* [PATCH 3.14 001/158] arm64: Do not synchronise I and D caches for special ptes
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 002/158] arm64: Make DMA coherent and strongly ordered mappings not executable Greg Kroah-Hartman
` (158 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Catalin Marinas, Steve Capper,
Laura Abbott, Bharat Bhushan
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <catalin.marinas@arm.com>
commit 71fdb6bf61bf0692f004f9daf5650392c0cfe300 upstream.
Special pte mappings are not intended to be executable and do not even
have an associated struct page. This patch ensures that we do not call
__sync_icache_dcache() on such ptes.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: Steve Capper <Steve.Capper@arm.com>
Tested-by: Laura Abbott <lauraa@codeaurora.org>
Tested-by: Bharat Bhushan <Bharat.Bhushan@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/pgtable.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -199,7 +199,7 @@ static inline void set_pte_at(struct mm_
pte_t *ptep, pte_t pte)
{
if (pte_valid_user(pte)) {
- if (pte_exec(pte))
+ if (!pte_special(pte) && pte_exec(pte))
__sync_icache_dcache(pte, addr);
if (pte_dirty(pte) && pte_write(pte))
pte_val(pte) &= ~PTE_RDONLY;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 002/158] arm64: Make DMA coherent and strongly ordered mappings not executable
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 001/158] arm64: Do not synchronise I and D caches for special ptes Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 003/158] ASoC: pcm: Drop incorrect double/extra frees Greg Kroah-Hartman
` (157 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Catalin Marinas, Bharat Bhushan,
Laura Abbott
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <catalin.marinas@arm.com>
commit de2db7432917a82b62d55bb59635586eeca6d1bd upstream.
pgprot_{dmacoherent,writecombine,noncached} don't need to generate
executable mappings with side-effects like __sync_icache_dcache() being
called when the mapping is in user space.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: Bharat Bhushan <Bharat.Bhushan@freescale.com>
Tested-by: Laura Abbott <lauraa@codeaurora.org>
Tested-by: Bharat Bhushan <Bharat.Bhushan@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/pgtable.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -286,11 +286,11 @@ static inline int has_transparent_hugepa
* Mark the prot value as uncacheable and unbufferable.
*/
#define pgprot_noncached(prot) \
- __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRnE))
+ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRnE) | PTE_PXN | PTE_UXN)
#define pgprot_writecombine(prot) \
- __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC))
+ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC) | PTE_PXN | PTE_UXN)
#define pgprot_dmacoherent(prot) \
- __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC))
+ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC) | PTE_PXN | PTE_UXN)
#define __HAVE_PHYS_MEM_ACCESS_PROT
struct file;
extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 003/158] ASoC: pcm: Drop incorrect double/extra frees
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 001/158] arm64: Do not synchronise I and D caches for special ptes Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 002/158] arm64: Make DMA coherent and strongly ordered mappings not executable Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 004/158] ASoC: cs42l51: Fix SOC_DOUBLE_R_SX_TLV shift values for ADC, PCM, and Analog kcontrols Greg Kroah-Hartman
` (156 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Mark Brown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <broonie@linaro.org>
commit 017d9491ce203c620ad1377f46a3ce78d554b2de upstream.
The changes in "ASoC: pcm: free path list before exiting from error
conditions" actually introduced both double frees (in case where the
path list was allocated but empty) and frees of unallocated memory (in
cases where the error being handled was -ENOMEM. Drop the commit for
now.
Fixes: e4ad1accb (ASoC: pcm: free path list before exiting from error conditions)
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/soc-pcm.c | 3 ---
1 file changed, 3 deletions(-)
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1989,7 +1989,6 @@ int soc_dpcm_runtime_update(struct snd_s
paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_PLAYBACK, &list);
if (paths < 0) {
- dpcm_path_put(&list);
dev_warn(fe->dev, "ASoC: %s no valid %s path\n",
fe->dai_link->name, "playback");
mutex_unlock(&card->mutex);
@@ -2019,7 +2018,6 @@ capture:
paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_CAPTURE, &list);
if (paths < 0) {
- dpcm_path_put(&list);
dev_warn(fe->dev, "ASoC: %s no valid %s path\n",
fe->dai_link->name, "capture");
mutex_unlock(&card->mutex);
@@ -2084,7 +2082,6 @@ static int dpcm_fe_dai_open(struct snd_p
fe->dpcm[stream].runtime = fe_substream->runtime;
if (dpcm_path_get(fe, stream, &list) <= 0) {
- dpcm_path_put(&list);
dev_dbg(fe->dev, "ASoC: %s no valid %s route\n",
fe->dai_link->name, stream ? "capture" : "playback");
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 004/158] ASoC: cs42l51: Fix SOC_DOUBLE_R_SX_TLV shift values for ADC, PCM, and Analog kcontrols
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 003/158] ASoC: pcm: Drop incorrect double/extra frees Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 005/158] ASoC: cs42l52: Fix mask bits for SOC_VALUE_ENUM_SINGLE Greg Kroah-Hartman
` (155 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Petazzoni, Brian Austin, Mark Brown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Austin <brian.austin@cirrus.com>
commit 7272e051157ccd5871b5d939548d0ba5a94a2965 upstream.
The shift values for the ADC,PCM, and Analog kcontrols were wrong causing wrong values for the SOC_DOUBLE_R_SX_TLV macros
Fixed the TLV for aout_tlv to show -102dB correctly
Fixes: 1d99f2436d (ASoC: core: Rework SOC_DOUBLE_R_SX_TLV add SOC_SINGLE_SX_TLV)
Reported-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Brian Austin <brian.austin@cirrus.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/cs42l51.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/sound/soc/codecs/cs42l51.c
+++ b/sound/soc/codecs/cs42l51.c
@@ -124,9 +124,8 @@ static int cs42l51_set_chan_mix(struct s
static const DECLARE_TLV_DB_SCALE(adc_pcm_tlv, -5150, 50, 0);
static const DECLARE_TLV_DB_SCALE(tone_tlv, -1050, 150, 0);
-/* This is a lie. after -102 db, it stays at -102 */
-/* maybe a range would be better */
-static const DECLARE_TLV_DB_SCALE(aout_tlv, -11550, 50, 0);
+
+static const DECLARE_TLV_DB_SCALE(aout_tlv, -10200, 50, 0);
static const DECLARE_TLV_DB_SCALE(boost_tlv, 1600, 1600, 0);
static const char *chan_mix[] = {
@@ -141,7 +140,7 @@ static const struct soc_enum cs42l51_cha
static const struct snd_kcontrol_new cs42l51_snd_controls[] = {
SOC_DOUBLE_R_SX_TLV("PCM Playback Volume",
CS42L51_PCMA_VOL, CS42L51_PCMB_VOL,
- 6, 0x19, 0x7F, adc_pcm_tlv),
+ 0, 0x19, 0x7F, adc_pcm_tlv),
SOC_DOUBLE_R("PCM Playback Switch",
CS42L51_PCMA_VOL, CS42L51_PCMB_VOL, 7, 1, 1),
SOC_DOUBLE_R_SX_TLV("Analog Playback Volume",
@@ -149,7 +148,7 @@ static const struct snd_kcontrol_new cs4
0, 0x34, 0xE4, aout_tlv),
SOC_DOUBLE_R_SX_TLV("ADC Mixer Volume",
CS42L51_ADCA_VOL, CS42L51_ADCB_VOL,
- 6, 0x19, 0x7F, adc_pcm_tlv),
+ 0, 0x19, 0x7F, adc_pcm_tlv),
SOC_DOUBLE_R("ADC Mixer Switch",
CS42L51_ADCA_VOL, CS42L51_ADCB_VOL, 7, 1, 1),
SOC_SINGLE("Playback Deemphasis Switch", CS42L51_DAC_CTL, 3, 1, 0),
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 005/158] ASoC: cs42l52: Fix mask bits for SOC_VALUE_ENUM_SINGLE
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 004/158] ASoC: cs42l51: Fix SOC_DOUBLE_R_SX_TLV shift values for ADC, PCM, and Analog kcontrols Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 006/158] ASoC: cs42l73: " Greg Kroah-Hartman
` (154 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Brian Austin, Mark Brown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Austin <brian.austin@cirrus.com>
commit d31a33dd7792c7d6c11fda226a3b9e4fb7f86f95 upstream.
The mask bits values were wrong for the SOC_VALUE_ENUM_SINGLE for the PCM/ADC Swap controls
Reported-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Brian Austin <brian.austin@cirrus.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/cs42l52.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/sound/soc/codecs/cs42l52.c
+++ b/sound/soc/codecs/cs42l52.c
@@ -347,7 +347,7 @@ static const char * const right_swap_tex
static const unsigned int swap_values[] = { 0, 1, 3 };
static const struct soc_enum adca_swap_enum =
- SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 2, 1,
+ SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 2, 3,
ARRAY_SIZE(left_swap_text),
left_swap_text,
swap_values);
@@ -356,7 +356,7 @@ static const struct snd_kcontrol_new adc
SOC_DAPM_ENUM("Route", adca_swap_enum);
static const struct soc_enum pcma_swap_enum =
- SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 6, 1,
+ SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 6, 3,
ARRAY_SIZE(left_swap_text),
left_swap_text,
swap_values);
@@ -365,7 +365,7 @@ static const struct snd_kcontrol_new pcm
SOC_DAPM_ENUM("Route", pcma_swap_enum);
static const struct soc_enum adcb_swap_enum =
- SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 0, 1,
+ SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 0, 3,
ARRAY_SIZE(right_swap_text),
right_swap_text,
swap_values);
@@ -374,7 +374,7 @@ static const struct snd_kcontrol_new adc
SOC_DAPM_ENUM("Route", adcb_swap_enum);
static const struct soc_enum pcmb_swap_enum =
- SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 4, 1,
+ SOC_VALUE_ENUM_SINGLE(CS42L52_ADC_PCM_MIXER, 4, 3,
ARRAY_SIZE(right_swap_text),
right_swap_text,
swap_values);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 006/158] ASoC: cs42l73: Fix mask bits for SOC_VALUE_ENUM_SINGLE
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 005/158] ASoC: cs42l52: Fix mask bits for SOC_VALUE_ENUM_SINGLE Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 007/158] ARM: OMAP2+: INTC: Acknowledge stuck active interrupts Greg Kroah-Hartman
` (153 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Brian Austin, Mark Brown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Austin <brian.austin@cirrus.com>
commit 1555b652970e541fa1cb80c61ffc696bbfb92bb7 upstream.
The mask bits values were wrong for the SOC_VALUE_ENUM_SINGLE for the mono mix controls.
Reported-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Brian Austin <brian.austin@cirrus.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/cs42l73.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/sound/soc/codecs/cs42l73.c
+++ b/sound/soc/codecs/cs42l73.c
@@ -319,7 +319,7 @@ static const char * const cs42l73_mono_m
static const unsigned int cs42l73_mono_mix_values[] = { 0, 1, 2 };
static const struct soc_enum spk_asp_enum =
- SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 6, 1,
+ SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 6, 3,
ARRAY_SIZE(cs42l73_mono_mix_texts),
cs42l73_mono_mix_texts,
cs42l73_mono_mix_values);
@@ -337,7 +337,7 @@ static const struct snd_kcontrol_new spk
SOC_DAPM_ENUM("Route", spk_xsp_enum);
static const struct soc_enum esl_asp_enum =
- SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 2, 5,
+ SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 2, 3,
ARRAY_SIZE(cs42l73_mono_mix_texts),
cs42l73_mono_mix_texts,
cs42l73_mono_mix_values);
@@ -346,7 +346,7 @@ static const struct snd_kcontrol_new esl
SOC_DAPM_ENUM("Route", esl_asp_enum);
static const struct soc_enum esl_xsp_enum =
- SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 0, 7,
+ SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 0, 3,
ARRAY_SIZE(cs42l73_mono_mix_texts),
cs42l73_mono_mix_texts,
cs42l73_mono_mix_values);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 007/158] ARM: OMAP2+: INTC: Acknowledge stuck active interrupts
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 006/158] ASoC: cs42l73: " Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 008/158] ARM: OMAP2+: hwmod: fix missing braces in _init() Greg Kroah-Hartman
` (152 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Sørensen, Tony Lindgren
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Sørensen <stefan.sorensen@spectralink.com>
commit 698b48532539484b012fb7c4176b959d32a17d00 upstream.
When an interrupt has become active on the INTC it will stay active
until it is acked, even if masked or de-asserted. The
INTC_PENDING_IRQn registers are however updated and since these are
used by omap_intc_handle_irq to determine which interrupt to handle,
it will never see the active interrupt. This will result in a storm of
useless interrupts that is only stopped when another higher priority
interrupt is asserted.
Fix by sending the INTC an acknowledge if we find no interrupts to
handle.
Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-omap2/irq.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/arch/arm/mach-omap2/irq.c
+++ b/arch/arm/mach-omap2/irq.c
@@ -222,6 +222,7 @@ void __init ti81xx_init_irq(void)
static inline void omap_intc_handle_irq(void __iomem *base_addr, struct pt_regs *regs)
{
u32 irqnr;
+ int handled_irq = 0;
do {
irqnr = readl_relaxed(base_addr + 0x98);
@@ -249,8 +250,15 @@ out:
if (irqnr) {
irqnr = irq_find_mapping(domain, irqnr);
handle_IRQ(irqnr, regs);
+ handled_irq = 1;
}
} while (irqnr);
+
+ /* If an irq is masked or deasserted while active, we will
+ * keep ending up here with no irq handled. So remove it from
+ * the INTC with an ack.*/
+ if (!handled_irq)
+ omap_ack_irq(NULL);
}
asmlinkage void __exception_irq_entry omap2_intc_handle_irq(struct pt_regs *regs)
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 008/158] ARM: OMAP2+: hwmod: fix missing braces in _init()
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 007/158] ARM: OMAP2+: INTC: Acknowledge stuck active interrupts Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 009/158] CLK: TI: OMAP4/5/DRA7: Remove gpmc_fck from dummy clocks Greg Kroah-Hartman
` (151 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nishanth Menon, Rajendra Nayak,
Suman Anna, Lokesh Vutla, Paul Walmsley
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suman Anna <s-anna@ti.com>
commit 3d36ad7e7a9be0d130c862727a052ed279046437 upstream.
Bug was introduced by commit 'f92d959: ARM: OMAP2+: hwmod:
Extract no-idle and no-reset info from DT'
There were 2 versions of the patch posted which resulted in the above
commit. While v1 [1] had the bug, v2 [2] had it fixed.
However v1 apparently seemed to have been pulled in by mistake
introducing the bug.
Given of_find_property() does return NULL when the node passed is
NULL, it did not introduce any functional issues as such, just the
fact that the second if check was executed unnecessarily.
[1] https://www.mail-archive.com/linux-omap@vger.kernel.org/msg94220.html
[2] http://www.spinics.net/lists/linux-omap/msg98490.html
Cc: Nishanth Menon <nm@ti.com>
Signed-off-by: Rajendra Nayak <rnayak@ti.com>
Signed-off-by: Suman Anna <s-anna@ti.com>
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
Fixes: f92d9597f781f6a5a39c73dc71604bd8a21c5299 ("ARM: OMAP2+: hwmod: Extract no-idle and no-reset info from DT")
Signed-off-by: Paul Walmsley <paul@pwsan.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-omap2/omap_hwmod.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -2546,11 +2546,12 @@ static int __init _init(struct omap_hwmo
return -EINVAL;
}
- if (np)
+ if (np) {
if (of_find_property(np, "ti,no-reset-on-init", NULL))
oh->flags |= HWMOD_INIT_NO_RESET;
if (of_find_property(np, "ti,no-idle-on-init", NULL))
oh->flags |= HWMOD_INIT_NO_IDLE;
+ }
oh->_state = _HWMOD_STATE_INITIALIZED;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 009/158] CLK: TI: OMAP4/5/DRA7: Remove gpmc_fck from dummy clocks
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 008/158] ARM: OMAP2+: hwmod: fix missing braces in _init() Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 010/158] ARM: OMAP4: Fix definition of IS_PM44XX_ERRATUM Greg Kroah-Hartman
` (150 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Vaussard, Tero Kristo, Tony Lindgren
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Vaussard <florian.vaussard@epfl.ch>
commit 8559087f0e9722a95df43fa5968bd1ee42bcf540 upstream.
When arch/arm/mach-omap2/gpmc.c calls clk_get(..., "fck"), it will
get a dummy clock and try to use it. As the rate is configured to zero,
this will result in several divisions by zero, and misconfigured
timings, with devices on the bus being lost in the La La Land.
It is better to remove gpmc_fck from the dummy clocks, so that gpmc.c
can fail gracefully.
Signed-off-by: Florian Vaussard <florian.vaussard@epfl.ch>
Acked-by: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/ti/clk-44xx.c | 1 -
drivers/clk/ti/clk-54xx.c | 1 -
drivers/clk/ti/clk-7xx.c | 1 -
3 files changed, 3 deletions(-)
--- a/drivers/clk/ti/clk-44xx.c
+++ b/drivers/clk/ti/clk-44xx.c
@@ -222,7 +222,6 @@ static struct ti_dt_clk omap44xx_clks[]
DT_CLK(NULL, "auxclk5_src_ck", "auxclk5_src_ck"),
DT_CLK(NULL, "auxclk5_ck", "auxclk5_ck"),
DT_CLK(NULL, "auxclkreq5_ck", "auxclkreq5_ck"),
- DT_CLK("50000000.gpmc", "fck", "dummy_ck"),
DT_CLK("omap_i2c.1", "ick", "dummy_ck"),
DT_CLK("omap_i2c.2", "ick", "dummy_ck"),
DT_CLK("omap_i2c.3", "ick", "dummy_ck"),
--- a/drivers/clk/ti/clk-54xx.c
+++ b/drivers/clk/ti/clk-54xx.c
@@ -182,7 +182,6 @@ static struct ti_dt_clk omap54xx_clks[]
DT_CLK(NULL, "auxclk3_src_ck", "auxclk3_src_ck"),
DT_CLK(NULL, "auxclk3_ck", "auxclk3_ck"),
DT_CLK(NULL, "auxclkreq3_ck", "auxclkreq3_ck"),
- DT_CLK(NULL, "gpmc_ck", "dummy_ck"),
DT_CLK("omap_i2c.1", "ick", "dummy_ck"),
DT_CLK("omap_i2c.2", "ick", "dummy_ck"),
DT_CLK("omap_i2c.3", "ick", "dummy_ck"),
--- a/drivers/clk/ti/clk-7xx.c
+++ b/drivers/clk/ti/clk-7xx.c
@@ -262,7 +262,6 @@ static struct ti_dt_clk dra7xx_clks[] =
DT_CLK(NULL, "vip1_gclk_mux", "vip1_gclk_mux"),
DT_CLK(NULL, "vip2_gclk_mux", "vip2_gclk_mux"),
DT_CLK(NULL, "vip3_gclk_mux", "vip3_gclk_mux"),
- DT_CLK(NULL, "gpmc_ck", "dummy_ck"),
DT_CLK("omap_i2c.1", "ick", "dummy_ck"),
DT_CLK("omap_i2c.2", "ick", "dummy_ck"),
DT_CLK("omap_i2c.3", "ick", "dummy_ck"),
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 010/158] ARM: OMAP4: Fix definition of IS_PM44XX_ERRATUM
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 009/158] CLK: TI: OMAP4/5/DRA7: Remove gpmc_fck from dummy clocks Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 011/158] ARM: OMAP3: hwmod data: Correct clock domains for USB modules Greg Kroah-Hartman
` (149 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Nishanth Menon,
Santosh Shilimkar, Kevin Hilman
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <nm@ti.com>
commit 07484ca33ef83900f5cfbde075c1a19e5a237aa1 upstream.
Just like IS_PM34XX_ERRATUM, IS_PM44XX_ERRATUM is valid only if
CONFIG_PM is enabled, else, disabling CONFIG_PM results in build
failure complaining about the following:
arch/arm/mach-omap2/built-in.o: In function `omap4_boot_secondary':
:(.text+0x8a70): undefined reference to `pm44xx_errata'
Fixes: c962184 (ARM: OMAP4: PM: add errata support)
Reported-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Nishanth Menon <nm@ti.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.ocm>
Acked-by: Kevin Hilman <khilman@linaro.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-omap2/pm.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/mach-omap2/pm.h
+++ b/arch/arm/mach-omap2/pm.h
@@ -103,7 +103,7 @@ static inline void enable_omap3630_toggl
#define PM_OMAP4_ROM_SMP_BOOT_ERRATUM_GICD (1 << 0)
-#if defined(CONFIG_ARCH_OMAP4)
+#if defined(CONFIG_PM) && defined(CONFIG_ARCH_OMAP4)
extern u16 pm44xx_errata;
#define IS_PM44XX_ERRATUM(id) (pm44xx_errata & (id))
#else
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 011/158] ARM: OMAP3: hwmod data: Correct clock domains for USB modules
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 010/158] ARM: OMAP4: Fix definition of IS_PM44XX_ERRATUM Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 012/158] ARM: dts: am33xx: correcting dt node unit address for usb Greg Kroah-Hartman
` (148 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nishanth Menon, Paul Walmsley,
Roger Quadros, Keshava Munegowda, Partha Basak
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <rogerq@ti.com>
commit c6c56697ae4bf1226263c19e8353343d7083f40e upstream.
OMAP3 doesn't contain "l3_init_clkdm" clock domain. Use the
proper clock domains for USB Host and USB TLL modules.
Gets rid of the following warnings during boot
omap_hwmod: usb_host_hs: could not associate to clkdm l3_init_clkdm
omap_hwmod: usb_tll_hs: could not associate to clkdm l3_init_clkdm
Reported-by: Nishanth Menon <nm@ti.com>
Cc: Paul Walmsley <paul@pwsan.com>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Fixes: de231388cb80a8ef3e779bbfa0564ba0157b7377 ("ARM: OMAP: USB: EHCI and OHCI hwmod structures for OMAP3")
Cc: Keshava Munegowda <keshava_mgowda@ti.com>
Cc: Partha Basak <parthab@india.ti.com>
Signed-off-by: Paul Walmsley <paul@pwsan.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-omap2/omap_hwmod_3xxx_data.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -1968,7 +1968,7 @@ static struct omap_hwmod_irq_info omap3x
static struct omap_hwmod omap3xxx_usb_host_hs_hwmod = {
.name = "usb_host_hs",
.class = &omap3xxx_usb_host_hs_hwmod_class,
- .clkdm_name = "l3_init_clkdm",
+ .clkdm_name = "usbhost_clkdm",
.mpu_irqs = omap3xxx_usb_host_hs_irqs,
.main_clk = "usbhost_48m_fck",
.prcm = {
@@ -2053,7 +2053,7 @@ static struct omap_hwmod_irq_info omap3x
static struct omap_hwmod omap3xxx_usb_tll_hs_hwmod = {
.name = "usb_tll_hs",
.class = &omap3xxx_usb_tll_hs_hwmod_class,
- .clkdm_name = "l3_init_clkdm",
+ .clkdm_name = "core_l4_clkdm",
.mpu_irqs = omap3xxx_usb_tll_hs_irqs,
.main_clk = "usbtll_fck",
.prcm = {
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 012/158] ARM: dts: am33xx: correcting dt node unit address for usb
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 011/158] ARM: OMAP3: hwmod data: Correct clock domains for USB modules Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-05 8:37 ` Johan Hovold
2014-05-04 15:38 ` [PATCH 3.14 013/158] ARM: dts: omap4/5: Use l3_ick for the gpmc node Greg Kroah-Hartman
` (147 subsequent siblings)
159 siblings, 1 reply; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior,
Felipe Balbi, Mugunthan V N, Tony Lindgren
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mugunthan V N <mugunthanvnm@ti.com>
commit 8abcdd680d543fb582371e146e62ba9f2af8a816 upstream.
DT node's unit address should be its own register offset address to make it a
unique across the system. This patch corrects the incorrect USB entries with
correct register offset for unit address.
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/am33xx.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/boot/dts/am33xx.dtsi
+++ b/arch/arm/boot/dts/am33xx.dtsi
@@ -448,7 +448,7 @@
ti,hwmods = "usb_otg_hs";
status = "disabled";
- usb_ctrl_mod: control@44e10000 {
+ usb_ctrl_mod: control@44e10620 {
compatible = "ti,am335x-usb-ctrl-module";
reg = <0x44e10620 0x10
0x44e10648 0x4>;
@@ -551,7 +551,7 @@
"tx14", "tx15";
};
- cppi41dma: dma-controller@07402000 {
+ cppi41dma: dma-controller@47402000 {
compatible = "ti,am3359-cppi41";
reg = <0x47400000 0x1000
0x47402000 0x1000
^ permalink raw reply [flat|nested] 165+ messages in thread* Re: [PATCH 3.14 012/158] ARM: dts: am33xx: correcting dt node unit address for usb
2014-05-04 15:38 ` [PATCH 3.14 012/158] ARM: dts: am33xx: correcting dt node unit address for usb Greg Kroah-Hartman
@ 2014-05-05 8:37 ` Johan Hovold
2014-05-05 20:47 ` Greg Kroah-Hartman
0 siblings, 1 reply; 165+ messages in thread
From: Johan Hovold @ 2014-05-05 8:37 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Sebastian Andrzej Siewior, Felipe Balbi,
Mugunthan V N, Tony Lindgren, bcousson, linux-omap,
linux-arm-kernel, Leigh Brown, devicetree
On Sun, May 04, 2014 at 11:38:41AM -0400, Greg Kroah-Hartman wrote:
> 3.14-stable review patch. If anyone has any objections, please let me know.
This one should not be backported without commit
a2f8d6b30321 ("ARM: dts: am335x: update USB DT references")
which is in Linus' tree but is not marked for stable (or USB will be
disabled for the boards relying on the old node addresses).
Thanks,
Johan
> ------------------
>
> From: Mugunthan V N <mugunthanvnm@ti.com>
>
> commit 8abcdd680d543fb582371e146e62ba9f2af8a816 upstream.
>
> DT node's unit address should be its own register offset address to make it a
> unique across the system. This patch corrects the incorrect USB entries with
> correct register offset for unit address.
>
> Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> Acked-by: Felipe Balbi <balbi@ti.com>
> Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
> Signed-off-by: Tony Lindgren <tony@atomide.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> arch/arm/boot/dts/am33xx.dtsi | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> --- a/arch/arm/boot/dts/am33xx.dtsi
> +++ b/arch/arm/boot/dts/am33xx.dtsi
> @@ -448,7 +448,7 @@
> ti,hwmods = "usb_otg_hs";
> status = "disabled";
>
> - usb_ctrl_mod: control@44e10000 {
> + usb_ctrl_mod: control@44e10620 {
> compatible = "ti,am335x-usb-ctrl-module";
> reg = <0x44e10620 0x10
> 0x44e10648 0x4>;
> @@ -551,7 +551,7 @@
> "tx14", "tx15";
> };
>
> - cppi41dma: dma-controller@07402000 {
> + cppi41dma: dma-controller@47402000 {
> compatible = "ti,am3359-cppi41";
> reg = <0x47400000 0x1000
> 0x47402000 0x1000
^ permalink raw reply [flat|nested] 165+ messages in thread* Re: [PATCH 3.14 012/158] ARM: dts: am33xx: correcting dt node unit address for usb
2014-05-05 8:37 ` Johan Hovold
@ 2014-05-05 20:47 ` Greg Kroah-Hartman
0 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-05 20:47 UTC (permalink / raw)
To: Johan Hovold
Cc: linux-kernel, stable, Sebastian Andrzej Siewior, Felipe Balbi,
Mugunthan V N, Tony Lindgren, bcousson, linux-omap,
linux-arm-kernel, Leigh Brown, devicetree
On Mon, May 05, 2014 at 10:37:57AM +0200, Johan Hovold wrote:
> On Sun, May 04, 2014 at 11:38:41AM -0400, Greg Kroah-Hartman wrote:
> > 3.14-stable review patch. If anyone has any objections, please let me know.
>
> This one should not be backported without commit
>
> a2f8d6b30321 ("ARM: dts: am335x: update USB DT references")
>
> which is in Linus' tree but is not marked for stable (or USB will be
> disabled for the boards relying on the old node addresses).
Thanks for letting me know, I've now applied that patch as well.
greg k-h
^ permalink raw reply [flat|nested] 165+ messages in thread
* [PATCH 3.14 013/158] ARM: dts: omap4/5: Use l3_ick for the gpmc node
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 012/158] ARM: dts: am33xx: correcting dt node unit address for usb Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 014/158] ARM: dts: Keep G3D regulator always on for exynos5250-arndale Greg Kroah-Hartman
` (146 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Florian Vaussard, Tony Lindgren
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Vaussard <florian.vaussard@epfl.ch>
commit 7b8b6af169a069454936053631d151a50af7b69a upstream.
The GPMC clock is derived from l3_ick. The simplest solution is
to reference directly l3_ick to provide the GPMC fck in order to
get correct timings. The real management of the clock is left to
hwmod.
Signed-off-by: Florian Vaussard <florian.vaussard@epfl.ch>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/omap4.dtsi | 2 ++
arch/arm/boot/dts/omap5.dtsi | 2 ++
2 files changed, 4 insertions(+)
--- a/arch/arm/boot/dts/omap4.dtsi
+++ b/arch/arm/boot/dts/omap4.dtsi
@@ -275,6 +275,8 @@
gpmc,num-waitpins = <4>;
ti,hwmods = "gpmc";
ti,no-idle-on-init;
+ clocks = <&l3_div_ck>;
+ clock-names = "fck";
};
uart1: serial@4806a000 {
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -302,6 +302,8 @@
gpmc,num-cs = <8>;
gpmc,num-waitpins = <4>;
ti,hwmods = "gpmc";
+ clocks = <&l3_iclk_div>;
+ clock-names = "fck";
};
i2c1: i2c@48070000 {
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 014/158] ARM: dts: Keep G3D regulator always on for exynos5250-arndale
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 013/158] ARM: dts: omap4/5: Use l3_ick for the gpmc node Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 015/158] ARM: 7954/1: mm: remove remaining domain support from ARMv6 Greg Kroah-Hartman
` (145 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tomasz Figa, Kyungmin Park,
Tushar Behera, Kukjin Kim
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomasz Figa <t.figa@samsung.com>
commit bfeda827278f09f4db35877e5f1ca9c149ca2890 upstream.
Apparently, if G3D regulator is powered off, the SoC cannot enter low
power modes and just hangs. This patch fixes this by keeping the
regulator always on when the system is running, as suggested by Exynos 4
User's Manual in case of Exynos4210/4x12 SoCs (Exynos5250 UM does not
have such note, but observed behavior seems to confirm that it is true
for this SoC as well).
This fixes an issue preventing Arndale board from entering sleep mode
observed since commit
346f372f7b72a0 clk: exynos5250: Add CLK_IGNORE_UNUSED flag for pmu clock
that landed in kernel 3.10, which has fixed the clock driver to make the
SoC actually try to enter the sleep mode.
Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Acked-by: Kyungmin Park <kyungmin.park@samsung.com>
Tested-by: Tushar Behera <tushar.behera@linaro.org>
Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/exynos5250-arndale.dts | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm/boot/dts/exynos5250-arndale.dts
+++ b/arch/arm/boot/dts/exynos5250-arndale.dts
@@ -287,6 +287,7 @@
regulator-name = "vdd_g3d";
regulator-min-microvolt = <1000000>;
regulator-max-microvolt = <1000000>;
+ regulator-always-on;
regulator-boot-on;
op_mode = <1>;
};
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 015/158] ARM: 7954/1: mm: remove remaining domain support from ARMv6
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 014/158] ARM: dts: Keep G3D regulator always on for exynos5250-arndale Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 016/158] ARM: Fix default CPU selection for ARCH_MULTI_V5 Greg Kroah-Hartman
` (144 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Will Deacon, Russell King
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit b6ccb9803e90c16b212cf4ed62913a7591e79a39 upstream.
CPU_32v6 currently selects CPU_USE_DOMAINS if CPU_V6 and MMU. This is
because ARM 1136 r0pX CPUs lack the v6k extensions, and therefore do
not have hardware thread registers. The lack of these registers requires
the kernel to update the vectors page at each context switch in order to
write a new TLS pointer. This write must be done via the userspace
mapping, since aliasing caches can lead to expensive flushing when using
kmap. Finally, this requires the vectors page to be mapped r/w for
kernel and r/o for user, which has implications for things like put_user
which must trigger CoW appropriately when targetting user pages.
The upshot of all this is that a v6/v7 kernel makes use of domains to
segregate kernel and user memory accesses. This has the nasty
side-effect of making device mappings executable, which has been
observed to cause subtle bugs on recent cores (e.g. Cortex-A15
performing a speculative instruction fetch from the GIC and acking an
interrupt in the process).
This patch solves this problem by removing the remaining domain support
from ARMv6. A new memory type is added specifically for the vectors page
which allows that page (and only that page) to be mapped as user r/o,
kernel r/w. All other user r/o pages are mapped also as kernel r/o.
Patch co-developed with Russell King.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/include/asm/futex.h | 6 ------
arch/arm/include/asm/pgtable-2level.h | 1 +
arch/arm/mm/Kconfig | 3 +--
arch/arm/mm/mmu.c | 10 ++++++++++
arch/arm/mm/proc-macros.S | 19 ++++++-------------
arch/arm/mm/proc-v7-2level.S | 7 -------
6 files changed, 18 insertions(+), 28 deletions(-)
--- a/arch/arm/include/asm/futex.h
+++ b/arch/arm/include/asm/futex.h
@@ -3,11 +3,6 @@
#ifdef __KERNEL__
-#if defined(CONFIG_CPU_USE_DOMAINS) && defined(CONFIG_SMP)
-/* ARM doesn't provide unprivileged exclusive memory accessors */
-#include <asm-generic/futex.h>
-#else
-
#include <linux/futex.h>
#include <linux/uaccess.h>
#include <asm/errno.h>
@@ -164,6 +159,5 @@ futex_atomic_op_inuser (int encoded_op,
return ret;
}
-#endif /* !(CPU_USE_DOMAINS && SMP) */
#endif /* __KERNEL__ */
#endif /* _ASM_ARM_FUTEX_H */
--- a/arch/arm/include/asm/pgtable-2level.h
+++ b/arch/arm/include/asm/pgtable-2level.h
@@ -140,6 +140,7 @@
#define L_PTE_MT_DEV_NONSHARED (_AT(pteval_t, 0x0c) << 2) /* 1100 */
#define L_PTE_MT_DEV_WC (_AT(pteval_t, 0x09) << 2) /* 1001 */
#define L_PTE_MT_DEV_CACHED (_AT(pteval_t, 0x0b) << 2) /* 1011 */
+#define L_PTE_MT_VECTORS (_AT(pteval_t, 0x0f) << 2) /* 1111 */
#define L_PTE_MT_MASK (_AT(pteval_t, 0x0f) << 2)
#ifndef __ASSEMBLY__
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -446,7 +446,6 @@ config CPU_32v5
config CPU_32v6
bool
- select CPU_USE_DOMAINS if CPU_V6 && MMU
select TLS_REG_EMUL if !CPU_32v6K && !MMU
config CPU_32v6K
@@ -671,7 +670,7 @@ config ARM_VIRT_EXT
config SWP_EMULATE
bool "Emulate SWP/SWPB instructions"
- depends on !CPU_USE_DOMAINS && CPU_V7
+ depends on CPU_V7
default y if SMP
select HAVE_PROC_CPU if PROC_FS
help
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -516,6 +516,16 @@ static void __init build_mem_type_table(
s2_device_pgprot = mem_types[MT_DEVICE].prot_pte_s2;
/*
+ * We don't use domains on ARMv6 (since this causes problems with
+ * v6/v7 kernels), so we must use a separate memory type for user
+ * r/o, kernel r/w to map the vectors page.
+ */
+#ifndef CONFIG_ARM_LPAE
+ if (cpu_arch == CPU_ARCH_ARMv6)
+ vecs_pgprot |= L_PTE_MT_VECTORS;
+#endif
+
+ /*
* ARMv6 and above have extended page tables.
*/
if (cpu_arch >= CPU_ARCH_ARMv6 && (cr & CR_XP)) {
--- a/arch/arm/mm/proc-macros.S
+++ b/arch/arm/mm/proc-macros.S
@@ -112,13 +112,9 @@
* 100x 1 0 1 r/o no acc
* 10x0 1 0 1 r/o no acc
* 1011 0 0 1 r/w no acc
- * 110x 0 1 0 r/w r/o
- * 11x0 0 1 0 r/w r/o
- * 1111 0 1 1 r/w r/w
- *
- * If !CONFIG_CPU_USE_DOMAINS, the following permissions are changed:
* 110x 1 1 1 r/o r/o
* 11x0 1 1 1 r/o r/o
+ * 1111 0 1 1 r/w r/w
*/
.macro armv6_mt_table pfx
\pfx\()_mt_table:
@@ -137,7 +133,7 @@
.long PTE_EXT_TEX(2) @ L_PTE_MT_DEV_NONSHARED
.long 0x00 @ unused
.long 0x00 @ unused
- .long 0x00 @ unused
+ .long PTE_CACHEABLE | PTE_BUFFERABLE | PTE_EXT_APX @ L_PTE_MT_VECTORS
.endm
.macro armv6_set_pte_ext pfx
@@ -158,24 +154,21 @@
tst r1, #L_PTE_USER
orrne r3, r3, #PTE_EXT_AP1
-#ifdef CONFIG_CPU_USE_DOMAINS
- @ allow kernel read/write access to read-only user pages
tstne r3, #PTE_EXT_APX
- bicne r3, r3, #PTE_EXT_APX | PTE_EXT_AP0
-#endif
+
+ @ user read-only -> kernel read-only
+ bicne r3, r3, #PTE_EXT_AP0
tst r1, #L_PTE_XN
orrne r3, r3, #PTE_EXT_XN
- orr r3, r3, r2
+ eor r3, r3, r2
tst r1, #L_PTE_YOUNG
tstne r1, #L_PTE_PRESENT
moveq r3, #0
-#ifndef CONFIG_CPU_USE_DOMAINS
tstne r1, #L_PTE_NONE
movne r3, #0
-#endif
str r3, [r0]
mcr p15, 0, r0, c7, c10, 1 @ flush_pte
--- a/arch/arm/mm/proc-v7-2level.S
+++ b/arch/arm/mm/proc-v7-2level.S
@@ -90,21 +90,14 @@ ENTRY(cpu_v7_set_pte_ext)
tst r1, #L_PTE_USER
orrne r3, r3, #PTE_EXT_AP1
-#ifdef CONFIG_CPU_USE_DOMAINS
- @ allow kernel read/write access to read-only user pages
- tstne r3, #PTE_EXT_APX
- bicne r3, r3, #PTE_EXT_APX | PTE_EXT_AP0
-#endif
tst r1, #L_PTE_XN
orrne r3, r3, #PTE_EXT_XN
tst r1, #L_PTE_YOUNG
tstne r1, #L_PTE_VALID
-#ifndef CONFIG_CPU_USE_DOMAINS
eorne r1, r1, #L_PTE_NONE
tstne r1, #L_PTE_NONE
-#endif
moveq r3, #0
ARM( str r3, [r0, #2048]! )
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 016/158] ARM: Fix default CPU selection for ARCH_MULTI_V5
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 015/158] ARM: 7954/1: mm: remove remaining domain support from ARMv6 Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 017/158] ARM: 8007/1: Remove extraneous kcmp syscall ignore Greg Kroah-Hartman
` (143 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrew Lunn, Arnd Bergmann,
Jason Gunthorpe, Jason Cooper
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <andrew@lunn.ch>
commit 12567bbdee7ea553237085a2bbc0ffa5240f5248 upstream.
CPU_ARM926T should be selected if no other CPU is. Put the ! in the
right place so this works.
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Tested-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Fixes: 24e860fbfdb1c ("ARM: multiplatform: always pick one CPU type")
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -898,7 +898,7 @@ config ARCH_MULTI_V5
bool "ARMv5 based platforms (ARM926T, XSCALE, PJ1, ...)"
depends on !ARCH_MULTI_V6_V7
select ARCH_MULTI_V4_V5
- select CPU_ARM926T if (!CPU_ARM946E || CPU_ARM1020 || \
+ select CPU_ARM926T if !(CPU_ARM946E || CPU_ARM1020 || \
CPU_ARM1020E || CPU_ARM1022 || CPU_ARM1026 || \
CPU_XSCALE || CPU_XSC3 || CPU_MOHAWK || CPU_FEROCEON)
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 017/158] ARM: 8007/1: Remove extraneous kcmp syscall ignore
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 016/158] ARM: Fix default CPU selection for ARCH_MULTI_V5 Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 018/158] ARM: 8027/1: fix do_div() bug in big-endian systems Greg Kroah-Hartman
` (142 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christopher Covington, Russell King
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christopher Covington <cov@codeaurora.org>
commit 95c52fe063351192e0f4ffb70ef9bac1aa26f5a4 upstream.
The kcmp system call was ported to ARM in
commit 3f7d1fe108dbaefd0c57a41753fc2c90b395f458
"ARM: 7665/1: Wire up kcmp syscall".
Fixes: 3f7d1fe108db ("ARM: 7665/1: Wire up kcmp syscall")
Signed-off-by: Christopher Covington <cov@codeaurora.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/include/asm/unistd.h | 1 -
1 file changed, 1 deletion(-)
--- a/arch/arm/include/asm/unistd.h
+++ b/arch/arm/include/asm/unistd.h
@@ -48,6 +48,5 @@
*/
#define __IGNORE_fadvise64_64
#define __IGNORE_migrate_pages
-#define __IGNORE_kcmp
#endif /* __ASM_ARM_UNISTD_H */
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 018/158] ARM: 8027/1: fix do_div() bug in big-endian systems
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 017/158] ARM: 8007/1: Remove extraneous kcmp syscall ignore Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 019/158] ARM: 8030/1: ARM : kdump : add arch_crash_save_vmcoreinfo Greg Kroah-Hartman
` (141 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Martin, Nicolas Pitre, Alex Wu,
Xiangyu Lu, Russell King
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiangyu Lu <luxiangyu@huawei.com>
commit 80bb3ef109ff40a7593d9481c17de9bbc4d7c0e2 upstream.
In big-endian systems, "%1" get the most significant part of the value, cause the instruction to get the wrong result.
When viewing ftrace record in big-endian ARM systems, we found that
the timestamp errors:
swapper-0 [001] 1325.970000: 0:120:R ==> [001] 16:120:R events/1
events/1-16 [001] 1325.970000: 16:120:S ==> [001] 0:120:R swapper
swapper-0 [000] 1325.1000000: 0:120:R + [000] 15:120:R events/0
swapper-0 [000] 1325.1000000: 0:120:R ==> [000] 15:120:R events/0
swapper-0 [000] 1326.030000: 0:120:R + [000] 1150:120:R sshd
swapper-0 [000] 1326.030000: 0:120:R ==> [000] 1150:120:R sshd
When viewed ftrace records, it will call the do_div(n, base) function, which achieved arch/arm/include/asm/div64.h in. When n = 10000000, base = 1000000, in do_div(n, base) will execute "umull %Q0, %R0, %1, %Q2".
Reviewed-by: Dave Martin <Dave.Martin@arm.com>
Reviewed-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Alex Wu <wuquanming@huawei.com>
Signed-off-by: Xiangyu Lu <luxiangyu@huawei.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/include/asm/div64.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/include/asm/div64.h
+++ b/arch/arm/include/asm/div64.h
@@ -156,7 +156,7 @@
/* Select the best insn combination to perform the */ \
/* actual __m * __n / (__p << 64) operation. */ \
if (!__c) { \
- asm ( "umull %Q0, %R0, %1, %Q2\n\t" \
+ asm ( "umull %Q0, %R0, %Q1, %Q2\n\t" \
"mov %Q0, #0" \
: "=&r" (__res) \
: "r" (__m), "r" (__n) \
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 019/158] ARM: 8030/1: ARM : kdump : add arch_crash_save_vmcoreinfo
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 018/158] ARM: 8027/1: fix do_div() bug in big-endian systems Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 020/158] ARM: mvebu: ensure the mdio node has a clock reference on Armada 370/XP Greg Kroah-Hartman
` (140 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Will Deacon, Liu Hua, Russell King
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Hua <sdu.liu@huawei.com>
commit 56b700fd6f1e49149880fb1b6ffee0dca5be45fb upstream.
For vmcore generated by LPAE enabled kernel, user space
utility such as crash needs additional infomation to
parse.
So this patch add arch_crash_save_vmcoreinfo as what PAE enabled
i386 linux does.
Reviewed-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Liu Hua <sdu.liu@huawei.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kernel/machine_kexec.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -184,3 +184,10 @@ void machine_kexec(struct kimage *image)
soft_restart(reboot_entry_phys);
}
+
+void arch_crash_save_vmcoreinfo(void)
+{
+#ifdef CONFIG_ARM_LPAE
+ VMCOREINFO_CONFIG(ARM_LPAE);
+#endif
+}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 020/158] ARM: mvebu: ensure the mdio node has a clock reference on Armada 370/XP
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 019/158] ARM: 8030/1: ARM : kdump : add arch_crash_save_vmcoreinfo Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 021/158] ARM: pxa: hx4700.h: include "irqs.h" for PXA_NR_BUILTIN_GPIO Greg Kroah-Hartman
` (139 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Petazzoni, Andrew Lunn,
Gregory CLEMENT, Jason Cooper
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit a6e03dd451c724f785277d8ecca5d1a0b886d892 upstream.
The mvmdio driver accesses some register of the Ethernet unit. It
therefore takes a reference and enables a clock. However, on Armada
370/XP, no clock specification was given in the Device Tree, which
leads the mvmdio driver to fail when being used as a module and loaded
before the mvneta driver: it tries to access a register from a
hardware unit that isn't clocked.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Link: https://lkml.kernel.org/r/1395790439-21332-2-git-send-email-thomas.petazzoni@free-electrons.com
Acked-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/armada-370-xp.dtsi | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm/boot/dts/armada-370-xp.dtsi
+++ b/arch/arm/boot/dts/armada-370-xp.dtsi
@@ -226,6 +226,7 @@
#size-cells = <0>;
compatible = "marvell,orion-mdio";
reg = <0x72004 0x4>;
+ clocks = <&gateclk 4>;
};
eth1: ethernet@74000 {
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 021/158] ARM: pxa: hx4700.h: include "irqs.h" for PXA_NR_BUILTIN_GPIO
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 020/158] ARM: mvebu: ensure the mdio node has a clock reference on Armada 370/XP Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 022/158] ALSA: hda/realtek - Restore default value for ALC283 Greg Kroah-Hartman
` (138 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrea Adami, Linus Walleij, Arnd Bergmann
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Adami <andrea.adami@gmail.com>
commit c02b50e90be9f41d6802049a1a08246e9eb1a22c upstream.
hx4700 needs the same fix as in
9705e74671f0e4f994d86b00cecf441917c64a66
"ARM: pxa: fix various compilation problems"
Fix build errors. Initial one is:
/linux/arch/arm/mach-pxa/include/mach/hx4700.h:18:32: error:
'PXA_NR_BUILTIN_GPIO' undeclared here (not in a function)
| #define HX4700_ASIC3_GPIO_BASE PXA_NR_BUILTIN_GPIO
Signed-off-by: Andrea Adami <andrea.adami@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-pxa/include/mach/hx4700.h | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm/mach-pxa/include/mach/hx4700.h
+++ b/arch/arm/mach-pxa/include/mach/hx4700.h
@@ -14,6 +14,7 @@
#include <linux/gpio.h>
#include <linux/mfd/asic3.h>
+#include "irqs.h" /* PXA_NR_BUILTIN_GPIO */
#define HX4700_ASIC3_GPIO_BASE PXA_NR_BUILTIN_GPIO
#define HX4700_EGPIO_BASE (HX4700_ASIC3_GPIO_BASE + ASIC3_NUM_GPIOS)
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 022/158] ALSA: hda/realtek - Restore default value for ALC283
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 021/158] ARM: pxa: hx4700.h: include "irqs.h" for PXA_NR_BUILTIN_GPIO Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 023/158] ALSA: hda - add headset mic detect quirks for three Dell laptops Greg Kroah-Hartman
` (137 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <kailang@realtek.com>
commit 6bd55b04fe05cb26094b0fe494c7a207e6c0c36e upstream.
Restore the registers to prevent the abnormal digital power supply
rising ratio/sequence to the codec and causing the incorrect default
codec register restoration during initialization.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=71861
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 85 ++++++++++++++++++++++++++++++++++++++++++
1 file changed, 85 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2786,6 +2786,89 @@ static void alc269_shutup(struct hda_cod
snd_hda_shutup_pins(codec);
}
+static void alc283_restore_default_value(struct hda_codec *codec)
+{
+ int val;
+
+ /* Power Down Control */
+ alc_write_coef_idx(codec, 0x03, 0x0002);
+ /* FIFO and filter clock */
+ alc_write_coef_idx(codec, 0x05, 0x0700);
+ /* DMIC control */
+ alc_write_coef_idx(codec, 0x07, 0x0200);
+ /* Analog clock */
+ val = alc_read_coef_idx(codec, 0x06);
+ alc_write_coef_idx(codec, 0x06, (val & ~0x00f0) | 0x0);
+ /* JD */
+ val = alc_read_coef_idx(codec, 0x08);
+ alc_write_coef_idx(codec, 0x08, (val & ~0xfffc) | 0x0c2c);
+ /* JD offset1 */
+ alc_write_coef_idx(codec, 0x0a, 0xcccc);
+ /* JD offset2 */
+ alc_write_coef_idx(codec, 0x0b, 0xcccc);
+ /* LDO1/2/3, DAC/ADC */
+ alc_write_coef_idx(codec, 0x0e, 0x6fc0);
+ /* JD */
+ val = alc_read_coef_idx(codec, 0x0f);
+ alc_write_coef_idx(codec, 0x0f, (val & ~0xf800) | 0x1000);
+ /* Capless */
+ val = alc_read_coef_idx(codec, 0x10);
+ alc_write_coef_idx(codec, 0x10, (val & ~0xfc00) | 0x0c00);
+ /* Class D test 4 */
+ alc_write_coef_idx(codec, 0x3a, 0x0);
+ /* IO power down directly */
+ val = alc_read_coef_idx(codec, 0x0c);
+ alc_write_coef_idx(codec, 0x0c, (val & ~0xfe00) | 0x0);
+ /* ANC */
+ alc_write_coef_idx(codec, 0x22, 0xa0c0);
+ /* AGC MUX */
+ val = alc_read_coefex_idx(codec, 0x53, 0x01);
+ alc_write_coefex_idx(codec, 0x53, 0x01, (val & ~0x000f) | 0x0008);
+ /* DAC simple content protection */
+ val = alc_read_coef_idx(codec, 0x1d);
+ alc_write_coef_idx(codec, 0x1d, (val & ~0x00e0) | 0x0);
+ /* ADC simple content protection */
+ val = alc_read_coef_idx(codec, 0x1f);
+ alc_write_coef_idx(codec, 0x1f, (val & ~0x00e0) | 0x0);
+ /* DAC ADC Zero Detection */
+ alc_write_coef_idx(codec, 0x21, 0x8804);
+ /* PLL */
+ alc_write_coef_idx(codec, 0x2e, 0x2902);
+ /* capless control 2 */
+ alc_write_coef_idx(codec, 0x33, 0xa080);
+ /* capless control 3 */
+ alc_write_coef_idx(codec, 0x34, 0x3400);
+ /* capless control 4 */
+ alc_write_coef_idx(codec, 0x35, 0x2f3e);
+ /* capless control 5 */
+ alc_write_coef_idx(codec, 0x36, 0x0);
+ /* class D test 2 */
+ val = alc_read_coef_idx(codec, 0x38);
+ alc_write_coef_idx(codec, 0x38, (val & ~0x0fff) | 0x0900);
+ /* class D test 3 */
+ alc_write_coef_idx(codec, 0x39, 0x110a);
+ /* class D test 5 */
+ val = alc_read_coef_idx(codec, 0x3b);
+ alc_write_coef_idx(codec, 0x3b, (val & ~0x00f8) | 0x00d8);
+ /* class D test 6 */
+ alc_write_coef_idx(codec, 0x3c, 0x0014);
+ /* classD OCP */
+ alc_write_coef_idx(codec, 0x3d, 0xc2ba);
+ /* classD pure DC test */
+ val = alc_read_coef_idx(codec, 0x42);
+ alc_write_coef_idx(codec, 0x42, (val & ~0x0f80) | 0x0);
+ /* test mode */
+ alc_write_coef_idx(codec, 0x49, 0x0);
+ /* Class D DC enable */
+ val = alc_read_coef_idx(codec, 0x40);
+ alc_write_coef_idx(codec, 0x40, (val & ~0xf800) | 0x9800);
+ /* DC offset */
+ val = alc_read_coef_idx(codec, 0x42);
+ alc_write_coef_idx(codec, 0x42, (val & ~0xf000) | 0x2000);
+ /* Class D amp control */
+ alc_write_coef_idx(codec, 0x37, 0xfc06);
+}
+
static void alc283_init(struct hda_codec *codec)
{
struct alc_spec *spec = codec->spec;
@@ -2793,6 +2876,8 @@ static void alc283_init(struct hda_codec
bool hp_pin_sense;
int val;
+ alc283_restore_default_value(codec);
+
if (!hp_pin)
return;
hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 023/158] ALSA: hda - add headset mic detect quirks for three Dell laptops
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 022/158] ALSA: hda/realtek - Restore default value for ALC283 Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 024/158] ALSA: hda - Enable beep for ASUS 1015E Greg Kroah-Hartman
` (136 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Henningsson, Hui Wang, Takashi Iwai
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <hui.wang@canonical.com>
commit a870593bab179ca402ead455f45af6e4404a2a7f upstream.
When we plug a 3-ring headset on the Dell machines (VID: 0x10ec0255,
SID: 0x10280632; VID: 0x10ec0293, SID: 0x1028062c; VID: 0x10ec0293,
SID: 0x1028062e), the headset mic can't be detected, after apply this
patch, the headset mic can work well.
BugLink: https://bugs.launchpad.net/bugs/1297581
Cc: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 3 +++
1 file changed, 3 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4404,6 +4404,9 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x1028, 0x0616, "Dell Vostro 5470", ALC290_FIXUP_SUBWOOFER_HSJACK),
SND_PCI_QUIRK(0x1028, 0x061f, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x0629, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x062c, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x062e, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0632, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x0638, "Dell Inspiron 5439", ALC290_FIXUP_MONO_SPEAKERS_HSJACK),
SND_PCI_QUIRK(0x1028, 0x063e, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x063f, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 024/158] ALSA: hda - Enable beep for ASUS 1015E
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 023/158] ALSA: hda - add headset mic detect quirks for three Dell laptops Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 025/158] ALSA: ice1712: Fix boundary checks in PCM pointer ops Greg Kroah-Hartman
` (135 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, W. Trevor King, Takashi Iwai
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "W. Trevor King" <wking@tremily.us>
commit a4b7f21d7b42b33609df3f86992a8deff80abfaf upstream.
The `lspci -nnvv` output contains (wrapped for line length):
00:1b.0 Audio device [0403]:
Intel Corporation 7 Series/C210 Series Chipset Family
High Definition Audio Controller [8086:1e20] (rev 04)
Subsystem: ASUSTeK Computer Inc. Device [1043:115d]
Signed-off-by: W. Trevor King <wking@tremily.us>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -993,6 +993,7 @@ static int alc_codec_rename_from_preset(
static const struct snd_pci_quirk beep_white_list[] = {
SND_PCI_QUIRK(0x1043, 0x103c, "ASUS", 1),
+ SND_PCI_QUIRK(0x1043, 0x115d, "ASUS", 1),
SND_PCI_QUIRK(0x1043, 0x829f, "ASUS", 1),
SND_PCI_QUIRK(0x1043, 0x8376, "EeePC", 1),
SND_PCI_QUIRK(0x1043, 0x83ce, "EeePC", 1),
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 025/158] ALSA: ice1712: Fix boundary checks in PCM pointer ops
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 024/158] ALSA: hda - Enable beep for ASUS 1015E Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 026/158] ALSA: hda - Fix silent speaker output due to mute LED fixup Greg Kroah-Hartman
` (134 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 4f8e940095536bc002a81666a4107a581c84e9b9 upstream.
PCM pointer callbacks in ice1712 driver check the buffer size boundary
wrongly between bytes and frames. This leads to PCM core warnings
like:
snd_pcm_update_hw_ptr0: 105 callbacks suppressed
ALSA pcm_lib.c:352 BUG: pcmC3D0c:0, pos = 5461, buffer size = 5461, period size = 2730
This patch fixes these checks to be placed after the proper unit
conversions.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/ice1712/ice1712.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/sound/pci/ice1712/ice1712.c
+++ b/sound/pci/ice1712/ice1712.c
@@ -685,9 +685,10 @@ static snd_pcm_uframes_t snd_ice1712_pla
if (!(snd_ice1712_read(ice, ICE1712_IREG_PBK_CTRL) & 1))
return 0;
ptr = runtime->buffer_size - inw(ice->ddma_port + 4);
+ ptr = bytes_to_frames(substream->runtime, ptr);
if (ptr == runtime->buffer_size)
ptr = 0;
- return bytes_to_frames(substream->runtime, ptr);
+ return ptr;
}
static snd_pcm_uframes_t snd_ice1712_playback_ds_pointer(struct snd_pcm_substream *substream)
@@ -704,9 +705,10 @@ static snd_pcm_uframes_t snd_ice1712_pla
addr = ICE1712_DSC_ADDR0;
ptr = snd_ice1712_ds_read(ice, substream->number * 2, addr) -
ice->playback_con_virt_addr[substream->number];
+ ptr = bytes_to_frames(substream->runtime, ptr);
if (ptr == substream->runtime->buffer_size)
ptr = 0;
- return bytes_to_frames(substream->runtime, ptr);
+ return ptr;
}
static snd_pcm_uframes_t snd_ice1712_capture_pointer(struct snd_pcm_substream *substream)
@@ -717,9 +719,10 @@ static snd_pcm_uframes_t snd_ice1712_cap
if (!(snd_ice1712_read(ice, ICE1712_IREG_CAP_CTRL) & 1))
return 0;
ptr = inl(ICEREG(ice, CONCAP_ADDR)) - ice->capture_con_virt_addr;
+ ptr = bytes_to_frames(substream->runtime, ptr);
if (ptr == substream->runtime->buffer_size)
ptr = 0;
- return bytes_to_frames(substream->runtime, ptr);
+ return ptr;
}
static const struct snd_pcm_hardware snd_ice1712_playback = {
@@ -1113,9 +1116,10 @@ static snd_pcm_uframes_t snd_ice1712_pla
if (!(inl(ICEMT(ice, PLAYBACK_CONTROL)) & ICE1712_PLAYBACK_START))
return 0;
ptr = ice->playback_pro_size - (inw(ICEMT(ice, PLAYBACK_SIZE)) << 2);
+ ptr = bytes_to_frames(substream->runtime, ptr);
if (ptr == substream->runtime->buffer_size)
ptr = 0;
- return bytes_to_frames(substream->runtime, ptr);
+ return ptr;
}
static snd_pcm_uframes_t snd_ice1712_capture_pro_pointer(struct snd_pcm_substream *substream)
@@ -1126,9 +1130,10 @@ static snd_pcm_uframes_t snd_ice1712_cap
if (!(inl(ICEMT(ice, PLAYBACK_CONTROL)) & ICE1712_CAPTURE_START_SHADOW))
return 0;
ptr = ice->capture_pro_size - (inw(ICEMT(ice, CAPTURE_SIZE)) << 2);
+ ptr = bytes_to_frames(substream->runtime, ptr);
if (ptr == substream->runtime->buffer_size)
ptr = 0;
- return bytes_to_frames(substream->runtime, ptr);
+ return ptr;
}
static const struct snd_pcm_hardware snd_ice1712_playback_pro = {
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 026/158] ALSA: hda - Fix silent speaker output due to mute LED fixup
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 025/158] ALSA: ice1712: Fix boundary checks in PCM pointer ops Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 027/158] ALSA: hda/realtek - Add support of ALC288 codec Greg Kroah-Hartman
` (133 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 415d555e6b398b00fc1733f0113065a54df9106a upstream.
The recent fixups for HP laptops to support the mute LED made the
speaker output silent on some machines. It turned out that they use
the NID 0x18 for the speaker while it's also used for controlling the
LED via VREF bits although the current driver code blindly assumes
that such a node is a mic pin (where 0x18 is usually so).
This patch fixes the problem by only changing the VREF bits and
keeping the other pin ctl bits.
Reported-and-tested-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3212,8 +3212,9 @@ static void alc269_fixup_mic_mute_hook(v
if (spec->mute_led_polarity)
enabled = !enabled;
- pinval = AC_PINCTL_IN_EN |
- (enabled ? AC_PINCTL_VREF_HIZ : AC_PINCTL_VREF_80);
+ pinval = snd_hda_codec_get_pin_target(codec, spec->mute_led_nid);
+ pinval &= ~AC_PINCTL_VREFEN;
+ pinval |= enabled ? AC_PINCTL_VREF_HIZ : AC_PINCTL_VREF_80;
if (spec->mute_led_nid)
snd_hda_set_pin_ctl_cache(codec, spec->mute_led_nid, pinval);
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 027/158] ALSA: hda/realtek - Add support of ALC288 codec
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 026/158] ALSA: hda - Fix silent speaker output due to mute LED fixup Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 028/158] ALSA: hda/realtek - Add headset Mic support for Dell machine Greg Kroah-Hartman
` (132 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <kailang@realtek.com>
commit 7c66593286bcd153e4868383e675673a27071bd5 upstream.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4708,6 +4708,7 @@ static int patch_alc269(struct hda_codec
spec->codec_variant = ALC269_TYPE_ALC285;
break;
case 0x10ec0286:
+ case 0x10ec0288:
spec->codec_variant = ALC269_TYPE_ALC286;
break;
case 0x10ec0255:
@@ -5514,6 +5515,7 @@ static const struct hda_codec_preset snd
{ .id = 0x10ec0284, .name = "ALC284", .patch = patch_alc269 },
{ .id = 0x10ec0285, .name = "ALC285", .patch = patch_alc269 },
{ .id = 0x10ec0286, .name = "ALC286", .patch = patch_alc269 },
+ { .id = 0x10ec0288, .name = "ALC288", .patch = patch_alc269 },
{ .id = 0x10ec0290, .name = "ALC290", .patch = patch_alc269 },
{ .id = 0x10ec0292, .name = "ALC292", .patch = patch_alc269 },
{ .id = 0x10ec0293, .name = "ALC293", .patch = patch_alc269 },
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 028/158] ALSA: hda/realtek - Add headset Mic support for Dell machine
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 027/158] ALSA: hda/realtek - Add support of ALC288 codec Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 029/158] ACPICA: Restore code that repairs NULL package elements in return values Greg Kroah-Hartman
` (131 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <kailang@realtek.com>
commit 8dc9abb93dde94e7f2bc719032fe16f5713df05c upstream.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5275,6 +5275,8 @@ static const struct snd_pci_quirk alc662
SND_PCI_QUIRK(0x1028, 0x0626, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x0628, "Dell", ALC668_FIXUP_AUTO_MUTE),
SND_PCI_QUIRK(0x1028, 0x064e, "Dell", ALC668_FIXUP_AUTO_MUTE),
+ SND_PCI_QUIRK(0x1028, 0x0696, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A_CHMAP),
SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_CHMAP),
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 029/158] ACPICA: Restore code that repairs NULL package elements in return values.
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 028/158] ALSA: hda/realtek - Add headset Mic support for Dell machine Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:38 ` [PATCH 3.14 030/158] spi: efm32: use $vendor,$device scheme for compatible string Greg Kroah-Hartman
` (130 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lv Zheng, Bob Moore, Rafael J. Wysocki
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lv Zheng <lv.zheng@intel.com>
commit 61db45ca21630f5ab7f678d54c5d969c21647854 upstream.
The original code was lost accidently, it was not generated along with the
following commit of mechanism improvements and thus not get merged:
Commit: d5a36100f62fa6db5541344e08b361b34e9114c5
Subject: ACPICA: Add mechanism for early object repairs on a per-name basis
Adds the framework to allow object repairs very early in the
return object analysis. Enables repairs like string->unicode,
etc.
This patch restores the implementation of the NULL element repair code for
ACPI_RTYPE_NONE. In the original design, ACPI_RTYPE_NONE is defined to
collect simple NULL object repairs.
Lv Zheng.
Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=67901
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/acpica/nsrepair.c | 25 +++++++++++++++++++++----
1 file changed, 21 insertions(+), 4 deletions(-)
--- a/drivers/acpi/acpica/nsrepair.c
+++ b/drivers/acpi/acpica/nsrepair.c
@@ -207,13 +207,30 @@ acpi_ns_simple_repair(struct acpi_evalua
* this predefined name. Either one return value is expected, or none,
* for both methods and other objects.
*
- * Exit now if there is no return object. Warning if one was expected.
+ * Try to fix if there was no return object. Warning if failed to fix.
*/
if (!return_object) {
if (expected_btypes && (!(expected_btypes & ACPI_RTYPE_NONE))) {
- ACPI_WARN_PREDEFINED((AE_INFO, info->full_pathname,
- ACPI_WARN_ALWAYS,
- "Missing expected return value"));
+ if (package_index != ACPI_NOT_PACKAGE_ELEMENT) {
+ ACPI_WARN_PREDEFINED((AE_INFO,
+ info->full_pathname,
+ ACPI_WARN_ALWAYS,
+ "Found unexpected NULL package element"));
+
+ status =
+ acpi_ns_repair_null_element(info,
+ expected_btypes,
+ package_index,
+ return_object_ptr);
+ if (ACPI_SUCCESS(status)) {
+ return (AE_OK); /* Repair was successful */
+ }
+ } else {
+ ACPI_WARN_PREDEFINED((AE_INFO,
+ info->full_pathname,
+ ACPI_WARN_ALWAYS,
+ "Missing expected return value"));
+ }
return (AE_AML_NO_RETURN_VALUE);
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 030/158] spi: efm32: use $vendor,$device scheme for compatible string
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 029/158] ACPICA: Restore code that repairs NULL package elements in return values Greg Kroah-Hartman
@ 2014-05-04 15:38 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 031/158] spi: dw: Dont call kfree for memory allocated by devm_kzalloc Greg Kroah-Hartman
` (129 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König, Wolfram Sang,
Mark Brown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
commit 12f6dd860cf8bf036c0bec38c00a53da71bcd43a upstream.
Wolfram Sang pointed out that "efm32,$device" is non-standard. So use the
common scheme and prefix device with "efm32-". The old compatible string
is left in place until arch/arm/boot/dts/efm32* is fixed.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/spi/efm32-spi.txt | 4 ++--
drivers/spi/spi-efm32.c | 3 +++
2 files changed, 5 insertions(+), 2 deletions(-)
--- a/Documentation/devicetree/bindings/spi/efm32-spi.txt
+++ b/Documentation/devicetree/bindings/spi/efm32-spi.txt
@@ -3,7 +3,7 @@
Required properties:
- #address-cells: see spi-bus.txt
- #size-cells: see spi-bus.txt
-- compatible: should be "efm32,spi"
+- compatible: should be "energymicro,efm32-spi"
- reg: Offset and length of the register set for the controller
- interrupts: pair specifying rx and tx irq
- clocks: phandle to the spi clock
@@ -15,7 +15,7 @@ Example:
spi1: spi@0x4000c400 { /* USART1 */
#address-cells = <1>;
#size-cells = <0>;
- compatible = "efm32,spi";
+ compatible = "energymicro,efm32-spi";
reg = <0x4000c400 0x400>;
interrupts = <15 16>;
clocks = <&cmu 20>;
--- a/drivers/spi/spi-efm32.c
+++ b/drivers/spi/spi-efm32.c
@@ -487,6 +487,9 @@ static int efm32_spi_remove(struct platf
static const struct of_device_id efm32_spi_dt_ids[] = {
{
+ .compatible = "energymicro,efm32-spi",
+ }, {
+ /* doesn't follow the "vendor,device" scheme, don't use */
.compatible = "efm32,spi",
}, {
/* sentinel */
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 031/158] spi: dw: Dont call kfree for memory allocated by devm_kzalloc
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2014-05-04 15:38 ` [PATCH 3.14 030/158] spi: efm32: use $vendor,$device scheme for compatible string Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 032/158] s390/cio: fix driver callback initialization for ccw consoles Greg Kroah-Hartman
` (128 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Axel Lin, Baruch Siach, Mark Brown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <axel.lin@ingics.com>
commit c63f5da00845143de621e991ea186be0829647ee upstream.
With devm_kzalloc, the memory is automatically freed when spi_device detach from
the bus.
Fixes: commit 43f627ac9de42 (spi: dw: fix memory leak on error path)
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-dw.c | 7 -------
1 file changed, 7 deletions(-)
--- a/drivers/spi/spi-dw.c
+++ b/drivers/spi/spi-dw.c
@@ -671,12 +671,6 @@ static int dw_spi_setup(struct spi_devic
return 0;
}
-static void dw_spi_cleanup(struct spi_device *spi)
-{
- struct chip_data *chip = spi_get_ctldata(spi);
- kfree(chip);
-}
-
static int init_queue(struct dw_spi *dws)
{
INIT_LIST_HEAD(&dws->queue);
@@ -806,7 +800,6 @@ int dw_spi_add_host(struct device *dev,
master->bits_per_word_mask = SPI_BPW_MASK(8) | SPI_BPW_MASK(16);
master->bus_num = dws->bus_num;
master->num_chipselect = dws->num_cs;
- master->cleanup = dw_spi_cleanup;
master->setup = dw_spi_setup;
master->transfer = dw_spi_transfer;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 032/158] s390/cio: fix driver callback initialization for ccw consoles
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 031/158] spi: dw: Dont call kfree for memory allocated by devm_kzalloc Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 033/158] KVM: s390: Optimize ucontrol path Greg Kroah-Hartman
` (127 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mike Frysinger, Heiko Carstens,
Peter Oberparleiter, Sebastian Ott, Martin Schwidefsky
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Ott <sebott@linux.vnet.ibm.com>
commit 2253e8d79237c69086ded391e6767afe16972527 upstream.
ccw consoles are in use before they can be properly registered with
the driver core. For devices which are in use by a device driver we
rely on the ccw_device's pointer to the driver callbacks to be valid.
For ccw consoles this pointer is NULL until they are registered later
during boot and we dereferenced this pointer. This worked by
chance on 64 bit builds (cdev->drv was NULL but the optional callback
cdev->drv->path_event was also NULL by coincidence) and was unnoticed
until we received reports about boot failures on 31 bit systems.
Fix it by initializing the driver pointer for ccw consoles.
Reported-by: Mike Frysinger <vapier@gentoo.org>
Reported-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/ccwdev.h | 2 +-
drivers/s390/char/con3215.c | 2 +-
drivers/s390/char/con3270.c | 6 +-----
drivers/s390/char/raw3270.c | 10 +++++++++-
drivers/s390/char/raw3270.h | 2 +-
drivers/s390/cio/device.c | 3 ++-
6 files changed, 15 insertions(+), 10 deletions(-)
--- a/arch/s390/include/asm/ccwdev.h
+++ b/arch/s390/include/asm/ccwdev.h
@@ -219,7 +219,7 @@ extern void ccw_device_get_id(struct ccw
#define to_ccwdev(n) container_of(n, struct ccw_device, dev)
#define to_ccwdrv(n) container_of(n, struct ccw_driver, driver)
-extern struct ccw_device *ccw_device_probe_console(void);
+extern struct ccw_device *ccw_device_probe_console(struct ccw_driver *);
extern void ccw_device_wait_idle(struct ccw_device *);
extern int ccw_device_force_console(struct ccw_device *);
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -922,7 +922,7 @@ static int __init con3215_init(void)
raw3215_freelist = req;
}
- cdev = ccw_device_probe_console();
+ cdev = ccw_device_probe_console(&raw3215_ccw_driver);
if (IS_ERR(cdev))
return -ENODEV;
--- a/drivers/s390/char/con3270.c
+++ b/drivers/s390/char/con3270.c
@@ -576,7 +576,6 @@ static struct console con3270 = {
static int __init
con3270_init(void)
{
- struct ccw_device *cdev;
struct raw3270 *rp;
void *cbuf;
int i;
@@ -591,10 +590,7 @@ con3270_init(void)
cpcmd("TERM AUTOCR OFF", NULL, 0, NULL);
}
- cdev = ccw_device_probe_console();
- if (IS_ERR(cdev))
- return -ENODEV;
- rp = raw3270_setup_console(cdev);
+ rp = raw3270_setup_console();
if (IS_ERR(rp))
return PTR_ERR(rp);
--- a/drivers/s390/char/raw3270.c
+++ b/drivers/s390/char/raw3270.c
@@ -776,16 +776,24 @@ raw3270_setup_device(struct ccw_device *
}
#ifdef CONFIG_TN3270_CONSOLE
+/* Tentative definition - see below for actual definition. */
+static struct ccw_driver raw3270_ccw_driver;
+
/*
* Setup 3270 device configured as console.
*/
-struct raw3270 __init *raw3270_setup_console(struct ccw_device *cdev)
+struct raw3270 __init *raw3270_setup_console(void)
{
+ struct ccw_device *cdev;
unsigned long flags;
struct raw3270 *rp;
char *ascebc;
int rc;
+ cdev = ccw_device_probe_console(&raw3270_ccw_driver);
+ if (IS_ERR(cdev))
+ return ERR_CAST(cdev);
+
rp = kzalloc(sizeof(struct raw3270), GFP_KERNEL | GFP_DMA);
ascebc = kzalloc(256, GFP_KERNEL);
rc = raw3270_setup_device(cdev, rp, ascebc);
--- a/drivers/s390/char/raw3270.h
+++ b/drivers/s390/char/raw3270.h
@@ -190,7 +190,7 @@ raw3270_put_view(struct raw3270_view *vi
wake_up(&raw3270_wait_queue);
}
-struct raw3270 *raw3270_setup_console(struct ccw_device *cdev);
+struct raw3270 *raw3270_setup_console(void);
void raw3270_wait_cons_dev(struct raw3270 *);
/* Notifier for device addition/removal */
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1609,7 +1609,7 @@ out_unlock:
return rc;
}
-struct ccw_device *ccw_device_probe_console(void)
+struct ccw_device *ccw_device_probe_console(struct ccw_driver *drv)
{
struct io_subchannel_private *io_priv;
struct ccw_device *cdev;
@@ -1631,6 +1631,7 @@ struct ccw_device *ccw_device_probe_cons
kfree(io_priv);
return cdev;
}
+ cdev->drv = drv;
set_io_private(sch, io_priv);
ret = ccw_device_console_enable(cdev, sch);
if (ret) {
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 033/158] KVM: s390: Optimize ucontrol path
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 032/158] s390/cio: fix driver callback initialization for ccw consoles Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 034/158] s390/bitops,atomic: add missing memory barriers Greg Kroah-Hartman
` (126 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Borntraeger, Cornelia Huck
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <borntraeger@de.ibm.com>
commit 2955c83f72801245afd0fe5c560cc75b82bea9aa upstream.
Since commit 7c470539c95630c1f2a10f109e96f249730b75eb
(s390/kvm: avoid automatic sie reentry) we will run through the C code
of KVM on host interrupts instead of just reentering the guest. This
will result in additional ucontrol exits (at least HZ per second). Let
handle a 0 intercept in the kernel and dont return to userspace,
even if in ucontrol mode.
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kvm/kvm-s390.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -753,7 +753,8 @@ static int vcpu_post_run(struct kvm_vcpu
if (rc == 0) {
if (kvm_is_ucontrol(vcpu->kvm))
- rc = -EOPNOTSUPP;
+ /* Don't exit for host interrupts. */
+ rc = vcpu->arch.sie_block->icptcode ? -EOPNOTSUPP : 0;
else
rc = kvm_handle_sie_intercept(vcpu);
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 034/158] s390/bitops,atomic: add missing memory barriers
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 033/158] KVM: s390: Optimize ucontrol path Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 035/158] s390: fix control register update Greg Kroah-Hartman
` (125 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Martin Schwidefsky
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <heiko.carstens@de.ibm.com>
commit 0ccc8b7ac86053388e793bad20bd26bd777752eb upstream.
When reworking the bitops and atomic ops I missed that those instructions
that got atomic behaviour only perform a "specific-operand-serialization"
instead of a full "serialization".
The compare-and-swap instruction used before performs a full serialization
before and after the instruction is executed, which means it has full
memory barrier semantics.
In order to give the new bitops and atomic ops functions also full memory
barrier semantics add a "bcr 14,0" before and after each of those new
instructions which performs full serialization as well.
This restores memory barrier semantics for bitops and atomic ops functions
which return values, like e.g. atomic_add_return(), but not for functions
which do not return a value, like e.g. atomic_add().
This is consistent to other architectures and what common code requires.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/atomic.h | 70 ++++++++++++++++++++++++-----------------
arch/s390/include/asm/bitops.h | 41 +++++++++++++-----------
2 files changed, 65 insertions(+), 46 deletions(-)
--- a/arch/s390/include/asm/atomic.h
+++ b/arch/s390/include/asm/atomic.h
@@ -15,23 +15,29 @@
#include <linux/compiler.h>
#include <linux/types.h>
+#include <asm/barrier.h>
#include <asm/cmpxchg.h>
#define ATOMIC_INIT(i) { (i) }
+#define __ATOMIC_NO_BARRIER "\n"
+
#ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
#define __ATOMIC_OR "lao"
#define __ATOMIC_AND "lan"
#define __ATOMIC_ADD "laa"
+#define __ATOMIC_BARRIER "bcr 14,0\n"
-#define __ATOMIC_LOOP(ptr, op_val, op_string) \
+#define __ATOMIC_LOOP(ptr, op_val, op_string, __barrier) \
({ \
int old_val; \
\
typecheck(atomic_t *, ptr); \
asm volatile( \
+ __barrier \
op_string " %0,%2,%1\n" \
+ __barrier \
: "=d" (old_val), "+Q" ((ptr)->counter) \
: "d" (op_val) \
: "cc", "memory"); \
@@ -43,8 +49,9 @@
#define __ATOMIC_OR "or"
#define __ATOMIC_AND "nr"
#define __ATOMIC_ADD "ar"
+#define __ATOMIC_BARRIER "\n"
-#define __ATOMIC_LOOP(ptr, op_val, op_string) \
+#define __ATOMIC_LOOP(ptr, op_val, op_string, __barrier) \
({ \
int old_val, new_val; \
\
@@ -82,7 +89,7 @@ static inline void atomic_set(atomic_t *
static inline int atomic_add_return(int i, atomic_t *v)
{
- return __ATOMIC_LOOP(v, i, __ATOMIC_ADD) + i;
+ return __ATOMIC_LOOP(v, i, __ATOMIC_ADD, __ATOMIC_BARRIER) + i;
}
static inline void atomic_add(int i, atomic_t *v)
@@ -94,12 +101,10 @@ static inline void atomic_add(int i, ato
: "+Q" (v->counter)
: "i" (i)
: "cc", "memory");
- } else {
- atomic_add_return(i, v);
+ return;
}
-#else
- atomic_add_return(i, v);
#endif
+ __ATOMIC_LOOP(v, i, __ATOMIC_ADD, __ATOMIC_NO_BARRIER);
}
#define atomic_add_negative(_i, _v) (atomic_add_return(_i, _v) < 0)
@@ -115,12 +120,12 @@ static inline void atomic_add(int i, ato
static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
{
- __ATOMIC_LOOP(v, ~mask, __ATOMIC_AND);
+ __ATOMIC_LOOP(v, ~mask, __ATOMIC_AND, __ATOMIC_NO_BARRIER);
}
static inline void atomic_set_mask(unsigned int mask, atomic_t *v)
{
- __ATOMIC_LOOP(v, mask, __ATOMIC_OR);
+ __ATOMIC_LOOP(v, mask, __ATOMIC_OR, __ATOMIC_NO_BARRIER);
}
#define atomic_xchg(v, new) (xchg(&((v)->counter), new))
@@ -157,19 +162,24 @@ static inline int __atomic_add_unless(at
#ifdef CONFIG_64BIT
+#define __ATOMIC64_NO_BARRIER "\n"
+
#ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
#define __ATOMIC64_OR "laog"
#define __ATOMIC64_AND "lang"
#define __ATOMIC64_ADD "laag"
+#define __ATOMIC64_BARRIER "bcr 14,0\n"
-#define __ATOMIC64_LOOP(ptr, op_val, op_string) \
+#define __ATOMIC64_LOOP(ptr, op_val, op_string, __barrier) \
({ \
long long old_val; \
\
typecheck(atomic64_t *, ptr); \
asm volatile( \
+ __barrier \
op_string " %0,%2,%1\n" \
+ __barrier \
: "=d" (old_val), "+Q" ((ptr)->counter) \
: "d" (op_val) \
: "cc", "memory"); \
@@ -181,8 +191,9 @@ static inline int __atomic_add_unless(at
#define __ATOMIC64_OR "ogr"
#define __ATOMIC64_AND "ngr"
#define __ATOMIC64_ADD "agr"
+#define __ATOMIC64_BARRIER "\n"
-#define __ATOMIC64_LOOP(ptr, op_val, op_string) \
+#define __ATOMIC64_LOOP(ptr, op_val, op_string, __barrier) \
({ \
long long old_val, new_val; \
\
@@ -220,17 +231,32 @@ static inline void atomic64_set(atomic64
static inline long long atomic64_add_return(long long i, atomic64_t *v)
{
- return __ATOMIC64_LOOP(v, i, __ATOMIC64_ADD) + i;
+ return __ATOMIC64_LOOP(v, i, __ATOMIC64_ADD, __ATOMIC64_BARRIER) + i;
+}
+
+static inline void atomic64_add(long long i, atomic64_t *v)
+{
+#ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
+ if (__builtin_constant_p(i) && (i > -129) && (i < 128)) {
+ asm volatile(
+ "agsi %0,%1\n"
+ : "+Q" (v->counter)
+ : "i" (i)
+ : "cc", "memory");
+ return;
+ }
+#endif
+ __ATOMIC64_LOOP(v, i, __ATOMIC64_ADD, __ATOMIC64_NO_BARRIER);
}
static inline void atomic64_clear_mask(unsigned long mask, atomic64_t *v)
{
- __ATOMIC64_LOOP(v, ~mask, __ATOMIC64_AND);
+ __ATOMIC64_LOOP(v, ~mask, __ATOMIC64_AND, __ATOMIC64_NO_BARRIER);
}
static inline void atomic64_set_mask(unsigned long mask, atomic64_t *v)
{
- __ATOMIC64_LOOP(v, mask, __ATOMIC64_OR);
+ __ATOMIC64_LOOP(v, mask, __ATOMIC64_OR, __ATOMIC64_NO_BARRIER);
}
#define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
@@ -334,25 +360,13 @@ static inline void atomic64_clear_mask(u
} while (atomic64_cmpxchg(v, old, new) != old);
}
-#endif /* CONFIG_64BIT */
-
static inline void atomic64_add(long long i, atomic64_t *v)
{
-#ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
- if (__builtin_constant_p(i) && (i > -129) && (i < 128)) {
- asm volatile(
- "agsi %0,%1\n"
- : "+Q" (v->counter)
- : "i" (i)
- : "cc", "memory");
- } else {
- atomic64_add_return(i, v);
- }
-#else
atomic64_add_return(i, v);
-#endif
}
+#endif /* CONFIG_64BIT */
+
static inline int atomic64_add_unless(atomic64_t *v, long long i, long long u)
{
long long c, old;
--- a/arch/s390/include/asm/bitops.h
+++ b/arch/s390/include/asm/bitops.h
@@ -47,14 +47,18 @@
#include <linux/typecheck.h>
#include <linux/compiler.h>
+#include <asm/barrier.h>
+
+#define __BITOPS_NO_BARRIER "\n"
#ifndef CONFIG_64BIT
#define __BITOPS_OR "or"
#define __BITOPS_AND "nr"
#define __BITOPS_XOR "xr"
+#define __BITOPS_BARRIER "\n"
-#define __BITOPS_LOOP(__addr, __val, __op_string) \
+#define __BITOPS_LOOP(__addr, __val, __op_string, __barrier) \
({ \
unsigned long __old, __new; \
\
@@ -67,7 +71,7 @@
" jl 0b" \
: "=&d" (__old), "=&d" (__new), "+Q" (*(__addr))\
: "d" (__val) \
- : "cc"); \
+ : "cc", "memory"); \
__old; \
})
@@ -78,17 +82,20 @@
#define __BITOPS_OR "laog"
#define __BITOPS_AND "lang"
#define __BITOPS_XOR "laxg"
+#define __BITOPS_BARRIER "bcr 14,0\n"
-#define __BITOPS_LOOP(__addr, __val, __op_string) \
+#define __BITOPS_LOOP(__addr, __val, __op_string, __barrier) \
({ \
unsigned long __old; \
\
typecheck(unsigned long *, (__addr)); \
asm volatile( \
+ __barrier \
__op_string " %0,%2,%1\n" \
+ __barrier \
: "=d" (__old), "+Q" (*(__addr)) \
: "d" (__val) \
- : "cc"); \
+ : "cc", "memory"); \
__old; \
})
@@ -97,8 +104,9 @@
#define __BITOPS_OR "ogr"
#define __BITOPS_AND "ngr"
#define __BITOPS_XOR "xgr"
+#define __BITOPS_BARRIER "\n"
-#define __BITOPS_LOOP(__addr, __val, __op_string) \
+#define __BITOPS_LOOP(__addr, __val, __op_string, __barrier) \
({ \
unsigned long __old, __new; \
\
@@ -111,7 +119,7 @@
" jl 0b" \
: "=&d" (__old), "=&d" (__new), "+Q" (*(__addr))\
: "d" (__val) \
- : "cc"); \
+ : "cc", "memory"); \
__old; \
})
@@ -149,12 +157,12 @@ static inline void set_bit(unsigned long
"oi %0,%b1\n"
: "+Q" (*caddr)
: "i" (1 << (nr & 7))
- : "cc");
+ : "cc", "memory");
return;
}
#endif
mask = 1UL << (nr & (BITS_PER_LONG - 1));
- __BITOPS_LOOP(addr, mask, __BITOPS_OR);
+ __BITOPS_LOOP(addr, mask, __BITOPS_OR, __BITOPS_NO_BARRIER);
}
static inline void clear_bit(unsigned long nr, volatile unsigned long *ptr)
@@ -170,12 +178,12 @@ static inline void clear_bit(unsigned lo
"ni %0,%b1\n"
: "+Q" (*caddr)
: "i" (~(1 << (nr & 7)))
- : "cc");
+ : "cc", "memory");
return;
}
#endif
mask = ~(1UL << (nr & (BITS_PER_LONG - 1)));
- __BITOPS_LOOP(addr, mask, __BITOPS_AND);
+ __BITOPS_LOOP(addr, mask, __BITOPS_AND, __BITOPS_NO_BARRIER);
}
static inline void change_bit(unsigned long nr, volatile unsigned long *ptr)
@@ -191,12 +199,12 @@ static inline void change_bit(unsigned l
"xi %0,%b1\n"
: "+Q" (*caddr)
: "i" (1 << (nr & 7))
- : "cc");
+ : "cc", "memory");
return;
}
#endif
mask = 1UL << (nr & (BITS_PER_LONG - 1));
- __BITOPS_LOOP(addr, mask, __BITOPS_XOR);
+ __BITOPS_LOOP(addr, mask, __BITOPS_XOR, __BITOPS_NO_BARRIER);
}
static inline int
@@ -206,8 +214,7 @@ test_and_set_bit(unsigned long nr, volat
unsigned long old, mask;
mask = 1UL << (nr & (BITS_PER_LONG - 1));
- old = __BITOPS_LOOP(addr, mask, __BITOPS_OR);
- barrier();
+ old = __BITOPS_LOOP(addr, mask, __BITOPS_OR, __BITOPS_BARRIER);
return (old & mask) != 0;
}
@@ -218,8 +225,7 @@ test_and_clear_bit(unsigned long nr, vol
unsigned long old, mask;
mask = ~(1UL << (nr & (BITS_PER_LONG - 1)));
- old = __BITOPS_LOOP(addr, mask, __BITOPS_AND);
- barrier();
+ old = __BITOPS_LOOP(addr, mask, __BITOPS_AND, __BITOPS_BARRIER);
return (old & ~mask) != 0;
}
@@ -230,8 +236,7 @@ test_and_change_bit(unsigned long nr, vo
unsigned long old, mask;
mask = 1UL << (nr & (BITS_PER_LONG - 1));
- old = __BITOPS_LOOP(addr, mask, __BITOPS_XOR);
- barrier();
+ old = __BITOPS_LOOP(addr, mask, __BITOPS_XOR, __BITOPS_BARRIER);
return (old & mask) != 0;
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 035/158] s390: fix control register update
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 034/158] s390/bitops,atomic: add missing memory barriers Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 036/158] mei: fix memory leak of pending write cb objects Greg Kroah-Hartman
` (124 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin Schwidefsky
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <schwidefsky@de.ibm.com>
commit a8a934e44f2bd0ed613e1aa0471e3478c6a9228a upstream.
The git commit c63badebfebacdba827ab1cc1d420fc81bd8d818
"s390: optimize control register update" broke the update for
control register 0. After the update do the lctlg from the correct
value.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/ptrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -64,7 +64,7 @@ void update_cr_regs(struct task_struct *
if (task->thread.per_flags & PER_FLAG_NO_TE)
cr_new &= ~(1UL << 55);
if (cr_new != cr)
- __ctl_load(cr, 0, 0);
+ __ctl_load(cr_new, 0, 0);
/* Set or clear transaction execution TDC bits 62 and 63. */
__ctl_store(cr, 2, 2);
cr_new = cr & ~3UL;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 036/158] mei: fix memory leak of pending write cb objects
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 035/158] s390: fix control register update Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 037/158] mei: me: do not load the driver if the FW doesnt support MEI interface Greg Kroah-Hartman
` (123 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tomas Winkler, Alexander Usyskin
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Winkler <tomas.winkler@intel.com>
commit cc99ecfdac01215594c73907726b12f251c21e20 upstream.
Write callbacks are released on the write completed path but
when file handler is closed before the writes are
completed those are left dangling on write and write_waiting queues.
We add mei_io_list_free function to perform this task
Also move static functions to client.c form client.h
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/mei/client.c | 76 +++++++++++++++++++++++++++++++++-------------
drivers/misc/mei/client.h | 18 ----------
2 files changed, 55 insertions(+), 39 deletions(-)
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -74,23 +74,69 @@ int mei_me_cl_by_id(struct mei_device *d
/**
- * mei_io_list_flush - removes list entry belonging to cl.
+ * mei_cl_cmp_id - tells if the clients are the same
*
- * @list: An instance of our list structure
- * @cl: host client
+ * @cl1: host client 1
+ * @cl2: host client 2
+ *
+ * returns true - if the clients has same host and me ids
+ * false - otherwise
+ */
+static inline bool mei_cl_cmp_id(const struct mei_cl *cl1,
+ const struct mei_cl *cl2)
+{
+ return cl1 && cl2 &&
+ (cl1->host_client_id == cl2->host_client_id) &&
+ (cl1->me_client_id == cl2->me_client_id);
+}
+
+/**
+ * mei_io_list_flush - removes cbs belonging to cl.
+ *
+ * @list: an instance of our list structure
+ * @cl: host client, can be NULL for flushing the whole list
+ * @free: whether to free the cbs
*/
-void mei_io_list_flush(struct mei_cl_cb *list, struct mei_cl *cl)
+static void __mei_io_list_flush(struct mei_cl_cb *list,
+ struct mei_cl *cl, bool free)
{
struct mei_cl_cb *cb;
struct mei_cl_cb *next;
+ /* enable removing everything if no cl is specified */
list_for_each_entry_safe(cb, next, &list->list, list) {
- if (cb->cl && mei_cl_cmp_id(cl, cb->cl))
+ if (!cl || (cb->cl && mei_cl_cmp_id(cl, cb->cl))) {
list_del(&cb->list);
+ if (free)
+ mei_io_cb_free(cb);
+ }
}
}
/**
+ * mei_io_list_flush - removes list entry belonging to cl.
+ *
+ * @list: An instance of our list structure
+ * @cl: host client
+ */
+static inline void mei_io_list_flush(struct mei_cl_cb *list, struct mei_cl *cl)
+{
+ __mei_io_list_flush(list, cl, false);
+}
+
+
+/**
+ * mei_io_list_free - removes cb belonging to cl and free them
+ *
+ * @list: An instance of our list structure
+ * @cl: host client
+ */
+static inline void mei_io_list_free(struct mei_cl_cb *list, struct mei_cl *cl)
+{
+ __mei_io_list_flush(list, cl, true);
+}
+
+/**
* mei_io_cb_free - free mei_cb_private related memory
*
* @cb: mei callback struct
@@ -196,8 +242,8 @@ int mei_cl_flush_queues(struct mei_cl *c
cl_dbg(dev, cl, "remove list entry belonging to cl\n");
mei_io_list_flush(&cl->dev->read_list, cl);
- mei_io_list_flush(&cl->dev->write_list, cl);
- mei_io_list_flush(&cl->dev->write_waiting_list, cl);
+ mei_io_list_free(&cl->dev->write_list, cl);
+ mei_io_list_free(&cl->dev->write_waiting_list, cl);
mei_io_list_flush(&cl->dev->ctrl_wr_list, cl);
mei_io_list_flush(&cl->dev->ctrl_rd_list, cl);
mei_io_list_flush(&cl->dev->amthif_cmd_list, cl);
@@ -942,20 +988,8 @@ void mei_cl_all_wakeup(struct mei_device
*/
void mei_cl_all_write_clear(struct mei_device *dev)
{
- struct mei_cl_cb *cb, *next;
- struct list_head *list;
-
- list = &dev->write_list.list;
- list_for_each_entry_safe(cb, next, list, list) {
- list_del(&cb->list);
- mei_io_cb_free(cb);
- }
-
- list = &dev->write_waiting_list.list;
- list_for_each_entry_safe(cb, next, list, list) {
- list_del(&cb->list);
- mei_io_cb_free(cb);
- }
+ mei_io_list_free(&dev->write_list, NULL);
+ mei_io_list_free(&dev->write_waiting_list, NULL);
}
--- a/drivers/misc/mei/client.h
+++ b/drivers/misc/mei/client.h
@@ -45,8 +45,6 @@ static inline void mei_io_list_init(stru
{
INIT_LIST_HEAD(&list->list);
}
-void mei_io_list_flush(struct mei_cl_cb *list, struct mei_cl *cl);
-
/*
* MEI Host Client Functions
*/
@@ -61,22 +59,6 @@ int mei_cl_unlink(struct mei_cl *cl);
int mei_cl_flush_queues(struct mei_cl *cl);
struct mei_cl_cb *mei_cl_find_read_cb(struct mei_cl *cl);
-/**
- * mei_cl_cmp_id - tells if file private data have same id
- *
- * @fe1: private data of 1. file object
- * @fe2: private data of 2. file object
- *
- * returns true - if ids are the same and not NULL
- */
-static inline bool mei_cl_cmp_id(const struct mei_cl *cl1,
- const struct mei_cl *cl2)
-{
- return cl1 && cl2 &&
- (cl1->host_client_id == cl2->host_client_id) &&
- (cl1->me_client_id == cl2->me_client_id);
-}
-
int mei_cl_flow_ctrl_creds(struct mei_cl *cl);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 037/158] mei: me: do not load the driver if the FW doesnt support MEI interface
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 036/158] mei: fix memory leak of pending write cb objects Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 038/158] mei: ignore client writing state during cb completion Greg Kroah-Hartman
` (122 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tomas Winkler, Nikola Ciprich
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Winkler <tomas.winkler@intel.com>
commit 5e6533a6f52f1a8283b2f818f5828be99a417dd6 upstream.
NM and SPS FW types that may run on ME device on server platforms
do not have valid MEI/HECI interface and driver should not
be bound to it as this might lead to system hung.
In practice not all BIOSes effectively hide such devices from the
OS and in some cases it is not possible.
We determine FW type by examining Host FW status registers in order to
unbind the driver.
In this patch we are adding check for ME on Cougar Point, Lynx Point
Devices
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Tested-by: Nikola Ciprich <nikola.ciprich@linuxbox.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/mei/hw-me-regs.h | 5 +++++
drivers/misc/mei/pci-me.c | 30 +++++++++++++++++++++++-------
2 files changed, 28 insertions(+), 7 deletions(-)
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -115,6 +115,11 @@
#define MEI_DEV_ID_LPT_HR 0x8CBA /* Lynx Point H Refresh */
#define MEI_DEV_ID_WPT_LP 0x9CBA /* Wildcat Point LP */
+
+/* Host Firmware Status Registers in PCI Config Space */
+#define PCI_CFG_HFS_1 0x40
+#define PCI_CFG_HFS_2 0x48
+
/*
* MEI HW Section
*/
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -100,15 +100,31 @@ static bool mei_me_quirk_probe(struct pc
const struct pci_device_id *ent)
{
u32 reg;
- if (ent->device == MEI_DEV_ID_PBG_1) {
- pci_read_config_dword(pdev, 0x48, ®);
- /* make sure that bit 9 is up and bit 10 is down */
- if ((reg & 0x600) == 0x200) {
- dev_info(&pdev->dev, "Device doesn't have valid ME Interface\n");
- return false;
- }
+ /* Cougar Point || Patsburg */
+ if (ent->device == MEI_DEV_ID_CPT_1 ||
+ ent->device == MEI_DEV_ID_PBG_1) {
+ pci_read_config_dword(pdev, PCI_CFG_HFS_2, ®);
+ /* make sure that bit 9 (NM) is up and bit 10 (DM) is down */
+ if ((reg & 0x600) == 0x200)
+ goto no_mei;
}
+
+ /* Lynx Point */
+ if (ent->device == MEI_DEV_ID_LPT_H ||
+ ent->device == MEI_DEV_ID_LPT_W ||
+ ent->device == MEI_DEV_ID_LPT_HR) {
+ /* Read ME FW Status check for SPS Firmware */
+ pci_read_config_dword(pdev, PCI_CFG_HFS_1, ®);
+ /* if bits [19:16] = 15, running SPS Firmware */
+ if ((reg & 0xf0000) == 0xf0000)
+ goto no_mei;
+ }
+
return true;
+
+no_mei:
+ dev_info(&pdev->dev, "Device doesn't have valid ME Interface\n");
+ return false;
}
/**
* mei_probe - Device Initialization Routine
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 038/158] mei: ignore client writing state during cb completion
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 037/158] mei: me: do not load the driver if the FW doesnt support MEI interface Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 039/158] mfd: sec-core: Fix possible NULL pointer dereference when i2c_new_dummy error Greg Kroah-Hartman
` (121 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexander Usyskin, Tomas Winkler
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <alexander.usyskin@intel.com>
commit 34ec43661fe8f1977dd0f05353302ae2ed10aabb upstream.
Ignore client writing state during cb completion to fix a memory
leak.
When moving cbs to the completion list we should not look at
writing_state as this state can be already overwritten by next
write, the fact that a cb is on the write waiting list means
that it was already written to the HW and we can safely complete it.
Same pays for wait in poll handler, we do not have to check the state
wake is done after completion list processing.
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/mei/interrupt.c | 3 +--
drivers/misc/mei/main.c | 3 +--
2 files changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -428,8 +428,7 @@ int mei_irq_write_handler(struct mei_dev
cl->status = 0;
list_del(&cb->list);
- if (MEI_WRITING == cl->writing_state &&
- cb->fop_type == MEI_FOP_WRITE &&
+ if (cb->fop_type == MEI_FOP_WRITE &&
cl != &dev->iamthif_cl) {
cl_dbg(dev, cl, "MEI WRITE COMPLETE\n");
cl->writing_state = MEI_WRITE_COMPLETE;
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -653,8 +653,7 @@ static unsigned int mei_poll(struct file
goto out;
}
- if (MEI_WRITE_COMPLETE == cl->writing_state)
- mask |= (POLLIN | POLLRDNORM);
+ mask |= (POLLIN | POLLRDNORM);
out:
mutex_unlock(&dev->device_lock);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 039/158] mfd: sec-core: Fix possible NULL pointer dereference when i2c_new_dummy error
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 038/158] mei: ignore client writing state during cb completion Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 040/158] mfd: 88pm860x: Fix possible NULL pointer dereference on " Greg Kroah-Hartman
` (120 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Lee Jones
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit 65aba1e04916d72b30c028730a1e31860c225412 upstream.
During probe the sec-core driver allocates dummy I2C device for RTC with
i2c_new_dummy() but return value is not checked. In case of error
(i2c_new_device(): memory allocation failure or I2C address cannot be
used) this function returns NULL which is later used by
devm_regmap_init_i2c() or i2c_unregister_device().
If i2c_new_dummy() fails for RTC device, fail also the probe for main
MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/sec-core.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/mfd/sec-core.c
+++ b/drivers/mfd/sec-core.c
@@ -252,6 +252,10 @@ static int sec_pmic_probe(struct i2c_cli
}
sec_pmic->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
+ if (!sec_pmic->rtc) {
+ dev_err(&i2c->dev, "Failed to allocate I2C for RTC\n");
+ return -ENODEV;
+ }
i2c_set_clientdata(sec_pmic->rtc, sec_pmic);
sec_pmic->regmap_rtc = devm_regmap_init_i2c(sec_pmic->rtc,
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 040/158] mfd: 88pm860x: Fix possible NULL pointer dereference on i2c_new_dummy error
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 039/158] mfd: sec-core: Fix possible NULL pointer dereference when i2c_new_dummy error Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 041/158] mfd: 88pm860x: Fix I2C device resource leak on regmap init fail Greg Kroah-Hartman
` (119 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Lee Jones
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit 159ce52a6b777fc82fa0b51c7440e25f9e4c6feb upstream.
During probe the driver allocates dummy I2C device for companion chip
with i2c_new_dummy() but it does not check the return value of this call.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by regmap_init_i2c().
If i2c_new_dummy() fails for companion device, fail also the probe for
main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/88pm860x-core.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/mfd/88pm860x-core.c
+++ b/drivers/mfd/88pm860x-core.c
@@ -1179,6 +1179,11 @@ static int pm860x_probe(struct i2c_clien
chip->companion_addr = pdata->companion_addr;
chip->companion = i2c_new_dummy(chip->client->adapter,
chip->companion_addr);
+ if (!chip->companion) {
+ dev_err(&client->dev,
+ "Failed to allocate I2C companion device\n");
+ return -ENODEV;
+ }
chip->regmap_companion = regmap_init_i2c(chip->companion,
&pm860x_regmap_config);
if (IS_ERR(chip->regmap_companion)) {
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 041/158] mfd: 88pm860x: Fix I2C device resource leak on regmap init fail
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 040/158] mfd: 88pm860x: Fix possible NULL pointer dereference on " Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 042/158] mfd: 88pm800: Fix I2C device resource leak if probe fails Greg Kroah-Hartman
` (118 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Lee Jones
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit a7ab1c8b261305af583ce26bb4a14f555fdaa73e upstream.
During probe the driver allocates dummy I2C device for companion chip
and then allocates a regmap for it. If regmap_init_i2c() fails then the
I2C driver (allocated with i2c_new_dummy()) is not freed and this
resource leaks.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/88pm860x-core.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/mfd/88pm860x-core.c
+++ b/drivers/mfd/88pm860x-core.c
@@ -1190,6 +1190,7 @@ static int pm860x_probe(struct i2c_clien
ret = PTR_ERR(chip->regmap_companion);
dev_err(&chip->companion->dev,
"Failed to allocate register map: %d\n", ret);
+ i2c_unregister_device(chip->companion);
return ret;
}
i2c_set_clientdata(chip->companion, chip);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 042/158] mfd: 88pm800: Fix I2C device resource leak if probe fails
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 041/158] mfd: 88pm860x: Fix I2C device resource leak on regmap init fail Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 043/158] mfd: max77686: Fix possible NULL pointer dereference on i2c_new_dummy error Greg Kroah-Hartman
` (117 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Lee Jones
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit 141050cf3d84fc303df58796d68dc1376b0e8f67 upstream.
During probe the driver allocates two dummy I2C devices for subchips in
function pm800_pages_init(). Additionally this function allocates
regmaps for these subchips. If any of these steps fail then these dummy
I2C devices are not freed and resources leak.
On pm800_pages_init() fail the driver must call pm800_pages_exit() to
unregister dummy I2C devices.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/88pm800.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/mfd/88pm800.c
+++ b/drivers/mfd/88pm800.c
@@ -571,7 +571,7 @@ static int pm800_probe(struct i2c_client
ret = pm800_pages_init(chip);
if (ret) {
dev_err(&client->dev, "pm800_pages_init failed!\n");
- goto err_page_init;
+ goto err_device_init;
}
ret = device_800_init(chip, pdata);
@@ -587,7 +587,6 @@ static int pm800_probe(struct i2c_client
err_device_init:
pm800_pages_exit(chip);
-err_page_init:
err_subchip_alloc:
pm80x_deinit();
out_init:
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 043/158] mfd: max77686: Fix possible NULL pointer dereference on i2c_new_dummy error
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 042/158] mfd: 88pm800: Fix I2C device resource leak if probe fails Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 044/158] mfd: max77693: " Greg Kroah-Hartman
` (116 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Lee Jones
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit b9e183a1d495cd65412abe0f9df19b151716bfe7 upstream.
During probe the driver allocates dummy I2C device for RTC with
i2c_new_dummy() but it does not check the return value of this call.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().
If i2c_new_dummy() fails for RTC device, fail also the probe for main
MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/max77686.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/mfd/max77686.c
+++ b/drivers/mfd/max77686.c
@@ -121,6 +121,10 @@ static int max77686_i2c_probe(struct i2c
dev_info(max77686->dev, "device found\n");
max77686->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC);
+ if (!max77686->rtc) {
+ dev_err(max77686->dev, "Failed to allocate I2C device for RTC\n");
+ return -ENODEV;
+ }
i2c_set_clientdata(max77686->rtc, max77686);
max77686_irq_init(max77686);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 044/158] mfd: max77693: Fix possible NULL pointer dereference on i2c_new_dummy error
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 043/158] mfd: max77686: Fix possible NULL pointer dereference on i2c_new_dummy error Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 045/158] mfd: max8925: " Greg Kroah-Hartman
` (115 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Lee Jones
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit ad09dd6a1f5d6244bd89314015af506ba7f9810a upstream.
During probe the driver allocates dummy I2C devices for MUIC and haptic
with i2c_new_dummy() but it does not check the return value of this
calls.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by devm_regmap_init_i2c() and i2c_unregister_device().
If i2c_new_dummy() fails for MUIC or haptic devices, fail also the probe
for main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/max77693.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/mfd/max77693.c
+++ b/drivers/mfd/max77693.c
@@ -148,9 +148,18 @@ static int max77693_i2c_probe(struct i2c
dev_info(max77693->dev, "device ID: 0x%x\n", reg_data);
max77693->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC);
+ if (!max77693->muic) {
+ dev_err(max77693->dev, "Failed to allocate I2C device for MUIC\n");
+ return -ENODEV;
+ }
i2c_set_clientdata(max77693->muic, max77693);
max77693->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC);
+ if (!max77693->haptic) {
+ dev_err(max77693->dev, "Failed to allocate I2C device for Haptic\n");
+ ret = -ENODEV;
+ goto err_i2c_haptic;
+ }
i2c_set_clientdata(max77693->haptic, max77693);
/*
@@ -184,8 +193,9 @@ err_mfd:
max77693_irq_exit(max77693);
err_irq:
err_regmap_muic:
- i2c_unregister_device(max77693->muic);
i2c_unregister_device(max77693->haptic);
+err_i2c_haptic:
+ i2c_unregister_device(max77693->muic);
return ret;
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 045/158] mfd: max8925: Fix possible NULL pointer dereference on i2c_new_dummy error
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 044/158] mfd: max77693: " Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 046/158] mfd: max8998: " Greg Kroah-Hartman
` (114 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Lee Jones
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit 96cf3dedc491d2f1f66cc26217f2b06b0c7b6797 upstream.
During probe the driver allocates dummy I2C devices for RTC and ADC
with i2c_new_dummy() but it does not check the return value of this
calls.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().
If i2c_new_dummy() fails for RTC or ADC devices, fail also the probe
for main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/max8925-i2c.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/mfd/max8925-i2c.c
+++ b/drivers/mfd/max8925-i2c.c
@@ -181,9 +181,18 @@ static int max8925_probe(struct i2c_clie
mutex_init(&chip->io_lock);
chip->rtc = i2c_new_dummy(chip->i2c->adapter, RTC_I2C_ADDR);
+ if (!chip->rtc) {
+ dev_err(chip->dev, "Failed to allocate I2C device for RTC\n");
+ return -ENODEV;
+ }
i2c_set_clientdata(chip->rtc, chip);
chip->adc = i2c_new_dummy(chip->i2c->adapter, ADC_I2C_ADDR);
+ if (!chip->adc) {
+ dev_err(chip->dev, "Failed to allocate I2C device for ADC\n");
+ i2c_unregister_device(chip->rtc);
+ return -ENODEV;
+ }
i2c_set_clientdata(chip->adc, chip);
device_init_wakeup(&client->dev, 1);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 046/158] mfd: max8998: Fix possible NULL pointer dereference on i2c_new_dummy error
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 045/158] mfd: max8925: " Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 047/158] mfd: max8997: " Greg Kroah-Hartman
` (113 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Lee Jones
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit ed26f87b9f71693a1d1ee85f5e6209601505080f upstream.
During probe the driver allocates dummy I2C device for RTC with i2c_new_dummy() but it does not check the return value of this call.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().
If i2c_new_dummy() fails for RTC device, fail also the probe for
main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/max8998.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/mfd/max8998.c
+++ b/drivers/mfd/max8998.c
@@ -215,6 +215,10 @@ static int max8998_i2c_probe(struct i2c_
mutex_init(&max8998->iolock);
max8998->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
+ if (!max8998->rtc) {
+ dev_err(&i2c->dev, "Failed to allocate I2C device for RTC\n");
+ return -ENODEV;
+ }
i2c_set_clientdata(max8998->rtc, max8998);
max8998_irq_init(max8998);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 047/158] mfd: max8997: Fix possible NULL pointer dereference on i2c_new_dummy error
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 046/158] mfd: max8998: " Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 048/158] mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail Greg Kroah-Hartman
` (112 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Lee Jones
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit 97dc4ed3fa377ec91bb60ba98b70d645c2099384 upstream.
During probe the driver allocates dummy I2C devices for RTC, haptic and
MUIC with i2c_new_dummy() but it does not check the return value of this
calls.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().
If i2c_new_dummy() fails for RTC, haptic or MUIC devices, fail also the
probe for main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/max8997.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
--- a/drivers/mfd/max8997.c
+++ b/drivers/mfd/max8997.c
@@ -208,10 +208,26 @@ static int max8997_i2c_probe(struct i2c_
mutex_init(&max8997->iolock);
max8997->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC);
+ if (!max8997->rtc) {
+ dev_err(max8997->dev, "Failed to allocate I2C device for RTC\n");
+ return -ENODEV;
+ }
i2c_set_clientdata(max8997->rtc, max8997);
+
max8997->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC);
+ if (!max8997->haptic) {
+ dev_err(max8997->dev, "Failed to allocate I2C device for Haptic\n");
+ ret = -ENODEV;
+ goto err_i2c_haptic;
+ }
i2c_set_clientdata(max8997->haptic, max8997);
+
max8997->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC);
+ if (!max8997->muic) {
+ dev_err(max8997->dev, "Failed to allocate I2C device for MUIC\n");
+ ret = -ENODEV;
+ goto err_i2c_muic;
+ }
i2c_set_clientdata(max8997->muic, max8997);
pm_runtime_set_active(max8997->dev);
@@ -239,7 +255,9 @@ static int max8997_i2c_probe(struct i2c_
err_mfd:
mfd_remove_devices(max8997->dev);
i2c_unregister_device(max8997->muic);
+err_i2c_muic:
i2c_unregister_device(max8997->haptic);
+err_i2c_haptic:
i2c_unregister_device(max8997->rtc);
return ret;
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 048/158] mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 047/158] mfd: max8997: " Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 049/158] mfd: kempld-core: Fix potential hang-up during boot Greg Kroah-Hartman
` (111 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Lee Jones
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit 483e2dfdbc94751430e41db9973985f5b054d322 upstream.
Fixes: 4aab3fadad32 ("mfd: tps65910: Move interrupt implementation code to mfd file")
tps65910_irq_init() sets 'tps65910->chip_irq' before calling
regmap_add_irq_chip(). If the regmap_add_irq_chip() call fails in
memory allocation of regmap_irq_chip_data members then:
1. The 'tps65910->chip_irq' will still hold some value
2. 'tps65910->irq_data' will be pointing to already freed memory
(because regmap_add_irq_chip() will free it on error)
This results in invalid memory access during driver remove because the
tps65910_irq_exit() tests whether 'tps65910->chip_irq' is not zero.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/tps65910.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/mfd/tps65910.c
+++ b/drivers/mfd/tps65910.c
@@ -255,8 +255,10 @@ static int tps65910_irq_init(struct tps6
ret = regmap_add_irq_chip(tps65910->regmap, tps65910->chip_irq,
IRQF_ONESHOT, pdata->irq_base,
tps6591x_irqs_chip, &tps65910->irq_data);
- if (ret < 0)
+ if (ret < 0) {
dev_warn(tps65910->dev, "Failed to add irq_chip %d\n", ret);
+ tps65910->chip_irq = 0;
+ }
return ret;
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 049/158] mfd: kempld-core: Fix potential hang-up during boot
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 048/158] mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 050/158] mfd: twl-core: Fix accessibility of some twl4030 audio registers Greg Kroah-Hartman
` (110 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Brunner, Guenter Roeck, Lee Jones
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
commit 204747c970c0d568721c76ab8a57dde0e5dcf0d5 upstream.
On PXT and COMe-cPC2 boards it is observed that the hardware
mutex is acquired but not being released during initialization.
This can result in a hang-up during boot if the driver is built
into the kernel.
Releasing the mutex twice if it was acquired fixes the problem.
Subsequent request/release cycles work as expected, so the fix is
only needed during initialization.
Reviewed-by: Michael Brunner <michael.brunner@kontron.com>
Tested-by: Michael Brunner <michael.brunner@kontron.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/kempld-core.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/mfd/kempld-core.c
+++ b/drivers/mfd/kempld-core.c
@@ -322,9 +322,12 @@ static int kempld_detect_device(struct k
return -ENODEV;
}
- /* Release hardware mutex if aquired */
- if (!(index_reg & KEMPLD_MUTEX_KEY))
+ /* Release hardware mutex if acquired */
+ if (!(index_reg & KEMPLD_MUTEX_KEY)) {
iowrite8(KEMPLD_MUTEX_KEY, pld->io_index);
+ /* PXT and COMe-cPC2 boards may require a second release */
+ iowrite8(KEMPLD_MUTEX_KEY, pld->io_index);
+ }
mutex_unlock(&pld->lock);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 050/158] mfd: twl-core: Fix accessibility of some twl4030 audio registers
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 049/158] mfd: kempld-core: Fix potential hang-up during boot Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 051/158] w1: fix w1_send_slave dropping a slave id Greg Kroah-Hartman
` (109 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tomas Novotny, Lee Jones
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Novotny <tomas@novotny.cz>
commit 56816b700c8c773270f3aaf4c92be53e359a03fd upstream.
There are some unused registers in twl4030 at I2C address 0x49 and function
twl4030_49_nop_reg() is used to check accessibility of that registers. These
registers are written in decimal format but the values are correct in
hexadecimal format. (It can be checked few lines above the patched code -
these registers are marked as unused there.)
As a consequence three registers of audio submodule are treated as
inaccessible (preamplifier carkit right and both handsfree registers).
Signed-off-by: Tomas Novotny <tomas@novotny.cz>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/twl-core.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/mfd/twl-core.c
+++ b/drivers/mfd/twl-core.c
@@ -282,11 +282,11 @@ static struct reg_default twl4030_49_def
static bool twl4030_49_nop_reg(struct device *dev, unsigned int reg)
{
switch (reg) {
- case 0:
- case 3:
- case 40:
- case 41:
- case 42:
+ case 0x00:
+ case 0x03:
+ case 0x40:
+ case 0x41:
+ case 0x42:
return false;
default:
return true;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 051/158] w1: fix w1_send_slave dropping a slave id
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 050/158] mfd: twl-core: Fix accessibility of some twl4030 audio registers Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 052/158] staging:serqt_usb2: Fix sparse warning restricted __le16 degrades to integer Greg Kroah-Hartman
` (108 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Fries, Evgeniy Polyakov
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Fries <David@Fries.net>
commit 6b355b33a64fd6d8ead2b838ec16fb9b551f71e8 upstream.
Previous logic,
if (avail > 8) {
store slave;
return;
}
send data; clear;
The logic error is, if there isn't space send the buffer and clear,
but the slave wasn't added to the now empty buffer loosing that slave
id. It also should have been "if (avail >= 8)" because when it is 8,
there is space.
Instead, if there isn't space send and clear the buffer, then there is
always space for the slave id.
Signed-off-by: David Fries <David@Fries.net>
Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/w1/w1_netlink.c | 27 ++++++++++++++-------------
1 file changed, 14 insertions(+), 13 deletions(-)
--- a/drivers/w1/w1_netlink.c
+++ b/drivers/w1/w1_netlink.c
@@ -54,28 +54,29 @@ static void w1_send_slave(struct w1_mast
struct w1_netlink_msg *hdr = (struct w1_netlink_msg *)(msg + 1);
struct w1_netlink_cmd *cmd = (struct w1_netlink_cmd *)(hdr + 1);
int avail;
+ u64 *data;
/* update kernel slave list */
w1_slave_found(dev, rn);
avail = dev->priv_size - cmd->len;
- if (avail > 8) {
- u64 *data = (void *)(cmd + 1) + cmd->len;
-
- *data = rn;
- cmd->len += 8;
- hdr->len += 8;
- msg->len += 8;
- return;
+ if (avail < 8) {
+ msg->ack++;
+ cn_netlink_send(msg, 0, GFP_KERNEL);
+
+ msg->len = sizeof(struct w1_netlink_msg) +
+ sizeof(struct w1_netlink_cmd);
+ hdr->len = sizeof(struct w1_netlink_cmd);
+ cmd->len = 0;
}
- msg->ack++;
- cn_netlink_send(msg, 0, GFP_KERNEL);
+ data = (void *)(cmd + 1) + cmd->len;
- msg->len = sizeof(struct w1_netlink_msg) + sizeof(struct w1_netlink_cmd);
- hdr->len = sizeof(struct w1_netlink_cmd);
- cmd->len = 0;
+ *data = rn;
+ cmd->len += 8;
+ hdr->len += 8;
+ msg->len += 8;
}
static int w1_process_search_command(struct w1_master *dev, struct cn_msg *msg,
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 052/158] staging:serqt_usb2: Fix sparse warning restricted __le16 degrades to integer
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 051/158] w1: fix w1_send_slave dropping a slave id Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 053/158] staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0 Greg Kroah-Hartman
` (107 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Himangi Saraogi
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Himangi Saraogi <himangi774@gmail.com>
commit abe5d64d1a74195a44cd14624f8178b9f48b7cc7 upstream.
This patch fixes the following sparse warning :
drivers/staging/serqt_usb2/serqt_usb2.c:727:40: warning: restricted __le16 degrades to integer
Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/serqt_usb2/serqt_usb2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/serqt_usb2/serqt_usb2.c
+++ b/drivers/staging/serqt_usb2/serqt_usb2.c
@@ -724,7 +724,7 @@ static int qt_startup(struct usb_serial
goto startup_error;
}
- switch (serial->dev->descriptor.idProduct) {
+ switch (le16_to_cpu(serial->dev->descriptor.idProduct)) {
case QUATECH_DSU100:
case QUATECH_QSU100:
case QUATECH_ESU100A:
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 053/158] staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 052/158] staging:serqt_usb2: Fix sparse warning restricted __le16 degrades to integer Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 054/158] staging: comedi: usbdux: bug fix for accessing ao_chanlist in private data Greg Kroah-Hartman
` (106 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jes Sorensen, Larry Finger
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <Larry.Finger@lwfinger.net>
commit f764cd68d9036498f08fe8834deb6a367b5c2542 upstream.
Zero-initializing ether_type masked that the ether type would never be
obtained for 8021x packets and the comparison against eapol_type
would always fail.
Reported-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8712/rtl871x_recv.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
--- a/drivers/staging/rtl8712/rtl871x_recv.c
+++ b/drivers/staging/rtl8712/rtl871x_recv.c
@@ -254,7 +254,7 @@ union recv_frame *r8712_portctrl(struct
struct sta_info *psta;
struct sta_priv *pstapriv;
union recv_frame *prtnframe;
- u16 ether_type = 0;
+ u16 ether_type;
pstapriv = &adapter->stapriv;
ptr = get_recvframe_data(precv_frame);
@@ -263,15 +263,14 @@ union recv_frame *r8712_portctrl(struct
psta = r8712_get_stainfo(pstapriv, psta_addr);
auth_alg = adapter->securitypriv.AuthAlgrthm;
if (auth_alg == 2) {
+ /* get ether_type */
+ ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE;
+ memcpy(ðer_type, ptr, 2);
+ ether_type = ntohs((unsigned short)ether_type);
+
if ((psta != NULL) && (psta->ieee8021x_blocked)) {
/* blocked
* only accept EAPOL frame */
- prtnframe = precv_frame;
- /*get ether_type */
- ptr = ptr + pfhdr->attrib.hdrlen +
- pfhdr->attrib.iv_len + LLC_HEADER_SIZE;
- memcpy(ðer_type, ptr, 2);
- ether_type = ntohs((unsigned short)ether_type);
if (ether_type == 0x888e)
prtnframe = precv_frame;
else {
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 054/158] staging: comedi: usbdux: bug fix for accessing ao_chanlist in private data
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 053/158] staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0 Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 055/158] staging: r8188eu: Calling rtw_get_stainfo() with a NULL sta_addr will return NULL Greg Kroah-Hartman
` (105 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, H Hartley Sweeten, Ian Abbott, Bernd Porr
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: H Hartley Sweeten <hsweeten@visionengravers.com>
commit 2704f807f9498054b8153002bafa3e818079e9a5 upstream.
In usbdux_ao_cmd(), the channels for the command are transfered from the
cmd->chanlist and stored in the private data 'ao_chanlist'. The channel
numbers are bit-shifted when stored so that they become the "command"
that is transfered to the device. The channel to command conversion
results in the 'ao_chanlist' having these values for the channels:
channel 0 -> ao_chanlist = 0x00
channel 1 -> ao_chanlist = 0x40
channel 2 -> ao_chanlist = 0x80
channel 3 -> ao_chanlist = 0xc0
The problem is, the usbduxsub_ao_isoc_irq() function uses the 'chan' value
from 'ao_chanlist' to access the 'ao_readback' array in the private data.
So instead of accessing the array as 0, 1, 2, 3, it accesses it as 0x00,
0x40, 0x80, 0xc0.
Fix this by storing the raw channel number in 'ao_chanlist' and doing the
bit-shift when creating the command.
Fixes: a998a3db530bff80 "staging: comedi: usbdux: cleanup the private data 'outBuffer'"
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Acked-by: Bernd Porr <mail@berndporr.me.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/comedi/drivers/usbdux.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
--- a/drivers/staging/comedi/drivers/usbdux.c
+++ b/drivers/staging/comedi/drivers/usbdux.c
@@ -493,7 +493,7 @@ static void usbduxsub_ao_isoc_irq(struct
/* pointer to the DA */
*datap++ = val & 0xff;
*datap++ = (val >> 8) & 0xff;
- *datap++ = chan;
+ *datap++ = chan << 6;
devpriv->ao_readback[chan] = val;
s->async->events |= COMEDI_CB_BLOCK;
@@ -1040,11 +1040,8 @@ static int usbdux_ao_cmd(struct comedi_d
/* set current channel of the running acquisition to zero */
s->async->cur_chan = 0;
- for (i = 0; i < cmd->chanlist_len; ++i) {
- unsigned int chan = CR_CHAN(cmd->chanlist[i]);
-
- devpriv->ao_chanlist[i] = chan << 6;
- }
+ for (i = 0; i < cmd->chanlist_len; ++i)
+ devpriv->ao_chanlist[i] = CR_CHAN(cmd->chanlist[i]);
/* we count in steps of 1ms (125us) */
/* 125us mode not used yet */
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 055/158] staging: r8188eu: Calling rtw_get_stainfo() with a NULL sta_addr will return NULL
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 054/158] staging: comedi: usbdux: bug fix for accessing ao_chanlist in private data Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 056/158] x86, hash: Fix build failure with older binutils Greg Kroah-Hartman
` (104 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jes Sorensen, Larry Finger
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <Larry.Finger@lwfinger.net>
commit 9452bf560273e4de2395ffdd79024debfb0c1290 upstream.
This makes the follow-on check for psta != NULL pointless and makes
the whole exercise rather pointless. This is another case of why
blindly zero-initializing variables when they are declared is bad.
Reported-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8188eu/core/rtw_recv.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/staging/rtl8188eu/core/rtw_recv.c
+++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
@@ -542,7 +542,7 @@ _func_exit_;
/* set the security information in the recv_frame */
static union recv_frame *portctrl(struct adapter *adapter, union recv_frame *precv_frame)
{
- u8 *psta_addr = NULL, *ptr;
+ u8 *psta_addr, *ptr;
uint auth_alg;
struct recv_frame_hdr *pfhdr;
struct sta_info *psta;
@@ -556,7 +556,6 @@ static union recv_frame *portctrl(struct
_func_enter_;
pstapriv = &adapter->stapriv;
- psta = rtw_get_stainfo(pstapriv, psta_addr);
auth_alg = adapter->securitypriv.dot11AuthAlgrthm;
@@ -564,6 +563,7 @@ _func_enter_;
pfhdr = &precv_frame->u.hdr;
pattrib = &pfhdr->attrib;
psta_addr = pattrib->ta;
+ psta = rtw_get_stainfo(pstapriv, psta_addr);
prtnframe = NULL;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 056/158] x86, hash: Fix build failure with older binutils
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 055/158] staging: r8188eu: Calling rtw_get_stainfo() with a NULL sta_addr will return NULL Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 057/158] x86, AVX-512: AVX-512 Feature Detection Greg Kroah-Hartman
` (103 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Beulich, Francesco Fusco,
Thomas Graf, David S. Miller, Daniel Borkmann, H. Peter Anvin
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <JBeulich@suse.com>
commit 06325190bd577e11429444d54f454b9d13f560c9 upstream.
Just like for other ISA extension instruction uses we should check
whether the assembler actually supports them. The fallback here simply
is to encode an instruction with fixed operands (%eax and %ecx).
[ hpa: tagging for -stable as a build fix ]
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Link: http://lkml.kernel.org/r/530F0996020000780011FBE7@nat28.tlf.novell.com
Cc: Francesco Fusco <ffusco@redhat.com>
Cc: Thomas Graf <tgraf@redhat.com>
Cc: David S. Miller <davem@davemloft.net>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/Makefile | 1 +
arch/x86/lib/hash.c | 4 ++++
2 files changed, 5 insertions(+)
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -152,6 +152,7 @@ cfi-sections := $(call as-instr,.cfi_sec
# does binutils support specific instructions?
asinstr := $(call as-instr,fxsaveq (%rax),-DCONFIG_AS_FXSAVEQ=1)
+asinstr += $(call as-instr,crc32l %eax$(comma)%eax,-DCONFIG_AS_CRC32=1)
avx_instr := $(call as-instr,vxorps %ymm0$(comma)%ymm1$(comma)%ymm2,-DCONFIG_AS_AVX=1)
avx2_instr :=$(call as-instr,vpbroadcastb %xmm0$(comma)%ymm1,-DCONFIG_AS_AVX2=1)
--- a/arch/x86/lib/hash.c
+++ b/arch/x86/lib/hash.c
@@ -39,7 +39,11 @@
static inline u32 crc32_u32(u32 crc, u32 val)
{
+#ifdef CONFIG_AS_CRC32
asm ("crc32l %1,%0\n" : "+r" (crc) : "rm" (val));
+#else
+ asm (".byte 0xf2, 0x0f, 0x38, 0xf1, 0xc1" : "+a" (crc) : "c" (val));
+#endif
return crc;
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 057/158] x86, AVX-512: AVX-512 Feature Detection
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 056/158] x86, hash: Fix build failure with older binutils Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 058/158] x86, AVX-512: Enable AVX-512 States Context Switch Greg Kroah-Hartman
` (102 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Fenghua Yu, H. Peter Anvin
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fenghua Yu <fenghua.yu@intel.com>
commit 8e5780fdeef7dc490b3f0b3a62704593721fa4f3 upstream.
AVX-512 is an extention of AVX2. Its spec can be found at:
http://download-software.intel.com/sites/default/files/managed/71/2e/319433-017.pdf
This patch detects AVX-512 features by CPUID.
Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
Link: http://lkml.kernel.org/r/1392931491-33237-1-git-send-email-fenghua.yu@intel.com
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/cpufeature.h | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -217,9 +217,13 @@
#define X86_FEATURE_INVPCID (9*32+10) /* Invalidate Processor Context ID */
#define X86_FEATURE_RTM (9*32+11) /* Restricted Transactional Memory */
#define X86_FEATURE_MPX (9*32+14) /* Memory Protection Extension */
+#define X86_FEATURE_AVX512F (9*32+16) /* AVX-512 Foundation */
#define X86_FEATURE_RDSEED (9*32+18) /* The RDSEED instruction */
#define X86_FEATURE_ADX (9*32+19) /* The ADCX and ADOX instructions */
#define X86_FEATURE_SMAP (9*32+20) /* Supervisor Mode Access Prevention */
+#define X86_FEATURE_AVX512PF (9*32+26) /* AVX-512 Prefetch */
+#define X86_FEATURE_AVX512ER (9*32+27) /* AVX-512 Exponential and Reciprocal */
+#define X86_FEATURE_AVX512CD (9*32+28) /* AVX-512 Conflict Detection */
/*
* BUG word(s)
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 058/158] x86, AVX-512: Enable AVX-512 States Context Switch
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 057/158] x86, AVX-512: AVX-512 Feature Detection Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 059/158] ftrace/x86: One more missing sync after fixup of function modification failure Greg Kroah-Hartman
` (101 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Fenghua Yu, H. Peter Anvin
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fenghua Yu <fenghua.yu@intel.com>
commit c2bc11f10a39527cd1bb252097b5525664560956 upstream.
This patch enables Opmask, ZMM_Hi256, and Hi16_ZMM AVX-512 states for
xstate context switch.
Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
Link: http://lkml.kernel.org/r/1392931491-33237-2-git-send-email-fenghua.yu@intel.com
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/xsave.h | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/arch/x86/include/asm/xsave.h
+++ b/arch/x86/include/asm/xsave.h
@@ -6,11 +6,14 @@
#define XSTATE_CPUID 0x0000000d
-#define XSTATE_FP 0x1
-#define XSTATE_SSE 0x2
-#define XSTATE_YMM 0x4
-#define XSTATE_BNDREGS 0x8
-#define XSTATE_BNDCSR 0x10
+#define XSTATE_FP 0x1
+#define XSTATE_SSE 0x2
+#define XSTATE_YMM 0x4
+#define XSTATE_BNDREGS 0x8
+#define XSTATE_BNDCSR 0x10
+#define XSTATE_OPMASK 0x20
+#define XSTATE_ZMM_Hi256 0x40
+#define XSTATE_Hi16_ZMM 0x80
#define XSTATE_FPSSE (XSTATE_FP | XSTATE_SSE)
@@ -23,7 +26,8 @@
#define XSAVE_YMM_OFFSET (XSAVE_HDR_SIZE + XSAVE_HDR_OFFSET)
/* Supported features which support lazy state saving */
-#define XSTATE_LAZY (XSTATE_FP | XSTATE_SSE | XSTATE_YMM)
+#define XSTATE_LAZY (XSTATE_FP | XSTATE_SSE | XSTATE_YMM \
+ | XSTATE_OPMASK | XSTATE_ZMM_Hi256 | XSTATE_Hi16_ZMM)
/* Supported features which require eager state saving */
#define XSTATE_EAGER (XSTATE_BNDREGS | XSTATE_BNDCSR)
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 059/158] ftrace/x86: One more missing sync after fixup of function modification failure
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 058/158] x86, AVX-512: Enable AVX-512 States Context Switch Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 060/158] x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels Greg Kroah-Hartman
` (100 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Frederic Weisbecker, H. Peter Anvin,
Petr Mladek, Steven Rostedt
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Mladek <pmladek@suse.cz>
commit 12729f14d8357fb845d75155228b21e76360272d upstream.
If a failure occurs while modifying ftrace function, it bails out and will
remove the tracepoints to be back to what the code originally was.
There is missing the final sync run across the CPUs after the fix up is done
and before the ftrace int3 handler flag is reset.
Here's the description of the problem:
CPU0 CPU1
---- ----
remove_breakpoint();
modifying_ftrace_code = 0;
[still sees breakpoint]
<takes trap>
[sees modifying_ftrace_code as zero]
[no breakpoint handler]
[goto failed case]
[trap exception - kernel breakpoint, no
handler]
BUG()
Link: http://lkml.kernel.org/r/1393258342-29978-2-git-send-email-pmladek@suse.cz
Fixes: 8a4d0a687a5 "ftrace: Use breakpoint method to update ftrace caller"
Acked-by: Frederic Weisbecker <fweisbec@gmail.com>
Acked-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Petr Mladek <pmladek@suse.cz>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/ftrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -659,8 +659,8 @@ ftrace_modify_code(unsigned long ip, uns
ret = -EPERM;
goto out;
}
- run_sync();
out:
+ run_sync();
return ret;
fail_update:
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 060/158] x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 059/158] ftrace/x86: One more missing sync after fixup of function modification failure Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 061/158] regulator: arizona-ldo1: Correct default regulator init_data Greg Kroah-Hartman
` (99 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Linus Torvalds, H. Peter Anvin
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "H. Peter Anvin" <hpa@linux.intel.com>
commit b3b42ac2cbae1f3cecbb6229964a4d48af31d382 upstream.
The IRET instruction, when returning to a 16-bit segment, only
restores the bottom 16 bits of the user space stack pointer. We have
a software workaround for that ("espfix") for the 32-bit kernel, but
it relies on a nonzero stack segment base which is not available in
32-bit mode.
Since 16-bit support is somewhat crippled anyway on a 64-bit kernel
(no V86 mode), and most (if not quite all) 64-bit processors support
virtualization for the users who really need it, simply reject
attempts at creating a 16-bit segment when running on top of a 64-bit
kernel.
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/n/tip-kicdm89kzw9lldryb1br9od0@git.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/ldt.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -229,6 +229,17 @@ static int write_ldt(void __user *ptr, u
}
}
+ /*
+ * On x86-64 we do not support 16-bit segments due to
+ * IRET leaking the high bits of the kernel stack address.
+ */
+#ifdef CONFIG_X86_64
+ if (!ldt_info.seg_32bit) {
+ error = -EINVAL;
+ goto out_unlock;
+ }
+#endif
+
fill_ldt(&ldt, &ldt_info);
if (oldmode)
ldt.avl = 0;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 061/158] regulator: arizona-ldo1: Correct default regulator init_data
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 060/158] x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 062/158] PCI: imx6: Wait for retraining Greg Kroah-Hartman
` (98 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Charles Keepax, Mark Brown
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
commit a35ff2861690eaf9dbb38fa744a8a9e6f4ebfd61 upstream.
Both 5102 and 8997 have the regulator capable of supplying 1.8V, and the
voltage step from the 5110 regulator is different from what is specified
in the default description. This patch updates the default regulator
description to match 5110 and selects the 1.8V capable description for
8997.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/arizona-ldo1.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/regulator/arizona-ldo1.c
+++ b/drivers/regulator/arizona-ldo1.c
@@ -153,11 +153,9 @@ static const struct regulator_desc arizo
.vsel_reg = ARIZONA_LDO1_CONTROL_1,
.vsel_mask = ARIZONA_LDO1_VSEL_MASK,
- .bypass_reg = ARIZONA_LDO1_CONTROL_1,
- .bypass_mask = ARIZONA_LDO1_BYPASS,
.min_uV = 900000,
- .uV_step = 50000,
- .n_voltages = 7,
+ .uV_step = 25000,
+ .n_voltages = 13,
.enable_time = 500,
.owner = THIS_MODULE,
@@ -203,6 +201,7 @@ static int arizona_ldo1_probe(struct pla
*/
switch (arizona->type) {
case WM5102:
+ case WM8997:
desc = &arizona_ldo1_hc;
ldo1->init_data = arizona_ldo1_dvfs;
break;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 062/158] PCI: imx6: Wait for retraining
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 061/158] regulator: arizona-ldo1: Correct default regulator init_data Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 063/158] PCI: mvebu: Fix potential issue in range parsing Greg Kroah-Hartman
` (97 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Troy Kisky, Sascha Hauer,
Marek Vasut, Bjorn Helgaas, Shawn Guo
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marex@denx.de>
commit f95d3ae771916c8c7024fecfb6c420e5dfeced05 upstream.
This patch handles the case where the PCIe link is up and running, yet
drops into the LTSSM training mode. The link spends short time in the LTSSM
training mode, but the current code can misinterpret it as the link being
stalled. Waiting for the LTSSM training to complete fixes the issue.
Quoting Sascha:
This is broken since commit 7f9f40c01cce ('PCI: imx6: Report "link up"
only after link training completes').
The designware driver changes the PORT_LOGIC_SPEED_CHANGE bit in
dw_pcie_host_init() which causes the link to be retrained. During the
next call to dw_pcie_rd_conf() the link is then reported being down and
the function returns PCIBIOS_DEVICE_NOT_FOUND resulting in nonfunctioning
PCIe.
Fixes: 7f9f40c01cce (PCI: imx6: Report "link up" only after link training completes)
Tested-by: Troy Kisky <troy.kisky@boundarydevices.com>
Tested-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Marek Vasut <marex@denx.de>
Signed-off-by: Troy Kisky <troy.kisky@boundarydevices.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/host/pci-imx6.c | 47 +++++++++++++++++++++++++++++++-------------
1 file changed, 34 insertions(+), 13 deletions(-)
--- a/drivers/pci/host/pci-imx6.c
+++ b/drivers/pci/host/pci-imx6.c
@@ -424,20 +424,40 @@ static void imx6_pcie_reset_phy(struct p
static int imx6_pcie_link_up(struct pcie_port *pp)
{
- u32 rc, ltssm, rx_valid;
+ u32 rc, debug_r0, rx_valid;
+ int count = 5;
/*
- * Test if the PHY reports that the link is up and also that
- * the link training finished. It might happen that the PHY
- * reports the link is already up, but the link training bit
- * is still set, so make sure to check the training is done
- * as well here.
+ * Test if the PHY reports that the link is up and also that the LTSSM
+ * training finished. There are three possible states of the link when
+ * this code is called:
+ * 1) The link is DOWN (unlikely)
+ * The link didn't come up yet for some reason. This usually means
+ * we have a real problem somewhere. Reset the PHY and exit. This
+ * state calls for inspection of the DEBUG registers.
+ * 2) The link is UP, but still in LTSSM training
+ * Wait for the training to finish, which should take a very short
+ * time. If the training does not finish, we have a problem and we
+ * need to inspect the DEBUG registers. If the training does finish,
+ * the link is up and operating correctly.
+ * 3) The link is UP and no longer in LTSSM training
+ * The link is up and operating correctly.
*/
- rc = readl(pp->dbi_base + PCIE_PHY_DEBUG_R1);
- if ((rc & PCIE_PHY_DEBUG_R1_XMLH_LINK_UP) &&
- !(rc & PCIE_PHY_DEBUG_R1_XMLH_LINK_IN_TRAINING))
- return 1;
-
+ while (1) {
+ rc = readl(pp->dbi_base + PCIE_PHY_DEBUG_R1);
+ if (!(rc & PCIE_PHY_DEBUG_R1_XMLH_LINK_UP))
+ break;
+ if (!(rc & PCIE_PHY_DEBUG_R1_XMLH_LINK_IN_TRAINING))
+ return 1;
+ if (!count--)
+ break;
+ dev_dbg(pp->dev, "Link is up, but still in training\n");
+ /*
+ * Wait a little bit, then re-check if the link finished
+ * the training.
+ */
+ usleep_range(1000, 2000);
+ }
/*
* From L0, initiate MAC entry to gen2 if EP/RC supports gen2.
* Wait 2ms (LTSSM timeout is 24ms, PHY lock is ~5us in gen2).
@@ -446,15 +466,16 @@ static int imx6_pcie_link_up(struct pcie
* to gen2 is stuck
*/
pcie_phy_read(pp->dbi_base, PCIE_PHY_RX_ASIC_OUT, &rx_valid);
- ltssm = readl(pp->dbi_base + PCIE_PHY_DEBUG_R0) & 0x3F;
+ debug_r0 = readl(pp->dbi_base + PCIE_PHY_DEBUG_R0);
if (rx_valid & 0x01)
return 0;
- if (ltssm != 0x0d)
+ if ((debug_r0 & 0x3f) != 0x0d)
return 0;
dev_err(pp->dev, "transition to gen2 is stuck, reset PHY!\n");
+ dev_dbg(pp->dev, "debug_r0=%08x debug_r1=%08x\n", debug_r0, rc);
imx6_pcie_reset_phy(pp);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 063/158] PCI: mvebu: Fix potential issue in range parsing
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 062/158] PCI: imx6: Wait for retraining Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 064/158] USB: fix crash during hotplug of PCI USB controller card Greg Kroah-Hartman
` (96 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Petazzoni,
Jean-Jacques Hiblot, Bjorn Helgaas, Jason Cooper
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
commit 4f4bde1df33bde076f53325bdf2c6430cf85e1bb upstream.
The second parameter of of_read_number() is not the index, but a size. As
it happens, in this case it may work just fine because of the conversion to
u32 and the favorable endianness on this architecture.
Fixes: 11be65472a427 ("PCI: mvebu: Adapt to the new device tree layout")
Tested-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Acked-by: Jason Cooper <jason@lakedaemon.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/host/pci-mvebu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -797,7 +797,7 @@ static int mvebu_get_tgt_attr(struct dev
for (i = 0; i < nranges; i++) {
u32 flags = of_read_number(range, 1);
- u32 slot = of_read_number(range, 2);
+ u32 slot = of_read_number(range + 1, 1);
u64 cpuaddr = of_read_number(range + na, pna);
unsigned long rtype;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 064/158] USB: fix crash during hotplug of PCI USB controller card
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 063/158] PCI: mvebu: Fix potential issue in range parsing Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 065/158] iio: querying buffer scan_mask should return 0/1 Greg Kroah-Hartman
` (95 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alan Stern, Stefani Seibold
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit a2ff864b53eac9a0e9b05bfe9d1781ccd6c2af71 upstream.
The code in hcd-pci.c that matches up EHCI controllers with their
companion UHCI or OHCI controllers assumes that the private drvdata
fields don't get set too early. However, it turns out that this field
gets set by usb_create_hcd(), before hcd-pci expects it, and this can
result in a crash when two controllers are probed in parallel (as can
happen when a new controller card is hotplugged).
The companions_rwsem lock was supposed to prevent this sort of thing,
but usb_create_hcd() is called outside the scope of the rwsem.
A simple solution is to check that the root-hub pointer has been
initialized as well as the drvdata field. This doesn't happen until
usb_add_hcd() is called; that call and the check are both protected by
the rwsem.
This patch should be applied to stable kernels from 3.10 onward.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Stefani Seibold <stefani@seibold.net>
Tested-by: Stefani Seibold <stefani@seibold.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hcd-pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -75,7 +75,7 @@ static void for_each_companion(struct pc
PCI_SLOT(companion->devfn) != slot)
continue;
companion_hcd = pci_get_drvdata(companion);
- if (!companion_hcd)
+ if (!companion_hcd || !companion_hcd->self.root_hub)
continue;
fn(pdev, hcd, companion, companion_hcd);
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 065/158] iio: querying buffer scan_mask should return 0/1
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 064/158] USB: fix crash during hotplug of PCI USB controller card Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 066/158] iio: adc: at91_adc: Repair broken platform_data support Greg Kroah-Hartman
` (94 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alec Berg, Jonathan Cameron
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alec Berg <alecaberg@chromium.org>
commit 2076a20fc1a06f7b0333c62a2bb4eeeac7ed1bcb upstream.
Ensure that querying the IIO buffer scan_mask returns a value of
0 or 1. Currently querying the scan mask has the value returned
by test_bit(), which returns either true or false. For some
architectures test_bit() may return -1 for true, which will appear
to return an error when returning from iio_scan_mask_query().
Additionally, it's important for the sysfs interface to consistently
return the same thing when querying the scan_mask.
Signed-off-by: Alec Berg <alecaberg@chromium.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-buffer.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -165,7 +165,8 @@ static ssize_t iio_scan_el_show(struct d
int ret;
struct iio_dev *indio_dev = dev_to_iio_dev(dev);
- ret = test_bit(to_iio_dev_attr(attr)->address,
+ /* Ensure ret is 0 or 1. */
+ ret = !!test_bit(to_iio_dev_attr(attr)->address,
indio_dev->buffer->scan_mask);
return sprintf(buf, "%d\n", ret);
@@ -866,7 +867,8 @@ int iio_scan_mask_query(struct iio_dev *
if (!buffer->scan_mask)
return 0;
- return test_bit(bit, buffer->scan_mask);
+ /* Ensure return value is 0 or 1. */
+ return !!test_bit(bit, buffer->scan_mask);
};
EXPORT_SYMBOL_GPL(iio_scan_mask_query);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 066/158] iio: adc: at91_adc: Repair broken platform_data support
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 065/158] iio: querying buffer scan_mask should return 0/1 Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 067/158] iio: cm32181: Fix read integration time function Greg Kroah-Hartman
` (93 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexandre Belloni, Josh Wu, Jonathan Cameron
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
commit 467a44b0372d8268ce5bd90e58bde7db51c1d476 upstream.
Trying to use the at91_adc driver while not using device tree is ending up in a
kernel crash:
Unable to handle kernel NULL pointer dereference at virtual address 00000004
[...]
[<c01f3510>] (at91_adc_probe) from [<c0183828>] (platform_drv_probe+0x18/0x48)
[<c0183828>] (platform_drv_probe) from [<c01824a4>] (driver_probe_device+0x100/0x218)
[<c01824a4>] (driver_probe_device) from [<c0182648>] (__driver_attach+0x8c/0x90)
[<c0182648>] (__driver_attach) from [<c0180de4>] (bus_for_each_dev+0x58/0x88)
[<c0180de4>] (bus_for_each_dev) from [<c0181c7c>] (bus_add_driver+0xd4/0x1d4)
[<c0181c7c>] (bus_add_driver) from [<c0182c40>] (driver_register+0x78/0xf4)
[<c0182c40>] (driver_register) from [<c0008998>] (do_one_initcall+0xe8/0x14c)
[<c0008998>] (do_one_initcall) from [<c02f0b50>] (kernel_init_freeable+0xec/0x1b4)
[<c02f0b50>] (kernel_init_freeable) from [<c022acdc>] (kernel_init+0x8/0xe4)
[<c022acdc>] (kernel_init) from [<c0009670>] (ret_from_fork+0x14/0x24)
This is because the at91_adc_caps structure is mandatory but is not filled when
using platform_data. Correct that by using an id_table. It ensues that the
driver will not match "at91_adc" anymore but it was crashing anyway.
Fixes: c46016665fff (iio: at91: ADC start-up time calculation changed since at91sam9x5)
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Tested-by: Josh Wu <josh.wu@atmel.com>
Acked-by: Josh Wu <josh.wu@atmel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/at91_adc.c | 26 ++++++++++++++++++++++----
1 file changed, 22 insertions(+), 4 deletions(-)
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -765,14 +765,17 @@ static int at91_adc_probe_pdata(struct a
if (!pdata)
return -EINVAL;
+ st->caps = (struct at91_adc_caps *)
+ platform_get_device_id(pdev)->driver_data;
+
st->use_external = pdata->use_external_triggers;
st->vref_mv = pdata->vref;
st->channels_mask = pdata->channels_used;
- st->num_channels = pdata->num_channels;
+ st->num_channels = st->caps->num_channels;
st->startup_time = pdata->startup_time;
st->trigger_number = pdata->trigger_number;
st->trigger_list = pdata->trigger_list;
- st->registers = pdata->registers;
+ st->registers = &st->caps->registers;
return 0;
}
@@ -1101,7 +1104,6 @@ static int at91_adc_remove(struct platfo
return 0;
}
-#ifdef CONFIG_OF
static struct at91_adc_caps at91sam9260_caps = {
.calc_startup_ticks = calc_startup_ticks_9260,
.num_channels = 4,
@@ -1154,11 +1156,27 @@ static const struct of_device_id at91_ad
{},
};
MODULE_DEVICE_TABLE(of, at91_adc_dt_ids);
-#endif
+
+static const struct platform_device_id at91_adc_ids[] = {
+ {
+ .name = "at91sam9260-adc",
+ .driver_data = (unsigned long)&at91sam9260_caps,
+ }, {
+ .name = "at91sam9g45-adc",
+ .driver_data = (unsigned long)&at91sam9g45_caps,
+ }, {
+ .name = "at91sam9x5-adc",
+ .driver_data = (unsigned long)&at91sam9x5_caps,
+ }, {
+ /* terminator */
+ }
+};
+MODULE_DEVICE_TABLE(platform, at91_adc_ids);
static struct platform_driver at91_adc_driver = {
.probe = at91_adc_probe,
.remove = at91_adc_remove,
+ .id_table = at91_adc_ids,
.driver = {
.name = DRIVER_NAME,
.of_match_table = of_match_ptr(at91_adc_dt_ids),
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 067/158] iio: cm32181: Fix read integration time function
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 066/158] iio: adc: at91_adc: Repair broken platform_data support Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 068/158] iio: cm36651: Fix i2c client leak and possible NULL pointer dereference Greg Kroah-Hartman
` (92 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kevin Tsai, Beomho Seo, Jonathan Cameron
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Beomho Seo <beomho.seo@samsung.com>
commit 41c897f8789d0d1039ed873ddcd0caabd5756e0f upstream.
In read integration time function, assign 0 to val.
Because, prevent return inaccurate value when call read integration time.
Cc: Kevin Tsai <ktsai@capellamicro.com>
Signed-off-by: Beomho Seo <beomho.seo@samsung.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/cm32181.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/iio/light/cm32181.c
+++ b/drivers/iio/light/cm32181.c
@@ -221,6 +221,7 @@ static int cm32181_read_raw(struct iio_d
*val = cm32181->calibscale;
return IIO_VAL_INT;
case IIO_CHAN_INFO_INT_TIME:
+ *val = 0;
ret = cm32181_read_als_it(cm32181, val2);
return ret;
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 068/158] iio: cm36651: Fix i2c client leak and possible NULL pointer dereference
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 067/158] iio: cm32181: Fix read integration time function Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 069/158] NFSv4: Fix a use-after-free problem in open() Greg Kroah-Hartman
` (91 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Beomho Seo,
Jonathan Cameron
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit d0a588a57c2b0748df8307a0865a1bbbf1624c53 upstream.
During probe the driver allocates dummy I2C devices (i2c_new_dummy())
but they aren't unregistered during driver remove or probe failure.
Additionally driver does not check the return value of i2c_new_dummy().
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later
dereferenced by i2c_smbus_{read,write}_data() functions.
Fix issues by properly checking for i2c_new_dummy() return value and
unregistering I2C devices on driver remove or probe failure.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Acked-by: Beomho Seo <beomho.seo@samsung.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/cm36651.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
--- a/drivers/iio/light/cm36651.c
+++ b/drivers/iio/light/cm36651.c
@@ -652,7 +652,19 @@ static int cm36651_probe(struct i2c_clie
cm36651->client = client;
cm36651->ps_client = i2c_new_dummy(client->adapter,
CM36651_I2C_ADDR_PS);
+ if (!cm36651->ps_client) {
+ dev_err(&client->dev, "%s: new i2c device failed\n", __func__);
+ ret = -ENODEV;
+ goto error_disable_reg;
+ }
+
cm36651->ara_client = i2c_new_dummy(client->adapter, CM36651_ARA);
+ if (!cm36651->ara_client) {
+ dev_err(&client->dev, "%s: new i2c device failed\n", __func__);
+ ret = -ENODEV;
+ goto error_i2c_unregister_ps;
+ }
+
mutex_init(&cm36651->lock);
indio_dev->dev.parent = &client->dev;
indio_dev->channels = cm36651_channels;
@@ -664,7 +676,7 @@ static int cm36651_probe(struct i2c_clie
ret = cm36651_setup_reg(cm36651);
if (ret) {
dev_err(&client->dev, "%s: register setup failed\n", __func__);
- goto error_disable_reg;
+ goto error_i2c_unregister_ara;
}
ret = request_threaded_irq(client->irq, NULL, cm36651_irq_handler,
@@ -672,7 +684,7 @@ static int cm36651_probe(struct i2c_clie
"cm36651", indio_dev);
if (ret) {
dev_err(&client->dev, "%s: request irq failed\n", __func__);
- goto error_disable_reg;
+ goto error_i2c_unregister_ara;
}
ret = iio_device_register(indio_dev);
@@ -685,6 +697,10 @@ static int cm36651_probe(struct i2c_clie
error_free_irq:
free_irq(client->irq, indio_dev);
+error_i2c_unregister_ara:
+ i2c_unregister_device(cm36651->ara_client);
+error_i2c_unregister_ps:
+ i2c_unregister_device(cm36651->ps_client);
error_disable_reg:
regulator_disable(cm36651->vled_reg);
return ret;
@@ -698,6 +714,8 @@ static int cm36651_remove(struct i2c_cli
iio_device_unregister(indio_dev);
regulator_disable(cm36651->vled_reg);
free_irq(client->irq, indio_dev);
+ i2c_unregister_device(cm36651->ps_client);
+ i2c_unregister_device(cm36651->ara_client);
return 0;
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 069/158] NFSv4: Fix a use-after-free problem in open()
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 068/158] iio: cm36651: Fix i2c client leak and possible NULL pointer dereference Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 070/158] nfsd: revert v2 half of "nfsd: dont return high mode bits" Greg Kroah-Hartman
` (90 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steve Dickson, Trond Myklebust
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@primarydata.com>
commit e911b8158ee1def8153849b1641b736026b036e0 upstream.
If we interrupt the nfs4_wait_for_completion_rpc_task() call in
nfs4_run_open_task(), then we don't prevent the RPC call from
completing. So freeing up the opendata->f_attr.mdsthreshold
in the error path in _nfs4_do_open() leads to a use-after-free
when the XDR decoder tries to decode the mdsthreshold information
from the server.
Fixes: 82be417aa37c0 (NFSv4.1 cache mdsthreshold values on OPEN)
Tested-by: Steve Dickson <SteveD@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1068,6 +1068,7 @@ static void nfs4_opendata_free(struct kr
dput(p->dentry);
nfs_sb_deactive(sb);
nfs_fattr_free_names(&p->f_attr);
+ kfree(p->f_attr.mdsthreshold);
kfree(p);
}
@@ -2244,10 +2245,12 @@ static int _nfs4_do_open(struct inode *d
}
}
- if (ctx_th && server->attr_bitmask[2] & FATTR4_WORD2_MDSTHRESHOLD) {
- opendata->f_attr.mdsthreshold = pnfs_mdsthreshold_alloc();
- if (!opendata->f_attr.mdsthreshold)
- goto err_free_label;
+ if (server->attr_bitmask[2] & FATTR4_WORD2_MDSTHRESHOLD) {
+ if (!opendata->f_attr.mdsthreshold) {
+ opendata->f_attr.mdsthreshold = pnfs_mdsthreshold_alloc();
+ if (!opendata->f_attr.mdsthreshold)
+ goto err_free_label;
+ }
opendata->o_arg.open_bitmap = &nfs4_pnfs_open_bitmap[0];
}
if (dentry->d_inode != NULL)
@@ -2275,11 +2278,10 @@ static int _nfs4_do_open(struct inode *d
if (opendata->file_created)
*opened |= FILE_CREATED;
- if (pnfs_use_threshold(ctx_th, opendata->f_attr.mdsthreshold, server))
+ if (pnfs_use_threshold(ctx_th, opendata->f_attr.mdsthreshold, server)) {
*ctx_th = opendata->f_attr.mdsthreshold;
- else
- kfree(opendata->f_attr.mdsthreshold);
- opendata->f_attr.mdsthreshold = NULL;
+ opendata->f_attr.mdsthreshold = NULL;
+ }
nfs4_label_free(olabel);
@@ -2289,7 +2291,6 @@ static int _nfs4_do_open(struct inode *d
err_free_label:
nfs4_label_free(olabel);
err_opendata_put:
- kfree(opendata->f_attr.mdsthreshold);
nfs4_opendata_put(opendata);
err_put_state_owner:
nfs4_put_state_owner(sp);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 070/158] nfsd: revert v2 half of "nfsd: dont return high mode bits"
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 069/158] NFSv4: Fix a use-after-free problem in open() Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 071/158] nfsd4: session needs room for following op to error out Greg Kroah-Hartman
` (89 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mark Lord, Jeff Layton,
J. Bruce Fields, Johan Hovold
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit 082f31a2169bd639785e45bf252f3d5bce0303c6 upstream.
This reverts the part of commit 6e14b46b91fee8a049b0940333ce13a820beaaa5
that changes NFSv2 behavior.
Mark Lord found that it broke nfs-root for Linux clients, because it
broke NFSv2.
In fact, from RFC 1094:
"Notice that the file type is specified both in the mode bits
and in the file type. This is really a bug in the protocol and
will be fixed in future versions."
So NFSv2 clients really are expected to depend on the high bits of the
mode.
Reported-by: Mark Lord <mlord@pobox.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Cc: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsxdr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -152,7 +152,7 @@ encode_fattr(struct svc_rqst *rqstp, __b
type = (stat->mode & S_IFMT);
*p++ = htonl(nfs_ftypes[type >> 12]);
- *p++ = htonl((u32) (stat->mode & S_IALLUGO));
+ *p++ = htonl((u32) stat->mode);
*p++ = htonl((u32) stat->nlink);
*p++ = htonl((u32) from_kuid(&init_user_ns, stat->uid));
*p++ = htonl((u32) from_kgid(&init_user_ns, stat->gid));
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 071/158] nfsd4: session needs room for following op to error out
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 070/158] nfsd: revert v2 half of "nfsd: dont return high mode bits" Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 072/158] nfsd4: buffer-length check for SUPPATTR_EXCLCREAT Greg Kroah-Hartman
` (88 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, J. Bruce Fields
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit 4c69d5855a16f7378648c5733632628fa10431db upstream.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1359,6 +1359,12 @@ nfsd4_proc_compound(struct svc_rqst *rqs
/* If op is non-idempotent */
if (opdesc->op_flags & OP_MODIFIES_SOMETHING) {
plen = opdesc->op_rsize_bop(rqstp, op);
+ /*
+ * If there's still another operation, make sure
+ * we'll have space to at least encode an error:
+ */
+ if (resp->opcnt < args->opcnt)
+ plen += COMPOUND_ERR_SLACK_SPACE;
op->status = nfsd4_check_resp_size(resp, plen);
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 072/158] nfsd4: buffer-length check for SUPPATTR_EXCLCREAT
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 071/158] nfsd4: session needs room for following op to error out Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 073/158] nfsd4: fix test_stateid error reply encoding Greg Kroah-Hartman
` (87 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Benny Halevy, J. Bruce Fields
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit de3997a7eeb9ea286b15879fdf8a95aae065b4f7 upstream.
This was an omission from 8c18f2052e756e7d5dea712fc6e7ed70c00e8a39
"nfsd41: SUPPATTR_EXCLCREAT attribute".
Cc: Benny Halevy <bhalevy@primarydata.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2483,6 +2483,8 @@ out_acl:
goto out;
}
if (bmval2 & FATTR4_WORD2_SUPPATTR_EXCLCREAT) {
+ if ((buflen -= 16) < 0)
+ goto out_resource;
WRITE32(3);
WRITE32(NFSD_SUPPATTR_EXCLCREAT_WORD0);
WRITE32(NFSD_SUPPATTR_EXCLCREAT_WORD1);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 073/158] nfsd4: fix test_stateid error reply encoding
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 072/158] nfsd4: buffer-length check for SUPPATTR_EXCLCREAT Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 074/158] nfsd4: leave reply buffer space for failed setattr Greg Kroah-Hartman
` (86 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, J. Bruce Fields
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit a11fcce1544df08c723d950ff0edef3adac40405 upstream.
If the entire operation fails then there's nothing to encode.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -3473,6 +3473,9 @@ nfsd4_encode_test_stateid(struct nfsd4_c
struct nfsd4_test_stateid_id *stateid, *next;
__be32 *p;
+ if (nfserr)
+ return nfserr;
+
RESERVE_SPACE(4 + (4 * test_stateid->ts_num_ids));
*p++ = htonl(test_stateid->ts_num_ids);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 074/158] nfsd4: leave reply buffer space for failed setattr
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 073/158] nfsd4: fix test_stateid error reply encoding Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 075/158] nfsd: notify_change needs elevated write count Greg Kroah-Hartman
` (85 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, J. Bruce Fields
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit 04819bf6449094e62cebaf5199d85d68d711e667 upstream.
This fixes an ommission from 18032ca062e621e15683cb61c066ef3dc5414a7b
"NFSD: Server implementation of MAC Labeling", which increased the size
of the setattr error reply without increasing COMPOUND_ERR_SLACK_SPACE.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsd.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfsd.h
+++ b/fs/nfsd/nfsd.h
@@ -282,7 +282,7 @@ void nfsd_lockd_shutdown(void);
* reason.
*/
#define COMPOUND_SLACK_SPACE 140 /* OP_GETFH */
-#define COMPOUND_ERR_SLACK_SPACE 12 /* OP_SETATTR */
+#define COMPOUND_ERR_SLACK_SPACE 16 /* OP_SETATTR */
#define NFSD_LAUNDROMAT_MINTIMEOUT 1 /* seconds */
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 075/158] nfsd: notify_change needs elevated write count
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 074/158] nfsd4: leave reply buffer space for failed setattr Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 076/158] nfsd: check passed sockets net matches NFSd superblocks one Greg Kroah-Hartman
` (84 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Matthew Rahtz, J. Bruce Fields
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit 9f67f189939eccaa54f3d2c9cf10788abaf2d584 upstream.
Looks like this bug has been here since these write counts were
introduced, not sure why it was just noticed now.
Thanks also to Jan Kara for pointing out the problem.
Reported-by: Matthew Rahtz <mrahtz@rapitasystems.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/vfs.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -404,6 +404,7 @@ nfsd_setattr(struct svc_rqst *rqstp, str
umode_t ftype = 0;
__be32 err;
int host_err;
+ bool get_write_count;
int size_change = 0;
if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
@@ -411,10 +412,18 @@ nfsd_setattr(struct svc_rqst *rqstp, str
if (iap->ia_valid & ATTR_SIZE)
ftype = S_IFREG;
+ /* Callers that do fh_verify should do the fh_want_write: */
+ get_write_count = !fhp->fh_dentry;
+
/* Get inode */
err = fh_verify(rqstp, fhp, ftype, accmode);
if (err)
goto out;
+ if (get_write_count) {
+ host_err = fh_want_write(fhp);
+ if (host_err)
+ return nfserrno(host_err);
+ }
dentry = fhp->fh_dentry;
inode = dentry->d_inode;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 076/158] nfsd: check passed sockets net matches NFSd superblocks one
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 075/158] nfsd: notify_change needs elevated write count Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 077/158] nfsd4: fix memory leak in nfsd4_encode_fattr() Greg Kroah-Hartman
` (83 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Weng Meiling, Stanislav Kinsbursky,
J. Bruce Fields
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Kinsbursky <skinsbursky@parallels.com>
commit 3064639423c48d6e0eb9ecc27c512a58e38c6c57 upstream.
There could be a case, when NFSd file system is mounted in network, different
to socket's one, like below:
"ip netns exec" creates new network and mount namespace, which duplicates NFSd
mount point, created in init_net context. And thus NFS server stop in nested
network context leads to RPCBIND client destruction in init_net.
Then, on NFSd start in nested network context, rpc.nfsd process creates socket
in nested net and passes it into "write_ports", which leads to RPCBIND sockets
creation in init_net context because of the same reason (NFSd monut point was
created in init_net context). An attempt to register passed socket in nested
net leads to panic, because no RPCBIND client present in nexted network
namespace.
This patch add check that passed socket's net matches NFSd superblock's one.
And returns -EINVAL error to user psace otherwise.
v2: Put socket on exit.
Reported-by: Weng Meiling <wengmeiling.weng@huawei.com>
Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 5 +++++
include/linux/sunrpc/svcsock.h | 1 +
net/sunrpc/svcsock.c | 16 ++++++++++++++++
3 files changed, 22 insertions(+)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -699,6 +699,11 @@ static ssize_t __write_ports_addfd(char
if (err != 0 || fd < 0)
return -EINVAL;
+ if (svc_alien_sock(net, fd)) {
+ printk(KERN_ERR "%s: socket net is different to NFSd's one\n", __func__);
+ return -EINVAL;
+ }
+
err = nfsd_create_serv(net);
if (err != 0)
return err;
--- a/include/linux/sunrpc/svcsock.h
+++ b/include/linux/sunrpc/svcsock.h
@@ -56,6 +56,7 @@ int svc_recv(struct svc_rqst *, long);
int svc_send(struct svc_rqst *);
void svc_drop(struct svc_rqst *);
void svc_sock_update_bufs(struct svc_serv *serv);
+bool svc_alien_sock(struct net *net, int fd);
int svc_addsock(struct svc_serv *serv, const int fd,
char *name_return, const size_t len);
void svc_init_xprt_sock(void);
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1397,6 +1397,22 @@ static struct svc_sock *svc_setup_socket
return svsk;
}
+bool svc_alien_sock(struct net *net, int fd)
+{
+ int err;
+ struct socket *sock = sockfd_lookup(fd, &err);
+ bool ret = false;
+
+ if (!sock)
+ goto out;
+ if (sock_net(sock->sk) != net)
+ ret = true;
+ sockfd_put(sock);
+out:
+ return ret;
+}
+EXPORT_SYMBOL_GPL(svc_alien_sock);
+
/**
* svc_addsock - add a listener socket to an RPC service
* @serv: pointer to RPC service to which to add a new listener
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 077/158] nfsd4: fix memory leak in nfsd4_encode_fattr()
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 076/158] nfsd: check passed sockets net matches NFSd superblocks one Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 078/158] nfsd4: fix setclientid encode size Greg Kroah-Hartman
` (82 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yan, Zheng, J. Bruce Fields
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Yan, Zheng" <zheng.z.yan@intel.com>
commit 18df11d0eacf67bbcd8dda755b568bbbd7264735 upstream.
fh_put() does not free the temporary file handle.
Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2501,8 +2501,10 @@ out:
security_release_secctx(context, contextlen);
#endif /* CONFIG_NFSD_V4_SECURITY_LABEL */
kfree(acl);
- if (tempfh)
+ if (tempfh) {
fh_put(tempfh);
+ kfree(tempfh);
+ }
return status;
out_nfserr:
status = nfserrno(err);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 078/158] nfsd4: fix setclientid encode size
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 077/158] nfsd4: fix memory leak in nfsd4_encode_fattr() Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 079/158] NFSD: Traverse unconfirmed client through hash-table Greg Kroah-Hartman
` (81 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, J. Bruce Fields
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit 480efaee085235bb848f1063f959bf144103c342 upstream.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1529,7 +1529,8 @@ static inline u32 nfsd4_setattr_rsize(st
static inline u32 nfsd4_setclientid_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op)
{
- return (op_encode_hdr_size + 2 + 1024) * sizeof(__be32);
+ return (op_encode_hdr_size + 2 + XDR_QUADLEN(NFS4_VERIFIER_SIZE)) *
+ sizeof(__be32);
}
static inline u32 nfsd4_write_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op)
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 079/158] NFSD: Traverse unconfirmed client through hash-table
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 078/158] nfsd4: fix setclientid encode size Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 080/158] nfsd: set timeparms.to_maxval in setup_callback_client Greg Kroah-Hartman
` (80 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kinglong Mee, Jeff Layton, J. Bruce Fields
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kinglong Mee <kinglongmee@gmail.com>
commit 2b9056359889c78ea5decb5b654a512c2e8a945c upstream.
When stopping nfsd, I got BUG messages, and soft lockup messages,
The problem is cuased by double rb_erase() in nfs4_state_destroy_net()
and destroy_client().
This patch just let nfsd traversing unconfirmed client through
hash-table instead of rbtree.
[ 2325.021995] BUG: unable to handle kernel NULL pointer dereference at
(null)
[ 2325.022809] IP: [<ffffffff8133c18c>] rb_erase+0x14c/0x390
[ 2325.022982] PGD 7a91b067 PUD 7a33d067 PMD 0
[ 2325.022982] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
[ 2325.022982] Modules linked in: nfsd(OF) cfg80211 rfkill bridge stp
llc snd_intel8x0 snd_ac97_codec ac97_bus auth_rpcgss nfs_acl serio_raw
e1000 i2c_piix4 ppdev snd_pcm snd_timer lockd pcspkr joydev parport_pc
snd parport i2c_core soundcore microcode sunrpc ata_generic pata_acpi
[last unloaded: nfsd]
[ 2325.022982] CPU: 1 PID: 2123 Comm: nfsd Tainted: GF O
3.14.0-rc8+ #2
[ 2325.022982] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
VirtualBox 12/01/2006
[ 2325.022982] task: ffff88007b384800 ti: ffff8800797f6000 task.ti:
ffff8800797f6000
[ 2325.022982] RIP: 0010:[<ffffffff8133c18c>] [<ffffffff8133c18c>]
rb_erase+0x14c/0x390
[ 2325.022982] RSP: 0018:ffff8800797f7d98 EFLAGS: 00010246
[ 2325.022982] RAX: ffff880079c1f010 RBX: ffff880079f4c828 RCX:
0000000000000000
[ 2325.022982] RDX: 0000000000000000 RSI: ffff880079bcb070 RDI:
ffff880079f4c810
[ 2325.022982] RBP: ffff8800797f7d98 R08: 0000000000000000 R09:
ffff88007964fc70
[ 2325.022982] R10: 0000000000000000 R11: 0000000000000400 R12:
ffff880079f4c800
[ 2325.022982] R13: ffff880079bcb000 R14: ffff8800797f7da8 R15:
ffff880079f4c860
[ 2325.022982] FS: 0000000000000000(0000) GS:ffff88007f900000(0000)
knlGS:0000000000000000
[ 2325.022982] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 2325.022982] CR2: 0000000000000000 CR3: 000000007a3ef000 CR4:
00000000000006e0
[ 2325.022982] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[ 2325.022982] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[ 2325.022982] Stack:
[ 2325.022982] ffff8800797f7de0 ffffffffa0191c6e ffff8800797f7da8
ffff8800797f7da8
[ 2325.022982] ffff880079f4c810 ffff880079bcb000 ffffffff81cc26c0
ffff880079c1f010
[ 2325.022982] ffff880079bcb070 ffff8800797f7e28 ffffffffa01977f2
ffff8800797f7df0
[ 2325.022982] Call Trace:
[ 2325.022982] [<ffffffffa0191c6e>] destroy_client+0x32e/0x3b0 [nfsd]
[ 2325.022982] [<ffffffffa01977f2>] nfs4_state_shutdown_net+0x1a2/0x220
[nfsd]
[ 2325.022982] [<ffffffffa01700b8>] nfsd_shutdown_net+0x38/0x70 [nfsd]
[ 2325.022982] [<ffffffffa017013e>] nfsd_last_thread+0x4e/0x80 [nfsd]
[ 2325.022982] [<ffffffffa001f1eb>] svc_shutdown_net+0x2b/0x30 [sunrpc]
[ 2325.022982] [<ffffffffa017064b>] nfsd_destroy+0x5b/0x80 [nfsd]
[ 2325.022982] [<ffffffffa0170773>] nfsd+0x103/0x130 [nfsd]
[ 2325.022982] [<ffffffffa0170670>] ? nfsd_destroy+0x80/0x80 [nfsd]
[ 2325.022982] [<ffffffff810a8232>] kthread+0xd2/0xf0
[ 2325.022982] [<ffffffff810a8160>] ? insert_kthread_work+0x40/0x40
[ 2325.022982] [<ffffffff816c493c>] ret_from_fork+0x7c/0xb0
[ 2325.022982] [<ffffffff810a8160>] ? insert_kthread_work+0x40/0x40
[ 2325.022982] Code: 48 83 e1 fc 48 89 10 0f 84 02 01 00 00 48 3b 41 10
0f 84 08 01 00 00 48 89 51 08 48 89 fa e9 74 ff ff ff 0f 1f 40 00 48 8b
50 10 <f6> 02 01 0f 84 93 00 00 00 48 8b 7a 10 48 85 ff 74 05 f6 07 01
[ 2325.022982] RIP [<ffffffff8133c18c>] rb_erase+0x14c/0x390
[ 2325.022982] RSP <ffff8800797f7d98>
[ 2325.022982] CR2: 0000000000000000
[ 2325.022982] ---[ end trace 28c27ed011655e57 ]---
[ 228.064071] BUG: soft lockup - CPU#0 stuck for 22s! [nfsd:558]
[ 228.064428] Modules linked in: ip6t_rpfilter ip6t_REJECT cfg80211
xt_conntrack rfkill ebtable_nat ebtable_broute bridge stp llc
ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6
nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw
ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4
nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security
iptable_raw nfsd(OF) auth_rpcgss nfs_acl lockd snd_intel8x0
snd_ac97_codec ac97_bus joydev snd_pcm snd_timer e1000 sunrpc snd ppdev
parport_pc serio_raw pcspkr i2c_piix4 microcode parport soundcore
i2c_core ata_generic pata_acpi
[ 228.064539] CPU: 0 PID: 558 Comm: nfsd Tainted: GF O
3.14.0-rc8+ #2
[ 228.064539] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
VirtualBox 12/01/2006
[ 228.064539] task: ffff880076adec00 ti: ffff880074616000 task.ti:
ffff880074616000
[ 228.064539] RIP: 0010:[<ffffffff8133ba17>] [<ffffffff8133ba17>]
rb_next+0x27/0x50
[ 228.064539] RSP: 0018:ffff880074617de0 EFLAGS: 00000282
[ 228.064539] RAX: ffff880074478010 RBX: ffff88007446f860 RCX:
0000000000000014
[ 228.064539] RDX: ffff880074478010 RSI: 0000000000000000 RDI:
ffff880074478010
[ 228.064539] RBP: ffff880074617de0 R08: 0000000000000000 R09:
0000000000000012
[ 228.064539] R10: 0000000000000001 R11: ffffffffffffffec R12:
ffffea0001d11a00
[ 228.064539] R13: ffff88007f401400 R14: ffff88007446f800 R15:
ffff880074617d50
[ 228.064539] FS: 0000000000000000(0000) GS:ffff88007f800000(0000)
knlGS:0000000000000000
[ 228.064539] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 228.064539] CR2: 00007fe9ac6ec000 CR3: 000000007a5d6000 CR4:
00000000000006f0
[ 228.064539] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[ 228.064539] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[ 228.064539] Stack:
[ 228.064539] ffff880074617e28 ffffffffa01ab7db ffff880074617df0
ffff880074617df0
[ 228.064539] ffff880079273000 ffffffff81cc26c0 ffffffff81cc26c0
0000000000000000
[ 228.064539] 0000000000000000 ffff880074617e48 ffffffffa01840b8
ffffffff81cc26c0
[ 228.064539] Call Trace:
[ 228.064539] [<ffffffffa01ab7db>] nfs4_state_shutdown_net+0x18b/0x220
[nfsd]
[ 228.064539] [<ffffffffa01840b8>] nfsd_shutdown_net+0x38/0x70 [nfsd]
[ 228.064539] [<ffffffffa018413e>] nfsd_last_thread+0x4e/0x80 [nfsd]
[ 228.064539] [<ffffffffa00aa1eb>] svc_shutdown_net+0x2b/0x30 [sunrpc]
[ 228.064539] [<ffffffffa018464b>] nfsd_destroy+0x5b/0x80 [nfsd]
[ 228.064539] [<ffffffffa0184773>] nfsd+0x103/0x130 [nfsd]
[ 228.064539] [<ffffffffa0184670>] ? nfsd_destroy+0x80/0x80 [nfsd]
[ 228.064539] [<ffffffff810a8232>] kthread+0xd2/0xf0
[ 228.064539] [<ffffffff810a8160>] ? insert_kthread_work+0x40/0x40
[ 228.064539] [<ffffffff816c493c>] ret_from_fork+0x7c/0xb0
[ 228.064539] [<ffffffff810a8160>] ? insert_kthread_work+0x40/0x40
[ 228.064539] Code: 1f 44 00 00 55 48 8b 17 48 89 e5 48 39 d7 74 3b 48
8b 47 08 48 85 c0 75 0e eb 25 66 0f 1f 84 00 00 00 00 00 48 89 d0 48 8b
50 10 <48> 85 d2 75 f4 5d c3 66 90 48 3b 78 08 75 f6 48 8b 10 48 89 c7
Fixes: ac55fdc408039 (nfsd: move the confirmed and unconfirmed hlists...)
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 13 +++++--------
1 file changed, 5 insertions(+), 8 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -5062,7 +5062,6 @@ nfs4_state_destroy_net(struct net *net)
int i;
struct nfs4_client *clp = NULL;
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
- struct rb_node *node, *tmp;
for (i = 0; i < CLIENT_HASH_SIZE; i++) {
while (!list_empty(&nn->conf_id_hashtbl[i])) {
@@ -5071,13 +5070,11 @@ nfs4_state_destroy_net(struct net *net)
}
}
- node = rb_first(&nn->unconf_name_tree);
- while (node != NULL) {
- tmp = node;
- node = rb_next(tmp);
- clp = rb_entry(tmp, struct nfs4_client, cl_namenode);
- rb_erase(tmp, &nn->unconf_name_tree);
- destroy_client(clp);
+ for (i = 0; i < CLIENT_HASH_SIZE; i++) {
+ while (!list_empty(&nn->unconf_id_hashtbl[i])) {
+ clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
+ destroy_client(clp);
+ }
}
kfree(nn->sessionid_hashtbl);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 080/158] nfsd: set timeparms.to_maxval in setup_callback_client
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 079/158] NFSD: Traverse unconfirmed client through hash-table Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 081/158] IB/ipath: Fix potential buffer overrun in sending diag packet routine Greg Kroah-Hartman
` (79 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jeff Layton, J. Bruce Fields
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@redhat.com>
commit 3758cf7e14b753838fe754ede3862af10b35fdac upstream.
...otherwise the logic in the timeout handling doesn't work correctly.
Spotted-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4callback.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -637,9 +637,11 @@ static struct rpc_cred *get_backchannel_
static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *conn, struct nfsd4_session *ses)
{
+ int maxtime = max_cb_time(clp->net);
struct rpc_timeout timeparms = {
- .to_initval = max_cb_time(clp->net),
+ .to_initval = maxtime,
.to_retries = 0,
+ .to_maxval = maxtime,
};
struct rpc_create_args args = {
.net = clp->net,
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 081/158] IB/ipath: Fix potential buffer overrun in sending diag packet routine
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 080/158] nfsd: set timeparms.to_maxval in setup_callback_client Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 082/158] IB/nes: Return an error on ib_copy_from_udata() failure instead of NULL Greg Kroah-Hartman
` (78 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nico Golde, Fabian Yamaguchi,
Mike Marciniszyn, Dennis Dalessandro, Roland Dreier
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Dalessandro <dennis.dalessandro@intel.com>
commit a2cb0eb8a64adb29a99fd864013de957028f36ae upstream.
Guard against a potential buffer overrun. The size to read from the
user is passed in, and due to the padding that needs to be taken into
account, as well as the place holder for the ICRC it is possible to
overflow the 32bit value which would cause more data to be copied from
user space than is allocated in the buffer.
Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/ipath/ipath_diag.c | 66 +++++++++++--------------------
1 file changed, 25 insertions(+), 41 deletions(-)
--- a/drivers/infiniband/hw/ipath/ipath_diag.c
+++ b/drivers/infiniband/hw/ipath/ipath_diag.c
@@ -326,7 +326,7 @@ static ssize_t ipath_diagpkt_write(struc
size_t count, loff_t *off)
{
u32 __iomem *piobuf;
- u32 plen, clen, pbufn;
+ u32 plen, pbufn, maxlen_reserve;
struct ipath_diag_pkt odp;
struct ipath_diag_xpkt dp;
u32 *tmpbuf = NULL;
@@ -335,51 +335,29 @@ static ssize_t ipath_diagpkt_write(struc
u64 val;
u32 l_state, lt_state; /* LinkState, LinkTrainingState */
- if (count < sizeof(odp)) {
- ret = -EINVAL;
- goto bail;
- }
if (count == sizeof(dp)) {
if (copy_from_user(&dp, data, sizeof(dp))) {
ret = -EFAULT;
goto bail;
}
- } else if (copy_from_user(&odp, data, sizeof(odp))) {
- ret = -EFAULT;
+ } else if (count == sizeof(odp)) {
+ if (copy_from_user(&odp, data, sizeof(odp))) {
+ ret = -EFAULT;
+ goto bail;
+ }
+ } else {
+ ret = -EINVAL;
goto bail;
}
- /*
- * Due to padding/alignment issues (lessened with new struct)
- * the old and new structs are the same length. We need to
- * disambiguate them, which we can do because odp.len has never
- * been less than the total of LRH+BTH+DETH so far, while
- * dp.unit (same offset) unit is unlikely to get that high.
- * Similarly, dp.data, the pointer to user at the same offset
- * as odp.unit, is almost certainly at least one (512byte)page
- * "above" NULL. The if-block below can be omitted if compatibility
- * between a new driver and older diagnostic code is unimportant.
- * compatibility the other direction (new diags, old driver) is
- * handled in the diagnostic code, with a warning.
- */
- if (dp.unit >= 20 && dp.data < 512) {
- /* very probable version mismatch. Fix it up */
- memcpy(&odp, &dp, sizeof(odp));
- /* We got a legacy dp, copy elements to dp */
- dp.unit = odp.unit;
- dp.data = odp.data;
- dp.len = odp.len;
- dp.pbc_wd = 0; /* Indicate we need to compute PBC wd */
- }
-
/* send count must be an exact number of dwords */
if (dp.len & 3) {
ret = -EINVAL;
goto bail;
}
- clen = dp.len >> 2;
+ plen = dp.len >> 2;
dd = ipath_lookup(dp.unit);
if (!dd || !(dd->ipath_flags & IPATH_PRESENT) ||
@@ -422,16 +400,22 @@ static ssize_t ipath_diagpkt_write(struc
goto bail;
}
- /* need total length before first word written */
- /* +1 word is for the qword padding */
- plen = sizeof(u32) + dp.len;
-
- if ((plen + 4) > dd->ipath_ibmaxlen) {
+ /*
+ * need total length before first word written, plus 2 Dwords. One Dword
+ * is for padding so we get the full user data when not aligned on
+ * a word boundary. The other Dword is to make sure we have room for the
+ * ICRC which gets tacked on later.
+ */
+ maxlen_reserve = 2 * sizeof(u32);
+ if (dp.len > dd->ipath_ibmaxlen - maxlen_reserve) {
ipath_dbg("Pkt len 0x%x > ibmaxlen %x\n",
- plen - 4, dd->ipath_ibmaxlen);
+ dp.len, dd->ipath_ibmaxlen);
ret = -EINVAL;
- goto bail; /* before writing pbc */
+ goto bail;
}
+
+ plen = sizeof(u32) + dp.len;
+
tmpbuf = vmalloc(plen);
if (!tmpbuf) {
dev_info(&dd->pcidev->dev, "Unable to allocate tmp buffer, "
@@ -473,11 +457,11 @@ static ssize_t ipath_diagpkt_write(struc
*/
if (dd->ipath_flags & IPATH_PIO_FLUSH_WC) {
ipath_flush_wc();
- __iowrite32_copy(piobuf + 2, tmpbuf, clen - 1);
+ __iowrite32_copy(piobuf + 2, tmpbuf, plen - 1);
ipath_flush_wc();
- __raw_writel(tmpbuf[clen - 1], piobuf + clen + 1);
+ __raw_writel(tmpbuf[plen - 1], piobuf + plen + 1);
} else
- __iowrite32_copy(piobuf + 2, tmpbuf, clen);
+ __iowrite32_copy(piobuf + 2, tmpbuf, plen);
ipath_flush_wc();
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 082/158] IB/nes: Return an error on ib_copy_from_udata() failure instead of NULL
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 081/158] IB/ipath: Fix potential buffer overrun in sending diag packet routine Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 083/158] IB/mthca: Return an error on ib_copy_to_udata() failure Greg Kroah-Hartman
` (77 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yann Droneaud, Roland Dreier
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yann Droneaud <ydroneaud@opteya.com>
commit 9d194d1025f463392feafa26ff8c2d8247f71be1 upstream.
In case of error while accessing to userspace memory, function
nes_create_qp() returns NULL instead of an error code wrapped through
ERR_PTR(). But NULL is not expected by ib_uverbs_create_qp(), as it
check for error with IS_ERR().
As page 0 is likely not mapped, it is going to trigger an Oops when
the kernel will try to dereference NULL pointer to access to struct
ib_qp's fields.
In some rare cases, page 0 could be mapped by userspace, which could
turn this bug to a vulnerability that could be exploited: the function
pointers in struct ib_device will be under userspace total control.
This was caught when using spatch (aka. coccinelle)
to rewrite calls to ib_copy_{from,to}_udata().
Link: https://www.gitorious.org/opteya/ib-hw-nes-create-qp-null
Link: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci
Link: http://marc.info/?i=cover.1394485254.git.ydroneaud@opteya.com
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/nes/nes_verbs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -1186,7 +1186,7 @@ static struct ib_qp *nes_create_qp(struc
nes_free_resource(nesadapter, nesadapter->allocated_qps, qp_num);
kfree(nesqp->allocated_buffer);
nes_debug(NES_DBG_QP, "ib_copy_from_udata() Failed \n");
- return NULL;
+ return ERR_PTR(-EFAULT);
}
if (req.user_wqe_buffers) {
virt_wqs = 1;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 083/158] IB/mthca: Return an error on ib_copy_to_udata() failure
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 082/158] IB/nes: Return an error on ib_copy_from_udata() failure instead of NULL Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 084/158] IB/ehca: Returns " Greg Kroah-Hartman
` (76 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yann Droneaud, Roland Dreier
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yann Droneaud <ydroneaud@opteya.com>
commit 08e74c4b00c30c232d535ff368554959403d0432 upstream.
In case of error when writing to userspace, the function mthca_create_cq()
does not set an error code before following its error path.
This patch sets the error code to -EFAULT when ib_copy_to_udata() fails.
This was caught when using spatch (aka. coccinelle)
to rewrite call to ib_copy_{from,to}_udata().
Link: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci
Link: http://marc.info/?i=cover.1394485254.git.ydroneaud@opteya.com
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mthca/mthca_provider.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -695,6 +695,7 @@ static struct ib_cq *mthca_create_cq(str
if (context && ib_copy_to_udata(udata, &cq->cqn, sizeof (__u32))) {
mthca_free_cq(to_mdev(ibdev), cq);
+ err = -EFAULT;
goto err_free;
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 084/158] IB/ehca: Returns an error on ib_copy_to_udata() failure
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 083/158] IB/mthca: Return an error on ib_copy_to_udata() failure Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 085/158] IB/qib: Fix debugfs ordering issue with multiple HCAs Greg Kroah-Hartman
` (75 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yann Droneaud, Roland Dreier
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yann Droneaud <ydroneaud@opteya.com>
commit 5bdb0f02add5994b0bc17494f4726925ca5d6ba1 upstream.
In case of error when writing to userspace, function ehca_create_cq()
does not set an error code before following its error path.
This patch sets the error code to -EFAULT when ib_copy_to_udata()
fails.
This was caught when using spatch (aka. coccinelle)
to rewrite call to ib_copy_{from,to}_udata().
Link: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci
Link: http://marc.info/?i=cover.1394485254.git.ydroneaud@opteya.com
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/ehca/ehca_cq.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/infiniband/hw/ehca/ehca_cq.c
+++ b/drivers/infiniband/hw/ehca/ehca_cq.c
@@ -283,6 +283,7 @@ struct ib_cq *ehca_create_cq(struct ib_d
(my_cq->galpas.user.fw_handle & (PAGE_SIZE - 1));
if (ib_copy_to_udata(udata, &resp, sizeof(resp))) {
ehca_err(device, "Copy to udata failed.");
+ cq = ERR_PTR(-EFAULT);
goto create_cq_exit4;
}
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 085/158] IB/qib: Fix debugfs ordering issue with multiple HCAs
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 084/158] IB/ehca: Returns " Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 086/158] IB/qib: add missing braces in do_qib_user_sdma_queue_create() Greg Kroah-Hartman
` (74 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dennis Dalessandro, Mike Marciniszyn,
Roland Dreier
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marciniszyn <mike.marciniszyn@intel.com>
commit f8b6c47a44c063062317646683a73371c24c69ee upstream.
The debugfs init code was incorrectly called before the idr mechanism
is used to get the unit number, so the dd->unit hasn't been
initialized. This caused the unit relative directory creation to fail
after the first.
This patch moves the init for the debugfs stuff until after all of the
failures and after the unit number has been determined.
A bug in unwind code in qib_alloc_devdata() is also fixed.
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/qib/qib_init.c | 25 +++++++++++--------------
1 file changed, 11 insertions(+), 14 deletions(-)
--- a/drivers/infiniband/hw/qib/qib_init.c
+++ b/drivers/infiniband/hw/qib/qib_init.c
@@ -1097,14 +1097,10 @@ struct qib_devdata *qib_alloc_devdata(st
int ret;
dd = (struct qib_devdata *) ib_alloc_device(sizeof(*dd) + extra);
- if (!dd) {
- dd = ERR_PTR(-ENOMEM);
- goto bail;
- }
+ if (!dd)
+ return ERR_PTR(-ENOMEM);
-#ifdef CONFIG_DEBUG_FS
- qib_dbg_ibdev_init(&dd->verbs_dev);
-#endif
+ INIT_LIST_HEAD(&dd->list);
idr_preload(GFP_KERNEL);
spin_lock_irqsave(&qib_devs_lock, flags);
@@ -1121,11 +1117,6 @@ struct qib_devdata *qib_alloc_devdata(st
if (ret < 0) {
qib_early_err(&pdev->dev,
"Could not allocate unit ID: error %d\n", -ret);
-#ifdef CONFIG_DEBUG_FS
- qib_dbg_ibdev_exit(&dd->verbs_dev);
-#endif
- ib_dealloc_device(&dd->verbs_dev.ibdev);
- dd = ERR_PTR(ret);
goto bail;
}
@@ -1139,9 +1130,15 @@ struct qib_devdata *qib_alloc_devdata(st
qib_early_err(&pdev->dev,
"Could not alloc cpulist info, cpu affinity might be wrong\n");
}
-
-bail:
+#ifdef CONFIG_DEBUG_FS
+ qib_dbg_ibdev_init(&dd->verbs_dev);
+#endif
return dd;
+bail:
+ if (!list_empty(&dd->list))
+ list_del_init(&dd->list);
+ ib_dealloc_device(&dd->verbs_dev.ibdev);
+ return ERR_PTR(ret);;
}
/*
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 086/158] IB/qib: add missing braces in do_qib_user_sdma_queue_create()
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 085/158] IB/qib: Fix debugfs ordering issue with multiple HCAs Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 087/158] IB/core: Dont resolve passive side RoCE L2 address in CMA REQ handler Greg Kroah-Hartman
` (73 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mike Marciniszyn, Julia Lawall,
Yann Droneaud, Roland Dreier, infinipath, cocci
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yann Droneaud <ydroneaud@opteya.com>
commit 37a967651caf99dd267017023737bd442f5acb3d upstream.
Commit c804f07248895ff9c moved qib_assign_ctxt() to
do_qib_user_sdma_queue_create() but dropped the braces
around the statements.
This was spotted by coccicheck (coccinelle/spatch):
$ make C=2 CHECK=scripts/coccicheck drivers/infiniband/hw/qib/
CHECK drivers/infiniband/hw/qib/qib_file_ops.c
drivers/infiniband/hw/qib/qib_file_ops.c:1583:2-23: code aligned with following code on line 1587
This patch adds braces back.
Link: http://marc.info/?i=cover.1394485254.git.ydroneaud@opteya.com
Cc: Mike Marciniszyn <mike.marciniszyn@intel.com>
Cc: infinipath@intel.com
Cc: Julia Lawall <julia.lawall@lip6.fr>
Cc: cocci@systeme.lip6.fr
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Tested-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Acked-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/qib/qib_file_ops.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/hw/qib/qib_file_ops.c
+++ b/drivers/infiniband/hw/qib/qib_file_ops.c
@@ -1578,7 +1578,7 @@ static int do_qib_user_sdma_queue_create
struct qib_ctxtdata *rcd = fd->rcd;
struct qib_devdata *dd = rcd->dd;
- if (dd->flags & QIB_HAS_SEND_DMA)
+ if (dd->flags & QIB_HAS_SEND_DMA) {
fd->pq = qib_user_sdma_queue_create(&dd->pcidev->dev,
dd->unit,
@@ -1586,6 +1586,7 @@ static int do_qib_user_sdma_queue_create
fd->subctxt);
if (!fd->pq)
return -ENOMEM;
+ }
return 0;
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 087/158] IB/core: Dont resolve passive side RoCE L2 address in CMA REQ handler
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 086/158] IB/qib: add missing braces in do_qib_user_sdma_queue_create() Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 088/158] ib_srpt: Use correct ib_sg_dma primitives Greg Kroah-Hartman
` (72 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Moni Shoua, Or Gerlitz, Roland Dreier
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moni Shoua <monis@mellanox.com>
commit b2853fd6c2d0f383dbdf7427e263eb576a633867 upstream.
The code that resolves the passive side source MAC within the rdma_cm
connection request handler was both redundant and buggy, so remove it.
It was redundant since later, when an RC QP is modified to RTR state,
the resolution will take place in the ib_core module. It was buggy
because this callback also deals with UD SIDR exchange, for which we
incorrectly looked at the REQ member of the CM event and dereferenced
a random value.
Fixes: dd5f03beb4f7 ("IB/core: Ethernet L2 attributes in verbs/cm structures")
Signed-off-by: Moni Shoua <monis@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/cm.c | 17 -----------------
drivers/infiniband/core/cma.c | 26 --------------------------
include/rdma/ib_cm.h | 1 -
3 files changed, 44 deletions(-)
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -349,23 +349,6 @@ static void cm_init_av_for_response(stru
grh, &av->ah_attr);
}
-int ib_update_cm_av(struct ib_cm_id *id, const u8 *smac, const u8 *alt_smac)
-{
- struct cm_id_private *cm_id_priv;
-
- cm_id_priv = container_of(id, struct cm_id_private, id);
-
- if (smac != NULL)
- memcpy(cm_id_priv->av.smac, smac, sizeof(cm_id_priv->av.smac));
-
- if (alt_smac != NULL)
- memcpy(cm_id_priv->alt_av.smac, alt_smac,
- sizeof(cm_id_priv->alt_av.smac));
-
- return 0;
-}
-EXPORT_SYMBOL(ib_update_cm_av);
-
static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
{
struct cm_device *cm_dev;
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1284,15 +1284,6 @@ static int cma_req_handler(struct ib_cm_
struct rdma_id_private *listen_id, *conn_id;
struct rdma_cm_event event;
int offset, ret;
- u8 smac[ETH_ALEN];
- u8 alt_smac[ETH_ALEN];
- u8 *psmac = smac;
- u8 *palt_smac = alt_smac;
- int is_iboe = ((rdma_node_get_transport(cm_id->device->node_type) ==
- RDMA_TRANSPORT_IB) &&
- (rdma_port_get_link_layer(cm_id->device,
- ib_event->param.req_rcvd.port) ==
- IB_LINK_LAYER_ETHERNET));
listen_id = cm_id->context;
if (!cma_check_req_qp_type(&listen_id->id, ib_event))
@@ -1336,28 +1327,11 @@ static int cma_req_handler(struct ib_cm_
ret = conn_id->id.event_handler(&conn_id->id, &event);
if (ret)
goto err3;
-
- if (is_iboe) {
- if (ib_event->param.req_rcvd.primary_path != NULL)
- rdma_addr_find_smac_by_sgid(
- &ib_event->param.req_rcvd.primary_path->sgid,
- psmac, NULL);
- else
- psmac = NULL;
- if (ib_event->param.req_rcvd.alternate_path != NULL)
- rdma_addr_find_smac_by_sgid(
- &ib_event->param.req_rcvd.alternate_path->sgid,
- palt_smac, NULL);
- else
- palt_smac = NULL;
- }
/*
* Acquire mutex to prevent user executing rdma_destroy_id()
* while we're accessing the cm_id.
*/
mutex_lock(&lock);
- if (is_iboe)
- ib_update_cm_av(cm_id, psmac, palt_smac);
if (cma_comp(conn_id, RDMA_CM_CONNECT) &&
(conn_id->id.qp_type != IB_QPT_UD))
ib_send_cm_mra(cm_id, CMA_CM_MRA_SETTING, NULL, 0);
--- a/include/rdma/ib_cm.h
+++ b/include/rdma/ib_cm.h
@@ -601,5 +601,4 @@ struct ib_cm_sidr_rep_param {
int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id,
struct ib_cm_sidr_rep_param *param);
-int ib_update_cm_av(struct ib_cm_id *id, const u8 *smac, const u8 *alt_smac);
#endif /* IB_CM_H */
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 088/158] ib_srpt: Use correct ib_sg_dma primitives
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 087/158] IB/core: Dont resolve passive side RoCE L2 address in CMA REQ handler Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 089/158] SCSI: qla2xxx: fix error handling of qla2x00_mem_alloc() Greg Kroah-Hartman
` (71 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Dennis Dalessandro,
Vinod Kumar, Mike Marciniszyn, Nicholas Bellinger
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marciniszyn <mike.marciniszyn@intel.com>
commit b076808051f2c80d38e03fb2f1294f525c7a446d upstream.
The code was incorrectly using sg_dma_address() and
sg_dma_len() instead of ib_sg_dma_address() and
ib_sg_dma_len().
This prevents srpt from functioning with the
Intel HCA and indeed will corrupt memory
badly.
Cc: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Tested-by: Vinod Kumar <vinod.kumar@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/ulp/srpt/ib_srpt.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1078,6 +1078,7 @@ static void srpt_unmap_sg_to_ib_sge(stru
static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch,
struct srpt_send_ioctx *ioctx)
{
+ struct ib_device *dev = ch->sport->sdev->device;
struct se_cmd *cmd;
struct scatterlist *sg, *sg_orig;
int sg_cnt;
@@ -1124,7 +1125,7 @@ static int srpt_map_sg_to_ib_sge(struct
db = ioctx->rbufs;
tsize = cmd->data_length;
- dma_len = sg_dma_len(&sg[0]);
+ dma_len = ib_sg_dma_len(dev, &sg[0]);
riu = ioctx->rdma_ius;
/*
@@ -1155,7 +1156,8 @@ static int srpt_map_sg_to_ib_sge(struct
++j;
if (j < count) {
sg = sg_next(sg);
- dma_len = sg_dma_len(sg);
+ dma_len = ib_sg_dma_len(
+ dev, sg);
}
}
} else {
@@ -1192,8 +1194,8 @@ static int srpt_map_sg_to_ib_sge(struct
tsize = cmd->data_length;
riu = ioctx->rdma_ius;
sg = sg_orig;
- dma_len = sg_dma_len(&sg[0]);
- dma_addr = sg_dma_address(&sg[0]);
+ dma_len = ib_sg_dma_len(dev, &sg[0]);
+ dma_addr = ib_sg_dma_address(dev, &sg[0]);
/* this second loop is really mapped sg_addres to rdma_iu->ib_sge */
for (i = 0, j = 0;
@@ -1216,8 +1218,10 @@ static int srpt_map_sg_to_ib_sge(struct
++j;
if (j < count) {
sg = sg_next(sg);
- dma_len = sg_dma_len(sg);
- dma_addr = sg_dma_address(sg);
+ dma_len = ib_sg_dma_len(
+ dev, sg);
+ dma_addr = ib_sg_dma_address(
+ dev, sg);
}
}
} else {
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 089/158] SCSI: qla2xxx: fix error handling of qla2x00_mem_alloc()
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 088/158] ib_srpt: Use correct ib_sg_dma primitives Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:39 ` [PATCH 3.14 090/158] SCSI: arcmsr: upper 32 of dma address lost Greg Kroah-Hartman
` (70 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Saurav Kashyap,
James Bottomley
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit b2a72ec32d0f499aaadf41264232517a12326df0 upstream.
qla2x00_mem_alloc() returns 1 on success and -ENOMEM on failure. On the
one hand the caller assumes non-zero is success but on the other hand
the caller also assumes that it returns an error code.
I've fixed it to return zero on success and a negative error code on
failure. This matches the documentation as well.
[jejb: checkpatch fix]
Fixes: e315cd28b9ef ('[SCSI] qla2xxx: Code changes for qla data structure refactoring')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Saurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_os.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -2536,7 +2536,7 @@ qla2x00_probe_one(struct pci_dev *pdev,
ha->flags.enable_64bit_addressing ? "enable" :
"disable");
ret = qla2x00_mem_alloc(ha, req_length, rsp_length, &req, &rsp);
- if (!ret) {
+ if (ret) {
ql_log_pci(ql_log_fatal, pdev, 0x0031,
"Failed to allocate memory for adapter, aborting.\n");
@@ -3478,10 +3478,10 @@ qla2x00_mem_alloc(struct qla_hw_data *ha
else {
qla2x00_set_reserved_loop_ids(ha);
ql_dbg_pci(ql_dbg_init, ha->pdev, 0x0123,
- "loop_id_map=%p. \n", ha->loop_id_map);
+ "loop_id_map=%p.\n", ha->loop_id_map);
}
- return 1;
+ return 0;
fail_async_pd:
dma_pool_free(ha->s_dma_pool, ha->ex_init_cb, ha->ex_init_cb_dma);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 090/158] SCSI: arcmsr: upper 32 of dma address lost
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 089/158] SCSI: qla2xxx: fix error handling of qla2x00_mem_alloc() Greg Kroah-Hartman
@ 2014-05-04 15:39 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 091/158] iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug Greg Kroah-Hartman
` (69 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, James Bottomley
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit e2c70425f05219b142b3a8a9489a622c736db39d upstream.
The original code always set the upper 32 bits to zero because it was
doing a shift of the wrong variable.
Fixes: 1a4f550a09f8 ('[SCSI] arcmsr: 1.20.00.15: add SATA RAID plus other fixes')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/arcmsr/arcmsr_hba.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -2500,16 +2500,15 @@ static int arcmsr_polling_ccbdone(struct
static int arcmsr_iop_confirm(struct AdapterControlBlock *acb)
{
uint32_t cdb_phyaddr, cdb_phyaddr_hi32;
- dma_addr_t dma_coherent_handle;
+
/*
********************************************************************
** here we need to tell iop 331 our freeccb.HighPart
** if freeccb.HighPart is not zero
********************************************************************
*/
- dma_coherent_handle = acb->dma_coherent_handle;
- cdb_phyaddr = (uint32_t)(dma_coherent_handle);
- cdb_phyaddr_hi32 = (uint32_t)((cdb_phyaddr >> 16) >> 16);
+ cdb_phyaddr = lower_32_bits(acb->dma_coherent_handle);
+ cdb_phyaddr_hi32 = upper_32_bits(acb->dma_coherent_handle);
acb->cdb_phyaddr_hi32 = cdb_phyaddr_hi32;
/*
***********************************************************************
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 091/158] iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2014-05-04 15:39 ` [PATCH 3.14 090/158] SCSI: arcmsr: upper 32 of dma address lost Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 092/158] target/rd: T10-Dif: RAM disk is allocating more space than required Greg Kroah-Hartman
` (68 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arshad Hussain, santosh kulkarni,
Nicholas Bellinger
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit d444edc679e7713412f243b792b1f964e5cff1e1 upstream.
This patch fixes a long-standing bug in iscsit_build_conn_drop_async_message()
where during ERL=2 connection recovery, a bogus conn_p pointer could
end up being used to send the ISCSI_OP_ASYNC_EVENT + DROPPING_CONNECTION
notifying the initiator that cmd->logout_cid has failed.
The bug was manifesting itself as an OOPs in iscsit_allocate_cmd() with
a bogus conn_p pointer in iscsit_build_conn_drop_async_message().
Reported-by: Arshad Hussain <arshad.hussain@calsoftinc.com>
Reported-by: santosh kulkarni <santosh.kulkarni@calsoftinc.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/iscsi/iscsi_target.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -2468,6 +2468,7 @@ static void iscsit_build_conn_drop_async
{
struct iscsi_cmd *cmd;
struct iscsi_conn *conn_p;
+ bool found = false;
/*
* Only send a Asynchronous Message on connections whos network
@@ -2476,11 +2477,12 @@ static void iscsit_build_conn_drop_async
list_for_each_entry(conn_p, &conn->sess->sess_conn_list, conn_list) {
if (conn_p->conn_state == TARG_CONN_STATE_LOGGED_IN) {
iscsit_inc_conn_usage_count(conn_p);
+ found = true;
break;
}
}
- if (!conn_p)
+ if (!found)
return;
cmd = iscsit_allocate_cmd(conn_p, TASK_RUNNING);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 092/158] target/rd: T10-Dif: RAM disk is allocating more space than required.
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 091/158] iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 093/158] Target/sbc: Initialize COMPARE_AND_WRITE write_sg scatterlist Greg Kroah-Hartman
` (67 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Giridhar Malavali, Quinn Tran,
Nicholas Bellinger
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <quinn.tran@qlogic.com>
commit 9d2e59f2a778328a41771fe9a0098dadbc4314ba upstream.
Ram disk is allocating 8x more space than required for diff data.
For large RAM disk test, there is small potential for memory
starvation.
(Use block_size when calculating total_sg_needed - sagi + nab)
Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: Quinn Tran <quinn.tran@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/target_core_rd.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/target/target_core_rd.c
+++ b/drivers/target/target_core_rd.c
@@ -242,7 +242,7 @@ static void rd_release_prot_space(struct
rd_dev->sg_prot_count = 0;
}
-static int rd_build_prot_space(struct rd_dev *rd_dev, int prot_length)
+static int rd_build_prot_space(struct rd_dev *rd_dev, int prot_length, int block_size)
{
struct rd_dev_sg_table *sg_table;
u32 total_sg_needed, sg_tables;
@@ -252,8 +252,13 @@ static int rd_build_prot_space(struct rd
if (rd_dev->rd_flags & RDF_NULLIO)
return 0;
-
- total_sg_needed = rd_dev->rd_page_count / prot_length;
+ /*
+ * prot_length=8byte dif data
+ * tot sg needed = rd_page_count * (PGSZ/block_size) *
+ * (prot_length/block_size) + pad
+ * PGSZ canceled each other.
+ */
+ total_sg_needed = (rd_dev->rd_page_count * prot_length / block_size) + 1;
sg_tables = (total_sg_needed / max_sg_per_table) + 1;
@@ -606,7 +611,8 @@ static int rd_init_prot(struct se_device
if (!dev->dev_attrib.pi_prot_type)
return 0;
- return rd_build_prot_space(rd_dev, dev->prot_length);
+ return rd_build_prot_space(rd_dev, dev->prot_length,
+ dev->dev_attrib.block_size);
}
static void rd_free_prot(struct se_device *dev)
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 093/158] Target/sbc: Initialize COMPARE_AND_WRITE write_sg scatterlist
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 092/158] target/rd: T10-Dif: RAM disk is allocating more space than required Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 094/158] target/iblock: Fix double bioset_integrity_free bug Greg Kroah-Hartman
` (66 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin Svec, Nicholas Bellinger
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Svec <martin.svec@zoner.cz>
commit a1e1774c6dfa3a524dd8df51ca95185fe5ef3247 upstream.
When compiled with CONFIG_DEBUG_SG set, uninitialized SGL leads
to BUG() in compare_and_write_callback().
Signed-off-by: Martin Svec <martin.svec@zoner.cz>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/target_core_sbc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -425,13 +425,14 @@ static sense_reason_t compare_and_write_
goto out;
}
- write_sg = kzalloc(sizeof(struct scatterlist) * cmd->t_data_nents,
+ write_sg = kmalloc(sizeof(struct scatterlist) * cmd->t_data_nents,
GFP_KERNEL);
if (!write_sg) {
pr_err("Unable to allocate compare_and_write sg\n");
ret = TCM_OUT_OF_RESOURCES;
goto out;
}
+ sg_init_table(write_sg, cmd->t_data_nents);
/*
* Setup verify and write data payloads from total NumberLBAs.
*/
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 094/158] target/iblock: Fix double bioset_integrity_free bug
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 093/158] Target/sbc: Initialize COMPARE_AND_WRITE write_sg scatterlist Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 095/158] target/tcm_fc: Fix use-after-free of ft_tpg Greg Kroah-Hartman
` (65 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sagi Grimberg, Martin K. Petersen,
Or Gerlitz, Quinn Tran, Giridhar Malavali, Nicholas Bellinger
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit d84287bcfe624697cd4f3c1df746beb53b86d9c4 upstream.
This patch fixes a double free bug during IBLOCK backend shutdown
where bioset_integrity_free() was incorrectly called ahead of
bioset_free(), who is already making the same call directly.
This bug was introduced with commit ecebbf6cc, and will end up
triggering a general protection fault in iblock_free_device()
Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Or Gerlitz <ogerlitz@mellanox.com>
Cc: Quinn Tran <quinn.tran@qlogic.com>
Cc: Giridhar Malavali <giridhar.malavali@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/target_core_iblock.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -203,10 +203,9 @@ static void iblock_free_device(struct se
if (ib_dev->ibd_bd != NULL)
blkdev_put(ib_dev->ibd_bd, FMODE_WRITE|FMODE_READ|FMODE_EXCL);
- if (ib_dev->ibd_bio_set != NULL) {
- bioset_integrity_free(ib_dev->ibd_bio_set);
+ if (ib_dev->ibd_bio_set != NULL)
bioset_free(ib_dev->ibd_bio_set);
- }
+
kfree(ib_dev);
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 095/158] target/tcm_fc: Fix use-after-free of ft_tpg
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (93 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 094/158] target/iblock: Fix double bioset_integrity_free bug Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 096/158] Drivers: hv: vmbus: Negotiate version 3.0 when running on ws2012r2 hosts Greg Kroah-Hartman
` (64 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andy Grover, Nicholas Bellinger
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Grover <agrover@redhat.com>
commit 2c42be2dd4f6586728dba5c4e197afd5cfaded78 upstream.
ft_del_tpg checks tpg->tport is set before unlinking the tpg from the
tport when the tpg is being removed. Set this pointer in ft_tport_create,
or the unlinking won't happen in ft_del_tpg and tport->tpg will reference
a deleted object.
This patch sets tpg->tport in ft_tport_create, because that's what
ft_del_tpg checks, and is the only way to get back to the tport to
clear tport->tpg.
The bug was occuring when:
- lport created, tport (our per-lport, per-provider context) is
allocated.
tport->tpg = NULL
- tpg created
- a PRLI is received. ft_tport_create is called, tpg is found and
tport->tpg is set
- tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg->tport was not
set, tport->tpg is not cleared and points at freed memory
- Future calls to ft_tport_create return tport via first conditional,
instead of searching for new tpg by calling ft_lport_find_tpg.
tport->tpg is still invalid, and will access freed memory.
see https://bugzilla.redhat.com/show_bug.cgi?id=1071340
Signed-off-by: Andy Grover <agrover@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/tcm_fc/tfc_sess.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -68,6 +68,7 @@ static struct ft_tport *ft_tport_create(
if (tport) {
tport->tpg = tpg;
+ tpg->tport = tport;
return tport;
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 096/158] Drivers: hv: vmbus: Negotiate version 3.0 when running on ws2012r2 hosts
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (94 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 095/158] target/tcm_fc: Fix use-after-free of ft_tpg Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 097/158] x86/efi: Correct EFI boot stub use of code32_start Greg Kroah-Hartman
` (63 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, K. Y. Srinivasan
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "K. Y. Srinivasan" <kys@microsoft.com>
commit 03367ef5ea811475187a0732aada068919e14d61 upstream.
Only ws2012r2 hosts support the ability to reconnect to the host on VMBUS. This functionality
is needed by kexec in Linux. To use this functionality we need to negotiate version 3.0 of the
VMBUS protocol.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hv/connection.c | 5 ++++-
include/linux/hyperv.h | 4 +++-
2 files changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/hv/connection.c
+++ b/drivers/hv/connection.c
@@ -55,6 +55,9 @@ static __u32 vmbus_get_next_version(__u3
case (VERSION_WIN8):
return VERSION_WIN7;
+ case (VERSION_WIN8_1):
+ return VERSION_WIN8;
+
case (VERSION_WS2008):
default:
return VERSION_INVAL;
@@ -77,7 +80,7 @@ static int vmbus_negotiate_version(struc
msg->interrupt_page = virt_to_phys(vmbus_connection.int_page);
msg->monitor_page1 = virt_to_phys(vmbus_connection.monitor_pages[0]);
msg->monitor_page2 = virt_to_phys(vmbus_connection.monitor_pages[1]);
- if (version == VERSION_WIN8)
+ if (version == VERSION_WIN8_1)
msg->target_vcpu = hv_context.vp_index[smp_processor_id()];
/*
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -464,15 +464,17 @@ hv_get_ringbuffer_availbytes(struct hv_r
* 0 . 13 (Windows Server 2008)
* 1 . 1 (Windows 7)
* 2 . 4 (Windows 8)
+ * 3 . 0 (Windows 8 R2)
*/
#define VERSION_WS2008 ((0 << 16) | (13))
#define VERSION_WIN7 ((1 << 16) | (1))
#define VERSION_WIN8 ((2 << 16) | (4))
+#define VERSION_WIN8_1 ((3 << 16) | (0))
#define VERSION_INVAL -1
-#define VERSION_CURRENT VERSION_WIN8
+#define VERSION_CURRENT VERSION_WIN8_1
/* Make maximum size of pipe payload of 16K */
#define MAX_PIPE_DATA_PAYLOAD (sizeof(u8) * 16384)
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 097/158] x86/efi: Correct EFI boot stub use of code32_start
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (95 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 096/158] Drivers: hv: vmbus: Negotiate version 3.0 when running on ws2012r2 hosts Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 098/158] efi: Pass correct file handle to efi_file_{read,close} Greg Kroah-Hartman
` (62 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Bächler, Matt Fleming
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fleming <matt@console-pimps.org>
commit 7e8213c1f3acc064aef37813a39f13cbfe7c3ce7 upstream.
code32_start should point at the start of the protected mode code, and
*not* at the beginning of the bzImage. This is much easier to do in
assembly so document that callers of make_boot_params() need to fill out
code32_start.
The fallout from this bug is that we would end up relocating the image
but copying the image at some offset, resulting in what appeared to be
memory corruption.
Reported-by: Thomas Bächler <thomas@archlinux.org>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/boot/compressed/eboot.c | 5 +++--
arch/x86/boot/compressed/head_32.S | 14 ++++++++------
arch/x86/boot/compressed/head_64.S | 9 +++------
3 files changed, 14 insertions(+), 14 deletions(-)
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -425,6 +425,9 @@ void setup_graphics(struct boot_params *
* Because the x86 boot code expects to be passed a boot_params we
* need to create one ourselves (usually the bootloader would create
* one for us).
+ *
+ * The caller is responsible for filling out ->code32_start in the
+ * returned boot_params.
*/
struct boot_params *make_boot_params(void *handle, efi_system_table_t *_table)
{
@@ -483,8 +486,6 @@ struct boot_params *make_boot_params(voi
hdr->vid_mode = 0xffff;
hdr->boot_flag = 0xAA55;
- hdr->code32_start = (__u64)(unsigned long)image->image_base;
-
hdr->type_of_loader = 0x21;
/* Convert unicode cmdline to ascii */
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -50,6 +50,13 @@ ENTRY(efi_pe_entry)
pushl %eax
pushl %esi
pushl %ecx
+
+ call reloc
+reloc:
+ popl %ecx
+ subl reloc, %ecx
+ movl %ecx, BP_code32_start(%eax)
+
sub $0x4, %esp
ENTRY(efi_stub_entry)
@@ -63,12 +70,7 @@ ENTRY(efi_stub_entry)
hlt
jmp 1b
2:
- call 3f
-3:
- popl %eax
- subl $3b, %eax
- subl BP_pref_address(%esi), %eax
- add BP_code32_start(%esi), %eax
+ movl BP_code32_start(%esi), %eax
leal preferred_addr(%eax), %eax
jmp *%eax
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -217,6 +217,8 @@ ENTRY(efi_pe_entry)
cmpq $0,%rax
je 1f
mov %rax, %rdx
+ leaq startup_32(%rip), %rax
+ movl %eax, BP_code32_start(%rdx)
popq %rsi
popq %rdi
@@ -230,12 +232,7 @@ ENTRY(efi_stub_entry)
hlt
jmp 1b
2:
- call 3f
-3:
- popq %rax
- subq $3b, %rax
- subq BP_pref_address(%rsi), %rax
- add BP_code32_start(%esi), %eax
+ movl BP_code32_start(%esi), %eax
leaq preferred_addr(%rax), %rax
jmp *%rax
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 098/158] efi: Pass correct file handle to efi_file_{read,close}
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (96 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 097/158] x86/efi: Correct EFI boot stub use of code32_start Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 099/158] word-at-a-time: avoid undefined behaviour in zero_bytemask macro Greg Kroah-Hartman
` (61 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Olivier Martin, Mark Rutland,
Leif Lindholm, Matt Fleming
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fleming <matt.fleming@intel.com>
commit 47514c996fac5e6f13ef3a4c5e23f1c5cffabb7b upstream.
We're currently passing the file handle for the root file system to
efi_file_read() and efi_file_close(), instead of the file handle for the
file we wish to read/close.
While this has worked up until now, it seems that it has only been by
pure luck. Olivier explains,
"The issue is the UEFI Fat driver might return the same function for
'fh->read()' and 'h->read()'. While in our case it does not work with
a different implementation of EFI_SIMPLE_FILE_SYSTEM_PROTOCOL. In our
case, we return a different pointer when reading a directory and
reading a file."
Fixing this actually clears up the two functions because we can drop one
of the arguments, and instead only pass a file 'handle' argument.
Reported-by: Olivier Martin <olivier.martin@arm.com>
Reviewed-by: Olivier Martin <olivier.martin@arm.com>
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Cc: Leif Lindholm <leif.lindholm@linaro.org>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/efi/efi-stub-helper.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/firmware/efi/efi-stub-helper.c
+++ b/drivers/firmware/efi/efi-stub-helper.c
@@ -468,7 +468,7 @@ grow:
chunksize = EFI_READ_CHUNK_SIZE;
else
chunksize = size;
- status = efi_call_phys3(fh->read,
+ status = efi_call_phys3(files[j].handle->read,
files[j].handle,
&chunksize,
(void *)addr);
@@ -480,7 +480,7 @@ grow:
size -= chunksize;
}
- efi_call_phys1(fh->close, files[j].handle);
+ efi_call_phys1(files[j].handle->close, files[j].handle);
}
}
@@ -497,7 +497,7 @@ free_file_total:
close_handles:
for (k = j; k < i; k++)
- efi_call_phys1(fh->close, files[k].handle);
+ efi_call_phys1(files[k].handle->close, files[k].handle);
free_files:
efi_call_phys1(sys_table_arg->boottime->free_pool, files);
fail:
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 099/158] word-at-a-time: avoid undefined behaviour in zero_bytemask macro
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (97 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 098/158] efi: Pass correct file handle to efi_file_{read,close} Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 100/158] arm64: __NR_compat_syscalls fix Greg Kroah-Hartman
` (60 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Victor Kamensky, Will Deacon, Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit ec6931b281797b69e6cf109f9cc94d5a2bf994e0 upstream.
The asm-generic, big-endian version of zero_bytemask creates a mask of
bytes preceding the first zero-byte by left shifting ~0ul based on the
position of the first zero byte.
Unfortunately, if the first (top) byte is zero, the output of
prep_zero_mask has only the top bit set, resulting in undefined C
behaviour as we shift left by an amount equal to the width of the type.
As it happens, GCC doesn't manage to spot this through the call to fls(),
but the issue remains if architectures choose to implement their shift
instructions differently.
An example would be arch/arm/ (AArch32), where LSL Rd, Rn, #32 results
in Rd == 0x0, whilst on arch/arm64 (AArch64) LSL Xd, Xn, #64 results in
Xd == Xn.
Rather than check explicitly for the problematic shift, this patch adds
an extra shift by 1, replacing fls with __fls. Since zero_bytemask is
never called with a zero argument (has_zero() is used to check the data
first), we don't need to worry about calling __fls(0), which is
undefined.
Cc: Victor Kamensky <victor.kamensky@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/asm-generic/word-at-a-time.h | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
--- a/include/asm-generic/word-at-a-time.h
+++ b/include/asm-generic/word-at-a-time.h
@@ -50,11 +50,7 @@ static inline bool has_zero(unsigned lon
}
#ifndef zero_bytemask
-#ifdef CONFIG_64BIT
-#define zero_bytemask(mask) (~0ul << fls64(mask))
-#else
-#define zero_bytemask(mask) (~0ul << fls(mask))
-#endif /* CONFIG_64BIT */
-#endif /* zero_bytemask */
+#define zero_bytemask(mask) (~0ul << __fls(mask) << 1)
+#endif
#endif /* _ASM_WORD_AT_A_TIME_H */
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 100/158] arm64: __NR_compat_syscalls fix
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (98 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 099/158] word-at-a-time: avoid undefined behaviour in zero_bytemask macro Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 101/158] DRM: armada: fix corruption while loading cursors Greg Kroah-Hartman
` (59 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miklos Szeredi, Catalin Marinas
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@suse.cz>
commit 838977f0178334bf3d7f3e974ea3154b68979be0 upstream.
This fixes commit 6290b53de025 (arm64: compat: Wire up new AArch32 syscalls)
which did not update __NR_compat_syscalls accordingly.
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/unistd32.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/include/asm/unistd32.h
+++ b/arch/arm64/include/asm/unistd32.h
@@ -404,7 +404,7 @@ __SYSCALL(379, sys_finit_module)
__SYSCALL(380, sys_sched_setattr)
__SYSCALL(381, sys_sched_getattr)
-#define __NR_compat_syscalls 379
+#define __NR_compat_syscalls 382
/*
* Compat syscall numbers used by the AArch64 kernel.
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 101/158] DRM: armada: fix corruption while loading cursors
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (99 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 100/158] arm64: __NR_compat_syscalls fix Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 102/158] reiserfs: fix race in readdir Greg Kroah-Hartman
` (58 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Russell King, Dave Airlie
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <rmk+kernel@arm.linux.org.uk>
commit c39b06951f1dc2e384650288676c5b7dcc0ec92c upstream.
Loading cursors to the LCD controller's SRAM can be corrupted when the
configured pixel clock is relatively slow. This seems to be caused
when we write back-to-back to the SRAM registers.
There doesn't appear to be any status register we can read to check
when an access has completed.
Inserting a dummy read between the writes appears to fix the problem.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/armada/armada_crtc.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/armada/armada_crtc.c
+++ b/drivers/gpu/drm/armada/armada_crtc.c
@@ -678,6 +678,7 @@ static void armada_load_cursor_argb(void
base + LCD_SPU_SRAM_WRDAT);
writel_relaxed(addr | SRAM_WRITE,
base + LCD_SPU_SRAM_CTRL);
+ readl_relaxed(base + LCD_SPU_HWC_OVSA_HPXL_VLN);
addr += 1;
if ((addr & 0x00ff) == 0)
addr += 0xf00;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 102/158] reiserfs: fix race in readdir
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (100 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 101/158] DRM: armada: fix corruption while loading cursors Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 103/158] usb: gadget: tcm_usb_gadget: stop format strings Greg Kroah-Hartman
` (57 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jeff Mahoney, Jan Kara
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Mahoney <jeffm@suse.com>
commit 01d8885785a60ae8f4c37b0ed75bdc96d0fc6a44 upstream.
jdm-20004 reiserfs_delete_xattrs: Couldn't delete all xattrs (-2)
The -ENOENT is due to readdir calling dir_emit on the same entry twice.
If the dir_emit callback sleeps and the tree is changed underneath us,
we won't be able to trust deh_offset(deh) anymore. We need to save
next_pos before we might sleep so we can find the next entry.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/reiserfs/dir.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/fs/reiserfs/dir.c
+++ b/fs/reiserfs/dir.c
@@ -125,6 +125,7 @@ int reiserfs_readdir_inode(struct inode
int d_reclen;
char *d_name;
ino_t d_ino;
+ loff_t cur_pos = deh_offset(deh);
if (!de_visible(deh))
/* it is hidden entry */
@@ -196,8 +197,9 @@ int reiserfs_readdir_inode(struct inode
if (local_buf != small_buf) {
kfree(local_buf);
}
- // next entry should be looked for with such offset
- next_pos = deh_offset(deh) + 1;
+
+ /* deh_offset(deh) may be invalid now. */
+ next_pos = cur_pos + 1;
if (item_moved(&tmp_ih, &path_to_entry)) {
set_cpu_key_k_offset(&pos_key,
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 103/158] usb: gadget: tcm_usb_gadget: stop format strings
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (101 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 102/158] reiserfs: fix race in readdir Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 104/158] usb: gadget: atmel_usba: fix crashed during stopping when DEBUG is enabled Greg Kroah-Hartman
` (56 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kees Cook
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
commit aba37fd975f0dd58e025c99c2a79b61b20190831 upstream.
This makes sure that the name coming out of configfs cannot be used
accidentally as a format string.
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/tcm_usb_gadget.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/gadget/tcm_usb_gadget.c
+++ b/drivers/usb/gadget/tcm_usb_gadget.c
@@ -1613,7 +1613,7 @@ static struct se_wwn *usbg_make_tport(
return ERR_PTR(-ENOMEM);
}
tport->tport_wwpn = wwpn;
- snprintf(tport->tport_name, sizeof(tport->tport_name), wnn_name);
+ snprintf(tport->tport_name, sizeof(tport->tport_name), "%s", wnn_name);
return &tport->tport_wwn;
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 104/158] usb: gadget: atmel_usba: fix crashed during stopping when DEBUG is enabled
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (102 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 103/158] usb: gadget: tcm_usb_gadget: stop format strings Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 105/158] usb: gadget: zero: Fix SuperSpeed enumeration for alternate setting 1 Greg Kroah-Hartman
` (55 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexandre Belloni, Gregory CLEMENT,
Felipe Balbi
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory CLEMENT <gregory.clement@free-electrons.com>
commit d8eb6c653ef6b323d630de3c5685478469e248bc upstream.
commit 511f3c5 (usb: gadget: udc-core: fix a regression during gadget driver
unbinding) introduced a crash when DEBUG is enabled.
The debug trace in the atmel_usba_stop function made the assumption that the
driver pointer passed in parameter was not NULL, but since the commit above,
such assumption was no longer always true.
This commit now uses the driver pointer stored in udc which fixes this
issue.
[ balbi@ti.com : improved commit log a bit ]
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/atmel_usba_udc.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/usb/gadget/atmel_usba_udc.c
+++ b/drivers/usb/gadget/atmel_usba_udc.c
@@ -1827,12 +1827,12 @@ static int atmel_usba_stop(struct usb_ga
toggle_bias(0);
usba_writel(udc, CTRL, USBA_DISABLE_MASK);
- udc->driver = NULL;
-
clk_disable_unprepare(udc->hclk);
clk_disable_unprepare(udc->pclk);
- DBG(DBG_GADGET, "unregistered driver `%s'\n", driver->driver.name);
+ DBG(DBG_GADGET, "unregistered driver `%s'\n", udc->driver->driver.name);
+
+ udc->driver = NULL;
return 0;
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 105/158] usb: gadget: zero: Fix SuperSpeed enumeration for alternate setting 1
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (103 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 104/158] usb: gadget: atmel_usba: fix crashed during stopping when DEBUG is enabled Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 106/158] xhci: Prevent runtime pm from autosuspending during initialization Greg Kroah-Hartman
` (54 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Felipe Balbi,
Sebastian Andrzej Siewior, Roger Quadros
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <rogerq@ti.com>
commit 9c1b70361e0b38e4acb8e62b54da66538cb77ff2 upstream.
It was impossible to enumerate on a SuperSpeed (XHCI) host
with alternate setting = 1 due to the wrongly set 'bMaxBurst'
field in the SuperSpeed Endpoint Companion descriptor.
Testcase:
<host> modprobe -r usbtest; modprobe usbtest alt=1
<device> modprobe g_zero
plug device to SuperSpeed port on the host.
Without this patch the host always complains like so
"usb 12-2: Not enough bandwidth for new device state.
usb 12-2: Not enough bandwidth for altsetting 1"
Bug was introduced by commit cf9a08ae in v3.9
Fixes: cf9a08ae5aec (usb: gadget: convert source sink and loopback to
new function interface)
Reviewed-by: Felipe Balbi <balbi@ti.com>
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/zero.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -300,7 +300,7 @@ static int __init zero_bind(struct usb_c
ss_opts->isoc_interval = gzero_options.isoc_interval;
ss_opts->isoc_maxpacket = gzero_options.isoc_maxpacket;
ss_opts->isoc_mult = gzero_options.isoc_mult;
- ss_opts->isoc_maxburst = gzero_options.isoc_maxpacket;
+ ss_opts->isoc_maxburst = gzero_options.isoc_maxburst;
ss_opts->bulk_buflen = gzero_options.bulk_buflen;
func_ss = usb_get_function(func_inst_ss);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 106/158] xhci: Prevent runtime pm from autosuspending during initialization
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (104 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 105/158] usb: gadget: zero: Fix SuperSpeed enumeration for alternate setting 1 Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 107/158] xhci: Switch Intel Lynx Point ports to EHCI on shutdown Greg Kroah-Hartman
` (53 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mathias Nyman, Dan Williams,
Alan Stern, Sarah Sharp
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit bcffae7708eb8352f44dc510b326541fe43a02a4 upstream.
xHCI driver has its own pci probe function that will call usb_hcd_pci_probe
to register its usb-2 bus, and then continue to manually register the
usb-3 bus. usb_hcd_pci_probe does a pm_runtime_put_noidle at the end and
might thus trigger a runtime suspend before the usb-3 bus is ready.
Prevent the runtime suspend by increasing the usage count in the
beginning of xhci_pci_probe, and decrease it once the usb-3 bus is
ready.
xhci-platform driver is not using usb_hcd_pci_probe to set up
busses and should not need to have it's usage count increased during probe.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-pci.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -190,6 +190,10 @@ static int xhci_pci_probe(struct pci_dev
struct usb_hcd *hcd;
driver = (struct hc_driver *)id->driver_data;
+
+ /* Prevent runtime suspending between USB-2 and USB-3 initialization */
+ pm_runtime_get_noresume(&dev->dev);
+
/* Register the USB 2.0 roothub.
* FIXME: USB core must know to register the USB 2.0 roothub first.
* This is sort of silly, because we could just set the HCD driver flags
@@ -199,7 +203,7 @@ static int xhci_pci_probe(struct pci_dev
retval = usb_hcd_pci_probe(dev, id);
if (retval)
- return retval;
+ goto put_runtime_pm;
/* USB 2.0 roothub is stored in the PCI device now. */
hcd = dev_get_drvdata(&dev->dev);
@@ -228,12 +232,17 @@ static int xhci_pci_probe(struct pci_dev
if (xhci->quirks & XHCI_LPM_SUPPORT)
hcd_to_bus(xhci->shared_hcd)->root_hub->lpm_capable = 1;
+ /* USB-2 and USB-3 roothubs initialized, allow runtime pm suspend */
+ pm_runtime_put_noidle(&dev->dev);
+
return 0;
put_usb3_hcd:
usb_put_hcd(xhci->shared_hcd);
dealloc_usb2_hcd:
usb_hcd_pci_remove(dev);
+put_runtime_pm:
+ pm_runtime_put_noidle(&dev->dev);
return retval;
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 107/158] xhci: Switch Intel Lynx Point ports to EHCI on shutdown.
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (105 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 106/158] xhci: Prevent runtime pm from autosuspending during initialization Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 108/158] xhci: extend quirk for Renesas cards Greg Kroah-Hartman
` (52 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Denis Turischev, Mathias Nyman
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Turischev <denis.turischev@compulab.co.il>
commit c09ec25d3684cad74d851c0f028a495999591279 upstream.
The same issue like with Panther Point chipsets. If the USB ports are
switched to xHCI on shutdown, the xHCI host will send a spurious interrupt,
which will wake the system. Some BIOS have work around for this, but not all.
One example is Compulab's mini-desktop, the Intense-PC2.
The bug can be avoided if the USB ports are switched back to EHCI on
shutdown.
This patch should be backported to stable kernels as old as 3.12,
that contain the commit 638298dc66ea36623dbc2757a24fc2c4ab41b016
"xhci: Fix spurious wakeups after S5 on Haswell"
Signed-off-by: Denis Turischev <denis@compulab.co.il>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-pci.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -134,6 +134,8 @@ static void xhci_pci_quirks(struct devic
*/
if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP)
xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+
+ xhci->quirks |= XHCI_SPURIOUS_REBOOT;
}
if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 108/158] xhci: extend quirk for Renesas cards
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (106 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 107/158] xhci: Switch Intel Lynx Point ports to EHCI on shutdown Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 109/158] usb/xhci: fix compilation warning when !CONFIG_PCI && !CONFIG_PM Greg Kroah-Hartman
` (51 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Igor Gnatenko, Mathias Nyman
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Gnatenko <i.gnatenko.brain@gmail.com>
commit 6db249ebefc6bf5c39f35dfaacc046d8ad3ffd70 upstream.
After suspend another Renesas PCI-X USB 3.0 card doesn't work.
[root@fedora-20 ~]# lspci -vmnnd 1912:
Device: 03:00.0
Class: USB controller [0c03]
Vendor: Renesas Technology Corp. [1912]
Device: uPD720202 USB 3.0 Host Controller [0015]
SVendor: Renesas Technology Corp. [1912]
SDevice: uPD720202 USB 3.0 Host Controller [0015]
Rev: 02
ProgIf: 30
This patch should be applied to stable kernel 3.14 that contain
the commit 1aa9578c1a9450fb21501c4f549f5b1edb557e6d
"xhci: Fix resume issues on Renesas chips in Samsung laptops"
Reported-and-tested-by: Anatoly Kharchenko <rfr-bugs@yandex.ru>
Reference: http://redmine.russianfedora.pro/issues/1315
Signed-off-by: Igor Gnatenko <i.gnatenko.brain@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-pci.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -145,9 +145,7 @@ static void xhci_pci_quirks(struct devic
xhci->quirks |= XHCI_TRUST_TX_LENGTH;
}
if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
- pdev->device == 0x0015 &&
- pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG &&
- pdev->subsystem_device == 0xc0cd)
+ pdev->device == 0x0015)
xhci->quirks |= XHCI_RESET_ON_RESUME;
if (pdev->vendor == PCI_VENDOR_ID_VIA)
xhci->quirks |= XHCI_RESET_ON_RESUME;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 109/158] usb/xhci: fix compilation warning when !CONFIG_PCI && !CONFIG_PM
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (107 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 108/158] xhci: extend quirk for Renesas cards Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 110/158] media: uvcvideo: Do not use usb_set_interface on bulk EP Greg Kroah-Hartman
` (50 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Cohen, Mathias Nyman
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Cohen <david.a.cohen@linux.intel.com>
commit 01bb59ebffdec314da8da66266edf29529372f9b upstream.
When CONFIG_PCI and CONFIG_PM are not selected, xhci.c gets this
warning:
drivers/usb/host/xhci.c:409:13: warning: ‘xhci_msix_sync_irqs’ defined
but not used [-Wunused-function]
Instead of creating nested #ifdefs, this patch fixes it by defining the
xHCI PCI stubs as inline.
This warning has been in since 3.2 kernel and was
caused by commit 421aa841a134f6a743111cf44d0c6d3b45e3cf8c
"usb/xhci: hide MSI code behind PCI bars", but wasn't noticed
until 3.13 when a configuration with these options was tried
Signed-off-by: David Cohen <david.a.cohen@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -404,16 +404,16 @@ static int xhci_try_enable_msi(struct us
#else
-static int xhci_try_enable_msi(struct usb_hcd *hcd)
+static inline int xhci_try_enable_msi(struct usb_hcd *hcd)
{
return 0;
}
-static void xhci_cleanup_msix(struct xhci_hcd *xhci)
+static inline void xhci_cleanup_msix(struct xhci_hcd *xhci)
{
}
-static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
+static inline void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
{
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 110/158] media: uvcvideo: Do not use usb_set_interface on bulk EP
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (108 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 109/158] usb/xhci: fix compilation warning when !CONFIG_PCI && !CONFIG_PM Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 111/158] media: videodev2.h: add parenthesis around macro arguments Greg Kroah-Hartman
` (49 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleksij Rempel, Laurent Pinchart,
Mauro Carvalho Chehab
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <linux@rempel-privat.de>
commit b1e43f232698274871e1358c276d7b0242a7d607 upstream.
The UVC specification uses alternate setting selection to notify devices
of stream start/stop. This breaks when using bulk-based devices, as the
video streaming interface has a single alternate setting in that case,
making video stream start and video stream stop events to appear
identical to the device. Bulk-based devices are thus not well supported
by UVC.
The webcam built in the Asus Zenbook UX302LA ignores the set interface
request and will keep the video stream enabled when the driver tries to
stop it. If USB autosuspend is enabled the device will then be suspended
and will crash, requiring a cold reboot.
USB trace capture showed that Windows sends a CLEAR_FEATURE(HALT)
request to the bulk endpoint when stopping the stream instead of
selecting alternate setting 0. The camera then behaves correctly, and
thus seems to require that behaviour.
Replace selection of alternate setting 0 with clearing of the endpoint
halt feature at video stream stop for bulk-based devices. Let's refrain
from blaming Microsoft this time, as it's not clear whether this
Windows-specific but USB-compliant behaviour was specifically developed
to handle bulkd-based UVC devices, or if the camera just took advantage
of it.
Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_video.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -1847,7 +1847,25 @@ int uvc_video_enable(struct uvc_streamin
if (!enable) {
uvc_uninit_video(stream, 1);
- usb_set_interface(stream->dev->udev, stream->intfnum, 0);
+ if (stream->intf->num_altsetting > 1) {
+ usb_set_interface(stream->dev->udev,
+ stream->intfnum, 0);
+ } else {
+ /* UVC doesn't specify how to inform a bulk-based device
+ * when the video stream is stopped. Windows sends a
+ * CLEAR_FEATURE(HALT) request to the video streaming
+ * bulk endpoint, mimic the same behaviour.
+ */
+ unsigned int epnum = stream->header.bEndpointAddress
+ & USB_ENDPOINT_NUMBER_MASK;
+ unsigned int dir = stream->header.bEndpointAddress
+ & USB_ENDPOINT_DIR_MASK;
+ unsigned int pipe;
+
+ pipe = usb_sndbulkpipe(stream->dev->udev, epnum) | dir;
+ usb_clear_halt(stream->dev->udev, pipe);
+ }
+
uvc_queue_enable(&stream->queue, 0);
uvc_video_clock_cleanup(stream);
return 0;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 111/158] media: videodev2.h: add parenthesis around macro arguments
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (109 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 110/158] media: uvcvideo: Do not use usb_set_interface on bulk EP Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 112/158] video: atmel_lcdfb: ensure the hardware is initialized with the correct mode Greg Kroah-Hartman
` (48 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <hverkuil@xs4all.nl>
commit aee786acfc0a12bcd37a1c60f3198fb25cf7181a upstream.
bt->width should be (bt)->width, and same for the other fields.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/uapi/linux/videodev2.h | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/include/uapi/linux/videodev2.h
+++ b/include/uapi/linux/videodev2.h
@@ -1059,14 +1059,14 @@ struct v4l2_bt_timings {
/* A few useful defines to calculate the total blanking and frame sizes */
#define V4L2_DV_BT_BLANKING_WIDTH(bt) \
- (bt->hfrontporch + bt->hsync + bt->hbackporch)
+ ((bt)->hfrontporch + (bt)->hsync + (bt)->hbackporch)
#define V4L2_DV_BT_FRAME_WIDTH(bt) \
- (bt->width + V4L2_DV_BT_BLANKING_WIDTH(bt))
+ ((bt)->width + V4L2_DV_BT_BLANKING_WIDTH(bt))
#define V4L2_DV_BT_BLANKING_HEIGHT(bt) \
- (bt->vfrontporch + bt->vsync + bt->vbackporch + \
- bt->il_vfrontporch + bt->il_vsync + bt->il_vbackporch)
+ ((bt)->vfrontporch + (bt)->vsync + (bt)->vbackporch + \
+ (bt)->il_vfrontporch + (bt)->il_vsync + (bt)->il_vbackporch)
#define V4L2_DV_BT_FRAME_HEIGHT(bt) \
- (bt->height + V4L2_DV_BT_BLANKING_HEIGHT(bt))
+ ((bt)->height + V4L2_DV_BT_BLANKING_HEIGHT(bt))
/** struct v4l2_dv_timings - DV timings
* @type: the type of the timings
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 112/158] video: atmel_lcdfb: ensure the hardware is initialized with the correct mode
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (110 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 111/158] media: videodev2.h: add parenthesis around macro arguments Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 113/158] media: v4l2-dv-timings: add module name, description, license Greg Kroah-Hartman
` (47 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Antoine Ténart,
Alexandre Belloni, Nicolas Ferre, Tomi Valkeinen
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Antoine=20T=C3=A9nart?= <antoine.tenart@free-electrons.com>
commit 7d3477d801808a5037a511cf5a5aae5718e7ecce upstream.
If no driver takeover the atmel_lcdfb, the lcd won't be in a working state
since atmel_lcdfb_set_par() will never be called. Enabling a driver which does,
like fbcon, will call the function and put atmel_lcdfb in a working state.
Fixes: b985172b328a (video: atmel_lcdfb: add device tree suport)
Signed-off-by: Antoine Ténart <antoine.tenart@free-electrons.com>
Reported-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/atmel_lcdfb.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -1298,6 +1298,12 @@ static int __init atmel_lcdfb_probe(stru
goto unregister_irqs;
}
+ ret = atmel_lcdfb_set_par(info);
+ if (ret < 0) {
+ dev_err(dev, "set par failed: %d\n", ret);
+ goto unregister_irqs;
+ }
+
dev_set_drvdata(dev, info);
/*
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 113/158] media: v4l2-dv-timings: add module name, description, license
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (111 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 112/158] video: atmel_lcdfb: ensure the hardware is initialized with the correct mode Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 114/158] media: v4l2-compat-ioctl32: fix wrong VIDIOC_SUBDEV_G/S_EDID32 support Greg Kroah-Hartman
` (46 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <hans.verkuil@cisco.com>
commit c4885ada88e4331f8ac56d14296d0058359db2d7 upstream.
I completely forgot to add them when I made this module. Loading this module
without it will taint the kernel, which is not intended.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/v4l2-dv-timings.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
+++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
@@ -26,6 +26,10 @@
#include <linux/v4l2-dv-timings.h>
#include <media/v4l2-dv-timings.h>
+MODULE_AUTHOR("Hans Verkuil");
+MODULE_DESCRIPTION("V4L2 DV Timings Helper Functions");
+MODULE_LICENSE("GPL");
+
const struct v4l2_dv_timings v4l2_dv_timings_presets[] = {
V4L2_DV_BT_CEA_640X480P59_94,
V4L2_DV_BT_CEA_720X480I59_94,
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 114/158] media: v4l2-compat-ioctl32: fix wrong VIDIOC_SUBDEV_G/S_EDID32 support
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (112 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 113/158] media: v4l2-dv-timings: add module name, description, license Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 115/158] media: m88rs2000: prevent frontend crash on continuous transponder scans Greg Kroah-Hartman
` (45 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Laurent Pinchart,
Mauro Carvalho Chehab
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <hans.verkuil@cisco.com>
commit bc826d6e39fe5f09cbadf8723e9183e6331b586f upstream.
The wrong ioctl numbers were used due to a copy-and-paste error.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -787,8 +787,8 @@ static int put_v4l2_subdev_edid32(struct
#define VIDIOC_DQBUF32 _IOWR('V', 17, struct v4l2_buffer32)
#define VIDIOC_ENUMSTD32 _IOWR('V', 25, struct v4l2_standard32)
#define VIDIOC_ENUMINPUT32 _IOWR('V', 26, struct v4l2_input32)
-#define VIDIOC_SUBDEV_G_EDID32 _IOWR('V', 63, struct v4l2_subdev_edid32)
-#define VIDIOC_SUBDEV_S_EDID32 _IOWR('V', 64, struct v4l2_subdev_edid32)
+#define VIDIOC_SUBDEV_G_EDID32 _IOWR('V', 40, struct v4l2_subdev_edid32)
+#define VIDIOC_SUBDEV_S_EDID32 _IOWR('V', 41, struct v4l2_subdev_edid32)
#define VIDIOC_TRY_FMT32 _IOWR('V', 64, struct v4l2_format32)
#define VIDIOC_G_EXT_CTRLS32 _IOWR('V', 71, struct v4l2_ext_controls32)
#define VIDIOC_S_EXT_CTRLS32 _IOWR('V', 72, struct v4l2_ext_controls32)
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 115/158] media: m88rs2000: prevent frontend crash on continuous transponder scans
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (113 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 114/158] media: v4l2-compat-ioctl32: fix wrong VIDIOC_SUBDEV_G/S_EDID32 support Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 116/158] media: em28xx-audio: fix user counting in snd_em28xx_capture_open() Greg Kroah-Hartman
` (44 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Malcolm Priestley, Michael Krufky,
Mauro Carvalho Chehab
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <tvboxspy@gmail.com>
commit 8272d0a0c0d374a01721e579df6e8add5577132b upstream.
Add m88rs2000_get_tune_settings, min delay of 2000 ms on symbol
rate more than 3000000 and delay of 3000ms less than this.
Adding min delay prevents crashing the frontend on continuous
transponder scans. Other dvb_frontend_tune_settings remain as default.
This makes very little time difference to good channel scans, but slows down
the set frontend where lock can never be achieved i.e. DVB-S2.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb-frontends/m88rs2000.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
--- a/drivers/media/dvb-frontends/m88rs2000.c
+++ b/drivers/media/dvb-frontends/m88rs2000.c
@@ -715,6 +715,22 @@ static int m88rs2000_get_frontend(struct
return 0;
}
+static int m88rs2000_get_tune_settings(struct dvb_frontend *fe,
+ struct dvb_frontend_tune_settings *tune)
+{
+ struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+
+ if (c->symbol_rate > 3000000)
+ tune->min_delay_ms = 2000;
+ else
+ tune->min_delay_ms = 3000;
+
+ tune->step_size = c->symbol_rate / 16000;
+ tune->max_drift = c->symbol_rate / 2000;
+
+ return 0;
+}
+
static int m88rs2000_i2c_gate_ctrl(struct dvb_frontend *fe, int enable)
{
struct m88rs2000_state *state = fe->demodulator_priv;
@@ -766,6 +782,7 @@ static struct dvb_frontend_ops m88rs2000
.set_frontend = m88rs2000_set_frontend,
.get_frontend = m88rs2000_get_frontend,
+ .get_tune_settings = m88rs2000_get_tune_settings,
};
struct dvb_frontend *m88rs2000_attach(const struct m88rs2000_config *config,
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 116/158] media: em28xx-audio: fix user counting in snd_em28xx_capture_open()
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (114 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 115/158] media: m88rs2000: prevent frontend crash on continuous transponder scans Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 117/158] media: m88rs2000: add caps FE_CAN_INVERSION_AUTO Greg Kroah-Hartman
` (43 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Frank Schäfer, Mauro Carvalho Chehab
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Schaefer <fschaefer.oss@googlemail.com>
commit 01ae3b51af7144ea29eb28ba718b65ad59ab9493 upstream.
dev->adev.users always needs to be increased when snd_em28xx_capture_open() is
called and succeeds.
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/em28xx/em28xx-audio.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
--- a/drivers/media/usb/em28xx/em28xx-audio.c
+++ b/drivers/media/usb/em28xx/em28xx-audio.c
@@ -252,7 +252,7 @@ static int snd_em28xx_capture_open(struc
{
struct em28xx *dev = snd_pcm_substream_chip(substream);
struct snd_pcm_runtime *runtime = substream->runtime;
- int ret = 0;
+ int nonblock, ret = 0;
if (!dev) {
em28xx_err("BUG: em28xx can't find device struct."
@@ -265,15 +265,15 @@ static int snd_em28xx_capture_open(struc
dprintk("opening device and trying to acquire exclusive lock\n");
+ nonblock = !!(substream->f_flags & O_NONBLOCK);
+ if (nonblock) {
+ if (!mutex_trylock(&dev->lock))
+ return -EAGAIN;
+ } else
+ mutex_lock(&dev->lock);
+
runtime->hw = snd_em28xx_hw_capture;
if ((dev->alt == 0 || dev->is_audio_only) && dev->adev.users == 0) {
- int nonblock = !!(substream->f_flags & O_NONBLOCK);
-
- if (nonblock) {
- if (!mutex_trylock(&dev->lock))
- return -EAGAIN;
- } else
- mutex_lock(&dev->lock);
if (dev->is_audio_only)
/* vendor audio is on a separate interface */
dev->alt = 1;
@@ -299,11 +299,11 @@ static int snd_em28xx_capture_open(struc
ret = em28xx_audio_analog_set(dev);
if (ret < 0)
goto err;
-
- dev->adev.users++;
- mutex_unlock(&dev->lock);
}
+ dev->adev.users++;
+ mutex_unlock(&dev->lock);
+
/* Dynamically adjust the period size */
snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS);
snd_pcm_hw_constraint_minmax(runtime, SNDRV_PCM_HW_PARAM_PERIOD_BYTES,
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 117/158] media: m88rs2000: add caps FE_CAN_INVERSION_AUTO
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (115 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 116/158] media: em28xx-audio: fix user counting in snd_em28xx_capture_open() Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 118/158] media: em28xx: fix PCTV 290e LNA oops Greg Kroah-Hartman
` (42 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Malcolm Priestley, Michael Krufky,
Mauro Carvalho Chehab
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <tvboxspy@gmail.com>
commit 3c8023a782964c72574ad8268ba0ea4e2d9772fc upstream.
The m88rs2000 frontend is always auto inversion.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb-frontends/m88rs2000.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/dvb-frontends/m88rs2000.c
+++ b/drivers/media/dvb-frontends/m88rs2000.c
@@ -762,7 +762,7 @@ static struct dvb_frontend_ops m88rs2000
.symbol_rate_tolerance = 500, /* ppm */
.caps = FE_CAN_FEC_1_2 | FE_CAN_FEC_2_3 | FE_CAN_FEC_3_4 |
FE_CAN_FEC_5_6 | FE_CAN_FEC_7_8 |
- FE_CAN_QPSK |
+ FE_CAN_QPSK | FE_CAN_INVERSION_AUTO |
FE_CAN_FEC_AUTO
},
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 118/158] media: em28xx: fix PCTV 290e LNA oops
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (116 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 117/158] media: m88rs2000: add caps FE_CAN_INVERSION_AUTO Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 119/158] media: saa7134: fix WARN_ON during resume Greg Kroah-Hartman
` (41 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Janne Kujanpää,
Antti Palosaari, Mauro Carvalho Chehab
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antti Palosaari <crope@iki.fi>
commit 3ec40dcfb413214b2874aec858870502b61c2202 upstream.
Pointer to device state has been moved to different location during
some change. PCTV 290e LNA function still uses old pointer, carried
over FE priv, and it crash.
Reported-by: Janne Kujanpää <jikuja@iki.fi>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/em28xx/em28xx-dvb.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/media/usb/em28xx/em28xx-dvb.c
+++ b/drivers/media/usb/em28xx/em28xx-dvb.c
@@ -693,7 +693,8 @@ static void pctv_520e_init(struct em28xx
static int em28xx_pctv_290e_set_lna(struct dvb_frontend *fe)
{
struct dtv_frontend_properties *c = &fe->dtv_property_cache;
- struct em28xx *dev = fe->dvb->priv;
+ struct em28xx_i2c_bus *i2c_bus = fe->dvb->priv;
+ struct em28xx *dev = i2c_bus->dev;
#ifdef CONFIG_GPIOLIB
struct em28xx_dvb *dvb = dev->dvb;
int ret;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 119/158] media: saa7134: fix WARN_ON during resume
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (117 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 118/158] media: em28xx: fix PCTV 290e LNA oops Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 120/158] media: omap3isp: preview: Fix the crop margins Greg Kroah-Hartman
` (40 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <hans.verkuil@cisco.com>
commit 30d652823de5fd7907d40e969a2d8e23938d8d03 upstream.
Do not attempt to reload the tuner modules when resuming after a suspend.
This triggers a WARN_ON in kernel/kmod.c:148 __request_module.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=69581.
This has always been wrong, but it was never noticed until the WARN_ON
was added in 3.9.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/saa7134/saa7134-cards.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/pci/saa7134/saa7134-cards.c
+++ b/drivers/media/pci/saa7134/saa7134-cards.c
@@ -8045,8 +8045,8 @@ int saa7134_board_init2(struct saa7134_d
break;
} /* switch() */
- /* initialize tuner */
- if (TUNER_ABSENT != dev->tuner_type) {
+ /* initialize tuner (don't do this when resuming) */
+ if (!dev->insuspend && TUNER_ABSENT != dev->tuner_type) {
int has_demod = (dev->tda9887_conf & TDA9887_PRESENT);
/* Note: radio tuner address is always filled in,
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 120/158] media: omap3isp: preview: Fix the crop margins
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (118 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 119/158] media: saa7134: fix WARN_ON during resume Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 121/158] media: media: gspca: sn9c20x: add ID for Genius Look 1320 V2 Greg Kroah-Hartman
` (39 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Vaussard, Laurent Pinchart,
Mauro Carvalho Chehab
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Vaussard <florian.vaussard@epfl.ch>
commit 8b57b9669aa884ac75b8d09c251d6b1755533c15 upstream.
Commit 3fdfedaaa "[media] omap3isp: preview: Lower the crop margins"
accidentally changed the previewer's cropping, causing the previewer
to miss four pixels on each line, thus corrupting the final image.
Restored the removed setting.
Signed-off-by: Florian Vaussard <florian.vaussard@epfl.ch>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/omap3isp/isppreview.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/media/platform/omap3isp/isppreview.c
+++ b/drivers/media/platform/omap3isp/isppreview.c
@@ -1079,6 +1079,7 @@ static void preview_config_input_format(
*/
static void preview_config_input_size(struct isp_prev_device *prev, u32 active)
{
+ const struct v4l2_mbus_framefmt *format = &prev->formats[PREV_PAD_SINK];
struct isp_device *isp = to_isp_device(prev);
unsigned int sph = prev->crop.left;
unsigned int eph = prev->crop.left + prev->crop.width - 1;
@@ -1086,6 +1087,14 @@ static void preview_config_input_size(st
unsigned int elv = prev->crop.top + prev->crop.height - 1;
u32 features;
+ if (format->code != V4L2_MBUS_FMT_Y8_1X8 &&
+ format->code != V4L2_MBUS_FMT_Y10_1X10) {
+ sph -= 2;
+ eph += 2;
+ slv -= 2;
+ elv += 2;
+ }
+
features = (prev->params.params[0].features & active)
| (prev->params.params[1].features & ~active);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 121/158] media: media: gspca: sn9c20x: add ID for Genius Look 1320 V2
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (119 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 120/158] media: omap3isp: preview: Fix the crop margins Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 122/158] usb: dwc3: fix wrong bit mask in dwc3_event_devt Greg Kroah-Hartman
` (38 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wolfram Sang, Hans de Goede,
Mauro Carvalho Chehab
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <wsa@the-dreams.de>
commit 61f0319193c44adbbada920162d880b1fdb3aeb3 upstream.
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/video4linux/gspca.txt | 1 +
drivers/media/usb/gspca/sn9c20x.c | 1 +
2 files changed, 2 insertions(+)
--- a/Documentation/video4linux/gspca.txt
+++ b/Documentation/video4linux/gspca.txt
@@ -55,6 +55,7 @@ zc3xx 0458:700f Genius VideoCam Web V2
sonixj 0458:7025 Genius Eye 311Q
sn9c20x 0458:7029 Genius Look 320s
sonixj 0458:702e Genius Slim 310 NB
+sn9c20x 0458:7045 Genius Look 1320 V2
sn9c20x 0458:704a Genius Slim 1320
sn9c20x 0458:704c Genius i-Look 1321
sn9c20x 045e:00f4 LifeCam VX-6000 (SN9C20x + OV9650)
--- a/drivers/media/usb/gspca/sn9c20x.c
+++ b/drivers/media/usb/gspca/sn9c20x.c
@@ -2359,6 +2359,7 @@ static const struct usb_device_id device
{USB_DEVICE(0x045e, 0x00f4), SN9C20X(OV9650, 0x30, 0)},
{USB_DEVICE(0x145f, 0x013d), SN9C20X(OV7660, 0x21, 0)},
{USB_DEVICE(0x0458, 0x7029), SN9C20X(HV7131R, 0x11, 0)},
+ {USB_DEVICE(0x0458, 0x7045), SN9C20X(MT9M112, 0x5d, LED_REVERSE)},
{USB_DEVICE(0x0458, 0x704a), SN9C20X(MT9M112, 0x5d, 0)},
{USB_DEVICE(0x0458, 0x704c), SN9C20X(MT9M112, 0x5d, 0)},
{USB_DEVICE(0xa168, 0x0610), SN9C20X(HV7131R, 0x11, 0)},
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 122/158] usb: dwc3: fix wrong bit mask in dwc3_event_devt
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (120 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 121/158] media: media: gspca: sn9c20x: add ID for Genius Look 1320 V2 Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 123/158] usb: dwc3: fix randconfig build errors Greg Kroah-Hartman
` (37 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Huang Rui, Felipe Balbi
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Rui <ray.huang@amd.com>
commit 06f9b6e59661cee510b04513b13ea7927727d758 upstream.
Around DWC USB3 2.30a release another bit has been added to the
Device-Specific Event (DEVT) Event Information (EvtInfo) bitfield.
Because of that, what used to be 8 bits long, has become 9 bits long.
Per dwc3 2.30a+ spec in the Device-Specific Event (DEVT), the field of
Event Information Bits(EvtInfo) uses [24:16] bits, and it has 9 bits
not 8 bits. And the following reserved field uses [31:25] bits not
[31:24] bits, and it has 7 bits.
So in dwc3_event_devt, the bit mask should be:
event_info [24:16] 9 bits
reserved31_25 [31:25] 7 bits
This patch makes sure that newer core releases will work fine with
Linux and that we will decode the event information properly on new
core releases.
[ balbi@ti.com : improve commit log a bit ]
Signed-off-by: Huang Rui <ray.huang@amd.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/core.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -815,15 +815,15 @@ struct dwc3_event_depevt {
* 12 - VndrDevTstRcved
* @reserved15_12: Reserved, not used
* @event_info: Information about this event
- * @reserved31_24: Reserved, not used
+ * @reserved31_25: Reserved, not used
*/
struct dwc3_event_devt {
u32 one_bit:1;
u32 device_event:7;
u32 type:4;
u32 reserved15_12:4;
- u32 event_info:8;
- u32 reserved31_24:8;
+ u32 event_info:9;
+ u32 reserved31_25:7;
} __packed;
/**
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 123/158] usb: dwc3: fix randconfig build errors
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (121 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 122/158] usb: dwc3: fix wrong bit mask in dwc3_event_devt Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 124/158] usb: musb: avoid NULL pointer dereference Greg Kroah-Hartman
` (36 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jim Davis, Felipe Balbi
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <balbi@ti.com>
commit 610183051d8f9421f138c4203ca894387f9f8839 upstream.
commit 388e5c5 (usb: dwc3: remove dwc3 dependency
on host AND gadget.) created the possibility for
host-only and peripheral-only dwc3 builds but
left a possible randconfig build error when host-only
builds are selected.
Reported-by: Jim Davis <jim.epost@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/core.h | 33 +++++++++++++++++++++++++++++++++
drivers/usb/dwc3/gadget.h | 12 ------------
2 files changed, 33 insertions(+), 12 deletions(-)
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -856,6 +856,19 @@ union dwc3_event {
struct dwc3_event_gevt gevt;
};
+/**
+ * struct dwc3_gadget_ep_cmd_params - representation of endpoint command
+ * parameters
+ * @param2: third parameter
+ * @param1: second parameter
+ * @param0: first parameter
+ */
+struct dwc3_gadget_ep_cmd_params {
+ u32 param2;
+ u32 param1;
+ u32 param0;
+};
+
/*
* DWC3 Features to be used as Driver Data
*/
@@ -881,11 +894,31 @@ static inline void dwc3_host_exit(struct
#if IS_ENABLED(CONFIG_USB_DWC3_GADGET) || IS_ENABLED(CONFIG_USB_DWC3_DUAL_ROLE)
int dwc3_gadget_init(struct dwc3 *dwc);
void dwc3_gadget_exit(struct dwc3 *dwc);
+int dwc3_gadget_set_test_mode(struct dwc3 *dwc, int mode);
+int dwc3_gadget_get_link_state(struct dwc3 *dwc);
+int dwc3_gadget_set_link_state(struct dwc3 *dwc, enum dwc3_link_state state);
+int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
+ unsigned cmd, struct dwc3_gadget_ep_cmd_params *params);
+int dwc3_send_gadget_generic_command(struct dwc3 *dwc, int cmd, u32 param);
#else
static inline int dwc3_gadget_init(struct dwc3 *dwc)
{ return 0; }
static inline void dwc3_gadget_exit(struct dwc3 *dwc)
{ }
+static inline int dwc3_gadget_set_test_mode(struct dwc3 *dwc, int mode)
+{ return 0; }
+static inline int dwc3_gadget_get_link_state(struct dwc3 *dwc)
+{ return 0; }
+static inline int dwc3_gadget_set_link_state(struct dwc3 *dwc,
+ enum dwc3_link_state state)
+{ return 0; }
+
+static inline int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
+ unsigned cmd, struct dwc3_gadget_ep_cmd_params *params)
+{ return 0; }
+static inline int dwc3_send_gadget_generic_command(struct dwc3 *dwc,
+ int cmd, u32 param)
+{ return 0; }
#endif
/* power management interface */
--- a/drivers/usb/dwc3/gadget.h
+++ b/drivers/usb/dwc3/gadget.h
@@ -56,12 +56,6 @@ struct dwc3;
/* DEPXFERCFG parameter 0 */
#define DWC3_DEPXFERCFG_NUM_XFER_RES(n) ((n) & 0xffff)
-struct dwc3_gadget_ep_cmd_params {
- u32 param2;
- u32 param1;
- u32 param0;
-};
-
/* -------------------------------------------------------------------------- */
#define to_dwc3_request(r) (container_of(r, struct dwc3_request, request))
@@ -85,9 +79,6 @@ static inline void dwc3_gadget_move_requ
void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
int status);
-int dwc3_gadget_set_test_mode(struct dwc3 *dwc, int mode);
-int dwc3_gadget_set_link_state(struct dwc3 *dwc, enum dwc3_link_state state);
-
void dwc3_ep0_interrupt(struct dwc3 *dwc,
const struct dwc3_event_depevt *event);
void dwc3_ep0_out_start(struct dwc3 *dwc);
@@ -95,9 +86,6 @@ int dwc3_gadget_ep0_set_halt(struct usb_
int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request,
gfp_t gfp_flags);
int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value);
-int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
- unsigned cmd, struct dwc3_gadget_ep_cmd_params *params);
-int dwc3_send_gadget_generic_command(struct dwc3 *dwc, int cmd, u32 param);
/**
* dwc3_gadget_ep_get_transfer_index - Gets transfer index from HW
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 124/158] usb: musb: avoid NULL pointer dereference
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (122 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 123/158] usb: dwc3: fix randconfig build errors Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 125/158] usb: musb: fix PHY power on/off Greg Kroah-Hartman
` (35 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Felipe Balbi
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <balbi@ti.com>
commit eee3f15d5f1f4f0c283dd4db67dc1b874a2852d1 upstream.
instead of relying on the otg pointer, which
can be NULL in certain cases, we can use the
gadget and host pointers we already hold inside
struct musb.
Tested-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/musb/musb_core.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -438,7 +438,6 @@ void musb_hnp_stop(struct musb *musb)
static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
u8 devctl)
{
- struct usb_otg *otg = musb->xceiv->otg;
irqreturn_t handled = IRQ_NONE;
dev_dbg(musb->controller, "<== DevCtl=%02x, int_usb=0x%x\n", devctl,
@@ -656,7 +655,7 @@ static irqreturn_t musb_stage0_irq(struc
break;
case OTG_STATE_B_PERIPHERAL:
musb_g_suspend(musb);
- musb->is_active = otg->gadget->b_hnp_enable;
+ musb->is_active = musb->g.b_hnp_enable;
if (musb->is_active) {
musb->xceiv->state = OTG_STATE_B_WAIT_ACON;
dev_dbg(musb->controller, "HNP: Setting timer for b_ase0_brst\n");
@@ -672,7 +671,7 @@ static irqreturn_t musb_stage0_irq(struc
break;
case OTG_STATE_A_HOST:
musb->xceiv->state = OTG_STATE_A_SUSPEND;
- musb->is_active = otg->host->b_hnp_enable;
+ musb->is_active = musb->hcd->self.b_hnp_enable;
break;
case OTG_STATE_B_HOST:
/* Transition to B_PERIPHERAL, see 6.8.2.6 p 44 */
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 125/158] usb: musb: fix PHY power on/off
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (123 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 124/158] usb: musb: avoid NULL pointer dereference Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 126/158] hvc: ensure hvc_init is only ever called once in hvc_console.c Greg Kroah-Hartman
` (34 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Ivaylo Dimitrov,
Michael Scott, Stefan Roese, Rabin Vincent, Felipe Balbi
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <balbi@ti.com>
commit 3063a12be2b07c64e9802708a19489342e64c1a3 upstream.
commi 30a70b0 (usb: musb: fix obex in g_nokia.ko
causing kernel panic) removed phy_power_on()
and phy_power_off() calls from runtime PM callbacks
but it failed to note that the driver depended
on pm_runtime_get_sync() calls to power up the PHY,
thus leaving some platforms without any means to
have a working PHY.
Fix that by enabling the phy during omap2430_musb_init()
and killing it in omap2430_musb_exit().
Fixes: 30a70b0 (usb: musb: fix obex in g_nokia.ko causing kernel panic)
Cc: Pali Rohár <pali.rohar@gmail.com>
Cc: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Reported-by: Michael Scott <hashcode0f@gmail.com>
Tested-by: Michael Scott <hashcode0f@gmail.com>
Tested-by: Stefan Roese <sr@denx.de>
Reported-by: Rabin Vincent <rabin@rab.in>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/musb/omap2430.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -416,6 +416,7 @@ static int omap2430_musb_init(struct mus
omap_musb_set_mailbox(glue);
phy_init(musb->phy);
+ phy_power_on(musb->phy);
pm_runtime_put_noidle(musb->controller);
return 0;
@@ -478,6 +479,7 @@ static int omap2430_musb_exit(struct mus
del_timer_sync(&musb_idle_timer);
omap2430_low_level_exit(musb);
+ phy_power_off(musb->phy);
phy_exit(musb->phy);
return 0;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 126/158] hvc: ensure hvc_init is only ever called once in hvc_console.c
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (124 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 125/158] usb: musb: fix PHY power on/off Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 127/158] usb: phy: Add ulpi IDs for SMSC USB3320 and TI TUSB1210 Greg Kroah-Hartman
` (33 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Rusty Russell, Jim Somerville,
Paul Gortmaker
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Gortmaker <paul.gortmaker@windriver.com>
commit f76a1cbed18c86e2d192455f0daebb48458965f3 upstream.
Commit 3e6c6f630a5282df8f3393a59f10eb9c56536d23 ("Delay creation of
khcvd thread") moved the call of hvc_init from being a device_initcall
into hvc_alloc, and used a non-null hvc_driver as indication of whether
hvc_init had already been called.
The problem with this is that hvc_driver is only assigned a value
at the bottom of hvc_init, and so there is a window where multiple
hvc_alloc calls can be in progress at the same time and hence try
and call hvc_init multiple times. Previously the use of device_init
guaranteed that hvc_init was only called once.
This manifests itself as sporadic instances of two hvc_init calls
racing each other, and with the loser of the race getting -EBUSY
from tty_register_driver() and hence that virtual console fails:
Couldn't register hvc console driver
virtio-ports vport0p1: error -16 allocating hvc for port
Here we add an atomic_t to guarantee we'll never run hvc_init twice.
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fixes: 3e6c6f630a52 ("Delay creation of khcvd thread")
Reported-by: Jim Somerville <Jim.Somerville@windriver.com>
Tested-by: Jim Somerville <Jim.Somerville@windriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/hvc/hvc_console.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/tty/hvc/hvc_console.c
+++ b/drivers/tty/hvc/hvc_console.c
@@ -31,6 +31,7 @@
#include <linux/list.h>
#include <linux/module.h>
#include <linux/major.h>
+#include <linux/atomic.h>
#include <linux/sysrq.h>
#include <linux/tty.h>
#include <linux/tty_flip.h>
@@ -70,6 +71,9 @@ static struct task_struct *hvc_task;
/* Picks up late kicks after list walk but before schedule() */
static int hvc_kicked;
+/* hvc_init is triggered from hvc_alloc, i.e. only when actually used */
+static atomic_t hvc_needs_init __read_mostly = ATOMIC_INIT(-1);
+
static int hvc_init(void);
#ifdef CONFIG_MAGIC_SYSRQ
@@ -851,7 +855,7 @@ struct hvc_struct *hvc_alloc(uint32_t vt
int i;
/* We wait until a driver actually comes along */
- if (!hvc_driver) {
+ if (atomic_inc_not_zero(&hvc_needs_init)) {
int err = hvc_init();
if (err)
return ERR_PTR(err);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 127/158] usb: phy: Add ulpi IDs for SMSC USB3320 and TI TUSB1210
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (125 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 126/158] hvc: ensure hvc_init is only ever called once in hvc_console.c Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 128/158] usb: phy: am335x-control: wait 1ms after power-up transitions Greg Kroah-Hartman
` (32 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michal Simek
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Simek <michal.simek@xilinx.com>
commit ead5178bf442dbae4008ee54bf4f66a1f6a317c9 upstream.
Add new ulpi IDs which are available on Xilinx Zynq boards.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/phy/phy-ulpi.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/phy/phy-ulpi.c
+++ b/drivers/usb/phy/phy-ulpi.c
@@ -47,6 +47,8 @@ struct ulpi_info {
static struct ulpi_info ulpi_ids[] = {
ULPI_INFO(ULPI_ID(0x04cc, 0x1504), "NXP ISP1504"),
ULPI_INFO(ULPI_ID(0x0424, 0x0006), "SMSC USB331x"),
+ ULPI_INFO(ULPI_ID(0x0424, 0x0007), "SMSC USB3320"),
+ ULPI_INFO(ULPI_ID(0x0451, 0x1507), "TI TUSB1210"),
};
static int ulpi_set_otg_flags(struct usb_phy *phy)
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 128/158] usb: phy: am335x-control: wait 1ms after power-up transitions
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (126 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 127/158] usb: phy: Add ulpi IDs for SMSC USB3320 and TI TUSB1210 Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 129/158] USB: unbind all interfaces before rebinding any Greg Kroah-Hartman
` (31 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Daniel Mack, Felipe Balbi
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Mack <zonque@gmail.com>
commit a31a942a148e0083ce560ffeb54fb60e06ab7201 upstream.
Tests have shown that when a power-up transition is followed by other
PHY operations too quickly, the USB port appears dead. Waiting 1ms fixes
this problem.
Signed-off-by: Daniel Mack <zonque@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/phy/phy-am335x-control.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/usb/phy/phy-am335x-control.c
+++ b/drivers/usb/phy/phy-am335x-control.c
@@ -3,6 +3,7 @@
#include <linux/err.h>
#include <linux/of.h>
#include <linux/io.h>
+#include <linux/delay.h>
#include "am35x-phy-control.h"
struct am335x_control_usb {
@@ -86,6 +87,14 @@ static void am335x_phy_power(struct phy_
}
writel(val, usb_ctrl->phy_reg + reg);
+
+ /*
+ * Give the PHY ~1ms to complete the power up operation.
+ * Tests have shown unstable behaviour if other USB PHY related
+ * registers are written too shortly after such a transition.
+ */
+ if (on)
+ mdelay(1);
}
static const struct phy_control ctrl_am335x = {
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 129/158] USB: unbind all interfaces before rebinding any
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (127 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 128/158] usb: phy: am335x-control: wait 1ms after power-up transitions Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 130/158] mtip32xx: Set queue bounce limit Greg Kroah-Hartman
` (30 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alan Stern
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 6aec044cc2f5670cf3b143c151c8be846499bd15 upstream.
When a driver doesn't have pre_reset, post_reset, or reset_resume
methods, the USB core unbinds that driver when its device undergoes a
reset or a reset-resume, and then rebinds it afterward.
The existing straightforward implementation can lead to problems,
because each interface gets unbound and rebound before the next
interface is handled. If a driver claims additional interfaces, the
claim may fail because the old binding instance may still own the
additional interface when the new instance tries to claim it.
This patch fixes the problem by first unbinding all the interfaces
that are marked (i.e., their needs_binding flag is set) and then
rebinding all of them.
The patch also makes the helper functions in driver.c a little more
uniform and adjusts some out-of-date comments.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: "Poulain, Loic" <loic.poulain@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/driver.c | 94 +++++++++++++++++++++++++++-------------------
drivers/usb/core/hub.c | 5 +-
drivers/usb/core/usb.h | 2
3 files changed, 60 insertions(+), 41 deletions(-)
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -990,8 +990,7 @@ EXPORT_SYMBOL_GPL(usb_deregister);
* it doesn't support pre_reset/post_reset/reset_resume or
* because it doesn't support suspend/resume.
*
- * The caller must hold @intf's device's lock, but not its pm_mutex
- * and not @intf->dev.sem.
+ * The caller must hold @intf's device's lock, but not @intf's lock.
*/
void usb_forced_unbind_intf(struct usb_interface *intf)
{
@@ -1004,16 +1003,37 @@ void usb_forced_unbind_intf(struct usb_i
intf->needs_binding = 1;
}
+/*
+ * Unbind drivers for @udev's marked interfaces. These interfaces have
+ * the needs_binding flag set, for example by usb_resume_interface().
+ *
+ * The caller must hold @udev's device lock.
+ */
+static void unbind_marked_interfaces(struct usb_device *udev)
+{
+ struct usb_host_config *config;
+ int i;
+ struct usb_interface *intf;
+
+ config = udev->actconfig;
+ if (config) {
+ for (i = 0; i < config->desc.bNumInterfaces; ++i) {
+ intf = config->interface[i];
+ if (intf->dev.driver && intf->needs_binding)
+ usb_forced_unbind_intf(intf);
+ }
+ }
+}
+
/* Delayed forced unbinding of a USB interface driver and scan
* for rebinding.
*
- * The caller must hold @intf's device's lock, but not its pm_mutex
- * and not @intf->dev.sem.
+ * The caller must hold @intf's device's lock, but not @intf's lock.
*
* Note: Rebinds will be skipped if a system sleep transition is in
* progress and the PM "complete" callback hasn't occurred yet.
*/
-void usb_rebind_intf(struct usb_interface *intf)
+static void usb_rebind_intf(struct usb_interface *intf)
{
int rc;
@@ -1030,68 +1050,66 @@ void usb_rebind_intf(struct usb_interfac
}
}
-#ifdef CONFIG_PM
-
-/* Unbind drivers for @udev's interfaces that don't support suspend/resume
- * There is no check for reset_resume here because it can be determined
- * only during resume whether reset_resume is needed.
+/*
+ * Rebind drivers to @udev's marked interfaces. These interfaces have
+ * the needs_binding flag set.
*
* The caller must hold @udev's device lock.
*/
-static void unbind_no_pm_drivers_interfaces(struct usb_device *udev)
+static void rebind_marked_interfaces(struct usb_device *udev)
{
struct usb_host_config *config;
int i;
struct usb_interface *intf;
- struct usb_driver *drv;
config = udev->actconfig;
if (config) {
for (i = 0; i < config->desc.bNumInterfaces; ++i) {
intf = config->interface[i];
-
- if (intf->dev.driver) {
- drv = to_usb_driver(intf->dev.driver);
- if (!drv->suspend || !drv->resume)
- usb_forced_unbind_intf(intf);
- }
+ if (intf->needs_binding)
+ usb_rebind_intf(intf);
}
}
}
-/* Unbind drivers for @udev's interfaces that failed to support reset-resume.
- * These interfaces have the needs_binding flag set by usb_resume_interface().
+/*
+ * Unbind all of @udev's marked interfaces and then rebind all of them.
+ * This ordering is necessary because some drivers claim several interfaces
+ * when they are first probed.
*
* The caller must hold @udev's device lock.
*/
-static void unbind_no_reset_resume_drivers_interfaces(struct usb_device *udev)
+void usb_unbind_and_rebind_marked_interfaces(struct usb_device *udev)
{
- struct usb_host_config *config;
- int i;
- struct usb_interface *intf;
-
- config = udev->actconfig;
- if (config) {
- for (i = 0; i < config->desc.bNumInterfaces; ++i) {
- intf = config->interface[i];
- if (intf->dev.driver && intf->needs_binding)
- usb_forced_unbind_intf(intf);
- }
- }
+ unbind_marked_interfaces(udev);
+ rebind_marked_interfaces(udev);
}
-static void do_rebind_interfaces(struct usb_device *udev)
+#ifdef CONFIG_PM
+
+/* Unbind drivers for @udev's interfaces that don't support suspend/resume
+ * There is no check for reset_resume here because it can be determined
+ * only during resume whether reset_resume is needed.
+ *
+ * The caller must hold @udev's device lock.
+ */
+static void unbind_no_pm_drivers_interfaces(struct usb_device *udev)
{
struct usb_host_config *config;
int i;
struct usb_interface *intf;
+ struct usb_driver *drv;
config = udev->actconfig;
if (config) {
for (i = 0; i < config->desc.bNumInterfaces; ++i) {
intf = config->interface[i];
- if (intf->needs_binding)
- usb_rebind_intf(intf);
+
+ if (intf->dev.driver) {
+ drv = to_usb_driver(intf->dev.driver);
+ if (!drv->suspend || !drv->resume)
+ usb_forced_unbind_intf(intf);
+ }
}
}
}
@@ -1420,7 +1438,7 @@ int usb_resume_complete(struct device *d
* whose needs_binding flag is set
*/
if (udev->state != USB_STATE_NOTATTACHED)
- do_rebind_interfaces(udev);
+ rebind_marked_interfaces(udev);
return 0;
}
@@ -1442,7 +1460,7 @@ int usb_resume(struct device *dev, pm_me
pm_runtime_disable(dev);
pm_runtime_set_active(dev);
pm_runtime_enable(dev);
- unbind_no_reset_resume_drivers_interfaces(udev);
+ unbind_marked_interfaces(udev);
}
/* Avoid PM error messages for devices disconnected while suspended
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -5340,10 +5340,11 @@ int usb_reset_device(struct usb_device *
else if (cintf->condition ==
USB_INTERFACE_BOUND)
rebind = 1;
+ if (rebind)
+ cintf->needs_binding = 1;
}
- if (ret == 0 && rebind)
- usb_rebind_intf(cintf);
}
+ usb_unbind_and_rebind_marked_interfaces(udev);
}
usb_autosuspend_device(udev);
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -55,7 +55,7 @@ extern int usb_match_one_id_intf(struct
extern int usb_match_device(struct usb_device *dev,
const struct usb_device_id *id);
extern void usb_forced_unbind_intf(struct usb_interface *intf);
-extern void usb_rebind_intf(struct usb_interface *intf);
+extern void usb_unbind_and_rebind_marked_interfaces(struct usb_device *udev);
extern int usb_hub_claim_port(struct usb_device *hdev, unsigned port,
struct dev_state *owner);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 130/158] mtip32xx: Set queue bounce limit
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (128 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 129/158] USB: unbind all interfaces before rebinding any Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 131/158] mtip32xx: Unmap the DMA segments before completing the IO request Greg Kroah-Hartman
` (29 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felipe Franciosi, Jens Axboe
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Franciosi <felipe@paradoxo.org>
commit 1044b1bb9278f2e656a1a7b63dc24a59506540aa upstream.
We need to set the queue bounce limit during the device initialization to
prevent excessive bouncing on 32 bit architectures.
Signed-off-by: Felipe Franciosi <felipe@paradoxo.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/mtip32xx/mtip32xx.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -4213,6 +4213,7 @@ skip_create_disk:
blk_queue_max_hw_sectors(dd->queue, 0xffff);
blk_queue_max_segment_size(dd->queue, 0x400000);
blk_queue_io_min(dd->queue, 4096);
+ blk_queue_bounce_limit(dd->queue, dd->pdev->dma_mask);
/*
* write back cache is not supported in the device. FUA depends on
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 131/158] mtip32xx: Unmap the DMA segments before completing the IO request
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (129 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 130/158] mtip32xx: Set queue bounce limit Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 132/158] mtip32xx: mtip_async_complete() bug fixes Greg Kroah-Hartman
` (28 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felipe Franciosi, Jens Axboe
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Franciosi <felipe@paradoxo.org>
commit 368c89d7ac70f937c93cd6f3b65bcfdfb3ba794f upstream.
If the buffers are unmapped after completing a request, then stale data
might be in the request.
Signed-off-by: Felipe Franciosi <felipe@paradoxo.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/mtip32xx/mtip32xx.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -266,6 +266,12 @@ static void mtip_async_complete(struct m
"Command tag %d failed due to TFE\n", tag);
}
+ /* Unmap the DMA scatter list entries */
+ dma_unmap_sg(&dd->pdev->dev,
+ command->sg,
+ command->scatter_ents,
+ command->direction);
+
/* Upper layer callback */
if (likely(command->async_callback))
command->async_callback(command->async_data, cb_status);
@@ -273,12 +279,6 @@ static void mtip_async_complete(struct m
command->async_callback = NULL;
command->comp_func = NULL;
- /* Unmap the DMA scatter list entries */
- dma_unmap_sg(&dd->pdev->dev,
- command->sg,
- command->scatter_ents,
- command->direction);
-
/* Clear the allocated and active bits for the command */
atomic_set(&port->commands[tag].active, 0);
release_slot(port, tag);
@@ -709,6 +709,12 @@ static void mtip_timeout_function(unsign
*/
writel(1 << bit, port->completed[group]);
+ /* Unmap the DMA scatter list entries */
+ dma_unmap_sg(&port->dd->pdev->dev,
+ command->sg,
+ command->scatter_ents,
+ command->direction);
+
/* Call the async completion callback. */
if (likely(command->async_callback))
command->async_callback(command->async_data,
@@ -716,12 +722,6 @@ static void mtip_timeout_function(unsign
command->async_callback = NULL;
command->comp_func = NULL;
- /* Unmap the DMA scatter list entries */
- dma_unmap_sg(&port->dd->pdev->dev,
- command->sg,
- command->scatter_ents,
- command->direction);
-
/*
* Clear the allocated bit and active tag for the
* command.
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 132/158] mtip32xx: mtip_async_complete() bug fixes
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (130 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 131/158] mtip32xx: Unmap the DMA segments before completing the IO request Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 133/158] iser-target: Match FRMR descriptors to available session tags Greg Kroah-Hartman
` (27 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sam Bradshaw, Jens Axboe
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Bradshaw <sbradshaw@micron.com>
commit 5eb9291c36c7d71d7c6c832d5a4f551eb8ac015d upstream.
This patch fixes 2 issues in the fast completion path:
1) Possible double completions / double dma_unmap_sg() calls due to lack
of atomicity in the check and subsequent dereference of the upper layer
callback function. Fixed with cmpxchg before unmap and callback.
2) Regression in unaligned IO constraining workaround for p420m devices.
Fixed by checking if IO is unaligned and using proper semaphore if so.
Signed-off-by: Sam Bradshaw <sbradshaw@micron.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/mtip32xx/mtip32xx.c | 93 +++++++++++++++++++++-----------------
drivers/block/mtip32xx/mtip32xx.h | 2
2 files changed, 53 insertions(+), 42 deletions(-)
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -252,38 +252,45 @@ static void mtip_async_complete(struct m
void *data,
int status)
{
- struct mtip_cmd *command;
+ struct mtip_cmd *cmd;
struct driver_data *dd = data;
- int cb_status = status ? -EIO : 0;
+ int unaligned, cb_status = status ? -EIO : 0;
+ void (*func)(void *, int);
if (unlikely(!dd) || unlikely(!port))
return;
- command = &port->commands[tag];
+ cmd = &port->commands[tag];
if (unlikely(status == PORT_IRQ_TF_ERR)) {
dev_warn(&port->dd->pdev->dev,
"Command tag %d failed due to TFE\n", tag);
}
- /* Unmap the DMA scatter list entries */
- dma_unmap_sg(&dd->pdev->dev,
- command->sg,
- command->scatter_ents,
- command->direction);
+ /* Clear the active flag */
+ atomic_set(&port->commands[tag].active, 0);
/* Upper layer callback */
- if (likely(command->async_callback))
- command->async_callback(command->async_data, cb_status);
-
- command->async_callback = NULL;
- command->comp_func = NULL;
+ func = cmd->async_callback;
+ if (likely(func && cmpxchg(&cmd->async_callback, func, 0) == func)) {
- /* Clear the allocated and active bits for the command */
- atomic_set(&port->commands[tag].active, 0);
- release_slot(port, tag);
-
- up(&port->cmd_slot);
+ /* Unmap the DMA scatter list entries */
+ dma_unmap_sg(&dd->pdev->dev,
+ cmd->sg,
+ cmd->scatter_ents,
+ cmd->direction);
+
+ func(cmd->async_data, cb_status);
+ unaligned = cmd->unaligned;
+
+ /* Clear the allocated bit for the command */
+ release_slot(port, tag);
+
+ if (unlikely(unaligned))
+ up(&port->cmd_slot_unal);
+ else
+ up(&port->cmd_slot);
+ }
}
/*
@@ -660,11 +667,12 @@ static void mtip_timeout_function(unsign
{
struct mtip_port *port = (struct mtip_port *) data;
struct host_to_dev_fis *fis;
- struct mtip_cmd *command;
- int tag, cmdto_cnt = 0;
+ struct mtip_cmd *cmd;
+ int unaligned, tag, cmdto_cnt = 0;
unsigned int bit, group;
unsigned int num_command_slots;
unsigned long to, tagaccum[SLOTBITS_IN_LONGS];
+ void (*func)(void *, int);
if (unlikely(!port))
return;
@@ -694,8 +702,8 @@ static void mtip_timeout_function(unsign
group = tag >> 5;
bit = tag & 0x1F;
- command = &port->commands[tag];
- fis = (struct host_to_dev_fis *) command->command;
+ cmd = &port->commands[tag];
+ fis = (struct host_to_dev_fis *) cmd->command;
set_bit(tag, tagaccum);
cmdto_cnt++;
@@ -709,27 +717,30 @@ static void mtip_timeout_function(unsign
*/
writel(1 << bit, port->completed[group]);
- /* Unmap the DMA scatter list entries */
- dma_unmap_sg(&port->dd->pdev->dev,
- command->sg,
- command->scatter_ents,
- command->direction);
-
- /* Call the async completion callback. */
- if (likely(command->async_callback))
- command->async_callback(command->async_data,
- -EIO);
- command->async_callback = NULL;
- command->comp_func = NULL;
-
- /*
- * Clear the allocated bit and active tag for the
- * command.
- */
+ /* Clear the active flag for the command */
atomic_set(&port->commands[tag].active, 0);
- release_slot(port, tag);
- up(&port->cmd_slot);
+ func = cmd->async_callback;
+ if (func &&
+ cmpxchg(&cmd->async_callback, func, 0) == func) {
+
+ /* Unmap the DMA scatter list entries */
+ dma_unmap_sg(&port->dd->pdev->dev,
+ cmd->sg,
+ cmd->scatter_ents,
+ cmd->direction);
+
+ func(cmd->async_data, -EIO);
+ unaligned = cmd->unaligned;
+
+ /* Clear the allocated bit for the command. */
+ release_slot(port, tag);
+
+ if (unaligned)
+ up(&port->cmd_slot_unal);
+ else
+ up(&port->cmd_slot);
+ }
}
}
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -92,7 +92,7 @@
/* Driver name and version strings */
#define MTIP_DRV_NAME "mtip32xx"
-#define MTIP_DRV_VERSION "1.3.0"
+#define MTIP_DRV_VERSION "1.3.1"
/* Maximum number of minor device numbers per device. */
#define MTIP_MAX_MINORS 16
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 133/158] iser-target: Match FRMR descriptors to available session tags
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (131 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 132/158] mtip32xx: mtip_async_complete() bug fixes Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 134/158] [PATCH-v3.14.y 2/2] iser-target: Add missing se_cmd put for WRITE_PENDING in tx_comp_err Greg Kroah-Hartman
` (26 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel, target-devel
Cc: Greg Kroah-Hartman, stable, Sagi Grimberg, Or Gerlitz,
Nicholas Bellinger
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit f46d6a8a01d6bbd83a97140f30a72a89b038807b upstream.
This patch changes isert_conn_create_fastreg_pool() to follow
logic in iscsi_target_locate_portal() for determining how many
FRMR descriptors to allocate based upon the number of possible
per-session command slots that are available.
This addresses an OOPs in isert_reg_rdma() where due to the
use of ISCSI_DEF_XMIT_CMDS_MAX could end up returning a bogus
fast_reg_descriptor when the number of active tags exceeded
the original hardcoded max.
Note this also includes moving isert_conn_create_fastreg_pool()
from isert_connect_request() to isert_put_login_tx() before
posting the final Login Response PDU in order to determine the
se_nacl->queue_depth (eg: number of tags) per session the target
will be enforcing.
v2 changes:
- Move isert_conn->conn_fr_pool list_head init into
isert_conn_request()
v3 changes:
- Drop unnecessary list_empty() check in isert_reg_rdma()
(Sagi)
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/ulp/isert/ib_isert.c | 35 ++++++++++++++++++--------------
1 file changed, 20 insertions(+), 15 deletions(-)
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -436,11 +436,18 @@ isert_conn_create_fastreg_pool(struct is
{
struct fast_reg_descriptor *fr_desc;
struct isert_device *device = isert_conn->conn_device;
- int i, ret;
+ struct se_session *se_sess = isert_conn->conn->sess->se_sess;
+ struct se_node_acl *se_nacl = se_sess->se_node_acl;
+ int i, ret, tag_num;
+ /*
+ * Setup the number of FRMRs based upon the number of tags
+ * available to session in iscsi_target_locate_portal().
+ */
+ tag_num = max_t(u32, ISCSIT_MIN_TAGS, se_nacl->queue_depth);
+ tag_num = (tag_num * 2) + ISCSIT_EXTRA_TAGS;
- INIT_LIST_HEAD(&isert_conn->conn_fr_pool);
isert_conn->conn_fr_pool_size = 0;
- for (i = 0; i < ISCSI_DEF_XMIT_CMDS_MAX; i++) {
+ for (i = 0; i < tag_num; i++) {
fr_desc = kzalloc(sizeof(*fr_desc), GFP_KERNEL);
if (!fr_desc) {
pr_err("Failed to allocate fast_reg descriptor\n");
@@ -498,6 +505,7 @@ isert_connect_request(struct rdma_cm_id
kref_get(&isert_conn->conn_kref);
mutex_init(&isert_conn->conn_mutex);
spin_lock_init(&isert_conn->conn_lock);
+ INIT_LIST_HEAD(&isert_conn->conn_fr_pool);
cma_id->context = isert_conn;
isert_conn->conn_cm_id = cma_id;
@@ -569,15 +577,6 @@ isert_connect_request(struct rdma_cm_id
goto out_mr;
}
- if (device->use_fastreg) {
- ret = isert_conn_create_fastreg_pool(isert_conn);
- if (ret) {
- pr_err("Conn: %p failed to create fastreg pool\n",
- isert_conn);
- goto out_fastreg;
- }
- }
-
ret = isert_conn_setup_qp(isert_conn, cma_id);
if (ret)
goto out_conn_dev;
@@ -591,9 +590,6 @@ isert_connect_request(struct rdma_cm_id
return 0;
out_conn_dev:
- if (device->use_fastreg)
- isert_conn_free_fastreg_pool(isert_conn);
-out_fastreg:
ib_dereg_mr(isert_conn->conn_mr);
out_mr:
ib_dealloc_pd(isert_conn->conn_pd);
@@ -967,6 +963,15 @@ isert_put_login_tx(struct iscsi_conn *co
}
if (!login->login_failed) {
if (login->login_complete) {
+ if (isert_conn->conn_device->use_fastreg) {
+ ret = isert_conn_create_fastreg_pool(isert_conn);
+ if (ret) {
+ pr_err("Conn: %p failed to create"
+ " fastreg pool\n", isert_conn);
+ return ret;
+ }
+ }
+
ret = isert_alloc_rx_descriptors(isert_conn);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 134/158] [PATCH-v3.14.y 2/2] iser-target: Add missing se_cmd put for WRITE_PENDING in tx_comp_err
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (132 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 133/158] iser-target: Match FRMR descriptors to available session tags Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 135/158] sh: fix format string bug in stack tracer Greg Kroah-Hartman
` (25 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel, target-devel
Cc: Greg Kroah-Hartman, stable, Sagi Grimberg, Or Gerlitz,
Nicholas Bellinger
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit 03e7848a64ed535a30f5d7fc6dede2d5a6a2534b upstream.
This patch fixes a bug where outstanding RDMA_READs with WRITE_PENDING
status require an extra target_put_sess_cmd() in isert_put_cmd() code
when called from isert_cq_tx_comp_err() + isert_cq_drain_comp_llist()
context during session shutdown.
The extra kref PUT is required so that transport_generic_free_cmd()
invokes the last target_put_sess_cmd() -> target_release_cmd_kref(),
which will complete(&se_cmd->cmd_wait_comp) the outstanding se_cmd
descriptor with WRITE_PENDING status, and awake the completion in
target_wait_for_sess_cmds() to invoke TFO->release_cmd().
The bug was manifesting itself in target_wait_for_sess_cmds() where
a se_cmd descriptor with WRITE_PENDING status would end up sleeping
indefinately.
Acked-by: Sagi Grimberg <sagig@mellanox.com>
Cc: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/ulp/isert/ib_isert.c | 35 +++++++++++++++++++++-----------
1 file changed, 24 insertions(+), 11 deletions(-)
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -1456,7 +1456,7 @@ isert_unreg_rdma(struct isert_cmd *isert
}
static void
-isert_put_cmd(struct isert_cmd *isert_cmd)
+isert_put_cmd(struct isert_cmd *isert_cmd, bool comp_err)
{
struct iscsi_cmd *cmd = isert_cmd->iscsi_cmd;
struct isert_conn *isert_conn = isert_cmd->conn;
@@ -1472,8 +1472,21 @@ isert_put_cmd(struct isert_cmd *isert_cm
list_del_init(&cmd->i_conn_node);
spin_unlock_bh(&conn->cmd_lock);
- if (cmd->data_direction == DMA_TO_DEVICE)
+ if (cmd->data_direction == DMA_TO_DEVICE) {
iscsit_stop_dataout_timer(cmd);
+ /*
+ * Check for special case during comp_err where
+ * WRITE_PENDING has been handed off from core,
+ * but requires an extra target_put_sess_cmd()
+ * before transport_generic_free_cmd() below.
+ */
+ if (comp_err &&
+ cmd->se_cmd.t_state == TRANSPORT_WRITE_PENDING) {
+ struct se_cmd *se_cmd = &cmd->se_cmd;
+
+ target_put_sess_cmd(se_cmd->se_sess, se_cmd);
+ }
+ }
device->unreg_rdma_mem(isert_cmd, isert_conn);
transport_generic_free_cmd(&cmd->se_cmd, 0);
@@ -1528,7 +1541,7 @@ isert_unmap_tx_desc(struct iser_tx_desc
static void
isert_completion_put(struct iser_tx_desc *tx_desc, struct isert_cmd *isert_cmd,
- struct ib_device *ib_dev)
+ struct ib_device *ib_dev, bool comp_err)
{
if (isert_cmd->pdu_buf_dma != 0) {
pr_debug("Calling ib_dma_unmap_single for isert_cmd->pdu_buf_dma\n");
@@ -1538,7 +1551,7 @@ isert_completion_put(struct iser_tx_desc
}
isert_unmap_tx_desc(tx_desc, ib_dev);
- isert_put_cmd(isert_cmd);
+ isert_put_cmd(isert_cmd, comp_err);
}
static void
@@ -1582,14 +1595,14 @@ isert_do_control_comp(struct work_struct
iscsit_tmr_post_handler(cmd, cmd->conn);
cmd->i_state = ISTATE_SENT_STATUS;
- isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev);
+ isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev, false);
break;
case ISTATE_SEND_REJECT:
pr_debug("Got isert_do_control_comp ISTATE_SEND_REJECT: >>>\n");
atomic_dec(&isert_conn->post_send_buf_count);
cmd->i_state = ISTATE_SENT_STATUS;
- isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev);
+ isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev, false);
break;
case ISTATE_SEND_LOGOUTRSP:
pr_debug("Calling iscsit_logout_post_handler >>>>>>>>>>>>>>\n");
@@ -1603,7 +1616,7 @@ isert_do_control_comp(struct work_struct
case ISTATE_SEND_TEXTRSP:
atomic_dec(&isert_conn->post_send_buf_count);
cmd->i_state = ISTATE_SENT_STATUS;
- isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev);
+ isert_completion_put(&isert_cmd->tx_desc, isert_cmd, ib_dev, false);
break;
default:
pr_err("Unknown do_control_comp i_state %d\n", cmd->i_state);
@@ -1634,7 +1647,7 @@ isert_response_completion(struct iser_tx
atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
cmd->i_state = ISTATE_SENT_STATUS;
- isert_completion_put(tx_desc, isert_cmd, ib_dev);
+ isert_completion_put(tx_desc, isert_cmd, ib_dev, false);
}
static void
@@ -1715,7 +1728,7 @@ isert_cq_drain_comp_llist(struct isert_c
wr = &t->isert_cmd->rdma_wr;
atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
- isert_completion_put(t, t->isert_cmd, ib_dev);
+ isert_completion_put(t, t->isert_cmd, ib_dev, true);
}
}
@@ -1734,14 +1747,14 @@ isert_cq_tx_comp_err(struct iser_tx_desc
wr = &t->isert_cmd->rdma_wr;
atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
- isert_completion_put(t, t->isert_cmd, ib_dev);
+ isert_completion_put(t, t->isert_cmd, ib_dev, true);
}
tx_desc->comp_llnode_batch = NULL;
if (!isert_cmd)
isert_unmap_tx_desc(tx_desc, ib_dev);
else
- isert_completion_put(tx_desc, isert_cmd, ib_dev);
+ isert_completion_put(tx_desc, isert_cmd, ib_dev, true);
}
static void
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 135/158] sh: fix format string bug in stack tracer
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (133 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 134/158] [PATCH-v3.14.y 2/2] iser-target: Add missing se_cmd put for WRITE_PENDING in tx_comp_err Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 136/158] mm: page_alloc: spill to remote nodes before waking kswapd Greg Kroah-Hartman
` (24 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Matt Fleming, Kees Cook, Paul Mundt,
Andrew Morton, Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fleming <matt.fleming@intel.com>
commit a0c32761e73c9999cbf592b702f284221fea8040 upstream.
Kees reported the following error:
arch/sh/kernel/dumpstack.c: In function 'print_trace_address':
arch/sh/kernel/dumpstack.c:118:2: error: format not a string literal and no format arguments [-Werror=format-security]
Use the "%s" format so that it's impossible to interpret 'data' as a
format string.
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Reported-by: Kees Cook <keescook@chromium.org>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/sh/kernel/dumpstack.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/sh/kernel/dumpstack.c
+++ b/arch/sh/kernel/dumpstack.c
@@ -115,7 +115,7 @@ static int print_trace_stack(void *data,
*/
static void print_trace_address(void *data, unsigned long addr, int reliable)
{
- printk(data);
+ printk("%s", (char *)data);
printk_address(addr, reliable);
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 136/158] mm: page_alloc: spill to remote nodes before waking kswapd
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (134 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 135/158] sh: fix format string bug in stack tracer Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 137/158] mm: try_to_unmap_cluster() should lock_page() before mlocking Greg Kroah-Hartman
` (23 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johannes Weiner, Rik van Riel,
Mel Gorman, Andrew Morton, Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Weiner <hannes@cmpxchg.org>
commit 3a025760fc158b3726eac89ee95d7f29599e9dfa upstream.
On NUMA systems, a node may start thrashing cache or even swap anonymous
pages while there are still free pages on remote nodes.
This is a result of commits 81c0a2bb515f ("mm: page_alloc: fair zone
allocator policy") and fff4068cba48 ("mm: page_alloc: revert NUMA aspect
of fair allocation policy").
Before those changes, the allocator would first try all allowed zones,
including those on remote nodes, before waking any kswapds. But now,
the allocator fastpath doubles as the fairness pass, which in turn can
only consider the local node to prevent remote spilling based on
exhausted fairness batches alone. Remote nodes are only considered in
the slowpath, after the kswapds are woken up. But if remote nodes still
have free memory, kswapd should not be woken to rebalance the local node
or it may thrash cash or swap prematurely.
Fix this by adding one more unfair pass over the zonelist that is
allowed to spill to remote nodes after the local fairness pass fails but
before entering the slowpath and waking the kswapds.
This also gets rid of the GFP_THISNODE exemption from the fairness
protocol because the unfair pass is no longer tied to kswapd, which
GFP_THISNODE is not allowed to wake up.
However, because remote spills can be more frequent now - we prefer them
over local kswapd reclaim - the allocation batches on remote nodes could
underflow more heavily. When resetting the batches, use
atomic_long_read() directly instead of zone_page_state() to calculate the
delta as the latter filters negative counter values.
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Rik van Riel <riel@redhat.com>
Acked-by: Mel Gorman <mgorman@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/internal.h | 1
mm/page_alloc.c | 89 ++++++++++++++++++++++++++++----------------------------
2 files changed, 46 insertions(+), 44 deletions(-)
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -370,5 +370,6 @@ unsigned long reclaim_clean_pages_from_l
#define ALLOC_HIGH 0x20 /* __GFP_HIGH set */
#define ALLOC_CPUSET 0x40 /* check for correct cpuset */
#define ALLOC_CMA 0x80 /* allow allocations from CMA areas */
+#define ALLOC_FAIR 0x100 /* fair zone allocation */
#endif /* __MM_INTERNAL_H */
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1238,15 +1238,6 @@ void drain_zone_pages(struct zone *zone,
}
local_irq_restore(flags);
}
-static bool gfp_thisnode_allocation(gfp_t gfp_mask)
-{
- return (gfp_mask & GFP_THISNODE) == GFP_THISNODE;
-}
-#else
-static bool gfp_thisnode_allocation(gfp_t gfp_mask)
-{
- return false;
-}
#endif
/*
@@ -1583,12 +1574,7 @@ again:
get_pageblock_migratetype(page));
}
- /*
- * NOTE: GFP_THISNODE allocations do not partake in the kswapd
- * aging protocol, so they can't be fair.
- */
- if (!gfp_thisnode_allocation(gfp_flags))
- __mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order));
+ __mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order));
__count_zone_vm_events(PGALLOC, zone, 1 << order);
zone_statistics(preferred_zone, zone, gfp_flags);
@@ -1954,23 +1940,12 @@ zonelist_scan:
* zone size to ensure fair page aging. The zone a
* page was allocated in should have no effect on the
* time the page has in memory before being reclaimed.
- *
- * Try to stay in local zones in the fastpath. If
- * that fails, the slowpath is entered, which will do
- * another pass starting with the local zones, but
- * ultimately fall back to remote zones that do not
- * partake in the fairness round-robin cycle of this
- * zonelist.
- *
- * NOTE: GFP_THISNODE allocations do not partake in
- * the kswapd aging protocol, so they can't be fair.
*/
- if ((alloc_flags & ALLOC_WMARK_LOW) &&
- !gfp_thisnode_allocation(gfp_mask)) {
- if (zone_page_state(zone, NR_ALLOC_BATCH) <= 0)
- continue;
+ if (alloc_flags & ALLOC_FAIR) {
if (!zone_local(preferred_zone, zone))
continue;
+ if (zone_page_state(zone, NR_ALLOC_BATCH) <= 0)
+ continue;
}
/*
* When allocating a page cache page for writing, we
@@ -2408,32 +2383,40 @@ __alloc_pages_high_priority(gfp_t gfp_ma
return page;
}
-static void prepare_slowpath(gfp_t gfp_mask, unsigned int order,
- struct zonelist *zonelist,
- enum zone_type high_zoneidx,
- struct zone *preferred_zone)
+static void reset_alloc_batches(struct zonelist *zonelist,
+ enum zone_type high_zoneidx,
+ struct zone *preferred_zone)
{
struct zoneref *z;
struct zone *zone;
for_each_zone_zonelist(zone, z, zonelist, high_zoneidx) {
- if (!(gfp_mask & __GFP_NO_KSWAPD))
- wakeup_kswapd(zone, order, zone_idx(preferred_zone));
/*
* Only reset the batches of zones that were actually
- * considered in the fast path, we don't want to
- * thrash fairness information for zones that are not
+ * considered in the fairness pass, we don't want to
+ * trash fairness information for zones that are not
* actually part of this zonelist's round-robin cycle.
*/
if (!zone_local(preferred_zone, zone))
continue;
mod_zone_page_state(zone, NR_ALLOC_BATCH,
- high_wmark_pages(zone) -
- low_wmark_pages(zone) -
- zone_page_state(zone, NR_ALLOC_BATCH));
+ high_wmark_pages(zone) - low_wmark_pages(zone) -
+ atomic_long_read(&zone->vm_stat[NR_ALLOC_BATCH]));
}
}
+static void wake_all_kswapds(unsigned int order,
+ struct zonelist *zonelist,
+ enum zone_type high_zoneidx,
+ struct zone *preferred_zone)
+{
+ struct zoneref *z;
+ struct zone *zone;
+
+ for_each_zone_zonelist(zone, z, zonelist, high_zoneidx)
+ wakeup_kswapd(zone, order, zone_idx(preferred_zone));
+}
+
static inline int
gfp_to_alloc_flags(gfp_t gfp_mask)
{
@@ -2522,12 +2505,13 @@ __alloc_pages_slowpath(gfp_t gfp_mask, u
* allowed per node queues are empty and that nodes are
* over allocated.
*/
- if (gfp_thisnode_allocation(gfp_mask))
+ if (IS_ENABLED(CONFIG_NUMA) &&
+ (gfp_mask & GFP_THISNODE) == GFP_THISNODE)
goto nopage;
restart:
- prepare_slowpath(gfp_mask, order, zonelist,
- high_zoneidx, preferred_zone);
+ if (!(gfp_mask & __GFP_NO_KSWAPD))
+ wake_all_kswapds(order, zonelist, high_zoneidx, preferred_zone);
/*
* OK, we're below the kswapd watermark and have kicked background
@@ -2711,7 +2695,7 @@ __alloc_pages_nodemask(gfp_t gfp_mask, u
struct page *page = NULL;
int migratetype = allocflags_to_migratetype(gfp_mask);
unsigned int cpuset_mems_cookie;
- int alloc_flags = ALLOC_WMARK_LOW|ALLOC_CPUSET;
+ int alloc_flags = ALLOC_WMARK_LOW|ALLOC_CPUSET|ALLOC_FAIR;
struct mem_cgroup *memcg = NULL;
gfp_mask &= gfp_allowed_mask;
@@ -2752,12 +2736,29 @@ retry_cpuset:
if (allocflags_to_migratetype(gfp_mask) == MIGRATE_MOVABLE)
alloc_flags |= ALLOC_CMA;
#endif
+retry:
/* First allocation attempt */
page = get_page_from_freelist(gfp_mask|__GFP_HARDWALL, nodemask, order,
zonelist, high_zoneidx, alloc_flags,
preferred_zone, migratetype);
if (unlikely(!page)) {
/*
+ * The first pass makes sure allocations are spread
+ * fairly within the local node. However, the local
+ * node might have free pages left after the fairness
+ * batches are exhausted, and remote zones haven't
+ * even been considered yet. Try once more without
+ * fairness, and include remote zones now, before
+ * entering the slowpath and waking kswapd: prefer
+ * spilling to a remote zone over swapping locally.
+ */
+ if (alloc_flags & ALLOC_FAIR) {
+ reset_alloc_batches(zonelist, high_zoneidx,
+ preferred_zone);
+ alloc_flags &= ~ALLOC_FAIR;
+ goto retry;
+ }
+ /*
* Runtime PM, block IO and its error handling path
* can deadlock because I/O on the device might not
* complete.
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 137/158] mm: try_to_unmap_cluster() should lock_page() before mlocking
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (135 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 136/158] mm: page_alloc: spill to remote nodes before waking kswapd Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 138/158] mm: hugetlb: fix softlockup when a large number of hugepages are freed Greg Kroah-Hartman
` (22 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vlastimil Babka, Bob Liu,
Sasha Levin, Wanpeng Li, Michel Lespinasse, KOSAKI Motohiro,
Rik van Riel, David Rientjes, Mel Gorman, Hugh Dickins,
Joonsoo Kim, Andrew Morton, Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlastimil Babka <vbabka@suse.cz>
commit 57e68e9cd65b4b8eb4045a1e0d0746458502554c upstream.
A BUG_ON(!PageLocked) was triggered in mlock_vma_page() by Sasha Levin
fuzzing with trinity. The call site try_to_unmap_cluster() does not lock
the pages other than its check_page parameter (which is already locked).
The BUG_ON in mlock_vma_page() is not documented and its purpose is
somewhat unclear, but apparently it serializes against page migration,
which could otherwise fail to transfer the PG_mlocked flag. This would
not be fatal, as the page would be eventually encountered again, but
NR_MLOCK accounting would become distorted nevertheless. This patch adds
a comment to the BUG_ON in mlock_vma_page() and munlock_vma_page() to that
effect.
The call site try_to_unmap_cluster() is fixed so that for page !=
check_page, trylock_page() is attempted (to avoid possible deadlocks as we
already have check_page locked) and mlock_vma_page() is performed only
upon success. If the page lock cannot be obtained, the page is left
without PG_mlocked, which is again not a problem in the whole unevictable
memory design.
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Bob Liu <bob.liu@oracle.com>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Cc: Wanpeng Li <liwanp@linux.vnet.ibm.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Acked-by: Rik van Riel <riel@redhat.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Hugh Dickins <hughd@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mlock.c | 2 ++
mm/rmap.c | 14 ++++++++++++--
2 files changed, 14 insertions(+), 2 deletions(-)
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -79,6 +79,7 @@ void clear_page_mlock(struct page *page)
*/
void mlock_vma_page(struct page *page)
{
+ /* Serialize with page migration */
BUG_ON(!PageLocked(page));
if (!TestSetPageMlocked(page)) {
@@ -174,6 +175,7 @@ unsigned int munlock_vma_page(struct pag
unsigned int nr_pages;
struct zone *zone = page_zone(page);
+ /* For try_to_munlock() and to serialize with page migration */
BUG_ON(!PageLocked(page));
/*
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1322,9 +1322,19 @@ static int try_to_unmap_cluster(unsigned
BUG_ON(!page || PageAnon(page));
if (locked_vma) {
- mlock_vma_page(page); /* no-op if already mlocked */
- if (page == check_page)
+ if (page == check_page) {
+ /* we know we have check_page locked */
+ mlock_vma_page(page);
ret = SWAP_MLOCK;
+ } else if (trylock_page(page)) {
+ /*
+ * If we can lock the page, perform mlock.
+ * Otherwise leave the page alone, it will be
+ * eventually encountered again later.
+ */
+ mlock_vma_page(page);
+ unlock_page(page);
+ }
continue; /* don't unmap */
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 138/158] mm: hugetlb: fix softlockup when a large number of hugepages are freed.
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (136 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 137/158] mm: try_to_unmap_cluster() should lock_page() before mlocking Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 139/158] hung_task: check the value of "sysctl_hung_task_timeout_sec" Greg Kroah-Hartman
` (21 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Masayoshi Mizuma, Joonsoo Kim,
Michal Hocko, Wanpeng Li, Aneesh Kumar, KOSAKI Motohiro,
Naoya Horiguchi, Andrew Morton, Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Mizuma, Masayoshi" <m.mizuma@jp.fujitsu.com>
commit 55f67141a8927b2be3e51840da37b8a2320143ed upstream.
When I decrease the value of nr_hugepage in procfs a lot, softlockup
happens. It is because there is no chance of context switch during this
process.
On the other hand, when I allocate a large number of hugepages, there is
some chance of context switch. Hence softlockup doesn't happen during
this process. So it's necessary to add the context switch in the
freeing process as same as allocating process to avoid softlockup.
When I freed 12 TB hugapages with kernel-2.6.32-358.el6, the freeing
process occupied a CPU over 150 seconds and following softlockup message
appeared twice or more.
$ echo 6000000 > /proc/sys/vm/nr_hugepages
$ cat /proc/sys/vm/nr_hugepages
6000000
$ grep ^Huge /proc/meminfo
HugePages_Total: 6000000
HugePages_Free: 6000000
HugePages_Rsvd: 0
HugePages_Surp: 0
Hugepagesize: 2048 kB
$ echo 0 > /proc/sys/vm/nr_hugepages
BUG: soft lockup - CPU#16 stuck for 67s! [sh:12883] ...
Pid: 12883, comm: sh Not tainted 2.6.32-358.el6.x86_64 #1
Call Trace:
free_pool_huge_page+0xb8/0xd0
set_max_huge_pages+0x128/0x190
hugetlb_sysctl_handler_common+0x113/0x140
hugetlb_sysctl_handler+0x1e/0x20
proc_sys_call_handler+0x97/0xd0
proc_sys_write+0x14/0x20
vfs_write+0xb8/0x1a0
sys_write+0x51/0x90
__audit_syscall_exit+0x265/0x290
system_call_fastpath+0x16/0x1b
I have not confirmed this problem with upstream kernels because I am not
able to prepare the machine equipped with 12TB memory now. However I
confirmed that the amount of decreasing hugepages was directly
proportional to the amount of required time.
I measured required times on a smaller machine. It showed 130-145
hugepages decreased in a millisecond.
Amount of decreasing Required time Decreasing rate
hugepages (msec) (pages/msec)
------------------------------------------------------------
10,000 pages == 20GB 70 - 74 135-142
30,000 pages == 60GB 208 - 229 131-144
It means decrement of 6TB hugepages will trigger softlockup with the
default threshold 20sec, in this decreasing rate.
Signed-off-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Wanpeng Li <liwanp@linux.vnet.ibm.com>
Cc: Aneesh Kumar <aneesh.kumar@linux.vnet.ibm.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 1 +
1 file changed, 1 insertion(+)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1509,6 +1509,7 @@ static unsigned long set_max_huge_pages(
while (min_count < persistent_huge_pages(h)) {
if (!free_pool_huge_page(h, nodes_allowed, 0))
break;
+ cond_resched_lock(&hugetlb_lock);
}
while (count < persistent_huge_pages(h)) {
if (!adjust_pool_surplus(h, nodes_allowed, 1))
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 139/158] hung_task: check the value of "sysctl_hung_task_timeout_sec"
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (137 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 138/158] mm: hugetlb: fix softlockup when a large number of hugepages are freed Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 140/158] xattr: guard against simultaneous glibc header inclusion Greg Kroah-Hartman
` (20 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Liu Hua, Satoru Takeuchi,
Andrew Morton, Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Hua <sdu.liu@huawei.com>
commit 80df28476505ed4e6701c3448c63c9229a50c655 upstream.
As sysctl_hung_task_timeout_sec is unsigned long, when this value is
larger then LONG_MAX/HZ, the function schedule_timeout_interruptible in
watchdog will return immediately without sleep and with print :
schedule_timeout: wrong timeout value ffffffffffffff83
and then the funtion watchdog will call schedule_timeout_interruptible
again and again. The screen will be filled with
"schedule_timeout: wrong timeout value ffffffffffffff83"
This patch does some check and correction in sysctl, to let the function
schedule_timeout_interruptible allways get the valid parameter.
Signed-off-by: Liu Hua <sdu.liu@huawei.com>
Tested-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/sysctl/kernel.txt | 1 +
kernel/sysctl.c | 6 ++++++
2 files changed, 7 insertions(+)
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -317,6 +317,7 @@ for more than this value report a warnin
This file shows up if CONFIG_DETECT_HUNG_TASK is enabled.
0: means infinite timeout - no checking done.
+Possible values to set are in range {0..LONG_MAX/HZ}.
==============================================================
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -144,6 +144,11 @@ static int min_percpu_pagelist_fract = 8
static int ngroups_max = NGROUPS_MAX;
static const int cap_last_cap = CAP_LAST_CAP;
+/*this is needed for proc_doulongvec_minmax of sysctl_hung_task_timeout_secs */
+#ifdef CONFIG_DETECT_HUNG_TASK
+static unsigned long hung_task_timeout_max = (LONG_MAX/HZ);
+#endif
+
#ifdef CONFIG_INOTIFY_USER
#include <linux/inotify.h>
#endif
@@ -995,6 +1000,7 @@ static struct ctl_table kern_table[] = {
.maxlen = sizeof(unsigned long),
.mode = 0644,
.proc_handler = proc_dohung_task_timeout_secs,
+ .extra2 = &hung_task_timeout_max,
},
{
.procname = "hung_task_warnings",
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 140/158] xattr: guard against simultaneous glibc header inclusion
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (138 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 139/158] hung_task: check the value of "sysctl_hung_task_timeout_sec" Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 141/158] ocfs2: dlm: fix lock migration crash Greg Kroah-Hartman
` (19 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Serge Hallyn, Andrew Morton,
Allan McRae, Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Hallyn <serge.hallyn@ubuntu.com>
commit ea1a8217b06b41b31a2b60b0b83f75c77ef9c873 upstream.
If the glibc xattr.h header is included after the uapi header,
compilation fails due to an enum re-using a #define from the uapi
header.
Protect against this by guarding the define and enum inclusions against
each other.
(See https://lists.debian.org/debian-glibc/2014/03/msg00029.html
and https://sourceware.org/glibc/wiki/Synchronizing_Headers
for more information.)
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Allan McRae <allan@archlinux.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/uapi/linux/libc-compat.h | 9 +++++++++
include/uapi/linux/xattr.h | 7 +++++++
2 files changed, 16 insertions(+)
--- a/include/uapi/linux/libc-compat.h
+++ b/include/uapi/linux/libc-compat.h
@@ -85,6 +85,12 @@
#endif /* _NETINET_IN_H */
+/* Definitions for xattr.h */
+#if defined(_SYS_XATTR_H)
+#define __UAPI_DEF_XATTR 0
+#else
+#define __UAPI_DEF_XATTR 1
+#endif
/* If we did not see any headers from any supported C libraries,
* or we are being included in the kernel, then define everything
@@ -98,6 +104,9 @@
#define __UAPI_DEF_IPV6_MREQ 1
#define __UAPI_DEF_IPPROTO_V6 1
+/* Definitions for xattr.h */
+#define __UAPI_DEF_XATTR 1
+
#endif /* __GLIBC__ */
#endif /* _UAPI_LIBC_COMPAT_H */
--- a/include/uapi/linux/xattr.h
+++ b/include/uapi/linux/xattr.h
@@ -7,11 +7,18 @@
Copyright (c) 2001-2002 Silicon Graphics, Inc. All Rights Reserved.
Copyright (c) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
*/
+
+#include <linux/libc-compat.h>
+
#ifndef _UAPI_LINUX_XATTR_H
#define _UAPI_LINUX_XATTR_H
+#ifdef __UAPI_DEF_XATTR
+#define __USE_KERNEL_XATTR_DEFS
+
#define XATTR_CREATE 0x1 /* set value, fail if attr already exists */
#define XATTR_REPLACE 0x2 /* set value, fail if attr does not exist */
+#endif
/* Namespaces */
#define XATTR_OS2_PREFIX "os2."
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 141/158] ocfs2: dlm: fix lock migration crash
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (139 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 140/158] xattr: guard against simultaneous glibc header inclusion Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 142/158] ocfs2: dlm: fix recovery hung Greg Kroah-Hartman
` (18 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Junxiao Bi, Wengang Wang,
Sunil Mushran, Srinivas Eeda, Joel Becker, Mark Fasheh,
Andrew Morton, Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxiao Bi <junxiao.bi@oracle.com>
commit 34aa8dac482f1358d59110d5e3a12f4351f6acaa upstream.
This issue was introduced by commit 800deef3f6f8 ("ocfs2: use
list_for_each_entry where benefical") in 2007 where it replaced
list_for_each with list_for_each_entry. The variable "lock" will point
to invalid data if "tmpq" list is empty and a panic will be triggered
due to this. Sunil advised reverting it back, but the old version was
also not right. At the end of the outer for loop, that
list_for_each_entry will also set "lock" to an invalid data, then in the
next loop, if the "tmpq" list is empty, "lock" will be an stale invalid
data and cause the panic. So reverting the list_for_each back and reset
"lock" to NULL to fix this issue.
Another concern is that this seemes can not happen because the "tmpq"
list should not be empty. Let me describe how.
old lock resource owner(node 1): migratation target(node 2):
image there's lockres with a EX lock from node 2 in
granted list, a NR lock from node x with convert_type
EX in converting list.
dlm_empty_lockres() {
dlm_pick_migration_target() {
pick node 2 as target as its lock is the first one
in granted list.
}
dlm_migrate_lockres() {
dlm_mark_lockres_migrating() {
res->state |= DLM_LOCK_RES_BLOCK_DIRTY;
wait_event(dlm->ast_wq, !dlm_lockres_is_dirty(dlm, res));
//after the above code, we can not dirty lockres any more,
// so dlm_thread shuffle list will not run
downconvert lock from EX to NR
upconvert lock from NR to EX
<<< migration may schedule out here, then
<<< node 2 send down convert request to convert type from EX to
<<< NR, then send up convert request to convert type from NR to
<<< EX, at this time, lockres granted list is empty, and two locks
<<< in the converting list, node x up convert lock followed by
<<< node 2 up convert lock.
// will set lockres RES_MIGRATING flag, the following
// lock/unlock can not run
dlm_lockres_release_ast(dlm, res);
}
dlm_send_one_lockres()
dlm_process_recovery_data()
for (i=0; i<mres->num_locks; i++)
if (ml->node == dlm->node_num)
for (j = DLM_GRANTED_LIST; j <= DLM_BLOCKED_LIST; j++) {
list_for_each_entry(lock, tmpq, list)
if (lock) break; <<< lock is invalid as grant list is empty.
}
if (lock->ml.node != ml->node)
BUG() >>> crash here
}
I see the above locks status from a vmcore of our internal bug.
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Wengang Wang <wen.gang.wang@oracle.com>
Cc: Sunil Mushran <sunil.mushran@gmail.com>
Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/dlm/dlmrecovery.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1750,13 +1750,13 @@ static int dlm_process_recovery_data(str
struct dlm_migratable_lockres *mres)
{
struct dlm_migratable_lock *ml;
- struct list_head *queue;
+ struct list_head *queue, *iter;
struct list_head *tmpq = NULL;
struct dlm_lock *newlock = NULL;
struct dlm_lockstatus *lksb = NULL;
int ret = 0;
int i, j, bad;
- struct dlm_lock *lock = NULL;
+ struct dlm_lock *lock;
u8 from = O2NM_MAX_NODES;
unsigned int added = 0;
__be64 c;
@@ -1791,14 +1791,16 @@ static int dlm_process_recovery_data(str
/* MIGRATION ONLY! */
BUG_ON(!(mres->flags & DLM_MRES_MIGRATION));
+ lock = NULL;
spin_lock(&res->spinlock);
for (j = DLM_GRANTED_LIST; j <= DLM_BLOCKED_LIST; j++) {
tmpq = dlm_list_idx_to_ptr(res, j);
- list_for_each_entry(lock, tmpq, list) {
- if (lock->ml.cookie != ml->cookie)
- lock = NULL;
- else
+ list_for_each(iter, tmpq) {
+ lock = list_entry(iter,
+ struct dlm_lock, list);
+ if (lock->ml.cookie == ml->cookie)
break;
+ lock = NULL;
}
if (lock)
break;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 142/158] ocfs2: dlm: fix recovery hung
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (140 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 141/158] ocfs2: dlm: fix lock migration crash Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 143/158] ocfs2: do not put bh when buffer_uptodate failed Greg Kroah-Hartman
` (17 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Junxiao Bi, Srinivas Eeda,
Wengang Wang, Joel Becker, Mark Fasheh, Andrew Morton,
Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxiao Bi <junxiao.bi@oracle.com>
commit ded2cf71419b9353060e633b59e446c42a6a2a09 upstream.
There is a race window in dlm_do_recovery() between dlm_remaster_locks()
and dlm_reset_recovery() when the recovery master nearly finish the
recovery process for a dead node. After the master sends FINALIZE_RECO
message in dlm_remaster_locks(), another node may become the recovery
master for another dead node, and then send the BEGIN_RECO message to
all the nodes included the old master, in the handler of this message
dlm_begin_reco_handler() of old master, dlm->reco.dead_node and
dlm->reco.new_master will be set to the second dead node and the new
master, then in dlm_reset_recovery(), these two variables will be reset
to default value. This will cause new recovery master can not finish
the recovery process and hung, at last the whole cluster will hung for
recovery.
old recovery master: new recovery master:
dlm_remaster_locks()
become recovery master for
another dead node.
dlm_send_begin_reco_message()
dlm_begin_reco_handler()
{
if (dlm->reco.state & DLM_RECO_STATE_FINALIZE) {
return -EAGAIN;
}
dlm_set_reco_master(dlm, br->node_idx);
dlm_set_reco_dead_node(dlm, br->dead_node);
}
dlm_reset_recovery()
{
dlm_set_reco_dead_node(dlm, O2NM_INVALID_NODE_NUM);
dlm_set_reco_master(dlm, O2NM_INVALID_NODE_NUM);
}
will hang in dlm_remaster_locks() for
request dlm locks info
Before send FINALIZE_RECO message, recovery master should set
DLM_RECO_STATE_FINALIZE for itself and clear it after the recovery done,
this can break the race windows as the BEGIN_RECO messages will not be
handled before DLM_RECO_STATE_FINALIZE flag is cleared.
A similar race may happen between new recovery master and normal node
which is in dlm_finalize_reco_handler(), also fix it.
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
Reviewed-by: Wengang Wang <wen.gang.wang@oracle.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/dlm/dlmrecovery.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -537,7 +537,10 @@ master_here:
/* success! see if any other nodes need recovery */
mlog(0, "DONE mastering recovery of %s:%u here(this=%u)!\n",
dlm->name, dlm->reco.dead_node, dlm->node_num);
- dlm_reset_recovery(dlm);
+ spin_lock(&dlm->spinlock);
+ __dlm_reset_recovery(dlm);
+ dlm->reco.state &= ~DLM_RECO_STATE_FINALIZE;
+ spin_unlock(&dlm->spinlock);
}
dlm_end_recovery(dlm);
@@ -695,6 +698,14 @@ static int dlm_remaster_locks(struct dlm
if (all_nodes_done) {
int ret;
+ /* Set this flag on recovery master to avoid
+ * a new recovery for another dead node start
+ * before the recovery is not done. That may
+ * cause recovery hung.*/
+ spin_lock(&dlm->spinlock);
+ dlm->reco.state |= DLM_RECO_STATE_FINALIZE;
+ spin_unlock(&dlm->spinlock);
+
/* all nodes are now in DLM_RECO_NODE_DATA_DONE state
* just send a finalize message to everyone and
* clean up */
@@ -2884,8 +2895,8 @@ int dlm_finalize_reco_handler(struct o2n
BUG();
}
dlm->reco.state &= ~DLM_RECO_STATE_FINALIZE;
+ __dlm_reset_recovery(dlm);
spin_unlock(&dlm->spinlock);
- dlm_reset_recovery(dlm);
dlm_kick_recovery_thread(dlm);
break;
default:
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 143/158] ocfs2: do not put bh when buffer_uptodate failed
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (141 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 142/158] ocfs2: dlm: fix recovery hung Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 144/158] ocfs2: fix panic on kfree(xattr->name) Greg Kroah-Hartman
` (16 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Chen, Joseph Qi, Srinivas Eeda,
Mark Fasheh, Joel Becker, Andrew Morton, Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: alex chen <alex.chen@huawei.com>
commit f7cf4f5bfe073ad792ab49c04f247626b3e38db6 upstream.
Do not put bh when buffer_uptodate failed in ocfs2_write_block and
ocfs2_write_super_or_backup, because it will put bh in b_end_io.
Otherwise it will hit a warning "VFS: brelse: Trying to free free
buffer".
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Joseph Qi <joseph.qi@huawei.com>
Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
Cc: Mark Fasheh <mfasheh@suse.com>
Acked-by: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/buffer_head_io.c | 2 --
1 file changed, 2 deletions(-)
--- a/fs/ocfs2/buffer_head_io.c
+++ b/fs/ocfs2/buffer_head_io.c
@@ -90,7 +90,6 @@ int ocfs2_write_block(struct ocfs2_super
* information for this bh as it's not marked locally
* uptodate. */
ret = -EIO;
- put_bh(bh);
mlog_errno(ret);
}
@@ -420,7 +419,6 @@ int ocfs2_write_super_or_backup(struct o
if (!buffer_uptodate(bh)) {
ret = -EIO;
- put_bh(bh);
mlog_errno(ret);
}
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 144/158] ocfs2: fix panic on kfree(xattr->name)
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (142 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 143/158] ocfs2: do not put bh when buffer_uptodate failed Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 145/158] clk: s2mps11: Fix possible NULL pointer dereference Greg Kroah-Hartman
` (15 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tetsuo Handa, Tariq Saeed,
Srinivas Eeda, Joel Becker, Mark Fasheh, Andrew Morton,
Linus Torvalds
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
commit f81c20158f8d5f7938d5eb86ecc42ecc09273ce6 upstream.
Commit 9548906b2bb7 ('xattr: Constify ->name member of "struct xattr"')
missed that ocfs2 is calling kfree(xattr->name). As a result, kernel
panic occurs upon calling kfree(xattr->name) because xattr->name refers
static constant names. This patch removes kfree(xattr->name) from
ocfs2_mknod() and ocfs2_symlink().
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: Tariq Saeed <tariq.x.saeed@oracle.com>
Tested-by: Tariq Saeed <tariq.x.saeed@oracle.com>
Reviewed-by: Srinivas Eeda <srinivas.eeda@oracle.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/namei.c | 2 --
1 file changed, 2 deletions(-)
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -450,7 +450,6 @@ leave:
brelse(new_fe_bh);
brelse(parent_fe_bh);
- kfree(si.name);
kfree(si.value);
ocfs2_free_dir_lookup_result(&lookup);
@@ -1855,7 +1854,6 @@ bail:
brelse(new_fe_bh);
brelse(parent_fe_bh);
- kfree(si.name);
kfree(si.value);
ocfs2_free_dir_lookup_result(&lookup);
if (inode_ac)
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 145/158] clk: s2mps11: Fix possible NULL pointer dereference
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (143 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 144/158] ocfs2: fix panic on kfree(xattr->name) Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 146/158] smarter propagate_mnt() Greg Kroah-Hartman
` (14 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Mike Turquette
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit 238e14055da87d0d012257788e39fe0df3a82226 upstream.
If parent device does not have of_node set the s2mps11_clk_parse_dt()
returned NULL. This NULL was later passed to of_clk_add_provider() which
dereferenced it in pr_debug() call.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/clk-s2mps11.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clk/clk-s2mps11.c
+++ b/drivers/clk/clk-s2mps11.c
@@ -130,7 +130,7 @@ static struct device_node *s2mps11_clk_p
int i;
if (!iodev->dev->of_node)
- return NULL;
+ return ERR_PTR(-EINVAL);
clk_np = of_find_node_by_name(iodev->dev->of_node, "clocks");
if (!clk_np) {
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 146/158] smarter propagate_mnt()
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (144 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 145/158] clk: s2mps11: Fix possible NULL pointer dereference Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 147/158] block: Fix for_each_bvec() Greg Kroah-Hartman
` (13 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 upstream.
The current mainline has copies propagated to *all* nodes, then
tears down the copies we made for nodes that do not contain
counterparts of the desired mountpoint. That sets the right
propagation graph for the copies (at teardown time we move
the slaves of removed node to a surviving peer or directly
to master), but we end up paying a fairly steep price in
useless allocations. It's fairly easy to create a situation
where N calls of mount(2) create exactly N bindings, with
O(N^2) vfsmounts allocated and freed in process.
Fortunately, it is possible to avoid those allocations/freeings.
The trick is to create copies in the right order and find which
one would've eventually become a master with the current algorithm.
It turns out to be possible in O(nodes getting propagation) time
and with no extra allocations at all.
One part is that we need to make sure that eventual master will be
created before its slaves, so we need to walk the propagation
tree in a different order - by peer groups. And iterate through
the peers before dealing with the next group.
Another thing is finding the (earlier) copy that will be a master
of one we are about to create; to do that we are (temporary) marking
the masters of mountpoints we are attaching the copies to.
Either we are in a peer of the last mountpoint we'd dealt with,
or we have the following situation: we are attaching to mountpoint M,
the last copy S_0 had been attached to M_0 and there are sequences
S_0...S_n, M_0...M_n such that S_{i+1} is a master of S_{i},
S_{i} mounted on M{i} and we need to create a slave of the first S_{k}
such that M is getting propagation from M_{k}. It means that the master
of M_{k} will be among the sequence of masters of M. On the
other hand, the nearest marked node in that sequence will either
be the master of M_{k} or the master of M_{k-1} (the latter -
in the case if M_{k-1} is a slave of something M gets propagation
from, but in a wrong peer group).
So we go through the sequence of masters of M until we find
a marked one (P). Let N be the one before it. Then we go through
the sequence of masters of S_0 until we find one (say, S) mounted
on a node D that has P as master and check if D is a peer of N.
If it is, S will be the master of new copy, if not - the master of S
will be.
That's it for the hard part; the rest is fairly simple. Iterator
is in next_group(), handling of one prospective mountpoint is
propagate_one().
It seems to survive all tests and gives a noticably better performance
than the current mainline for setups that are seriously using shared
subtrees.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 11 ++
fs/pnode.c | 198 ++++++++++++++++++++++++++++++--------------------
fs/pnode.h | 3
include/linux/mount.h | 3
4 files changed, 133 insertions(+), 82 deletions(-)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -885,7 +885,7 @@ static struct mount *clone_mnt(struct mo
goto out_free;
}
- mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~MNT_WRITE_HOLD;
+ mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED);
/* Don't allow unprivileged users to change mount flags */
if ((flag & CL_UNPRIVILEGED) && (mnt->mnt.mnt_flags & MNT_READONLY))
mnt->mnt.mnt_flags |= MNT_LOCK_READONLY;
@@ -1661,9 +1661,9 @@ static int attach_recursive_mnt(struct m
if (err)
goto out;
err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list);
+ lock_mount_hash();
if (err)
goto out_cleanup_ids;
- lock_mount_hash();
for (p = source_mnt; p; p = next_mnt(p, source_mnt))
set_mnt_shared(p);
} else {
@@ -1690,6 +1690,11 @@ static int attach_recursive_mnt(struct m
return 0;
out_cleanup_ids:
+ while (!hlist_empty(&tree_list)) {
+ child = hlist_entry(tree_list.first, struct mount, mnt_hash);
+ umount_tree(child, 0);
+ }
+ unlock_mount_hash();
cleanup_group_ids(source_mnt, NULL);
out:
return err;
@@ -2044,7 +2049,7 @@ static int do_add_mount(struct mount *ne
struct mount *parent;
int err;
- mnt_flags &= ~(MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL | MNT_DOOMED | MNT_SYNC_UMOUNT);
+ mnt_flags &= ~MNT_INTERNAL_FLAGS;
mp = lock_mount(path);
if (IS_ERR(mp))
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -164,46 +164,94 @@ static struct mount *propagation_next(st
}
}
-/*
- * return the source mount to be used for cloning
- *
- * @dest the current destination mount
- * @last_dest the last seen destination mount
- * @last_src the last seen source mount
- * @type return CL_SLAVE if the new mount has to be
- * cloned as a slave.
- */
-static struct mount *get_source(struct mount *dest,
- struct mount *last_dest,
- struct mount *last_src,
- int *type)
+static struct mount *next_group(struct mount *m, struct mount *origin)
{
- struct mount *p_last_src = NULL;
- struct mount *p_last_dest = NULL;
-
- while (last_dest != dest->mnt_master) {
- p_last_dest = last_dest;
- p_last_src = last_src;
- last_dest = last_dest->mnt_master;
- last_src = last_src->mnt_master;
+ while (1) {
+ while (1) {
+ struct mount *next;
+ if (!IS_MNT_NEW(m) && !list_empty(&m->mnt_slave_list))
+ return first_slave(m);
+ next = next_peer(m);
+ if (m->mnt_group_id == origin->mnt_group_id) {
+ if (next == origin)
+ return NULL;
+ } else if (m->mnt_slave.next != &next->mnt_slave)
+ break;
+ m = next;
+ }
+ /* m is the last peer */
+ while (1) {
+ struct mount *master = m->mnt_master;
+ if (m->mnt_slave.next != &master->mnt_slave_list)
+ return next_slave(m);
+ m = next_peer(master);
+ if (master->mnt_group_id == origin->mnt_group_id)
+ break;
+ if (master->mnt_slave.next == &m->mnt_slave)
+ break;
+ m = master;
+ }
+ if (m == origin)
+ return NULL;
}
+}
- if (p_last_dest) {
- do {
- p_last_dest = next_peer(p_last_dest);
- } while (IS_MNT_NEW(p_last_dest));
- /* is that a peer of the earlier? */
- if (dest == p_last_dest) {
- *type = CL_MAKE_SHARED;
- return p_last_src;
+/* all accesses are serialized by namespace_sem */
+static struct user_namespace *user_ns;
+static struct mount *last_dest, *last_source, *dest_master;
+static struct mountpoint *mp;
+static struct hlist_head *list;
+
+static int propagate_one(struct mount *m)
+{
+ struct mount *child;
+ int type;
+ /* skip ones added by this propagate_mnt() */
+ if (IS_MNT_NEW(m))
+ return 0;
+ /* skip if mountpoint isn't covered by it */
+ if (!is_subdir(mp->m_dentry, m->mnt.mnt_root))
+ return 0;
+ if (m->mnt_group_id == last_dest->mnt_group_id) {
+ type = CL_MAKE_SHARED;
+ } else {
+ struct mount *n, *p;
+ for (n = m; ; n = p) {
+ p = n->mnt_master;
+ if (p == dest_master || IS_MNT_MARKED(p)) {
+ while (last_dest->mnt_master != p) {
+ last_source = last_source->mnt_master;
+ last_dest = last_source->mnt_parent;
+ }
+ if (n->mnt_group_id != last_dest->mnt_group_id) {
+ last_source = last_source->mnt_master;
+ last_dest = last_source->mnt_parent;
+ }
+ break;
+ }
}
+ type = CL_SLAVE;
+ /* beginning of peer group among the slaves? */
+ if (IS_MNT_SHARED(m))
+ type |= CL_MAKE_SHARED;
}
- /* slave of the earlier, then */
- *type = CL_SLAVE;
- /* beginning of peer group among the slaves? */
- if (IS_MNT_SHARED(dest))
- *type |= CL_MAKE_SHARED;
- return last_src;
+
+ /* Notice when we are propagating across user namespaces */
+ if (m->mnt_ns->user_ns != user_ns)
+ type |= CL_UNPRIVILEGED;
+ child = copy_tree(last_source, last_source->mnt.mnt_root, type);
+ if (IS_ERR(child))
+ return PTR_ERR(child);
+ mnt_set_mountpoint(m, mp, child);
+ last_dest = m;
+ last_source = child;
+ if (m->mnt_master != dest_master) {
+ read_seqlock_excl(&mount_lock);
+ SET_MNT_MARK(m->mnt_master);
+ read_sequnlock_excl(&mount_lock);
+ }
+ hlist_add_head(&child->mnt_hash, list);
+ return 0;
}
/*
@@ -222,56 +270,48 @@ static struct mount *get_source(struct m
int propagate_mnt(struct mount *dest_mnt, struct mountpoint *dest_mp,
struct mount *source_mnt, struct hlist_head *tree_list)
{
- struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
- struct mount *m, *child;
+ struct mount *m, *n;
int ret = 0;
- struct mount *prev_dest_mnt = dest_mnt;
- struct mount *prev_src_mnt = source_mnt;
- HLIST_HEAD(tmp_list);
-
- for (m = propagation_next(dest_mnt, dest_mnt); m;
- m = propagation_next(m, dest_mnt)) {
- int type;
- struct mount *source;
-
- if (IS_MNT_NEW(m))
- continue;
-
- source = get_source(m, prev_dest_mnt, prev_src_mnt, &type);
-
- /* Notice when we are propagating across user namespaces */
- if (m->mnt_ns->user_ns != user_ns)
- type |= CL_UNPRIVILEGED;
-
- child = copy_tree(source, source->mnt.mnt_root, type);
- if (IS_ERR(child)) {
- ret = PTR_ERR(child);
- tmp_list = *tree_list;
- tmp_list.first->pprev = &tmp_list.first;
- INIT_HLIST_HEAD(tree_list);
+
+ /*
+ * we don't want to bother passing tons of arguments to
+ * propagate_one(); everything is serialized by namespace_sem,
+ * so globals will do just fine.
+ */
+ user_ns = current->nsproxy->mnt_ns->user_ns;
+ last_dest = dest_mnt;
+ last_source = source_mnt;
+ mp = dest_mp;
+ list = tree_list;
+ dest_master = dest_mnt->mnt_master;
+
+ /* all peers of dest_mnt, except dest_mnt itself */
+ for (n = next_peer(dest_mnt); n != dest_mnt; n = next_peer(n)) {
+ ret = propagate_one(n);
+ if (ret)
goto out;
- }
+ }
- if (is_subdir(dest_mp->m_dentry, m->mnt.mnt_root)) {
- mnt_set_mountpoint(m, dest_mp, child);
- hlist_add_head(&child->mnt_hash, tree_list);
- } else {
- /*
- * This can happen if the parent mount was bind mounted
- * on some subdirectory of a shared/slave mount.
- */
- hlist_add_head(&child->mnt_hash, &tmp_list);
- }
- prev_dest_mnt = m;
- prev_src_mnt = child;
+ /* all slave groups */
+ for (m = next_group(dest_mnt, dest_mnt); m;
+ m = next_group(m, dest_mnt)) {
+ /* everything in that slave group */
+ n = m;
+ do {
+ ret = propagate_one(n);
+ if (ret)
+ goto out;
+ n = next_peer(n);
+ } while (n != m);
}
out:
- lock_mount_hash();
- while (!hlist_empty(&tmp_list)) {
- child = hlist_entry(tmp_list.first, struct mount, mnt_hash);
- umount_tree(child, 0);
+ read_seqlock_excl(&mount_lock);
+ hlist_for_each_entry(n, tree_list, mnt_hash) {
+ m = n->mnt_parent;
+ if (m->mnt_master != dest_mnt->mnt_master)
+ CLEAR_MNT_MARK(m->mnt_master);
}
- unlock_mount_hash();
+ read_sequnlock_excl(&mount_lock);
return ret;
}
--- a/fs/pnode.h
+++ b/fs/pnode.h
@@ -16,6 +16,9 @@
#define IS_MNT_NEW(m) (!(m)->mnt_ns)
#define CLEAR_MNT_SHARED(m) ((m)->mnt.mnt_flags &= ~MNT_SHARED)
#define IS_MNT_UNBINDABLE(m) ((m)->mnt.mnt_flags & MNT_UNBINDABLE)
+#define IS_MNT_MARKED(m) ((m)->mnt.mnt_flags & MNT_MARKED)
+#define SET_MNT_MARK(m) ((m)->mnt.mnt_flags |= MNT_MARKED)
+#define CLEAR_MNT_MARK(m) ((m)->mnt.mnt_flags &= ~MNT_MARKED)
#define CL_EXPIRE 0x01
#define CL_SLAVE 0x02
--- a/include/linux/mount.h
+++ b/include/linux/mount.h
@@ -44,6 +44,8 @@ struct mnt_namespace;
#define MNT_SHARED_MASK (MNT_UNBINDABLE)
#define MNT_PROPAGATION_MASK (MNT_SHARED | MNT_UNBINDABLE)
+#define MNT_INTERNAL_FLAGS (MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL | \
+ MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED)
#define MNT_INTERNAL 0x4000
@@ -51,6 +53,7 @@ struct mnt_namespace;
#define MNT_LOCKED 0x800000
#define MNT_DOOMED 0x1000000
#define MNT_SYNC_UMOUNT 0x2000000
+#define MNT_MARKED 0x4000000
struct vfsmount {
struct dentry *mnt_root; /* root of the mounted tree */
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 147/158] block: Fix for_each_bvec()
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (145 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 146/158] smarter propagate_mnt() Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 148/158] ext4: FIBMAP ioctl causes BUG_ON due to handle EXT_MAX_BLOCKS Greg Kroah-Hartman
` (12 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martin K. Petersen, Kent Overstreet,
Nicholas Bellinger, Jens Axboe
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Martin K. Petersen" <martin.petersen@oracle.com>
commit b7aa84d9cb9f26da1a9312c3e39dbd1a3c25a426 upstream.
Commit 4550dd6c6b062 introduced for_each_bvec() which iterates over each
bvec attached to a bio or bip. However, the macro fails to check bi_size
before dereferencing which can lead to crashes while counting/mapping
integrity scatterlist segments.
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Kent Overstreet <kmo@daterainc.com>
Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/bio.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -216,9 +216,9 @@ static inline void bvec_iter_advance(str
}
#define for_each_bvec(bvl, bio_vec, iter, start) \
- for ((iter) = start; \
- (bvl) = bvec_iter_bvec((bio_vec), (iter)), \
- (iter).bi_size; \
+ for (iter = (start); \
+ (iter).bi_size && \
+ ((bvl = bvec_iter_bvec((bio_vec), (iter))), 1); \
bvec_iter_advance((bio_vec), &(iter), (bvl).bv_len))
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 148/158] ext4: FIBMAP ioctl causes BUG_ON due to handle EXT_MAX_BLOCKS
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (146 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 147/158] block: Fix for_each_bvec() Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 149/158] ext4: note the error in ext4_end_bio() Greg Kroah-Hartman
` (11 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kazuya Mio, Theodore Tso
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kazuya Mio <k-mio@sx.jp.nec.com>
commit 4adb6ab3e0fa71363a5ef229544b2d17de6600d7 upstream.
When we try to get 2^32-1 block of the file which has the extent
(ee_block=2^32-2, ee_len=1) with FIBMAP ioctl, it causes BUG_ON
in ext4_ext_put_gap_in_cache().
To avoid the problem, ext4_map_blocks() needs to check the file logical block
number. ext4_ext_put_gap_in_cache() called via ext4_map_blocks() cannot
handle 2^32-1 because the maximum file logical block number is 2^32-2.
Note that ext4_ind_map_blocks() returns -EIO when the block number is invalid.
So ext4_map_blocks() should also return the same errno.
Signed-off-by: Kazuya Mio <k-mio@sx.jp.nec.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/inode.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -515,6 +515,10 @@ int ext4_map_blocks(handle_t *handle, st
"logical block %lu\n", inode->i_ino, flags, map->m_len,
(unsigned long) map->m_lblk);
+ /* We can handle the block number less than EXT_MAX_BLOCKS */
+ if (unlikely(map->m_lblk >= EXT_MAX_BLOCKS))
+ return -EIO;
+
/* Lookup extent status tree firstly */
if (ext4_es_lookup_extent(inode, map->m_lblk, &es)) {
ext4_es_lru_add(inode);
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 149/158] ext4: note the error in ext4_end_bio()
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (147 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 148/158] ext4: FIBMAP ioctl causes BUG_ON due to handle EXT_MAX_BLOCKS Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:40 ` [PATCH 3.14 150/158] ext4: fix jbd2 warning under heavy xattr load Greg Kroah-Hartman
` (10 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Matthew Wilcox, Theodore Tso, Jan Kara
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox <willy@linux.intel.com>
commit 9503c67c93ed0b95ba62d12d1fd09da6245dbdd6 upstream.
ext4_end_bio() currently throws away the error that it receives. Chances
are this is part of a spate of errors, one of which will end up getting
the error returned to userspace somehow, but we shouldn't take that risk.
Also print out the errno to aid in debug.
Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/page-io.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/ext4/page-io.c
+++ b/fs/ext4/page-io.c
@@ -308,13 +308,14 @@ static void ext4_end_bio(struct bio *bio
if (error) {
struct inode *inode = io_end->inode;
- ext4_warning(inode->i_sb, "I/O error writing to inode %lu "
+ ext4_warning(inode->i_sb, "I/O error %d writing to inode %lu "
"(offset %llu size %ld starting block %llu)",
- inode->i_ino,
+ error, inode->i_ino,
(unsigned long long) io_end->offset,
(long) io_end->size,
(unsigned long long)
bi_sector >> (inode->i_blkbits - 9));
+ mapping_set_error(inode->i_mapping, error);
}
if (io_end->flag & EXT4_IO_END_UNWRITTEN) {
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 150/158] ext4: fix jbd2 warning under heavy xattr load
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (148 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 149/158] ext4: note the error in ext4_end_bio() Greg Kroah-Hartman
@ 2014-05-04 15:40 ` Greg Kroah-Hartman
2014-05-04 15:41 ` [PATCH 3.14 151/158] ext4: move ext4_update_i_disksize() into mpage_map_and_submit_extent() Greg Kroah-Hartman
` (9 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sage Weil, Jan Kara, Theodore Tso
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit ec4cb1aa2b7bae18dd8164f2e9c7c51abcf61280 upstream.
When heavily exercising xattr code the assertion that
jbd2_journal_dirty_metadata() shouldn't return error was triggered:
WARNING: at /srv/autobuild-ceph/gitbuilder.git/build/fs/jbd2/transaction.c:1237
jbd2_journal_dirty_metadata+0x1ba/0x260()
CPU: 0 PID: 8877 Comm: ceph-osd Tainted: G W 3.10.0-ceph-00049-g68d04c9 #1
Hardware name: Dell Inc. PowerEdge R410/01V648, BIOS 1.6.3 02/07/2011
ffffffff81a1d3c8 ffff880214469928 ffffffff816311b0 ffff880214469968
ffffffff8103fae0 ffff880214469958 ffff880170a9dc30 ffff8802240fbe80
0000000000000000 ffff88020b366000 ffff8802256e7510 ffff880214469978
Call Trace:
[<ffffffff816311b0>] dump_stack+0x19/0x1b
[<ffffffff8103fae0>] warn_slowpath_common+0x70/0xa0
[<ffffffff8103fb2a>] warn_slowpath_null+0x1a/0x20
[<ffffffff81267c2a>] jbd2_journal_dirty_metadata+0x1ba/0x260
[<ffffffff81245093>] __ext4_handle_dirty_metadata+0xa3/0x140
[<ffffffff812561f3>] ext4_xattr_release_block+0x103/0x1f0
[<ffffffff81256680>] ext4_xattr_block_set+0x1e0/0x910
[<ffffffff8125795b>] ext4_xattr_set_handle+0x38b/0x4a0
[<ffffffff810a319d>] ? trace_hardirqs_on+0xd/0x10
[<ffffffff81257b32>] ext4_xattr_set+0xc2/0x140
[<ffffffff81258547>] ext4_xattr_user_set+0x47/0x50
[<ffffffff811935ce>] generic_setxattr+0x6e/0x90
[<ffffffff81193ecb>] __vfs_setxattr_noperm+0x7b/0x1c0
[<ffffffff811940d4>] vfs_setxattr+0xc4/0xd0
[<ffffffff8119421e>] setxattr+0x13e/0x1e0
[<ffffffff811719c7>] ? __sb_start_write+0xe7/0x1b0
[<ffffffff8118f2e8>] ? mnt_want_write_file+0x28/0x60
[<ffffffff8118c65c>] ? fget_light+0x3c/0x130
[<ffffffff8118f2e8>] ? mnt_want_write_file+0x28/0x60
[<ffffffff8118f1f8>] ? __mnt_want_write+0x58/0x70
[<ffffffff811946be>] SyS_fsetxattr+0xbe/0x100
[<ffffffff816407c2>] system_call_fastpath+0x16/0x1b
The reason for the warning is that buffer_head passed into
jbd2_journal_dirty_metadata() didn't have journal_head attached. This is
caused by the following race of two ext4_xattr_release_block() calls:
CPU1 CPU2
ext4_xattr_release_block() ext4_xattr_release_block()
lock_buffer(bh);
/* False */
if (BHDR(bh)->h_refcount == cpu_to_le32(1))
} else {
le32_add_cpu(&BHDR(bh)->h_refcount, -1);
unlock_buffer(bh);
lock_buffer(bh);
/* True */
if (BHDR(bh)->h_refcount == cpu_to_le32(1))
get_bh(bh);
ext4_free_blocks()
...
jbd2_journal_forget()
jbd2_journal_unfile_buffer()
-> JH is gone
error = ext4_handle_dirty_xattr_block(handle, inode, bh);
-> triggers the warning
We fix the problem by moving ext4_handle_dirty_xattr_block() under the
buffer lock. Sadly this cannot be done in nojournal mode as that
function can call sync_dirty_buffer() which would deadlock. Luckily in
nojournal mode the race is harmless (we only dirty already freed buffer)
and thus for nojournal mode we leave the dirtying outside of the buffer
lock.
Reported-by: Sage Weil <sage@inktank.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/xattr.c | 23 +++++++++++++++++++----
1 file changed, 19 insertions(+), 4 deletions(-)
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -517,8 +517,8 @@ static void ext4_xattr_update_super_bloc
}
/*
- * Release the xattr block BH: If the reference count is > 1, decrement
- * it; otherwise free the block.
+ * Release the xattr block BH: If the reference count is > 1, decrement it;
+ * otherwise free the block.
*/
static void
ext4_xattr_release_block(handle_t *handle, struct inode *inode,
@@ -538,16 +538,31 @@ ext4_xattr_release_block(handle_t *handl
if (ce)
mb_cache_entry_free(ce);
get_bh(bh);
+ unlock_buffer(bh);
ext4_free_blocks(handle, inode, bh, 0, 1,
EXT4_FREE_BLOCKS_METADATA |
EXT4_FREE_BLOCKS_FORGET);
- unlock_buffer(bh);
} else {
le32_add_cpu(&BHDR(bh)->h_refcount, -1);
if (ce)
mb_cache_entry_release(ce);
+ /*
+ * Beware of this ugliness: Releasing of xattr block references
+ * from different inodes can race and so we have to protect
+ * from a race where someone else frees the block (and releases
+ * its journal_head) before we are done dirtying the buffer. In
+ * nojournal mode this race is harmless and we actually cannot
+ * call ext4_handle_dirty_xattr_block() with locked buffer as
+ * that function can call sync_dirty_buffer() so for that case
+ * we handle the dirtying after unlocking the buffer.
+ */
+ if (ext4_handle_valid(handle))
+ error = ext4_handle_dirty_xattr_block(handle, inode,
+ bh);
unlock_buffer(bh);
- error = ext4_handle_dirty_xattr_block(handle, inode, bh);
+ if (!ext4_handle_valid(handle))
+ error = ext4_handle_dirty_xattr_block(handle, inode,
+ bh);
if (IS_SYNC(inode))
ext4_handle_sync(handle);
dquot_free_block(inode, EXT4_C2B(EXT4_SB(inode->i_sb), 1));
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 151/158] ext4: move ext4_update_i_disksize() into mpage_map_and_submit_extent()
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (149 preceding siblings ...)
2014-05-04 15:40 ` [PATCH 3.14 150/158] ext4: fix jbd2 warning under heavy xattr load Greg Kroah-Hartman
@ 2014-05-04 15:41 ` Greg Kroah-Hartman
2014-05-04 15:41 ` [PATCH 3.14 152/158] ext4: use i_size_read in ext4_unaligned_aio() Greg Kroah-Hartman
` (8 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:41 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Theodore Tso, Jan Kara
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit 622cad1325e404598fe3b148c3fa640dbaabc235 upstream.
The function ext4_update_i_disksize() is used in only one place, in
the function mpage_map_and_submit_extent(). Move its code to simplify
the code paths, and also move the call to ext4_mark_inode_dirty() into
the i_data_sem's critical region, to be consistent with all of the
other places where we update i_disksize. That way, we also keep the
raw_inode's i_disksize protected, to avoid the following race:
CPU #1 CPU #2
down_write(&i_data_sem)
Modify i_disk_size
up_write(&i_data_sem)
down_write(&i_data_sem)
Modify i_disk_size
Copy i_disk_size to on-disk inode
up_write(&i_data_sem)
Copy i_disk_size to on-disk inode
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/ext4.h | 17 -----------------
fs/ext4/inode.c | 14 ++++++++++++--
2 files changed, 12 insertions(+), 19 deletions(-)
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2462,23 +2462,6 @@ static inline void ext4_update_i_disksiz
up_write(&EXT4_I(inode)->i_data_sem);
}
-/*
- * Update i_disksize after writeback has been started. Races with truncate
- * are avoided by checking i_size under i_data_sem.
- */
-static inline void ext4_wb_update_i_disksize(struct inode *inode, loff_t newsize)
-{
- loff_t i_size;
-
- down_write(&EXT4_I(inode)->i_data_sem);
- i_size = i_size_read(inode);
- if (newsize > i_size)
- newsize = i_size;
- if (newsize > EXT4_I(inode)->i_disksize)
- EXT4_I(inode)->i_disksize = newsize;
- up_write(&EXT4_I(inode)->i_data_sem);
-}
-
struct ext4_group_info {
unsigned long bb_state;
struct rb_root bb_free_root;
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2236,13 +2236,23 @@ static int mpage_map_and_submit_extent(h
return err;
} while (map->m_len);
- /* Update on-disk size after IO is submitted */
+ /*
+ * Update on-disk size after IO is submitted. Races with
+ * truncate are avoided by checking i_size under i_data_sem.
+ */
disksize = ((loff_t)mpd->first_page) << PAGE_CACHE_SHIFT;
if (disksize > EXT4_I(inode)->i_disksize) {
int err2;
+ loff_t i_size;
- ext4_wb_update_i_disksize(inode, disksize);
+ down_write(&EXT4_I(inode)->i_data_sem);
+ i_size = i_size_read(inode);
+ if (disksize > i_size)
+ disksize = i_size;
+ if (disksize > EXT4_I(inode)->i_disksize)
+ EXT4_I(inode)->i_disksize = disksize;
err2 = ext4_mark_inode_dirty(handle, inode);
+ up_write(&EXT4_I(inode)->i_data_sem);
if (err2)
ext4_error(inode->i_sb,
"Failed to mark inode %lu dirty",
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 152/158] ext4: use i_size_read in ext4_unaligned_aio()
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (150 preceding siblings ...)
2014-05-04 15:41 ` [PATCH 3.14 151/158] ext4: move ext4_update_i_disksize() into mpage_map_and_submit_extent() Greg Kroah-Hartman
@ 2014-05-04 15:41 ` Greg Kroah-Hartman
2014-05-04 15:41 ` [PATCH 3.14 153/158] usb: xhci: Prefer endpoint context dequeue pointer over stopped_trb Greg Kroah-Hartman
` (7 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:41 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Theodore Tso
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit 6e6358fc3c3c862bfe9a5bc029d3f8ce43dc9765 upstream.
We haven't taken i_mutex yet, so we need to use i_size_read().
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -82,7 +82,7 @@ ext4_unaligned_aio(struct inode *inode,
size_t count = iov_length(iov, nr_segs);
loff_t final_size = pos + count;
- if (pos >= inode->i_size)
+ if (pos >= i_size_read(inode))
return 0;
if ((pos & blockmask) || (final_size & blockmask))
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 153/158] usb: xhci: Prefer endpoint context dequeue pointer over stopped_trb
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (151 preceding siblings ...)
2014-05-04 15:41 ` [PATCH 3.14 152/158] ext4: use i_size_read in ext4_unaligned_aio() Greg Kroah-Hartman
@ 2014-05-04 15:41 ` Greg Kroah-Hartman
2014-05-04 15:41 ` [PATCH 3.14 154/158] ARM: tegra: remove UART5/UARTE from tegra124.dtsi Greg Kroah-Hartman
` (6 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:41 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Julius Werner, Mathias Nyman
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julius Werner <jwerner@chromium.org>
commit 1f81b6d22a5980955b01e08cf27fb745dc9b686f upstream.
We have observed a rare cycle state desync bug after Set TR Dequeue
Pointer commands on Intel LynxPoint xHCs (resulting in an endpoint that
doesn't fetch new TRBs and thus an unresponsive USB device). It always
triggers when a previous Set TR Dequeue Pointer command has set the
pointer to the final Link TRB of a segment, and then another URB gets
enqueued and cancelled again before it can be completed. Further
investigation showed that the xHC had returned the Link TRB in the TRB
Pointer field of the Transfer Event (CC == Stopped -- Length Invalid),
but when xhci_find_new_dequeue_state() later accesses the Endpoint
Context's TR Dequeue Pointer field it is set to the first TRB of the
next segment.
The driver expects those two values to be the same in this situation,
and uses the cycle state of the latter together with the address of the
former. This should be fine according to the XHCI specification, since
the endpoint ring should be stopped when returning the Transfer Event
and thus should not advance over the Link TRB before it gets restarted.
However, real-world XHCI implementations apparently don't really care
that much about these details, so the driver should follow a more
defensive approach to try to work around HC spec violations.
This patch removes the stopped_trb variable that had been used to store
the TRB Pointer from the last Transfer Event of a stopped TRB. Instead,
xhci_find_new_dequeue_state() now relies only on the Endpoint Context,
requiring a small amount of additional processing to find the virtual
address corresponding to the TR Dequeue Pointer. Some other parts of the
function were slightly rearranged to better fit into this model.
This patch should be backported to kernels as old as 2.6.31 that contain
the commit ae636747146ea97efa18e04576acd3416e2514f5 "USB: xhci: URB
cancellation support."
Signed-off-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-ring.c | 67 +++++++++++++++++++------------------------
drivers/usb/host/xhci.c | 1
drivers/usb/host/xhci.h | 2 -
3 files changed, 31 insertions(+), 39 deletions(-)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -550,6 +550,7 @@ void xhci_find_new_dequeue_state(struct
struct xhci_generic_trb *trb;
struct xhci_ep_ctx *ep_ctx;
dma_addr_t addr;
+ u64 hw_dequeue;
ep_ring = xhci_triad_to_transfer_ring(xhci, slot_id,
ep_index, stream_id);
@@ -559,56 +560,57 @@ void xhci_find_new_dequeue_state(struct
stream_id);
return;
}
- state->new_cycle_state = 0;
- xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
- "Finding segment containing stopped TRB.");
- state->new_deq_seg = find_trb_seg(cur_td->start_seg,
- dev->eps[ep_index].stopped_trb,
- &state->new_cycle_state);
- if (!state->new_deq_seg) {
- WARN_ON(1);
- return;
- }
/* Dig out the cycle state saved by the xHC during the stop ep cmd */
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
"Finding endpoint context");
ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
- state->new_cycle_state = 0x1 & le64_to_cpu(ep_ctx->deq);
+ hw_dequeue = le64_to_cpu(ep_ctx->deq);
+
+ /* Find virtual address and segment of hardware dequeue pointer */
+ state->new_deq_seg = ep_ring->deq_seg;
+ state->new_deq_ptr = ep_ring->dequeue;
+ while (xhci_trb_virt_to_dma(state->new_deq_seg, state->new_deq_ptr)
+ != (dma_addr_t)(hw_dequeue & ~0xf)) {
+ next_trb(xhci, ep_ring, &state->new_deq_seg,
+ &state->new_deq_ptr);
+ if (state->new_deq_ptr == ep_ring->dequeue) {
+ WARN_ON(1);
+ return;
+ }
+ }
+ /*
+ * Find cycle state for last_trb, starting at old cycle state of
+ * hw_dequeue. If there is only one segment ring, find_trb_seg() will
+ * return immediately and cannot toggle the cycle state if this search
+ * wraps around, so add one more toggle manually in that case.
+ */
+ state->new_cycle_state = hw_dequeue & 0x1;
+ if (ep_ring->first_seg == ep_ring->first_seg->next &&
+ cur_td->last_trb < state->new_deq_ptr)
+ state->new_cycle_state ^= 0x1;
state->new_deq_ptr = cur_td->last_trb;
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
"Finding segment containing last TRB in TD.");
state->new_deq_seg = find_trb_seg(state->new_deq_seg,
- state->new_deq_ptr,
- &state->new_cycle_state);
+ state->new_deq_ptr, &state->new_cycle_state);
if (!state->new_deq_seg) {
WARN_ON(1);
return;
}
+ /* Increment to find next TRB after last_trb. Cycle if appropriate. */
trb = &state->new_deq_ptr->generic;
if (TRB_TYPE_LINK_LE32(trb->field[3]) &&
(trb->field[3] & cpu_to_le32(LINK_TOGGLE)))
state->new_cycle_state ^= 0x1;
next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr);
- /*
- * If there is only one segment in a ring, find_trb_seg()'s while loop
- * will not run, and it will return before it has a chance to see if it
- * needs to toggle the cycle bit. It can't tell if the stalled transfer
- * ended just before the link TRB on a one-segment ring, or if the TD
- * wrapped around the top of the ring, because it doesn't have the TD in
- * question. Look for the one-segment case where stalled TRB's address
- * is greater than the new dequeue pointer address.
- */
- if (ep_ring->first_seg == ep_ring->first_seg->next &&
- state->new_deq_ptr < dev->eps[ep_index].stopped_trb)
- state->new_cycle_state ^= 0x1;
+ /* Don't update the ring cycle state for the producer (us). */
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
"Cycle state = 0x%x", state->new_cycle_state);
- /* Don't update the ring cycle state for the producer (us). */
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
"New dequeue segment = %p (virtual)",
state->new_deq_seg);
@@ -791,7 +793,6 @@ static void xhci_handle_cmd_stop_ep(stru
if (list_empty(&ep->cancelled_td_list)) {
xhci_stop_watchdog_timer_in_irq(xhci, ep);
ep->stopped_td = NULL;
- ep->stopped_trb = NULL;
ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
return;
}
@@ -859,11 +860,9 @@ remove_finished_td:
ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
}
- /* Clear stopped_td and stopped_trb if endpoint is not halted */
- if (!(ep->ep_state & EP_HALTED)) {
+ /* Clear stopped_td if endpoint is not halted */
+ if (!(ep->ep_state & EP_HALTED))
ep->stopped_td = NULL;
- ep->stopped_trb = NULL;
- }
/*
* Drop the lock and complete the URBs in the cancelled TD list.
@@ -1908,14 +1907,12 @@ static void xhci_cleanup_halted_endpoint
struct xhci_virt_ep *ep = &xhci->devs[slot_id]->eps[ep_index];
ep->ep_state |= EP_HALTED;
ep->stopped_td = td;
- ep->stopped_trb = event_trb;
ep->stopped_stream = stream_id;
xhci_queue_reset_ep(xhci, slot_id, ep_index);
xhci_cleanup_stalled_ring(xhci, td->urb->dev, ep_index);
ep->stopped_td = NULL;
- ep->stopped_trb = NULL;
ep->stopped_stream = 0;
xhci_ring_cmd_db(xhci);
@@ -1997,7 +1994,6 @@ static int finish_td(struct xhci_hcd *xh
* the ring dequeue pointer or take this TD off any lists yet.
*/
ep->stopped_td = td;
- ep->stopped_trb = event_trb;
return 0;
} else {
if (trb_comp_code == COMP_STALL) {
@@ -2009,7 +2005,6 @@ static int finish_td(struct xhci_hcd *xh
* USB class driver clear the stall later.
*/
ep->stopped_td = td;
- ep->stopped_trb = event_trb;
ep->stopped_stream = ep_ring->stream_id;
} else if (xhci_requires_manual_halt_cleanup(xhci,
ep_ctx, trb_comp_code)) {
@@ -2626,7 +2621,7 @@ static int handle_tx_event(struct xhci_h
* successful event after a short transfer.
* Ignore it.
*/
- if ((xhci->quirks & XHCI_SPURIOUS_SUCCESS) &&
+ if ((xhci->quirks & XHCI_SPURIOUS_SUCCESS) &&
ep_ring->last_td_was_short) {
ep_ring->last_td_was_short = false;
ret = 0;
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -2933,7 +2933,6 @@ void xhci_endpoint_reset(struct usb_hcd
xhci_ring_cmd_db(xhci);
}
virt_ep->stopped_td = NULL;
- virt_ep->stopped_trb = NULL;
virt_ep->stopped_stream = 0;
spin_unlock_irqrestore(&xhci->lock, flags);
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -864,8 +864,6 @@ struct xhci_virt_ep {
#define EP_GETTING_NO_STREAMS (1 << 5)
/* ---- Related to URB cancellation ---- */
struct list_head cancelled_td_list;
- /* The TRB that was last reported in a stopped endpoint ring */
- union xhci_trb *stopped_trb;
struct xhci_td *stopped_td;
unsigned int stopped_stream;
/* Watchdog timer for stop endpoint command to cancel URBs */
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 154/158] ARM: tegra: remove UART5/UARTE from tegra124.dtsi
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (152 preceding siblings ...)
2014-05-04 15:41 ` [PATCH 3.14 153/158] usb: xhci: Prefer endpoint context dequeue pointer over stopped_trb Greg Kroah-Hartman
@ 2014-05-04 15:41 ` Greg Kroah-Hartman
2014-05-04 15:41 ` [PATCH 3.14 155/158] clk: tegra: remove non-existent clocks Greg Kroah-Hartman
` (5 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:41 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stephen Warren, Arnd Bergmann
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Warren <swarren@nvidia.com>
commit 862f0eea38409ff0d7f226c1245b787e3f0e2607 upstream.
Tegra124 only has 4 UARTs. Parts of the documentation hint at a fifth
UART, but this appears to be left-over from earlier SoC documentation.
Remove the non-existent DT node for UART5.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/tegra124.dtsi | 13 -------------
1 file changed, 13 deletions(-)
--- a/arch/arm/boot/dts/tegra124.dtsi
+++ b/arch/arm/boot/dts/tegra124.dtsi
@@ -164,19 +164,6 @@
status = "disabled";
};
- serial@70006400 {
- compatible = "nvidia,tegra124-uart", "nvidia,tegra20-uart";
- reg = <0x70006400 0x40>;
- reg-shift = <2>;
- interrupts = <GIC_SPI 91 IRQ_TYPE_LEVEL_HIGH>;
- clocks = <&tegra_car TEGRA124_CLK_UARTE>;
- resets = <&tegra_car 66>;
- reset-names = "serial";
- dmas = <&apbdma 20>, <&apbdma 20>;
- dma-names = "rx", "tx";
- status = "disabled";
- };
-
pwm@7000a000 {
compatible = "nvidia,tegra124-pwm", "nvidia,tegra20-pwm";
reg = <0x7000a000 0x100>;
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 155/158] clk: tegra: remove non-existent clocks
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (153 preceding siblings ...)
2014-05-04 15:41 ` [PATCH 3.14 154/158] ARM: tegra: remove UART5/UARTE from tegra124.dtsi Greg Kroah-Hartman
@ 2014-05-04 15:41 ` Greg Kroah-Hartman
2014-05-04 15:41 ` [PATCH 3.14 156/158] dt: tegra: remove non-existent clock IDs Greg Kroah-Hartman
` (4 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:41 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stephen Warren, Arnd Bergmann
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Warren <swarren@nvidia.com>
commit 9ba71705706aa83bcd7f9b74ae2d167da934c951 upstream.
The Tegra124 clock driver currently provides 3 clocks that don't actually
exist; 2 for NAND and one for UART5/UARTE. Delete these.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/tegra/clk-tegra124.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/clk/tegra/clk-tegra124.c
+++ b/drivers/clk/tegra/clk-tegra124.c
@@ -764,7 +764,6 @@ static struct tegra_clk tegra124_clks[te
[tegra_clk_sdmmc2_8] = { .dt_id = TEGRA124_CLK_SDMMC2, .present = true },
[tegra_clk_i2s1] = { .dt_id = TEGRA124_CLK_I2S1, .present = true },
[tegra_clk_i2c1] = { .dt_id = TEGRA124_CLK_I2C1, .present = true },
- [tegra_clk_ndflash] = { .dt_id = TEGRA124_CLK_NDFLASH, .present = true },
[tegra_clk_sdmmc1_8] = { .dt_id = TEGRA124_CLK_SDMMC1, .present = true },
[tegra_clk_sdmmc4_8] = { .dt_id = TEGRA124_CLK_SDMMC4, .present = true },
[tegra_clk_pwm] = { .dt_id = TEGRA124_CLK_PWM, .present = true },
@@ -809,7 +808,6 @@ static struct tegra_clk tegra124_clks[te
[tegra_clk_trace] = { .dt_id = TEGRA124_CLK_TRACE, .present = true },
[tegra_clk_soc_therm] = { .dt_id = TEGRA124_CLK_SOC_THERM, .present = true },
[tegra_clk_dtv] = { .dt_id = TEGRA124_CLK_DTV, .present = true },
- [tegra_clk_ndspeed] = { .dt_id = TEGRA124_CLK_NDSPEED, .present = true },
[tegra_clk_i2cslow] = { .dt_id = TEGRA124_CLK_I2CSLOW, .present = true },
[tegra_clk_dsib] = { .dt_id = TEGRA124_CLK_DSIB, .present = true },
[tegra_clk_tsec] = { .dt_id = TEGRA124_CLK_TSEC, .present = true },
@@ -952,7 +950,6 @@ static struct tegra_clk tegra124_clks[te
[tegra_clk_clk_out_3_mux] = { .dt_id = TEGRA124_CLK_CLK_OUT_3_MUX, .present = true },
[tegra_clk_dsia_mux] = { .dt_id = TEGRA124_CLK_DSIA_MUX, .present = true },
[tegra_clk_dsib_mux] = { .dt_id = TEGRA124_CLK_DSIB_MUX, .present = true },
- [tegra_clk_uarte] = { .dt_id = TEGRA124_CLK_UARTE, .present = true },
};
static struct tegra_devclk devclks[] __initdata = {
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 156/158] dt: tegra: remove non-existent clock IDs
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (154 preceding siblings ...)
2014-05-04 15:41 ` [PATCH 3.14 155/158] clk: tegra: remove non-existent clocks Greg Kroah-Hartman
@ 2014-05-04 15:41 ` Greg Kroah-Hartman
2014-05-04 15:41 ` [PATCH 3.14 157/158] USB: EHCI: tegra: set txfill_tuning Greg Kroah-Hartman
` (3 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:41 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stephen Warren, Arnd Bergmann
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Warren <swarren@nvidia.com>
commit 9ef1af9ea28c23d0eaed97f7f5142788b6cf570a upstream.
The Tegra124 clock DT binding currently provides 3 clocks that don't
actually exist; 2 for NAND and one for UART5/UARTE. Delete these. While
this is technically an incompatible DT ABI change, nothing could have
used these clock IDs for anything practical, since the HW doesn't exist.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/dt-bindings/clock/tegra124-car.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/include/dt-bindings/clock/tegra124-car.h
+++ b/include/dt-bindings/clock/tegra124-car.h
@@ -29,7 +29,7 @@
/* 10 (register bit affects spdif_in and spdif_out) */
#define TEGRA124_CLK_I2S1 11
#define TEGRA124_CLK_I2C1 12
-#define TEGRA124_CLK_NDFLASH 13
+/* 13 */
#define TEGRA124_CLK_SDMMC1 14
#define TEGRA124_CLK_SDMMC4 15
/* 16 */
@@ -83,7 +83,7 @@
/* 64 */
#define TEGRA124_CLK_UARTD 65
-#define TEGRA124_CLK_UARTE 66
+/* 66 */
#define TEGRA124_CLK_I2C3 67
#define TEGRA124_CLK_SBC4 68
#define TEGRA124_CLK_SDMMC3 69
@@ -97,7 +97,7 @@
#define TEGRA124_CLK_TRACE 77
#define TEGRA124_CLK_SOC_THERM 78
#define TEGRA124_CLK_DTV 79
-#define TEGRA124_CLK_NDSPEED 80
+/* 80 */
#define TEGRA124_CLK_I2CSLOW 81
#define TEGRA124_CLK_DSIB 82
#define TEGRA124_CLK_TSEC 83
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 157/158] USB: EHCI: tegra: set txfill_tuning
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (155 preceding siblings ...)
2014-05-04 15:41 ` [PATCH 3.14 156/158] dt: tegra: remove non-existent clock IDs Greg Kroah-Hartman
@ 2014-05-04 15:41 ` Greg Kroah-Hartman
2014-05-04 15:41 ` [PATCH 3.14 158/158] USB: pl2303: add ids for Hewlett-Packard HP POS pole displays Greg Kroah-Hartman
` (2 subsequent siblings)
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:41 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stephen Warren, Alan Stern,
Alexandre Courbot
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Warren <swarren@nvidia.com>
commit 4f2fe2d27472f4a5dbd875888af4fc5175f3fdc5 upstream.
To avoid memory fetch underflows with larger USB transfers, Tegra SoCs
need txfill_tuning's txfifothresh register field set to a non-default
value. Add a custom reset override in order to set this up.
These values are recommended practice for all Tegra chips. However,
I've only noticed practical problems when not setting them this way on
systems using Tegra124. Hence, CC: stable only for recent kernels which
actually support Tegra124.
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Alexandre Courbot <acourbot@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/ehci-tegra.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
--- a/drivers/usb/host/ehci-tegra.c
+++ b/drivers/usb/host/ehci-tegra.c
@@ -513,8 +513,31 @@ static struct platform_driver tegra_ehci
}
};
+static int tegra_ehci_reset(struct usb_hcd *hcd)
+{
+ struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+ int retval;
+ int txfifothresh;
+
+ retval = ehci_setup(hcd);
+ if (retval)
+ return retval;
+
+ /*
+ * We should really pull this value out of tegra_ehci_soc_config, but
+ * to avoid needing access to it, make use of the fact that Tegra20 is
+ * the only one so far that needs a value of 10, and Tegra20 is the
+ * only one which doesn't set has_hostpc.
+ */
+ txfifothresh = ehci->has_hostpc ? 0x10 : 10;
+ ehci_writel(ehci, txfifothresh << 16, &ehci->regs->txfill_tuning);
+
+ return 0;
+}
+
static const struct ehci_driver_overrides tegra_overrides __initconst = {
.extra_priv_size = sizeof(struct tegra_ehci_hcd),
+ .reset = tegra_ehci_reset,
};
static int __init ehci_tegra_init(void)
^ permalink raw reply [flat|nested] 165+ messages in thread* [PATCH 3.14 158/158] USB: pl2303: add ids for Hewlett-Packard HP POS pole displays
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (156 preceding siblings ...)
2014-05-04 15:41 ` [PATCH 3.14 157/158] USB: EHCI: tegra: set txfill_tuning Greg Kroah-Hartman
@ 2014-05-04 15:41 ` Greg Kroah-Hartman
2014-05-04 17:19 ` [PATCH 3.14 000/158] 3.14.3-stable review Guenter Roeck
2014-05-06 14:56 ` Shuah Khan
159 siblings, 0 replies; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 15:41 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Aaron Sanders, Johan Hovold
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Sanders <aaron.sanders@hp.com>
commit b16c02fbfb963fa2941b7517ebf1f8a21946775e upstream.
Add device ids to pl2303 for the Hewlett-Packard HP POS pole displays:
LD960: 03f0:0B39
LCM220: 03f0:3139
LCM960: 03f0:3239
[ Johan: fix indentation and sort PIDs numerically ]
Signed-off-by: Aaron Sanders <aaron.sanders@hp.com>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/pl2303.c | 3 +++
drivers/usb/serial/pl2303.h | 5 ++++-
2 files changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -83,6 +83,9 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
{ USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
{ USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) },
{ USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
{ USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) },
{ USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -121,8 +121,11 @@
#define SUPERIAL_VENDOR_ID 0x5372
#define SUPERIAL_PRODUCT_ID 0x2303
-/* Hewlett-Packard LD220-HP POS Pole Display */
+/* Hewlett-Packard POS Pole Displays */
#define HP_VENDOR_ID 0x03f0
+#define HP_LD960_PRODUCT_ID 0x0b39
+#define HP_LCM220_PRODUCT_ID 0x3139
+#define HP_LCM960_PRODUCT_ID 0x3239
#define HP_LD220_PRODUCT_ID 0x3524
/* Cressi Edy (diving computer) PC interface */
^ permalink raw reply [flat|nested] 165+ messages in thread* Re: [PATCH 3.14 000/158] 3.14.3-stable review
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (157 preceding siblings ...)
2014-05-04 15:41 ` [PATCH 3.14 158/158] USB: pl2303: add ids for Hewlett-Packard HP POS pole displays Greg Kroah-Hartman
@ 2014-05-04 17:19 ` Guenter Roeck
2014-05-04 20:27 ` Greg Kroah-Hartman
2014-05-06 14:56 ` Shuah Khan
159 siblings, 1 reply; 165+ messages in thread
From: Guenter Roeck @ 2014-05-04 17:19 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, satoru.takeuchi, shuah.kh, stable
On 05/04/2014 08:38 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.14.3 release.
> There are 158 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue May 6 15:38:47 UTC 2014.
> Anything received after that time might be too late.
>
Build results:
total: 127 pass: 121 skipped: 4 fail: 2
Qemu tests all passed.
Additional failure is from new build target unicore32:defconfig, which fails
in all releases. The second failure is powerpc:allmodconfig which, together
with powerpc:allyesconfig, fails to build in 3.14 and later kernels.
Results are therefore as expected.
Details are available at http://server.roeck-us.net:8010/builders.
Guenter
^ permalink raw reply [flat|nested] 165+ messages in thread* Re: [PATCH 3.14 000/158] 3.14.3-stable review
2014-05-04 17:19 ` [PATCH 3.14 000/158] 3.14.3-stable review Guenter Roeck
@ 2014-05-04 20:27 ` Greg Kroah-Hartman
2014-05-04 21:33 ` Guenter Roeck
0 siblings, 1 reply; 165+ messages in thread
From: Greg Kroah-Hartman @ 2014-05-04 20:27 UTC (permalink / raw)
To: Guenter Roeck
Cc: linux-kernel, torvalds, akpm, satoru.takeuchi, shuah.kh, stable
On Sun, May 04, 2014 at 10:19:25AM -0700, Guenter Roeck wrote:
> On 05/04/2014 08:38 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.14.3 release.
> > There are 158 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Tue May 6 15:38:47 UTC 2014.
> > Anything received after that time might be too late.
> >
>
> Build results:
> total: 127 pass: 121 skipped: 4 fail: 2
>
> Qemu tests all passed.
>
> Additional failure is from new build target unicore32:defconfig, which fails
> in all releases. The second failure is powerpc:allmodconfig which, together
> with powerpc:allyesconfig, fails to build in 3.14 and later kernels.
> Results are therefore as expected.
>
> Details are available at http://server.roeck-us.net:8010/builders.
>
If unicore32 doesn't build on any kernel version, should we just drop
the whole arch?
I'd suggest the same for powerpc, but odds are, there are still users :)
thanks,
greg k-h
^ permalink raw reply [flat|nested] 165+ messages in thread
* Re: [PATCH 3.14 000/158] 3.14.3-stable review
2014-05-04 20:27 ` Greg Kroah-Hartman
@ 2014-05-04 21:33 ` Guenter Roeck
0 siblings, 0 replies; 165+ messages in thread
From: Guenter Roeck @ 2014-05-04 21:33 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, satoru.takeuchi, shuah.kh, stable
On 05/04/2014 01:27 PM, Greg Kroah-Hartman wrote:
> On Sun, May 04, 2014 at 10:19:25AM -0700, Guenter Roeck wrote:
>> On 05/04/2014 08:38 AM, Greg Kroah-Hartman wrote:
>>> This is the start of the stable review cycle for the 3.14.3 release.
>>> There are 158 patches in this series, all will be posted as a response
>>> to this one. If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Tue May 6 15:38:47 UTC 2014.
>>> Anything received after that time might be too late.
>>>
>>
>> Build results:
>> total: 127 pass: 121 skipped: 4 fail: 2
>>
>> Qemu tests all passed.
>>
>> Additional failure is from new build target unicore32:defconfig, which fails
>> in all releases. The second failure is powerpc:allmodconfig which, together
>> with powerpc:allyesconfig, fails to build in 3.14 and later kernels.
>> Results are therefore as expected.
>>
>> Details are available at http://server.roeck-us.net:8010/builders.
>>
>
> If unicore32 doesn't build on any kernel version, should we just drop
> the whole arch?
>
Idea was to put the maintainer on notice. If nothing changes, that
may be a good idea.
> I'd suggest the same for powerpc, but odds are, there are still users :)
>
Yes, the company paying my salary, for example :-). But then if failure to build
allmodconfig/allyesconfig is a criteria, arm would be a prime target as well ...
Might be a discussion point for the kernel summit, though: What are criteria
for an architecture to be accepted, and for it to remain in the kernel ?
Availability of a pre-built tool set (score drops out)? defconfig build
failure (unicore32 be gone) ? Something else ?
Guenter
^ permalink raw reply [flat|nested] 165+ messages in thread
* Re: [PATCH 3.14 000/158] 3.14.3-stable review
2014-05-04 15:38 [PATCH 3.14 000/158] 3.14.3-stable review Greg Kroah-Hartman
` (158 preceding siblings ...)
2014-05-04 17:19 ` [PATCH 3.14 000/158] 3.14.3-stable review Guenter Roeck
@ 2014-05-06 14:56 ` Shuah Khan
159 siblings, 0 replies; 165+ messages in thread
From: Shuah Khan @ 2014-05-06 14:56 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, satoru.takeuchi, stable, Shuah Khan
On 05/04/2014 09:38 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.14.3 release.
> There are 158 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue May 6 15:38:47 UTC 2014.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.14.3-rc1.gz
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test systems. No dmesg regressions.
-- Shuah
--
Shuah Khan
Senior Linux Kernel Developer - Open Source Group
Samsung Research America(Silicon Valley)
shuah.kh@samsung.com | (970) 672-0658
^ permalink raw reply [flat|nested] 165+ messages in thread