[PATCH 3.15 36/61] Drivers: hv: balloon: Ensure pressure reports are posted regularly

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: K. Y. Srinivasan k...@microsoft.com

commit ae339336dc950b9b05e7ccd3565dd3e8781c06d9 upstream.

The current code posts periodic memory pressure status from a dedicated thread.
Under some conditions, especially when we are releasing a lot of memory into
the guest, we may not send timely pressure reports back to the host. Fix this
issue by reporting pressure in all contexts that can be active in this driver.

Signed-off-by: K. Y. Srinivasan k...@microsoft.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/hv/hv_balloon.c |   29 ++---
 1 file changed, 26 insertions(+), 3 deletions(-)

--- a/drivers/hv/hv_balloon.c
+++ b/drivers/hv/hv_balloon.c
@@ -19,6 +19,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME :  fmt
 
 #include linux/kernel.h
+#include linux/jiffies.h
 #include linux/mman.h
 #include linux/delay.h
 #include linux/init.h
@@ -459,6 +460,11 @@ static bool do_hot_add;
  */
 static uint pressure_report_delay = 45;
 
+/*
+ * The last time we posted a pressure report to host.
+ */
+static unsigned long last_post_time;
+
 module_param(hot_add, bool, (S_IRUGO | S_IWUSR));
 MODULE_PARM_DESC(hot_add, If set attempt memory hot_add);
 
@@ -542,6 +548,7 @@ struct hv_dynmem_device {
 
 static struct hv_dynmem_device dm_device;
 
+static void post_status(struct hv_dynmem_device *dm);
 #ifdef CONFIG_MEMORY_HOTPLUG
 
 static void hv_bring_pgs_online(unsigned long start_pfn, unsigned long size)
@@ -612,7 +619,7 @@ static void hv_mem_hot_add(unsigned long
 * have not been onlined within the allowed time.
 */
wait_for_completion_timeout(dm_device.ol_waitevent, 5*HZ);
-
+   post_status(dm_device);
}
 
return;
@@ -951,11 +958,17 @@ static void post_status(struct hv_dynmem
 {
struct dm_status status;
struct sysinfo val;
+   unsigned long now = jiffies;
+   unsigned long last_post = last_post_time;
 
if (pressure_report_delay  0) {
--pressure_report_delay;
return;
}
+
+   if (!time_after(now, (last_post_time + HZ)))
+   return;
+
si_meminfo(val);
memset(status, 0, sizeof(struct dm_status));
status.hdr.type = DM_STATUS_REPORT;
@@ -983,6 +996,14 @@ static void post_status(struct hv_dynmem
if (status.hdr.trans_id != atomic_read(trans_id))
return;
 
+   /*
+* If the last post time that we sampled has changed,
+* we have raced, don't post the status.
+*/
+   if (last_post != last_post_time)
+   return;
+
+   last_post_time = jiffies;
vmbus_sendpacket(dm-dev-channel, status,
sizeof(struct dm_status),
(unsigned long)NULL,
@@ -1117,7 +1138,7 @@ static void balloon_up(struct work_struc
 
if (ret == -EAGAIN)
msleep(20);
-
+   post_status(dm_device);
} while (ret == -EAGAIN);
 
if (ret) {
@@ -1144,8 +1165,10 @@ static void balloon_down(struct hv_dynme
struct dm_unballoon_response resp;
int i;
 
-   for (i = 0; i  range_count; i++)
+   for (i = 0; i  range_count; i++) {
free_balloon_pages(dm, range_array[i]);
+   post_status(dm_device);
+   }
 
if (req-more_pages == 1)
return;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 27/61] USB: cdc-acm: fix write and resume race

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold jhov...@gmail.com

commit e144ed28bed10684f9aaec6325ed974d53f76110 upstream.

Fix race between write() and resume() due to improper locking that could
lead to writes being reordered.

Resume must be done atomically and susp_count be protected by the
write_lock in order to prevent racing with write(). This could otherwise
lead to writes being reordered if write() grabs the write_lock after
susp_count is decremented, but before the delayed urb is submitted.

Fixes: 11ea859d64b6 (USB: additional power savings for cdc-acm devices
that support remote wakeup)

Signed-off-by: Johan Hovold jhov...@gmail.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/usb/class/cdc-acm.c |   23 +--
 1 file changed, 9 insertions(+), 14 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1541,27 +1541,20 @@ static int acm_resume(struct usb_interfa
struct acm *acm = usb_get_intfdata(intf);
struct acm_wb *wb;
int rv = 0;
-   int cnt;
 
spin_lock_irq(acm-read_lock);
-   acm-susp_count -= 1;
-   cnt = acm-susp_count;
-   spin_unlock_irq(acm-read_lock);
+   spin_lock(acm-write_lock);
 
-   if (cnt)
-   return 0;
+   if (--acm-susp_count)
+   goto out;
 
if (test_bit(ASYNCB_INITIALIZED, acm-port.flags)) {
-   rv = usb_submit_urb(acm-ctrlurb, GFP_NOIO);
+   rv = usb_submit_urb(acm-ctrlurb, GFP_ATOMIC);
 
-   spin_lock_irq(acm-write_lock);
if (acm-delayed_wb) {
wb = acm-delayed_wb;
acm-delayed_wb = NULL;
-   spin_unlock_irq(acm-write_lock);
acm_start_wb(acm, wb);
-   } else {
-   spin_unlock_irq(acm-write_lock);
}
 
/*
@@ -1569,12 +1562,14 @@ static int acm_resume(struct usb_interfa
 * do the write path at all cost
 */
if (rv  0)
-   goto err_out;
+   goto out;
 
-   rv = acm_submit_read_urbs(acm, GFP_NOIO);
+   rv = acm_submit_read_urbs(acm, GFP_ATOMIC);
}
+out:
+   spin_unlock(acm-write_lock);
+   spin_unlock_irq(acm-read_lock);
 
-err_out:
return rv;
 }
 


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 45/61] iio: adc: at91: signedness bug in at91_adc_get_trigger_value_by_name()

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter dan.carpen...@oracle.com

commit 4f3bcd878f1d3c730fe00f619b7260c6125d49eb upstream.

at91_adc_get_trigger_value_by_name() was returning -ENOMEM truncated to
a positive u8 and that doesn't work.  I've changed it to int and
refactored it to preserve the error code.

Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
Acked-by: Alexandre Belloni alexandre.bell...@free-electrons.com
Tested-by: Alexandre Belloni alexandre.bell...@free-electrons.com
Signed-off-by: Jonathan Cameron ji...@kernel.org
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/iio/adc/at91_adc.c |   16 
 1 file changed, 8 insertions(+), 8 deletions(-)

--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -322,12 +322,11 @@ static int at91_adc_channel_init(struct
return idev-num_channels;
 }
 
-static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev,
+static int at91_adc_get_trigger_value_by_name(struct iio_dev *idev,
 struct at91_adc_trigger *triggers,
 const char *trigger_name)
 {
struct at91_adc_state *st = iio_priv(idev);
-   u8 value = 0;
int i;
 
for (i = 0; i  st-trigger_number; i++) {
@@ -340,15 +339,16 @@ static u8 at91_adc_get_trigger_value_by_
return -ENOMEM;
 
if (strcmp(trigger_name, name) == 0) {
-   value = triggers[i].value;
kfree(name);
-   break;
+   if (triggers[i].value == 0)
+   return -EINVAL;
+   return triggers[i].value;
}
 
kfree(name);
}
 
-   return value;
+   return -EINVAL;
 }
 
 static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
@@ -358,14 +358,14 @@ static int at91_adc_configure_trigger(st
struct iio_buffer *buffer = idev-buffer;
struct at91_adc_reg_desc *reg = st-registers;
u32 status = at91_adc_readl(st, reg-trigger_register);
-   u8 value;
+   int value;
u8 bit;
 
value = at91_adc_get_trigger_value_by_name(idev,
   st-trigger_list,
   idev-trig-name);
-   if (value == 0)
-   return -EINVAL;
+   if (value  0)
+   return value;
 
if (state) {
st-buffer = kmalloc(idev-scan_bytes, GFP_KERNEL);


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 34/61] USB: cdc-acm: fix I/O after failed open

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold jhov...@gmail.com

commit e4c36076c2a6195ec62c35b03c3fde84d0087dc8 upstream.

Make sure to kill any already submitted read urbs on read-urb submission
failures in open in order to prevent doing I/O for a closed port.

Fixes: 088c64f81284 (USB: cdc-acm: re-write read processing)
Signed-off-by: Johan Hovold jhov...@gmail.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/usb/class/cdc-acm.c |3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -506,6 +506,7 @@ static int acm_port_activate(struct tty_
 {
struct acm *acm = container_of(port, struct acm, port);
int retval = -ENODEV;
+   int i;
 
dev_dbg(acm-control-dev, %s\n, __func__);
 
@@ -556,6 +557,8 @@ static int acm_port_activate(struct tty_
return 0;
 
 error_submit_read_urbs:
+   for (i = 0; i  acm-rx_buflimit; i++)
+   usb_kill_urb(acm-read_urbs[i]);
acm-ctrlout = 0;
acm_set_control(acm, acm-ctrlout);
 error_set_control:


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 42/61] staging: iio: tsl2x7x_core: fix proximity treshold

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Mario Schuknecht mario.schukne...@dresearch-fe.de

commit c404618cd06dad771495fe1cf9d5a63b5664f65f upstream.

Consider high byte of proximity min and max treshold in function
'tsl2x7x_chip_on'. So far, the high byte was not set.

Signed-off-by: Mario Schuknecht mario.schukne...@dresearch-fe.de
Signed-off-by: Jonathan Cameron ji...@kernel.org
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/staging/iio/light/tsl2x7x_core.c |8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/staging/iio/light/tsl2x7x_core.c
+++ b/drivers/staging/iio/light/tsl2x7x_core.c
@@ -667,9 +667,13 @@ static int tsl2x7x_chip_on(struct iio_de
chip-tsl2x7x_config[TSL2X7X_PRX_COUNT] =
chip-tsl2x7x_settings.prox_pulse_count;
chip-tsl2x7x_config[TSL2X7X_PRX_MINTHRESHLO] =
-   chip-tsl2x7x_settings.prox_thres_low;
+   (chip-tsl2x7x_settings.prox_thres_low)  0xFF;
+   chip-tsl2x7x_config[TSL2X7X_PRX_MINTHRESHHI] =
+   (chip-tsl2x7x_settings.prox_thres_low  8)  0xFF;
chip-tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHLO] =
-   chip-tsl2x7x_settings.prox_thres_high;
+   (chip-tsl2x7x_settings.prox_thres_high)  0xFF;
+   chip-tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHHI] =
+   (chip-tsl2x7x_settings.prox_thres_high  8)  0xFF;
 
/* and make sure we're not already on */
if (chip-tsl2x7x_chip_status == TSL2X7X_CHIP_WORKING) {


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 55/61] ALSA: control: Protect user controls against concurrent access

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen l...@metafoo.de

commit 07f4d9d74a04aa7c72c5dae0ef97565f28f17b92 upstream.

The user-control put and get handlers as well as the tlv do not protect against
concurrent access from multiple threads. Since the state of the control is not
updated atomically it is possible that either two write operations or a write
and a read operation race against each other. Both can lead to arbitrary memory
disclosure. This patch introduces a new lock that protects user-controls from
concurrent access. Since applications typically access controls sequentially
than in parallel a single lock per card should be fine.

Signed-off-by: Lars-Peter Clausen l...@metafoo.de
Acked-by: Jaroslav Kysela pe...@perex.cz
Signed-off-by: Takashi Iwai ti...@suse.de
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 include/sound/core.h |2 ++
 sound/core/control.c |   31 +--
 sound/core/init.c|1 +
 3 files changed, 28 insertions(+), 6 deletions(-)

--- a/include/sound/core.h
+++ b/include/sound/core.h
@@ -116,6 +116,8 @@ struct snd_card {
int user_ctl_count; /* count of all user controls */
struct list_head controls;  /* all controls for this card */
struct list_head ctl_files; /* active control files */
+   struct mutex user_ctl_lock; /* protects user controls against
+  concurrent access */
 
struct snd_info_entry *proc_root;   /* root for soundcard specific 
files */
struct snd_info_entry *proc_id; /* the card id */
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -991,6 +991,7 @@ static int snd_ctl_elem_unlock(struct sn
 
 struct user_element {
struct snd_ctl_elem_info info;
+   struct snd_card *card;
void *elem_data;/* element data */
unsigned long elem_data_size;   /* size of element data in bytes */
void *tlv_data; /* TLV data */
@@ -1034,7 +1035,9 @@ static int snd_ctl_elem_user_get(struct
 {
struct user_element *ue = kcontrol-private_data;
 
+   mutex_lock(ue-card-user_ctl_lock);
memcpy(ucontrol-value, ue-elem_data, ue-elem_data_size);
+   mutex_unlock(ue-card-user_ctl_lock);
return 0;
 }
 
@@ -1043,10 +1046,12 @@ static int snd_ctl_elem_user_put(struct
 {
int change;
struct user_element *ue = kcontrol-private_data;
-   
+
+   mutex_lock(ue-card-user_ctl_lock);
change = memcmp(ucontrol-value, ue-elem_data, ue-elem_data_size) != 
0;
if (change)
memcpy(ue-elem_data, ucontrol-value, ue-elem_data_size);
+   mutex_unlock(ue-card-user_ctl_lock);
return change;
 }
 
@@ -1066,19 +1071,32 @@ static int snd_ctl_elem_user_tlv(struct
new_data = memdup_user(tlv, size);
if (IS_ERR(new_data))
return PTR_ERR(new_data);
+   mutex_lock(ue-card-user_ctl_lock);
change = ue-tlv_data_size != size;
if (!change)
change = memcmp(ue-tlv_data, new_data, size);
kfree(ue-tlv_data);
ue-tlv_data = new_data;
ue-tlv_data_size = size;
+   mutex_unlock(ue-card-user_ctl_lock);
} else {
-   if (! ue-tlv_data_size || ! ue-tlv_data)
-   return -ENXIO;
-   if (size  ue-tlv_data_size)
-   return -ENOSPC;
+   int ret = 0;
+
+   mutex_lock(ue-card-user_ctl_lock);
+   if (!ue-tlv_data_size || !ue-tlv_data) {
+   ret = -ENXIO;
+   goto err_unlock;
+   }
+   if (size  ue-tlv_data_size) {
+   ret = -ENOSPC;
+   goto err_unlock;
+   }
if (copy_to_user(tlv, ue-tlv_data, ue-tlv_data_size))
-   return -EFAULT;
+   ret = -EFAULT;
+err_unlock:
+   mutex_unlock(ue-card-user_ctl_lock);
+   if (ret)
+   return ret;
}
return change;
 }
@@ -1210,6 +1228,7 @@ static int snd_ctl_elem_add(struct snd_c
ue = kzalloc(sizeof(struct user_element) + private_size, GFP_KERNEL);
if (ue == NULL)
return -ENOMEM;
+   ue-card = card;
ue-info = *info;
ue-info.access = 0;
ue-elem_data = (char *)ue + sizeof(*ue);
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -232,6 +232,7 @@ int snd_card_new(struct device *parent,
INIT_LIST_HEAD(card-devices);
init_rwsem(card-controls_rwsem);
rwlock_init(card-ctl_files_rwlock);
+   mutex_init(card-user_ctl_lock);
INIT_LIST_HEAD(card-controls);
INIT_LIST_HEAD(card-ctl_files);

Re: [PATCH v6 1/4] arm: fiq: Add callbacks to manage FIQ routings

[Daniel Thompson]

On 24/06/14 16:44, Nicolas Pitre wrote:
 On Tue, 24 Jun 2014, Daniel Thompson wrote:
 
 Currently enable_fiq/disable_fiq use a simple offset to convert an IRQ
 virq into a FIQ virq. This is too inflexible for multi-platform kernels
 and makes runtime error checking impossible.

 We solve this by introducing a flexible mapping that allows interrupt
 controllers that support FIQ to register those mappings. This, in turn,
 makes it much possible for drivers in DT kernels to install FIQ handlers
 without knowing anything about the interrupt controller.

 Signed-off-by: Daniel Thompson daniel.thomp...@linaro.org
 Cc: Russell King li...@arm.linux.org.uk
 Cc: Fabio Estevam feste...@gmail.com
 Cc: Nicolas Pitre n...@linaro.org
 ---
  arch/arm/include/asm/fiq.h |   7 +++
  arch/arm/kernel/fiq.c  | 103 
 -
  2 files changed, 108 insertions(+), 2 deletions(-)
 
 [...]
 
 +bool has_fiq(int fiq)
 +{
 +struct fiq_data *data = lookup_fiq_data(fiq);
 +
 +if (data)
 +return true;
 +
 +if (fiq_start == -1)
 +return false;
 +
 +return fiq  fiq_start;
 
 Shouldn't this be fiq = fiq_start ?

Absolutely! Will fix that shortly.


Thanks

Daniel.


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 03/61] iscsi-target: Reject mutual authentication with reflected CHAP_C

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Nicholas Bellinger n...@linux-iscsi.org

commit 1d2b60a5545942b1376cb48c1d55843d71e3a08f upstream.

This patch adds an explicit check in chap_server_compute_md5() to ensure
the CHAP_C value received from the initiator during mutual authentication
does not match the original CHAP_C provided by the target.

This is in line with RFC-3720, section 8.2.1:

   Originators MUST NOT reuse the CHAP challenge sent by the Responder
   for the other direction of a bidirectional authentication.
   Responders MUST check for this condition and close the iSCSI TCP
   connection if it occurs.

Reported-by: Tejas Vaykole tejas.vayk...@calsoftinc.com
Signed-off-by: Nicholas Bellinger n...@linux-iscsi.org
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/target/iscsi/iscsi_target_auth.c |   10 ++
 1 file changed, 10 insertions(+)

--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -314,6 +314,16 @@ static int chap_server_compute_md5(
goto out;
}
/*
+* During mutual authentication, the CHAP_C generated by the
+* initiator must not match the original CHAP_C generated by
+* the target.
+*/
+   if (!memcmp(challenge_binhex, chap-challenge, CHAP_CHALLENGE_LENGTH)) {
+   pr_err(initiator CHAP_C matches target CHAP_C, failing
+   login attempt\n);
+   goto out;
+   }
+   /*
 * Generate CHAP_N and CHAP_R for mutual authentication.
 */
tfm = crypto_alloc_hash(md5, 0, CRYPTO_ALG_ASYNC);


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 20/61] vxlan: use dev-needed_headroom instead of dev-hard_header_len

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Cong Wang cw...@twopensource.com

[ Upstream commit 2853af6a2ea1a8ed09b09dd4fb578e7f435e8d34 ]

When we mirror packets from a vxlan tunnel to other device,
the mirror device should see the same packets (that is, without
outer header). Because vxlan tunnel sets dev-hard_header_len,
tcf_mirred() resets mac header back to outer mac, the mirror device
actually sees packets with outer headers

Vxlan tunnel should set dev-needed_headroom instead of
dev-hard_header_len, like what other ip tunnels do. This fixes
the above problem.

Cc: David S. Miller da...@davemloft.net
Cc: stephen hemminger step...@networkplumber.org
Cc: Pravin B Shelar pshe...@nicira.com
Signed-off-by: Cong Wang cw...@twopensource.com
Signed-off-by: Cong Wang xiyou.wangc...@gmail.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 drivers/net/vxlan.c |7 +++
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2275,9 +2275,9 @@ static void vxlan_setup(struct net_devic
eth_hw_addr_random(dev);
ether_setup(dev);
if (vxlan-default_dst.remote_ip.sa.sa_family == AF_INET6)
-   dev-hard_header_len = ETH_HLEN + VXLAN6_HEADROOM;
+   dev-needed_headroom = ETH_HLEN + VXLAN6_HEADROOM;
else
-   dev-hard_header_len = ETH_HLEN + VXLAN_HEADROOM;
+   dev-needed_headroom = ETH_HLEN + VXLAN_HEADROOM;
 
dev-netdev_ops = vxlan_netdev_ops;
dev-destructor = free_netdev;
@@ -2660,8 +2660,7 @@ static int vxlan_newlink(struct net *net
if (!tb[IFLA_MTU])
dev-mtu = lowerdev-mtu - (use_ipv6 ? VXLAN6_HEADROOM 
: VXLAN_HEADROOM);
 
-   /* update header length based on lower device */
-   dev-hard_header_len = lowerdev-hard_header_len +
+   dev-needed_headroom = lowerdev-hard_header_len +
   (use_ipv6 ? VXLAN6_HEADROOM : 
VXLAN_HEADROOM);
} else if (use_ipv6)
vxlan-flags |= VXLAN_F_IPV6;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 28/61] USB: cdc-acm: fix broken runtime suspend

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold jhov...@gmail.com

commit 140cb81ac8c625942a1d695875932c615767a526 upstream.

The current ACM runtime-suspend implementation is broken in several
ways:

Firstly, it buffers only the first write request being made while
suspended -- any further writes are silently dropped.

Secondly, writes being dropped also leak write urbs, which are never
reclaimed (until the device is unbound).

Thirdly, even the single buffered write is not cleared at shutdown
(which may happen before the device is resumed), something which can
lead to another urb leak as well as a PM usage-counter leak.

Fix this by implementing a delayed-write queue using urb anchors and
making sure to discard the queue properly at shutdown.

Fixes: 11ea859d64b6 (USB: additional power savings for cdc-acm devices
that support remote wakeup)

Reported-by: Xiao Jin jin.x...@intel.com
Signed-off-by: Johan Hovold jhov...@gmail.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/usb/class/cdc-acm.c |   32 ++--
 drivers/usb/class/cdc-acm.h |2 +-
 2 files changed, 23 insertions(+), 11 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -573,6 +573,8 @@ static void acm_port_destruct(struct tty
 static void acm_port_shutdown(struct tty_port *port)
 {
struct acm *acm = container_of(port, struct acm, port);
+   struct urb *urb;
+   struct acm_wb *wb;
int i;
 
dev_dbg(acm-control-dev, %s\n, __func__);
@@ -581,6 +583,16 @@ static void acm_port_shutdown(struct tty
if (!acm-disconnected) {
usb_autopm_get_interface(acm-control);
acm_set_control(acm, acm-ctrlout = 0);
+
+   for (;;) {
+   urb = usb_get_from_anchor(acm-delayed);
+   if (!urb)
+   break;
+   wb = urb-context;
+   wb-use = 0;
+   usb_autopm_put_interface_async(acm-control);
+   }
+
usb_kill_urb(acm-ctrlurb);
for (i = 0; i  ACM_NW; i++)
usb_kill_urb(acm-wb[i].urb);
@@ -648,12 +660,9 @@ static int acm_tty_write(struct tty_stru
 
usb_autopm_get_interface_async(acm-control);
if (acm-susp_count) {
-   if (!acm-delayed_wb)
-   acm-delayed_wb = wb;
-   else
-   usb_autopm_put_interface_async(acm-control);
+   usb_anchor_urb(wb-urb, acm-delayed);
spin_unlock_irqrestore(acm-write_lock, flags);
-   return count;   /* A white lie */
+   return count;
}
usb_mark_last_busy(acm-dev);
 
@@ -1269,6 +1278,7 @@ made_compressed_probe:
acm-bInterval = epread-bInterval;
tty_port_init(acm-port);
acm-port.ops = acm_port_ops;
+   init_usb_anchor(acm-delayed);
 
buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, acm-ctrl_dma);
if (!buf) {
@@ -1539,7 +1549,7 @@ static int acm_suspend(struct usb_interf
 static int acm_resume(struct usb_interface *intf)
 {
struct acm *acm = usb_get_intfdata(intf);
-   struct acm_wb *wb;
+   struct urb *urb;
int rv = 0;
 
spin_lock_irq(acm-read_lock);
@@ -1551,10 +1561,12 @@ static int acm_resume(struct usb_interfa
if (test_bit(ASYNCB_INITIALIZED, acm-port.flags)) {
rv = usb_submit_urb(acm-ctrlurb, GFP_ATOMIC);
 
-   if (acm-delayed_wb) {
-   wb = acm-delayed_wb;
-   acm-delayed_wb = NULL;
-   acm_start_wb(acm, wb);
+   for (;;) {
+   urb = usb_get_from_anchor(acm-delayed);
+   if (!urb)
+   break;
+
+   acm_start_wb(acm, urb-context);
}
 
/*
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -120,7 +120,7 @@ struct acm {
unsigned int throttled:1;   /* actually throttled */
unsigned int throttle_req:1;/* throttle requested */
u8 bInterval;
-   struct acm_wb *delayed_wb;  /* write queued for a 
device about to be woken */
+   struct usb_anchor delayed;  /* writes queued for a 
device about to be woken */
 };
 
 #define CDC_DATA_INTERFACE_TYPE0x0a


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 21/61] udp: ipv4: do not waste time in __udp4_lib_mcast_demux_lookup

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric Dumazet eduma...@google.com

[ Upstream commit 63c6f81cdde58c41da62a8d8a209592e42a0203e ]

Its too easy to add thousand of UDP sockets on a particular bucket,
and slow down an innocent multicast receiver.

Early demux is supposed to be an optimization, we should avoid spending
too much time in it.

It is interesting to note __udp4_lib_demux_lookup() only tries to
match first socket in the chain.

10 is the threshold we already have in __udp4_lib_lookup() to switch
to secondary hash.

Fixes: 421b3885bf6d5 (udp: ipv4: Add udp early demux)
Signed-off-by: Eric Dumazet eduma...@google.com
Reported-by: David Held drh...@google.com
Cc: Shawn Bohrer sboh...@rgmadvisors.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 net/ipv4/udp.c |4 
 1 file changed, 4 insertions(+)

--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1834,6 +1834,10 @@ static struct sock *__udp4_lib_mcast_dem
unsigned int count, slot = udp_hashfn(net, hnum, udp_table.mask);
struct udp_hslot *hslot = udp_table.hash[slot];
 
+   /* Do not bother scanning a too big list */
+   if (hslot-count  10)
+   return NULL;
+
rcu_read_lock();
 begin:
count = 0;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 29/61] USB: cdc-acm: fix runtime PM for control messages

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold jhov...@gmail.com

commit bae3f4c53585e9a170da9436e0f06919874bda9a upstream.

Fix runtime PM handling of control messages by adding the required PM
counter operations.

Fixes: 11ea859d64b6 (USB: additional power savings for cdc-acm devices
that support remote wakeup)

Signed-off-by: Johan Hovold jhov...@gmail.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/usb/class/cdc-acm.c |   12 +++-
 1 file changed, 11 insertions(+), 1 deletion(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -122,13 +122,23 @@ static void acm_release_minor(struct acm
 static int acm_ctrl_msg(struct acm *acm, int request, int value,
void *buf, int len)
 {
-   int retval = usb_control_msg(acm-dev, usb_sndctrlpipe(acm-dev, 0),
+   int retval;
+
+   retval = usb_autopm_get_interface(acm-control);
+   if (retval)
+   return retval;
+
+   retval = usb_control_msg(acm-dev, usb_sndctrlpipe(acm-dev, 0),
request, USB_RT_ACM, value,
acm-control-altsetting[0].desc.bInterfaceNumber,
buf, len, 5000);
+
dev_dbg(acm-control-dev,
%s - rq 0x%02x, val %#x, len %#x, result %d\n,
__func__, request, value, len, retval);
+
+   usb_autopm_put_interface(acm-control);
+
return retval  0 ? retval : 0;
 }
 


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 12/61] net: filter: fix sparc32 typo

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Alexei Starovoitov a...@plumgrid.com

[ Upstream commit 588f5d629b3369aba88f52217d1c473a28fa7723 ]

Fixes: 569810d1e327 (net: filter: fix typo in sparc BPF JIT)
Signed-off-by: Alexei Starovoitov a...@plumgrid.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 arch/sparc/net/bpf_jit_comp.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -85,7 +85,7 @@ static void bpf_flush_icache(void *start
 #ifdef CONFIG_SPARC64
 #define BE_PTR (F2(0, 1) | CONDE | (2  20))
 #else
-#define BE_PTR BNE
+#define BE_PTR BE
 #endif
 
 #define SETHI(K, REG)  \


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH v2 3/4] clk: samsung: Add driver to control CLKOUT line on Exynos SoCs

[Tomasz Figa]

This patch introduces a driver that handles configuration of CLKOUT pin
of Exynos SoCs that can be used to output certain clocks from inside of
the SoC to a dedicated output pin.

Signed-off-by: Tomasz Figa t.f...@samsung.com
---
 .../devicetree/bindings/arm/samsung/pmu.txt|  30 
 drivers/clk/samsung/Makefile   |   1 +
 drivers/clk/samsung/clk-exynos-clkout.c| 153 +
 3 files changed, 184 insertions(+)
 create mode 100644 drivers/clk/samsung/clk-exynos-clkout.c

diff --git a/Documentation/devicetree/bindings/arm/samsung/pmu.txt 
b/Documentation/devicetree/bindings/arm/samsung/pmu.txt
index 2a4ab04..f9865e7 100644
--- a/Documentation/devicetree/bindings/arm/samsung/pmu.txt
+++ b/Documentation/devicetree/bindings/arm/samsung/pmu.txt
@@ -12,8 +12,38 @@ Properties:
 
  - reg : offset and length of the register set.
 
+ - #clock-cells : must be 1, since PMU requires once cell as clock specifier.
+   The single specifier cell is used as index to list of clocks
+   provided by PMU, which is currently:
+   0 : SoC clock output (CLKOUT pin)
+
+ - clock-names : list of clock names for particular CLKOUT mux inputs in
+   following format:
+   clkoutN, where N is a decimal number corresponding to
+   CLKOUT mux control bits value for given input, e.g.
+   clkout0, clkout7, clkout15.
+
+ - clocks : list of phandles and specifiers to all input clocks listed in
+   clock-names property.
+
 Example :
 pmu_system_controller: system-controller@1004 {
compatible = samsung,exynos5250-pmu, syscon;
reg = 0x1004 0x5000;
+   #clock-cells = 1;
+   clock-names = clkout0, clkout1, clkout2, clkout3,
+   clkout4, clkout8, clkout9;
+   clocks = clock CLK_OUT_DMC, clock CLK_OUT_TOP,
+   clock CLK_OUT_LEFTBUS, clock CLK_OUT_RIGHTBUS,
+   clock CLK_OUT_CPU, clock CLK_XXTI,
+   clock CLK_XUSBXTI;
+};
+
+Example of clock consumer :
+
+usb3503: usb3503@08 {
+   /* ... */
+   clock-names = refclk;
+   clocks = pmu_system_controller 0;
+   /* ... */
 };
diff --git a/drivers/clk/samsung/Makefile b/drivers/clk/samsung/Makefile
index 69e8177..2949a55 100644
--- a/drivers/clk/samsung/Makefile
+++ b/drivers/clk/samsung/Makefile
@@ -11,6 +11,7 @@ obj-$(CONFIG_SOC_EXYNOS5410)  += clk-exynos5410.o
 obj-$(CONFIG_SOC_EXYNOS5420)   += clk-exynos5420.o
 obj-$(CONFIG_SOC_EXYNOS5440)   += clk-exynos5440.o
 obj-$(CONFIG_ARCH_EXYNOS)  += clk-exynos-audss.o
+obj-$(CONFIG_ARCH_EXYNOS)  += clk-exynos-clkout.o
 obj-$(CONFIG_S3C2410_COMMON_CLK)+= clk-s3c2410.o
 obj-$(CONFIG_S3C2410_COMMON_DCLK)+= clk-s3c2410-dclk.o
 obj-$(CONFIG_S3C2412_COMMON_CLK)+= clk-s3c2412.o
diff --git a/drivers/clk/samsung/clk-exynos-clkout.c 
b/drivers/clk/samsung/clk-exynos-clkout.c
new file mode 100644
index 000..3a7cb25
--- /dev/null
+++ b/drivers/clk/samsung/clk-exynos-clkout.c
@@ -0,0 +1,153 @@
+/*
+ * Copyright (c) 2014 Samsung Electronics Co., Ltd.
+ * Author: Tomasz Figa t.f...@samsung.com
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Clock driver for Exynos clock output
+ */
+
+#include linux/clk.h
+#include linux/clkdev.h
+#include linux/clk-provider.h
+#include linux/of.h
+#include linux/of_address.h
+#include linux/syscore_ops.h
+
+#define EXYNOS_CLKOUT_NR_CLKS  1
+#define EXYNOS_CLKOUT_PARENTS  32
+
+#define EXYNOS_PMU_DEBUG_REG   0xa00
+#define EXYNOS_CLKOUT_DISABLE_SHIFT0
+#define EXYNOS_CLKOUT_MUX_SHIFT8
+#define EXYNOS4_CLKOUT_MUX_MASK0xf
+#define EXYNOS5_CLKOUT_MUX_MASK0x1f
+
+struct exynos_clkout {
+   struct clk_gate gate;
+   struct clk_mux mux;
+   spinlock_t slock;
+   struct clk_onecell_data data;
+   struct clk *clk_table[EXYNOS_CLKOUT_NR_CLKS];
+   void __iomem *reg;
+   u32 pmu_debug_save;
+};
+
+static struct exynos_clkout *clkout;
+
+static int exynos_clkout_suspend(void)
+{
+   clkout-pmu_debug_save = readl(clkout-reg + EXYNOS_PMU_DEBUG_REG);
+
+   return 0;
+}
+
+static void exynos_clkout_resume(void)
+{
+   writel(clkout-pmu_debug_save, clkout-reg + EXYNOS_PMU_DEBUG_REG);
+}
+
+static struct syscore_ops exynos_clkout_syscore_ops = {
+   .suspend = exynos_clkout_suspend,
+   .resume = exynos_clkout_resume,
+};
+
+static void __init exynos_clkout_init(struct device_node *node, u32 mux_mask)
+{
+   const char *parent_names[EXYNOS_CLKOUT_PARENTS];
+   struct clk *parents[EXYNOS_CLKOUT_PARENTS];
+   int parent_count;
+   int ret;
+   int i;
+
+   clkout = kzalloc(sizeof(*clkout), GFP_KERNEL);
+   if (!clkout)
+   return;
+
+   

[PATCH 3.15 11/61] net: filter: fix typo in sparc BPF JIT

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Alexei Starovoitov a...@plumgrid.com

[ Upstream commit 569810d1e3278907264f5b115281fca3f0038d53 ]

fix typo in sparc codegen for SKF_AD_IFINDEX and SKF_AD_HATYPE
classic BPF extensions

Fixes: 2809a2087cc4 (net: filter: Just In Time compiler for sparc)
Signed-off-by: Alexei Starovoitov a...@plumgrid.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 arch/sparc/net/bpf_jit_comp.c |8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -83,9 +83,9 @@ static void bpf_flush_icache(void *start
 #define BNE(F2(0, 2) | CONDNE)
 
 #ifdef CONFIG_SPARC64
-#define BNE_PTR(F2(0, 1) | CONDNE | (2  20))
+#define BE_PTR (F2(0, 1) | CONDE | (2  20))
 #else
-#define BNE_PTRBNE
+#define BE_PTR BNE
 #endif
 
 #define SETHI(K, REG)  \
@@ -600,7 +600,7 @@ void bpf_jit_compile(struct sk_filter *f
case BPF_S_ANC_IFINDEX:
emit_skb_loadptr(dev, r_A);
emit_cmpi(r_A, 0);
-   emit_branch(BNE_PTR, cleanup_addr + 4);
+   emit_branch(BE_PTR, cleanup_addr + 4);
emit_nop();
emit_load32(r_A, struct net_device, ifindex, 
r_A);
break;
@@ -613,7 +613,7 @@ void bpf_jit_compile(struct sk_filter *f
case BPF_S_ANC_HATYPE:
emit_skb_loadptr(dev, r_A);
emit_cmpi(r_A, 0);
-   emit_branch(BNE_PTR, cleanup_addr + 4);
+   emit_branch(BE_PTR, cleanup_addr + 4);
emit_nop();
emit_load16(r_A, struct net_device, type, r_A);
break;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH v6 4/4] ARM: Add KGDB/KDB FIQ debugger generic code

[Russell King - ARM Linux]

On Tue, Jun 24, 2014 at 04:18:17PM +0100, Daniel Thompson wrote:
 + .align  5
 +__fiq_svc:
 + svc_entry

Remember that the registers you have on the stack here are r0-r12, plus
the SVC banked sp and lr registers.  These may not be the registers
from the mode you took the FIQ (eg, if it was IRQ, or abort mode.)

Also bear in mind that svc_entry calls trace_hardirqs_off - is this
appropriate and safe for the FIQ to call?

 + fiq_handler
 + mov r0, sp
 + ldmib   r0, {r1 - r14}

So this restores r1 to r12, and the SVC mode sp and lr registers.
Nothing touches the SVC SPSR, so we hope that retains its value
throughout the FIQ processing.  Note that the stack pointer at this
point will be above state which we have not yet read, so we better
not take any exceptions from this instruction (not even an imprecise
abort).

 + msr cpsr_c, #FIQ_MODE | PSR_I_BIT | PSR_F_BIT

Here we switch to FIQ mode.  What about the PSR_A_BIT which prevents
imprecise aborts on ARMv6+ ?

Nevertheless, I think it's safe because the A bit will be set by the
CPU when taking the FIQ exception, and it should remain set since
cpsr_c won't modify it.

 + add r8, r0, #S_PC
 + ldr r9, [r0, #S_PSR]
 + msr spsr_cxsf, r9

Here we update the FIQ SPSR with the calling mode's CPSR, ready to
return...

 + ldr r0, [r0, #S_R0]

Load the calling mode's R0 value.

 + ldmia   r8, {pc}^

And return (restoring CPSR from SPSR_fiq).

This looks pretty good except for the niggles...

-- 
FTTC broadband for 0.8mile line: now at 9.7Mbps down 460kbps up... slowly
improving, and getting towards what was expected from it.
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH v2 4/4] ARM: dts: exynos: Update PMU node with CLKOUT related data

[Tomasz Figa]

This patch extends nodes of PMU system controller on Exynos4210, 4x12,
5250 and 5420 SoCs with newly defined properties used by Exynos CLKOUT
driver.

Signed-off-by: Tomasz Figa t.f...@samsung.com
---
 arch/arm/boot/dts/exynos4210.dtsi | 10 ++
 arch/arm/boot/dts/exynos4x12.dtsi |  7 +++
 arch/arm/boot/dts/exynos5250.dtsi |  3 +++
 arch/arm/boot/dts/exynos5420.dtsi |  3 +++
 4 files changed, 23 insertions(+)

diff --git a/arch/arm/boot/dts/exynos4210.dtsi 
b/arch/arm/boot/dts/exynos4210.dtsi
index ee3001f..97ea7a9 100644
--- a/arch/arm/boot/dts/exynos4210.dtsi
+++ b/arch/arm/boot/dts/exynos4210.dtsi
@@ -31,6 +31,16 @@
pinctrl2 = pinctrl_2;
};
 
+   pmu_system_controller: system-controller@1002 {
+   clock-names = clkout0, clkout1, clkout2, clkout3,
+   clkout4, clkout8, clkout9;
+   clocks = clock CLK_OUT_DMC, clock CLK_OUT_TOP,
+   clock CLK_OUT_LEFTBUS, clock CLK_OUT_RIGHTBUS,
+   clock CLK_OUT_CPU, clock CLK_XXTI,
+   clock CLK_XUSBXTI;
+   #clock-cells = 1;
+   };
+
sysram@0202 {
compatible = mmio-sram;
reg = 0x0202 0x2;
diff --git a/arch/arm/boot/dts/exynos4x12.dtsi 
b/arch/arm/boot/dts/exynos4x12.dtsi
index c5a943d..de1f9c7 100644
--- a/arch/arm/boot/dts/exynos4x12.dtsi
+++ b/arch/arm/boot/dts/exynos4x12.dtsi
@@ -139,6 +139,13 @@
 
pmu_system_controller: system-controller@1002 {
compatible = samsung,exynos4212-pmu, syscon;
+   clock-names = clkout0, clkout1, clkout2, clkout3,
+   clkout4, clkout8, clkout9;
+   clocks = clock CLK_OUT_DMC, clock CLK_OUT_TOP,
+   clock CLK_OUT_LEFTBUS, clock CLK_OUT_RIGHTBUS,
+   clock CLK_OUT_CPU, clock CLK_XXTI,
+   clock CLK_XUSBXTI;
+   #clock-cells = 1;
};
 
g2d@1080 {
diff --git a/arch/arm/boot/dts/exynos5250.dtsi 
b/arch/arm/boot/dts/exynos5250.dtsi
index 834fb5a..492e1ef 100644
--- a/arch/arm/boot/dts/exynos5250.dtsi
+++ b/arch/arm/boot/dts/exynos5250.dtsi
@@ -191,6 +191,9 @@
pmu_system_controller: system-controller@1004 {
compatible = samsung,exynos5250-pmu, syscon;
reg = 0x1004 0x5000;
+   clock-names = clkout16;
+   clocks = clock CLK_FIN_PLL;
+   #clock-cells = 1;
};
 
sysreg_system_controller: syscon@1005 {
diff --git a/arch/arm/boot/dts/exynos5420.dtsi 
b/arch/arm/boot/dts/exynos5420.dtsi
index e385322..481beec 100644
--- a/arch/arm/boot/dts/exynos5420.dtsi
+++ b/arch/arm/boot/dts/exynos5420.dtsi
@@ -724,6 +724,9 @@
pmu_system_controller: system-controller@1004 {
compatible = samsung,exynos5420-pmu, syscon;
reg = 0x1004 0x5000;
+   clock-names = clkout16;
+   clocks = clock CLK_FIN_PLL;
+   #clock-cells = 1;
};
 
sysreg_system_controller: syscon@1005 {
-- 
1.9.3

--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH v2 0/4] Add support for Exynos clock output configuration

[Tomasz Figa]

On all Exynos SoCs there is a dedicated CLKOUT pin that allows many of
internal SoC clocks to be output from the SoC. The hardware structure
of CLKOUT related clocks looks as follows:

CMU |--- clock0 - |   PMU |
|   |   |
several |--- clock1 - |   mux |
muxes   |   |   +   |--- CLKOUT
dividers|   ... |   gate|
and gates   |   |   |
|--- clockN - |   |

Since the block responsible for handling the pin is PMU, not CMU,
a separate driver, that binds to PMU node is required and acquires
all input clocks by standard DT clock look-up. This way we don't need
any cross-IP block drivers and cross-driver register sharing or
nodes for fake devices.

To represent the PMU mux/gate clock, generic composite clock is registered.

Tested on Odroid U3, with HSIC/USB hub using CLKOUT as reference clock,
with some additional patches.

Changes since v1:
(http://www.spinics.net/lists/arm-kernel/msg333276.html)
 - rebased onto next-20140624,
 - fixed #clock-cells values in exynos5250.dtsi and exynos5420.dtsi,
 - temporarily removed ISP CLKOUT clocks on Exynos4x12, until ISP clock
   domain handling gets fixed in Exynos4 clock driver.
Changes since RFC v1:
(https://lkml.org/lkml/2014/5/15/506)
 - rebased onto v5 of Enable usbphy and hsotg for exynos4 series and
   current HEAD of samsung-clk tree,
 - added handling of suspend/resume in the driver,
 - added missing CPU clocks on Exynos4,
 - added CLK_SET_RATE_PARENT to CMU CLKOUT gates on Exynos4,
 - fixed bit field width on Exynos4,
 - added CLKOUT CMU registers of Exynos4 to save/restore list,
 - added CLK_SET_RATE_PARENT and CLK_SET_RATE_NO_REPARENT to clkout clock,
 - changed the binding to use 1-cell clock specifier to allow extension
   with further PMU clocks in future, if needed.

Tomasz Figa (4):
  clk: samsung: exynos4: Add missing CPU/DMC clock hierarchy
  clk: samsung: exynos4: Add CLKOUT clock hierarchy
  clk: samsung: Add driver to control CLKOUT line on Exynos SoCs
  ARM: dts: exynos: Update PMU node with CLKOUT related data

 .../devicetree/bindings/arm/samsung/pmu.txt|  30 
 arch/arm/boot/dts/exynos4210.dtsi  |  10 ++
 arch/arm/boot/dts/exynos4x12.dtsi  |   7 +
 arch/arm/boot/dts/exynos5250.dtsi  |   3 +
 arch/arm/boot/dts/exynos5420.dtsi  |   3 +
 drivers/clk/samsung/Makefile   |   1 +
 drivers/clk/samsung/clk-exynos-clkout.c| 153 +++
 drivers/clk/samsung/clk-exynos4.c  | 166 -
 include/dt-bindings/clock/exynos4.h|   5 +
 9 files changed, 374 insertions(+), 4 deletions(-)
 create mode 100644 drivers/clk/samsung/clk-exynos-clkout.c

-- 
1.9.3

--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 07/61] ipv6: Fix regression caused by efe4208 in udp_v6_mcast_next()

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Sven Wegener sven.wege...@stealer.net

[ Upstream commit 3bfdc59a6c24608ed23e903f670aaf5f58c7a6f3 ]

Commit efe4208 (ipv6: make lookups simpler and faster) introduced a
regression in udp_v6_mcast_next(), resulting in multicast packets not
reaching the destination sockets under certain conditions.

The packet's IPv6 addresses are wrongly compared to the IPv6 addresses
from the function's socket argument, which indicates the starting point
for looping, instead of the loop variable. If the addresses from the
first socket do not match the packet's addresses, no socket in the list
will match.

Signed-off-by: Sven Wegener sven.wege...@stealer.net
Acked-by: Eric Dumazet eduma...@google.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 net/ipv6/udp.c |8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -716,15 +716,15 @@ static struct sock *udp_v6_mcast_next(st
if (inet-inet_dport != rmt_port)
continue;
}
-   if (!ipv6_addr_any(sk-sk_v6_daddr) 
-   !ipv6_addr_equal(sk-sk_v6_daddr, rmt_addr))
+   if (!ipv6_addr_any(s-sk_v6_daddr) 
+   !ipv6_addr_equal(s-sk_v6_daddr, rmt_addr))
continue;
 
if (s-sk_bound_dev_if  s-sk_bound_dev_if != dif)
continue;
 
-   if (!ipv6_addr_any(sk-sk_v6_rcv_saddr)) {
-   if (!ipv6_addr_equal(sk-sk_v6_rcv_saddr, 
loc_addr))
+   if (!ipv6_addr_any(s-sk_v6_rcv_saddr)) {
+   if (!ipv6_addr_equal(s-sk_v6_rcv_saddr, 
loc_addr))
continue;
}
if (!inet6_mc_check(s, loc_addr, rmt_addr))


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [memcontrol] WARNING: CPU: 0 PID: 1 at kernel/res_counter.c:28 res_counter_uncharge_locked()

[Felipe Balbi]

On Fri, Jun 20, 2014 at 11:42:10AM -0400, Johannes Weiner wrote:
 On Fri, Jun 20, 2014 at 06:27:04PM +0800, Fengguang Wu wrote:
  Greetings,
  
  0day kernel testing robot got the below dmesg and the first bad commit is
  
  git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
 
 Thanks for the bisect.
 
  commit ddc5bfec501f4be3f9e89084c2db270c0c45d1d6
  Author: Johannes Weiner han...@cmpxchg.org
  AuthorDate: Fri Jun 20 10:27:58 2014 +1000
  Commit: Stephen Rothwell s...@canb.auug.org.au
  CommitDate: Fri Jun 20 10:27:58 2014 +1000
  
  mm: memcontrol: rewrite uncharge API
  
  The memcg uncharging code that is involved towards the end of a page's
  lifetime - truncation, reclaim, swapout, migration - is impressively
  complicated and fragile.
  
  Because anonymous and file pages were always charged before they had 
  their
  page-mapping established, uncharges had to happen when the page type
  could still be known from the context; as in unmap for anonymous, page
  cache removal for file and shmem pages, and swap cache truncation for 
  swap
  pages.  However, these operations happen well before the page is 
  actually
  freed, and so a lot of synchronization is necessary:
  
  - Charging, uncharging, page migration, and charge migration all need
to take a per-page bit spinlock as they could race with uncharging.
  
  - Swap cache truncation happens during both swap-in and swap-out, and
possibly repeatedly before the page is actually freed.  This means
that the memcg swapout code is called from many contexts that make
no sense and it has to figure out the direction from page state to
make sure memory and memory+swap are always correctly charged.
  
  - On page migration, the old page might be unmapped but then reused,
so memcg code has to prevent untimely uncharging in that case.
Because this code - which should be a simple charge transfer - is so
special-cased, it is not reusable for replace_page_cache().
  
  But now that charged pages always have a page-mapping, introduce
  mem_cgroup_uncharge(), which is called after the final put_page(), when 
  we
  know for sure that nobody is looking at the page anymore.
  
  For page migration, introduce mem_cgroup_migrate(), which is called 
  after
  the migration is successful and the new page is fully rmapped.  Because
  the old page is no longer uncharged after migration, prevent double
  charges by decoupling the page's memcg association (PCG_USED and
  pc-mem_cgroup) from the page holding an actual charge.  The new bits
  PCG_MEM and PCG_MEMSW represent the respective charges and are 
  transferred
  to the new page during migration.
  
  mem_cgroup_migrate() is suitable for replace_page_cache() as well, which
  gets rid of mem_cgroup_replace_page_cache().
  
  Swap accounting is massively simplified: because the page is no longer
  uncharged as early as swap cache deletion, a new mem_cgroup_swapout() 
  can
  transfer the page's memory+swap charge (PCG_MEMSW) to the swap entry
  before the final put_page() in page reclaim.
  
  Finally, page_cgroup changes are now protected by whatever protection 
  the
  page itself offers: anonymous pages are charged under the page table 
  lock,
  whereas page cache insertions, swapin, and migration hold the page lock.
  Uncharging happens under full exclusion with no outstanding references.
  Charging and uncharging also ensure that the page is off-LRU, which
  serializes against charge migration.  Remove the very costly page_cgroup
  lock and set pc-flags non-atomically.
  
  Signed-off-by: Johannes Weiner han...@cmpxchg.org
  Cc: Michal Hocko mho...@suse.cz
  Cc: Hugh Dickins hu...@google.com
  Cc: Tejun Heo t...@kernel.org
  Cc: Vladimir Davydov vdavy...@parallels.com
  Signed-off-by: Andrew Morton a...@linux-foundation.org
  
  +---+++---+
  |   | 
  5b647620c6 | ddc5bfec50 | next-20140620 |
  +---+++---+
  | boot_successes| 
  60 | 0  | 0 |
  | boot_failures | 0 
   | 20 | 13|
  | WARNING:CPU:PID:at_kernel/res_counter.c:res_counter_uncharge_locked() | 0 
   | 20 | 13|
  | backtrace:vm_munmap   | 0 
   | 20 | 13|
  | backtrace:SyS_munmap  

Re: Re: [PATCH v2 0/8] Add Keystone PCIe controller driver

[Murali Karicheri]

Pratyush,

On 06/23/2014 12:50 PM, Santosh Shilimkar wrote:




 Original Message 
Subject: Re: [PATCH v2 0/8] Add Keystone PCIe controller driver
On Sat, Jun 21, 2014 at 03:05:30AM +0800, Arnd Bergmann wrote:

On Friday 20 June 2014 13:11:37 Santosh Shilimkar wrote:





Arnd suggestion was to have the version 3.65 code in generic place since
its IP specific and just in case some other vendor using the same version
can leverage the code.


Sorry, I do not follow PCIe mailing list these days, doing something else
now. So coming to this topic a bit delayed.


My Apologies for the email format as I mysteriously lost this email and
had to resort to a forwarded email to respond to this.

Let us have the discussion on this thread as I lost the original emails.


Concern here seems toe really those name of the files. I can't think of
any other appropriate name.


We should definitely keep the version in the DT compatible strings
wherever we know it. Regarding a better file name, I have no idea.


In my opinion, we do not need any of dw-v3_65 files, as code in these
files will not be usable by other vendors.

Anything which is implemented in application space, will not be same
across all IP users. For example, MSI0_IRQ_ENABLE_SET has been defined
at offset 0x108 in keystone PCIe application space.Other vendor may
not have this register at the same offset. Moreover, other vendors are
not even obliged to implement MSI Enable signals in same way, so
internal bit definition of the register may change.

Therefore code is not reusable if all register offset and bit
definitions are not same across vendors. So, in case of DW driver none
of the code which are accessed using va_app_base should go to common
area.



I think based on the response far on this issue, it is best to keep
the Application specific code as part of Keystone driver and in
future if there is any driver that has similar application register
implemented. we can refactor the code and re-use.

My V3 will revert back to implementation similar to RFC. Also since this
is individual h/w specific, there is no no need for a compatibility as
well. Will use keystone specific compatibility string for this.

Arnd, hope this is fine. Please respond if you still think a 
compatibility string is needed.


Murali


Pratyush



Arnd





--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 15/61] ipip, sit: fix ipv4_{update_pmtu,redirect} calls

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Popov ixaph...@qrator.net

[ Upstream commit 2346829e641b804ece9ac9298136b56d9567c278 ]

ipv4_{update_pmtu,redirect} were called with tunnel's ifindex (t-dev is a
tunnel netdevice). It caused wrong route lookup and failure of pmtu update or
redirect. We should use the same ifindex that we use in ip_route_output_* in
*tunnel_xmit code. It is t-parms.link .

Signed-off-by: Dmitry Popov ixaph...@qrator.net
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 net/ipv4/ipip.c |4 ++--
 net/ipv6/sit.c  |4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -149,13 +149,13 @@ static int ipip_err(struct sk_buff *skb,
 
if (type == ICMP_DEST_UNREACH  code == ICMP_FRAG_NEEDED) {
ipv4_update_pmtu(skb, dev_net(skb-dev), info,
-t-dev-ifindex, 0, IPPROTO_IPIP, 0);
+t-parms.link, 0, IPPROTO_IPIP, 0);
err = 0;
goto out;
}
 
if (type == ICMP_REDIRECT) {
-   ipv4_redirect(skb, dev_net(skb-dev), t-dev-ifindex, 0,
+   ipv4_redirect(skb, dev_net(skb-dev), t-parms.link, 0,
  IPPROTO_IPIP, 0);
err = 0;
goto out;
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -560,12 +560,12 @@ static int ipip6_err(struct sk_buff *skb
 
if (type == ICMP_DEST_UNREACH  code == ICMP_FRAG_NEEDED) {
ipv4_update_pmtu(skb, dev_net(skb-dev), info,
-t-dev-ifindex, 0, IPPROTO_IPV6, 0);
+t-parms.link, 0, IPPROTO_IPV6, 0);
err = 0;
goto out;
}
if (type == ICMP_REDIRECT) {
-   ipv4_redirect(skb, dev_net(skb-dev), t-dev-ifindex, 0,
+   ipv4_redirect(skb, dev_net(skb-dev), t-parms.link, 0,
  IPPROTO_IPV6, 0);
err = 0;
goto out;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH v2 1/4] clk: samsung: exynos4: Add missing CPU/DMC clock hierarchy

[Tomasz Figa]

This patch adds missing definitions of clocks from CPU and DMC clock
domains, which are necessary to properly represent CLKOUT clock hierarchy
added in further patch.

Signed-off-by: Tomasz Figa t.f...@samsung.com
---
 drivers/clk/samsung/clk-exynos4.c | 50 +++
 1 file changed, 50 insertions(+)

diff --git a/drivers/clk/samsung/clk-exynos4.c 
b/drivers/clk/samsung/clk-exynos4.c
index 4f150c9..f95ae6c 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -397,10 +397,15 @@ PNAME(mout_audio2_p4210) = { cdclk2, none, 
sclk_hdmi24m,
sclk_epll, sclk_vpll, };
 PNAME(mout_mixer_p4210)= { sclk_dac, sclk_hdmi, };
 PNAME(mout_dac_p4210)  = { sclk_vpll, sclk_hdmiphy, };
+PNAME(mout_pwi_p4210) = { xxti, xusbxti, sclk_hdmi24m, sclk_usbphy0,
+   sclk_usbphy1, sclk_hdmiphy, none,
+   sclk_epll, sclk_vpll };
 
 /* Exynos 4x12-specific parent groups */
 PNAME(mout_mpll_user_p4x12) = { fin_pll, sclk_mpll, };
 PNAME(mout_core_p4x12) = { mout_apll, mout_mpll_user_c, };
+PNAME(mout_gdl_p4x12)  = { mout_mpll_user_l, sclk_apll, };
+PNAME(mout_gdr_p4x12)  = { mout_mpll_user_r, sclk_apll, };
 PNAME(sclk_ampll_p4x12)= { mout_mpll_user_t, sclk_apll, };
 PNAME(group1_p4x12)= { xxti, xusbxti, sclk_hdmi24m, sclk_usbphy0,
none, sclk_hdmiphy, mout_mpll_user_t,
@@ -418,6 +423,9 @@ PNAME(aclk_p4412)   = { mout_mpll_user_t, sclk_apll, };
 PNAME(mout_user_aclk400_mcuisp_p4x12) = {fin_pll, div_aclk400_mcuisp, };
 PNAME(mout_user_aclk200_p4x12) = {fin_pll, div_aclk200, };
 PNAME(mout_user_aclk266_gps_p4x12) = {fin_pll, div_aclk266_gps, };
+PNAME(mout_pwi_p4x12) = { xxti, xusbxti, sclk_hdmi24m, sclk_usbphy0,
+   none, sclk_hdmiphy, sclk_mpll,
+   sclk_epll, sclk_vpll };
 
 /* fixed rate clocks generated outside the soc */
 static struct samsung_fixed_rate_clock exynos4_fixed_rate_ext_clks[] 
__initdata = {
@@ -451,6 +459,9 @@ static struct samsung_mux_clock exynos4_mux_clks[] 
__initdata = {
MUX(0, mout_onenand1, mout_onenand1_p, SRC_TOP0, 0, 1),
MUX(CLK_SCLK_EPLL, sclk_epll, mout_epll_p, SRC_TOP0, 4, 1),
MUX(0, mout_onenand, mout_onenand_p, SRC_TOP0, 28, 1),
+
+   MUX(0, mout_dmc_bus, sclk_ampll_p4210, SRC_DMC, 4, 1),
+   MUX(0, mout_dphy, sclk_ampll_p4210, SRC_DMC, 8, 1),
 };
 
 /* list of mux clocks supported in exynos4210 soc */
@@ -459,6 +470,10 @@ static struct samsung_mux_clock exynos4210_mux_early[] 
__initdata = {
 };
 
 static struct samsung_mux_clock exynos4210_mux_clks[] __initdata = {
+   MUX(0, mout_gdl, sclk_ampll_p4210, SRC_LEFTBUS, 0, 1),
+
+   MUX(0, mout_gdr, sclk_ampll_p4210, SRC_RIGHTBUS, 0, 1),
+
MUX(0, mout_aclk200, sclk_ampll_p4210, SRC_TOP0, 12, 1),
MUX(0, mout_aclk100, sclk_ampll_p4210, SRC_TOP0, 16, 1),
MUX(0, mout_aclk160, sclk_ampll_p4210, SRC_TOP0, 20, 1),
@@ -472,6 +487,7 @@ static struct samsung_mux_clock exynos4210_mux_clks[] 
__initdata = {
MUX(0, mout_mipi1, group1_p4210, E4210_SRC_LCD1, 12, 4),
MUX(CLK_SCLK_MPLL, sclk_mpll, mout_mpll_p, SRC_CPU, 8, 1),
MUX(CLK_MOUT_CORE, mout_core, mout_core_p4210, SRC_CPU, 16, 1),
+   MUX(0, mout_hpm, mout_core_p4210, SRC_CPU, 20, 1),
MUX(CLK_SCLK_VPLL, sclk_vpll, sclk_vpll_p4210, SRC_TOP0, 8, 1),
MUX(CLK_MOUT_FIMC0, mout_fimc0, group1_p4210, SRC_CAM, 0, 4),
MUX(CLK_MOUT_FIMC1, mout_fimc1, group1_p4210, SRC_CAM, 4, 4),
@@ -503,10 +519,18 @@ static struct samsung_mux_clock exynos4210_mux_clks[] 
__initdata = {
MUX(0, mout_spi0, group1_p4210, SRC_PERIL1, 16, 4),
MUX(0, mout_spi1, group1_p4210, SRC_PERIL1, 20, 4),
MUX(0, mout_spi2, group1_p4210, SRC_PERIL1, 24, 4),
+
+   MUX(0, mout_pwi, mout_pwi_p4210, SRC_DMC, 16, 4),
 };
 
 /* list of mux clocks supported in exynos4x12 soc */
 static struct samsung_mux_clock exynos4x12_mux_clks[] __initdata = {
+   MUX(0, mout_mpll_user_l, mout_mpll_p, SRC_LEFTBUS, 4, 1),
+   MUX(0, mout_gdl, mout_gdl_p4x12, SRC_LEFTBUS, 0, 1),
+
+   MUX(0, mout_mpll_user_r, mout_mpll_p, SRC_RIGHTBUS, 4, 1),
+   MUX(0, mout_gdr, mout_gdr_p4x12, SRC_RIGHTBUS, 0, 1),
+
MUX(CLK_MOUT_MPLL_USER_C, mout_mpll_user_c, mout_mpll_user_p4x12,
SRC_CPU, 24, 1),
MUX(0, mout_aclk266_gps, aclk_p4412, SRC_TOP1, 4, 1),
@@ -531,6 +555,7 @@ static struct samsung_mux_clock exynos4x12_mux_clks[] 
__initdata = {
MUX(CLK_SCLK_MPLL, sclk_mpll, mout_mpll_p, SRC_DMC, 12, 1),
MUX(CLK_SCLK_VPLL, sclk_vpll, mout_vpll_p, SRC_TOP0, 8, 1),
MUX(CLK_MOUT_CORE, mout_core, mout_core_p4x12, SRC_CPU, 16, 1),
+   MUX(0, mout_hpm, mout_core_p4x12, SRC_CPU, 20, 1),
MUX(CLK_MOUT_FIMC0, mout_fimc0, group1_p4x12, SRC_CAM, 0, 4),
MUX(CLK_MOUT_FIMC1, mout_fimc1, group1_p4x12, SRC_CAM, 4, 4),

[PATCH 3.15 08/61] net: tunnels - enable module autoloading

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Tom Gundersen t...@jklm.no

[ Upstream commit f98f89a0104454f35a62d681683c844f6dbf4043 ]

Enable the module alias hookup to allow tunnel modules to be autoloaded on 
demand.

This is in line with how most other netdev kinds work, and will allow userspace
to create tunnels without having CAP_SYS_MODULE.

Signed-off-by: Tom Gundersen t...@jklm.no
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 net/ipv4/ipip.c   |1 +
 net/ipv6/ip6_tunnel.c |1 +
 net/ipv6/sit.c|1 +
 3 files changed, 3 insertions(+)

--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -486,4 +486,5 @@ static void __exit ipip_fini(void)
 module_init(ipip_init);
 module_exit(ipip_fini);
 MODULE_LICENSE(GPL);
+MODULE_ALIAS_RTNL_LINK(ipip);
 MODULE_ALIAS_NETDEV(tunl0);
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -61,6 +61,7 @@
 MODULE_AUTHOR(Ville Nuorvala);
 MODULE_DESCRIPTION(IPv6 tunneling device);
 MODULE_LICENSE(GPL);
+MODULE_ALIAS_RTNL_LINK(ip6tnl);
 MODULE_ALIAS_NETDEV(ip6tnl0);
 
 #ifdef IP6_TNL_DEBUG
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1828,4 +1828,5 @@ xfrm_tunnel_failed:
 module_init(sit_init);
 module_exit(sit_cleanup);
 MODULE_LICENSE(GPL);
+MODULE_ALIAS_RTNL_LINK(sit);
 MODULE_ALIAS_NETDEV(sit0);


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 06/61] evm: prohibit userspace writing security.evm HMAC value

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Mimi Zohar zo...@linux.vnet.ibm.com

commit 2fb1c9a4f2dbc2f0bd2431c7fa64d0b5483864e4 upstream.

Calculating the 'security.evm' HMAC value requires access to the
EVM encrypted key.  Only the kernel should have access to it.  This
patch prevents userspace tools(eg. setfattr, cp --preserve=xattr)
from setting/modifying the 'security.evm' HMAC value directly.

Signed-off-by: Mimi Zohar zo...@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 security/integrity/evm/evm_main.c |   12 ++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -287,12 +287,20 @@ out:
  * @xattr_value: pointer to the new extended attribute value
  * @xattr_value_len: pointer to the new extended attribute value length
  *
- * Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that
- * the current value is valid.
+ * Before allowing the 'security.evm' protected xattr to be updated,
+ * verify the existing value is valid.  As only the kernel should have
+ * access to the EVM encrypted key needed to calculate the HMAC, prevent
+ * userspace from writing HMAC value.  Writing 'security.evm' requires
+ * requires CAP_SYS_ADMIN privileges.
  */
 int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,
   const void *xattr_value, size_t xattr_value_len)
 {
+   const struct evm_ima_xattr_data *xattr_data = xattr_value;
+
+   if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0)
+(xattr_data-type == EVM_XATTR_HMAC))
+   return -EPERM;
return evm_protect_xattr(dentry, xattr_name, xattr_value,
 xattr_value_len);
 }


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 16/61] sfc: PIO:Restrict to 64bit arch and use 64-bit writes.

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Jon Cooper jcoo...@solarflare.com

[ Upstream commit daf37b556e437ec1ea1a597dcfeff338068380e1 ]

Fixes:ee45fd92c739
(sfc: Use TX PIO for sufficiently small packets)

The linux net driver uses memcpy_toio() in order to copy into
the PIO buffers.
Even on a 64bit machine this causes 32bit accesses to a write-
combined memory region.
There are hardware limitations that mean that only 64bit
naturally aligned accesses are safe in all cases.
Due to being write-combined memory region two 32bit accesses
may be coalesced to form a 64bit non 64bit aligned access.
Solution was to open-code the memory copy routines using pointers
and to only enable PIO for x86_64 machines.

Not tested on platforms other than x86_64 because this patch
disables the PIO feature on other platforms.
Compile-tested on x86 to ensure that works.

The WARN_ON_ONCE() code in the previous version of this patch
has been moved into the internal sfc debug driver as the
assertion was unnecessary in the upstream kernel code.

This bug fix applies to v3.13 and v3.14 stable branches.

Signed-off-by: Shradha Shah ss...@solarflare.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 drivers/net/ethernet/sfc/io.h |7 +++
 drivers/net/ethernet/sfc/tx.c |   22 +-
 2 files changed, 24 insertions(+), 5 deletions(-)

--- a/drivers/net/ethernet/sfc/io.h
+++ b/drivers/net/ethernet/sfc/io.h
@@ -66,10 +66,17 @@
 #define EFX_USE_QWORD_IO 1
 #endif
 
+/* Hardware issue requires that only 64-bit naturally aligned writes
+ * are seen by hardware. Its not strictly necessary to restrict to
+ * x86_64 arch, but done for safety since unusual write combining behaviour
+ * can break PIO.
+ */
+#ifdef CONFIG_X86_64
 /* PIO is a win only if write-combining is possible */
 #ifdef ARCH_HAS_IOREMAP_WC
 #define EFX_USE_PIO 1
 #endif
+#endif
 
 #ifdef EFX_USE_QWORD_IO
 static inline void _efx_writeq(struct efx_nic *efx, __le64 value,
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -189,6 +189,18 @@ struct efx_short_copy_buffer {
u8 buf[L1_CACHE_BYTES];
 };
 
+/* Copy in explicit 64-bit writes. */
+static void efx_memcpy_64(void __iomem *dest, void *src, size_t len)
+{
+   u64 *src64 = src;
+   u64 __iomem *dest64 = dest;
+   size_t l64 = len / 8;
+   size_t i;
+
+   for (i = 0; i  l64; i++)
+   writeq(src64[i], dest64[i]);
+}
+
 /* Copy to PIO, respecting that writes to PIO buffers must be dword aligned.
  * Advances piobuf pointer. Leaves additional data in the copy buffer.
  */
@@ -198,7 +210,7 @@ static void efx_memcpy_toio_aligned(stru
 {
int block_len = len  ~(sizeof(copy_buf-buf) - 1);
 
-   memcpy_toio(*piobuf, data, block_len);
+   efx_memcpy_64(*piobuf, data, block_len);
*piobuf += block_len;
len -= block_len;
 
@@ -230,7 +242,7 @@ static void efx_memcpy_toio_aligned_cb(s
if (copy_buf-used  sizeof(copy_buf-buf))
return;
 
-   memcpy_toio(*piobuf, copy_buf-buf, sizeof(copy_buf-buf));
+   efx_memcpy_64(*piobuf, copy_buf-buf, sizeof(copy_buf-buf));
*piobuf += sizeof(copy_buf-buf);
data += copy_to_buf;
len -= copy_to_buf;
@@ -245,7 +257,7 @@ static void efx_flush_copy_buffer(struct
 {
/* if there's anything in it, write the whole buffer, including junk */
if (copy_buf-used)
-   memcpy_toio(piobuf, copy_buf-buf, sizeof(copy_buf-buf));
+   efx_memcpy_64(piobuf, copy_buf-buf, sizeof(copy_buf-buf));
 }
 
 /* Traverse skb structure and copy fragments in to PIO buffer.
@@ -304,8 +316,8 @@ efx_enqueue_skb_pio(struct efx_tx_queue
 */
BUILD_BUG_ON(L1_CACHE_BYTES 
 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)));
-   memcpy_toio(tx_queue-piobuf, skb-data,
-   ALIGN(skb-len, L1_CACHE_BYTES));
+   efx_memcpy_64(tx_queue-piobuf, skb-data,
+ ALIGN(skb-len, L1_CACHE_BYTES));
}
 
EFX_POPULATE_QWORD_5(buffer-option,


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 05/61] ima: introduce ima_kernel_read()

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Kasatkin d.kasat...@samsung.com

commit 0430e49b6e7c6b5e076be8fefdee089958c9adad upstream.

Commit 8aac62706 move exit_task_namespaces() outside of exit_notify
introduced the kernel opps since the kernel v3.10, which happens when
Apparmor and IMA-appraisal are enabled at the same time.

--
[  106.750167] BUG: unable to handle kernel NULL pointer dereference at
0018
[  106.750221] IP: [811ec7da] our_mnt+0x1a/0x30
[  106.750241] PGD 0
[  106.750254] Oops:  [#1] SMP
[  106.750272] Modules linked in: cuse parport_pc ppdev bnep rfcomm
bluetooth rpcsec_gss_krb5 nfsd auth_rpcgss nfs_acl nfs lockd sunrpc
fscache dm_crypt intel_rapl x86_pkg_temp_thermal intel_powerclamp
kvm_intel snd_hda_codec_hdmi kvm crct10dif_pclmul crc32_pclmul
ghash_clmulni_intel aesni_intel aes_x86_64 glue_helper lrw gf128mul
ablk_helper cryptd snd_hda_codec_realtek dcdbas snd_hda_intel
snd_hda_codec snd_hwdep snd_pcm snd_page_alloc snd_seq_midi
snd_seq_midi_event snd_rawmidi psmouse snd_seq microcode serio_raw
snd_timer snd_seq_device snd soundcore video lpc_ich coretemp mac_hid lp
parport mei_me mei nbd hid_generic e1000e usbhid ahci ptp hid libahci
pps_core
[  106.750658] CPU: 6 PID: 1394 Comm: mysqld Not tainted 3.13.0-rc7-kds+ #15
[  106.750673] Hardware name: Dell Inc. OptiPlex 9010/0M9KCM, BIOS A08
09/19/2012
[  106.750689] task: 8800de804920 ti: 880400fca000 task.ti:
880400fca000
[  106.750704] RIP: 0010:[811ec7da]  [811ec7da]
our_mnt+0x1a/0x30
[  106.750725] RSP: 0018:880400fcba60  EFLAGS: 00010286
[  106.750738] RAX:  RBX: 0100 RCX:
8800d51523e7
[  106.750764] RDX: ffea RSI: 880400fcba34 RDI:
880402d20020
[  106.750791] RBP: 880400fcbae0 R08:  R09:
0001
[  106.750817] R10:  R11: 0001 R12:
8800d5152300
[  106.750844] R13: 8803eb8df510 R14: 880400fcbb28 R15:
8800d51523e7
[  106.750871] FS:  () GS:88040d20()
knlGS:
[  106.750910] CS:  0010 DS:  ES:  CR0: 80050033
[  106.750935] CR2: 0018 CR3: 01c0e000 CR4:
001407e0
[  106.750962] Stack:
[  106.750981]  813434eb 880400fcbb20 880400fcbb18

[  106.751037]  8800de804920 8101b9b9 00018000
0100
[  106.751093]  0100 0002 000e
8803eb8df500
[  106.751149] Call Trace:
[  106.751172]  [813434eb] ? aa_path_name+0x2ab/0x430
[  106.751199]  [8101b9b9] ? sched_clock+0x9/0x10
[  106.751225]  [8134a68d] aa_path_perm+0x7d/0x170
[  106.751250]  [8101b945] ? native_sched_clock+0x15/0x80
[  106.751276]  [8134aa73] aa_file_perm+0x33/0x40
[  106.751301]  [81348c5e] common_file_perm+0x8e/0xb0
[  106.751327]  [81348d78] apparmor_file_permission+0x18/0x20
[  106.751355]  [8130c853] security_file_permission+0x23/0xa0
[  106.751382]  [811c77a2] rw_verify_area+0x52/0xe0
[  106.751407]  [811c789d] vfs_read+0x6d/0x170
[  106.751432]  [811cda31] kernel_read+0x41/0x60
[  106.751457]  [8134fd45] ima_calc_file_hash+0x225/0x280
[  106.751483]  [8134fb52] ? ima_calc_file_hash+0x32/0x280
[  106.751509]  [8135022d] ima_collect_measurement+0x9d/0x160
[  106.751536]  [810b552d] ? trace_hardirqs_on+0xd/0x10
[  106.751562]  [8134f07c] ? ima_file_free+0x6c/0xd0
[  106.751587]  [81352824] ima_update_xattr+0x34/0x60
[  106.751612]  [8134f0d0] ima_file_free+0xc0/0xd0
[  106.751637]  [811c9635] __fput+0xd5/0x300
[  106.751662]  [811c98ae] fput+0xe/0x10
[  106.751687]  [81086774] task_work_run+0xc4/0xe0
[  106.751712]  [81066fad] do_exit+0x2bd/0xa90
[  106.751738]  [8173c958] ? retint_swapgs+0x13/0x1b
[  106.751763]  [8106780c] do_group_exit+0x4c/0xc0
[  106.751788]  [81067894] SyS_exit_group+0x14/0x20
[  106.751814]  [8174522d] system_call_fastpath+0x1a/0x1f
[  106.751839] Code: c3 0f 1f 44 00 00 55 48 89 e5 e8 22 fe ff ff 5d c3
0f 1f 44 00 00 55 65 48 8b 04 25 c0 c9 00 00 48 8b 80 28 06 00 00 48 89
e5 5d 48 8b 40 18 48 39 87 c0 00 00 00 0f 94 c0 c3 0f 1f 80 00 00 00
[  106.752185] RIP  [811ec7da] our_mnt+0x1a/0x30
[  106.752214]  RSP 880400fcba60
[  106.752236] CR2: 0018
[  106.752258] ---[ end trace 3c520748b4732721 ]---
--

The reason for the oops is that IMA-appraisal uses kernel_read() when
file is closed. kernel_read() honors LSM security hook which calls
Apparmor handler, which uses current-nsproxy-mnt_ns. The 'guilty'
commit changed the order of cleanup code so that 

[PATCH v2 2/4] clk: samsung: exynos4: Add CLKOUT clock hierarchy

[Tomasz Figa]

This patch adds definitions of clocks that are used to drive clock
output signals of particular CMU sub-blocks that are then fed to PMU and
handled by Exynos CLKOUT driver added in further patch.

Signed-off-by: Tomasz Figa t.f...@samsung.com
---
 drivers/clk/samsung/clk-exynos4.c   | 116 ++--
 include/dt-bindings/clock/exynos4.h |   5 ++
 2 files changed, 117 insertions(+), 4 deletions(-)

diff --git a/drivers/clk/samsung/clk-exynos4.c 
b/drivers/clk/samsung/clk-exynos4.c
index f95ae6c..7d1fb99 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -25,10 +25,12 @@
 #define DIV_LEFTBUS0x4500
 #define GATE_IP_LEFTBUS0x4800
 #define E4X12_GATE_IP_IMAGE0x4930
+#define CLKOUT_CMU_LEFTBUS 0x4a00
 #define SRC_RIGHTBUS   0x8200
 #define DIV_RIGHTBUS   0x8500
 #define GATE_IP_RIGHTBUS   0x8800
 #define E4X12_GATE_IP_PERIR0x8960
+#define CLKOUT_CMU_RIGHTBUS0x8a00
 #define EPLL_LOCK  0xc010
 #define VPLL_LOCK  0xc020
 #define EPLL_CON0  0xc110
@@ -98,6 +100,7 @@
 #define GATE_IP_PERIL  0xc950
 #define E4210_GATE_IP_PERIR0xc960
 #define GATE_BLOCK 0xc970
+#define CLKOUT_CMU_TOP 0xca00
 #define E4X12_MPLL_LOCK0x10008
 #define E4X12_MPLL_CON00x10108
 #define SRC_DMC0x10200
@@ -105,6 +108,7 @@
 #define DIV_DMC0   0x10500
 #define DIV_DMC1   0x10504
 #define GATE_IP_DMC0x10900
+#define CLKOUT_CMU_DMC 0x10a00
 #define APLL_LOCK  0x14000
 #define E4210_MPLL_LOCK0x14008
 #define APLL_CON0  0x14100
@@ -114,6 +118,7 @@
 #define DIV_CPU1   0x14504
 #define GATE_SCLK_CPU  0x14800
 #define GATE_IP_CPU0x14900
+#define CLKOUT_CMU_CPU 0x14a00
 #define E4X12_DIV_ISP0 0x18300
 #define E4X12_DIV_ISP1 0x18304
 #define E4X12_GATE_ISP00x18800
@@ -242,6 +247,11 @@ static unsigned long exynos4_clk_regs[] __initdata = {
DIV_CPU1,
GATE_SCLK_CPU,
GATE_IP_CPU,
+   CLKOUT_CMU_LEFTBUS,
+   CLKOUT_CMU_RIGHTBUS,
+   CLKOUT_CMU_TOP,
+   CLKOUT_CMU_DMC,
+   CLKOUT_CMU_CPU,
 };
 
 static const struct samsung_clk_reg_dump src_mask_suspend[] = {
@@ -400,6 +410,23 @@ PNAME(mout_dac_p4210)  = { sclk_vpll, 
sclk_hdmiphy, };
 PNAME(mout_pwi_p4210) = { xxti, xusbxti, sclk_hdmi24m, sclk_usbphy0,
sclk_usbphy1, sclk_hdmiphy, none,
sclk_epll, sclk_vpll };
+PNAME(clkout_left_p4210) = { sclk_mpll_div_2, sclk_apll_div_2,
+   div_gdl, div_gpl };
+PNAME(clkout_right_p4210) = { sclk_mpll_div_2, sclk_apll_div_2,
+   div_gdr, div_gpr };
+PNAME(clkout_top_p4210) = { fout_epll, fout_vpll, sclk_hdmi24m,
+   sclk_usbphy0, sclk_usbphy1, sclk_hdmiphy,
+   cdclk0, cdclk1, cdclk2, spdif_extclk,
+   aclk160, aclk133, aclk200, aclk100,
+   sclk_mfc, sclk_g3d, sclk_g2d,
+   cam_a_pclk, cam_b_pclk, s_rxbyteclkhs0_2l,
+   s_rxbyteclkhs0_4l };
+PNAME(clkout_dmc_p4210) = { div_dmcd, div_dmcp, div_acp_pclk, div_dmc,
+   div_dphy, none, div_pwi };
+PNAME(clkout_cpu_p4210) = { fout_apll_div_2, none, fout_mpll_div_2,
+   none, arm_clk_div_2, div_corem0,
+   div_corem1, div_corem0, div_atb,
+   div_periph, div_pclk_dbg, div_hpm };
 
 /* Exynos 4x12-specific parent groups */
 PNAME(mout_mpll_user_p4x12) = { fin_pll, sclk_mpll, };
@@ -426,6 +453,29 @@ PNAME(mout_user_aclk266_gps_p4x12) = {fin_pll, 
div_aclk266_gps, };
 PNAME(mout_pwi_p4x12) = { xxti, xusbxti, sclk_hdmi24m, sclk_usbphy0,
none, sclk_hdmiphy, sclk_mpll,
sclk_epll, sclk_vpll };
+PNAME(clkout_left_p4x12) = { sclk_mpll_user_l_div_2, sclk_apll_div_2,
+   div_gdl, div_gpl };
+PNAME(clkout_right_p4x12) = { sclk_mpll_user_r_div_2, sclk_apll_div_2,
+   div_gdr, div_gpr };
+PNAME(clkout_top_p4x12) = { fout_epll, fout_vpll, sclk_hdmi24m,
+   sclk_usbphy0, none, sclk_hdmiphy,
+   cdclk0, cdclk1, cdclk2, spdif_extclk,
+   aclk160, aclk133, aclk200, aclk100,
+   sclk_mfc, sclk_g3d, aclk400_mcuisp,
+   cam_a_pclk, cam_b_pclk, s_rxbyteclkhs0_2l,
+   s_rxbyteclkhs0_4l, rx_half_byte_clk_csis0,
+   rx_half_byte_clk_csis1, div_jpeg,
+   sclk_pwm_isp, 

[PATCH 3.15 09/61] sh_eth: use RNC mode for packet reception

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Ben Dooks ben.do...@codethink.co.uk

[ Upstream commit 530aa2d0d9d55ab2775d47621ddf4b5b15bc1110 ]

The current behaviour of the sh_eth driver is not to use the RNC bit
for the receive ring. This means that every packet recieved is not only
generating an IRQ but it also stops the receive ring DMA as well until
the driver re-enables it after unloading the packet.

This means that a number of the following errors are generated due to
the receive packet FIFO overflowing due to nowhere to put packets:

net eth0: Receive FIFO Overflow

Since feedback from Yoshihiro Shimoda shows that every supported LSI
for this driver should have the bit enabled it seems the best way is
to remove the RMCR default value from the per-system data and just
write it when initialising the RMCR value. This is discussed in
the message (http://www.spinics.net/lists/netdev/msg284912.html).

I have tested the RMCR_RNC configuration with NFS root filesystem and
the driver has not failed yet.  There are further test reports from
Sergei Shtylov and others for both the R8A7790 and R8A7791.

There is also feedback fron Cao Minh Hiep[1] which reports the
same issue in (http://comments.gmane.org/gmane.linux.network/316285)
showing this fixes issues with losing UDP datagrams under iperf.

Tested-by: Sergei Shtylyov sergei.shtyl...@cogentembedded.com
Signed-off-by: Ben Dooks ben.do...@codethink.co.uk
Acked-by: Yoshihiro Shimoda yoshihiro.shimoda...@renesas.com
Acked-by: Simon Horman horms+rene...@verge.net.au
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 drivers/net/ethernet/renesas/sh_eth.c |   11 ++-
 drivers/net/ethernet/renesas/sh_eth.h |2 --
 2 files changed, 2 insertions(+), 11 deletions(-)

--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -546,7 +546,6 @@ static struct sh_eth_cpu_data sh7757_dat
.register_type  = SH_ETH_REG_FAST_SH4,
 
.eesipr_value   = DMAC_M_RFRMER | DMAC_M_ECI | 0x003f,
-   .rmcr_value = RMCR_RNC,
 
.tx_check   = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO,
.eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
@@ -624,7 +623,6 @@ static struct sh_eth_cpu_data sh7757_dat
  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
  EESR_TDE | EESR_ECI,
.fdr_value  = 0x072f,
-   .rmcr_value = RMCR_RNC,
 
.irq_flags  = IRQF_SHARED,
.apr= 1,
@@ -752,7 +750,6 @@ static struct sh_eth_cpu_data r8a7740_da
  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
  EESR_TDE | EESR_ECI,
.fdr_value  = 0x070f,
-   .rmcr_value = RMCR_RNC,
 
.apr= 1,
.mpr= 1,
@@ -784,7 +781,6 @@ static struct sh_eth_cpu_data r7s72100_d
  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
  EESR_TDE | EESR_ECI,
.fdr_value  = 0x070f,
-   .rmcr_value = RMCR_RNC,
 
.no_psr = 1,
.apr= 1,
@@ -833,9 +829,6 @@ static void sh_eth_set_default_cpu_data(
if (!cd-fdr_value)
cd-fdr_value = DEFAULT_FDR_INIT;
 
-   if (!cd-rmcr_value)
-   cd-rmcr_value = DEFAULT_RMCR_VALUE;
-
if (!cd-tx_check)
cd-tx_check = DEFAULT_TX_CHECK;
 
@@ -1287,8 +1280,8 @@ static int sh_eth_dev_init(struct net_de
sh_eth_write(ndev, mdp-cd-fdr_value, FDR);
sh_eth_write(ndev, 0, TFTR);
 
-   /* Frame recv control */
-   sh_eth_write(ndev, mdp-cd-rmcr_value, RMCR);
+   /* Frame recv control (enable multiple-packets per rx irq) */
+   sh_eth_write(ndev, RMCR_RNC, RMCR);
 
sh_eth_write(ndev, DESC_I_RINT8 | DESC_I_RINT5 | DESC_I_TINT2, TRSCER);
 
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -319,7 +319,6 @@ enum TD_STS_BIT {
 enum RMCR_BIT {
RMCR_RNC = 0x0001,
 };
-#define DEFAULT_RMCR_VALUE 0x
 
 /* ECMR */
 enum FELIC_MODE_BIT {
@@ -466,7 +465,6 @@ struct sh_eth_cpu_data {
unsigned long fdr_value;
unsigned long fcftr_value;
unsigned long rpadir_value;
-   unsigned long rmcr_value;
 
/* interrupt checking mask */
unsigned long tx_check;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 64/68] ALSA: control: Protect user controls against concurrent access

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen l...@metafoo.de

commit 07f4d9d74a04aa7c72c5dae0ef97565f28f17b92 upstream.

The user-control put and get handlers as well as the tlv do not protect against
concurrent access from multiple threads. Since the state of the control is not
updated atomically it is possible that either two write operations or a write
and a read operation race against each other. Both can lead to arbitrary memory
disclosure. This patch introduces a new lock that protects user-controls from
concurrent access. Since applications typically access controls sequentially
than in parallel a single lock per card should be fine.

Signed-off-by: Lars-Peter Clausen l...@metafoo.de
Acked-by: Jaroslav Kysela pe...@perex.cz
Signed-off-by: Takashi Iwai ti...@suse.de
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 include/sound/core.h |2 ++
 sound/core/control.c |   31 +--
 sound/core/init.c|1 +
 3 files changed, 28 insertions(+), 6 deletions(-)

--- a/include/sound/core.h
+++ b/include/sound/core.h
@@ -121,6 +121,8 @@ struct snd_card {
int user_ctl_count; /* count of all user controls */
struct list_head controls;  /* all controls for this card */
struct list_head ctl_files; /* active control files */
+   struct mutex user_ctl_lock; /* protects user controls against
+  concurrent access */
 
struct snd_info_entry *proc_root;   /* root for soundcard specific 
files */
struct snd_info_entry *proc_id; /* the card id */
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -992,6 +992,7 @@ static int snd_ctl_elem_unlock(struct sn
 
 struct user_element {
struct snd_ctl_elem_info info;
+   struct snd_card *card;
void *elem_data;/* element data */
unsigned long elem_data_size;   /* size of element data in bytes */
void *tlv_data; /* TLV data */
@@ -1035,7 +1036,9 @@ static int snd_ctl_elem_user_get(struct
 {
struct user_element *ue = kcontrol-private_data;
 
+   mutex_lock(ue-card-user_ctl_lock);
memcpy(ucontrol-value, ue-elem_data, ue-elem_data_size);
+   mutex_unlock(ue-card-user_ctl_lock);
return 0;
 }
 
@@ -1044,10 +1047,12 @@ static int snd_ctl_elem_user_put(struct
 {
int change;
struct user_element *ue = kcontrol-private_data;
-   
+
+   mutex_lock(ue-card-user_ctl_lock);
change = memcmp(ucontrol-value, ue-elem_data, ue-elem_data_size) != 
0;
if (change)
memcpy(ue-elem_data, ucontrol-value, ue-elem_data_size);
+   mutex_unlock(ue-card-user_ctl_lock);
return change;
 }
 
@@ -1067,19 +1072,32 @@ static int snd_ctl_elem_user_tlv(struct
new_data = memdup_user(tlv, size);
if (IS_ERR(new_data))
return PTR_ERR(new_data);
+   mutex_lock(ue-card-user_ctl_lock);
change = ue-tlv_data_size != size;
if (!change)
change = memcmp(ue-tlv_data, new_data, size);
kfree(ue-tlv_data);
ue-tlv_data = new_data;
ue-tlv_data_size = size;
+   mutex_unlock(ue-card-user_ctl_lock);
} else {
-   if (! ue-tlv_data_size || ! ue-tlv_data)
-   return -ENXIO;
-   if (size  ue-tlv_data_size)
-   return -ENOSPC;
+   int ret = 0;
+
+   mutex_lock(ue-card-user_ctl_lock);
+   if (!ue-tlv_data_size || !ue-tlv_data) {
+   ret = -ENXIO;
+   goto err_unlock;
+   }
+   if (size  ue-tlv_data_size) {
+   ret = -ENOSPC;
+   goto err_unlock;
+   }
if (copy_to_user(tlv, ue-tlv_data, ue-tlv_data_size))
-   return -EFAULT;
+   ret = -EFAULT;
+err_unlock:
+   mutex_unlock(ue-card-user_ctl_lock);
+   if (ret)
+   return ret;
}
return change;
 }
@@ -1211,6 +1229,7 @@ static int snd_ctl_elem_add(struct snd_c
ue = kzalloc(sizeof(struct user_element) + private_size, GFP_KERNEL);
if (ue == NULL)
return -ENOMEM;
+   ue-card = card;
ue-info = *info;
ue-info.access = 0;
ue-elem_data = (char *)ue + sizeof(*ue);
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -218,6 +218,7 @@ int snd_card_create(int idx, const char
INIT_LIST_HEAD(card-devices);
init_rwsem(card-controls_rwsem);
rwlock_init(card-ctl_files_rwlock);
+   mutex_init(card-user_ctl_lock);
INIT_LIST_HEAD(card-controls);
INIT_LIST_HEAD(card-ctl_files);

[PATCH 3.15 32/61] USB: cdc-acm: fix open and suspend race

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold jhov...@gmail.com

commit 703df3297fb1950b0aa53e656108eb936d3f21d9 upstream.

We must not do the usb_autopm_put_interface() before submitting the read
urbs or we might end up doing I/O to a suspended device.

Fixes: 088c64f81284 (USB: cdc-acm: re-write read processing)
Signed-off-by: Johan Hovold jhov...@gmail.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/usb/class/cdc-acm.c |7 +++
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -528,19 +528,15 @@ static int acm_port_activate(struct tty_
if (usb_submit_urb(acm-ctrlurb, GFP_KERNEL)) {
dev_err(acm-control-dev,
%s - usb_submit_urb(ctrl irq) failed\n, __func__);
-   usb_autopm_put_interface(acm-control);
goto error_submit_urb;
}
 
acm-ctrlout = ACM_CTRL_DTR | ACM_CTRL_RTS;
if (acm_set_control(acm, acm-ctrlout)  0 
(acm-ctrl_caps  USB_CDC_CAP_LINE)) {
-   usb_autopm_put_interface(acm-control);
goto error_set_control;
}
 
-   usb_autopm_put_interface(acm-control);
-
/*
 * Unthrottle device in case the TTY was closed while throttled.
 */
@@ -552,6 +548,8 @@ static int acm_port_activate(struct tty_
if (acm_submit_read_urbs(acm, GFP_KERNEL))
goto error_submit_read_urbs;
 
+   usb_autopm_put_interface(acm-control);
+
mutex_unlock(acm-mutex);
 
return 0;
@@ -562,6 +560,7 @@ error_submit_read_urbs:
 error_set_control:
usb_kill_urb(acm-ctrlurb);
 error_submit_urb:
+   usb_autopm_put_interface(acm-control);
 error_get_interface:
 disconnected:
mutex_unlock(acm-mutex);


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 02/61] target: Fix NULL pointer dereference for XCOPY in target_put_sess_cmd

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Nicholas Bellinger n...@linux-iscsi.org

commit 0ed6e189e3f6ac3a25383ed5cc8b0ac24c9b97b7 upstream.

This patch fixes a NULL pointer dereference regression bug that was
introduced with:

commit 1e1110c43b1cda9fe77fc4a04835e460550e6b3c
Author: Mikulas Patocka mpato...@redhat.com
Date:   Sat May 17 06:49:22 2014 -0400

target: fix memory leak on XCOPY

Now that target_put_sess_cmd() - kref_put_spinlock_irqsave() is
called with a valid se_cmd-cmd_kref, a NULL pointer dereference
is triggered because the XCOPY passthrough commands don't have
an associated se_session pointer.

To address this bug, go ahead and checking for a NULL se_sess pointer
within target_put_sess_cmd(), and call se_cmd-se_tfo-release_cmd()
to release the XCOPY's xcopy_pt_cmd memory.

Reported-by: Thomas Glanzmann tho...@glanzmann.de
Cc: Thomas Glanzmann tho...@glanzmann.de
Cc: Mikulas Patocka mpato...@redhat.com
Signed-off-by: Nicholas Bellinger n...@linux-iscsi.org
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/target/target_core_transport.c |4 
 1 file changed, 4 insertions(+)

--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2407,6 +2407,10 @@ static void target_release_cmd_kref(stru
  */
 int target_put_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd)
 {
+   if (!se_sess) {
+   se_cmd-se_tfo-release_cmd(se_cmd);
+   return 1;
+   }
return kref_put_spinlock_irqsave(se_cmd-cmd_kref, 
target_release_cmd_kref,
se_sess-sess_cmd_lock);
 }


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 14/61] net: force a list_del() in unregister_netdevice_many()

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric Dumazet eduma...@google.com

[ Upstream commit 87757a917b0b3c0787e0563c679762152be81312 ]

unregister_netdevice_many() API is error prone and we had too
many bugs because of dangling LIST_HEAD on stacks.

See commit f87e6f47933e3e (net: dont leave active on stack LIST_HEAD)

In fact, instead of making sure no caller leaves an active list_head,
just force a list_del() in the callee. No one seems to need to access
the list after unregister_netdevice_many()

Signed-off-by: Eric Dumazet eduma...@google.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 drivers/net/macvlan.c |1 -
 net/core/dev.c|5 -
 net/core/rtnetlink.c  |1 -
 net/mac80211/iface.c  |1 -
 4 files changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1036,7 +1036,6 @@ static int macvlan_device_event(struct n
list_for_each_entry_safe(vlan, next, port-vlans, list)
vlan-dev-rtnl_link_ops-dellink(vlan-dev, 
list_kill);
unregister_netdevice_many(list_kill);
-   list_del(list_kill);
break;
case NETDEV_PRE_TYPE_CHANGE:
/* Forbid underlaying device to change its type. */
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6613,6 +6613,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue
 /**
  * unregister_netdevice_many - unregister many devices
  * @head: list of devices
+ *
+ *  Note: As most callers use a stack allocated list_head,
+ *  we force a list_del() to make sure stack wont be corrupted later.
  */
 void unregister_netdevice_many(struct list_head *head)
 {
@@ -6622,6 +6625,7 @@ void unregister_netdevice_many(struct li
rollback_registered_many(head);
list_for_each_entry(dev, head, unreg_list)
net_set_todo(dev);
+   list_del(head);
}
 }
 EXPORT_SYMBOL(unregister_netdevice_many);
@@ -7077,7 +7081,6 @@ static void __net_exit default_device_ex
}
}
unregister_netdevice_many(dev_kill_list);
-   list_del(dev_kill_list);
rtnl_unlock();
 }
 
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1744,7 +1744,6 @@ static int rtnl_dellink(struct sk_buff *
 
ops-dellink(dev, list_kill);
unregister_netdevice_many(list_kill);
-   list_del(list_kill);
return 0;
 }
 
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1758,7 +1758,6 @@ void ieee80211_remove_interfaces(struct
}
mutex_unlock(local-iflist_mtx);
unregister_netdevice_many(unreg_list);
-   list_del(unreg_list);
 
list_for_each_entry_safe(sdata, tmp, wdev_list, list) {
list_del(sdata-list);


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 00/61] 3.15.2-stable review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 3.15.2 release.
There are 61 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Thu Jun 26 15:49:36 UTC 2014.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.15.2-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-
Pseudo-Shortlog of commits:

Greg Kroah-Hartman gre...@linuxfoundation.org
Linux 3.15.2-rc1

Joonsoo Kim iamjoonsoo@lge.com
slab: fix oops when reading /proc/slab_allocators

Hugh Dickins hu...@google.com
tmpfs: ZERO_RANGE and COLLAPSE_RANGE not currently supported

Lars-Peter Clausen l...@metafoo.de
ALSA: control: Make sure that id-index does not overflow

Lars-Peter Clausen l...@metafoo.de
ALSA: control: Handle numid overflow

Lars-Peter Clausen l...@metafoo.de
ALSA: control: Don't access controls outside of protected regions

Lars-Peter Clausen l...@metafoo.de
ALSA: control: Fix replacing user controls

Lars-Peter Clausen l...@metafoo.de
ALSA: control: Protect user controls against concurrent access

David Henningsson david.hennings...@canonical.com
ALSA: hda - Add quirk for external mic on Lifebook U904

Mengdong Lin mengdong@intel.com
ALSA: hda - verify pin:converter connection on unsol event for HSW and VLV

Kailang Yang kail...@realtek.com
ALSA: hda/realtek - Add more entry for enable HP mute led

Kailang Yang kail...@realtek.com
ALSA: hda/realtek - Add support of ALC891 codec

Wang, Xiaoming xiaoming.w...@intel.com
ALSA: compress: Cancel the optimization of compiler and fix the size of 
struct for all platform.

Greg Kroah-Hartman gre...@linuxfoundation.org
lz4: ensure length does not wrap

Greg Kroah-Hartman gre...@linuxfoundation.org
lzo: properly check for overruns

Peter Meerwald pme...@pmeerw.net
iio: Fix two mpl3115 issues in measurement conversion

Peter Meerwald pme...@pmeerw.net
iio: Fix endianness issue in ak8975_read_axis()

Dan Carpenter dan.carpen...@oracle.com
iio: adc: at91: signedness bug in at91_adc_get_trigger_value_by_name()

Robert Hodaszi robert.hoda...@digi.com
iio: mxs-lradc: fix divider

Dan Carpenter dan.carpen...@oracle.com
iio: adc: checking for NULL instead of IS_ERR() in probe

Mario Schuknecht mario.schukne...@dresearch-fe.de
staging: iio: tsl2x7x_core: fix proximity treshold

Jonathan Cameron ji...@kernel.org
iio:adc:max1363 incorrect resolutions for max11604, max11605, max11610 and 
max11611.

Peter Ujfalusi peter.ujfal...@ti.com
ASoC: tlv320aci3x: Fix custom snd_soc_dapm_put_volsw_aic3x() function

Liam Girdwood liam.r.girdw...@linux.intel.com
ASoC: max98090: Fix reset at resume time

Lars-Peter Clausen l...@metafoo.de
ASoC: dapm: Make sure to always update the DAPM graph in _put_volsw()

Radim Krčmář rkrc...@redhat.com
hv: use correct order when freeing monitor_pages

K. Y. Srinivasan k...@microsoft.com
Drivers: hv: balloon: Ensure pressure reports are posted regularly

Johan Hovold jhov...@gmail.com
USB: cdc-acm: fix runtime PM imbalance at shutdown

Johan Hovold jhov...@gmail.com
USB: cdc-acm: fix I/O after failed open

Johan Hovold jhov...@gmail.com
USB: cdc-acm: fix failed open not being detected

Johan Hovold jhov...@gmail.com
USB: cdc-acm: fix open and suspend race

Johan Hovold jhov...@gmail.com
USB: cdc-acm: fix potential urb leak and PM imbalance in write

Johan Hovold jhov...@gmail.com
USB: cdc-acm: fix shutdown and suspend race

Johan Hovold jhov...@gmail.com
USB: cdc-acm: fix runtime PM for control messages

Johan Hovold jhov...@gmail.com
USB: cdc-acm: fix broken runtime suspend

Johan Hovold jhov...@gmail.com
USB: cdc-acm: fix write and resume race

Johan Hovold jhov...@gmail.com
USB: cdc-acm: fix write and suspend race

James Hogan james.ho...@imgtec.com
MIPS: KVM: Allocate at least 16KB for exception handlers

Christian Borntraeger borntrae...@de.ibm.com
KVM: s390: Drop pending interrupts on guest exit

Paolo Bonzini pbonz...@redhat.com
KVM: lapic: sync highest ISR to hardware apic on EOI

Boris BREZILLON boris.brezil...@free-electrons.com
ARM: at91: fix at91_sysirq_mask_rtc for sam9x5 SoCs

Eric Dumazet eduma...@google.com
udp: ipv4: do not waste time in __udp4_lib_mcast_demux_lookup

Cong Wang cw...@twopensource.com
vxlan: use dev-needed_headroom instead of dev-hard_header_len

Michal Schmidt mschm...@redhat.com
rtnetlink: fix userspace API breakage for iproute2  v3.9.0

Xufeng Zhang xufeng.zh...@windriver.com
sctp: Fix sk_ack_backlog wrap-around problem

Eric Dumazet eduma...@google.com
ipv4: fix a race in ip4_datagram_release_cb()

Jon Cooper jcoo...@solarflare.com
sfc: PIO:Restrict to 64bit arch and use 64-bit writes.

Dmitry 

[PATCH 3.15 17/61] ipv4: fix a race in ip4_datagram_release_cb()

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric Dumazet eduma...@google.com

[ Upstream commit 9709674e68646cee5a24e3000b3558d25412203a ]

Alexey gave a AddressSanitizer[1] report that finally gave a good hint
at where was the origin of various problems already reported by Dormando
in the past [2]

Problem comes from the fact that UDP can have a lockless TX path, and
concurrent threads can manipulate sk_dst_cache, while another thread,
is holding socket lock and calls __sk_dst_set() in
ip4_datagram_release_cb() (this was added in linux-3.8)

It seems that all we need to do is to use sk_dst_check() and
sk_dst_set() so that all the writers hold same spinlock
(sk-sk_dst_lock) to prevent corruptions.

TCP stack do not need this protection, as all sk_dst_cache writers hold
the socket lock.

[1]
https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel

AddressSanitizer: heap-use-after-free in ipv4_dst_check
Read of size 2 by thread T15453:
 [817daa3a] ipv4_dst_check+0x1a/0x90 ./net/ipv4/route.c:1116
 [8175b789] __sk_dst_check+0x89/0xe0 ./net/core/sock.c:531
 [81830a36] ip4_datagram_release_cb+0x46/0x390 ??:0
 [8175eaea] release_sock+0x17a/0x230 ./net/core/sock.c:2413
 [81830882] ip4_datagram_connect+0x462/0x5d0 ??:0
 [81846d06] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534
 [817580ac] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701
 [817596ce] SyS_connect+0xe/0x10 ./net/socket.c:1682
 [818b0a29] system_call_fastpath+0x16/0x1b
./arch/x86/kernel/entry_64.S:629

Freed by thread T15455:
 [8178d9b8] dst_destroy+0xa8/0x160 ./net/core/dst.c:251
 [8178de25] dst_release+0x45/0x80 ./net/core/dst.c:280
 [818304c1] ip4_datagram_connect+0xa1/0x5d0 ??:0
 [81846d06] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534
 [817580ac] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701
 [817596ce] SyS_connect+0xe/0x10 ./net/socket.c:1682
 [818b0a29] system_call_fastpath+0x16/0x1b
./arch/x86/kernel/entry_64.S:629

Allocated by thread T15453:
 [8178d291] dst_alloc+0x81/0x2b0 ./net/core/dst.c:171
 [817db3b7] rt_dst_alloc+0x47/0x50 ./net/ipv4/route.c:1406
 [ inlined] __ip_route_output_key+0x3e8/0xf70
__mkroute_output ./net/ipv4/route.c:1939
 [817dde08] __ip_route_output_key+0x3e8/0xf70 ./net/ipv4/route.c:2161
 [817deb34] ip_route_output_flow+0x14/0x30 ./net/ipv4/route.c:2249
 [81830737] ip4_datagram_connect+0x317/0x5d0 ??:0
 [81846d06] inet_dgram_connect+0x76/0xd0 ./net/ipv4/af_inet.c:534
 [817580ac] SYSC_connect+0x15c/0x1c0 ./net/socket.c:1701
 [817596ce] SyS_connect+0xe/0x10 ./net/socket.c:1682
 [818b0a29] system_call_fastpath+0x16/0x1b
./arch/x86/kernel/entry_64.S:629

[2]
4[196727.311203] general protection fault:  [#1] SMP
4[196727.311224] Modules linked in: xt_TEE xt_dscp xt_DSCP macvlan bridge 
coretemp crc32_pclmul ghash_clmulni_intel gpio_ich microcode ipmi_watchdog 
ipmi_devintf sb_edac edac_core lpc_ich mfd_core tpm_tis tpm tpm_bios ipmi_si 
ipmi_msghandler isci igb libsas i2c_algo_bit ixgbe ptp pps_core mdio
4[196727.311333] CPU: 17 PID: 0 Comm: swapper/17 Not tainted 3.10.26 #1
4[196727.311344] Hardware name: Supermicro 
X9DRi-LN4+/X9DR3-LN4+/X9DRi-LN4+/X9DR3-LN4+, BIOS 3.0 07/05/2013
4[196727.311364] task: 885e6f069700 ti: 885e6f072000 task.ti: 
885e6f072000
4[196727.311377] RIP: 0010:[815f8c7f]  [815f8c7f] 
ipv4_dst_destroy+0x4f/0x80
4[196727.311399] RSP: 0018:885effd23a70  EFLAGS: 00010282
4[196727.311409] RAX: dead00200200 RBX: 8854c398ecc0 RCX: 
0040
4[196727.311423] RDX: dead00100100 RSI: dead00100100 RDI: 
dead00200200
4[196727.311437] RBP: 885effd23a80 R08: 815fd9e0 R09: 
885d5a590800
4[196727.311451] R10:  R11:  R12: 

4[196727.311464] R13: 81c8c280 R14:  R15: 
880e85ee16ce
4[196727.311510] FS:  () GS:885effd2() 
knlGS:
4[196727.311554] CS:  0010 DS:  ES:  CR0: 80050033
4[196727.311581] CR2: 7a46751eb000 CR3: 005e65688000 CR4: 
000407e0
4[196727.311625] DR0:  DR1:  DR2: 

4[196727.311669] DR3:  DR6: 0ff0 DR7: 
0400
4[196727.311713] Stack:
4[196727.311733]  8854c398ecc0 8854c398ecc0 885effd23ab0 
815b7f42
4[196727.311784]  88be6595bc00 8854c398ecc0  
8854c398ecc0
4[196727.311834]  885effd23ad0 815b86c6 885d5a590800 
8816827821c0
4[196727.311885] Call Trace:
4[196727.311907]  IRQ
4[196727.311912]  [815b7f42] dst_destroy+0x32/0xe0
4[196727.311959]  [815b86c6] dst_release+0x56/0x80
4[196727.311986]  [81620bd5] 

[PATCH 3.15 19/61] rtnetlink: fix userspace API breakage for iproute2 v3.9.0

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Michal Schmidt mschm...@redhat.com

[ Upstream commit e5eca6d41f53db48edd8cf88a3f59d2c30227f8e ]

When running RHEL6 userspace on a current upstream kernel, ip link
fails to show VF information.

The reason is a kernel-userspace API change introduced by commit
88c5b5ce5cb57 (rtnetlink: Call nlmsg_parse() with correct header length),
after which the kernel does not see iproute2's IFLA_EXT_MASK attribute
in the netlink request.

iproute2 adjusted for the API change in its commit 63338dca4513
(libnetlink: Use ifinfomsg instead of rtgenmsg in rtnl_wilddump_req_filter).

The problem has been noticed before:
http://marc.info/?l=linux-netdevm=136692296022182w=2
(Subject: Re: getting VF link info seems to be broken in 3.9-rc8)

We can do better than tell those with old userspace to upgrade. We can
recognize the old iproute2 in the kernel by checking the netlink message
length. Even when including the IFLA_EXT_MASK attribute, its netlink
message is shorter than struct ifinfomsg.

With this patch ip link shows VF information in both old and new
iproute2 versions.

Signed-off-by: Michal Schmidt mschm...@redhat.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 net/core/rtnetlink.c |   22 ++
 1 file changed, 18 insertions(+), 4 deletions(-)

--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1234,6 +1234,7 @@ static int rtnl_dump_ifinfo(struct sk_bu
struct nlattr *tb[IFLA_MAX+1];
u32 ext_filter_mask = 0;
int err;
+   int hdrlen;
 
s_h = cb-args[0];
s_idx = cb-args[1];
@@ -1241,8 +1242,17 @@ static int rtnl_dump_ifinfo(struct sk_bu
rcu_read_lock();
cb-seq = net-dev_base_seq;
 
-   if (nlmsg_parse(cb-nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
-   ifla_policy) = 0) {
+   /* A hack to preserve kernel-userspace interface.
+* The correct header is ifinfomsg. It is consistent with rtnl_getlink.
+* However, before Linux v3.9 the code here assumed rtgenmsg and that's
+* what iproute2  v3.9.0 used.
+* We can detect the old iproute2. Even including the IFLA_EXT_MASK
+* attribute, its netlink message is shorter than struct ifinfomsg.
+*/
+   hdrlen = nlmsg_len(cb-nlh)  sizeof(struct ifinfomsg) ?
+sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg);
+
+   if (nlmsg_parse(cb-nlh, hdrlen, tb, IFLA_MAX, ifla_policy) = 0) {
 
if (tb[IFLA_EXT_MASK])
ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
@@ -2094,9 +2104,13 @@ static u16 rtnl_calcit(struct sk_buff *s
struct nlattr *tb[IFLA_MAX+1];
u32 ext_filter_mask = 0;
u16 min_ifinfo_dump_size = 0;
+   int hdrlen;
+
+   /* Same kernel-userspace interface hack as in rtnl_dump_ifinfo. */
+   hdrlen = nlmsg_len(nlh)  sizeof(struct ifinfomsg) ?
+sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg);
 
-   if (nlmsg_parse(nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
-   ifla_policy) = 0) {
+   if (nlmsg_parse(nlh, hdrlen, tb, IFLA_MAX, ifla_policy) = 0) {
if (tb[IFLA_EXT_MASK])
ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
}


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 24/61] KVM: s390: Drop pending interrupts on guest exit

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Christian Borntraeger borntrae...@de.ibm.com

commit 67335e63c9ef59e97b45a08b4a6a93767762031d upstream.

On hard exits (abort, sigkill) we have have some kvm_s390_interrupt_info
structures hanging around. Delete those on exit to avoid memory leaks.

Signed-off-by: Christian Borntraeger borntrae...@de.ibm.com
Reviewed-by: Thomas Huth th...@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 arch/s390/kvm/interrupt.c |4 ++--
 arch/s390/kvm/kvm-s390.c  |2 ++
 arch/s390/kvm/kvm-s390.h  |1 +
 3 files changed, 5 insertions(+), 2 deletions(-)

--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -900,7 +900,7 @@ int kvm_s390_inject_vcpu(struct kvm_vcpu
return 0;
 }
 
-static void clear_floating_interrupts(struct kvm *kvm)
+void kvm_s390_clear_float_irqs(struct kvm *kvm)
 {
struct kvm_s390_float_interrupt *fi;
struct kvm_s390_interrupt_info  *n, *inti = NULL;
@@ -1246,7 +1246,7 @@ static int flic_set_attr(struct kvm_devi
break;
case KVM_DEV_FLIC_CLEAR_IRQS:
r = 0;
-   clear_floating_interrupts(dev-kvm);
+   kvm_s390_clear_float_irqs(dev-kvm);
break;
case KVM_DEV_FLIC_APF_ENABLE:
dev-kvm-arch.gmap-pfault_enabled = 1;
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -322,6 +322,7 @@ void kvm_arch_vcpu_destroy(struct kvm_vc
 {
VCPU_EVENT(vcpu, 3, %s, free cpu);
trace_kvm_s390_destroy_vcpu(vcpu-vcpu_id);
+   kvm_s390_clear_local_irqs(vcpu);
kvm_clear_async_pf_completion_queue(vcpu);
if (!kvm_is_ucontrol(vcpu-kvm)) {
clear_bit(63 - vcpu-vcpu_id,
@@ -372,6 +373,7 @@ void kvm_arch_destroy_vm(struct kvm *kvm
if (!kvm_is_ucontrol(kvm))
gmap_free(kvm-arch.gmap);
kvm_s390_destroy_adapters(kvm);
+   kvm_s390_clear_float_irqs(kvm);
 }
 
 /* Section: vcpu related */
--- a/arch/s390/kvm/kvm-s390.h
+++ b/arch/s390/kvm/kvm-s390.h
@@ -130,6 +130,7 @@ void kvm_s390_tasklet(unsigned long parm
 void kvm_s390_deliver_pending_interrupts(struct kvm_vcpu *vcpu);
 void kvm_s390_deliver_pending_machine_checks(struct kvm_vcpu *vcpu);
 void kvm_s390_clear_local_irqs(struct kvm_vcpu *vcpu);
+void kvm_s390_clear_float_irqs(struct kvm *kvm);
 int __must_check kvm_s390_inject_vm(struct kvm *kvm,
struct kvm_s390_interrupt *s390int);
 int __must_check kvm_s390_inject_vcpu(struct kvm_vcpu *vcpu,


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH] sysctl: Add a feature to drop caches selectively

[Maksym Planeta]

To clean the page cache one can use /proc/sys/vm/drop_caches. But this
drops the whole page cache. In contrast to that sdrop_caches enables
ability to drop the page cache selectively by path string.

Suggested-by: Thomas Knauth thomas.kna...@gmx.de
Signed-off-by: Maksym Planeta mcsim.plan...@gmail.com
---
 Documentation/sysctl/vm.txt |  15 ++
 fs/Makefile |   2 +-
 fs/sdrop_caches.c   | 124 
 3 files changed, 140 insertions(+), 1 deletion(-)
 create mode 100644 fs/sdrop_caches.c

diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index bd4b34c..faad01d 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt
@@ -28,6 +28,7 @@ Currently, these files are in /proc/sys/vm:
 - dirty_ratio
 - dirty_writeback_centisecs
 - drop_caches
+- sdrop_caches
 - extfrag_threshold
 - hugepages_treat_as_movable
 - hugetlb_shm_group
@@ -211,6 +212,20 @@ with your system.  To disable them, echo 4 (bit 3) into 
drop_caches.
 
 ==
 
+sdrop_caches
+
+Writing to this will cause the kernel to drop clean caches starting from
+specified path.
+
+To free pagecache of a file:
+   echo /home/user/file  /proc/sys/vm/sdrop_caches
+To free pagecache of a directory and all files in it.
+   echo /home/user/directly  /proc/sys/vm/sdrop_caches
+
+Restrictions are the same as for drop_caches.
+
+==
+
 extfrag_threshold
 
 This parameter affects whether the kernel will compact memory or direct
diff --git a/fs/Makefile b/fs/Makefile
index 4030cbf..366c7b9 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -44,7 +44,7 @@ obj-$(CONFIG_FS_MBCACHE)  += mbcache.o
 obj-$(CONFIG_FS_POSIX_ACL) += posix_acl.o
 obj-$(CONFIG_NFS_COMMON)   += nfs_common/
 obj-$(CONFIG_COREDUMP) += coredump.o
-obj-$(CONFIG_SYSCTL)   += drop_caches.o
+obj-$(CONFIG_SYSCTL)   += drop_caches.o sdrop_caches.o
 
 obj-$(CONFIG_FHANDLE)  += fhandle.o
 
diff --git a/fs/sdrop_caches.c b/fs/sdrop_caches.c
new file mode 100644
index 000..c193655
--- /dev/null
+++ b/fs/sdrop_caches.c
@@ -0,0 +1,124 @@
+/*
+ * Implement the manual selective drop pagecache function
+ */
+
+#include linux/module.h
+
+
+#include linux/kernel.h
+#include linux/proc_fs.h
+#include linux/string.h
+#include linux/vmalloc.h
+#include linux/uaccess.h
+#include linux/mm.h
+#include linux/fs.h
+#include linux/writeback.h
+#include linux/sysctl.h
+#include linux/gfp.h
+#include linux/limits.h
+#include linux/namei.h
+
+static void clean_mapping(struct dentry *dentry)
+{
+   struct inode *inode = dentry-d_inode;
+
+   if (!inode)
+   return;
+
+   if ((inode-i_state  (I_FREEING|I_WILL_FREE|I_NEW)) ||
+   (inode-i_mapping-nrpages == 0)) {
+   return;
+   }
+
+   invalidate_mapping_pages(inode-i_mapping, 0, -1);
+}
+
+static void clean_all_dentries_locked(struct dentry *dentry)
+{
+   struct dentry *child;
+
+   list_for_each_entry(child, dentry-d_subdirs, d_u.d_child) {
+   clean_all_dentries_locked(child);
+   }
+
+   clean_mapping(dentry);
+}
+
+static void clean_all_dentries(struct dentry *dentry)
+{
+   spin_lock_nested(dentry-d_lock, DENTRY_D_LOCK_NESTED);
+   clean_all_dentries_locked(dentry);
+   spin_unlock(dentry-d_lock);
+}
+
+static int drop_pagecache(const char * __user filename)
+{
+   unsigned int lookup_flags = LOOKUP_FOLLOW;
+   struct path path;
+   int error;
+
+retry:
+   error = user_path_at(AT_FDCWD, filename, lookup_flags, path);
+   if (!error) {
+   /* clean */
+   clean_all_dentries(path.dentry);
+   }
+   if (retry_estale(error, lookup_flags)) {
+   lookup_flags |= LOOKUP_REVAL;
+   goto retry;
+   }
+   return error;
+}
+
+static int sdrop_ctl_handler(struct ctl_table *table, int write,
+void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+   char __user *pathname = buffer + *lenp - 1;
+
+   put_user('\0', pathname);
+
+   if (!write)
+   return 0;
+
+   return drop_pagecache(buffer);
+}
+
+static struct ctl_path vm_path[] = { { .procname = vm, }, { } };
+static struct ctl_table sdrop_ctl_table[] = {
+   {
+   .procname = sdrop_caches,
+   .mode = 0644,
+   .proc_handler = sdrop_ctl_handler,
+   },
+   { }
+};
+
+static struct ctl_table_header *sdrop_proc_entry;
+
+/* Init function called on module entry */
+int sdrop_init(void)
+{
+   int ret = 0;
+
+   sdrop_proc_entry = register_sysctl_paths(vm_path, sdrop_ctl_table);
+
+   if (sdrop_proc_entry == NULL) {
+   ret = -ENOMEM;
+   pr_err(sdrop_caches: Couldn't create proc entry\n);
+   }
+
+   return ret;
+}
+
+/* Cleanup function called on module 

Re: [PATCH v4] sched: Fast idling of CPU when system is partially loaded

[Tim Chen]

On Mon, 2014-06-23 at 12:16 -0700, Tim Chen wrote:
 Thanks to the review from Jason, Andi and Peter. I've updated
 the code as Peter suggested with simplified logic.
 
 When a system is lightly loaded (i.e. no more than 1 job per cpu),
 attempt to pull job to a cpu before putting it to idle is unnecessary and
 can be skipped.  This patch adds an indicator so the scheduler can know
 when there's no more than 1 active job is on any CPU in the system to
 skip needless job pulls.
 
 On a 4 socket machine with a request/response kind of workload from
 clients, we saw about 0.13 msec delay when we go through a full load
 balance to try pull job from all the other cpus.  While 0.1 msec was
 spent on processing the request and generating a response, the 0.13 msec
 load balance overhead was actually more than the actual work being done.
 This overhead can be skipped much of the time for lightly loaded systems.
 
 With this patch, we tested with a netperf request/response workload that
 has the server busy with half the cpus in a 4 socket system.  We found
 the patch eliminated 75% of the load balance attempts before idling a cpu.
 
 The overhead of setting/clearing the indicator is low as we already gather
 the necessary info while we call add_nr_running and update_sd_lb_stats.
 We switch to full load balance load immediately if any cpu got more than
 one job on its run queue in add_nr_running.  We'll clear the indicator
 to avoid load balance when we detect no cpu's have more than one job
 when we scan the work queues in update_sg_lb_stats.  We are aggressive
 in turning on the load balance and opportunistic in skipping the load
 balance.
 
 Signed-off-by: Tim Chen tim.c.c...@linux.intel.com
 Acked-by: Jason Low jason.l...@hp.com

Peter,

I need to fixup the code of updating the indicator under
the CONFIG_SMP compile flag.  

Also attached a complete updated patch.

Thanks.

Tim

diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 6d25f1d..d051712 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1222,9 +1222,10 @@ static inline void add_nr_running(struct rq *rq, 
unsigned count)
rq-nr_running = prev_nr + count;
 
if (prev_nr  2  rq-nr_running = 2) {
+#ifdef CONFIG_SMP
if (!rq-rd-overload)
rq-rd-overload = true;
-
+#endif
 #ifdef CONFIG_NO_HZ_FULL
if (tick_nohz_full_cpu(rq-cpu)) {
/* Order rq-nr_running write against the IPI */



The complete updated patch is attached below:
---
From 8716a50c85f98a92d2240da923ef4ae9a9719bbe Mon Sep 17 00:00:00 2001
Message-Id: 
8716a50c85f98a92d2240da923ef4ae9a9719bbe.1403625949.git.tim.c.c...@linux.intel.com
From: Tim Chen tim.c.c...@linux.intel.com
Date: Thu, 12 Jun 2014 11:28:38 -0700
Subject: [PATCH v5] sched: Fast idling of CPU when system is partially loaded
To: Ingo Molnar mi...@elte.hu, Peter Zijlstra pet...@infradead.org
Cc: Andrew Morton a...@linux-foundation.org, Davidlohr Bueso 
davidl...@hp.com, Alex Shi alex@linaro.org, Andi Kleen 
a...@firstfloor.org, Michel Lespinasse wal...@google.com, Rik van Riel 
r...@redhat.com, Peter Hurley pe...@hurleysoftware.com, Thomas Gleixner 
t...@linutronix.de, Paul E.McKenney paul...@linux.vnet.ibm.com, Jason Low 
jason.l...@hp.com, linux-kernel@vger.kernel.org

When a system is lightly loaded (i.e. no more than 1 job per cpu),
attempt to pull job to a cpu before putting it to idle is unnecessary and
can be skipped.  This patch adds an indicator so the scheduler can know
when there's no more than 1 active job is on any CPU in the system to
skip needless job pulls.

On a 4 socket machine with a request/response kind of workload from
clients, we saw about 0.13 msec delay when we go through a full load
balance to try pull job from all the other cpus.  While 0.1 msec was
spent on processing the request and generating a response, the 0.13 msec
load balance overhead was actually more than the actual work being done.
This overhead can be skipped much of the time for lightly loaded systems.

With this patch, we tested with a netperf request/response workload that
has the server busy with half the cpus in a 4 socket system.  We found
the patch eliminated 75% of the load balance attempts before idling a cpu.

The overhead of setting/clearing the indicator is low as we already gather
the necessary info while we call add_nr_running and update_sd_lb_stats.
We switch to full load balance load immediately if any cpu got more than
one job on its run queue in add_nr_running.  We'll clear the indicator
to avoid load balance when we detect no cpu's have more than one job
when we scan the work queues in update_sg_lb_stats.  We are aggressive
in turning on the load balance and opportunistic in skipping the load
balance.

Signed-off-by: Tim Chen tim.c.c...@linux.intel.com
Acked-by: Jason Low jason.l...@hp.com
Acked-by: Rik van Riel r...@redhat.com
---
 kernel/sched/fair.c  | 21 ++---
 kernel/sched/sched.h | 11 

[PATCH 3.14 67/68] ALSA: control: Handle numid overflow

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen l...@metafoo.de

commit ac902c112d90a89e59916f751c2745f4dbdbb4bd upstream.

Each control gets automatically assigned its numids when the control is created.
The allocation is done by incrementing the numid by the amount of allocated
numids per allocation. This means that excessive creation and destruction of
controls (e.g. via SNDRV_CTL_IOCTL_ELEM_ADD/REMOVE) can cause the id to
eventually overflow. Currently when this happens for the control that caused the
overflow kctl-id.numid + kctl-count will also over flow causing it to be
smaller than kctl-id.numid. Most of the code assumes that this is something
that can not happen, so we need to make sure that it won't happen

Signed-off-by: Lars-Peter Clausen l...@metafoo.de
Acked-by: Jaroslav Kysela pe...@perex.cz
Signed-off-by: Takashi Iwai ti...@suse.de
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 sound/core/control.c |4 
 1 file changed, 4 insertions(+)

--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -289,6 +289,10 @@ static bool snd_ctl_remove_numid_conflic
 {
struct snd_kcontrol *kctl;
 
+   /* Make sure that the ids assigned to the control do not wrap around */
+   if (card-last_numid = UINT_MAX - count)
+   card-last_numid = 0;
+
list_for_each_entry(kctl, card-controls, list) {
if (kctl-id.numid  card-last_numid + 1 + count 
kctl-id.numid + kctl-count  card-last_numid + 1) {


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.15 30/61] USB: cdc-acm: fix shutdown and suspend race

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold jhov...@gmail.com

commit ed797074031a37bb9bf4a70952fffc606b77274d upstream.

We should stop I/O unconditionally at suspend rather than rely on the
tty-port initialised flag (which is set prior to stopping I/O during
shutdown) in order to prevent suspend returning with URBs still active.

Fixes: 11ea859d64b6 (USB: additional power savings for cdc-acm devices
that support remote wakeup)

Signed-off-by: Johan Hovold jhov...@gmail.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/usb/class/cdc-acm.c |3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1550,8 +1550,7 @@ static int acm_suspend(struct usb_interf
if (cnt)
return 0;
 
-   if (test_bit(ASYNCB_INITIALIZED, acm-port.flags))
-   stop_data_traffic(acm);
+   stop_data_traffic(acm);
 
return 0;
 }


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [RFT 0/3] cxgb4: use request_firmware_nowait()

[Casey Leedom]

On 06/23/14 17:29, Luis R. Rodriguez wrote:

On Mon, Jun 23, 2014 at 12:06:48PM -0700, Casey Leedom wrote:

   I've looked through the patch and I might be wrong, but it appears that
all the uses of the asynchronous request_firmware_nowait() are followed
immediately by wait_for_completion() calls which essentially would be the
same as the previous code with an added layer of mechanism.  Am I missing
something?

No you're right and I frailed to mention my original goal really is to
see if we can instead move that to ndo_init().


  Okay, thanks for confirming that.  I thought I was being very stupid.

  The problem I think with ndo_init() is that comes off a Network 
Device (struct net_device) and you can't have Network Devices till you 
talk to the adpater, discover how many ports you have, what their MAC 
Addresses are, etc.  And of course you'd then have to be prepared for an 
ndo_init() call on every instantiated Network Device on an adapter and 
only do the device initialization for the first (while holding off any 
and all activity on the others), etc.  All doable but a bit more 
complicated than doing this at Device Probe time.



   We do have a problem with initialization of multiple adapters with
external PHYs since, for each adapter we can check to see if the main
adapter firmware needs updating, and then load the PHY firmware.  If the
main firmware needs updating on more than one adapter, the combined time to
update each adapter's main firmware plus load the PHY firmware can exceed
some Distribution's default limits for a driver module's load time (since
the kernel seems to be processing the PCI Probe of each device
sequentially).

I noticed that for configuration updates it is optional for these configuration
updates to exist, in which case then if udev is enabled the driver will wait
quite a long time unncessarily. To fix that it seems request_firmware_direct()
would be better.


  Hhmmm, I'm unfamiliar with all of this.  I hadn't looked that far 
under the covers of request_firmware() to know that any of these 
variants existed, what their semantics were and when one over the other 
was the preferred API.



   It seems to me that it's unfortunate that the limit isn't on a per device
basis since a system could have an arbitrary number of devices managed by a
driver module.

The timeout is for the amount of time it takes the kernel to get the firemware,
not for device initialization, so its unclear to me that the 60 timeout thing
is actually causing an issue here.


  Are you sure about that?  I just loaded firmware on two of my 
T4-based adapters and each took about 15 seconds to complete.  The 
firmware is ~0.5MB and needs to be written to the on-adapter FLASH. The 
PHY firmware takes a bit less but not a lot.  Add that to the time to do 
general adapter initialization and you're cruising close to 1 minute for 
two adapters ...  Thus, my comment that whatever timeout is present 
should really be per-adapter based ... and it would be nice if the 
driver could inform the kernel as to the expected maximum device probe 
initialization time so we didn't have to have a huge inappropriate 
timeout for all devices ...



Also, it might be useful if there was a way for the driver
module to tell the timeout mechanism that forward progress _is_ being
made so it doesn't blow away the driver module load.

Indeed if this is actually needed, but believe the issue here for the
huge delays might be instead the lack of not using request_firmware_direct()
and actual device initialization time, which I do not believe we penalize,
we should be penalizing only the amount of time it takes either the
kernel or udev to read the firmware from the filesystem.


  If you want I can time the actual phases of loading new firmware: 
request_firmware(), writing it to FLASH, release_firmware() ...



  And maybe, if I'm
right regarding the sequential nature of the introduction of devices to
driver modules, it might make sense for a driver module to be able to
tell the kernel that it has no per-device dependencies and multiple
devices may be probed simultaneously ...

What if just configuration updates use request_firmware_direct() and
for the actual firmware which is required a request_firmware_nowait()
with a proper wait_for_completion() on the ndo_init() ?


  I'm not quite sure I understand what you're asking here.  The cxgb4 
driver attaches to the firmware in the probe() stage and, if the 
firmware is older then the supported version, upgrades the firmware and 
RESETs the device.  Then, for adapters with external PHYs (10Gb/s BT 
predominantly), the same process can happen for the PHY firmware (or on 
some adapters which have no PHY-attached FLASH, this happens for every 
driver load).  It's conceivable that we could defer the PHY firmware 
load till the first ndo_open() but we'd still be stuck with the 
seemingly broken idea that a simple timeout for a driver module load is 
good enough when what we seem to need is 

[PATCH 3.15 01/61] rtc: rtc-at91rm9200: fix infinite wait for ACKUPD irq

[Greg Kroah-Hartman]

3.15-stable review patch.  If anyone has any objections, please let me know.

--

From: Boris BREZILLON boris.brezil...@free-electrons.com

commit 2fe121e1f5aa3bf31b418a9790db6c400e922291 upstream.

The rtc user must wait at least 1 sec between each time/calandar update
(see atmel's datasheet chapter Updating Time/Calendar).

Use the 1Hz interrupt to update the at91_rtc_upd_rdy flag and wait for
the at91_rtc_wait_upd_rdy event if the rtc is not ready.

This patch fixes a deadlock in an uninterruptible wait when the RTC is
updated more than once every second.  AFAICT the bug is here from the
beginning, but I think we should at least backport this fix to 3.10 and
the following longterm and stable releases.

Signed-off-by: Boris BREZILLON boris.brezil...@free-electrons.com
Reported-by: Bryan Evenson beven...@melinkcorp.com
Tested-by: Bryan Evenson beven...@melinkcorp.com
Cc: Andrew Victor li...@maxim.org.za
Cc: Nicolas Ferre nicolas.fe...@atmel.com
Cc: Jean-Christophe Plagniol-Villard plagn...@jcrosoft.com
Cc: Alessandro Zummo a.zu...@towertech.it
Signed-off-by: Andrew Morton a...@linux-foundation.org
Signed-off-by: Linus Torvalds torva...@linux-foundation.org
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/rtc/rtc-at91rm9200.c |   16 ++--
 1 file changed, 14 insertions(+), 2 deletions(-)

--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -48,6 +48,7 @@ struct at91_rtc_config {
 
 static const struct at91_rtc_config *at91_rtc_config;
 static DECLARE_COMPLETION(at91_rtc_updated);
+static DECLARE_COMPLETION(at91_rtc_upd_rdy);
 static unsigned int at91_alarm_year = AT91_RTC_EPOCH;
 static void __iomem *at91_rtc_regs;
 static int irq;
@@ -161,6 +162,8 @@ static int at91_rtc_settime(struct devic
1900 + tm-tm_year, tm-tm_mon, tm-tm_mday,
tm-tm_hour, tm-tm_min, tm-tm_sec);
 
+   wait_for_completion(at91_rtc_upd_rdy);
+
/* Stop Time/Calendar from counting */
cr = at91_rtc_read(AT91_RTC_CR);
at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM);
@@ -183,7 +186,9 @@ static int at91_rtc_settime(struct devic
 
/* Restart Time/Calendar */
cr = at91_rtc_read(AT91_RTC_CR);
+   at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_SECEV);
at91_rtc_write(AT91_RTC_CR, cr  ~(AT91_RTC_UPDCAL | AT91_RTC_UPDTIM));
+   at91_rtc_write_ier(AT91_RTC_SECEV);
 
return 0;
 }
@@ -290,8 +295,10 @@ static irqreturn_t at91_rtc_interrupt(in
if (rtsr) { /* this interrupt is shared!  Is it ours? */
if (rtsr  AT91_RTC_ALARM)
events |= (RTC_AF | RTC_IRQF);
-   if (rtsr  AT91_RTC_SECEV)
-   events |= (RTC_UF | RTC_IRQF);
+   if (rtsr  AT91_RTC_SECEV) {
+   complete(at91_rtc_upd_rdy);
+   at91_rtc_write_idr(AT91_RTC_SECEV);
+   }
if (rtsr  AT91_RTC_ACKUPD)
complete(at91_rtc_updated);
 
@@ -413,6 +420,11 @@ static int __init at91_rtc_probe(struct
return PTR_ERR(rtc);
platform_set_drvdata(pdev, rtc);
 
+   /* enable SECEV interrupt in order to initialize at91_rtc_upd_rdy
+* completion.
+*/
+   at91_rtc_write_ier(AT91_RTC_SECEV);
+
dev_info(pdev-dev, AT91 Real Time Clock driver.\n);
return 0;
 }


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 58/68] lzo: properly check for overruns

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Greg Kroah-Hartman gre...@linuxfoundation.org

commit 206a81c18401c0cde6e579164f752c4b147324ce upstream.

The lzo decompressor can, if given some really crazy data, possibly
overrun some variable types.  Modify the checking logic to properly
detect overruns before they happen.

Reported-by: Don A. Bailey d...@securitymouse.com
Tested-by: Don A. Bailey d...@securitymouse.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 lib/lzo/lzo1x_decompress_safe.c |   62 ++--
 1 file changed, 41 insertions(+), 21 deletions(-)

--- a/lib/lzo/lzo1x_decompress_safe.c
+++ b/lib/lzo/lzo1x_decompress_safe.c
@@ -19,11 +19,31 @@
 #include linux/lzo.h
 #include lzodefs.h
 
-#define HAVE_IP(x)  ((size_t)(ip_end - ip) = (size_t)(x))
-#define HAVE_OP(x)  ((size_t)(op_end - op) = (size_t)(x))
-#define NEED_IP(x)  if (!HAVE_IP(x)) goto input_overrun
-#define NEED_OP(x)  if (!HAVE_OP(x)) goto output_overrun
-#define TEST_LB(m_pos)  if ((m_pos)  out) goto lookbehind_overrun
+#define HAVE_IP(t, x)  \
+   (((size_t)(ip_end - ip) = (size_t)(t + x))   \
+(((t + x) = t)  ((t + x) = x)))
+
+#define HAVE_OP(t, x)  \
+   (((size_t)(op_end - op) = (size_t)(t + x))   \
+(((t + x) = t)  ((t + x) = x)))
+
+#define NEED_IP(t, x)  \
+   do {\
+   if (!HAVE_IP(t, x)) \
+   goto input_overrun; \
+   } while (0)
+
+#define NEED_OP(t, x)  \
+   do {\
+   if (!HAVE_OP(t, x)) \
+   goto output_overrun;\
+   } while (0)
+
+#define TEST_LB(m_pos) \
+   do {\
+   if ((m_pos)  out)  \
+   goto lookbehind_overrun;\
+   } while (0)
 
 int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
  unsigned char *out, size_t *out_len)
@@ -58,14 +78,14 @@ int lzo1x_decompress_safe(const unsigned
while (unlikely(*ip == 0)) {
t += 255;
ip++;
-   NEED_IP(1);
+   NEED_IP(1, 0);
}
t += 15 + *ip++;
}
t += 3;
 copy_literal_run:
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
-   if (likely(HAVE_IP(t + 15)  HAVE_OP(t + 15))) 
{
+   if (likely(HAVE_IP(t, 15)  HAVE_OP(t, 15))) {
const unsigned char *ie = ip + t;
unsigned char *oe = op + t;
do {
@@ -81,8 +101,8 @@ copy_literal_run:
} else
 #endif
{
-   NEED_OP(t);
-   NEED_IP(t + 3);
+   NEED_OP(t, 0);
+   NEED_IP(t, 3);
do {
*op++ = *ip++;
} while (--t  0);
@@ -95,7 +115,7 @@ copy_literal_run:
m_pos -= t  2;
m_pos -= *ip++  2;
TEST_LB(m_pos);
-   NEED_OP(2);
+   NEED_OP(2, 0);
op[0] = m_pos[0];
op[1] = m_pos[1];
op += 2;
@@ -119,10 +139,10 @@ copy_literal_run:
while (unlikely(*ip == 0)) {
t += 255;
ip++;
-   NEED_IP(1);
+   NEED_IP(1, 0);
}
t += 31 + *ip++;
-   NEED_IP(2);
+   NEED_IP(2, 0);
}
m_pos = op - 1;
next = get_unaligned_le16(ip);
@@ -137,10 +157,10 @@ copy_literal_run:
while (unlikely(*ip == 0)) {
t += 255;
 

[PATCH 3.14 49/68] ASoC: dapm: Make sure to always update the DAPM graph in _put_volsw()

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen l...@metafoo.de

commit c9e065c27fe9b81e5d6e7681d77a24f7b9616675 upstream.

When using auto-muted controls it may happen that the register value will not
change when changing a control from enabled to disabled (since the control might
be physically disabled due to the auto-muting). We have to make sure to still
update the DAPM graph and disconnect the mixer input.

Fixes: commit 5729507 (ASoC: dapm: Implement mixer input auto-disable)
Signed-off-by: Lars-Peter Clausen l...@metafoo.de
Signed-off-by: Mark Brown broo...@linaro.org
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 sound/soc/soc-dapm.c |   23 ++-
 1 file changed, 10 insertions(+), 13 deletions(-)

--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2888,22 +2888,19 @@ int snd_soc_dapm_put_volsw(struct snd_kc
mutex_lock_nested(card-dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
 
change = dapm_kcontrol_set_value(kcontrol, val);
-
-   if (reg != SND_SOC_NOPM) {
-   mask = mask  shift;
-   val = val  shift;
-
-   change = snd_soc_test_bits(codec, reg, mask, val);
-   }
-
if (change) {
if (reg != SND_SOC_NOPM) {
-   update.kcontrol = kcontrol;
-   update.reg = reg;
-   update.mask = mask;
-   update.val = val;
+   mask = mask  shift;
+   val = val  shift;
+
+   if (snd_soc_test_bits(codec, reg, mask, val)) {
+   update.kcontrol = kcontrol;
+   update.reg = reg;
+   update.mask = mask;
+   update.val = val;
+   card-update = update;
+   }
 
-   card-update = update;
}
 
ret = soc_dapm_mixer_update_power(card, kcontrol, connect);


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 51/68] ASoC: tlv320aci3x: Fix custom snd_soc_dapm_put_volsw_aic3x() function

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Peter Ujfalusi peter.ujfal...@ti.com

commit e6c111fac4464e3f4bf7b3802b517dafc80f8e0f upstream.

For some unknown reason the parameters for snd_soc_test_bits() were in wrong
order:
It was:
snd_soc_test_bits(codec, val, mask, reg); /* WRONG!!! */
while it should be:
snd_soc_test_bits(codec, reg, mask, val);

Signed-off-by: Peter Ujfalusi peter.ujfal...@ti.com
Signed-off-by: Mark Brown broo...@linaro.org
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 sound/soc/codecs/tlv320aic3x.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -169,7 +169,7 @@ static int snd_soc_dapm_put_volsw_aic3x(
mask = shift;
val = shift;
 
-   change = snd_soc_test_bits(codec, val, mask, reg);
+   change = snd_soc_test_bits(codec, reg, mask, val);
if (change) {
update.kcontrol = kcontrol;
update.reg = reg;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 52/68] iio:adc:max1363 incorrect resolutions for max11604, max11605, max11610 and max11611.

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Jonathan Cameron ji...@kernel.org

commit a91a73c8b39a6b8bcc53fafa5372c65387c81233 upstream.

Reported-by: Erik Habbinga erik.habbi...@schneider-electric.com
Signed-off-by: Jonathan Cameron ji...@kernel.org
Acked-by: Hartmut Knaack knaac...@gmx.de
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/iio/adc/max1363.c |   16 
 1 file changed, 8 insertions(+), 8 deletions(-)

--- a/drivers/iio/adc/max1363.c
+++ b/drivers/iio/adc/max1363.c
@@ -1258,8 +1258,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = max1238_info,
-   .channels = max1238_channels,
-   .num_channels = ARRAY_SIZE(max1238_channels),
+   .channels = max1038_channels,
+   .num_channels = ARRAY_SIZE(max1038_channels),
},
[max11605] = {
.bits = 8,
@@ -1268,8 +1268,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = max1238_info,
-   .channels = max1238_channels,
-   .num_channels = ARRAY_SIZE(max1238_channels),
+   .channels = max1038_channels,
+   .num_channels = ARRAY_SIZE(max1038_channels),
},
[max11606] = {
.bits = 10,
@@ -1318,8 +1318,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = max1238_info,
-   .channels = max1238_channels,
-   .num_channels = ARRAY_SIZE(max1238_channels),
+   .channels = max1138_channels,
+   .num_channels = ARRAY_SIZE(max1138_channels),
},
[max11611] = {
.bits = 10,
@@ -1328,8 +1328,8 @@ static const struct max1363_chip_info ma
.num_modes = ARRAY_SIZE(max1238_mode_list),
.default_mode = s0to11,
.info = max1238_info,
-   .channels = max1238_channels,
-   .num_channels = ARRAY_SIZE(max1238_channels),
+   .channels = max1138_channels,
+   .num_channels = ARRAY_SIZE(max1138_channels),
},
[max11612] = {
.bits = 12,


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 62/68] ALSA: hda/realtek - Add more entry for enable HP mute led

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Kailang Yang kail...@realtek.com

commit 8a02b164d4bfac108bfe37e98108bff1e062bd3d upstream.

More HP machine need mute led support.

Signed-off-by: Kailang Yang kail...@realtek.com
Signed-off-by: Takashi Iwai ti...@suse.de
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 sound/pci/hda/patch_realtek.c |   14 ++
 1 file changed, 14 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4427,14 +4427,24 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x103c, 0x1983, HP Pavilion, 
ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x218b, HP, 
ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
/* ALC282 */
+   SND_PCI_QUIRK(0x103c, 0x220d, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x220e, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x220f, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2210, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2211, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2212, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2213, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2214, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2266, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2267, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2268, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x2269, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x226a, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x226b, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x226c, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x226d, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x226e, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x226f, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x227a, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x227b, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x229e, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
@@ -4474,6 +4484,10 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x103c, 0x22c8, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x22c3, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK(0x103c, 0x22c4, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2334, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2335, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2336, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
+   SND_PCI_QUIRK(0x103c, 0x2337, HP, ALC269_FIXUP_HP_MUTE_LED_MIC1),
SND_PCI_QUIRK_VENDOR(0x103c, HP, ALC269_FIXUP_HP_MUTE_LED),
SND_PCI_QUIRK(0x1043, 0x103f, ASUS TX300, ALC282_FIXUP_ASUS_TX300),
SND_PCI_QUIRK(0x1043, 0x106d, Asus K53BE, 
ALC269_FIXUP_LIMIT_INT_MIC_BOOST),


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 61/68] ALSA: hda/realtek - Add support of ALC891 codec

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Kailang Yang kail...@realtek.com

commit b6c5fbad16aa5026f508093a8d651c25e1cb6179 upstream.

New codec support for ALC891.

Signed-off-by: Kailang Yang kail...@realtek.com
Signed-off-by: Takashi Iwai ti...@suse.de
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 sound/pci/hda/patch_realtek.c |1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5536,6 +5536,7 @@ static const struct hda_codec_preset snd
{ .id = 0x10ec0670, .name = ALC670, .patch = patch_alc662 },
{ .id = 0x10ec0671, .name = ALC671, .patch = patch_alc662 },
{ .id = 0x10ec0680, .name = ALC680, .patch = patch_alc680 },
+   { .id = 0x10ec0867, .name = ALC891, .patch = patch_alc882 },
{ .id = 0x10ec0880, .name = ALC880, .patch = patch_alc880 },
{ .id = 0x10ec0882, .name = ALC882, .patch = patch_alc882 },
{ .id = 0x10ec0883, .name = ALC883, .patch = patch_alc882 },


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 53/68] staging: iio: tsl2x7x_core: fix proximity treshold

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Mario Schuknecht mario.schukne...@dresearch-fe.de

commit c404618cd06dad771495fe1cf9d5a63b5664f65f upstream.

Consider high byte of proximity min and max treshold in function
'tsl2x7x_chip_on'. So far, the high byte was not set.

Signed-off-by: Mario Schuknecht mario.schukne...@dresearch-fe.de
Signed-off-by: Jonathan Cameron ji...@kernel.org
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/staging/iio/light/tsl2x7x_core.c |8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/staging/iio/light/tsl2x7x_core.c
+++ b/drivers/staging/iio/light/tsl2x7x_core.c
@@ -667,9 +667,13 @@ static int tsl2x7x_chip_on(struct iio_de
chip-tsl2x7x_config[TSL2X7X_PRX_COUNT] =
chip-tsl2x7x_settings.prox_pulse_count;
chip-tsl2x7x_config[TSL2X7X_PRX_MINTHRESHLO] =
-   chip-tsl2x7x_settings.prox_thres_low;
+   (chip-tsl2x7x_settings.prox_thres_low)  0xFF;
+   chip-tsl2x7x_config[TSL2X7X_PRX_MINTHRESHHI] =
+   (chip-tsl2x7x_settings.prox_thres_low  8)  0xFF;
chip-tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHLO] =
-   chip-tsl2x7x_settings.prox_thres_high;
+   (chip-tsl2x7x_settings.prox_thres_high)  0xFF;
+   chip-tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHHI] =
+   (chip-tsl2x7x_settings.prox_thres_high  8)  0xFF;
 
/* and make sure we're not already on */
if (chip-tsl2x7x_chip_status == TSL2X7X_CHIP_WORKING) {


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 59/68] lz4: ensure length does not wrap

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Greg Kroah-Hartman gre...@linuxfoundation.org

commit 206204a1162b995e2185275167b22468c00d6b36 upstream.

Given some pathologically compressed data, lz4 could possibly decide to
wrap a few internal variables, causing unknown things to happen.  Catch
this before the wrapping happens and abort the decompression.

Reported-by: Don A. Bailey d...@securitymouse.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 lib/lz4/lz4_decompress.c |2 ++
 1 file changed, 2 insertions(+)

--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -72,6 +72,8 @@ static int lz4_uncompress(const char *so
len = *ip++;
for (; len == 255; length += 255)
len = *ip++;
+   if (unlikely(length  (size_t)(length + len)))
+   goto _output_error;
length += len;
}
 


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 50/68] ASoC: max98090: Fix reset at resume time

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Liam Girdwood liam.r.girdw...@linux.intel.com

commit 25b4ab430f8e166c9b63f4db28e7e812d5a59396 upstream.

Reset needs to wait 20ms before other codec IO is performed. This wait
was not being performed. Fix this by making sure the reset register is not
restored with the cache, but use the manual reset method in resume with
the wait.

Signed-off-by: Liam Girdwood liam.r.girdw...@linux.intel.com
Signed-off-by: Jarkko Nikula jarkko.nik...@linux.intel.com
Signed-off-by: Mark Brown broo...@linaro.org
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 sound/soc/codecs/max98090.c |3 +++
 1 file changed, 3 insertions(+)

--- a/sound/soc/codecs/max98090.c
+++ b/sound/soc/codecs/max98090.c
@@ -255,6 +255,7 @@ static struct reg_default max98090_reg[]
 static bool max98090_volatile_register(struct device *dev, unsigned int reg)
 {
switch (reg) {
+   case M98090_REG_SOFTWARE_RESET:
case M98090_REG_DEVICE_STATUS:
case M98090_REG_JACK_STATUS:
case M98090_REG_REVISION_ID:
@@ -2360,6 +2361,8 @@ static int max98090_runtime_resume(struc
 
regcache_cache_only(max98090-regmap, false);
 
+   max98090_reset(max98090);
+
regcache_sync(max98090-regmap);
 
return 0;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 65/68] ALSA: control: Fix replacing user controls

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen l...@metafoo.de

commit 82262a46627bebb0febcc26664746c25cef08563 upstream.

There are two issues with the current implementation for replacing user
controls. The first is that the code does not check if the control is actually a
user control and neither does it check if the control is owned by the process
that tries to remove it. That allows userspace applications to remove arbitrary
controls, which can cause a user after free if a for example a driver does not
expect a control to be removed from under its feed.

The second issue is that on one hand when a control is replaced the
user_ctl_count limit is not checked and on the other hand the user_ctl_count is
increased (even though the number of user controls does not change). This allows
userspace, once the user_ctl_count limit as been reached, to repeatedly replace
a control until user_ctl_count overflows. Once that happens new controls can be
added effectively bypassing the user_ctl_count limit.

Both issues can be fixed by instead of open-coding the removal of the control
that is to be replaced to use snd_ctl_remove_user_ctl(). This function does
proper permission checks as well as decrements user_ctl_count after the control
has been removed.

Note that by using snd_ctl_remove_user_ctl() the check which returns -EBUSY at
beginning of the function if the control already exists is removed. This is not
a problem though since the check is quite useless, because the lock that is
protecting the control list is released between the check and before adding the
new control to the list, which means that it is possible that a different
control with the same settings is added to the list after the check. Luckily
there is another check that is done while holding the lock in snd_ctl_add(), so
we'll rely on that to make sure that the same control is not added twice.

Signed-off-by: Lars-Peter Clausen l...@metafoo.de
Acked-by: Jaroslav Kysela pe...@perex.cz
Signed-off-by: Takashi Iwai ti...@suse.de
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 sound/core/control.c |   25 +
 1 file changed, 9 insertions(+), 16 deletions(-)

--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1155,8 +1155,6 @@ static int snd_ctl_elem_add(struct snd_c
struct user_element *ue;
int idx, err;
 
-   if (!replace  card-user_ctl_count = MAX_USER_CONTROLS)
-   return -ENOMEM;
if (info-count  1)
return -EINVAL;
access = info-access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
@@ -1165,21 +1163,16 @@ static int snd_ctl_elem_add(struct snd_c
 SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE));
info-id.numid = 0;
memset(kctl, 0, sizeof(kctl));
-   down_write(card-controls_rwsem);
-   _kctl = snd_ctl_find_id(card, info-id);
-   err = 0;
-   if (_kctl) {
-   if (replace)
-   err = snd_ctl_remove(card, _kctl);
-   else
-   err = -EBUSY;
-   } else {
-   if (replace)
-   err = -ENOENT;
+
+   if (replace) {
+   err = snd_ctl_remove_user_ctl(file, info-id);
+   if (err)
+   return err;
}
-   up_write(card-controls_rwsem);
-   if (err  0)
-   return err;
+
+   if (card-user_ctl_count = MAX_USER_CONTROLS)
+   return -ENOMEM;
+
memcpy(kctl.id, info-id, sizeof(info-id));
kctl.count = info-owner ? info-owner : 1;
access |= SNDRV_CTL_ELEM_ACCESS_USER;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 66/68] ALSA: control: Dont access controls outside of protected regions

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen l...@metafoo.de

commit fd9f26e4eca5d08a27d12c0933fceef76ed9663d upstream.

A control that is visible on the card-controls list can be freed at any time.
This means we must not access any of its memory while not holding the
controls_rw_lock. Otherwise we risk a use after free access.

Signed-off-by: Lars-Peter Clausen l...@metafoo.de
Acked-by: Jaroslav Kysela pe...@perex.cz
Signed-off-by: Takashi Iwai ti...@suse.de
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 sound/core/control.c |   15 ++-
 1 file changed, 10 insertions(+), 5 deletions(-)

--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -331,6 +331,7 @@ int snd_ctl_add(struct snd_card *card, s
 {
struct snd_ctl_elem_id id;
unsigned int idx;
+   unsigned int count;
int err = -EINVAL;
 
if (! kcontrol)
@@ -359,8 +360,9 @@ int snd_ctl_add(struct snd_card *card, s
card-controls_count += kcontrol-count;
kcontrol-id.numid = card-last_numid + 1;
card-last_numid += kcontrol-count;
+   count = kcontrol-count;
up_write(card-controls_rwsem);
-   for (idx = 0; idx  kcontrol-count; idx++, id.index++, id.numid++)
+   for (idx = 0; idx  count; idx++, id.index++, id.numid++)
snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, id);
return 0;
 
@@ -389,6 +391,7 @@ int snd_ctl_replace(struct snd_card *car
bool add_on_replace)
 {
struct snd_ctl_elem_id id;
+   unsigned int count;
unsigned int idx;
struct snd_kcontrol *old;
int ret;
@@ -424,8 +427,9 @@ add:
card-controls_count += kcontrol-count;
kcontrol-id.numid = card-last_numid + 1;
card-last_numid += kcontrol-count;
+   count = kcontrol-count;
up_write(card-controls_rwsem);
-   for (idx = 0; idx  kcontrol-count; idx++, id.index++, id.numid++)
+   for (idx = 0; idx  count; idx++, id.index++, id.numid++)
snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, id);
return 0;
 
@@ -898,9 +902,9 @@ static int snd_ctl_elem_write(struct snd
result = kctl-put(kctl, control);
}
if (result  0) {
+   struct snd_ctl_elem_id id = control-id;
up_read(card-controls_rwsem);
-   snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-  control-id);
+   snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, id);
return 0;
}
}
@@ -1334,8 +1338,9 @@ static int snd_ctl_tlv_ioctl(struct snd_
}
err = kctl-tlv.c(kctl, op_flag, tlv.length, _tlv-tlv);
if (err  0) {
+   struct snd_ctl_elem_id id = kctl-id;
up_read(card-controls_rwsem);
-   snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, 
kctl-id);
+   snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, id);
return 0;
}
} else {


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 60/68] ALSA: compress: Cancel the optimization of compiler and fix the size of struct for all platform.

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Wang, Xiaoming xiaoming.w...@intel.com

commit 2bd0ae464a6cf7363bbf72c8545e0aa43caa57f0 upstream.

Cancel the optimization of compiler for struct snd_compr_avail
which size will be 0x1c in 32bit kernel while 0x20 in 64bit
kernel under the optimizer. That will make compaction between
32bit and 64bit. So add packed to fix the size of struct
snd_compr_avail to 0x1c for all platform.

Signed-off-by: Zhang Dongxing dongxing.zh...@intel.com
Signed-off-by: xiaoming wang xiaoming.w...@intel.com
Acked-by: Vinod Koul vinod.k...@intel.com
Signed-off-by: Takashi Iwai ti...@suse.de
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 include/uapi/sound/compress_offload.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/uapi/sound/compress_offload.h
+++ b/include/uapi/sound/compress_offload.h
@@ -80,7 +80,7 @@ struct snd_compr_tstamp {
 struct snd_compr_avail {
__u64 avail;
struct snd_compr_tstamp tstamp;
-};
+} __attribute__((packed));
 
 enum snd_compr_direction {
SND_COMPRESS_PLAYBACK = 0,


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH tip/core/rcu] Reduce overhead of cond_resched() checks for RCU

[Dave Hansen]

On 06/23/2014 05:39 PM, Paul E. McKenney wrote:
 On Mon, Jun 23, 2014 at 05:20:30PM -0700, Dave Hansen wrote:
 On 06/23/2014 05:15 PM, Paul E. McKenney wrote:
 Just out of curiosity, how many CPUs does your system have?  80?
 If 160, looks like something bad is happening at 80.

 80 cores, 160 threads.  80 processes/threads is where we start using
 the second thread on the cores.  The tasks are also pinned to
 hyperthread pairs, so they disturb each other, and the scheduler moves
 them between threads on occasion which causes extra noise.
 
 OK, that could explain the near flattening of throughput near 80
 processes.  Is 3.16.0-rc1-pf2 with the two RCU patches?

It's actually with _just_ e552592e03 applied on top of 3.16-rc1.

 If so, is the new sysfs parameter at its default value?

I didn't record that, and I've forgotten.  I'll re-run it to verify what
it was.
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 68/68] ALSA: control: Make sure that id-index does not overflow

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Lars-Peter Clausen l...@metafoo.de

commit 883a1d49f0d77d30012f114b2e19fc141beb3e8e upstream.

The ALSA control code expects that the range of assigned indices to a control is
continuous and does not overflow. Currently there are no checks to enforce this.
If a control with a overflowing index range is created that control becomes
effectively inaccessible and unremovable since snd_ctl_find_id() will not be
able to find it. This patch adds a check that makes sure that controls with a
overflowing index range can not be created.

Signed-off-by: Lars-Peter Clausen l...@metafoo.de
Acked-by: Jaroslav Kysela pe...@perex.cz
Signed-off-by: Takashi Iwai ti...@suse.de
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 sound/core/control.c |3 +++
 1 file changed, 3 insertions(+)

--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -343,6 +343,9 @@ int snd_ctl_add(struct snd_card *card, s
if (snd_BUG_ON(!card || !kcontrol-info))
goto error;
id = kcontrol-id;
+   if (id.index  UINT_MAX - kcontrol-count)
+   goto error;
+
down_write(card-controls_rwsem);
if (snd_ctl_find_id(card, id)) {
up_write(card-controls_rwsem);


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 44/68] USB: cdc-acm: fix potential urb leak and PM imbalance in write

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold jhov...@gmail.com

commit 183a45087d126d126e8dd1d9b2602fc129dff9ad upstream.

Make sure to check return value of autopm get in write() in order to
avoid urb leak and PM counter imbalance on errors.

Fixes: 11ea859d64b6 (USB: additional power savings for cdc-acm devices
that support remote wakeup)

Signed-off-by: Johan Hovold jhov...@gmail.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/usb/class/cdc-acm.c |8 +++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -666,7 +666,13 @@ static int acm_tty_write(struct tty_stru
memcpy(wb-buf, buf, count);
wb-len = count;
 
-   usb_autopm_get_interface_async(acm-control);
+   stat = usb_autopm_get_interface_async(acm-control);
+   if (stat) {
+   wb-use = 0;
+   spin_unlock_irqrestore(acm-write_lock, flags);
+   return stat;
+   }
+
if (acm-susp_count) {
usb_anchor_urb(wb-urb, acm-delayed);
spin_unlock_irqrestore(acm-write_lock, flags);


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH] Allow increasing the buffer-head per-CPU LRU size

[Sebastien Buisson]

Influence of buffer-head per-CPU LRU size on metadata performance has 
been studied with mdtest, on one ext4 formatted ramdisk device, 
creating, stating and removing 100 files in the same directory. 
Several test cases were evaluated, varying the 'size' of the directory 
in which files are created:

- target directory is empty
- target directory already contains 10 files
- target directory already contains 50 files
- target directory already contains 200 files
- target directory already contains 500 files
- target directory already contains 1000 files

To compare the effect of the patch, the same series of tests was run with:
- a vanilla kernel
- a patched kernel with BH_LRU_SIZE set to 16

The tests launched were:
(a) mdtest on ramdisk device, single shared dir, with large ACL and SELinux
(b) mdtest on ramdisk device, single shared dir, with large ACL but NO 
SELinux


Below are the results showing performance gain (in percentage) when 
increasing BH_LRU_SIZE to 16 (vanilla default value is 8):

(a)
files   tasks   dir sizeCreation   Stat Removal
100 1   0   -8,7   -2,7 -0,5
100 1   10  -5,2   -0,5 -1,1
100 1   50  -5,1   -3,7 -1,5
100 1   200 -5,1   -4,0 -8,5
100 1   500 -4,2   -5,3 -10,2
100 1   1000-3,5   -8,0 -10,9
100 8   0   -0,3   -3,8 -1,2
100 8   10  -1,2   -3,7 -1,5
100 8   50   0,5   -3,2 -5,3
100 8   200 -1,7   -6,1 -8,7
100 8   500 -5,9   -7,7 -11,9
100 8   1000-4,1   -8,8 -13,6

(b)
files   tasks   dir sizeCreation   Stat Removal
100 1   00,0   -0,9 -1,1
100 1   10   1,0   -3,0 -3,5
100 1   50   3,7   -3,0 -2,4
100 1   200  1,13,6 -0,2
100 1   500  3,50,1  5,9
100 1   1000 9,03,8  6,4
100 8   02,4   -1,2 -4,3
100 8   10  -0,2   -1,8 -2,4
100 8   50   1,1   -0,3  2,0
100 8   200 -0,3   -2,8 -3,3
100 8   500  0,3   -3,1 -1,3
100 8   1000 1,50,0  0,7


To sum up briefly, it is very difficult to show performance improvement 
with mdtest. The only positive case is on Create without SELinux when 
using 1 thread. Strangely the more threads we have, the poorer is the 
gain in performance.



Furthermore, metadata tests were run on Lustre with a specific benchmark 
called mds-survey. They used a ramdisk device, creating, stating and 
removing 100 files.


The tests launched were:
(c) mds-survey on ramdisk device, quota enabled, shared directory
(d) mds-survey on ramdisk device, quota enabled, directory per process

Below are the results showing performance gain (in percentage) when 
increasing BH_LRU_SIZE to 16 (vanilla default value is 8):

(c)
files   dir threads create  lookup  destroy
100 1   111,31,2 7,2
100 1   2 6,42,3 6,9
100 1   4 1,93,0 1,3
100 1   8-0,64,3 0,7
100 1   160,54,4 0,6

(d)
files   dir threads create  lookup  destroy
100 4   4 3,2   28,5 5,3
100 8   8 1,2   33,9 2,0
100 16  160,67,9-0,2


Compared to pure ext4 tests, we can see more improvements thanks to 
mds-survey. In shared directory case, gain is between 0 and 10% for 
create, between 1 and 4% for lookup, and between 0 and 7% for destroy, 
depending on the number of threads.


All this test plan has been elaborated in collaboration with Intel, and 
results have been already shared with them.




[PATCH] Allow increasing the buffer-head per-CPU LRU size

Allow increasing the buffer-head per-CPU LRU size to allow efficient
filesystem operations that access many blocks for each transaction.
For example, creating a file in a large ext4 directory with quota
enabled will accesses multiple buffer heads and will overflow the LRU
at the default 8-block LRU size:

* parent directory inode table block (ctime, nlinks for subdirs)
* new inode bitmap

[PATCH 3.14 40/68] USB: cdc-acm: fix write and resume race

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold jhov...@gmail.com

commit e144ed28bed10684f9aaec6325ed974d53f76110 upstream.

Fix race between write() and resume() due to improper locking that could
lead to writes being reordered.

Resume must be done atomically and susp_count be protected by the
write_lock in order to prevent racing with write(). This could otherwise
lead to writes being reordered if write() grabs the write_lock after
susp_count is decremented, but before the delayed urb is submitted.

Fixes: 11ea859d64b6 (USB: additional power savings for cdc-acm devices
that support remote wakeup)

Signed-off-by: Johan Hovold jhov...@gmail.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/usb/class/cdc-acm.c |   23 +--
 1 file changed, 9 insertions(+), 14 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1539,27 +1539,20 @@ static int acm_resume(struct usb_interfa
struct acm *acm = usb_get_intfdata(intf);
struct acm_wb *wb;
int rv = 0;
-   int cnt;
 
spin_lock_irq(acm-read_lock);
-   acm-susp_count -= 1;
-   cnt = acm-susp_count;
-   spin_unlock_irq(acm-read_lock);
+   spin_lock(acm-write_lock);
 
-   if (cnt)
-   return 0;
+   if (--acm-susp_count)
+   goto out;
 
if (test_bit(ASYNCB_INITIALIZED, acm-port.flags)) {
-   rv = usb_submit_urb(acm-ctrlurb, GFP_NOIO);
+   rv = usb_submit_urb(acm-ctrlurb, GFP_ATOMIC);
 
-   spin_lock_irq(acm-write_lock);
if (acm-delayed_wb) {
wb = acm-delayed_wb;
acm-delayed_wb = NULL;
-   spin_unlock_irq(acm-write_lock);
acm_start_wb(acm, wb);
-   } else {
-   spin_unlock_irq(acm-write_lock);
}
 
/*
@@ -1567,12 +1560,14 @@ static int acm_resume(struct usb_interfa
 * do the write path at all cost
 */
if (rv  0)
-   goto err_out;
+   goto out;
 
-   rv = acm_submit_read_urbs(acm, GFP_NOIO);
+   rv = acm_submit_read_urbs(acm, GFP_ATOMIC);
}
+out:
+   spin_unlock(acm-write_lock);
+   spin_unlock_irq(acm-read_lock);
 
-err_out:
return rv;
 }
 


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 45/68] USB: cdc-acm: fix I/O after failed open

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold jhov...@gmail.com

commit e4c36076c2a6195ec62c35b03c3fde84d0087dc8 upstream.

Make sure to kill any already submitted read urbs on read-urb submission
failures in open in order to prevent doing I/O for a closed port.

Fixes: 088c64f81284 (USB: cdc-acm: re-write read processing)
Signed-off-by: Johan Hovold jhov...@gmail.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/usb/class/cdc-acm.c |3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -506,6 +506,7 @@ static int acm_port_activate(struct tty_
 {
struct acm *acm = container_of(port, struct acm, port);
int retval = -ENODEV;
+   int i;
 
dev_dbg(acm-control-dev, %s\n, __func__);
 
@@ -554,6 +555,8 @@ static int acm_port_activate(struct tty_
return 0;
 
 error_submit_read_urbs:
+   for (i = 0; i  acm-rx_buflimit; i++)
+   usb_kill_urb(acm-read_urbs[i]);
acm-ctrlout = 0;
acm_set_control(acm, acm-ctrlout);
 error_set_control:


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 37/68] ARM: at91: fix at91_sysirq_mask_rtc for sam9x5 SoCs

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Boris BREZILLON boris.brezil...@free-electrons.com

commit 9dcc87fec8947308e0111c65dcd881e6aa5b1673 upstream.

sam9x5 SoCs have the following errata:
 RTC: Interrupt Mask Register cannot be used
  Interrupt Mask Register read always returns 0.

Hence we should not rely on what IMR claims about already masked IRQs
and just disable all IRQs.

Signed-off-by: Boris BREZILLON boris.brezil...@free-electrons.com
Reported-by: Bryan Evenson beven...@melinkcorp.com
Reviewed-by: Johan Hovold jo...@hovold.com
Acked-by: Nicolas Ferre nicolas.fe...@atmel.com
Cc: Bryan Evenson beven...@melinkcorp.com
Cc: Andrew Victor li...@maxim.org.za
Cc: Jean-Christophe Plagniol-Villard plagn...@jcrosoft.com
Cc: Alessandro Zummo a.zu...@towertech.it
Cc: Mark Roszko mark.ros...@gmail.com
Signed-off-by: Andrew Morton a...@linux-foundation.org
Signed-off-by: Linus Torvalds torva...@linux-foundation.org
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 arch/arm/mach-at91/sysirq_mask.c |   22 +-
 1 file changed, 13 insertions(+), 9 deletions(-)

--- a/arch/arm/mach-at91/sysirq_mask.c
+++ b/arch/arm/mach-at91/sysirq_mask.c
@@ -25,24 +25,28 @@
 
 #include generic.h
 
-#define AT91_RTC_IDR   0x24/* Interrupt Disable Register */
-#define AT91_RTC_IMR   0x28/* Interrupt Mask Register */
+#define AT91_RTC_IDR   0x24/* Interrupt Disable Register */
+#define AT91_RTC_IMR   0x28/* Interrupt Mask Register */
+#define AT91_RTC_IRQ_MASK  0x1f/* Available IRQs mask */
 
 void __init at91_sysirq_mask_rtc(u32 rtc_base)
 {
void __iomem *base;
-   u32 mask;
 
base = ioremap(rtc_base, 64);
if (!base)
return;
 
-   mask = readl_relaxed(base + AT91_RTC_IMR);
-   if (mask) {
-   pr_info(AT91: Disabling rtc irq\n);
-   writel_relaxed(mask, base + AT91_RTC_IDR);
-   (void)readl_relaxed(base + AT91_RTC_IMR);   /* flush */
-   }
+   /*
+* sam9x5 SoCs have the following errata:
+* RTC: Interrupt Mask Register cannot be used
+*  Interrupt Mask Register read always returns 0.
+*
+* Hence we're not relying on IMR values to disable
+* interrupts.
+*/
+   writel_relaxed(AT91_RTC_IRQ_MASK, base + AT91_RTC_IDR);
+   (void)readl_relaxed(base + AT91_RTC_IMR);   /* flush */
 
iounmap(base);
 }


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 32/68] vxlan: use dev-needed_headroom instead of dev-hard_header_len

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Cong Wang cw...@twopensource.com

[ Upstream commit 2853af6a2ea1a8ed09b09dd4fb578e7f435e8d34 ]

When we mirror packets from a vxlan tunnel to other device,
the mirror device should see the same packets (that is, without
outer header). Because vxlan tunnel sets dev-hard_header_len,
tcf_mirred() resets mac header back to outer mac, the mirror device
actually sees packets with outer headers

Vxlan tunnel should set dev-needed_headroom instead of
dev-hard_header_len, like what other ip tunnels do. This fixes
the above problem.

Cc: David S. Miller da...@davemloft.net
Cc: stephen hemminger step...@networkplumber.org
Cc: Pravin B Shelar pshe...@nicira.com
Signed-off-by: Cong Wang cw...@twopensource.com
Signed-off-by: Cong Wang xiyou.wangc...@gmail.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 drivers/net/vxlan.c |7 +++
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2282,9 +2282,9 @@ static void vxlan_setup(struct net_devic
eth_hw_addr_random(dev);
ether_setup(dev);
if (vxlan-default_dst.remote_ip.sa.sa_family == AF_INET6)
-   dev-hard_header_len = ETH_HLEN + VXLAN6_HEADROOM;
+   dev-needed_headroom = ETH_HLEN + VXLAN6_HEADROOM;
else
-   dev-hard_header_len = ETH_HLEN + VXLAN_HEADROOM;
+   dev-needed_headroom = ETH_HLEN + VXLAN_HEADROOM;
 
dev-netdev_ops = vxlan_netdev_ops;
dev-destructor = free_netdev;
@@ -2667,8 +2667,7 @@ static int vxlan_newlink(struct net *net
if (!tb[IFLA_MTU])
dev-mtu = lowerdev-mtu - (use_ipv6 ? VXLAN6_HEADROOM 
: VXLAN_HEADROOM);
 
-   /* update header length based on lower device */
-   dev-hard_header_len = lowerdev-hard_header_len +
+   dev-needed_headroom = lowerdev-hard_header_len +
   (use_ipv6 ? VXLAN6_HEADROOM : 
VXLAN_HEADROOM);
} else if (use_ipv6)
vxlan-flags |= VXLAN_F_IPV6;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 56/68] iio: Fix endianness issue in ak8975_read_axis()

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Peter Meerwald pme...@pmeerw.net

commit 8ba42fb7b17649c9ab5b5e79d4e90370a0b4645e upstream.

i2c_smbus_read_word_data() does host endian conversion already,
no need for le16_to_cpu()

Signed-off-by: Peter Meerwald pme...@pmeerw.net
Signed-off-by: Jonathan Cameron ji...@kernel.org
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/iio/magnetometer/ak8975.c |9 +
 1 file changed, 1 insertion(+), 8 deletions(-)

--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -352,8 +352,6 @@ static int ak8975_read_axis(struct iio_d
 {
struct ak8975_data *data = iio_priv(indio_dev);
struct i2c_client *client = data-client;
-   u16 meas_reg;
-   s16 raw;
int ret;
 
mutex_lock(data-lock);
@@ -401,16 +399,11 @@ static int ak8975_read_axis(struct iio_d
dev_err(client-dev, Read axis data fails\n);
goto exit;
}
-   meas_reg = ret;
 
mutex_unlock(data-lock);
 
-   /* Endian conversion of the measured values. */
-   raw = (s16) (le16_to_cpu(meas_reg));
-
/* Clamp to valid range. */
-   raw = clamp_t(s16, raw, -4096, 4095);
-   *val = raw;
+   *val = clamp_t(s16, ret, -4096, 4095);
return IIO_VAL_INT;
 
 exit:


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 39/68] USB: cdc-acm: fix write and suspend race

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold jhov...@gmail.com

commit 5a345c20c17d87099224a4be12e69e5bd7023dca upstream.

Fix race between write() and suspend() which could lead to writes being
dropped (or I/O while suspended) if the device is runtime suspended
while a write request is being processed.

Specifically, suspend() releases the write_lock after determining the
device is idle but before incrementing the susp_count, thus leaving a
window where a concurrent write() can submit an urb.

Fixes: 11ea859d64b6 (USB: additional power savings for cdc-acm devices
that support remote wakeup)

Signed-off-by: Johan Hovold jhov...@gmail.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/usb/class/cdc-acm.c |   15 ++-
 1 file changed, 6 insertions(+), 9 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1512,18 +1512,15 @@ static int acm_suspend(struct usb_interf
struct acm *acm = usb_get_intfdata(intf);
int cnt;
 
+   spin_lock_irq(acm-read_lock);
+   spin_lock(acm-write_lock);
if (PMSG_IS_AUTO(message)) {
-   int b;
-
-   spin_lock_irq(acm-write_lock);
-   b = acm-transmitting;
-   spin_unlock_irq(acm-write_lock);
-   if (b)
+   if (acm-transmitting) {
+   spin_unlock(acm-write_lock);
+   spin_unlock_irq(acm-read_lock);
return -EBUSY;
+   }
}
-
-   spin_lock_irq(acm-read_lock);
-   spin_lock(acm-write_lock);
cnt = acm-susp_count++;
spin_unlock(acm-write_lock);
spin_unlock_irq(acm-read_lock);


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 54/68] iio: mxs-lradc: fix divider

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Robert Hodaszi robert.hoda...@digi.com

commit 19bc4981a213d0c5b0e1e8b08815c0b26f01ec54 upstream.

All channels' single measurement are happening on CH 0. So enabling / disabling
the divider once is not enough, because it has impact on all channels.

Set only a flag, then check this on each measurement, and enable / disable the
divider as required.

Signed-off-by: Robert Hodaszi robert.hoda...@digi.com
Acked-by: Alexandre Belloni alexandre.bell...@free-electrons.com
Acked-by: Marek Vasut ma...@denx.de
Signed-off-by: Jonathan Cameron ji...@kernel.org
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/staging/iio/adc/mxs-lradc.c |   12 
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -846,6 +846,14 @@ static int mxs_lradc_read_single(struct
LRADC_CTRL1);
mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
 
+   /* Enable / disable the divider per requirement */
+   if (test_bit(chan, lradc-is_divided))
+   mxs_lradc_reg_set(lradc, 1  LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
+   LRADC_CTRL2);
+   else
+   mxs_lradc_reg_clear(lradc,
+   1  LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, LRADC_CTRL2);
+
/* Clean the slot's previous content, then set new one. */
mxs_lradc_reg_clear(lradc, LRADC_CTRL4_LRADCSELECT_MASK(0), 
LRADC_CTRL4);
mxs_lradc_reg_set(lradc, chan, LRADC_CTRL4);
@@ -964,15 +972,11 @@ static int mxs_lradc_write_raw(struct ii
if (val == scale_avail[MXS_LRADC_DIV_DISABLED].integer 
val2 == scale_avail[MXS_LRADC_DIV_DISABLED].nano) {
/* divider by two disabled */
-   writel(1  LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
-  lradc-base + LRADC_CTRL2 + STMP_OFFSET_REG_CLR);
clear_bit(chan-channel, lradc-is_divided);
ret = 0;
} else if (val == scale_avail[MXS_LRADC_DIV_ENABLED].integer 
   val2 == scale_avail[MXS_LRADC_DIV_ENABLED].nano) {
/* divider by two enabled */
-   writel(1  LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
-  lradc-base + LRADC_CTRL2 + STMP_OFFSET_REG_SET);
set_bit(chan-channel, lradc-is_divided);
ret = 0;
}


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 41/68] USB: cdc-acm: fix broken runtime suspend

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold jhov...@gmail.com

commit 140cb81ac8c625942a1d695875932c615767a526 upstream.

The current ACM runtime-suspend implementation is broken in several
ways:

Firstly, it buffers only the first write request being made while
suspended -- any further writes are silently dropped.

Secondly, writes being dropped also leak write urbs, which are never
reclaimed (until the device is unbound).

Thirdly, even the single buffered write is not cleared at shutdown
(which may happen before the device is resumed), something which can
lead to another urb leak as well as a PM usage-counter leak.

Fix this by implementing a delayed-write queue using urb anchors and
making sure to discard the queue properly at shutdown.

Fixes: 11ea859d64b6 (USB: additional power savings for cdc-acm devices
that support remote wakeup)

Reported-by: Xiao Jin jin.x...@intel.com
Signed-off-by: Johan Hovold jhov...@gmail.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/usb/class/cdc-acm.c |   32 ++--
 drivers/usb/class/cdc-acm.h |2 +-
 2 files changed, 23 insertions(+), 11 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -571,6 +571,8 @@ static void acm_port_destruct(struct tty
 static void acm_port_shutdown(struct tty_port *port)
 {
struct acm *acm = container_of(port, struct acm, port);
+   struct urb *urb;
+   struct acm_wb *wb;
int i;
 
dev_dbg(acm-control-dev, %s\n, __func__);
@@ -579,6 +581,16 @@ static void acm_port_shutdown(struct tty
if (!acm-disconnected) {
usb_autopm_get_interface(acm-control);
acm_set_control(acm, acm-ctrlout = 0);
+
+   for (;;) {
+   urb = usb_get_from_anchor(acm-delayed);
+   if (!urb)
+   break;
+   wb = urb-context;
+   wb-use = 0;
+   usb_autopm_put_interface_async(acm-control);
+   }
+
usb_kill_urb(acm-ctrlurb);
for (i = 0; i  ACM_NW; i++)
usb_kill_urb(acm-wb[i].urb);
@@ -646,12 +658,9 @@ static int acm_tty_write(struct tty_stru
 
usb_autopm_get_interface_async(acm-control);
if (acm-susp_count) {
-   if (!acm-delayed_wb)
-   acm-delayed_wb = wb;
-   else
-   usb_autopm_put_interface_async(acm-control);
+   usb_anchor_urb(wb-urb, acm-delayed);
spin_unlock_irqrestore(acm-write_lock, flags);
-   return count;   /* A white lie */
+   return count;
}
usb_mark_last_busy(acm-dev);
 
@@ -1267,6 +1276,7 @@ made_compressed_probe:
acm-bInterval = epread-bInterval;
tty_port_init(acm-port);
acm-port.ops = acm_port_ops;
+   init_usb_anchor(acm-delayed);
 
buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, acm-ctrl_dma);
if (!buf) {
@@ -1537,7 +1547,7 @@ static int acm_suspend(struct usb_interf
 static int acm_resume(struct usb_interface *intf)
 {
struct acm *acm = usb_get_intfdata(intf);
-   struct acm_wb *wb;
+   struct urb *urb;
int rv = 0;
 
spin_lock_irq(acm-read_lock);
@@ -1549,10 +1559,12 @@ static int acm_resume(struct usb_interfa
if (test_bit(ASYNCB_INITIALIZED, acm-port.flags)) {
rv = usb_submit_urb(acm-ctrlurb, GFP_ATOMIC);
 
-   if (acm-delayed_wb) {
-   wb = acm-delayed_wb;
-   acm-delayed_wb = NULL;
-   acm_start_wb(acm, wb);
+   for (;;) {
+   urb = usb_get_from_anchor(acm-delayed);
+   if (!urb)
+   break;
+
+   acm_start_wb(acm, urb-context);
}
 
/*
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -120,7 +120,7 @@ struct acm {
unsigned int throttled:1;   /* actually throttled */
unsigned int throttle_req:1;/* throttle requested */
u8 bInterval;
-   struct acm_wb *delayed_wb;  /* write queued for a 
device about to be woken */
+   struct usb_anchor delayed;  /* writes queued for a 
device about to be woken */
 };
 
 #define CDC_DATA_INTERFACE_TYPE0x0a


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 36/68] KVM: lapic: sync highest ISR to hardware apic on EOI

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Paolo Bonzini pbonz...@redhat.com

commit fc57ac2c9ca8109ea97fcc594f4be436944230cc upstream.

When Hyper-V enlightenments are in effect, Windows prefers to issue an
Hyper-V MSR write to issue an EOI rather than an x2apic MSR write.
The Hyper-V MSR write is not handled by the processor, and besides
being slower, this also causes bugs with APIC virtualization.  The
reason is that on EOI the processor will modify the highest in-service
interrupt (SVI) field of the VMCS, as explained in section 29.1.4 of
the SDM; every other step in EOI virtualization is already done by
apic_send_eoi or on VM entry, but this one is missing.

We need to do the same, and be careful not to muck with the isr_count
and highest_isr_cache fields that are unused when virtual interrupt
delivery is enabled.

Reviewed-by: Yang Zhang yang.z.zh...@intel.com
Signed-off-by: Paolo Bonzini pbonz...@redhat.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 arch/x86/kvm/lapic.c |   62 +++
 1 file changed, 43 insertions(+), 19 deletions(-)

--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -360,6 +360,8 @@ static inline void apic_clear_irr(int ve
 
 static inline void apic_set_isr(int vec, struct kvm_lapic *apic)
 {
+   /* Note that we never get here with APIC virtualization enabled.  */
+
if (!__apic_test_and_set_vector(vec, apic-regs + APIC_ISR))
++apic-isr_count;
BUG_ON(apic-isr_count  MAX_APIC_VECTOR);
@@ -371,12 +373,48 @@ static inline void apic_set_isr(int vec,
apic-highest_isr_cache = vec;
 }
 
+static inline int apic_find_highest_isr(struct kvm_lapic *apic)
+{
+   int result;
+
+   /*
+* Note that isr_count is always 1, and highest_isr_cache
+* is always -1, with APIC virtualization enabled.
+*/
+   if (!apic-isr_count)
+   return -1;
+   if (likely(apic-highest_isr_cache != -1))
+   return apic-highest_isr_cache;
+
+   result = find_highest_vector(apic-regs + APIC_ISR);
+   ASSERT(result == -1 || result = 16);
+
+   return result;
+}
+
 static inline void apic_clear_isr(int vec, struct kvm_lapic *apic)
 {
-   if (__apic_test_and_clear_vector(vec, apic-regs + APIC_ISR))
+   struct kvm_vcpu *vcpu;
+   if (!__apic_test_and_clear_vector(vec, apic-regs + APIC_ISR))
+   return;
+
+   vcpu = apic-vcpu;
+
+   /*
+* We do get here for APIC virtualization enabled if the guest
+* uses the Hyper-V APIC enlightenment.  In this case we may need
+* to trigger a new interrupt delivery by writing the SVI field;
+* on the other hand isr_count and highest_isr_cache are unused
+* and must be left alone.
+*/
+   if (unlikely(kvm_apic_vid_enabled(vcpu-kvm)))
+   kvm_x86_ops-hwapic_isr_update(vcpu-kvm,
+  apic_find_highest_isr(apic));
+   else {
--apic-isr_count;
-   BUG_ON(apic-isr_count  0);
-   apic-highest_isr_cache = -1;
+   BUG_ON(apic-isr_count  0);
+   apic-highest_isr_cache = -1;
+   }
 }
 
 int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu)
@@ -456,22 +494,6 @@ static void pv_eoi_clr_pending(struct kv
__clear_bit(KVM_APIC_PV_EOI_PENDING, vcpu-arch.apic_attention);
 }
 
-static inline int apic_find_highest_isr(struct kvm_lapic *apic)
-{
-   int result;
-
-   /* Note that isr_count is always 1 with vid enabled */
-   if (!apic-isr_count)
-   return -1;
-   if (likely(apic-highest_isr_cache != -1))
-   return apic-highest_isr_cache;
-
-   result = find_highest_vector(apic-regs + APIC_ISR);
-   ASSERT(result == -1 || result = 16);
-
-   return result;
-}
-
 void kvm_apic_update_tmr(struct kvm_vcpu *vcpu, u32 *tmr)
 {
struct kvm_lapic *apic = vcpu-arch.apic;
@@ -1605,6 +1627,8 @@ int kvm_get_apic_interrupt(struct kvm_vc
int vector = kvm_apic_has_interrupt(vcpu);
struct kvm_lapic *apic = vcpu-arch.apic;
 
+   /* Note that we never get here with APIC virtualization enabled.  */
+
if (vector == -1)
return -1;
 


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 35/68] net/mlx4_core: Keep only one driver entry release mlx4_priv

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Wei Yang weiy...@linux.vnet.ibm.com

[ Upstream commit da1de8dfff09d33d4a5345762c21b487028e25f5 ]

Following commit befdf89 net/mlx4_core: Preserve pci_dev_data after
__mlx4_remove_one(), there are two mlx4 pci callbacks which will
attempt to release the mlx4_priv object -- .shutdown and .remove.

This leads to a use-after-free access to the already freed mlx4_priv
instance and trigger a Kernel access of bad area crash when both
.shutdown and .remove are called.

During reboot or kexec, .shutdown is called, with the VFs probed to
the host going through shutdown first and then the PF. Later, the PF
will trigger VFs' .remove since VFs still have driver attached.

Fix that by keeping only one driver entry which releases mlx4_priv.

Fixes: befdf89 ('net/mlx4_core: Preserve pci_dev_data after 
__mlx4_remove_one()')
CC: Bjorn Helgaas bhelg...@google.com
Signed-off-by: Or Gerlitz ogerl...@mellanox.com
Signed-off-by: Jack Morgenstein ja...@dev.mellanox.co.il
Signed-off-by: Wei Yang weiy...@linux.vnet.ibm.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 drivers/net/ethernet/mellanox/mlx4/main.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2718,7 +2718,7 @@ static struct pci_driver mlx4_driver = {
.name   = DRV_NAME,
.id_table   = mlx4_pci_table,
.probe  = mlx4_init_one,
-   .shutdown   = mlx4_remove_one,
+   .shutdown   = __mlx4_remove_one,
.remove = mlx4_remove_one,
.err_handler= mlx4_err_handler,
 };


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 47/68] Drivers: hv: balloon: Ensure pressure reports are posted regularly

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: K. Y. Srinivasan k...@microsoft.com

commit ae339336dc950b9b05e7ccd3565dd3e8781c06d9 upstream.

The current code posts periodic memory pressure status from a dedicated thread.
Under some conditions, especially when we are releasing a lot of memory into
the guest, we may not send timely pressure reports back to the host. Fix this
issue by reporting pressure in all contexts that can be active in this driver.

Signed-off-by: K. Y. Srinivasan k...@microsoft.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/hv/hv_balloon.c |   29 ++---
 1 file changed, 26 insertions(+), 3 deletions(-)

--- a/drivers/hv/hv_balloon.c
+++ b/drivers/hv/hv_balloon.c
@@ -19,6 +19,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME :  fmt
 
 #include linux/kernel.h
+#include linux/jiffies.h
 #include linux/mman.h
 #include linux/delay.h
 #include linux/init.h
@@ -459,6 +460,11 @@ static bool do_hot_add;
  */
 static uint pressure_report_delay = 45;
 
+/*
+ * The last time we posted a pressure report to host.
+ */
+static unsigned long last_post_time;
+
 module_param(hot_add, bool, (S_IRUGO | S_IWUSR));
 MODULE_PARM_DESC(hot_add, If set attempt memory hot_add);
 
@@ -542,6 +548,7 @@ struct hv_dynmem_device {
 
 static struct hv_dynmem_device dm_device;
 
+static void post_status(struct hv_dynmem_device *dm);
 #ifdef CONFIG_MEMORY_HOTPLUG
 
 static void hv_bring_pgs_online(unsigned long start_pfn, unsigned long size)
@@ -612,7 +619,7 @@ static void hv_mem_hot_add(unsigned long
 * have not been onlined within the allowed time.
 */
wait_for_completion_timeout(dm_device.ol_waitevent, 5*HZ);
-
+   post_status(dm_device);
}
 
return;
@@ -951,11 +958,17 @@ static void post_status(struct hv_dynmem
 {
struct dm_status status;
struct sysinfo val;
+   unsigned long now = jiffies;
+   unsigned long last_post = last_post_time;
 
if (pressure_report_delay  0) {
--pressure_report_delay;
return;
}
+
+   if (!time_after(now, (last_post_time + HZ)))
+   return;
+
si_meminfo(val);
memset(status, 0, sizeof(struct dm_status));
status.hdr.type = DM_STATUS_REPORT;
@@ -983,6 +996,14 @@ static void post_status(struct hv_dynmem
if (status.hdr.trans_id != atomic_read(trans_id))
return;
 
+   /*
+* If the last post time that we sampled has changed,
+* we have raced, don't post the status.
+*/
+   if (last_post != last_post_time)
+   return;
+
+   last_post_time = jiffies;
vmbus_sendpacket(dm-dev-channel, status,
sizeof(struct dm_status),
(unsigned long)NULL,
@@ -1117,7 +1138,7 @@ static void balloon_up(struct work_struc
 
if (ret == -EAGAIN)
msleep(20);
-
+   post_status(dm_device);
} while (ret == -EAGAIN);
 
if (ret) {
@@ -1144,8 +1165,10 @@ static void balloon_down(struct hv_dynme
struct dm_unballoon_response resp;
int i;
 
-   for (i = 0; i  range_count; i++)
+   for (i = 0; i  range_count; i++) {
free_balloon_pages(dm, range_array[i]);
+   post_status(dm_device);
+   }
 
if (req-more_pages == 1)
return;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 38/68] MIPS: KVM: Allocate at least 16KB for exception handlers

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: James Hogan james.ho...@imgtec.com

commit 7006e2dfda9adfa40251093604db76d7e44263b3 upstream.

Each MIPS KVM guest has its own copy of the KVM exception vector. This
contains the TLB refill exception handler at offset 0x000, the general
exception handler at offset 0x180, and interrupt exception handlers at
offset 0x200 in case Cause_IV=1. A common handler is copied to offset
0x2000 and offset 0x3000 is used for temporarily storing k1 during entry
from guest.

However the amount of memory allocated for this purpose is calculated as
0x200 rounded up to the next page boundary, which is insufficient if 4KB
pages are in use. This can lead to the common handler at offset 0x2000
being overwritten and infinitely recursive exceptions on the next exit
from the guest.

Increase the minimum size from 0x200 to 0x4000 to cover the full use of
the page.

Signed-off-by: James Hogan james.ho...@imgtec.com
Cc: Paolo Bonzini pbonz...@redhat.com
Cc: Gleb Natapov g...@kernel.org
Cc: k...@vger.kernel.org
Cc: Ralf Baechle r...@linux-mips.org
Cc: linux-m...@linux-mips.org
Cc: Sanjay Lal sanj...@kymasys.com
Signed-off-by: Paolo Bonzini pbonz...@redhat.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 arch/mips/kvm/kvm_mips.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/mips/kvm/kvm_mips.c
+++ b/arch/mips/kvm/kvm_mips.c
@@ -304,7 +304,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st
if (cpu_has_veic || cpu_has_vint) {
size = 0x200 + VECTORSPACING * 64;
} else {
-   size = 0x200;
+   size = 0x4000;
}
 
/* Save Linux EBASE */


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: Re: [PATCH v2 0/8] Add Keystone PCIe controller driver

[Murali Karicheri]

Mohit,

On 06/23/2014 12:49 PM, Santosh Shilimkar wrote:




 Original Message 
Subject: Re: [PATCH v2 0/8] Add Keystone PCIe controller driver
Date: Mon, 23 Jun 2014 10:43:46 +0530
From: Pratyush Anandpratyush.an...@st.com
To: Murali Karicherim-kariche...@ti.com

On Sat, Jun 21, 2014 at 05:17:07AM +0800, Murali Karicheri wrote:


Sorry, my previous response was in html and not sure it has made to the
list. I did
get an error as well. So resending my response.

On 6/18/2014 6:14 AM, Mohit KUMAR DCG wrote:

Hello Murali,





[...]


*pos = pos0;

@@ -349,7 +353,10 @@ static int dw_msi_setup_irq(struct msi_chip *chip,
struct pci_dev *pdev,

*/

desc-msi_attrib.multiple = msgvec;

-msg.address_lo = virt_to_phys((void *)pp-msi_data);

+if (pp-ops-get_msi_data)

+msg.address_lo = pp-ops-get_msi_data(pp);

+else

+msg.address_lo = virt_to_phys((void *)pp-msi_data);

msg.address_hi = 0x0;

msg.data = pos;


What about this code? This requires get_msi_data() as well


pp-msi_data is set in dw_pcie_msi_init, which is a global function
called from vendor specific code. You can have your own
keystone_pcie_msi_init and then you do not need above changes.


My Apologies for the email format as I lost the original email and had
to respond using a forwarded email.

If you look at my original patch, keystone driver was not calling
dw_pcie_msi_init(). However the issue is msi_chip of DW core is
re-used as most of the code is platform independent. However
code that sends write_msi_msg() can be re-used on keystone by
adding this get_msi_data() API as the only difference IMO is the
address EP writes to raise an MSI IRQ event. I don't see any
reason why the entire code needs to be duplicated on Keystone.
BTW, currently I have not tested the MSI IRQ and tested my driver
only with Legacy IRQ. I plan to test this before sending my
v3 of the patch.

Murali




-- 3rd to use pp-ops-msi_set/clear if defined.

Why not API enhancement and refactor the code in a single patch?


Yes, can be. You can send changes in 2 or 3 patches as you wish, but I
believe that should be able to solve problem in best way.

Regards
Pratyush


Murali

Pls let us know for any issue or have different opinion.

Regards
Mohit





--
1.7.9.5







--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 33/68] udp: ipv4: do not waste time in __udp4_lib_mcast_demux_lookup

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric Dumazet eduma...@google.com

[ Upstream commit 63c6f81cdde58c41da62a8d8a209592e42a0203e ]

Its too easy to add thousand of UDP sockets on a particular bucket,
and slow down an innocent multicast receiver.

Early demux is supposed to be an optimization, we should avoid spending
too much time in it.

It is interesting to note __udp4_lib_demux_lookup() only tries to
match first socket in the chain.

10 is the threshold we already have in __udp4_lib_lookup() to switch
to secondary hash.

Fixes: 421b3885bf6d5 (udp: ipv4: Add udp early demux)
Signed-off-by: Eric Dumazet eduma...@google.com
Reported-by: David Held drh...@google.com
Cc: Shawn Bohrer sboh...@rgmadvisors.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 net/ipv4/udp.c |4 
 1 file changed, 4 insertions(+)

--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1833,6 +1833,10 @@ static struct sock *__udp4_lib_mcast_dem
unsigned int count, slot = udp_hashfn(net, hnum, udp_table.mask);
struct udp_hslot *hslot = udp_table.hash[slot];
 
+   /* Do not bother scanning a too big list */
+   if (hslot-count  10)
+   return NULL;
+
rcu_read_lock();
 begin:
count = 0;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH v6 4/4] ARM: Add KGDB/KDB FIQ debugger generic code

[Nicolas Pitre]

On Tue, 24 Jun 2014, Daniel Thompson wrote:

 From: Anton Vorontsov anton.voront...@linaro.org
 
 The FIQ debugger may be used to debug situations when the kernel stuck
 in uninterruptable sections, e.g. the kernel infinitely loops or
 deadlocked in an interrupt or with interrupts disabled.
 
 By default KGDB FIQ is disabled in runtime, but can be enabled with
 kgdb_fiq.enable=1 kernel command line option.
 
 Signed-off-by: Anton Vorontsov anton.voront...@linaro.org
 Signed-off-by: John Stultz john.stu...@linaro.org
 Signed-off-by: Daniel Thompson daniel.thomp...@linaro.org
 Cc: Russell King li...@arm.linux.org.uk
 Cc: Ben Dooks ben.do...@codethink.co.uk
 Cc: Dave Martin dave.mar...@arm.com
 ---
  arch/arm/Kconfig |   2 +
  arch/arm/Kconfig.debug   |  18 ++
  arch/arm/include/asm/kgdb.h  |   7 +++
  arch/arm/kernel/Makefile |   1 +
  arch/arm/kernel/kgdb_fiq.c   | 124 
 +++
  arch/arm/kernel/kgdb_fiq_entry.S |  87 +++
  6 files changed, 239 insertions(+)
  create mode 100644 arch/arm/kernel/kgdb_fiq.c
  create mode 100644 arch/arm/kernel/kgdb_fiq_entry.S

[...]

 +static long kgdb_fiq_setup_stack(void *info)
 +{
 + struct pt_regs regs;
 +
 + regs.ARM_sp = __get_free_pages(GFP_KERNEL, THREAD_SIZE_ORDER) +
 + THREAD_START_SP;
 + WARN_ON(!regs.ARM_sp);

Isn't this rather fatal if you can't allocate any stack? Why not using 
BUG_ON(), or better yet propagate a proper error code back?

 +
 + set_fiq_regs(regs);
 + return 0;
 +}
 +
 +/**
 + * kgdb_fiq_enable_nmi - Manage NMI-triggered entry to KGDB
 + * @on: Flag to either enable or disable an NMI
 + *
 + * This function manages NMIs that usually cause KGDB to enter. That is, not
 + * all NMIs should be enabled or disabled, but only those that issue
 + * kgdb_handle_exception().
 + *
 + * The call counts disable requests, and thus allows to nest disables. But
 + * trying to enable already enabled NMI is an error.
 + */
 +static void kgdb_fiq_enable_nmi(bool on)
 +{
 + static atomic_t cnt;
 + int ret;
 +
 + ret = atomic_add_return(on ? 1 : -1, cnt);
 + if (ret  1  on) {
 + /*
 +  * There should be only one instance that calls this function
 +  * in enable, disable order. All other users must call
 +  * disable first, then enable. If not, something is wrong.
 +  */
 + WARN_ON(1);
 + return;
 + }

Minor style suggestion:

/*
 * There should be only one instance that calls this function
 * in enable, disable order. All other users must call
 * disable first, then enable. If not, something is wrong.
 */
if (WARN_ON(ret  1  on))
return;

Other than that...

Acked-by: Nicolas Pitre n...@linaro.org


Nicolas
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 26/68] net: force a list_del() in unregister_netdevice_many()

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric Dumazet eduma...@google.com

[ Upstream commit 87757a917b0b3c0787e0563c679762152be81312 ]

unregister_netdevice_many() API is error prone and we had too
many bugs because of dangling LIST_HEAD on stacks.

See commit f87e6f47933e3e (net: dont leave active on stack LIST_HEAD)

In fact, instead of making sure no caller leaves an active list_head,
just force a list_del() in the callee. No one seems to need to access
the list after unregister_netdevice_many()

Signed-off-by: Eric Dumazet eduma...@google.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 drivers/net/macvlan.c |1 -
 net/core/dev.c|5 -
 net/core/rtnetlink.c  |1 -
 net/mac80211/iface.c  |1 -
 4 files changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1043,7 +1043,6 @@ static int macvlan_device_event(struct n
list_for_each_entry_safe(vlan, next, port-vlans, list)
vlan-dev-rtnl_link_ops-dellink(vlan-dev, 
list_kill);
unregister_netdevice_many(list_kill);
-   list_del(list_kill);
break;
case NETDEV_PRE_TYPE_CHANGE:
/* Forbid underlaying device to change its type. */
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6548,6 +6548,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue
 /**
  * unregister_netdevice_many - unregister many devices
  * @head: list of devices
+ *
+ *  Note: As most callers use a stack allocated list_head,
+ *  we force a list_del() to make sure stack wont be corrupted later.
  */
 void unregister_netdevice_many(struct list_head *head)
 {
@@ -6557,6 +6560,7 @@ void unregister_netdevice_many(struct li
rollback_registered_many(head);
list_for_each_entry(dev, head, unreg_list)
net_set_todo(dev);
+   list_del(head);
}
 }
 EXPORT_SYMBOL(unregister_netdevice_many);
@@ -7012,7 +7016,6 @@ static void __net_exit default_device_ex
}
}
unregister_netdevice_many(dev_kill_list);
-   list_del(dev_kill_list);
rtnl_unlock();
 }
 
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1735,7 +1735,6 @@ static int rtnl_dellink(struct sk_buff *
 
ops-dellink(dev, list_kill);
unregister_netdevice_many(list_kill);
-   list_del(list_kill);
return 0;
 }
 
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1761,7 +1761,6 @@ void ieee80211_remove_interfaces(struct
}
mutex_unlock(local-iflist_mtx);
unregister_netdevice_many(unreg_list);
-   list_del(unreg_list);
 
list_for_each_entry_safe(sdata, tmp, wdev_list, list) {
list_del(sdata-list);


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH] vfio: Fix endianness handling for emulated BARs

[Alexey Kardashevskiy]

On 06/25/2014 12:43 AM, Alex Williamson wrote:
 On Wed, 2014-06-25 at 00:33 +1000, Alexey Kardashevskiy wrote:
 On 06/25/2014 12:21 AM, Alex Williamson wrote:
 On Tue, 2014-06-24 at 15:22 +0200, Alexander Graf wrote:
 On 24.06.14 15:01, Alexey Kardashevskiy wrote:
 On 06/24/2014 10:52 PM, Alexander Graf wrote:
 On 24.06.14 14:50, Alexey Kardashevskiy wrote:
 On 06/24/2014 08:41 PM, Alexander Graf wrote:
 On 24.06.14 12:11, Alexey Kardashevskiy wrote:
 On 06/21/2014 09:12 AM, Benjamin Herrenschmidt wrote:
 On Thu, 2014-06-19 at 21:21 -0600, Alex Williamson wrote:

 Working on big endian being an accident may be a matter of 
 perspective
 :-)

 The comment remains that this patch doesn't actually fix anything 
 except
 the overhead on big endian systems doing redundant byte swapping and
 maybe the philosophy that vfio regions are little endian.
 Yes, that works by accident because technically VFIO is a transport 
 and
 thus shouldn't perform any endian swapping of any sort, which remains
 the responsibility of the end driver which is the only one to know
 whether a given BAR location is a a register or some streaming data
 and in the former case whether it's LE or BE (some PCI devices are BE
 even ! :-)

 But yes, in the end, it works with the dual cancelling swaps and 
 the
 overhead of those swaps is probably drowned in the noise of the 
 syscall
 overhead.

 I'm still not a fan of iowrite vs iowritebe, there must be 
 something we
 can use that doesn't have an implicit swap.
 Sadly there isn't ... In the old day we didn't even have the be
 variant and readl/writel style accessors still don't have them either
 for all archs.

 There is __raw_readl/writel but here the semantics are much more than
 just don't swap, they also don't have memory barriers (which means
 they are essentially useless to most drivers unless those are 
 platform
 specific drivers which know exactly what they are doing, or in the 
 rare
 cases such as accessing a framebuffer which we know never have side
 effects).

 Calling it iowrite*_native is also an abuse of the namespace.
 Next thing we know some common code
 will legitimately use that name.
 I might make sense to those definitions into a common header. There 
 have
 been a handful of cases in the past that wanted that sort of native
 byte order MMIOs iirc (though don't ask me for examples, I can't 
 really
 remember).

 If we do need to define an alias
 (which I'd like to avoid) it should be something like 
 vfio_iowrite32.
 Ping?

 We need to make a decision whether to move those xxx_native() helpers
 somewhere (where?) or leave the patch as is (as we figured out that
 iowriteXX functions implement barriers and we cannot just use raw
 accessors) and fix commit log to explain everything.
 Is there actually any difference in generated code with this patch 
 applied
 and without? I would hope that iowrite..() is inlined and cancels out 
 the
 cpu_to_le..() calls that are also inlined?
 iowrite32 is a non-inline function so conversions take place so are the
 others. And sorry but I fail to see why this matters. We are not trying 
 to
 accelerate things, we are removing redundant operations which confuse
 people who read the code.
 The confusion depends on where you're coming from. If you happen to know
 that iowrite32 writes in LE, then the LE conversion makes a lot of 
 sense.
 It was like this (and this is just confusing):

 iowrite32(le32_to_cpu(val), io + off);

 What would make sense (according to you and I would understand this) is 
 this:

 iowrite32(cpu_to_le32(val), io + off);


 Or I missed your point, did I?

 No, you didn't miss it. I think for people who know how iowrite32() 
 works the above is obvious. I find the fact that iowrite32() writes in 
 LE always pretty scary though ;).

 So IMHO we should either create new, generic iowrite helpers that don't 
 do any endian swapping at all or do iowrite32(cpu_to_le32(val)) calls.

 I'm one of those people for whom iowrite32(le32_to_cpu(val)) makes sense


 I do not understand why @val is considered LE here and need to be converted
 to CPU. Really. I truly believe it should be cpu_to_le32().
 
 Because iowrite32 is defined to take a cpu byte order value and write it
 as little endian.


Ok, then neither le32_to_cpu() nor cpu_to_le32() should be there at all, if
we are talking about not scratching anyone's head :)



 and keeps the byte order consistent regardless of the platform, while
 iowrite32(val) or iowrite32be(val) makes me scratch my head and try to
 remember that the byte swaps are a nop on the given platforms.  As Ben
 noted, a native, no-swap ioread/write doesn't exist, but perhaps should.
 I'd prefer an attempt be made to make it exist before adding
 vfio-specific macros.  vfio is arguably doing the right thing here given
 the functions available.  Thanks,


I do not mind to make that atempt but what exactly would make sense here?
Try moving macros to include/asm-generic/io.h? Something else? 

[PATCH 3.14 34/68] net/mlx4_core: Preserve pci_dev_data after __mlx4_remove_one()

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Wei Yang weiy...@linux.vnet.ibm.com

[ Upstream commit befdf8978accecac2e0739e6b5075afc62db37fe ]

pci_match_id() just match the static pci_device_id, which may return NULL if
someone binds the driver to a device manually using
/sys/bus/pci/drivers/.../new_id.

This patch wrap up a helper function __mlx4_remove_one() which does the tear
down function but preserve the drv_data. Functions like
mlx4_pci_err_detected() and mlx4_restart_one() will call this one with out
releasing drvdata.

Fixes: 97a5221 net/mlx4_core: pass pci_device_id.driver_data to 
__mlx4_init_one during reset.

CC: Bjorn Helgaas bhelg...@google.com
CC: Amir Vadai am...@mellanox.com
CC: Jack Morgenstein ja...@dev.mellanox.co.il
CC: Or Gerlitz ogerl...@mellanox.com
Signed-off-by: Wei Yang weiy...@linux.vnet.ibm.com
Acked-by: Jack Morgenstein ja...@dev.mellanox.co.il
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 drivers/net/ethernet/mellanox/mlx4/main.c |  168 --
 drivers/net/ethernet/mellanox/mlx4/mlx4.h |1 
 2 files changed, 94 insertions(+), 75 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2275,13 +2275,8 @@ static int __mlx4_init_one(struct pci_de
/* Allow large DMA segments, up to the firmware limit of 1 GB */
dma_set_max_seg_size(pdev-dev, 1024 * 1024 * 1024);
 
-   priv = kzalloc(sizeof(*priv), GFP_KERNEL);
-   if (!priv) {
-   err = -ENOMEM;
-   goto err_release_regions;
-   }
-
-   dev   = priv-dev;
+   dev   = pci_get_drvdata(pdev);
+   priv  = mlx4_priv(dev);
dev-pdev = pdev;
INIT_LIST_HEAD(priv-ctx_list);
spin_lock_init(priv-ctx_lock);
@@ -2465,8 +2460,7 @@ slave_start:
mlx4_sense_init(dev);
mlx4_start_sense(dev);
 
-   priv-pci_dev_data = pci_dev_data;
-   pci_set_drvdata(pdev, dev);
+   priv-removed = 0;
 
return 0;
 
@@ -2532,84 +2526,108 @@ err_disable_pdev:
 
 static int mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 {
+   struct mlx4_priv *priv;
+   struct mlx4_dev *dev;
+
printk_once(KERN_INFO %s, mlx4_version);
 
+   priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+   if (!priv)
+   return -ENOMEM;
+
+   dev   = priv-dev;
+   pci_set_drvdata(pdev, dev);
+   priv-pci_dev_data = id-driver_data;
+
return __mlx4_init_one(pdev, id-driver_data);
 }
 
-static void mlx4_remove_one(struct pci_dev *pdev)
+static void __mlx4_remove_one(struct pci_dev *pdev)
 {
struct mlx4_dev  *dev  = pci_get_drvdata(pdev);
struct mlx4_priv *priv = mlx4_priv(dev);
+   int   pci_dev_data;
int p;
 
-   if (dev) {
-   /* in SRIOV it is not allowed to unload the pf's
-* driver while there are alive vf's */
-   if (mlx4_is_master(dev)) {
-   if (mlx4_how_many_lives_vf(dev))
-   printk(KERN_ERR Removing PF when there are 
assigned VF's !!!\n);
-   }
-   mlx4_stop_sense(dev);
-   mlx4_unregister_device(dev);
+   if (priv-removed)
+   return;
 
-   for (p = 1; p = dev-caps.num_ports; p++) {
-   mlx4_cleanup_port_info(priv-port[p]);
-   mlx4_CLOSE_PORT(dev, p);
-   }
+   pci_dev_data = priv-pci_dev_data;
 
-   if (mlx4_is_master(dev))
-   mlx4_free_resource_tracker(dev,
-  RES_TR_FREE_SLAVES_ONLY);
+   /* in SRIOV it is not allowed to unload the pf's
+* driver while there are alive vf's */
+   if (mlx4_is_master(dev)  mlx4_how_many_lives_vf(dev))
+   printk(KERN_ERR Removing PF when there are assigned VF's 
!!!\n);
+   mlx4_stop_sense(dev);
+   mlx4_unregister_device(dev);
+
+   for (p = 1; p = dev-caps.num_ports; p++) {
+   mlx4_cleanup_port_info(priv-port[p]);
+   mlx4_CLOSE_PORT(dev, p);
+   }
 
-   mlx4_cleanup_counters_table(dev);
-   mlx4_cleanup_qp_table(dev);
-   mlx4_cleanup_srq_table(dev);
-   mlx4_cleanup_cq_table(dev);
-   mlx4_cmd_use_polling(dev);
-   mlx4_cleanup_eq_table(dev);
-   mlx4_cleanup_mcg_table(dev);
-   mlx4_cleanup_mr_table(dev);
-   mlx4_cleanup_xrcd_table(dev);
-   mlx4_cleanup_pd_table(dev);
+   if (mlx4_is_master(dev))
+   mlx4_free_resource_tracker(dev,
+  RES_TR_FREE_SLAVES_ONLY);
 
-   if (mlx4_is_master(dev))
-   mlx4_free_resource_tracker(dev,
-   

[PATCH 3.14 43/68] USB: cdc-acm: fix shutdown and suspend race

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold jhov...@gmail.com

commit ed797074031a37bb9bf4a70952fffc606b77274d upstream.

We should stop I/O unconditionally at suspend rather than rely on the
tty-port initialised flag (which is set prior to stopping I/O during
shutdown) in order to prevent suspend returning with URBs still active.

Fixes: 11ea859d64b6 (USB: additional power savings for cdc-acm devices
that support remote wakeup)

Signed-off-by: Johan Hovold jhov...@gmail.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/usb/class/cdc-acm.c |3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1548,8 +1548,7 @@ static int acm_suspend(struct usb_interf
if (cnt)
return 0;
 
-   if (test_bit(ASYNCB_INITIALIZED, acm-port.flags))
-   stop_data_traffic(acm);
+   stop_data_traffic(acm);
 
return 0;
 }


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 20/68] tcp: fix cwnd undo on DSACK in F-RTO

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Yuchung Cheng ych...@google.com

[ Upstream commit 0cfa5c07d6d1d7f8e710fc671c5ba1ce85e09fa4 ]

This bug is discovered by an recent F-RTO issue on tcpm list
https://www.ietf.org/mail-archive/web/tcpm/current/msg08794.html

The bug is that currently F-RTO does not use DSACK to undo cwnd in
certain cases: upon receiving an ACK after the RTO retransmission in
F-RTO, and the ACK has DSACK indicating the retransmission is spurious,
the sender only calls tcp_try_undo_loss() if some never retransmisted
data is sacked (FLAG_ORIG_DATA_SACKED).

The correct behavior is to unconditionally call tcp_try_undo_loss so
the DSACK information is used properly to undo the cwnd reduction.

Signed-off-by: Yuchung Cheng ych...@google.com
Signed-off-by: Neal Cardwell ncardw...@google.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 net/ipv4/tcp_input.c |   11 +--
 1 file changed, 5 insertions(+), 6 deletions(-)

--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2683,13 +2683,12 @@ static void tcp_process_loss(struct sock
bool recovered = !before(tp-snd_una, tp-high_seq);
 
if (tp-frto) { /* F-RTO RFC5682 sec 3.1 (sack enhanced version). */
-   if (flag  FLAG_ORIG_SACK_ACKED) {
-   /* Step 3.b. A timeout is spurious if not all data are
-* lost, i.e., never-retransmitted data are (s)acked.
-*/
-   tcp_try_undo_loss(sk, true);
+   /* Step 3.b. A timeout is spurious if not all data are
+* lost, i.e., never-retransmitted data are (s)acked.
+*/
+   if (tcp_try_undo_loss(sk, flag  FLAG_ORIG_SACK_ACKED))
return;
-   }
+
if (after(tp-snd_nxt, tp-high_seq) 
(flag  FLAG_DATA_SACKED || is_dupack)) {
tp-frto = 0; /* Loss was real: 2nd part of step 3.a */


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 21/68] sh_eth: use RNC mode for packet reception

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Ben Dooks ben.do...@codethink.co.uk

[ Upstream commit 530aa2d0d9d55ab2775d47621ddf4b5b15bc1110 ]

The current behaviour of the sh_eth driver is not to use the RNC bit
for the receive ring. This means that every packet recieved is not only
generating an IRQ but it also stops the receive ring DMA as well until
the driver re-enables it after unloading the packet.

This means that a number of the following errors are generated due to
the receive packet FIFO overflowing due to nowhere to put packets:

net eth0: Receive FIFO Overflow

Since feedback from Yoshihiro Shimoda shows that every supported LSI
for this driver should have the bit enabled it seems the best way is
to remove the RMCR default value from the per-system data and just
write it when initialising the RMCR value. This is discussed in
the message (http://www.spinics.net/lists/netdev/msg284912.html).

I have tested the RMCR_RNC configuration with NFS root filesystem and
the driver has not failed yet.  There are further test reports from
Sergei Shtylov and others for both the R8A7790 and R8A7791.

There is also feedback fron Cao Minh Hiep[1] which reports the
same issue in (http://comments.gmane.org/gmane.linux.network/316285)
showing this fixes issues with losing UDP datagrams under iperf.

Tested-by: Sergei Shtylyov sergei.shtyl...@cogentembedded.com
Signed-off-by: Ben Dooks ben.do...@codethink.co.uk
Acked-by: Yoshihiro Shimoda yoshihiro.shimoda...@renesas.com
Acked-by: Simon Horman horms+rene...@verge.net.au
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 drivers/net/ethernet/renesas/sh_eth.c |   11 ++-
 drivers/net/ethernet/renesas/sh_eth.h |2 --
 2 files changed, 2 insertions(+), 11 deletions(-)

--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -539,7 +539,6 @@ static struct sh_eth_cpu_data sh7757_dat
.register_type  = SH_ETH_REG_FAST_SH4,
 
.eesipr_value   = DMAC_M_RFRMER | DMAC_M_ECI | 0x003f,
-   .rmcr_value = RMCR_RNC,
 
.tx_check   = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO,
.eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
@@ -617,7 +616,6 @@ static struct sh_eth_cpu_data sh7757_dat
  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
  EESR_TDE | EESR_ECI,
.fdr_value  = 0x072f,
-   .rmcr_value = RMCR_RNC,
 
.irq_flags  = IRQF_SHARED,
.apr= 1,
@@ -745,7 +743,6 @@ static struct sh_eth_cpu_data r8a7740_da
  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
  EESR_TDE | EESR_ECI,
.fdr_value  = 0x070f,
-   .rmcr_value = RMCR_RNC,
 
.apr= 1,
.mpr= 1,
@@ -777,7 +774,6 @@ static struct sh_eth_cpu_data r7s72100_d
  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
  EESR_TDE | EESR_ECI,
.fdr_value  = 0x070f,
-   .rmcr_value = RMCR_RNC,
 
.no_psr = 1,
.apr= 1,
@@ -826,9 +822,6 @@ static void sh_eth_set_default_cpu_data(
if (!cd-fdr_value)
cd-fdr_value = DEFAULT_FDR_INIT;
 
-   if (!cd-rmcr_value)
-   cd-rmcr_value = DEFAULT_RMCR_VALUE;
-
if (!cd-tx_check)
cd-tx_check = DEFAULT_TX_CHECK;
 
@@ -1281,8 +1274,8 @@ static int sh_eth_dev_init(struct net_de
sh_eth_write(ndev, mdp-cd-fdr_value, FDR);
sh_eth_write(ndev, 0, TFTR);
 
-   /* Frame recv control */
-   sh_eth_write(ndev, mdp-cd-rmcr_value, RMCR);
+   /* Frame recv control (enable multiple-packets per rx irq) */
+   sh_eth_write(ndev, RMCR_RNC, RMCR);
 
sh_eth_write(ndev, DESC_I_RINT8 | DESC_I_RINT5 | DESC_I_TINT2, TRSCER);
 
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -320,7 +320,6 @@ enum TD_STS_BIT {
 enum RMCR_BIT {
RMCR_RNC = 0x0001,
 };
-#define DEFAULT_RMCR_VALUE 0x
 
 /* ECMR */
 enum FELIC_MODE_BIT {
@@ -467,7 +466,6 @@ struct sh_eth_cpu_data {
unsigned long fdr_value;
unsigned long fcftr_value;
unsigned long rpadir_value;
-   unsigned long rmcr_value;
 
/* interrupt checking mask */
unsigned long tx_check;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 24/68] net: filter: fix sparc32 typo

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Alexei Starovoitov a...@plumgrid.com

[ Upstream commit 588f5d629b3369aba88f52217d1c473a28fa7723 ]

Fixes: 569810d1e327 (net: filter: fix typo in sparc BPF JIT)
Signed-off-by: Alexei Starovoitov a...@plumgrid.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 arch/sparc/net/bpf_jit_comp.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -85,7 +85,7 @@ static void bpf_flush_icache(void *start
 #ifdef CONFIG_SPARC64
 #define BE_PTR (F2(0, 1) | CONDE | (2  20))
 #else
-#define BE_PTR BNE
+#define BE_PTR BE
 #endif
 
 #define SETHI(K, REG)  \


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 27/68] ipip, sit: fix ipv4_{update_pmtu,redirect} calls

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Popov ixaph...@qrator.net

[ Upstream commit 2346829e641b804ece9ac9298136b56d9567c278 ]

ipv4_{update_pmtu,redirect} were called with tunnel's ifindex (t-dev is a
tunnel netdevice). It caused wrong route lookup and failure of pmtu update or
redirect. We should use the same ifindex that we use in ip_route_output_* in
*tunnel_xmit code. It is t-parms.link .

Signed-off-by: Dmitry Popov ixaph...@qrator.net
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 net/ipv4/ipip.c |4 ++--
 net/ipv6/sit.c  |4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -149,13 +149,13 @@ static int ipip_err(struct sk_buff *skb,
 
if (type == ICMP_DEST_UNREACH  code == ICMP_FRAG_NEEDED) {
ipv4_update_pmtu(skb, dev_net(skb-dev), info,
-t-dev-ifindex, 0, IPPROTO_IPIP, 0);
+t-parms.link, 0, IPPROTO_IPIP, 0);
err = 0;
goto out;
}
 
if (type == ICMP_REDIRECT) {
-   ipv4_redirect(skb, dev_net(skb-dev), t-dev-ifindex, 0,
+   ipv4_redirect(skb, dev_net(skb-dev), t-parms.link, 0,
  IPPROTO_IPIP, 0);
err = 0;
goto out;
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -560,12 +560,12 @@ static int ipip6_err(struct sk_buff *skb
 
if (type == ICMP_DEST_UNREACH  code == ICMP_FRAG_NEEDED) {
ipv4_update_pmtu(skb, dev_net(skb-dev), info,
-t-dev-ifindex, 0, IPPROTO_IPV6, 0);
+t-parms.link, 0, IPPROTO_IPV6, 0);
err = 0;
goto out;
}
if (type == ICMP_REDIRECT) {
-   ipv4_redirect(skb, dev_net(skb-dev), t-dev-ifindex, 0,
+   ipv4_redirect(skb, dev_net(skb-dev), t-parms.link, 0,
  IPPROTO_IPV6, 0);
err = 0;
goto out;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 42/68] USB: cdc-acm: fix runtime PM for control messages

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold jhov...@gmail.com

commit bae3f4c53585e9a170da9436e0f06919874bda9a upstream.

Fix runtime PM handling of control messages by adding the required PM
counter operations.

Fixes: 11ea859d64b6 (USB: additional power savings for cdc-acm devices
that support remote wakeup)

Signed-off-by: Johan Hovold jhov...@gmail.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/usb/class/cdc-acm.c |   12 +++-
 1 file changed, 11 insertions(+), 1 deletion(-)

--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -122,13 +122,23 @@ static void acm_release_minor(struct acm
 static int acm_ctrl_msg(struct acm *acm, int request, int value,
void *buf, int len)
 {
-   int retval = usb_control_msg(acm-dev, usb_sndctrlpipe(acm-dev, 0),
+   int retval;
+
+   retval = usb_autopm_get_interface(acm-control);
+   if (retval)
+   return retval;
+
+   retval = usb_control_msg(acm-dev, usb_sndctrlpipe(acm-dev, 0),
request, USB_RT_ACM, value,
acm-control-altsetting[0].desc.bInterfaceNumber,
buf, len, 5000);
+
dev_dbg(acm-control-dev,
%s - rq 0x%02x, val %#x, len %#x, result %d\n,
__func__, request, value, len, retval);
+
+   usb_autopm_put_interface(acm-control);
+
return retval  0 ? retval : 0;
 }
 


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 23/68] net: filter: fix typo in sparc BPF JIT

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Alexei Starovoitov a...@plumgrid.com

[ Upstream commit 569810d1e3278907264f5b115281fca3f0038d53 ]

fix typo in sparc codegen for SKF_AD_IFINDEX and SKF_AD_HATYPE
classic BPF extensions

Fixes: 2809a2087cc4 (net: filter: Just In Time compiler for sparc)
Signed-off-by: Alexei Starovoitov a...@plumgrid.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 arch/sparc/net/bpf_jit_comp.c |8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -83,9 +83,9 @@ static void bpf_flush_icache(void *start
 #define BNE(F2(0, 2) | CONDNE)
 
 #ifdef CONFIG_SPARC64
-#define BNE_PTR(F2(0, 1) | CONDNE | (2  20))
+#define BE_PTR (F2(0, 1) | CONDE | (2  20))
 #else
-#define BNE_PTRBNE
+#define BE_PTR BNE
 #endif
 
 #define SETHI(K, REG)  \
@@ -600,7 +600,7 @@ void bpf_jit_compile(struct sk_filter *f
case BPF_S_ANC_IFINDEX:
emit_skb_loadptr(dev, r_A);
emit_cmpi(r_A, 0);
-   emit_branch(BNE_PTR, cleanup_addr + 4);
+   emit_branch(BE_PTR, cleanup_addr + 4);
emit_nop();
emit_load32(r_A, struct net_device, ifindex, 
r_A);
break;
@@ -613,7 +613,7 @@ void bpf_jit_compile(struct sk_filter *f
case BPF_S_ANC_HATYPE:
emit_skb_loadptr(dev, r_A);
emit_cmpi(r_A, 0);
-   emit_branch(BNE_PTR, cleanup_addr + 4);
+   emit_branch(BE_PTR, cleanup_addr + 4);
emit_nop();
emit_load16(r_A, struct net_device, type, r_A);
break;


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 31/68] rtnetlink: fix userspace API breakage for iproute2 v3.9.0

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Michal Schmidt mschm...@redhat.com

[ Upstream commit e5eca6d41f53db48edd8cf88a3f59d2c30227f8e ]

When running RHEL6 userspace on a current upstream kernel, ip link
fails to show VF information.

The reason is a kernel-userspace API change introduced by commit
88c5b5ce5cb57 (rtnetlink: Call nlmsg_parse() with correct header length),
after which the kernel does not see iproute2's IFLA_EXT_MASK attribute
in the netlink request.

iproute2 adjusted for the API change in its commit 63338dca4513
(libnetlink: Use ifinfomsg instead of rtgenmsg in rtnl_wilddump_req_filter).

The problem has been noticed before:
http://marc.info/?l=linux-netdevm=136692296022182w=2
(Subject: Re: getting VF link info seems to be broken in 3.9-rc8)

We can do better than tell those with old userspace to upgrade. We can
recognize the old iproute2 in the kernel by checking the netlink message
length. Even when including the IFLA_EXT_MASK attribute, its netlink
message is shorter than struct ifinfomsg.

With this patch ip link shows VF information in both old and new
iproute2 versions.

Signed-off-by: Michal Schmidt mschm...@redhat.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 net/core/rtnetlink.c |   22 ++
 1 file changed, 18 insertions(+), 4 deletions(-)

--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1166,6 +1166,7 @@ static int rtnl_dump_ifinfo(struct sk_bu
struct nlattr *tb[IFLA_MAX+1];
u32 ext_filter_mask = 0;
int err;
+   int hdrlen;
 
s_h = cb-args[0];
s_idx = cb-args[1];
@@ -1173,8 +1174,17 @@ static int rtnl_dump_ifinfo(struct sk_bu
rcu_read_lock();
cb-seq = net-dev_base_seq;
 
-   if (nlmsg_parse(cb-nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
-   ifla_policy) = 0) {
+   /* A hack to preserve kernel-userspace interface.
+* The correct header is ifinfomsg. It is consistent with rtnl_getlink.
+* However, before Linux v3.9 the code here assumed rtgenmsg and that's
+* what iproute2  v3.9.0 used.
+* We can detect the old iproute2. Even including the IFLA_EXT_MASK
+* attribute, its netlink message is shorter than struct ifinfomsg.
+*/
+   hdrlen = nlmsg_len(cb-nlh)  sizeof(struct ifinfomsg) ?
+sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg);
+
+   if (nlmsg_parse(cb-nlh, hdrlen, tb, IFLA_MAX, ifla_policy) = 0) {
 
if (tb[IFLA_EXT_MASK])
ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
@@ -2085,9 +2095,13 @@ static u16 rtnl_calcit(struct sk_buff *s
struct nlattr *tb[IFLA_MAX+1];
u32 ext_filter_mask = 0;
u16 min_ifinfo_dump_size = 0;
+   int hdrlen;
+
+   /* Same kernel-userspace interface hack as in rtnl_dump_ifinfo. */
+   hdrlen = nlmsg_len(nlh)  sizeof(struct ifinfomsg) ?
+sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg);
 
-   if (nlmsg_parse(nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
-   ifla_policy) = 0) {
+   if (nlmsg_parse(nlh, hdrlen, tb, IFLA_MAX, ifla_policy) = 0) {
if (tb[IFLA_EXT_MASK])
ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
}


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 30/68] sctp: Fix sk_ack_backlog wrap-around problem

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Xufeng Zhang xufeng.zh...@windriver.com

[ Upstream commit d3217b15a19a4779c39b212358a5c71d725822ee ]

Consider the scenario:
For a TCP-style socket, while processing the COOKIE_ECHO chunk in
sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check,
a new association would be created in sctp_unpack_cookie(), but afterwards,
some processing maybe failed, and sctp_association_free() will be called to
free the previously allocated association, in sctp_association_free(),
sk_ack_backlog value is decremented for this socket, since the initial
value for sk_ack_backlog is 0, after the decrement, it will be 65535,
a wrap-around problem happens, and if we want to establish new associations
afterward in the same socket, ABORT would be triggered since sctp deem the
accept queue as full.
Fix this issue by only decrementing sk_ack_backlog for associations in
the endpoint's list.

Fix-suggested-by: Neil Horman nhor...@tuxdriver.com
Signed-off-by: Xufeng Zhang xufeng.zh...@windriver.com
Acked-by: Daniel Borkmann dbork...@redhat.com
Acked-by: Vlad Yasevich vyasev...@gmail.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 net/sctp/associola.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -330,7 +330,7 @@ void sctp_association_free(struct sctp_a
/* Only real associations count against the endpoint, so
 * don't bother for if this is a temporary association.
 */
-   if (!asoc-temp) {
+   if (!list_empty(asoc-asocs)) {
list_del(asoc-asocs);
 
/* Decrement the backlog value for a TCP-style listening


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH v6 3/4] ARM: Move some macros from entry-armv to entry-header

[Nicolas Pitre]

On Tue, 24 Jun 2014, Daniel Thompson wrote:

 From: Anton Vorontsov anton.voront...@linaro.org
 
 Just move the macros into header file as we would want to use them for
 KGDB FIQ entry code.
 
 The following macros were moved:
 
  - svc_entry
  - usr_entry
  - kuser_cmpxchg_check
  - vector_stub
 
 To make kuser_cmpxchg_check actually work across different files, we
 also have to make kuser_cmpxchg64_fixup global.
 
 Signed-off-by: Anton Vorontsov anton.voront...@linaro.org
 Signed-off-by: John Stultz john.stu...@linaro.org
 Signed-off-by: Daniel Thompson daniel.thomp...@linaro.org
 Cc: Russell King li...@arm.linux.org.uk
 Cc: Nicolas Pitre n...@linaro.org
 Cc: Catalin Marinas catalin.mari...@arm.com
 Cc: Frederic Weisbecker fweis...@gmail.com

Acked-by: Nicolas Pitre n...@linaro.org


 ---
  arch/arm/kernel/entry-armv.S   | 151 +
  arch/arm/kernel/entry-header.S | 164 
 +
  2 files changed, 165 insertions(+), 150 deletions(-)
 
 diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
 index 52a949a..4172cd6 100644
 --- a/arch/arm/kernel/entry-armv.S
 +++ b/arch/arm/kernel/entry-armv.S
 @@ -140,53 +140,6 @@ ENDPROC(__und_invalid)
   * SVC mode handlers
   */
  
 -#if defined(CONFIG_AEABI)  (__LINUX_ARM_ARCH__ = 5)
 -#define SPFIX(code...) code
 -#else
 -#define SPFIX(code...)
 -#endif
 -
 - .macro  svc_entry, stack_hole=0
 - UNWIND(.fnstart )
 - UNWIND(.save {r0 - pc}  )
 - sub sp, sp, #(S_FRAME_SIZE + \stack_hole - 4)
 -#ifdef CONFIG_THUMB2_KERNEL
 - SPFIX(  str r0, [sp])   @ temporarily saved
 - SPFIX(  mov r0, sp  )
 - SPFIX(  tst r0, #4  )   @ test original stack alignment
 - SPFIX(  ldr r0, [sp])   @ restored
 -#else
 - SPFIX(  tst sp, #4  )
 -#endif
 - SPFIX(  subeq   sp, sp, #4  )
 - stmia   sp, {r1 - r12}
 -
 - ldmia   r0, {r3 - r5}
 - add r7, sp, #S_SP - 4   @ here for interlock avoidance
 - mov r6, #-1 @ 
 - add r2, sp, #(S_FRAME_SIZE + \stack_hole - 4)
 - SPFIX(  addeq   r2, r2, #4  )
 - str r3, [sp, #-4]!  @ save the real r0 copied
 - @ from the exception stack
 -
 - mov r3, lr
 -
 - @
 - @ We are now ready to fill in the remaining blanks on the stack:
 - @
 - @  r2 - sp_svc
 - @  r3 - lr_svc
 - @  r4 - lr_exception, already fixed up for correct return/restart
 - @  r5 - spsr_exception
 - @  r6 - orig_r0 (see pt_regs definition in ptrace.h)
 - @
 - stmia   r7, {r2 - r6}
 -
 -#ifdef CONFIG_TRACE_IRQFLAGS
 - bl  trace_hardirqs_off
 -#endif
 - .endm
 -
   .align  5
  __dabt_svc:
   svc_entry
 @@ -306,73 +259,8 @@ ENDPROC(__pabt_svc)
  
  /*
   * User mode handlers
 - *
 - * EABI note: sp_svc is always 64-bit aligned here, so should S_FRAME_SIZE
   */
  
 -#if defined(CONFIG_AEABI)  (__LINUX_ARM_ARCH__ = 5)  (S_FRAME_SIZE  7)
 -#error sizeof(struct pt_regs) must be a multiple of 8
 -#endif
 -
 - .macro  usr_entry
 - UNWIND(.fnstart )
 - UNWIND(.cantunwind  )   @ don't unwind the user space
 - sub sp, sp, #S_FRAME_SIZE
 - ARM(stmib   sp, {r1 - r12}  )
 - THUMB(  stmia   sp, {r0 - r12}  )
 -
 - ldmia   r0, {r3 - r5}
 - add r0, sp, #S_PC   @ here for interlock avoidance
 - mov r6, #-1 @ 
 -
 - str r3, [sp]@ save the real r0 copied
 - @ from the exception stack
 -
 - @
 - @ We are now ready to fill in the remaining blanks on the stack:
 - @
 - @  r4 - lr_exception, already fixed up for correct return/restart
 - @  r5 - spsr_exception
 - @  r6 - orig_r0 (see pt_regs definition in ptrace.h)
 - @
 - @ Also, separately save sp_usr and lr_usr
 - @
 - stmia   r0, {r4 - r6}
 - ARM(stmdb   r0, {sp, lr}^   )
 - THUMB(  store_user_sp_lr r0, r1, S_SP - S_PC)
 -
 - @
 - @ Enable the alignment trap while in kernel mode
 - @
 - alignment_trap r0, .LCcralign
 -
 - @
 - @ Clear FP to mark the first stack frame
 - @
 - zero_fp
 -
 -#ifdef CONFIG_IRQSOFF_TRACER
 - bl  trace_hardirqs_off
 -#endif
 - ct_user_exit save = 0
 - .endm
 -
 - .macro  kuser_cmpxchg_check
 -#if !defined(CONFIG_CPU_32v6K)  defined(CONFIG_KUSER_HELPERS)  \
 -!defined(CONFIG_NEEDS_SYSCALL_FOR_CMPXCHG)
 -#ifndef CONFIG_MMU
 -#warning NPTL on non MMU needs fixing
 -#else
 - @ Make sure our user space atomic helper is restarted
 - @ if it was interrupted in a critical region.  Here we
 - @ perform a quick test inline since it should be false
 - @ 99.% of the time.  The rest is done out of line.
 - cmp r4, #TASK_SIZE
 - blhs

Re: [PATCH 2/2] ARM: tegra: roth: enable input on mmc clock pins

[Stephen Warren]

On 06/23/2014 11:44 PM, Alexandre Courbot wrote:
 On 06/24/2014 04:01 AM, Stephen Warren wrote:
 On 06/23/2014 01:32 AM, Alexandre Courbot wrote:
 Input had been disabled by mistake on these pins, leading to issues with
 SDIO devices like the Wifi module not being probed or random errors
 occuring on the SD card.

 I thought the host controller always drove the clock, so there should be
 no need for the pin's input path to be enabled. Perhaps it depends on
 the transfer mode (e.g. UHS)?
 
 That's what I thought too, so I went against what was done downstream
 and disabled input mode. Eventually noticed various issues with MMC
 devices, reverted to the downstream settings and noticed my problems
 were solved by this single change.

Hmm. That's odd. Can you talk to one of the HW engineers behind the
SDHCI controller and get a definitive answer. Thanks.
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH v2] ARM: dts: Add cros_ec to exynos5420-peach-pit and exynos5800-peach-pi

[Doug Anderson]

Tushar,

On Mon, Jun 23, 2014 at 11:43 PM, Tushar Behera trbli...@gmail.com wrote:
 On 06/24/2014 02:19 AM, Doug Anderson wrote:
 This adds cros_ec to exynos5420-peach-pit and exynos5800-peach-pi,
 including:
 * The keyboard
 * The i2c tunnel
 * The tps65090 under the i2c tunnel
 * The battery under the i2c tunnel

 To add extra motivation, it should be noted that tps65090 is one of
 the things needed to get display-related FETs turned on for pit and
 pi.

 Note that this relies on a few outstanding changes:
 * Needs (spi: s3c64xx: fix broken cs_gpios usage in the driver) and
   (spi: s3c64xx: for DT platofrms always get the chipselect info from
   DT node) to work properly and match the documented bindings.  See
   https://patchwork.kernel.org/patch/4346701/ and
   https://patchwork.kernel.org/patch/4346711/

 Signed-off-by: Doug Anderson diand...@chromium.org
 Tested-by: Javier Martinez Canillas javier.marti...@collabora.co.uk

 Along with the dependency patches on next-20140623, tested keyboard on
 Peach-Pi board.

 Tested-by: Tushar Behera tusha...@samsung.com

 Some comments below.

 ---
 Changes in v2:
 - Now just one patch since mfd patch landed.
 - Rebased to ToT linux-next

  arch/arm/boot/dts/exynos5420-peach-pit.dts | 145 
 +
  arch/arm/boot/dts/exynos5800-peach-pi.dts  | 145 
 +
  2 files changed, 290 insertions(+)

 diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts 
 b/arch/arm/boot/dts/exynos5420-peach-pit.dts
 index 7649982..581f385 100644
 --- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
 +++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts

 + regulators {
 + dcdc1 {
 + ti,enable-ext-control;
 + };
 + dcdc2 {
 + ti,enable-ext-control;
 + };
 + dcdc3 {
 + ti,enable-ext-control;
 + };
 + fet1 {

 tps65090_fet1: fet1 { ?

 + regulator-name = vcd_led;
 + };
 + tps65090_fet2: fet2 {

 I would suggest we add similar labels to fet1, fet3, fet4, fet5 and fet6
 also. That way it would be easy to reference them in subsequent DT nodes.

 Same comment for Peach-Pi dts file too.

OK.  I added it to all the regulators in tps65090.  That'll probably
be useful for Javier in his max77802 work.

-Doug
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 08/68] net: Move the permission check in sock_diag_put_filterinfo to packet_diag_dump

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric W. Biederman ebied...@xmission.com

[ Upstream commit a53b72c83a4216f2eb883ed45a0cbce014b8e62d ]

The permission check in sock_diag_put_filterinfo is wrong, and it is so removed
from it's sources it is not clear why it is wrong.  Move the computation
into packet_diag_dump and pass a bool of the result into sock_diag_filterinfo.

This does not yet correct the capability check but instead simply moves it to 
make
it clear what is going on.

Reported-by: Andy Lutomirski l...@amacapital.net
Signed-off-by: Eric W. Biederman ebied...@xmission.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 include/linux/sock_diag.h |2 +-
 net/core/sock_diag.c  |4 ++--
 net/packet/diag.c |7 ++-
 3 files changed, 9 insertions(+), 4 deletions(-)

--- a/include/linux/sock_diag.h
+++ b/include/linux/sock_diag.h
@@ -23,7 +23,7 @@ int sock_diag_check_cookie(void *sk, __u
 void sock_diag_save_cookie(void *sk, __u32 *cookie);
 
 int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr);
-int sock_diag_put_filterinfo(struct sock *sk,
+int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk,
 struct sk_buff *skb, int attrtype);
 
 #endif
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -49,7 +49,7 @@ int sock_diag_put_meminfo(struct sock *s
 }
 EXPORT_SYMBOL_GPL(sock_diag_put_meminfo);
 
-int sock_diag_put_filterinfo(struct sock *sk,
+int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk,
 struct sk_buff *skb, int attrtype)
 {
struct nlattr *attr;
@@ -57,7 +57,7 @@ int sock_diag_put_filterinfo(struct sock
unsigned int len;
int err = 0;
 
-   if (!ns_capable(sock_net(sk)-user_ns, CAP_NET_ADMIN)) {
+   if (!may_report_filterinfo) {
nla_reserve(skb, attrtype, 0);
return 0;
}
--- a/net/packet/diag.c
+++ b/net/packet/diag.c
@@ -128,6 +128,7 @@ static int pdiag_put_fanout(struct packe
 
 static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
struct packet_diag_req *req,
+   bool may_report_filterinfo,
struct user_namespace *user_ns,
u32 portid, u32 seq, u32 flags, int sk_ino)
 {
@@ -172,7 +173,8 @@ static int sk_diag_fill(struct sock *sk,
goto out_nlmsg_trim;
 
if ((req-pdiag_show  PACKET_SHOW_FILTER) 
-   sock_diag_put_filterinfo(sk, skb, PACKET_DIAG_FILTER))
+   sock_diag_put_filterinfo(may_report_filterinfo, sk, skb,
+PACKET_DIAG_FILTER))
goto out_nlmsg_trim;
 
return nlmsg_end(skb, nlh);
@@ -188,9 +190,11 @@ static int packet_diag_dump(struct sk_bu
struct packet_diag_req *req;
struct net *net;
struct sock *sk;
+   bool may_report_filterinfo;
 
net = sock_net(skb-sk);
req = nlmsg_data(cb-nlh);
+   may_report_filterinfo = ns_capable(net-user_ns, CAP_NET_ADMIN);
 
mutex_lock(net-packet.sklist_lock);
sk_for_each(sk, net-packet.sklist) {
@@ -200,6 +204,7 @@ static int packet_diag_dump(struct sk_bu
goto next;
 
if (sk_diag_fill(sk, skb, req,
+may_report_filterinfo,
 sk_user_ns(NETLINK_CB(cb-skb).sk),
 NETLINK_CB(cb-skb).portid,
 cb-nlh-nlmsg_seq, NLM_F_MULTI,


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 28/68] sfc: PIO:Restrict to 64bit arch and use 64-bit writes.

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Jon Cooper jcoo...@solarflare.com

[ Upstream commit daf37b556e437ec1ea1a597dcfeff338068380e1 ]

Fixes:ee45fd92c739
(sfc: Use TX PIO for sufficiently small packets)

The linux net driver uses memcpy_toio() in order to copy into
the PIO buffers.
Even on a 64bit machine this causes 32bit accesses to a write-
combined memory region.
There are hardware limitations that mean that only 64bit
naturally aligned accesses are safe in all cases.
Due to being write-combined memory region two 32bit accesses
may be coalesced to form a 64bit non 64bit aligned access.
Solution was to open-code the memory copy routines using pointers
and to only enable PIO for x86_64 machines.

Not tested on platforms other than x86_64 because this patch
disables the PIO feature on other platforms.
Compile-tested on x86 to ensure that works.

The WARN_ON_ONCE() code in the previous version of this patch
has been moved into the internal sfc debug driver as the
assertion was unnecessary in the upstream kernel code.

This bug fix applies to v3.13 and v3.14 stable branches.

Signed-off-by: Shradha Shah ss...@solarflare.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 drivers/net/ethernet/sfc/io.h |7 +++
 drivers/net/ethernet/sfc/tx.c |   22 +-
 2 files changed, 24 insertions(+), 5 deletions(-)

--- a/drivers/net/ethernet/sfc/io.h
+++ b/drivers/net/ethernet/sfc/io.h
@@ -66,10 +66,17 @@
 #define EFX_USE_QWORD_IO 1
 #endif
 
+/* Hardware issue requires that only 64-bit naturally aligned writes
+ * are seen by hardware. Its not strictly necessary to restrict to
+ * x86_64 arch, but done for safety since unusual write combining behaviour
+ * can break PIO.
+ */
+#ifdef CONFIG_X86_64
 /* PIO is a win only if write-combining is possible */
 #ifdef ARCH_HAS_IOREMAP_WC
 #define EFX_USE_PIO 1
 #endif
+#endif
 
 #ifdef EFX_USE_QWORD_IO
 static inline void _efx_writeq(struct efx_nic *efx, __le64 value,
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -189,6 +189,18 @@ struct efx_short_copy_buffer {
u8 buf[L1_CACHE_BYTES];
 };
 
+/* Copy in explicit 64-bit writes. */
+static void efx_memcpy_64(void __iomem *dest, void *src, size_t len)
+{
+   u64 *src64 = src;
+   u64 __iomem *dest64 = dest;
+   size_t l64 = len / 8;
+   size_t i;
+
+   for (i = 0; i  l64; i++)
+   writeq(src64[i], dest64[i]);
+}
+
 /* Copy to PIO, respecting that writes to PIO buffers must be dword aligned.
  * Advances piobuf pointer. Leaves additional data in the copy buffer.
  */
@@ -198,7 +210,7 @@ static void efx_memcpy_toio_aligned(stru
 {
int block_len = len  ~(sizeof(copy_buf-buf) - 1);
 
-   memcpy_toio(*piobuf, data, block_len);
+   efx_memcpy_64(*piobuf, data, block_len);
*piobuf += block_len;
len -= block_len;
 
@@ -230,7 +242,7 @@ static void efx_memcpy_toio_aligned_cb(s
if (copy_buf-used  sizeof(copy_buf-buf))
return;
 
-   memcpy_toio(*piobuf, copy_buf-buf, sizeof(copy_buf-buf));
+   efx_memcpy_64(*piobuf, copy_buf-buf, sizeof(copy_buf-buf));
*piobuf += sizeof(copy_buf-buf);
data += copy_to_buf;
len -= copy_to_buf;
@@ -245,7 +257,7 @@ static void efx_flush_copy_buffer(struct
 {
/* if there's anything in it, write the whole buffer, including junk */
if (copy_buf-used)
-   memcpy_toio(piobuf, copy_buf-buf, sizeof(copy_buf-buf));
+   efx_memcpy_64(piobuf, copy_buf-buf, sizeof(copy_buf-buf));
 }
 
 /* Traverse skb structure and copy fragments in to PIO buffer.
@@ -304,8 +316,8 @@ efx_enqueue_skb_pio(struct efx_tx_queue
 */
BUILD_BUG_ON(L1_CACHE_BYTES 
 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)));
-   memcpy_toio(tx_queue-piobuf, skb-data,
-   ALIGN(skb-len, L1_CACHE_BYTES));
+   efx_memcpy_64(tx_queue-piobuf, skb-data,
+ ALIGN(skb-len, L1_CACHE_BYTES));
}
 
EFX_POPULATE_QWORD_5(buffer-option,


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 03/68] iscsi-target: Reject mutual authentication with reflected CHAP_C

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Nicholas Bellinger n...@linux-iscsi.org

commit 1d2b60a5545942b1376cb48c1d55843d71e3a08f upstream.

This patch adds an explicit check in chap_server_compute_md5() to ensure
the CHAP_C value received from the initiator during mutual authentication
does not match the original CHAP_C provided by the target.

This is in line with RFC-3720, section 8.2.1:

   Originators MUST NOT reuse the CHAP challenge sent by the Responder
   for the other direction of a bidirectional authentication.
   Responders MUST check for this condition and close the iSCSI TCP
   connection if it occurs.

Reported-by: Tejas Vaykole tejas.vayk...@calsoftinc.com
Signed-off-by: Nicholas Bellinger n...@linux-iscsi.org
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org

---
 drivers/target/iscsi/iscsi_target_auth.c |   10 ++
 1 file changed, 10 insertions(+)

--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -314,6 +314,16 @@ static int chap_server_compute_md5(
goto out;
}
/*
+* During mutual authentication, the CHAP_C generated by the
+* initiator must not match the original CHAP_C generated by
+* the target.
+*/
+   if (!memcmp(challenge_binhex, chap-challenge, CHAP_CHALLENGE_LENGTH)) {
+   pr_err(initiator CHAP_C matches target CHAP_C, failing
+   login attempt\n);
+   goto out;
+   }
+   /*
 * Generate CHAP_N and CHAP_R for mutual authentication.
 */
tfm = crypto_alloc_hash(md5, 0, CRYPTO_ALG_ASYNC);


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 11/68] net: Use netlink_ns_capable to verify the permisions of netlink messages

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric W. Biederman ebied...@xmission.com

[ Upstream commit 90f62cf30a78721641e08737bda787552428061e ]

It is possible by passing a netlink socket to a more privileged
executable and then to fool that executable into writing to the socket
data that happens to be valid netlink message to do something that
privileged executable did not intend to do.

To keep this from happening replace bare capable and ns_capable calls
with netlink_capable, netlink_net_calls and netlink_ns_capable calls.
Which act the same as the previous calls except they verify that the
opener of the socket had the desired permissions as well.

Reported-by: Andy Lutomirski l...@amacapital.net
Signed-off-by: Eric W. Biederman ebied...@xmission.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 crypto/crypto_user.c|2 +-
 drivers/connector/cn_proc.c |2 +-
 drivers/scsi/scsi_netlink.c |2 +-
 kernel/audit.c  |4 ++--
 net/can/gw.c|4 ++--
 net/core/rtnetlink.c|   20 +++-
 net/dcb/dcbnl.c |2 +-
 net/decnet/dn_dev.c |4 ++--
 net/decnet/dn_fib.c |4 ++--
 net/decnet/netfilter/dn_rtmsg.c |2 +-
 net/netfilter/nfnetlink.c   |2 +-
 net/netlink/genetlink.c |2 +-
 net/packet/diag.c   |2 +-
 net/phonet/pn_netlink.c |8 
 net/sched/act_api.c |2 +-
 net/sched/cls_api.c |2 +-
 net/sched/sch_api.c |6 +++---
 net/tipc/netlink.c  |2 +-
 net/xfrm/xfrm_user.c|2 +-
 19 files changed, 38 insertions(+), 36 deletions(-)

--- a/crypto/crypto_user.c
+++ b/crypto/crypto_user.c
@@ -466,7 +466,7 @@ static int crypto_user_rcv_msg(struct sk
type -= CRYPTO_MSG_BASE;
link = crypto_dispatch[type];
 
-   if (!capable(CAP_NET_ADMIN))
+   if (!netlink_capable(skb, CAP_NET_ADMIN))
return -EPERM;
 
if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) 
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -369,7 +369,7 @@ static void cn_proc_mcast_ctl(struct cn_
return;
 
/* Can only change if privileged. */
-   if (!capable(CAP_NET_ADMIN)) {
+   if (!__netlink_ns_capable(nsp, init_user_ns, CAP_NET_ADMIN)) {
err = EPERM;
goto out;
}
--- a/drivers/scsi/scsi_netlink.c
+++ b/drivers/scsi/scsi_netlink.c
@@ -77,7 +77,7 @@ scsi_nl_rcv_msg(struct sk_buff *skb)
goto next_msg;
}
 
-   if (!capable(CAP_SYS_ADMIN)) {
+   if (!netlink_capable(skb, CAP_SYS_ADMIN)) {
err = -EPERM;
goto next_msg;
}
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -639,13 +639,13 @@ static int audit_netlink_ok(struct sk_bu
case AUDIT_TTY_SET:
case AUDIT_TRIM:
case AUDIT_MAKE_EQUIV:
-   if (!capable(CAP_AUDIT_CONTROL))
+   if (!netlink_capable(skb, CAP_AUDIT_CONTROL))
err = -EPERM;
break;
case AUDIT_USER:
case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
-   if (!capable(CAP_AUDIT_WRITE))
+   if (!netlink_capable(skb, CAP_AUDIT_WRITE))
err = -EPERM;
break;
default:  /* bad msg */
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -804,7 +804,7 @@ static int cgw_create_job(struct sk_buff
u8 limhops = 0;
int err = 0;
 
-   if (!capable(CAP_NET_ADMIN))
+   if (!netlink_capable(skb, CAP_NET_ADMIN))
return -EPERM;
 
if (nlmsg_len(nlh)  sizeof(*r))
@@ -893,7 +893,7 @@ static int cgw_remove_job(struct sk_buff
u8 limhops = 0;
int err = 0;
 
-   if (!capable(CAP_NET_ADMIN))
+   if (!netlink_capable(skb, CAP_NET_ADMIN))
return -EPERM;
 
if (nlmsg_len(nlh)  sizeof(*r))
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1428,7 +1428,8 @@ static int do_set_master(struct net_devi
return 0;
 }
 
-static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
+static int do_setlink(const struct sk_buff *skb,
+ struct net_device *dev, struct ifinfomsg *ifm,
  struct nlattr **tb, char *ifname, int modified)
 {
const struct net_device_ops *ops = dev-netdev_ops;
@@ -1440,7 +1441,7 @@ static int do_setlink(struct net_device
err = PTR_ERR(net);
goto errout;
}
-   if (!ns_capable(net-user_ns, CAP_NET_ADMIN)) {
+   if (!netlink_ns_capable(skb, net-user_ns, 

[PATCH v3] ARM: dts: Add cros_ec to exynos5420-peach-pit and exynos5800-peach-pi

[Doug Anderson]

This adds cros_ec to exynos5420-peach-pit and exynos5800-peach-pi,
including:
* The keyboard
* The i2c tunnel
* The tps65090 under the i2c tunnel
* The battery under the i2c tunnel

To add extra motivation, it should be noted that tps65090 is one of
the things needed to get display-related FETs turned on for pit and
pi.

Note that this relies on a few outstanding changes:
* Needs (spi: s3c64xx: fix broken cs_gpios usage in the driver) and
  (spi: s3c64xx: for DT platofrms always get the chipselect info from
  DT node) to work properly and match the documented bindings.  See
  https://patchwork.kernel.org/patch/4346701/ and
  https://patchwork.kernel.org/patch/4346711/

Signed-off-by: Doug Anderson diand...@chromium.org
Tested-by: Javier Martinez Canillas javier.marti...@collabora.co.uk
Tested-by: Tushar Behera tusha...@samsung.com
---
Changes in v3:
- Added aliases for tps65090 regulators as per Tushar.

Changes in v2:
- Now just one patch since mfd patch landed.
- Rebased to ToT linux-next

 arch/arm/boot/dts/exynos5420-peach-pit.dts | 145 +
 arch/arm/boot/dts/exynos5800-peach-pi.dts  | 145 +
 2 files changed, 290 insertions(+)

diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts 
b/arch/arm/boot/dts/exynos5420-peach-pit.dts
index 7649982..b2f1237 100644
--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
+++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts
@@ -25,6 +25,11 @@
google,pit, google,peach,samsung,exynos5420,
samsung,exynos5;
 
+   aliases {
+   /* Assign 20 so we don't get confused w/ builtin ones */
+   i2c20 = /spi@12d4/cros-ec@0/i2c-tunnel;
+   };
+
backlight {
compatible = pwm-backlight;
pwms = pwm 0 100 0;
@@ -87,6 +92,13 @@
pinctrl-0 = usb301_vbus_en;
enable-active-high;
};
+
+   vbat: fixed-regulator {
+   compatible = regulator-fixed;
+   regulator-name = vbat-supply;
+   regulator-boot-on;
+   regulator-always-on;
+   };
 };
 
 dp {
@@ -231,6 +243,20 @@
samsung,pin-drv = 0;
};
 
+   ec_irq: ec-irq {
+   samsung,pins = gpx1-5;
+   samsung,pin-function = 0;
+   samsung,pin-pud = 0;
+   samsung,pin-drv = 0;
+   };
+
+   tps65090_irq: tps65090-irq {
+   samsung,pins = gpx2-5;
+   samsung,pin-function = 0;
+   samsung,pin-pud = 0;
+   samsung,pin-drv = 0;
+   };
+
dp_hpd_gpio: dp_hpd_gpio {
samsung,pins = gpx2-6;
samsung,pin-function = 0;
@@ -247,6 +273,19 @@
 };
 
 pinctrl_3 {
+   /* Drive SPI lines at x2 for better integrity */
+   spi2-bus {
+   samsung,pin-drv = 2;
+   };
+
+   /* Drive SPI chip select at x2 for better integrity */
+   ec_spi_cs: ec-spi-cs {
+   samsung,pins = gpb1-2;
+   samsung,pin-function = 1;
+   samsung,pin-pud = 0;
+   samsung,pin-drv = 2;
+   };
+
usb300_vbus_en: usb300-vbus-en {
samsung,pins = gph0-0;
samsung,pin-function = 1;
@@ -266,6 +305,111 @@
status = okay;
 };
 
+spi_2 {
+   status = okay;
+   num-cs = 1;
+   samsung,spi-src-clk = 0;
+   cs-gpios = gpb1 2 0;
+
+   cros_ec: cros-ec@0 {
+   compatible = google,cros-ec-spi;
+   interrupt-parent = gpx1;
+   interrupts = 5 0;
+   pinctrl-names = default;
+   pinctrl-0 = ec_spi_cs ec_irq;
+   reg = 0;
+   spi-max-frequency = 3125000;
+
+   controller-data {
+   samsung,spi-feedback-delay = 1;
+   };
+
+   i2c-tunnel {
+   compatible = google,cros-ec-i2c-tunnel;
+   #address-cells = 1;
+   #size-cells = 0;
+   google,remote-bus = 0;
+
+   battery: sbs-battery@b {
+   compatible = sbs,sbs-battery;
+   reg = 0xb;
+   sbs,poll-retry-count = 1;
+   sbs,i2c-retry-count = 2;
+   };
+
+   power-regulator@48 {
+   compatible = ti,tps65090;
+   reg = 0x48;
+
+   /*
+* Config irq to disable internal pulls
+* even though we run in polling mode.
+*/
+   pinctrl-names = default;
+   pinctrl-0 = tps65090_irq;
+
+   vsys1-supply = vbat;
+   vsys2-supply = vbat;
+  

[PATCH 3.14 19/68] team: fix mtu setting

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Jiri Pirko j...@resnulli.us

[ Upstream commit 9d0d68faea6962d62dd501cd6e71ce5cc8ed262b ]

Now it is not possible to set mtu to team device which has a port
enslaved to it. The reason is that when team_change_mtu() calls
dev_set_mtu() for port device, notificator for NETDEV_PRECHANGEMTU
event is called and team_device_event() returns NOTIFY_BAD forbidding
the change. So fix this by returning NOTIFY_DONE here in case team is
changing mtu in team_change_mtu().

Introduced-by: 3d249d4c net: introduce ethernet teaming device
Signed-off-by: Jiri Pirko j...@resnulli.us
Acked-by: Flavio Leitner f...@redhat.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 drivers/net/team/team.c |7 ++-
 include/linux/if_team.h |1 +
 2 files changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1732,6 +1732,7 @@ static int team_change_mtu(struct net_de
 * to traverse list in reverse under rcu_read_lock
 */
mutex_lock(team-lock);
+   team-port_mtu_change_allowed = true;
list_for_each_entry(port, team-port_list, list) {
err = dev_set_mtu(port-dev, new_mtu);
if (err) {
@@ -1740,6 +1741,7 @@ static int team_change_mtu(struct net_de
goto unwind;
}
}
+   team-port_mtu_change_allowed = false;
mutex_unlock(team-lock);
 
dev-mtu = new_mtu;
@@ -1749,6 +1751,7 @@ static int team_change_mtu(struct net_de
 unwind:
list_for_each_entry_continue_reverse(port, team-port_list, list)
dev_set_mtu(port-dev, dev-mtu);
+   team-port_mtu_change_allowed = false;
mutex_unlock(team-lock);
 
return err;
@@ -2857,7 +2860,9 @@ static int team_device_event(struct noti
break;
case NETDEV_PRECHANGEMTU:
/* Forbid to change mtu of underlaying device */
-   return NOTIFY_BAD;
+   if (!port-team-port_mtu_change_allowed)
+   return NOTIFY_BAD;
+   break;
case NETDEV_PRE_TYPE_CHANGE:
/* Forbid to change type of underlaying device */
return NOTIFY_BAD;
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -194,6 +194,7 @@ struct team {
bool user_carrier_enabled;
bool queue_override_enabled;
struct list_head *qom_lists; /* array of queue override mapping lists */
+   bool port_mtu_change_allowed;
struct {
unsigned int count;
unsigned int interval; /* in ms */


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 10/68] net: Add variants of capable for use on netlink messages

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric W. Biederman ebied...@xmission.com

[ Upstream commit aa4cf9452f469f16cea8c96283b641b4576d4a7b ]

netlink_net_capable - The common case use, for operations that are safe on a 
network namespace
netlink_capable - For operations that are only known to be safe for the global 
root
netlink_ns_capable - The general case of capable used to handle special cases

__netlink_ns_capable - Same as netlink_ns_capable except taking a 
netlink_skb_parms instead of
   the skbuff of a netlink message.

Signed-off-by: Eric W. Biederman ebied...@xmission.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 include/linux/netlink.h  |7 +
 net/netlink/af_netlink.c |   65 +++
 2 files changed, 72 insertions(+)

--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -169,4 +169,11 @@ struct netlink_tap {
 extern int netlink_add_tap(struct netlink_tap *nt);
 extern int netlink_remove_tap(struct netlink_tap *nt);
 
+bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
+ struct user_namespace *ns, int cap);
+bool netlink_ns_capable(const struct sk_buff *skb,
+   struct user_namespace *ns, int cap);
+bool netlink_capable(const struct sk_buff *skb, int cap);
+bool netlink_net_capable(const struct sk_buff *skb, int cap);
+
 #endif /* __LINUX_NETLINK_H */
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1360,6 +1360,71 @@ retry:
return err;
 }
 
+/**
+ * __netlink_ns_capable - General netlink message capability test
+ * @nsp: NETLINK_CB of the socket buffer holding a netlink command from 
userspace.
+ * @user_ns: The user namespace of the capability to use
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket we received the message
+ * from had when the netlink socket was created and the sender of the
+ * message has has the capability @cap in the user namespace @user_ns.
+ */
+bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
+   struct user_namespace *user_ns, int cap)
+{
+   return sk_ns_capable(nsp-sk, user_ns, cap);
+}
+EXPORT_SYMBOL(__netlink_ns_capable);
+
+/**
+ * netlink_ns_capable - General netlink message capability test
+ * @skb: socket buffer holding a netlink command from userspace
+ * @user_ns: The user namespace of the capability to use
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket we received the message
+ * from had when the netlink socket was created and the sender of the
+ * message has has the capability @cap in the user namespace @user_ns.
+ */
+bool netlink_ns_capable(const struct sk_buff *skb,
+   struct user_namespace *user_ns, int cap)
+{
+   return __netlink_ns_capable(NETLINK_CB(skb), user_ns, cap);
+}
+EXPORT_SYMBOL(netlink_ns_capable);
+
+/**
+ * netlink_capable - Netlink global message capability test
+ * @skb: socket buffer holding a netlink command from userspace
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket we received the message
+ * from had when the netlink socket was created and the sender of the
+ * message has has the capability @cap in all user namespaces.
+ */
+bool netlink_capable(const struct sk_buff *skb, int cap)
+{
+   return netlink_ns_capable(skb, init_user_ns, cap);
+}
+EXPORT_SYMBOL(netlink_capable);
+
+/**
+ * netlink_net_capable - Netlink network namespace message capability test
+ * @skb: socket buffer holding a netlink command from userspace
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket we received the message
+ * from had when the netlink socket was created and the sender of the
+ * message has has the capability @cap over the network namespace of
+ * the socket we received the message from.
+ */
+bool netlink_net_capable(const struct sk_buff *skb, int cap)
+{
+   return netlink_ns_capable(skb, sock_net(skb-sk)-user_ns, cap);
+}
+EXPORT_SYMBOL(netlink_net_capable);
+
 static inline int netlink_allowed(const struct socket *sock, unsigned int flag)
 {
return (nl_table[sock-sk-sk_protocol].flags  flag) ||


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 12/68] netlink: Only check file credentials for implicit destinations

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric W. Biederman ebied...@xmission.com

[ Upstream commit 2d7a85f4b06e9c27ff629f07a524c48074f07f81 ]

It was possible to get a setuid root or setcap executable to write to
it's stdout or stderr (which has been set made a netlink socket) and
inadvertently reconfigure the networking stack.

To prevent this we check that both the creator of the socket and
the currentl applications has permission to reconfigure the network
stack.

Unfortunately this breaks Zebra which always uses sendto/sendmsg
and creates it's socket without any privileges.

To keep Zebra working don't bother checking if the creator of the
socket has privilege when a destination address is specified.  Instead
rely exclusively on the privileges of the sender of the socket.

Note from Andy: This is exactly Eric's code except for some comment
clarifications and formatting fixes.  Neither I nor, I think, anyone
else is thrilled with this approach, but I'm hesitant to wait on a
better fix since 3.15 is almost here.

Note to stable maintainers: This is a mess.  An earlier series of
patches in 3.15 fix a rather serious security issue (CVE-2014-0181),
but they did so in a way that breaks Zebra.  The offending series
includes:

commit aa4cf9452f469f16cea8c96283b641b4576d4a7b
Author: Eric W. Biederman ebied...@xmission.com
Date:   Wed Apr 23 14:28:03 2014 -0700

net: Add variants of capable for use on netlink messages

If a given kernel version is missing that series of fixes, it's
probably worth backporting it and this patch.  if that series is
present, then this fix is critical if you care about Zebra.

Cc: sta...@vger.kernel.org
Signed-off-by: Eric W. Biederman ebied...@xmission.com
Signed-off-by: Andy Lutomirski l...@amacapital.net
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 include/linux/netlink.h  |7 ---
 net/netlink/af_netlink.c |7 ++-
 2 files changed, 10 insertions(+), 4 deletions(-)

--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -16,9 +16,10 @@ static inline struct nlmsghdr *nlmsg_hdr
 }
 
 enum netlink_skb_flags {
-   NETLINK_SKB_MMAPED  = 0x1,  /* Packet data is mmaped */
-   NETLINK_SKB_TX  = 0x2,  /* Packet was sent by userspace 
*/
-   NETLINK_SKB_DELIVERED   = 0x4,  /* Packet was delivered */
+   NETLINK_SKB_MMAPED  = 0x1,  /* Packet data is mmaped */
+   NETLINK_SKB_TX  = 0x2,  /* Packet was sent by userspace */
+   NETLINK_SKB_DELIVERED   = 0x4,  /* Packet was delivered */
+   NETLINK_SKB_DST = 0x8,  /* Dst set in sendto or sendmsg */
 };
 
 struct netlink_skb_parms {
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1373,7 +1373,9 @@ retry:
 bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
struct user_namespace *user_ns, int cap)
 {
-   return sk_ns_capable(nsp-sk, user_ns, cap);
+   return ((nsp-flags  NETLINK_SKB_DST) ||
+   file_ns_capable(nsp-sk-sk_socket-file, user_ns, cap)) 
+   ns_capable(user_ns, cap);
 }
 EXPORT_SYMBOL(__netlink_ns_capable);
 
@@ -2293,6 +2295,7 @@ static int netlink_sendmsg(struct kiocb
struct sk_buff *skb;
int err;
struct scm_cookie scm;
+   u32 netlink_skb_flags = 0;
 
if (msg-msg_flagsMSG_OOB)
return -EOPNOTSUPP;
@@ -2314,6 +2317,7 @@ static int netlink_sendmsg(struct kiocb
if ((dst_group || dst_portid) 
!netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
goto out;
+   netlink_skb_flags |= NETLINK_SKB_DST;
} else {
dst_portid = nlk-dst_portid;
dst_group = nlk-dst_group;
@@ -2343,6 +2347,7 @@ static int netlink_sendmsg(struct kiocb
NETLINK_CB(skb).portid  = nlk-portid;
NETLINK_CB(skb).dst_group = dst_group;
NETLINK_CB(skb).creds   = siocb-scm-creds;
+   NETLINK_CB(skb).flags   = netlink_skb_flags;
 
err = -EFAULT;
if (memcpy_fromiovec(skb_put(skb, len), msg-msg_iov, len)) {


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: mm: shm: hang in shmem_fallocate

[Vlastimil Babka]

On 06/16/2014 04:29 AM, Hugh Dickins wrote:
 On Thu, 12 Jun 2014, Sasha Levin wrote:
 On 02/09/2014 08:41 PM, Sasha Levin wrote:
 On 02/08/2014 10:25 PM, Hugh Dickins wrote:
 Would trinity be likely to have a thread or process repeatedly faulting
 in pages from the hole while it is being punched?

 I can see how trinity would do that, but just to be certain - Cc davej.

 On 02/08/2014 10:25 PM, Hugh Dickins wrote:
 Does this happen with other holepunch filesystems?  If it does not,
 I'd suppose it's because the tmpfs fault-in-newly-created-page path
 is lighter than a consistent disk-based filesystem's has to be.
 But we don't want to make the tmpfs path heavier to match them.

 No, this is strictly limited to tmpfs, and AFAIK trinity tests hole
 punching in other filesystems and I make sure to get a bunch of those
 mounted before starting testing.

 Just pinging this one again. I still see hangs in -next where the hang
 location looks same as before:

 
 Please give this patch a try.  It fixes what I can reproduce, but given
 your unexplained page_mapped() BUG in this area, we know there's more
 yet to be understood, so perhaps this patch won't do enough for you.
 

Hi,

since this got a CVE, I've been looking at backport to an older kernel where
fallocate(FALLOC_FL_PUNCH_HOLE) is not yet supported, and there's also no
range notification mechanism yet. There's just madvise(MADV_REMOVE) and since
it doesn't guarantee anything, it seems simpler just to give up retrying to
truncate really everything. Then I realized that maybe it would work for
current kernel as well, without having to add any checks in the page fault
path. The semantics of fallocate(FALLOC_FL_PUNCH_HOLE) might look different
from madvise(MADV_REMOVE), but it seems to me that as long as it does discard
the old data from the range, it's fine from any information leak point of view.
If someone races page faulting, it IMHO doesn't matter if he gets a new zeroed
page before the parallel truncate has ended, or right after it has ended.
So I'm posting it here as a RFC. I haven't thought about the
i915_gem_object_truncate caller yet. I think that this path wouldn't satisfy
the new lstart  inode-i_size condition, but I don't know if it's 
vulnerable
to the problem.

-8-
From: Vlastimil Babka vba...@suse.cz
Subject: [RFC PATCH] shmem: prevent livelock between page fault and hole 
punching

---
 mm/shmem.c | 19 +++
 1 file changed, 19 insertions(+)

diff --git a/mm/shmem.c b/mm/shmem.c
index f484c27..6d6005c 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -476,6 +476,25 @@ static void shmem_undo_range(struct inode *inode, loff_t 
lstart, loff_t lend,
if (!pvec.nr) {
if (index == start || unfalloc)
break;
+/* 
+ * When this condition is true, it means we were
+ * called from fallocate(FALLOC_FL_PUNCH_HOLE).
+ * To prevent a livelock when someone else is faulting
+ * pages back, we are content with single pass and do
+ * not retry with index = start. It's important that
+ * previous page content has been discarded, and
+ * faulter(s) got new zeroed pages.
+ *
+ * The other callsites are shmem_setattr (for
+ * truncation) and shmem_evict_inode, which set i_size
+ * to truncated size or 0, respectively, and then call
+ * us with lstart == inode-i_size. There we do want to
+ * retry, and livelock cannot happen for other reasons.
+ *
+ * XXX what about i915_gem_object_truncate?
+ */
+if (lstart  inode-i_size)
+break;
index = start;
continue;
}
-- 
1.8.4.5




--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 3.14 09/68] net: Add variants of capable for use on on sockets

[Greg Kroah-Hartman]

3.14-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric W. Biederman ebied...@xmission.com

[ Upstream commit a3b299da869d6e78cf42ae0b1b41797bcb8c5e4b ]

sk_net_capable - The common case, operations that are safe in a network 
namespace.
sk_capable - Operations that are not known to be safe in a network namespace
sk_ns_capable - The general case for special cases.

Signed-off-by: Eric W. Biederman ebied...@xmission.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
---
 include/net/sock.h |5 +
 net/core/sock.c|   49 +
 2 files changed, 54 insertions(+)

--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2278,6 +2278,11 @@ int sock_get_timestampns(struct sock *,
 int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len, int level,
   int type);
 
+bool sk_ns_capable(const struct sock *sk,
+  struct user_namespace *user_ns, int cap);
+bool sk_capable(const struct sock *sk, int cap);
+bool sk_net_capable(const struct sock *sk, int cap);
+
 /*
  * Enable debug/info messages
  */
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -145,6 +145,55 @@
 static DEFINE_MUTEX(proto_list_mutex);
 static LIST_HEAD(proto_list);
 
+/**
+ * sk_ns_capable - General socket capability test
+ * @sk: Socket to use a capability on or through
+ * @user_ns: The user namespace of the capability to use
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket had when the socket was
+ * created and the current process has the capability @cap in the user
+ * namespace @user_ns.
+ */
+bool sk_ns_capable(const struct sock *sk,
+  struct user_namespace *user_ns, int cap)
+{
+   return file_ns_capable(sk-sk_socket-file, user_ns, cap) 
+   ns_capable(user_ns, cap);
+}
+EXPORT_SYMBOL(sk_ns_capable);
+
+/**
+ * sk_capable - Socket global capability test
+ * @sk: Socket to use a capability on or through
+ * @cap: The global capbility to use
+ *
+ * Test to see if the opener of the socket had when the socket was
+ * created and the current process has the capability @cap in all user
+ * namespaces.
+ */
+bool sk_capable(const struct sock *sk, int cap)
+{
+   return sk_ns_capable(sk, init_user_ns, cap);
+}
+EXPORT_SYMBOL(sk_capable);
+
+/**
+ * sk_net_capable - Network namespace socket capability test
+ * @sk: Socket to use a capability on or through
+ * @cap: The capability to use
+ *
+ * Test to see if the opener of the socket had when the socke was created
+ * and the current process has the capability @cap over the network namespace
+ * the socket is a member of.
+ */
+bool sk_net_capable(const struct sock *sk, int cap)
+{
+   return sk_ns_capable(sk, sock_net(sk)-user_ns, cap);
+}
+EXPORT_SYMBOL(sk_net_capable);
+
+
 #ifdef CONFIG_MEMCG_KMEM
 int mem_cgroup_sockets_init(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
 {


--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH -mm 3/3] page-cgroup: fix flags definition

[Vladimir Davydov]

Since commit a9ce315aaec1f (mm: memcontrol: rewrite uncharge API),
PCG_* flags are used as bit masks, but they are still defined in a enum
as bit numbers. Fix it.

Signed-off-by: Vladimir Davydov vdavy...@parallels.com
---
 include/linux/page_cgroup.h |   12 +---
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/include/linux/page_cgroup.h b/include/linux/page_cgroup.h
index fb60e4a466c0..9065a61345a1 100644
--- a/include/linux/page_cgroup.h
+++ b/include/linux/page_cgroup.h
@@ -1,12 +1,10 @@
 #ifndef __LINUX_PAGE_CGROUP_H
 #define __LINUX_PAGE_CGROUP_H
 
-enum {
-   /* flags for mem_cgroup */
-   PCG_USED,   /* This page is charged to a memcg */
-   PCG_MEM,/* This page holds a memory charge */
-   PCG_MEMSW,  /* This page holds a memory+swap charge */
-};
+/* flags for mem_cgroup */
+#define PCG_USED   0x01/* This page is charged to a memcg */
+#define PCG_MEM0x02/* This page holds a memory charge */
+#define PCG_MEMSW  0x04/* This page holds a memory+swap charge */
 
 struct pglist_data;
 
@@ -44,7 +42,7 @@ struct page *lookup_cgroup_page(struct page_cgroup *pc);
 
 static inline int PageCgroupUsed(struct page_cgroup *pc)
 {
-   return test_bit(PCG_USED, pc-flags);
+   return !!(pc-flags  PCG_USED);
 }
 #else /* !CONFIG_MEMCG */
 struct page_cgroup;
-- 
1.7.10.4

--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/