[3.5.y.z extended stable] Linux 3.5.7.6
|2 + mm/hugetlb.c |1 + mm/migrate.c |4 +- mm/mlock.c |6 +- mm/page_alloc.c| 15 +- net/bluetooth/smp.c| 13 + net/bridge/br_netfilter.c |3 + net/core/pktgen.c |9 +- net/ipv4/ip_sockglue.c |2 +- net/ipv4/tcp_input.c |5 + net/ipv6/addrconf.c|2 +- net/ipv6/ip6_output.c |4 +- net/ipv6/route.c |3 +- net/packet/af_packet.c | 10 +- net/sctp/endpointola.c |5 + net/sctp/outqueue.c| 12 +- net/sctp/socket.c |2 +- 85 files changed, 787 insertions(+), 641 deletions(-) Alan Stern (3): USB: XHCI: fix memory leak of URB-private data USB: EHCI: fix timer bug affecting port resume USB: EHCI: fix bug in scheduling periodic split transfers Alex Deucher (5): drm/radeon: add WAIT_UNTIL to the non-VM safe regs list for cayman/TN drm/radeon: add quirk for RV100 board drm/radeon: fix backend map setup on 1 RB sumo boards drm/radeon/evergreen+: wait for the MC to settle after MC blackout drm/radeon: prevent crash in the ring space allocation Alexander Stein (1): can: c_can: Set reserved bit in IFx_MASK2 to 1 on write Bing Zhao (1): mwifiex: fix incomplete scan in case of IE parsing error Bjørn Mork (1): USB: option: add Changhong CH690 Bruce Allan (1): e1000e: enable ECC on I217/I218 to catch packet buffer memory errors Christopher Staite (1): drm/radeon: fix MC blackout on evergreen+ Cong Wang (2): net: prevent setting ttl=0 via IP_TTL pktgen: correctly handle failures when adding a device Daniel Borkmann (2): net: sctp: sctp_setsockopt_auth_key: use kzfree instead of kfree net: sctp: sctp_endpoint_free: zero out secret key data Daniele Palmas (2): USB: qcserial: add Telit Gobi QDL device USB: option: add support for Telit LE920 David Moore (1): usb: Prevent dead ports when xhci is not enabled David S. Miller (1): via-rhine: Fix bugs in NAPI support. Eric Dumazet (4): macvlan: fix macvlan_get_size() netxen: fix off by one bug in netxen_release_tx_buffer() net: loopback: fix a dst refcounting issue tcp: frto should not set snd_cwnd to 0 Gerald Schaefer (1): mm: don't overwrite mm->def_flags in do_mlockall() Haojian Zhuang (1): drivers/rtc/rtc-pl031.c: fix the missing operation on enable Heiko Carstens (2): atm/iphase: rename fregt_t -> ffreg_t s390/timer: avoid overflow when programming clock comparator Herton Ronaldo Krzesinski (2): Revert "USB: Handle warm reset failure on empty port." Linux 3.5.7.6 Ian Campbell (3): xen/netback: shutdown the ring if it contains garbage. xen/netback: free already allocated memory on failure in xen_netbk_get_requests netback: correct netbk_tx_err to handle wrap around. Ilpo Järvinen (1): tcp: fix for zero packets_in_flight was too broad Jan Beulich (1): x86-64: Replace left over sti/cli in ia32 audit exit code Jan Luebbe (1): drivers/rtc/rtc-isl1208.c: call rtc_update_irq() from the alarm irq handler Johan Hedberg (1): Bluetooth: Fix handling of unexpected SMP PDUs Kees Cook (1): x86: Do not leak kernel page mapping locations Lan Tianyu (1): usb: Using correct way to clear usb3.0 device's remote wakeup feature. Larry Finger (2): rtlwifi: Fix the usage of the wrong variable in usb.c rtlwifi: Fix scheduling while atomic bug Linus Torvalds (1): mm: fix pageblock bitmap allocation Linus Walleij (1): drivers/rtc/rtc-pl031.c: restore ST variant functionality Marcelo Ricardo Leitner (1): ipv6: do not create neighbor entries for local delivery Marek Szyprowski (1): regulator: max8998: fix incorrect min_uV value for ldo10 Matthew Daley (1): xen/netback: don't leak pages on failure in xen_netbk_tx_check_gop. Mel Gorman (1): x86/mm: Check if PUD is large when validating a kernel address Mikko Tiihonen (1): drm/radeon: protect against div by 0 in backend setup Neil Horman (1): sctp: refactor sctp_outq_teardown to insure proper re-initalization Nicholas Bellinger (1): target: Fix divide by zero bug in fabric_max_sectors for unconfigured devices Nicholas Santos (1): HID: usbhid: quirk for Formosa IR receiver Nickolai Zeldovich (1): drivers: xhci: fix incorrect bit test Nithin Nayak Sujir (2): tg3: Avoid null pointer dereference in tg3_interrupt in
[3.5.y.z extended stable] Linux 3.5.7.6
|2 + mm/hugetlb.c |1 + mm/migrate.c |4 +- mm/mlock.c |6 +- mm/page_alloc.c| 15 +- net/bluetooth/smp.c| 13 + net/bridge/br_netfilter.c |3 + net/core/pktgen.c |9 +- net/ipv4/ip_sockglue.c |2 +- net/ipv4/tcp_input.c |5 + net/ipv6/addrconf.c|2 +- net/ipv6/ip6_output.c |4 +- net/ipv6/route.c |3 +- net/packet/af_packet.c | 10 +- net/sctp/endpointola.c |5 + net/sctp/outqueue.c| 12 +- net/sctp/socket.c |2 +- 85 files changed, 787 insertions(+), 641 deletions(-) Alan Stern (3): USB: XHCI: fix memory leak of URB-private data USB: EHCI: fix timer bug affecting port resume USB: EHCI: fix bug in scheduling periodic split transfers Alex Deucher (5): drm/radeon: add WAIT_UNTIL to the non-VM safe regs list for cayman/TN drm/radeon: add quirk for RV100 board drm/radeon: fix backend map setup on 1 RB sumo boards drm/radeon/evergreen+: wait for the MC to settle after MC blackout drm/radeon: prevent crash in the ring space allocation Alexander Stein (1): can: c_can: Set reserved bit in IFx_MASK2 to 1 on write Bing Zhao (1): mwifiex: fix incomplete scan in case of IE parsing error Bjørn Mork (1): USB: option: add Changhong CH690 Bruce Allan (1): e1000e: enable ECC on I217/I218 to catch packet buffer memory errors Christopher Staite (1): drm/radeon: fix MC blackout on evergreen+ Cong Wang (2): net: prevent setting ttl=0 via IP_TTL pktgen: correctly handle failures when adding a device Daniel Borkmann (2): net: sctp: sctp_setsockopt_auth_key: use kzfree instead of kfree net: sctp: sctp_endpoint_free: zero out secret key data Daniele Palmas (2): USB: qcserial: add Telit Gobi QDL device USB: option: add support for Telit LE920 David Moore (1): usb: Prevent dead ports when xhci is not enabled David S. Miller (1): via-rhine: Fix bugs in NAPI support. Eric Dumazet (4): macvlan: fix macvlan_get_size() netxen: fix off by one bug in netxen_release_tx_buffer() net: loopback: fix a dst refcounting issue tcp: frto should not set snd_cwnd to 0 Gerald Schaefer (1): mm: don't overwrite mm-def_flags in do_mlockall() Haojian Zhuang (1): drivers/rtc/rtc-pl031.c: fix the missing operation on enable Heiko Carstens (2): atm/iphase: rename fregt_t - ffreg_t s390/timer: avoid overflow when programming clock comparator Herton Ronaldo Krzesinski (2): Revert USB: Handle warm reset failure on empty port. Linux 3.5.7.6 Ian Campbell (3): xen/netback: shutdown the ring if it contains garbage. xen/netback: free already allocated memory on failure in xen_netbk_get_requests netback: correct netbk_tx_err to handle wrap around. Ilpo Järvinen (1): tcp: fix for zero packets_in_flight was too broad Jan Beulich (1): x86-64: Replace left over sti/cli in ia32 audit exit code Jan Luebbe (1): drivers/rtc/rtc-isl1208.c: call rtc_update_irq() from the alarm irq handler Johan Hedberg (1): Bluetooth: Fix handling of unexpected SMP PDUs Kees Cook (1): x86: Do not leak kernel page mapping locations Lan Tianyu (1): usb: Using correct way to clear usb3.0 device's remote wakeup feature. Larry Finger (2): rtlwifi: Fix the usage of the wrong variable in usb.c rtlwifi: Fix scheduling while atomic bug Linus Torvalds (1): mm: fix pageblock bitmap allocation Linus Walleij (1): drivers/rtc/rtc-pl031.c: restore ST variant functionality Marcelo Ricardo Leitner (1): ipv6: do not create neighbor entries for local delivery Marek Szyprowski (1): regulator: max8998: fix incorrect min_uV value for ldo10 Matthew Daley (1): xen/netback: don't leak pages on failure in xen_netbk_tx_check_gop. Mel Gorman (1): x86/mm: Check if PUD is large when validating a kernel address Mikko Tiihonen (1): drm/radeon: protect against div by 0 in backend setup Neil Horman (1): sctp: refactor sctp_outq_teardown to insure proper re-initalization Nicholas Bellinger (1): target: Fix divide by zero bug in fabric_max_sectors for unconfigured devices Nicholas Santos (1): HID: usbhid: quirk for Formosa IR receiver Nickolai Zeldovich (1): drivers: xhci: fix incorrect bit test Nithin Nayak Sujir (2): tg3: Avoid null pointer dereference in tg3_interrupt in netconsole mode
[PATCH 05/81] usb: Prevent dead ports when xhci is not enabled
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: David Moore commit 58b2939b4d5a030eaec469d29812ab8477ee7e76 upstream. When the xHCI driver is not available, actively switch the ports to EHCI mode since some BIOSes leave them in xHCI mode where they would otherwise appear dead. This was discovered on a Dell Optiplex 7010, but it's possible other systems could be affected. This should be backported to kernels as old as 3.0, that contain the commit 69e848c2090aebba5698a1620604c7dccb448684 "Intel xhci: Support EHCI/xHCI port switching." Signed-off-by: David Moore Signed-off-by: Sarah Sharp Signed-off-by: Herton Ronaldo Krzesinski --- drivers/usb/host/pci-quirks.c |1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c index eb5563a..7893351 100644 --- a/drivers/usb/host/pci-quirks.c +++ b/drivers/usb/host/pci-quirks.c @@ -780,6 +780,7 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev) "defaulting to EHCI.\n"); dev_warn(_pdev->dev, "USB 3.0 devices will work at USB 2.0 speeds.\n"); + usb_disable_xhci_ports(xhci_pdev); return; } -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 09/81] regulator: max8998: fix incorrect min_uV value for ldo10
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Marek Szyprowski
commit 36a6f8c035760dcbd0c3acb4c2fd56268588a9cb upstream.
Correct value for minimal voltage for ldo10 output is 95 uV. This
patch fixes the typo introduced by patch adf6178ad5552a7f2f742a8c85343c50
("regulator: max8998: Use uV in voltage_map_desc"), what solves broken
probe of max8998 in v3.8-rc4.
Signed-off-by: Marek Szyprowski
Signed-off-by: Mark Brown
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/regulator/max8998.c |2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/regulator/max8998.c b/drivers/regulator/max8998.c
index b3b2984..b03c22d 100644
--- a/drivers/regulator/max8998.c
+++ b/drivers/regulator/max8998.c
@@ -65,7 +65,7 @@ static const struct voltage_map_desc ldo9_voltage_map_desc = {
.min = 280, .step = 10, .max = 310,
};
static const struct voltage_map_desc ldo10_voltage_map_desc = {
- .min = 95000, .step = 5, .max = 130,
+ .min = 95, .step = 5, .max = 130,
};
static const struct voltage_map_desc ldo1213_voltage_map_desc = {
.min = 80, .step = 10, .max = 330,
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 03/81] drivers: xhci: fix incorrect bit test
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Nickolai Zeldovich
commit ba7b5c22d33136a5612ca5ef8d31564dcc501126 upstream.
Fix incorrect bit test that originally showed up in
4ee823b83bc9851743fab756c76b27d6a1e2472b "USB/xHCI: Support
device-initiated USB 3.0 resume."
Use '&' instead of '&&'.
This should be backported to kernels as old as 3.4.
Signed-off-by: Nickolai Zeldovich
Signed-off-by: Sarah Sharp
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/usb/host/xhci-ring.c |2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 3dc8e3f..5530c76 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1698,7 +1698,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
faked_port_index + 1);
if (slot_id && xhci->devs[slot_id])
xhci_ring_device(xhci, slot_id);
- if (bus_state->port_remote_wakeup && (1 << faked_port_index)) {
+ if (bus_state->port_remote_wakeup & (1 << faked_port_index)) {
bus_state->port_remote_wakeup &=
~(1 << faked_port_index);
xhci_test_and_clear_bit(xhci, port_array,
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 01/81] xhci: Fix isoc TD encoding.
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Sarah Sharp
commit 760973d2a74b93eb1697981f7448f0e62767cfc4 upstream.
An isochronous TD is comprised of one isochronous TRB chained to zero or
more normal TRBs. Only the isoc TRB has the TBC and TLBPC fields. The
normal TRBs must set those fields to zeroes. The code was setting the
TBC and TLBPC fields for both isoc and normal TRBs. Fix this.
This should be backported to stable kernels as old as 3.0, that contain
the commit b61d378f2da41c748aba6ca19d77e1e1c02bcea5 " xhci 1.0: Set
transfer burst last packet count field."
Signed-off-by: Sarah Sharp
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/usb/host/xhci-ring.c |4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index c3c174d..3bf13f8 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3662,9 +3662,11 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci,
gfp_t mem_flags,
td = urb_priv->td[i];
for (j = 0; j < trbs_per_td; j++) {
u32 remainder = 0;
- field = TRB_TBC(burst_count) | TRB_TLBPC(residue);
+ field = 0;
if (first_trb) {
+ field = TRB_TBC(burst_count) |
+ TRB_TLBPC(residue);
/* Queue the isoc TRB */
field |= TRB_TYPE(TRB_ISOC);
/* Assume URB_ISO_ASAP is set */
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[ 3.5.y.z extended stable ] Linux 3.5.7.6 stable review
|4 +- mm/mlock.c |6 +- mm/page_alloc.c| 15 +- net/bluetooth/smp.c| 13 + net/bridge/br_netfilter.c |3 + net/core/pktgen.c |9 +- net/ipv4/ip_sockglue.c |2 +- net/ipv4/tcp_input.c |5 + net/ipv6/addrconf.c|2 +- net/ipv6/ip6_output.c |4 +- net/ipv6/route.c |3 +- net/packet/af_packet.c | 10 +- net/sctp/endpointola.c |5 + net/sctp/outqueue.c| 12 +- net/sctp/socket.c |2 +- 84 files changed, 786 insertions(+), 640 deletions(-) Alan Stern (3): USB: XHCI: fix memory leak of URB-private data USB: EHCI: fix timer bug affecting port resume USB: EHCI: fix bug in scheduling periodic split transfers Alex Deucher (5): drm/radeon: add WAIT_UNTIL to the non-VM safe regs list for cayman/TN drm/radeon: add quirk for RV100 board drm/radeon: fix backend map setup on 1 RB sumo boards drm/radeon/evergreen+: wait for the MC to settle after MC blackout drm/radeon: prevent crash in the ring space allocation Alexander Stein (1): can: c_can: Set reserved bit in IFx_MASK2 to 1 on write Bing Zhao (1): mwifiex: fix incomplete scan in case of IE parsing error Bjørn Mork (1): USB: option: add Changhong CH690 Bruce Allan (1): e1000e: enable ECC on I217/I218 to catch packet buffer memory errors Christopher Staite (1): drm/radeon: fix MC blackout on evergreen+ Cong Wang (2): net: prevent setting ttl=0 via IP_TTL pktgen: correctly handle failures when adding a device Daniel Borkmann (2): net: sctp: sctp_setsockopt_auth_key: use kzfree instead of kfree net: sctp: sctp_endpoint_free: zero out secret key data Daniele Palmas (2): USB: qcserial: add Telit Gobi QDL device USB: option: add support for Telit LE920 David Moore (1): usb: Prevent dead ports when xhci is not enabled David S. Miller (1): via-rhine: Fix bugs in NAPI support. Eric Dumazet (4): macvlan: fix macvlan_get_size() netxen: fix off by one bug in netxen_release_tx_buffer() net: loopback: fix a dst refcounting issue tcp: frto should not set snd_cwnd to 0 Gerald Schaefer (1): mm: don't overwrite mm->def_flags in do_mlockall() Haojian Zhuang (1): drivers/rtc/rtc-pl031.c: fix the missing operation on enable Heiko Carstens (2): atm/iphase: rename fregt_t -> ffreg_t s390/timer: avoid overflow when programming clock comparator Herton Ronaldo Krzesinski (1): Revert "USB: Handle warm reset failure on empty port." Ian Campbell (3): xen/netback: shutdown the ring if it contains garbage. xen/netback: free already allocated memory on failure in xen_netbk_get_requests netback: correct netbk_tx_err to handle wrap around. Ilpo Järvinen (1): tcp: fix for zero packets_in_flight was too broad Jan Beulich (1): x86-64: Replace left over sti/cli in ia32 audit exit code Jan Luebbe (1): drivers/rtc/rtc-isl1208.c: call rtc_update_irq() from the alarm irq handler Johan Hedberg (1): Bluetooth: Fix handling of unexpected SMP PDUs Kees Cook (1): x86: Do not leak kernel page mapping locations Lan Tianyu (1): usb: Using correct way to clear usb3.0 device's remote wakeup feature. Larry Finger (2): rtlwifi: Fix the usage of the wrong variable in usb.c rtlwifi: Fix scheduling while atomic bug Linus Torvalds (1): mm: fix pageblock bitmap allocation Linus Walleij (1): drivers/rtc/rtc-pl031.c: restore ST variant functionality Marcelo Ricardo Leitner (1): ipv6: do not create neighbor entries for local delivery Marek Szyprowski (1): regulator: max8998: fix incorrect min_uV value for ldo10 Matthew Daley (1): xen/netback: don't leak pages on failure in xen_netbk_tx_check_gop. Mel Gorman (1): x86/mm: Check if PUD is large when validating a kernel address Mikko Tiihonen (1): drm/radeon: protect against div by 0 in backend setup Neil Horman (1): sctp: refactor sctp_outq_teardown to insure proper re-initalization Nicholas Bellinger (1): target: Fix divide by zero bug in fabric_max_sectors for unconfigured devices Nicholas Santos (1): HID: usbhid: quirk for Formosa IR receiver Nickolai Zeldovich (1): drivers: xhci: fix incorrect bit test Nithin Nayak Sujir (2): tg3: Avoid null pointer dereference in tg3_interrupt in netconsole mode tg3: Fix crc errors on jumbo frame receive Or Gerlitz (1): net/mlx4_core: Set number of msix vec
[PATCH 07/81] sched/rt: Use root_domain of rt_rq not current processor
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Shawn Bohrer
commit aa7f67304d1a03180f463258aa6f15a8b434e77d upstream.
When the system has multiple domains do_sched_rt_period_timer()
can run on any CPU and may iterate over all rt_rq in
cpu_online_mask. This means when balance_runtime() is run for a
given rt_rq that rt_rq may be in a different rd than the current
processor. Thus if we use smp_processor_id() to get rd in
do_balance_runtime() we may borrow runtime from a rt_rq that is
not part of our rd.
This changes do_balance_runtime to get the rd from the passed in
rt_rq ensuring that we borrow runtime only from the correct rd
for the given rt_rq.
This fixes a BUG at kernel/sched/rt.c:687! in __disable_runtime
when we try reclaim runtime lent to other rt_rq but runtime has
been lent to a rt_rq in another rd.
Signed-off-by: Shawn Bohrer
Acked-by: Steven Rostedt
Acked-by: Mike Galbraith
Cc: pet...@infradead.org
Link:
http://lkml.kernel.org/r/1358186131-29494-1-git-send-email-sboh...@rgmadvisors.com
Signed-off-by: Ingo Molnar
Signed-off-by: Herton Ronaldo Krzesinski
---
kernel/sched/rt.c |2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 573e1ca..2a05e56 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -566,7 +566,7 @@ static inline struct rt_bandwidth
*sched_rt_bandwidth(struct rt_rq *rt_rq)
static int do_balance_runtime(struct rt_rq *rt_rq)
{
struct rt_bandwidth *rt_b = sched_rt_bandwidth(rt_rq);
- struct root_domain *rd = cpu_rq(smp_processor_id())->rd;
+ struct root_domain *rd = rq_of_rt_rq(rt_rq)->rd;
int i, weight, more = 0;
u64 rt_period;
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 10/81] drm/radeon: fix MC blackout on evergreen+
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Christopher Staite
commit bb588820ef421c6098dca1fec29c3b347f1c8c19 upstream.
Force the crtc mem requests on/off immediately rather
than waiting for the double buffered updates to kick in.
Seems we miss the update in certain conditions. Also
handle the DCE6 case.
Signed-off-by: Christopher Staite
Signed-off-by: Alex Deucher
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/gpu/drm/radeon/evergreen.c |8
1 file changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/radeon/evergreen.c
b/drivers/gpu/drm/radeon/evergreen.c
index 2aa7fdb..c490d16 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1147,14 +1147,18 @@ void evergreen_mc_stop(struct radeon_device *rdev,
struct evergreen_mc_save *sav
if (!(tmp & EVERGREEN_CRTC_BLANK_DATA_EN)) {
radeon_wait_for_vblank(rdev, i);
tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
+ WREG32(EVERGREEN_CRTC_UPDATE_LOCK +
crtc_offsets[i], 1);
WREG32(EVERGREEN_CRTC_BLANK_CONTROL +
crtc_offsets[i], tmp);
+ WREG32(EVERGREEN_CRTC_UPDATE_LOCK +
crtc_offsets[i], 0);
}
} else {
tmp = RREG32(EVERGREEN_CRTC_CONTROL +
crtc_offsets[i]);
if (!(tmp &
EVERGREEN_CRTC_DISP_READ_REQUEST_DISABLE)) {
radeon_wait_for_vblank(rdev, i);
tmp |=
EVERGREEN_CRTC_DISP_READ_REQUEST_DISABLE;
+ WREG32(EVERGREEN_CRTC_UPDATE_LOCK +
crtc_offsets[i], 1);
WREG32(EVERGREEN_CRTC_CONTROL +
crtc_offsets[i], tmp);
+ WREG32(EVERGREEN_CRTC_UPDATE_LOCK +
crtc_offsets[i], 0);
}
}
/* wait for the next frame */
@@ -1212,11 +1216,15 @@ void evergreen_mc_resume(struct radeon_device *rdev,
struct evergreen_mc_save *s
if (ASIC_IS_DCE6(rdev)) {
tmp = RREG32(EVERGREEN_CRTC_BLANK_CONTROL +
crtc_offsets[i]);
tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
+ WREG32(EVERGREEN_CRTC_UPDATE_LOCK +
crtc_offsets[i], 1);
WREG32(EVERGREEN_CRTC_BLANK_CONTROL +
crtc_offsets[i], tmp);
+ WREG32(EVERGREEN_CRTC_UPDATE_LOCK +
crtc_offsets[i], 0);
} else {
tmp = RREG32(EVERGREEN_CRTC_CONTROL +
crtc_offsets[i]);
tmp &=
~EVERGREEN_CRTC_DISP_READ_REQUEST_DISABLE;
+ WREG32(EVERGREEN_CRTC_UPDATE_LOCK +
crtc_offsets[i], 1);
WREG32(EVERGREEN_CRTC_CONTROL +
crtc_offsets[i], tmp);
+ WREG32(EVERGREEN_CRTC_UPDATE_LOCK +
crtc_offsets[i], 0);
}
/* wait for the next frame */
frame_count = radeon_get_vblank_counter(rdev, i);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 12/81] rtlwifi: Fix the usage of the wrong variable in usb.c
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Larry Finger
commit 0a06ad8e3a1cb5311b7dbafde45410aa1bce9d40 upstream.
In routine _rtl_rx_pre_process(), skb_dequeue() is called to get an skb;
however, the wrong variable name is used in subsequent calls.
Reported-by: Guenter Roeck
Signed-off-by: Larry Finger
Cc: Guenter Roeck
Signed-off-by: John W. Linville
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/wireless/rtlwifi/usb.c |4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/rtlwifi/usb.c
b/drivers/net/wireless/rtlwifi/usb.c
index 8fa144f..17cd028 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -542,8 +542,8 @@ static void _rtl_rx_pre_process(struct ieee80211_hw *hw,
struct sk_buff *skb)
WARN_ON(skb_queue_empty(_queue));
while (!skb_queue_empty(_queue)) {
_skb = skb_dequeue(_queue);
- _rtl_usb_rx_process_agg(hw, skb);
- ieee80211_rx_irqsafe(hw, skb);
+ _rtl_usb_rx_process_agg(hw, _skb);
+ ieee80211_rx_irqsafe(hw, _skb);
}
}
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 15/81] USB: qcserial: add Telit Gobi QDL device
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Daniele Palmas
commit 78796ae17eacedcdcaaeb03ba73d2e532a4c8f83 upstream.
Add VID and PID for Telit Gobi QDL device
Signed-off-by: Daniele Palmas
Signed-off-by: Greg Kroah-Hartman
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/usb/serial/qcserial.c |1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 996015c..4302733 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -55,6 +55,7 @@ static const struct usb_device_id id_table[] = {
{DEVICE_G1K(0x05c6, 0x9221)}, /* Generic Gobi QDL device */
{DEVICE_G1K(0x05c6, 0x9231)}, /* Generic Gobi QDL device */
{DEVICE_G1K(0x1f45, 0x0001)}, /* Unknown Gobi QDL device */
+ {DEVICE_G1K(0x1bc7, 0x900e)}, /* Telit Gobi QDL device */
/* Gobi 2000 devices */
{USB_DEVICE(0x1410, 0xa010)}, /* Novatel Gobi 2000 QDL device */
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 19/81] mwifiex: fix incomplete scan in case of IE parsing error
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Bing Zhao
commit 8a7d7cbf7b5ff9912ef50b3e94c9ad9f37b1c75f upstream.
A scan request is split into multiple scan commands queued in
scan_pending_q. Each scan command will be sent to firmware and
its response is handlded one after another.
If any error is detected while parsing IE in command response
buffer the remaining data will be ignored and error is returned.
We should check if there is any more scan commands pending in
the queue before returning error. This ensures that we will call
cfg80211_scan_done if this is the last scan command, or send
next scan command in scan_pending_q to firmware.
Signed-off-by: Bing Zhao
Signed-off-by: Amitkumar Karwar
Signed-off-by: John W. Linville
[ herton: adjust context ]
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/wireless/mwifiex/scan.c |9 +
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/mwifiex/scan.c
b/drivers/net/wireless/mwifiex/scan.c
index 74f0457..9ca1b9c 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1553,7 +1553,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
dev_err(adapter->dev, "SCAN_RESP: too many AP returned (%d)\n",
scan_rsp->number_of_sets);
ret = -1;
- goto done;
+ goto check_next_scan;
}
bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
@@ -1624,7 +1624,8 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
if (!beacon_size || beacon_size > bytes_left) {
bss_info += bytes_left;
bytes_left = 0;
- return -1;
+ ret = -1;
+ goto check_next_scan;
}
/* Initialize the current working beacon pointer for this BSS
@@ -1680,7 +1681,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
dev_err(priv->adapter->dev,
"%s: bytes left < IE length\n",
__func__);
- goto done;
+ goto check_next_scan;
}
if (element_id == WLAN_EID_DS_PARAMS) {
channel = *(u8 *) (current_ptr +
@@ -1744,6 +1745,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
}
}
+check_next_scan:
spin_lock_irqsave(>scan_pending_q_lock, flags);
if (list_empty(>scan_pending_q)) {
spin_unlock_irqrestore(>scan_pending_q_lock, flags);
@@ -1782,7 +1784,6 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
mwifiex_insert_cmd_to_pending_q(adapter, cmd_node, true);
}
-done:
return ret;
}
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 17/81] drm/radeon: fix backend map setup on 1 RB sumo boards
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Alex Deucher
commit f7eb97300832f4fe5fe916c5d84cd2e25169330e upstream.
Need to adjust the backend map depending on which
RB is enabled.
Fixes:
https://bugzilla.redhat.com/show_bug.cgi?id=892233
Reported-by: Mikko Tiihonen
Signed-off-by: Alex Deucher
[ herton: adjust context ]
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/gpu/drm/radeon/evergreen.c | 17 ++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/radeon/evergreen.c
b/drivers/gpu/drm/radeon/evergreen.c
index c490d16..4170e1e 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1861,9 +1861,20 @@ static void evergreen_gpu_init(struct radeon_device
*rdev)
WREG32(DMIF_ADDR_CONFIG, gb_addr_config);
WREG32(HDP_ADDR_CONFIG, gb_addr_config);
- tmp = gb_addr_config & NUM_PIPES_MASK;
- tmp = r6xx_remap_render_backend(rdev, tmp,
rdev->config.evergreen.max_backends,
- EVERGREEN_MAX_BACKENDS,
disabled_rb_mask);
+ if ((rdev->config.evergreen.max_backends == 1) &&
+ (rdev->flags & RADEON_IS_IGP)) {
+ if ((disabled_rb_mask & 3) == 1) {
+ /* RB0 disabled, RB1 enabled */
+ tmp = 0x;
+ } else {
+ /* RB1 disabled, RB0 enabled */
+ tmp = 0x;
+ }
+ } else {
+ tmp = gb_addr_config & NUM_PIPES_MASK;
+ tmp = r6xx_remap_render_backend(rdev, tmp,
rdev->config.evergreen.max_backends,
+ EVERGREEN_MAX_BACKENDS,
disabled_rb_mask);
+ }
WREG32(GB_BACKEND_MAP, tmp);
WREG32(CGTS_SYS_TCC_DISABLE, 0);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 16/81] USB: option: add support for Telit LE920
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Daniele Palmas
commit 03eb466f276ceef9dcf023dc5474db02af68aad9 upstream.
Add PID and special handling for Telit LE920
Signed-off-by: Daniele Palmas
Signed-off-by: Greg Kroah-Hartman
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/usb/serial/option.c |8
1 file changed, 8 insertions(+)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index bafe6b9..bafe018 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -242,6 +242,7 @@ static void option_instat_callback(struct urb *urb);
#define TELIT_PRODUCT_CC864_DUAL 0x1005
#define TELIT_PRODUCT_CC864_SINGLE 0x1006
#define TELIT_PRODUCT_DE910_DUAL 0x1010
+#define TELIT_PRODUCT_LE9200x1200
/* ZTE PRODUCTS */
#define ZTE_VENDOR_ID 0x19d2
@@ -534,6 +535,11 @@ static const struct option_blacklist_info
zte_1255_blacklist = {
.reserved = BIT(3) | BIT(4),
};
+static const struct option_blacklist_info telit_le920_blacklist = {
+ .sendsetup = BIT(0),
+ .reserved = BIT(1) | BIT(5),
+};
+
static const struct usb_device_id option_ids[] = {
{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -784,6 +790,8 @@ static const struct usb_device_id option_ids[] = {
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+ .driver_info = (kernel_ulong_t)_le920_blacklist },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff,
0xff, 0xff) }, /* ZTE WCDMA products */
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff,
0xff),
.driver_info = (kernel_ulong_t)_intf1_blacklist },
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 13/81] e1000e: enable ECC on I217/I218 to catch packet buffer memory errors
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Bruce Allan
commit 286003048aaef49b26bb9d93611dc69085e8982e upstream.
In rare instances, memory errors have been detected in the internal packet
buffer memory on I217/I218 when stressed under certain environmental
conditions. Enable Error Correcting Code (ECC) in hardware to catch both
correctable and uncorrectable errors. Correctable errors will be handled
by the hardware. Uncorrectable errors in the packet buffer will cause the
packet to be received with an error indication in the buffer descriptor
causing the packet to be discarded. If the uncorrectable error is in the
descriptor itself, the hardware will stop and interrupt the driver
indicating the error. The driver will then reset the hardware in order to
clear the error and restart.
Both types of errors will be accounted for in statistics counters.
Signed-off-by: Bruce Allan
Tested-by: Jeff Pieper
Signed-off-by: Jeff Kirsher
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/ethernet/intel/e1000e/defines.h |9 ++
drivers/net/ethernet/intel/e1000e/e1000.h |2 ++
drivers/net/ethernet/intel/e1000e/ethtool.c |2 ++
drivers/net/ethernet/intel/e1000e/hw.h |1 +
drivers/net/ethernet/intel/e1000e/ich8lan.c | 11 +++
drivers/net/ethernet/intel/e1000e/netdev.c | 46 +++
6 files changed, 71 insertions(+)
diff --git a/drivers/net/ethernet/intel/e1000e/defines.h
b/drivers/net/ethernet/intel/e1000e/defines.h
index 76edbc1..cccbbe8 100644
--- a/drivers/net/ethernet/intel/e1000e/defines.h
+++ b/drivers/net/ethernet/intel/e1000e/defines.h
@@ -233,6 +233,7 @@
#define E1000_CTRL_FRCDPX 0x1000 /* Force Duplex */
#define E1000_CTRL_LANPHYPC_OVERRIDE 0x0001 /* SW control of LANPHYPC */
#define E1000_CTRL_LANPHYPC_VALUE0x0002 /* SW value of LANPHYPC */
+#define E1000_CTRL_MEHE 0x0008 /* Memory Error Handling Enable */
#define E1000_CTRL_SWDPIN0 0x0004 /* SWDPIN 0 value */
#define E1000_CTRL_SWDPIN1 0x0008 /* SWDPIN 1 value */
#define E1000_CTRL_SWDPIO0 0x0040 /* SWDPIN 0 Input or output */
@@ -391,6 +392,12 @@
#define E1000_PBS_16K E1000_PBA_16K
+/* Uncorrectable/correctable ECC Error counts and enable bits */
+#define E1000_PBECCSTS_CORR_ERR_CNT_MASK 0x00FF
+#define E1000_PBECCSTS_UNCORR_ERR_CNT_MASK 0xFF00
+#define E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT8
+#define E1000_PBECCSTS_ECC_ENABLE 0x0001
+
#define IFS_MAX 80
#define IFS_MIN 40
#define IFS_RATIO 4
@@ -410,6 +417,7 @@
#define E1000_ICR_RXSEQ 0x0008 /* Rx sequence error */
#define E1000_ICR_RXDMT00x0010 /* Rx desc min. threshold (0) */
#define E1000_ICR_RXT0 0x0080 /* Rx timer intr (ring 0) */
+#define E1000_ICR_ECCER 0x0040 /* Uncorrectable ECC Error */
#define E1000_ICR_INT_ASSERTED 0x8000 /* If this bit asserted, the driver
should claim the interrupt */
#define E1000_ICR_RXQ0 0x0010 /* Rx Queue 0 Interrupt */
#define E1000_ICR_RXQ1 0x0020 /* Rx Queue 1 Interrupt */
@@ -446,6 +454,7 @@
#define E1000_IMS_RXSEQ E1000_ICR_RXSEQ /* Rx sequence error */
#define E1000_IMS_RXDMT0E1000_ICR_RXDMT0/* Rx desc min. threshold */
#define E1000_IMS_RXT0 E1000_ICR_RXT0 /* Rx timer intr */
+#define E1000_IMS_ECCER E1000_ICR_ECCER /* Uncorrectable ECC Error */
#define E1000_IMS_RXQ0 E1000_ICR_RXQ0 /* Rx Queue 0 Interrupt */
#define E1000_IMS_RXQ1 E1000_ICR_RXQ1 /* Rx Queue 1 Interrupt */
#define E1000_IMS_TXQ0 E1000_ICR_TXQ0 /* Tx Queue 0 Interrupt */
diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h
b/drivers/net/ethernet/intel/e1000e/e1000.h
index fa47b85..63a51ae 100644
--- a/drivers/net/ethernet/intel/e1000e/e1000.h
+++ b/drivers/net/ethernet/intel/e1000e/e1000.h
@@ -314,6 +314,8 @@ struct e1000_adapter {
struct napi_struct napi;
+ unsigned int uncorr_errors; /* uncorrectable ECC errors */
+ unsigned int corr_errors; /* correctable ECC errors */
unsigned int restart_queue;
u32 txd_cmd;
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c
b/drivers/net/ethernet/intel/e1000e/ethtool.c
index 905e214..3d3f3bb 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -108,6 +108,8 @@ static const struct e1000_stats e1000_gstrings_stats[] = {
E1000_STAT("dropped_smbus", stats.mgpdc),
E1000_STAT("rx_dma_failed", rx_dma_failed),
E1000_STAT("tx_dma_failed", tx_dma_failed),
+ E1000_STAT("uncorr_ecc_errors", uncorr_errors),
+ E1000_STAT("corr_ecc_errors", corr_errors),
};
#define E1000_GLOBAL_STATS_LEN ARRAY_SIZE(e1000_gstrings_stats)
diff --git a/dri
[PATCH 11/81] drm/radeon: add WAIT_UNTIL to the non-VM safe regs list for cayman/TN
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Alex Deucher commit 674a16f2b4724880d07389abbb95abf320b924aa upstream. Newer versions of mesa emit this. Signed-off-by: Alex Deucher Signed-off-by: Herton Ronaldo Krzesinski --- drivers/gpu/drm/radeon/reg_srcs/cayman |1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/radeon/reg_srcs/cayman b/drivers/gpu/drm/radeon/reg_srcs/cayman index 0f656b1..a072fa8 100644 --- a/drivers/gpu/drm/radeon/reg_srcs/cayman +++ b/drivers/gpu/drm/radeon/reg_srcs/cayman @@ -1,5 +1,6 @@ cayman 0x9400 0x802C GRBM_GFX_INDEX +0x8040 WAIT_UNTIL 0x84FC CP_STRMOUT_CNTL 0x85F0 CP_COHER_CNTL 0x85F4 CP_COHER_SIZE -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 22/81] drm/radeon/evergreen+: wait for the MC to settle after MC blackout
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Alex Deucher commit ed39fadd6df01095378e499fac3674883f16b853 upstream. Some chips seem to need a little delay after blacking out the MC before the requests actually stop. May fix: https://bugs.freedesktop.org/show_bug.cgi?id=56139 https://bugs.freedesktop.org/show_bug.cgi?id=57567 Signed-off-by: Alex Deucher Signed-off-by: Herton Ronaldo Krzesinski --- drivers/gpu/drm/radeon/evergreen.c |2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c index 4170e1e..ccac010 100644 --- a/drivers/gpu/drm/radeon/evergreen.c +++ b/drivers/gpu/drm/radeon/evergreen.c @@ -1183,6 +1183,8 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav blackout &= ~BLACKOUT_MODE_MASK; WREG32(MC_SHARED_BLACKOUT_CNTL, blackout | 1); } + /* wait for the MC to settle */ + udelay(100); } void evergreen_mc_resume(struct radeon_device *rdev, struct evergreen_mc_save *save) -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 23/81] Bluetooth: Fix handling of unexpected SMP PDUs
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Johan Hedberg
commit 8cf9fa1240229cbdd888236c0c43fcbad680cf00 upstream.
The conn->smp_chan pointer can be NULL if SMP PDUs arrive at unexpected
moments. To avoid NULL pointer dereferences the code should be checking
for this and disconnect if an unexpected SMP PDU arrives. This patch
fixes the issue by adding a check for conn->smp_chan for all other PDUs
except pairing request and security request (which are are the first
PDUs to come to initialize the SMP context).
Signed-off-by: Johan Hedberg
Acked-by: Marcel Holtmann
Signed-off-by: Gustavo Padovan
Signed-off-by: Herton Ronaldo Krzesinski
---
net/bluetooth/smp.c | 13 +
1 file changed, 13 insertions(+)
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 22fe004..9c97f7a 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -855,6 +855,19 @@ int smp_sig_channel(struct l2cap_conn *conn, struct
sk_buff *skb)
skb_pull(skb, sizeof(code));
+ /*
+* The SMP context must be initialized for all other PDUs except
+* pairing and security requests. If we get any other PDU when
+* not initialized simply disconnect (done if this function
+* returns an error).
+*/
+ if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
+ !conn->smp_chan) {
+ BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
+ kfree_skb(skb);
+ return -ENOTSUPP;
+ }
+
switch (code) {
case SMP_CMD_PAIRING_REQ:
reason = smp_cmd_pairing_req(conn, skb);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 26/81] target: Fix divide by zero bug in fabric_max_sectors for unconfigured devices
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Nicholas Bellinger
commit 7a3cf6ca1ab2a2f7161c6dec5a787fc7a5de864e upstream.
This patch fixes a possible divide by zero bug when the fabric_max_sectors
device attribute is written and backend se_device failed to be successfully
configured -> enabled.
Go ahead and use block_size=512 within se_dev_set_fabric_max_sectors()
in the event of a target_configure_device() failure case, as no valid
dev->dev_attrib.block_size value will have been setup yet.
Signed-off-by: Nicholas Bellinger
[ herton: adjust context, block size is
dev->se_sub_dev->se_dev_attrib.block_size ]
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/target/target_core_device.c |8 +++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/target/target_core_device.c
b/drivers/target/target_core_device.c
index 8542099..0208baa 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -1167,6 +1167,8 @@ int se_dev_set_queue_depth(struct se_device *dev, u32
queue_depth)
int se_dev_set_fabric_max_sectors(struct se_device *dev, u32
fabric_max_sectors)
{
+ int block_size = dev->se_sub_dev->se_dev_attrib.block_size;
+
if (atomic_read(>dev_export_obj.obj_access_count)) {
pr_err("dev[%p]: Unable to change SE Device"
" fabric_max_sectors while dev_export_obj: %d count
exists\n",
@@ -1204,8 +1206,12 @@ int se_dev_set_fabric_max_sectors(struct se_device *dev,
u32 fabric_max_sectors)
/*
* Align max_sectors down to PAGE_SIZE to follow
transport_allocate_data_tasks()
*/
+ if (!block_size) {
+ block_size = 512;
+ pr_warn("Defaulting to 512 for zero block_size\n");
+ }
fabric_max_sectors = se_dev_align_max_sectors(fabric_max_sectors,
-
dev->se_sub_dev->se_dev_attrib.block_size);
+ block_size);
dev->se_sub_dev->se_dev_attrib.fabric_max_sectors = fabric_max_sectors;
pr_debug("dev[%p]: SE Device max_sectors changed to %u\n",
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 27/81] digsig: Fix memory leakage in digsig_verify_rsa()
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: YOSHIFUJI Hideaki commit 7810cc1e7721220f1ed2a23ca95113d6434f6dcd upstream. digsig_verify_rsa() does not free kmalloc'ed buffer returned by mpi_get_buffer(). Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: Dmitry Kasatkin Signed-off-by: James Morris Signed-off-by: Herton Ronaldo Krzesinski --- lib/digsig.c |2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/digsig.c b/lib/digsig.c index 8c0e629..dc2be7e 100644 --- a/lib/digsig.c +++ b/lib/digsig.c @@ -162,6 +162,8 @@ static int digsig_verify_rsa(struct key *key, memset(out1, 0, head); memcpy(out1 + head, p, l); + kfree(p); + err = pkcs_1_v1_5_decode_emsa(out1, len, mblen, out2, ); if (err) goto err; -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 28/81] can: c_can: Set reserved bit in IFx_MASK2 to 1 on write
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Alexander Stein commit 2bd3bc4e8472424f1a6009825397639a8968920a upstream. According to C_CAN documentation, the reserved bit in IFx_MASK2 register is fixed 1. Signed-off-by: Alexander Stein Signed-off-by: Marc Kleine-Budde [ herton: adjust context ] Signed-off-by: Herton Ronaldo Krzesinski --- drivers/net/can/c_can/c_can.c |6 +- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c index 21a3d77..64647d4 100644 --- a/drivers/net/can/c_can/c_can.c +++ b/drivers/net/can/c_can/c_can.c @@ -446,8 +446,12 @@ static void c_can_setup_receive_object(struct net_device *dev, int iface, priv->write_reg(priv, >regs->ifregs[iface].mask1, IFX_WRITE_LOW_16BIT(mask)); + + /* According to C_CAN documentation, the reserved bit +* in IFx_MASK2 register is fixed 1 +*/ priv->write_reg(priv, >regs->ifregs[iface].mask2, - IFX_WRITE_HIGH_16BIT(mask)); + IFX_WRITE_HIGH_16BIT(mask) | BIT(13)); priv->write_reg(priv, >regs->ifregs[iface].arb1, IFX_WRITE_LOW_16BIT(id)); -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 30/81] USB: option: add Changhong CH690
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?=
commit d4fa681541aa7bf8570d03426dd7ba663a71c467 upstream.
New device with 3 serial interfaces:
If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend) Sub=ff Prot=ff
If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend) Sub=ff Prot=ff
If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend) Sub=ff Prot=ff
If#= 3 Alt= 0 #EPs= 2 Cls=08(stor) Sub=06 Prot=50
Signed-off-by: Bjørn Mork
Signed-off-by: Greg Kroah-Hartman
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/usb/serial/option.c |5 +
1 file changed, 5 insertions(+)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index bafe018..5f4ce8e 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -454,6 +454,10 @@ static void option_instat_callback(struct urb *urb);
#define TPLINK_VENDOR_ID 0x2357
#define TPLINK_PRODUCT_MA180 0x0201
+/* Changhong products */
+#define CHANGHONG_VENDOR_ID0x2077
+#define CHANGHONG_PRODUCT_CH6900x7001
+
/* some devices interfaces need special handling due to a number of reasons */
enum option_blacklist_reason {
OPTION_BLACKLIST_NONE = 0,
@@ -1326,6 +1330,7 @@ static const struct usb_device_id option_ids[] = {
{ USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T) },
{ USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
.driver_info = (kernel_ulong_t)_intf4_blacklist },
+ { USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) },
{ } /* Terminating entry */
};
MODULE_DEVICE_TABLE(usb, option_ids);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 32/81] USB: storage: Define a new macro for USB storage match rules
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: fangxiaozhi
commit 07c7be3d87e5cdaf5f94c271c516456364ef286c upstream.
1. Define a new macro for USB storage match rules:
matching with Vendor ID and interface descriptors.
Signed-off-by: fangxiaozhi
Signed-off-by: Greg Kroah-Hartman
[ herton: adjust context ]
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/usb/storage/usb.c | 12
drivers/usb/storage/usual-tables.c | 15 +++
2 files changed, 27 insertions(+)
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index e23c30a..2f232a2 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -120,6 +120,17 @@ MODULE_PARM_DESC(quirks, "supplemental list of device IDs
and their quirks");
.useTransport = use_transport, \
}
+#define UNUSUAL_VENDOR_INTF(idVendor, cl, sc, pr, \
+ vendor_name, product_name, use_protocol, use_transport, \
+ init_function, Flags) \
+{ \
+ .vendorName = vendor_name, \
+ .productName = product_name,\
+ .useProtocol = use_protocol,\
+ .useTransport = use_transport, \
+ .initFunction = init_function, \
+}
+
static struct us_unusual_dev us_unusual_dev_list[] = {
# include "unusual_devs.h"
{ } /* Terminating entry */
@@ -131,6 +142,7 @@ static struct us_unusual_dev for_dynamic_ids =
#undef UNUSUAL_DEV
#undef COMPLIANT_DEV
#undef USUAL_DEV
+#undef UNUSUAL_VENDOR_INTF
#ifdef CONFIG_LOCKDEP
diff --git a/drivers/usb/storage/usual-tables.c
b/drivers/usb/storage/usual-tables.c
index b969279..a9b5f2e 100644
--- a/drivers/usb/storage/usual-tables.c
+++ b/drivers/usb/storage/usual-tables.c
@@ -46,6 +46,20 @@
{ USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, useProto, useTrans), \
.driver_info = ((useType)<<24) }
+/* Define the device is matched with Vendor ID and interface descriptors */
+#define UNUSUAL_VENDOR_INTF(id_vendor, cl, sc, pr, \
+ vendorName, productName, useProtocol, useTransport, \
+ initFunction, flags) \
+{ \
+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO \
+ | USB_DEVICE_ID_MATCH_VENDOR, \
+ .idVendor= (id_vendor), \
+ .bInterfaceClass = (cl), \
+ .bInterfaceSubClass = (sc), \
+ .bInterfaceProtocol = (pr), \
+ .driver_info = (flags) \
+}
+
struct usb_device_id usb_storage_usb_ids[] = {
# include "unusual_devs.h"
{ } /* Terminating entry */
@@ -57,6 +71,7 @@ MODULE_DEVICE_TABLE(usb, usb_storage_usb_ids);
#undef UNUSUAL_DEV
#undef COMPLIANT_DEV
#undef USUAL_DEV
+#undef UNUSUAL_VENDOR_INTF
/*
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 29/81] USB: ftdi_sio: add PID/VID entries for ELV WS 300 PC II
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Sven Killig
commit c249f911406efcc7456cb4af79396726bf7b8c57 upstream.
Add PID/VID entries for ELV WS 300 PC II weather station
Signed-off-by: Sven Killig
Signed-off-by: Greg Kroah-Hartman
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/usb/serial/ftdi_sio.c |1 +
drivers/usb/serial/ftdi_sio_ids.h |4 +++-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 653139b..031b23c 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -590,6 +590,7 @@ static struct usb_device_id id_table_combined [] = {
/*
* ELV devices:
*/
+ { USB_DEVICE(FTDI_ELV_VID, FTDI_ELV_WS300_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_ELV_USR_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_ELV_MSM1_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_ELV_KL100_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h
b/drivers/usb/serial/ftdi_sio_ids.h
index fa5d560..7c89cfc 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -204,7 +204,7 @@
/*
* ELV USB devices submitted by Christian Abt of ELV (www.elv.de).
- * All of these devices use FTDI's vendor ID (0x0403).
+ * Almost all of these devices use FTDI's vendor ID (0x0403).
* Further IDs taken from ELV Windows .inf file.
*
* The previously included PID for the UO 100 module was incorrect.
@@ -212,6 +212,8 @@
*
* Armin Laeuger originally sent the PID for the UM 100 module.
*/
+#define FTDI_ELV_VID 0x1B1F /* ELV AG */
+#define FTDI_ELV_WS300_PID 0xC006 /* eQ3 WS 300 PC II */
#define FTDI_ELV_USR_PID 0xE000 /* ELV Universal-Sound-Recorder */
#define FTDI_ELV_MSM1_PID 0xE001 /* ELV Mini-Sound-Modul */
#define FTDI_ELV_KL100_PID 0xE002 /* ELV Kfz-Leistungsmesser KL 100 */
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 24/81] drm/radeon: Calling object_unrefer() when creating fb failure
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: liu chuansheng
commit f2d68cf4daa4de97d400d94836b907e35228e54f upstream.
When kzalloc() failed in radeon_user_framebuffer_create(), need to
call object_unreference() to match the object_reference().
Signed-off-by: liu chuansheng
Signed-off-by: xueminsu
Signed-off-by: Alex Deucher
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/gpu/drm/radeon/radeon_display.c |4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/radeon/radeon_display.c
b/drivers/gpu/drm/radeon/radeon_display.c
index 4ea672e..70eb18a 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -,8 +,10 @@ radeon_user_framebuffer_create(struct drm_device *dev,
}
radeon_fb = kzalloc(sizeof(*radeon_fb), GFP_KERNEL);
- if (radeon_fb == NULL)
+ if (radeon_fb == NULL) {
+ drm_gem_object_unreference_unlocked(obj);
return ERR_PTR(-ENOMEM);
+ }
ret = radeon_framebuffer_init(dev, radeon_fb, mode_cmd, obj);
if (ret) {
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 21/81] x86-64: Replace left over sti/cli in ia32 audit exit code
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Jan Beulich commit 40a1ef95da85843696fc3ebe5fce39b0db32669f upstream. For some reason they didn't get replaced so far by their paravirt equivalents, resulting in code to be run with interrupts disabled that doesn't expect so (causing, in the observed case, a BUG_ON() to trigger) when syscall auditing is enabled. David (Cc-ed) came up with an identical fix, so likely this can be taken to count as an ack from him. Reported-by: Peter Moody Signed-off-by: Jan Beulich Cc: David Vrabel Cc: Konrad Rzeszutek Wilk Link: http://lkml.kernel.org/r/5108e0190278000ba...@nat28.tlf.novell.com Signed-off-by: Ingo Molnar Cc: Konrad Rzeszutek Wilk Cc: David Vrabel Tested-by: Peter Moody Signed-off-by: Herton Ronaldo Krzesinski --- arch/x86/ia32/ia32entry.S |4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S index 20e5f7b..f6d477a 100644 --- a/arch/x86/ia32/ia32entry.S +++ b/arch/x86/ia32/ia32entry.S @@ -204,7 +204,7 @@ sysexit_from_sys_call: testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET) jnz ia32_ret_from_sys_call TRACE_IRQS_ON - sti + ENABLE_INTERRUPTS(CLBR_NONE) movl %eax,%esi /* second arg, syscall return value */ cmpl $-MAX_ERRNO,%eax /* is it an error ? */ jbe 1f @@ -214,7 +214,7 @@ sysexit_from_sys_call: call __audit_syscall_exit movq RAX-ARGOFFSET(%rsp),%rax /* reload syscall return value */ movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi - cli + DISABLE_INTERRUPTS(CLBR_NONE) TRACE_IRQS_OFF testl %edi,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET) jz \exit -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 36/81] mm/hugetlb: set PTE as huge in hugetlb_change_protection and remove_migration_pte
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Tony Lu
commit be7517d6ab9722f0abad6ba5ffd39cfced95549c upstream.
When setting a huge PTE, besides calling pte_mkhuge(), we also need to
call arch_make_huge_pte(), which we indeed do in make_huge_pte(), but we
forget to do in hugetlb_change_protection() and remove_migration_pte().
Signed-off-by: Zhigang Lu
Signed-off-by: Chris Metcalf
Reviewed-by: Michal Hocko
Acked-by: Hillf Danton
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
[ herton: adjust context ]
Signed-off-by: Herton Ronaldo Krzesinski
---
mm/hugetlb.c |1 +
mm/migrate.c |4 +++-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 9c34eb5..33d8b38 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2972,6 +2972,7 @@ void hugetlb_change_protection(struct vm_area_struct *vma,
if (!huge_pte_none(huge_ptep_get(ptep))) {
pte = huge_ptep_get_and_clear(mm, address, ptep);
pte = pte_mkhuge(pte_modify(pte, newprot));
+ pte = arch_make_huge_pte(pte, vma, NULL, 0);
set_huge_pte_at(mm, address, ptep, pte);
}
}
diff --git a/mm/migrate.c b/mm/migrate.c
index be26d5c..2e03986 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -142,8 +142,10 @@ static int remove_migration_pte(struct page *new, struct
vm_area_struct *vma,
if (is_write_migration_entry(entry))
pte = pte_mkwrite(pte);
#ifdef CONFIG_HUGETLB_PAGE
- if (PageHuge(new))
+ if (PageHuge(new)) {
pte = pte_mkhuge(pte);
+ pte = arch_make_huge_pte(pte, vma, new, 0);
+ }
#endif
flush_cache_page(vma, addr, pte_pfn(pte));
set_pte_at(mm, addr, ptep, pte);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 38/81] drivers/rtc/rtc-pl031.c: fix the missing operation on enable
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Haojian Zhuang commit e7e034e18a0ab6bafb2425c3242cac311164f4d6 upstream. The RTC control register should be enabled in the process of initializing. Without this patch, I failed to enable RTC in Hisilicon Hi3620 SoC. The register mapping section in RTC is always read as zero. So I doubt that ST guys may already enable this register in bootloader. So they won't meet this issue. Signed-off-by: Haojian Zhuang Cc: Srinidhi Kasagar Cc: Linus Walleij Cc: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds [ herton: adjust context ] Signed-off-by: Herton Ronaldo Krzesinski --- drivers/rtc/rtc-pl031.c |8 +--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c index cc05339..c42054b 100644 --- a/drivers/rtc/rtc-pl031.c +++ b/drivers/rtc/rtc-pl031.c @@ -44,6 +44,7 @@ #define RTC_YMR0x34/* Year match register */ #define RTC_YLR0x38/* Year data load register */ +#define RTC_CR_EN (1 << 0)/* counter enable bit */ #define RTC_CR_CWEN(1 << 26) /* Clockwatch enable bit */ #define RTC_TCR_EN (1 << 1) /* Periodic timer enable bit */ @@ -304,7 +305,7 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id) int ret; struct pl031_local *ldata; struct rtc_class_ops *ops = id->data; - unsigned long time; + unsigned long time, data; ret = amba_request_regions(adev, NULL); if (ret) @@ -331,10 +332,11 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id) dev_dbg(>dev, "designer ID = 0x%02x\n", ldata->hw_designer); dev_dbg(>dev, "revision = 0x%01x\n", ldata->hw_revision); + data = readl(ldata->base + RTC_CR); /* Enable the clockwatch on ST Variants */ if (ldata->hw_designer == AMBA_VENDOR_ST) - writel(readl(ldata->base + RTC_CR) | RTC_CR_CWEN, - ldata->base + RTC_CR); + data |= RTC_CR_CWEN; + writel(data | RTC_CR_EN, ldata->base + RTC_CR); /* * On ST PL031 variants, the RTC reset value does not provide correct -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 34/81] rtlwifi: Fix scheduling while atomic bug
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Larry Finger
commit a5ffbe0a1993a27072742ef7db6cf9839956fce9 upstream.
Kernel commits 41affd5 and 6539306 changed the locking in rtl_lps_leave()
from a spinlock to a mutex by doing the calls indirectly from a work queue
to reduce the time that interrupts were disabled. This change was fine for
most systems; however a scheduling while atomic bug was reported in
https://bugzilla.redhat.com/show_bug.cgi?id=903881. The backtrace indicates
that routine rtl_is_special(), which calls rtl_lps_leave() in three places
was entered in atomic context. These direct calls are replaced by putting a
request on the appropriate work queue.
Signed-off-by: Larry Finger
Reported-and-tested-by: Nathaniel Doherty
Cc: Nathaniel Doherty
Cc: Stanislaw Gruszka
Signed-off-by: John W. Linville
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/wireless/rtlwifi/base.c |7 ---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/rtlwifi/base.c
b/drivers/net/wireless/rtlwifi/base.c
index f4c852c..4110a6d 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -980,7 +980,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct
sk_buff *skb, u8 is_tx)
is_tx ? "Tx" : "Rx");
if (is_tx) {
- rtl_lps_leave(hw);
+ schedule_work(>
+ works.lps_leave_work);
ppsc->last_delaylps_stamp_jiffies =
jiffies;
}
@@ -990,7 +991,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct
sk_buff *skb, u8 is_tx)
}
} else if (ETH_P_ARP == ether_type) {
if (is_tx) {
- rtl_lps_leave(hw);
+ schedule_work(>works.lps_leave_work);
ppsc->last_delaylps_stamp_jiffies = jiffies;
}
@@ -1000,7 +1001,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct
sk_buff *skb, u8 is_tx)
"802.1X %s EAPOL pkt!!\n", is_tx ? "Tx" : "Rx");
if (is_tx) {
- rtl_lps_leave(hw);
+ schedule_work(>works.lps_leave_work);
ppsc->last_delaylps_stamp_jiffies = jiffies;
}
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 40/81] HID: usbhid: quirk for Formosa IR receiver
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Nicholas Santos
commit 320cde19a4e8f122b19d2df7a5c00636e11ca3fb upstream.
Patch to add the Formosa Industrial Computing, Inc. Infrared Receiver
[IR605A/Q] to hid-ids.h and hid-quirks.c. This IR receiver causes about a 10
second timeout when the usbhid driver attempts to initialze the device. Adding
this device to the quirks list with HID_QUIRK_NO_INIT_REPORTS removes the
delay.
Signed-off-by: Nicholas Santos
[jkos...@suse.cz: fix ordering]
Signed-off-by: Jiri Kosina
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/hid/hid-ids.h |3 +++
drivers/hid/usbhid/hid-quirks.c |1 +
2 files changed, 4 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 5ddfcc7..dc48cd1 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -296,6 +296,9 @@
#define USB_VENDOR_ID_EZKEY0x0518
#define USB_DEVICE_ID_BTC_8193 0x0002
+#define USB_VENDOR_ID_FORMOSA 0x147a
+#define USB_DEVICE_ID_FORMOSA_IR_RECEIVER 0xe03e
+
#define USB_VENDOR_ID_FREESCALE0x15A2
#define USB_DEVICE_ID_FREESCALE_MX28 0x004F
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 8865fa3..1a4bc41 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -70,6 +70,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER,
HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28,
HID_QUIRK_NOGET },
{ USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN,
HID_QUIRK_NO_INIT_REPORTS },
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 41/81] kernel/resource.c: fix stack overflow in __reserve_region_with_split()
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: T Makphaibulchoke
commit 4965f5667f36a95b41cda6638875bc992bd7d18b upstream.
Using a recursive call add a non-conflicting region in
__reserve_region_with_split() could result in a stack overflow in the case
that the recursive calls are too deep. Convert the recursive calls to an
iterative loop to avoid the problem.
Tested on a machine containing 135 regions. The kernel no longer panicked
with stack overflow.
Also tested with code arbitrarily adding regions with no conflict,
embedding two consecutive conflicts and embedding two non-consecutive
conflicts.
Signed-off-by: T Makphaibulchoke
Reviewed-by: Ram Pai
Cc: Paul Gortmaker
Cc: Wei Yang
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
Cc: Jiri Slaby
Signed-off-by: Herton Ronaldo Krzesinski
---
kernel/resource.c | 50 ++
1 file changed, 38 insertions(+), 12 deletions(-)
diff --git a/kernel/resource.c b/kernel/resource.c
index e1d2b8e..7de982e 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -758,6 +758,7 @@ static void __init __reserve_region_with_split(struct
resource *root,
struct resource *parent = root;
struct resource *conflict;
struct resource *res = kzalloc(sizeof(*res), GFP_ATOMIC);
+ struct resource *next_res = NULL;
if (!res)
return;
@@ -767,21 +768,46 @@ static void __init __reserve_region_with_split(struct
resource *root,
res->end = end;
res->flags = IORESOURCE_BUSY;
- conflict = __request_resource(parent, res);
- if (!conflict)
- return;
+ while (1) {
- /* failed, split and try again */
- kfree(res);
+ conflict = __request_resource(parent, res);
+ if (!conflict) {
+ if (!next_res)
+ break;
+ res = next_res;
+ next_res = NULL;
+ continue;
+ }
- /* conflict covered whole area */
- if (conflict->start <= start && conflict->end >= end)
- return;
+ /* conflict covered whole area */
+ if (conflict->start <= res->start &&
+ conflict->end >= res->end) {
+ kfree(res);
+ WARN_ON(next_res);
+ break;
+ }
+
+ /* failed, split and try again */
+ if (conflict->start > res->start) {
+ end = res->end;
+ res->end = conflict->start - 1;
+ if (conflict->end < end) {
+ next_res = kzalloc(sizeof(*next_res),
+ GFP_ATOMIC);
+ if (!next_res) {
+ kfree(res);
+ break;
+ }
+ next_res->name = name;
+ next_res->start = conflict->end + 1;
+ next_res->end = end;
+ next_res->flags = IORESOURCE_BUSY;
+ }
+ } else {
+ res->start = conflict->end + 1;
+ }
+ }
- if (conflict->start > start)
- __reserve_region_with_split(root, start, conflict->start-1,
name);
- if (conflict->end < end)
- __reserve_region_with_split(root, conflict->end+1, end, name);
}
void __init reserve_region_with_split(struct resource *root,
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 45/81] MAINTAINERS: Stephen Hemminger email change
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Stephen Hemminger commit adbbf69d1a54abf424e91875746a610dcc80017d upstream. I changed my email because the vyatta.com mail server is now redirected to brocade.com; and the Brocade mail system is not friendly to Linux desktop users. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller Signed-off-by: Herton Ronaldo Krzesinski --- MAINTAINERS |6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/MAINTAINERS b/MAINTAINERS index 0d67d1b..5927882 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -2663,7 +2663,7 @@ S:Maintained F: drivers/net/ethernet/i825xx/eexpress.* ETHERNET BRIDGE -M: Stephen Hemminger +M: Stephen Hemminger L: bri...@lists.linux-foundation.org L: net...@vger.kernel.org W: http://www.linuxfoundation.org/en/Net:Bridge @@ -4385,7 +4385,7 @@ S:Maintained MARVELL GIGABIT ETHERNET DRIVERS (skge/sky2) M: Mirko Lindner -M: Stephen Hemminger +M: Stephen Hemminger L: net...@vger.kernel.org S: Maintained F: drivers/net/ethernet/marvell/sk* @@ -4630,7 +4630,7 @@ S:Supported F: drivers/infiniband/hw/nes/ NETEM NETWORK EMULATOR -M: Stephen Hemminger +M: Stephen Hemminger L: ne...@lists.linux-foundation.org S: Maintained F: net/sched/sch_netem.c -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 50/81] net/mlx4_core: Set number of msix vectors under SRIOV mode to firmware defaults
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Or Gerlitz
commit ca4c7b35f75492de7fbf5ee95be07481c348caee upstream.
The lines
if (mlx4_is_mfunc(dev)) {
nreq = 2;
} else {
which hard code the number of requested msi-x vectors under multi-function
mode to two can be removed completely, since the firmware sets num_eqs and
reserved_eqs appropriately Thus, the code line:
nreq = min_t(int, dev->caps.num_eqs - dev->caps.reserved_eqs, nreq);
is by itself sufficient and correct for all cases. Currently, for mfunc
mode num_eqs = 32 and reserved_eqs = 28, hence four vectors will be enabled.
This triples (one vector is used for the async events and commands EQ) the
horse power provided for processing of incoming packets on netdev RSS scheme,
IO initiators/targets commands processing flows, etc.
Reviewed-by: Jack Morgenstein
Signed-off-by: Amir Vadai
Signed-off-by: Or Gerlitz
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/ethernet/mellanox/mlx4/main.c | 11 ++-
1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c
b/drivers/net/ethernet/mellanox/mlx4/main.c
index a0313de..c749b82 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1545,15 +1545,8 @@ static void mlx4_enable_msi_x(struct mlx4_dev *dev)
int i;
if (msi_x) {
- /* In multifunction mode each function gets 2 msi-X vectors
-* one for data path completions anf the other for asynch events
-* or command completions */
- if (mlx4_is_mfunc(dev)) {
- nreq = 2;
- } else {
- nreq = min_t(int, dev->caps.num_eqs -
-dev->caps.reserved_eqs, nreq);
- }
+ nreq = min_t(int, dev->caps.num_eqs - dev->caps.reserved_eqs,
+nreq);
entries = kcalloc(nreq, sizeof *entries, GFP_KERNEL);
if (!entries)
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 53/81] r8169: remove the obsolete and incorrect AMD workaround
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: =?UTF-8?q?Timo=20Ter=C3=A4s?=
commit 5d0feaff230c0abfe4a112e6f09f096ed99e0b2d upstream.
This was introduced in commit 6dccd16 "r8169: merge with version
6.001.00 of Realtek's r8169 driver". I did not find the version
6.001.00 online, but in 6.002.00 or any later r8169 from Realtek
this hunk is no longer present.
Also commit 05af214 "r8169: fix Ethernet Hangup for RTL8110SC
rev d" claims to have fixed this issue otherwise.
The magic compare mask of 0xfffe000 is dubious as it masks
parts of the Reserved part, and parts of the VLAN tag. But this
does not make much sense as the VLAN tag parts are perfectly
valid there. In matter of fact this seems to be triggered with
any VLAN tagged packet as RxVlanTag bit is matched. I would
suspect 0xfffe was intended to test reserved part only.
Finally, this hunk is evil as it can cause more packets to be
handled than what was NAPI quota causing net/core/dev.c:
net_rx_action(): WARN_ON_ONCE(work > weight) to trigger, and
mess up the NAPI state causing device to hang.
As result, any system using VLANs and having high receive
traffic (so that NAPI poll budget limits rtl_rx) would result
in device hang.
Signed-off-by: Timo Teräs
Acked-by: Francois Romieu
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/ethernet/realtek/r8169.c |7 ---
1 file changed, 7 deletions(-)
diff --git a/drivers/net/ethernet/realtek/r8169.c
b/drivers/net/ethernet/realtek/r8169.c
index 0e09bb8..67f73ae 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -5812,13 +5812,6 @@ process_pkt:
tp->rx_stats.bytes += pkt_size;
u64_stats_update_end(>rx_stats.syncp);
}
-
- /* Work around for AMD plateform. */
- if ((desc->opts2 & cpu_to_le32(0xfffe000)) &&
- (tp->mac_version == RTL_GIGA_MAC_VER_05)) {
- desc->opts2 = 0;
- cur_rx++;
- }
}
count = cur_rx - tp->cur_rx;
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 56/81] ipv6: do not create neighbor entries for local delivery
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Marcelo Ricardo Leitner commit bd30e947207e2ea0ff2c08f5b4a03025ddce48d3 upstream. They will be created at output, if ever needed. This avoids creating empty neighbor entries when TPROXYing/Forwarding packets for addresses that are not even directly reachable. Note that IPv4 already handles it this way. No neighbor entries are created for local input. Tested by myself and customer. Signed-off-by: Jiri Pirko Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller [ herton: adjust if condition, add additional RTF_LOCAL flag for the check ] Signed-off-by: Herton Ronaldo Krzesinski --- net/ipv6/route.c |3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index fd44184..08c149c 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -846,7 +846,8 @@ restart: dst_hold(>dst); read_unlock_bh(>tb6_lock); - if (!dst_get_neighbour_noref_raw(>dst) && !(rt->rt6i_flags & RTF_NONEXTHOP)) + if (!dst_get_neighbour_noref_raw(>dst) && + !(rt->rt6i_flags & (RTF_NONEXTHOP | RTF_LOCAL))) nrt = rt6_alloc_cow(rt, >daddr, >saddr); else if (!(rt->dst.flags & DST_HOST)) nrt = rt6_alloc_clone(rt, >daddr); -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 54/81] net: loopback: fix a dst refcounting issue
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet commit 794ed393b707f01858f5ebe2ae5eabaf89d00022 upstream. Ben Greear reported crashes in ip_rcv_finish() on a stress test involving many macvlans. We tracked the bug to a dst use after free. ip_rcv_finish() was calling dst->input() and got garbage for dst->input value. It appears the bug is in loopback driver, lacking a skb_dst_force() before calling netif_rx(). As a result, a non refcounted dst, normally protected by a RCU read_lock section, was escaping this section and could be freed before the packet being processed. [] loopback_xmit+0x64/0x83 [] dev_hard_start_xmit+0x26c/0x35e [] dev_queue_xmit+0x2c4/0x37c [] ? dev_hard_start_xmit+0x35e/0x35e [] ? eth_header+0x28/0xb6 [] neigh_resolve_output+0x176/0x1a7 [] ip_finish_output2+0x297/0x30d [] ? ip_finish_output2+0x137/0x30d [] ip_finish_output+0x63/0x68 [] ip_output+0x61/0x67 [] dst_output+0x17/0x1b [] ip_local_out+0x1e/0x23 [] ip_queue_xmit+0x315/0x353 [] ? ip_send_unicast_reply+0x2cc/0x2cc [] tcp_transmit_skb+0x7ca/0x80b [] tcp_connect+0x53c/0x587 [] ? getnstimeofday+0x44/0x7d [] ? ktime_get_real+0x11/0x3e [] tcp_v4_connect+0x3c2/0x431 [] __inet_stream_connect+0x84/0x287 [] ? inet_stream_connect+0x22/0x49 [] ? _local_bh_enable_ip+0x84/0x9f [] ? local_bh_enable+0xd/0x11 [] ? lock_sock_nested+0x6e/0x79 [] ? inet_stream_connect+0x22/0x49 [] inet_stream_connect+0x33/0x49 [] sys_connect+0x75/0x98 This bug was introduced in linux-2.6.35, in commit 7fee226ad2397b (net: add a noref bit on skb dst) skb_dst_force() is enforced in dev_queue_xmit() for devices having a qdisc. Reported-by: Ben Greear Signed-off-by: Eric Dumazet Tested-by: Ben Greear Signed-off-by: David S. Miller Signed-off-by: Herton Ronaldo Krzesinski --- drivers/net/loopback.c |5 + 1 file changed, 5 insertions(+) diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c index 32eb94e..a3d4707 100644 --- a/drivers/net/loopback.c +++ b/drivers/net/loopback.c @@ -77,6 +77,11 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb, skb_orphan(skb); + /* Before queueing this packet to netif_rx(), +* make sure dst is refcounted. +*/ + skb_dst_force(skb); + skb->protocol = eth_type_trans(skb, dev); /* it's OK to use per_cpu_ptr() because BHs are off */ -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 51/81] isdn/gigaset: fix zero size border case in debug dump
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Tilman Schmidt commit d721a1752ba544df8d7d36959038b26bc92bdf80 upstream. If subtracting 12 from l leaves zero we'd do a zero size allocation, leading to an oops later when we try to set the NUL terminator. Reported-by: Dan Carpenter Signed-off-by: Tilman Schmidt Signed-off-by: David S. Miller Signed-off-by: Herton Ronaldo Krzesinski --- drivers/isdn/gigaset/capi.c |2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c index 27e4a3e..f45b5b0 100644 --- a/drivers/isdn/gigaset/capi.c +++ b/drivers/isdn/gigaset/capi.c @@ -248,6 +248,8 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag, CAPIMSG_APPID(data), CAPIMSG_MSGID(data), l, CAPIMSG_CONTROL(data)); l -= 12; + if (l <= 0) + return; dbgline = kmalloc(3 * l, GFP_ATOMIC); if (!dbgline) return; -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 48/81] net: calxedaxgmac: throw away overrun frames
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Rob Herring commit d6fb3be544b46a7611a3373fcaa62b5b0be01888 upstream. The xgmac driver assumes 1 frame per descriptor. If a frame larger than the descriptor's buffer size is received, the frame will spill over into the next descriptor. So check for received frames that span more than one descriptor and discard them. This prevents a crash if we receive erroneous large packets. Signed-off-by: Rob Herring Cc: net...@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: David S. Miller Signed-off-by: Herton Ronaldo Krzesinski --- drivers/net/ethernet/calxeda/xgmac.c |4 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/calxeda/xgmac.c b/drivers/net/ethernet/calxeda/xgmac.c index 8b0a0e4..8a3cd87 100644 --- a/drivers/net/ethernet/calxeda/xgmac.c +++ b/drivers/net/ethernet/calxeda/xgmac.c @@ -546,6 +546,10 @@ static int desc_get_rx_status(struct xgmac_priv *priv, struct xgmac_dma_desc *p) return -1; } + /* All frames should fit into a single buffer */ + if (!(status & RXDESC_FIRST_SEG) || !(status & RXDESC_LAST_SEG)) + return -1; + /* Check if packet has checksum already */ if ((status & RXDESC_FRAME_TYPE) && (status & RXDESC_EXT_STATUS) && !(ext_status & RXDESC_IP_PAYLOAD_MASK)) -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 47/81] macvlan: fix macvlan_get_size()
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Eric Dumazet
commit 01fe944f1024bd4e5c327ddbe8d657656b66af2f upstream.
commit df8ef8f3aaa (macvlan: add FDB bridge ops and macvlan flags)
forgot to update macvlan_get_size() after the addition of
IFLA_MACVLAN_FLAGS
Signed-off-by: Eric Dumazet
Cc: John Fastabend
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/macvlan.c |5 -
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 66a9bfe..62ce7b8 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -822,7 +822,10 @@ static int macvlan_changelink(struct net_device *dev,
static size_t macvlan_get_size(const struct net_device *dev)
{
- return nla_total_size(4);
+ return (0
+ + nla_total_size(4) /* IFLA_MACVLAN_MODE */
+ + nla_total_size(2) /* IFLA_MACVLAN_FLAGS */
+ );
}
static int macvlan_fill_info(struct sk_buff *skb,
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 44/81] ipv6: fix the noflags test in addrconf_get_prefix_route
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Romain Kuntz commit 85da53bf1c336bb07ac038fb951403ab0478d2c5 upstream. The tests on the flags in addrconf_get_prefix_route() does no make much sense: the 'noflags' parameter contains the set of flags that must not match with the route flags, so the test must be done against 'noflags', and not against 'flags'. Signed-off-by: Romain Kuntz Acked-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller Signed-off-by: Herton Ronaldo Krzesinski --- net/ipv6/addrconf.c |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 0808ad5..fc9ac78 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -1741,7 +1741,7 @@ static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx, continue; if ((rt->rt6i_flags & flags) != flags) continue; - if ((noflags != 0) && ((rt->rt6i_flags & flags) != 0)) + if ((rt->rt6i_flags & noflags) != 0) continue; dst_hold(>dst); break; -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 58/81] packet: fix leakage of tx_ring memory
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Phil Sutter
commit 9665d5d62487e8e7b1f546c00e11107155384b9a upstream.
When releasing a packet socket, the routine packet_set_ring() is reused
to free rings instead of allocating them. But when calling it for the
first time, it fills req->tp_block_nr with the value of rb->pg_vec_len
which in the second invocation makes it bail out since req->tp_block_nr
is greater zero but req->tp_block_size is zero.
This patch solves the problem by passing a zeroed auto-variable to
packet_set_ring() upon each invocation from packet_release().
As far as I can tell, this issue exists even since 69e3c75 (net: TX_RING
and packet mmap), i.e. the original inclusion of TX ring support into
af_packet, but applies only to sockets with both RX and TX ring
allocated, which is probably why this was unnoticed all the time.
Signed-off-by: Phil Sutter
Cc: Johann Baudy
Cc: Daniel Borkmann
Acked-by: Daniel Borkmann
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
net/packet/af_packet.c | 10 ++
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 901cffd..02b1ef8 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2450,13 +2450,15 @@ static int packet_release(struct socket *sock)
packet_flush_mclist(sk);
- memset(_u, 0, sizeof(req_u));
-
- if (po->rx_ring.pg_vec)
+ if (po->rx_ring.pg_vec) {
+ memset(_u, 0, sizeof(req_u));
packet_set_ring(sk, _u, 1, 0);
+ }
- if (po->tx_ring.pg_vec)
+ if (po->tx_ring.pg_vec) {
+ memset(_u, 0, sizeof(req_u));
packet_set_ring(sk, _u, 1, 1);
+ }
fanout_release(sk);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 62/81] net: sctp: sctp_endpoint_free: zero out secret key data
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Daniel Borkmann
commit b5c37fe6e24eec194bb29d22fdd55d73bcc709bf upstream.
On sctp_endpoint_destroy, previously used sensitive keying material
should be zeroed out before the memory is returned, as we already do
with e.g. auth keys when released.
Signed-off-by: Daniel Borkmann
Acked-by: Vlad Yasevich
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
net/sctp/endpointola.c |5 +
1 file changed, 5 insertions(+)
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 68a385d..58cd035 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -248,6 +248,8 @@ void sctp_endpoint_free(struct sctp_endpoint *ep)
/* Final destructor for endpoint. */
static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
{
+ int i;
+
SCTP_ASSERT(ep->base.dead, "Endpoint is not dead", return);
/* Free up the HMAC transform. */
@@ -270,6 +272,9 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
sctp_inq_free(>base.inqueue);
sctp_bind_addr_free(>base.bind_addr);
+ for (i = 0; i < SCTP_HOW_MANY_SECRETS; ++i)
+ memset(>secret_key[i], 0, SCTP_SECRET_SIZE);
+
/* Remove and free the port */
if (sctp_sk(ep->base.sk)->bind_hash)
sctp_put_port(ep->base.sk);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 60/81] sctp: refactor sctp_outq_teardown to insure proper re-initalization
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Neil Horman
commit 2f94aabd9f6c925d77aecb3ff020f1cc12ed8f86 upstream.
Jamie Parsons reported a problem recently, in which the re-initalization of an
association (The duplicate init case), resulted in a loss of receive window
space. He tracked down the root cause to sctp_outq_teardown, which discarded
all the data on an outq during a re-initalization of the corresponding
association, but never reset the outq->outstanding_data field to zero. I wrote,
and he tested this fix, which does a proper full re-initalization of the outq,
fixing this problem, and hopefully future proofing us from simmilar issues down
the road.
Signed-off-by: Neil Horman
Reported-by: Jamie Parsons
Tested-by: Jamie Parsons
CC: Jamie Parsons
CC: Vlad Yasevich
CC: "David S. Miller"
CC: net...@vger.kernel.org
Acked-by: Vlad Yasevich
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
net/sctp/outqueue.c | 12
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index a0fa19f..0716290 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -223,7 +223,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct
sctp_outq *q)
/* Free the outqueue structure and any related pending chunks.
*/
-void sctp_outq_teardown(struct sctp_outq *q)
+static void __sctp_outq_teardown(struct sctp_outq *q)
{
struct sctp_transport *transport;
struct list_head *lchunk, *temp;
@@ -276,8 +276,6 @@ void sctp_outq_teardown(struct sctp_outq *q)
sctp_chunk_free(chunk);
}
- q->error = 0;
-
/* Throw away any leftover control chunks. */
list_for_each_entry_safe(chunk, tmp, >control_chunk_list, list) {
list_del_init(>list);
@@ -285,11 +283,17 @@ void sctp_outq_teardown(struct sctp_outq *q)
}
}
+void sctp_outq_teardown(struct sctp_outq *q)
+{
+ __sctp_outq_teardown(q);
+ sctp_outq_init(q->asoc, q);
+}
+
/* Free the outqueue structure and any related pending chunks. */
void sctp_outq_free(struct sctp_outq *q)
{
/* Throw away leftover chunks. */
- sctp_outq_teardown(q);
+ __sctp_outq_teardown(q);
/* If we were kmalloc()'d, free the memory. */
if (q->malloced)
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 66/81] netback: correct netbk_tx_err to handle wrap around.
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Ian Campbell
commit b9149729ebdcfce63f853aa54a404c6a8f6ebbf3 upstream.
Signed-off-by: Ian Campbell
Acked-by: Jan Beulich
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/xen-netback/netback.c |2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/xen-netback/netback.c
b/drivers/net/xen-netback/netback.c
index c503a58..f3c3a68 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -851,7 +851,7 @@ static void netbk_tx_err(struct xenvif *vif,
do {
make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
- if (cons >= end)
+ if (cons == end)
break;
txp = RING_GET_REQUEST(>tx, cons++);
} while (1);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 68/81] tcp: fix for zero packets_in_flight was too broad
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?=
commit 6731d2095bd4aef18027c72ef845ab1087c3ba63 upstream.
There are transients during normal FRTO procedure during which
the packets_in_flight can go to zero between write_queue state
updates and firing the resulting segments out. As FRTO processing
occurs during that window the check must be more precise to
not match "spuriously" :-). More specificly, e.g., when
packets_in_flight is zero but FLAG_DATA_ACKED is true the problematic
branch that set cwnd into zero would not be taken and new segments
might be sent out later.
Signed-off-by: Ilpo Järvinen
Tested-by: Eric Dumazet
Acked-by: Neal Cardwell
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
net/ipv4/tcp_input.c |8 ++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 6affa92..3b14d81 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3695,8 +3695,7 @@ static bool tcp_process_frto(struct sock *sk, int flag)
((tp->frto_counter >= 2) && (flag & FLAG_RETRANS_DATA_ACKED)))
tp->undo_marker = 0;
- if (!before(tp->snd_una, tp->frto_highmark) ||
- !tcp_packets_in_flight(tp)) {
+ if (!before(tp->snd_una, tp->frto_highmark)) {
tcp_enter_frto_loss(sk, (tp->frto_counter == 1 ? 2 : 3), flag);
return true;
}
@@ -3716,6 +3715,11 @@ static bool tcp_process_frto(struct sock *sk, int flag)
}
} else {
if (!(flag & FLAG_DATA_ACKED) && (tp->frto_counter == 1)) {
+ if (!tcp_packets_in_flight(tp)) {
+ tcp_enter_frto_loss(sk, 2, flag);
+ return true;
+ }
+
/* Prevent sending of new data. */
tp->snd_cwnd = min(tp->snd_cwnd,
tcp_packets_in_flight(tp));
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 69/81] bridge: Pull ip header into skb->data before looking into ip header.
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Sarveshwar Bandi commit 6caab7b0544e83e6c160b5e80f5a4a7dd69545c7 upstream. If lower layer driver leaves the ip header in the skb fragment, it needs to be first pulled into skb->data before inspecting ip header length or ip version number. Signed-off-by: Sarveshwar Bandi Signed-off-by: David S. Miller Signed-off-by: Herton Ronaldo Krzesinski --- net/bridge/br_netfilter.c |3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c index e41456b..ab52468 100644 --- a/net/bridge/br_netfilter.c +++ b/net/bridge/br_netfilter.c @@ -256,6 +256,9 @@ static int br_parse_ip_options(struct sk_buff *skb) struct net_device *dev = skb->dev; u32 len; + if (!pskb_may_pull(skb, sizeof(struct iphdr))) + goto inhdr_error; + iph = ip_hdr(skb); opt = &(IPCB(skb)->opt); -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 72/81] Revert "USB: Handle warm reset failure on empty port."
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Herton Ronaldo Krzesinski
This reverts commit ff88c5021f17139d961478e40372f6bb028321bc, which is a
cherry-pick of commit 65bdac5effd15d6af619b3b7218627ef4d84ed6a upstream.
As discussed on a recent thread on stable/lkml/etc. ("[regression]
external HDD in USB3 enclosure cannot be dynamically removed"), this
changed caused issues, and shall be reapplied later with the proper
fixes, once they go into Linus tree.
Cc: Sarah Sharp
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/usb/core/hub.c | 12 +---
1 file changed, 1 insertion(+), 11 deletions(-)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index c9590c6..1e8b3bd 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2488,11 +2488,6 @@ static int hub_port_wait_reset(struct usb_hub *hub, int
port1,
return 0;
}
} else {
- if (!(portstatus & USB_PORT_STAT_CONNECTION) ||
- hub_port_warm_reset_required(hub,
- portstatus))
- return -ENOTCONN;
-
return 0;
}
@@ -4537,14 +4532,9 @@ static void hub_events(void)
* SS.Inactive state.
*/
if (hub_port_warm_reset_required(hub, portstatus)) {
- int status;
-
dev_dbg(hub_dev, "warm reset port %d\n", i);
- status = hub_port_reset(hub, i, NULL,
+ hub_port_reset(hub, i, NULL,
HUB_BH_RESET_TIME, true);
- if (status < 0)
- hub_port_disable(hub, i, 1);
- connect_change = 0;
}
if (connect_change)
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 75/81] x86/apic: Work around boot failure on HP ProLiant DL980 G7 Server systems
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Stoney Wang
commit cb214ede7657db458fd0b2a25ea0b28dbf900ebc upstream.
When a HP ProLiant DL980 G7 Server boots a regular kernel,
there will be intermittent lost interrupts which could
result in a hang or (in extreme cases) data loss.
The reason is that this system only supports x2apic physical
mode, while the kernel boots with a logical-cluster default
setting.
This bug can be worked around by specifying the "x2apic_phys" or
"nox2apic" boot option, but we want to handle this system
without requiring manual workarounds.
The BIOS sets ACPI_FADT_APIC_PHYSICAL in FADT table.
As all apicids are smaller than 255, BIOS need to pass the
control to the OS with xapic mode, according to x2apic-spec,
chapter 2.9.
Current code handle x2apic when BIOS pass with xapic mode
enabled:
When user specifies x2apic_phys, or FADT indicates PHYSICAL:
1. During madt oem check, apic driver is set with xapic logical
or xapic phys driver at first.
2. enable_IR_x2apic() will enable x2apic_mode.
3. if user specifies x2apic_phys on the boot line, x2apic_phys_probe()
will install the correct x2apic phys driver and use x2apic phys mode.
Otherwise it will skip the driver will let x2apic_cluster_probe to
take over to install x2apic cluster driver (wrong one) even though FADT
indicates PHYSICAL, because x2apic_phys_probe does not check
FADT PHYSICAL.
Add checking x2apic_fadt_phys in x2apic_phys_probe() to fix the
problem.
Signed-off-by: Stoney Wang
[ updated the changelog and simplified the code ]
Signed-off-by: Yinghai Lu
Link:
http://lkml.kernel.org/r/1360263182-16226-1-git-send-email-ying...@kernel.org
Signed-off-by: Ingo Molnar
Signed-off-by: Herton Ronaldo Krzesinski
---
arch/x86/kernel/apic/x2apic_phys.c | 21 +++--
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/arch/x86/kernel/apic/x2apic_phys.c
b/arch/x86/kernel/apic/x2apic_phys.c
index c17e982..d14fee3 100644
--- a/arch/x86/kernel/apic/x2apic_phys.c
+++ b/arch/x86/kernel/apic/x2apic_phys.c
@@ -20,18 +20,19 @@ static int set_x2apic_phys_mode(char *arg)
}
early_param("x2apic_phys", set_x2apic_phys_mode);
-static int x2apic_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
+static bool x2apic_fadt_phys(void)
{
- if (x2apic_phys)
- return x2apic_enabled();
- else if ((acpi_gbl_FADT.header.revision >= FADT2_REVISION_ID) &&
- (acpi_gbl_FADT.flags & ACPI_FADT_APIC_PHYSICAL) &&
- x2apic_enabled()) {
+ if ((acpi_gbl_FADT.header.revision >= FADT2_REVISION_ID) &&
+ (acpi_gbl_FADT.flags & ACPI_FADT_APIC_PHYSICAL)) {
printk(KERN_DEBUG "System requires x2apic physical mode\n");
- return 1;
+ return true;
}
- else
- return 0;
+ return false;
+}
+
+static int x2apic_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
+{
+ return x2apic_enabled() && (x2apic_phys || x2apic_fadt_phys());
}
static void
@@ -114,7 +115,7 @@ static void init_x2apic_ldr(void)
static int x2apic_phys_probe(void)
{
- if (x2apic_mode && x2apic_phys)
+ if (x2apic_mode && (x2apic_phys || x2apic_fadt_phys()))
return 1;
return apic == _x2apic_phys;
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 71/81] tg3: Fix crc errors on jumbo frame receive
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Nithin Nayak Sujir
commit daf3ec688e057f6060fb9bb0819feac7a8bbf45c upstream.
TG3_PHY_AUXCTL_SMDSP_ENABLE/DISABLE macros do a blind write to the phy
auxiliary control register and overwrite the EXT_PKT_LEN (bit 14) resulting
in intermittent crc errors on jumbo frames with some link partners. Change
the code to do a read/modify/write.
Signed-off-by: Nithin Nayak Sujir
Signed-off-by: Michael Chan
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/ethernet/broadcom/tg3.c | 58 +--
1 file changed, 35 insertions(+), 23 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/tg3.c
b/drivers/net/ethernet/broadcom/tg3.c
index 82a8ed2..4da6a86 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -1136,14 +1136,26 @@ static int tg3_phy_auxctl_write(struct tg3 *tp, int
reg, u32 set)
return tg3_writephy(tp, MII_TG3_AUX_CTRL, set | reg);
}
-#define TG3_PHY_AUXCTL_SMDSP_ENABLE(tp) \
- tg3_phy_auxctl_write((tp), MII_TG3_AUXCTL_SHDWSEL_AUXCTL, \
-MII_TG3_AUXCTL_ACTL_SMDSP_ENA | \
-MII_TG3_AUXCTL_ACTL_TX_6DB)
+static int tg3_phy_toggle_auxctl_smdsp(struct tg3 *tp, bool enable)
+{
+ u32 val;
+ int err;
+
+ err = tg3_phy_auxctl_read(tp, MII_TG3_AUXCTL_SHDWSEL_AUXCTL, );
-#define TG3_PHY_AUXCTL_SMDSP_DISABLE(tp) \
- tg3_phy_auxctl_write((tp), MII_TG3_AUXCTL_SHDWSEL_AUXCTL, \
-MII_TG3_AUXCTL_ACTL_TX_6DB);
+ if (err)
+ return err;
+ if (enable)
+
+ val |= MII_TG3_AUXCTL_ACTL_SMDSP_ENA;
+ else
+ val &= ~MII_TG3_AUXCTL_ACTL_SMDSP_ENA;
+
+ err = tg3_phy_auxctl_write((tp), MII_TG3_AUXCTL_SHDWSEL_AUXCTL,
+ val | MII_TG3_AUXCTL_ACTL_TX_6DB);
+
+ return err;
+}
static int tg3_bmcr_reset(struct tg3 *tp)
{
@@ -2076,7 +2088,7 @@ static void tg3_phy_apply_otp(struct tg3 *tp)
otp = tp->phy_otp;
- if (TG3_PHY_AUXCTL_SMDSP_ENABLE(tp))
+ if (tg3_phy_toggle_auxctl_smdsp(tp, true))
return;
phy = ((otp & TG3_OTP_AGCTGT_MASK) >> TG3_OTP_AGCTGT_SHIFT);
@@ -2101,7 +2113,7 @@ static void tg3_phy_apply_otp(struct tg3 *tp)
((otp & TG3_OTP_RCOFF_MASK) >> TG3_OTP_RCOFF_SHIFT);
tg3_phydsp_write(tp, MII_TG3_DSP_EXP97, phy);
- TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+ tg3_phy_toggle_auxctl_smdsp(tp, false);
}
static void tg3_phy_eee_adjust(struct tg3 *tp, u32 current_link_up)
@@ -2137,9 +2149,9 @@ static void tg3_phy_eee_adjust(struct tg3 *tp, u32
current_link_up)
if (!tp->setlpicnt) {
if (current_link_up == 1 &&
- !TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
+ !tg3_phy_toggle_auxctl_smdsp(tp, true)) {
tg3_phydsp_write(tp, MII_TG3_DSP_TAP26, 0x);
- TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+ tg3_phy_toggle_auxctl_smdsp(tp, false);
}
val = tr32(TG3_CPMU_EEE_MODE);
@@ -2155,11 +2167,11 @@ static void tg3_phy_eee_enable(struct tg3 *tp)
(GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 ||
GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719 ||
tg3_flag(tp, 57765_CLASS)) &&
- !TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
+ !tg3_phy_toggle_auxctl_smdsp(tp, true)) {
val = MII_TG3_DSP_TAP26_ALNOKO |
MII_TG3_DSP_TAP26_RMRXSTO;
tg3_phydsp_write(tp, MII_TG3_DSP_TAP26, val);
- TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+ tg3_phy_toggle_auxctl_smdsp(tp, false);
}
val = tr32(TG3_CPMU_EEE_MODE);
@@ -2303,7 +2315,7 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
tg3_writephy(tp, MII_CTRL1000,
CTL1000_AS_MASTER | CTL1000_ENABLE_MASTER);
- err = TG3_PHY_AUXCTL_SMDSP_ENABLE(tp);
+ err = tg3_phy_toggle_auxctl_smdsp(tp, true);
if (err)
return err;
@@ -2324,7 +2336,7 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
tg3_writephy(tp, MII_TG3_DSP_ADDRESS, 0x8200);
tg3_writephy(tp, MII_TG3_DSP_CONTROL, 0x);
- TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+ tg3_phy_toggle_auxctl_smdsp(tp, false);
tg3_writephy(tp, MII_CTRL1000, phy9_orig);
@@ -2413,10 +2425,10 @@ static int tg3_phy_reset(struct tg3 *tp)
out:
if ((tp->phy_flags & TG3_PHYFLG_ADC_BUG) &&
- !TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
+ !tg3_phy_toggle_auxctl_smdsp(tp, true)) {
tg3_phydsp_write(tp, 0
[PATCH 63/81] xen/netback: shutdown the ring if it contains garbage.
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Ian Campbell
commit 48856286b64e4b66ec62b94e504d0b29c1ade664 upstream.
A buggy or malicious frontend should not be able to confuse netback.
If we spot anything which is not as it should be then shutdown the
device and don't try to continue with the ring in a potentially
hostile state. Well behaved and non-hostile frontends will not be
penalised.
As well as making the existing checks for such errors fatal also add a
new check that ensures that there isn't an insane number of requests
on the ring (i.e. more than would fit in the ring). If the ring
contains garbage then previously is was possible to loop over this
insane number, getting an error each time and therefore not generating
any more pending requests and therefore not exiting the loop in
xen_netbk_tx_build_gops for an externded period.
Also turn various netdev_dbg calls which no precipitate a fatal error
into netdev_err, they are rate limited because the device is shutdown
afterwards.
This fixes at least one known DoS/softlockup of the backend domain.
Signed-off-by: Ian Campbell
Reviewed-by: Konrad Rzeszutek Wilk
Acked-by: Jan Beulich
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/xen-netback/common.h|3 ++
drivers/net/xen-netback/interface.c | 23 -
drivers/net/xen-netback/netback.c | 62 +--
3 files changed, 62 insertions(+), 26 deletions(-)
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 94b79c3..9d7f172 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -151,6 +151,9 @@ void xen_netbk_queue_tx_skb(struct xenvif *vif, struct
sk_buff *skb);
/* Notify xenvif that ring now has space to send an skb to the frontend */
void xenvif_notify_tx_completion(struct xenvif *vif);
+/* Prevent the device from generating any further traffic. */
+void xenvif_carrier_off(struct xenvif *vif);
+
/* Returns number of ring slots required to send an skb to the frontend */
unsigned int xen_netbk_count_skb_slots(struct xenvif *vif, struct sk_buff
*skb);
diff --git a/drivers/net/xen-netback/interface.c
b/drivers/net/xen-netback/interface.c
index b7d41f8..b8c5193 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -343,17 +343,22 @@ err:
return err;
}
-void xenvif_disconnect(struct xenvif *vif)
+void xenvif_carrier_off(struct xenvif *vif)
{
struct net_device *dev = vif->dev;
- if (netif_carrier_ok(dev)) {
- rtnl_lock();
- netif_carrier_off(dev); /* discard queued packets */
- if (netif_running(dev))
- xenvif_down(vif);
- rtnl_unlock();
- xenvif_put(vif);
- }
+
+ rtnl_lock();
+ netif_carrier_off(dev); /* discard queued packets */
+ if (netif_running(dev))
+ xenvif_down(vif);
+ rtnl_unlock();
+ xenvif_put(vif);
+}
+
+void xenvif_disconnect(struct xenvif *vif)
+{
+ if (netif_carrier_ok(vif->dev))
+ xenvif_carrier_off(vif);
atomic_dec(>refcnt);
wait_event(vif->waiting_to_free, atomic_read(>refcnt) == 0);
diff --git a/drivers/net/xen-netback/netback.c
b/drivers/net/xen-netback/netback.c
index f4a6fca..ae321c0 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -859,6 +859,13 @@ static void netbk_tx_err(struct xenvif *vif,
xenvif_put(vif);
}
+static void netbk_fatal_tx_err(struct xenvif *vif)
+{
+ netdev_err(vif->dev, "fatal error; disabling device\n");
+ xenvif_carrier_off(vif);
+ xenvif_put(vif);
+}
+
static int netbk_count_requests(struct xenvif *vif,
struct xen_netif_tx_request *first,
struct xen_netif_tx_request *txp,
@@ -872,19 +879,22 @@ static int netbk_count_requests(struct xenvif *vif,
do {
if (frags >= work_to_do) {
- netdev_dbg(vif->dev, "Need more frags\n");
+ netdev_err(vif->dev, "Need more frags\n");
+ netbk_fatal_tx_err(vif);
return -frags;
}
if (unlikely(frags >= MAX_SKB_FRAGS)) {
- netdev_dbg(vif->dev, "Too many frags\n");
+ netdev_err(vif->dev, "Too many frags\n");
+ netbk_fatal_tx_err(vif);
return -frags;
}
memcpy(txp, RING_GET_REQUEST(>tx, cons + frags),
sizeof(*txp));
if (txp->size > first->size) {
- netdev_dbg(vif-&
[PATCH 77/81] mm: don't overwrite mm->def_flags in do_mlockall()
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Gerald Schaefer
commit 9977f0f164d46613288e0b5778eae500dfe06f31 upstream.
With commit 8e72033f2a48 ("thp: make MADV_HUGEPAGE check for
mm->def_flags") the VM_NOHUGEPAGE flag may be set on s390 in
mm->def_flags for certain processes, to prevent future thp mappings.
This would be overwritten by do_mlockall(), which sets it back to 0 with
an optional VM_LOCKED flag set.
To fix this, instead of overwriting mm->def_flags in do_mlockall(), only
the VM_LOCKED flag should be set or cleared.
Signed-off-by: Gerald Schaefer
Reported-by: Vivek Goyal
Cc: Andrea Arcangeli
Cc: Hugh Dickins
Cc: Martin Schwidefsky
Cc: Heiko Carstens
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
Signed-off-by: Herton Ronaldo Krzesinski
---
mm/mlock.c |6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/mm/mlock.c b/mm/mlock.c
index ef726e8..3283272 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -524,11 +524,11 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t,
len)
static int do_mlockall(int flags)
{
struct vm_area_struct * vma, * prev = NULL;
- unsigned int def_flags = 0;
if (flags & MCL_FUTURE)
- def_flags = VM_LOCKED;
- current->mm->def_flags = def_flags;
+ current->mm->def_flags |= VM_LOCKED;
+ else
+ current->mm->def_flags &= ~VM_LOCKED;
if (flags == MCL_FUTURE)
goto out;
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 78/81] x86/mm: Check if PUD is large when validating a kernel address
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Mel Gorman
commit 0ee364eb316348ddf3e0dfcd986f5f13f528f821 upstream.
A user reported the following oops when a backup process reads
/proc/kcore:
BUG: unable to handle kernel paging request at bb00ff33b000
IP: [] kern_addr_valid+0xbe/0x110
[...]
Call Trace:
[] read_kcore+0x17a/0x370
[] proc_reg_read+0x77/0xc0
[] vfs_read+0xc7/0x130
[] sys_read+0x53/0xa0
[] system_call_fastpath+0x16/0x1b
Investigation determined that the bug triggered when reading
system RAM at the 4G mark. On this system, that was the first
address using 1G pages for the virt->phys direct mapping so the
PUD is pointing to a physical address, not a PMD page.
The problem is that the page table walker in kern_addr_valid() is
not checking pud_large() and treats the physical address as if
it was a PMD. If it happens to look like pmd_none then it'll
silently fail, probably returning zeros instead of real data. If
the data happens to look like a present PMD though, it will be
walked resulting in the oops above.
This patch adds the necessary pud_large() check.
Unfortunately the problem was not readily reproducible and now
they are running the backup program without accessing
/proc/kcore so the patch has not been validated but I think it
makes sense.
Signed-off-by: Mel Gorman
Reviewed-by: Rik van Riel
Reviewed-by: Michal Hocko
Acked-by: Johannes Weiner
Cc: linux...@kvack.org
Link: http://lkml.kernel.org/r/20130211145236.gx21...@suse.de
Signed-off-by: Ingo Molnar
Signed-off-by: Herton Ronaldo Krzesinski
---
arch/x86/include/asm/pgtable.h |5 +
arch/x86/mm/init_64.c |3 +++
2 files changed, 8 insertions(+)
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index c3520d7..3f3dd52 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -142,6 +142,11 @@ static inline unsigned long pmd_pfn(pmd_t pmd)
return (pmd_val(pmd) & PTE_PFN_MASK) >> PAGE_SHIFT;
}
+static inline unsigned long pud_pfn(pud_t pud)
+{
+ return (pud_val(pud) & PTE_PFN_MASK) >> PAGE_SHIFT;
+}
+
#define pte_page(pte) pfn_to_page(pte_pfn(pte))
static inline int pmd_large(pmd_t pte)
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 3baff25..ce42da7 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -829,6 +829,9 @@ int kern_addr_valid(unsigned long addr)
if (pud_none(*pud))
return 0;
+ if (pud_large(*pud))
+ return pfn_valid(pud_pfn(*pud));
+
pmd = pmd_offset(pud, addr);
if (pmd_none(*pmd))
return 0;
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 80/81] efi: Clear EFI_RUNTIME_SERVICES rather than EFI_BOOT by "noefi" boot parameter
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Satoru Takeuchi
commit 1de63d60cd5b0d33a812efa455d5933bf1564a51 upstream.
There was a serious problem in samsung-laptop that its platform driver is
designed to run under BIOS and running under EFI can cause the machine to
become bricked or can cause Machine Check Exceptions.
Discussion about this problem:
https://bugs.launchpad.net/ubuntu-cdimage/+bug/1040557
https://bugzilla.kernel.org/show_bug.cgi?id=47121
The patches to fix this problem:
efi: Make 'efi_enabled' a function to query EFI facilities
83e68189745ad931c2afd45d8ee3303929233e7f
samsung-laptop: Disable on EFI hardware
e0094244e41c4d0c7ad69920681972fc45d8ce34
Unfortunately this problem comes back again if users specify "noefi" option.
This parameter clears EFI_BOOT and that driver continues to run even if running
under EFI. Refer to the document, this parameter should clear
EFI_RUNTIME_SERVICES instead.
Documentation/kernel-parameters.txt:
===
...
noefi [X86] Disable EFI runtime services support.
...
===
Documentation/x86/x86_64/uefi.txt:
===
...
- If some or all EFI runtime services don't work, you can try following
kernel command line parameters to turn off some or all EFI runtime
services.
noefi turn off all EFI runtime services
...
===
Signed-off-by: Satoru Takeuchi
Link: http://lkml.kernel.org/r/511c2c04.2070...@jp.fujitsu.com
Cc: Matt Fleming
Signed-off-by: H. Peter Anvin
Signed-off-by: Herton Ronaldo Krzesinski
---
arch/x86/platform/efi/efi.c |2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 6fcd4ad..3705bb0 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -86,7 +86,7 @@ EXPORT_SYMBOL(efi_enabled);
static int __init setup_noefi(char *arg)
{
- clear_bit(EFI_BOOT, _efi_facility);
+ clear_bit(EFI_RUNTIME_SERVICES, _efi_facility);
return 0;
}
early_param("noefi", setup_noefi);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 81/81] mm: fix pageblock bitmap allocation
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Linus Torvalds
commit 7c45512df987c5619db041b5c9b80d281e26d3db upstream.
Commit c060f943d092 ("mm: use aligned zone start for pfn_to_bitidx
calculation") fixed out calculation of the index into the pageblock
bitmap when a !SPARSEMEM zome was not aligned to pageblock_nr_pages.
However, the _allocation_ of that bitmap had never taken this alignment
requirement into accout, so depending on the exact size and alignment of
the zone, the use of that index could then access past the allocation,
resulting in some very subtle memory corruption.
This was reported (and bisected) by Ingo Molnar: one of his random
config builds would hang with certain very specific kernel command line
options.
In the meantime, commit c060f943d092 has been marked for stable, so this
fix needs to be back-ported to the stable kernels that backported the
commit to use the right alignment.
Bisected-and-tested-by: Ingo Molnar
Acked-by: Mel Gorman
Signed-off-by: Linus Torvalds
Signed-off-by: Herton Ronaldo Krzesinski
---
mm/page_alloc.c | 15 +--
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 007bf3b..0ed96c7 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4272,10 +4272,11 @@ static void __meminit calculate_node_totalpages(struct
pglist_data *pgdat,
* round what is now in bits to nearest long in bits, then return it in
* bytes.
*/
-static unsigned long __init usemap_size(unsigned long zonesize)
+static unsigned long __init usemap_size(unsigned long zone_start_pfn, unsigned
long zonesize)
{
unsigned long usemapsize;
+ zonesize += zone_start_pfn & (pageblock_nr_pages-1);
usemapsize = roundup(zonesize, pageblock_nr_pages);
usemapsize = usemapsize >> pageblock_order;
usemapsize *= NR_PAGEBLOCK_BITS;
@@ -4285,17 +4286,19 @@ static unsigned long __init usemap_size(unsigned long
zonesize)
}
static void __init setup_usemap(struct pglist_data *pgdat,
- struct zone *zone, unsigned long zonesize)
+ struct zone *zone,
+ unsigned long zone_start_pfn,
+ unsigned long zonesize)
{
- unsigned long usemapsize = usemap_size(zonesize);
+ unsigned long usemapsize = usemap_size(zone_start_pfn, zonesize);
zone->pageblock_flags = NULL;
if (usemapsize)
zone->pageblock_flags = alloc_bootmem_node_nopanic(pgdat,
usemapsize);
}
#else
-static inline void setup_usemap(struct pglist_data *pgdat,
- struct zone *zone, unsigned long zonesize) {}
+static inline void setup_usemap(struct pglist_data *pgdat, struct zone *zone,
+ unsigned long zone_start_pfn, unsigned long
zonesize) {}
#endif /* CONFIG_SPARSEMEM */
#ifdef CONFIG_HUGETLB_PAGE_SIZE_VARIABLE
@@ -4414,7 +4417,7 @@ static void __paginginit free_area_init_core(struct
pglist_data *pgdat,
continue;
set_pageblock_order();
- setup_usemap(pgdat, zone, size);
+ setup_usemap(pgdat, zone, zone_start_pfn, size);
ret = init_currently_empty_zone(zone, zone_start_pfn,
size, MEMMAP_EARLY);
BUG_ON(ret);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 79/81] PCI/PM: Clean up PME state when removing a device
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: "Rafael J. Wysocki"
commit 249bfb83cf8ba658955f0245ac3981d941f746ee upstream.
Devices are added to pci_pme_list when drivers use pci_enable_wake()
or pci_wake_from_d3(), but they aren't removed from the list unless
the driver explicitly disables wakeup. Many drivers never disable
wakeup, so their devices remain on the list even after they are
removed, e.g., via hotplug. A subsequent PME poll will oops when
it tries to touch the device.
This patch disables PME# on a device before removing it, which removes
the device from pci_pme_list. This is safe even if the device never
had PME# enabled.
This oops can be triggered by unplugging a Thunderbolt ethernet adapter
on a Macbook Pro, as reported by Daniel below.
[bhelgaas: changelog]
Reference:
http://lkml.kernel.org/r/camvg2svg21yim1wkh4_2pen2n+cr2-zv7tbh3gj+8mwevzj...@mail.gmail.com
Reported-and-tested-by: Daniel J Blueman
Signed-off-by: Rafael J. Wysocki
Signed-off-by: Bjorn Helgaas
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/pci/remove.c |2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
index fd77e2b..eae55c7 100644
--- a/drivers/pci/remove.c
+++ b/drivers/pci/remove.c
@@ -19,6 +19,8 @@ static void pci_free_resources(struct pci_dev *dev)
static void pci_stop_dev(struct pci_dev *dev)
{
+ pci_pme_active(dev, false);
+
if (dev->is_added) {
pci_proc_detach_device(dev);
pci_remove_sysfs_dev_files(dev);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 76/81] drivers/rtc/rtc-pl031.c: restore ST variant functionality
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Linus Walleij
commit 3399cfb5df9594495b876d1843a7165f77366b2b upstream.
Commit e7e034e18a0a ("drivers/rtc/rtc-pl031.c: fix the missing operation
on enable") accidentally broke the ST variants of PL031.
The bit that is being poked as "clockwatch" enable bit for the ST
variants does the work of bit 0 on this variant. Bit 0 is used for a
clock divider on the ST variants, and setting it to 1 will affect
timekeeping in a very bad way.
Signed-off-by: Linus Walleij
Acked-by: Haojian Zhuang
Cc: Mian Yousaf KAUKAB
Cc: Srinidhi Kasagar
Cc: Alessandro Zummo
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
[ herton: adjust context ]
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/rtc/rtc-pl031.c |4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c
index c42054b..b232996 100644
--- a/drivers/rtc/rtc-pl031.c
+++ b/drivers/rtc/rtc-pl031.c
@@ -336,7 +336,9 @@ static int pl031_probe(struct amba_device *adev, const
struct amba_id *id)
/* Enable the clockwatch on ST Variants */
if (ldata->hw_designer == AMBA_VENDOR_ST)
data |= RTC_CR_CWEN;
- writel(data | RTC_CR_EN, ldata->base + RTC_CR);
+ else
+ data |= RTC_CR_EN;
+ writel(data, ldata->base + RTC_CR);
/*
* On ST PL031 variants, the RTC reset value does not provide correct
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 74/81] x86: Do not leak kernel page mapping locations
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Kees Cook commit e575a86fdc50d013bf3ad3aa81d9100e8e6cc60d upstream. Without this patch, it is trivial to determine kernel page mappings by examining the error code reported to dmesg[1]. Instead, declare the entire kernel memory space as a violation of a present page. Additionally, since show_unhandled_signals is enabled by default, switch branch hinting to the more realistic expectation, and unobfuscate the setting of the PF_PROT bit to improve readability. [1] http://vulnfactory.org/blog/2013/02/06/a-linux-memory-trick/ Reported-by: Dan Rosenberg Suggested-by: Brad Spengler Signed-off-by: Kees Cook Acked-by: H. Peter Anvin Cc: Paul E. McKenney Cc: Frederic Weisbecker Cc: Eric W. Biederman Cc: Linus Torvalds Cc: Andrew Morton Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20130207174413.ga12...@www.outflux.net Signed-off-by: Ingo Molnar Signed-off-by: Herton Ronaldo Krzesinski --- arch/x86/mm/fault.c |8 +--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c index 76dcd9d..c6b10e2 100644 --- a/arch/x86/mm/fault.c +++ b/arch/x86/mm/fault.c @@ -747,13 +747,15 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code, return; } #endif + /* Kernel addresses are always protection faults: */ + if (address >= TASK_SIZE) + error_code |= PF_PROT; - if (unlikely(show_unhandled_signals)) + if (likely(show_unhandled_signals)) show_signal_msg(regs, error_code, address, tsk); - /* Kernel addresses are always protection faults: */ tsk->thread.cr2 = address; - tsk->thread.error_code = error_code | (address >= TASK_SIZE); + tsk->thread.error_code = error_code; tsk->thread.trap_nr = X86_TRAP_PF; force_sig_info_fault(SIGSEGV, si_code, address, tsk, 0); -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 70/81] tg3: Avoid null pointer dereference in tg3_interrupt in netconsole mode
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Nithin Nayak Sujir commit 9c13cb8bb477a83b9a3c9e5a5478a4e21294a760 upstream. When netconsole is enabled, logging messages generated during tg3_open can result in a null pointer dereference for the uninitialized tg3 status block. Use the irq_sync flag to disable polling in the early stages. irq_sync is cleared when the driver is enabling interrupts after all initialization is completed. Signed-off-by: Nithin Nayak Sujir Signed-off-by: Michael Chan Signed-off-by: David S. Miller Signed-off-by: Herton Ronaldo Krzesinski --- drivers/net/ethernet/broadcom/tg3.c |4 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c index 15f8b00..82a8ed2 100644 --- a/drivers/net/ethernet/broadcom/tg3.c +++ b/drivers/net/ethernet/broadcom/tg3.c @@ -6594,6 +6594,9 @@ static void tg3_poll_controller(struct net_device *dev) int i; struct tg3 *tp = netdev_priv(dev); + if (tg3_irq_sync(tp)) + return; + for (i = 0; i < tp->irq_cnt; i++) tg3_interrupt(tp->napi[i].irq_vec, >napi[i]); } @@ -15556,6 +15559,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev, tp->pm_cap = pm_cap; tp->rx_mode = TG3_DEF_RX_MODE; tp->tx_mode = TG3_DEF_TX_MODE; + tp->irq_sync = 1; if (tg3_debug > 0) tp->msg_enable = tg3_debug; -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 73/81] s390/timer: avoid overflow when programming clock comparator
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Heiko Carstens commit d911e03d097bdc01363df5d81c43f69432eb785c upstream. Since ed4f209 "s390/time: fix sched_clock() overflow" a new helper function is used to avoid overflows when converting TOD format values to nanosecond values. The kvm interrupt code formerly however only worked by accident because of an overflow. It tried to program a timer that would expire in more than ~29 years. Because of the old TOD-to-nanoseconds overflow bug the real expiry value however was much smaller, but now it isn't anymore. This however triggers yet another bug in the function that programs the clock comparator s390_next_ktime(): if the absolute "expires" value is after 2042 this will result in an overflow and the programmed value is lower than the current TOD value which immediatly triggers a clock comparator (= timer) interrupt. Since the timer isn't expired it will be programmed immediately again and so on... the result is a dead system. To fix this simply program the maximum possible value if an overflow is detected. Reported-by: Christian Borntraeger Tested-by: Christian Borntraeger Signed-off-by: Heiko Carstens Signed-off-by: Herton Ronaldo Krzesinski --- arch/s390/kernel/time.c |3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c index c5531db..747ab28 100644 --- a/arch/s390/kernel/time.c +++ b/arch/s390/kernel/time.c @@ -121,6 +121,9 @@ static int s390_next_ktime(ktime_t expires, nsecs = ktime_to_ns(ktime_add(timespec_to_ktime(ts), expires)); do_div(nsecs, 125); S390_lowcore.clock_comparator = sched_clock_base_cc + (nsecs << 9); + /* Program the maximum value if we have an overflow (== year 2042) */ + if (unlikely(S390_lowcore.clock_comparator < sched_clock_base_cc)) + S390_lowcore.clock_comparator = -1ULL; set_clock_comparator(S390_lowcore.clock_comparator); return 0; } -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 67/81] tcp: frto should not set snd_cwnd to 0
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Eric Dumazet
commit 2e5f421211ff76c17130b4597bc06df4eeead24f upstream.
Commit 9dc274151a548 (tcp: fix ABC in tcp_slow_start())
uncovered a bug in FRTO code :
tcp_process_frto() is setting snd_cwnd to 0 if the number
of in flight packets is 0.
As Neal pointed out, if no packet is in flight we lost our
chance to disambiguate whether a loss timeout was spurious.
We should assume it was a proper loss.
Reported-by: Pasi Kärkkäinen
Signed-off-by: Neal Cardwell
Signed-off-by: Eric Dumazet
Cc: Ilpo Järvinen
Cc: Yuchung Cheng
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
net/ipv4/tcp_input.c |3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 19c430c..6affa92 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3695,7 +3695,8 @@ static bool tcp_process_frto(struct sock *sk, int flag)
((tp->frto_counter >= 2) && (flag & FLAG_RETRANS_DATA_ACKED)))
tp->undo_marker = 0;
- if (!before(tp->snd_una, tp->frto_highmark)) {
+ if (!before(tp->snd_una, tp->frto_highmark) ||
+ !tcp_packets_in_flight(tp)) {
tcp_enter_frto_loss(sk, (tp->frto_counter == 1 ? 2 : 3), flag);
return true;
}
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 65/81] xen/netback: free already allocated memory on failure in xen_netbk_get_requests
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Ian Campbell
commit 4cc7c1cb7b11b6f3515bd9075527576a1eecc4aa upstream.
Signed-off-by: Ian Campbell
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/xen-netback/netback.c | 13 -
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/net/xen-netback/netback.c
b/drivers/net/xen-netback/netback.c
index e7913e0..c503a58 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -949,7 +949,7 @@ static struct gnttab_copy *xen_netbk_get_requests(struct
xen_netbk *netbk,
pending_idx = netbk->pending_ring[index];
page = xen_netbk_alloc_page(netbk, skb, pending_idx);
if (!page)
- return NULL;
+ goto err;
gop->source.u.ref = txp->gref;
gop->source.domid = vif->domid;
@@ -971,6 +971,17 @@ static struct gnttab_copy *xen_netbk_get_requests(struct
xen_netbk *netbk,
}
return gop;
+err:
+ /* Unwind, freeing all pages and sending error responses. */
+ while (i-- > start) {
+ xen_netbk_idx_release(netbk, frag_get_pending_idx([i]),
+ XEN_NETIF_RSP_ERROR);
+ }
+ /* The head too, if necessary. */
+ if (start)
+ xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
+
+ return NULL;
}
static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 61/81] net: sctp: sctp_setsockopt_auth_key: use kzfree instead of kfree
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Daniel Borkmann commit 6ba542a291a5e558603ac51cda9bded347ce7627 upstream. In sctp_setsockopt_auth_key, we create a temporary copy of the user passed shared auth key for the endpoint or association and after internal setup, we free it right away. Since it's sensitive data, we should zero out the key before returning the memory back to the allocator. Thus, use kzfree instead of kfree, just as we do in sctp_auth_key_put(). Signed-off-by: Daniel Borkmann Signed-off-by: David S. Miller Signed-off-by: Herton Ronaldo Krzesinski --- net/sctp/socket.c |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 944cfce..957bb6e 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -3375,7 +3375,7 @@ static int sctp_setsockopt_auth_key(struct sock *sk, ret = sctp_auth_set_key(sctp_sk(sk)->ep, asoc, authkey); out: - kfree(authkey); + kzfree(authkey); return ret; } -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 64/81] xen/netback: don't leak pages on failure in xen_netbk_tx_check_gop.
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Matthew Daley
commit 7d5145d8eb2b9791533ffe4dc003b129b9696c48 upstream.
Signed-off-by: Matthew Daley
Reviewed-by: Konrad Rzeszutek Wilk
Acked-by: Ian Campbell
Acked-by: Jan Beulich
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/xen-netback/netback.c | 38 +
1 file changed, 13 insertions(+), 25 deletions(-)
diff --git a/drivers/net/xen-netback/netback.c
b/drivers/net/xen-netback/netback.c
index ae321c0..e7913e0 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -146,7 +146,8 @@ void xen_netbk_remove_xenvif(struct xenvif *vif)
atomic_dec(>netfront_count);
}
-static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx);
+static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx,
+ u8 status);
static void make_tx_response(struct xenvif *vif,
struct xen_netif_tx_request *txp,
s8 st);
@@ -978,30 +979,20 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
{
struct gnttab_copy *gop = *gopp;
u16 pending_idx = *((u16 *)skb->data);
- struct pending_tx_info *pending_tx_info = netbk->pending_tx_info;
- struct xenvif *vif = pending_tx_info[pending_idx].vif;
- struct xen_netif_tx_request *txp;
struct skb_shared_info *shinfo = skb_shinfo(skb);
int nr_frags = shinfo->nr_frags;
int i, err, start;
/* Check status of header. */
err = gop->status;
- if (unlikely(err)) {
- pending_ring_idx_t index;
- index = pending_index(netbk->pending_prod++);
- txp = _tx_info[pending_idx].req;
- make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
- netbk->pending_ring[index] = pending_idx;
- xenvif_put(vif);
- }
+ if (unlikely(err))
+ xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
/* Skip first skb fragment if it is on same page as header fragment. */
start = (frag_get_pending_idx(>frags[0]) == pending_idx);
for (i = start; i < nr_frags; i++) {
int j, newerr;
- pending_ring_idx_t index;
pending_idx = frag_get_pending_idx(>frags[i]);
@@ -1010,16 +1001,12 @@ static int xen_netbk_tx_check_gop(struct xen_netbk
*netbk,
if (likely(!newerr)) {
/* Had a previous error? Invalidate this fragment. */
if (unlikely(err))
- xen_netbk_idx_release(netbk, pending_idx);
+ xen_netbk_idx_release(netbk, pending_idx,
XEN_NETIF_RSP_OKAY);
continue;
}
/* Error on this fragment: respond to client with an error. */
- txp = >pending_tx_info[pending_idx].req;
- make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
- index = pending_index(netbk->pending_prod++);
- netbk->pending_ring[index] = pending_idx;
- xenvif_put(vif);
+ xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
/* Not the first error? Preceding frags already invalidated. */
if (err)
@@ -1027,10 +1014,10 @@ static int xen_netbk_tx_check_gop(struct xen_netbk
*netbk,
/* First error: invalidate header and preceding fragments. */
pending_idx = *((u16 *)skb->data);
- xen_netbk_idx_release(netbk, pending_idx);
+ xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
for (j = start; j < i; j++) {
pending_idx = frag_get_pending_idx(>frags[j]);
- xen_netbk_idx_release(netbk, pending_idx);
+ xen_netbk_idx_release(netbk, pending_idx,
XEN_NETIF_RSP_OKAY);
}
/* Remember the error: invalidate all subsequent fragments. */
@@ -1064,7 +1051,7 @@ static void xen_netbk_fill_frags(struct xen_netbk *netbk,
struct sk_buff *skb)
/* Take an extra reference to offset xen_netbk_idx_release */
get_page(netbk->mmap_pages[pending_idx]);
- xen_netbk_idx_release(netbk, pending_idx);
+ xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
}
}
@@ -1447,7 +1434,7 @@ static void xen_netbk_tx_submit(struct xen_netbk *netbk)
txp->size -= data_len;
} else {
/* Schedule a response immediately. */
- xen_netbk_idx_release(netbk, pending_idx);
+ xen_net
[PATCH 59/81] atm/iphase: rename fregt_t -> ffreg_t
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Heiko Carstens
commit ab54ee80aa7585f9666ff4dd665441d7ce41f1e8 upstream.
We have conflicting type qualifiers for "freg_t" in s390's ptrace.h and the
iphase atm device driver, which causes the compile error below.
Unfortunately the s390 typedef can't be renamed, since it's a user visible api,
nor can I change the include order in s390 code to avoid the conflict.
So simply rename the iphase typedef to a new name. Fixes this compile error:
In file included from drivers/atm/iphase.c:66:0:
drivers/atm/iphase.h:639:25: error: conflicting type qualifiers for 'freg_t'
In file included from next/arch/s390/include/asm/ptrace.h:9:0,
from next/arch/s390/include/asm/lowcore.h:12,
from next/arch/s390/include/asm/thread_info.h:30,
from include/linux/thread_info.h:54,
from include/linux/preempt.h:9,
from include/linux/spinlock.h:50,
from include/linux/seqlock.h:29,
from include/linux/time.h:5,
from include/linux/stat.h:18,
from include/linux/module.h:10,
from drivers/atm/iphase.c:43:
next/arch/s390/include/uapi/asm/ptrace.h:197:3: note: previous declaration of
'freg_t' was here
Signed-off-by: Heiko Carstens
Acked-by: chas williams - CONTRACTOR
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/atm/iphase.h | 146 +-
1 file changed, 73 insertions(+), 73 deletions(-)
diff --git a/drivers/atm/iphase.h b/drivers/atm/iphase.h
index 6a0955e..53ecac5 100644
--- a/drivers/atm/iphase.h
+++ b/drivers/atm/iphase.h
@@ -636,82 +636,82 @@ struct rx_buf_desc {
#define SEG_BASE IPHASE5575_FRAG_CONTROL_REG_BASE
#define REASS_BASE IPHASE5575_REASS_CONTROL_REG_BASE
-typedef volatile u_int freg_t;
+typedef volatile u_int ffreg_t;
typedef u_int rreg_t;
typedef struct _ffredn_t {
-freg_t idlehead_high; /* Idle cell header (high) */
-freg_t idlehead_low; /* Idle cell header (low) */
-freg_t maxrate;/* Maximum rate */
-freg_t stparms;/* Traffic Management Parameters*/
-freg_t abrubr_abr; /* ABRUBR Priority Byte 1, TCR Byte 0 */
-freg_t rm_type;/* */
-u_int filler5[0x17 - 0x06];
-freg_t cmd_reg;/* Command register */
-u_int filler18[0x20 - 0x18];
-freg_t cbr_base; /* CBR Pointer Base */
-freg_t vbr_base; /* VBR Pointer Base */
-freg_t abr_base; /* ABR Pointer Base */
-freg_t ubr_base; /* UBR Pointer Base */
-u_int filler24;
-freg_t vbrwq_base; /* VBR Wait Queue Base */
-freg_t abrwq_base; /* ABR Wait Queue Base */
-freg_t ubrwq_base; /* UBR Wait Queue Base */
-freg_t vct_base; /* Main VC Table Base */
-freg_t vcte_base; /* Extended Main VC Table Base */
-u_int filler2a[0x2C - 0x2A];
-freg_t cbr_tab_beg;/* CBR Table Begin */
-freg_t cbr_tab_end;/* CBR Table End*/
-freg_t cbr_pointer;/* CBR Pointer */
-u_int filler2f[0x30 - 0x2F];
-freg_t prq_st_adr; /* Packet Ready Queue Start Address */
-freg_t prq_ed_adr; /* Packet Ready Queue End Address */
-freg_t prq_rd_ptr; /* Packet Ready Queue read pointer */
-freg_t prq_wr_ptr; /* Packet Ready Queue write pointer */
-freg_t tcq_st_adr; /* Transmit Complete Queue Start Address*/
-freg_t tcq_ed_adr; /* Transmit Complete Queue End Address */
-freg_t tcq_rd_ptr; /* Transmit Complete Queue read pointer */
-freg_t tcq_wr_ptr; /* Transmit Complete Queue write pointer*/
-u_int filler38[0x40 - 0x38];
-freg_t queue_base; /* Base address for PRQ and TCQ */
-freg_t desc_base; /* Base address of descriptor table */
-u_int filler42[0x45 - 0x42];
-freg_t mode_reg_0; /* Mode register 0 */
-freg_t mode_reg_1; /* Mode register 1 */
-freg_t intr_status_reg;/* Interrupt Status register*/
-freg_t mask_reg; /* Mask Register*/
-freg_t cell_ctr_high1; /* Total cell transfer count (high) */
-freg_t cell_ctr_lo1; /* Total cell transfer
[PATCH 57/81] via-rhine: Fix bugs in NAPI support.
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: "David S. Miller"
commit 559bcac35facfed49ab4f408e162971612dcfdf3 upstream.
1) rhine_tx() should use dev_kfree_skb() not dev_kfree_skb_irq()
2) rhine_slow_event_task's NAPI triggering logic is racey, it
should just hit the interrupt mask register. This is the
same as commit 7dbb491878a2c51d372a8890fa45a8ff80358af1
("r8169: avoid NAPI scheduling delay.") made to fix the same
problem in the r8169 driver. From Francois Romieu.
Reported-by: Jamie Gloudon
Tested-by: Jamie Gloudon
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/ethernet/via/via-rhine.c |8 ++--
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/via/via-rhine.c
b/drivers/net/ethernet/via/via-rhine.c
index 0459c09..046526e0 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -1802,7 +1802,7 @@ static void rhine_tx(struct net_device *dev)
rp->tx_skbuff[entry]->len,
PCI_DMA_TODEVICE);
}
- dev_kfree_skb_irq(rp->tx_skbuff[entry]);
+ dev_kfree_skb(rp->tx_skbuff[entry]);
rp->tx_skbuff[entry] = NULL;
entry = (++rp->dirty_tx) % TX_RING_SIZE;
}
@@ -2011,11 +2011,7 @@ static void rhine_slow_event_task(struct work_struct
*work)
if (intr_status & IntrPCIErr)
netif_warn(rp, hw, dev, "PCI error\n");
- napi_disable(>napi);
- rhine_irq_disable(rp);
- /* Slow and safe. Consider __napi_schedule as a replacement ? */
- napi_enable(>napi);
- napi_schedule(>napi);
+ iowrite16(RHINE_EVENT & 0x, rp->base + IntrEnable);
out_unlock:
mutex_unlock(>task_lock);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 55/81] pktgen: correctly handle failures when adding a device
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Cong Wang
commit 604dfd6efc9b79bce432f2394791708d8e8f6efc upstream.
The return value of pktgen_add_device() is not checked, so
even if we fail to add some device, for example, non-exist one,
we still see "OK:...". This patch fixes it.
After this patch, I got:
# echo "add_device non-exist" > /proc/net/pktgen/kpktgend_0
-bash: echo: write error: No such device
# cat /proc/net/pktgen/kpktgend_0
Running:
Stopped:
Result: ERROR: can not add device non-exist
# echo "add_device eth0" > /proc/net/pktgen/kpktgend_0
# cat /proc/net/pktgen/kpktgend_0
Running:
Stopped: eth0
Result: OK: add_device=eth0
(Candidate for -stable)
Cc: David S. Miller
Signed-off-by: Cong Wang
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
net/core/pktgen.c |9 ++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index aa278cd..2a42802 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -1797,10 +1797,13 @@ static ssize_t pktgen_thread_write(struct file *file,
return -EFAULT;
i += len;
mutex_lock(_thread_lock);
- pktgen_add_device(t, f);
+ ret = pktgen_add_device(t, f);
mutex_unlock(_thread_lock);
- ret = count;
- sprintf(pg_result, "OK: add_device=%s", f);
+ if (!ret) {
+ ret = count;
+ sprintf(pg_result, "OK: add_device=%s", f);
+ } else
+ sprintf(pg_result, "ERROR: can not add device %s", f);
goto out;
}
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 52/81] netxen: fix off by one bug in netxen_release_tx_buffer()
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Eric Dumazet
commit a05948f296ce103989b28a2606e47d2e287c3c89 upstream.
Christoph Paasch found netxen could trigger a BUG in its dismantle
phase, in netxen_release_tx_buffer(), using full size TSO packets.
cmd_buf->frag_count includes the skb->data part, so the loop must
start at index 1 instead of 0, or else we can make an out
of bound access to cmd_buff->frag_array[MAX_SKB_FRAGS + 2]
Christoph provided the fixes in netxen_map_tx_skb() function.
In case of a dma mapping error, its better to clear the dma fields
so that we don't try to unmap them again in netxen_release_tx_buffer()
Reported-by: Christoph Paasch
Signed-off-by: Eric Dumazet
Tested-by: Christoph Paasch
Cc: Sony Chacko
Cc: Rajesh Borundia
Signed-off-by: Christoph Paasch
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
.../net/ethernet/qlogic/netxen/netxen_nic_init.c |2 +-
.../net/ethernet/qlogic/netxen/netxen_nic_main.c |2 ++
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
index 8694124..fdddfcc 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
@@ -144,7 +144,7 @@ void netxen_release_tx_buffers(struct netxen_adapter
*adapter)
buffrag->length, PCI_DMA_TODEVICE);
buffrag->dma = 0ULL;
}
- for (j = 0; j < cmd_buf->frag_count; j++) {
+ for (j = 1; j < cmd_buf->frag_count; j++) {
buffrag++;
if (buffrag->dma) {
pci_unmap_page(adapter->pdev, buffrag->dma,
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index a77c558..d6a8218 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -1963,10 +1963,12 @@ unwind:
while (--i >= 0) {
nf = >frag_array[i+1];
pci_unmap_page(pdev, nf->dma, nf->length, PCI_DMA_TODEVICE);
+ nf->dma = 0ULL;
}
nf = >frag_array[0];
pci_unmap_single(pdev, nf->dma, skb_headlen(skb), PCI_DMA_TODEVICE);
+ nf->dma = 0ULL;
out_err:
return -ENOMEM;
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 46/81] ipv6: fix header length calculation in ip6_append_data()
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Romain KUNTZ
commit 7efdba5bd9a2f3e2059beeb45c9fa55eefe1bced upstream.
Commit 299b0767 (ipv6: Fix IPsec slowpath fragmentation problem)
has introduced a error in the header length calculation that
provokes corrupted packets when non-fragmentable extensions
headers (Destination Option or Routing Header Type 2) are used.
rt->rt6i_nfheader_len is the length of the non-fragmentable
extension header, and it should be substracted to
rt->dst.header_len, and not to exthdrlen, as it was done before
commit 299b0767.
This patch reverts to the original and correct behavior. It has
been successfully tested with and without IPsec on packets
that include non-fragmentable extensions headers.
Signed-off-by: Romain Kuntz
Acked-by: Steffen Klassert
Signed-off-by: David S. Miller
[ herton: adjust context ]
Signed-off-by: Herton Ronaldo Krzesinski
---
net/ipv6/ip6_output.c |4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index decc21d1..4703c70 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1293,10 +1293,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void
*from, char *to,
cork->length = 0;
sk->sk_sndmsg_page = NULL;
sk->sk_sndmsg_off = 0;
- exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len;
+ exthdrlen = (opt ? opt->opt_flen : 0);
length += exthdrlen;
transhdrlen += exthdrlen;
- dst_exthdrlen = rt->dst.header_len;
+ dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
} else {
rt = (struct rt6_info *)cork->dst;
fl6 = >cork.fl.u.ip6;
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 49/81] net/mlx4_en: Fix bridged vSwitch configuration for non SRIOV mode
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Yan Burman
commit 213815a1e6ae70b9648483b110bc5081795f99e8 upstream.
Commit 5b4c4d36860e "mlx4_en: Allow communication between functions on
same host" introduced a regression under which a bridge acting as vSwitch
whose uplink is an mlx4 Ethernet device become non-operative in native
(non sriov) mode. This happens since broadcast ARP requests sent by VMs
were loopback-ed by the HW and hence the bridge learned VM source MACs
on both the VM and the uplink ports.
The fix is to place the DMAC in the send WQE only under SRIOV/eSwitch
configuration or when the device is in selftest.
Reviewed-by: Or Gerlitz
Signed-off-by: Yan Burman
Signed-off-by: Amir Vadai
Signed-off-by: David S. Miller
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/ethernet/mellanox/mlx4/en_tx.c | 13 +
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 019d856..8ba03c9 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -633,10 +633,15 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct
net_device *dev)
ring->tx_csum++;
}
- /* Copy dst mac address to wqe */
- ethh = (struct ethhdr *)skb->data;
- tx_desc->ctrl.srcrb_flags16[0] = get_unaligned((__be16 *)ethh->h_dest);
- tx_desc->ctrl.imm = get_unaligned((__be32 *)(ethh->h_dest + 2));
+ if (mlx4_is_mfunc(mdev->dev) || priv->validate_loopback) {
+ /* Copy dst mac address to wqe. This allows loopback in eSwitch,
+* so that VFs and PF can communicate with each other
+*/
+ ethh = (struct ethhdr *)skb->data;
+ tx_desc->ctrl.srcrb_flags16[0] = get_unaligned((__be16
*)ethh->h_dest);
+ tx_desc->ctrl.imm = get_unaligned((__be32 *)(ethh->h_dest + 2));
+ }
+
/* Handle LSO (TSO) packets */
if (lso_header_size) {
/* Mark opcode as LSO */
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 43/81] net: prevent setting ttl=0 via IP_TTL
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Cong Wang commit c9be4a5c49cf51cc70a993f004c5bb30067a65ce upstream. A regression is introduced by the following commit: commit 4d52cfbef6266092d535237ba5a4b981458ab171 Author: Eric Dumazet Date: Tue Jun 2 00:42:16 2009 -0700 net: ipv4/ip_sockglue.c cleanups Pure cleanups but it is not a pure cleanup... - if (val != -1 && (val < 1 || val>255)) + if (val != -1 && (val < 0 || val > 255)) Since there is no reason provided to allow ttl=0, change it back. Reported-by: nitin padalia Cc: nitin padalia Cc: Eric Dumazet Cc: David S. Miller Signed-off-by: Cong Wang Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Herton Ronaldo Krzesinski --- net/ipv4/ip_sockglue.c |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 8285f00..aabeb7b 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -589,7 +589,7 @@ static int do_ip_setsockopt(struct sock *sk, int level, case IP_TTL: if (optlen < 1) goto e_inval; - if (val != -1 && (val < 0 || val > 255)) + if (val != -1 && (val < 1 || val > 255)) goto e_inval; inet->uc_ttl = val; break; -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 42/81] be2net: Fix to trim skb for padded vlan packets to workaround an ASIC Bug
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Somnath Kotur
commit 93040ae5cc8dcc893eca4a4366dc8415af278edf upstream.
Fixed spelling error in a comment as pointed out by DaveM.
Also refactored existing code a bit to provide placeholders for another ASIC
Bug workaround that will be checked-in soon after this.
Signed-off-by: Somnath Kotur
Signed-off-by: David S. Miller
Cc: Jacek Luczak
[ herton: adjust context ]
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/net/ethernet/emulex/benet/be.h |5 +++
drivers/net/ethernet/emulex/benet/be_main.c | 56 ---
2 files changed, 47 insertions(+), 14 deletions(-)
diff --git a/drivers/net/ethernet/emulex/benet/be.h
b/drivers/net/ethernet/emulex/benet/be.h
index c5c4c0e..793ee6b 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -573,6 +573,11 @@ static inline u8 is_udp_pkt(struct sk_buff *skb)
return val;
}
+static inline bool is_ipv4_pkt(struct sk_buff *skb)
+{
+ return skb->protocol == ntohs(ETH_P_IP) && ip_hdr(skb)->version == 4;
+}
+
static inline void be_vf_eth_addr_generate(struct be_adapter *adapter, u8 *mac)
{
u32 addr;
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c
b/drivers/net/ethernet/emulex/benet/be_main.c
index bd5cf7e..dc36f5c 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -576,6 +576,11 @@ static inline u16 be_get_tx_vlan_tag(struct be_adapter
*adapter,
return vlan_tag;
}
+static int be_vlan_tag_chk(struct be_adapter *adapter, struct sk_buff *skb)
+{
+ return vlan_tx_tag_present(skb) || adapter->pvid;
+}
+
static void wrb_fill_hdr(struct be_adapter *adapter, struct be_eth_hdr_wrb
*hdr,
struct sk_buff *skb, u32 wrb_cnt, u32 len)
{
@@ -703,33 +708,56 @@ dma_err:
return 0;
}
+static struct sk_buff *be_insert_vlan_in_pkt(struct be_adapter *adapter,
+struct sk_buff *skb)
+{
+ u16 vlan_tag = 0;
+
+ skb = skb_share_check(skb, GFP_ATOMIC);
+ if (unlikely(!skb))
+ return skb;
+
+ if (vlan_tx_tag_present(skb)) {
+ vlan_tag = be_get_tx_vlan_tag(adapter, skb);
+ __vlan_put_tag(skb, vlan_tag);
+ skb->vlan_tci = 0;
+ }
+
+ return skb;
+}
+
static netdev_tx_t be_xmit(struct sk_buff *skb,
struct net_device *netdev)
{
struct be_adapter *adapter = netdev_priv(netdev);
struct be_tx_obj *txo = >tx_obj[skb_get_queue_mapping(skb)];
struct be_queue_info *txq = >q;
+ struct iphdr *ip = NULL;
u32 wrb_cnt = 0, copied = 0;
- u32 start = txq->head;
+ u32 start = txq->head, eth_hdr_len;
bool dummy_wrb, stopped = false;
- /* For vlan tagged pkts, BE
-* 1) calculates checksum even when CSO is not requested
-* 2) calculates checksum wrongly for padded pkt less than
-* 60 bytes long.
-* As a workaround disable TX vlan offloading in such cases.
+ eth_hdr_len = ntohs(skb->protocol) == ETH_P_8021Q ?
+ VLAN_ETH_HLEN : ETH_HLEN;
+
+ /* HW has a bug which considers padding bytes as legal
+* and modifies the IPv4 hdr's 'tot_len' field
*/
- if (unlikely(vlan_tx_tag_present(skb) &&
-(skb->ip_summed != CHECKSUM_PARTIAL || skb->len <= 60))) {
- skb = skb_share_check(skb, GFP_ATOMIC);
- if (unlikely(!skb))
- goto tx_drop;
+ if (skb->len <= 60 && be_vlan_tag_chk(adapter, skb) &&
+ is_ipv4_pkt(skb)) {
+ ip = (struct iphdr *)ip_hdr(skb);
+ pskb_trim(skb, eth_hdr_len + ntohs(ip->tot_len));
+ }
- skb = __vlan_put_tag(skb, be_get_tx_vlan_tag(adapter, skb));
+ /* HW has a bug wherein it will calculate CSUM for VLAN
+* pkts even though it is disabled.
+* Manually insert VLAN in pkt.
+*/
+ if (skb->ip_summed != CHECKSUM_PARTIAL &&
+ be_vlan_tag_chk(adapter, skb)) {
+ skb = be_insert_vlan_in_pkt(adapter, skb);
if (unlikely(!skb))
goto tx_drop;
-
- skb->vlan_tci = 0;
}
wrb_cnt = wrb_cnt_for_skb(adapter, skb, _wrb);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 39/81] virtio_console: Don't access uninitialized data.
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: =?UTF-8?q?Sjur=20Br=C3=A6ndeland?= commit aded024a12b32fc1ed9a80639681daae2d07ec25 upstream. Don't access uninitialized work-queue when removing device. The work queue is initialized only if the device multi-queue. So don't call cancel_work unless this is a multi-queue device. This fixes the following panic: Kernel panic - not syncing: BUG! Call Trace: 62031b28: [<6026085d>] panic+0x16b/0x2d3 62031b30: [<6004ef5e>] flush_work+0x0/0x1d7 62031b60: [<602606f2>] panic+0x0/0x2d3 62031b68: [<600333b0>] memcpy+0x0/0x140 62031b80: [<6002d58a>] unblock_signals+0x0/0x84 62031ba0: [<602609c5>] printk+0x0/0xa0 62031bd8: [<60264e51>] __mutex_unlock_slowpath+0x13d/0x148 62031c10: [<6004ef5e>] flush_work+0x0/0x1d7 62031c18: [<60050234>] try_to_grab_pending+0x0/0x17e 62031c38: [<6004e984>] get_work_gcwq+0x71/0x8f 62031c48: [<60050539>] __cancel_work_timer+0x5b/0x115 62031c78: [<628acc85>] unplug_port+0x0/0x191 [virtio_console] 62031c98: [<6005061c>] cancel_work_sync+0x12/0x14 62031ca8: [<628ace96>] virtcons_remove+0x80/0x15c [virtio_console] 62031ce8: [<628191de>] virtio_dev_remove+0x1e/0x7e [virtio] 62031d08: [<601cf242>] __device_release_driver+0x75/0xe4 62031d28: [<601cf2dd>] device_release_driver+0x2c/0x40 62031d48: [<601ce0dd>] driver_unbind+0x7d/0xc6 62031d88: [<601cd5d9>] drv_attr_store+0x27/0x29 62031d98: [<60115f61>] sysfs_write_file+0x100/0x14d 62031df8: [<600b737d>] vfs_write+0xcb/0x184 62031e08: [<600b58b8>] filp_close+0x88/0x94 62031e38: [<600b7686>] sys_write+0x59/0x88 62031e88: [<6001ced1>] handle_syscall+0x5d/0x80 62031ea8: [<60030a74>] userspace+0x405/0x531 62031f08: [<600d32cc>] sys_dup+0x0/0x5e 62031f28: [<601b11d6>] strcpy+0x0/0x18 62031f38: [<600be46c>] do_execve+0x10/0x12 62031f48: [<600184c7>] run_init_process+0x43/0x45 62031fd8: [<60019a91>] new_thread_handler+0xba/0xbc Signed-off-by: Sjur Brændeland Signed-off-by: Rusty Russell Signed-off-by: Herton Ronaldo Krzesinski --- drivers/char/virtio_console.c |3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index cdf2f54..f77e341 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -1808,7 +1808,8 @@ static void virtcons_remove(struct virtio_device *vdev) /* Disable interrupts for vqs */ vdev->config->reset(vdev); /* Finish up work that's lined up */ - cancel_work_sync(>control_work); + if (use_multiport(portdev)) + cancel_work_sync(>control_work); list_for_each_entry_safe(port, port2, >ports, list) unplug_port(port); -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 37/81] drivers/rtc/rtc-isl1208.c: call rtc_update_irq() from the alarm irq handler
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Jan Luebbe
commit 72fca4a4b32dc778b5b885c3498700e42b610d49 upstream.
Previously the alarm event was not propagated into the RTC subsystem.
By adding a call to rtc_update_irq, this fixes a timeout problem with
the hwclock utility.
Signed-off-by: Jan Luebbe
Cc: Alessandro Zummo
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/rtc/rtc-isl1208.c |3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/rtc/rtc-isl1208.c b/drivers/rtc/rtc-isl1208.c
index dd2aeee..8f8c8ae 100644
--- a/drivers/rtc/rtc-isl1208.c
+++ b/drivers/rtc/rtc-isl1208.c
@@ -494,6 +494,7 @@ isl1208_rtc_interrupt(int irq, void *data)
{
unsigned long timeout = jiffies + msecs_to_jiffies(1000);
struct i2c_client *client = data;
+ struct rtc_device *rtc = i2c_get_clientdata(client);
int handled = 0, sr, err;
/*
@@ -516,6 +517,8 @@ isl1208_rtc_interrupt(int irq, void *data)
if (sr & ISL1208_REG_SR_ALM) {
dev_dbg(>dev, "alarm!\n");
+ rtc_update_irq(rtc, 1, RTC_IRQF | RTC_AF);
+
/* Clear the alarm */
sr &= ~ISL1208_REG_SR_ALM;
sr = i2c_smbus_write_byte_data(client, ISL1208_REG_SR, sr);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 33/81] USB: storage: optimize to match the Huawei USB storage devices and support new switch command
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: fangxiaozhi
commit 200e0d994d9d1919b28c87f1a5fb99a8e13b8a0f upstream.
1. Optimize the match rules with new macro for Huawei USB storage devices,
to avoid to load USB storage driver for the modem interface
with Huawei devices.
2. Add to support new switch command for new Huawei USB dongles.
Signed-off-by: fangxiaozhi
Signed-off-by: Greg Kroah-Hartman
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/usb/storage/initializers.c | 76 -
drivers/usb/storage/initializers.h |4 +-
drivers/usb/storage/unusual_devs.h | 329 +---
3 files changed, 78 insertions(+), 331 deletions(-)
diff --git a/drivers/usb/storage/initializers.c
b/drivers/usb/storage/initializers.c
index 105d900..16b0bf0 100644
--- a/drivers/usb/storage/initializers.c
+++ b/drivers/usb/storage/initializers.c
@@ -92,8 +92,8 @@ int usb_stor_ucr61s2b_init(struct us_data *us)
return 0;
}
-/* This places the HUAWEI E220 devices in multi-port mode */
-int usb_stor_huawei_e220_init(struct us_data *us)
+/* This places the HUAWEI usb dongles in multi-port mode */
+static int usb_stor_huawei_feature_init(struct us_data *us)
{
int result;
@@ -104,3 +104,75 @@ int usb_stor_huawei_e220_init(struct us_data *us)
US_DEBUGP("Huawei mode set result is %d\n", result);
return 0;
}
+
+/*
+ * It will send a scsi switch command called rewind' to huawei dongle.
+ * When the dongle receives this command at the first time,
+ * it will reboot immediately. After rebooted, it will ignore this command.
+ * So it is unnecessary to read its response.
+ */
+static int usb_stor_huawei_scsi_init(struct us_data *us)
+{
+ int result = 0;
+ int act_len = 0;
+ struct bulk_cb_wrap *bcbw = (struct bulk_cb_wrap *) us->iobuf;
+ char rewind_cmd[] = {0x11, 0x06, 0x20, 0x00, 0x00, 0x01, 0x01, 0x00,
+ 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+ bcbw->Signature = cpu_to_le32(US_BULK_CB_SIGN);
+ bcbw->Tag = 0;
+ bcbw->DataTransferLength = 0;
+ bcbw->Flags = bcbw->Lun = 0;
+ bcbw->Length = sizeof(rewind_cmd);
+ memset(bcbw->CDB, 0, sizeof(bcbw->CDB));
+ memcpy(bcbw->CDB, rewind_cmd, sizeof(rewind_cmd));
+
+ result = usb_stor_bulk_transfer_buf(us, us->send_bulk_pipe, bcbw,
+ US_BULK_CB_WRAP_LEN, _len);
+ US_DEBUGP("transfer actual length=%d, result=%d\n", act_len, result);
+ return result;
+}
+
+/*
+ * It tries to find the supported Huawei USB dongles.
+ * In Huawei, they assign the following product IDs
+ * for all of their mobile broadband dongles,
+ * including the new dongles in the future.
+ * So if the product ID is not included in this list,
+ * it means it is not Huawei's mobile broadband dongles.
+ */
+static int usb_stor_huawei_dongles_pid(struct us_data *us)
+{
+ struct usb_interface_descriptor *idesc;
+ int idProduct;
+
+ idesc = >pusb_intf->cur_altsetting->desc;
+ idProduct = us->pusb_dev->descriptor.idProduct;
+ /* The first port is CDROM,
+* means the dongle in the single port mode,
+* and a switch command is required to be sent. */
+ if (idesc && idesc->bInterfaceNumber == 0) {
+ if ((idProduct == 0x1001)
+ || (idProduct == 0x1003)
+ || (idProduct == 0x1004)
+ || (idProduct >= 0x1401 && idProduct <= 0x1500)
+ || (idProduct >= 0x1505 && idProduct <= 0x1600)
+ || (idProduct >= 0x1c02 && idProduct <= 0x2202)) {
+ return 1;
+ }
+ }
+ return 0;
+}
+
+int usb_stor_huawei_init(struct us_data *us)
+{
+ int result = 0;
+
+ if (usb_stor_huawei_dongles_pid(us)) {
+ if (us->pusb_dev->descriptor.idProduct >= 0x1446)
+ result = usb_stor_huawei_scsi_init(us);
+ else
+ result = usb_stor_huawei_feature_init(us);
+ }
+ return result;
+}
diff --git a/drivers/usb/storage/initializers.h
b/drivers/usb/storage/initializers.h
index 529327f..5376d4f 100644
--- a/drivers/usb/storage/initializers.h
+++ b/drivers/usb/storage/initializers.h
@@ -46,5 +46,5 @@ int usb_stor_euscsi_init(struct us_data *us);
* flash reader */
int usb_stor_ucr61s2b_init(struct us_data *us);
-/* This places the HUAWEI E220 devices in multi-port mode */
-int usb_stor_huawei_e220_init(struct us_data *us);
+/* This places the HUAWEI usb dongles in multi-port mode */
+int usb_stor_huawei_init(struct us_data *us);
diff --git a/drivers/usb/storage/unusual_devs.h
b/drivers/usb/storage/unusual_devs.h
index dd2c64f..fff5d10 100644
--- a
[PATCH 35/81] nilfs2: fix fix very long mount time issue
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Vyacheslav Dubeyko
commit a9bae189542e71f91e61a4428adf6e5a7dfe8063 upstream.
There exists a situation when GC can work in background alone without
any other filesystem activity during significant time.
The nilfs_clean_segments() method calls nilfs_segctor_construct() that
updates superblocks in the case of NILFS_SC_SUPER_ROOT and
THE_NILFS_DISCONTINUED flags are set. But when GC is working alone the
nilfs_clean_segments() is called with unset THE_NILFS_DISCONTINUED flag.
As a result, the update of superblocks doesn't occurred all this time
and in the case of SPOR superblocks keep very old values of last super
root placement.
SYMPTOMS:
Trying to mount a NILFS2 volume after SPOR in such environment ends with
very long mounting time (it can achieve about several hours in some
cases).
REPRODUCING PATH:
1. It needs to use external USB HDD, disable automount and doesn't
make any additional filesystem activity on the NILFS2 volume.
2. Generate temporary file with size about 100 - 500 GB (for example,
dd if=/dev/zero of= bs=1073741824 count=200). The size of
file defines duration of GC working.
3. Then it needs to delete file.
4. Start GC manually by means of command "nilfs-clean -p 0". When you
start GC by means of such way then, at the end, superblocks is updated
by once. So, for simulation of SPOR, it needs to wait sometime (15 -
40 minutes) and simply switch off USB HDD manually.
5. Switch on USB HDD again and try to mount NILFS2 volume. As a
result, NILFS2 volume will mount during very long time.
REPRODUCIBILITY: 100%
FIX:
This patch adds checking that superblocks need to update and set
THE_NILFS_DISCONTINUED flag before nilfs_clean_segments() call.
Reported-by: Sergey Alexandrov
Signed-off-by: Vyacheslav Dubeyko
Tested-by: Vyacheslav Dubeyko
Acked-by: Ryusuke Konishi
Tested-by: Ryusuke Konishi
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
Signed-off-by: Herton Ronaldo Krzesinski
---
fs/nilfs2/ioctl.c |5 -
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 0b6387c..29990c9 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -666,8 +666,11 @@ static int nilfs_ioctl_clean_segments(struct inode *inode,
struct file *filp,
if (ret < 0)
printk(KERN_ERR "NILFS: GC failed during preparation: "
"cannot read source blocks: err=%d\n", ret);
- else
+ else {
+ if (nilfs_sb_need_update(nilfs))
+ set_nilfs_discontinued(nilfs);
ret = nilfs_clean_segments(inode->i_sb, argv, kbufs);
+ }
nilfs_remove_all_gcinodes(nilfs);
clear_nilfs_gc_running(nilfs);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 31/81] USB: ftdi_sio: add Zolix FTDI PID
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: =?UTF-8?q?Petr=20Kub=C3=A1nek?=
commit 0ba3b2ccc72b3df5c305d61f59d93ab0f0e87991 upstream.
Add support for Zolix Omni 1509 monochromator custom USB-RS232 converter.
Signed-off-by: Petr Kubánek
Signed-off-by: Greg Kroah-Hartman
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/usb/serial/ftdi_sio.c |1 +
drivers/usb/serial/ftdi_sio_ids.h |5 +
2 files changed, 6 insertions(+)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 031b23c..4c1fa24 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -677,6 +677,7 @@ static struct usb_device_id id_table_combined [] = {
{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) },
{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) },
{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
{ USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_ACTIVE_ROBOTS_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_MHAM_KW_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h
b/drivers/usb/serial/ftdi_sio_ids.h
index 7c89cfc..9d359e18 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -147,6 +147,11 @@
#define XSENS_CONVERTER_6_PID 0xD38E
#define XSENS_CONVERTER_7_PID 0xD38F
+/**
+ * Zolix (www.zolix.com.cb) product ids
+ */
+#define FTDI_OMNI1509 0xD491 /* Omni1509 embedded USB-serial
*/
+
/*
* NDI (www.ndigital.com) product ids
*/
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 25/81] drm/radeon: prevent crash in the ring space allocation
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Alex Deucher
commit fd5d93a0015ce1a7db881382022b2fcdfdc61760 upstream.
If the requested number of DWs on the ring is larger than
the size of the ring itself, return an error.
In testing with large VM updates, we've seen crashes when we
try and allocate more space on the ring than the total size
of the ring without checking.
This prevents the crash but for large VM updates or bo moves
of very large buffers, we will need to break the transaction
down into multiple batches. I have patches to use IBs for
the next kernel.
Signed-off-by: Alex Deucher
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/gpu/drm/radeon/radeon_ring.c |3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c
b/drivers/gpu/drm/radeon/radeon_ring.c
index 7843b36..727ebfe 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -219,6 +219,9 @@ int radeon_ring_alloc(struct radeon_device *rdev, struct
radeon_ring *ring, unsi
{
int r;
+ /* make sure we aren't trying to allocate more space than there is on
the ring */
+ if (ndw > (ring->ring_size / 4))
+ return -ENOMEM;
/* Align requested size with padding so unlock_commit can
* pad safely */
ndw = (ndw + ring->align_mask) & ~ring->align_mask;
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 20/81] USB: EHCI: fix bug in scheduling periodic split transfers
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Alan Stern
commit 3e619d04159be54b3daa0b7036b0ce9e067f4b5d upstream.
This patch (as1654) fixes a very old bug in ehci-hcd, connected with
scheduling of periodic split transfers. The calculations for
full/low-speed bus usage are all carried out after the correction for
bit-stuffing has been applied, but the values in the max_tt_usecs
array assume it hasn't been. The array should allow for allocation of
up to 90% of the bus capacity, which is 900 us, not 780 us.
The symptom caused by this bug is that any isochronous transfer to a
full-speed device with a maxpacket size larger than about 980 bytes is
always rejected with a -ENOSPC error.
Signed-off-by: Alan Stern
Signed-off-by: Greg Kroah-Hartman
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/usb/host/ehci-sched.c |2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 33182c6..ccc9f70 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -236,7 +236,7 @@ static inline unsigned char tt_start_uframe(struct ehci_hcd
*ehci, __hc32 mask)
}
static const unsigned char
-max_tt_usecs[] = { 125, 125, 125, 125, 125, 125, 30, 0 };
+max_tt_usecs[] = { 125, 125, 125, 125, 125, 125, 125, 25 };
/* carryover low/fullspeed bandwidth that crosses uframe boundries */
static inline void carryover_tt_bandwidth(unsigned short tt_usecs[8])
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 18/81] drm/radeon: protect against div by 0 in backend setup
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Mikko Tiihonen
commit f689e3acbd2e48cc4101e0af454193f81af4baaf upstream.
Make sure at least one RB is enabled in
r6xx_remap_render_backend() to avoid an division by
zero in some corner cases.
See:
https://bugzilla.redhat.com/show_bug.cgi?id=892233
Signed-off-by: Alex Deucher
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/gpu/drm/radeon/r600.c |7 +--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index bff6272..0c7476d 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1383,12 +1383,15 @@ u32 r6xx_remap_render_backend(struct radeon_device
*rdev,
u32 disabled_rb_mask)
{
u32 rendering_pipe_num, rb_num_width, req_rb_num;
- u32 pipe_rb_ratio, pipe_rb_remain;
+ u32 pipe_rb_ratio, pipe_rb_remain, tmp;
u32 data = 0, mask = 1 << (max_rb_num - 1);
unsigned i, j;
/* mask out the RBs that don't exist on that asic */
- disabled_rb_mask |= (0xff << max_rb_num) & 0xff;
+ tmp = disabled_rb_mask | ((0xff << max_rb_num) & 0xff);
+ /* make sure at least one RB is available */
+ if ((tmp & 0xff) != 0xff)
+ disabled_rb_mask = tmp;
rendering_pipe_num = 1 << tiling_pipe_num;
req_rb_num = total_max_rb_num - r600_count_pipe_bits(disabled_rb_mask);
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 14/81] drm/radeon: add quirk for RV100 board
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Alex Deucher
commit 9200ee4941a6e5d1ec5df88982243686882dff3f upstream.
vbios says external TMDS while the board is actually
internal TMDS.
fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=60037
Signed-off-by: Alex Deucher
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/gpu/drm/radeon/radeon_combios.c |8
1 file changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c
b/drivers/gpu/drm/radeon/radeon_combios.c
index 558e5c0..7139341 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -2455,6 +2455,14 @@ bool radeon_get_legacy_connector_info_from_bios(struct
drm_device *dev)
1),
ATOM_DEVICE_CRT1_SUPPORT);
}
+ /* RV100 board with external TDMS bit mis-set.
+* Actually uses internal TMDS, clear the bit.
+*/
+ if (dev->pdev->device == 0x5159 &&
+ dev->pdev->subsystem_vendor == 0x1014 &&
+ dev->pdev->subsystem_device == 0x029A) {
+ tmp &= ~(1 << 4);
+ }
if ((tmp >> 4) & 0x1) {
devices |= ATOM_DEVICE_DFP2_SUPPORT;
radeon_add_legacy_encoder(dev,
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 08/81] USB: EHCI: fix timer bug affecting port resume
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit ee74290b7853db9d5fd64db70e5c175241c59fba upstream. This patch (as1652) fixes a long-standing bug in ehci-hcd. The driver relies on status polls to know when to stop port-resume signalling. It uses the root-hub status timer to schedule these status polls. But when the driver for the root hub is resumed, the timer is rescheduled to go off immediately -- before the port is ready. When this happens the timer does not get re-enabled, which prevents the port resume from finishing until some other event occurs. The symptom is that when a new device is plugged in, it doesn't get recognized or enumerated until lsusb is run or something else happens. The solution is to re-enable the root-hub status timer after every status poll while a port resume is in progress. This bug hasn't surfaced before now because we never used to try to suspend the root hub in the middle of a port resume (except by coincidence). Signed-off-by: Alan Stern Reported-and-tested-by: Norbert Preining Tested-by: Ming Lei Signed-off-by: Greg Kroah-Hartman Signed-off-by: Herton Ronaldo Krzesinski --- drivers/usb/host/ehci-hub.c |6 +- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c index fc9e7cc..349d3fe 100644 --- a/drivers/usb/host/ehci-hub.c +++ b/drivers/usb/host/ehci-hub.c @@ -613,7 +613,11 @@ ehci_hub_status_data (struct usb_hcd *hcd, char *buf) status = STS_PCD; } } - /* FIXME autosuspend idle root hubs */ + + /* If a resume is in progress, make sure it can finish */ + if (ehci->resuming_ports) + mod_timer(>rh_timer, jiffies + msecs_to_jiffies(25)); + spin_unlock_irqrestore (>lock, flags); return status ? retval : 0; } -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 04/81] USB: XHCI: fix memory leak of URB-private data
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Alan Stern commit 48c3375c5f69b1c2ef3d1051a0009cb9bce0ce24 upstream. This patch (as1640) fixes a memory leak in xhci-hcd. The urb_priv data structure isn't always deallocated in the handle_tx_event() routine for non-control transfers. The patch adds a kfree() call so that all paths end up freeing the memory properly. This patch should be backported to kernels as old as 2.6.36, that contain the commit 8e51adccd4c4b9ffcd509d7f2afce0a906139f75 "USB: xHCI: Introduce urb_priv structure" Signed-off-by: Alan Stern Signed-off-by: Sarah Sharp Reported-and-tested-by: Martin Mokrejs Signed-off-by: Herton Ronaldo Krzesinski --- drivers/usb/host/xhci-ring.c |2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 5530c76..6f3043f 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2587,6 +2587,8 @@ cleanup: (trb_comp_code != COMP_STALL && trb_comp_code != COMP_BABBLE)) xhci_urb_free_priv(xhci, urb_priv); + else + kfree(urb_priv); usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb->dev->bus), urb); if ((urb->actual_length != urb->transfer_buffer_length && -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 06/81] usb: Using correct way to clear usb3.0 device's remote wakeup feature.
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Lan Tianyu
commit 54a3ac0c9e5b7213daa358ce74d154352657353a upstream.
Usb3.0 device defines function remote wakeup which is only for interface
recipient rather than device recipient. This is different with usb2.0 device's
remote wakeup feature which is defined for device recipient. According usb3.0
spec 9.4.5, the function remote wakeup can be modified by the SetFeature()
requests using the FUNCTION_SUSPEND feature selector. This patch is to use
correct way to disable usb3.0 device's function remote wakeup after suspend
error and resuming.
This should be backported to kernels as old as 3.4, that contain the
commit 623bef9e03a60adc623b09673297ca7a1cdfb367 "USB/xhci: Enable remote
wakeup for USB3 devices."
Signed-off-by: Lan Tianyu
Signed-off-by: Sarah Sharp
[ herton: include/uapi/linux/usb/ch9.h -> include/linux/usb/ch9.h,
adjust context ]
Signed-off-by: Herton Ronaldo Krzesinski
---
drivers/usb/core/hub.c | 70 +++
include/linux/usb/ch9.h |6
2 files changed, 58 insertions(+), 18 deletions(-)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 92c0229..c9590c6 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2685,6 +2685,23 @@ static int check_port_resume_type(struct usb_device
*udev,
}
#ifdef CONFIG_USB_SUSPEND
+/*
+ * usb_disable_function_remotewakeup - disable usb3.0
+ * device's function remote wakeup
+ * @udev: target device
+ *
+ * Assume there's only one function on the USB 3.0
+ * device and disable remote wake for the first
+ * interface. FIXME if the interface association
+ * descriptor shows there's more than one function.
+ */
+static int usb_disable_function_remotewakeup(struct usb_device *udev)
+{
+ return usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+ USB_REQ_CLEAR_FEATURE, USB_RECIP_INTERFACE,
+ USB_INTRF_FUNC_SUSPEND, 0, NULL, 0,
+ USB_CTRL_SET_TIMEOUT);
+}
/*
* usb_port_suspend - suspend a usb device's upstream port
@@ -2797,12 +2814,19 @@ int usb_port_suspend(struct usb_device *udev,
pm_message_t msg)
dev_dbg(hub->intfdev, "can't suspend port %d, status %d\n",
port1, status);
/* paranoia: "should not happen" */
- if (udev->do_remote_wakeup)
- (void) usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
- USB_REQ_CLEAR_FEATURE, USB_RECIP_DEVICE,
- USB_DEVICE_REMOTE_WAKEUP, 0,
- NULL, 0,
- USB_CTRL_SET_TIMEOUT);
+ if (udev->do_remote_wakeup) {
+ if (!hub_is_superspeed(hub->hdev)) {
+ (void) usb_control_msg(udev,
+ usb_sndctrlpipe(udev, 0),
+ USB_REQ_CLEAR_FEATURE,
+ USB_RECIP_DEVICE,
+ USB_DEVICE_REMOTE_WAKEUP, 0,
+ NULL, 0,
+ USB_CTRL_SET_TIMEOUT);
+ } else
+ (void) usb_disable_function_remotewakeup(udev);
+
+ }
/* Try to enable USB2 hardware LPM again */
if (udev->usb2_hw_lpm_capable == 1)
@@ -2892,20 +2916,30 @@ static int finish_port_resume(struct usb_device *udev)
* udev->reset_resume
*/
} else if (udev->actconfig && !udev->reset_resume) {
- le16_to_cpus();
- if (devstatus & (1 << USB_DEVICE_REMOTE_WAKEUP)) {
- status = usb_control_msg(udev,
- usb_sndctrlpipe(udev, 0),
- USB_REQ_CLEAR_FEATURE,
+ if (!hub_is_superspeed(udev->parent)) {
+ le16_to_cpus();
+ if (devstatus & (1 << USB_DEVICE_REMOTE_WAKEUP))
+ status = usb_control_msg(udev,
+ usb_sndctrlpipe(udev, 0),
+ USB_REQ_CLEAR_FEATURE,
USB_RECIP_DEVICE,
- USB_DEVICE_REMOTE_WAKEUP, 0,
- NULL, 0,
- USB_CTRL_SET_TIMEOUT);
- if (status)
- dev_dbg(>dev,
-
[PATCH 02/81] xhci: Fix TD size for isochronous URBs.
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Sarah Sharp commit f18f8ed2a9adc41c2d9294b85b6af115829d2af1 upstream. To calculate the TD size for a particular TRB in an isoc TD, we need know the endpoint's max packet size. Isochronous endpoints also encode the number of additional service opportunities in their wMaxPacketSize field. The TD size calculation did not mask off those bits before using the field. This resulted in incorrect TD size information for isochronous TRBs when an URB frame buffer crossed a 64KB boundary. For example: - an isoc endpoint has 2 additional service opportunites and a max packet size of 1020 bytes - a frame transfer buffer contains 3060 bytes - one frame buffer crosses a 64KB boundary, and must be split into one 1276 byte TRB, and one 1784 byte TRB. The TD size is is the number of packets that remain to be transferred for a TD after processing all the max packet sized packets in the current TRB and all previous TRBs. For this TD, the number of packets to be transferred is (3060 / 1020), or 3. The first TRB contains 1276 bytes, which means it contains one full packet, and a 256 byte remainder. After processing all the max packet-sized packets in the first TRB, the host will have 2 packets left to transfer. The old code would calculate the TD size for the first TRB as: total packet count = DIV_ROUND_UP (TD length / endpoint wMaxPacketSize) total packet count - (first TRB length / endpoint wMaxPacketSize) The math should have been: total packet count = DIV_ROUND_UP (3060 / 1020) = 3 3 - (1276 / 1020) = 2 Since the old code didn't mask off the additional service interval bits from the wMaxPacketSize field, the math ended up as total packet count = DIV_ROUND_UP (3060 / 5116) = 1 1 - (1276 / 5116) = 1 Fix this by masking off the number of additional service opportunities in the wMaxPacketSize field. This patch should be backported to stable kernels as old as 3.0, that contain the commit 4da6e6f247a2601ab9f1e63424e4d944ed4124f3 "xhci 1.0: Update TD size field format." It may not apply well to kernels older than 3.2 because of commit 29cc88979a8818cd8c5019426e945aed118b400e "USB: use usb_endpoint_maxp() instead of le16_to_cpu()". Signed-off-by: Sarah Sharp Signed-off-by: Herton Ronaldo Krzesinski --- drivers/usb/host/xhci-ring.c |5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 3bf13f8..3dc8e3f 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -3106,7 +3106,7 @@ static u32 xhci_v1_0_td_remainder(int running_total, int trb_buff_len, * running_total. */ packets_transferred = (running_total + trb_buff_len) / - usb_endpoint_maxp(>ep->desc); + GET_MAX_PACKET(usb_endpoint_maxp(>ep->desc)); if ((total_packet_count - packets_transferred) > 31) return 31 << 17; @@ -3640,7 +3640,8 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags, td_len = urb->iso_frame_desc[i].length; td_remain_len = td_len; total_packet_count = DIV_ROUND_UP(td_len, - usb_endpoint_maxp(>ep->desc)); + GET_MAX_PACKET( + usb_endpoint_maxp(>ep->desc))); /* A zero-length transfer still involves at least one packet. */ if (total_packet_count == 0) total_packet_count++; -- 1.7.9.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 02/81] xhci: Fix TD size for isochronous URBs.
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Sarah Sharp sarah.a.sh...@linux.intel.com commit f18f8ed2a9adc41c2d9294b85b6af115829d2af1 upstream. To calculate the TD size for a particular TRB in an isoc TD, we need know the endpoint's max packet size. Isochronous endpoints also encode the number of additional service opportunities in their wMaxPacketSize field. The TD size calculation did not mask off those bits before using the field. This resulted in incorrect TD size information for isochronous TRBs when an URB frame buffer crossed a 64KB boundary. For example: - an isoc endpoint has 2 additional service opportunites and a max packet size of 1020 bytes - a frame transfer buffer contains 3060 bytes - one frame buffer crosses a 64KB boundary, and must be split into one 1276 byte TRB, and one 1784 byte TRB. The TD size is is the number of packets that remain to be transferred for a TD after processing all the max packet sized packets in the current TRB and all previous TRBs. For this TD, the number of packets to be transferred is (3060 / 1020), or 3. The first TRB contains 1276 bytes, which means it contains one full packet, and a 256 byte remainder. After processing all the max packet-sized packets in the first TRB, the host will have 2 packets left to transfer. The old code would calculate the TD size for the first TRB as: total packet count = DIV_ROUND_UP (TD length / endpoint wMaxPacketSize) total packet count - (first TRB length / endpoint wMaxPacketSize) The math should have been: total packet count = DIV_ROUND_UP (3060 / 1020) = 3 3 - (1276 / 1020) = 2 Since the old code didn't mask off the additional service interval bits from the wMaxPacketSize field, the math ended up as total packet count = DIV_ROUND_UP (3060 / 5116) = 1 1 - (1276 / 5116) = 1 Fix this by masking off the number of additional service opportunities in the wMaxPacketSize field. This patch should be backported to stable kernels as old as 3.0, that contain the commit 4da6e6f247a2601ab9f1e63424e4d944ed4124f3 xhci 1.0: Update TD size field format. It may not apply well to kernels older than 3.2 because of commit 29cc88979a8818cd8c5019426e945aed118b400e USB: use usb_endpoint_maxp() instead of le16_to_cpu(). Signed-off-by: Sarah Sharp sarah.a.sh...@linux.intel.com Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com --- drivers/usb/host/xhci-ring.c |5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 3bf13f8..3dc8e3f 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -3106,7 +3106,7 @@ static u32 xhci_v1_0_td_remainder(int running_total, int trb_buff_len, * running_total. */ packets_transferred = (running_total + trb_buff_len) / - usb_endpoint_maxp(urb-ep-desc); + GET_MAX_PACKET(usb_endpoint_maxp(urb-ep-desc)); if ((total_packet_count - packets_transferred) 31) return 31 17; @@ -3640,7 +3640,8 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags, td_len = urb-iso_frame_desc[i].length; td_remain_len = td_len; total_packet_count = DIV_ROUND_UP(td_len, - usb_endpoint_maxp(urb-ep-desc)); + GET_MAX_PACKET( + usb_endpoint_maxp(urb-ep-desc))); /* A zero-length transfer still involves at least one packet. */ if (total_packet_count == 0) total_packet_count++; -- 1.7.9.5 -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 04/81] USB: XHCI: fix memory leak of URB-private data
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Alan Stern st...@rowland.harvard.edu commit 48c3375c5f69b1c2ef3d1051a0009cb9bce0ce24 upstream. This patch (as1640) fixes a memory leak in xhci-hcd. The urb_priv data structure isn't always deallocated in the handle_tx_event() routine for non-control transfers. The patch adds a kfree() call so that all paths end up freeing the memory properly. This patch should be backported to kernels as old as 2.6.36, that contain the commit 8e51adccd4c4b9ffcd509d7f2afce0a906139f75 USB: xHCI: Introduce urb_priv structure Signed-off-by: Alan Stern st...@rowland.harvard.edu Signed-off-by: Sarah Sharp sarah.a.sh...@linux.intel.com Reported-and-tested-by: Martin Mokrejs mmokr...@fold.natur.cuni.cz Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com --- drivers/usb/host/xhci-ring.c |2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 5530c76..6f3043f 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2587,6 +2587,8 @@ cleanup: (trb_comp_code != COMP_STALL trb_comp_code != COMP_BABBLE)) xhci_urb_free_priv(xhci, urb_priv); + else + kfree(urb_priv); usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb-dev-bus), urb); if ((urb-actual_length != urb-transfer_buffer_length -- 1.7.9.5 -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 06/81] usb: Using correct way to clear usb3.0 device's remote wakeup feature.
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Lan Tianyu tianyu@intel.com
commit 54a3ac0c9e5b7213daa358ce74d154352657353a upstream.
Usb3.0 device defines function remote wakeup which is only for interface
recipient rather than device recipient. This is different with usb2.0 device's
remote wakeup feature which is defined for device recipient. According usb3.0
spec 9.4.5, the function remote wakeup can be modified by the SetFeature()
requests using the FUNCTION_SUSPEND feature selector. This patch is to use
correct way to disable usb3.0 device's function remote wakeup after suspend
error and resuming.
This should be backported to kernels as old as 3.4, that contain the
commit 623bef9e03a60adc623b09673297ca7a1cdfb367 USB/xhci: Enable remote
wakeup for USB3 devices.
Signed-off-by: Lan Tianyu tianyu@intel.com
Signed-off-by: Sarah Sharp sarah.a.sh...@linux.intel.com
[ herton: include/uapi/linux/usb/ch9.h - include/linux/usb/ch9.h,
adjust context ]
Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com
---
drivers/usb/core/hub.c | 70 +++
include/linux/usb/ch9.h |6
2 files changed, 58 insertions(+), 18 deletions(-)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 92c0229..c9590c6 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2685,6 +2685,23 @@ static int check_port_resume_type(struct usb_device
*udev,
}
#ifdef CONFIG_USB_SUSPEND
+/*
+ * usb_disable_function_remotewakeup - disable usb3.0
+ * device's function remote wakeup
+ * @udev: target device
+ *
+ * Assume there's only one function on the USB 3.0
+ * device and disable remote wake for the first
+ * interface. FIXME if the interface association
+ * descriptor shows there's more than one function.
+ */
+static int usb_disable_function_remotewakeup(struct usb_device *udev)
+{
+ return usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+ USB_REQ_CLEAR_FEATURE, USB_RECIP_INTERFACE,
+ USB_INTRF_FUNC_SUSPEND, 0, NULL, 0,
+ USB_CTRL_SET_TIMEOUT);
+}
/*
* usb_port_suspend - suspend a usb device's upstream port
@@ -2797,12 +2814,19 @@ int usb_port_suspend(struct usb_device *udev,
pm_message_t msg)
dev_dbg(hub-intfdev, can't suspend port %d, status %d\n,
port1, status);
/* paranoia: should not happen */
- if (udev-do_remote_wakeup)
- (void) usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
- USB_REQ_CLEAR_FEATURE, USB_RECIP_DEVICE,
- USB_DEVICE_REMOTE_WAKEUP, 0,
- NULL, 0,
- USB_CTRL_SET_TIMEOUT);
+ if (udev-do_remote_wakeup) {
+ if (!hub_is_superspeed(hub-hdev)) {
+ (void) usb_control_msg(udev,
+ usb_sndctrlpipe(udev, 0),
+ USB_REQ_CLEAR_FEATURE,
+ USB_RECIP_DEVICE,
+ USB_DEVICE_REMOTE_WAKEUP, 0,
+ NULL, 0,
+ USB_CTRL_SET_TIMEOUT);
+ } else
+ (void) usb_disable_function_remotewakeup(udev);
+
+ }
/* Try to enable USB2 hardware LPM again */
if (udev-usb2_hw_lpm_capable == 1)
@@ -2892,20 +2916,30 @@ static int finish_port_resume(struct usb_device *udev)
* udev-reset_resume
*/
} else if (udev-actconfig !udev-reset_resume) {
- le16_to_cpus(devstatus);
- if (devstatus (1 USB_DEVICE_REMOTE_WAKEUP)) {
- status = usb_control_msg(udev,
- usb_sndctrlpipe(udev, 0),
- USB_REQ_CLEAR_FEATURE,
+ if (!hub_is_superspeed(udev-parent)) {
+ le16_to_cpus(devstatus);
+ if (devstatus (1 USB_DEVICE_REMOTE_WAKEUP))
+ status = usb_control_msg(udev,
+ usb_sndctrlpipe(udev, 0),
+ USB_REQ_CLEAR_FEATURE,
USB_RECIP_DEVICE,
- USB_DEVICE_REMOTE_WAKEUP, 0,
- NULL, 0,
- USB_CTRL_SET_TIMEOUT);
- if (status)
- dev_dbg(udev-dev,
- disable remote wakeup, status %d\n
[PATCH 08/81] USB: EHCI: fix timer bug affecting port resume
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Alan Stern st...@rowland.harvard.edu commit ee74290b7853db9d5fd64db70e5c175241c59fba upstream. This patch (as1652) fixes a long-standing bug in ehci-hcd. The driver relies on status polls to know when to stop port-resume signalling. It uses the root-hub status timer to schedule these status polls. But when the driver for the root hub is resumed, the timer is rescheduled to go off immediately -- before the port is ready. When this happens the timer does not get re-enabled, which prevents the port resume from finishing until some other event occurs. The symptom is that when a new device is plugged in, it doesn't get recognized or enumerated until lsusb is run or something else happens. The solution is to re-enable the root-hub status timer after every status poll while a port resume is in progress. This bug hasn't surfaced before now because we never used to try to suspend the root hub in the middle of a port resume (except by coincidence). Signed-off-by: Alan Stern st...@rowland.harvard.edu Reported-and-tested-by: Norbert Preining prein...@logic.at Tested-by: Ming Lei ming@canonical.com Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com --- drivers/usb/host/ehci-hub.c |6 +- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c index fc9e7cc..349d3fe 100644 --- a/drivers/usb/host/ehci-hub.c +++ b/drivers/usb/host/ehci-hub.c @@ -613,7 +613,11 @@ ehci_hub_status_data (struct usb_hcd *hcd, char *buf) status = STS_PCD; } } - /* FIXME autosuspend idle root hubs */ + + /* If a resume is in progress, make sure it can finish */ + if (ehci-resuming_ports) + mod_timer(hcd-rh_timer, jiffies + msecs_to_jiffies(25)); + spin_unlock_irqrestore (ehci-lock, flags); return status ? retval : 0; } -- 1.7.9.5 -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 14/81] drm/radeon: add quirk for RV100 board
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Alex Deucher alexander.deuc...@amd.com
commit 9200ee4941a6e5d1ec5df88982243686882dff3f upstream.
vbios says external TMDS while the board is actually
internal TMDS.
fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=60037
Signed-off-by: Alex Deucher alexander.deuc...@amd.com
Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com
---
drivers/gpu/drm/radeon/radeon_combios.c |8
1 file changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c
b/drivers/gpu/drm/radeon/radeon_combios.c
index 558e5c0..7139341 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -2455,6 +2455,14 @@ bool radeon_get_legacy_connector_info_from_bios(struct
drm_device *dev)
1),
ATOM_DEVICE_CRT1_SUPPORT);
}
+ /* RV100 board with external TDMS bit mis-set.
+* Actually uses internal TMDS, clear the bit.
+*/
+ if (dev-pdev-device == 0x5159
+ dev-pdev-subsystem_vendor == 0x1014
+ dev-pdev-subsystem_device == 0x029A) {
+ tmp = ~(1 4);
+ }
if ((tmp 4) 0x1) {
devices |= ATOM_DEVICE_DFP2_SUPPORT;
radeon_add_legacy_encoder(dev,
--
1.7.9.5
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 18/81] drm/radeon: protect against div by 0 in backend setup
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Mikko Tiihonen mikko.tiiho...@iki.fi
commit f689e3acbd2e48cc4101e0af454193f81af4baaf upstream.
Make sure at least one RB is enabled in
r6xx_remap_render_backend() to avoid an division by
zero in some corner cases.
See:
https://bugzilla.redhat.com/show_bug.cgi?id=892233
Signed-off-by: Alex Deucher alexander.deuc...@amd.com
Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com
---
drivers/gpu/drm/radeon/r600.c |7 +--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index bff6272..0c7476d 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1383,12 +1383,15 @@ u32 r6xx_remap_render_backend(struct radeon_device
*rdev,
u32 disabled_rb_mask)
{
u32 rendering_pipe_num, rb_num_width, req_rb_num;
- u32 pipe_rb_ratio, pipe_rb_remain;
+ u32 pipe_rb_ratio, pipe_rb_remain, tmp;
u32 data = 0, mask = 1 (max_rb_num - 1);
unsigned i, j;
/* mask out the RBs that don't exist on that asic */
- disabled_rb_mask |= (0xff max_rb_num) 0xff;
+ tmp = disabled_rb_mask | ((0xff max_rb_num) 0xff);
+ /* make sure at least one RB is available */
+ if ((tmp 0xff) != 0xff)
+ disabled_rb_mask = tmp;
rendering_pipe_num = 1 tiling_pipe_num;
req_rb_num = total_max_rb_num - r600_count_pipe_bits(disabled_rb_mask);
--
1.7.9.5
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 20/81] USB: EHCI: fix bug in scheduling periodic split transfers
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Alan Stern st...@rowland.harvard.edu
commit 3e619d04159be54b3daa0b7036b0ce9e067f4b5d upstream.
This patch (as1654) fixes a very old bug in ehci-hcd, connected with
scheduling of periodic split transfers. The calculations for
full/low-speed bus usage are all carried out after the correction for
bit-stuffing has been applied, but the values in the max_tt_usecs
array assume it hasn't been. The array should allow for allocation of
up to 90% of the bus capacity, which is 900 us, not 780 us.
The symptom caused by this bug is that any isochronous transfer to a
full-speed device with a maxpacket size larger than about 980 bytes is
always rejected with a -ENOSPC error.
Signed-off-by: Alan Stern st...@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com
---
drivers/usb/host/ehci-sched.c |2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 33182c6..ccc9f70 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -236,7 +236,7 @@ static inline unsigned char tt_start_uframe(struct ehci_hcd
*ehci, __hc32 mask)
}
static const unsigned char
-max_tt_usecs[] = { 125, 125, 125, 125, 125, 125, 30, 0 };
+max_tt_usecs[] = { 125, 125, 125, 125, 125, 125, 125, 25 };
/* carryover low/fullspeed bandwidth that crosses uframe boundries */
static inline void carryover_tt_bandwidth(unsigned short tt_usecs[8])
--
1.7.9.5
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 25/81] drm/radeon: prevent crash in the ring space allocation
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Alex Deucher alexander.deuc...@amd.com
commit fd5d93a0015ce1a7db881382022b2fcdfdc61760 upstream.
If the requested number of DWs on the ring is larger than
the size of the ring itself, return an error.
In testing with large VM updates, we've seen crashes when we
try and allocate more space on the ring than the total size
of the ring without checking.
This prevents the crash but for large VM updates or bo moves
of very large buffers, we will need to break the transaction
down into multiple batches. I have patches to use IBs for
the next kernel.
Signed-off-by: Alex Deucher alexander.deuc...@amd.com
Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com
---
drivers/gpu/drm/radeon/radeon_ring.c |3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c
b/drivers/gpu/drm/radeon/radeon_ring.c
index 7843b36..727ebfe 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -219,6 +219,9 @@ int radeon_ring_alloc(struct radeon_device *rdev, struct
radeon_ring *ring, unsi
{
int r;
+ /* make sure we aren't trying to allocate more space than there is on
the ring */
+ if (ndw (ring-ring_size / 4))
+ return -ENOMEM;
/* Align requested size with padding so unlock_commit can
* pad safely */
ndw = (ndw + ring-align_mask) ~ring-align_mask;
--
1.7.9.5
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 31/81] USB: ftdi_sio: add Zolix FTDI PID
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: =?UTF-8?q?Petr=20Kub=C3=A1nek?= p...@kubanek.net
commit 0ba3b2ccc72b3df5c305d61f59d93ab0f0e87991 upstream.
Add support for Zolix Omni 1509 monochromator custom USB-RS232 converter.
Signed-off-by: Petr Kubánek p...@kubanek.net
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com
---
drivers/usb/serial/ftdi_sio.c |1 +
drivers/usb/serial/ftdi_sio_ids.h |5 +
2 files changed, 6 insertions(+)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 031b23c..4c1fa24 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -677,6 +677,7 @@ static struct usb_device_id id_table_combined [] = {
{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) },
{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) },
{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
{ USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_ACTIVE_ROBOTS_PID) },
{ USB_DEVICE(FTDI_VID, FTDI_MHAM_KW_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h
b/drivers/usb/serial/ftdi_sio_ids.h
index 7c89cfc..9d359e18 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -147,6 +147,11 @@
#define XSENS_CONVERTER_6_PID 0xD38E
#define XSENS_CONVERTER_7_PID 0xD38F
+/**
+ * Zolix (www.zolix.com.cb) product ids
+ */
+#define FTDI_OMNI1509 0xD491 /* Omni1509 embedded USB-serial
*/
+
/*
* NDI (www.ndigital.com) product ids
*/
--
1.7.9.5
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 33/81] USB: storage: optimize to match the Huawei USB storage devices and support new switch command
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: fangxiaozhi huana...@huawei.com
commit 200e0d994d9d1919b28c87f1a5fb99a8e13b8a0f upstream.
1. Optimize the match rules with new macro for Huawei USB storage devices,
to avoid to load USB storage driver for the modem interface
with Huawei devices.
2. Add to support new switch command for new Huawei USB dongles.
Signed-off-by: fangxiaozhi huana...@huawei.com
Signed-off-by: Greg Kroah-Hartman gre...@linuxfoundation.org
Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com
---
drivers/usb/storage/initializers.c | 76 -
drivers/usb/storage/initializers.h |4 +-
drivers/usb/storage/unusual_devs.h | 329 +---
3 files changed, 78 insertions(+), 331 deletions(-)
diff --git a/drivers/usb/storage/initializers.c
b/drivers/usb/storage/initializers.c
index 105d900..16b0bf0 100644
--- a/drivers/usb/storage/initializers.c
+++ b/drivers/usb/storage/initializers.c
@@ -92,8 +92,8 @@ int usb_stor_ucr61s2b_init(struct us_data *us)
return 0;
}
-/* This places the HUAWEI E220 devices in multi-port mode */
-int usb_stor_huawei_e220_init(struct us_data *us)
+/* This places the HUAWEI usb dongles in multi-port mode */
+static int usb_stor_huawei_feature_init(struct us_data *us)
{
int result;
@@ -104,3 +104,75 @@ int usb_stor_huawei_e220_init(struct us_data *us)
US_DEBUGP(Huawei mode set result is %d\n, result);
return 0;
}
+
+/*
+ * It will send a scsi switch command called rewind' to huawei dongle.
+ * When the dongle receives this command at the first time,
+ * it will reboot immediately. After rebooted, it will ignore this command.
+ * So it is unnecessary to read its response.
+ */
+static int usb_stor_huawei_scsi_init(struct us_data *us)
+{
+ int result = 0;
+ int act_len = 0;
+ struct bulk_cb_wrap *bcbw = (struct bulk_cb_wrap *) us-iobuf;
+ char rewind_cmd[] = {0x11, 0x06, 0x20, 0x00, 0x00, 0x01, 0x01, 0x00,
+ 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+ bcbw-Signature = cpu_to_le32(US_BULK_CB_SIGN);
+ bcbw-Tag = 0;
+ bcbw-DataTransferLength = 0;
+ bcbw-Flags = bcbw-Lun = 0;
+ bcbw-Length = sizeof(rewind_cmd);
+ memset(bcbw-CDB, 0, sizeof(bcbw-CDB));
+ memcpy(bcbw-CDB, rewind_cmd, sizeof(rewind_cmd));
+
+ result = usb_stor_bulk_transfer_buf(us, us-send_bulk_pipe, bcbw,
+ US_BULK_CB_WRAP_LEN, act_len);
+ US_DEBUGP(transfer actual length=%d, result=%d\n, act_len, result);
+ return result;
+}
+
+/*
+ * It tries to find the supported Huawei USB dongles.
+ * In Huawei, they assign the following product IDs
+ * for all of their mobile broadband dongles,
+ * including the new dongles in the future.
+ * So if the product ID is not included in this list,
+ * it means it is not Huawei's mobile broadband dongles.
+ */
+static int usb_stor_huawei_dongles_pid(struct us_data *us)
+{
+ struct usb_interface_descriptor *idesc;
+ int idProduct;
+
+ idesc = us-pusb_intf-cur_altsetting-desc;
+ idProduct = us-pusb_dev-descriptor.idProduct;
+ /* The first port is CDROM,
+* means the dongle in the single port mode,
+* and a switch command is required to be sent. */
+ if (idesc idesc-bInterfaceNumber == 0) {
+ if ((idProduct == 0x1001)
+ || (idProduct == 0x1003)
+ || (idProduct == 0x1004)
+ || (idProduct = 0x1401 idProduct = 0x1500)
+ || (idProduct = 0x1505 idProduct = 0x1600)
+ || (idProduct = 0x1c02 idProduct = 0x2202)) {
+ return 1;
+ }
+ }
+ return 0;
+}
+
+int usb_stor_huawei_init(struct us_data *us)
+{
+ int result = 0;
+
+ if (usb_stor_huawei_dongles_pid(us)) {
+ if (us-pusb_dev-descriptor.idProduct = 0x1446)
+ result = usb_stor_huawei_scsi_init(us);
+ else
+ result = usb_stor_huawei_feature_init(us);
+ }
+ return result;
+}
diff --git a/drivers/usb/storage/initializers.h
b/drivers/usb/storage/initializers.h
index 529327f..5376d4f 100644
--- a/drivers/usb/storage/initializers.h
+++ b/drivers/usb/storage/initializers.h
@@ -46,5 +46,5 @@ int usb_stor_euscsi_init(struct us_data *us);
* flash reader */
int usb_stor_ucr61s2b_init(struct us_data *us);
-/* This places the HUAWEI E220 devices in multi-port mode */
-int usb_stor_huawei_e220_init(struct us_data *us);
+/* This places the HUAWEI usb dongles in multi-port mode */
+int usb_stor_huawei_init(struct us_data *us);
diff --git a/drivers/usb/storage/unusual_devs.h
b/drivers/usb/storage/unusual_devs.h
index dd2c64f..fff5d10 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage
[PATCH 35/81] nilfs2: fix fix very long mount time issue
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Vyacheslav Dubeyko sl...@dubeyko.com
commit a9bae189542e71f91e61a4428adf6e5a7dfe8063 upstream.
There exists a situation when GC can work in background alone without
any other filesystem activity during significant time.
The nilfs_clean_segments() method calls nilfs_segctor_construct() that
updates superblocks in the case of NILFS_SC_SUPER_ROOT and
THE_NILFS_DISCONTINUED flags are set. But when GC is working alone the
nilfs_clean_segments() is called with unset THE_NILFS_DISCONTINUED flag.
As a result, the update of superblocks doesn't occurred all this time
and in the case of SPOR superblocks keep very old values of last super
root placement.
SYMPTOMS:
Trying to mount a NILFS2 volume after SPOR in such environment ends with
very long mounting time (it can achieve about several hours in some
cases).
REPRODUCING PATH:
1. It needs to use external USB HDD, disable automount and doesn't
make any additional filesystem activity on the NILFS2 volume.
2. Generate temporary file with size about 100 - 500 GB (for example,
dd if=/dev/zero of=file_name bs=1073741824 count=200). The size of
file defines duration of GC working.
3. Then it needs to delete file.
4. Start GC manually by means of command nilfs-clean -p 0. When you
start GC by means of such way then, at the end, superblocks is updated
by once. So, for simulation of SPOR, it needs to wait sometime (15 -
40 minutes) and simply switch off USB HDD manually.
5. Switch on USB HDD again and try to mount NILFS2 volume. As a
result, NILFS2 volume will mount during very long time.
REPRODUCIBILITY: 100%
FIX:
This patch adds checking that superblocks need to update and set
THE_NILFS_DISCONTINUED flag before nilfs_clean_segments() call.
Reported-by: Sergey Alexandrov spla...@gmail.com
Signed-off-by: Vyacheslav Dubeyko sl...@dubeyko.com
Tested-by: Vyacheslav Dubeyko sl...@dubeyko.com
Acked-by: Ryusuke Konishi konishi.ryus...@lab.ntt.co.jp
Tested-by: Ryusuke Konishi konishi.ryus...@lab.ntt.co.jp
Signed-off-by: Andrew Morton a...@linux-foundation.org
Signed-off-by: Linus Torvalds torva...@linux-foundation.org
Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com
---
fs/nilfs2/ioctl.c |5 -
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 0b6387c..29990c9 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -666,8 +666,11 @@ static int nilfs_ioctl_clean_segments(struct inode *inode,
struct file *filp,
if (ret 0)
printk(KERN_ERR NILFS: GC failed during preparation:
cannot read source blocks: err=%d\n, ret);
- else
+ else {
+ if (nilfs_sb_need_update(nilfs))
+ set_nilfs_discontinued(nilfs);
ret = nilfs_clean_segments(inode-i_sb, argv, kbufs);
+ }
nilfs_remove_all_gcinodes(nilfs);
clear_nilfs_gc_running(nilfs);
--
1.7.9.5
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 37/81] drivers/rtc/rtc-isl1208.c: call rtc_update_irq() from the alarm irq handler
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Jan Luebbe j...@pengutronix.de
commit 72fca4a4b32dc778b5b885c3498700e42b610d49 upstream.
Previously the alarm event was not propagated into the RTC subsystem.
By adding a call to rtc_update_irq, this fixes a timeout problem with
the hwclock utility.
Signed-off-by: Jan Luebbe j...@pengutronix.de
Cc: Alessandro Zummo a.zu...@towertech.it
Signed-off-by: Andrew Morton a...@linux-foundation.org
Signed-off-by: Linus Torvalds torva...@linux-foundation.org
Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com
---
drivers/rtc/rtc-isl1208.c |3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/rtc/rtc-isl1208.c b/drivers/rtc/rtc-isl1208.c
index dd2aeee..8f8c8ae 100644
--- a/drivers/rtc/rtc-isl1208.c
+++ b/drivers/rtc/rtc-isl1208.c
@@ -494,6 +494,7 @@ isl1208_rtc_interrupt(int irq, void *data)
{
unsigned long timeout = jiffies + msecs_to_jiffies(1000);
struct i2c_client *client = data;
+ struct rtc_device *rtc = i2c_get_clientdata(client);
int handled = 0, sr, err;
/*
@@ -516,6 +517,8 @@ isl1208_rtc_interrupt(int irq, void *data)
if (sr ISL1208_REG_SR_ALM) {
dev_dbg(client-dev, alarm!\n);
+ rtc_update_irq(rtc, 1, RTC_IRQF | RTC_AF);
+
/* Clear the alarm */
sr = ~ISL1208_REG_SR_ALM;
sr = i2c_smbus_write_byte_data(client, ISL1208_REG_SR, sr);
--
1.7.9.5
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 39/81] virtio_console: Don't access uninitialized data.
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: =?UTF-8?q?Sjur=20Br=C3=A6ndeland?= sjur.brandel...@stericsson.com commit aded024a12b32fc1ed9a80639681daae2d07ec25 upstream. Don't access uninitialized work-queue when removing device. The work queue is initialized only if the device multi-queue. So don't call cancel_work unless this is a multi-queue device. This fixes the following panic: Kernel panic - not syncing: BUG! Call Trace: 62031b28: [6026085d] panic+0x16b/0x2d3 62031b30: [6004ef5e] flush_work+0x0/0x1d7 62031b60: [602606f2] panic+0x0/0x2d3 62031b68: [600333b0] memcpy+0x0/0x140 62031b80: [6002d58a] unblock_signals+0x0/0x84 62031ba0: [602609c5] printk+0x0/0xa0 62031bd8: [60264e51] __mutex_unlock_slowpath+0x13d/0x148 62031c10: [6004ef5e] flush_work+0x0/0x1d7 62031c18: [60050234] try_to_grab_pending+0x0/0x17e 62031c38: [6004e984] get_work_gcwq+0x71/0x8f 62031c48: [60050539] __cancel_work_timer+0x5b/0x115 62031c78: [628acc85] unplug_port+0x0/0x191 [virtio_console] 62031c98: [6005061c] cancel_work_sync+0x12/0x14 62031ca8: [628ace96] virtcons_remove+0x80/0x15c [virtio_console] 62031ce8: [628191de] virtio_dev_remove+0x1e/0x7e [virtio] 62031d08: [601cf242] __device_release_driver+0x75/0xe4 62031d28: [601cf2dd] device_release_driver+0x2c/0x40 62031d48: [601ce0dd] driver_unbind+0x7d/0xc6 62031d88: [601cd5d9] drv_attr_store+0x27/0x29 62031d98: [60115f61] sysfs_write_file+0x100/0x14d 62031df8: [600b737d] vfs_write+0xcb/0x184 62031e08: [600b58b8] filp_close+0x88/0x94 62031e38: [600b7686] sys_write+0x59/0x88 62031e88: [6001ced1] handle_syscall+0x5d/0x80 62031ea8: [60030a74] userspace+0x405/0x531 62031f08: [600d32cc] sys_dup+0x0/0x5e 62031f28: [601b11d6] strcpy+0x0/0x18 62031f38: [600be46c] do_execve+0x10/0x12 62031f48: [600184c7] run_init_process+0x43/0x45 62031fd8: [60019a91] new_thread_handler+0xba/0xbc Signed-off-by: Sjur Brændeland sjur.brandel...@stericsson.com Signed-off-by: Rusty Russell ru...@rustcorp.com.au Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com --- drivers/char/virtio_console.c |3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index cdf2f54..f77e341 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -1808,7 +1808,8 @@ static void virtcons_remove(struct virtio_device *vdev) /* Disable interrupts for vqs */ vdev-config-reset(vdev); /* Finish up work that's lined up */ - cancel_work_sync(portdev-control_work); + if (use_multiport(portdev)) + cancel_work_sync(portdev-control_work); list_for_each_entry_safe(port, port2, portdev-ports, list) unplug_port(port); -- 1.7.9.5 -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 42/81] be2net: Fix to trim skb for padded vlan packets to workaround an ASIC Bug
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Somnath Kotur somnath.ko...@emulex.com
commit 93040ae5cc8dcc893eca4a4366dc8415af278edf upstream.
Fixed spelling error in a comment as pointed out by DaveM.
Also refactored existing code a bit to provide placeholders for another ASIC
Bug workaround that will be checked-in soon after this.
Signed-off-by: Somnath Kotur somnath.ko...@emulex.com
Signed-off-by: David S. Miller da...@davemloft.net
Cc: Jacek Luczak difrost.ker...@gmail.com
[ herton: adjust context ]
Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com
---
drivers/net/ethernet/emulex/benet/be.h |5 +++
drivers/net/ethernet/emulex/benet/be_main.c | 56 ---
2 files changed, 47 insertions(+), 14 deletions(-)
diff --git a/drivers/net/ethernet/emulex/benet/be.h
b/drivers/net/ethernet/emulex/benet/be.h
index c5c4c0e..793ee6b 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -573,6 +573,11 @@ static inline u8 is_udp_pkt(struct sk_buff *skb)
return val;
}
+static inline bool is_ipv4_pkt(struct sk_buff *skb)
+{
+ return skb-protocol == ntohs(ETH_P_IP) ip_hdr(skb)-version == 4;
+}
+
static inline void be_vf_eth_addr_generate(struct be_adapter *adapter, u8 *mac)
{
u32 addr;
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c
b/drivers/net/ethernet/emulex/benet/be_main.c
index bd5cf7e..dc36f5c 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -576,6 +576,11 @@ static inline u16 be_get_tx_vlan_tag(struct be_adapter
*adapter,
return vlan_tag;
}
+static int be_vlan_tag_chk(struct be_adapter *adapter, struct sk_buff *skb)
+{
+ return vlan_tx_tag_present(skb) || adapter-pvid;
+}
+
static void wrb_fill_hdr(struct be_adapter *adapter, struct be_eth_hdr_wrb
*hdr,
struct sk_buff *skb, u32 wrb_cnt, u32 len)
{
@@ -703,33 +708,56 @@ dma_err:
return 0;
}
+static struct sk_buff *be_insert_vlan_in_pkt(struct be_adapter *adapter,
+struct sk_buff *skb)
+{
+ u16 vlan_tag = 0;
+
+ skb = skb_share_check(skb, GFP_ATOMIC);
+ if (unlikely(!skb))
+ return skb;
+
+ if (vlan_tx_tag_present(skb)) {
+ vlan_tag = be_get_tx_vlan_tag(adapter, skb);
+ __vlan_put_tag(skb, vlan_tag);
+ skb-vlan_tci = 0;
+ }
+
+ return skb;
+}
+
static netdev_tx_t be_xmit(struct sk_buff *skb,
struct net_device *netdev)
{
struct be_adapter *adapter = netdev_priv(netdev);
struct be_tx_obj *txo = adapter-tx_obj[skb_get_queue_mapping(skb)];
struct be_queue_info *txq = txo-q;
+ struct iphdr *ip = NULL;
u32 wrb_cnt = 0, copied = 0;
- u32 start = txq-head;
+ u32 start = txq-head, eth_hdr_len;
bool dummy_wrb, stopped = false;
- /* For vlan tagged pkts, BE
-* 1) calculates checksum even when CSO is not requested
-* 2) calculates checksum wrongly for padded pkt less than
-* 60 bytes long.
-* As a workaround disable TX vlan offloading in such cases.
+ eth_hdr_len = ntohs(skb-protocol) == ETH_P_8021Q ?
+ VLAN_ETH_HLEN : ETH_HLEN;
+
+ /* HW has a bug which considers padding bytes as legal
+* and modifies the IPv4 hdr's 'tot_len' field
*/
- if (unlikely(vlan_tx_tag_present(skb)
-(skb-ip_summed != CHECKSUM_PARTIAL || skb-len = 60))) {
- skb = skb_share_check(skb, GFP_ATOMIC);
- if (unlikely(!skb))
- goto tx_drop;
+ if (skb-len = 60 be_vlan_tag_chk(adapter, skb)
+ is_ipv4_pkt(skb)) {
+ ip = (struct iphdr *)ip_hdr(skb);
+ pskb_trim(skb, eth_hdr_len + ntohs(ip-tot_len));
+ }
- skb = __vlan_put_tag(skb, be_get_tx_vlan_tag(adapter, skb));
+ /* HW has a bug wherein it will calculate CSUM for VLAN
+* pkts even though it is disabled.
+* Manually insert VLAN in pkt.
+*/
+ if (skb-ip_summed != CHECKSUM_PARTIAL
+ be_vlan_tag_chk(adapter, skb)) {
+ skb = be_insert_vlan_in_pkt(adapter, skb);
if (unlikely(!skb))
goto tx_drop;
-
- skb-vlan_tci = 0;
}
wrb_cnt = wrb_cnt_for_skb(adapter, skb, dummy_wrb);
--
1.7.9.5
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 43/81] net: prevent setting ttl=0 via IP_TTL
3.5.7.6 -stable review patch. If anyone has any objections, please let me know. -- From: Cong Wang xiyou.wangc...@gmail.com commit c9be4a5c49cf51cc70a993f004c5bb30067a65ce upstream. A regression is introduced by the following commit: commit 4d52cfbef6266092d535237ba5a4b981458ab171 Author: Eric Dumazet eric.duma...@gmail.com Date: Tue Jun 2 00:42:16 2009 -0700 net: ipv4/ip_sockglue.c cleanups Pure cleanups but it is not a pure cleanup... - if (val != -1 (val 1 || val255)) + if (val != -1 (val 0 || val 255)) Since there is no reason provided to allow ttl=0, change it back. Reported-by: nitin padalia padalia.ni...@gmail.com Cc: nitin padalia padalia.ni...@gmail.com Cc: Eric Dumazet eric.duma...@gmail.com Cc: David S. Miller da...@davemloft.net Signed-off-by: Cong Wang xiyou.wangc...@gmail.com Acked-by: Eric Dumazet eduma...@google.com Signed-off-by: David S. Miller da...@davemloft.net Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com --- net/ipv4/ip_sockglue.c |2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 8285f00..aabeb7b 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -589,7 +589,7 @@ static int do_ip_setsockopt(struct sock *sk, int level, case IP_TTL: if (optlen 1) goto e_inval; - if (val != -1 (val 0 || val 255)) + if (val != -1 (val 1 || val 255)) goto e_inval; inet-uc_ttl = val; break; -- 1.7.9.5 -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH 46/81] ipv6: fix header length calculation in ip6_append_data()
3.5.7.6 -stable review patch. If anyone has any objections, please let me know.
--
From: Romain KUNTZ r.ku...@ipflavors.com
commit 7efdba5bd9a2f3e2059beeb45c9fa55eefe1bced upstream.
Commit 299b0767 (ipv6: Fix IPsec slowpath fragmentation problem)
has introduced a error in the header length calculation that
provokes corrupted packets when non-fragmentable extensions
headers (Destination Option or Routing Header Type 2) are used.
rt-rt6i_nfheader_len is the length of the non-fragmentable
extension header, and it should be substracted to
rt-dst.header_len, and not to exthdrlen, as it was done before
commit 299b0767.
This patch reverts to the original and correct behavior. It has
been successfully tested with and without IPsec on packets
that include non-fragmentable extensions headers.
Signed-off-by: Romain Kuntz r.ku...@ipflavors.com
Acked-by: Steffen Klassert steffen.klass...@secunet.com
Signed-off-by: David S. Miller da...@davemloft.net
[ herton: adjust context ]
Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com
---
net/ipv6/ip6_output.c |4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index decc21d1..4703c70 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1293,10 +1293,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void
*from, char *to,
cork-length = 0;
sk-sk_sndmsg_page = NULL;
sk-sk_sndmsg_off = 0;
- exthdrlen = (opt ? opt-opt_flen : 0) - rt-rt6i_nfheader_len;
+ exthdrlen = (opt ? opt-opt_flen : 0);
length += exthdrlen;
transhdrlen += exthdrlen;
- dst_exthdrlen = rt-dst.header_len;
+ dst_exthdrlen = rt-dst.header_len - rt-rt6i_nfheader_len;
} else {
rt = (struct rt6_info *)cork-dst;
fl6 = inet-cork.fl.u.ip6;
--
1.7.9.5
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
