mounts
- * that cover anything except for empty directories.
+ /* This mount is not fully visible if there are any
+ * locked child mounts that cover anything except for
+ * empty directories.
*/
list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
struct inode *inode = child->mnt_mountpoint->d_inode;
+ /* Only worry about locked mounts */
+ if (!(mnt->mnt.mnt_flags & MNT_LOCKED))
+ continue;
if (!S_ISDIR(inode->i_mode))
goto next;
if (inode->i_nlink > 2)
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 131/185] VFS: Introduce inode-getting helpers for layered/unioned fs environments
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (129 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 130/185] vfs: Ignore unlocked mounts in fs_fully_visible Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 132/185] fs: Add helper functions for permanently empty directories Luis Henriques
` (53 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: David Howells, Al Viro, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 155e35d4daa804582f75acaa2c74ec797a89c615 upstream.
Introduce some function for getting the inode (and also the dentry) in an
environment where layered/unioned filesystems are in operation.
The problem is that we have places where we need *both* the union dentry and
the lower source or workspace inode or dentry available, but we can only have
a handle on one of them. Therefore we need to derive the handle to the other
from that.
The idea is to introduce an extra field in struct dentry that allows the union
dentry to refer to and pin the lower dentry.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[ luis: 3.16 prereq for:
fbabfd0f4ee2 "fs: Add helper functions for permanently empty directories." ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
include/linux/dcache.h | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 57 insertions(+)
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index 6cddc8708a95..3597f13088a8 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -473,4 +473,61 @@ static inline unsigned long vfs_pressure_ratio(unsigned long val)
{
return mult_frac(val, sysctl_vfs_cache_pressure, 100);
}
+
+/**
+ * d_inode - Get the actual inode of this dentry
+ * @dentry: The dentry to query
+ *
+ * This is the helper normal filesystems should use to get at their own inodes
+ * in their own dentries and ignore the layering superimposed upon them.
+ */
+static inline struct inode *d_inode(const struct dentry *dentry)
+{
+ return dentry->d_inode;
+}
+
+/**
+ * d_inode_rcu - Get the actual inode of this dentry with ACCESS_ONCE()
+ * @dentry: The dentry to query
+ *
+ * This is the helper normal filesystems should use to get at their own inodes
+ * in their own dentries and ignore the layering superimposed upon them.
+ */
+static inline struct inode *d_inode_rcu(const struct dentry *dentry)
+{
+ return ACCESS_ONCE(dentry->d_inode);
+}
+
+/**
+ * d_backing_inode - Get upper or lower inode we should be using
+ * @upper: The upper layer
+ *
+ * This is the helper that should be used to get at the inode that will be used
+ * if this dentry were to be opened as a file. The inode may be on the upper
+ * dentry or it may be on a lower dentry pinned by the upper.
+ *
+ * Normal filesystems should not use this to access their own inodes.
+ */
+static inline struct inode *d_backing_inode(const struct dentry *upper)
+{
+ struct inode *inode = upper->d_inode;
+
+ return inode;
+}
+
+/**
+ * d_backing_dentry - Get upper or lower dentry we should be using
+ * @upper: The upper layer
+ *
+ * This is the helper that should be used to get the dentry of the inode that
+ * will be used if this dentry were opened as a file. It may be the upper
+ * dentry or it may be a lower dentry pinned by the upper.
+ *
+ * Normal filesystems should not use this to access their own dentries.
+ */
+static inline struct dentry *d_backing_dentry(struct dentry *upper)
+{
+ return upper;
+}
+
#endif /* __LINUX_DCACHE_H */
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 132/185] fs: Add helper functions for permanently empty directories.
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (130 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 131/185] VFS: Introduce inode-getting helpers for layered/unioned fs environments Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 133/185] sysctl: Allow creating permanently empty directories that serve as mountpoints Luis Henriques
` (52 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Eric W. Biederman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit fbabfd0f4ee2e8847bf56edf481249ad1bb8c44d upstream.
To ensure it is safe to mount proc and sysfs I need to check if
filesystems that are mounted on top of them are mounted on truly empty
directories. Given that some directories can gain entries over time,
knowing that a directory is empty right now is insufficient.
Therefore add supporting infrastructure for permantently empty
directories that proc and sysfs can use when they create mount points
for filesystems and fs_fully_visible can use to test for permanently
empty directories to ensure that nothing will be gained by mounting a
fresh copy of proc or sysfs.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/libfs.c | 96 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
include/linux/fs.h | 2 ++
2 files changed, 98 insertions(+)
diff --git a/fs/libfs.c b/fs/libfs.c
index e801b983b46b..c4c5f7223477 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -1075,3 +1075,99 @@ struct inode *alloc_anon_inode(struct super_block *s)
return inode;
}
EXPORT_SYMBOL(alloc_anon_inode);
+
+
+/*
+ * Operations for a permanently empty directory.
+ */
+static struct dentry *empty_dir_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags)
+{
+ return ERR_PTR(-ENOENT);
+}
+
+static int empty_dir_getattr(struct vfsmount *mnt, struct dentry *dentry,
+ struct kstat *stat)
+{
+ struct inode *inode = d_inode(dentry);
+ generic_fillattr(inode, stat);
+ return 0;
+}
+
+static int empty_dir_setattr(struct dentry *dentry, struct iattr *attr)
+{
+ return -EPERM;
+}
+
+static int empty_dir_setxattr(struct dentry *dentry, const char *name,
+ const void *value, size_t size, int flags)
+{
+ return -EOPNOTSUPP;
+}
+
+static ssize_t empty_dir_getxattr(struct dentry *dentry, const char *name,
+ void *value, size_t size)
+{
+ return -EOPNOTSUPP;
+}
+
+static int empty_dir_removexattr(struct dentry *dentry, const char *name)
+{
+ return -EOPNOTSUPP;
+}
+
+static ssize_t empty_dir_listxattr(struct dentry *dentry, char *list, size_t size)
+{
+ return -EOPNOTSUPP;
+}
+
+static const struct inode_operations empty_dir_inode_operations = {
+ .lookup = empty_dir_lookup,
+ .permission = generic_permission,
+ .setattr = empty_dir_setattr,
+ .getattr = empty_dir_getattr,
+ .setxattr = empty_dir_setxattr,
+ .getxattr = empty_dir_getxattr,
+ .removexattr = empty_dir_removexattr,
+ .listxattr = empty_dir_listxattr,
+};
+
+static loff_t empty_dir_llseek(struct file *file, loff_t offset, int whence)
+{
+ /* An empty directory has two entries . and .. at offsets 0 and 1 */
+ return generic_file_llseek_size(file, offset, whence, 2, 2);
+}
+
+static int empty_dir_readdir(struct file *file, struct dir_context *ctx)
+{
+ dir_emit_dots(file, ctx);
+ return 0;
+}
+
+static const struct file_operations empty_dir_operations = {
+ .llseek = empty_dir_llseek,
+ .read = generic_read_dir,
+ .iterate = empty_dir_readdir,
+ .fsync = noop_fsync,
+};
+
+
+void make_empty_dir_inode(struct inode *inode)
+{
+ set_nlink(inode, 2);
+ inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO;
+ inode->i_uid = GLOBAL_ROOT_UID;
+ inode->i_gid = GLOBAL_ROOT_GID;
+ inode->i_rdev = 0;
+ inode->i_size = 2;
+ inode->i_blkbits = PAGE_SHIFT;
+ inode->i_blocks = 0;
+
+ inode->i_op = &empty_dir_inode_operations;
+ inode->i_fop = &empty_dir_operations;
+}
+
+bool is_empty_dir_inode(struct inode *inode)
+{
+ return (inode->i_fop == &empty_dir_operations) &&
+ (inode->i_op == &empty_dir_inode_operations);
+}
diff --git a/include/linux/fs.h b/include/linux/fs.h
index abbd77a27f3d..9bd6f37d885a 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2590,6 +2590,8 @@ extern struct dentry *simple_lookup(struct inode *, struct dentry *, unsigned in
extern ssize_t generic_read_dir(struct file *, char __user *, size_t, loff_t *);
extern const struct file_operations simple_dir_operations;
extern const struct inode_operations simple_dir_inode_operations;
+extern void make_empty_dir_inode(struct inode *inode);
+extern bool is_empty_dir_inode(struct inode *inode);
struct tree_descr { char *name; const struct file_operations *ops; int mode; };
struct dentry *d_alloc_name(struct dentry *, const char *);
extern int simple_fill_super(struct super_block *, unsigned long, struct tree_descr *);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 133/185] sysctl: Allow creating permanently empty directories that serve as mountpoints.
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (131 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 132/185] fs: Add helper functions for permanently empty directories Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 134/185] proc: Allow creating permanently empty directories that serve as mount points Luis Henriques
` (51 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Eric W. Biederman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit f9bd6733d3f11e24f3949becf277507d422ee1eb upstream.
Add a magic sysctl table sysctl_mount_point that when used to
create a directory forces that directory to be permanently empty.
Update the code to use make_empty_dir_inode when accessing permanently
empty directories.
Update the code to not allow adding to permanently empty directories.
Update /proc/sys/fs/binfmt_misc to be a permanently empty directory.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/proc/proc_sysctl.c | 37 +++++++++++++++++++++++++++++++++++++
include/linux/sysctl.h | 3 +++
kernel/sysctl.c | 8 +-------
3 files changed, 41 insertions(+), 7 deletions(-)
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 71290463a1d3..b45db1ddb8e0 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -19,6 +19,28 @@ static const struct inode_operations proc_sys_inode_operations;
static const struct file_operations proc_sys_dir_file_operations;
static const struct inode_operations proc_sys_dir_operations;
+/* Support for permanently empty directories */
+
+struct ctl_table sysctl_mount_point[] = {
+ { }
+};
+
+static bool is_empty_dir(struct ctl_table_header *head)
+{
+ return head->ctl_table[0].child == sysctl_mount_point;
+}
+
+static void set_empty_dir(struct ctl_dir *dir)
+{
+ dir->header.ctl_table[0].child = sysctl_mount_point;
+}
+
+static void clear_empty_dir(struct ctl_dir *dir)
+
+{
+ dir->header.ctl_table[0].child = NULL;
+}
+
void proc_sys_poll_notify(struct ctl_table_poll *poll)
{
if (!poll)
@@ -187,6 +209,17 @@ static int insert_header(struct ctl_dir *dir, struct ctl_table_header *header)
struct ctl_table *entry;
int err;
+ /* Is this a permanently empty directory? */
+ if (is_empty_dir(&dir->header))
+ return -EROFS;
+
+ /* Am I creating a permanently empty directory? */
+ if (header->ctl_table == sysctl_mount_point) {
+ if (!RB_EMPTY_ROOT(&dir->root))
+ return -EINVAL;
+ set_empty_dir(dir);
+ }
+
dir->header.nreg++;
header->parent = dir;
err = insert_links(header);
@@ -202,6 +235,8 @@ fail:
erase_header(header);
put_links(header);
fail_links:
+ if (header->ctl_table == sysctl_mount_point)
+ clear_empty_dir(dir);
header->parent = NULL;
drop_sysctl_table(&dir->header);
return err;
@@ -419,6 +454,8 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
inode->i_mode |= S_IFDIR;
inode->i_op = &proc_sys_dir_operations;
inode->i_fop = &proc_sys_dir_file_operations;
+ if (is_empty_dir(head))
+ make_empty_dir_inode(inode);
}
out:
return inode;
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 14a8ff2de11e..07e597b8802f 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -190,6 +190,9 @@ struct ctl_table_header *register_sysctl_paths(const struct ctl_path *path,
void unregister_sysctl_table(struct ctl_table_header * table);
extern int sysctl_init(void);
+
+extern struct ctl_table sysctl_mount_point[];
+
#else /* CONFIG_SYSCTL */
static inline struct ctl_table_header *register_sysctl_table(struct ctl_table * table)
{
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 75b22e22a72c..344788eba906 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1507,12 +1507,6 @@ static struct ctl_table vm_table[] = {
{ }
};
-#if defined(CONFIG_BINFMT_MISC) || defined(CONFIG_BINFMT_MISC_MODULE)
-static struct ctl_table binfmt_misc_table[] = {
- { }
-};
-#endif
-
static struct ctl_table fs_table[] = {
{
.procname = "inode-nr",
@@ -1666,7 +1660,7 @@ static struct ctl_table fs_table[] = {
{
.procname = "binfmt_misc",
.mode = 0555,
- .child = binfmt_misc_table,
+ .child = sysctl_mount_point,
},
#endif
{
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 134/185] proc: Allow creating permanently empty directories that serve as mount points
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (132 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 133/185] sysctl: Allow creating permanently empty directories that serve as mountpoints Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 135/185] kernfs: Add support for always empty directories Luis Henriques
` (50 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Eric W. Biederman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit eb6d38d5427b3ad42f5268da0f1dd31bb0af1264 upstream.
Add a new function proc_create_mount_point that when used to creates a
directory that can not be added to.
Add a new function is_empty_pde to test if a function is a mount
point.
Update the code to use make_empty_dir_inode when reporting
a permanently empty directory to the vfs.
Update the code to not allow adding to permanently empty directories.
Update /proc/openprom and /proc/fs/nfsd to be permanently empty directories.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/proc/generic.c | 24 ++++++++++++++++++++++++
fs/proc/inode.c | 4 ++++
fs/proc/internal.h | 6 ++++++
fs/proc/root.c | 4 ++--
4 files changed, 36 insertions(+), 2 deletions(-)
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 2e2d9d5d78d9..c18d9b05cea9 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -334,6 +334,11 @@ static struct proc_dir_entry *__proc_create(struct proc_dir_entry **parent,
len = strlen(fn);
+ if (is_empty_pde(*parent)) {
+ WARN(1, "attempt to add to permanently empty directory");
+ return NULL;
+ }
+
ent = kzalloc(sizeof(struct proc_dir_entry) + len + 1, GFP_KERNEL);
if (!ent)
goto out;
@@ -409,6 +414,25 @@ struct proc_dir_entry *proc_mkdir(const char *name,
}
EXPORT_SYMBOL(proc_mkdir);
+struct proc_dir_entry *proc_create_mount_point(const char *name)
+{
+ umode_t mode = S_IFDIR | S_IRUGO | S_IXUGO;
+ struct proc_dir_entry *ent, *parent = NULL;
+
+ ent = __proc_create(&parent, name, mode, 2);
+ if (ent) {
+ ent->data = NULL;
+ ent->proc_fops = NULL;
+ ent->proc_iops = NULL;
+ if (proc_register(parent, ent) < 0) {
+ kfree(ent);
+ parent->nlink--;
+ ent = NULL;
+ }
+ }
+ return ent;
+}
+
struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
struct proc_dir_entry *parent,
const struct file_operations *proc_fops,
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 965b82e61570..6582583201ee 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -431,6 +431,10 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
PROC_I(inode)->pde = de;
+ if (is_empty_pde(de)) {
+ make_empty_dir_inode(inode);
+ return inode;
+ }
if (de->mode) {
inode->i_mode = de->mode;
inode->i_uid = de->uid;
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index 8b24f3640cd9..e62c247b46cc 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -193,6 +193,12 @@ static inline struct proc_dir_entry *pde_get(struct proc_dir_entry *pde)
}
extern void pde_put(struct proc_dir_entry *);
+static inline bool is_empty_pde(const struct proc_dir_entry *pde)
+{
+ return S_ISDIR(pde->mode) && !pde->proc_iops;
+}
+struct proc_dir_entry *proc_create_mount_point(const char *name);
+
/*
* inode.c
*/
diff --git a/fs/proc/root.c b/fs/proc/root.c
index 7fd8c1f1b1d9..dd77e1483196 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -176,10 +176,10 @@ void __init proc_root_init(void)
#endif
proc_mkdir("fs", NULL);
proc_mkdir("driver", NULL);
- proc_mkdir("fs/nfsd", NULL); /* somewhere for the nfsd filesystem to be mounted */
+ proc_create_mount_point("fs/nfsd"); /* somewhere for the nfsd filesystem to be mounted */
#if defined(CONFIG_SUN_OPENPROMFS) || defined(CONFIG_SUN_OPENPROMFS_MODULE)
/* just give it a mountpoint */
- proc_mkdir("openprom", NULL);
+ proc_create_mount_point("openprom");
#endif
proc_tty_init();
proc_mkdir("bus", NULL);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 135/185] kernfs: Add support for always empty directories.
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (133 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 134/185] proc: Allow creating permanently empty directories that serve as mount points Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 136/185] sysfs: Add support for permanently empty directories to serve as mount points Luis Henriques
` (49 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Eric W. Biederman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit ea015218f2f7ace2dad9cedd21ed95bdba2886d7 upstream.
Add a new function kernfs_create_empty_dir that can be used to create
directory that can not be modified.
Update the code to use make_empty_dir_inode when reporting a
permanently empty directory to the vfs.
Update the code to not allow adding to permanently empty directories.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/kernfs/dir.c | 38 +++++++++++++++++++++++++++++++++++++-
fs/kernfs/inode.c | 2 ++
include/linux/kernfs.h | 3 +++
3 files changed, 42 insertions(+), 1 deletion(-)
diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
index a693f5b01ae6..6309457847cd 100644
--- a/fs/kernfs/dir.c
+++ b/fs/kernfs/dir.c
@@ -594,6 +594,9 @@ int kernfs_add_one(struct kernfs_node *kn)
goto out_unlock;
ret = -ENOENT;
+ if (parent->flags & KERNFS_EMPTY_DIR)
+ goto out_unlock;
+
if ((parent->flags & KERNFS_ACTIVATED) && !kernfs_active(parent))
goto out_unlock;
@@ -785,6 +788,38 @@ struct kernfs_node *kernfs_create_dir_ns(struct kernfs_node *parent,
return ERR_PTR(rc);
}
+/**
+ * kernfs_create_empty_dir - create an always empty directory
+ * @parent: parent in which to create a new directory
+ * @name: name of the new directory
+ *
+ * Returns the created node on success, ERR_PTR() value on failure.
+ */
+struct kernfs_node *kernfs_create_empty_dir(struct kernfs_node *parent,
+ const char *name)
+{
+ struct kernfs_node *kn;
+ int rc;
+
+ /* allocate */
+ kn = kernfs_new_node(parent, name, S_IRUGO|S_IXUGO|S_IFDIR, KERNFS_DIR);
+ if (!kn)
+ return ERR_PTR(-ENOMEM);
+
+ kn->flags |= KERNFS_EMPTY_DIR;
+ kn->dir.root = parent->dir.root;
+ kn->ns = NULL;
+ kn->priv = NULL;
+
+ /* link in */
+ rc = kernfs_add_one(kn);
+ if (!rc)
+ return kn;
+
+ kernfs_put(kn);
+ return ERR_PTR(rc);
+}
+
static struct dentry *kernfs_iop_lookup(struct inode *dir,
struct dentry *dentry,
unsigned int flags)
@@ -1256,7 +1291,8 @@ int kernfs_rename_ns(struct kernfs_node *kn, struct kernfs_node *new_parent,
mutex_lock(&kernfs_mutex);
error = -ENOENT;
- if (!kernfs_active(kn) || !kernfs_active(new_parent))
+ if (!kernfs_active(kn) || !kernfs_active(new_parent) ||
+ (new_parent->flags & KERNFS_EMPTY_DIR))
goto out;
error = 0;
diff --git a/fs/kernfs/inode.c b/fs/kernfs/inode.c
index 985217626e66..5b8ab29494b7 100644
--- a/fs/kernfs/inode.c
+++ b/fs/kernfs/inode.c
@@ -309,6 +309,8 @@ static void kernfs_init_inode(struct kernfs_node *kn, struct inode *inode)
case KERNFS_DIR:
inode->i_op = &kernfs_dir_iops;
inode->i_fop = &kernfs_dir_fops;
+ if (kn->flags & KERNFS_EMPTY_DIR)
+ make_empty_dir_inode(inode);
break;
case KERNFS_FILE:
inode->i_size = kn->attr.size;
diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h
index 30faf797c2c3..6658ff53203e 100644
--- a/include/linux/kernfs.h
+++ b/include/linux/kernfs.h
@@ -46,6 +46,7 @@ enum kernfs_node_flag {
KERNFS_STATIC_NAME = 0x0200,
KERNFS_SUICIDAL = 0x0400,
KERNFS_SUICIDED = 0x0800,
+ KERNFS_EMPTY_DIR = 0x1000,
};
/* @flags for kernfs_create_root() */
@@ -278,6 +279,8 @@ void kernfs_destroy_root(struct kernfs_root *root);
struct kernfs_node *kernfs_create_dir_ns(struct kernfs_node *parent,
const char *name, umode_t mode,
void *priv, const void *ns);
+struct kernfs_node *kernfs_create_empty_dir(struct kernfs_node *parent,
+ const char *name);
struct kernfs_node *__kernfs_create_file(struct kernfs_node *parent,
const char *name,
umode_t mode, loff_t size,
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 136/185] sysfs: Add support for permanently empty directories to serve as mount points.
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (134 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 135/185] kernfs: Add support for always empty directories Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 137/185] mnt: Update fs_fully_visible to test for permanently empty directories Luis Henriques
` (48 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Eric W. Biederman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit 87d2846fcf88113fae2341da1ca9a71f0d916f2c upstream.
Add two functions sysfs_create_mount_point and
sysfs_remove_mount_point that hang a permanently empty directory off
of a kobject or remove a permanently emptpy directory hanging from a
kobject. Export these new functions so modular filesystems can use
them.
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/sysfs/dir.c | 34 ++++++++++++++++++++++++++++++++++
include/linux/sysfs.h | 15 +++++++++++++++
2 files changed, 49 insertions(+)
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 0b45ff42f374..94374e435025 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -121,3 +121,37 @@ int sysfs_move_dir_ns(struct kobject *kobj, struct kobject *new_parent_kobj,
return kernfs_rename_ns(kn, new_parent, kn->name, new_ns);
}
+
+/**
+ * sysfs_create_mount_point - create an always empty directory
+ * @parent_kobj: kobject that will contain this always empty directory
+ * @name: The name of the always empty directory to add
+ */
+int sysfs_create_mount_point(struct kobject *parent_kobj, const char *name)
+{
+ struct kernfs_node *kn, *parent = parent_kobj->sd;
+
+ kn = kernfs_create_empty_dir(parent, name);
+ if (IS_ERR(kn)) {
+ if (PTR_ERR(kn) == -EEXIST)
+ sysfs_warn_dup(parent, name);
+ return PTR_ERR(kn);
+ }
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(sysfs_create_mount_point);
+
+/**
+ * sysfs_remove_mount_point - remove an always empty directory.
+ * @parent_kobj: kobject that will contain this always empty directory
+ * @name: The name of the always empty directory to remove
+ *
+ */
+void sysfs_remove_mount_point(struct kobject *parent_kobj, const char *name)
+{
+ struct kernfs_node *parent = parent_kobj->sd;
+
+ kernfs_remove_by_name_ns(parent, name, NULL);
+}
+EXPORT_SYMBOL_GPL(sysfs_remove_mount_point);
diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
index f97d0dbb59fa..8ce4e648efc1 100644
--- a/include/linux/sysfs.h
+++ b/include/linux/sysfs.h
@@ -186,6 +186,10 @@ int __must_check sysfs_rename_dir_ns(struct kobject *kobj, const char *new_name,
int __must_check sysfs_move_dir_ns(struct kobject *kobj,
struct kobject *new_parent_kobj,
const void *new_ns);
+int __must_check sysfs_create_mount_point(struct kobject *parent_kobj,
+ const char *name);
+void sysfs_remove_mount_point(struct kobject *parent_kobj,
+ const char *name);
int __must_check sysfs_create_file_ns(struct kobject *kobj,
const struct attribute *attr,
@@ -274,6 +278,17 @@ static inline int sysfs_move_dir_ns(struct kobject *kobj,
return 0;
}
+static inline int sysfs_create_mount_point(struct kobject *parent_kobj,
+ const char *name)
+{
+ return 0;
+}
+
+static inline void sysfs_remove_mount_point(struct kobject *parent_kobj,
+ const char *name)
+{
+}
+
static inline int sysfs_create_file_ns(struct kobject *kobj,
const struct attribute *attr,
const void *ns)
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 137/185] mnt: Update fs_fully_visible to test for permanently empty directories
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (135 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 136/185] sysfs: Add support for permanently empty directories to serve as mount points Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 138/185] vfs: Remove incorrect debugging WARN in prepend_path Luis Henriques
` (47 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Eric W. Biederman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit 7236c85e1be51a9e25ba0f6e087a66ca89605a49 upstream.
fs_fully_visible attempts to make fresh mounts of proc and sysfs give
the mounter no more access to proc and sysfs than if they could have
by creating a bind mount. One aspect of proc and sysfs that makes
this particularly tricky is that there are other filesystems that
typically mount on top of proc and sysfs. As those filesystems are
mounted on empty directories in practice it is safe to ignore them.
However testing to ensure filesystems are mounted on empty directories
has not been something the in kernel data structures have supported so
the current test for an empty directory which checks to see
if nlink <= 2 is a bit lacking.
proc and sysfs have recently been modified to use the new empty_dir
infrastructure to create all of their dedicated mount points. Instead
of testing for S_ISDIR(inode->i_mode) && i_nlink <= 2 to see if a
directory is empty, test for is_empty_dir_inode(inode). That small
change guaranteess mounts found on proc and sysfs really are safe to
ignore, because the directories are not only empty but nothing can
ever be added to them. This guarantees there is nothing to worry
about when mounting proc and sysfs.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/namespace.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index efd13c26ad9c..b50d8daa7cb0 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3073,9 +3073,8 @@ static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags)
/* Only worry about locked mounts */
if (!(mnt->mnt.mnt_flags & MNT_LOCKED))
continue;
- if (!S_ISDIR(inode->i_mode))
- goto next;
- if (inode->i_nlink > 2)
+ /* Is the directory permanetly empty? */
+ if (!is_empty_dir_inode(inode))
goto next;
}
/* Preserve the locked attributes */
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 138/185] vfs: Remove incorrect debugging WARN in prepend_path
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (136 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 137/185] mnt: Update fs_fully_visible to test for permanently empty directories Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 139/185] hwmon: (mcp3021) Fix broken output scaling Luis Henriques
` (46 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Eric W. Biederman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit 93e3bce6287e1fb3e60d3324ed08555b5bbafa89 upstream.
The warning message in prepend_path is unclear and outdated. It was
added as a warning that the mechanism for generating names of pseudo
files had been removed from prepend_path and d_dname should be used
instead. Unfortunately the warning reads like a general warning,
making it unclear what to do with it.
Remove the warning. The transition it was added to warn about is long
over, and I added code several years ago which in rare cases causes
the warning to fire on legitimate code, and the warning is now firing
and scaring people for no good reason.
Reported-by: Ivan Delalande <colona@arista.com>
Reported-by: Omar Sandoval <osandov@osandov.com>
Fixes: f48cfddc6729e ("vfs: In d_path don't call d_dname on a mount point")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/dcache.c | 11 -----------
1 file changed, 11 deletions(-)
diff --git a/fs/dcache.c b/fs/dcache.c
index 05a041a134c4..df0de6b95409 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2898,17 +2898,6 @@ restart:
vfsmnt = &mnt->mnt;
continue;
}
- /*
- * Filesystems needing to implement special "root names"
- * should do so with ->d_dname()
- */
- if (IS_ROOT(dentry) &&
- (dentry->d_name.len != 1 ||
- dentry->d_name.name[0] != '/')) {
- WARN(1, "Root dentry has weird name <%.*s>\n",
- (int) dentry->d_name.len,
- dentry->d_name.name);
- }
if (!error)
error = is_mounted(vfsmnt) ? 1 : 2;
break;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 139/185] hwmon: (mcp3021) Fix broken output scaling
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (137 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 138/185] vfs: Remove incorrect debugging WARN in prepend_path Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 140/185] ACPICA: Tables: Enable both 32-bit and 64-bit FACS Luis Henriques
` (45 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Nick Stevens, Guenter Roeck, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Stevens, Nick" <Nick.Stevens@digi.com>
commit 347d7e45bd09ce09cbc30d5cea9de377eb22f55c upstream.
The mcp3021 scaling code is dividing the VDD (full-scale) value in
millivolts by the A2D resolution to obtain the scaling factor. When VDD
is 3300mV (the standard value) and the resolution is 12-bit (4096
divisions), the result is a scale factor of 3300/4096, which is always
one. Effectively, the raw A2D reading is always being returned because
no scaling is applied.
This patch fixes the issue and simplifies the register-to-volts
calculation, removing the unneeded "output_scale" struct member.
Signed-off-by: Nick Stevens <Nick.Stevens@digi.com>
[Guenter Roeck: Dropped unnecessary value check]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/hwmon/mcp3021.c | 14 +-------------
1 file changed, 1 insertion(+), 13 deletions(-)
diff --git a/drivers/hwmon/mcp3021.c b/drivers/hwmon/mcp3021.c
index d219c06a857b..972444a14cca 100644
--- a/drivers/hwmon/mcp3021.c
+++ b/drivers/hwmon/mcp3021.c
@@ -31,14 +31,11 @@
/* output format */
#define MCP3021_SAR_SHIFT 2
#define MCP3021_SAR_MASK 0x3ff
-
#define MCP3021_OUTPUT_RES 10 /* 10-bit resolution */
-#define MCP3021_OUTPUT_SCALE 4
#define MCP3221_SAR_SHIFT 0
#define MCP3221_SAR_MASK 0xfff
#define MCP3221_OUTPUT_RES 12 /* 12-bit resolution */
-#define MCP3221_OUTPUT_SCALE 1
enum chips {
mcp3021,
@@ -54,7 +51,6 @@ struct mcp3021_data {
u16 sar_shift;
u16 sar_mask;
u8 output_res;
- u8 output_scale;
};
static int mcp3021_read16(struct i2c_client *client)
@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_client *client)
static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val)
{
- if (val == 0)
- return 0;
-
- val = val * data->output_scale - data->output_scale / 2;
-
- return val * DIV_ROUND_CLOSEST(data->vdd,
- (1 << data->output_res) * data->output_scale);
+ return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res);
}
static ssize_t show_in_input(struct device *dev, struct device_attribute *attr,
@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_client *client,
data->sar_shift = MCP3021_SAR_SHIFT;
data->sar_mask = MCP3021_SAR_MASK;
data->output_res = MCP3021_OUTPUT_RES;
- data->output_scale = MCP3021_OUTPUT_SCALE;
break;
case mcp3221:
data->sar_shift = MCP3221_SAR_SHIFT;
data->sar_mask = MCP3221_SAR_MASK;
data->output_res = MCP3221_OUTPUT_RES;
- data->output_scale = MCP3221_OUTPUT_SCALE;
break;
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 140/185] ACPICA: Tables: Enable both 32-bit and 64-bit FACS
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (138 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 139/185] hwmon: (mcp3021) Fix broken output scaling Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 141/185] ACPICA: Tables: Fix an issue that FACS initialization is performed twice Luis Henriques
` (44 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Lv Zheng, Bob Moore, Rafael J. Wysocki, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Lv Zheng <lv.zheng@intel.com>
commit c04e1fb4396d27f18296db0f914760fa7fe8223a upstream.
ACPICA commit f7b86f35416e3d1f71c3d816ff5075ddd33ed486
The following commit is reported to have broken s2ram on some platforms:
Commit: 0249ed2444d65d65fc3f3f64f398f1ad0b7e54cd
ACPICA: Add option to favor 32-bit FADT addresses.
The platform reports 2 FACS tables (which is not allowed by ACPI
specification) and the new 32-bit address favor rule forces OSPMs to use
the FACS table reported via FADT's X_FIRMWARE_CTRL field.
The root cause of the reported bug might be one of the followings:
1. BIOS may favor the 64-bit firmware waking vector address when the
version of the FACS is greater than 0 and Linux currently only supports
resuming from the real mode, so the 64-bit firmware waking vector has
never been set and might be invalid to BIOS while the commit enables
higher version FACS.
2. BIOS may favor the FACS reported via the "FIRMWARE_CTRL" field in the
FADT while the commit doesn't set the firmware waking vector address of
the FACS reported by "FIRMWARE_CTRL", it only sets the firware waking
vector address of the FACS reported by "X_FIRMWARE_CTRL".
This patch excludes the cases that can trigger the bugs caused by the root
cause 2.
There is no handshaking mechanism can be used by OSPM to tell BIOS which
FACS is currently used. Thus the FACS reported by "FIRMWARE_CTRL" may still
be used by BIOS and the 0 value of the 32-bit firmware waking vector might
trigger such failure.
This patch tries to favor 32bit FACS address in another way where both the
FACS reported by "FIRMWARE_CTRL" and the FACS reported by "X_FIRMWARE_CTRL"
are loaded so that further commit can set firmware waking vector in the
both tables to ensure we can exclude the cases that trigger the bugs caused
by the root cause 2. The exclusion is split into 2 commits as this commit
is also useful for dumping more ACPI tables, it won't get reverted when
such exclusion is no longer necessary. Lv Zheng.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=74021
Link: https://github.com/acpica/acpica/commit/f7b86f35
Reported-and-tested-by: Oswald Buddenhagen <ossi@kde.org>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/acpi/acpica/aclocal.h | 1 +
drivers/acpi/acpica/tbfadt.c | 21 +++++++++++++--------
drivers/acpi/acpica/tbutils.c | 34 +++++++++++++++++++++++-----------
drivers/acpi/acpica/tbxfload.c | 3 ++-
include/acpi/acpixf.h | 9 +++++++++
5 files changed, 48 insertions(+), 20 deletions(-)
diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
index 494775a67ffa..3fc71e7fb847 100644
--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -213,6 +213,7 @@ struct acpi_table_list {
#define ACPI_TABLE_INDEX_DSDT (0)
#define ACPI_TABLE_INDEX_FACS (1)
+#define ACPI_TABLE_INDEX_X_FACS (2)
struct acpi_find_context {
char *search_for;
diff --git a/drivers/acpi/acpica/tbfadt.c b/drivers/acpi/acpica/tbfadt.c
index 41519a958083..dfa3f367f364 100644
--- a/drivers/acpi/acpica/tbfadt.c
+++ b/drivers/acpi/acpica/tbfadt.c
@@ -350,9 +350,18 @@ void acpi_tb_parse_fadt(u32 table_index)
/* If Hardware Reduced flag is set, there is no FACS */
if (!acpi_gbl_reduced_hardware) {
- acpi_tb_install_fixed_table((acpi_physical_address)
- acpi_gbl_FADT.Xfacs, ACPI_SIG_FACS,
- ACPI_TABLE_INDEX_FACS);
+ if (acpi_gbl_FADT.facs) {
+ acpi_tb_install_fixed_table((acpi_physical_address)
+ acpi_gbl_FADT.facs,
+ ACPI_SIG_FACS,
+ ACPI_TABLE_INDEX_FACS);
+ }
+ if (acpi_gbl_FADT.Xfacs) {
+ acpi_tb_install_fixed_table((acpi_physical_address)
+ acpi_gbl_FADT.Xfacs,
+ ACPI_SIG_FACS,
+ ACPI_TABLE_INDEX_X_FACS);
+ }
}
}
@@ -491,13 +500,9 @@ static void acpi_tb_convert_fadt(void)
acpi_gbl_FADT.header.length = sizeof(struct acpi_table_fadt);
/*
- * Expand the 32-bit FACS and DSDT addresses to 64-bit as necessary.
+ * Expand the 32-bit DSDT addresses to 64-bit as necessary.
* Later ACPICA code will always use the X 64-bit field.
*/
- acpi_gbl_FADT.Xfacs = acpi_tb_select_address("FACS",
- acpi_gbl_FADT.facs,
- acpi_gbl_FADT.Xfacs);
-
acpi_gbl_FADT.Xdsdt = acpi_tb_select_address("DSDT",
acpi_gbl_FADT.dsdt,
acpi_gbl_FADT.Xdsdt);
diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
index 6b1ca9991b90..0912b166ac66 100644
--- a/drivers/acpi/acpica/tbutils.c
+++ b/drivers/acpi/acpica/tbutils.c
@@ -68,7 +68,8 @@ acpi_tb_get_root_table_entry(u8 *table_entry, u32 table_entry_size);
acpi_status acpi_tb_initialize_facs(void)
{
- acpi_status status;
+ struct acpi_table_facs *facs32;
+ struct acpi_table_facs *facs64;
/* If Hardware Reduced flag is set, there is no FACS */
@@ -77,11 +78,22 @@ acpi_status acpi_tb_initialize_facs(void)
return (AE_OK);
}
- status = acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS,
- ACPI_CAST_INDIRECT_PTR(struct
- acpi_table_header,
- &acpi_gbl_FACS));
- return (status);
+ (void)acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS,
+ ACPI_CAST_INDIRECT_PTR(struct
+ acpi_table_header,
+ &facs32));
+ (void)acpi_get_table_by_index(ACPI_TABLE_INDEX_X_FACS,
+ ACPI_CAST_INDIRECT_PTR(struct
+ acpi_table_header,
+ &facs64));
+
+ if (acpi_gbl_use32_bit_facs_addresses) {
+ acpi_gbl_FACS = facs32 ? facs32 : facs64;
+ } else {
+ acpi_gbl_FACS = facs64 ? facs64 : facs32;
+ }
+
+ return (AE_OK);
}
#endif /* !ACPI_REDUCED_HARDWARE */
@@ -101,7 +113,7 @@ acpi_status acpi_tb_initialize_facs(void)
u8 acpi_tb_tables_loaded(void)
{
- if (acpi_gbl_root_table_list.current_table_count >= 3) {
+ if (acpi_gbl_root_table_list.current_table_count >= 4) {
return (TRUE);
}
@@ -357,11 +369,11 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
table_entry = ACPI_ADD_PTR(u8, table, sizeof(struct acpi_table_header));
/*
- * First two entries in the table array are reserved for the DSDT
- * and FACS, which are not actually present in the RSDT/XSDT - they
- * come from the FADT
+ * First three entries in the table array are reserved for the DSDT
+ * and 32bit/64bit FACS, which are not actually present in the
+ * RSDT/XSDT - they come from the FADT
*/
- acpi_gbl_root_table_list.current_table_count = 2;
+ acpi_gbl_root_table_list.current_table_count = 3;
/* Initialize the root table array from the RSDT/XSDT */
diff --git a/drivers/acpi/acpica/tbxfload.c b/drivers/acpi/acpica/tbxfload.c
index ab5308b81aa8..435f71648e17 100644
--- a/drivers/acpi/acpica/tbxfload.c
+++ b/drivers/acpi/acpica/tbxfload.c
@@ -166,7 +166,8 @@ static acpi_status acpi_tb_load_namespace(void)
(void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
for (i = 0; i < acpi_gbl_root_table_list.current_table_count; ++i) {
- if ((!ACPI_COMPARE_NAME
+ if (!acpi_gbl_root_table_list.tables[i].address ||
+ (!ACPI_COMPARE_NAME
(&(acpi_gbl_root_table_list.tables[i].signature),
ACPI_SIG_SSDT)
&&
diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index 664a1a4b6f6a..77391cfd7c6b 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -202,6 +202,15 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_do_not_use_xsdt, FALSE);
ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, TRUE);
/*
+ * Optionally use 32-bit FACS table addresses.
+ * It is reported that some platforms fail to resume from system suspending
+ * if 64-bit FACS table address is selected:
+ * https://bugzilla.kernel.org/show_bug.cgi?id=74021
+ * Default is TRUE, favor the 32-bit addresses.
+ */
+ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_facs_addresses, TRUE);
+
+/*
* Optionally truncate I/O addresses to 16 bits. Provides compatibility
* with other ACPI implementations. NOTE: During ACPICA initialization,
* this value is set to TRUE if any Windows OSI strings have been
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 141/185] ACPICA: Tables: Fix an issue that FACS initialization is performed twice
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (139 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 140/185] ACPICA: Tables: Enable both 32-bit and 64-bit FACS Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 142/185] ACPICA: Tables: Enable default 64-bit FADT addresses favor Luis Henriques
` (43 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Lv Zheng, Bob Moore, Rafael J. Wysocki, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Lv Zheng <lv.zheng@intel.com>
commit c04be18448355441a0c424362df65b6422e27bda upstream.
ACPICA commit 90f5332a15e9d9ba83831ca700b2b9f708274658
This patch adds a new FACS initialization flag for acpi_tb_initialize().
acpi_enable_subsystem() might be invoked several times in OS bootup process,
and we don't want FACS initialization to be invoked twice. Lv Zheng.
Link: https://github.com/acpica/acpica/commit/90f5332a
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/acpi/acpica/utxfinit.c | 10 ++++++----
include/acpi/actypes.h | 1 +
2 files changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c
index 13380d818462..64f8f307243b 100644
--- a/drivers/acpi/acpica/utxfinit.c
+++ b/drivers/acpi/acpica/utxfinit.c
@@ -175,10 +175,12 @@ acpi_status __init acpi_enable_subsystem(u32 flags)
* Obtain a permanent mapping for the FACS. This is required for the
* Global Lock and the Firmware Waking Vector
*/
- status = acpi_tb_initialize_facs();
- if (ACPI_FAILURE(status)) {
- ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
- return_ACPI_STATUS(status);
+ if (!(flags & ACPI_NO_FACS_INIT)) {
+ status = acpi_tb_initialize_facs();
+ if (ACPI_FAILURE(status)) {
+ ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
+ return_ACPI_STATUS(status);
+ }
}
#endif /* !ACPI_REDUCED_HARDWARE */
diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
index f0a23d7fd302..00b6e76c8d4c 100644
--- a/include/acpi/actypes.h
+++ b/include/acpi/actypes.h
@@ -572,6 +572,7 @@ typedef u64 acpi_integer;
#define ACPI_NO_ACPI_ENABLE 0x10
#define ACPI_NO_DEVICE_INIT 0x20
#define ACPI_NO_OBJECT_INIT 0x40
+#define ACPI_NO_FACS_INIT 0x80
/*
* Initialization state
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 142/185] ACPICA: Tables: Enable default 64-bit FADT addresses favor
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (140 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 141/185] ACPICA: Tables: Fix an issue that FACS initialization is performed twice Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 143/185] KVM: x86: make vapics_in_nmi_mode atomic Luis Henriques
` (42 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Lv Zheng, Bob Moore, Rafael J. Wysocki, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Lv Zheng <lv.zheng@intel.com>
commit 0ea61381788a37d864f9841b0fe97d40f7058f3b upstream.
ACPICA commit 4da56eeae0749dfe8491285c1e1fad48f6efafd8
The following commit temporarily disables correct 64-bit FADT addresses
favor during the period the root cause of the bug is not fixed:
Commit: 85dbd5801f62b66e2aa7826aaefcaebead44c8a6
ACPICA: Tables: Restore old behavor to favor 32-bit FADT addresses.
With enough protections, this patch re-enables 64-bit FADT addresses by
default. If regressions are reported against such change, this patch should
be bisected and reverted.
Note that 64-bit FACS favor and 64-bit firmware waking vector favor are
excluded by this commit in order not to break OSPMs. Lv Zheng.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=74021
Link: https://github.com/acpica/acpica/commit/4da56eea
Reported-and-tested-by: Oswald Buddenhagen <ossi@kde.org>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
include/acpi/acpixf.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index 77391cfd7c6b..d95681144545 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -197,9 +197,9 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_do_not_use_xsdt, FALSE);
* address. Although ACPICA adheres to the ACPI specification which
* requires the use of the corresponding 64-bit address if it is non-zero,
* some machines have been found to have a corrupted non-zero 64-bit
- * address. Default is TRUE, favor the 32-bit addresses.
+ * address. Default is FALSE, do not favor the 32-bit addresses.
*/
-ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, TRUE);
+ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, FALSE);
/*
* Optionally use 32-bit FACS table addresses.
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 143/185] KVM: x86: make vapics_in_nmi_mode atomic
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (141 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 142/185] ACPICA: Tables: Enable default 64-bit FADT addresses favor Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 144/185] KVM: x86: properly restore LVT0 Luis Henriques
` (41 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Radim Krčmář, Paolo Bonzini, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= <rkrcmar@redhat.com>
commit 42720138b06301cc8a7ee8a495a6d021c4b6a9bc upstream.
Writes were a bit racy, but hard to turn into a bug at the same time.
(Particularly because modern Linux doesn't use this feature anymore.)
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
[Actually the next patch makes it much, much easier to trigger the race
so I'm including this one for stable@ as well. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/x86/include/asm/kvm_host.h | 2 +-
arch/x86/kvm/i8254.c | 2 +-
arch/x86/kvm/lapic.c | 4 ++--
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 554dcdf7ad82..b1ecb145d9a5 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -571,7 +571,7 @@ struct kvm_arch {
struct kvm_pic *vpic;
struct kvm_ioapic *vioapic;
struct kvm_pit *vpit;
- int vapics_in_nmi_mode;
+ atomic_t vapics_in_nmi_mode;
struct mutex apic_map_lock;
struct kvm_apic_map *apic_map;
diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
index 298781d4cfb4..1406ffde3e35 100644
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -305,7 +305,7 @@ static void pit_do_work(struct kthread_work *work)
* LVT0 to NMI delivery. Other PIC interrupts are just sent to
* VCPU0, and only if its LVT0 is in EXTINT mode.
*/
- if (kvm->arch.vapics_in_nmi_mode > 0)
+ if (atomic_read(&kvm->arch.vapics_in_nmi_mode) > 0)
kvm_for_each_vcpu(i, vcpu, kvm)
kvm_apic_nmi_wd_deliver(vcpu);
}
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index f96b8a4d3fed..17ca64643a11 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1115,10 +1115,10 @@ static void apic_manage_nmi_watchdog(struct kvm_lapic *apic, u32 lvt0_val)
if (!nmi_wd_enabled) {
apic_debug("Receive NMI setting on APIC_LVT0 "
"for cpu %d\n", apic->vcpu->vcpu_id);
- apic->vcpu->kvm->arch.vapics_in_nmi_mode++;
+ atomic_inc(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
}
} else if (nmi_wd_enabled)
- apic->vcpu->kvm->arch.vapics_in_nmi_mode--;
+ atomic_dec(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
}
static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 144/185] KVM: x86: properly restore LVT0
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (142 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 143/185] KVM: x86: make vapics_in_nmi_mode atomic Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 145/185] KVM: s390: virtio-ccw: don't overwrite config space values Luis Henriques
` (40 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Radim Krčmář, Paolo Bonzini, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= <rkrcmar@redhat.com>
commit db1385624c686fe99fe2d1b61a36e1537b915d08 upstream.
Legacy NMI watchdog didn't work after migration/resume, because
vapics_in_nmi_mode was left at 0.
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/x86/kvm/lapic.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 17ca64643a11..1f4e8e4ea865 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1685,6 +1685,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu,
apic_update_ppr(apic);
hrtimer_cancel(&apic->lapic_timer.timer);
+ apic_manage_nmi_watchdog(apic, kvm_apic_get_reg(apic, APIC_LVT0));
update_divide_count(apic);
start_apic_timer(apic);
apic->irr_pending = true;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 145/185] KVM: s390: virtio-ccw: don't overwrite config space values
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (143 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 144/185] KVM: x86: properly restore LVT0 Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 146/185] 9p: forgetting to cancel request on interrupted zero-copy RPC Luis Henriques
` (39 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Cornelia Huck, Christian Borntraeger, Paolo Bonzini, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Cornelia Huck <cornelia.huck@de.ibm.com>
commit 431dae778aea4eed31bd12e5ee82edc571cd4d70 upstream.
Eric noticed problems with vhost-scsi and virtio-ccw: vhost-scsi
complained about overwriting values in the config space, which
was triggered by a broken implementation of virtio-ccw's config
get/set routines. It was probably sheer luck that we did not hit
this before.
When writing a value to the config space, the WRITE_CONF ccw will
always write from the beginning of the config space up to and
including the value to be set. If the config space up to the value
has not yet been retrieved from the device, however, we'll end up
overwriting values. Keep track of the known config space and update
if needed to avoid this.
Moreover, READ_CONF will only read the number of bytes it has been
instructed to retrieve, so we must not copy more than that to the
buffer, or we might overwrite trailing values.
Reported-by: Eric Farman <farman@linux.vnet.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Reviewed-by: Eric Farman <farman@linux.vnet.ibm.com>
Tested-by: Eric Farman <farman@linux.vnet.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/s390/kvm/virtio_ccw.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/s390/kvm/virtio_ccw.c b/drivers/s390/kvm/virtio_ccw.c
index d2c0b442bce5..b6ade163445c 100644
--- a/drivers/s390/kvm/virtio_ccw.c
+++ b/drivers/s390/kvm/virtio_ccw.c
@@ -64,6 +64,7 @@ struct virtio_ccw_device {
bool is_thinint;
bool going_away;
bool device_lost;
+ unsigned int config_ready;
void *airq_info;
};
@@ -758,8 +759,11 @@ static void virtio_ccw_get_config(struct virtio_device *vdev,
if (ret)
goto out_free;
- memcpy(vcdev->config, config_area, sizeof(vcdev->config));
- memcpy(buf, &vcdev->config[offset], len);
+ memcpy(vcdev->config, config_area, offset + len);
+ if (buf)
+ memcpy(buf, &vcdev->config[offset], len);
+ if (vcdev->config_ready < offset + len)
+ vcdev->config_ready = offset + len;
out_free:
kfree(config_area);
@@ -782,6 +786,9 @@ static void virtio_ccw_set_config(struct virtio_device *vdev,
if (!config_area)
goto out_free;
+ /* Make sure we don't overwrite fields. */
+ if (vcdev->config_ready < offset)
+ virtio_ccw_get_config(vdev, 0, NULL, offset);
memcpy(&vcdev->config[offset], buf, len);
/* Write the config area to the host. */
memcpy(config_area, vcdev->config, sizeof(vcdev->config));
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 146/185] 9p: forgetting to cancel request on interrupted zero-copy RPC
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (144 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 145/185] KVM: s390: virtio-ccw: don't overwrite config space values Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 147/185] clk: Fix JSON output in debugfs Luis Henriques
` (38 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Al Viro, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit a84b69cb6e0a41e86bc593904faa6def3b957343 upstream.
If we'd already sent a request and decide to abort it, we *must*
issue TFLUSH properly and not just blindly reuse the tag, or
we'll get seriously screwed when response eventually arrives
and we confuse it for response to later request that had reused
the same tag.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/9p/client.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/9p/client.c b/net/9p/client.c
index 0004cbaac4a4..55a55ce92dc1 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -850,7 +850,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type,
if (err < 0) {
if (err == -EIO)
c->status = Disconnected;
- goto reterr;
+ if (err != -ERESTARTSYS)
+ goto reterr;
}
if (req->status == REQ_STATUS_ERROR) {
p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 147/185] clk: Fix JSON output in debugfs
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (145 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 146/185] 9p: forgetting to cancel request on interrupted zero-copy RPC Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 148/185] e1000e: Cleanup handling of VLAN_HLEN as a part of max frame size Luis Henriques
` (37 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Stefan Wahren, Stephen Boyd, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <stefan.wahren@i2se.com>
commit 7cb81136d2efe0f5ed9d965857f4756a15e6c338 upstream.
key/value pairs in a JSON object must be separated by a comma.
After adding the properties "accuracy" and "phase" the JSON output
of /sys/kernel/debug/clk/clk_dump is invalid.
So add the missing commas to fix it.
Fixes: 5279fc402ae5 ("clk: add clk accuracy retrieval support")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
[sboyd@codeaurora.org: Added comment in function]
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/clk/clk.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 1dee8d2086fb..604f79f867d1 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -165,11 +165,12 @@ static void clk_dump_one(struct seq_file *s, struct clk *c, int level)
if (!c)
return;
+ /* This should be JSON format, i.e. elements separated with a comma */
seq_printf(s, "\"%s\": { ", c->name);
seq_printf(s, "\"enable_count\": %d,", c->enable_count);
seq_printf(s, "\"prepare_count\": %d,", c->prepare_count);
- seq_printf(s, "\"rate\": %lu", clk_get_rate(c));
- seq_printf(s, "\"accuracy\": %lu", clk_get_accuracy(c));
+ seq_printf(s, "\"rate\": %lu,", clk_get_rate(c));
+ seq_printf(s, "\"accuracy\": %lu,", clk_get_accuracy(c));
}
static void clk_dump_subtree(struct seq_file *s, struct clk *c, int level)
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 148/185] e1000e: Cleanup handling of VLAN_HLEN as a part of max frame size
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (146 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 147/185] clk: Fix JSON output in debugfs Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 149/185] powerpc/pseries: Fix possible leaked device node reference Luis Henriques
` (36 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Alexander Duyck, Jeff Kirsher, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Duyck <alexander.h.duyck@redhat.com>
commit 8084b86dcfbc4b4822868c1dbdb429b5c08154e2 upstream.
When the VLAN_HLEN was added to the calculation for the maximum frame size
there seems to have been a number of issues added to the driver.
The first issue is that in some cases the maximum frame size for a device
never really reached the actual maximum frame size as the VLAN header
length was not included the calculation for that value. As a result some
parts only supported a maximum frame size of either 1496 in the case of
parts that didn't support jumbo frames, and 8996 in the case of the parts
that do.
The second issue is the fact that there were several checks that weren't
updated so as a result setting an MTU of 1500 was treated as enabling jumbo
frames as the calculated value was 1522 instead of 1518. I have addressed
those by replacing ETH_FRAME_LEN with VLAN_ETH_FRAME_LEN where appropriate.
The final issue was the fact that lowering the MTU below 1500 would cause
the driver to allocate 2K buffers for the rings. This is an old issue that
was fixed several years ago in igb/ixgbe and I am addressing now by just
replacing == with a <= so that we always just round up to 1522 for anything
that isn't a jumbo frame.
Fixes: c751a3d58cf2d ("e1000e: Correctly include VLAN_HLEN when changing interface MTU")
Signed-off-by: Alexander Duyck <alexander.h.duyck@redhat.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
[ luis: backported to 3.16:
- dropped changes to struct e1000_pch_spt_info as i219 isn't supported ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/ethernet/intel/e1000e/82571.c | 2 +-
drivers/net/ethernet/intel/e1000e/ich8lan.c | 8 ++++----
drivers/net/ethernet/intel/e1000e/netdev.c | 18 ++++++++----------
3 files changed, 13 insertions(+), 15 deletions(-)
diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
index 218481e509f9..c1396829ca96 100644
--- a/drivers/net/ethernet/intel/e1000e/82571.c
+++ b/drivers/net/ethernet/intel/e1000e/82571.c
@@ -2014,7 +2014,7 @@ const struct e1000_info e1000_82573_info = {
.flags2 = FLAG2_DISABLE_ASPM_L1
| FLAG2_DISABLE_ASPM_L0S,
.pba = 20,
- .max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN,
+ .max_hw_frame_size = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN,
.get_variants = e1000_get_variants_82571,
.mac_ops = &e82571_mac_ops,
.phy_ops = &e82_phy_ops_m88,
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 8894ab8ed6bd..060c5510b0c4 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -1495,7 +1495,7 @@ static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
((adapter->hw.mac.type >= e1000_pch2lan) &&
(!(er32(CTRL_EXT) & E1000_CTRL_EXT_LSECCK)))) {
adapter->flags &= ~FLAG_HAS_JUMBO_FRAMES;
- adapter->max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN;
+ adapter->max_hw_frame_size = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN;
hw->mac.ops.blink_led = NULL;
}
@@ -5054,7 +5054,7 @@ const struct e1000_info e1000_ich8_info = {
| FLAG_HAS_FLASH
| FLAG_APME_IN_WUC,
.pba = 8,
- .max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN,
+ .max_hw_frame_size = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN,
.get_variants = e1000_get_variants_ich8lan,
.mac_ops = &ich8_mac_ops,
.phy_ops = &ich8_phy_ops,
@@ -5127,7 +5127,7 @@ const struct e1000_info e1000_pch2_info = {
.flags2 = FLAG2_HAS_PHY_STATS
| FLAG2_HAS_EEE,
.pba = 26,
- .max_hw_frame_size = 9018,
+ .max_hw_frame_size = 9022,
.get_variants = e1000_get_variants_ich8lan,
.mac_ops = &ich8_mac_ops,
.phy_ops = &ich8_phy_ops,
@@ -5147,7 +5147,7 @@ const struct e1000_info e1000_pch_lpt_info = {
.flags2 = FLAG2_HAS_PHY_STATS
| FLAG2_HAS_EEE,
.pba = 26,
- .max_hw_frame_size = 9018,
+ .max_hw_frame_size = 9022,
.get_variants = e1000_get_variants_ich8lan,
.mac_ops = &ich8_mac_ops,
.phy_ops = &ich8_phy_ops,
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 201cc93f3625..fe03a752b84b 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -3787,7 +3787,7 @@ void e1000e_reset(struct e1000_adapter *adapter)
/* reset Packet Buffer Allocation to default */
ew32(PBA, pba);
- if (adapter->max_frame_size > ETH_FRAME_LEN + ETH_FCS_LEN) {
+ if (adapter->max_frame_size > (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)) {
/* To maintain wire speed transmits, the Tx FIFO should be
* large enough to accommodate two full transmit packets,
* rounded up to the next 1KB and expressed in KB. Likewise,
@@ -4175,9 +4175,9 @@ static int e1000_sw_init(struct e1000_adapter *adapter)
{
struct net_device *netdev = adapter->netdev;
- adapter->rx_buffer_len = ETH_FRAME_LEN + VLAN_HLEN + ETH_FCS_LEN;
+ adapter->rx_buffer_len = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN;
adapter->rx_ps_bsize0 = 128;
- adapter->max_frame_size = netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
+ adapter->max_frame_size = netdev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
adapter->min_frame_size = ETH_ZLEN + ETH_FCS_LEN;
adapter->tx_ring_count = E1000_DEFAULT_TXD;
adapter->rx_ring_count = E1000_DEFAULT_RXD;
@@ -5759,17 +5759,17 @@ struct rtnl_link_stats64 *e1000e_get_stats64(struct net_device *netdev,
static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
{
struct e1000_adapter *adapter = netdev_priv(netdev);
- int max_frame = new_mtu + VLAN_HLEN + ETH_HLEN + ETH_FCS_LEN;
+ int max_frame = new_mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
/* Jumbo frame support */
- if ((max_frame > ETH_FRAME_LEN + ETH_FCS_LEN) &&
+ if ((max_frame > (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)) &&
!(adapter->flags & FLAG_HAS_JUMBO_FRAMES)) {
e_err("Jumbo Frames not supported.\n");
return -EINVAL;
}
/* Supported frame sizes */
- if ((new_mtu < ETH_ZLEN + ETH_FCS_LEN + VLAN_HLEN) ||
+ if ((new_mtu < (VLAN_ETH_ZLEN + ETH_FCS_LEN)) ||
(max_frame > adapter->max_hw_frame_size)) {
e_err("Unsupported MTU setting\n");
return -EINVAL;
@@ -5809,10 +5809,8 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
adapter->rx_buffer_len = 4096;
/* adjust allocation if LPE protects us, and we aren't using SBP */
- if ((max_frame == ETH_FRAME_LEN + ETH_FCS_LEN) ||
- (max_frame == ETH_FRAME_LEN + VLAN_HLEN + ETH_FCS_LEN))
- adapter->rx_buffer_len = ETH_FRAME_LEN + VLAN_HLEN
- + ETH_FCS_LEN;
+ if (max_frame <= (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN))
+ adapter->rx_buffer_len = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN;
if (netif_running(netdev))
e1000e_up(adapter);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 149/185] powerpc/pseries: Fix possible leaked device node reference
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (147 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 148/185] e1000e: Cleanup handling of VLAN_HLEN as a part of max frame size Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 150/185] clk: ti: dra7-atl-clock: Fix possible ERR_PTR dereference Luis Henriques
` (35 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Nathan Fontenot, Michael Ellerman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Fontenot <nfont@linux.vnet.ibm.com>
commit 2222ce0fbbcc4ebfa9995c8d23d72c8239ad712c upstream.
Failure return from dlpar_configure_connector when dlpar adding cpus
results in leaking references to the cpus parent device node. Move the
call to of_node_put() prior to checking the result of
dlpar_configure_connector.
Fixes: 8d5ff320766f ("powerpc/pseries: Make dlpar_configure_connector parent node aware")
Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/powerpc/platforms/pseries/dlpar.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
index 06685498b681..7d82a2321fc7 100644
--- a/arch/powerpc/platforms/pseries/dlpar.c
+++ b/arch/powerpc/platforms/pseries/dlpar.c
@@ -416,11 +416,10 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
return -ENODEV;
dn = dlpar_configure_connector(drc_index, parent);
+ of_node_put(parent);
if (!dn)
return -EINVAL;
- of_node_put(parent);
-
rc = dlpar_attach_node(dn);
if (rc) {
dlpar_release_drc(drc_index);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 150/185] clk: ti: dra7-atl-clock: Fix possible ERR_PTR dereference
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (148 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 149/185] powerpc/pseries: Fix possible leaked device node reference Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 151/185] ipip: fix one sparse error Luis Henriques
` (34 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Krzysztof Kozlowski, Stephen Boyd, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit e0cdcda508f110b7ec190dc7c5eb2869ba73a535 upstream.
of_clk_get_from_provider() returns ERR_PTR on failure. The
dra7-atl-clock driver was not checking its return value and
immediately used it in __clk_get_hw(). __clk_get_hw()
dereferences supplied clock, if it is not NULL, so in that case
it would dereference an ERR_PTR.
Fixes: 9ac33b0ce81f ("CLK: TI: Driver for DRA7 ATL (Audio Tracking Logic)")
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/clk/ti/clk-dra7-atl.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
index af29359677da..d1db76887b8b 100644
--- a/drivers/clk/ti/clk-dra7-atl.c
+++ b/drivers/clk/ti/clk-dra7-atl.c
@@ -250,6 +250,11 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev)
}
clk = of_clk_get_from_provider(&clkspec);
+ if (IS_ERR(clk)) {
+ pr_err("%s: failed to get atl clock %d from provider\n",
+ __func__, i);
+ return PTR_ERR(clk);
+ }
cdesc = to_atl_desc(__clk_get_hw(clk));
cdesc->cinfo = cinfo;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 151/185] ipip: fix one sparse error
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (149 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 150/185] clk: ti: dra7-atl-clock: Fix possible ERR_PTR dereference Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 152/185] HID: rmi: fix some harmless BIT() mistakes Luis Henriques
` (33 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Eric Dumazet, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 252a8fbe819d041b29789e2035cd1760f373345f upstream.
make C=2 CF=-D__CHECK_ENDIAN__ net/ipv4/ipip.o
CHECK net/ipv4/ipip.c
net/ipv4/ipip.c:254:27: warning: incorrect type in assignment (different base types)
net/ipv4/ipip.c:254:27: expected restricted __be32 [addressable] [usertype] o_key
net/ipv4/ipip.c:254:27: got restricted __be16 [addressable] [usertype] i_flags
Fixes: 3b7b514f44bf ("ipip: fix a regression in ioctl")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/ipv4/ipip.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 62eaa005e146..2299f9fafd86 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -249,7 +249,8 @@ ipip_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
return -EINVAL;
}
- p.i_key = p.o_key = p.i_flags = p.o_flags = 0;
+ p.i_key = p.o_key = 0;
+ p.i_flags = p.o_flags = 0;
if (p.iph.ttl)
p.iph.frag_off |= htons(IP_DF);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 152/185] HID: rmi: fix some harmless BIT() mistakes
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (150 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 151/185] ipip: fix one sparse error Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 153/185] HID: i2c-hid: fix harmless test_bit() issue Luis Henriques
` (32 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dan Carpenter, Jiri Kosina, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit af43c4086cf24c3eb74a968195351163750c82b6 upstream.
These defines are used like this:
if (!(test_bit(RMI_STARTED, &hdata->flags)))
So the intent was to use bits 0, 1 and 2 but because of the extra BIT()
shifts we're actually using 1, 2 and 4. It's harmless because it's done
consistently but static checkers will complain.
Fixes: 9fb6bf02e3ad ('HID: rmi: introduce RMI driver for Synaptics touchpads')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/hid/hid-rmi.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
index 53df21735cea..bedc1acd0c4a 100644
--- a/drivers/hid/hid-rmi.c
+++ b/drivers/hid/hid-rmi.c
@@ -29,9 +29,9 @@
#define RMI_SET_RMI_MODE_REPORT_ID 0x0f /* Feature Report */
/* flags */
-#define RMI_READ_REQUEST_PENDING BIT(0)
-#define RMI_READ_DATA_PENDING BIT(1)
-#define RMI_STARTED BIT(2)
+#define RMI_READ_REQUEST_PENDING 0
+#define RMI_READ_DATA_PENDING 1
+#define RMI_STARTED 2
enum rmi_mode_type {
RMI_MODE_OFF = 0,
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 153/185] HID: i2c-hid: fix harmless test_bit() issue
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (151 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 152/185] HID: rmi: fix some harmless BIT() mistakes Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 154/185] pktgen: adjust spacing in proc file interface output Luis Henriques
` (31 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dan Carpenter, Jiri Kosina, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit c8fd51dc12c6e22bb97d5e273babcf339770aba5 upstream.
These defines are used like this:
if (test_bit(I2C_HID_STARTED, &ihid->flags))
The intent was to use bits 0, 1, and 2 but because of the extra shifts
we're using bits 1, 2, and 4. It's harmless becuase it's done
consistently but it's not the intent and static checkers will complain.
Fixes: 4a200c3b9a40 ('HID: i2c-hid: introduce HID over i2c specification implementation')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/hid/i2c-hid/i2c-hid.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 1c313e3aa0fd..d40d1f36f47e 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -41,9 +41,9 @@
#include <linux/i2c/i2c-hid.h>
/* flags */
-#define I2C_HID_STARTED (1 << 0)
-#define I2C_HID_RESET_PENDING (1 << 1)
-#define I2C_HID_READ_PENDING (1 << 2)
+#define I2C_HID_STARTED 0
+#define I2C_HID_RESET_PENDING 1
+#define I2C_HID_READ_PENDING 2
#define I2C_HID_PWR_ON 0x00
#define I2C_HID_PWR_SLEEP 0x01
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 154/185] pktgen: adjust spacing in proc file interface output
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (152 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 153/185] HID: i2c-hid: fix harmless test_bit() issue Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 155/185] USB: devio: fix a condition in async_completed() Luis Henriques
` (30 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Jesper Dangaard Brouer, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesper Dangaard Brouer <brouer@redhat.com>
commit d079abd181950a44cdf31daafd1662388a6c4d2e upstream.
Too many spaces were introduced in commit 63adc6fb8ac0 ("pktgen: cleanup
checkpatch warnings"), thus misaligning "src_min:" to other columns.
Fixes: 63adc6fb8ac0 ("pktgen: cleanup checkpatch warnings")
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/core/pktgen.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 5901a1187cd2..0e5719c20d61 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -563,7 +563,7 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
" dst_min: %s dst_max: %s\n",
pkt_dev->dst_min, pkt_dev->dst_max);
seq_printf(seq,
- " src_min: %s src_max: %s\n",
+ " src_min: %s src_max: %s\n",
pkt_dev->src_min, pkt_dev->src_max);
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 155/185] USB: devio: fix a condition in async_completed()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (153 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 154/185] pktgen: adjust spacing in proc file interface output Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 156/185] tty: remove platform_sysrq_reset_seq Luis Henriques
` (29 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dan Carpenter, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 83ed07c5db71bc02bd646d6eb60b48908235cdf9 upstream.
Static checkers complain that the current condition is never true. It
seems pretty likely that it's a typo and "URB" was intended instead of
"USB".
Fixes: 3d97ff63f899 ('usbdevfs: Use scatter-gather lists for large bulk transfers')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/usb/core/devio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index e500243803d8..fae81924fd4b 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -513,7 +513,7 @@ static void async_completed(struct urb *urb)
snoop(&urb->dev->dev, "urb complete\n");
snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
as->status, COMPLETE, NULL, 0);
- if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN)
+ if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN)
snoop_urb_data(urb, urb->actual_length);
if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 156/185] tty: remove platform_sysrq_reset_seq
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (154 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 155/185] USB: devio: fix a condition in async_completed() Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 157/185] net/mlx4_core: Enhance the MAD_IFC wrapper to convert VF port to physical Luis Henriques
` (28 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Arnd Bergmann, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit abab381feea7e61a0b5125504aa955cf339676ca upstream.
The platform_sysrq_reset_seq code was intended as a way for an embedded
platform to provide its own sysrq sequence at compile time. After over
two years, nobody has started using it in an upstream kernel, and
the platforms that were interested in it have moved on to devicetree,
which can be used to configure the sequence without requiring kernel
changes. The method is also incompatible with the way that most
architectures build support for multiple platforms into a single
kernel.
Now the code is producing warnings when built with gcc-5.1:
drivers/tty/sysrq.c: In function 'sysrq_init':
drivers/tty/sysrq.c:959:33: warning: array subscript is above array bounds [-Warray-bounds]
key = platform_sysrq_reset_seq[i];
We could fix this, but it seems unlikely that it will ever be used,
so let's just remove the code instead. We still have the option to
pass the sequence either in DT, using the kernel command line,
or using the /sys/module/sysrq/parameters/reset_seq file.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 154b7a489a ("Input: sysrq - allow specifying alternate reset sequence")
----
v2: moved sysrq_reset_downtime_ms variable to avoid introducing a compile
warning when CONFIG_INPUT is disabled
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/tty/sysrq.c | 19 +------------------
1 file changed, 1 insertion(+), 18 deletions(-)
diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
index 454b65898e2c..b5e98de489dc 100644
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -55,9 +55,6 @@
static int __read_mostly sysrq_enabled = CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE;
static bool __read_mostly sysrq_always_enabled;
-unsigned short platform_sysrq_reset_seq[] __weak = { KEY_RESERVED };
-int sysrq_reset_downtime_ms __weak;
-
static bool sysrq_on(void)
{
return sysrq_enabled || sysrq_always_enabled;
@@ -567,6 +564,7 @@ void handle_sysrq(int key)
EXPORT_SYMBOL(handle_sysrq);
#ifdef CONFIG_INPUT
+static int sysrq_reset_downtime_ms;
/* Simple translation table for the SysRq keys */
static const unsigned char sysrq_xlate[KEY_CNT] =
@@ -947,23 +945,8 @@ static bool sysrq_handler_registered;
static inline void sysrq_register_handler(void)
{
- unsigned short key;
int error;
- int i;
-
- /* First check if a __weak interface was instantiated. */
- for (i = 0; i < ARRAY_SIZE(sysrq_reset_seq); i++) {
- key = platform_sysrq_reset_seq[i];
- if (key == KEY_RESERVED || key > KEY_MAX)
- break;
-
- sysrq_reset_seq[sysrq_reset_seq_len++] = key;
- }
- /*
- * DT configuration takes precedence over anything that would
- * have been defined via the __weak interface.
- */
sysrq_of_get_keyreset_config();
error = input_register_handler(&sysrq_handler);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 157/185] net/mlx4_core: Enhance the MAD_IFC wrapper to convert VF port to physical
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (155 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 156/185] tty: remove platform_sysrq_reset_seq Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 158/185] IB/mlx4: Convert slave port before building address-handle Luis Henriques
` (27 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Or Gerlitz, Jack Morgenstein, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Or Gerlitz <ogerlitz@mellanox.com>
commit 7c35ef4525c3255c747b935fe5af9ef4d1fbbf93 upstream.
Single port VFs always provide port = 1 (even if the actual physical
port used is port 2). As such, we need to convert the port provided
by the VF to the physical port before calling into the firmware.
It turns out that the Linux mlx4 VF RoCE driver maintains a copy of
the GID table and hence this change became critical only for single
ported IB VFs, but it could be needed for other RoCE VF drivers too.
Fixes: 449fc48866f7 ('net/mlx4: Adapt code for N-Port VF')
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/ethernet/mellanox/mlx4/cmd.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index c9d2988e364d..27fccfdeb12e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -714,7 +714,7 @@ static int mlx4_MAD_IFC_wrapper(struct mlx4_dev *dev, int slave,
{
struct ib_smp *smp = inbox->buf;
u32 index;
- u8 port;
+ u8 port, slave_port;
u8 opcode_modifier;
u16 *table;
int err;
@@ -726,7 +726,8 @@ static int mlx4_MAD_IFC_wrapper(struct mlx4_dev *dev, int slave,
__be32 slave_cap_mask;
__be64 slave_node_guid;
- port = vhcr->in_modifier;
+ slave_port = vhcr->in_modifier;
+ port = mlx4_slave_convert_port(dev, slave, slave_port);
/* network-view bit is for driver use only, and should not be passed to FW */
opcode_modifier = vhcr->op_modifier & ~0x8; /* clear netw view bit */
@@ -760,8 +761,9 @@ static int mlx4_MAD_IFC_wrapper(struct mlx4_dev *dev, int slave,
if (smp->attr_id == IB_SMP_ATTR_PORT_INFO) {
/*get the slave specific caps:*/
/*do the command */
+ smp->attr_mod = cpu_to_be32(port);
err = mlx4_cmd_box(dev, inbox->dma, outbox->dma,
- vhcr->in_modifier, opcode_modifier,
+ port, opcode_modifier,
vhcr->op, MLX4_CMD_TIME_CLASS_C, MLX4_CMD_NATIVE);
/* modify the response for slaves */
if (!err && slave != mlx4_master_func_num(dev)) {
@@ -792,7 +794,7 @@ static int mlx4_MAD_IFC_wrapper(struct mlx4_dev *dev, int slave,
}
if (smp->attr_id == IB_SMP_ATTR_NODE_INFO) {
err = mlx4_cmd_box(dev, inbox->dma, outbox->dma,
- vhcr->in_modifier, opcode_modifier,
+ port, opcode_modifier,
vhcr->op, MLX4_CMD_TIME_CLASS_C, MLX4_CMD_NATIVE);
if (!err) {
slave_node_guid = mlx4_get_slave_node_guid(dev, slave);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 158/185] IB/mlx4: Convert slave port before building address-handle
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (156 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 157/185] net/mlx4_core: Enhance the MAD_IFC wrapper to convert VF port to physical Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 159/185] ath9k_htc: memory corruption calling set_bit() Luis Henriques
` (26 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Or Gerlitz, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Or Gerlitz <ogerlitz@mellanox.com>
commit 430910b1b93292d3a724c91123bb15bd32df1b5b upstream.
When multiplexling a MAD sent from VF, we should convert the port used
by the guest to send the packet to the actual physical port which will be
used to transmit the packet, before building the relevant address-handle (AH).
This is needed under VPI for single ported VFs, since the code that builds
the AH (mlx4_ib_query_ah()) makes decisions based on the input port. If we
use the port number provided by the guest, it might have different protocol
vs. the one this packat has to go from, and hence the result could be wrong.
So far, the conversion was done after the AH was built and it worked for
single ported Eth VFs which were not enabled under VPI. When adding support
for single ported IB VFs and VPI, we hit that.
Fixes: 449fc48866f7 ('net/mlx4: Adapt code for N-Port VF')
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/infiniband/hw/mlx4/mad.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index c128abd5f4c2..35df708ffa53 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1365,14 +1365,17 @@ static void mlx4_ib_multiplex_mad(struct mlx4_ib_demux_pv_ctx *ctx, struct ib_wc
* stadard address handle by decoding the tunnelled mlx4_ah fields */
memcpy(&ah.av, &tunnel->hdr.av, sizeof (struct mlx4_av));
ah.ibah.device = ctx->ib_dev;
+
+ port = be32_to_cpu(ah.av.ib.port_pd) >> 24;
+ port = mlx4_slave_convert_port(dev->dev, slave, port);
+ if (port < 0)
+ return;
+ ah.av.ib.port_pd = cpu_to_be32(port << 24 | (be32_to_cpu(ah.av.ib.port_pd) & 0xffffff));
+
mlx4_ib_query_ah(&ah.ibah, &ah_attr);
if (ah_attr.ah_flags & IB_AH_GRH)
fill_in_real_sgid_index(dev, slave, ctx->port, &ah_attr);
- port = mlx4_slave_convert_port(dev->dev, slave, ah_attr.port_num);
- if (port < 0)
- return;
- ah_attr.port_num = port;
memcpy(ah_attr.dmac, tunnel->hdr.mac, 6);
ah_attr.vlan_id = be16_to_cpu(tunnel->hdr.vlan);
/* if slave have default vlan use it */
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 159/185] ath9k_htc: memory corruption calling set_bit()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (157 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 158/185] IB/mlx4: Convert slave port before building address-handle Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 160/185] rndis_wlan: harmless issue " Luis Henriques
` (25 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dan Carpenter, Kalle Valo, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 191f1aeeb93bb58e56f4d1868294ae22f3f67d4e upstream.
In d8a2c51cdcae ('ath9k_htc: Use atomic operations for op_flags') we
changed things like this:
- if (priv->op_flags & OP_TSF_RESET) {
+ if (test_bit(OP_TSF_RESET, &priv->op_flags)) {
The problem is that test_bit() takes a bit number and not a mask. It
means that when we do:
set_bit(OP_TSF_RESET, &priv->op_flags);
Then it sets the (1 << 6) bit instead of the 6 bit so we are setting a
bit which is past the end of the unsigned long.
Fixes: d8a2c51cdcae ('ath9k_htc: Use atomic operations for op_flags')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/wireless/ath/ath9k/htc.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 09a5d72f3ff5..792fa3c891f2 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -437,9 +437,9 @@ static inline void ath9k_htc_stop_btcoex(struct ath9k_htc_priv *priv)
}
#endif /* CONFIG_ATH9K_BTCOEX_SUPPORT */
-#define OP_BT_PRIORITY_DETECTED BIT(3)
-#define OP_BT_SCAN BIT(4)
-#define OP_TSF_RESET BIT(6)
+#define OP_BT_PRIORITY_DETECTED 3
+#define OP_BT_SCAN 4
+#define OP_TSF_RESET 6
struct ath9k_htc_priv {
struct device *dev;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 160/185] rndis_wlan: harmless issue calling set_bit()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (158 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 159/185] ath9k_htc: memory corruption calling set_bit() Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 161/185] mtd: dc21285: use raw spinlock functions for nw_gpio_lock Luis Henriques
` (24 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dan Carpenter, Kalle Valo, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit e3958e9d60b4570fff709f397ef5c6b8483f40f7 upstream.
These are used like:
set_bit(WORK_LINK_UP, &priv->work_pending);
The problem is that set_bit() takes the actual bit number and not a mask
so static checkers get upset. It doesn't affect run time because we do
it consistently, but we may as well clean it up.
Fixes: 6010ce07a66c ('rndis_wlan: do link-down state change in worker thread')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/wireless/rndis_wlan.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index d2a9a08210be..19a1c9cde772 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -356,9 +356,9 @@ struct ndis_80211_pmkid {
#define CAP_MODE_80211G 4
#define CAP_MODE_MASK 7
-#define WORK_LINK_UP (1<<0)
-#define WORK_LINK_DOWN (1<<1)
-#define WORK_SET_MULTICAST_LIST (1<<2)
+#define WORK_LINK_UP 0
+#define WORK_LINK_DOWN 1
+#define WORK_SET_MULTICAST_LIST 2
#define RNDIS_WLAN_ALG_NONE 0
#define RNDIS_WLAN_ALG_WEP (1<<0)
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 161/185] mtd: dc21285: use raw spinlock functions for nw_gpio_lock
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (159 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 160/185] rndis_wlan: harmless issue " Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 162/185] mac80211: prevent possible crypto tx tailroom corruption Luis Henriques
` (23 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Uwe Kleine-König, Brian Norris, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
commit e5babdf928e5d0c432a8d4b99f20421ce14d1ab6 upstream.
Since commit bd31b85960a7 (which is in 3.2-rc1) nw_gpio_lock is a raw spinlock
that needs usage of the corresponding raw functions.
This fixes:
drivers/mtd/maps/dc21285.c: In function 'nw_en_write':
drivers/mtd/maps/dc21285.c:41:340: warning: passing argument 1 of 'spinlock_check' from incompatible pointer type
spin_lock_irqsave(&nw_gpio_lock, flags);
In file included from include/linux/seqlock.h:35:0,
from include/linux/time.h:5,
from include/linux/stat.h:18,
from include/linux/module.h:10,
from drivers/mtd/maps/dc21285.c:8:
include/linux/spinlock.h:299:102: note: expected 'struct spinlock_t *' but argument is of type 'struct raw_spinlock_t *'
static inline raw_spinlock_t *spinlock_check(spinlock_t *lock)
^
drivers/mtd/maps/dc21285.c:43:25: warning: passing argument 1 of 'spin_unlock_irqrestore' from incompatible pointer type
spin_unlock_irqrestore(&nw_gpio_lock, flags);
^
In file included from include/linux/seqlock.h:35:0,
from include/linux/time.h:5,
from include/linux/stat.h:18,
from include/linux/module.h:10,
from drivers/mtd/maps/dc21285.c:8:
include/linux/spinlock.h:370:91: note: expected 'struct spinlock_t *' but argument is of type 'struct raw_spinlock_t *'
static inline void spin_unlock_irqrestore(spinlock_t *lock, unsigned long flags)
Fixes: bd31b85960a7 ("locking, ARM: Annotate low level hw locks as raw")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/mtd/maps/dc21285.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/maps/dc21285.c b/drivers/mtd/maps/dc21285.c
index f8a7dd14cee0..70a3db3ab856 100644
--- a/drivers/mtd/maps/dc21285.c
+++ b/drivers/mtd/maps/dc21285.c
@@ -38,9 +38,9 @@ static void nw_en_write(void)
* we want to write a bit pattern XXX1 to Xilinx to enable
* the write gate, which will be open for about the next 2ms.
*/
- spin_lock_irqsave(&nw_gpio_lock, flags);
+ raw_spin_lock_irqsave(&nw_gpio_lock, flags);
nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE);
- spin_unlock_irqrestore(&nw_gpio_lock, flags);
+ raw_spin_unlock_irqrestore(&nw_gpio_lock, flags);
/*
* let the ISA bus to catch on...
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 162/185] mac80211: prevent possible crypto tx tailroom corruption
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (160 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 161/185] mtd: dc21285: use raw spinlock functions for nw_gpio_lock Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 163/185] cfg80211: ignore netif running state when changing iftype Luis Henriques
` (22 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Michal Kazior, Johannes Berg, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kazior <michal.kazior@tieto.com>
commit ab499db80fcf07c18e4053f91a619500f663e90e upstream.
There was a possible race between
ieee80211_reconfig() and
ieee80211_delayed_tailroom_dec(). This could
result in inability to transmit data if driver
crashed during roaming or rekeying and subsequent
skbs with insufficient tailroom appeared.
This race was probably never seen in the wild
because a device driver would have to crash AND
recover within 0.5s which is very unlikely.
I was able to prove this race exists after
changing the delay to 10s locally and crashing
ath10k via debugfs immediately after GTK
rekeying. In case of ath10k the counter went below
0. This was harmless but other drivers which
actually require tailroom (e.g. for WEP ICV or
MMIC) could end up with the counter at 0 instead
of >0 and introduce insufficient skb tailroom
failures because mac80211 would not resize skbs
appropriately anymore.
Fixes: 8d1f7ecd2af5 ("mac80211: defer tailroom counter manipulation when roaming")
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/mac80211/main.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index d17c26d6e369..8915b1e081e4 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -248,6 +248,7 @@ static void ieee80211_restart_work(struct work_struct *work)
{
struct ieee80211_local *local =
container_of(work, struct ieee80211_local, restart_work);
+ struct ieee80211_sub_if_data *sdata;
/* wait for scan work complete */
flush_workqueue(local->workqueue);
@@ -256,6 +257,8 @@ static void ieee80211_restart_work(struct work_struct *work)
"%s called with hardware scan in progress\n", __func__);
rtnl_lock();
+ list_for_each_entry(sdata, &local->interfaces, list)
+ flush_delayed_work(&sdata->dec_tailroom_needed_wk);
ieee80211_scan_cancel(local);
ieee80211_reconfig(local);
rtnl_unlock();
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 163/185] cfg80211: ignore netif running state when changing iftype
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (161 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 162/185] mac80211: prevent possible crypto tx tailroom corruption Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 164/185] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function Luis Henriques
` (21 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Michal Kazior, Johannes Berg, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kazior <michal.kazior@tieto.com>
commit 6cbfb1bb66e4e85da5db78e8ff429a85bd84ce64 upstream.
It was possible for mac80211 to be coerced into an
unexpected flow causing sdata union to become
corrupted. Station pointer was put into
sdata->u.vlan.sta memory location while it was
really master AP's sdata->u.ap.next_beacon. This
led to station entry being later freed as
next_beacon before __sta_info_flush() in
ieee80211_stop_ap() and a subsequent invalid
pointer dereference crash.
The problem was that ieee80211_ptr->use_4addr
wasn't cleared on interface type changes.
This could be reproduced with the following steps:
# host A and host B have just booted; no
# wpa_s/hostapd running; all vifs are down
host A> iw wlan0 set type station
host A> iw wlan0 set 4addr on
host A> printf 'interface=wlan0\nssid=4addrcrash\nchannel=1\nwds_sta=1' > /tmp/hconf
host A> hostapd -B /tmp/conf
host B> iw wlan0 set 4addr on
host B> ifconfig wlan0 up
host B> iw wlan0 connect -w hostAssid
host A> pkill hostapd
# host A crashed:
[ 127.928192] BUG: unable to handle kernel NULL pointer dereference at 00000000000006c8
[ 127.929014] IP: [<ffffffff816f4f32>] __sta_info_flush+0xac/0x158
...
[ 127.934578] [<ffffffff8170789e>] ieee80211_stop_ap+0x139/0x26c
[ 127.934578] [<ffffffff8100498f>] ? dump_trace+0x279/0x28a
[ 127.934578] [<ffffffff816dc661>] __cfg80211_stop_ap+0x84/0x191
[ 127.934578] [<ffffffff816dc7ad>] cfg80211_stop_ap+0x3f/0x58
[ 127.934578] [<ffffffff816c5ad6>] nl80211_stop_ap+0x1b/0x1d
[ 127.934578] [<ffffffff815e53f8>] genl_family_rcv_msg+0x259/0x2b5
Note: This isn't a revert of f8cdddb8d61d
("cfg80211: check iface combinations only when
iface is running") as far as functionality is
considered because b6a550156bc ("cfg80211/mac80211:
move more combination checks to mac80211") moved
the logic somewhere else already.
Fixes: f8cdddb8d61d ("cfg80211: check iface combinations only when iface is running")
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/wireless/util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 728f1c0dc70d..b5dd3c829b1a 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -891,7 +891,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
ntype == NL80211_IFTYPE_P2P_CLIENT))
return -EBUSY;
- if (ntype != otype && netif_running(dev)) {
+ if (ntype != otype) {
dev->ieee80211_ptr->use_4addr = false;
dev->ieee80211_ptr->mesh_id_up_len = 0;
wdev_lock(dev->ieee80211_ptr);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 164/185] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function.
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (162 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 163/185] cfg80211: ignore netif running state when changing iftype Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 165/185] NFS: Fix size of NFSACL SETACL operations Luis Henriques
` (20 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: NeilBrown, Kishon Vijay Abraham I, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neil@brown.name>
commit 4724e27114c4a7eceeee07db227a17fcab6f165c upstream.
The USB phy should initialize with power-off, and will be powered on
by the USB system when a cable connection is detected.
Having this pm_runtime_get_sync() during probe causes the phy to
*always* be powered on.
Removing it returns to sensible power management.
Fixes: 96be39ab34b77c6f6f5cd6ae03aac6c6449ee5c4
Signed-off-by: NeilBrown <neil@brown.name>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/phy/phy-twl4030-usb.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
index ef4f3350faa1..a2b877911b0f 100644
--- a/drivers/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -745,7 +745,6 @@ static int twl4030_usb_probe(struct platform_device *pdev)
pm_runtime_use_autosuspend(&pdev->dev);
pm_runtime_set_autosuspend_delay(&pdev->dev, 2000);
pm_runtime_enable(&pdev->dev);
- pm_runtime_get_sync(&pdev->dev);
/* Our job is to use irqs and status from the power module
* to keep the transceiver disabled when nothing's connected.
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 165/185] NFS: Fix size of NFSACL SETACL operations
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (163 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 164/185] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 166/185] Btrfs: lock superblock before remounting for rw subvol Luis Henriques
` (19 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Chuck Lever, Trond Myklebust, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit d683cc49daf7c5afca8cd9654aaa1bf63cdf2ad9 upstream.
When encoding the NFSACL SETACL operation, reserve just the estimated
size of the ACL rather than a fixed maximum. This eliminates needless
zero padding on the wire that the server ignores.
Fixes: ee5dc7732bd5 ('NFS: Fix "kernel BUG at fs/nfs/nfs3xdr.c:1338!"')
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/nfs/nfs3xdr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index 8f4cbe7f4aa8..53853ca134e5 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -1342,7 +1342,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req,
if (args->npages != 0)
xdr_write_pages(xdr, args->pages, 0, args->len);
else
- xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE);
+ xdr_reserve_space(xdr, args->len);
error = nfsacl_encode(xdr->buf, base, args->inode,
(args->mask & NFS_ACL) ?
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 166/185] Btrfs: lock superblock before remounting for rw subvol
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (164 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 165/185] NFS: Fix size of NFSACL SETACL operations Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 167/185] of: return NUMA_NO_NODE from fallback of_node_to_nid() Luis Henriques
` (18 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Omar Sandoval, Chris Mason, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Omar Sandoval <osandov@osandov.com>
commit 773cd04ec1911abb33cf9538b65f55b76cad5d92 upstream.
Since commit 0723a0473fb4 ("btrfs: allow mounting btrfs subvolumes with
different ro/rw options"), when mounting a subvolume read/write when
another subvolume has previously been mounted read-only, we first do a
remount. However, this should be done with the superblock locked, as per
sync_filesystem():
/*
* We need to be protected against the filesystem going from
* r/o to r/w or vice versa.
*/
WARN_ON(!rwsem_is_locked(&sb->s_umount));
This WARN_ON can easily be hit with:
mkfs.btrfs -f /dev/vdb
mount /dev/vdb /mnt
btrfs subvol create /mnt/vol1
btrfs subvol create /mnt/vol2
umount /mnt
mount -oro,subvol=/vol1 /dev/vdb /mnt
mount -orw,subvol=/vol2 /dev/vdb /mnt2
Fixes: 0723a0473fb4 ("btrfs: allow mounting btrfs subvolumes with different ro/rw options")
Reviewed-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Omar Sandoval <osandov@osandov.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/btrfs/super.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 600035120ca3..863f3d65fe39 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1203,7 +1203,9 @@ static struct dentry *mount_subvol(const char *subvol_name, int flags,
return ERR_CAST(mnt);
}
+ down_write(&mnt->mnt_sb->s_umount);
r = btrfs_remount(mnt->mnt_sb, &flags, NULL);
+ up_write(&mnt->mnt_sb->s_umount);
if (r < 0) {
/* FIXME: release vfsmount mnt ??*/
kfree(newargs);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 167/185] of: return NUMA_NO_NODE from fallback of_node_to_nid()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (165 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 166/185] Btrfs: lock superblock before remounting for rw subvol Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 168/185] sched/fair: Prevent throttling in early pick_next_task_fair() Luis Henriques
` (17 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Konstantin Khlebnikov, Grant Likely, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
commit c8fff7bc5bba6bd59cad40441c189c4efe7190f6 upstream.
Node 0 might be offline as well as any other numa node,
in this case kernel cannot handle memory allocation and crashes.
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Fixes: 0c3f061c195c ("of: implement of_node_to_nid as a weak function")
Signed-off-by: Grant Likely <grant.likely@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/of/base.c | 2 +-
include/linux/of.h | 5 ++++-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 296bc43d26cc..9985665f7397 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -85,7 +85,7 @@ EXPORT_SYMBOL(of_n_size_cells);
#ifdef CONFIG_NUMA
int __weak of_node_to_nid(struct device_node *np)
{
- return numa_node_id();
+ return NUMA_NO_NODE;
}
#endif
diff --git a/include/linux/of.h b/include/linux/of.h
index db2f8ac18dad..55452d38ae06 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -580,7 +580,10 @@ static inline const char *of_prop_next_string(struct property *prop,
#if defined(CONFIG_OF) && defined(CONFIG_NUMA)
extern int of_node_to_nid(struct device_node *np);
#else
-static inline int of_node_to_nid(struct device_node *device) { return 0; }
+static inline int of_node_to_nid(struct device_node *device)
+{
+ return NUMA_NO_NODE;
+}
#endif
static inline struct device_node *of_find_matching_node(
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 168/185] sched/fair: Prevent throttling in early pick_next_task_fair()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (166 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 167/185] of: return NUMA_NO_NODE from fallback of_node_to_nid() Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 169/185] ASoC: imx-wm8962: Add a missing error check Luis Henriques
` (16 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Ben Segall, Peter Zijlstra (Intel),
Andrew Morton, H. Peter Anvin, Linus Torvalds, Roman Gushchin,
Thomas Gleixner, pjt, Ingo Molnar, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Segall <bsegall@google.com>
commit 54d27365cae88fbcc853b391dcd561e71acb81fa upstream.
The optimized task selection logic optimistically selects a new task
to run without first doing a full put_prev_task(). This is so that we
can avoid a put/set on the common ancestors of the old and new task.
Similarly, we should only call check_cfs_rq_runtime() to throttle
eligible groups if they're part of the common ancestry, otherwise it
is possible to end up with no eligible task in the simple task
selection.
Imagine:
/root
/prev /next
/A /B
If our optimistic selection ends up throttling /next, we goto simple
and our put_prev_task() ends up throttling /prev, after which we're
going to bug out in set_next_entity() because there aren't any tasks
left.
Avoid this scenario by only throttling common ancestors.
Reported-by: Mohammed Naser <mnaser@vexxhost.com>
Reported-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Ben Segall <bsegall@google.com>
[ munged Changelog ]
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Roman Gushchin <klamm@yandex-team.ru>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: pjt@google.com
Fixes: 678d5718d8d0 ("sched/fair: Optimize cgroup pick_next_task_fair()")
Link: http://lkml.kernel.org/r/xm26wq1oswoq.fsf@sword-of-the-dawn.mtv.corp.google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
kernel/sched/fair.c | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index fea7d3335e1f..123078569a96 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -4773,18 +4773,21 @@ again:
* entity, update_curr() will update its vruntime, otherwise
* forget we've ever seen it.
*/
- if (curr && curr->on_rq)
- update_curr(cfs_rq);
- else
- curr = NULL;
+ if (curr) {
+ if (curr->on_rq)
+ update_curr(cfs_rq);
+ else
+ curr = NULL;
- /*
- * This call to check_cfs_rq_runtime() will do the throttle and
- * dequeue its entity in the parent(s). Therefore the 'simple'
- * nr_running test will indeed be correct.
- */
- if (unlikely(check_cfs_rq_runtime(cfs_rq)))
- goto simple;
+ /*
+ * This call to check_cfs_rq_runtime() will do the
+ * throttle and dequeue its entity in the parent(s).
+ * Therefore the 'simple' nr_running test will indeed
+ * be correct.
+ */
+ if (unlikely(check_cfs_rq_runtime(cfs_rq)))
+ goto simple;
+ }
se = pick_next_entity(cfs_rq, curr);
cfs_rq = group_cfs_rq(se);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 169/185] ASoC: imx-wm8962: Add a missing error check
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (167 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 168/185] sched/fair: Prevent throttling in early pick_next_task_fair() Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 170/185] ACPI / init: Switch over platform to the ACPI mode later Luis Henriques
` (15 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Dan Carpenter, Mark Brown, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 474ff0ae23b834e9fc18374d14bb5f3e7b3828b4 upstream.
My static checker complains that:
sound/soc/fsl/imx-wm8962.c:196 imx_wm8962_probe() warn:
we tested 'ret' before and it was 'false'
The intent was that we use "ret" to check imx_audmux_v2_configure_port().
Fixes: 8de2ae2a7f1f ('ASoC: fsl: add imx-wm8962 machine driver')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Otherwise, Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/soc/fsl/imx-wm8962.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c
index 3a3d17ce6ba4..664452599497 100644
--- a/sound/soc/fsl/imx-wm8962.c
+++ b/sound/soc/fsl/imx-wm8962.c
@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platform_device *pdev)
dev_err(&pdev->dev, "audmux internal port setup failed\n");
return ret;
}
- imx_audmux_v2_configure_port(ext_port,
+ ret = imx_audmux_v2_configure_port(ext_port,
IMX_AUDMUX_V2_PTCR_SYN,
IMX_AUDMUX_V2_PDCR_RXDSEL(int_port));
if (ret) {
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 170/185] ACPI / init: Switch over platform to the ACPI mode later
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (168 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 169/185] ASoC: imx-wm8962: Add a missing error check Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 171/185] drm/tegra: dpaux: Fix transfers larger than 4 bytes Luis Henriques
` (14 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Rafael J. Wysocki, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
commit b064a8fa77dfead647564c46ac8fc5b13bd1ab73 upstream.
Commit 73f7d1ca3263 "ACPI / init: Run acpi_early_init() before
timekeeping_init()" moved the ACPI subsystem initialization,
including the ACPI mode enabling, to an earlier point in the
initialization sequence, to allow the timekeeping subsystem
use ACPI early. Unfortunately, that resulted in boot regressions
on some systems and the early ACPI initialization was moved toward
its original position in the kernel initialization code by commit
c4e1acbb35e4 "ACPI / init: Invoke early ACPI initialization later".
However, that turns out to be insufficient, as boot is still broken
on the Tyan S8812 mainboard.
To fix that issue, split the ACPI early initialization code into
two pieces so the majority of it still located in acpi_early_init()
and the part switching over the platform into the ACPI mode goes into
a new function, acpi_subsystem_init(), executed at the original early
ACPI initialization spot.
That fixes the Tyan S8812 boot problem, but still allows ACPI
tables to be loaded earlier which is useful to the EFI code in
efi_enter_virtual_mode().
Link: https://bugzilla.kernel.org/show_bug.cgi?id=97141
Fixes: 73f7d1ca3263 "ACPI / init: Run acpi_early_init() before timekeeping_init()"
Reported-and-tested-by: Marius Tolzmann <tolzmann@molgen.mpg.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Toshi Kani <toshi.kani@hp.com>
Reviewed-by: Hanjun Guo <hanjun.guo@linaro.org>
Reviewed-by: Lee, Chun-Yi <jlee@suse.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/acpi/bus.c | 56 ++++++++++++++++++++++++++++++++++++++--------------
include/linux/acpi.h | 2 ++
init/main.c | 1 +
3 files changed, 44 insertions(+), 15 deletions(-)
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index c5bc8cfe09fa..60a38349f297 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -480,6 +480,16 @@ static int __init acpi_bus_init_irq(void)
u8 acpi_gbl_permanent_mmap;
+/**
+ * acpi_early_init - Initialize ACPICA and populate the ACPI namespace.
+ *
+ * The ACPI tables are accessible after this, but the handling of events has not
+ * been initialized and the global lock is not available yet, so AML should not
+ * be executed at this point.
+ *
+ * Doing this before switching the EFI runtime services to virtual mode allows
+ * the EfiBootServices memory to be freed slightly earlier on boot.
+ */
void __init acpi_early_init(void)
{
acpi_status status;
@@ -543,26 +553,42 @@ void __init acpi_early_init(void)
acpi_gbl_FADT.sci_interrupt = acpi_sci_override_gsi;
}
#endif
+ return;
+
+ error0:
+ disable_acpi();
+}
+
+/**
+ * acpi_subsystem_init - Finalize the early initialization of ACPI.
+ *
+ * Switch over the platform to the ACPI mode (if possible), initialize the
+ * handling of ACPI events, install the interrupt and global lock handlers.
+ *
+ * Doing this too early is generally unsafe, but at the same time it needs to be
+ * done before all things that really depend on ACPI. The right spot appears to
+ * be before finalizing the EFI initialization.
+ */
+void __init acpi_subsystem_init(void)
+{
+ acpi_status status;
+
+ if (acpi_disabled)
+ return;
status = acpi_enable_subsystem(~ACPI_NO_ACPI_ENABLE);
if (ACPI_FAILURE(status)) {
printk(KERN_ERR PREFIX "Unable to enable ACPI\n");
- goto error0;
+ disable_acpi();
+ } else {
+ /*
+ * If the system is using ACPI then we can be reasonably
+ * confident that any regulators are managed by the firmware
+ * so tell the regulator core it has everything it needs to
+ * know.
+ */
+ regulator_has_full_constraints();
}
-
- /*
- * If the system is using ACPI then we can be reasonably
- * confident that any regulators are managed by the firmware
- * so tell the regulator core it has everything it needs to
- * know.
- */
- regulator_has_full_constraints();
-
- return;
-
- error0:
- disable_acpi();
- return;
}
static int __init acpi_bus_init(void)
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index fa91beba3cd0..ef152461bd46 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -406,6 +406,7 @@ extern acpi_status acpi_pci_osc_control_set(acpi_handle handle,
#define ACPI_OST_SC_INSERT_NOT_SUPPORTED 0x82
extern void acpi_early_init(void);
+extern void acpi_subsystem_init(void);
extern int acpi_nvs_register(__u64 start, __u64 size);
@@ -440,6 +441,7 @@ static inline const char *acpi_dev_name(struct acpi_device *adev)
}
static inline void acpi_early_init(void) { }
+static inline void acpi_subsystem_init(void) { }
static inline int early_acpi_boot_init(void)
{
diff --git a/init/main.c b/init/main.c
index ed5f48edc7a8..44af5b583cf4 100644
--- a/init/main.c
+++ b/init/main.c
@@ -666,6 +666,7 @@ asmlinkage __visible void __init start_kernel(void)
check_bugs();
+ acpi_subsystem_init();
sfi_init_late();
if (efi_enabled(EFI_RUNTIME_SERVICES)) {
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 171/185] drm/tegra: dpaux: Fix transfers larger than 4 bytes
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (169 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 170/185] ACPI / init: Switch over platform to the ACPI mode later Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 172/185] mmc: card: Fixup request missing in mmc_blk_issue_rw_rq Luis Henriques
` (13 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Thierry Reding, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Thierry Reding <treding@nvidia.com>
commit 3c1dae0a07c651526f8e878d223a88f82caa5a50 upstream.
The DPAUX read/write FIFO registers aren't sequential in the register
space, causing transfers larger than 4 bytes to cause accesses to non-
existing FIFO registers.
Fixes: 6b6b604215c6 ("drm/tegra: Add eDP support")
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/gpu/drm/tegra/dpaux.c | 18 ++++++++----------
1 file changed, 8 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c
index 708f783ead47..7fb27458444f 100644
--- a/drivers/gpu/drm/tegra/dpaux.c
+++ b/drivers/gpu/drm/tegra/dpaux.c
@@ -72,34 +72,32 @@ static inline void tegra_dpaux_writel(struct tegra_dpaux *dpaux,
static void tegra_dpaux_write_fifo(struct tegra_dpaux *dpaux, const u8 *buffer,
size_t size)
{
- unsigned long offset = DPAUX_DP_AUXDATA_WRITE(0);
size_t i, j;
- for (i = 0; i < size; i += 4) {
- size_t num = min_t(size_t, size - i, 4);
+ for (i = 0; i < DIV_ROUND_UP(size, 4); i++) {
+ size_t num = min_t(size_t, size - i * 4, 4);
unsigned long value = 0;
for (j = 0; j < num; j++)
- value |= buffer[i + j] << (j * 8);
+ value |= buffer[i * 4 + j] << (j * 8);
- tegra_dpaux_writel(dpaux, value, offset++);
+ tegra_dpaux_writel(dpaux, value, DPAUX_DP_AUXDATA_WRITE(i));
}
}
static void tegra_dpaux_read_fifo(struct tegra_dpaux *dpaux, u8 *buffer,
size_t size)
{
- unsigned long offset = DPAUX_DP_AUXDATA_READ(0);
size_t i, j;
- for (i = 0; i < size; i += 4) {
- size_t num = min_t(size_t, size - i, 4);
+ for (i = 0; i < DIV_ROUND_UP(size, 4); i++) {
+ size_t num = min_t(size_t, size - i * 4, 4);
unsigned long value;
- value = tegra_dpaux_readl(dpaux, offset++);
+ value = tegra_dpaux_readl(dpaux, DPAUX_DP_AUXDATA_READ(i));
for (j = 0; j < num; j++)
- buffer[i + j] = value >> (j * 8);
+ buffer[i * 4 + j] = value >> (j * 8);
}
}
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 172/185] mmc: card: Fixup request missing in mmc_blk_issue_rw_rq
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (170 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 171/185] drm/tegra: dpaux: Fix transfers larger than 4 bytes Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 173/185] perf: Fix ring_buffer_attach() RCU sync, again Luis Henriques
` (12 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Ding Wang, Ulf Hansson, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Ding Wang <justin.wang@spreadtrum.com>
commit 29535f7b797df35cc9b6b3bca635591cdd3dd2a8 upstream.
The current handler of MMC_BLK_CMD_ERR in mmc_blk_issue_rw_rq function
may cause new coming request permanent missing when the ongoing
request (previoulsy started) complete end.
The problem scenario is as follows:
(1) Request A is ongoing;
(2) Request B arrived, and finally mmc_blk_issue_rw_rq() is called;
(3) Request A encounters the MMC_BLK_CMD_ERR error;
(4) In the error handling of MMC_BLK_CMD_ERR, suppose mmc_blk_cmd_err()
end request A completed and return zero. Continue the error handling,
suppose mmc_blk_reset() reset device success;
(5) Continue the execution, while loop completed because variable ret
is zero now;
(6) Finally, mmc_blk_issue_rw_rq() return without processing request B.
The process related to the missing request may wait that IO request
complete forever, possibly crashing the application or hanging the system.
Fix this issue by starting new request when reset success.
Signed-off-by: Ding Wang <justin.wang@spreadtrum.com>
Fixes: 67716327eec7 ("mmc: block: add eMMC hardware reset support")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/mmc/card/block.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index e32206ecfa04..7ec3c79852e5 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -1910,9 +1910,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc)
break;
case MMC_BLK_CMD_ERR:
ret = mmc_blk_cmd_err(md, card, brq, req, ret);
- if (!mmc_blk_reset(md, card->host, type))
- break;
- goto cmd_abort;
+ if (mmc_blk_reset(md, card->host, type))
+ goto cmd_abort;
+ if (!ret)
+ goto start_new_req;
+ break;
case MMC_BLK_RETRY:
if (retry++ < 5)
break;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 173/185] perf: Fix ring_buffer_attach() RCU sync, again
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (171 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 172/185] mmc: card: Fixup request missing in mmc_blk_issue_rw_rq Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 174/185] watchdog: omap: assert the counter being stopped before reprogramming Luis Henriques
` (11 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Oleg Nesterov, Peter Zijlstra (Intel),
Alexander Shishkin, Andrew Morton, Andy Lutomirski,
Borislav Petkov, Brian Gerst, Denys Vlasenko, H. Peter Anvin,
Linus Torvalds, Paul E. McKenney, Thomas Gleixner, dave,
der.herr, josh, tj, Ingo Molnar, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit 2f993cf093643b98477c421fa2b9a98dcc940323 upstream.
While looking for other users of get_state/cond_sync. I Found
ring_buffer_attach() and it looks obviously buggy?
Don't we need to ensure that we have "synchronize" _between_
list_del() and list_add() ?
IOW. Suppose that ring_buffer_attach() preempts right_after
get_state_synchronize_rcu() and gp completes before spin_lock().
In this case cond_synchronize_rcu() does nothing and we reuse
->rb_entry without waiting for gp in between?
It also moves the ->rcu_pending check under "if (rb)", to make it
more readable imo.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: dave@stgolabs.net
Cc: der.herr@hofr.at
Cc: josh@joshtriplett.org
Cc: tj@kernel.org
Fixes: b69cf53640da ("perf: Fix a race between ring_buffer_detach() and ring_buffer_attach()")
Link: http://lkml.kernel.org/r/20150530200425.GA15748@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
kernel/events/core.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 92320781b140..40338799dcb0 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3944,20 +3944,20 @@ static void ring_buffer_attach(struct perf_event *event,
WARN_ON_ONCE(event->rcu_pending);
old_rb = event->rb;
- event->rcu_batches = get_state_synchronize_rcu();
- event->rcu_pending = 1;
-
spin_lock_irqsave(&old_rb->event_lock, flags);
list_del_rcu(&event->rb_entry);
spin_unlock_irqrestore(&old_rb->event_lock, flags);
- }
- if (event->rcu_pending && rb) {
- cond_synchronize_rcu(event->rcu_batches);
- event->rcu_pending = 0;
+ event->rcu_batches = get_state_synchronize_rcu();
+ event->rcu_pending = 1;
}
if (rb) {
+ if (event->rcu_pending) {
+ cond_synchronize_rcu(event->rcu_batches);
+ event->rcu_pending = 0;
+ }
+
spin_lock_irqsave(&rb->event_lock, flags);
list_add_rcu(&event->rb_entry, &rb->event_list);
spin_unlock_irqrestore(&rb->event_lock, flags);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 174/185] watchdog: omap: assert the counter being stopped before reprogramming
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (172 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 173/185] perf: Fix ring_buffer_attach() RCU sync, again Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 175/185] bridge: multicast: restore router configuration on port link down/up Luis Henriques
` (10 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Uwe Kleine-König, Wim Van Sebroeck, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
commit 530c11d432727c697629ad5f9d00ee8e2864d453 upstream.
The omap watchdog has the annoying behaviour that writes to most
registers don't have any effect when the watchdog is already running.
Quoting the AM335x reference manual:
To modify the timer counter value (the WDT_WCRR register),
prescaler ratio (the WDT_WCLR[4:2] PTV bit field), delay
configuration value (the WDT_WDLY[31:0] DLY_VALUE bit field), or
the load value (the WDT_WLDR[31:0] TIMER_LOAD bit field), the
watchdog timer must be disabled by using the start/stop sequence
(the WDT_WSPR register).
Currently the timer is stopped in the .probe callback but still there
are possibilities that yield to a situation where omap_wdt_start is
entered with the timer running (e.g. when /dev/watchdog is closed
without stopping and then reopened). In such a case programming the
timeout silently fails!
To circumvent this stop the timer before reprogramming.
Assuming one of the first things the watchdog user does is setting the
timeout explicitly nothing too bad should happen because this explicit
setting works fine.
Fixes: 7768a13c252a ("[PATCH] OMAP: Add Watchdog driver support")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/watchdog/omap_wdt.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
index 3691b157516a..0c8868eceb4d 100644
--- a/drivers/watchdog/omap_wdt.c
+++ b/drivers/watchdog/omap_wdt.c
@@ -132,6 +132,13 @@ static int omap_wdt_start(struct watchdog_device *wdog)
pm_runtime_get_sync(wdev->dev);
+ /*
+ * Make sure the watchdog is disabled. This is unfortunately required
+ * because writing to various registers with the watchdog running has no
+ * effect.
+ */
+ omap_wdt_disable(wdev);
+
/* initialize prescaler */
while (readl_relaxed(base + OMAP_WATCHDOG_WPS) & 0x01)
cpu_relax();
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 175/185] bridge: multicast: restore router configuration on port link down/up
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (173 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 174/185] watchdog: omap: assert the counter being stopped before reprogramming Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 176/185] mm/hugetlb: introduce minimum hugepage order Luis Henriques
` (9 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Satish Ashok, Nikolay Aleksandrov, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Satish Ashok <sashok@cumulusnetworks.com>
commit 754bc547f0a79f7568b5b81c7fc0a8d044a6571a upstream.
When a port goes through a link down/up the multicast router configuration
is not restored.
Signed-off-by: Satish Ashok <sashok@cumulusnetworks.com>
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Fixes: 0909e11758bd ("bridge: Add multicast_router sysfs entries")
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/bridge/br_multicast.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 32de99bf6e42..46ac609d0882 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -37,6 +37,8 @@
static void br_multicast_start_querier(struct net_bridge *br,
struct bridge_mcast_own_query *query);
+static void br_multicast_add_router(struct net_bridge *br,
+ struct net_bridge_port *port);
unsigned int br_mdb_rehash_seq;
static inline int br_ip_equal(const struct br_ip *a, const struct br_ip *b)
@@ -935,6 +937,8 @@ void br_multicast_enable_port(struct net_bridge_port *port)
#if IS_ENABLED(CONFIG_IPV6)
br_multicast_enable(&port->ip6_own_query);
#endif
+ if (port->multicast_router == 2 && hlist_unhashed(&port->rlist))
+ br_multicast_add_router(br, port);
out:
spin_unlock(&br->multicast_lock);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 176/185] mm/hugetlb: introduce minimum hugepage order
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (174 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 175/185] bridge: multicast: restore router configuration on port link down/up Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 177/185] security_syslog() should be called once only Luis Henriques
` (8 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Naoya Horiguchi, Andrew Morton, Linus Torvalds, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
commit 641844f5616d7c6597309f560838f996466d7aac upstream.
Currently the initial value of order in dissolve_free_huge_page is 64 or
32, which leads to the following warning in static checker:
mm/hugetlb.c:1203 dissolve_free_huge_pages()
warn: potential right shift more than type allows '9,18,64'
This is a potential risk of infinite loop, because 1 << order (== 0) is used
in for-loop like this:
for (pfn =3D start_pfn; pfn < end_pfn; pfn +=3D 1 << order)
...
So this patch fixes it by using global minimum_order calculated at boot time.
text data bss dec hex filename
28313 469 84236 113018 1b97a mm/hugetlb.o
28256 473 84236 112965 1b945 mm/hugetlb.o (patched)
Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
mm/hugetlb.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 5f217e906ff9..94add6da0fad 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -41,6 +41,11 @@ unsigned long hugepages_treat_as_movable;
int hugetlb_max_hstate __read_mostly;
unsigned int default_hstate_idx;
struct hstate hstates[HUGE_MAX_HSTATE];
+/*
+ * Minimum page order among possible hugepage sizes, set to a proper value
+ * at boot time.
+ */
+static unsigned int minimum_order __read_mostly = UINT_MAX;
__initdata LIST_HEAD(huge_boot_pages);
@@ -1085,19 +1090,13 @@ static void dissolve_free_huge_page(struct page *page)
*/
void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
{
- unsigned int order = 8 * sizeof(void *);
unsigned long pfn;
- struct hstate *h;
if (!hugepages_supported())
return;
- /* Set scan step to minimum hugepage size */
- for_each_hstate(h)
- if (order > huge_page_order(h))
- order = huge_page_order(h);
- VM_BUG_ON(!IS_ALIGNED(start_pfn, 1 << order));
- for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << order)
+ VM_BUG_ON(!IS_ALIGNED(start_pfn, 1 << minimum_order));
+ for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order)
dissolve_free_huge_page(pfn_to_page(pfn));
}
@@ -1524,10 +1523,14 @@ static void __init hugetlb_init_hstates(void)
struct hstate *h;
for_each_hstate(h) {
+ if (minimum_order > huge_page_order(h))
+ minimum_order = huge_page_order(h);
+
/* oversize hugepages were init'ed in early boot */
if (!hstate_is_gigantic(h))
hugetlb_hstate_alloc_pages(h);
}
+ VM_BUG_ON(minimum_order == UINT_MAX);
}
static char * __init memfmt(char *buf, unsigned long n)
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 177/185] security_syslog() should be called once only
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (175 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 176/185] mm/hugetlb: introduce minimum hugepage order Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 178/185] __bitmap_parselist: fix bug in empty string handling Luis Henriques
` (7 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Vasily Averin, Kees Cook, Josh Boyer, Eric Paris, Andrew Morton,
Linus Torvalds, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <vvs@virtuozzo.com>
commit d194e5d666225b04c7754471df0948f645b6ab3a upstream.
The final version of commit 637241a900cb ("kmsg: honor dmesg_restrict
sysctl on /dev/kmsg") lost few hooks, as result security_syslog() are
processed incorrectly:
- open of /dev/kmsg checks syslog access permissions by using
check_syslog_permissions() where security_syslog() is not called if
dmesg_restrict is set.
- syslog syscall and /proc/kmsg calls do_syslog() where security_syslog
can be executed twice (inside check_syslog_permissions() and then
directly in do_syslog())
With this patch security_syslog() is called once only in all
syslog-related operations regardless of dmesg_restrict value.
Fixes: 637241a900cb ("kmsg: honor dmesg_restrict sysctl on /dev/kmsg")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Josh Boyer <jwboyer@redhat.com>
Cc: Eric Paris <eparis@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
kernel/printk/printk.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index cce20d2f38d5..f7f6f7e5ff8a 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -478,11 +478,11 @@ static int check_syslog_permissions(int type, bool from_file)
* already done the capabilities checks at open time.
*/
if (from_file && type != SYSLOG_ACTION_OPEN)
- return 0;
+ goto ok;
if (syslog_action_restricted(type)) {
if (capable(CAP_SYSLOG))
- return 0;
+ goto ok;
/*
* For historical reasons, accept CAP_SYS_ADMIN too, with
* a warning.
@@ -492,10 +492,11 @@ static int check_syslog_permissions(int type, bool from_file)
"CAP_SYS_ADMIN but no CAP_SYSLOG "
"(deprecated).\n",
current->comm, task_pid_nr(current));
- return 0;
+ goto ok;
}
return -EPERM;
}
+ok:
return security_syslog(type);
}
@@ -1221,10 +1222,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
if (error)
goto out;
- error = security_syslog(type);
- if (error)
- return error;
-
switch (type) {
case SYSLOG_ACTION_CLOSE: /* Close log */
break;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 178/185] __bitmap_parselist: fix bug in empty string handling
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (176 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 177/185] security_syslog() should be called once only Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 179/185] x86/iosf: Add Kconfig prompt for IOSF_MBI selection Luis Henriques
` (6 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Chris Metcalf, Rasmus Villemoes, Andrew Morton, Linus Torvalds,
Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Metcalf <cmetcalf@ezchip.com>
commit 2528a8b8f457d7432552d0e2b6f0f4046bb702f4 upstream.
bitmap_parselist("", &mask, nmaskbits) will erroneously set bit zero in
the mask. The same bug is visible in cpumask_parselist() since it is
layered on top of the bitmask code, e.g. if you boot with "isolcpus=",
you will actually end up with cpu zero isolated.
The bug was introduced in commit 4b060420a596 ("bitmap, irq: add
smp_affinity_list interface to /proc/irq") when bitmap_parselist() was
generalized to support userspace as well as kernelspace.
Fixes: 4b060420a596 ("bitmap, irq: add smp_affinity_list interface to /proc/irq")
Signed-off-by: Chris Metcalf <cmetcalf@ezchip.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
lib/bitmap.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/lib/bitmap.c b/lib/bitmap.c
index e5c4ebe586ba..c0634aa923a6 100644
--- a/lib/bitmap.c
+++ b/lib/bitmap.c
@@ -603,12 +603,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
unsigned a, b;
int c, old_c, totaldigits;
const char __user __force *ubuf = (const char __user __force *)buf;
- int exp_digit, in_range;
+ int at_start, in_range;
totaldigits = c = 0;
bitmap_zero(maskp, nmaskbits);
do {
- exp_digit = 1;
+ at_start = 1;
in_range = 0;
a = b = 0;
@@ -637,11 +637,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
break;
if (c == '-') {
- if (exp_digit || in_range)
+ if (at_start || in_range)
return -EINVAL;
b = 0;
in_range = 1;
- exp_digit = 1;
continue;
}
@@ -651,16 +650,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
b = b * 10 + (c - '0');
if (!in_range)
a = b;
- exp_digit = 0;
+ at_start = 0;
totaldigits++;
}
if (!(a <= b))
return -EINVAL;
if (b >= nmaskbits)
return -ERANGE;
- while (a <= b) {
- set_bit(a, maskp);
- a++;
+ if (!at_start) {
+ while (a <= b) {
+ set_bit(a, maskp);
+ a++;
+ }
}
} while (buflen && c == ',');
return 0;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 179/185] x86/iosf: Add Kconfig prompt for IOSF_MBI selection
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (177 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 178/185] __bitmap_parselist: fix bug in empty string handling Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 180/185] kvm: x86: fix kvm_apic_has_events to check for NULL pointer Luis Henriques
` (5 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: David E. Box, H. Peter Anvin, William Dauchy, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "David E. Box" <david.e.box@linux.intel.com>
commit aa8e4f22ab7773352ba3895597189b8097f2c307 upstream.
Fixes an error in having the iosf build as 'default m'. On X86 SoC's the iosf
sideband is the only way to access information for some registers, as opposed to
through MSR's on other Intel architectures. While selecting IOSF_MBI is
preferred, it does mean carrying extra code on non-SoC architectures. This
exports the selection to the user, allowing those driver writers to compile out
iosf code if it's not being built.
Signed-off-by: David E. Box <david.e.box@linux.intel.com>
Link: http://lkml.kernel.org/r/1409175640-32426-2-git-send-email-david.e.box@linux.intel.com
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: William Dauchy <william@gandi.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/x86/Kconfig | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 04fe4a66c3ec..a51d8286c75d 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2405,9 +2405,19 @@ config X86_DMA_REMAP
depends on STA2X11
config IOSF_MBI
- tristate
- default m
+ tristate "Intel System On Chip IOSF Sideband support"
depends on PCI
+ ---help---
+ Enables sideband access to mailbox registers on SoC's. The sideband is
+ available on the following platforms. This list is not meant to be
+ exclusive.
+ - BayTrail
+ - Cherryview
+ - Braswell
+ - Quark
+
+ You should say Y if you are running a kernel on one of these
+ platforms.
source "net/Kconfig"
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 180/185] kvm: x86: fix kvm_apic_has_events to check for NULL pointer
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (178 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 179/185] x86/iosf: Add Kconfig prompt for IOSF_MBI selection Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 181/185] sparc: Use GFP_ATOMIC in ldc_alloc_exp_dring() as it can be called in softirq context Luis Henriques
` (4 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Paolo Bonzini, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit ce40cd3fc7fa40a6119e5fe6c0f2bc0eb4541009 upstream.
Malicious (or egregiously buggy) userspace can trigger it, but it
should never happen in normal operation.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/x86/kvm/lapic.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h
index 6a11845fd8b9..72051730caf1 100644
--- a/arch/x86/kvm/lapic.h
+++ b/arch/x86/kvm/lapic.h
@@ -165,7 +165,7 @@ static inline u16 apic_logical_id(struct kvm_apic_map *map, u32 ldr)
static inline bool kvm_apic_has_events(struct kvm_vcpu *vcpu)
{
- return vcpu->arch.apic->pending_events;
+ return kvm_vcpu_has_lapic(vcpu) && vcpu->arch.apic->pending_events;
}
bool kvm_apic_pending_eoi(struct kvm_vcpu *vcpu, int vector);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 181/185] sparc: Use GFP_ATOMIC in ldc_alloc_exp_dring() as it can be called in softirq context
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (179 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 180/185] kvm: x86: fix kvm_apic_has_events to check for NULL pointer Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 182/185] fs/ufs: restore s_lock mutex_init() Luis Henriques
` (3 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Sowmini Varadhan, David S. Miller, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
commit 0edfad5959df7379c9e554fbe8ba264ae232d321 upstream.
Since it is possible for vnet_event_napi to end up doing
vnet_control_pkt_engine -> ... -> vnet_send_attr ->
vnet_port_alloc_tx_ring -> ldc_alloc_exp_dring -> kzalloc()
(i.e., in softirq context), kzalloc() should be called with
GFP_ATOMIC from ldc_alloc_exp_dring.
Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/sparc/kernel/ldc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
index 27bb55485472..7ef28625c199 100644
--- a/arch/sparc/kernel/ldc.c
+++ b/arch/sparc/kernel/ldc.c
@@ -2307,7 +2307,7 @@ void *ldc_alloc_exp_dring(struct ldc_channel *lp, unsigned int len,
if (len & (8UL - 1))
return ERR_PTR(-EINVAL);
- buf = kzalloc(len, GFP_KERNEL);
+ buf = kzalloc(len, GFP_ATOMIC);
if (!buf)
return ERR_PTR(-ENOMEM);
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 182/185] fs/ufs: restore s_lock mutex_init()
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (180 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 181/185] sparc: Use GFP_ATOMIC in ldc_alloc_exp_dring() as it can be called in softirq context Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 183/185] ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage Luis Henriques
` (2 subsequent siblings)
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Fabian Frederick, Al Viro, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabian Frederick <fabf@skynet.be>
commit e4f95517f18271b1da36cfc5d700e46844396d6e upstream.
Add last missing line in commit "cdd9eefdf905"
("fs/ufs: restore s_lock mutex")
Signed-off-by: Fabian Frederick <fabf@skynet.be>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/ufs/super.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index c78e43342107..f5fb525ae201 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -805,6 +805,7 @@ static int ufs_fill_super(struct super_block *sb, void *data, int silent)
UFSD("flag %u\n", (int)(sb->s_flags & MS_RDONLY));
mutex_init(&sbi->mutex);
+ mutex_init(&sbi->s_lock);
spin_lock_init(&sbi->work_lock);
INIT_DELAYED_WORK(&sbi->sync_work, delayed_sync_fs);
/*
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 183/185] ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (181 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 182/185] fs/ufs: restore s_lock mutex_init() Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 184/185] LZ4 : fix the data abort issue Luis Henriques
2015-07-15 9:13 ` [PATCH 3.16.y-ckt 185/185] lz4: fix system halt at boot kernel on x86_64 Luis Henriques
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team; +Cc: Rafael J. Wysocki, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
commit 0294112ee3135fbd15eaa70015af8283642dd970 upstream.
This effectively reverts the following three commits:
7bc10388ccdd ACPI / resources: free memory on error in add_region_before()
0f1b414d1907 ACPI / PNP: Avoid conflicting resource reservations
b9a5e5e18fbf ACPI / init: Fix the ordering of acpi_reserve_resources()
(commit b9a5e5e18fbf introduced regressions some of which, but not
all, were addressed by commit 0f1b414d1907 and commit 7bc10388ccdd
was a fixup on top of the latter) and causes ACPI fixed hardware
resources to be reserved at the fs_initcall_sync stage of system
initialization.
The story is as follows. First, a boot regression was reported due
to an apparent resource reservation ordering change after a commit
that shouldn't lead to such changes. Investigation led to the
conclusion that the problem happened because acpi_reserve_resources()
was executed at the device_initcall() stage of system initialization
which wasn't strictly ordered with respect to driver initialization
(and with respect to the initialization of the pcieport driver in
particular), so a random change causing the device initcalls to be
run in a different order might break things.
The response to that was to attempt to run acpi_reserve_resources()
as soon as we knew that ACPI would be in use (commit b9a5e5e18fbf).
However, that turned out to be too early, because it caused resource
reservations made by the PNP system driver to fail on at least one
system and that failure was addressed by commit 0f1b414d1907.
That fix still turned out to be insufficient, though, because
calling acpi_reserve_resources() before the fs_initcall stage of
system initialization caused a boot regression to happen on the
eCAFE EC-800-H20G/S netbook. That meant that we only could call
acpi_reserve_resources() at the fs_initcall initialization stage
or later, but then we might just as well call it after the PNP
initalization in which case commit 0f1b414d1907 wouldn't be
necessary any more.
For this reason, the changes made by commit 0f1b414d1907 are reverted
(along with a memory leak fixup on top of that commit), the changes
made by commit b9a5e5e18fbf that went too far are reverted too and
acpi_reserve_resources() is changed into fs_initcall_sync, which
will cause it to be executed after the PNP subsystem initialization
(which is an fs_initcall) and before device initcalls (including
the pcieport driver initialization) which should avoid the initial
issue.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=100581
Link: http://marc.info/?t=143092384600002&r=1&w=2
Link: https://bugzilla.kernel.org/show_bug.cgi?id=99831
Link: http://marc.info/?t=143389402600001&r=1&w=2
Fixes: b9a5e5e18fbf "ACPI / init: Fix the ordering of acpi_reserve_resources()"
Reported-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/acpi/osl.c | 12 +++-
drivers/acpi/resource.c | 162 ------------------------------------------------
drivers/pnp/system.c | 35 +++--------
include/linux/acpi.h | 10 ---
4 files changed, 18 insertions(+), 201 deletions(-)
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index bbde6af69584..5e240a479b71 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -165,10 +165,14 @@ static void __init acpi_request_region (struct acpi_generic_address *gas,
if (!addr || !length)
return;
- acpi_reserve_region(addr, length, gas->space_id, 0, desc);
+ /* Resources are never freed */
+ if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO)
+ request_region(addr, length, desc);
+ else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
+ request_mem_region(addr, length, desc);
}
-static void __init acpi_reserve_resources(void)
+static int __init acpi_reserve_resources(void)
{
acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length,
"ACPI PM1a_EVT_BLK");
@@ -197,7 +201,10 @@ static void __init acpi_reserve_resources(void)
if (!(acpi_gbl_FADT.gpe1_block_length & 0x1))
acpi_request_region(&acpi_gbl_FADT.xgpe1_block,
acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK");
+
+ return 0;
}
+fs_initcall_sync(acpi_reserve_resources);
void acpi_os_printf(const char *fmt, ...)
{
@@ -1820,7 +1827,6 @@ acpi_status __init acpi_os_initialize(void)
acpi_status __init acpi_os_initialize1(void)
{
- acpi_reserve_resources();
kacpid_wq = alloc_workqueue("kacpid", 0, 1);
kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1);
kacpi_hotplug_wq = alloc_ordered_workqueue("kacpi_hotplug", 0);
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 3760e9635aea..2ba8f02ced36 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -26,7 +26,6 @@
#include <linux/device.h>
#include <linux/export.h>
#include <linux/ioport.h>
-#include <linux/list.h>
#include <linux/slab.h>
#ifdef CONFIG_X86
@@ -539,164 +538,3 @@ int acpi_dev_get_resources(struct acpi_device *adev, struct list_head *list,
return c.count;
}
EXPORT_SYMBOL_GPL(acpi_dev_get_resources);
-
-struct reserved_region {
- struct list_head node;
- u64 start;
- u64 end;
-};
-
-static LIST_HEAD(reserved_io_regions);
-static LIST_HEAD(reserved_mem_regions);
-
-static int request_range(u64 start, u64 end, u8 space_id, unsigned long flags,
- char *desc)
-{
- unsigned int length = end - start + 1;
- struct resource *res;
-
- res = space_id == ACPI_ADR_SPACE_SYSTEM_IO ?
- request_region(start, length, desc) :
- request_mem_region(start, length, desc);
- if (!res)
- return -EIO;
-
- res->flags &= ~flags;
- return 0;
-}
-
-static int add_region_before(u64 start, u64 end, u8 space_id,
- unsigned long flags, char *desc,
- struct list_head *head)
-{
- struct reserved_region *reg;
- int error;
-
- reg = kmalloc(sizeof(*reg), GFP_KERNEL);
- if (!reg)
- return -ENOMEM;
-
- error = request_range(start, end, space_id, flags, desc);
- if (error) {
- kfree(reg);
- return error;
- }
-
- reg->start = start;
- reg->end = end;
- list_add_tail(®->node, head);
- return 0;
-}
-
-/**
- * acpi_reserve_region - Reserve an I/O or memory region as a system resource.
- * @start: Starting address of the region.
- * @length: Length of the region.
- * @space_id: Identifier of address space to reserve the region from.
- * @flags: Resource flags to clear for the region after requesting it.
- * @desc: Region description (for messages).
- *
- * Reserve an I/O or memory region as a system resource to prevent others from
- * using it. If the new region overlaps with one of the regions (in the given
- * address space) already reserved by this routine, only the non-overlapping
- * parts of it will be reserved.
- *
- * Returned is either 0 (success) or a negative error code indicating a resource
- * reservation problem. It is the code of the first encountered error, but the
- * routine doesn't abort until it has attempted to request all of the parts of
- * the new region that don't overlap with other regions reserved previously.
- *
- * The resources requested by this routine are never released.
- */
-int acpi_reserve_region(u64 start, unsigned int length, u8 space_id,
- unsigned long flags, char *desc)
-{
- struct list_head *regions;
- struct reserved_region *reg;
- u64 end = start + length - 1;
- int ret = 0, error = 0;
-
- if (space_id == ACPI_ADR_SPACE_SYSTEM_IO)
- regions = &reserved_io_regions;
- else if (space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
- regions = &reserved_mem_regions;
- else
- return -EINVAL;
-
- if (list_empty(regions))
- return add_region_before(start, end, space_id, flags, desc, regions);
-
- list_for_each_entry(reg, regions, node)
- if (reg->start == end + 1) {
- /* The new region can be prepended to this one. */
- ret = request_range(start, end, space_id, flags, desc);
- if (!ret)
- reg->start = start;
-
- return ret;
- } else if (reg->start > end) {
- /* No overlap. Add the new region here and get out. */
- return add_region_before(start, end, space_id, flags,
- desc, ®->node);
- } else if (reg->end == start - 1) {
- goto combine;
- } else if (reg->end >= start) {
- goto overlap;
- }
-
- /* The new region goes after the last existing one. */
- return add_region_before(start, end, space_id, flags, desc, regions);
-
- overlap:
- /*
- * The new region overlaps an existing one.
- *
- * The head part of the new region immediately preceding the existing
- * overlapping one can be combined with it right away.
- */
- if (reg->start > start) {
- error = request_range(start, reg->start - 1, space_id, flags, desc);
- if (error)
- ret = error;
- else
- reg->start = start;
- }
-
- combine:
- /*
- * The new region is adjacent to an existing one. If it extends beyond
- * that region all the way to the next one, it is possible to combine
- * all three of them.
- */
- while (reg->end < end) {
- struct reserved_region *next = NULL;
- u64 a = reg->end + 1, b = end;
-
- if (!list_is_last(®->node, regions)) {
- next = list_next_entry(reg, node);
- if (next->start <= end)
- b = next->start - 1;
- }
- error = request_range(a, b, space_id, flags, desc);
- if (!error) {
- if (next && next->start == b + 1) {
- reg->end = next->end;
- list_del(&next->node);
- kfree(next);
- } else {
- reg->end = end;
- break;
- }
- } else if (next) {
- if (!ret)
- ret = error;
-
- reg = next;
- } else {
- break;
- }
- }
-
- return ret ? ret : error;
-}
-EXPORT_SYMBOL_GPL(acpi_reserve_region);
diff --git a/drivers/pnp/system.c b/drivers/pnp/system.c
index 515f33882ab8..49c1720df59a 100644
--- a/drivers/pnp/system.c
+++ b/drivers/pnp/system.c
@@ -7,7 +7,6 @@
* Bjorn Helgaas <bjorn.helgaas@hp.com>
*/
-#include <linux/acpi.h>
#include <linux/pnp.h>
#include <linux/device.h>
#include <linux/init.h>
@@ -23,41 +22,25 @@ static const struct pnp_device_id pnp_dev_table[] = {
{"", 0}
};
-#ifdef CONFIG_ACPI
-static bool __reserve_range(u64 start, unsigned int length, bool io, char *desc)
-{
- u8 space_id = io ? ACPI_ADR_SPACE_SYSTEM_IO : ACPI_ADR_SPACE_SYSTEM_MEMORY;
- return !acpi_reserve_region(start, length, space_id, IORESOURCE_BUSY, desc);
-}
-#else
-static bool __reserve_range(u64 start, unsigned int length, bool io, char *desc)
-{
- struct resource *res;
-
- res = io ? request_region(start, length, desc) :
- request_mem_region(start, length, desc);
- if (res) {
- res->flags &= ~IORESOURCE_BUSY;
- return true;
- }
- return false;
-}
-#endif
-
static void reserve_range(struct pnp_dev *dev, struct resource *r, int port)
{
char *regionid;
const char *pnpid = dev_name(&dev->dev);
resource_size_t start = r->start, end = r->end;
- bool reserved;
+ struct resource *res;
regionid = kmalloc(16, GFP_KERNEL);
if (!regionid)
return;
snprintf(regionid, 16, "pnp %s", pnpid);
- reserved = __reserve_range(start, end - start + 1, !!port, regionid);
- if (!reserved)
+ if (port)
+ res = request_region(start, end - start + 1, regionid);
+ else
+ res = request_mem_region(start, end - start + 1, regionid);
+ if (res)
+ res->flags &= ~IORESOURCE_BUSY;
+ else
kfree(regionid);
/*
@@ -66,7 +49,7 @@ static void reserve_range(struct pnp_dev *dev, struct resource *r, int port)
* have double reservations.
*/
dev_info(&dev->dev, "%pR %s reserved\n", r,
- reserved ? "has been" : "could not be");
+ res ? "has been" : "could not be");
}
static void reserve_resources_of_dev(struct pnp_dev *dev)
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index ef152461bd46..3b18cb3d5307 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -306,9 +306,6 @@ int acpi_check_region(resource_size_t start, resource_size_t n,
int acpi_resources_are_enforced(void);
-int acpi_reserve_region(u64 start, unsigned int length, u8 space_id,
- unsigned long flags, char *desc);
-
#ifdef CONFIG_HIBERNATION
void __init acpi_no_s4_hw_signature(void);
#endif
@@ -473,13 +470,6 @@ static inline int acpi_check_region(resource_size_t start, resource_size_t n,
return 0;
}
-static inline int acpi_reserve_region(u64 start, unsigned int length,
- u8 space_id, unsigned long flags,
- char *desc)
-{
- return -ENXIO;
-}
-
struct acpi_table_header;
static inline int acpi_table_parse(char *id,
int (*handler)(struct acpi_table_header *))
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 184/185] LZ4 : fix the data abort issue
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (182 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 183/185] ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage Luis Henriques
@ 2015-07-15 9:12 ` Luis Henriques
2015-07-15 9:13 ` [PATCH 3.16.y-ckt 185/185] lz4: fix system halt at boot kernel on x86_64 Luis Henriques
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:12 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: JeHyeon Yeon, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: JeHyeon Yeon <tom.yeon@windriver.com>
commit d5e7cafd69da24e6d6cc988fab6ea313a2577efc upstream.
If the part of the compression data are corrupted, or the compression
data is totally fake, the memory access over the limit is possible.
This is the log from my system usning lz4 decompression.
[6502]data abort, halting
[6503]r0 0x00000000 r1 0x00000000 r2 0xdcea0ffc r3 0xdcea0ffc
[6509]r4 0xb9ab0bfd r5 0xdcea0ffc r6 0xdcea0ff8 r7 0xdce80000
[6515]r8 0x00000000 r9 0x00000000 r10 0x00000000 r11 0xb9a98000
[6522]r12 0xdcea1000 usp 0x00000000 ulr 0x00000000 pc 0x820149bc
[6528]spsr 0x400001f3
and the memory addresses of some variables at the moment are
ref:0xdcea0ffc, op:0xdcea0ffc, oend:0xdcea1000
As you can see, COPYLENGH is 8bytes, so @ref and @op can access the momory
over @oend.
Signed-off-by: JeHyeon Yeon <tom.yeon@windriver.com>
Reviewed-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
lib/lz4/lz4_decompress.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index 7a85967060a5..f0f5c5c3de12 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
/* Error: request to write beyond destination buffer */
if (cpy > oend)
goto _output_error;
+ if ((ref + COPYLENGTH) > oend ||
+ (op + COPYLENGTH) > oend)
+ goto _output_error;
LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
while (op < cpy)
*op++ = *ref++;
^ permalink raw reply related [flat|nested] 186+ messages in thread
* [PATCH 3.16.y-ckt 185/185] lz4: fix system halt at boot kernel on x86_64
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
` (183 preceding siblings ...)
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 184/185] LZ4 : fix the data abort issue Luis Henriques
@ 2015-07-15 9:13 ` Luis Henriques
184 siblings, 0 replies; 186+ messages in thread
From: Luis Henriques @ 2015-07-15 9:13 UTC (permalink / raw)
To: linux-kernel, stable, kernel-team
Cc: Krzysztof Kolasa, Greg Kroah-Hartman, Luis Henriques
3.16.7-ckt15 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kolasa <kkolasa@winsoft.pl>
commit 99b7e93c95c78952724a9783de6c78def8fbfc3f upstream.
Sometimes, on x86_64, decompression fails with the following
error:
Decompressing Linux...
Decoding failed
-- System halted
This condition is not needed for a 64bit kernel(from commit d5e7caf):
if( ... ||
(op + COPYLENGTH) > oend)
goto _output_error
macro LZ4_SECURE_COPY() tests op and does not copy any data
when op exceeds the value.
added by analogy to lz4_uncompress_unknownoutputsize(...)
Signed-off-by: Krzysztof Kolasa <kkolasa@winsoft.pl>
Tested-by: Alexander Kuleshov <kuleshovmail@gmail.com>
Tested-by: Caleb Jorden <cjorden@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
lib/lz4/lz4_decompress.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index f0f5c5c3de12..8a742b195c69 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -139,8 +139,12 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
/* Error: request to write beyond destination buffer */
if (cpy > oend)
goto _output_error;
+#if LZ4_ARCH64
+ if ((ref + COPYLENGTH) > oend)
+#else
if ((ref + COPYLENGTH) > oend ||
(op + COPYLENGTH) > oend)
+#endif
goto _output_error;
LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
while (op < cpy)
@@ -270,7 +274,13 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
if (cpy > oend - COPYLENGTH) {
if (cpy > oend)
goto _output_error; /* write outside of buf */
-
+#if LZ4_ARCH64
+ if ((ref + COPYLENGTH) > oend)
+#else
+ if ((ref + COPYLENGTH) > oend ||
+ (op + COPYLENGTH) > oend)
+#endif
+ goto _output_error;
LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
while (op < cpy)
*op++ = *ref++;
^ permalink raw reply related [flat|nested] 186+ messages in thread
end of thread, other threads:[~2015-07-15 10:18 UTC | newest]
Thread overview: 186+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-07-15 9:09 [3.16.y-ckt stable] Linux 3.16.7-ckt15 stable review Luis Henriques
2015-07-15 9:09 ` [PATCH 3.16.y-ckt 001/185] ARM: clk-imx6q: refine sata's parent Luis Henriques
2015-07-15 9:09 ` [PATCH 3.16.y-ckt 002/185] KVM: nSVM: Check for NRIPS support before updating control field Luis Henriques
2015-07-15 9:09 ` [PATCH 3.16.y-ckt 003/185] nfs: take extra reference to fl->fl_file when running a setlk Luis Henriques
2015-07-15 9:09 ` [PATCH 3.16.y-ckt 004/185] bridge: fix multicast router rlist endless loop Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 005/185] net: don't wait for order-3 page allocation Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 006/185] sctp: fix ASCONF list handling Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 007/185] bridge: fix br_stp_set_bridge_priority race conditions Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 008/185] packet: read num_members once in packet_rcv_fanout() Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 009/185] packet: avoid out of bounds read in round robin fanout Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 010/185] neigh: do not modify unlinked entries Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 011/185] tcp: Do not call tcp_fastopen_reset_cipher from interrupt context Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 012/185] net: phy: fix phy link up when limiting speed via device tree Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 013/185] sctp: Fix race between OOTB responce and route removal Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 014/185] x86/mce: Fix MCE severity messages Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 015/185] [media] s5h1420: fix a buffer overflow when checking userspace params Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 016/185] [media] cx24116: " Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 017/185] [media] af9013: Don't accept invalid bandwidth Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 018/185] [media] cx24117: fix a buffer overflow when checking userspace params Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 019/185] spi: fix race freeing dummy_tx/rx before it is unmapped Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 020/185] mtd: fix: avoid race condition when accessing mtd->usecount Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 021/185] intel_pstate: set BYT MSR with wrmsrl_on_cpu() Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 022/185] leds / PM: fix hibernation on arm when gpio-led used with CPU led trigger Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 023/185] crypto: talitos - avoid memleak in talitos_alg_alloc() Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 024/185] Revert "crypto: talitos - convert to use be16_add_cpu()" Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 025/185] genirq: devres: Fix testing return value of request_any_context_irq() Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 026/185] ASoC: wm8737: Fixup setting VMID Impedance control register Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 027/185] ASoC: wm8903: Fix define for WM8903_VMID_RES_250K Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 028/185] mnt: Refactor the logic for mounting sysfs and proc in a user namespace Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 029/185] ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 030/185] scsi_transport_srp: Introduce srp_wait_for_queuecommand() Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 031/185] scsi_transport_srp: Fix a race condition Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 032/185] KVM: mips: use id_to_memslot correctly Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 033/185] w1_therm reference count family data Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 034/185] drm/radeon: take the mode_config mutex when dealing with hpds (v2) Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 035/185] usb: dwc3: gadget: return error if command sent to DGCMD register fails Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 036/185] rcu: Correctly handle non-empty Tiny RCU callback list with none ready Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 037/185] ASoC: arizona: Fix noise generator gain TLV Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 038/185] usb: dwc3: gadget: don't clear EP_BUSY too early Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 039/185] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 040/185] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 041/185] staging: vt6655: device_rx_srv check sk_buff is NULL Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 042/185] fixing infinite OPEN loop in 4.0 stateid recovery Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 043/185] ideapad_laptop: Lenovo G50-30 fix rfkill reports wireless blocked Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 044/185] powerpc/perf: Fix book3s kernel to userspace backtraces Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 045/185] SUNRPC: Fix a memory leak in the backchannel code Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 046/185] ipr: Increase default adapter init stage change timeout Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 047/185] ieee802154: Fix sockaddr_ieee802154 implicit padding information leak Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 048/185] mnt: Modify fs_fully_visible to deal with locked ro nodev and atime Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 049/185] drm/qxl: Do not cause spice-server to clean our objects Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 050/185] drm/qxl: Do not leak memory if qxl_release_list_add fails Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 051/185] selinux: fix setting of security labels on NFS Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 052/185] ath3k: Add support of 0489:e076 AR3012 device Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 053/185] ath3k: add support of 13d3:3474 " Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 054/185] Bluetooth: btusb: Fix memory leak in Intel setup routine Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 055/185] ath9k: fix DMA stop sequence for AR9003+ Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 056/185] b43: fix support for 14e4:4321 PCI dev with BCM4321 chipset Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 057/185] cdc-acm: Add support of ATOL FPrint fiscal printers Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 058/185] regulator: core: fix constraints output buffer Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 059/185] ACPI / PM: Add missing pm_generic_complete() invocation Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 060/185] x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 061/185] pinctrl: mvebu: armada-38x: fix PCIe functions Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 062/185] pinctrl: mvebu: armada-370: fix spi0 pin description Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 063/185] pinctrl: mvebu: armada-375: remove non-existing NAND re/we pins Luis Henriques
2015-07-15 9:10 ` [PATCH 3.16.y-ckt 064/185] pinctrl: mvebu: armada-xp: remove non-existing NAND pins Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 065/185] pinctrl: mvebu: armada-xp: remove non-existing VDD cpu_pd functions Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 066/185] pinctrl: mvebu: armada-xp: fix functions of MPP48 Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 067/185] pinctrl: mvebu: armada-375: remove incorrect space in pin description Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 068/185] pinctrl: mvebu: armada-38x: fix incorrect total number of GPIOs Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 069/185] i2c: at91: fix a race condition when using the DMA controller Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 070/185] dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 071/185] ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1] Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 072/185] arm64: Do not attempt to use init_mm in reset_context() Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 073/185] ext4: fix race between truncate and __ext4_journalled_writepage() Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 074/185] Disable write buffering on Toshiba ToPIC95 Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 075/185] fs/ufs: revert "ufs: fix deadlocks introduced by sb mutex merge" Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 076/185] jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail() Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 077/185] regmap: Fix regmap_bulk_read in BE mode Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 078/185] jbd2: fix ocfs2 corrupt when updating journal superblock fails Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 079/185] ideapad: fix software rfkill setting Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 080/185] fs/ufs: restore s_lock mutex Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 081/185] regmap: Fix possible shift overflow in regmap_field_init() Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 082/185] ima: fix ima_show_template_data_ascii() Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 083/185] nfs: increase size of EXCHANGE_ID name string buffer Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 084/185] vTPM: set virtual device before passing to ibmvtpm_reset_crq Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 085/185] arm: KVM: force execution of HCPTR access on VM exit Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 086/185] arm64: mm: Fix freeing of the wrong memmap entries with !SPARSEMEM_VMEMMAP Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 087/185] dm space map metadata: fix occasional leak of a metadata block on resize Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 088/185] dm stats: fix divide by zero if 'number_of_areas' arg is zero Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 089/185] x86/PCI: Use host bridge _CRS info on systems with >32 bit addressing Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 090/185] pNFS: Fix a memory leak when attempted pnfs fails Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 091/185] ACPI / PNP: Avoid conflicting resource reservations Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 092/185] Bluetooth: ath3k: add support of 04ca:300f AR3012 device Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 093/185] Bluetooth: ath3k: Add support of 04ca:300d " Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 094/185] libata: Do not blacklist Micron M500DC Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 095/185] arm64: vdso: work-around broken ELF toolchains in Makefile Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 096/185] iommu/amd: Handle large pages correctly in free_pagetable Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 097/185] ext4: call sync_blockdev() before invalidate_bdev() in put_super() Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 098/185] MIPS: Fix KVM guest fixmap address Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 099/185] xfs: fix remote symlinks on V5/CRC filesystems Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 100/185] ext4: don't retry file block mapping on bigalloc fs with non-extent file Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 101/185] xfs: don't truncate attribute extents if no extents exist Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 102/185] NET: ROSE: Don't dereference NULL neighbour pointer Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 103/185] netfilter: nf_qeueue: Drop queue entries on nf_unregister_hook Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 104/185] fs: Fix S_NOSEC handling Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 105/185] stmmac: troubleshoot unexpected bits in des0 & des1 Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 106/185] ACPI / resources: free memory on error in add_region_before() Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 107/185] PM / sleep: Increase default DPM watchdog timeout to 60 Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 108/185] ARC: add compiler barrier to LLSC based cmpxchg Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 109/185] locking,arch,arc: Fold atomic_ops Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 110/185] ARC: add smp barriers around atomics per Documentation/atomic_ops.txt Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 111/185] mm: kmemleak: allow safe memory scanning during kmemleak disabling Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 112/185] dell-laptop: Fix allocating & freeing SMI buffer page Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 113/185] ALSA: hda - Fix Dock Headphone on Thinkpad X250 seen as a Line Out Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 114/185] tracing/filter: Do not WARN on operand count going below zero Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 115/185] tracing/filter: Do not allow infix to exceed end of string Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 116/185] clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 117/185] ALSA: hda - Add headset support to Acer Aspire V5 Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 118/185] ALSA: hda - Fix the dock headphone output on Fujitsu Lifebook E780 Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 119/185] agp/intel: Fix typo in needs_ilk_vtd_wa() Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 120/185] drm/i915: fix backlight after resume on 855gm Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 121/185] drm/radeon: compute ring fix hibernation (CI GPU family) v2 Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 122/185] drm/radeon: SDMA fix hibernation (CI GPU family) Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 123/185] net: mvneta: introduce compatible string "marvell, armada-xp-neta" Luis Henriques
2015-07-15 9:11 ` [PATCH 3.16.y-ckt 124/185] ARM: mvebu: update Ethernet compatible string for Armada XP Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 125/185] net: mvneta: disable IP checksum with jumbo frames for Armada 370 Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 126/185] crush: fix a bug in tree bucket decode Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 127/185] rbd: use GFP_NOIO in rbd_obj_request_create() Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 128/185] arm64: Don't report clear pmds and puds as huge Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 129/185] fuse: initialize fc->release before calling it Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 130/185] vfs: Ignore unlocked mounts in fs_fully_visible Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 131/185] VFS: Introduce inode-getting helpers for layered/unioned fs environments Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 132/185] fs: Add helper functions for permanently empty directories Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 133/185] sysctl: Allow creating permanently empty directories that serve as mountpoints Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 134/185] proc: Allow creating permanently empty directories that serve as mount points Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 135/185] kernfs: Add support for always empty directories Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 136/185] sysfs: Add support for permanently empty directories to serve as mount points Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 137/185] mnt: Update fs_fully_visible to test for permanently empty directories Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 138/185] vfs: Remove incorrect debugging WARN in prepend_path Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 139/185] hwmon: (mcp3021) Fix broken output scaling Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 140/185] ACPICA: Tables: Enable both 32-bit and 64-bit FACS Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 141/185] ACPICA: Tables: Fix an issue that FACS initialization is performed twice Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 142/185] ACPICA: Tables: Enable default 64-bit FADT addresses favor Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 143/185] KVM: x86: make vapics_in_nmi_mode atomic Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 144/185] KVM: x86: properly restore LVT0 Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 145/185] KVM: s390: virtio-ccw: don't overwrite config space values Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 146/185] 9p: forgetting to cancel request on interrupted zero-copy RPC Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 147/185] clk: Fix JSON output in debugfs Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 148/185] e1000e: Cleanup handling of VLAN_HLEN as a part of max frame size Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 149/185] powerpc/pseries: Fix possible leaked device node reference Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 150/185] clk: ti: dra7-atl-clock: Fix possible ERR_PTR dereference Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 151/185] ipip: fix one sparse error Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 152/185] HID: rmi: fix some harmless BIT() mistakes Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 153/185] HID: i2c-hid: fix harmless test_bit() issue Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 154/185] pktgen: adjust spacing in proc file interface output Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 155/185] USB: devio: fix a condition in async_completed() Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 156/185] tty: remove platform_sysrq_reset_seq Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 157/185] net/mlx4_core: Enhance the MAD_IFC wrapper to convert VF port to physical Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 158/185] IB/mlx4: Convert slave port before building address-handle Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 159/185] ath9k_htc: memory corruption calling set_bit() Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 160/185] rndis_wlan: harmless issue " Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 161/185] mtd: dc21285: use raw spinlock functions for nw_gpio_lock Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 162/185] mac80211: prevent possible crypto tx tailroom corruption Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 163/185] cfg80211: ignore netif running state when changing iftype Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 164/185] phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 165/185] NFS: Fix size of NFSACL SETACL operations Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 166/185] Btrfs: lock superblock before remounting for rw subvol Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 167/185] of: return NUMA_NO_NODE from fallback of_node_to_nid() Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 168/185] sched/fair: Prevent throttling in early pick_next_task_fair() Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 169/185] ASoC: imx-wm8962: Add a missing error check Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 170/185] ACPI / init: Switch over platform to the ACPI mode later Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 171/185] drm/tegra: dpaux: Fix transfers larger than 4 bytes Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 172/185] mmc: card: Fixup request missing in mmc_blk_issue_rw_rq Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 173/185] perf: Fix ring_buffer_attach() RCU sync, again Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 174/185] watchdog: omap: assert the counter being stopped before reprogramming Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 175/185] bridge: multicast: restore router configuration on port link down/up Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 176/185] mm/hugetlb: introduce minimum hugepage order Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 177/185] security_syslog() should be called once only Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 178/185] __bitmap_parselist: fix bug in empty string handling Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 179/185] x86/iosf: Add Kconfig prompt for IOSF_MBI selection Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 180/185] kvm: x86: fix kvm_apic_has_events to check for NULL pointer Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 181/185] sparc: Use GFP_ATOMIC in ldc_alloc_exp_dring() as it can be called in softirq context Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 182/185] fs/ufs: restore s_lock mutex_init() Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 183/185] ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage Luis Henriques
2015-07-15 9:12 ` [PATCH 3.16.y-ckt 184/185] LZ4 : fix the data abort issue Luis Henriques
2015-07-15 9:13 ` [PATCH 3.16.y-ckt 185/185] lz4: fix system halt at boot kernel on x86_64 Luis Henriques
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).