Re: [PATCH 2/2] media: davinci: vpbe: venc: move the enabling of vpss clocks to driver

[Sekhar Nori]

On 3/22/2013 1:23 PM, Prabhakar lad wrote:
> From: Lad, Prabhakar 
> 
> The vpss clocks were enabled by calling a exported function from a driver
> in a machine code. calling driver code from platform code is incorrect way.
> 
> This patch fixes this issue and calls the function from driver code itself.
> 
> Signed-off-by: Lad, Prabhakar 
> ---
>  Note: This patch is based on the comment from Sekhar
>   (https://patchwork-mail1.kernel.org/patch/2278441/).
>   Shekar I haven't completely removed the callback, I just added
>   the function calls after the callback. As you mentioned just to
>   pass the VPSS_CLK_CTRL as a resource to venc but the VPSS_CLK_CTRL
>   is already being used by VPSS driver. I'll take this cleanup task later
>   point of time.

Fine by me.

Thanks,
Sekhar
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH] PowerPC:kernel: make additional room in exception vector area

[Chen Gang]

On 2013年03月25日 13:14, Stephen Rothwell wrote:
> Hi all,
> 
> On Mon, 25 Mar 2013 09:31:31 +0800 Chen Gang  wrote:
>> >
>> >   The FWNMI region is fixed at 0x7000 and the vector are now overflowing
>> >   that with allmodconfig. Fix that by moving slb_miss_realmode code out
>> >   of that region as it doesn't need to be that close to the call sites
>> >   (it is a _GLOBAL function)
>> > 
>> > Signed-off-by: Chen Gang 
>> > ---
>> >  arch/powerpc/kernel/exceptions-64s.S |  144 
>> > +-
>> >  1 files changed, 72 insertions(+), 72 deletions(-)
> Thanks, Chen,
> 
> I have applied this to linux-next today and pending the builds overnight,
> will send it to Linus tomorrow or Wednesday.

  thanks.

  :-)

-- 
Chen Gang

Asianux Corporation
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH] staging: vme: fix for a potential NULL pointer dereference

[Kumar Amit Mehta]

Audit the return value of cdev_alloc and hence fixes a potential NULL pointer
dereferencing.

Signed-off-by: Kumar Amit Mehta 
---
 drivers/staging/vme/devices/vme_user.c |4 
 1 file changed, 4 insertions(+)

diff --git a/drivers/staging/vme/devices/vme_user.c 
b/drivers/staging/vme/devices/vme_user.c
index d074b1e..da7f759 100644
--- a/drivers/staging/vme/devices/vme_user.c
+++ b/drivers/staging/vme/devices/vme_user.c
@@ -710,6 +710,10 @@ static int vme_user_probe(struct vme_dev *vdev)
 
/* Register the driver as a char device */
vme_user_cdev = cdev_alloc();
+   if (!vme_user_cdev) {
+   err = -ENOMEM;
+   goto err_char;
+   }
vme_user_cdev->ops = _user_fops;
vme_user_cdev->owner = THIS_MODULE;
err = cdev_add(vme_user_cdev, MKDEV(VME_MAJOR, 0), VME_DEVS);
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: BUG at kmem_cache_alloc

[CAI Qian]

- Original Message -
> From: "David Rientjes" 
> To: "CAI Qian" 
> Cc: "linux-mm" kvack.org>, linux-kernel@vger.kernel.org, "Oleg Nesterov" 
> 
> Sent: Friday, March 22, 2013 5:35:34 PM
> Subject: Re: BUG at kmem_cache_alloc
> 
> On Fri, 22 Mar 2013, CAI Qian wrote:
> 
> > Starting to see those on 3.8.4 (never saw in 3.8.2) stable kernel
> > on a few systems
> > during LTP run,
> > 
> > [11297.597242] BUG: unable to handle kernel paging request at
> > fffe
> > [11297.598022] IP: [] kmem_cache_alloc+0x68/0x1e0
> 
> Is this repeatable?  Do you have CONFIG_SLAB or CONFIG_SLUB enabled?
Saw it on 2 systems so far - one HP server and one KVM guest. Still
trying to reproduce. Used CONFIG_SLUB=y.
CAI Qian
> 
> > [11297.598022] PGD 7b9eb067 PUD 0
> > [11297.598022] Oops:  [#2] SMP
> > [11297.598022] Modules linked in: cmtp kernelcapi bnep
> > scsi_transport_iscsi rfcomm l2tp_ppp l2tp_netlink l2tp_core hidp
> > ipt_ULOG af_key nfc rds pppoe pppox ppp_generic slhc af_802154 atm
> > ip6table_filter ip6_tables iptable_filter ip_tables btrfs
> > zlib_deflate vfat fat nfs_layout_nfsv41_files nfsv4 auth_rpcgss
> > nfsv3 nfs_acl nfsv2 nfs lockd sunrpc fscache nfnetlink_log
> > nfnetlink bluetooth rfkill arc4 md4 nls_utf8 cifs dns_resolver
> > nf_tproxy_core nls_koi8_u nls_cp932 ts_kmp sctp sg kvm_amd kvm
> > virtio_balloon i2c_piix4 pcspkr xfs libcrc32c ata_generic
> > pata_acpi cirrus drm_kms_helper ttm ata_piix virtio_net drm libata
> > virtio_blk i2c_core floppy dm_mirror dm_region_hash dm_log dm_mod
> > [last unloaded: ipt_REJECT]
> > [11297.598022] CPU 1
> > [11297.598022] Pid: 14134, comm: ltp-pan Tainted: G  D
> >  3.8.4+ #1 Bochs Bochs
> > [11297.598022] RIP: 0010:[]  [] kmem_cache_alloc+0x68/0x1e0
> > [11297.598022] RSP: 0018:8800447dbdd0  EFLAGS: 00010246
> > [11297.598022] RAX:  RBX: 88007c169970 RCX:
> > 018acdcd
> > [11297.598022] RDX: 0006c104 RSI: 80d0 RDI:
> > 88007d04ac00
> > [11297.598022] RBP: 8800447dbe10 R08: 00017620 R09:
> > 810fe2e2
> > [11297.598022] R10:  R11:  R12:
> > fffe
> > [11297.598022] R13: 80d0 R14: 88007d04ac00 R15:
> > 88007d04ac00
> > [11297.598022] FS:  7f09c29b4740()
> > GS:88007fd0() knlGS:f74d86c0
> > [11297.598022] CS:  0010 DS:  ES:  CR0: 8005003b
> > [11297.598022] CR2: fffe CR3: 37213000 CR4:
> > 06e0
> > [11297.598022] DR0:  DR1:  DR2:
> > 
> > [11297.598022] DR3:  DR6: 0ff0 DR7:
> > 0400
> > [11297.598022] Process ltp-pan (pid: 14134, threadinfo
> > 8800447da000, task 8800551ab2e0)
> > [11297.598022] Stack:
> > [11297.598022]  810fe2e2 8108cf0f 01200011
> > 88007c169970
> > [11297.598022]   7f09c29b4a10 
> > 88007c169970
> > [11297.598022]  8800447dbe30 810fe2e2 
> > 01200011
> > [11297.598022] Call Trace:
> > [11297.598022]  [] ? __delayacct_tsk_init+0x22/0x40
> > [11297.598022]  [] ? prepare_creds+0xdf/0x190
> > [11297.598022]  [] __delayacct_tsk_init+0x22/0x40
> > [11297.598022]  [] copy_process.part.25+0x31f/0x13f0
> > [11297.598022]  [] do_fork+0xa9/0x350
> > [11297.598022]  [] sys_clone+0x16/0x20
> > [11297.598022]  [] stub_clone+0x69/0x90
> > [11297.598022]  [] ? system_call_fastpath+0x16/0x1b
> > [11297.598022] Code: 90 4d 89 fe 4d 8b 06 65 4c 03 04 25 c8 db 00
> > 00 49 8b 50 08 4d 8b 20 4d 85 e4 0f 84 2b 01 00 00 49 63 46 20 4d
> > 8b 06 41 f6 c0 0f <49> 8b 1c 04 0f 85 55 01 00 00 48 8d 4a 01 4c
> > 89 e0 65 49 0f c7
> > [11297.598022] RIP  [] kmem_cache_alloc+0x68/0x1e0
> > [11297.598022]  RSP
> > [11297.598022] CR2: fffe
> > [11297.727799] ---[ end trace 037bde72f23b34d2 ]---
> > 
> > Never saw this in mainline but only something like this wondering
> > could be related
> > (that kmem_cache_alloc also in the trace).
> > 
> 
> These are unrelated.
> 
> --
> To unsubscribe, send a message with 'unsubscribe linux-mm' in
> the body to majord...@kvack.org.  For more info on Linux MM,
> see: http://www.linux-mm.org/ .
> Don't email: href=mailto:"d...@kvack.org;> em...@kvack.org 
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH 1/2] media: davinci: vpss: enable vpss clocks

[Sekhar Nori]

On 3/22/2013 1:23 PM, Prabhakar lad wrote:
> From: Lad, Prabhakar 
> 
> By default the VPSS clocks are only enabled in capture driver
> for davinci family which creates duplicates. This
> patch adds support to enable the VPSS clocks in VPSS driver.
> This avoids duplication of code and also adding clock aliases.
> This patch cleanups the VPSS clock enabling in the capture driver,
> and also removes the clock alias in machine file. Along side adds
> a vpss slave clock for DM365 as mentioned by Sekhar
> (https://patchwork.kernel.org/patch/1221261/).
> 
> Signed-off-by: Lad, Prabhakar 
> ---
>  arch/arm/mach-davinci/dm355.c|3 -
>  arch/arm/mach-davinci/dm365.c|9 +++-
>  arch/arm/mach-davinci/dm644x.c   |5 --
>  drivers/media/platform/davinci/dm355_ccdc.c  |   39 +
>  drivers/media/platform/davinci/dm644x_ccdc.c |   44 ---
>  drivers/media/platform/davinci/isif.c|   28 ++--
>  drivers/media/platform/davinci/vpss.c|   60 
> ++
>  7 files changed, 72 insertions(+), 116 deletions(-)
> 
>  static struct clk arm_clk = {
>   .name   = "arm_clk",
>   .parent = _sysclk2,
> @@ -450,6 +456,7 @@ static struct clk_lookup dm365_clks[] = {
>   CLK(NULL, "pll2_sysclk9", _sysclk9),
>   CLK(NULL, "vpss_dac", _dac_clk),
>   CLK(NULL, "vpss_master", _master_clk),
> + CLK(NULL, "vpss_slave", _slave_clk),

These should use device name for look-up instead of relying just on
con_id. So the entry should look like:

CLK("vpss", "slave", _slave_clk),

>   CLK(NULL, "arm", _clk),
>   CLK(NULL, "uart0", _clk),
>   CLK(NULL, "uart1", _clk),
> @@ -1239,8 +1246,6 @@ static int __init dm365_init_devices(void)
>   clk_add_alias(NULL, dev_name(_mdio_device.dev),
> NULL, _emac_device.dev);
>  
> - /* Add isif clock alias */
> - clk_add_alias("master", dm365_isif_dev.name, "vpss_master", NULL);
>   platform_device_register(_vpss_device);
>   platform_device_register(_isif_dev);
>   platform_device_register(_capture_dev);
> diff --git a/arch/arm/mach-davinci/dm644x.c b/arch/arm/mach-davinci/dm644x.c
> index ee0e994..026e7e3 100644
> --- a/arch/arm/mach-davinci/dm644x.c
> +++ b/arch/arm/mach-davinci/dm644x.c
> @@ -901,11 +901,6 @@ int __init dm644x_init_video(struct vpfe_config 
> *vpfe_cfg,
>   dm644x_vpfe_dev.dev.platform_data = vpfe_cfg;
>   platform_device_register(_ccdc_dev);
>   platform_device_register(_vpfe_dev);
> - /* Add ccdc clock aliases */
> - clk_add_alias("master", dm644x_ccdc_dev.name,
> -   "vpss_master", NULL);
> - clk_add_alias("slave", dm644x_ccdc_dev.name,
> -   "vpss_slave", NULL);
>   }
>  
>   if (vpbe_cfg) {
> diff --git a/drivers/media/platform/davinci/dm355_ccdc.c 
> b/drivers/media/platform/davinci/dm355_ccdc.c
> index 2364dba..05f8fb7 100644
> --- a/drivers/media/platform/davinci/dm355_ccdc.c
> +++ b/drivers/media/platform/davinci/dm355_ccdc.c
> @@ -37,7 +37,6 @@
>  #include 
>  #include 
>  #include 
> -#include 
>  #include 
>  #include 
>  
> @@ -59,10 +58,6 @@ static struct ccdc_oper_config {
>   struct ccdc_params_raw bayer;
>   /* YCbCr configuration */
>   struct ccdc_params_ycbcr ycbcr;
> - /* Master clock */
> - struct clk *mclk;
> - /* slave clock */
> - struct clk *sclk;
>   /* ccdc base address */
>   void __iomem *base_addr;
>  } ccdc_cfg = {
> @@ -997,32 +992,10 @@ static int dm355_ccdc_probe(struct platform_device 
> *pdev)
>   goto fail_nomem;
>   }
>  
> - /* Get and enable Master clock */
> - ccdc_cfg.mclk = clk_get(>dev, "master");
> - if (IS_ERR(ccdc_cfg.mclk)) {
> - status = PTR_ERR(ccdc_cfg.mclk);
> - goto fail_nomap;
> - }
> - if (clk_prepare_enable(ccdc_cfg.mclk)) {
> - status = -ENODEV;
> - goto fail_mclk;
> - }
> -
> - /* Get and enable Slave clock */
> - ccdc_cfg.sclk = clk_get(>dev, "slave");
> - if (IS_ERR(ccdc_cfg.sclk)) {
> - status = PTR_ERR(ccdc_cfg.sclk);
> - goto fail_mclk;
> - }
> - if (clk_prepare_enable(ccdc_cfg.sclk)) {
> - status = -ENODEV;
> - goto fail_sclk;
> - }
> -
>   /* Platform data holds setup_pinmux function ptr */
>   if (NULL == pdev->dev.platform_data) {
>   status = -ENODEV;
> - goto fail_sclk;
> + goto fail_nomap;
>   }
>   setup_pinmux = pdev->dev.platform_data;
>   /*
> @@ -1033,12 +1006,6 @@ static int dm355_ccdc_probe(struct platform_device 
> *pdev)
>   ccdc_cfg.dev = >dev;
>   printk(KERN_NOTICE "%s is registered with vpfe.\n", ccdc_hw_dev.name);
>   return 0;
> -fail_sclk:
> - clk_disable_unprepare(ccdc_cfg.sclk);
> - 

Re: Submitting fbdev tree patches

[Jingoo Han]

On Monday, March 25, 2013 2:11 PM, Tony Prisk wrote:
> 
> Is anyone taking patches for fbdev at the moment?
> 
> I sent in some patches for 3.9 but didn't hear back - checking the lists
> it doesn't appear Florian has posted much since the end of Oct 2012.

CC'ed Tomi Valkeinen, Andrew Morton


Hi Tony Prisk,

Tomy Valkeien will take care of fbdev fixes for 3.9.
(http://www.spinics.net/lists/linux-fbdev/msg10243.html)

How about sending a pull request to Tomy?

Best regards,
Jingoo Han

> 
> Regards
> Tony Prisk
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-fbdev" in
> the body of a message to majord...@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

[RFC PATCH] sched: wake-affine throttle

[Michael Wang]

Recently testing show that wake-affine stuff cause regression on pgbench, the
hiding rat was finally catched out.

wake-affine stuff is always trying to pull wakee close to waker, by theory,
this will benefit us if waker's cpu cached hot data for wakee, or the extreme
ping-pong case.

However, the whole stuff is somewhat blindly, there is no examining on the
relationship between waker and wakee, and since the stuff itself
is time-consuming, some workload suffered, pgbench is just the one who
has been found.

Thus, throttle the wake-affine stuff for such workload is necessary.

This patch introduced a new knob 'sysctl_sched_wake_affine_interval' with the
default value 1ms, which means wake-affine stuff only effect once per 1ms, which
usually the minimum balance interval (the idea is that the rapid of wake-affine
should lower than the rapid of load-balance at least).

By turning the new knob, those workload who suffered will have the chance to
stop the regression.

Test:
Test with 12 cpu X86 server and tip 3.9.0-rc2.

Default 1ms interval bring limited performance improvement(<5%) for
pgbench, significant improvement start to show when turning the
knob to 100ms.

original100ms   

| db_size | clients |  tps  |   |  tps  |
+-+-+---+   +---+
| 21 MB   |   1 | 10572 |   | 10675 |
| 21 MB   |   2 | 21275 |   | 21228 |
| 21 MB   |   4 | 41866 |   | 41946 |
| 21 MB   |   8 | 53931 |   | 55176 |
| 21 MB   |  12 | 50956 |   | 54457 |   +6.87%
| 21 MB   |  16 | 49911 |   | 55468 |   +11.11%
| 21 MB   |  24 | 46046 |   | 56446 |   +22.59%
| 21 MB   |  32 | 43405 |   | 55177 |   +27.12%
| 7483 MB |   1 |  7734 |   |  7721 |
| 7483 MB |   2 | 19375 |   | 19277 |
| 7483 MB |   4 | 37408 |   | 37685 |
| 7483 MB |   8 | 49033 |   | 49152 |
| 7483 MB |  12 | 45525 |   | 49241 |   +8.16%
| 7483 MB |  16 | 45731 |   | 51425 |   +12.45%
| 7483 MB |  24 | 41533 |   | 52349 |   +26.04%
| 7483 MB |  32 | 36370 |   | 51022 |   +40.28%
| 15 GB   |   1 |  7576 |   |  7422 |
| 15 GB   |   2 | 19157 |   | 19176 |
| 15 GB   |   4 | 37285 |   | 36982 |
| 15 GB   |   8 | 48718 |   | 48413 |
| 15 GB   |  12 | 45167 |   | 48497 |   +7.37%
| 15 GB   |  16 | 45270 |   | 51276 |   +13.27%
| 15 GB   |  24 | 40984 |   | 51628 |   +25.97%
| 15 GB   |  32 | 35918 |   | 51060 |   +42.16%

Suggested-by: Peter Zijlstra 
Signed-off-by: Michael Wang 
---
 include/linux/sched.h |5 +
 kernel/sched/fair.c   |   33 -
 kernel/sysctl.c   |   10 ++
 3 files changed, 47 insertions(+), 1 deletions(-)

diff --git a/include/linux/sched.h b/include/linux/sched.h
index d35d2b6..e9efd3a 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1197,6 +1197,10 @@ enum perf_event_task_context {
perf_nr_task_contexts,
 };
 
+#ifdef CONFIG_SMP
+extern unsigned int sysctl_sched_wake_affine_interval;
+#endif
+
 struct task_struct {
volatile long state;/* -1 unrunnable, 0 runnable, >0 stopped */
void *stack;
@@ -1207,6 +1211,7 @@ struct task_struct {
 #ifdef CONFIG_SMP
struct llist_node wake_entry;
int on_cpu;
+   unsigned long next_wake_affine;
 #endif
int on_rq;
 
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 7a33e59..00d7f45 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3087,6 +3087,22 @@ static inline unsigned long effective_load(struct 
task_group *tg, int cpu,
 
 #endif
 
+/*
+ * Default is 1ms, to prevent the wake_affine() stuff working too frequently.
+ */
+unsigned int sysctl_sched_wake_affine_interval = 1U;
+
+static inline int wake_affine_throttled(struct task_struct *p)
+{
+   return time_before(jiffies, p->next_wake_affine);
+}
+
+static inline void wake_affine_throttle(struct task_struct *p)
+{
+   p->next_wake_affine = jiffies +
+   msecs_to_jiffies(sysctl_sched_wake_affine_interval);
+}
+
 static int wake_affine(struct sched_domain *sd, struct task_struct *p, int 
sync)
 {
s64 this_load, load;
@@ -3096,6 +3112,9 @@ static int wake_affine(struct sched_domain *sd, struct 
task_struct *p, int sync)
unsigned long weight;
int balanced;
 
+   if (wake_affine_throttled(p))
+   return 0;
+
idx   = sd->wake_idx;
this_cpu  = smp_processor_id();
prev_cpu  = task_cpu(p);
@@ -3342,8 +3361,20 @@ select_task_rq_fair(struct task_struct *p, int sd_flag, 
int wake_flags)
}
 
if (affine_sd) {
-   if (cpu != prev_cpu && wake_affine(affine_sd, p, sync))
+   if (cpu 

Re: [PATCH 1/1] watchdog:improve w83627hf_wdt to timeout in minutes

[Guenter Roeck]

On Sun, Mar 24, 2013 at 09:15:57PM -0700, Tony Chung wrote:
> The current maximum of 255 seconds is insufficient.
> For example, crash dump could take 5+ minutes.
> 
> Signed-off-by: Tony Chung 

I would suggest to use the port to the watchdog infrastructure for any
changes on this driver.

> ---
>  drivers/watchdog/w83627hf_wdt.c |   73 ++
>  1 files changed, 57 insertions(+), 16 deletions(-)
> 
> diff --git a/drivers/watchdog/w83627hf_wdt.c b/drivers/watchdog/w83627hf_wdt.c
> index 92f1326..d26adfb 100644
> --- a/drivers/watchdog/w83627hf_wdt.c
> +++ b/drivers/watchdog/w83627hf_wdt.c
> @@ -58,7 +58,7 @@ MODULE_PARM_DESC(wdt_io, "w83627hf/thf WDT io port (default 
> 0x2E)");
>  static int timeout = WATCHDOG_TIMEOUT;   /* in seconds */
>  module_param(timeout, int, 0);
>  MODULE_PARM_DESC(timeout,
> - "Watchdog timeout in seconds. 1 <= timeout <= 255, default="
> + "Watchdog timeout in seconds. 1 <= timeout <= 15300, default="
>   __MODULE_STRING(WATCHDOG_TIMEOUT) ".");
>  
>  static bool nowayout = WATCHDOG_NOWAYOUT;
> @@ -67,6 +67,29 @@ MODULE_PARM_DESC(nowayout,
>   "Watchdog cannot be stopped once started (default="
>   __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
>  
> +/* timeout unit in minute */
> +static bool use_minute;
> +static char *unit;
> +static int max_timeout = 15300; /* 255*60 seconds */
> +
> +static inline int wdt_round_secs_to_minute(int t)
> +{
> + return (t + 59) / 60;
> +}

Use DIV_ROUND_UP().

> +
> +static inline int wdt_use_minute(int t)
> +{
> + if (t > 255) {
> + t = wdt_round_secs_to_minute(t);
> + use_minute = 1;

bool has true / false.

> + unit = "minutes";
> + } else {
> + use_minute = 0;
> + unit = "secs";
> + }
> + return t;
> +}
> +
>  /*
>   *   Kernel methods.
>   */
> @@ -107,6 +130,23 @@ static void w83627hf_unselect_wd_register(void)
>   outb_p(0xAA, WDT_EFER); /* Leave extended function mode */
>  }
>  
> +/* set CRF5 register */
> +static void w83627hf_set_crf5(void)
> +{
> + unsigned char t;
> +
> + outb_p(0xF5, WDT_EFER); /* Select CRF5 */
> + t = inb_p(WDT_EFDR);  /* read CRF5 */
> + t &= ~0x0C;   /* set second mode & disable keyboard
> + turning off watchdog */
> + t |= 0x02;/* enable the WDTO# output low pulse
> + to the KBRST# pin (PIN60) */
> + if (use_minute)
> + t |= 0x80;/* set timeout in minute */
> +
> + outb_p(t, WDT_EFDR);/* Write back to CRF5 */
> +}
> +
>  /* tyan motherboards seem to set F5 to 0x4C ?
>   * So explicitly init to appropriate value. */
>  
> @@ -116,21 +156,16 @@ static void w83627hf_init(void)
>  
>   w83627hf_select_wd_register();
>  
> + w83627hf_set_crf5();
> +
>   outb_p(0xF6, WDT_EFER); /* Select CRF6 */
>   t = inb_p(WDT_EFDR);  /* read CRF6 */
>   if (t != 0) {
> - pr_info("Watchdog already running. Resetting timeout to %d 
> sec\n",
> - timeout);
> + pr_info("Watchdog already running.  Reset timeout to %d %s\n",
> + timeout, unit);
>   outb_p(timeout, WDT_EFDR);/* Write back to CRF6 */
>   }
>  
> - outb_p(0xF5, WDT_EFER); /* Select CRF5 */
> - t = inb_p(WDT_EFDR);  /* read CRF5 */
> - t &= ~0x0C;   /* set second mode & disable keyboard
> - turning off watchdog */
> - t |= 0x02;/* enable the WDTO# output low pulse
> - to the KBRST# pin (PIN60) */
> - outb_p(t, WDT_EFDR);/* Write back to CRF5 */
>  
>   outb_p(0xF7, WDT_EFER); /* Select CRF7 */
>   t = inb_p(WDT_EFDR);  /* read CRF7 */
> @@ -147,6 +182,9 @@ static void wdt_set_time(int timeout)
>  
>   w83627hf_select_wd_register();
>  
> + if (use_minute)
> + w83627hf_set_crf5();

What if the new timeout is less than 256 seconds ?

> +
>   outb_p(0xF6, WDT_EFER);/* Select CRF6 */
>   outb_p(timeout, WDT_EFDR); /* Write Timeout counter to CRF6 */
>  
> @@ -169,9 +207,9 @@ static int wdt_disable(void)
>  
>  static int wdt_set_heartbeat(int t)
>  {
> - if (t < 1 || t > 255)
> + if (t < 1 || t > max_timeout)
>   return -EINVAL;
> - timeout = t;
> + timeout = wdt_use_minute(t);

This should probably also update the watchdog timer register.

>   return 0;
>  }
>  
> @@ -262,9 +300,11 @@ static long wdt_ioctl(struct file *file, unsigned int 
> cmd, unsigned long arg)
>   wdt_ping();
>   /* Fall */
>   case WDIOC_GETTIMEOUT:
> - return put_user(timeout, p);
> + timeval = (use_minute) ? timeout * 60 : timeout;

Isn't timeout always in seconds ?

> + return 

Re: Question: How to distribute the interrupts over multiple cores?

[Lin Feng]

Hi,

On 03/25/2013 11:44 AM, Lenky Gao wrote:
>> On 03/25/2013 11:18 AM, Lenky Gao wrote:
>>> The irqbalance service has been stopped.
>> So try start irqbalance to see what happen?
>> It should help to give what you want ;-)
> 
> Using the irqbalance service to dynamically change the IRQ-bound? It's
> seems a software solution. In my old machine, there is no this
> problem. I need some information to explain why. Maybe is the

Do you mean on your old machine the irq will be distributed automatically 
among the cpus set by smp_affinity?

Sorry, I forgot one thing that the irqbalance service will break the mask
set by smp_affinity. So I don't know if now we support the feature
that balance among the cpus set by smp_affinity.
 
In my old conception when we set smp_affinity the irqbalance service
should be stopped, so you are right before, and the kernel will choose
one cpu in your mask for the IRQ and bounded from now on if there is no
irqbalance service.

thanks,
linfeng 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH] PowerPC:kernel: make additional room in exception vector area

[Stephen Rothwell]

Hi all,

On Mon, 25 Mar 2013 09:31:31 +0800 Chen Gang  wrote:
>
>   The FWNMI region is fixed at 0x7000 and the vector are now overflowing
>   that with allmodconfig. Fix that by moving slb_miss_realmode code out
>   of that region as it doesn't need to be that close to the call sites
>   (it is a _GLOBAL function)
> 
> Signed-off-by: Chen Gang 
> ---
>  arch/powerpc/kernel/exceptions-64s.S |  144 
> +-
>  1 files changed, 72 insertions(+), 72 deletions(-)

Thanks, Chen,

I have applied this to linux-next today and pending the builds overnight,
will send it to Linus tomorrow or Wednesday.

-- 
Cheers,
Stephen Rothwells...@canb.auug.org.au


pgpv8w5WUOFOz.pgp
Description: PGP signature

Re: [PATCH v3 3/3] backlight: as3711: add OF support

[Jingoo Han]

On Saturday, March 23, 2013 1:16 AM, Guennadi Liakhovetski wrote:
> 
> Add support for configuring AS3711 backlight driver from DT.
> 
> Signed-off-by: Guennadi Liakhovetski 
> Reviwed-by: Mark Brown 

Acked-by: Jingoo Han 


But, there is a typo in comment.
> +  * At least one su2-auto-curr* must be specified iff
s/iff/if

Best regards.
Jingoo Han

> ---
>  drivers/video/backlight/as3711_bl.c |  118 
> ++-
>  1 files changed, 117 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/video/backlight/as3711_bl.c 
> b/drivers/video/backlight/as3711_bl.c
> index 41d52fe..123887c 100644
> --- a/drivers/video/backlight/as3711_bl.c
> +++ b/drivers/video/backlight/as3711_bl.c
> @@ -258,6 +258,109 @@ static int as3711_bl_register(struct platform_device 
> *pdev,
>   return 0;
>  }
> 
> +static int as3711_backlight_parse_dt(struct device *dev)
> +{
> + struct as3711_bl_pdata *pdata = dev_get_platdata(dev);
> + struct device_node *bl =
> + of_find_node_by_name(dev->parent->of_node, "backlight"), *fb;
> + int ret;
> +
> + if (!bl) {
> + dev_dbg(dev, "backlight node not found\n");
> + return -ENODEV;
> + }
> +
> + fb = of_parse_phandle(bl, "su1-dev", 0);
> + if (fb) {
> + pdata->su1_fb = fb->full_name;
> +
> + ret = of_property_read_u32(bl, "su1-max-uA", 
> >su1_max_uA);
> + if (pdata->su1_max_uA <= 0)
> + ret = -EINVAL;
> + if (ret < 0)
> + return ret;
> + }
> +
> + fb = of_parse_phandle(bl, "su2-dev", 0);
> + if (fb) {
> + int count = 0;
> +
> + pdata->su2_fb = fb->full_name;
> +
> + ret = of_property_read_u32(bl, "su2-max-uA", 
> >su2_max_uA);
> + if (pdata->su2_max_uA <= 0)
> + ret = -EINVAL;
> + if (ret < 0)
> + return ret;
> +
> + if (of_find_property(bl, "su2-feedback-voltage", NULL)) {
> + pdata->su2_feedback = AS3711_SU2_VOLTAGE;
> + count++;
> + }
> + if (of_find_property(bl, "su2-feedback-curr1", NULL)) {
> + pdata->su2_feedback = AS3711_SU2_CURR1;
> + count++;
> + }
> + if (of_find_property(bl, "su2-feedback-curr2", NULL)) {
> + pdata->su2_feedback = AS3711_SU2_CURR2;
> + count++;
> + }
> + if (of_find_property(bl, "su2-feedback-curr3", NULL)) {
> + pdata->su2_feedback = AS3711_SU2_CURR3;
> + count++;
> + }
> + if (of_find_property(bl, "su2-feedback-curr-auto", NULL)) {
> + pdata->su2_feedback = AS3711_SU2_CURR_AUTO;
> + count++;
> + }
> + if (count != 1)
> + return -EINVAL;
> +
> + count = 0;
> + if (of_find_property(bl, "su2-fbprot-lx-sd4", NULL)) {
> + pdata->su2_fbprot = AS3711_SU2_LX_SD4;
> + count++;
> + }
> + if (of_find_property(bl, "su2-fbprot-gpio2", NULL)) {
> + pdata->su2_fbprot = AS3711_SU2_GPIO2;
> + count++;
> + }
> + if (of_find_property(bl, "su2-fbprot-gpio3", NULL)) {
> + pdata->su2_fbprot = AS3711_SU2_GPIO3;
> + count++;
> + }
> + if (of_find_property(bl, "su2-fbprot-gpio4", NULL)) {
> + pdata->su2_fbprot = AS3711_SU2_GPIO4;
> + count++;
> + }
> + if (count != 1)
> + return -EINVAL;
> +
> + count = 0;
> + if (of_find_property(bl, "su2-auto-curr1", NULL)) {
> + pdata->su2_auto_curr1 = true;
> + count++;
> + }
> + if (of_find_property(bl, "su2-auto-curr2", NULL)) {
> + pdata->su2_auto_curr2 = true;
> + count++;
> + }
> + if (of_find_property(bl, "su2-auto-curr3", NULL)) {
> + pdata->su2_auto_curr3 = true;
> + count++;
> + }
> +
> + /*
> +  * At least one su2-auto-curr* must be specified iff
> +  * AS3711_SU2_CURR_AUTO is used
> +  */
> + if (!count ^ (pdata->su2_feedback != AS3711_SU2_CURR_AUTO))
> + return -EINVAL;
> + }
> +
> + return 0;
> +}
> +
>  static int as3711_backlight_probe(struct platform_device *pdev)
>  {
>   struct as3711_bl_pdata *pdata = dev_get_platdata(>dev);
> @@ -267,11 +370,24 @@ static int as3711_backlight_probe(struct 
> platform_device *pdev)
>   unsigned int max_brightness;
>   int ret;
> 
> - if (!pdata || 

linux-next: Tree for Mar 25

[Stephen Rothwell]

Hi all,

Changes since 20130322:

Linus' tree lost its build failure.

The kvm tree gained a conflict against the net-next tree.

The tty tree still has its build failure so I used the version from
next-20130319.

The akpm tree gained a conflict against Linus' tree and lost several
patches that turned up elsewhere.

I applied a patch to partially fix the powerpc allmodconfig build
failures.



I have created today's linux-next tree at
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
(patches at http://www.kernel.org/pub/linux/kernel/next/ ).  If you
are tracking the linux-next tree using git, you should not use "git pull"
to do so as that will try to merge the new linux-next release with the
old one.  You should use "git fetch" as mentioned in the FAQ on the wiki
(see below).

You can see which trees have been included by looking in the Next/Trees
file in the source.  There are also quilt-import.log and merge.log files
in the Next directory.  Between each merge, the tree was built with
a ppc64_defconfig for powerpc and an allmodconfig for x86_64. After the
final fixups (if any), it is also built with powerpc allnoconfig (32 and
64 bit), ppc44x_defconfig and allyesconfig (minus
CONFIG_PROFILE_ALL_BRANCHES - this fails its final link) and i386, sparc,
sparc64 and arm defconfig. These builds also have
CONFIG_ENABLE_WARN_DEPRECATED, CONFIG_ENABLE_MUST_CHECK and
CONFIG_DEBUG_INFO disabled when necessary.

Below is a summary of the state of the merge.

We are up to 222 trees (counting Linus' and 31 trees of patches pending
for Linus' tree), more are welcome (even if they are currently empty).
Thanks to those who have contributed, and to those who haven't, please do.

Status of my local build tests will be at
http://kisskb.ellerman.id.au/linux-next .  If maintainers want to give
advice about cross compilers/configs that work, we are always open to add
more builds.

Thanks to Randy Dunlap for doing many randconfig builds.  And to Paul
Gortmaker for triage and bug fixes.

There is a wiki covering stuff to do with linux-next at
http://linux.f-seidel.de/linux-next/pmwiki/ .  Thanks to Frank Seidel.

-- 
Cheers,
Stephen Rothwells...@canb.auug.org.au

$ git checkout master
$ git reset --hard stable
Merging origin/master (3912a67 Merge tag 'pinctrl-fixes-for-v3.9' of 
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl)
Merging fixes/master (5da273f Merge 
git://git.infradead.org/users/willy/linux-nvme)
Merging kbuild-current/rc-fixes (6dbe51c Linux 3.9-rc1)
Merging arc-current/for-curr (367f3fc ARC: Fix the typo in event identifier 
flags used by ptrace)
Merging arm-current/fixes (68a154f ARM: 7681/1: hw_breakpoint: use warn_once to 
avoid spam from reset_ctrl_regs())
Merging m68k-current/for-linus (5618395 m68k: Sort out !CONFIG_MMU_SUN3 vs. 
CONFIG_HAS_DMA)
Merging powerpc-merge/merge (af81d78 powerpc: Rename USER_ESID_BITS* to 
ESID_BITS*)
Merging sparc/master (10b3866 Merge tag 'for-linus-v3.9-rc4' of 
git://oss.sgi.com/xfs/xfs)
Merging net/master (7ebe183 tcp: undo spurious timeout after SACK reneging)
Merging ipsec/master (85dfb74 af_key: initialize satype in 
key_notify_policy_flush())
Merging sound-current/for-linus (55a63d4 ALSA: hda - Fix DAC assignment for 
independent HP)
Merging pci-current/for-linus (249bfb8 PCI/PM: Clean up PME state when removing 
a device)
Merging wireless/master (36ef0b47 rtlwifi: usb: add missing freeing of skbuff)
Merging driver-core.current/driver-core-linus (e5110f4 sysfs: handle failure 
path correctly for readdir())
Merging tty.current/tty-linus (8b5c913 serial: 8250_pci: Add WCH CH352 quirk to 
avoid Xscale detection)
Merging usb.current/usb-linus (fc98ab8 USB: ti_usb_3410_5052: fix 
use-after-free in TIOCMIWAIT)
Merging staging.current/staging-linus (27ca039 staging: zcache: fix typo 
"64_BIT")
Merging char-misc.current/char-misc-linus (347e089 VMCI: Fix process-to-process 
DRGAMs.)
Merging input-current/for-linus (4b7d293 Input: mms114 - Fix regulator enable 
and disable paths)
Merging md-current/for-linus (238f590 md: remove CONFIG_MULTICORE_RAID456 
entirely)
Merging audit-current/for-linus (c158a35 audit: no leading space in 
audit_log_d_path prefix)
Merging crypto-current/master (246bbed Revert "crypto: caam - add IPsec ESN 
support")
Merging ide/master (bf6b438 ide: gayle: use module_platform_driver_probe())
Merging dwmw2/master (63662139 params: Fix potential memory leak in 
add_sysfs_param())
Merging sh-current/sh-fixes-for-linus (4403310 SH: Convert out[bwl] macros to 
inline functions)
Merging irqdomain-current/irqdomain/merge (a0d271c Linux 3.6)
Merging devicetree-current/devicetree/merge (ab28698 of: define struct device 
in of_platform.h if !OF_DEVICE and !OF_ADDRESS)
Merging spi-current/spi/merge (d3601e5 spi/sh-hspi: fix return value check in 
hspi_probe().)
Merging gpio-current/gpio/merge (e97f9b5 gpio/gpio-ich: fix 

Submitting fbdev tree patches

[Tony Prisk]

Is anyone taking patches for fbdev at the moment?

I sent in some patches for 3.9 but didn't hear back - checking the lists
it doesn't appear Florian has posted much since the end of Oct 2012.

Regards
Tony Prisk

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

RE: [PATCH 0/2] Add dT support for tps6507x touchscreen.

[Vishwanathrao Badarkhe, Manish]

Hi all
I am sending next version for this, as need to update commit message for 
some patches.

Thanks
Manish Badarkhe

-Original Message-
From: Vishwanathrao Badarkhe, Manish 
Sent: Saturday, March 23, 2013 6:29 PM
To: devicetree-disc...@lists.ozlabs.org; linux-in...@vger.kernel.org; 
linux-kernel@vger.kernel.org; davinci-linux-open-sou...@linux.davincidsp.com; 
linux-...@vger.kernel.org
Cc: dmitry.torok...@gmail.com; r...@landley.net; rob.herr...@calxeda.com; 
grant.lik...@secretlab.ca; Vishwanathrao Badarkhe, Manish
Subject: [PATCH 0/2] Add dT support for tps6507x touchscreen.

Patch set adds DT support for tps6507x based touchscreen
Also, add DT data for tps6507x touchscreen in da850-evm by 
providing touchscreen node inside tps6507x mfd device.

This patch series applies on top of v3.9-rc2 of linus tree and
depends on [1].  

[1]davinci: Add device tree data for tps6507x
   http://www.spinics.net/lists/linux-doc/msg09473.html
 
Tested on da850-evm board.

Vishwanathrao Badarkhe, Manish (2):
  tps6507x-ts: Add DT support
  ARM: davinci: da850: add tps6507x touchscreen DT data

 Documentation/devicetree/bindings/mfd/tps6507x.txt |   22 
 arch/arm/boot/dts/da850-evm.dts|9 ++
 drivers/input/touchscreen/tps6507x-ts.c|  104 ++--
 3 files changed, 105 insertions(+), 30 deletions(-)

-- 
1.7.4.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [patch v5 14/15] sched: power aware load balance

[Alex Shi]

On 03/22/2013 01:14 PM, Preeti U Murthy wrote:
>> > 
>> > the value get from decay_load():
>> >  sa->runnable_avg_sum = decay_load(sa->runnable_avg_sum,
>> > in decay_load it is possible to be set zero.
> Yes you are right, it is possible to be set to 0, but after a very long
> time, to be more precise, nearly 2 seconds. If you look at decay_load(),
> if the period between last update and now has crossed (32*63),only then
> will the runnable_avg_sum become 0, else it will simply decay.
> 
> This means that for nearly 2seconds,consolidation of loads may not be
> possible even after the runqueues have finished executing tasks running
> on them.

Look into the decay_load(), since the LOAD_AVG_MAX is about 47742, so
after 16 * 32ms, the maximum avg sum will be decay to zero. 2^16 = 65536

Yes, compare to accumulate time 345ms, the decay is not symmetry, and
not precise, seems it has space to tune well. But it is acceptable now.
> 
> The exact experiment that I performed was running ebizzy, with just two
> threads. My setup was 2 socket,2 cores each,4 threads each core. So a 16
> logical cpu machine.When I begin running ebizzy with balance policy, the
> 2 threads of ebizzy are found one on each socket, while I would expect
> them to be on the same socket. All other cpus, except the ones running
> ebizzy threads are idle and not running anything on either socket.
> I am not running any other processes.

did you try the simplest benchmark: while true; do :; done
I am writing the v6 version which include rt_util etc. you may test on
it after I send out. :)
> 
> You could run a similar experiment and let me know if you see otherwise.
> I am at a loss to understand why else would such a spreading of load
> occur, if not for the rq->util not becoming 0 quickly,when it is not
> running anything. I have used trace_printks to keep track of runqueue
> util of those runqueues not running anything after maybe some initial
> load and it does not become 0 till the end of the run.


-- 
Thanks Alex
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH] cifs: Rename cERROR and cFYI to cifs_dbg

[Steve French]

On Fri, Mar 15, 2013 at 3:43 PM, Joe Perches  wrote:
> On Fri, 2013-03-15 at 15:16 -0500, Steve French wrote:
>
>> I would like to merge the three we have (one still has to be put in
>> for-next - the one from Jeff) for for-next in the next three or fouir
>> days - but I can create another temporary branch for the ones for 3.10
>> - but ... I would like to simplify things by merging the other cleanup
>> patches we already have first.  I agree that we are going to have to
>> let people know to rebase everything for cifs for 3.10 on this big
>> cleanup patch.
>
> Another possibility is to extend the
> cifs_dbg(type, fmt. ...) types from
>
> VFS, FYI, NOISY
>
> so that the messages could be
> filtered/classified better.
>
> Also, perhaps it'd be better to use
> pr_debug instead of KERN_ERR for
> the VFS messages.

Although it required hand merging, this large patch is now merged into
cifs-2.6.git (for-next branch, destined for 3.10) but ... I only
merged three obvious other patches (destined for 3.10) before it

4521ba9ca4138f424769f17ae7166ff5ccf08805 fs: cifs: use kmemdup instead
of kmalloc + memcpy
41057e5a5d673015fc0d0e587e993d26f1818b1c cifs: replaced kmalloc +
memset with kzalloc
8f43465d17982767dd5b3f5d48216ef5c100c274 cifs: ignore the unc= and
prefixpath= mount options

and I merged one so far after it that Jeff had already rebased ontop
of Joe's large patch

457d2157ec2da6f9fa755e16ab740979f581e328 cifs: remove ENOSPC handling
in smb_sendv

So ... going forward for 3.10 make sure to fixup subsequent new cifs
patches ontop Joe's large "cifs: Rename cERROR and cFYI to cifs_dbg"
patch or else it will make merging a mess since Joe's patch changes
just about very cifs file due to the macro renaming.



-- 
Thanks,

Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH -next] backlight: adp8870: fix error return code in adp8870_led_probe()

[Jingoo Han]

On Friday, March 22, 2013 8:31 PM, Wei Yongjun wrote:
> 
> From: Wei Yongjun 
> 
> Fix to return a negative error code from the error handling
> case instead of 0, as returned elsewhere in this function.
> 
> Signed-off-by: Wei Yongjun 

CC'ed Andrdew Morton, linux-kernel@vger.kernel.org


Acked-by: Jingoo Han 

> ---
>  drivers/video/backlight/adp8870_bl.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/video/backlight/adp8870_bl.c 
> b/drivers/video/backlight/adp8870_bl.c
> index 302c800..759bf23 100644
> --- a/drivers/video/backlight/adp8870_bl.c
> +++ b/drivers/video/backlight/adp8870_bl.c
> @@ -274,12 +274,14 @@ static int adp8870_led_probe(struct i2c_client *client)
>   if (led_dat->id > 7 || led_dat->id < 1) {
>   dev_err(>dev, "Invalid LED ID %d\n",
>   led_dat->id);
> + ret = -EINVAL;
>   goto err;
>   }
> 
>   if (pdata->bl_led_assign & (1 << (led_dat->id - 1))) {
>   dev_err(>dev, "LED %d used by Backlight\n",
>   led_dat->id);
> + ret = -EBUSY;
>   goto err;
>   }
> 
> 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-fbdev" in
> the body of a message to majord...@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH] arch/powerpc/kernel: using %12.12s instead of %12s for avoiding memory overflow.

[Chen Gang]

Hello Maintainers:

  could you help check this patch whether is ok ?

  thanks.


On 2013年02月17日 12:00, Chen Gang wrote:
> Hello relative members:
> 
>   please give a glance to this patch, when you have time.
> 
>   thanks.
> 
>   :-)
> 
> gchen.
> 
> 
> 于 2013年01月24日 12:14, Chen Gang 写道:
>>
>>   for tmp_part->header.name:
>> it is "Terminating null required only for names < 12 chars".
>> so need to limit the %.12s for it in printk
>>
>>   additional info:
>>
>> %12s  limit the width, not for the original string output length
>>   if name length is more than 12, it still can be fully displayed.
>>   if name length is less than 12, the ' ' will be filled before name.
>>
>> %.12s truly limit the original string output length (precision)
>>
>>
>> Signed-off-by: Chen Gang 
>> ---
>>  arch/powerpc/kernel/nvram_64.c |2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/arch/powerpc/kernel/nvram_64.c b/arch/powerpc/kernel/nvram_64.c
>> index bec1e93..57bf6d2 100644
>> --- a/arch/powerpc/kernel/nvram_64.c
>> +++ b/arch/powerpc/kernel/nvram_64.c
>> @@ -202,7 +202,7 @@ static void __init nvram_print_partitions(char * label)
>>  printk(KERN_WARNING "%s-\n", label);
>>  printk(KERN_WARNING "indx\t\tsig\tchks\tlen\tname\n");
>>  list_for_each_entry(tmp_part, _partitions, partition) {
>> -printk(KERN_WARNING "%4d\t%02x\t%02x\t%d\t%12s\n",
>> +printk(KERN_WARNING "%4d\t%02x\t%02x\t%d\t%12.12s\n",
>> tmp_part->index, tmp_part->header.signature,
>> tmp_part->header.checksum, tmp_part->header.length,
>> tmp_part->header.name);
>>
> 
> 


-- 
Chen Gang

Asianux Corporation
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH -next] backlight: adp8860: fix error return code in adp8860_led_probe()

[Jingoo Han]

On Friday, March 22, 2013 8:30 PM, Wei Yongjun wrote:
> 
> From: Wei Yongjun 
> 
> Fix to return a negative error code from the error handling
> case instead of 0, as returned elsewhere in this function.
> 
> Signed-off-by: Wei Yongjun 

CC'ed Andrdew Morton, linux-kernel@vger.kernel.org


Acked-by: Jingoo Han 

> ---
>  drivers/video/backlight/adp8860_bl.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/video/backlight/adp8860_bl.c 
> b/drivers/video/backlight/adp8860_bl.c
> index 6bb7f36..75b10f8 100644
> --- a/drivers/video/backlight/adp8860_bl.c
> +++ b/drivers/video/backlight/adp8860_bl.c
> @@ -249,12 +249,14 @@ static int adp8860_led_probe(struct i2c_client *client)
>   if (led_dat->id > 7 || led_dat->id < 1) {
>   dev_err(>dev, "Invalid LED ID %d\n",
>   led_dat->id);
> + ret = -EINVAL;
>   goto err;
>   }
> 
>   if (pdata->bl_led_assign & (1 << (led_dat->id - 1))) {
>   dev_err(>dev, "LED %d used by Backlight\n",
>   led_dat->id);
> + ret = -EBUSY;
>   goto err;
>   }
> 
> 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-fbdev" in
> the body of a message to majord...@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH] PowerPC:kernel: section mismatch from smp_release_cpus to __initdata spinning_secondaries

[Chen Gang]

Hello Maintainers:

  could you help check this patch whether is ok ?

  thanks.


On 2013年03月20日 14:30, Chen Gang wrote:
> 
>   the smp_release_cpus is a normal funciton and called in normal environments,
>   but it calls the __initdata spinning_secondaries.
>   need modify spinning_secondaries to match smp_release_cpus.
> 
> the related warning:
>   (the linker report boot_paca.33377, but it should be spinning_secondaries)
> 
> -
> 
> WARNING: arch/powerpc/kernel/built-in.o(.text+0x23176): Section mismatch in 
> reference from the function .smp_release_cpus() to the variable 
> .init.data:boot_paca.33377
> The function .smp_release_cpus() references
> the variable __initdata boot_paca.33377.
> This is often because .smp_release_cpus lacks a __initdata 
> annotation or the annotation of boot_paca.33377 is wrong.
> 
> WARNING: arch/powerpc/kernel/built-in.o(.text+0x231fe): Section mismatch in 
> reference from the function .smp_release_cpus() to the variable 
> .init.data:boot_paca.33377
> The function .smp_release_cpus() references
> the variable __initdata boot_paca.33377.
> This is often because .smp_release_cpus lacks a __initdata 
> annotation or the annotation of boot_paca.33377 is wrong.
> 
> -
> 
> 
> 
> Signed-off-by: Chen Gang 
> ---
>  arch/powerpc/kernel/setup_64.c |2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
> index 75fbaceb..e8a2f2e 100644
> --- a/arch/powerpc/kernel/setup_64.c
> +++ b/arch/powerpc/kernel/setup_64.c
> @@ -76,7 +76,7 @@
>  #endif
>  
>  int boot_cpuid = 0;
> -int __initdata spinning_secondaries;
> +int spinning_secondaries;
>  u64 ppc64_pft_size;
>  
>  /* Pick defaults since we might want to patch instructions
> 


-- 
Chen Gang

Asianux Corporation
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH] fs: cifs: use kmemdup instead of kmalloc + memcpy

[Steve French]

Merged into cifs-2.6.git (for-next branch)

On Mon, Mar 11, 2013 at 11:22 AM, Silviu-Mihai Popescu
 wrote:
> This replaces calls to kmalloc followed by memcpy with a single call to
> kmemdup. This was found via make coccicheck.
>
> Signed-off-by: Silviu-Mihai Popescu 
> ---
>  fs/cifs/cifs_spnego.c |3 +--
>  fs/cifs/cifsacl.c |3 +--
>  fs/cifs/cifssmb.c |3 +--
>  fs/cifs/sess.c|8 
>  4 files changed, 7 insertions(+), 10 deletions(-)
>
> diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
> index 10e7747..b7ae3cb 100644
> --- a/fs/cifs/cifs_spnego.c
> +++ b/fs/cifs/cifs_spnego.c
> @@ -37,12 +37,11 @@ cifs_spnego_key_instantiate(struct key *key, struct 
> key_preparsed_payload *prep)
> int ret;
>
> ret = -ENOMEM;
> -   payload = kmalloc(prep->datalen, GFP_KERNEL);
> +   payload = kmemdup(prep->data, prep->datalen, GFP_KERNEL);
> if (!payload)
> goto error;
>
> /* attach the data */
> -   memcpy(payload, prep->data, prep->datalen);
> key->payload.data = payload;
> ret = 0;
>
> diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
> index f1e3f25..0bba930 100644
> --- a/fs/cifs/cifsacl.c
> +++ b/fs/cifs/cifsacl.c
> @@ -63,11 +63,10 @@ cifs_idmap_key_instantiate(struct key *key, struct 
> key_preparsed_payload *prep)
> key->datalen = prep->datalen;
> return 0;
> }
> -   payload = kmalloc(prep->datalen, GFP_KERNEL);
> +   payload = kmemdup(prep->data, prep->datalen, GFP_KERNEL);
> if (!payload)
> return -ENOMEM;
>
> -   memcpy(payload, prep->data, prep->datalen);
> key->payload.data = payload;
> key->datalen = prep->datalen;
> return 0;
> diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
> index 7353bc5..d900bf0 100644
> --- a/fs/cifs/cifssmb.c
> +++ b/fs/cifs/cifssmb.c
> @@ -3742,12 +3742,11 @@ CIFSSMBGetCIFSACL(const unsigned int xid, struct 
> cifs_tcon *tcon, __u16 fid,
> rc = -EINVAL;
> *pbuflen = 0;
> } else {
> -   *acl_inf = kmalloc(*pbuflen, GFP_KERNEL);
> +   *acl_inf = kmemdup(pdata, *pbuflen, GFP_KERNEL);
> if (*acl_inf == NULL) {
> *pbuflen = 0;
> rc = -ENOMEM;
> }
> -   memcpy(*acl_inf, pdata, *pbuflen);
> }
> }
>  qsec_out:
> diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
> index 76809f4..6f83881 100644
> --- a/fs/cifs/sess.c
> +++ b/fs/cifs/sess.c
> @@ -399,12 +399,12 @@ int decode_ntlmssp_challenge(char *bcc_ptr, int 
> blob_len,
> return -EINVAL;
> }
> if (tilen) {
> -   ses->auth_key.response = kmalloc(tilen, GFP_KERNEL);
> +   ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
> +GFP_KERNEL);
> if (!ses->auth_key.response) {
> cERROR(1, "Challenge target info allocation failure");
> return -ENOMEM;
> }
> -   memcpy(ses->auth_key.response, bcc_ptr + tioffset, tilen);
> ses->auth_key.len = tilen;
> }
>
> @@ -761,14 +761,14 @@ ssetup_ntlmssp_authenticate:
> goto ssetup_exit;
> }
>
> -   ses->auth_key.response = kmalloc(msg->sesskey_len, 
> GFP_KERNEL);
> +   ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
> +GFP_KERNEL);
> if (!ses->auth_key.response) {
> cERROR(1, "Kerberos can't allocate (%u bytes) memory",
> msg->sesskey_len);
> rc = -ENOMEM;
> goto ssetup_exit;
> }
> -   memcpy(ses->auth_key.response, msg->data, msg->sesskey_len);
> ses->auth_key.len = msg->sesskey_len;
>
> pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
> --
> 1.7.9.5
>



-- 
Thanks,

Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

linux-next: manual merge of the akpm tree with Linus' tree

[Stephen Rothwell]

Hi Andrew,

Today's linux-next merge of the akpm tree got a conflict in
fs/proc/inode.c between commit  ("vfs,proc: guarantee unique inodes
in /proc") from Linus' tree and commit
"procfs-improve-scaling-in-proc-v5" from the akpm tree.

I fixed it up (see below) and can carry the fix as necessary (no action
is required).

-- 
Cheers,
Stephen Rothwells...@canb.auug.org.au

diff --cc fs/proc/inode.c
index 38f0775,f53660a..000
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@@ -463,10 -464,10 +464,11 @@@ static const struct file_operations pro
  
  struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry 
*de)
  {
 -  struct inode *inode = iget_locked(sb, de->low_ino);
 +  struct inode *inode = new_inode_pseudo(sb);
+   const struct file_operations *fops;
  
 -  if (inode && (inode->i_state & I_NEW)) {
 +  if (inode) {
 +  inode->i_ino = de->low_ino;
inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
PROC_I(inode)->pde = de;
  
@@@ -491,9 -494,11 +495,10 @@@
  #endif
inode->i_fop = _reg_file_ops;
} else {
-   inode->i_fop = de->proc_fops;
+   inode->i_fop = fops;
}
}
+   rcu_read_unlock();
 -  unlock_new_inode(inode);
} else
   pde_put(de);
return inode;


pgps5KMI0e0_i.pgp
Description: PGP signature

Re: [PATCH] cifs: replaced kmalloc + memset with kzalloc

[Steve French]

Merged into cifs-2.6.git for-next branch

On Sun, Mar 10, 2013 at 7:29 AM, Dia Vasile
 wrote:
> From: Dia Vasile 
>
> Signed-off-by: Diana Vasile 
> ---
>  fs/cifs/smb2pdu.c |4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
> index 41d9d07..83ef66e 100644
> --- a/fs/cifs/smb2pdu.c
> +++ b/fs/cifs/smb2pdu.c
> @@ -846,12 +846,10 @@ create_lease_buf(u8 *lease_key, u8 oplock)
>  {
> struct create_lease *buf;
>
> -   buf = kmalloc(sizeof(struct create_lease), GFP_KERNEL);
> +   buf = kzalloc(sizeof(struct create_lease), GFP_KERNEL);
> if (!buf)
> return NULL;
>
> -   memset(buf, 0, sizeof(struct create_lease));
> -
> buf->lcontext.LeaseKeyLow = cpu_to_le64(*((u64 *)lease_key));
> buf->lcontext.LeaseKeyHigh = cpu_to_le64(*((u64 *)(lease_key + 8)));
> if (oplock == SMB2_OPLOCK_LEVEL_EXCLUSIVE)
> --
> 1.7.10.4
>



-- 
Thanks,

Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH 1/1] watchdog:improve w83627hf_wdt to timeout in minutes

[Tony Chung]

The current maximum of 255 seconds is insufficient.
For example, crash dump could take 5+ minutes.

Signed-off-by: Tony Chung 
---
 drivers/watchdog/w83627hf_wdt.c |   73 ++
 1 files changed, 57 insertions(+), 16 deletions(-)

diff --git a/drivers/watchdog/w83627hf_wdt.c b/drivers/watchdog/w83627hf_wdt.c
index 92f1326..d26adfb 100644
--- a/drivers/watchdog/w83627hf_wdt.c
+++ b/drivers/watchdog/w83627hf_wdt.c
@@ -58,7 +58,7 @@ MODULE_PARM_DESC(wdt_io, "w83627hf/thf WDT io port (default 
0x2E)");
 static int timeout = WATCHDOG_TIMEOUT; /* in seconds */
 module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout,
-   "Watchdog timeout in seconds. 1 <= timeout <= 255, default="
+   "Watchdog timeout in seconds. 1 <= timeout <= 15300, default="
__MODULE_STRING(WATCHDOG_TIMEOUT) ".");
 
 static bool nowayout = WATCHDOG_NOWAYOUT;
@@ -67,6 +67,29 @@ MODULE_PARM_DESC(nowayout,
"Watchdog cannot be stopped once started (default="
__MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
+/* timeout unit in minute */
+static bool use_minute;
+static char *unit;
+static int max_timeout = 15300; /* 255*60 seconds */
+
+static inline int wdt_round_secs_to_minute(int t)
+{
+   return (t + 59) / 60;
+}
+
+static inline int wdt_use_minute(int t)
+{
+   if (t > 255) {
+   t = wdt_round_secs_to_minute(t);
+   use_minute = 1;
+   unit = "minutes";
+   } else {
+   use_minute = 0;
+   unit = "secs";
+   }
+   return t;
+}
+
 /*
  * Kernel methods.
  */
@@ -107,6 +130,23 @@ static void w83627hf_unselect_wd_register(void)
outb_p(0xAA, WDT_EFER); /* Leave extended function mode */
 }
 
+/* set CRF5 register */
+static void w83627hf_set_crf5(void)
+{
+   unsigned char t;
+
+   outb_p(0xF5, WDT_EFER); /* Select CRF5 */
+   t = inb_p(WDT_EFDR);  /* read CRF5 */
+   t &= ~0x0C;   /* set second mode & disable keyboard
+   turning off watchdog */
+   t |= 0x02;/* enable the WDTO# output low pulse
+   to the KBRST# pin (PIN60) */
+   if (use_minute)
+   t |= 0x80;/* set timeout in minute */
+
+   outb_p(t, WDT_EFDR);/* Write back to CRF5 */
+}
+
 /* tyan motherboards seem to set F5 to 0x4C ?
  * So explicitly init to appropriate value. */
 
@@ -116,21 +156,16 @@ static void w83627hf_init(void)
 
w83627hf_select_wd_register();
 
+   w83627hf_set_crf5();
+
outb_p(0xF6, WDT_EFER); /* Select CRF6 */
t = inb_p(WDT_EFDR);  /* read CRF6 */
if (t != 0) {
-   pr_info("Watchdog already running. Resetting timeout to %d 
sec\n",
-   timeout);
+   pr_info("Watchdog already running.  Reset timeout to %d %s\n",
+   timeout, unit);
outb_p(timeout, WDT_EFDR);/* Write back to CRF6 */
}
 
-   outb_p(0xF5, WDT_EFER); /* Select CRF5 */
-   t = inb_p(WDT_EFDR);  /* read CRF5 */
-   t &= ~0x0C;   /* set second mode & disable keyboard
-   turning off watchdog */
-   t |= 0x02;/* enable the WDTO# output low pulse
-   to the KBRST# pin (PIN60) */
-   outb_p(t, WDT_EFDR);/* Write back to CRF5 */
 
outb_p(0xF7, WDT_EFER); /* Select CRF7 */
t = inb_p(WDT_EFDR);  /* read CRF7 */
@@ -147,6 +182,9 @@ static void wdt_set_time(int timeout)
 
w83627hf_select_wd_register();
 
+   if (use_minute)
+   w83627hf_set_crf5();
+
outb_p(0xF6, WDT_EFER);/* Select CRF6 */
outb_p(timeout, WDT_EFDR); /* Write Timeout counter to CRF6 */
 
@@ -169,9 +207,9 @@ static int wdt_disable(void)
 
 static int wdt_set_heartbeat(int t)
 {
-   if (t < 1 || t > 255)
+   if (t < 1 || t > max_timeout)
return -EINVAL;
-   timeout = t;
+   timeout = wdt_use_minute(t);
return 0;
 }
 
@@ -262,9 +300,11 @@ static long wdt_ioctl(struct file *file, unsigned int cmd, 
unsigned long arg)
wdt_ping();
/* Fall */
case WDIOC_GETTIMEOUT:
-   return put_user(timeout, p);
+   timeval = (use_minute) ? timeout * 60 : timeout;
+   return put_user(timeval, p);
case WDIOC_GETTIMELEFT:
timeval = wdt_get_time();
+   timeval = (use_minute) ? timeval * 60 : timeval;
return put_user(timeval, p);
default:
return -ENOTTY;
@@ -346,7 +386,8 @@ static int __init wdt_init(void)
 
if (wdt_set_heartbeat(timeout)) {
wdt_set_heartbeat(WATCHDOG_TIMEOUT);
-   pr_info("timeout value must be 1 <= timeout <= 255, using %d\n",
+   

[RFC PATCH 5/6] ARM, mm: change meaning of max_low_pfn to maximum pfn for nobootmem

[Joonsoo Kim]

nobootmem use max_low_pfn for computing boundary in free_all_bootmem()
So we need proper value to max_low_pfn.

But, there is some difficulty related to max_low_pfn. max_low_pfn is used
for two meanings in various architectures. One is for number of pages
in lowmem and the other is for maximum lowmem pfn. Now, in ARM, it is used
as number of pages in lowmem. You can get more information in below link.
http://lwn.net/Articles/543408/
http://lwn.net/Articles/543424/

As I investigated, architectures which use max_low_pfn as maximum pfn are
more than others, so to change meaning of max_low_pfn to maximum pfn
is preferable solution to me. This patch change max_low_pfn as maximum
lowmem pfn in ARM. In addition, min_low_pfn, max_pfn is assigned according
to this criteria.

There is no real user for max_low_pfn except block/blk-setting.c and
blk-setting.c assume that max_low_pfn is maximum lowmem pfn,
so this patch may not harm anything.

Signed-off-by: Joonsoo Kim 

diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 049414a..873f4ca 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -423,12 +423,10 @@ void __init bootmem_init(void)
 * This doesn't seem to be used by the Linux memory manager any
 * more, but is used by ll_rw_block.  If we can get rid of it, we
 * also get rid of some of the stuff above as well.
-*
-* Note: max_low_pfn and max_pfn reflect the number of _pages_ in
-* the system, not the maximum PFN.
 */
-   max_low_pfn = max_low - PHYS_PFN_OFFSET;
-   max_pfn = max_high - PHYS_PFN_OFFSET;
+   min_low_pfn = min;
+   max_low_pfn = max_low;
+   max_pfn = max_high;
 }
 
 static inline int free_area(unsigned long pfn, unsigned long end, char *s)
@@ -544,7 +542,7 @@ static void __init free_unused_memmap(struct meminfo *mi)
 static void __init free_highpages(void)
 {
 #ifdef CONFIG_HIGHMEM
-   unsigned long max_low = max_low_pfn + PHYS_PFN_OFFSET;
+   unsigned long max_low = max_low_pfn;
struct memblock_region *mem, *res;
 
/* set highmem page free */
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[RFC PATCH 6/6] ARM, mm: enable NO_BOOTMEM for default ARM build

[Joonsoo Kim]

If we use NO_BOOTMEM, we don't need to initialize a bitmap and
we don't need to do bitmap operation, so we can boot slightly faster.

Additionaly advantage of enabling NO_BOOTMEM is saving more memory.
bootmem allocator manage memories as page unit, so if we request
4 bytes area to bootmem, it actually give us PAGE_SIZE area.
nobootmem manage memory as byte unit, so there is no waste.

Signed-off-by: Joonsoo Kim 

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 13b7394..8b73417 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -58,6 +58,7 @@ config ARM
select CLONE_BACKWARDS
select OLD_SIGSUSPEND3
select OLD_SIGACTION
+   select NO_BOOTMEM
help
  The ARM series is a line of low-power-consumption RISC chip designs
  licensed by ARM Ltd and targeted at embedded applications and
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[RFC PATCH 3/6] ARM, crashkernel: correct total_mem size in reserve_crashkernel()

[Joonsoo Kim]

There is some platforms which have highmem, so this equation
doesn't represent total_mem size properly.
In addition, max_low_pfn's meaning is different in other architecture and
it is scheduled to be changed, so remove related code to max_low_pfn.

Signed-off-by: Joonsoo Kim 

diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 99ffe87..1149988 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -655,14 +655,6 @@ static int __init init_machine_late(void)
 late_initcall(init_machine_late);
 
 #ifdef CONFIG_KEXEC
-static inline unsigned long long get_total_mem(void)
-{
-   unsigned long total;
-
-   total = max_low_pfn - min_low_pfn;
-   return total << PAGE_SHIFT;
-}
-
 /**
  * reserve_crashkernel() - reserves memory are for crash kernel
  *
@@ -677,7 +669,7 @@ static void __init reserve_crashkernel(void)
unsigned long limit = 0;
int ret;
 
-   total_mem = get_total_mem();
+   total_mem = memblock_phys_mem_size();
ret = parse_crashkernel(boot_command_line, total_mem,
_size, _base);
if (ret != 0 || crash_size == 0)
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[RFC PATCH 2/6] ARM, crashkernel: use ___alloc_bootmem_node_nopanic() for reserving memory

[Joonsoo Kim]

For crashkernel, specific address should be reserved.
It can be achived by reserve_bootmem(), but this function is
only for bootmem.

Now, we try to enable nobootmem, therfore change it more general function,
___alloc_bootmem_node_nopanic(). It can be use for both,
bootmem and nobootmem.

Signed-off-by: Joonsoo Kim 

diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index b3990a3..99ffe87 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -674,15 +674,20 @@ static void __init reserve_crashkernel(void)
 {
unsigned long long crash_size, crash_base;
unsigned long long total_mem;
+   unsigned long limit = 0;
int ret;
 
total_mem = get_total_mem();
ret = parse_crashkernel(boot_command_line, total_mem,
_size, _base);
-   if (ret)
+   if (ret != 0 || crash_size == 0)
return;
 
-   ret = reserve_bootmem(crash_base, crash_size, BOOTMEM_EXCLUSIVE);
+   if (crash_base != 0)
+   limit = crash_base + crash_size;
+
+   ret = ___alloc_bootmem_node_nopanic(NODE_DATA(0), crash_size,
+   PAGE_ALIGN, crash_base, limit);
if (ret < 0) {
printk(KERN_WARNING "crashkernel reservation failed - "
   "memory is in use (0x%lx)\n", (unsigned long)crash_base);
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[RFC PATCH 1/6] ARM, TCM: initialize TCM in paging_init(), instead of setup_arch()

[Joonsoo Kim]

tcm_init() call iotable_init() and it use early_alloc variants which
do memblock allocation. Directly using memblock allocation after
initializing bootmem should not permitted, because bootmem can't know
where are additinally reserved.
So move tcm_init() to a safe place before initalizing bootmem.

Signed-off-by: Joonsoo Kim 

diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 3f6cbb2..b3990a3 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -56,7 +56,6 @@
 #include 
 
 #include "atags.h"
-#include "tcm.h"
 
 
 #if defined(CONFIG_FPE_NWFPE) || defined(CONFIG_FPE_FASTFPE)
@@ -778,8 +777,6 @@ void __init setup_arch(char **cmdline_p)
 
reserve_crashkernel();
 
-   tcm_init();
-
 #ifdef CONFIG_MULTI_IRQ_HANDLER
handle_arch_irq = mdesc->handle_irq;
 #endif
diff --git a/arch/arm/kernel/tcm.c b/arch/arm/kernel/tcm.c
index 30ae6bb..f50f19e 100644
--- a/arch/arm/kernel/tcm.c
+++ b/arch/arm/kernel/tcm.c
@@ -17,7 +17,6 @@
 #include 
 #include 
 #include 
-#include "tcm.h"
 
 static struct gen_pool *tcm_pool;
 static bool dtcm_present;
diff --git a/arch/arm/kernel/tcm.h b/arch/arm/kernel/tcm.h
deleted file mode 100644
index 8015ad4..000
--- a/arch/arm/kernel/tcm.h
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright (C) 2008-2009 ST-Ericsson AB
- * License terms: GNU General Public License (GPL) version 2
- * TCM memory handling for ARM systems
- *
- * Author: Linus Walleij 
- * Author: Rickard Andersson 
- */
-
-#ifdef CONFIG_HAVE_TCM
-void __init tcm_init(void);
-#else
-/* No TCM support, just blank inlines to be optimized out */
-inline void tcm_init(void)
-{
-}
-#endif
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index e95a996..a7f127d 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -34,6 +34,7 @@
 #include 
 
 #include "mm.h"
+#include "tcm.h"
 
 /*
  * empty_zero_page is a special page that is used for
@@ -1256,6 +1257,7 @@ void __init paging_init(struct machine_desc *mdesc)
dma_contiguous_remap();
devicemaps_init(mdesc);
kmap_init();
+   tcm_init();
 
top_pmd = pmd_off_k(0x);
 
diff --git a/arch/arm/mm/tcm.h b/arch/arm/mm/tcm.h
new file mode 100644
index 000..8015ad4
--- /dev/null
+++ b/arch/arm/mm/tcm.h
@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) 2008-2009 ST-Ericsson AB
+ * License terms: GNU General Public License (GPL) version 2
+ * TCM memory handling for ARM systems
+ *
+ * Author: Linus Walleij 
+ * Author: Rickard Andersson 
+ */
+
+#ifdef CONFIG_HAVE_TCM
+void __init tcm_init(void);
+#else
+/* No TCM support, just blank inlines to be optimized out */
+inline void tcm_init(void)
+{
+}
+#endif
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[RFC PATCH 0/6] ARM: use NO_BOOTMEM on default configuration

[Joonsoo Kim]

Currently, ARM use traditional 'bootmem' allocator. It use a bitmap for
managing memory space, so initialize a bitmap at first step. It is
a needless overhead if we use 'nobootmem'. 'nobootmem' use a memblock
allocator internally, so there is no additional initializing overhead.
In addition, if we use 'nobootmem', we can save small amount of memory,
because 'nobootmem' manage memory space as byte unit. However, 
'bootmem' manage it as page unit, so some space is wasted,
although it is very small. On my system, 20 KB memories can be saved. :)
Using 'nobootmem' have another advantage. Before initializing 'bootmem'
allocator, we use memblock allocator. If we use memblock allocator
after initializing 'bootmem' by mistake, there is possible problem.
Patch '1/6' is good example of this case. 'nobootmem' use memblock
allocator internally, so these risk will be disappeared.

There is one stopper to enable NO_BOOTMEM, it is max_low_pfn.
nobootmem use max_low_pfn for computing boundary in free_all_bootmem()
So we need proper value to max_low_pfn.
But, there is some difficulty related to max_low_pfn. max_low_pfn is used
for two meanings in various architectures. One is for number of pages
in lowmem and the other is for maximum lowmem pfn. Now, in ARM, it is used
as number of pages in lowmem. You can get more information in below link.
http://lwn.net/Articles/543408/
http://lwn.net/Articles/543424/

As I investigated, architectures which use max_low_pfn as maximum pfn are
more than others, so IMHO, to change meaning of max_low_pfn to maximum pfn
is preferable solution to me. This patchset change max_low_pfn as maximum
lowmem pfn in ARM. In addition, min_low_pfn, max_pfn is assigned according
to this criteria.

AFAIK, there is no real user for max_low_pfn except block/blk-setting.c
and blk-setting.c assume that max_low_pfn is maximum lowmem pfn,
so this patch may not harm anything. But, I'm not expert about this,
so please let me know what I am missing.

I did some working test on my android device and it worked. :)
Feel free to give me some opinion about this patset.
This patchset is based on v3.9-rc4.

Thanks.

Joonsoo Kim (6):
  ARM, TCM: initialize TCM in paging_init(), instead of setup_arch()
  ARM, crashkernel: use ___alloc_bootmem_node_nopanic() for reserving
memory
  ARM, crashkernel: correct total_mem size in reserve_crashkernel()
  ARM, mm: don't do arm_bootmem_init() if CONFIG_NO_BOOTMEM
  ARM, mm: change meaning of max_low_pfn to maximum pfn for nobootmem
  ARM, mm: enable NO_BOOTMEM for default ARM build

 arch/arm/Kconfig|1 +
 arch/arm/kernel/setup.c |   22 --
 arch/arm/kernel/tcm.c   |1 -
 arch/arm/kernel/tcm.h   |   17 -
 arch/arm/mm/init.c  |   19 ---
 arch/arm/mm/mmu.c   |2 ++
 arch/arm/mm/tcm.h   |   17 +
 7 files changed, 40 insertions(+), 39 deletions(-)
 delete mode 100644 arch/arm/kernel/tcm.h
 create mode 100644 arch/arm/mm/tcm.h

-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[RFC PATCH 4/6] ARM, mm: don't do arm_bootmem_init() if CONFIG_NO_BOOTMEM

[Joonsoo Kim]

arm_bootmem_init() initialize a bitmap for bootmem and
it is not needed for CONFIG_NO_BOOTMEM.
So skip it when CONFIG_NO_BOOTMEM.

Signed-off-by: Joonsoo Kim 

diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index ad722f1..049414a 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -149,6 +149,12 @@ static void __init find_limits(unsigned long *min, 
unsigned long *max_low,
*max_high = bank_pfn_end(>bank[mi->nr_banks - 1]);
 }
 
+#ifdef CONFIG_NO_BOOTMEM
+static inline void __init arm_bootmem_init(unsigned long start_pfn,
+   unsigned long end_pfn)
+{
+}
+#else
 static void __init arm_bootmem_init(unsigned long start_pfn,
unsigned long end_pfn)
 {
@@ -169,7 +175,6 @@ static void __init arm_bootmem_init(unsigned long start_pfn,
 * Initialise the bootmem allocator, handing the
 * memory banks over to bootmem.
 */
-   node_set_online(0);
pgdat = NODE_DATA(0);
init_bootmem_node(pgdat, __phys_to_pfn(bitmap), start_pfn, end_pfn);
 
@@ -200,6 +205,7 @@ static void __init arm_bootmem_init(unsigned long start_pfn,
(end - start) << PAGE_SHIFT, BOOTMEM_DEFAULT);
}
 }
+#endif
 
 #ifdef CONFIG_ZONE_DMA
 
@@ -392,6 +398,7 @@ void __init bootmem_init(void)
 
find_limits(, _low, _high);
 
+   node_set_online(0);
arm_bootmem_init(min, max_low);
 
/*
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH v3] ata: Fix DVD not dectected at some Haswell platforms

[Youquan Song]

> 
> Can you look at the patch which required by some Haswell platforms?
> 
Hi Jeff,

What's your opinion about the patch? It block the installation on some
new platforms.

Thanks
-Youquan 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: Question: How to distribute the interrupts over multiple cores?

[Lenky Gao]

> On 03/25/2013 11:18 AM, Lenky Gao wrote:
>> The irqbalance service has been stopped.
> So try start irqbalance to see what happen?
> It should help to give what you want ;-)

Using the irqbalance service to dynamically change the IRQ-bound? It's
seems a software solution. In my old machine, there is no this
problem. I need some information to explain why. Maybe is the
apic_physflat mode only support distribute the interrupts to one
processor, but i am not exactly sure if this is right? Or my E5504
Machine's hardware issue?

-- 
Regards,

Lenky
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH 02/29] x86, tsx: Add RTM intrinsics

[Michael Neuling]

> From: Andi Kleen 
> 
> This adds the basic RTM (Restricted Transactional Memory)
> intrinsics for TSX, implemented with alternative() so that they can be
> transparently used without checking CPUID first.
> 
> When the CPU does not support TSX we just always jump to the abort handler.
> 
> These intrinsics are only expected to be used by some low level code
> that presents higher level interface (like locks).
> 
> This is using the same interface as gcc and icc. There's a way to implement
> the intrinsics more efficiently with newer compilers that support asm goto,
> but to avoid undue dependencies on new tool chains this is not used here.
> 
> Also the current way looks slightly nicer, at the cost of only two more
> instructions.
> 
> Also don't require a TSX aware assembler -- all new instructions are 
> implemented
> with .byte.
> 
> Signed-off-by: Andi Kleen 
> ---
>  arch/x86/include/asm/rtm.h |   82 
> 
>  1 files changed, 82 insertions(+), 0 deletions(-)
>  create mode 100644 arch/x86/include/asm/rtm.h
> 
> diff --git a/arch/x86/include/asm/rtm.h b/arch/x86/include/asm/rtm.h
> new file mode 100644
> index 000..7075a04
> --- /dev/null
> +++ b/arch/x86/include/asm/rtm.h
> @@ -0,0 +1,82 @@
> +#ifndef _RTM_OFFICIAL_H
> +#define _RTM_OFFICIAL_H 1
> +
> +#include 
> +#include 
> +#include 
> +#include 
> +
> +/*
> + * RTM -- restricted transactional memory ISA
> + *
> + * Official RTM intrinsics interface matching gcc/icc, but works
> + * on older gcc compatible compilers and binutils.
> + *
> + * _xbegin() starts a transaction. When it returns a value different
> + * from _XBEGIN_STARTED a non transactional fallback path
> + * should be executed.
> + *
> + * This is a special kernel variant that supports binary patching.
> + * When the CPU does not support RTM we always jump to the abort handler.
> + * And _xtest() always returns 0.
> +
> + * This means these intrinsics can be used without checking cpu_has_rtm
> + * first.
> + *
> + * This is the low level interface mapping directly to the instructions.
> + * Usually kernel code will use a higher level abstraction instead (like 
> locks)
> + *
> + * Note this can be implemented more efficiently on compilers that support
> + * "asm goto". But we don't want to require this right now.
> + */
> +
> +#define _XBEGIN_STARTED  (~0u)
> +#define _XABORT_EXPLICIT (1 << 0)
> +#define _XABORT_RETRY(1 << 1)
> +#define _XABORT_CONFLICT (1 << 2)
> +#define _XABORT_CAPACITY (1 << 3)
> +#define _XABORT_DEBUG(1 << 4)
> +#define _XABORT_NESTED   (1 << 5)
> +#define _XABORT_CODE(x)  (((x) >> 24) & 0xff)
> +
> +#define _XABORT_SOFTWARE -5  /* not part of ISA */
> +
> +static __always_inline int _xbegin(void)
> +{
> + int ret;
> + alternative_io("mov %[fallback],%[ret] ; " ASM_NOP6,
> +"mov %[started],%[ret] ; "
> +".byte 0xc7,0xf8 ; .long 0 # XBEGIN 0",
> +X86_FEATURE_RTM,
> +[ret] "=a" (ret),
> +[fallback] "i" (_XABORT_SOFTWARE),
> +[started] "i" (_XBEGIN_STARTED) : "memory");
> + return ret;
> +}

So ppc can do something like this.  Stealing from
Documentation/powerpc/transactional_memory.txt, ppc transactions looks
like this:

  tbegin
  beq   abort_handler

  ldr4, SAVINGS_ACCT(r3)
  ldr5, CURRENT_ACCT(r3)
  subi  r5, r5, 1
  addi  r4, r4, 1
  std   r4, SAVINGS_ACCT(r3)
  std   r5, CURRENT_ACCT(r3)

  tend

  b continue

abort_handler:
  ... test for odd failures ...

  /* Retry the transaction if it failed because it conflicted with
   * someone else: */
  b begin_move_money

The abort handler can then see the failure reason via an SPR/status
register TEXASR.  There are bits in there to specify faulure modes like:

  - software failure code (set in the kernel/hypervisor.  see
  arch/powerpc/include/asm/reg.h)
#define TM_CAUSE_RESCHED0xfe
#define TM_CAUSE_TLBI   0xfc
#define TM_CAUSE_FAC_UNAV   0xfa
#define TM_CAUSE_SYSCALL0xf9 /* Persistent */
#define TM_CAUSE_MISC   0xf6
#define TM_CAUSE_SIGNAL 0xf4
  - Failure persistent
  - Disallowed (like disallowed instruction)
  - Nested overflow
  - footprint overflow
  - self induced conflict
  - non-transaction conflict
  - transaction conflict
  - instruction fetch conflict
  - tabort instruction
  - falure while transaction was suspended 

Some of these overlap with the x86 but I think the fidelity could be
improved.

FYI the TM spec can be downloaded here:
  https://www.power.org/documentation/power-isa-transactional-memory/

You're example code looks like this:

static __init int rtm_test(void)
{
unsigned status;

pr_info("simple rtm test\n");
if ((status = _xbegin()) == _XBEGIN_STARTED) {
x++;
  

Re: [PATCH 01/29] tsx: Add generic noop macros for RTM intrinsics

[Michael Neuling]

> From: Andi Kleen 
> 
> Add generic noop macros (act like transaction aborted) for RTM.
> The main use case is an occasional _xtest() added to generic
> code, without needing ifdefs. On x86+RTM this will use
> real TSX instructions.
> 
> Signed-off-by: Andi Kleen 
> ---
>  include/linux/rtm.h |   15 +++
>  1 files changed, 15 insertions(+), 0 deletions(-)
>  create mode 100644 include/linux/rtm.h
> 
> diff --git a/include/linux/rtm.h b/include/linux/rtm.h

RTM == restricted transactional memory.  I don't understand why it's
"restricted" and why any other architecture else would call it that and
hence why Linux should call it that?

Can we just call it TM for transactional memory?  Each arch can then
have their own implementation and call it what they want.

> new file mode 100644
> index 000..887b221
> --- /dev/null
> +++ b/include/linux/rtm.h
> @@ -0,0 +1,15 @@
> +#ifndef _LINUX_RTM
> +#define _LINUX_RTM 1
> +
> +#ifdef CONFIG_RTM_LOCKS
> +#include 
> +#else
> +/* Make transactions appear as always abort */
> +#define _XBEGIN_STARTED 0
> +#define _xbegin() 1
> +#define _xtest()  0
> +#define _xend()   do {} while (0)
> +#define _xabort(x) do {} while (0)

Similarly.. these are clearly x86 centric.  Can we just call them
tmbegin, tmtest, tm... etc?

Mikey

> +#endif
> +
> +#endif
> -- 
> 1.7.7.6
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majord...@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH 06/29] checkpatch: Don't warn about if ((status = _xbegin()) == _XBEGIN_STARTED)

[Michael Neuling]

> From: Andi Kleen 
> 
> Writing _xbegin which is like setjmp in a if is very natural.
> Stop checkpatch's whining about this.

This patch should go in before the RTM tester.  

> 
> Cc: a...@canonical.com
> Signed-off-by: Andi Kleen 
> ---
>  scripts/checkpatch.pl |5 -
>  1 files changed, 4 insertions(+), 1 deletions(-)
> 
> diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
> index b28cc38..659e683 100755
> --- a/scripts/checkpatch.pl
> +++ b/scripts/checkpatch.pl
> @@ -2831,7 +2831,10 @@ sub process {
>   $line =~ /\b(?:if|while|for)\s*\(/ && $line !~ /^.\s*#/) {
>   my ($s, $c) = ($stat, $cond);
>  
> - if ($c =~ /\bif\s*\(.*[^<>!=]=[^=].*/s) {
> + # if ((status = _xbegin()) == _XBEGIN_STARTED) is 
> natural,
> + # so don't warn about this case.
> + if ($c =~ /\bif\s*\(.*[^<>!=]=[^=].*/s &&
> + $c !~ /_xbegin/) {
>   ERROR("ASSIGN_IN_IF",
> "do not use assignment in if condition\n" 
> . $herecurr);
>   }
> -- 
> 1.7.7.6
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majord...@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH V3 0/5] Add polling support for 64xx spi controller

[Girish KS]

Hello grant,

any comments on this patch series?


On Wed, Mar 13, 2013 at 12:13 PM, Girish K S  wrote:
> [PATCH 1/5]: fixes the error handling in the interrupt handler
> [PATCH 2/5]: The existing driver support partial polling mode.
>  This patch modifies the current driver to support
>  only polling mode.
> [PATCH 3/5]: provision to support SoC's with dedicated i/o pins
> [PATCH 4/5]: provision to support dedicated cs pin
> [PATCH 5/5]: support exynos5440 SoC in polling mode
>
> Tested this patch on exynos5250 in dma mode, and exynos5440 in
> polling mode.
>
> changes in v3:
> Rebase it to the linus's master branch. After rebase
> there was a logical code change due to the merge of generic dma
> patch. resolved the merge conflicts and tested for the functionality
>
> Girish K S (5):
>   spi: s3c64xx: modified error interrupt handling and init
>   spi: s3c64xx: added support for polling mode
>   spi: s3c64xx: Added provision for non-gpio i/o's
>   spi: s3c64xx: Added provision for dedicated cs pin
>   spi: s3c64xx: Added support for exynos5440 spi
>
>  drivers/spi/spi-s3c64xx.c | 204 
> +-
>  include/linux/platform_data/spi-s3c64xx.h |   3 +
>  2 files changed, 148 insertions(+), 59 deletions(-)
>
> --
> 1.8.0
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: Question: How to distribute the interrupts over multiple cores?

[Lin Feng]

Hi,

On 03/25/2013 11:18 AM, Lenky Gao wrote:
> The irqbalance service has been stopped.
So try start irqbalance to see what happen?
It should help to give what you want ;-)

thanks,
linfeng
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: Question: How to distribute the interrupts over multiple cores?

[Lenky Gao]

> Seems you bind the nic irq to second and third cpu for the bit mask
> you set is 110, so now eth9's irq is working on the 3rd cpu.

> Have you ever tried irqbalance service? It may help to balance irq if the
> irq workload of 3rd cpu is too heavy.


I need the interrupts distribute over multiple cores, such as the
second and third, so i set the mask parameter to 0x3. But only one
core is handling the interrupts. As you can see, just the second cpu's
irq number has increased.

The irqbalance service has been stopped.

-- 
Regards,

Lenky
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH 4/5] power: pm2301_charger: Remove __dev* annotations

[Anton Vorontsov]

On Sun, Mar 10, 2013 at 02:34:08PM +0100, Lars-Peter Clausen wrote:
> The removal of __devinit and friends seems to have overlapped with the 
> addition
> of the pm2301_charger driver. Currently the driver fails to build with the
> following errors:
> 
>   drivers/power/pm2301_charger.c:843:22: error: expected '=', ',', ';', 
> 'asm' or '__attribute__' before 'pm2xxx_wall_charger_probe'
>   drivers/power/pm2301_charger.c:1013:22: error: expected '=', ',', ';', 
> 'asm' or '__attribute__' before 'pm2xxx_wall_charger_remove'
>   drivers/power/pm2301_charger.c:1049:11: error: 
> 'pm2xxx_wall_charger_probe' undeclared here (not in a function)
>   drivers/power/pm2301_charger.c:1050:2: error: implicit declaration of 
> function '__devexit_p'
>   drivers/power/pm2301_charger.c:1050:24: error: 
> 'pm2xxx_wall_charger_remove' undeclared here (not in a function)
> 
> This patch removes the __dev* annotations, which fixes the build errors.
> 
> Cc: Lee Jones 
> Signed-off-by: Lars-Peter Clausen 

Applied to battery-urgent.git, thanks a lot!

> ---
>  drivers/power/pm2301_charger.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/power/pm2301_charger.c b/drivers/power/pm2301_charger.c
> index ed48d75..ca424b8 100644
> --- a/drivers/power/pm2301_charger.c
> +++ b/drivers/power/pm2301_charger.c
> @@ -851,7 +851,7 @@ static int pm2xxx_wall_charger_suspend(struct i2c_client 
> *i2c_client,
>   return 0;
>  }
>  
> -static int __devinit pm2xxx_wall_charger_probe(struct i2c_client *i2c_client,
> +static int pm2xxx_wall_charger_probe(struct i2c_client *i2c_client,
>   const struct i2c_device_id *id)
>  {
>   struct pm2xxx_platform_data *pl_data = i2c_client->dev.platform_data;
> @@ -1021,7 +1021,7 @@ free_device_info:
>   return ret;
>  }
>  
> -static int __devexit pm2xxx_wall_charger_remove(struct i2c_client 
> *i2c_client)
> +static int pm2xxx_wall_charger_remove(struct i2c_client *i2c_client)
>  {
>   struct pm2xxx_charger *pm2 = i2c_get_clientdata(i2c_client);
>  
> @@ -1058,7 +1058,7 @@ MODULE_DEVICE_TABLE(i2c, pm2xxx_id);
>  
>  static struct i2c_driver pm2xxx_charger_driver = {
>   .probe = pm2xxx_wall_charger_probe,
> - .remove = __devexit_p(pm2xxx_wall_charger_remove),
> + .remove = pm2xxx_wall_charger_remove,
>   .suspend = pm2xxx_wall_charger_suspend,
>   .resume = pm2xxx_wall_charger_resume,
>   .driver = {
> -- 
> 1.8.0
> 
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: Question: How to distribute the interrupts over multiple cores?

[Lin Feng]

Hi Gao,

On 03/25/2013 10:33 AM, Lenky Gao wrote:
> [root@localhost ~]# echo 6 > /proc/irq/25/smp_affinity
> [root@localhost ~]# cat /proc/irq/25/smp_affinity
> 06
Seems you bind the nic irq to second and third cpu for the bit mask
you set is 110, so now eth9's irq is working on the 3rd cpu.

Have you ever tried irqbalance service? It may help to balance irq if the 
irq workload of 3rd cpu is too heavy.

thanks,
linfeng
> [root@localhost ~]# cat /proc/interrupts | grep eth9
>   25:   5824  13914159128210
> 0  0  0  IR-IO-APIC-fasteoi   eth9
> [root@localhost ~]# cat /proc/interrupts | grep eth9
>   25:   5824  13927159128210
> 0  0  0  IR-IO-APIC-fasteoi   eth9
> [root@localhost ~]# cat /proc/interrupts | grep eth9
>   25:   5824  13939159128210
> 0  0  0  IR-IO-APIC-fasteoi   eth9
> [root@localhost ~]# cat /proc/interrupts | grep eth9
>   25:   5824  13973159128210
> 0  0  0  IR-IO-APIC-fasteoi   eth9
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[Suggestion] scripts/checkpatch.pl: an issue about checking failed for a patch

[Chen Gang]

Hello Maintainers:

  when I use ./scripts/checkpatch.pl to check a patch,
it reports a style issue.
but after check, I can not find issue.
  (I use "static inline void" instead of "static void inline")

  please help check.

  thanks.


the related issue is:


[root@gchenlinux linux-next]# ./scripts/checkpatch.pl  
/tmp/0003-include-linux-platform_data-beautify-code-inline-is-.patch 
WARNING: line over 80 characters
#22: FILE: include/linux/platform_data/usb-ohci-s3c2410.h:34:
+static inline void s3c2410_usb_report_oc(struct s3c2410_hcd_info *info, int 
ports)

total: 0 errors, 1 warnings, 8 lines checked

/tmp/0003-include-linux-platform_data-beautify-code-inline-is-.patch has style 
problems, please review.

If any of these errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.





the related patch is :
  ("/tmp/0003-include-linux-platform_data-beautify-code-inline-is-.patch")


>From e8be21fd7b7126847a6ddfea5ac002c2ca2ca194 Mon Sep 17 00:00:00 2001
From: Chen Gang 
Date: Mon, 25 Mar 2013 10:25:53 +0800
Subject: [PATCH] include/linux/platform_data: beautify code, 'inline' is better 
in front of 'void'

  better to let 'inline' in front of 'void'

Signed-off-by: Chen Gang 
---
 include/linux/platform_data/usb-ohci-s3c2410.h |2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/include/linux/platform_data/usb-ohci-s3c2410.h 
b/include/linux/platform_data/usb-ohci-s3c2410.h
index 7fa1fbe..cc7554a 100644
--- a/include/linux/platform_data/usb-ohci-s3c2410.h
+++ b/include/linux/platform_data/usb-ohci-s3c2410.h
@@ -31,7 +31,7 @@ struct s3c2410_hcd_info {
void(*report_oc)(struct s3c2410_hcd_info *, int ports);
 };
 
-static void inline s3c2410_usb_report_oc(struct s3c2410_hcd_info *info, int 
ports)
+static inline void s3c2410_usb_report_oc(struct s3c2410_hcd_info *info, int 
ports)
 {
if (info->report_oc != NULL) {
(info->report_oc)(info, ports);
-- 
1.7.7.6
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH] include/linux/platform_data: beautify code, 'inline' is better in front of 'void'

[Chen Gang]

  better to let 'inline' in front of 'void'

Signed-off-by: Chen Gang 
---
 include/linux/platform_data/usb-ohci-s3c2410.h |2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/include/linux/platform_data/usb-ohci-s3c2410.h 
b/include/linux/platform_data/usb-ohci-s3c2410.h
index 7fa1fbe..cc7554a 100644
--- a/include/linux/platform_data/usb-ohci-s3c2410.h
+++ b/include/linux/platform_data/usb-ohci-s3c2410.h
@@ -31,7 +31,7 @@ struct s3c2410_hcd_info {
void(*report_oc)(struct s3c2410_hcd_info *, int ports);
 };
 
-static void inline s3c2410_usb_report_oc(struct s3c2410_hcd_info *info, int 
ports)
+static inline void s3c2410_usb_report_oc(struct s3c2410_hcd_info *info, int 
ports)
 {
if (info->report_oc != NULL) {
(info->report_oc)(info, ports);
-- 
1.7.7.6
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Question: How to distribute the interrupts over multiple cores?

[Lenky Gao]

Hi everyone,

I faced the same problem as this URL:
http://stackoverflow.com/questions/13641440/unable-to-distrubute-the-interrupts-over-multiple-cores

The question have been closed with no answer. :(

My machine have 2x Xeon E5504 processors and running vanilla kernel
3.6.11 in CentOS 6.0.

Could anyone give me some tips?

PS:
[root@localhost ~]# cat /proc/cmdline
ro root=/dev/mapper/vg_localhost-lv_root rd_NO_LUKS LANG=en_US.UTF-8
rd_NO_MD quiet rd_LVM_LV=vg_localhost/lv_swap
SYSFONT=latarcyrheb-sun16 rhgb rd_LVM_LV=vg_localhost/lv_root
KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM apic=debug pci=nomsi
[root@localhost ~]# uname -a
Linux localhost.lenkydomain 3.6.11 #2 SMP Fri Mar 22 21:13:41 CST 2013
x86_64 x86_64 x86_64 GNU/Linux
[root@localhost ~]# echo 6 > /proc/irq/25/smp_affinity
[root@localhost ~]# cat /proc/irq/25/smp_affinity
06
[root@localhost ~]# cat /proc/interrupts | grep eth9
  25:   5824  13914159128210
0  0  0  IR-IO-APIC-fasteoi   eth9
[root@localhost ~]# cat /proc/interrupts | grep eth9
  25:   5824  13927159128210
0  0  0  IR-IO-APIC-fasteoi   eth9
[root@localhost ~]# cat /proc/interrupts | grep eth9
  25:   5824  13939159128210
0  0  0  IR-IO-APIC-fasteoi   eth9
[root@localhost ~]# cat /proc/interrupts | grep eth9
  25:   5824  13973159128210
0  0  0  IR-IO-APIC-fasteoi   eth9


-- 
Regards,

Lenky
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

linux-next: manual merge of the kvm tree with the tree

[Stephen Rothwell]

Hi all,

Today's linux-next merge of the kvm tree got a conflict in
drivers/s390/kvm/virtio_ccw.c between commit 9d0ca6ed6f2f ("virtio:
remove obsolete virtqueue_get_queue_index()") from the net-next tree and
commit 07e169335ff0 ("virtio_ccw: pass a cookie value to kvm hypercall")
from the kvm tree.

I fixed it up (see below) and can carry the fix as necessary (no action
is required).

-- 
Cheers,
Stephen Rothwells...@canb.auug.org.au

diff --cc drivers/s390/kvm/virtio_ccw.c
index fb877b59,42d507c..000
--- a/drivers/s390/kvm/virtio_ccw.c
+++ b/drivers/s390/kvm/virtio_ccw.c
@@@ -166,7 -167,8 +167,7 @@@ static void virtio_ccw_kvm_notify(struc
  
vcdev = to_vc_device(info->vq->vdev);
ccw_device_get_schid(vcdev->cdev, );
-   do_kvm_notify(schid, vq->index);
 -  info->cookie = do_kvm_notify(schid, virtqueue_get_queue_index(vq),
 -   info->cookie);
++  info->cookie = do_kvm_notify(schid, vq->index, info->cookie);
  }
  
  static int virtio_ccw_read_vq_conf(struct virtio_ccw_device *vcdev,


pgpeAm2EMDEx7.pgp
Description: PGP signature

Re: [patch] mm: speedup in __early_pfn_to_nid

[Lin Feng]

On 03/24/2013 04:37 AM, Yinghai Lu wrote:
> +#ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP
> +int __init_memblock memblock_search_pfn_nid(unsigned long pfn,
> +  unsigned long *start_pfn, unsigned long *end_pfn)
> +{
> + struct memblock_type *type = 
> + int mid = memblock_search(type, (phys_addr_t)pfn << PAGE_SHIFT);

I'm really eager to see how much time can we save using binary search compared 
to
linear search in this case :)

(quote)
> A 4 TB (single rack) UV1 system takes 512 seconds to get through
> the zone code.  This performance optimization reduces the time
> by 189 seconds, a 36% improvement.
>
> A 2 TB (single rack) UV2 system goes from 212.7 seconds to 99.8 seconds,
> a 112.9 second (53%) reduction.
(quote)

thanks,
linfeng
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: OOM triggered with plenty of memory free

[Jonathan Woithe]

This post ties up a few loose ends in this thread which remained after my
21 March 2013 post.

 * The memory leak was not present in 2.6.36.

 * The patch to 2.6.35.11 at the end of this email (based on
   48e6b121605512d87f8da1ccd014313489c19630 from linux-stable) resolves the
   memory leak in 2.6.35.11.

This gives us a workable solution while we await fixes to current mainline
in the r8169 driver.  Once that's done we can revalidate our systems against
a more recent kernel and start shipping that.

Thanks to those who assisted with this issue.

Regards
  jonathan

--- a/net/netlink/af_netlink.c  2013-03-25 10:32:15.365781434 +1100
+++ b/net/netlink/af_netlink.c  2013-03-25 10:32:15.373782107 +1100
@@ -1387,6 +1387,8 @@ static int netlink_sendmsg(struct kiocb
err = netlink_unicast(sk, skb, dst_pid, msg->msg_flags_DONTWAIT);
 
 out:
+   scm_destroy(siocb->scm);
+   siocb->scm = NULL;
return err;
 }
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH] vfio powerpc: implement IOMMU driver for VFIO

[David Gibson]

On Wed, Mar 20, 2013 at 09:16:24PM -0600, Alex Williamson wrote:
> On Thu, 2013-03-21 at 12:55 +1100, David Gibson wrote:
> > On Wed, Mar 20, 2013 at 02:45:24PM -0600, Alex Williamson wrote:
> > > On Tue, 2013-03-19 at 18:08 +1100, Alexey Kardashevskiy wrote:
> > > > VFIO implements platform independent stuff such as
> > > > a PCI driver, BAR access (via read/write on a file descriptor
> > > > or direct mapping when possible) and IRQ signaling.
> > > > 
> > > > The platform dependent part includes IOMMU initialization
> > > > and handling. This patch implements an IOMMU driver for VFIO
> > > > which does mapping/unmapping pages for the guest IO and
> > > > provides information about DMA window (required by a POWERPC
> > > > guest).
> > > > 
> > > > The counterpart in QEMU is required to support this functionality.
> > > > 
> > > > Changelog:
> > > > * documentation updated
> > > > * containter enable/disable ioctls added
> > > > * request_module(spapr_iommu) added
> > > > * various locks fixed
> > > > 
> > > > Cc: David Gibson 
> > > > Signed-off-by: Alexey Kardashevskiy 
> > > > ---
> > > 
> > > 
> > > Looking pretty good.  There's one problem with the detach_group,
> > > otherwise just some trivial comments below.  What's the status of the
> > > tce code that this depends on?  Thanks,
> > 
> > [snip]
> > > > +static void tce_iommu_detach_group(void *iommu_data,
> > > > +   struct iommu_group *iommu_group)
> > > > +{
> > > > +   struct tce_container *container = iommu_data;
> > > > +   struct iommu_table *tbl = 
> > > > iommu_group_get_iommudata(iommu_group);
> > > > +
> > > > +   BUG_ON(!tbl);
> > > > +   mutex_lock(>lock);
> > > > +   if (tbl != container->tbl) {
> > > > +   pr_warn("tce_vfio: detaching group #%u, expected group 
> > > > is #%u\n",
> > > > +   iommu_group_id(iommu_group),
> > > > +   iommu_group_id(tbl->it_group));
> > > > +   } else if (container->enabled) {
> > > > +   pr_err("tce_vfio: detaching group #%u from enabled 
> > > > container\n",
> > > > +   iommu_group_id(tbl->it_group));
> > > 
> > > Hmm, something more than a pr_err needs to happen here.  Wouldn't this
> > > imply a disable and going back to an unprivileged container?
> > 
> > Uh, no.  I think the idea here is that we use the enable/disable
> > semantic to address some other potential problems.  Specifically,
> > sidestepping the problems of what happens if you change the
> > container's capabilities by adding/removing groups while in the middle
> > of using it.  So the point is that the detach fails when the group is
> > enabled, rather than implicitly doing anything.
> 
> The function returns void.

Uh, yeah, we should probably fix that.

>  We're not failing the detach, just getting
> into a broken state.  This is only called to unwind attaching groups
> when the iommu is set or if the user explicitly calls
> GROUP_UNSET_CONTAINER.  The former won't have had a chance to call
> enable but the latter would need to be fixed.

Well, in the latter case it's essentialy a silent failure, which isn't
great.

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


signature.asc
Description: Digital signature

[PATCH] mfd:rtsx: Support RTS5249

[wei_wang]

From: Wei WANG 

Support new model: RTS5249

Signed-off-by: Wei WANG 
---
 drivers/mfd/Makefile |2 +-
 drivers/mfd/rts5249.c|  245 ++
 drivers/mfd/rtsx_pcr.c   |5 +
 drivers/mfd/rtsx_pcr.h   |1 +
 include/linux/mfd/rtsx_pci.h |2 +
 5 files changed, 254 insertions(+), 1 deletion(-)
 create mode 100644 drivers/mfd/rts5249.c

diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile
index b90409c..f61ac02 100644
--- a/drivers/mfd/Makefile
+++ b/drivers/mfd/Makefile
@@ -9,7 +9,7 @@ obj-$(CONFIG_MFD_88PM805)   += 88pm805.o 88pm80x.o
 obj-$(CONFIG_MFD_SM501)+= sm501.o
 obj-$(CONFIG_MFD_ASIC3)+= asic3.o tmio_core.o
 
-rtsx_pci-objs  := rtsx_pcr.o rts5209.o rts5229.o rtl8411.o 
rts5227.o
+rtsx_pci-objs  := rtsx_pcr.o rts5209.o rts5229.o rtl8411.o 
rts5227.o rts5249.o
 obj-$(CONFIG_MFD_RTSX_PCI) += rtsx_pci.o
 
 obj-$(CONFIG_HTC_EGPIO)+= htc-egpio.o
diff --git a/drivers/mfd/rts5249.c b/drivers/mfd/rts5249.c
new file mode 100644
index 000..24a1861
--- /dev/null
+++ b/drivers/mfd/rts5249.c
@@ -0,0 +1,245 @@
+/* Driver for Realtek PCI-Express card reader
+ *
+ * Copyright(c) 2009 Realtek Semiconductor Corp. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2, or (at your option) any
+ * later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see .
+ *
+ * Author:
+ *   Wei WANG 
+ *   No. 450, Shenhu Road, Suzhou Industry Park, Suzhou, China
+ */
+
+#include 
+#include 
+#include 
+
+#include "rtsx_pcr.h"
+
+static u8 rts5249_get_ic_version(struct rtsx_pcr *pcr)
+{
+   u8 val;
+
+   rtsx_pci_read_register(pcr, DUMMY_REG_RESET_0, );
+   return val & 0x0F;
+}
+
+static int rts5249_extra_init_hw(struct rtsx_pcr *pcr)
+{
+   rtsx_pci_init_cmd(pcr);
+
+   /* Configure GPIO as output */
+   rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, GPIO_CTL, 0x02, 0x02);
+   /* Switch LDO3318 source from DV33 to card_3v3 */
+   rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, LDO_PWR_SEL, 0x03, 0x00);
+   rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, LDO_PWR_SEL, 0x03, 0x01);
+   /* LED shine disabled, set initial shine cycle period */
+   rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, OLT_LED_CTL, 0x0F, 0x02);
+   /* Configure force_clock_req
+* Maybe We should define 0xFF03 as some name
+*/
+   rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, 0xFF03, 0x08, 0x08);
+   /* Correct driving */
+   rtsx_pci_add_cmd(pcr, WRITE_REG_CMD,
+   SD30_CLK_DRIVE_SEL, 0xFF, 0x99);
+   rtsx_pci_add_cmd(pcr, WRITE_REG_CMD,
+   SD30_CMD_DRIVE_SEL, 0xFF, 0x99);
+   rtsx_pci_add_cmd(pcr, WRITE_REG_CMD,
+   SD30_DAT_DRIVE_SEL, 0xFF, 0x92);
+
+   return rtsx_pci_send_cmd(pcr, 100);
+}
+
+static int rts5249_optimize_phy(struct rtsx_pcr *pcr)
+{
+   int err;
+
+   err = rtsx_pci_write_phy_register(pcr, 0x19, 0xFE46);
+   if (err < 0)
+   return err;
+
+   mdelay(1);
+
+   return rtsx_pci_write_phy_register(pcr, 0x0A, 0x05C0);
+}
+
+static int rts5249_turn_on_led(struct rtsx_pcr *pcr)
+{
+   return rtsx_pci_write_register(pcr, GPIO_CTL, 0x02, 0x02);
+}
+
+static int rts5249_turn_off_led(struct rtsx_pcr *pcr)
+{
+   return rtsx_pci_write_register(pcr, GPIO_CTL, 0x02, 0x00);
+}
+
+static int rts5249_enable_auto_blink(struct rtsx_pcr *pcr)
+{
+   return rtsx_pci_write_register(pcr, OLT_LED_CTL, 0x08, 0x08);
+}
+
+static int rts5249_disable_auto_blink(struct rtsx_pcr *pcr)
+{
+   return rtsx_pci_write_register(pcr, OLT_LED_CTL, 0x08, 0x00);
+}
+
+static int rts5249_card_power_on(struct rtsx_pcr *pcr, int card)
+{
+   int err;
+
+   rtsx_pci_init_cmd(pcr);
+   rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, CARD_PWR_CTL,
+   SD_POWER_MASK, SD_VCC_PARTIAL_POWER_ON);
+   rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, PWR_GATE_CTRL,
+   LDO3318_PWR_MASK, 0x02);
+   err = rtsx_pci_send_cmd(pcr, 100);
+   if (err < 0)
+   return err;
+
+   msleep(5);
+
+   rtsx_pci_init_cmd(pcr);
+   rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, CARD_PWR_CTL,
+   SD_POWER_MASK, SD_VCC_POWER_ON);
+   rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, PWR_GATE_CTRL,
+   LDO3318_PWR_MASK, 0x06);
+   err = rtsx_pci_send_cmd(pcr, 100);
+   if (err < 0)
+   

[ 017/104] drm/i915: Increase the RC6p threshold.

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Stéphane Marchesin 

commit 0920a48719f1ceefc909387a64f97563848c7854 upstream.

This increases GEN6_RC6p_THRESHOLD from 10 to 15. For some
reason this avoids the gen6_gt_check_fifodbg.isra warnings and
associated GPU lockups, which makes my ivy bridge machine stable.

Signed-off-by: Stéphane Marchesin 
Acked-by: Jesse Barnes 
Signed-off-by: Daniel Vetter 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/i915/intel_pm.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -8059,7 +8059,7 @@ void gen6_enable_rps(struct drm_i915_pri
I915_WRITE(GEN6_RC_SLEEP, 0);
I915_WRITE(GEN6_RC1e_THRESHOLD, 1000);
I915_WRITE(GEN6_RC6_THRESHOLD, 5);
-   I915_WRITE(GEN6_RC6p_THRESHOLD, 10);
+   I915_WRITE(GEN6_RC6p_THRESHOLD, 15);
I915_WRITE(GEN6_RC6pp_THRESHOLD, 64000); /* unused */
 
if (intel_enable_rc6(dev_priv->dev))


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 000/104] 3.2.42-stable review

[Ben Hutchings]

This is the start of the stable review cycle for the 3.2.42 release.
There are 104 patches in this series, which will be posted as responses
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed Mar 27 01:00:00 UTC 2013.
Anything received after that time might be too late.

A combined patch relative to 3.2.41 will be posted as an additional
response to this.  A shortlog and diffstat can be found below.

Ben.

-

Alan Stern (1):
  usb: gadget: udc-core: fix a regression during gadget driver unbinding
 [511f3c5326eabe1ece35202a404c24c0aeacc246]

Alex Deucher (1):
  drm/radeon/benchmark: make sure bo blit copy exists before using it
 [fa8d387dc3f62062a6b4afbbb2a3438094fd8584]

Ben Hutchings (11):
  efivars: Fix check for CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE
 [ca0ba26fbbd2d81c43085df49ce0abfe34535a90]
  efivars: pstore: Do not check size when erasing variable
 [not upstream; this is a fix for an incorrectly backported commit]
  perf: Revert duplicated commit 
 [not upstream; the commits were correctly merged by git]
  sfc: Convert firmware subtypes to native byte order in  
efx_mcdi_get_board_cfg()
 [bfeed902946a31692e7a24ed355b6d13ac37d014]
  sfc: Detach net device when stopping queues for  reconfiguration
 [29c69a4882641285a854d6d03ca5adbba68c0034]
  sfc: Disable soft interrupt handling during  efx_device_detach_sync()
 [35205b211c8d17a8a0b5e8926cb7c73e9a7ef1ad]
  sfc: Fix efx_rx_buf_offset() in the presence of  swiotlb
 [06e63c57acbb1df7c35ebe846ae416a8b88dfafa,
  b590ace09d51cd39744e0f7662c5e4a0d1b5d952,
  c73e787a8db9117d59b5180baf83203a42ecadca]
  sfc: Fix timekeeping in efx_mcdi_poll()
 [ebf98e797b4e26ad52ace1511a0b503ee60a6cd4]
  sfc: Fix two causes of flush failure
 [a606f4325dca6950996abbae452d33f2af095f39,
  d5e8cc6c946e0857826dcfbb3585068858445bfe,
  525d9e824018cd7cc8d8d44832ddcd363abfe6e1]
  sfc: Only use TX push if a single descriptor is to be  written
 [fae8563b25f73dc584a07bcda7a82750ff4f7672]
  sfc: Properly sync RX DMA buffer when it is not the  last in the page
 [3a68f19d7afb80f548d016effbc6ed52643a8085]

Benjamin Herrenschmidt (1):
  powerpc: Fix cputable entry for 970MP rev 1.0
 [d63ac5f6cf31c8a83170a9509b350c1489a7262b]

Bing Zhao (1):
  mwifiex: fix potential out-of-boundary access to ibss rate table
 [5f0fabf84d7b52f979dcbafa3d3c530c60d9a92c]

CQ Tang (1):
  x86-64: Fix the failure case in copy_user_handle_tail()
 [66db3feb486c01349f767b98ebb10b0c3d2d021b]

Cong Wang (1):
  rds: limit the size allocated by rds_message_alloc()
 [ece6b0a2b25652d684a7ced4ae680a863af041e0]

Cristian Bercaru (1):
  bridging: fix rx_handlers return code
 [3bc1b1add7a8484cc4a261c3e128dbe1528ce01f]

Dan Carpenter (1):
  selinux: use GFP_ATOMIC under spin_lock
 [4502403dcf8f5c76abd4dbab8726c8e4ecb5cd34]

Daniel Mack (2):
  ALSA: snd-usb: mixer: ignore -EINVAL in snd_usb_mixer_controls()
 [83ea5d18d74f032a760fecde78c0210f66f7f70c]
  ALSA: snd-usb: mixer: propagate errors up the call chain
 [4d7b86c98e445b075c2c4c3757eb6d3d6efbe72e]

Daniel Pieczko (1):
  sfc: lock TX queues when calling netif_device_detach()
 [c2f3b8e3a44b6fe9e36704e30157ebe1a88c08b1]

David Rientjes (1):
  perf,x86: fix link failure for non-Intel configs
 [6c4d3bc99b3341067775efd4d9d13cc8e655fd7c]

David Ward (1):
  net/ipv4: Ensure that location of timestamp option is  stored
 [4660c7f498c07c43173142ea95145e9dac5a6d14]

Denis V. Lunev (1):
  ipv4: fix definition of FIB_TABLE_HASHSZ
 [5b9e12dbf92b441b37136ea71dac59f05f2673a9]

Dmitry Artamonow (1):
  usb-storage: add unusual_devs entry for Samsung YP-Z3 mp3 player
 [29f86e66428ee083aec106cca1748dc63d98ce23]

Dmitry Torokhov (1):
  USB: xhci - fix bit definitions for IMAN register
 [f8264340e694604863255cc0276491d17c402390]

Eric Dumazet (2):
  tcp: fix skb_availroom()
 [16fad69cfe4adbbfa813de516757b87bcae36d93]
  tun: add a missing nf_reset() in tun_net_xmit()
 [f8af75f3517a24838a36eb5797a1a3e60bf9e276]

Guillaume Nault (1):
  l2tp: Restore socket refcount when sendmsg succeeds
 [8b82547e33e85fc24d4d172a93c796de1fefa81a]

Hannes Frederic Sowa (2):
  inet: limit length of fragment queue hash table bucket  lists
 [5a3da1fe9561828d0ca7eca664b16ec2b9bf0055]
  ipv6: stop multicast forwarding to process interface  scoped addresses
 [ddf64354af4a702ee0b85d0a285ba74c7278a460]

Hannes Reinecke (1):
  USB: xhci: correctly enable interrupts
 [00eed9c814cb8f281be6f0f5d8f45025dc0a97eb]

Heiko Carstens (1):
  s390/mm: fix flush_tlb_kernel_range()
 [f6a70a07079518280022286a1dceb797d12e1edf]

Jan Kara 

[ 002/104] perf,x86: fix kernel crash with PEBS/BTS after suspend/resume

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Stephane Eranian 

commit 1d9d8639c063caf6efc2447f5f26aa637f844ff6 upstream.

This patch fixes a kernel crash when using precise sampling (PEBS)
after a suspend/resume. Turns out the CPU notifier code is not invoked
on CPU0 (BP). Therefore, the DS_AREA (used by PEBS) is not restored properly
by the kernel and keeps it power-on/resume value of 0 causing any PEBS
measurement to crash when running on CPU0.

The workaround is to add a hook in the actual resume code to restore
the DS Area MSR value. It is invoked for all CPUS. So for all but CPU0,
the DS_AREA will be restored twice but this is harmless.

Reported-by: Linus Torvalds 
Signed-off-by: Stephane Eranian 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 arch/x86/kernel/cpu/perf_event_intel_ds.c |8 
 arch/x86/power/cpu.c  |2 ++
 include/linux/perf_event.h|2 ++
 3 files changed, 12 insertions(+)

--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -736,3 +736,11 @@ void intel_ds_init(void)
}
}
 }
+
+void perf_restore_debug_store(void)
+{
+   if (!x86_pmu.bts && !x86_pmu.pebs)
+   return;
+
+   init_debug_store_on_cpu(smp_processor_id());
+}
--- a/arch/x86/power/cpu.c
+++ b/arch/x86/power/cpu.c
@@ -11,6 +11,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #include 
 #include 
@@ -225,6 +226,7 @@ static void __restore_processor_state(st
 
do_fpu_end();
mtrr_bp_restore();
+   perf_restore_debug_store();
 }
 
 /* Needed by apm.c */
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -1146,6 +1146,7 @@ extern void perf_swevent_put_recursion_c
 extern void perf_event_enable(struct perf_event *event);
 extern void perf_event_disable(struct perf_event *event);
 extern void perf_event_task_tick(void);
+extern void perf_restore_debug_store(void);
 #else
 static inline void
 perf_event_task_sched_in(struct task_struct *prev,
@@ -1184,6 +1185,7 @@ static inline void perf_swevent_put_recu
 static inline void perf_event_enable(struct perf_event *event) { }
 static inline void perf_event_disable(struct perf_event *event)
{ }
 static inline void perf_event_task_tick(void)  { }
+static inline void perf_restore_debug_store(void)  { }
 #endif
 
 #define perf_output_put(handle, x) perf_output_copy((handle), &(x), sizeof(x))


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 003/104] perf,x86: fix wrmsr_on_cpu() warning on suspend/resume

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Linus Torvalds 

commit 2a6e06b2aed6995af401dcd4feb5e79a0c7ea554 upstream.

Commit 1d9d8639c063 ("perf,x86: fix kernel crash with PEBS/BTS after
suspend/resume") fixed a crash when doing PEBS performance profiling
after resuming, but in using init_debug_store_on_cpu() to restore the
DS_AREA mtrr it also resulted in a new WARN_ON() triggering.

init_debug_store_on_cpu() uses "wrmsr_on_cpu()", which in turn uses CPU
cross-calls to do the MSR update.  Which is not really valid at the
early resume stage, and the warning is quite reasonable.  Now, it all
happens to _work_, for the simple reason that smp_call_function_single()
ends up just doing the call directly on the CPU when the CPU number
matches, but we really should just do the wrmsr() directly instead.

This duplicates the wrmsr() logic, but hopefully we can just remove the
wrmsr_on_cpu() version eventually.

Reported-and-tested-by: Parag Warudkar 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 arch/x86/kernel/cpu/perf_event_intel_ds.c |4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -739,8 +739,10 @@ void intel_ds_init(void)
 
 void perf_restore_debug_store(void)
 {
+   struct debug_store *ds = __this_cpu_read(cpu_hw_events.ds);
+
if (!x86_pmu.bts && !x86_pmu.pebs)
return;
 
-   init_debug_store_on_cpu(smp_processor_id());
+   wrmsrl(MSR_IA32_DS_AREA, (unsigned long)ds);
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 006/104] rds: limit the size allocated by rds_message_alloc()

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Cong Wang 

[ Upstream commit ece6b0a2b25652d684a7ced4ae680a863af041e0 ]

Dave Jones reported the following bug:

"When fed mangled socket data, rds will trust what userspace gives it,
and tries to allocate enormous amounts of memory larger than what
kmalloc can satisfy."

WARNING: at mm/page_alloc.c:2393 __alloc_pages_nodemask+0xa0d/0xbe0()
Hardware name: GA-MA78GM-S2H
Modules linked in: vmw_vsock_vmci_transport vmw_vmci vsock fuse bnep dlci 
bridge 8021q garp stp mrp binfmt_misc l2tp_ppp l2tp_core rfcomm s
Pid: 24652, comm: trinity-child2 Not tainted 3.8.0+ #65
Call Trace:
 [] warn_slowpath_common+0x75/0xa0
 [] warn_slowpath_null+0x1a/0x20
 [] __alloc_pages_nodemask+0xa0d/0xbe0
 [] ? native_sched_clock+0x26/0x90
 [] ? trace_hardirqs_off_caller+0x28/0xc0
 [] ? trace_hardirqs_off+0xd/0x10
 [] alloc_pages_current+0xb8/0x180
 [] __get_free_pages+0x2a/0x80
 [] kmalloc_order_trace+0x3e/0x1a0
 [] __kmalloc+0x2f5/0x3a0
 [] ? local_bh_enable_ip+0x7c/0xf0
 [] rds_message_alloc+0x23/0xb0 [rds]
 [] rds_sendmsg+0x2b1/0x990 [rds]
 [] ? trace_hardirqs_off+0xd/0x10
 [] sock_sendmsg+0xb0/0xe0
 [] ? get_lock_stats+0x22/0x70
 [] ? put_lock_stats.isra.23+0xe/0x40
 [] sys_sendto+0x130/0x180
 [] ? trace_hardirqs_on+0xd/0x10
 [] ? _raw_spin_unlock_irq+0x3b/0x60
 [] ? sysret_check+0x1b/0x56
 [] ? trace_hardirqs_on_caller+0x115/0x1a0
 [] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [] system_call_fastpath+0x16/0x1b
---[ end trace eed6ae990d018c8b ]---

Reported-by: Dave Jones 
Cc: Dave Jones 
Cc: David S. Miller 
Cc: Venkat Venkatsubra 
Signed-off-by: Cong Wang 
Acked-by: Venkat Venkatsubra 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/rds/message.c | 3 +++
 1 file changed, 3 insertions(+)

--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -197,6 +197,9 @@ struct rds_message *rds_message_alloc(un
 {
struct rds_message *rm;
 
+   if (extra_len > KMALLOC_MAX_SIZE - sizeof(struct rds_message))
+   return NULL;
+
rm = kzalloc(sizeof(struct rds_message) + extra_len, gfp);
if (!rm)
goto out;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 016/104] 6lowpan: Fix endianness issue in is_addr_link_local().

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: YOSHIFUJI Hideaki / 吉藤英明 

[ Upstream commit 9026c4927254f5bea695cc3ef2e255280e6a3011 ]

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/ieee802154/6lowpan.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/ieee802154/6lowpan.h
+++ b/net/ieee802154/6lowpan.h
@@ -87,7 +87,7 @@
(memcmp(addr1, addr2, length >> 3) == 0)
 
 /* local link, i.e. FE80::/10 */
-#define is_addr_link_local(a) (((a)->s6_addr16[0]) == 0x80FE)
+#define is_addr_link_local(a) (((a)->s6_addr16[0]) == htons(0xFE80))
 
 /*
  * check whether we can compress the IID to 16 bits,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 007/104] net: ipv6: Dont purge default router if accept_ra=2

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Lorenzo Colitti 

[ Upstream commit 3e8b0ac3e41e3c88a5522d5df7212438ab51 ]

Setting net.ipv6.conf..accept_ra=2 causes the kernel
to accept RAs even when forwarding is enabled. However, enabling
forwarding purges all default routes on the system, breaking
connectivity until the next RA is received. Fix this by not
purging default routes on interfaces that have accept_ra=2.

Signed-off-by: Lorenzo Colitti 
Acked-by: YOSHIFUJI Hideaki 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/ipv6/route.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1920,7 +1920,8 @@ void rt6_purge_dflt_routers(struct net *
 restart:
read_lock_bh(>tb6_lock);
for (rt = table->tb6_root.leaf; rt; rt = rt->dst.rt6_next) {
-   if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) {
+   if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF) &&
+   (!rt->rt6i_idev || rt->rt6i_idev->cnf.accept_ra != 2)) {
dst_hold(>dst);
read_unlock_bh(>tb6_lock);
ip6_del_rt(rt);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 012/104] bridging: fix rx_handlers return code

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Cristian Bercaru 

[ Upstream commit 3bc1b1add7a8484cc4a261c3e128dbe1528ce01f ]

The frames for which rx_handlers return RX_HANDLER_CONSUMED are no longer
counted as dropped. They are counted as successfully received by
'netif_receive_skb'.

This allows network interface drivers to correctly update their RX-OK and
RX-DRP counters based on the result of 'netif_receive_skb'.

Signed-off-by: Cristian Bercaru 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/core/dev.c | 1 +
 1 file changed, 1 insertion(+)

--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3299,6 +3299,7 @@ ncls:
}
switch (rx_handler()) {
case RX_HANDLER_CONSUMED:
+   ret = NET_RX_SUCCESS;
goto out;
case RX_HANDLER_ANOTHER:
goto another_round;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 014/104] rtnl: fix info leak on RTM_GETLINK request for VF devices

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Mathias Krause 

[ Upstream commit 84d73cd3fb142bf1298a8c13fd4ca50fd2432372 ]

Initialize the mac address buffer with 0 as the driver specific function
will probably not fill the whole buffer. In fact, all in-kernel drivers
fill only ETH_ALEN of the MAX_ADDR_LEN bytes, i.e. 6 of the 32 possible
bytes. Therefore we currently leak 26 bytes of stack memory to userland
via the netlink interface.

Signed-off-by: Mathias Krause 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/core/rtnetlink.c | 1 +
 1 file changed, 1 insertion(+)

--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -973,6 +973,7 @@ static int rtnl_fill_ifinfo(struct sk_bu
 * report anything.
 */
ivi.spoofchk = -1;
+   memset(ivi.mac, 0, sizeof(ivi.mac));
if (dev->netdev_ops->ndo_get_vf_config(dev, i, ))
break;
vf_mac.vf =


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 009/104] tun: add a missing nf_reset() in tun_net_xmit()

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Eric Dumazet 

[ Upstream commit f8af75f3517a24838a36eb5797a1a3e60bf9e276 ]

Dave reported following crash :

general protection fault:  [#1] SMP
CPU 2
Pid: 25407, comm: qemu-kvm Not tainted 3.7.9-205.fc18.x86_64 #1 Hewlett-Packard 
HP Z400 Workstation/0B4Ch
RIP: 0010:[]  [] 
destroy_conntrack+0x35/0x120 [nf_conntrack]
RSP: 0018:880276913d78  EFLAGS: 00010206
RAX: 50626b6b7876376c RBX: 88026e530d68 RCX: 88028d158e00
RDX: 88026d0d5470 RSI: 0011 RDI: 0002
RBP: 880276913d88 R08:  R09: 880295002900
R10:  R11: 0003 R12: 81ca3b40
R13: 8151a8e0 R14: 880270875000 R15: 0002
FS:  7ff3bce38a00() GS:88029fc4() knlGS:
CS:  0010 DS:  ES:  CR0: 8005003b
CR2: 7fd1430bd000 CR3: 00027042b000 CR4: 27e0
DR0:  DR1:  DR2: 
DR3:  DR6: 0ff0 DR7: 0400
Process qemu-kvm (pid: 25407, threadinfo 880276912000, task 
88028c369720)
Stack:
 880156f59100 880156f59100 880276913d98 815534f7
 880276913db8 8151a74b 880270875000 880156f59100
 880276913dd8 8151a5a6 880276913dd8 88026d0d5470
Call Trace:
 [] nf_conntrack_destroy+0x17/0x20
 [] skb_release_head_state+0x7b/0x100
 [] __kfree_skb+0x16/0xa0
 [] kfree_skb+0x36/0xa0
 [] skb_queue_purge+0x20/0x40
 [] __tun_detach+0x117/0x140 [tun]
 [] tun_chr_close+0x3c/0xd0 [tun]
 [] __fput+0xec/0x240
 [] fput+0xe/0x10
 [] task_work_run+0xa7/0xe0
 [] do_notify_resume+0x71/0xb0
 [] int_signal+0x12/0x17
Code: 00 00 04 48 89 e5 41 54 53 48 89 fb 4c 8b a7 e8 00 00 00 0f 85 de 00 00 
00 0f b6 73 3e 0f b7 7b 2a e8 10 40 00 00 48 85 c0 74 0e <48> 8b 40 28 48 85 c0 
74 05 48 89 df ff d0 48 c7 c7 08 6a 3a a0
RIP  [] destroy_conntrack+0x35/0x120 [nf_conntrack]
 RSP 

This is because tun_net_xmit() needs to call nf_reset()
before queuing skb into receive_queue

Reported-by: Dave Jones 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 drivers/net/tun.c | 2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -417,6 +417,8 @@ static netdev_tx_t tun_net_xmit(struct s
 * for indefinite time. */
skb_orphan(skb);
 
+   nf_reset(skb);
+
/* Enqueue packet */
skb_queue_tail(>socket.sk->sk_receive_queue, skb);
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 015/104] dcbnl: fix various netlink info leaks

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Mathias Krause 

[ Upstream commit 29cd8ae0e1a39e239a3a7b67da1986add1199fc0 ]

The dcb netlink interface leaks stack memory in various places:
* perm_addr[] buffer is only filled at max with 12 of the 32 bytes but
  copied completely,
* no in-kernel driver fills all fields of an IEEE 802.1Qaz subcommand,
  so we're leaking up to 58 bytes for ieee_ets structs, up to 136 bytes
  for ieee_pfc structs, etc.,
* the same is true for CEE -- no in-kernel driver fills the whole
  struct,

Prevent all of the above stack info leaks by properly initializing the
buffers/structures involved.

Signed-off-by: Mathias Krause 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/dcb/dcbnl.c | 7 +++
 1 file changed, 7 insertions(+)

--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -336,6 +336,7 @@ static int dcbnl_getperm_hwaddr(struct n
dcb->dcb_family = AF_UNSPEC;
dcb->cmd = DCB_CMD_GPERM_HWADDR;
 
+   memset(perm_addr, 0, sizeof(perm_addr));
netdev->dcbnl_ops->getpermhwaddr(netdev, perm_addr);
 
ret = nla_put(dcbnl_skb, DCB_ATTR_PERM_HWADDR, sizeof(perm_addr),
@@ -1238,6 +1239,7 @@ static int dcbnl_ieee_fill(struct sk_buf
 
if (ops->ieee_getets) {
struct ieee_ets ets;
+   memset(, 0, sizeof(ets));
err = ops->ieee_getets(netdev, );
if (!err)
NLA_PUT(skb, DCB_ATTR_IEEE_ETS, sizeof(ets), );
@@ -1245,6 +1247,7 @@ static int dcbnl_ieee_fill(struct sk_buf
 
if (ops->ieee_getpfc) {
struct ieee_pfc pfc;
+   memset(, 0, sizeof(pfc));
err = ops->ieee_getpfc(netdev, );
if (!err)
NLA_PUT(skb, DCB_ATTR_IEEE_PFC, sizeof(pfc), );
@@ -1277,6 +1280,7 @@ static int dcbnl_ieee_fill(struct sk_buf
/* get peer info if available */
if (ops->ieee_peer_getets) {
struct ieee_ets ets;
+   memset(, 0, sizeof(ets));
err = ops->ieee_peer_getets(netdev, );
if (!err)
NLA_PUT(skb, DCB_ATTR_IEEE_PEER_ETS, sizeof(ets), );
@@ -1284,6 +1288,7 @@ static int dcbnl_ieee_fill(struct sk_buf
 
if (ops->ieee_peer_getpfc) {
struct ieee_pfc pfc;
+   memset(, 0, sizeof(pfc));
err = ops->ieee_peer_getpfc(netdev, );
if (!err)
NLA_PUT(skb, DCB_ATTR_IEEE_PEER_PFC, sizeof(pfc), );
@@ -1463,6 +1468,7 @@ static int dcbnl_cee_fill(struct sk_buff
/* peer info if available */
if (ops->cee_peer_getpg) {
struct cee_pg pg;
+   memset(, 0, sizeof(pg));
err = ops->cee_peer_getpg(netdev, );
if (!err)
NLA_PUT(skb, DCB_ATTR_CEE_PEER_PG, sizeof(pg), );
@@ -1470,6 +1476,7 @@ static int dcbnl_cee_fill(struct sk_buff
 
if (ops->cee_peer_getpfc) {
struct cee_pfc pfc;
+   memset(, 0, sizeof(pfc));
err = ops->cee_peer_getpfc(netdev, );
if (!err)
NLA_PUT(skb, DCB_ATTR_CEE_PEER_PFC, sizeof(pfc), );


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 010/104] macvlan: Set IFF_UNICAST_FLT flag to prevent unnecessary promisc mode.

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Vlad Yasevich 

[ Upstream commit 87ab7f6f2874f1115817e394a7ed2dea1c72549e ]

Macvlan already supports hw address filters.  Set the IFF_UNICAST_FLT
so that it doesn't needlesly enter PROMISC mode when macvlans are
stacked.

Signed-of-by: Vlad Yasevich 

Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 drivers/net/macvlan.c | 1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -585,6 +585,7 @@ void macvlan_common_setup(struct net_dev
ether_setup(dev);
 
dev->priv_flags&= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
+   dev->priv_flags|= IFF_UNICAST_FLT;
dev->netdev_ops = _netdev_ops;
dev->destructor = free_netdev;
dev->header_ops = _hard_header_ops,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 005/104] l2tp: Restore socket refcount when sendmsg succeeds

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Guillaume Nault 

[ Upstream commit 8b82547e33e85fc24d4d172a93c796de1fefa81a ]

The sendmsg() syscall handler for PPPoL2TP doesn't decrease the socket
reference counter after successful transmissions. Any successful
sendmsg() call from userspace will then increase the reference counter
forever, thus preventing the kernel's session and tunnel data from
being freed later on.

The problem only happens when writing directly on L2TP sockets.
PPP sockets attached to L2TP are unaffected as the PPP subsystem
uses pppol2tp_xmit() which symmetrically increase/decrease reference
counters.

This patch adds the missing call to sock_put() before returning from
pppol2tp_sendmsg().

Signed-off-by: Guillaume Nault 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/l2tp/l2tp_ppp.c | 1 +
 1 file changed, 1 insertion(+)

--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -360,6 +360,7 @@ static int pppol2tp_sendmsg(struct kiocb
l2tp_xmit_skb(session, skb, session->hdr_len);
 
sock_put(ps->tunnel_sock);
+   sock_put(sk);
 
return error;
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 020/104] s390/mm: fix flush_tlb_kernel_range()

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Heiko Carstens 

commit f6a70a07079518280022286a1dceb797d12e1edf upstream.

Our flush_tlb_kernel_range() implementation calls __tlb_flush_mm() with
_mm as argument. __tlb_flush_mm() however will only flush tlbs
for the passed in mm if its mm_cpumask is not empty.

For the init_mm however its mm_cpumask has never any bits set. Which in
turn means that our flush_tlb_kernel_range() implementation doesn't
work at all.

This can be easily verified with a vmalloc/vfree loop which allocates
a page, writes to it and then frees the page again. A crash will follow
almost instantly.

To fix this remove the cpumask_empty() check in __tlb_flush_mm() since
there shouldn't be too many mms with a zero mm_cpumask, besides the
init_mm of course.

Signed-off-by: Heiko Carstens 
Signed-off-by: Martin Schwidefsky 
Signed-off-by: Ben Hutchings 
---
 arch/s390/include/asm/tlbflush.h |2 --
 1 file changed, 2 deletions(-)

--- a/arch/s390/include/asm/tlbflush.h
+++ b/arch/s390/include/asm/tlbflush.h
@@ -74,8 +74,6 @@ static inline void __tlb_flush_idte(unsi
 
 static inline void __tlb_flush_mm(struct mm_struct * mm)
 {
-   if (unlikely(cpumask_empty(mm_cpumask(mm
-   return;
/*
 * If the machine has IDTE we prefer to do a per mm flush
 * on all cpus instead of doing a local flush if the mm


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 011/104] netlabel: correctly list all the static label mappings

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Paul Moore 

[ Upstream commits 0c1233aba1e948c37f6dc7620cb7c253fcd71ce9 and
  a6a8fe950e1b8596bb06f2c89c3a1a4bf2011ba9 ]

When we have a large number of static label mappings that spill across
the netlink message boundary we fail to properly save our state in the
netlink_callback struct which causes us to repeat the same listings.
This patch fixes this problem by saving the state correctly between
calls to the NetLabel static label netlink "dumpit" routines.

Signed-off-by: Paul Moore 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/netlabel/netlabel_unlabeled.c | 27 +++
 1 file changed, 11 insertions(+), 16 deletions(-)

--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1189,8 +1189,6 @@ static int netlbl_unlabel_staticlist(str
struct netlbl_unlhsh_walk_arg cb_arg;
u32 skip_bkt = cb->args[0];
u32 skip_chain = cb->args[1];
-   u32 skip_addr4 = cb->args[2];
-   u32 skip_addr6 = cb->args[3];
u32 iter_bkt;
u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
struct netlbl_unlhsh_iface *iface;
@@ -1215,7 +1213,7 @@ static int netlbl_unlabel_staticlist(str
continue;
netlbl_af4list_foreach_rcu(addr4,
   >addr4_list) {
-   if (iter_addr4++ < skip_addr4)
+   if (iter_addr4++ < cb->args[2])
continue;
if (netlbl_unlabel_staticlist_gen(
  NLBL_UNLABEL_C_STATICLIST,
@@ -1231,7 +1229,7 @@ static int netlbl_unlabel_staticlist(str
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
netlbl_af6list_foreach_rcu(addr6,
   >addr6_list) {
-   if (iter_addr6++ < skip_addr6)
+   if (iter_addr6++ < cb->args[3])
continue;
if (netlbl_unlabel_staticlist_gen(
  NLBL_UNLABEL_C_STATICLIST,
@@ -1250,10 +1248,10 @@ static int netlbl_unlabel_staticlist(str
 
 unlabel_staticlist_return:
rcu_read_unlock();
-   cb->args[0] = skip_bkt;
-   cb->args[1] = skip_chain;
-   cb->args[2] = skip_addr4;
-   cb->args[3] = skip_addr6;
+   cb->args[0] = iter_bkt;
+   cb->args[1] = iter_chain;
+   cb->args[2] = iter_addr4;
+   cb->args[3] = iter_addr6;
return skb->len;
 }
 
@@ -1273,12 +1271,9 @@ static int netlbl_unlabel_staticlistdef(
 {
struct netlbl_unlhsh_walk_arg cb_arg;
struct netlbl_unlhsh_iface *iface;
-   u32 skip_addr4 = cb->args[0];
-   u32 skip_addr6 = cb->args[1];
-   u32 iter_addr4 = 0;
+   u32 iter_addr4 = 0, iter_addr6 = 0;
struct netlbl_af4list *addr4;
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-   u32 iter_addr6 = 0;
struct netlbl_af6list *addr6;
 #endif
 
@@ -1292,7 +1287,7 @@ static int netlbl_unlabel_staticlistdef(
goto unlabel_staticlistdef_return;
 
netlbl_af4list_foreach_rcu(addr4, >addr4_list) {
-   if (iter_addr4++ < skip_addr4)
+   if (iter_addr4++ < cb->args[0])
continue;
if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
  iface,
@@ -1305,7 +1300,7 @@ static int netlbl_unlabel_staticlistdef(
}
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
netlbl_af6list_foreach_rcu(addr6, >addr6_list) {
-   if (iter_addr6++ < skip_addr6)
+   if (iter_addr6++ < cb->args[1])
continue;
if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
  iface,
@@ -1320,8 +1315,8 @@ static int netlbl_unlabel_staticlistdef(
 
 unlabel_staticlistdef_return:
rcu_read_unlock();
-   cb->args[0] = skip_addr4;
-   cb->args[1] = skip_addr6;
+   cb->args[0] = iter_addr4;
+   cb->args[1] = iter_addr6;
return skb->len;
 }
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 001/104] TTY: do not reset masters packet mode

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Jiri Slaby 

commit b81273a132177edd806476b953f6afeb17b786d5 upstream.

Now that login from util-linux is forced to drop all references to a
TTY which it wants to hangup (to reach reference count 1) we are
seeing issues with telnet. When login closes its last reference to the
slave PTY, it also resets packet mode on the *master* side. And we
have a race here.

What telnet does is fork+exec of `login'. Then there are two
scenarios:
* `login' closes the slave TTY and resets thus master's packet mode,
  but even now telnet properly sets the mode, or
* `telnetd' sets packet mode on the master, `login' closes the slave
  TTY and resets master's packet mode.

The former case is OK. However the latter happens in much more cases,
by the order of magnitude to be precise. So when one tries to login to
such a messed telnet setup, they see the following:
inux login:
ogin incorrect

Note the missing first letters -- telnet thinks it is still in the
packet mode, so when it receives "linux login" from `login', it
considers "l" as the type of the packet and strips it.

SuS does not mention how the implementation should behave. Both BSDs I
checked (Free and Net) do not reset the flag upon the last close.

By this I am resurrecting an old bug, see References. We are hitting
it regularly now, i.e. with updated util-linux, ergo login.

Here, I am changing a behavior introduced back in 2.1 times. It would
better have a long time testing before goes upstream.

Signed-off-by: Jiri Slaby 
Cc: Mauro Carvalho Chehab 
Cc: Bryan Mason 
References: https://lkml.org/lkml/2009/11/11/223
References: https://bugzilla.redhat.com/show_bug.cgi?id=504703
References: https://bugzilla.novell.com/show_bug.cgi?id=797042
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/tty/pty.c |1 -
 1 file changed, 1 deletion(-)

--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -49,7 +49,6 @@ static void pty_close(struct tty_struct
tty->packet = 0;
if (!tty->link)
return;
-   tty->link->packet = 0;
set_bit(TTY_OTHER_CLOSED, >link->flags);
wake_up_interruptible(>link->read_wait);
wake_up_interruptible(>link->write_wait);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 008/104] tcp: fix double-counted receiver RTT when leaving receiver fast path

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Neal Cardwell 

[ Upstream commit aab2b4bf224ef8358d262f95b568b8ad0cecf0a0 ]

We should not update ts_recent and call tcp_rcv_rtt_measure_ts() both
before and after going to step5. That wastes CPU and double-counts the
receiver-side RTT sample.

Signed-off-by: Neal Cardwell 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings 
---
 net/ipv4/tcp_input.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5494,6 +5494,9 @@ int tcp_rcv_established(struct sock *sk,
if (tcp_checksum_complete_user(sk, skb))
goto csum_error;
 
+   if ((int)skb->truesize > sk->sk_forward_alloc)
+   goto step5;
+
/* Predicted packet is in window by definition.
 * seq == rcv_nxt and rcv_wup <= rcv_nxt.
 * Hence, check seq<=rcv_wup reduces to:
@@ -5505,9 +5508,6 @@ int tcp_rcv_established(struct sock *sk,
 
tcp_rcv_rtt_measure_ts(sk, skb);
 
-   if ((int)skb->truesize > sk->sk_forward_alloc)
-   goto step5;
-
NET_INC_STATS_BH(sock_net(sk), 
LINUX_MIB_TCPHPHITS);
 
/* Bulk data transfer: receiver */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 102/104] KMS: fix EDID detailed timing vsync parsing

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Torsten Duwe 

commit 16dad1d743d31a104a849c8944e6b9eb479f6cd7 upstream.

EDID spreads some values across multiple bytes; bit-fiddling is needed
to retrieve these.  The current code to parse "detailed timings" has a
cut error that results in a vsync offset of at most 15 lines
instead of 63.

See

   http://en.wikipedia.org/wiki/EDID

and in the "EDID Detailed Timing Descriptor" see bytes 10+11 show why
that needs to be a left shift.

Signed-off-by: Torsten Duwe 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/drm_edid.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -852,7 +852,7 @@ static struct drm_display_mode *drm_mode
unsigned vblank = (pt->vactive_vblank_hi & 0xf) << 8 | pt->vblank_lo;
unsigned hsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc0) 
<< 2 | pt->hsync_offset_lo;
unsigned hsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 
0x30) << 4 | pt->hsync_pulse_width_lo;
-   unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) 
>> 2 | pt->vsync_offset_pulse_width_lo >> 4;
+   unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) 
<< 2 | pt->vsync_offset_pulse_width_lo >> 4;
unsigned vsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 
0x3) << 4 | (pt->vsync_offset_pulse_width_lo & 0xf);
 
/* ignore tiny modes */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 100/104] vfs,proc: guarantee unique inodes in /proc

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Linus Torvalds 

commit 51f0885e5415b4cc6535e9cdcc5145bfbc134353 upstream.

Dave Jones found another /proc issue with his Trinity tool: thanks to
the namespace model, we can have multiple /proc dentries that point to
the same inode, aliasing directories in /proc//net/ for example.

This ends up being a total disaster, because it acts like hardlinked
directories, and causes locking problems.  We rely on the topological
sort of the inodes pointed to by dentries, and if we have aliased
directories, that odering becomes unreliable.

In short: don't do this.  Multiple dentries with the same (directory)
inode is just a bad idea, and the namespace code should never have
exposed things this way.  But we're kind of stuck with it.

This solves things by just always allocating a new inode during /proc
dentry lookup, instead of using "iget_locked()" to look up existing
inodes by superblock and number.  That actually simplies the code a bit,
at the cost of potentially doing more inode [de]allocations.

That said, the inode lookup wasn't free either (and did a lot of locking
of inodes), so it is probably not that noticeable.  We could easily keep
the old lookup model for non-directory entries, but rather than try to
be excessively clever this just implements the minimal and simplest
workaround for the problem.

Reported-and-tested-by: Dave Jones 
Analyzed-by: Al Viro 
Signed-off-by: Linus Torvalds 
[bwh: Backported to 3.2:
 - Adjust context
 - Never drop the pde reference in proc_get_inode(), as callers only
   expect this when we return an existing inode, and we never do that now]
Signed-off-by: Ben Hutchings 
---
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -427,12 +427,10 @@ static const struct file_operations proc
 
 struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
 {
-   struct inode * inode;
+   struct inode *inode = new_inode_pseudo(sb);
 
-   inode = iget_locked(sb, de->low_ino);
-   if (!inode)
-   return NULL;
-   if (inode->i_state & I_NEW) {
+   if (inode) {
+   inode->i_ino = de->low_ino;
inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
PROC_I(inode)->fd = 0;
PROC_I(inode)->pde = de;
@@ -461,9 +459,7 @@ struct inode *proc_get_inode(struct supe
inode->i_fop = de->proc_fops;
}
}
-   unlock_new_inode(inode);
-   } else
-  pde_put(de);
+   }
return inode;
 }  
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 103/104] KMS: fix EDID detailed timing frame rate

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Torsten Duwe 

commit c19b3b0f6eed552952845e4ad908dba2113d67b4 upstream.

When KMS has parsed an EDID "detailed timing", it leaves the frame rate
zeroed.  Consecutive (debug-) output of that mode thus yields 0 for
vsync.  This simple fix also speeds up future invocations of
drm_mode_vrefresh().

While it is debatable whether this qualifies as a -stable fix I'd apply
it for consistency's sake; drm_helper_probe_single_connector_modes()
does the same thing already for all probed modes.

Signed-off-by: Torsten Duwe 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 drivers/gpu/drm/drm_edid.c |1 +
 1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -933,6 +933,7 @@ set_size:
}
 
mode->type = DRM_MODE_TYPE_DRIVER;
+   mode->vrefresh = drm_mode_vrefresh(mode);
drm_mode_set_name(mode);
 
return mode;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 095/104] USB: pl2303: fix use-after-free in TIOCMIWAIT

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 40509ca982c00c4b70fc00be887509feca0bff15 upstream.

Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.

This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/pl2303.c |   11 ++-
 1 file changed, 6 insertions(+), 5 deletions(-)

--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -150,7 +150,6 @@ enum pl2303_type {
 
 struct pl2303_private {
spinlock_t lock;
-   wait_queue_head_t delta_msr_wait;
u8 line_control;
u8 line_status;
enum pl2303_type type;
@@ -204,7 +203,6 @@ static int pl2303_startup(struct usb_ser
if (!priv)
goto cleanup;
spin_lock_init(>lock);
-   init_waitqueue_head(>delta_msr_wait);
priv->type = type;
usb_set_serial_port_data(serial->port[i], priv);
}
@@ -599,11 +597,14 @@ static int wait_modem_info(struct usb_se
spin_unlock_irqrestore(>lock, flags);
 
while (1) {
-   interruptible_sleep_on(>delta_msr_wait);
+   interruptible_sleep_on(>delta_msr_wait);
/* see if a signal did it */
if (signal_pending(current))
return -ERESTARTSYS;
 
+   if (port->serial->disconnected)
+   return -EIO;
+
spin_lock_irqsave(>lock, flags);
status = priv->line_status;
spin_unlock_irqrestore(>lock, flags);
@@ -725,7 +726,7 @@ static void pl2303_update_line_status(st
spin_unlock_irqrestore(>lock, flags);
if (priv->line_status & UART_BREAK_ERROR)
usb_serial_handle_break(port);
-   wake_up_interruptible(>delta_msr_wait);
+   wake_up_interruptible(>delta_msr_wait);
 
tty = tty_port_tty_get(>port);
if (!tty)
@@ -792,7 +793,7 @@ static void pl2303_process_read_urb(stru
line_status = priv->line_status;
priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
spin_unlock_irqrestore(>lock, flags);
-   wake_up_interruptible(>delta_msr_wait);
+   wake_up_interruptible(>delta_msr_wait);
 
if (!urb->actual_length)
return;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 104/104] efivars: pstore: Do not check size when erasing variable

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Ben Hutchings 

In 3.2, unlike mainline, efi_pstore_erase() calls efi_pstore_write()
with a size of 0, as the underlying EFI interface treats a size of 0
as meaning deletion.

This was not taken into account in my backport of commit d80a361d779a
'efi_pstore: Check remaining space with QueryVariableInfo() before
writing data'.  The size check should be omitted when erasing.

Signed-off-by: Ben Hutchings 
---
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -787,19 +787,21 @@ static int efi_pstore_write(enum pstore_
 
spin_lock_irqsave(>lock, flags);
 
-   /*
-* Check if there is a space enough to log.
-* size: a size of logging data
-* DUMP_NAME_LEN * 2: a maximum size of variable name
-*/
+   if (size) {
+   /*
+* Check if there is a space enough to log.
+* size: a size of logging data
+* DUMP_NAME_LEN * 2: a maximum size of variable name
+*/
 
-   status = check_var_size_locked(efivars, PSTORE_EFI_ATTRIBUTES,
-size + DUMP_NAME_LEN * 2);
+   status = check_var_size_locked(efivars, PSTORE_EFI_ATTRIBUTES,
+  size + DUMP_NAME_LEN * 2);
 
-   if (status) {
-   spin_unlock_irqrestore(>lock, flags);
-   *id = part;
-   return -ENOSPC;
+   if (status) {
+   spin_unlock_irqrestore(>lock, flags);
+   *id = part;
+   return -ENOSPC;
+   }
}
 
for (i = 0; i < DUMP_NAME_LEN; i++)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 097/104] USB: ssu100: fix use-after-free in TIOCMIWAIT

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 43a66b4c417ad15f6d2f632ce67ad195bdf999e8 upstream.

Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.

This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/ssu100.c |   12 +++-
 1 file changed, 7 insertions(+), 5 deletions(-)

--- a/drivers/usb/serial/ssu100.c
+++ b/drivers/usb/serial/ssu100.c
@@ -78,7 +78,6 @@ struct ssu100_port_private {
spinlock_t status_lock;
u8 shadowLSR;
u8 shadowMSR;
-   wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
struct async_icount icount;
 };
 
@@ -387,8 +386,9 @@ static int wait_modem_info(struct usb_se
spin_unlock_irqrestore(>status_lock, flags);
 
while (1) {
-   wait_event_interruptible(priv->delta_msr_wait,
-((priv->icount.rng != prev.rng) ||
+   wait_event_interruptible(port->delta_msr_wait,
+(port->serial->disconnected ||
+ (priv->icount.rng != prev.rng) ||
  (priv->icount.dsr != prev.dsr) ||
  (priv->icount.dcd != prev.dcd) ||
  (priv->icount.cts != prev.cts)));
@@ -396,6 +396,9 @@ static int wait_modem_info(struct usb_se
if (signal_pending(current))
return -ERESTARTSYS;
 
+   if (port->serial->disconnected)
+   return -EIO;
+
spin_lock_irqsave(>status_lock, flags);
cur = priv->icount;
spin_unlock_irqrestore(>status_lock, flags);
@@ -478,7 +481,6 @@ static int ssu100_attach(struct usb_seri
}
 
spin_lock_init(>status_lock);
-   init_waitqueue_head(>delta_msr_wait);
usb_set_serial_port_data(port, priv);
 
return ssu100_initdevice(serial->dev);
@@ -564,7 +566,7 @@ static void ssu100_update_msr(struct usb
priv->icount.dcd++;
if (msr & UART_MSR_TERI)
priv->icount.rng++;
-   wake_up_interruptible(>delta_msr_wait);
+   wake_up_interruptible(>delta_msr_wait);
}
 }
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 096/104] USB: spcp8x5: fix use-after-free in TIOCMIWAIT

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit dbcea7615d8d7d58f6ff49d2c5568113f70effe9 upstream.

Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.

This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context, indentation]
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/spcp8x5.c |9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/usb/serial/spcp8x5.c
+++ b/drivers/usb/serial/spcp8x5.c
@@ -163,7 +163,6 @@ static struct usb_driver spcp8x5_driver
 struct spcp8x5_private {
spinlock_t  lock;
enum spcp8x5_type   type;
-   wait_queue_head_t   delta_msr_wait;
u8  line_control;
u8  line_status;
 };
@@ -197,7 +196,6 @@ static int spcp8x5_startup(struct usb_se
goto cleanup;
 
spin_lock_init(>lock);
-   init_waitqueue_head(>delta_msr_wait);
priv->type = type;
usb_set_serial_port_data(serial->port[i] , priv);
}
@@ -502,7 +500,7 @@ static void spcp8x5_process_read_urb(str
priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
spin_unlock_irqrestore(>lock, flags);
/* wake up the wait for termios */
-   wake_up_interruptible(>delta_msr_wait);
+   wake_up_interruptible(>delta_msr_wait);
 
if (!urb->actual_length)
return;
@@ -552,12 +550,15 @@ static int spcp8x5_wait_modem_info(struc
 
while (1) {
/* wake up in bulk read */
-   interruptible_sleep_on(>delta_msr_wait);
+   interruptible_sleep_on(>delta_msr_wait);
 
/* see if a signal did it */
if (signal_pending(current))
return -ERESTARTSYS;
 
+   if (port->serial->disconnected)
+   return -EIO;
+
spin_lock_irqsave(>lock, flags);
status = priv->line_status;
spin_unlock_irqrestore(>lock, flags);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 093/104] USB: mos7840: fix use-after-free in TIOCMIWAIT

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit a14430db686b8e459e1cf070a6ecf391515c9ab9 upstream.

Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.

This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/mos7840.c |   13 -
 1 file changed, 8 insertions(+), 5 deletions(-)

--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -240,7 +240,6 @@ struct moschip_port {
char open;
char open_ports;
wait_queue_head_t wait_chase;   /* for handling sleeping while waiting 
for chase to finish */
-   wait_queue_head_t delta_msr_wait;   /* for handling sleeping while 
waiting for msr change to happen */
int delta_msr_cond;
struct async_icount icount;
struct usb_serial_port *port;   /* loop back to the owner of this 
object */
@@ -455,7 +454,7 @@ static void mos7840_handle_new_msr(struc
}
 
mos7840_port->delta_msr_cond = 1;
-   wake_up_interruptible(_port->delta_msr_wait);
+   wake_up_interruptible(>port->delta_msr_wait);
}
 }
 
@@ -1118,7 +1117,6 @@ static int mos7840_open(struct tty_struc
 
/* initialize our wait queues */
init_waitqueue_head(_port->wait_chase);
-   init_waitqueue_head(_port->delta_msr_wait);
 
/* initialize our icount structure */
memset(&(mos7840_port->icount), 0x00, sizeof(mos7840_port->icount));
@@ -2285,13 +2283,18 @@ static int mos7840_ioctl(struct tty_stru
while (1) {
/* 
interruptible_sleep_on(_port->delta_msr_wait); */
mos7840_port->delta_msr_cond = 0;
-   wait_event_interruptible(mos7840_port->delta_msr_wait,
-(mos7840_port->
+   wait_event_interruptible(port->delta_msr_wait,
+(port->serial->disconnected ||
+ mos7840_port->
  delta_msr_cond == 1));
 
/* see if a signal did it */
if (signal_pending(current))
return -ERESTARTSYS;
+
+   if (port->serial->disconnected)
+   return -EIO;
+
cnow = mos7840_port->icount;
smp_rmb();
if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 094/104] USB: oti6858: fix use-after-free in TIOCMIWAIT

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 8edfdab37157d2683e51b8be5d3d5697f66a9f7b upstream.

Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.

This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context, indentation]
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/oti6858.c |   10 ++
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/drivers/usb/serial/oti6858.c
+++ b/drivers/usb/serial/oti6858.c
@@ -196,7 +196,6 @@ struct oti6858_private {
u8 setup_done;
struct delayed_work delayed_setup_work;
 
-   wait_queue_head_t intr_wait;
struct usb_serial_port *port;   /* USB port with which associated */
 };
 
@@ -357,7 +356,6 @@ static int oti6858_startup(struct usb_se
break;
 
spin_lock_init(>lock);
-   init_waitqueue_head(>intr_wait);
 /* INIT_WORK(>setup_work, setup_line, serial->port[i]); */
 /* INIT_WORK(>write_work, send_data, serial->port[i]); */
priv->port = port;
@@ -705,11 +703,15 @@ static int wait_modem_info(struct usb_se
spin_unlock_irqrestore(>lock, flags);
 
while (1) {
-   wait_event_interruptible(priv->intr_wait,
+   wait_event_interruptible(port->delta_msr_wait,
+   port->serial->disconnected ||
priv->status.pin_state != prev);
if (signal_pending(current))
return -ERESTARTSYS;
 
+   if (port->serial->disconnected)
+   return -EIO;
+
spin_lock_irqsave(>lock, flags);
status = priv->status.pin_state & PIN_MASK;
spin_unlock_irqrestore(>lock, flags);
@@ -821,7 +823,7 @@ static void oti6858_read_int_callback(st
 
if (!priv->transient) {
if (xs->pin_state != priv->status.pin_state)
-   wake_up_interruptible(>intr_wait);
+   wake_up_interruptible(>delta_msr_wait);
memcpy(>status, xs, OTI6858_CTRL_PKT_SIZE);
}
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 092/104] USB: mos7840: fix broken TIOCMIWAIT

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit e670c6af12517d08a403487b1122eecf506021cf upstream.

Make sure waiting processes are woken on modem-status changes.

Currently processes are only woken on termios changes regardless of
whether the modem status has changed.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/mos7840.c |5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -453,6 +453,9 @@ static void mos7840_handle_new_msr(struc
icount->rng++;
smp_wmb();
}
+
+   mos7840_port->delta_msr_cond = 1;
+   wake_up_interruptible(_port->delta_msr_wait);
}
 }
 
@@ -2073,8 +2076,6 @@ static void mos7840_change_port_settings
mos7840_port->read_urb_busy = false;
}
}
-   wake_up(_port->delta_msr_wait);
-   mos7840_port->delta_msr_cond = 1;
dbg("mos7840_change_port_settings mos7840_port->shadowLCR is End %x",
mos7840_port->shadowLCR);
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 089/104] USB: io_edgeport: fix use-after-free in TIOCMIWAIT

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 333576255d4cfc53efd056aad438568184b36af6 upstream.

Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.

This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/io_edgeport.c |   12 +++-
 1 file changed, 7 insertions(+), 5 deletions(-)

--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -114,7 +114,6 @@ struct edgeport_port {
wait_queue_head_t   wait_chase; /* for handling 
sleeping while waiting for chase to finish */
wait_queue_head_t   wait_open;  /* for handling 
sleeping while waiting for open to finish */
wait_queue_head_t   wait_command;   /* for handling 
sleeping while waiting for command to finish */
-   wait_queue_head_t   delta_msr_wait; /* for handling 
sleeping while waiting for msr change to happen */
 
struct async_icount icount;
struct usb_serial_port  *port;  /* loop back to the 
owner of this object */
@@ -885,7 +884,6 @@ static int edge_open(struct tty_struct *
/* initialize our wait queues */
init_waitqueue_head(_port->wait_open);
init_waitqueue_head(_port->wait_chase);
-   init_waitqueue_head(_port->delta_msr_wait);
init_waitqueue_head(_port->wait_command);
 
/* initialize our icount structure */
@@ -1703,13 +1701,17 @@ static int edge_ioctl(struct tty_struct
dbg("%s (%d) TIOCMIWAIT", __func__,  port->number);
cprev = edge_port->icount;
while (1) {
-   prepare_to_wait(_port->delta_msr_wait,
+   prepare_to_wait(>delta_msr_wait,
, TASK_INTERRUPTIBLE);
schedule();
-   finish_wait(_port->delta_msr_wait, );
+   finish_wait(>delta_msr_wait, );
/* see if a signal did it */
if (signal_pending(current))
return -ERESTARTSYS;
+
+   if (port->serial->disconnected)
+   return -EIO;
+
cnow = edge_port->icount;
if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
@@ -2090,7 +2092,7 @@ static void handle_new_msr(struct edgepo
icount->dcd++;
if (newMsr & EDGEPORT_MSR_DELTA_RI)
icount->rng++;
-   wake_up_interruptible(_port->delta_msr_wait);
+   wake_up_interruptible(_port->port->delta_msr_wait);
}
 
/* Save the new modem status */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 087/104] USB: cypress_m8: fix use-after-free in TIOCMIWAIT

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 356050d8b1e526db093e9d2c78daf49d6bf418e3 upstream.

Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.

This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.

Also remove bogus test for private data pointer being NULL as it is
never assigned in the loop.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/cypress_m8.c |   14 --
 1 file changed, 8 insertions(+), 6 deletions(-)

--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -150,7 +150,6 @@ struct cypress_private {
int baud_rate; /* stores current baud rate in
  integer form */
int isthrottled;   /* if throttled, discard reads */
-   wait_queue_head_t delta_msr_wait;  /* used for TIOCMIWAIT */
char prev_status, diff_status; /* used for TIOCMIWAIT */
/* we pass a pointer to this as the argument sent to
   cypress_set_termios old_termios */
@@ -488,7 +487,6 @@ static int generic_startup(struct usb_se
kfree(priv);
return -ENOMEM;
}
-   init_waitqueue_head(>delta_msr_wait);
 
usb_reset_configuration(serial->dev);
 
@@ -928,12 +926,16 @@ static int cypress_ioctl(struct tty_stru
switch (cmd) {
/* This code comes from drivers/char/serial.c and ftdi_sio.c */
case TIOCMIWAIT:
-   while (priv != NULL) {
-   interruptible_sleep_on(>delta_msr_wait);
+   for (;;) {
+   interruptible_sleep_on(>delta_msr_wait);
/* see if a signal did it */
if (signal_pending(current))
return -ERESTARTSYS;
-   else {
+
+   if (port->serial->disconnected)
+   return -EIO;
+
+   {
char diff = priv->diff_status;
if (diff == 0)
return -EIO; /* no change => error */
@@ -1261,7 +1263,7 @@ static void cypress_read_int_callback(st
if (priv->current_status != priv->prev_status) {
priv->diff_status |= priv->current_status ^
priv->prev_status;
-   wake_up_interruptible(>delta_msr_wait);
+   wake_up_interruptible(>delta_msr_wait);
priv->prev_status = priv->current_status;
}
spin_unlock_irqrestore(>lock, flags);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 101/104] mm/hugetlb: fix total hugetlbfs pages count when using memory

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Wanpeng Li 

commit d00285884c0892bb1310df96bce6056e9ce9b9d9 upstream.

hugetlb_total_pages is used for overcommit calculations but the current
implementation considers only the default hugetlb page size (which is
either the first defined hugepage size or the one specified by
default_hugepagesz kernel boot parameter).

If the system is configured for more than one hugepage size, which is
possible since commit a137e1cc6d6e ("hugetlbfs: per mount huge page
sizes") then the overcommit estimation done by __vm_enough_memory()
(resp.  shown by meminfo_proc_show) is not precise - there is an
impression of more available/allowed memory.  This can lead to an
unexpected ENOMEM/EFAULT resp.  SIGSEGV when memory is accounted.

Testcase:
  boot: hugepagesz=1G hugepages=1
  the default overcommit ratio is 50
  before patch:

egrep 'CommitLimit' /proc/meminfo
CommitLimit: 55434168 kB

  after patch:

egrep 'CommitLimit' /proc/meminfo
CommitLimit: 54909880 kB

[a...@linux-foundation.org: coding-style tweak]
Signed-off-by: Wanpeng Li 
Acked-by: Michal Hocko 
Cc: "Aneesh Kumar K.V" 
Cc: Hillf Danton 
Cc: KAMEZAWA Hiroyuki 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings 
---
 mm/hugetlb.c |8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2092,8 +2092,12 @@ int hugetlb_report_node_meminfo(int nid,
 /* Return the number pages of memory we physically have, in PAGE_SIZE units. */
 unsigned long hugetlb_total_pages(void)
 {
-   struct hstate *h = _hstate;
-   return h->nr_huge_pages * pages_per_huge_page(h);
+   struct hstate *h;
+   unsigned long nr_total_pages = 0;
+
+   for_each_hstate(h)
+   nr_total_pages += h->nr_huge_pages * pages_per_huge_page(h);
+   return nr_total_pages;
 }
 
 static int hugetlb_acct_memory(struct hstate *h, long delta)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 086/104] USB: ch341: fix use-after-free in TIOCMIWAIT

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit fa1e11d5231c001c80a479160b5832933c5d35fb upstream.

Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.

This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/ch341.c |   11 ++-
 1 file changed, 6 insertions(+), 5 deletions(-)

--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -82,7 +82,6 @@ MODULE_DEVICE_TABLE(usb, id_table);
 
 struct ch341_private {
spinlock_t lock; /* access lock */
-   wait_queue_head_t delta_msr_wait; /* wait queue for modem status */
unsigned baud_rate; /* set baud rate */
u8 line_control; /* set line control value RTS/DTR */
u8 line_status; /* active status of modem control inputs */
@@ -262,7 +261,6 @@ static int ch341_attach(struct usb_seria
return -ENOMEM;
 
spin_lock_init(>lock);
-   init_waitqueue_head(>delta_msr_wait);
priv->baud_rate = DEFAULT_BAUD_RATE;
priv->line_control = CH341_BIT_RTS | CH341_BIT_DTR;
 
@@ -299,7 +297,7 @@ static void ch341_dtr_rts(struct usb_ser
priv->line_control &= ~(CH341_BIT_RTS | CH341_BIT_DTR);
spin_unlock_irqrestore(>lock, flags);
ch341_set_handshake(port->serial->dev, priv->line_control);
-   wake_up_interruptible(>delta_msr_wait);
+   wake_up_interruptible(>delta_msr_wait);
 }
 
 static void ch341_close(struct usb_serial_port *port)
@@ -503,7 +501,7 @@ static void ch341_read_int_callback(stru
tty_kref_put(tty);
}
 
-   wake_up_interruptible(>delta_msr_wait);
+   wake_up_interruptible(>delta_msr_wait);
}
 
 exit:
@@ -529,11 +527,14 @@ static int wait_modem_info(struct usb_se
spin_unlock_irqrestore(>lock, flags);
 
while (!multi_change) {
-   interruptible_sleep_on(>delta_msr_wait);
+   interruptible_sleep_on(>delta_msr_wait);
/* see if a signal did it */
if (signal_pending(current))
return -ERESTARTSYS;
 
+   if (port->serial->disconnected)
+   return -EIO;
+
spin_lock_irqsave(>lock, flags);
status = priv->line_status;
multi_change = priv->multi_status_change;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 090/104] USB: io_ti: fix use-after-free in TIOCMIWAIT

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 7b2459690584f239650a365f3411ba2ec1c6d1e0 upstream.

Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.

This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/io_ti.c |   12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -98,9 +98,6 @@ struct edgeport_port {
int close_pending;
int lsr_event;
struct async_icount icount;
-   wait_queue_head_t   delta_msr_wait; /* for handling sleeping while
-  waiting for msr change to
-  happen */
struct edgeport_serial  *edge_serial;
struct usb_serial_port  *port;
__u8 bUartMode; /* Port type, 0: RS232, etc. */
@@ -1557,7 +1554,7 @@ static void handle_new_msr(struct edgepo
icount->dcd++;
if (msr & EDGEPORT_MSR_DELTA_RI)
icount->rng++;
-   wake_up_interruptible(_port->delta_msr_wait);
+   wake_up_interruptible(_port->port->delta_msr_wait);
}
 
/* Save the new modem status */
@@ -1876,7 +1873,6 @@ static int edge_open(struct tty_struct *
dev = port->serial->dev;
 
memset(&(edge_port->icount), 0x00, sizeof(edge_port->icount));
-   init_waitqueue_head(_port->delta_msr_wait);
 
/* turn off loopback */
status = ti_do_config(edge_port, UMPC_SET_CLR_LOOPBACK, 0);
@@ -2574,10 +2570,14 @@ static int edge_ioctl(struct tty_struct
dbg("%s - (%d) TIOCMIWAIT", __func__, port->number);
cprev = edge_port->icount;
while (1) {
-   interruptible_sleep_on(_port->delta_msr_wait);
+   interruptible_sleep_on(>delta_msr_wait);
/* see if a signal did it */
if (signal_pending(current))
return -ERESTARTSYS;
+
+   if (port->serial->disconnected)
+   return -EIO;
+
cnow = edge_port->icount;
if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 098/104] USB: ti_usb_3410_5052: fix use-after-free in TIOCMIWAIT

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit fc98ab873aa3dbe783ce56a2ffdbbe7c7609521a upstream.

Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.

This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/ti_usb_3410_5052.c |   10 ++
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -75,7 +75,6 @@ struct ti_port {
int tp_flags;
int tp_closing_wait;/* in .01 secs */
struct async_icount tp_icount;
-   wait_queue_head_t   tp_msr_wait;/* wait for msr change */
wait_queue_head_t   tp_write_wait;
struct ti_device*tp_tdev;
struct usb_serial_port  *tp_port;
@@ -447,7 +446,6 @@ static int ti_startup(struct usb_serial
tport->tp_uart_base_addr = (i == 0 ?
TI_UART1_BASE_ADDR : TI_UART2_BASE_ADDR);
tport->tp_closing_wait = closing_wait;
-   init_waitqueue_head(>tp_msr_wait);
init_waitqueue_head(>tp_write_wait);
if (kfifo_alloc(>write_fifo, TI_WRITE_BUF_SIZE,
GFP_KERNEL)) {
@@ -848,9 +846,13 @@ static int ti_ioctl(struct tty_struct *t
dbg("%s - (%d) TIOCMIWAIT", __func__, port->number);
cprev = tport->tp_icount;
while (1) {
-   interruptible_sleep_on(>tp_msr_wait);
+   interruptible_sleep_on(>delta_msr_wait);
if (signal_pending(current))
return -ERESTARTSYS;
+
+   if (port->serial->disconnected)
+   return -EIO;
+
cnow = tport->tp_icount;
if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
@@ -1481,7 +1483,7 @@ static void ti_handle_new_msr(struct ti_
icount->dcd++;
if (msr & TI_MSR_DELTA_RI)
icount->rng++;
-   wake_up_interruptible(>tp_msr_wait);
+   wake_up_interruptible(>tp_port->delta_msr_wait);
spin_unlock_irqrestore(>tp_lock, flags);
}
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 091/104] USB: mct_u232: fix use-after-free in TIOCMIWAIT

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit cf1d24443677a0758cfa88ca40f24858b89261c0 upstream.

Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.

This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/mct_u232.c |   13 +++--
 1 file changed, 7 insertions(+), 6 deletions(-)

--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -168,8 +168,6 @@ struct mct_u232_private {
unsigned charlast_msr;  /* Modem Status Register */
unsigned int rx_flags;  /* Throttling flags */
struct async_icount  icount;
-   wait_queue_head_tmsr_wait;  /* for handling sleeping while waiting
-   for msr change to happen */
 };
 
 #define THROTTLED  0x01
@@ -449,7 +447,6 @@ static int mct_u232_startup(struct usb_s
if (!priv)
return -ENOMEM;
spin_lock_init(>lock);
-   init_waitqueue_head(>msr_wait);
usb_set_serial_port_data(serial->port[0], priv);
 
init_waitqueue_head(>port[0]->write_wait);
@@ -675,7 +672,7 @@ static void mct_u232_read_int_callback(s
tty_kref_put(tty);
}
 #endif
-   wake_up_interruptible(>msr_wait);
+   wake_up_interruptible(>delta_msr_wait);
spin_unlock_irqrestore(>lock, flags);
 exit:
retval = usb_submit_urb(urb, GFP_ATOMIC);
@@ -896,13 +893,17 @@ static int  mct_u232_ioctl(struct tty_st
cprev = mct_u232_port->icount;
spin_unlock_irqrestore(_u232_port->lock, flags);
for ( ; ; ) {
-   prepare_to_wait(_u232_port->msr_wait,
+   prepare_to_wait(>delta_msr_wait,
, TASK_INTERRUPTIBLE);
schedule();
-   finish_wait(_u232_port->msr_wait, );
+   finish_wait(>delta_msr_wait, );
/* see if a signal did it */
if (signal_pending(current))
return -ERESTARTSYS;
+
+   if (port->serial->disconnected)
+   return -EIO;
+
spin_lock_irqsave(_u232_port->lock, flags);
cnow = mct_u232_port->icount;
spin_unlock_irqrestore(_u232_port->lock, flags);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 085/104] USB: ark3116: fix use-after-free in TIOCMIWAIT

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 5018860321dc7a9e50a75d5f319bc981298fb5b7 upstream.

Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.

This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/ark3116.c |   10 ++
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/drivers/usb/serial/ark3116.c
+++ b/drivers/usb/serial/ark3116.c
@@ -68,7 +68,6 @@ static int is_irda(struct usb_serial *se
 }
 
 struct ark3116_private {
-   wait_queue_head_t   delta_msr_wait;
struct async_icount icount;
int irda;   /* 1 for irda device */
 
@@ -148,7 +147,6 @@ static int ark3116_attach(struct usb_ser
if (!priv)
return -ENOMEM;
 
-   init_waitqueue_head(>delta_msr_wait);
mutex_init(>hw_lock);
spin_lock_init(>status_lock);
 
@@ -460,10 +458,14 @@ static int ark3116_ioctl(struct tty_stru
case TIOCMIWAIT:
for (;;) {
struct async_icount prev = priv->icount;
-   interruptible_sleep_on(>delta_msr_wait);
+   interruptible_sleep_on(>delta_msr_wait);
/* see if a signal did it */
if (signal_pending(current))
return -ERESTARTSYS;
+
+   if (port->serial->disconnected)
+   return -EIO;
+
if ((prev.rng == priv->icount.rng) &&
(prev.dsr == priv->icount.dsr) &&
(prev.dcd == priv->icount.dcd) &&
@@ -584,7 +586,7 @@ static void ark3116_update_msr(struct us
priv->icount.dcd++;
if (msr & UART_MSR_TERI)
priv->icount.rng++;
-   wake_up_interruptible(>delta_msr_wait);
+   wake_up_interruptible(>delta_msr_wait);
}
 }
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 099/104] i2c: tegra: check the clk_prepare_enable() return value

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Laxman Dewangan 

commit 132c803f7b70b17322579f6f4f3f65cf68e55135 upstream.

NVIDIA's Tegra SoC allows read/write of controller register only
if controller clock is enabled. System hangs if read/write happens
to registers without enabling clock.

clk_prepare_enable() can be fail due to unknown reason and hence
adding check for return value of this function. If this function
success then only access register otherwise return to caller with
error.

Signed-off-by: Laxman Dewangan 
Reviewed-by: Stephen Warren 
Signed-off-by: Wolfram Sang 
[bwh: Backported to 3.2:
 - Adjust context
 - Keep calling clk_enable() directly]
Signed-off-by: Ben Hutchings 
---
 drivers/i2c/busses/i2c-tegra.c |   13 +++--
 1 file changed, 11 insertions(+), 2 deletions(-)

--- a/drivers/i2c/busses/i2c-tegra.c
+++ b/drivers/i2c/busses/i2c-tegra.c
@@ -341,7 +341,11 @@ static int tegra_i2c_init(struct tegra_i
u32 val;
int err = 0;
 
-   clk_enable(i2c_dev->clk);
+   err = clk_enable(i2c_dev->clk);
+   if (err < 0) {
+   dev_err(i2c_dev->dev, "Clock enable failed %d\n", err);
+   return err;
+   }
 
tegra_periph_reset_assert(i2c_dev->clk);
udelay(2);
@@ -536,7 +540,12 @@ static int tegra_i2c_xfer(struct i2c_ada
if (i2c_dev->is_suspended)
return -EBUSY;
 
-   clk_enable(i2c_dev->clk);
+   ret = clk_enable(i2c_dev->clk);
+   if (ret < 0) {
+   dev_err(i2c_dev->dev, "Clock enable failed %d\n", ret);
+   return ret;
+   }
+
for (i = 0; i < num; i++) {
int stop = (i == (num - 1)) ? 1  : 0;
ret = tegra_i2c_xfer_msg(i2c_dev, [i], stop);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 083/104] USB: serial: fix interface refcounting

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit d7971051e4df825e0bc11b995e87bfe86355b8e5 upstream.

Make sure the interface is not released before our serial device.

Note that drivers are still not allowed to access the interface in
any way that may interfere with another driver that may have gotten
bound to the same interface after disconnect returns.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/usb-serial.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -168,6 +168,7 @@ static void destroy_serial(struct kref *
}
}
 
+   usb_put_intf(serial->interface);
usb_put_dev(serial->dev);
kfree(serial);
 }
@@ -624,7 +625,7 @@ static struct usb_serial *create_serial(
}
serial->dev = usb_get_dev(dev);
serial->type = driver;
-   serial->interface = interface;
+   serial->interface = usb_get_intf(interface);
kref_init(>kref);
mutex_init(>disc_mutex);
serial->minor = SERIAL_TTY_NO_MINOR;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 082/104] USB: io_ti: fix get_icount for two port adapters

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 5492bf3d5655b4954164f69c02955a7fca267611 upstream.

Add missing get_icount field to two-port driver.

The two-port driver was not updated when switching to the new icount
interface in commit 0bca1b913aff ("tty: Convert the USB drivers to the
new icount interface").

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/io_ti.c |1 +
 1 file changed, 1 insertion(+)

--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -2796,6 +2796,7 @@ static struct usb_serial_driver edgeport
.set_termios= edge_set_termios,
.tiocmget   = edge_tiocmget,
.tiocmset   = edge_tiocmset,
+   .get_icount = edge_get_icount,
.write  = edge_write,
.write_room = edge_write_room,
.chars_in_buffer= edge_chars_in_buffer,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 080/104] cifs: ignore everything in SPNEGO blob after mechTypes

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Jeff Layton 

commit f853c616883a8de966873a1dab283f1369e275a1 upstream.

We've had several reports of people attempting to mount Windows 8 shares
and getting failures with a return code of -EINVAL. The default sec=
mode changed recently to sec=ntlmssp. With that, we expect and parse a
SPNEGO blob from the server in the NEGOTIATE reply.

The current decode_negTokenInit function first parses all of the
mechTypes and then tries to parse the rest of the negTokenInit reply.
The parser however currently expects a mechListMIC or nothing to follow the
mechTypes, but Windows 8 puts a mechToken field there instead to carry
some info for the new NegoEx stuff.

In practice, we don't do anything with the fields after the mechTypes
anyway so I don't see any real benefit in continuing to parse them.
This patch just has the kernel ignore the fields after the mechTypes.
We'll probably need to reinstate some of this if we ever want to support
NegoEx.

Reported-by: Jason Burgess 
Reported-by: Yan Li 
Signed-off-by: Jeff Layton 
Signed-off-by: Steve French 
Signed-off-by: Ben Hutchings 
---
 fs/cifs/asn1.c |   53 +
 1 file changed, 5 insertions(+), 48 deletions(-)

--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -614,53 +614,10 @@ decode_negTokenInit(unsigned char *secur
}
}
 
-   /* mechlistMIC */
-   if (asn1_header_decode(, , , , ) == 0) {
-   /* Check if we have reached the end of the blob, but with
-  no mechListMic (e.g. NTLMSSP instead of KRB5) */
-   if (ctx.error == ASN1_ERR_DEC_EMPTY)
-   goto decode_negtoken_exit;
-   cFYI(1, "Error decoding last part negTokenInit exit3");
-   return 0;
-   } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
-   /* tag = 3 indicating mechListMIC */
-   cFYI(1, "Exit 4 cls = %d con = %d tag = %d end = %p (%d)",
-   cls, con, tag, end, *end);
-   return 0;
-   }
-
-   /* sequence */
-   if (asn1_header_decode(, , , , ) == 0) {
-   cFYI(1, "Error decoding last part negTokenInit exit5");
-   return 0;
-   } else if ((cls != ASN1_UNI) || (con != ASN1_CON)
-  || (tag != ASN1_SEQ)) {
-   cFYI(1, "cls = %d con = %d tag = %d end = %p (%d)",
-   cls, con, tag, end, *end);
-   }
-
-   /* sequence of */
-   if (asn1_header_decode(, , , , ) == 0) {
-   cFYI(1, "Error decoding last part negTokenInit exit 7");
-   return 0;
-   } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
-   cFYI(1, "Exit 8 cls = %d con = %d tag = %d end = %p (%d)",
-   cls, con, tag, end, *end);
-   return 0;
-   }
-
-   /* general string */
-   if (asn1_header_decode(, , , , ) == 0) {
-   cFYI(1, "Error decoding last part negTokenInit exit9");
-   return 0;
-   } else if ((cls != ASN1_UNI) || (con != ASN1_PRI)
-  || (tag != ASN1_GENSTR)) {
-   cFYI(1, "Exit10 cls = %d con = %d tag = %d end = %p (%d)",
-   cls, con, tag, end, *end);
-   return 0;
-   }
-   cFYI(1, "Need to call asn1_octets_decode() function for %s",
-   ctx.pointer);   /* is this UTF-8 or ASCII? */
-decode_negtoken_exit:
+   /*
+* We currently ignore anything at the end of the SPNEGO blob after
+* the mechTypes have been parsed, since none of that info is
+* used at the moment.
+*/
return 1;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 088/104] USB: ftdi_sio: fix use-after-free in TIOCMIWAIT

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 71ccb9b01981fabae27d3c98260ea4613207618e upstream.

Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.

This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.

When switching to tty ports, some lifetime assumptions were changed.
Specifically, close can now be called before the final tty reference is
dropped as part of hangup at device disconnect. Even with the ftdi
private-data refcounting this means that the port private data can be
freed while a process is sleeping on modem-status changes and thus
cannot be relied on to detect disconnects when woken up.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/ftdi_sio.c |   19 ---
 1 file changed, 8 insertions(+), 11 deletions(-)

--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -74,9 +74,7 @@ struct ftdi_private {
int flags;  /* some ASYNC_ flags are supported */
unsigned long last_dtr_rts; /* saved modem control outputs */
struct async_icount icount;
-   wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
char prev_status;/* Used for TIOCMIWAIT */
-   bool dev_gone;/* Used to abort TIOCMIWAIT */
char transmit_empty;/* If transmitter is empty or not */
struct usb_serial_port *port;
__u16 interface;/* FT2232C, FT2232H or FT4232H port interface
@@ -1707,10 +1705,8 @@ static int ftdi_sio_port_probe(struct us
kref_init(>kref);
mutex_init(>cfg_lock);
memset(>icount, 0x00, sizeof(priv->icount));
-   init_waitqueue_head(>delta_msr_wait);
 
priv->flags = ASYNC_LOW_LATENCY;
-   priv->dev_gone = false;
 
if (quirk && quirk->port_probe)
quirk->port_probe(priv);
@@ -1868,8 +1864,7 @@ static int ftdi_sio_port_remove(struct u
 
dbg("%s", __func__);
 
-   priv->dev_gone = true;
-   wake_up_interruptible_all(>delta_msr_wait);
+   wake_up_interruptible(>delta_msr_wait);
 
remove_sysfs_attrs(port);
 
@@ -2024,7 +2019,7 @@ static int ftdi_process_packet(struct tt
if (diff_status & FTDI_RS0_RLSD)
priv->icount.dcd++;
 
-   wake_up_interruptible_all(>delta_msr_wait);
+   wake_up_interruptible(>delta_msr_wait);
priv->prev_status = status;
}
 
@@ -2423,11 +2418,15 @@ static int ftdi_ioctl(struct tty_struct
 */
case TIOCMIWAIT:
cprev = priv->icount;
-   while (!priv->dev_gone) {
-   interruptible_sleep_on(>delta_msr_wait);
+   for (;;) {
+   interruptible_sleep_on(>delta_msr_wait);
/* see if a signal did it */
if (signal_pending(current))
return -ERESTARTSYS;
+
+   if (port->serial->disconnected)
+   return -EIO;
+
cnow = priv->icount;
if (((arg & TIOCM_RNG) && (cnow.rng != cprev.rng)) ||
((arg & TIOCM_DSR) && (cnow.dsr != cprev.dsr)) ||
@@ -2437,8 +2436,6 @@ static int ftdi_ioctl(struct tty_struct
}
cprev = cnow;
}
-   return -EIO;
-   break;
case TIOCSERGETLSR:
return get_lsr_info(port, (struct serial_struct __user *)arg);
break;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH] PowerPC:kernel: make additional room in exception vector area

[Chen Gang]

  The FWNMI region is fixed at 0x7000 and the vector are now overflowing
  that with allmodconfig. Fix that by moving slb_miss_realmode code out
  of that region as it doesn't need to be that close to the call sites
  (it is a _GLOBAL function)

Signed-off-by: Chen Gang 
---
 arch/powerpc/kernel/exceptions-64s.S |  144 +-
 1 files changed, 72 insertions(+), 72 deletions(-)

diff --git a/arch/powerpc/kernel/exceptions-64s.S 
b/arch/powerpc/kernel/exceptions-64s.S
index 200afa5..56bd923 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1066,78 +1066,6 @@ unrecov_user_slb:
 #endif /* __DISABLED__ */
 
 
-/*
- * r13 points to the PACA, r9 contains the saved CR,
- * r12 contain the saved SRR1, SRR0 is still ready for return
- * r3 has the faulting address
- * r9 - r13 are saved in paca->exslb.
- * r3 is saved in paca->slb_r3
- * We assume we aren't going to take any exceptions during this procedure.
- */
-_GLOBAL(slb_miss_realmode)
-   mflrr10
-#ifdef CONFIG_RELOCATABLE
-   mtctr   r11
-#endif
-
-   stw r9,PACA_EXSLB+EX_CCR(r13)   /* save CR in exc. frame */
-   std r10,PACA_EXSLB+EX_LR(r13)   /* save LR */
-
-   bl  .slb_allocate_realmode
-
-   /* All done -- return from exception. */
-
-   ld  r10,PACA_EXSLB+EX_LR(r13)
-   ld  r3,PACA_EXSLB+EX_R3(r13)
-   lwz r9,PACA_EXSLB+EX_CCR(r13)   /* get saved CR */
-
-   mtlrr10
-
-   andi.   r10,r12,MSR_RI  /* check for unrecoverable exception */
-   beq-2f
-
-.machine   push
-.machine   "power4"
-   mtcrf   0x80,r9
-   mtcrf   0x01,r9 /* slb_allocate uses cr0 and cr7 */
-.machine   pop
-
-   RESTORE_PPR_PACA(PACA_EXSLB, r9)
-   ld  r9,PACA_EXSLB+EX_R9(r13)
-   ld  r10,PACA_EXSLB+EX_R10(r13)
-   ld  r11,PACA_EXSLB+EX_R11(r13)
-   ld  r12,PACA_EXSLB+EX_R12(r13)
-   ld  r13,PACA_EXSLB+EX_R13(r13)
-   rfid
-   b   .   /* prevent speculative execution */
-
-2: mfspr   r11,SPRN_SRR0
-   ld  r10,PACAKBASE(r13)
-   LOAD_HANDLER(r10,unrecov_slb)
-   mtspr   SPRN_SRR0,r10
-   ld  r10,PACAKMSR(r13)
-   mtspr   SPRN_SRR1,r10
-   rfid
-   b   .
-
-unrecov_slb:
-   EXCEPTION_PROLOG_COMMON(0x4100, PACA_EXSLB)
-   DISABLE_INTS
-   bl  .save_nvgprs
-1: addir3,r1,STACK_FRAME_OVERHEAD
-   bl  .unrecoverable_exception
-   b   1b
-
-
-#ifdef CONFIG_PPC_970_NAP
-power4_fixup_nap:
-   andcr9,r9,r10
-   std r9,TI_LOCAL_FLAGS(r11)
-   ld  r10,_LINK(r1)   /* make idle task do the */
-   std r10,_NIP(r1)/* equivalent of a blr */
-   blr
-#endif
-
.align  7
.globl alignment_common
 alignment_common:
@@ -1336,6 +1264,78 @@ _GLOBAL(opal_mc_secondary_handler)
 
 
 /*
+ * r13 points to the PACA, r9 contains the saved CR,
+ * r12 contain the saved SRR1, SRR0 is still ready for return
+ * r3 has the faulting address
+ * r9 - r13 are saved in paca->exslb.
+ * r3 is saved in paca->slb_r3
+ * We assume we aren't going to take any exceptions during this procedure.
+ */
+_GLOBAL(slb_miss_realmode)
+   mflrr10
+#ifdef CONFIG_RELOCATABLE
+   mtctr   r11
+#endif
+
+   stw r9,PACA_EXSLB+EX_CCR(r13)   /* save CR in exc. frame */
+   std r10,PACA_EXSLB+EX_LR(r13)   /* save LR */
+
+   bl  .slb_allocate_realmode
+
+   /* All done -- return from exception. */
+
+   ld  r10,PACA_EXSLB+EX_LR(r13)
+   ld  r3,PACA_EXSLB+EX_R3(r13)
+   lwz r9,PACA_EXSLB+EX_CCR(r13)   /* get saved CR */
+
+   mtlrr10
+
+   andi.   r10,r12,MSR_RI  /* check for unrecoverable exception */
+   beq-2f
+
+.machine   push
+.machine   "power4"
+   mtcrf   0x80,r9
+   mtcrf   0x01,r9 /* slb_allocate uses cr0 and cr7 */
+.machine   pop
+
+   RESTORE_PPR_PACA(PACA_EXSLB, r9)
+   ld  r9,PACA_EXSLB+EX_R9(r13)
+   ld  r10,PACA_EXSLB+EX_R10(r13)
+   ld  r11,PACA_EXSLB+EX_R11(r13)
+   ld  r12,PACA_EXSLB+EX_R12(r13)
+   ld  r13,PACA_EXSLB+EX_R13(r13)
+   rfid
+   b   .   /* prevent speculative execution */
+
+2: mfspr   r11,SPRN_SRR0
+   ld  r10,PACAKBASE(r13)
+   LOAD_HANDLER(r10,unrecov_slb)
+   mtspr   SPRN_SRR0,r10
+   ld  r10,PACAKMSR(r13)
+   mtspr   SPRN_SRR1,r10
+   rfid
+   b   .
+
+unrecov_slb:
+   EXCEPTION_PROLOG_COMMON(0x4100, PACA_EXSLB)
+   DISABLE_INTS
+   bl  .save_nvgprs
+1: addir3,r1,STACK_FRAME_OVERHEAD
+   bl  .unrecoverable_exception
+   b   1b
+
+
+#ifdef CONFIG_PPC_970_NAP
+power4_fixup_nap:
+   andcr9,r9,r10
+   std r9,TI_LOCAL_FLAGS(r11)
+   ld  r10,_LINK(r1)   /* make idle task do the */
+   std r10,_NIP(r1)

[ 069/104] ALSA: snd-usb: mixer: ignore -EINVAL in snd_usb_mixer_controls()

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Daniel Mack 

commit 83ea5d18d74f032a760fecde78c0210f66f7f70c upstream.

Creation of individual mixer controls may fail, but that shouldn't cause
the entire mixer creation to fail. Even worse, if the mixer creation
fails, that will error out the entire device probing.

All the functions called by parse_audio_unit() should return -EINVAL if
they find descriptors that are unsupported or believed to be malformed,
so we can safely handle this error code as a non-fatal condition in
snd_usb_mixer_controls().

That fixes a long standing bug which is commonly worked around by
adding quirks which make the driver ignore entire interfaces. Some of
them might now be unnecessary.

Signed-off-by: Daniel Mack 
Reported-and-tested-by: Rodolfo Thomazelli 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/usb/mixer.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2020,7 +2020,7 @@ static int snd_usb_mixer_controls(struct
state.oterm.type = le16_to_cpu(desc->wTerminalType);
state.oterm.name = desc->iTerminal;
err = parse_audio_unit(, desc->bSourceID);
-   if (err < 0)
+   if (err < 0 && err != -EINVAL)
return err;
} else { /* UAC_VERSION_2 */
struct uac2_output_terminal_descriptor *desc = p;
@@ -2032,12 +2032,12 @@ static int snd_usb_mixer_controls(struct
state.oterm.type = le16_to_cpu(desc->wTerminalType);
state.oterm.name = desc->iTerminal;
err = parse_audio_unit(, desc->bSourceID);
-   if (err < 0)
+   if (err < 0 && err != -EINVAL)
return err;
 
/* for UAC2, use the same approach to also add the 
clock selectors */
err = parse_audio_unit(, desc->bCSourceID);
-   if (err < 0)
+   if (err < 0 && err != -EINVAL)
return err;
}
}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 071/104] ALSA: hda - Fix typo in checking IEC958 emphasis bit

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit a686fd141e20244ad75f80ad54706da07d7bb90a upstream.

There is a typo in convert_to_spdif_status() about checking the
emphasis IEC958 status bit.  It should check the given value instead
of the resultant value.

Reported-by: Martin Weishart 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/pci/hda/hda_codec.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -2771,7 +2771,7 @@ static unsigned int convert_to_spdif_sta
if (val & AC_DIG1_PROFESSIONAL)
sbits |= IEC958_AES0_PROFESSIONAL;
if (sbits & IEC958_AES0_PROFESSIONAL) {
-   if (sbits & AC_DIG1_EMPHASIS)
+   if (val & AC_DIG1_EMPHASIS)
sbits |= IEC958_AES0_PRO_EMPHASIS_5015;
} else {
if (val & AC_DIG1_EMPHASIS)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 084/104] USB: serial: add modem-status-change wait queue

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit e5b33dc9d16053c2ae4c2c669cf008829530364b upstream.

Add modem-status-change wait queue to struct usb_serial_port that
subdrivers can use to implement TIOCMIWAIT.

Currently subdrivers use a private wait queue which may have been
released when waking up after device disconnected.

Note that we're adding a new wait queue rather than reusing the tty-port
one as we do not want to get woken up at hangup (yet).

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 include/linux/usb/serial.h |2 ++
 1 file changed, 2 insertions(+)

--- a/include/linux/usb/serial.h
+++ b/include/linux/usb/serial.h
@@ -71,6 +71,7 @@ enum port_dev_state {
  * port.
  * @flags: usb serial port flags
  * @write_wait: a wait_queue_head_t used by the port.
+ * @delta_msr_wait: modem-status-change wait queue
  * @work: work queue entry for the line discipline waking up.
  * @throttled: nonzero if the read urb is inactive to throttle the device
  * @throttle_req: nonzero if the tty wants to throttle us
@@ -114,6 +115,7 @@ struct usb_serial_port {
 
unsigned long   flags;
wait_queue_head_t   write_wait;
+   wait_queue_head_t   delta_msr_wait;
struct work_struct  work;
charthrottled;
charthrottle_req;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 068/104] ALSA: snd-usb: mixer: propagate errors up the call chain

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Daniel Mack 

commit 4d7b86c98e445b075c2c4c3757eb6d3d6efbe72e upstream.

In check_input_term() and parse_audio_feature_unit(), propagate the
error value that has been returned by a failing function instead of
-EINVAL. That helps cleaning up the error pathes in the mixer.

Signed-off-by: Daniel Mack 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings 
---
 sound/usb/mixer.c |   10 ++
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -711,8 +711,9 @@ static int check_input_term(struct mixer
case UAC2_CLOCK_SELECTOR: {
struct uac_selector_unit_descriptor *d = p1;
/* call recursively to retrieve the channel info */
-   if (check_input_term(state, d->baSourceID[0], term) < 0)
-   return -ENODEV;
+   err = check_input_term(state, d->baSourceID[0], term);
+   if (err < 0)
+   return err;
term->type = d->bDescriptorSubtype << 16; /* virtual 
type */
term->id = id;
term->name = uac_selector_unit_iSelector(d);
@@ -1263,8 +1264,9 @@ static int parse_audio_feature_unit(stru
return err;
 
/* determine the input source type and name */
-   if (check_input_term(state, hdr->bSourceID, ) < 0)
-   return -EINVAL;
+   err = check_input_term(state, hdr->bSourceID, );
+   if (err < 0)
+   return err;
 
master_bits = snd_usb_combine_bytes(bmaControls, csize);
/* master configuration quirks */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 066/104] USB: xhci - fix bit definitions for IMAN register

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Torokhov 

commit f8264340e694604863255cc0276491d17c402390 upstream.

According to XHCI specification (5.5.2.1) the IP is bit 0 and IE is bit 1
of IMAN register. Previously their definitions were reversed.

Even though there are no ill effects being observed from the swapped
definitions (because IMAN_IP is RW1C and in legacy PCI case we come in
with it already set to 1 so it was clearing itself even though we were
setting IMAN_IE instead of IMAN_IP), we should still correct the values.

This patch should be backported to kernels as old as 2.6.36, that
contain the commit 4e833c0b87a30798e67f06120cecebef6ee9644c "xhci: don't
re-enable IE constantly".

Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sarah Sharp 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/host/xhci.h |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -206,8 +206,8 @@ struct xhci_op_regs {
 /* bits 12:31 are reserved (and should be preserved on writes). */
 
 /* IMAN - Interrupt Management Register */
-#define IMAN_IP(1 << 1)
-#define IMAN_IE(1 << 0)
+#define IMAN_IE(1 << 1)
+#define IMAN_IP(1 << 0)
 
 /* USBSTS - USB status - status bitmasks */
 /* HC not running - set to 1 when run/stop bit is cleared. */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 081/104] USB: garmin_gps: fix memory leak on disconnect

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 618aa1068df29c37a58045fe940f9106664153fd upstream.

Remove bogus disconnect test introduced by 95bef012e ("USB: more serial
drivers writing after disconnect") which prevented queued data from
being freed on disconnect.

The possible IO it was supposed to prevent is long gone.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings 
---
 drivers/usb/serial/garmin_gps.c |7 +--
 1 file changed, 1 insertion(+), 6 deletions(-)

--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -973,10 +973,7 @@ static void garmin_close(struct usb_seri
if (!serial)
return;
 
-   mutex_lock(>serial->disc_mutex);
-
-   if (!port->serial->disconnected)
-   garmin_clear(garmin_data_p);
+   garmin_clear(garmin_data_p);
 
/* shutdown our urbs */
usb_kill_urb(port->read_urb);
@@ -985,8 +982,6 @@ static void garmin_close(struct usb_seri
/* keep reset state so we know that we must start a new session */
if (garmin_data_p->state != STATE_RESET)
garmin_data_p->state = STATE_DISCONNECTED;
-
-   mutex_unlock(>serial->disc_mutex);
 }
 
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 076/104] efivars: Fix check for CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Ben Hutchings 

commit ca0ba26fbbd2d81c43085df49ce0abfe34535a90 upstream.

The 'CONFIG_' prefix is not implicit in IS_ENABLED().

Signed-off-by: Ben Hutchings 
Cc: Seth Forshee 
Signed-off-by: Matt Fleming 
---
 drivers/firmware/efivars.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -93,7 +93,7 @@ MODULE_VERSION(EFIVARS_VERSION);
 #define DUMP_NAME_LEN 52
 
 static bool efivars_pstore_disable =
-   IS_ENABLED(EFI_VARS_PSTORE_DEFAULT_DISABLE);
+   IS_ENABLED(CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE);
 
 module_param_named(pstore_disable, efivars_pstore_disable, bool, 0644);
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 059/104] tracing: Protect tracer flags with trace_types_lock

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: "Steven Rostedt (Red Hat)" 

commit 69d34da2984c95b33ea21518227e1f9470f11d95 upstream.

Seems that the tracer flags have never been protected from
synchronous writes. Luckily, admins don't usually modify the
tracing flags via two different tasks. But if scripts were to
be used to modify them, then they could get corrupted.

Move the trace_types_lock that protects against tracers changing
to also protect the flags being set.

Signed-off-by: Steven Rostedt 
[bwh: Backported to 3.2: also move failure return in
 tracing_trace_options_write() after unlocking]
Signed-off-by: Ben Hutchings 
---
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2661,7 +2661,7 @@ tracing_trace_options_write(struct file
char buf[64];
char *cmp;
int neg = 0;
-   int ret;
+   int ret = 0;
int i;
 
if (cnt >= sizeof(buf))
@@ -2678,6 +2678,8 @@ tracing_trace_options_write(struct file
cmp += 2;
}
 
+   mutex_lock(_types_lock);
+
for (i = 0; trace_options[i]; i++) {
if (strcmp(cmp, trace_options[i]) == 0) {
set_tracer_flags(1 << i, !neg);
@@ -2686,13 +2688,13 @@ tracing_trace_options_write(struct file
}
 
/* If no option could be set, test the specific tracer options */
-   if (!trace_options[i]) {
-   mutex_lock(_types_lock);
+   if (!trace_options[i])
ret = set_tracer_option(current_trace, cmp, neg);
-   mutex_unlock(_types_lock);
-   if (ret)
-   return ret;
-   }
+
+   mutex_unlock(_types_lock);
+
+   if (ret)
+   return ret;
 
*ppos += cnt;
 
@@ -4379,7 +4381,10 @@ trace_options_core_write(struct file *fi
 
if (val != 0 && val != 1)
return -EINVAL;
+
+   mutex_lock(_types_lock);
set_tracer_flags(1 << index, val);
+   mutex_unlock(_types_lock);
 
*ppos += cnt;
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 072/104] usb: gadget: udc-core: fix a regression during gadget driver

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: Alan Stern 

commit 511f3c5326eabe1ece35202a404c24c0aeacc246 upstream.

This patch (as1666) fixes a regression in the UDC core.  The core
takes care of unbinding gadget drivers, and it does the unbinding
before telling the UDC driver to turn off the controller hardware.
When the call to the udc_stop callback is made, the gadget no longer
has a driver.  The callback routine should not be invoked with a
pointer to the old driver; doing so can cause problems (such as
use-after-free accesses in net2280).

This patch should be applied, with appropriate context changes, to all
the stable kernels going back to 3.1.

Signed-off-by: Alan Stern 
Signed-off-by: Felipe Balbi 
[bwh: Backported to 3.2: adjust context, indentation]
Signed-off-by: Ben Hutchings 
---
 drivers/usb/gadget/udc-core.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/gadget/udc-core.c
+++ b/drivers/usb/gadget/udc-core.c
@@ -213,7 +213,7 @@ static void usb_gadget_remove_driver(str
udc->driver->disconnect(udc->gadget);
usb_gadget_disconnect(udc->gadget);
udc->driver->unbind(udc->gadget);
-   usb_gadget_udc_stop(udc->gadget, udc->driver);
+   usb_gadget_udc_stop(udc->gadget, NULL);
} else {
usb_gadget_stop(udc->gadget, udc->driver);
}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[ 067/104] x86-64: Fix the failure case in copy_user_handle_tail()

[Ben Hutchings]

3.2-stable review patch.  If anyone has any objections, please let me know.

--

From: CQ Tang 

commit 66db3feb486c01349f767b98ebb10b0c3d2d021b upstream.

The increment of "to" in copy_user_handle_tail() will have incremented
before a failure has been noted.  This causes us to skip a byte in the
failure case.

Only do the increment when assured there is no failure.

Signed-off-by: CQ Tang 
Link: 
http://lkml.kernel.org/r/20130318150221.8439.993.st...@phlsvslse11.ph.intel.com
Signed-off-by: Mike Marciniszyn 
Signed-off-by: H. Peter Anvin 
Signed-off-by: Ben Hutchings 
---
 arch/x86/lib/usercopy_64.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/x86/lib/usercopy_64.c
+++ b/arch/x86/lib/usercopy_64.c
@@ -169,10 +169,10 @@ copy_user_handle_tail(char *to, char *fr
char c;
unsigned zero_len;
 
-   for (; len; --len) {
+   for (; len; --len, to++) {
if (__get_user_nocheck(c, from++, sizeof(char)))
break;
-   if (__put_user_nocheck(c, to++, sizeof(char)))
+   if (__put_user_nocheck(c, to, sizeof(char)))
break;
}
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/