diff options
| author | Paul Gortmaker <paul.gortmaker@windriver.com> | 2012-03-14 17:54:12 -0400 |
|---|---|---|
| committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2012-03-14 17:56:46 -0400 |
| commit | b6e90f164da5117d950e2b41ec38cf680c5952b2 (patch) | |
| tree | fcf0bf12a17190c904abd1b47352b0fdafdca209 | |
| parent | da420ff3abf386de3ecfc3285e554599410a300f (diff) | |
| download | longterm-queue-2.6.34-b6e90f164da5117d950e2b41ec38cf680c5952b2.tar.gz | |
import raw commits assoc. with the 32.42 stream
Parallels those added to 2.6.32.42 -- import by applying,
no compile or runtime testing yet.
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
78 files changed, 4852 insertions, 0 deletions
diff --git a/next_round/ALSA-HDA-Use-one-dmic-only-for-Dell-Studio-1558.patch b/next_round/ALSA-HDA-Use-one-dmic-only-for-Dell-Studio-1558.patch new file mode 100644 index 0000000..e04d9c3 --- /dev/null +++ b/next_round/ALSA-HDA-Use-one-dmic-only-for-Dell-Studio-1558.patch @@ -0,0 +1,36 @@ +From c9fb4431178d0e58b16cbb8ef978e602df0b497c Mon Sep 17 00:00:00 2001 +From: David Henningsson <david.henningsson@canonical.com> +Date: Mon, 16 May 2011 12:09:29 +0200 +Subject: [PATCH] ALSA: HDA: Use one dmic only for Dell Studio 1558 + +commit e033ebfb399227e01686260ac271029011bc6b47 upstream. + +There are no signs of a dmic at node 0x0b, so the user is left with +an additional internal mic which does not exist. This commit removes +that non-existing mic. + +BugLink: http://bugs.launchpad.net/bugs/731706 +Reported-by: James Page <james.page@canonical.com> +Signed-off-by: David Henningsson <david.henningsson@canonical.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + sound/pci/hda/patch_sigmatel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c +index 02b813ef6..6c06d17 100644 +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -1614,7 +1614,7 @@ static struct snd_pci_quirk stac92hd73xx_cfg_tbl[] = { + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02fe, + "Dell Studio XPS 1645", STAC_DELL_M6_BOTH), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0413, +- "Dell Studio 1558", STAC_DELL_M6_BOTH), ++ "Dell Studio 1558", STAC_DELL_M6_DMIC), + {} /* terminator */ + }; + +-- +1.7.9.3 + diff --git a/next_round/ALSA-hda-Fix-quirk-for-Dell-Inspiron-910.patch b/next_round/ALSA-hda-Fix-quirk-for-Dell-Inspiron-910.patch new file mode 100644 index 0000000..e1bd4be --- /dev/null +++ b/next_round/ALSA-hda-Fix-quirk-for-Dell-Inspiron-910.patch @@ -0,0 +1,38 @@ +From d401d09cc7d1c0e07407612b418cf970535e501b Mon Sep 17 00:00:00 2001 +From: Daniel T Chen <crimsun@ubuntu.com> +Date: Mon, 6 Jun 2011 18:55:34 -0400 +Subject: [PATCH] ALSA: hda: Fix quirk for Dell Inspiron 910 + +commit 0a1896b27b030529ec770aefd790544a1bdb7d5a upstream. + +BugLink: https://launchpad.net/bugs/792712 + +The original reporter states that sound from the internal speakers is +inaudible until using the model=auto quirk. This symptom is due to an +existing quirk mask for 0x102802b* that uses the model=dell quirk. To +limit the possible regressions, leave the existing quirk mask but add +a higher priority specific mask for the reporter's PCI SSID. + +Reported-and-tested-by: rodni hipp +Signed-off-by: Daniel T Chen <crimsun@ubuntu.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index d388680..434572b 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -13181,6 +13181,7 @@ static struct snd_pci_quirk alc268_cfg_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x015b, "Acer Aspire One", + ALC268_ACER_ASPIRE_ONE), + SND_PCI_QUIRK(0x1028, 0x0253, "Dell OEM", ALC268_DELL), ++ SND_PCI_QUIRK(0x1028, 0x02b0, "Dell Inspiron 910", ALC268_AUTO), + SND_PCI_QUIRK_MASK(0x1028, 0xfff0, 0x02b0, + "Dell Inspiron Mini9/Vostro A90", ALC268_DELL), + /* almost compatible with toshiba but with optional digital outs; +-- +1.7.9.3 + diff --git a/next_round/ASoC-Add-some-missing-volume-update-bit-sets-for-wm_.patch b/next_round/ASoC-Add-some-missing-volume-update-bit-sets-for-wm_.patch new file mode 100644 index 0000000..9cb7ae8 --- /dev/null +++ b/next_round/ASoC-Add-some-missing-volume-update-bit-sets-for-wm_.patch @@ -0,0 +1,46 @@ +From de62548ce72ae8fd7e3905868b7c38563a2ecf0c Mon Sep 17 00:00:00 2001 +From: Mark Brown <broonie@opensource.wolfsonmicro.com> +Date: Sun, 15 May 2011 12:18:38 -0700 +Subject: [PATCH] ASoC: Add some missing volume update bit sets for wm_hubs + devices + +commit fb5af53d421d80725172427e9076f6e889603df6 upstream. + +Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> +Acked-by: Liam Girdwood <lrg@ti.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + sound/soc/codecs/wm_hubs.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c +index 4f1d50b..9e5bce6 100644 +--- a/sound/soc/codecs/wm_hubs.c ++++ b/sound/soc/codecs/wm_hubs.c +@@ -795,17 +795,21 @@ int wm_hubs_add_analogue_controls(struct snd_soc_codec *codec) + snd_soc_update_bits(codec, WM8993_RIGHT_LINE_INPUT_3_4_VOLUME, + WM8993_IN2_VU, WM8993_IN2_VU); + ++ snd_soc_update_bits(codec, WM8993_SPEAKER_VOLUME_LEFT, ++ WM8993_SPKOUT_VU, WM8993_SPKOUT_VU); + snd_soc_update_bits(codec, WM8993_SPEAKER_VOLUME_RIGHT, + WM8993_SPKOUT_VU, WM8993_SPKOUT_VU); + + snd_soc_update_bits(codec, WM8993_LEFT_OUTPUT_VOLUME, +- WM8993_HPOUT1L_ZC, WM8993_HPOUT1L_ZC); ++ WM8993_HPOUT1_VU | WM8993_HPOUT1L_ZC, ++ WM8993_HPOUT1_VU | WM8993_HPOUT1L_ZC); + snd_soc_update_bits(codec, WM8993_RIGHT_OUTPUT_VOLUME, + WM8993_HPOUT1_VU | WM8993_HPOUT1R_ZC, + WM8993_HPOUT1_VU | WM8993_HPOUT1R_ZC); + + snd_soc_update_bits(codec, WM8993_LEFT_OPGA_VOLUME, +- WM8993_MIXOUTL_ZC, WM8993_MIXOUTL_ZC); ++ WM8993_MIXOUTL_ZC | WM8993_MIXOUT_VU, ++ WM8993_MIXOUTL_ZC | WM8993_MIXOUT_VU); + snd_soc_update_bits(codec, WM8993_RIGHT_OPGA_VOLUME, + WM8993_MIXOUTR_ZC | WM8993_MIXOUT_VU, + WM8993_MIXOUTR_ZC | WM8993_MIXOUT_VU); +-- +1.7.9.3 + diff --git a/next_round/ASoC-Ensure-output-PGA-is-enabled-for-line-outputs-i.patch b/next_round/ASoC-Ensure-output-PGA-is-enabled-for-line-outputs-i.patch new file mode 100644 index 0000000..6c98f46 --- /dev/null +++ b/next_round/ASoC-Ensure-output-PGA-is-enabled-for-line-outputs-i.patch @@ -0,0 +1,68 @@ +From 160049669820448337ba6122197d58c2f2dcc2e2 Mon Sep 17 00:00:00 2001 +From: Mark Brown <broonie@opensource.wolfsonmicro.com> +Date: Sat, 14 May 2011 17:21:28 -0700 +Subject: [PATCH] ASoC: Ensure output PGA is enabled for line outputs in + wm_hubs + +commit d0b48af6c2b887354d0893e598d92911ce52620e upstream. + +Also fix a left/right typo while we're at it. + +Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> +Acked-by: Liam Girdwood <lrg@ti.com. +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + sound/soc/codecs/wm_hubs.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c +index db6122f..4f1d50b 100644 +--- a/sound/soc/codecs/wm_hubs.c ++++ b/sound/soc/codecs/wm_hubs.c +@@ -748,17 +748,17 @@ static const struct snd_soc_dapm_route analogue_routes[] = { + static const struct snd_soc_dapm_route lineout1_diff_routes[] = { + { "LINEOUT1 Mixer", "IN1L Switch", "IN1L PGA" }, + { "LINEOUT1 Mixer", "IN1R Switch", "IN1R PGA" }, +- { "LINEOUT1 Mixer", "Output Switch", "Left Output Mixer" }, ++ { "LINEOUT1 Mixer", "Output Switch", "Left Output PGA" }, + + { "LINEOUT1N Driver", NULL, "LINEOUT1 Mixer" }, + { "LINEOUT1P Driver", NULL, "LINEOUT1 Mixer" }, + }; + + static const struct snd_soc_dapm_route lineout1_se_routes[] = { +- { "LINEOUT1N Mixer", "Left Output Switch", "Left Output Mixer" }, +- { "LINEOUT1N Mixer", "Right Output Switch", "Left Output Mixer" }, ++ { "LINEOUT1N Mixer", "Left Output Switch", "Left Output PGA" }, ++ { "LINEOUT1N Mixer", "Right Output Switch", "Right Output PGA" }, + +- { "LINEOUT1P Mixer", "Left Output Switch", "Left Output Mixer" }, ++ { "LINEOUT1P Mixer", "Left Output Switch", "Left Output PGA" }, + + { "LINEOUT1N Driver", NULL, "LINEOUT1N Mixer" }, + { "LINEOUT1P Driver", NULL, "LINEOUT1P Mixer" }, +@@ -767,17 +767,17 @@ static const struct snd_soc_dapm_route lineout1_se_routes[] = { + static const struct snd_soc_dapm_route lineout2_diff_routes[] = { + { "LINEOUT2 Mixer", "IN2L Switch", "IN2L PGA" }, + { "LINEOUT2 Mixer", "IN2R Switch", "IN2R PGA" }, +- { "LINEOUT2 Mixer", "Output Switch", "Right Output Mixer" }, ++ { "LINEOUT2 Mixer", "Output Switch", "Right Output PGA" }, + + { "LINEOUT2N Driver", NULL, "LINEOUT2 Mixer" }, + { "LINEOUT2P Driver", NULL, "LINEOUT2 Mixer" }, + }; + + static const struct snd_soc_dapm_route lineout2_se_routes[] = { +- { "LINEOUT2N Mixer", "Left Output Switch", "Left Output Mixer" }, +- { "LINEOUT2N Mixer", "Right Output Switch", "Left Output Mixer" }, ++ { "LINEOUT2N Mixer", "Left Output Switch", "Left Output PGA" }, ++ { "LINEOUT2N Mixer", "Right Output Switch", "Right Output PGA" }, + +- { "LINEOUT2P Mixer", "Right Output Switch", "Right Output Mixer" }, ++ { "LINEOUT2P Mixer", "Right Output Switch", "Right Output PGA" }, + + { "LINEOUT2N Driver", NULL, "LINEOUT2N Mixer" }, + { "LINEOUT2P Driver", NULL, "LINEOUT2P Mixer" }, +-- +1.7.9.3 + diff --git a/next_round/CPU-hotplug-re-create-sysfs-directory-and-symlinks.patch b/next_round/CPU-hotplug-re-create-sysfs-directory-and-symlinks.patch new file mode 100644 index 0000000..6e088eb --- /dev/null +++ b/next_round/CPU-hotplug-re-create-sysfs-directory-and-symlinks.patch @@ -0,0 +1,69 @@ +From 8f1e1b052b30ed52cad33939f576105a90f55f1a Mon Sep 17 00:00:00 2001 +From: Jacob Shin <jacob.shin@amd.com> +Date: Wed, 27 Apr 2011 13:32:11 -0500 +Subject: [PATCH] CPU hotplug, re-create sysfs directory and symlinks + +commit 27ecddc2a9f99ce4ac9a59a0acd77f7100b6d034 upstream. + +When we discover CPUs that are affected by each other's +frequency/voltage transitions, the first CPU gets a sysfs directory +created, and rest of the siblings get symlinks. Currently, when we +hotplug off only the first CPU, all of the symlinks and the sysfs +directory gets removed. Even though rest of the siblings are still +online and functional, they are orphaned, and no longer governed by +cpufreq. + +This patch, given the above scenario, creates a sysfs directory for +the first sibling and symlinks for the rest of the siblings. + +Please note the recursive call, it was rather too ugly to roll it +out. And the removal of redundant NULL setting (it is already taken +care of near the top of the function). + +Signed-off-by: Jacob Shin <jacob.shin@amd.com> +Acked-by: Mark Langsdorf <mark.langsdorf@amd.com> +Reviewed-by: Thomas Renninger <trenn@suse.de> +Signed-off-by: Dave Jones <davej@redhat.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/cpufreq/cpufreq.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 634757f..cb18598 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1216,12 +1216,28 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev) + cpufreq_driver->exit(data); + unlock_policy_rwsem_write(cpu); + ++ cpufreq_debug_enable_ratelimit(); ++ ++#ifdef CONFIG_HOTPLUG_CPU ++ /* when the CPU which is the parent of the kobj is hotplugged ++ * offline, check for siblings, and create cpufreq sysfs interface ++ * and symlinks ++ */ ++ if (unlikely(cpumask_weight(data->cpus) > 1)) { ++ /* first sibling now owns the new sysfs dir */ ++ cpumask_clear_cpu(cpu, data->cpus); ++ cpufreq_add_dev(get_cpu_sysdev(cpumask_first(data->cpus))); ++ ++ /* finally remove our own symlink */ ++ lock_policy_rwsem_write(cpu); ++ __cpufreq_remove_dev(sys_dev); ++ } ++#endif ++ + free_cpumask_var(data->related_cpus); + free_cpumask_var(data->cpus); + kfree(data); +- per_cpu(cpufreq_cpu_data, cpu) = NULL; + +- cpufreq_debug_enable_ratelimit(); + return 0; + } + +-- +1.7.9.3 + diff --git a/next_round/Fix-Ultrastor-asm-snippet.patch b/next_round/Fix-Ultrastor-asm-snippet.patch new file mode 100644 index 0000000..ccb9432 --- /dev/null +++ b/next_round/Fix-Ultrastor-asm-snippet.patch @@ -0,0 +1,42 @@ +From 34dec3aad9612bb86b2ce03244e7bbf434ee695c Mon Sep 17 00:00:00 2001 +From: Samuel Thibault <samuel.thibault@ens-lyon.org> +Date: Wed, 18 May 2011 17:06:05 +0200 +Subject: [PATCH] Fix Ultrastor asm snippet + +commit fad4dab5e44e10acf6b0235e469cb8e773b58e31 upstream. + +Commit 1292500b replaced + +"=m" (*field) : "1" (*field) + +with + +"=m" (*field) : + +with comment "The following patch fixes it by using the '+' operator on +the (*field) operand, marking it as read-write to gcc." +'+' was actually forgotten. This really puts it. + +Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> +Signed-off-by: James Bottomley <jbottomley@parallels.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/scsi/ultrastor.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/ultrastor.c b/drivers/scsi/ultrastor.c +index 27aa40f..7f0eda2 100644 +--- a/drivers/scsi/ultrastor.c ++++ b/drivers/scsi/ultrastor.c +@@ -306,7 +306,7 @@ static inline int find_and_clear_bit_16(unsigned long *field) + "0: bsfw %1,%w0\n\t" + "btr %0,%1\n\t" + "jnc 0b" +- : "=&r" (rv), "=m" (*field) :); ++ : "=&r" (rv), "+m" (*field) :); + + return rv; + } +-- +1.7.9.3 + diff --git a/next_round/Fix-memory-leak-in-cpufreq_stat.patch b/next_round/Fix-memory-leak-in-cpufreq_stat.patch new file mode 100644 index 0000000..15a88c1 --- /dev/null +++ b/next_round/Fix-memory-leak-in-cpufreq_stat.patch @@ -0,0 +1,82 @@ +From bd36bd099eeef0af4db67688f9b92b085ef9b802 Mon Sep 17 00:00:00 2001 +From: steven finney <Steven.Finney@palm.com> +Date: Mon, 2 May 2011 11:29:17 -0700 +Subject: [PATCH] Fix memory leak in cpufreq_stat + +commit 98586ed8b8878e10691203687e89a42fa3355300 upstream. + +When a CPU is taken offline in an SMP system, cpufreq_remove_dev() +nulls out the per-cpu policy before cpufreq_stats_free_table() can +make use of it. cpufreq_stats_free_table() then skips the +call to sysfs_remove_group(), leaving about 100 bytes of sysfs-related +memory unclaimed each time a CPU-removal occurs. Break up +cpu_stats_free_table into sysfs and table portions, and +call the sysfs portion early. + +Signed-off-by: Steven Finney <steven.finney@palm.com> +Signed-off-by: Dave Jones <davej@redhat.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/cpufreq/cpufreq_stats.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c +index 00d73fc..4f1b8de 100644 +--- a/drivers/cpufreq/cpufreq_stats.c ++++ b/drivers/cpufreq/cpufreq_stats.c +@@ -165,17 +165,27 @@ static int freq_table_get_index(struct cpufreq_stats *stat, unsigned int freq) + return -1; + } + ++/* should be called late in the CPU removal sequence so that the stats ++ * memory is still available in case someone tries to use it. ++ */ + static void cpufreq_stats_free_table(unsigned int cpu) + { + struct cpufreq_stats *stat = per_cpu(cpufreq_stats_table, cpu); +- struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); +- if (policy && policy->cpu == cpu) +- sysfs_remove_group(&policy->kobj, &stats_attr_group); + if (stat) { + kfree(stat->time_in_state); + kfree(stat); + } + per_cpu(cpufreq_stats_table, cpu) = NULL; ++} ++ ++/* must be called early in the CPU removal sequence (before ++ * cpufreq_remove_dev) so that policy is still valid. ++ */ ++static void cpufreq_stats_free_sysfs(unsigned int cpu) ++{ ++ struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); ++ if (policy && policy->cpu == cpu) ++ sysfs_remove_group(&policy->kobj, &stats_attr_group); + if (policy) + cpufreq_cpu_put(policy); + } +@@ -316,6 +326,9 @@ static int __cpuinit cpufreq_stat_cpu_callback(struct notifier_block *nfb, + case CPU_ONLINE_FROZEN: + cpufreq_update_policy(cpu); + break; ++ case CPU_DOWN_PREPARE: ++ cpufreq_stats_free_sysfs(cpu); ++ break; + case CPU_DEAD: + case CPU_DEAD_FROZEN: + cpufreq_stats_free_table(cpu); +@@ -324,9 +337,11 @@ static int __cpuinit cpufreq_stat_cpu_callback(struct notifier_block *nfb, + return NOTIFY_OK; + } + ++/* priority=1 so this will get called before cpufreq_remove_dev */ + static struct notifier_block cpufreq_stat_cpu_notifier __refdata = + { + .notifier_call = cpufreq_stat_cpu_callback, ++ .priority = 1, + }; + + static struct notifier_block notifier_policy_block = { +-- +1.7.9.3 + diff --git a/next_round/Fix-oops-caused-by-queue-refcounting-failure.patch b/next_round/Fix-oops-caused-by-queue-refcounting-failure.patch new file mode 100644 index 0000000..a3a246a --- /dev/null +++ b/next_round/Fix-oops-caused-by-queue-refcounting-failure.patch @@ -0,0 +1,51 @@ +From ee39ae868ff9b5b23d73c366df6df2c7f59a4d7f Mon Sep 17 00:00:00 2001 +From: James Bottomley <James.Bottomley@HansenPartnership.com> +Date: Wed, 25 May 2011 15:52:14 -0500 +Subject: [PATCH] Fix oops caused by queue refcounting failure + +commit e73e079bf128d68284efedeba1fbbc18d78610f9 upstream. + +In certain circumstances, we can get an oops from a torn down device. +Most notably this is from CD roms trying to call scsi_ioctl. The root +cause of the problem is the fact that after scsi_remove_device() has +been called, the queue is fully torn down. This is actually wrong +since the queue can be used until the sdev release function is called. +Therefore, we add an extra reference to the queue which is released in +sdev->release, so the queue always exists. + +Reported-by: Parag Warudkar <parag.lkml@gmail.com> +Signed-off-by: James Bottomley <jbottomley@parallels.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/scsi/scsi_scan.c | 2 +- + drivers/scsi/scsi_sysfs.c | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 38518b0..91d1724 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -295,7 +295,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, + kfree(sdev); + goto out; + } +- ++ blk_get_queue(sdev->request_queue); + sdev->request_queue->queuedata = sdev; + scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun); + +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index ed3b52f..f01117e 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -319,6 +319,7 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work) + kfree(evt); + } + ++ blk_put_queue(sdev->request_queue); + /* NULL queue means the device can't be used */ + sdev->request_queue = NULL; + +-- +1.7.9.3 + diff --git a/next_round/PCI-Add-quirk-for-setting-valid-class-for-TI816X-End.patch b/next_round/PCI-Add-quirk-for-setting-valid-class-for-TI816X-End.patch new file mode 100644 index 0000000..bc5b574 --- /dev/null +++ b/next_round/PCI-Add-quirk-for-setting-valid-class-for-TI816X-End.patch @@ -0,0 +1,51 @@ +From b354e820f2f106beee70a056ffba4910622be4e9 Mon Sep 17 00:00:00 2001 +From: Hemant Pedanekar <hemantp@ti.com> +Date: Tue, 5 Apr 2011 12:32:50 +0530 +Subject: [PATCH] PCI: Add quirk for setting valid class for TI816X Endpoint + +commit 63c4408074cbcc070ac17fc10e524800eb9bd0b0 upstream. + +TI816X (common name for DM816x/C6A816x/AM389x family) devices configured +to boot as PCIe Endpoint have class code = 0. This makes kernel PCI bus +code to skip allocating BARs to these devices resulting into following +type of error when trying to enable them: + +"Device 0000:01:00.0 not available because of resource collisions" + +The device cannot be operated because of the above issue. + +This patch adds a ID specific (TI VENDOR ID and 816X DEVICE ID based) +'early' fixup quirk to replace class code with +PCI_CLASS_MULTIMEDIA_VIDEO as class. + +Signed-off-by: Hemant Pedanekar <hemantp@ti.com> +Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/pci/quirks.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 46aca60..6938fdc 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -2682,6 +2682,16 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x342e, vtd_mask_spec_errors); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x3c28, vtd_mask_spec_errors); + #endif + ++static void __devinit fixup_ti816x_class(struct pci_dev* dev) ++{ ++ /* TI 816x devices do not have class code set when in PCIe boot mode */ ++ if (dev->class == PCI_CLASS_NOT_DEFINED) { ++ dev_info(&dev->dev, "Setting PCI class for 816x PCIe device\n"); ++ dev->class = PCI_CLASS_MULTIMEDIA_VIDEO; ++ } ++} ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_TI, 0xb800, fixup_ti816x_class); ++ + static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f, + struct pci_fixup *end) + { +-- +1.7.9.3 + diff --git a/next_round/PCI-Set-PCIE-maxpayload-for-card-during-hotplug-inse.patch b/next_round/PCI-Set-PCIE-maxpayload-for-card-during-hotplug-inse.patch new file mode 100644 index 0000000..733a471 --- /dev/null +++ b/next_round/PCI-Set-PCIE-maxpayload-for-card-during-hotplug-inse.patch @@ -0,0 +1,87 @@ +From 0ebc252981a525dc31e1e036f8a1831374457d05 Mon Sep 17 00:00:00 2001 +From: "Jordan_Hargrave@Dell.com" <Jordan_Hargrave@Dell.com> +Date: Mon, 9 May 2011 15:24:55 -0500 +Subject: [PATCH] PCI: Set PCIE maxpayload for card during hotplug insertion + +commit e522a7126c7c144a1dd14c6f217ac31e71082b1d upstream. + +The following patch sets the MaxPayload setting to match the parent +reading when inserting a PCIE card into a hotplug slot. On our system, +the upstream bridge is set to 256, but when inserting a card, the card +setting defaults to 128. As soon as I/O is performed to the card it +starts receiving errors since the payload size is too small. + +Reviewed-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com> +Signed-off-by: Jordan Hargrave <jordan_hargrave@dell.com> +Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/pci/hotplug/pcihp_slot.c | 45 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 45 insertions(+) + +diff --git a/drivers/pci/hotplug/pcihp_slot.c b/drivers/pci/hotplug/pcihp_slot.c +index 80b461c..749fdf0 100644 +--- a/drivers/pci/hotplug/pcihp_slot.c ++++ b/drivers/pci/hotplug/pcihp_slot.c +@@ -158,6 +158,47 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp) + */ + } + ++/* Program PCIE MaxPayload setting on device: ensure parent maxpayload <= device */ ++static int pci_set_payload(struct pci_dev *dev) ++{ ++ int pos, ppos; ++ u16 pctl, psz; ++ u16 dctl, dsz, dcap, dmax; ++ struct pci_dev *parent; ++ ++ parent = dev->bus->self; ++ pos = pci_find_capability(dev, PCI_CAP_ID_EXP); ++ if (!pos) ++ return 0; ++ ++ /* Read Device MaxPayload capability and setting */ ++ pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &dctl); ++ pci_read_config_word(dev, pos + PCI_EXP_DEVCAP, &dcap); ++ dsz = (dctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5; ++ dmax = (dcap & PCI_EXP_DEVCAP_PAYLOAD); ++ ++ /* Read Parent MaxPayload setting */ ++ ppos = pci_find_capability(parent, PCI_CAP_ID_EXP); ++ if (!ppos) ++ return 0; ++ pci_read_config_word(parent, ppos + PCI_EXP_DEVCTL, &pctl); ++ psz = (pctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5; ++ ++ /* If parent payload > device max payload -> error ++ * If parent payload > device payload -> set speed ++ * If parent payload <= device payload -> do nothing ++ */ ++ if (psz > dmax) ++ return -1; ++ else if (psz > dsz) { ++ dev_info(&dev->dev, "Setting MaxPayload to %d\n", 128 << psz); ++ pci_write_config_word(dev, pos + PCI_EXP_DEVCTL, ++ (dctl & ~PCI_EXP_DEVCTL_PAYLOAD) + ++ (psz << 5)); ++ } ++ return 0; ++} ++ + void pci_configure_slot(struct pci_dev *dev) + { + struct pci_dev *cdev; +@@ -169,6 +210,10 @@ void pci_configure_slot(struct pci_dev *dev) + (dev->class >> 8) == PCI_CLASS_BRIDGE_PCI))) + return; + ++ ret = pci_set_payload(dev); ++ if (ret) ++ dev_warn(&dev->dev, "could not set device max payload\n"); ++ + memset(&hpp, 0, sizeof(hpp)); + ret = pci_get_hp_params(dev, &hpp); + if (ret) +-- +1.7.9.3 + diff --git a/next_round/Remove-cpufreq_stats-sysfs-entries-on-module-unload.patch b/next_round/Remove-cpufreq_stats-sysfs-entries-on-module-unload.patch new file mode 100644 index 0000000..c816d8a --- /dev/null +++ b/next_round/Remove-cpufreq_stats-sysfs-entries-on-module-unload.patch @@ -0,0 +1,32 @@ +From 2664c5350964e9410005de893d7352d534efe315 Mon Sep 17 00:00:00 2001 +From: Dave Jones <davej@redhat.com> +Date: Sun, 12 Jun 2011 16:35:28 -0400 +Subject: [PATCH] Remove cpufreq_stats sysfs entries on module unload. + +commit 13f067537f34456443f61c950cd6dc37d1d5f3ee upstream. + +cpufreq_stats leaves behind its sysfs entries, which causes a panic +when something stumbled across them. +(Discovered by unloading cpufreq_stats while powertop was loaded). + +Signed-off-by: Dave Jones <davej@redhat.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/cpufreq/cpufreq_stats.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c +index 4f1b8de..7c7a1e4 100644 +--- a/drivers/cpufreq/cpufreq_stats.c ++++ b/drivers/cpufreq/cpufreq_stats.c +@@ -388,6 +388,7 @@ static void __exit cpufreq_stats_exit(void) + unregister_hotcpu_notifier(&cpufreq_stat_cpu_notifier); + for_each_online_cpu(cpu) { + cpufreq_stats_free_table(cpu); ++ cpufreq_stats_free_sysfs(cpu); + } + } + +-- +1.7.9.3 + diff --git a/next_round/SUNRPC-Deal-with-the-lack-of-a-SYN_SENT-sk-sk_state_.patch b/next_round/SUNRPC-Deal-with-the-lack-of-a-SYN_SENT-sk-sk_state_.patch new file mode 100644 index 0000000..4e4d44c --- /dev/null +++ b/next_round/SUNRPC-Deal-with-the-lack-of-a-SYN_SENT-sk-sk_state_.patch @@ -0,0 +1,66 @@ +From a958e73b78d6037e283fd7e5d0957392d9425075 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust <Trond.Myklebust@netapp.com> +Date: Fri, 18 Mar 2011 20:21:23 -0400 +Subject: [PATCH] SUNRPC: Deal with the lack of a SYN_SENT sk->sk_state_change + callback... + +commit fe19a96b10032035a35779f42ad59e35d6dd8ffd upstream. + +The TCP connection state code depends on the state_change() callback +being called when the SYN_SENT state is set. However the networking layer +doesn't actually call us back in that case. + +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + net/sunrpc/xprtsock.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 9bfb685..b502700 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -1362,7 +1362,6 @@ static void xs_tcp_state_change(struct sock *sk) + case TCP_CLOSE_WAIT: + /* The server initiated a shutdown of the socket */ + xprt_force_disconnect(xprt); +- case TCP_SYN_SENT: + xprt->connect_cookie++; + case TCP_CLOSING: + /* +@@ -1824,6 +1823,7 @@ static void xs_tcp_reuse_connection(struct rpc_xprt *xprt, struct sock_xprt *tra + static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock) + { + struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt); ++ int ret = -ENOTCONN; + + if (!transport->inet) { + struct sock *sk = sock->sk; +@@ -1855,12 +1855,22 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock) + } + + if (!xprt_bound(xprt)) +- return -ENOTCONN; ++ goto out; + + /* Tell the socket layer to start connecting... */ + xprt->stat.connect_count++; + xprt->stat.connect_start = jiffies; +- return kernel_connect(sock, xs_addr(xprt), xprt->addrlen, O_NONBLOCK); ++ ret = kernel_connect(sock, xs_addr(xprt), xprt->addrlen, O_NONBLOCK); ++ switch (ret) { ++ case 0: ++ case -EINPROGRESS: ++ /* SYN_SENT! */ ++ xprt->connect_cookie++; ++ if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO) ++ xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO; ++ } ++out: ++ return ret; + } + + /** +-- +1.7.9.3 + diff --git a/next_round/UBIFS-fix-a-rare-memory-leak-in-ro-to-rw-remounting-.patch b/next_round/UBIFS-fix-a-rare-memory-leak-in-ro-to-rw-remounting-.patch new file mode 100644 index 0000000..12ad217 --- /dev/null +++ b/next_round/UBIFS-fix-a-rare-memory-leak-in-ro-to-rw-remounting-.patch @@ -0,0 +1,48 @@ +From f0f6d0d43c40517079a4cb7447818a266e682852 Mon Sep 17 00:00:00 2001 +From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> +Date: Fri, 6 May 2011 17:08:56 +0300 +Subject: [PATCH] UBIFS: fix a rare memory leak in ro to rw remounting path + +commit eaeee242c531cd4b0a4a46e8b5dd7ef504380c42 upstream. + +When re-mounting from R/O mode to R/W mode and the LEB count in the superblock +is not up-to date, because for the underlying UBI volume became larger, we +re-write the superblock. We allocate RAM for these purposes, but never free it. +So this is a memory leak, although very rare one. + +Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + fs/ubifs/sb.c | 3 ++- + fs/ubifs/super.c | 1 + + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ubifs/sb.c b/fs/ubifs/sb.c +index 96cb62c..f75f89b 100644 +--- a/fs/ubifs/sb.c ++++ b/fs/ubifs/sb.c +@@ -475,7 +475,8 @@ failed: + * @c: UBIFS file-system description object + * + * This function returns a pointer to the superblock node or a negative error +- * code. ++ * code. Note, the user of this function is responsible of kfree()'ing the ++ * returned superblock buffer. + */ + struct ubifs_sb_node *ubifs_read_sb_node(struct ubifs_info *c) + { +diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c +index 4d2f215..f4d0c36 100644 +--- a/fs/ubifs/super.c ++++ b/fs/ubifs/super.c +@@ -1545,6 +1545,7 @@ static int ubifs_remount_rw(struct ubifs_info *c) + } + sup->leb_cnt = cpu_to_le32(c->leb_cnt); + err = ubifs_write_sb_node(c, sup); ++ kfree(sup); + if (err) + goto out; + } +-- +1.7.9.3 + diff --git a/next_round/UBIFS-fix-memory-leak-on-error-path.patch b/next_round/UBIFS-fix-memory-leak-on-error-path.patch new file mode 100644 index 0000000..122b635 --- /dev/null +++ b/next_round/UBIFS-fix-memory-leak-on-error-path.patch @@ -0,0 +1,33 @@ +From ccf82472cac66df90cda66ff98bcdea94504fbde Mon Sep 17 00:00:00 2001 +From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> +Date: Tue, 31 May 2011 08:40:40 +0300 +Subject: [PATCH] UBIFS: fix memory leak on error path + +commit 812eb258311f89bcd664a34a620f249d54a2cd83 upstream. + +UBIFS leaks memory on error path in 'ubifs_jnl_update()' in case of write +failure because it forgets to free the 'struct ubifs_dent_node *dent' object. +Although the object is small, the alignment can make it large - e.g., 2KiB +if the min. I/O unit is 2KiB. + +Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + fs/ubifs/journal.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c +index d321bae..841f77c 100644 +--- a/fs/ubifs/journal.c ++++ b/fs/ubifs/journal.c +@@ -665,6 +665,7 @@ out_free: + + out_release: + release_head(c, BASEHD); ++ kfree(dent); + out_ro: + ubifs_ro_mode(c, err); + if (last_reference) +-- +1.7.9.3 + diff --git a/next_round/UBIFS-fix-shrinker-object-count-reports.patch b/next_round/UBIFS-fix-shrinker-object-count-reports.patch new file mode 100644 index 0000000..1ef9ab2 --- /dev/null +++ b/next_round/UBIFS-fix-shrinker-object-count-reports.patch @@ -0,0 +1,42 @@ +From ffd392de7eb7dfaee9019e10889025fd8234c918 Mon Sep 17 00:00:00 2001 +From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> +Date: Tue, 31 May 2011 07:03:21 +0300 +Subject: [PATCH] UBIFS: fix shrinker object count reports + +commit cf610bf4199770420629d3bc273494bd27ad6c1d upstream. + +Sometimes VM asks the shrinker to return amount of objects it can shrink, +and we return the ubifs_clean_zn_cnt in that case. However, it is possible +that this counter is negative for a short period of time, due to the way +UBIFS TNC code updates it. And I can observe the following warnings sometimes: + +shrink_slab: ubifs_shrinker+0x0/0x2b7 [ubifs] negative objects to delete nr=-8541616642706119788 + +This patch makes sure UBIFS never returns negative count of objects. + +Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + fs/ubifs/shrinker.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/ubifs/shrinker.c b/fs/ubifs/shrinker.c +index 02feb59..aec6689 100644 +--- a/fs/ubifs/shrinker.c ++++ b/fs/ubifs/shrinker.c +@@ -283,7 +283,11 @@ int ubifs_shrinker(int nr, gfp_t gfp_mask) + long clean_zn_cnt = atomic_long_read(&ubifs_clean_zn_cnt); + + if (nr == 0) +- return clean_zn_cnt; ++ /* ++ * Due to the way UBIFS updates the clean znode counter it may ++ * temporarily be negative. ++ */ ++ return clean_zn_cnt >= 0 ? clean_zn_cnt : 1; + + if (!clean_zn_cnt) { + /* +-- +1.7.9.3 + diff --git a/next_round/USB-CP210x-Add-4-Device-IDs-for-AC-Services-Devices.patch b/next_round/USB-CP210x-Add-4-Device-IDs-for-AC-Services-Devices.patch new file mode 100644 index 0000000..05b0de4 --- /dev/null +++ b/next_round/USB-CP210x-Add-4-Device-IDs-for-AC-Services-Devices.patch @@ -0,0 +1,35 @@ +From 6e87858a11aaaef409c43360330df8f0b47df030 Mon Sep 17 00:00:00 2001 +From: Craig Shelley <craig@microtron.org.uk> +Date: Sun, 20 Mar 2011 13:51:13 +0000 +Subject: [PATCH] USB: CP210x Add 4 Device IDs for AC-Services Devices + +commit 4eff0b40a7174896b860312910e0db51f2dcc567 upstream. + +This patch adds 4 device IDs for CP2102 based devices manufactured by +AC-Services. See http://www.ac-services.eu for further info. + +Signed-off-by: Craig Shelley <craig@microtron.org.uk> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/usb/serial/cp210x.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index b2d428f..d53918b 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -114,6 +114,10 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */ + { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ + { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */ ++ { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ ++ { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */ ++ { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ ++ { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */ +-- +1.7.9.3 + diff --git a/next_round/USB-cdc-acm-Adding-second-ACM-channel-support-for-No.patch b/next_round/USB-cdc-acm-Adding-second-ACM-channel-support-for-No.patch new file mode 100644 index 0000000..4c41db5 --- /dev/null +++ b/next_round/USB-cdc-acm-Adding-second-ACM-channel-support-for-No.patch @@ -0,0 +1,36 @@ +From a02df4129665897138f5d00c41a40e99d57039b9 Mon Sep 17 00:00:00 2001 +From: Toby Gray <toby.gray@realvnc.com> +Date: Mon, 6 Jun 2011 14:52:48 +0100 +Subject: [PATCH] USB: cdc-acm: Adding second ACM channel support for Nokia E7 + and C7 + +commit 4061fde2fa80f40cb27114f60500d38d0afcf350 upstream. + +This adds the Nokia E7 and C7 to the list of devices in cdc-acm, allowing +the secondary ACM channel on the device to be exposed. Without this patch +the ACM driver won't claim this secondary channel as it's marked as +having a vendor-specific protocol. + +Signed-off-by: Toby Gray <toby.gray@realvnc.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/usb/class/cdc-acm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 657b434..e907cfd 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1619,6 +1619,8 @@ static const struct usb_device_id acm_ids[] = { + { NOKIA_PCSUITE_ACM_INFO(0x04ce), }, /* Nokia E90 */ + { NOKIA_PCSUITE_ACM_INFO(0x01d4), }, /* Nokia E55 */ + { NOKIA_PCSUITE_ACM_INFO(0x0302), }, /* Nokia N8 */ ++ { NOKIA_PCSUITE_ACM_INFO(0x0335), }, /* Nokia E7 */ ++ { NOKIA_PCSUITE_ACM_INFO(0x03cd), }, /* Nokia C7 */ + { SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */ + + /* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */ +-- +1.7.9.3 + diff --git a/next_round/USB-core-Tolerate-protocol-stall-during-hub-and-port.patch b/next_round/USB-core-Tolerate-protocol-stall-during-hub-and-port.patch new file mode 100644 index 0000000..6bf2f27 --- /dev/null +++ b/next_round/USB-core-Tolerate-protocol-stall-during-hub-and-port.patch @@ -0,0 +1,48 @@ +From 5b1b42f90a441102181b54f34d0c5d1242da6c27 Mon Sep 17 00:00:00 2001 +From: Libor Pechacek <lpechacek@suse.cz> +Date: Fri, 20 May 2011 14:53:25 +0200 +Subject: [PATCH] USB: core: Tolerate protocol stall during hub and port + status read + +commit 3824c1ddaf744be44b170a335332b9d6afe79254 upstream. + +Protocol stall should not be fatal while reading port or hub status as it is +transient state. Currently hub EP0 STALL during port status read results in +failed device enumeration. This has been observed with ST-Ericsson (formerly +Philips) USB 2.0 Hub (04cc:1521) after connecting keyboard. + +Signed-off-by: Libor Pechacek <lpechacek@suse.cz> +Acked-by: Alan Stern <stern@rowland.harvard.edu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/usb/core/hub.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index e5363de..642fc7e 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -327,7 +327,8 @@ static int get_hub_status(struct usb_device *hdev, + { + int i, status = -ETIMEDOUT; + +- for (i = 0; i < USB_STS_RETRIES && status == -ETIMEDOUT; i++) { ++ for (i = 0; i < USB_STS_RETRIES && ++ (status == -ETIMEDOUT || status == -EPIPE); i++) { + status = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0), + USB_REQ_GET_STATUS, USB_DIR_IN | USB_RT_HUB, 0, 0, + data, sizeof(*data), USB_STS_TIMEOUT); +@@ -343,7 +344,8 @@ static int get_port_status(struct usb_device *hdev, int port1, + { + int i, status = -ETIMEDOUT; + +- for (i = 0; i < USB_STS_RETRIES && status == -ETIMEDOUT; i++) { ++ for (i = 0; i < USB_STS_RETRIES && ++ (status == -ETIMEDOUT || status == -EPIPE); i++) { + status = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0), + USB_REQ_GET_STATUS, USB_DIR_IN | USB_RT_PORT, 0, port1, + data, sizeof(*data), USB_STS_TIMEOUT); +-- +1.7.9.3 + diff --git a/next_round/USB-gamin_gps-Fix-for-data-transfer-problems-in-nati.patch b/next_round/USB-gamin_gps-Fix-for-data-transfer-problems-in-nati.patch new file mode 100644 index 0000000..f1bcdbb --- /dev/null +++ b/next_round/USB-gamin_gps-Fix-for-data-transfer-problems-in-nati.patch @@ -0,0 +1,118 @@ +From 1428a2306f11d58df72f5d834d4aa21098d207fe Mon Sep 17 00:00:00 2001 +From: Hermann Kneissel <herkne@gmx.de> +Date: Fri, 29 Apr 2011 08:58:43 +0200 +Subject: [PATCH] USB: gamin_gps: Fix for data transfer problems in native + mode + +commit b4026c4584cd70858d4d3450abfb1cd0714d4f32 upstream. + +This patch fixes a problem where data received from the gps is sometimes +transferred incompletely to the serial port. If used in native mode now +all data received via the bulk queue will be forwarded to the serial +port. + +Signed-off-by: Hermann Kneissel <herkne@gmx.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/usb/serial/garmin_gps.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c +index a42b29a..c2bc179 100644 +--- a/drivers/usb/serial/garmin_gps.c ++++ b/drivers/usb/serial/garmin_gps.c +@@ -1,7 +1,7 @@ + /* + * Garmin GPS driver + * +- * Copyright (C) 2006-2009 Hermann Kneissel herkne@users.sourceforge.net ++ * Copyright (C) 2006-2011 Hermann Kneissel herkne@gmx.de + * + * The latest version of the driver can be found at + * http://sourceforge.net/projects/garmin-gps/ +@@ -51,7 +51,7 @@ static int debug; + */ + + #define VERSION_MAJOR 0 +-#define VERSION_MINOR 33 ++#define VERSION_MINOR 36 + + #define _STR(s) #s + #define _DRIVER_VERSION(a, b) "v" _STR(a) "." _STR(b) +@@ -410,6 +410,7 @@ static int gsp_send_ack(struct garmin_data *garmin_data_p, __u8 pkt_id) + */ + static int gsp_rec_packet(struct garmin_data *garmin_data_p, int count) + { ++ unsigned long flags; + const __u8 *recpkt = garmin_data_p->inbuffer+GSP_INITIAL_OFFSET; + __le32 *usbdata = (__le32 *) garmin_data_p->inbuffer; + +@@ -458,7 +459,9 @@ static int gsp_rec_packet(struct garmin_data *garmin_data_p, int count) + /* if this was an abort-transfer command, flush all + queued data. */ + if (isAbortTrfCmnd(garmin_data_p->inbuffer)) { ++ spin_lock_irqsave(&garmin_data_p->lock, flags); + garmin_data_p->flags |= FLAGS_DROP_DATA; ++ spin_unlock_irqrestore(&garmin_data_p->lock, flags); + pkt_clear(garmin_data_p); + } + +@@ -943,7 +946,7 @@ static int garmin_open(struct tty_struct *tty, struct usb_serial_port *port) + spin_lock_irqsave(&garmin_data_p->lock, flags); + garmin_data_p->mode = initial_mode; + garmin_data_p->count = 0; +- garmin_data_p->flags = 0; ++ garmin_data_p->flags &= FLAGS_SESSION_REPLY1_SEEN; + spin_unlock_irqrestore(&garmin_data_p->lock, flags); + + /* shutdown any bulk reads that might be going on */ +@@ -1178,7 +1181,8 @@ static int garmin_write_room(struct tty_struct *tty) + + + static void garmin_read_process(struct garmin_data *garmin_data_p, +- unsigned char *data, unsigned data_length) ++ unsigned char *data, unsigned data_length, ++ int bulk_data) + { + unsigned long flags; + +@@ -1193,7 +1197,8 @@ static void garmin_read_process(struct garmin_data *garmin_data_p, + send it directly to the tty port */ + if (garmin_data_p->flags & FLAGS_QUEUING) { + pkt_add(garmin_data_p, data, data_length); +- } else if (getLayerId(data) == GARMIN_LAYERID_APPL) { ++ } else if (bulk_data || ++ getLayerId(data) == GARMIN_LAYERID_APPL) { + + spin_lock_irqsave(&garmin_data_p->lock, flags); + garmin_data_p->flags |= APP_RESP_SEEN; +@@ -1237,7 +1242,7 @@ static void garmin_read_bulk_callback(struct urb *urb) + usb_serial_debug_data(debug, &port->dev, + __func__, urb->actual_length, data); + +- garmin_read_process(garmin_data_p, data, urb->actual_length); ++ garmin_read_process(garmin_data_p, data, urb->actual_length, 1); + + if (urb->actual_length == 0 && + 0 != (garmin_data_p->flags & FLAGS_BULK_IN_RESTART)) { +@@ -1347,7 +1352,7 @@ static void garmin_read_int_callback(struct urb *urb) + __func__, garmin_data_p->serial_num); + } + +- garmin_read_process(garmin_data_p, data, urb->actual_length); ++ garmin_read_process(garmin_data_p, data, urb->actual_length, 0); + + port->interrupt_in_urb->dev = port->serial->dev; + retval = usb_submit_urb(urb, GFP_ATOMIC); +@@ -1462,6 +1467,7 @@ static int garmin_attach(struct usb_serial *serial) + garmin_data_p->timer.function = timeout_handler; + garmin_data_p->port = port; + garmin_data_p->state = 0; ++ garmin_data_p->flags = 0; + garmin_data_p->count = 0; + usb_set_serial_port_data(port, garmin_data_p); + +-- +1.7.9.3 + diff --git a/next_round/USB-moto_modem-Add-USB-identifier-for-the-Motorola-V.patch b/next_round/USB-moto_modem-Add-USB-identifier-for-the-Motorola-V.patch new file mode 100644 index 0000000..5248f5f --- /dev/null +++ b/next_round/USB-moto_modem-Add-USB-identifier-for-the-Motorola-V.patch @@ -0,0 +1,32 @@ +From a5aabe1e229c894d6ccf39924083889c67236ee0 Mon Sep 17 00:00:00 2001 +From: Elizabeth Jennifer Myers <elizabeth@sporksirc.net> +Date: Sat, 16 Apr 2011 14:49:51 -0400 +Subject: [PATCH] USB: moto_modem: Add USB identifier for the Motorola VE240. + +commit 3938a0b32dc12229e76735679b37095bc2bc1578 upstream. + +Tested on my phone, the ttyUSB device is created and is fully +functional. + +Signed-off-by: Elizabeth Jennifer Myers <elizabeth@sporksirc.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/usb/serial/moto_modem.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/serial/moto_modem.c b/drivers/usb/serial/moto_modem.c +index cf17183..0147042 100644 +--- a/drivers/usb/serial/moto_modem.c ++++ b/drivers/usb/serial/moto_modem.c +@@ -25,6 +25,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x05c6, 0x3197) }, /* unknown Motorola phone */ + { USB_DEVICE(0x0c44, 0x0022) }, /* unknown Mororola phone */ + { USB_DEVICE(0x22b8, 0x2a64) }, /* Motorola KRZR K1m */ ++ { USB_DEVICE(0x22b8, 0x2c84) }, /* Motorola VE240 phone */ + { USB_DEVICE(0x22b8, 0x2c64) }, /* Motorola V950 phone */ + { }, + }; +-- +1.7.9.3 + diff --git a/next_round/USB-serial-add-another-4N-GALAXY.DE-PID-to-ftdi_sio-.patch b/next_round/USB-serial-add-another-4N-GALAXY.DE-PID-to-ftdi_sio-.patch new file mode 100644 index 0000000..bbee556 --- /dev/null +++ b/next_round/USB-serial-add-another-4N-GALAXY.DE-PID-to-ftdi_sio-.patch @@ -0,0 +1,44 @@ +From 1fbd07f90af80163e4361200d4ebc32830a583a3 Mon Sep 17 00:00:00 2001 +From: Steffen Sledz <sledz@dresearch-fe.de> +Date: Tue, 7 Jun 2011 14:01:56 +0200 +Subject: [PATCH] USB: serial: add another 4N-GALAXY.DE PID to ftdi_sio driver + +commit a26d31cef06f43a76327c21235e75450869df2b8 upstream. + +E.g. newer CAN 2.0 A/B <=> USB 2.0 converters report idProduct=f3c2. + +Signed-off-by: Steffen Sledz <sledz@dresearch-fe.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index eac7330..c7e4fb8 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -651,6 +651,7 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, EVER_ECO_PRO_CDS) }, + { USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_1_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_2_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_3_PID) }, + { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_0_PID) }, + { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_1_PID) }, + { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_2_PID) }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index a644665..a73443f 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -351,6 +351,7 @@ + */ + #define FTDI_4N_GALAXY_DE_1_PID 0xF3C0 + #define FTDI_4N_GALAXY_DE_2_PID 0xF3C1 ++#define FTDI_4N_GALAXY_DE_3_PID 0xF3C2 + + /* + * Linx Technologies product ids +-- +1.7.9.3 + diff --git a/next_round/USB-serial-ftdi_sio-adding-support-for-TavIR-STK500.patch b/next_round/USB-serial-ftdi_sio-adding-support-for-TavIR-STK500.patch new file mode 100644 index 0000000..3ae24d4 --- /dev/null +++ b/next_round/USB-serial-ftdi_sio-adding-support-for-TavIR-STK500.patch @@ -0,0 +1,52 @@ +From 4cc1b28ed5492d763daf26b7e1886fa12309d434 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Benedek=20L=C3=A1szl=C3=B3?= <benedekl@gmail.com> +Date: Wed, 20 Apr 2011 03:22:21 +0200 +Subject: [PATCH] USB: serial: ftdi_sio: adding support for TavIR STK500 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit 37909fe588c9e09ab57cd267e98678a17ceda64a upstream. + +Adding support for the TavIR STK500 (id 0403:FA33) +Atmel AVR programmer device based on FTDI FT232RL. + +Signed-off-by: Benedek László <benedekl@gmail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 5 +++++ + 2 files changed, 6 insertions(+) + +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 7d0107a..eac7330 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -570,6 +570,7 @@ static struct usb_device_id id_table_combined [] = { + { USB_DEVICE(FTDI_VID, FTDI_IBS_APP70_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) }, + /* + * ELV devices: + */ +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index aaeb159..a644665 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -491,6 +491,11 @@ + /* www.canusb.com Lawicel CANUSB device (FTDI_VID) */ + #define FTDI_CANUSB_PID 0xFFA8 /* Product Id */ + ++/* ++ * TavIR AVR product ids (FTDI_VID) ++ */ ++#define FTDI_TAVIR_STK500_PID 0xFA33 /* STK500 AVR programmer */ ++ + + + /********************************/ +-- +1.7.9.3 + diff --git a/next_round/USB-xhci-fix-interval-calculation-for-FS-isoc-endpoi.patch b/next_round/USB-xhci-fix-interval-calculation-for-FS-isoc-endpoi.patch new file mode 100644 index 0000000..15e7989 --- /dev/null +++ b/next_round/USB-xhci-fix-interval-calculation-for-FS-isoc-endpoi.patch @@ -0,0 +1,60 @@ +From cdea8f6ff7dc4fe4fa8321d973a4e3992a41db6b Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov <dtor@vmware.com> +Date: Tue, 31 May 2011 14:37:23 -0700 +Subject: [PATCH] USB: xhci - fix interval calculation for FS isoc endpoints + +commit cd3c18ba2fac14b34d03cae111f215009735ea06 upstream. + +Full-speed isoc endpoints specify interval in exponent based form in +frames, not microframes, so we need to adjust accordingly. + +NEC xHCI host controllers will return an error code of 0x11 if a full +speed isochronous endpoint is added with the Interval field set to +something less than 3 (2^3 = 8 microframes, or one frame). It is +impossible for a full speed device to have an interval smaller than one +frame. + +This was always an issue in the xHCI driver, but commit +dfa49c4ad120a784ef1ff0717168aa79f55a483a "USB: xhci - fix math in +xhci_get_endpoint_interval()" removed the clamping of the minimum value +in the Interval field, which revealed this bug. + +This needs to be backported to stable kernels back to 2.6.31. + +Reported-by: Matt Evans <matt@ozlabs.org> +Signed-off-by: Dmitry Torokhov <dtor@vmware.com> +Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/usb/host/xhci-mem.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 05b5c34..727ac40 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -533,9 +533,19 @@ static unsigned int xhci_parse_exponent_interval(struct usb_device *udev, + interval = clamp_val(ep->desc.bInterval, 1, 16) - 1; + if (interval != ep->desc.bInterval - 1) + dev_warn(&udev->dev, +- "ep %#x - rounding interval to %d microframes\n", ++ "ep %#x - rounding interval to %d %sframes\n", + ep->desc.bEndpointAddress, +- 1 << interval); ++ 1 << interval, ++ udev->speed == USB_SPEED_FULL ? "" : "micro"); ++ ++ if (udev->speed == USB_SPEED_FULL) { ++ /* ++ * Full speed isoc endpoints specify interval in frames, ++ * not microframes. We are using microframes everywhere, ++ * so adjust accordingly. ++ */ ++ interval += 3; /* 1 frame = 2^3 uframes */ ++ } + + return interval; + } +-- +1.7.9.3 + diff --git a/next_round/atm-expose-ATM-device-index-in-sysfs.patch b/next_round/atm-expose-ATM-device-index-in-sysfs.patch new file mode 100644 index 0000000..679e65c --- /dev/null +++ b/next_round/atm-expose-ATM-device-index-in-sysfs.patch @@ -0,0 +1,59 @@ +From 623671c5e986ad24813c992d8dbd200030105fec Mon Sep 17 00:00:00 2001 +From: Dan Williams <dcbw@redhat.com> +Date: Fri, 27 May 2011 04:51:54 +0000 +Subject: [PATCH] atm: expose ATM device index in sysfs + +commit e7a46b4d0839c2a3aa2e0ae0b145f293f6738498 upstream. + +It's currently exposed only through /proc which, besides requiring +screen-scraping, doesn't allow userspace to distinguish between two +identical ATM adapters with different ATM indexes. The ATM device index +is required when using PPPoATM on a system with multiple ATM adapters. + +Signed-off-by: Dan Williams <dcbw@redhat.com> +Reviewed-by: Eric Dumazet <eric.dumazet@gmail.com> +Tested-by: David Woodhouse <dwmw2@infradead.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + net/atm/atm_sysfs.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/net/atm/atm_sysfs.c b/net/atm/atm_sysfs.c +index 799c631..67b5bcf 100644 +--- a/net/atm/atm_sysfs.c ++++ b/net/atm/atm_sysfs.c +@@ -59,6 +59,14 @@ static ssize_t show_atmaddress(struct device *cdev, + return pos - buf; + } + ++static ssize_t show_atmindex(struct device *cdev, ++ struct device_attribute *attr, char *buf) ++{ ++ struct atm_dev *adev = to_atm_dev(cdev); ++ ++ return sprintf(buf, "%d\n", adev->number); ++} ++ + static ssize_t show_carrier(struct device *cdev, + struct device_attribute *attr, char *buf) + { +@@ -99,6 +107,7 @@ static ssize_t show_link_rate(struct device *cdev, + + static DEVICE_ATTR(address, S_IRUGO, show_address, NULL); + static DEVICE_ATTR(atmaddress, S_IRUGO, show_atmaddress, NULL); ++static DEVICE_ATTR(atmindex, S_IRUGO, show_atmindex, NULL); + static DEVICE_ATTR(carrier, S_IRUGO, show_carrier, NULL); + static DEVICE_ATTR(type, S_IRUGO, show_type, NULL); + static DEVICE_ATTR(link_rate, S_IRUGO, show_link_rate, NULL); +@@ -106,6 +115,7 @@ static DEVICE_ATTR(link_rate, S_IRUGO, show_link_rate, NULL); + static struct device_attribute *atm_attrs[] = { + &dev_attr_atmaddress, + &dev_attr_address, ++ &dev_attr_atmindex, + &dev_attr_carrier, + &dev_attr_type, + &dev_attr_link_rate, +-- +1.7.9.3 + diff --git a/next_round/block-add-proper-state-guards-to-__elv_next_request.patch b/next_round/block-add-proper-state-guards-to-__elv_next_request.patch new file mode 100644 index 0000000..19d85ad --- /dev/null +++ b/next_round/block-add-proper-state-guards-to-__elv_next_request.patch @@ -0,0 +1,38 @@ +From 5022805b40d3e9cbd866d3649b89508e39862bc2 Mon Sep 17 00:00:00 2001 +From: James Bottomley <James.Bottomley@suse.de> +Date: Wed, 18 May 2011 16:20:10 +0200 +Subject: [PATCH] block: add proper state guards to __elv_next_request + +commit 0a58e077eb600d1efd7e54ad9926a75a39d7f8ae upstream. + +blk_cleanup_queue() calls elevator_exit() and after this, we can't +touch the elevator without oopsing. __elv_next_request() must check +for this state because in the refcounted queue model, we can still +call it after blk_cleanup_queue() has been called. + +This was reported as causing an oops attributable to scsi. + +Signed-off-by: James Bottomley <James.Bottomley@suse.de> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + block/blk.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk.h b/block/blk.h +index 5ee3d7e..1414836 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -62,7 +62,8 @@ static inline struct request *__elv_next_request(struct request_queue *q) + return rq; + } + +- if (!q->elevator->ops->elevator_dispatch_fn(q, 0)) ++ if (test_bit(QUEUE_FLAG_DEAD, &q->queue_flags) || ++ !q->elevator->ops->elevator_dispatch_fn(q, 0)) + return NULL; + } + } +-- +1.7.9.3 + diff --git a/next_round/block-export-blk_-get-put-_queue.patch b/next_round/block-export-blk_-get-put-_queue.patch new file mode 100644 index 0000000..c78be80 --- /dev/null +++ b/next_round/block-export-blk_-get-put-_queue.patch @@ -0,0 +1,39 @@ +From 1f1d70bc3361e7fe9cfc6d7752024b1a3b35e7f1 Mon Sep 17 00:00:00 2001 +From: Jens Axboe <jaxboe@fusionio.com> +Date: Fri, 27 May 2011 07:44:43 +0200 +Subject: [PATCH] block: export blk_{get,put}_queue() + +commit d86e0e83b32bc84600adb0b6ea1fce389b266682 upstream. + +We need them in SCSI to fix a bug, but currently they are not +exported to modules. Export them. + +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + block/blk-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/block/blk-core.c b/block/blk-core.c +index dd9795d..94f274b 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -439,6 +439,7 @@ void blk_put_queue(struct request_queue *q) + { + kobject_put(&q->kobj); + } ++EXPORT_SYMBOL(blk_put_queue); + + void blk_cleanup_queue(struct request_queue *q) + { +@@ -612,6 +613,7 @@ int blk_get_queue(struct request_queue *q) + + return 1; + } ++EXPORT_SYMBOL(blk_get_queue); + + static inline void blk_free_request(struct request_queue *q, struct request *rq) + { +-- +1.7.9.3 + diff --git a/next_round/block-rescan-partitions-on-invalidated-devices-on-EN.patch b/next_round/block-rescan-partitions-on-invalidated-devices-on-EN.patch new file mode 100644 index 0000000..7075b5f --- /dev/null +++ b/next_round/block-rescan-partitions-on-invalidated-devices-on-EN.patch @@ -0,0 +1,101 @@ +From f57e642aa440902506ddeb9686571afe67f000f3 Mon Sep 17 00:00:00 2001 +From: Tejun Heo <tj@kernel.org> +Date: Fri, 29 Apr 2011 10:15:20 +0200 +Subject: [PATCH] block: rescan partitions on invalidated devices on -ENOMEDIA + too + +commit 02e352287a40bd456eb78df705bf888bc3161d3f upstream. + +__blkdev_get() doesn't rescan partitions if disk->fops->open() fails, +which leads to ghost partition devices lingering after medimum removal +is known to both the kernel and userland. The behavior also creates a +subtle inconsistency where O_NONBLOCK open, which doesn't fail even if +there's no medium, clears the ghots partitions, which is exploited to +work around the problem from userland. + +Fix it by updating __blkdev_get() to issue partition rescan after +-ENOMEDIA too. + +This was reported in the following bz. + + https://bugzilla.kernel.org/show_bug.cgi?id=13029 + +Stable: 2.6.38 + +Signed-off-by: Tejun Heo <tj@kernel.org> +Reported-by: David Zeuthen <zeuthen@gmail.com> +Reported-by: Martin Pitt <martin.pitt@ubuntu.com> +Reported-by: Kay Sievers <kay.sievers@vrfy.org> +Tested-by: Kay Sievers <kay.sievers@vrfy.org> +Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + fs/block_dev.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/fs/block_dev.c b/fs/block_dev.c +index d4d19ac..50797bf 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -1220,6 +1220,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) + if (!bdev->bd_part) + goto out_clear; + ++ ret = 0; + if (disk->fops->open) { + ret = disk->fops->open(bdev, mode); + if (ret == -ERESTARTSYS) { +@@ -1235,9 +1236,18 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) + mutex_unlock(&bdev->bd_mutex); + goto restart; + } +- if (ret) +- goto out_clear; + } ++ /* ++ * If the device is invalidated, rescan partition ++ * if open succeeded or failed with -ENOMEDIUM. ++ * The latter is necessary to prevent ghost ++ * partitions on a removed medium. ++ */ ++ if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM)) ++ rescan_partitions(disk, bdev); ++ if (ret) ++ goto out_clear; ++ + if (!bdev->bd_openers) { + bd_set_size(bdev,(loff_t)get_capacity(disk)<<9); + bdi = blk_get_backing_dev_info(bdev); +@@ -1245,8 +1255,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) + bdi = &default_backing_dev_info; + bdev->bd_inode->i_data.backing_dev_info = bdi; + } +- if (bdev->bd_invalidated) +- rescan_partitions(disk, bdev); + } else { + struct block_device *whole; + whole = bdget_disk(disk, 0); +@@ -1273,13 +1281,14 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) + put_disk(disk); + disk = NULL; + if (bdev->bd_contains == bdev) { +- if (bdev->bd_disk->fops->open) { ++ ret = 0; ++ if (bdev->bd_disk->fops->open) + ret = bdev->bd_disk->fops->open(bdev, mode); +- if (ret) +- goto out_unlock_bdev; +- } +- if (bdev->bd_invalidated) ++ /* the same as first opener case, read comment there */ ++ if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM)) + rescan_partitions(bdev->bd_disk, bdev); ++ if (ret) ++ goto out_unlock_bdev; + } + } + bdev->bd_openers++; +-- +1.7.9.3 + diff --git a/next_round/brd-handle-on-demand-devices-correctly.patch b/next_round/brd-handle-on-demand-devices-correctly.patch new file mode 100644 index 0000000..6d829b3 --- /dev/null +++ b/next_round/brd-handle-on-demand-devices-correctly.patch @@ -0,0 +1,85 @@ +From 50994a4c7b0b3a8293ccf6f34f109ca09c1f2be5 Mon Sep 17 00:00:00 2001 +From: Namhyung Kim <namhyung@gmail.com> +Date: Thu, 26 May 2011 21:06:50 +0200 +Subject: [PATCH] brd: handle on-demand devices correctly + +commit af46566885a373b0a526932484cd8fef8de7b598 upstream. + +When finding or allocating a ram disk device, brd_probe() did not take +partition numbers into account so that it can result to a different +device. Consider following example (I set CONFIG_BLK_DEV_RAM_COUNT=4 +for simplicity) : + +$ sudo modprobe brd max_part=15 +$ ls -l /dev/ram* +brw-rw---- 1 root disk 1, 0 2011-05-25 15:41 /dev/ram0 +brw-rw---- 1 root disk 1, 16 2011-05-25 15:41 /dev/ram1 +brw-rw---- 1 root disk 1, 32 2011-05-25 15:41 /dev/ram2 +brw-rw---- 1 root disk 1, 48 2011-05-25 15:41 /dev/ram3 +$ sudo mknod /dev/ram4 b 1 64 +$ sudo dd if=/dev/zero of=/dev/ram4 bs=4k count=256 +256+0 records in +256+0 records out +1048576 bytes (1.0 MB) copied, 0.00215578 s, 486 MB/s +namhyung@leonhard:linux$ ls -l /dev/ram* +brw-rw---- 1 root disk 1, 0 2011-05-25 15:41 /dev/ram0 +brw-rw---- 1 root disk 1, 16 2011-05-25 15:41 /dev/ram1 +brw-rw---- 1 root disk 1, 32 2011-05-25 15:41 /dev/ram2 +brw-rw---- 1 root disk 1, 48 2011-05-25 15:41 /dev/ram3 +brw-r--r-- 1 root root 1, 64 2011-05-25 15:45 /dev/ram4 +brw-rw---- 1 root disk 1, 1024 2011-05-25 15:44 /dev/ram64 + +After this patch, /dev/ram4 - instead of /dev/ram64 - was +accessed correctly. + +In addition, 'range' passed to blk_register_region() should +include all range of dev_t that RAMDISK_MAJOR can address. +It does not need to be limited by partition numbers unless +'rd_nr' param was specified. + +Signed-off-by: Namhyung Kim <namhyung@gmail.com> +Cc: Laurent Vivier <Laurent.Vivier@bull.net> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/block/brd.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/block/brd.c b/drivers/block/brd.c +index 9668128..8358a22 100644 +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -498,7 +498,7 @@ static struct kobject *brd_probe(dev_t dev, int *part, void *data) + struct kobject *kobj; + + mutex_lock(&brd_devices_mutex); +- brd = brd_init_one(dev & MINORMASK); ++ brd = brd_init_one(MINOR(dev) >> part_shift); + kobj = brd ? get_disk(brd->brd_disk) : ERR_PTR(-ENOMEM); + mutex_unlock(&brd_devices_mutex); + +@@ -539,10 +539,10 @@ static int __init brd_init(void) + + if (rd_nr) { + nr = rd_nr; +- range = rd_nr; ++ range = rd_nr << part_shift; + } else { + nr = CONFIG_BLK_DEV_RAM_COUNT; +- range = 1UL << (MINORBITS - part_shift); ++ range = 1UL << MINORBITS; + } + + if (register_blkdev(RAMDISK_MAJOR, "ramdisk")) +@@ -581,7 +581,7 @@ static void __exit brd_exit(void) + unsigned long range; + struct brd_device *brd, *next; + +- range = rd_nr ? rd_nr : 1UL << (MINORBITS - part_shift); ++ range = rd_nr ? rd_nr << part_shift : 1UL << MINORBITS; + + list_for_each_entry_safe(brd, next, &brd_devices, brd_list) + brd_del_one(brd); +-- +1.7.9.3 + diff --git a/next_round/brd-limit-max_part-module-param-to-DISK_MAX_PARTS.patch b/next_round/brd-limit-max_part-module-param-to-DISK_MAX_PARTS.patch new file mode 100644 index 0000000..dc98b5c --- /dev/null +++ b/next_round/brd-limit-max_part-module-param-to-DISK_MAX_PARTS.patch @@ -0,0 +1,87 @@ +From 0f9abdd95503521ef3b546eea9a37c1a36d2d5cc Mon Sep 17 00:00:00 2001 +From: Namhyung Kim <namhyung@gmail.com> +Date: Thu, 26 May 2011 21:06:50 +0200 +Subject: [PATCH] brd: limit 'max_part' module param to DISK_MAX_PARTS + +commit 315980c8688c4b06713c1a5fe9d64cdf8ab57a72 upstream. + +The 'max_part' parameter controls the number of maximum partition +a brd device can have. However if a user specifies very large +value it would exceed the limitation of device minor number and +can cause a kernel panic (or, at least, produce invalid device +nodes in some cases). + +On my desktop system, following command kills the kernel. On qemu, +it triggers similar oops but the kernel was alive: + +$ sudo modprobe brd max_part=100000 + BUG: unable to handle kernel NULL pointer dereference at 0000000000000058 + IP: [<ffffffff81110a9a>] sysfs_create_dir+0x2d/0xae + PGD 7af1067 PUD 7b19067 PMD 0 + Oops: 0000 [#1] SMP + last sysfs file: + CPU 0 + Modules linked in: brd(+) + + Pid: 44, comm: insmod Tainted: G W 2.6.39-qemu+ #158 Bochs Bochs + RIP: 0010:[<ffffffff81110a9a>] [<ffffffff81110a9a>] sysfs_create_dir+0x2d/0xae + RSP: 0018:ffff880007b15d78 EFLAGS: 00000286 + RAX: ffff880007b05478 RBX: ffff880007a52760 RCX: ffff880007b15dc8 + RDX: ffff880007a4f900 RSI: ffff880007b15e48 RDI: ffff880007a52760 + RBP: ffff880007b15da8 R08: 0000000000000002 R09: 0000000000000000 + R10: ffff880007b15e48 R11: ffff880007b05478 R12: 0000000000000000 + R13: ffff880007b05478 R14: 0000000000400920 R15: 0000000000000063 + FS: 0000000002160880(0063) GS:ffff880007c00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000058 CR3: 0000000007b1c000 CR4: 00000000000006b0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 0000000000000000 DR7: 0000000000000000 + Process insmod (pid: 44, threadinfo ffff880007b14000, task ffff880007acb980) + Stack: + ffff880007b15dc8 ffff880007b05478 ffff880007b15da8 00000000fffffffe + ffff880007a52760 ffff880007b05478 ffff880007b15de8 ffffffff81143c0a + 0000000000400920 ffff880007a52760 ffff880007b05478 0000000000000000 + Call Trace: + [<ffffffff81143c0a>] kobject_add_internal+0xdf/0x1a0 + [<ffffffff81143da1>] kobject_add_varg+0x41/0x50 + [<ffffffff81143e6b>] kobject_add+0x64/0x66 + [<ffffffff8113bbe7>] blk_register_queue+0x5f/0xb8 + [<ffffffff81140f72>] add_disk+0xdf/0x289 + [<ffffffffa00040df>] brd_init+0xdf/0x1aa [brd] + [<ffffffffa0004000>] ? 0xffffffffa0003fff + [<ffffffffa0004000>] ? 0xffffffffa0003fff + [<ffffffff8100020a>] do_one_initcall+0x7a/0x12e + [<ffffffff8108516c>] sys_init_module+0x9c/0x1dc + [<ffffffff812ff4bb>] system_call_fastpath+0x16/0x1b + Code: 89 e5 41 55 41 54 53 48 89 fb 48 83 ec 18 48 85 ff 75 04 0f 0b eb fe 48 8b 47 18 49 c7 c4 70 1e 4d 81 48 85 c0 74 04 4c 8b 60 30 + 8b 44 24 58 45 31 ed 0f b6 c4 85 c0 74 0d 48 8b 43 28 48 89 + RIP [<ffffffff81110a9a>] sysfs_create_dir+0x2d/0xae + RSP <ffff880007b15d78> + CR2: 0000000000000058 + ---[ end trace aebb1175ce1f6739 ]--- + +Signed-off-by: Namhyung Kim <namhyung@gmail.com> +Cc: Laurent Vivier <Laurent.Vivier@bull.net> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/block/brd.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/block/brd.c b/drivers/block/brd.c +index 6081e81..9668128 100644 +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -531,6 +531,9 @@ static int __init brd_init(void) + if (max_part > 0) + part_shift = fls(max_part); + ++ if ((1UL << part_shift) > DISK_MAX_PARTS) ++ return -EINVAL; ++ + if (rd_nr > 1UL << (MINORBITS - part_shift)) + return -EINVAL; + +-- +1.7.9.3 + diff --git a/next_round/cpuidle-menu-fixed-wrapping-timers-at-4.294-seconds.patch b/next_round/cpuidle-menu-fixed-wrapping-timers-at-4.294-seconds.patch new file mode 100644 index 0000000..9b72fdb --- /dev/null +++ b/next_round/cpuidle-menu-fixed-wrapping-timers-at-4.294-seconds.patch @@ -0,0 +1,47 @@ +From dfed9a2db60ca5fb238a2d03c689f414e41495e5 Mon Sep 17 00:00:00 2001 +From: Tero Kristo <tero.kristo@nokia.com> +Date: Thu, 24 Feb 2011 17:19:23 +0200 +Subject: [PATCH] cpuidle: menu: fixed wrapping timers at 4.294 seconds + +commit 7467571f4480b273007517b26297c07154c73924 upstream. + +Cpuidle menu governor is using u32 as a temporary datatype for storing +nanosecond values which wrap around at 4.294 seconds. This causes errors +in predicted sleep times resulting in higher than should be C state +selection and increased power consumption. This also breaks cpuidle +state residency statistics. + +cc: stable@kernel.org # .32.x through .39.x +Signed-off-by: Tero Kristo <tero.kristo@nokia.com> +Signed-off-by: Len Brown <len.brown@intel.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/cpuidle/governors/menu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c +index f8e57c6..0537437 100644 +--- a/drivers/cpuidle/governors/menu.c ++++ b/drivers/cpuidle/governors/menu.c +@@ -185,6 +185,7 @@ static int menu_select(struct cpuidle_device *dev) + int latency_req = pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY); + int i; + int multiplier; ++ struct timespec t; + + if (data->needs_update) { + menu_update(dev); +@@ -199,8 +200,9 @@ static int menu_select(struct cpuidle_device *dev) + return 0; + + /* determine the expected residency time, round up */ ++ t = ktime_to_timespec(tick_nohz_get_sleep_length()); + data->expected_us = +- DIV_ROUND_UP((u32)ktime_to_ns(tick_nohz_get_sleep_length()), 1000); ++ t.tv_sec * USEC_PER_SEC + t.tv_nsec / NSEC_PER_USEC; + + + data->bucket = which_bucket(data->expected_us); +-- +1.7.9.3 + diff --git a/next_round/dm-table-reject-devices-without-request-fns.patch b/next_round/dm-table-reject-devices-without-request-fns.patch new file mode 100644 index 0000000..2874710 --- /dev/null +++ b/next_round/dm-table-reject-devices-without-request-fns.patch @@ -0,0 +1,80 @@ +From e451bf4dc02cb8a2b2fc1d2b956ffc19be3d3065 Mon Sep 17 00:00:00 2001 +From: Milan Broz <mbroz@redhat.com> +Date: Sun, 29 May 2011 13:02:52 +0100 +Subject: [PATCH] dm table: reject devices without request fns + +commit f4808ca99a203f20b4475601748e44b25a65bdec upstream. + +This patch adds a check that a block device has a request function +defined before it is used. Otherwise, misconfiguration can cause an oops. + +Because we are allowing devices with zero size e.g. an offline multipath +device as in commit 2cd54d9bedb79a97f014e86c0da393416b264eb3 +("dm: allow offline devices") there needs to be an additional check +to ensure devices are initialised. Some block devices, like a loop +device without a backing file, exist but have no request function. + +Reproducer is trivial: dm-mirror on unbound loop device +(no backing file on loop devices) + +dmsetup create x --table "0 8 mirror core 2 8 sync 2 /dev/loop0 0 /dev/loop1 0" + +and mirror resync will immediatelly cause OOps. + +BUG: unable to handle kernel NULL pointer dereference at (null) + ? generic_make_request+0x2bd/0x590 + ? kmem_cache_alloc+0xad/0x190 + submit_bio+0x53/0xe0 + ? bio_add_page+0x3b/0x50 + dispatch_io+0x1ca/0x210 [dm_mod] + ? read_callback+0x0/0xd0 [dm_mirror] + dm_io+0xbb/0x290 [dm_mod] + do_mirror+0x1e0/0x748 [dm_mirror] + +Signed-off-by: Milan Broz <mbroz@redhat.com> +Reported-by: Zdenek Kabelac <zkabelac@redhat.com> +Acked-by: Mike Snitzer <snitzer@redhat.com> +Signed-off-by: Alasdair G Kergon <agk@redhat.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/md/dm-table.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index 4a83321..ebb3864 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -352,6 +352,7 @@ static void close_dev(struct dm_dev_internal *d, struct mapped_device *md) + static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev, + sector_t start, sector_t len, void *data) + { ++ struct request_queue *q; + struct queue_limits *limits = data; + struct block_device *bdev = dev->bdev; + sector_t dev_size = +@@ -360,6 +361,22 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev, + limits->logical_block_size >> SECTOR_SHIFT; + char b[BDEVNAME_SIZE]; + ++ /* ++ * Some devices exist without request functions, ++ * such as loop devices not yet bound to backing files. ++ * Forbid the use of such devices. ++ */ ++ q = bdev_get_queue(bdev); ++ if (!q || !q->make_request_fn) { ++ DMWARN("%s: %s is not yet initialised: " ++ "start=%llu, len=%llu, dev_size=%llu", ++ dm_device_name(ti->table->md), bdevname(bdev, b), ++ (unsigned long long)start, ++ (unsigned long long)len, ++ (unsigned long long)dev_size); ++ return 1; ++ } ++ + if (!dev_size) + return 0; + +-- +1.7.9.3 + diff --git a/next_round/drm-i915-Add-a-no-lvds-quirk-for-the-Asus-EeeBox-PC-.patch b/next_round/drm-i915-Add-a-no-lvds-quirk-for-the-Asus-EeeBox-PC-.patch new file mode 100644 index 0000000..45749a7 --- /dev/null +++ b/next_round/drm-i915-Add-a-no-lvds-quirk-for-the-Asus-EeeBox-PC-.patch @@ -0,0 +1,42 @@ +From d2eea157e00493368fd50baa97a9a27a9a91bde0 Mon Sep 17 00:00:00 2001 +From: Hans de Goede <hdegoede@redhat.com> +Date: Sat, 4 Jun 2011 15:39:21 +0200 +Subject: [PATCH] drm/i915: Add a no lvds quirk for the Asus EeeBox PC EB1007 + +commit 6a574b5b9b186e28abd3e571dfd1700c5220b510 upstream. + +I found this while figuring out why gnome-shell would not run on my +Asus EeeBox PC EB1007. As a standalone "pc" this device cleary does not have +an internal panel, yet it claims it does. Add a quirk to fix this. + +Signed-off-by: Hans de Goede <hdegoede@redhat.com> +Reviewed-by: Keith Packard <keithp@keithp.com> +cc: stable@kernel.org +Signed-off-by: Keith Packard <keithp@keithp.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/gpu/drm/i915/intel_lvds.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c +index 4072b0d..1183b42 100644 +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -876,6 +876,14 @@ static const struct dmi_system_id intel_no_lvds[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "U800"), + }, + }, ++ { ++ .callback = intel_no_lvds_dmi_callback, ++ .ident = "Asus EeeBox PC EB1007", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "EB1007"), ++ }, ++ }, + + { } /* terminating entry */ + }; +-- +1.7.9.3 + diff --git a/next_round/drm-radeon-kms-fix-for-radeon-on-systems-4GB-without.patch b/next_round/drm-radeon-kms-fix-for-radeon-on-systems-4GB-without.patch new file mode 100644 index 0000000..ce07f56 --- /dev/null +++ b/next_round/drm-radeon-kms-fix-for-radeon-on-systems-4GB-without.patch @@ -0,0 +1,46 @@ +From c55f5ee3433a1092ecd843521fbd3011c70a1b2a Mon Sep 17 00:00:00 2001 +From: Daniel Haid <d.haid@gogi.tv> +Date: Wed, 8 Jun 2011 20:04:45 +1000 +Subject: [PATCH] drm/radeon/kms: fix for radeon on systems >4GB without + hardware iommu + +commit 62fff811d73095bd95579d72f558f03c78f7914a upstream. + +On my x86_64 system with >4GB of ram and swiotlb instead of +a hardware iommu (because I have a VIA chipset), the call +to pci_set_dma_mask (see below) with 40bits returns an error. + +But it seems that the radeon driver is designed to have +need_dma32 = true exactly if pci_set_dma_mask is called +with 32 bits and false if it is called with 40 bits. + +I have read somewhere that the default are 32 bits. So if the +call fails I suppose that need_dma32 should be set to true. + +And indeed the patch fixes the problem I have had before +and which I had described here: +http://choon.net/forum/read.php?21,106131,115940 + +Acked-by: Alex Deucher <alexdeucher@gmail.com> +cc: stable@kernel.org +Signed-off-by: Dave Airlie <airlied@redhat.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/gpu/drm/radeon/radeon_device.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c +index 2008481..feff1c8 100644 +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -641,6 +641,7 @@ int radeon_device_init(struct radeon_device *rdev, + dma_bits = rdev->need_dma32 ? 32 : 40; + r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(dma_bits)); + if (r) { ++ rdev->need_dma32 = true; + printk(KERN_WARNING "radeon: No suitable DMA available.\n"); + } + +-- +1.7.9.3 + diff --git a/next_round/eCryptfs-Allow-2-scatterlist-entries-for-encrypted-f.patch b/next_round/eCryptfs-Allow-2-scatterlist-entries-for-encrypted-f.patch new file mode 100644 index 0000000..56bad12 --- /dev/null +++ b/next_round/eCryptfs-Allow-2-scatterlist-entries-for-encrypted-f.patch @@ -0,0 +1,145 @@ +From 1f0f680c930ac53eab341cddd4cc903a88f0a993 Mon Sep 17 00:00:00 2001 +From: Tyler Hicks <tyhicks@linux.vnet.ibm.com> +Date: Tue, 17 May 2011 00:50:33 -0500 +Subject: [PATCH] eCryptfs: Allow 2 scatterlist entries for encrypted + filenames + +commit 8d08dab786ad5cc2aca2bf870de370144b78c85a upstream. + +The buffers allocated while encrypting and decrypting long filenames can +sometimes straddle two pages. In this situation, virt_to_scatterlist() +will return -ENOMEM, causing the operation to fail and the user will get +scary error messages in their logs: + +kernel: ecryptfs_write_tag_70_packet: Internal error whilst attempting +to convert filename memory to scatterlist; expected rc = 1; got rc = +[-12]. block_aligned_filename_size = [272] +kernel: ecryptfs_encrypt_filename: Error attempting to generate tag 70 +packet; rc = [-12] +kernel: ecryptfs_encrypt_and_encode_filename: Error attempting to +encrypt filename; rc = [-12] +kernel: ecryptfs_lookup: Error attempting to encrypt and encode +filename; rc = [-12] + +The solution is to allow up to 2 scatterlist entries to be used. + +Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + fs/ecryptfs/keystore.c | 46 +++++++++++++++++++++------------------------- + 1 file changed, 21 insertions(+), 25 deletions(-) + +diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c +index d6e9355..07f23c5 100644 +--- a/fs/ecryptfs/keystore.c ++++ b/fs/ecryptfs/keystore.c +@@ -482,8 +482,8 @@ struct ecryptfs_write_tag_70_packet_silly_stack { + struct mutex *tfm_mutex; + char *block_aligned_filename; + struct ecryptfs_auth_tok *auth_tok; +- struct scatterlist src_sg; +- struct scatterlist dst_sg; ++ struct scatterlist src_sg[2]; ++ struct scatterlist dst_sg[2]; + struct blkcipher_desc desc; + char iv[ECRYPTFS_MAX_IV_BYTES]; + char hash[ECRYPTFS_TAG_70_DIGEST_SIZE]; +@@ -696,23 +696,21 @@ ecryptfs_write_tag_70_packet(char *dest, size_t *remaining_bytes, + memcpy(&s->block_aligned_filename[s->num_rand_bytes], filename, + filename_size); + rc = virt_to_scatterlist(s->block_aligned_filename, +- s->block_aligned_filename_size, &s->src_sg, 1); +- if (rc != 1) { ++ s->block_aligned_filename_size, s->src_sg, 2); ++ if (rc < 1) { + printk(KERN_ERR "%s: Internal error whilst attempting to " +- "convert filename memory to scatterlist; " +- "expected rc = 1; got rc = [%d]. " ++ "convert filename memory to scatterlist; rc = [%d]. " + "block_aligned_filename_size = [%zd]\n", __func__, rc, + s->block_aligned_filename_size); + goto out_release_free_unlock; + } + rc = virt_to_scatterlist(&dest[s->i], s->block_aligned_filename_size, +- &s->dst_sg, 1); +- if (rc != 1) { ++ s->dst_sg, 2); ++ if (rc < 1) { + printk(KERN_ERR "%s: Internal error whilst attempting to " + "convert encrypted filename memory to scatterlist; " +- "expected rc = 1; got rc = [%d]. " +- "block_aligned_filename_size = [%zd]\n", __func__, rc, +- s->block_aligned_filename_size); ++ "rc = [%d]. block_aligned_filename_size = [%zd]\n", ++ __func__, rc, s->block_aligned_filename_size); + goto out_release_free_unlock; + } + /* The characters in the first block effectively do the job +@@ -735,7 +733,7 @@ ecryptfs_write_tag_70_packet(char *dest, size_t *remaining_bytes, + mount_crypt_stat->global_default_fn_cipher_key_bytes); + goto out_release_free_unlock; + } +- rc = crypto_blkcipher_encrypt_iv(&s->desc, &s->dst_sg, &s->src_sg, ++ rc = crypto_blkcipher_encrypt_iv(&s->desc, s->dst_sg, s->src_sg, + s->block_aligned_filename_size); + if (rc) { + printk(KERN_ERR "%s: Error attempting to encrypt filename; " +@@ -767,8 +765,8 @@ struct ecryptfs_parse_tag_70_packet_silly_stack { + struct mutex *tfm_mutex; + char *decrypted_filename; + struct ecryptfs_auth_tok *auth_tok; +- struct scatterlist src_sg; +- struct scatterlist dst_sg; ++ struct scatterlist src_sg[2]; ++ struct scatterlist dst_sg[2]; + struct blkcipher_desc desc; + char fnek_sig_hex[ECRYPTFS_SIG_SIZE_HEX + 1]; + char iv[ECRYPTFS_MAX_IV_BYTES]; +@@ -873,13 +871,12 @@ ecryptfs_parse_tag_70_packet(char **filename, size_t *filename_size, + } + mutex_lock(s->tfm_mutex); + rc = virt_to_scatterlist(&data[(*packet_size)], +- s->block_aligned_filename_size, &s->src_sg, 1); +- if (rc != 1) { ++ s->block_aligned_filename_size, s->src_sg, 2); ++ if (rc < 1) { + printk(KERN_ERR "%s: Internal error whilst attempting to " + "convert encrypted filename memory to scatterlist; " +- "expected rc = 1; got rc = [%d]. " +- "block_aligned_filename_size = [%zd]\n", __func__, rc, +- s->block_aligned_filename_size); ++ "rc = [%d]. block_aligned_filename_size = [%zd]\n", ++ __func__, rc, s->block_aligned_filename_size); + goto out_unlock; + } + (*packet_size) += s->block_aligned_filename_size; +@@ -893,13 +890,12 @@ ecryptfs_parse_tag_70_packet(char **filename, size_t *filename_size, + goto out_unlock; + } + rc = virt_to_scatterlist(s->decrypted_filename, +- s->block_aligned_filename_size, &s->dst_sg, 1); +- if (rc != 1) { ++ s->block_aligned_filename_size, s->dst_sg, 2); ++ if (rc < 1) { + printk(KERN_ERR "%s: Internal error whilst attempting to " + "convert decrypted filename memory to scatterlist; " +- "expected rc = 1; got rc = [%d]. " +- "block_aligned_filename_size = [%zd]\n", __func__, rc, +- s->block_aligned_filename_size); ++ "rc = [%d]. block_aligned_filename_size = [%zd]\n", ++ __func__, rc, s->block_aligned_filename_size); + goto out_free_unlock; + } + /* The characters in the first block effectively do the job of +@@ -938,7 +934,7 @@ ecryptfs_parse_tag_70_packet(char **filename, size_t *filename_size, + mount_crypt_stat->global_default_fn_cipher_key_bytes); + goto out_free_unlock; + } +- rc = crypto_blkcipher_decrypt_iv(&s->desc, &s->dst_sg, &s->src_sg, ++ rc = crypto_blkcipher_decrypt_iv(&s->desc, s->dst_sg, s->src_sg, + s->block_aligned_filename_size); + if (rc) { + printk(KERN_ERR "%s: Error attempting to decrypt filename; " +-- +1.7.9.3 + diff --git a/next_round/exec-delay-address-limit-change-until-point-of-no-re.patch b/next_round/exec-delay-address-limit-change-until-point-of-no-re.patch new file mode 100644 index 0000000..1f04df8 --- /dev/null +++ b/next_round/exec-delay-address-limit-change-until-point-of-no-re.patch @@ -0,0 +1,81 @@ +From b0984a6beed60483c3ab086458e2803c056d153c Mon Sep 17 00:00:00 2001 +From: Mathias Krause <minipli@googlemail.com> +Date: Thu, 9 Jun 2011 20:05:18 +0200 +Subject: [PATCH] exec: delay address limit change until point of no return + +commit dac853ae89043f1b7752875300faf614de43c74b upstream. + +Unconditionally changing the address limit to USER_DS and not restoring +it to its old value in the error path is wrong because it prevents us +using kernel memory on repeated calls to this function. This, in fact, +breaks the fallback of hard coded paths to the init program from being +ever successful if the first candidate fails to load. + +With this patch applied switching to USER_DS is delayed until the point +of no return is reached which makes it possible to have a multi-arch +rootfs with one arch specific init binary for each of the (hard coded) +probed paths. + +Since the address limit is already set to USER_DS when start_thread() +will be invoked, this redundancy can be safely removed. + +Signed-off-by: Mathias Krause <minipli@googlemail.com> +Cc: Al Viro <viro@zeniv.linux.org.uk> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + arch/x86/kernel/process_32.c | 1 - + arch/x86/kernel/process_64.c | 1 - + fs/exec.c | 5 +---- + 3 files changed, 1 insertion(+), 6 deletions(-) + +diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c +index f6c6266..219141c 100644 +--- a/arch/x86/kernel/process_32.c ++++ b/arch/x86/kernel/process_32.c +@@ -253,7 +253,6 @@ start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp) + { + set_user_gs(regs, 0); + regs->fs = 0; +- set_fs(USER_DS); + regs->ds = __USER_DS; + regs->es = __USER_DS; + regs->ss = __USER_DS; +diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c +index 17cb329..0a18514 100644 +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -345,7 +345,6 @@ start_thread_common(struct pt_regs *regs, unsigned long new_ip, + regs->cs = _cs; + regs->ss = _ss; + regs->flags = X86_EFLAGS_IF; +- set_fs(USER_DS); + /* + * Free the old FP and other extended state + */ +diff --git a/fs/exec.c b/fs/exec.c +index 11cfcce..4afb996 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1020,6 +1020,7 @@ int flush_old_exec(struct linux_binprm * bprm) + + bprm->mm = NULL; /* We're using it now */ + ++ set_fs(USER_DS); + current->flags &= ~PF_RANDOMIZE; + flush_thread(); + current->personality &= ~bprm->per_clear; +@@ -1284,10 +1285,6 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs) + if (retval) + return retval; + +- /* kernel module loader fixup */ +- /* so we don't try to load run modprobe in kernel space. */ +- set_fs(USER_DS); +- + retval = audit_bprm(bprm); + if (retval) + return retval; +-- +1.7.9.3 + diff --git a/next_round/ext3-Fix-fs-corruption-when-make_indexed_dir-fails.patch b/next_round/ext3-Fix-fs-corruption-when-make_indexed_dir-fails.patch new file mode 100644 index 0000000..41e351d --- /dev/null +++ b/next_round/ext3-Fix-fs-corruption-when-make_indexed_dir-fails.patch @@ -0,0 +1,58 @@ +From eadbba5fa689cc5a787ce189edc62a4653c61f6c Mon Sep 17 00:00:00 2001 +From: Jan Kara <jack@suse.cz> +Date: Wed, 27 Apr 2011 18:20:44 +0200 +Subject: [PATCH] ext3: Fix fs corruption when make_indexed_dir() fails + +commit 86c4f6d85595cd7da635dc6985d27bfa43b1ae10 upstream. + +When make_indexed_dir() fails (e.g. because of ENOSPC) after it has allocated +block for index tree root, we did not properly mark all changed buffers dirty. +This lead to only some of these buffers being written out and thus effectively +corrupting the directory. + +Fix the issue by marking all changed data dirty even in the error failure case. + +Signed-off-by: Jan Kara <jack@suse.cz> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + fs/ext3/namei.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c +index 827b573..a97b96a 100644 +--- a/fs/ext3/namei.c ++++ b/fs/ext3/namei.c +@@ -1425,10 +1425,19 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry, + frame->at = entries; + frame->bh = bh; + bh = bh2; ++ /* ++ * Mark buffers dirty here so that if do_split() fails we write a ++ * consistent set of buffers to disk. ++ */ ++ ext3_journal_dirty_metadata(handle, frame->bh); ++ ext3_journal_dirty_metadata(handle, bh); + de = do_split(handle,dir, &bh, frame, &hinfo, &retval); +- dx_release (frames); +- if (!(de)) ++ if (!de) { ++ ext3_mark_inode_dirty(handle, dir); ++ dx_release(frames); + return retval; ++ } ++ dx_release(frames); + + return add_dirent_to_buf(handle, dentry, inode, de, bh); + } +@@ -2214,7 +2223,7 @@ retry: + drop_nlink(inode); + unlock_new_inode(inode); + ext3_mark_inode_dirty(handle, inode); +- iput (inode); ++ iput(inode); + goto out_stop; + } + } else { +-- +1.7.9.3 + diff --git a/next_round/ext4-release-page-cache-in-ext4_mb_load_buddy-error-.patch b/next_round/ext4-release-page-cache-in-ext4_mb_load_buddy-error-.patch new file mode 100644 index 0000000..923c086 --- /dev/null +++ b/next_round/ext4-release-page-cache-in-ext4_mb_load_buddy-error-.patch @@ -0,0 +1,32 @@ +From a20370583b26e7c6f5d66dc5cb9b766a3e285569 Mon Sep 17 00:00:00 2001 +From: Yang Ruirui <ruirui.r.yang@tieto.com> +Date: Sat, 16 Apr 2011 19:17:48 -0400 +Subject: [PATCH] ext4: release page cache in ext4_mb_load_buddy error path + +commit 26626f1172fb4f3f323239a6a5cf4e082643fa46 upstream. + +Add missing page_cache_release in the error path of ext4_mb_load_buddy + +Signed-off-by: Yang Ruirui <ruirui.r.yang@tieto.com> +Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + fs/ext4/mballoc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 917fe78..f1c9a84 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -1173,6 +1173,8 @@ repeat_load_buddy: + return 0; + + err: ++ if (page) ++ page_cache_release(page); + if (e4b->bd_bitmap_page) + page_cache_release(e4b->bd_bitmap_page); + if (e4b->bd_buddy_page) +-- +1.7.9.3 + diff --git a/next_round/fat-Fix-corrupt-inode-flags-when-remove-ATTR_SYS-fla.patch b/next_round/fat-Fix-corrupt-inode-flags-when-remove-ATTR_SYS-fla.patch new file mode 100644 index 0000000..d0548c6 --- /dev/null +++ b/next_round/fat-Fix-corrupt-inode-flags-when-remove-ATTR_SYS-fla.patch @@ -0,0 +1,32 @@ +From 6817fdf2f9c70cf3eb4f9d54d249fe09fc84dd69 Mon Sep 17 00:00:00 2001 +From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> +Date: Tue, 31 May 2011 19:38:07 +0900 +Subject: [PATCH] fat: Fix corrupt inode flags when remove ATTR_SYS flag + +commit 1adffbae22332bb558c2a29de19d9aca391869f6 upstream. + +We are clearly missing '~' in fat_ioctl_set_attributes(). + +Reported-by: Dmitry Dmitriev <dimondmm@yandex.ru> +Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + fs/fat/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/fat/file.c b/fs/fat/file.c +index e8c159d..279937b 100644 +--- a/fs/fat/file.c ++++ b/fs/fat/file.c +@@ -101,7 +101,7 @@ static int fat_ioctl_set_attributes(struct file *file, u32 __user *user_attr) + if (attr & ATTR_SYS) + inode->i_flags |= S_IMMUTABLE; + else +- inode->i_flags &= S_IMMUTABLE; ++ inode->i_flags &= ~S_IMMUTABLE; + } + + fat_save_attrs(inode, attr); +-- +1.7.9.3 + diff --git a/next_round/ftrace-Only-update-the-function-code-on-write-to-fil.patch b/next_round/ftrace-Only-update-the-function-code-on-write-to-fil.patch new file mode 100644 index 0000000..8dd5011 --- /dev/null +++ b/next_round/ftrace-Only-update-the-function-code-on-write-to-fil.patch @@ -0,0 +1,47 @@ +From b8f3a1dba962000fcc9691489611315be3a3fd2f Mon Sep 17 00:00:00 2001 +From: Steven Rostedt <srostedt@redhat.com> +Date: Fri, 29 Apr 2011 22:35:33 -0400 +Subject: [PATCH] ftrace: Only update the function code on write to filter + files + +commit 058e297d34a404caaa5ed277de15698d8dc43000 upstream. + +If function tracing is enabled, a read of the filter files will +cause the call to stop_machine to update the function trace sites. +It should only call stop_machine on write. + +Signed-off-by: Steven Rostedt <rostedt@goodmis.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + kernel/trace/ftrace.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index e28af02..7dd746c 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -2355,14 +2355,16 @@ ftrace_regex_release(struct inode *inode, struct file *file, int enable) + ftrace_match_records(parser->buffer, parser->idx, enable); + } + +- mutex_lock(&ftrace_lock); +- if (ftrace_start_up && ftrace_enabled) +- ftrace_run_update_code(FTRACE_ENABLE_CALLS); +- mutex_unlock(&ftrace_lock); +- + trace_parser_put(parser); + kfree(iter); + ++ if (file->f_mode & FMODE_WRITE) { ++ mutex_lock(&ftrace_lock); ++ if (ftrace_start_up && ftrace_enabled) ++ ftrace_run_update_code(FTRACE_ENABLE_CALLS); ++ mutex_unlock(&ftrace_lock); ++ } ++ + mutex_unlock(&ftrace_regex_lock); + return 0; + } +-- +1.7.9.3 + diff --git a/next_round/genirq-Add-IRQF_FORCE_RESUME.patch b/next_round/genirq-Add-IRQF_FORCE_RESUME.patch new file mode 100644 index 0000000..cbfacbb --- /dev/null +++ b/next_round/genirq-Add-IRQF_FORCE_RESUME.patch @@ -0,0 +1,80 @@ +From b99113fef0b34efde93f59e851dbcf54324e992d Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner <tglx@linutronix.de> +Date: Fri, 4 Feb 2011 13:19:20 +0100 +Subject: [PATCH] genirq: Add IRQF_FORCE_RESUME + +commit dc5f219e88294b93009eef946251251ffffb6d60 upstream. + +Xen needs to reenable interrupts which are marked IRQF_NO_SUSPEND in the +resume path. Add a flag to force the reenabling in the resume code. + +Tested-and-acked-by: Ian Campbell <Ian.Campbell@eu.citrix.com> +Signed-off-by: Thomas Gleixner <tglx@linutronix.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + include/linux/interrupt.h | 3 ++- + kernel/irq/manage.c | 11 ++++++++++- + kernel/irq/pm.c | 3 --- + 3 files changed, 12 insertions(+), 5 deletions(-) + +diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h +index 01db7a1..953ff1c 100644 +--- a/include/linux/interrupt.h ++++ b/include/linux/interrupt.h +@@ -53,7 +53,7 @@ + * Used by threaded interrupts which need to keep the + * irq line disabled until the threaded handler has been run. + * IRQF_NO_SUSPEND - Do not disable this IRQ during suspend +- * ++ * IRQF_FORCE_RESUME - Force enable it on resume even if IRQF_NO_SUSPEND is set + */ + #define IRQF_DISABLED 0x00000020 + #define IRQF_SAMPLE_RANDOM 0x00000040 +@@ -65,6 +65,7 @@ + #define IRQF_IRQPOLL 0x00001000 + #define IRQF_ONESHOT 0x00002000 + #define IRQF_NO_SUSPEND 0x00004000 ++#define IRQF_FORCE_RESUME 0x00008000 + + #define IRQF_TIMER (__IRQF_TIMER | IRQF_NO_SUSPEND) + +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index 8305828..46f10b1 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -265,8 +265,17 @@ EXPORT_SYMBOL(disable_irq); + + void __enable_irq(struct irq_desc *desc, unsigned int irq, bool resume) + { +- if (resume) ++ if (resume) { ++ if (!(desc->status & IRQ_SUSPENDED)) { ++ if (!desc->action) ++ return; ++ if (!(desc->action->flags & IRQF_FORCE_RESUME)) ++ return; ++ /* Pretend that it got disabled ! */ ++ desc->depth++; ++ } + desc->status &= ~IRQ_SUSPENDED; ++ } + + switch (desc->depth) { + case 0: +diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c +index 0d4005d8..d6bfb89 100644 +--- a/kernel/irq/pm.c ++++ b/kernel/irq/pm.c +@@ -53,9 +53,6 @@ void resume_device_irqs(void) + for_each_irq_desc(irq, desc) { + unsigned long flags; + +- if (!(desc->status & IRQ_SUSPENDED)) +- continue; +- + raw_spin_lock_irqsave(&desc->lock, flags); + __enable_irq(desc, irq, true); + raw_spin_unlock_irqrestore(&desc->lock, flags); +-- +1.7.9.3 + diff --git a/next_round/i8k-Avoid-lahf-in-64-bit-code.patch b/next_round/i8k-Avoid-lahf-in-64-bit-code.patch new file mode 100644 index 0000000..6a7f991 --- /dev/null +++ b/next_round/i8k-Avoid-lahf-in-64-bit-code.patch @@ -0,0 +1,41 @@ +From 7a505ee6d2bdbfb8e4380980c7b16a29bd788f1b Mon Sep 17 00:00:00 2001 +From: Luca Tettamanti <kronos.it@gmail.com> +Date: Wed, 25 May 2011 20:43:31 +0200 +Subject: [PATCH] i8k: Avoid lahf in 64-bit code + +commit bc1f419c76a2d6450413ce4349f4e4a07be011d5 upstream. + +i8k uses lahf to read the flag register in 64-bit code; early x86-64 +CPUs, however, lack this instruction and we get an invalid opcode +exception at runtime. +Use pushf to load the flag register into the stack instead. + +Signed-off-by: Luca Tettamanti <kronos.it@gmail.com> +Reported-by: Jeff Rickman <jrickman@myamigos.us> +Tested-by: Jeff Rickman <jrickman@myamigos.us> +Tested-by: Harry G McGavran Jr <w5pny@arrl.net> +Cc: Massimo Dal Zotto <dz@debian.org> +Signed-off-by: Jean Delvare <khali@linux-fr.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/char/i8k.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c +index 4365717..1e116ac 100644 +--- a/drivers/char/i8k.c ++++ b/drivers/char/i8k.c +@@ -138,8 +138,8 @@ static int i8k_smm(struct smm_regs *regs) + "movl %%edi,20(%%rax)\n\t" + "popq %%rdx\n\t" + "movl %%edx,0(%%rax)\n\t" +- "lahf\n\t" +- "shrl $8,%%eax\n\t" ++ "pushfq\n\t" ++ "popq %%rax\n\t" + "andl $1,%%eax\n" + :"=a"(rc) + : "a"(regs) +-- +1.7.9.3 + diff --git a/next_round/jbd-Fix-forever-sleeping-process-in-do_get_write_acc.patch b/next_round/jbd-Fix-forever-sleeping-process-in-do_get_write_acc.patch new file mode 100644 index 0000000..81c372f --- /dev/null +++ b/next_round/jbd-Fix-forever-sleeping-process-in-do_get_write_acc.patch @@ -0,0 +1,45 @@ +From ba5d38dcdb2c6586f514be25ef7055e0aeba376f Mon Sep 17 00:00:00 2001 +From: Jan Kara <jack@suse.cz> +Date: Thu, 5 May 2011 13:59:35 +0200 +Subject: [PATCH] jbd: Fix forever sleeping process in do_get_write_access() + +commit 2842bb20eed2e25cde5114298edc62c8883a1d9a upstream. + +In do_get_write_access() we wait on BH_Unshadow bit for buffer to get +from shadow state. The waking code in journal_commit_transaction() has +a bug because it does not issue a memory barrier after the buffer is moved +from the shadow state and before wake_up_bit() is called. Thus a waitqueue +check can happen before the buffer is actually moved from the shadow state +and waiting process may never be woken. Fix the problem by issuing proper +barrier. + +Reported-by: Tao Ma <boyu.mt@taobao.com> +Signed-off-by: Jan Kara <jack@suse.cz> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + fs/jbd/commit.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/fs/jbd/commit.c b/fs/jbd/commit.c +index ecb44c9..1df9270 100644 +--- a/fs/jbd/commit.c ++++ b/fs/jbd/commit.c +@@ -745,8 +745,13 @@ wait_for_iobuf: + required. */ + JBUFFER_TRACE(jh, "file as BJ_Forget"); + journal_file_buffer(jh, commit_transaction, BJ_Forget); +- /* Wake up any transactions which were waiting for this +- IO to complete */ ++ /* ++ * Wake up any transactions which were waiting for this ++ * IO to complete. The barrier must be here so that changes ++ * by journal_file_buffer() take effect before wake_up_bit() ++ * does the waitqueue check. ++ */ ++ smp_mb(); + wake_up_bit(&bh->b_state, BH_Unshadow); + JBUFFER_TRACE(jh, "brelse shadowed buffer"); + __brelse(bh); +-- +1.7.9.3 + diff --git a/next_round/jbd-fix-fsync-tid-wraparound-bug.patch b/next_round/jbd-fix-fsync-tid-wraparound-bug.patch new file mode 100644 index 0000000..54fb3ac --- /dev/null +++ b/next_round/jbd-fix-fsync-tid-wraparound-bug.patch @@ -0,0 +1,70 @@ +From 8571ec39cb45cc101646096dbd611c73031f360d Mon Sep 17 00:00:00 2001 +From: Ted Ts'o <tytso@mit.edu> +Date: Sat, 30 Apr 2011 13:17:11 -0400 +Subject: [PATCH] jbd: fix fsync() tid wraparound bug + +commit d9b01934d56a96d9f4ae2d6204d4ea78a36f5f36 upstream. + +If an application program does not make any changes to the indirect +blocks or extent tree, i_datasync_tid will not get updated. If there +are enough commits (i.e., 2**31) such that tid_geq()'s calculations +wrap, and there isn't a currently active transaction at the time of +the fdatasync() call, this can end up triggering a BUG_ON in +fs/jbd/commit.c: + + J_ASSERT(journal->j_running_transaction != NULL); + +It's pretty rare that this can happen, since it requires the use of +fdatasync() plus *very* frequent and excessive use of fsync(). But +with the right workload, it can. + +We fix this by replacing the use of tid_geq() with an equality test, +since there's only one valid transaction id that is valid for us to +start: namely, the currently running transaction (if it exists). + +Reported-by: Martin_Zielinski@McAfee.com +Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> +Signed-off-by: Jan Kara <jack@suse.cz> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + fs/jbd/journal.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c +index bd224ee..45905ff 100644 +--- a/fs/jbd/journal.c ++++ b/fs/jbd/journal.c +@@ -435,9 +435,12 @@ int __log_space_left(journal_t *journal) + int __log_start_commit(journal_t *journal, tid_t target) + { + /* +- * Are we already doing a recent enough commit? ++ * The only transaction we can possibly wait upon is the ++ * currently running transaction (if it exists). Otherwise, ++ * the target tid must be an old one. + */ +- if (!tid_geq(journal->j_commit_request, target)) { ++ if (journal->j_running_transaction && ++ journal->j_running_transaction->t_tid == target) { + /* + * We want a new commit: OK, mark the request and wakup the + * commit thread. We do _not_ do the commit ourselves. +@@ -449,7 +452,14 @@ int __log_start_commit(journal_t *journal, tid_t target) + journal->j_commit_sequence); + wake_up(&journal->j_wait_commit); + return 1; +- } ++ } else if (!tid_geq(journal->j_commit_request, target)) ++ /* This should never happen, but if it does, preserve ++ the evidence before kjournald goes into a loop and ++ increments j_commit_sequence beyond all recognition. */ ++ WARN_ONCE(1, "jbd: bad log_start_commit: %u %u %u %u\n", ++ journal->j_commit_request, journal->j_commit_sequence, ++ target, journal->j_running_transaction ? ++ journal->j_running_transaction->t_tid : 0); + return 0; + } + +-- +1.7.9.3 + diff --git a/next_round/kmemleak-Do-not-return-a-pointer-to-an-object-that-k.patch b/next_round/kmemleak-Do-not-return-a-pointer-to-an-object-that-k.patch new file mode 100644 index 0000000..7393203 --- /dev/null +++ b/next_round/kmemleak-Do-not-return-a-pointer-to-an-object-that-k.patch @@ -0,0 +1,44 @@ +From ac09dfc5337813bca9a14782ac4620cdf6a99bfe Mon Sep 17 00:00:00 2001 +From: Catalin Marinas <catalin.marinas@arm.com> +Date: Wed, 27 Apr 2011 16:44:26 +0100 +Subject: [PATCH] kmemleak: Do not return a pointer to an object that kmemleak + did not get + +commit 52c3ce4ec5601ee383a14f1485f6bac7b278896e upstream. + +The kmemleak_seq_next() function tries to get an object (and increment +its use count) before returning it. If it could not get the last object +during list traversal (because it may have been freed), the function +should return NULL rather than a pointer to such object that it did not +get. + +Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> +Reported-by: Phil Carmody <ext-phil.2.carmody@nokia.com> +Acked-by: Phil Carmody <ext-phil.2.carmody@nokia.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + mm/kmemleak.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/mm/kmemleak.c b/mm/kmemleak.c +index 2c0d032..49c94b5 100644 +--- a/mm/kmemleak.c ++++ b/mm/kmemleak.c +@@ -1368,9 +1368,12 @@ static void *kmemleak_seq_next(struct seq_file *seq, void *v, loff_t *pos) + ++(*pos); + + list_for_each_continue_rcu(n, &object_list) { +- next_obj = list_entry(n, struct kmemleak_object, object_list); +- if (get_object(next_obj)) ++ struct kmemleak_object *obj = ++ list_entry(n, struct kmemleak_object, object_list); ++ if (get_object(obj)) { ++ next_obj = obj; + break; ++ } + } + + put_object(prev_obj); +-- +1.7.9.3 + diff --git a/next_round/lockdep-Fix-lock_is_held-on-recursion.patch b/next_round/lockdep-Fix-lock_is_held-on-recursion.patch new file mode 100644 index 0000000..a8d98af --- /dev/null +++ b/next_round/lockdep-Fix-lock_is_held-on-recursion.patch @@ -0,0 +1,42 @@ +From ad62a152f33fdfccf2cb8e0e9dfb4b966d9ead62 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <a.p.zijlstra@chello.nl> +Date: Mon, 6 Jun 2011 12:32:43 +0200 +Subject: [PATCH] lockdep: Fix lock_is_held() on recursion + +commit f2513cde93f0957d5dc6c09bc24b0cccd27d8e1d upstream. + +The main lock_is_held() user is lockdep_assert_held(), avoid false +assertions in lockdep_off() sections by unconditionally reporting the +lock is taken. + +[ the reason this is important is a lockdep_assert_held() in ttwu() + which triggers a warning under lockdep_off() as in printk() which + can trigger another wakeup and lock up due to spinlock + recursion, as reported and heroically debugged by Arne Jansen ] + +Reported-and-tested-by: Arne Jansen <lists@die-jansens.de> +Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> +Cc: Linus Torvalds <torvalds@linux-foundation.org> +Link: http://lkml.kernel.org/r/1307398759.2497.966.camel@laptop +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + kernel/lockdep.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/lockdep.c b/kernel/lockdep.c +index 2594e1c..1571452 100644 +--- a/kernel/lockdep.c ++++ b/kernel/lockdep.c +@@ -3240,7 +3240,7 @@ int lock_is_held(struct lockdep_map *lock) + int ret = 0; + + if (unlikely(current->lockdep_recursion)) +- return ret; ++ return 1; /* avoid false negative lockdep_assert_held() */ + + raw_local_irq_save(flags); + check_flags(flags); +-- +1.7.9.3 + diff --git a/next_round/loop-handle-on-demand-devices-correctly.patch b/next_round/loop-handle-on-demand-devices-correctly.patch new file mode 100644 index 0000000..2f8ec46 --- /dev/null +++ b/next_round/loop-handle-on-demand-devices-correctly.patch @@ -0,0 +1,94 @@ +From 76805ac644c1012b72dd360bb5d69c2fe7f8e018 Mon Sep 17 00:00:00 2001 +From: Namhyung Kim <namhyung@gmail.com> +Date: Tue, 24 May 2011 16:48:55 +0200 +Subject: [PATCH] loop: handle on-demand devices correctly + +commit a1c15c59feee36267c43142a41152fbf7402afb6 upstream. + +When finding or allocating a loop device, loop_probe() did not take +partition numbers into account so that it can result to a different +device. Consider following example: + +$ sudo modprobe loop max_part=15 +$ ls -l /dev/loop* +brw-rw---- 1 root disk 7, 0 2011-05-24 22:16 /dev/loop0 +brw-rw---- 1 root disk 7, 16 2011-05-24 22:16 /dev/loop1 +brw-rw---- 1 root disk 7, 32 2011-05-24 22:16 /dev/loop2 +brw-rw---- 1 root disk 7, 48 2011-05-24 22:16 /dev/loop3 +brw-rw---- 1 root disk 7, 64 2011-05-24 22:16 /dev/loop4 +brw-rw---- 1 root disk 7, 80 2011-05-24 22:16 /dev/loop5 +brw-rw---- 1 root disk 7, 96 2011-05-24 22:16 /dev/loop6 +brw-rw---- 1 root disk 7, 112 2011-05-24 22:16 /dev/loop7 +$ sudo mknod /dev/loop8 b 7 128 +$ sudo losetup /dev/loop8 ~/temp/disk-with-3-parts.img +$ sudo losetup -a +/dev/loop128: [0805]:278201 (/home/namhyung/temp/disk-with-3-parts.img) +$ ls -l /dev/loop* +brw-rw---- 1 root disk 7, 0 2011-05-24 22:16 /dev/loop0 +brw-rw---- 1 root disk 7, 16 2011-05-24 22:16 /dev/loop1 +brw-rw---- 1 root disk 7, 2048 2011-05-24 22:18 /dev/loop128 +brw-rw---- 1 root disk 7, 2049 2011-05-24 22:18 /dev/loop128p1 +brw-rw---- 1 root disk 7, 2050 2011-05-24 22:18 /dev/loop128p2 +brw-rw---- 1 root disk 7, 2051 2011-05-24 22:18 /dev/loop128p3 +brw-rw---- 1 root disk 7, 32 2011-05-24 22:16 /dev/loop2 +brw-rw---- 1 root disk 7, 48 2011-05-24 22:16 /dev/loop3 +brw-rw---- 1 root disk 7, 64 2011-05-24 22:16 /dev/loop4 +brw-rw---- 1 root disk 7, 80 2011-05-24 22:16 /dev/loop5 +brw-rw---- 1 root disk 7, 96 2011-05-24 22:16 /dev/loop6 +brw-rw---- 1 root disk 7, 112 2011-05-24 22:16 /dev/loop7 +brw-r--r-- 1 root root 7, 128 2011-05-24 22:17 /dev/loop8 + +After this patch, /dev/loop8 - instead of /dev/loop128 - was +accessed correctly. + +In addition, 'range' passed to blk_register_region() should +include all range of dev_t that LOOP_MAJOR can address. It does +not need to be limited by partition numbers unless 'max_loop' +param was specified. + +Signed-off-by: Namhyung Kim <namhyung@gmail.com> +Cc: Laurent Vivier <Laurent.Vivier@bull.net> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/block/loop.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index bcd26d0..8d1c3c0e 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1571,7 +1571,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data) + struct kobject *kobj; + + mutex_lock(&loop_devices_mutex); +- lo = loop_init_one(dev & MINORMASK); ++ lo = loop_init_one(MINOR(dev) >> part_shift); + kobj = lo ? get_disk(lo->lo_disk) : ERR_PTR(-ENOMEM); + mutex_unlock(&loop_devices_mutex); + +@@ -1612,10 +1612,10 @@ static int __init loop_init(void) + + if (max_loop) { + nr = max_loop; +- range = max_loop; ++ range = max_loop << part_shift; + } else { + nr = 8; +- range = 1UL << (MINORBITS - part_shift); ++ range = 1UL << MINORBITS; + } + + if (register_blkdev(LOOP_MAJOR, "loop")) +@@ -1654,7 +1654,7 @@ static void __exit loop_exit(void) + unsigned long range; + struct loop_device *lo, *next; + +- range = max_loop ? max_loop : 1UL << (MINORBITS - part_shift); ++ range = max_loop ? max_loop << part_shift : 1UL << MINORBITS; + + list_for_each_entry_safe(lo, next, &loop_devices, lo_list) + loop_del_one(lo); +-- +1.7.9.3 + diff --git a/next_round/loop-limit-max_part-module-param-to-DISK_MAX_PARTS.patch b/next_round/loop-limit-max_part-module-param-to-DISK_MAX_PARTS.patch new file mode 100644 index 0000000..c3f833f --- /dev/null +++ b/next_round/loop-limit-max_part-module-param-to-DISK_MAX_PARTS.patch @@ -0,0 +1,89 @@ +From 46a8347c737ff4e9a66a916243179f14a85dfc8f Mon Sep 17 00:00:00 2001 +From: Namhyung Kim <namhyung@gmail.com> +Date: Tue, 24 May 2011 16:48:54 +0200 +Subject: [PATCH] loop: limit 'max_part' module param to DISK_MAX_PARTS + +commit 78f4bb367fd147a0e7e3998ba6e47109999d8814 upstream. + +The 'max_part' parameter controls the number of maximum partition +a loop block device can have. However if a user specifies very +large value it would exceed the limitation of device minor number +and can cause a kernel panic (or, at least, produce invalid +device nodes in some cases). + +On my desktop system, following command kills the kernel. On qemu, +it triggers similar oops but the kernel was alive: + +$ sudo modprobe loop max_part0000 + ------------[ cut here ]------------ + kernel BUG at /media/Linux_Data/project/linux/fs/sysfs/group.c:65! + invalid opcode: 0000 [#1] SMP + last sysfs file: + CPU 0 + Modules linked in: loop(+) + + Pid: 43, comm: insmod Tainted: G W 2.6.39-qemu+ #155 Bochs Bochs + RIP: 0010:[<ffffffff8113ce61>] [<ffffffff8113ce61>] internal_create_group= ++0x2a/0x170 + RSP: 0018:ffff880007b3fde8 EFLAGS: 00000246 + RAX: 00000000ffffffef RBX: ffff880007b3d878 RCX: 00000000000007b4 + RDX: ffffffff8152da50 RSI: 0000000000000000 RDI: ffff880007b3d878 + RBP: ffff880007b3fe38 R08: ffff880007b3fde8 R09: 0000000000000000 + R10: ffff88000783b4a8 R11: ffff880007b3d878 R12: ffffffff8152da50 + R13: ffff880007b3d868 R14: 0000000000000000 R15: ffff880007b3d800 + FS: 0000000002137880(0063) GS:ffff880007c00000(0000) knlGS:00000000000000= +00 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000422680 CR3: 0000000007b50000 CR4: 00000000000006b0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 0000000000000000 DR7: 0000000000000000 + Process insmod (pid: 43, threadinfo ffff880007b3e000, task ffff880007afb9c= +0) + Stack: + ffff880007b3fe58 ffffffff811e66dd ffff880007b3fe58 ffffffff811e570b + 0000000000000010 ffff880007b3d800 ffff880007a7b390 ffff880007b3d868 + 0000000000400920 ffff880007b3d800 ffff880007b3fe48 ffffffff8113cfc8 + Call Trace: + [<ffffffff811e66dd>] ? device_add+0x4bc/0x5af + [<ffffffff811e570b>] ? dev_set_name+0x3c/0x3e + [<ffffffff8113cfc8>] sysfs_create_group+0xe/0x12 + [<ffffffff810b420e>] blk_trace_init_sysfs+0x14/0x16 + [<ffffffff8116a090>] blk_register_queue+0x47/0xf7 + [<ffffffff8116f527>] add_disk+0xdf/0x290 + [<ffffffffa00060eb>] loop_init+0xeb/0x1b8 [loop] + [<ffffffffa0006000>] ? 0xffffffffa0005fff + [<ffffffff8100020a>] do_one_initcall+0x7a/0x12e + [<ffffffff81096804>] sys_init_module+0x9c/0x1e0 + [<ffffffff813329bb>] system_call_fastpath+0x16/0x1b + Code: c3 55 48 89 e5 41 57 41 56 41 89 f6 41 55 41 54 49 89 d4 53 48 89 fb= + 48 83 ec 28 48 85 ff 74 0b 85 f6 75 0b 48 83 7f 30 00 75 14 <0f> 0b eb fe = +48 83 7f 30 00 b9 ea ff ff ff 0f 84 18 01 00 00 49 + RIP [<ffffffff8113ce61>] internal_create_group+0x2a/0x170 + RSP <ffff880007b3fde8> + ---[ end trace a123eb592043acad ]--- + +Signed-off-by: Namhyung Kim <namhyung@gmail.com> +Cc: Laurent Vivier <Laurent.Vivier@bull.net> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/block/loop.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 8546d12..bcd26d0 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1604,6 +1604,9 @@ static int __init loop_init(void) + if (max_part > 0) + part_shift = fls(max_part); + ++ if ((1UL << part_shift) > DISK_MAX_PARTS) ++ return -EINVAL; ++ + if (max_loop > 1UL << (MINORBITS - part_shift)) + return -EINVAL; + +-- +1.7.9.3 + diff --git a/next_round/md-check-hot_remove_disk-when-removing-disk.patch b/next_round/md-check-hot_remove_disk-when-removing-disk.patch new file mode 100644 index 0000000..70d46fc --- /dev/null +++ b/next_round/md-check-hot_remove_disk-when-removing-disk.patch @@ -0,0 +1,76 @@ +From bdba7fda2dd74a0e9dcf4262bc44ceede6c47f17 Mon Sep 17 00:00:00 2001 +From: Namhyung Kim <namhyung@gmail.com> +Date: Thu, 9 Jun 2011 11:42:54 +1000 +Subject: [PATCH] md: check ->hot_remove_disk when removing disk + +commit 01393f3d5836b7d62e925e6f4658a7eb22b83a11 upstream. + +Check pers->hot_remove_disk instead of pers->hot_add_disk in slot_store() +during disk removal. The linear personality only has ->hot_add_disk and +no ->hot_remove_disk, so that removing disk in the array resulted to +following kernel bug: + +$ sudo mdadm --create /dev/md0 --level=linear --raid-devices=4 /dev/loop[0-3] +$ echo none | sudo tee /sys/block/md0/md/dev-loop2/slot + BUG: unable to handle kernel NULL pointer dereference at (null) + IP: [< (null)>] (null) + PGD c9f5d067 PUD 8575a067 PMD 0 + Oops: 0010 [#1] SMP + CPU 2 + Modules linked in: linear loop bridge stp llc kvm_intel kvm asus_atk0110 sr_mod cdrom sg + + Pid: 10450, comm: tee Not tainted 3.0.0-rc1-leonard+ #173 System manufacturer System Product Name/P5G41TD-M PRO + RIP: 0010:[<0000000000000000>] [< (null)>] (null) + RSP: 0018:ffff880085757df0 EFLAGS: 00010282 + RAX: ffffffffa00168e0 RBX: ffff8800d1431800 RCX: 000000000000006e + RDX: 0000000000000001 RSI: 0000000000000002 RDI: ffff88008543c000 + RBP: ffff880085757e48 R08: 0000000000000002 R09: 000000000000000a + R10: 0000000000000000 R11: ffff88008543c2e0 R12: 00000000ffffffff + R13: ffff8800b4641000 R14: 0000000000000005 R15: 0000000000000000 + FS: 00007fe8c9e05700(0000) GS:ffff88011fa00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b + CR2: 0000000000000000 CR3: 00000000b4502000 CR4: 00000000000406e0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 + Process tee (pid: 10450, threadinfo ffff880085756000, task ffff8800c9f08000) + Stack: + ffffffff8138496a ffff8800b4641000 ffff88008543c268 0000000000000000 + ffff8800b4641000 ffff88008543c000 ffff8800d1431868 ffffffff81a78a90 + ffff8800b4641000 ffff88008543c000 ffff8800d1431800 ffff880085757e98 + Call Trace: + [<ffffffff8138496a>] ? slot_store+0xaa/0x265 + [<ffffffff81384bae>] rdev_attr_store+0x89/0xa8 + [<ffffffff8115a96a>] sysfs_write_file+0x108/0x144 + [<ffffffff81106b87>] vfs_write+0xb1/0x10d + [<ffffffff8106e6c0>] ? trace_hardirqs_on_caller+0x111/0x135 + [<ffffffff81106cac>] sys_write+0x4d/0x77 + [<ffffffff814fe702>] system_call_fastpath+0x16/0x1b + Code: Bad RIP value. + RIP [< (null)>] (null) + RSP <ffff880085757df0> + CR2: 0000000000000000 + ---[ end trace ba5fc64319a826fb ]--- + +Signed-off-by: Namhyung Kim <namhyung@gmail.com> +Signed-off-by: NeilBrown <neilb@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/md/md.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index f468ec6..1287b03 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -2391,7 +2391,7 @@ slot_store(mdk_rdev_t *rdev, const char *buf, size_t len) + if (rdev->raid_disk == -1) + return -EEXIST; + /* personality does all needed checks */ +- if (rdev->mddev->pers->hot_add_disk == NULL) ++ if (rdev->mddev->pers->hot_remove_disk == NULL) + return -EINVAL; + err = rdev->mddev->pers-> + hot_remove_disk(rdev->mddev, rdev->raid_disk); +-- +1.7.9.3 + diff --git a/next_round/md-raid5-fix-FUA-request-handling-in-ops_run_io.patch b/next_round/md-raid5-fix-FUA-request-handling-in-ops_run_io.patch new file mode 100644 index 0000000..d75908b --- /dev/null +++ b/next_round/md-raid5-fix-FUA-request-handling-in-ops_run_io.patch @@ -0,0 +1,57 @@ +From adbdd383a4730408298e6665cfc31e35ba6a32e2 Mon Sep 17 00:00:00 2001 +From: Namhyung Kim <namhyung@gmail.com> +Date: Tue, 14 Jun 2011 14:20:19 +1000 +Subject: [PATCH] md/raid5: fix FUA request handling in ops_run_io() + +commit b062962edb086011e94ec4d9eb3f6a6d814f2a8f upstream. + +Commit e9c7469bb4f5 ("md: implment REQ_FLUSH/FUA support") +introduced R5_WantFUA flag and set rw to WRITE_FUA in that case. +However remaining code still checks whether rw is exactly same +as WRITE or not, so FUAed-write ends up with being treated as +READ. Fix it. + +This bug has been present since 2.6.37 and the fix is suitable for any +-stable kernel since then. It is not clear why this has not caused +more problems. + +Cc: Tejun Heo <tj@kernel.org> +Signed-off-by: Namhyung Kim <namhyung@gmail.com> +Signed-off-by: NeilBrown <neilb@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/md/raid5.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index de7984d..dc3e4fc 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -447,7 +447,7 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s) + bi = &sh->dev[i].req; + + bi->bi_rw = rw; +- if (rw == WRITE) ++ if (rw & WRITE) + bi->bi_end_io = raid5_end_write_request; + else + bi->bi_end_io = raid5_end_read_request; +@@ -481,13 +481,13 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s) + bi->bi_io_vec[0].bv_offset = 0; + bi->bi_size = STRIPE_SIZE; + bi->bi_next = NULL; +- if (rw == WRITE && ++ if ((rw & WRITE) && + test_bit(R5_ReWrite, &sh->dev[i].flags)) + atomic_add(STRIPE_SECTORS, + &rdev->corrected_errors); + generic_make_request(bi); + } else { +- if (rw == WRITE) ++ if (rw & WRITE) + set_bit(STRIPE_DEGRADED, &sh->state); + pr_debug("skip op %ld on disc %d for sector %llu\n", + bi->bi_rw, i, (unsigned long long)sh->sector); +-- +1.7.9.3 + diff --git a/next_round/md-raid5-fix-raid5_set_bi_hw_segments.patch b/next_round/md-raid5-fix-raid5_set_bi_hw_segments.patch new file mode 100644 index 0000000..f35965b --- /dev/null +++ b/next_round/md-raid5-fix-raid5_set_bi_hw_segments.patch @@ -0,0 +1,38 @@ +From dbfd3862d9808e98bbc9d96e0ff6c38408da6a2d Mon Sep 17 00:00:00 2001 +From: Namhyung Kim <namhyung@gmail.com> +Date: Mon, 13 Jun 2011 14:48:22 +0900 +Subject: [PATCH] md/raid5: fix raid5_set_bi_hw_segments + +commit 9b2dc8b665932a8e681a7ab3237f60475e75e161 upstream. + +The @bio->bi_phys_segments consists of active stripes count in the +lower 16 bits and processed stripes count in the upper 16 bits. So +logical-OR operator should be bitwise one. + +This bug has been present since 2.6.27 and the fix is suitable for any +-stable kernel since then. Fortunately the bad code is only used on +error paths and is relatively unlikely to be hit. + +Signed-off-by: Namhyung Kim <namhyung@gmail.com> +Signed-off-by: NeilBrown <neilb@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/md/raid5.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 6af0a6d..de7984d 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -128,7 +128,7 @@ static inline int raid5_dec_bi_hw_segments(struct bio *bio) + + static inline void raid5_set_bi_hw_segments(struct bio *bio, unsigned int cnt) + { +- bio->bi_phys_segments = raid5_bi_phys_segments(bio) || (cnt << 16); ++ bio->bi_phys_segments = raid5_bi_phys_segments(bio) | (cnt << 16); + } + + /* Find first data disk in a raid6 stripe */ +-- +1.7.9.3 + diff --git a/next_round/mm-fix-ENOSPC-returned-by-handle_mm_fault.patch b/next_round/mm-fix-ENOSPC-returned-by-handle_mm_fault.patch new file mode 100644 index 0000000..e437b65 --- /dev/null +++ b/next_round/mm-fix-ENOSPC-returned-by-handle_mm_fault.patch @@ -0,0 +1,39 @@ +From 516454306a1a82b1b1512c393a837299d1047d2f Mon Sep 17 00:00:00 2001 +From: Hugh Dickins <hughd@google.com> +Date: Sun, 5 Jun 2011 22:03:13 -0700 +Subject: [PATCH] mm: fix ENOSPC returned by handle_mm_fault() + +commit e0dcd8a05be438b3d2e49ef61441ea3a463663f8 upstream. + +Al Viro observes that in the hugetlb case, handle_mm_fault() may return +a value of the kind ENOSPC when its caller is expecting a value of the +kind VM_FAULT_SIGBUS: fix alloc_huge_page()'s failure returns. + +Signed-off-by: Hugh Dickins <hughd@google.com> +Acked-by: Al Viro <viro@zeniv.linux.org.uk> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + mm/hugetlb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 4c9e6bb..2583bbe 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -1026,10 +1026,10 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma, + */ + chg = vma_needs_reservation(h, vma, addr); + if (chg < 0) +- return ERR_PTR(chg); ++ return ERR_PTR(-VM_FAULT_OOM); + if (chg) + if (hugetlb_get_quota(inode->i_mapping, chg)) +- return ERR_PTR(-ENOSPC); ++ return ERR_PTR(-VM_FAULT_SIGBUS); + + spin_lock(&hugetlb_lock); + page = dequeue_huge_page_vma(h, vma, addr, avoid_reserve); +-- +1.7.9.3 + diff --git a/next_round/mm-page_alloc.c-prevent-unending-loop-in-__alloc_pag.patch b/next_round/mm-page_alloc.c-prevent-unending-loop-in-__alloc_pag.patch new file mode 100644 index 0000000..a234a0e --- /dev/null +++ b/next_round/mm-page_alloc.c-prevent-unending-loop-in-__alloc_pag.patch @@ -0,0 +1,67 @@ +From 44ebef703907c6ae9f8001df7d2090b456a08929 Mon Sep 17 00:00:00 2001 +From: Andrew Barry <abarry@cray.com> +Date: Tue, 24 May 2011 17:12:52 -0700 +Subject: [PATCH] mm/page_alloc.c: prevent unending loop in + __alloc_pages_slowpath() + +commit cfa54a0fcfc1017c6f122b6f21aaba36daa07f71 upstream. + +I believe I found a problem in __alloc_pages_slowpath, which allows a +process to get stuck endlessly looping, even when lots of memory is +available. + +Running an I/O and memory intensive stress-test I see a 0-order page +allocation with __GFP_IO and __GFP_WAIT, running on a system with very +little free memory. Right about the same time that the stress-test gets +killed by the OOM-killer, the utility trying to allocate memory gets stuck +in __alloc_pages_slowpath even though most of the systems memory was freed +by the oom-kill of the stress-test. + +The utility ends up looping from the rebalance label down through the +wait_iff_congested continiously. Because order=0, +__alloc_pages_direct_compact skips the call to get_page_from_freelist. +Because all of the reclaimable memory on the system has already been +reclaimed, __alloc_pages_direct_reclaim skips the call to +get_page_from_freelist. Since there is no __GFP_FS flag, the block with +__alloc_pages_may_oom is skipped. The loop hits the wait_iff_congested, +then jumps back to rebalance without ever trying to +get_page_from_freelist. This loop repeats infinitely. + +The test case is pretty pathological. Running a mix of I/O stress-tests +that do a lot of fork() and consume all of the system memory, I can pretty +reliably hit this on 600 nodes, in about 12 hours. 32GB/node. + +Signed-off-by: Andrew Barry <abarry@cray.com> +Signed-off-by: Minchan Kim <minchan.kim@gmail.com> +Reviewed-by: Rik van Riel<riel@redhat.com> +Acked-by: Mel Gorman <mgorman@suse.de> +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + mm/page_alloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 9826a8d..1418be7 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1863,6 +1863,7 @@ restart: + */ + alloc_flags = gfp_to_alloc_flags(gfp_mask); + ++rebalance: + /* This is the last chance, in general, before the goto nopage. */ + page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist, + high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS, +@@ -1870,7 +1871,6 @@ restart: + if (page) + goto got_pg; + +-rebalance: + /* Allocate without watermarks if the context allows */ + if (alloc_flags & ALLOC_NO_WATERMARKS) { + page = __alloc_pages_high_priority(gfp_mask, order, +-- +1.7.9.3 + diff --git a/next_round/mtd-mtdconcat-fix-NAND-OOB-write.patch b/next_round/mtd-mtdconcat-fix-NAND-OOB-write.patch new file mode 100644 index 0000000..577a0fc --- /dev/null +++ b/next_round/mtd-mtdconcat-fix-NAND-OOB-write.patch @@ -0,0 +1,44 @@ +From 753bc08e9ca02091c9a4ac41e1e993fcc54f3124 Mon Sep 17 00:00:00 2001 +From: Felix Radensky <felix@embedded-sol.com> +Date: Mon, 25 Apr 2011 01:57:12 +0300 +Subject: [PATCH] mtd: mtdconcat: fix NAND OOB write + +commit 431e1ecabddcd7cbba237182ddf431771f98bb4c upstream. + +Currently mtdconcat is broken for NAND. An attemtpt to create +JFFS2 filesystem on concatenation of several NAND devices fails +with OOB write errors. This patch fixes that problem. + +Signed-off-by: Felix Radensky <felix@embedded-sol.com> +Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> +Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/mtd/mtdconcat.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c +index db6de74..b140257 100644 +--- a/drivers/mtd/mtdconcat.c ++++ b/drivers/mtd/mtdconcat.c +@@ -306,7 +306,7 @@ concat_write_oob(struct mtd_info *mtd, loff_t to, struct mtd_oob_ops *ops) + if (!(mtd->flags & MTD_WRITEABLE)) + return -EROFS; + +- ops->retlen = 0; ++ ops->retlen = ops->oobretlen = 0; + + for (i = 0; i < concat->num_subdev; i++) { + struct mtd_info *subdev = concat->subdev[i]; +@@ -321,7 +321,7 @@ concat_write_oob(struct mtd_info *mtd, loff_t to, struct mtd_oob_ops *ops) + devops.len = subdev->size - to; + + err = subdev->write_oob(subdev, to, &devops); +- ops->retlen += devops.retlen; ++ ops->retlen += devops.oobretlen; + if (err) + return err; + +-- +1.7.9.3 + diff --git a/next_round/nbd-limit-module-parameters-to-a-sane-value.patch b/next_round/nbd-limit-module-parameters-to-a-sane-value.patch new file mode 100644 index 0000000..403e517 --- /dev/null +++ b/next_round/nbd-limit-module-parameters-to-a-sane-value.patch @@ -0,0 +1,90 @@ +From 7790f00cdc6c99965b9bc6b55356f06a34fea17b Mon Sep 17 00:00:00 2001 +From: Namhyung Kim <namhyung@gmail.com> +Date: Sat, 28 May 2011 14:44:46 +0200 +Subject: [PATCH] nbd: limit module parameters to a sane value + +commit 3b2710824e00d238554c13b5add347e6c701ab1a upstream. + +The 'max_part' parameter controls the number of maximum partition +a nbd device can have. However if a user specifies very large +value it would exceed the limitation of device minor number and +can cause a kernel oops (or, at least, produce invalid device +nodes in some cases). + +In addition, specifying large 'nbds_max' value causes same +problem for the same reason. + +On my desktop, following command results to the kernel bug: + +$ sudo modprobe nbd max_part=100000 + kernel BUG at /media/Linux_Data/project/linux/fs/sysfs/group.c:65! + invalid opcode: 0000 [#1] SMP + last sysfs file: /sys/devices/virtual/block/nbd4/range + CPU 1 + Modules linked in: nbd(+) bridge stp llc kvm_intel kvm asus_atk0110 sg sr_mod cdrom + + Pid: 2522, comm: modprobe Tainted: G W 2.6.39-leonard+ #159 System manufacturer System Product Name/P5G41TD-M PRO + RIP: 0010:[<ffffffff8115aa08>] [<ffffffff8115aa08>] internal_create_group+0x2f/0x166 + RSP: 0018:ffff8801009f1de8 EFLAGS: 00010246 + RAX: 00000000ffffffef RBX: ffff880103920478 RCX: 00000000000a7bd3 + RDX: ffffffff81a2dbe0 RSI: 0000000000000000 RDI: ffff880103920478 + RBP: ffff8801009f1e38 R08: ffff880103920468 R09: ffff880103920478 + R10: ffff8801009f1de8 R11: ffff88011eccbb68 R12: ffffffff81a2dbe0 + R13: ffff880103920468 R14: 0000000000000000 R15: ffff880103920400 + FS: 00007f3c49de9700(0000) GS:ffff88011f800000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b + CR2: 00007f3b7fe7c000 CR3: 00000000cd58d000 CR4: 00000000000406e0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 + Process modprobe (pid: 2522, threadinfo ffff8801009f0000, task ffff8801009a93a0) + Stack: + ffff8801009f1e58 ffffffff812e8f6e ffff8801009f1e58 ffffffff812e7a80 + ffff880000000010 ffff880103920400 ffff8801002fd0c0 ffff880103920468 + 0000000000000011 ffff880103920400 ffff8801009f1e48 ffffffff8115ab6a + Call Trace: + [<ffffffff812e8f6e>] ? device_add+0x4f1/0x5e4 + [<ffffffff812e7a80>] ? dev_set_name+0x41/0x43 + [<ffffffff8115ab6a>] sysfs_create_group+0x13/0x15 + [<ffffffff810b857e>] blk_trace_init_sysfs+0x14/0x16 + [<ffffffff811ee58b>] blk_register_queue+0x4c/0xfd + [<ffffffff811f3bdf>] add_disk+0xe4/0x29c + [<ffffffffa007e2ab>] nbd_init+0x2ab/0x30d [nbd] + [<ffffffffa007e000>] ? 0xffffffffa007dfff + [<ffffffff8100020f>] do_one_initcall+0x7f/0x13e + [<ffffffff8107ab0a>] sys_init_module+0xa1/0x1e3 + [<ffffffff814f3542>] system_call_fastpath+0x16/0x1b + Code: 41 57 41 56 41 55 41 54 53 48 83 ec 28 0f 1f 44 00 00 48 89 fb 41 89 f6 49 89 d4 48 85 ff 74 0b 85 f6 75 0b 48 83 + 7f 30 00 75 14 <0f> 0b eb fe b9 ea ff ff ff 48 83 7f 30 00 0f 84 09 01 00 00 49 + RIP [<ffffffff8115aa08>] internal_create_group+0x2f/0x166 + RSP <ffff8801009f1de8> + ---[ end trace 753285ffbf72c57c ]--- + +Signed-off-by: Namhyung Kim <namhyung@gmail.com> +Cc: Laurent Vivier <Laurent.Vivier@bull.net> +Cc: Paul Clements <Paul.Clements@steeleye.com> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/block/nbd.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 218d091..14046ff 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -755,6 +755,12 @@ static int __init nbd_init(void) + if (max_part > 0) + part_shift = fls(max_part); + ++ if ((1UL << part_shift) > DISK_MAX_PARTS) ++ return -EINVAL; ++ ++ if (nbds_max > 1UL << (MINORBITS - part_shift)) ++ return -EINVAL; ++ + for (i = 0; i < nbds_max; i++) { + struct gendisk *disk = alloc_disk(1 << part_shift); + if (!disk) +-- +1.7.9.3 + diff --git a/next_round/netfilter-IPv6-fix-DSCP-mangle-code.patch b/next_round/netfilter-IPv6-fix-DSCP-mangle-code.patch new file mode 100644 index 0000000..191354e --- /dev/null +++ b/next_round/netfilter-IPv6-fix-DSCP-mangle-code.patch @@ -0,0 +1,33 @@ +From a979bfe773f10601ed685c16813dd583d5c10d48 Mon Sep 17 00:00:00 2001 +From: Fernando Luis Vazquez Cao <fernando@oss.ntt.co.jp> +Date: Tue, 10 May 2011 10:00:21 +0200 +Subject: [PATCH] netfilter: IPv6: fix DSCP mangle code + +commit 1ed2f73d90fb49bcf5704aee7e9084adb882bfc5 upstream. + +The mask indicates the bits one wants to zero out, so it needs to be +inverted before applying to the original TOS field. + +Signed-off-by: Fernando Luis Vazquez Cao <fernando@oss.ntt.co.jp> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + net/netfilter/xt_DSCP.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/xt_DSCP.c b/net/netfilter/xt_DSCP.c +index 74ce892..5ec6374 100644 +--- a/net/netfilter/xt_DSCP.c ++++ b/net/netfilter/xt_DSCP.c +@@ -99,7 +99,7 @@ tos_tg6(struct sk_buff *skb, const struct xt_target_param *par) + u_int8_t orig, nv; + + orig = ipv6_get_dsfield(iph); +- nv = (orig & info->tos_mask) ^ info->tos_value; ++ nv = (orig & ~info->tos_mask) ^ info->tos_value; + + if (orig != nv) { + if (!skb_make_writable(skb, sizeof(struct iphdr))) +-- +1.7.9.3 + diff --git a/next_round/netfilter-IPv6-initialize-TOS-field-in-REJECT-target.patch b/next_round/netfilter-IPv6-initialize-TOS-field-in-REJECT-target.patch new file mode 100644 index 0000000..b8fd81d --- /dev/null +++ b/next_round/netfilter-IPv6-initialize-TOS-field-in-REJECT-target.patch @@ -0,0 +1,48 @@ +From 8a8da440c0fa3a053469ce3afb3d7002c0c53e86 Mon Sep 17 00:00:00 2001 +From: Fernando Luis Vazquez Cao <fernando@oss.ntt.co.jp> +Date: Tue, 10 May 2011 09:55:44 +0200 +Subject: [PATCH] netfilter: IPv6: initialize TOS field in REJECT target + module + +commit 4319cc0cf5bb894b7368008cdf6dd20eb8868018 upstream. + +The IPv6 header is not zeroed out in alloc_skb so we must initialize +it properly unless we want to see IPv6 packets with random TOS fields +floating around. The current implementation resets the flow label +but this could be changed if deemed necessary. + +We stumbled upon this issue when trying to apply a mangle rule to +the RST packet generated by the REJECT target module. + +Signed-off-by: Fernando Luis Vazquez Cao <fernando@oss.ntt.co.jp> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + net/ipv6/netfilter/ip6t_REJECT.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c +index 67e7110..ddd141e 100644 +--- a/net/ipv6/netfilter/ip6t_REJECT.c ++++ b/net/ipv6/netfilter/ip6t_REJECT.c +@@ -44,6 +44,8 @@ static void send_reset(struct net *net, struct sk_buff *oldskb) + int tcphoff, needs_ack; + const struct ipv6hdr *oip6h = ipv6_hdr(oldskb); + struct ipv6hdr *ip6h; ++#define DEFAULT_TOS_VALUE 0x0U ++ const __u8 tclass = DEFAULT_TOS_VALUE; + struct dst_entry *dst = NULL; + u8 proto; + struct flowi fl; +@@ -122,7 +124,7 @@ static void send_reset(struct net *net, struct sk_buff *oldskb) + skb_put(nskb, sizeof(struct ipv6hdr)); + skb_reset_network_header(nskb); + ip6h = ipv6_hdr(nskb); +- ip6h->version = 6; ++ *(__be32 *)ip6h = htonl(0x60000000 | (tclass << 20)); + ip6h->hop_limit = dst_metric(dst, RTAX_HOPLIMIT); + ip6h->nexthdr = IPPROTO_TCP; + ipv6_addr_copy(&ip6h->saddr, &oip6h->daddr); +-- +1.7.9.3 + diff --git a/next_round/nl80211-fix-check-for-valid-SSID-size-in-scan-operat.patch b/next_round/nl80211-fix-check-for-valid-SSID-size-in-scan-operat.patch new file mode 100644 index 0000000..9505b9d --- /dev/null +++ b/next_round/nl80211-fix-check-for-valid-SSID-size-in-scan-operat.patch @@ -0,0 +1,47 @@ +From 736dcee52bfbc9ac5247a1f4a3a9c4d791c380cc Mon Sep 17 00:00:00 2001 +From: Luciano Coelho <coelho@ti.com> +Date: Thu, 19 May 2011 00:43:38 +0300 +Subject: [PATCH] nl80211: fix check for valid SSID size in scan operations + +commit 208c72f4fe44fe09577e7975ba0e7fa0278f3d03 upstream. + +In both trigger_scan and sched_scan operations, we were checking for +the SSID length before assigning the value correctly. Since the +memory was just kzalloc'ed, the check was always failing and SSID with +over 32 characters were allowed to go through. + +This was causing a buffer overflow when copying the actual SSID to the +proper place. + +This bug has been there since 2.6.29-rc4. + +[PG: 34 codebase does not have nl80211_start_sched_scan part] + +Signed-off-by: Luciano Coelho <coelho@ti.com> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + net/wireless/nl80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 030cf15..0ba104f 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -3072,12 +3072,12 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) + i = 0; + if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) { + nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { ++ request->ssids[i].ssid_len = nla_len(attr); + if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) { + err = -EINVAL; + goto out_free; + } + memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); +- request->ssids[i].ssid_len = nla_len(attr); + i++; + } + } +-- +1.7.9.3 + diff --git a/next_round/oprofile-dcookies-Fix-possible-circular-locking-depe.patch b/next_round/oprofile-dcookies-Fix-possible-circular-locking-depe.patch new file mode 100644 index 0000000..2a5b81e --- /dev/null +++ b/next_round/oprofile-dcookies-Fix-possible-circular-locking-depe.patch @@ -0,0 +1,98 @@ +From c174438d73019dad478a215740425a60380c4a08 Mon Sep 17 00:00:00 2001 +From: Robert Richter <robert.richter@amd.com> +Date: Tue, 31 May 2011 12:35:41 +0200 +Subject: [PATCH] oprofile, dcookies: Fix possible circular locking dependency + +commit fe47ae7f53e179d2ef6771024feb000cbb86640f upstream. + +The lockdep warning below detects a possible A->B/B->A locking +dependency of mm->mmap_sem and dcookie_mutex. The order in +sync_buffer() is mm->mmap_sem/dcookie_mutex, while in +sys_lookup_dcookie() it is vice versa. + +Fixing it in sys_lookup_dcookie() by unlocking dcookie_mutex before +copy_to_user(). + +oprofiled/4432 is trying to acquire lock: + (&mm->mmap_sem){++++++}, at: [<ffffffff810b444b>] might_fault+0x53/0xa3 + +but task is already holding lock: + (dcookie_mutex){+.+.+.}, at: [<ffffffff81124d28>] sys_lookup_dcookie+0x45/0x149 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (dcookie_mutex){+.+.+.}: + [<ffffffff8106557f>] lock_acquire+0xf8/0x11e + [<ffffffff814634f0>] mutex_lock_nested+0x63/0x309 + [<ffffffff81124e5c>] get_dcookie+0x30/0x144 + [<ffffffffa0000fba>] sync_buffer+0x196/0x3ec [oprofile] + [<ffffffffa0001226>] task_exit_notify+0x16/0x1a [oprofile] + [<ffffffff81467b96>] notifier_call_chain+0x37/0x63 + [<ffffffff8105803d>] __blocking_notifier_call_chain+0x50/0x67 + [<ffffffff81058068>] blocking_notifier_call_chain+0x14/0x16 + [<ffffffff8105a718>] profile_task_exit+0x1a/0x1c + [<ffffffff81039e8f>] do_exit+0x2a/0x6fc + [<ffffffff8103a5e4>] do_group_exit+0x83/0xae + [<ffffffff8103a626>] sys_exit_group+0x17/0x1b + [<ffffffff8146ad4b>] system_call_fastpath+0x16/0x1b + +-> #0 (&mm->mmap_sem){++++++}: + [<ffffffff81064dfb>] __lock_acquire+0x1085/0x1711 + [<ffffffff8106557f>] lock_acquire+0xf8/0x11e + [<ffffffff810b4478>] might_fault+0x80/0xa3 + [<ffffffff81124de7>] sys_lookup_dcookie+0x104/0x149 + [<ffffffff8146ad4b>] system_call_fastpath+0x16/0x1b + +other info that might help us debug this: + +1 lock held by oprofiled/4432: + #0: (dcookie_mutex){+.+.+.}, at: [<ffffffff81124d28>] sys_lookup_dcookie+0x45/0x149 + +stack backtrace: +Pid: 4432, comm: oprofiled Not tainted 2.6.39-00008-ge5a450d #9 +Call Trace: + [<ffffffff81063193>] print_circular_bug+0xae/0xbc + [<ffffffff81064dfb>] __lock_acquire+0x1085/0x1711 + [<ffffffff8102ef13>] ? get_parent_ip+0x11/0x42 + [<ffffffff810b444b>] ? might_fault+0x53/0xa3 + [<ffffffff8106557f>] lock_acquire+0xf8/0x11e + [<ffffffff810b444b>] ? might_fault+0x53/0xa3 + [<ffffffff810d7d54>] ? path_put+0x22/0x27 + [<ffffffff810b4478>] might_fault+0x80/0xa3 + [<ffffffff810b444b>] ? might_fault+0x53/0xa3 + [<ffffffff81124de7>] sys_lookup_dcookie+0x104/0x149 + [<ffffffff8146ad4b>] system_call_fastpath+0x16/0x1b + +References: https://bugzilla.kernel.org/show_bug.cgi?id=13809 +Signed-off-by: Robert Richter <robert.richter@amd.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + fs/dcookies.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/dcookies.c b/fs/dcookies.c +index a21cabd..dda0dc7 100644 +--- a/fs/dcookies.c ++++ b/fs/dcookies.c +@@ -178,6 +178,8 @@ SYSCALL_DEFINE(lookup_dcookie)(u64 cookie64, char __user * buf, size_t len) + /* FIXME: (deleted) ? */ + path = d_path(&dcs->path, kbuf, PAGE_SIZE); + ++ mutex_unlock(&dcookie_mutex); ++ + if (IS_ERR(path)) { + err = PTR_ERR(path); + goto out_free; +@@ -194,6 +196,7 @@ SYSCALL_DEFINE(lookup_dcookie)(u64 cookie64, char __user * buf, size_t len) + + out_free: + kfree(kbuf); ++ return err; + out: + mutex_unlock(&dcookie_mutex); + return err; +-- +1.7.9.3 + diff --git a/next_round/p54usb-add-zoom-4410-usbid.patch b/next_round/p54usb-add-zoom-4410-usbid.patch new file mode 100644 index 0000000..3ab80a5 --- /dev/null +++ b/next_round/p54usb-add-zoom-4410-usbid.patch @@ -0,0 +1,30 @@ +From e704764139610bc0ed09e9dc0ab86c98a8b20b44 Mon Sep 17 00:00:00 2001 +From: Christian Lamparter <chunkeey@googlemail.com> +Date: Fri, 13 May 2011 21:47:23 +0200 +Subject: [PATCH] p54usb: add zoom 4410 usbid + +commit 9368a9a2378ab721f82f59430a135b4ce4ff5109 upstream. + +Reported-by: Mark Davis <marked86@gmail.com> +Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/net/wireless/p54/p54usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c +index 3317906d..0f2ff34 100644 +--- a/drivers/net/wireless/p54/p54usb.c ++++ b/drivers/net/wireless/p54/p54usb.c +@@ -82,6 +82,7 @@ static struct usb_device_id p54u_table[] __devinitdata = { + {USB_DEVICE(0x06b9, 0x0121)}, /* Thomson SpeedTouch 121g */ + {USB_DEVICE(0x0707, 0xee13)}, /* SMC 2862W-G version 2 */ + {USB_DEVICE(0x083a, 0x4521)}, /* Siemens Gigaset USB Adapter 54 version 2 */ ++ {USB_DEVICE(0x083a, 0xc501)}, /* Zoom Wireless-G 4410 */ + {USB_DEVICE(0x083a, 0xf503)}, /* Accton FD7050E ver 1010ec */ + {USB_DEVICE(0x0846, 0x4240)}, /* Netgear WG111 (v2) */ + {USB_DEVICE(0x0915, 0x2000)}, /* Cohiba Proto board */ +-- +1.7.9.3 + diff --git a/next_round/pata_cm64x-fix-boot-crash-on-parisc.patch b/next_round/pata_cm64x-fix-boot-crash-on-parisc.patch new file mode 100644 index 0000000..c37fce4 --- /dev/null +++ b/next_round/pata_cm64x-fix-boot-crash-on-parisc.patch @@ -0,0 +1,120 @@ +From 2f92256dcadab36275030267d993d765817b72a4 Mon Sep 17 00:00:00 2001 +From: James Bottomley <James.Bottomley@suse.de> +Date: Sun, 24 Apr 2011 14:30:14 -0500 +Subject: [PATCH] pata_cm64x: fix boot crash on parisc + +commit 9281b16caac1276817b77033c5b8a1f5ca30102c upstream. + +The old IDE cmd64x checks the status of the CNTRL register to see if +the ports are enabled before probing them. pata_cmd64x doesn't do +this, which causes a HPMC on parisc when it tries to poke at the +secondary port because apparently the BAR isn't wired up (and a +non-responding piece of memory causes a HPMC). + +Fix this by porting the CNTRL register port detection logic from IDE +cmd64x. In addition, following converns from Alan Cox, add a check to +see if a mobility electronics bridge is the immediate parent and forgo +the check if it is (prevents problems on hotplug controllers). + +Signed-off-by: James Bottomley <James.Bottomley@suse.de> +Signed-off-by: Jeff Garzik <jgarzik@pobox.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/ata/pata_cmd64x.c | 42 ++++++++++++++++++++++++++++++++++++++---- + include/linux/pci_ids.h | 2 ++ + 2 files changed, 40 insertions(+), 4 deletions(-) + +diff --git a/drivers/ata/pata_cmd64x.c b/drivers/ata/pata_cmd64x.c +index 4c81a71..c54e9af 100644 +--- a/drivers/ata/pata_cmd64x.c ++++ b/drivers/ata/pata_cmd64x.c +@@ -41,6 +41,9 @@ + enum { + CFR = 0x50, + CFR_INTR_CH0 = 0x04, ++ CNTRL = 0x51, ++ CNTRL_CH0 = 0x04, ++ CNTRL_CH1 = 0x08, + CMDTIM = 0x52, + ARTTIM0 = 0x53, + DRWTIM0 = 0x54, +@@ -334,9 +337,19 @@ static int cmd64x_init_one(struct pci_dev *pdev, const struct pci_device_id *id) + .port_ops = &cmd648_port_ops + } + }; +- const struct ata_port_info *ppi[] = { &cmd_info[id->driver_data], NULL }; +- u8 mrdmode; ++ const struct ata_port_info *ppi[] = { ++ &cmd_info[id->driver_data], ++ &cmd_info[id->driver_data], ++ NULL ++ }; ++ u8 mrdmode, reg; + int rc; ++ struct pci_dev *bridge = pdev->bus->self; ++ /* mobility split bridges don't report enabled ports correctly */ ++ int port_ok = !(bridge && bridge->vendor == ++ PCI_VENDOR_ID_MOBILITY_ELECTRONICS); ++ /* all (with exceptions below) apart from 643 have CNTRL_CH0 bit */ ++ int cntrl_ch0_ok = (id->driver_data != 0); + + rc = pcim_enable_device(pdev); + if (rc) +@@ -347,11 +360,18 @@ static int cmd64x_init_one(struct pci_dev *pdev, const struct pci_device_id *id) + + if (pdev->device == PCI_DEVICE_ID_CMD_646) { + /* Does UDMA work ? */ +- if (pdev->revision > 4) ++ if (pdev->revision > 4) { + ppi[0] = &cmd_info[2]; ++ ppi[1] = &cmd_info[2]; ++ } + /* Early rev with other problems ? */ +- else if (pdev->revision == 1) ++ else if (pdev->revision == 1) { + ppi[0] = &cmd_info[3]; ++ ppi[1] = &cmd_info[3]; ++ } ++ /* revs 1,2 have no CNTRL_CH0 */ ++ if (pdev->revision < 3) ++ cntrl_ch0_ok = 0; + } + + pci_write_config_byte(pdev, PCI_LATENCY_TIMER, 64); +@@ -360,6 +380,20 @@ static int cmd64x_init_one(struct pci_dev *pdev, const struct pci_device_id *id) + mrdmode |= 0x02; /* Memory read line enable */ + pci_write_config_byte(pdev, MRDMODE, mrdmode); + ++ /* check for enabled ports */ ++ pci_read_config_byte(pdev, CNTRL, ®); ++ if (!port_ok) ++ dev_printk(KERN_NOTICE, &pdev->dev, "Mobility Bridge detected, ignoring CNTRL port enable/disable\n"); ++ if (port_ok && cntrl_ch0_ok && !(reg & CNTRL_CH0)) { ++ dev_printk(KERN_NOTICE, &pdev->dev, "Primary port is disabled\n"); ++ ppi[0] = &ata_dummy_port_info; ++ ++ } ++ if (port_ok && !(reg & CNTRL_CH1)) { ++ dev_printk(KERN_NOTICE, &pdev->dev, "Secondary port is disabled\n"); ++ ppi[1] = &ata_dummy_port_info; ++ } ++ + /* Force PIO 0 here.. */ + + /* PPC specific fixup copied from old driver */ +diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h +index 32aa93d..fcb5225 100644 +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -605,6 +605,8 @@ + #define PCI_DEVICE_ID_MATROX_G550 0x2527 + #define PCI_DEVICE_ID_MATROX_VIA 0x4536 + ++#define PCI_VENDOR_ID_MOBILITY_ELECTRONICS 0x14f2 ++ + #define PCI_VENDOR_ID_CT 0x102c + #define PCI_DEVICE_ID_CT_69000 0x00c0 + #define PCI_DEVICE_ID_CT_65545 0x00d8 +-- +1.7.9.3 + diff --git a/next_round/powerpc-kexec-Fix-memory-corruption-from-unallocated.patch b/next_round/powerpc-kexec-Fix-memory-corruption-from-unallocated.patch new file mode 100644 index 0000000..9127ec6 --- /dev/null +++ b/next_round/powerpc-kexec-Fix-memory-corruption-from-unallocated.patch @@ -0,0 +1,76 @@ +From f550749099856dedaa578062622ecf44c0c6b8b4 Mon Sep 17 00:00:00 2001 +From: Milton Miller <miltonm@bga.com> +Date: Tue, 10 May 2011 19:28:33 +0000 +Subject: [PATCH] powerpc/kexec: Fix memory corruption from unallocated slaves + +commit 3d2cea732d68aa270c360f55d8669820ebce188a upstream. + +Commit 1fc711f7ffb01089efc58042cfdbac8573d1b59a (powerpc/kexec: Fix race +in kexec shutdown) moved the write to signal the cpu had exited the kernel +from before the transition to real mode in kexec_smp_wait to kexec_wait. + +Unfornately it missed that kexec_wait is used both by cpus leaving the +kernel and by secondary slave cpus that were not allocated a paca for +what ever reason -- they could be beyond nr_cpus or not described in +the current device tree for whatever reason (for example, kexec-load +was not refreshed after a cpu hotplug operation). Cpus coming through +that path they will write to paca[NR_CPUS] which is beyond the space +allocated for the paca data and overwrite memory not allocated to pacas +but very likely still real mode accessable). + +Move the write back to kexec_smp_wait, which is used only by cpus that +found their paca, but after the transition to real mode. + +Signed-off-by: Milton Miller <miltonm@bga.com> +Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + arch/powerpc/kernel/misc_64.S | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S +index a2b18df..9161338 100644 +--- a/arch/powerpc/kernel/misc_64.S ++++ b/arch/powerpc/kernel/misc_64.S +@@ -463,7 +463,8 @@ _GLOBAL(disable_kernel_fp) + * wait for the flag to change, indicating this kernel is going away but + * the slave code for the next one is at addresses 0 to 100. + * +- * This is used by all slaves. ++ * This is used by all slaves, even those that did not find a matching ++ * paca in the secondary startup code. + * + * Physical (hardware) cpu id should be in r3. + */ +@@ -472,10 +473,6 @@ _GLOBAL(kexec_wait) + 1: mflr r5 + addi r5,r5,kexec_flag-1b + +- li r4,KEXEC_STATE_REAL_MODE +- stb r4,PACAKEXECSTATE(r13) +- SYNC +- + 99: HMT_LOW + #ifdef CONFIG_KEXEC /* use no memory without kexec */ + lwz r4,0(r5) +@@ -500,11 +497,17 @@ kexec_flag: + * + * get phys id from paca + * switch to real mode ++ * mark the paca as no longer used + * join other cpus in kexec_wait(phys_id) + */ + _GLOBAL(kexec_smp_wait) + lhz r3,PACAHWCPUID(r13) + bl real_mode ++ ++ li r4,KEXEC_STATE_REAL_MODE ++ stb r4,PACAKEXECSTATE(r13) ++ SYNC ++ + b .kexec_wait + + /* +-- +1.7.9.3 + diff --git a/next_round/powerpc-oprofile-Handle-events-that-raise-an-excepti.patch b/next_round/powerpc-oprofile-Handle-events-that-raise-an-excepti.patch new file mode 100644 index 0000000..9207828 --- /dev/null +++ b/next_round/powerpc-oprofile-Handle-events-that-raise-an-excepti.patch @@ -0,0 +1,69 @@ +From 385ca6bcea9c3aaa5046583c246c87dd8f863146 Mon Sep 17 00:00:00 2001 +From: Eric B Munson <emunson@mgebm.net> +Date: Mon, 23 May 2011 04:22:40 +0000 +Subject: [PATCH] powerpc/oprofile: Handle events that raise an exception + without overflowing + +commit ad5d5292f16c6c1d7d3e257c4c7407594286b97e upstream. + +Commit 0837e3242c73566fc1c0196b4ec61779c25ffc93 fixes a situation on POWER7 +where events can roll back if a specualtive event doesn't actually complete. +This can raise a performance monitor exception. We need to catch this to ensure +that we reset the PMC. In all cases the PMC will be less than 256 cycles from +overflow. + +This patch lifts Anton's fix for the problem in perf and applies it to oprofile +as well. + +Signed-off-by: Eric B Munson <emunson@mgebm.net> +Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + arch/powerpc/oprofile/op_model_power4.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/oprofile/op_model_power4.c b/arch/powerpc/oprofile/op_model_power4.c +index 8077409..93636ca 100644 +--- a/arch/powerpc/oprofile/op_model_power4.c ++++ b/arch/powerpc/oprofile/op_model_power4.c +@@ -261,6 +261,28 @@ static int get_kernel(unsigned long pc, unsigned long mmcra) + return is_kernel; + } + ++static bool pmc_overflow(unsigned long val) ++{ ++ if ((int)val < 0) ++ return true; ++ ++ /* ++ * Events on POWER7 can roll back if a speculative event doesn't ++ * eventually complete. Unfortunately in some rare cases they will ++ * raise a performance monitor exception. We need to catch this to ++ * ensure we reset the PMC. In all cases the PMC will be 256 or less ++ * cycles from overflow. ++ * ++ * We only do this if the first pass fails to find any overflowing ++ * PMCs because a user might set a period of less than 256 and we ++ * don't want to mistakenly reset them. ++ */ ++ if (__is_processor(PV_POWER7) && ((0x80000000 - val) <= 256)) ++ return true; ++ ++ return false; ++} ++ + static void power4_handle_interrupt(struct pt_regs *regs, + struct op_counter_config *ctr) + { +@@ -281,7 +303,7 @@ static void power4_handle_interrupt(struct pt_regs *regs, + + for (i = 0; i < cur_cpu_spec->num_pmcs; ++i) { + val = classic_ctr_read(i); +- if (val < 0) { ++ if (pmc_overflow(val)) { + if (oprofile_running && ctr[i].enabled) { + oprofile_add_ext_sample(pc, regs, i, is_kernel); + classic_ctr_write(i, reset_value[i]); +-- +1.7.9.3 + diff --git a/next_round/rcu-Fix-unpaired-rcu_irq_enter-from-locking-selftest.patch b/next_round/rcu-Fix-unpaired-rcu_irq_enter-from-locking-selftest.patch new file mode 100644 index 0000000..92900d0 --- /dev/null +++ b/next_round/rcu-Fix-unpaired-rcu_irq_enter-from-locking-selftest.patch @@ -0,0 +1,57 @@ +From 07f1cf36ad6e100be67bf27727d908886a3d28f1 Mon Sep 17 00:00:00 2001 +From: Frederic Weisbecker <fweisbec@gmail.com> +Date: Fri, 20 May 2011 02:09:54 +0200 +Subject: [PATCH] rcu: Fix unpaired rcu_irq_enter() from locking selftests + +commit ba9f207c9f82115aba4ce04b22e0081af0ae300f upstream. + +HARDIRQ_ENTER() maps to irq_enter() which calls rcu_irq_enter(). +But HARDIRQ_EXIT() maps to __irq_exit() which doesn't call +rcu_irq_exit(). + +So for every locking selftest that simulates hardirq disabled, +we create an imbalance in the rcu extended quiescent state +internal state. + +As a result, after the first missing rcu_irq_exit(), subsequent +irqs won't exit dyntick-idle mode after leaving the interrupt +handler. This means that RCU won't see the affected CPU as being +in an extended quiescent state, resulting in long grace-period +delays (as in grace periods extending for hours). + +To fix this, just use __irq_enter() to simulate the hardirq +context. This is sufficient for the locking selftests as we +don't need to exit any extended quiescent state or perform +any check that irqs normally do when they wake up from idle. + +As a side effect, this patch makes it possible to restore +"rcu: Decrease memory-barrier usage based on semi-formal proof", +which eventually helped finding this bug. + +Reported-and-tested-by: Yinghai Lu <yinghai@kernel.org> +Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com> +Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com> +Cc: Ingo Molnar <mingo@elte.hu> +Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> +Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + lib/locking-selftest.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/locking-selftest.c b/lib/locking-selftest.c +index 619313e..507a22f 100644 +--- a/lib/locking-selftest.c ++++ b/lib/locking-selftest.c +@@ -144,7 +144,7 @@ static void init_shared_classes(void) + + #define HARDIRQ_ENTER() \ + local_irq_disable(); \ +- irq_enter(); \ ++ __irq_enter(); \ + WARN_ON(!in_irq()); + + #define HARDIRQ_EXIT() \ +-- +1.7.9.3 + diff --git a/next_round/seqlock-Don-t-smp_rmb-in-seqlock-reader-spin-loop.patch b/next_round/seqlock-Don-t-smp_rmb-in-seqlock-reader-spin-loop.patch new file mode 100644 index 0000000..90e0d19 --- /dev/null +++ b/next_round/seqlock-Don-t-smp_rmb-in-seqlock-reader-spin-loop.patch @@ -0,0 +1,78 @@ +From 85abd778a1428d0e2c2981bfb695d70c60105537 Mon Sep 17 00:00:00 2001 +From: Milton Miller <miltonm@bga.com> +Date: Thu, 12 May 2011 04:13:54 -0500 +Subject: [PATCH] seqlock: Don't smp_rmb in seqlock reader spin loop + +commit 5db1256a5131d3b133946fa02ac9770a784e6eb2 upstream. + +Move the smp_rmb after cpu_relax loop in read_seqlock and add +ACCESS_ONCE to make sure the test and return are consistent. + +A multi-threaded core in the lab didn't like the update +from 2.6.35 to 2.6.36, to the point it would hang during +boot when multiple threads were active. Bisection showed +af5ab277ded04bd9bc6b048c5a2f0e7d70ef0867 (clockevents: +Remove the per cpu tick skew) as the culprit and it is +supported with stack traces showing xtime_lock waits including +tick_do_update_jiffies64 and/or update_vsyscall. + +Experimentation showed the combination of cpu_relax and smp_rmb +was significantly slowing the progress of other threads sharing +the core, and this patch is effective in avoiding the hang. + +A theory is the rmb is affecting the whole core while the +cpu_relax is causing a resource rebalance flush, together they +cause an interfernce cadance that is unbroken when the seqlock +reader has interrupts disabled. + +At first I was confused why the refactor in +3c22cd5709e8143444a6d08682a87f4c57902df3 (kernel: optimise +seqlock) didn't affect this patch application, but after some +study that affected seqcount not seqlock. The new seqcount was +not factored back into the seqlock. I defer that the future. + +While the removal of the timer interrupt offset created +contention for the xtime lock while a cpu does the +additonal work to update the system clock, the seqlock +implementation with the tight rmb spin loop goes back much +further, and is just waiting for the right trigger. + +Cc: <stable@vger.kernel.org> +Signed-off-by: Milton Miller <miltonm@bga.com> +Cc: <linuxppc-dev@lists.ozlabs.org> +Cc: Linus Torvalds <torvalds@linux-foundation.org> +Cc: Andi Kleen <andi@firstfloor.org> +Cc: Nick Piggin <npiggin@kernel.dk> +Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> +Cc: Anton Blanchard <anton@samba.org> +Cc: Paul McKenney <paulmck@linux.vnet.ibm.com> +Acked-by: Eric Dumazet <eric.dumazet@gmail.com> +Link: http://lkml.kernel.org/r/%3Cseqlock-rmb%40mdm.bga.com%3E +Signed-off-by: Thomas Gleixner <tglx@linutronix.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + include/linux/seqlock.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h +index 632205c..4c3257d 100644 +--- a/include/linux/seqlock.h ++++ b/include/linux/seqlock.h +@@ -88,12 +88,12 @@ static __always_inline unsigned read_seqbegin(const seqlock_t *sl) + unsigned ret; + + repeat: +- ret = sl->sequence; +- smp_rmb(); ++ ret = ACCESS_ONCE(sl->sequence); + if (unlikely(ret & 1)) { + cpu_relax(); + goto repeat; + } ++ smp_rmb(); + + return ret; + } +-- +1.7.9.3 + diff --git a/next_round/series b/next_round/series index e69de29..be3c503 100644 --- a/next_round/series +++ b/next_round/series @@ -0,0 +1,77 @@ +ftrace-Only-update-the-function-code-on-write-to-fil.patch +kmemleak-Do-not-return-a-pointer-to-an-object-that-k.patch +CPU-hotplug-re-create-sysfs-directory-and-symlinks.patch +Fix-memory-leak-in-cpufreq_stat.patch +powerpc-kexec-Fix-memory-corruption-from-unallocated.patch +powerpc-oprofile-Handle-events-that-raise-an-excepti.patch +block-rescan-partitions-on-invalidated-devices-on-EN.patch +block-add-proper-state-guards-to-__elv_next_request.patch +mtd-mtdconcat-fix-NAND-OOB-write.patch +x86-64-bit-Fix-copy_-to-from-_user-checks-for-the-us.patch +ext3-Fix-fs-corruption-when-make_indexed_dir-fails.patch +jbd-Fix-forever-sleeping-process-in-do_get_write_acc.patch +jbd-fix-fsync-tid-wraparound-bug.patch +ext4-release-page-cache-in-ext4_mb_load_buddy-error-.patch +Fix-Ultrastor-asm-snippet.patch +x86-amd-Use-_safe-msr-access-for-GartTlbWlk-disable-.patch +rcu-Fix-unpaired-rcu_irq_enter-from-locking-selftest.patch +staging-usbip-fix-wrong-endian-conversion.patch +seqlock-Don-t-smp_rmb-in-seqlock-reader-spin-loop.patch +ALSA-HDA-Use-one-dmic-only-for-Dell-Studio-1558.patch +ASoC-Ensure-output-PGA-is-enabled-for-line-outputs-i.patch +ASoC-Add-some-missing-volume-update-bit-sets-for-wm_.patch +mm-page_alloc.c-prevent-unending-loop-in-__alloc_pag.patch +loop-limit-max_part-module-param-to-DISK_MAX_PARTS.patch +loop-handle-on-demand-devices-correctly.patch +USB-CP210x-Add-4-Device-IDs-for-AC-Services-Devices.patch +USB-moto_modem-Add-USB-identifier-for-the-Motorola-V.patch +USB-serial-ftdi_sio-adding-support-for-TavIR-STK500.patch +USB-gamin_gps-Fix-for-data-transfer-problems-in-nati.patch +usb-gadget-at91sam9g20-fix-end-point-max-packet-size.patch +usb-gadget-rndis-don-t-test-against-req-length.patch +xhci-Fix-full-speed-bInterval-encoding.patch +p54usb-add-zoom-4410-usbid.patch +eCryptfs-Allow-2-scatterlist-entries-for-encrypted-f.patch +UBIFS-fix-a-rare-memory-leak-in-ro-to-rw-remounting-.patch +i8k-Avoid-lahf-in-64-bit-code.patch +cpuidle-menu-fixed-wrapping-timers-at-4.294-seconds.patch +dm-table-reject-devices-without-request-fns.patch +atm-expose-ATM-device-index-in-sysfs.patch +brd-limit-max_part-module-param-to-DISK_MAX_PARTS.patch +brd-handle-on-demand-devices-correctly.patch +SUNRPC-Deal-with-the-lack-of-a-SYN_SENT-sk-sk_state_.patch +PCI-Add-quirk-for-setting-valid-class-for-TI816X-End.patch +xen-mmu-fix-a-race-window-causing-leave_mm-BUG.patch +UBIFS-fix-shrinker-object-count-reports.patch +UBIFS-fix-memory-leak-on-error-path.patch +nbd-limit-module-parameters-to-a-sane-value.patch +block-export-blk_-get-put-_queue.patch +Fix-oops-caused-by-queue-refcounting-failure.patch +mm-fix-ENOSPC-returned-by-handle_mm_fault.patch +PCI-Set-PCIE-maxpayload-for-card-during-hotplug-inse.patch +nl80211-fix-check-for-valid-SSID-size-in-scan-operat.patch +lockdep-Fix-lock_is_held-on-recursion.patch +drm-i915-Add-a-no-lvds-quirk-for-the-Asus-EeeBox-PC-.patch +drm-radeon-kms-fix-for-radeon-on-systems-4GB-without.patch +fat-Fix-corrupt-inode-flags-when-remove-ATTR_SYS-fla.patch +xen-off-by-one-errors-in-multicalls.c.patch +x86-amd-iommu-Fix-3-possible-endless-loops.patch +USB-cdc-acm-Adding-second-ACM-channel-support-for-No.patch +USB-core-Tolerate-protocol-stall-during-hub-and-port.patch +USB-serial-add-another-4N-GALAXY.DE-PID-to-ftdi_sio-.patch +USB-xhci-fix-interval-calculation-for-FS-isoc-endpoi.patch +ALSA-hda-Fix-quirk-for-Dell-Inspiron-910.patch +oprofile-dcookies-Fix-possible-circular-locking-depe.patch +Remove-cpufreq_stats-sysfs-entries-on-module-unload.patch +md-check-hot_remove_disk-when-removing-disk.patch +md-raid5-fix-raid5_set_bi_hw_segments.patch +md-raid5-fix-FUA-request-handling-in-ops_run_io.patch +pata_cm64x-fix-boot-crash-on-parisc.patch +xfs-properly-account-for-reclaimed-inodes.patch +exec-delay-address-limit-change-until-point-of-no-re.patch +netfilter-IPv6-initialize-TOS-field-in-REJECT-target.patch +netfilter-IPv6-fix-DSCP-mangle-code.patch +xen-events-do-not-unmask-event-channels-on-resume.patch +genirq-Add-IRQF_FORCE_RESUME.patch +xen-Use-IRQF_FORCE_RESUME.patch +time-Compensate-for-rounding-on-odd-frequency-clocks.patch diff --git a/next_round/staging-usbip-fix-wrong-endian-conversion.patch b/next_round/staging-usbip-fix-wrong-endian-conversion.patch new file mode 100644 index 0000000..e09a8cd --- /dev/null +++ b/next_round/staging-usbip-fix-wrong-endian-conversion.patch @@ -0,0 +1,34 @@ +From ba0d1315052ac525ab28547a7f436dbdcdb8c039 Mon Sep 17 00:00:00 2001 +From: David Chang <dchang@novell.com> +Date: Thu, 12 May 2011 18:31:11 +0800 +Subject: [PATCH] staging: usbip: fix wrong endian conversion + +commit cacd18a8476ce145ca5dcd46dc5b75585fd1289c upstream. + +Fix number_of_packets wrong endian conversion in function +correct_endian_ret_submit() + +Signed-off-by: David Chang <dchang@novell.com> +Acked-by: Arjan Mels <arjan.mels@gmx.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/staging/usbip/usbip_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/staging/usbip/usbip_common.c +index 707b57d..c172ae9 100644 +--- a/drivers/staging/usbip/usbip_common.c ++++ b/drivers/staging/usbip/usbip_common.c +@@ -689,7 +689,7 @@ static void correct_endian_ret_submit(struct usbip_header_ret_submit *pdu, + be32_to_cpus(&pdu->status); + be32_to_cpus(&pdu->actual_length); + be32_to_cpus(&pdu->start_frame); +- cpu_to_be32s(&pdu->number_of_packets); ++ be32_to_cpus(&pdu->number_of_packets); + be32_to_cpus(&pdu->error_count); + } + } +-- +1.7.9.3 + diff --git a/next_round/time-Compensate-for-rounding-on-odd-frequency-clocks.patch b/next_round/time-Compensate-for-rounding-on-odd-frequency-clocks.patch new file mode 100644 index 0000000..e92bd3a --- /dev/null +++ b/next_round/time-Compensate-for-rounding-on-odd-frequency-clocks.patch @@ -0,0 +1,85 @@ +From b72c8ce8f5c322a708bb3677738398981137b214 Mon Sep 17 00:00:00 2001 +From: Kasper Pedersen <kkp2010@kasperkp.dk> +Date: Wed, 20 Oct 2010 15:55:15 -0700 +Subject: [PATCH] time: Compensate for rounding on odd-frequency clocksources + +commit a386b5af8edda1c742ce9f77891e112eefffc005 upstream. + +When the clocksource is not a multiple of HZ, the clock will be off. For +acpi_pm, HZ=1000 the error is 127.111 ppm: + +The rounding of cycle_interval ends up generating a false error term in +ntp_error accumulation since xtime_interval is not exactly 1/HZ. So, we +subtract out the error caused by the rounding. + +This has been visible since 2.6.32-rc2 + commit a092ff0f90cae22b2ac8028ecd2c6f6c1a9e4601 + time: Implement logarithmic time accumulation +That commit raised NTP_INTERVAL_FREQ and exposed the rounding error. + +testing tool: http://n1.taur.dk/permanent/testpmt.c +Also tested with ntpd and a frequency counter. + +Signed-off-by: Kasper Pedersen <kkp2010@kasperkp.dk> +Acked-by: john stultz <johnstul@us.ibm.com> +Cc: John Kacur <jkacur@redhat.com> +Cc: Clark Williams <williams@redhat.com> +Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Thomas Gleixner <tglx@linutronix.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + kernel/time/timekeeping.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c +index 39f6177..268020d 100644 +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -32,6 +32,8 @@ struct timekeeper { + cycle_t cycle_interval; + /* Number of clock shifted nano seconds in one NTP interval. */ + u64 xtime_interval; ++ /* shifted nano seconds left over when rounding cycle_interval */ ++ s64 xtime_remainder; + /* Raw nano seconds accumulated per NTP interval. */ + u32 raw_interval; + +@@ -62,7 +64,7 @@ struct timekeeper timekeeper; + static void timekeeper_setup_internals(struct clocksource *clock) + { + cycle_t interval; +- u64 tmp; ++ u64 tmp, ntpinterval; + + timekeeper.clock = clock; + clock->cycle_last = clock->read(clock); +@@ -70,6 +72,7 @@ static void timekeeper_setup_internals(struct clocksource *clock) + /* Do the ns -> cycle conversion first, using original mult */ + tmp = NTP_INTERVAL_LENGTH; + tmp <<= clock->shift; ++ ntpinterval = tmp; + tmp += clock->mult/2; + do_div(tmp, clock->mult); + if (tmp == 0) +@@ -80,6 +83,7 @@ static void timekeeper_setup_internals(struct clocksource *clock) + + /* Go back from cycles -> shifted ns */ + timekeeper.xtime_interval = (u64) interval * clock->mult; ++ timekeeper.xtime_remainder = ntpinterval - timekeeper.xtime_interval; + timekeeper.raw_interval = + ((u64) interval * clock->mult) >> clock->shift; + +@@ -772,7 +776,8 @@ static cycle_t logarithmic_accumulation(cycle_t offset, int shift) + + /* Accumulate error between NTP and clock interval */ + timekeeper.ntp_error += tick_length << shift; +- timekeeper.ntp_error -= timekeeper.xtime_interval << ++ timekeeper.ntp_error -= ++ (timekeeper.xtime_interval + timekeeper.xtime_remainder) << + (timekeeper.ntp_error_shift + shift); + + return offset; +-- +1.7.9.3 + diff --git a/next_round/usb-gadget-at91sam9g20-fix-end-point-max-packet-size.patch b/next_round/usb-gadget-at91sam9g20-fix-end-point-max-packet-size.patch new file mode 100644 index 0000000..e9e79e5 --- /dev/null +++ b/next_round/usb-gadget-at91sam9g20-fix-end-point-max-packet-size.patch @@ -0,0 +1,33 @@ +From 7614117b28322e769ddb105783c90e0cef90b080 Mon Sep 17 00:00:00 2001 +From: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> +Date: Fri, 13 May 2011 17:03:02 +0200 +Subject: [PATCH] usb/gadget: at91sam9g20 fix end point max packet size + +commit bf1f0a05d472e33dda8e5e69525be1584cdbd03a upstream. + +on 9g20 they are the same as the 9260 + +Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> +Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/usb/gadget/at91_udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c +index df1bae9..ad617d9 100644 +--- a/drivers/usb/gadget/at91_udc.c ++++ b/drivers/usb/gadget/at91_udc.c +@@ -1694,7 +1694,7 @@ static int __init at91udc_probe(struct platform_device *pdev) + } + + /* newer chips have more FIFO memory than rm9200 */ +- if (cpu_is_at91sam9260()) { ++ if (cpu_is_at91sam9260() || cpu_is_at91sam9g20()) { + udc->ep[0].maxpacket = 64; + udc->ep[3].maxpacket = 64; + udc->ep[4].maxpacket = 512; +-- +1.7.9.3 + diff --git a/next_round/usb-gadget-rndis-don-t-test-against-req-length.patch b/next_round/usb-gadget-rndis-don-t-test-against-req-length.patch new file mode 100644 index 0000000..d712f18 --- /dev/null +++ b/next_round/usb-gadget-rndis-don-t-test-against-req-length.patch @@ -0,0 +1,41 @@ +From 46d45c3a14474d27ed09901656d59b518427cf95 Mon Sep 17 00:00:00 2001 +From: Felipe Balbi <balbi@ti.com> +Date: Fri, 13 May 2011 16:53:48 +0300 +Subject: [PATCH] usb: gadget: rndis: don't test against req->length + +commit 472b91274a6c6857877b5caddb875dcb5ecdfcb8 upstream. + +composite.c always sets req->length to zero +and expects function driver's setup handlers +to return the amount of bytes to be used +on req->length. If we test against req->length +w_length will always be greater than req->length +thus making us always stall that particular +SEND_ENCAPSULATED_COMMAND request. + +Tested against a Windows XP SP3. + +Signed-off-by: Felipe Balbi <balbi@ti.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/usb/gadget/f_rndis.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c +index 56b0221..d1eb94a 100644 +--- a/drivers/usb/gadget/f_rndis.c ++++ b/drivers/usb/gadget/f_rndis.c +@@ -420,8 +420,7 @@ rndis_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl) + */ + case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8) + | USB_CDC_SEND_ENCAPSULATED_COMMAND: +- if (w_length > req->length || w_value +- || w_index != rndis->ctrl_id) ++ if (w_value || w_index != rndis->ctrl_id) + goto invalid; + /* read the request; process it later */ + value = w_length; +-- +1.7.9.3 + diff --git a/next_round/x86-64-bit-Fix-copy_-to-from-_user-checks-for-the-us.patch b/next_round/x86-64-bit-Fix-copy_-to-from-_user-checks-for-the-us.patch new file mode 100644 index 0000000..296d412 --- /dev/null +++ b/next_round/x86-64-bit-Fix-copy_-to-from-_user-checks-for-the-us.patch @@ -0,0 +1,122 @@ +From a0057041dfb508e57ed4c08d572203291d4f037d Mon Sep 17 00:00:00 2001 +From: Jiri Olsa <jolsa@redhat.com> +Date: Thu, 12 May 2011 16:30:30 +0200 +Subject: [PATCH] x86, 64-bit: Fix copy_[to/from]_user() checks for the + userspace address limit + +commit 26afb7c661080ae3f1f13ddf7f0c58c4f931c22b upstream. + +As reported in BZ #30352: + + https://bugzilla.kernel.org/show_bug.cgi?id=30352 + +there's a kernel bug related to reading the last allowed page on x86_64. + +The _copy_to_user() and _copy_from_user() functions use the following +check for address limit: + + if (buf + size >= limit) + fail(); + +while it should be more permissive: + + if (buf + size > limit) + fail(); + +That's because the size represents the number of bytes being +read/write from/to buf address AND including the buf address. +So the copy function will actually never touch the limit +address even if "buf + size == limit". + +Following program fails to use the last page as buffer +due to the wrong limit check: + + #include <sys/mman.h> + #include <sys/socket.h> + #include <assert.h> + + #define PAGE_SIZE (4096) + #define LAST_PAGE ((void*)(0x7fffffffe000)) + + int main() + { + int fds[2], err; + void * ptr = mmap(LAST_PAGE, PAGE_SIZE, PROT_READ | PROT_WRITE, + MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0); + assert(ptr == LAST_PAGE); + err = socketpair(AF_LOCAL, SOCK_STREAM, 0, fds); + assert(err == 0); + err = send(fds[0], ptr, PAGE_SIZE, 0); + perror("send"); + assert(err == PAGE_SIZE); + err = recv(fds[1], ptr, PAGE_SIZE, MSG_WAITALL); + perror("recv"); + assert(err == PAGE_SIZE); + return 0; + } + +The other place checking the addr limit is the access_ok() function, +which is working properly. There's just a misleading comment +for the __range_not_ok() macro - which this patch fixes as well. + +The last page of the user-space address range is a guard page and +Brian Gerst observed that the guard page itself due to an erratum on K8 cpus +(#121 Sequential Execution Across Non-Canonical Boundary Causes Processor +Hang). + +However, the test code is using the last valid page before the guard page. +The bug is that the last byte before the guard page can't be read +because of the off-by-one error. The guard page is left in place. + +This bug would normally not show up because the last page is +part of the process stack and never accessed via syscalls. + +Signed-off-by: Jiri Olsa <jolsa@redhat.com> +Acked-by: Brian Gerst <brgerst@gmail.com> +Acked-by: Linus Torvalds <torvalds@linux-foundation.org> +Link: http://lkml.kernel.org/r/1305210630-7136-1-git-send-email-jolsa@redhat.com +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + arch/x86/include/asm/uaccess.h | 2 +- + arch/x86/lib/copy_user_64.S | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h +index abd3e0e..99f0ad7 100644 +--- a/arch/x86/include/asm/uaccess.h ++++ b/arch/x86/include/asm/uaccess.h +@@ -42,7 +42,7 @@ + * Returns 0 if the range is valid, nonzero otherwise. + * + * This is equivalent to the following test: +- * (u33)addr + (u33)size >= (u33)current->addr_limit.seg (u65 for x86_64) ++ * (u33)addr + (u33)size > (u33)current->addr_limit.seg (u65 for x86_64) + * + * This needs 33-bit (65-bit for x86_64) arithmetic. We have a carry... + */ +diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S +index 71100c9..a4899ae 100644 +--- a/arch/x86/lib/copy_user_64.S ++++ b/arch/x86/lib/copy_user_64.S +@@ -72,7 +72,7 @@ ENTRY(_copy_to_user) + addq %rdx,%rcx + jc bad_to_user + cmpq TI_addr_limit(%rax),%rcx +- jae bad_to_user ++ ja bad_to_user + ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string + CFI_ENDPROC + ENDPROC(_copy_to_user) +@@ -85,7 +85,7 @@ ENTRY(_copy_from_user) + addq %rdx,%rcx + jc bad_from_user + cmpq TI_addr_limit(%rax),%rcx +- jae bad_from_user ++ ja bad_from_user + ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string + CFI_ENDPROC + ENDPROC(_copy_from_user) +-- +1.7.9.3 + diff --git a/next_round/x86-amd-Use-_safe-msr-access-for-GartTlbWlk-disable-.patch b/next_round/x86-amd-Use-_safe-msr-access-for-GartTlbWlk-disable-.patch new file mode 100644 index 0000000..61bce51 --- /dev/null +++ b/next_round/x86-amd-Use-_safe-msr-access-for-GartTlbWlk-disable-.patch @@ -0,0 +1,64 @@ +From ca16ed36cca5338519622743ee730156c8caeeb2 Mon Sep 17 00:00:00 2001 +From: "Roedel, Joerg" <Joerg.Roedel@amd.com> +Date: Thu, 19 May 2011 11:13:39 +0200 +Subject: [PATCH] x86, amd: Use _safe() msr access for GartTlbWlk disable code +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit d47cc0db8fd6011de2248df505fc34990b7451bf upstream. + +The workaround for Bugzilla: + + https://bugzilla.kernel.org/show_bug.cgi?id=33012 + +introduced a read and a write to the MC4 mask msr. + +Unfortunatly this MSR is not emulated by the KVM hypervisor +so that the kernel will get a #GP and crashes when applying +this workaround when running inside KVM. + +This issue was reported as: + + https://bugzilla.kernel.org/show_bug.cgi?id=35132 + +and is fixed with this patch. The change just let the kernel +ignore any #GP it gets while accessing this MSR by using the +_safe msr access methods. + +Reported-by: Török Edwin <edwintorok@gmail.com> +Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> +Cc: Rafael J. Wysocki <rjw@sisk.pl> +Cc: Maciej Rutecki <maciej.rutecki@gmail.com> +Cc: Avi Kivity <avi@redhat.com> +Cc: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + arch/x86/kernel/cpu/amd.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index 770346d..02a5a5f 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -586,10 +586,13 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c) + * Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=33012 + */ + u64 mask; ++ int err; + +- rdmsrl(MSR_AMD64_MCx_MASK(4), mask); +- mask |= (1 << 10); +- wrmsrl(MSR_AMD64_MCx_MASK(4), mask); ++ err = rdmsrl_safe(MSR_AMD64_MCx_MASK(4), &mask); ++ if (err == 0) { ++ mask |= (1 << 10); ++ checking_wrmsrl(MSR_AMD64_MCx_MASK(4), mask); ++ } + } + } + +-- +1.7.9.3 + diff --git a/next_round/x86-amd-iommu-Fix-3-possible-endless-loops.patch b/next_round/x86-amd-iommu-Fix-3-possible-endless-loops.patch new file mode 100644 index 0000000..9efecb1 --- /dev/null +++ b/next_round/x86-amd-iommu-Fix-3-possible-endless-loops.patch @@ -0,0 +1,54 @@ +From db6b6ee55e51b7348e402e9760ffb0194af09255 Mon Sep 17 00:00:00 2001 +From: Joerg Roedel <joerg.roedel@amd.com> +Date: Mon, 6 Jun 2011 16:04:02 +0200 +Subject: [PATCH] x86/amd-iommu: Fix 3 possible endless loops + +commit 0de66d5b35ee148455e268b2782873204ffdef4b upstream. + +The driver contains several loops counting on an u16 value +where the exit-condition is checked against variables that +can have values up to 0xffff. In this case the loops will +never exit. This patch fixed 3 such loops. + +Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + arch/x86/kernel/amd_iommu_init.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c +index fa749f7..82571af 100644 +--- a/arch/x86/kernel/amd_iommu_init.c ++++ b/arch/x86/kernel/amd_iommu_init.c +@@ -649,8 +649,8 @@ static void __init init_iommu_from_acpi(struct amd_iommu *iommu, + { + u8 *p = (u8 *)h; + u8 *end = p, flags = 0; +- u16 dev_i, devid = 0, devid_start = 0, devid_to = 0; +- u32 ext_flags = 0; ++ u16 devid = 0, devid_start = 0, devid_to = 0; ++ u32 dev_i, ext_flags = 0; + bool alias = false; + struct ivhd_entry *e; + +@@ -805,7 +805,7 @@ static void __init init_iommu_from_acpi(struct amd_iommu *iommu, + /* Initializes the device->iommu mapping for the driver */ + static int __init init_iommu_devices(struct amd_iommu *iommu) + { +- u16 i; ++ u32 i; + + for (i = iommu->first_device; i <= iommu->last_device; ++i) + set_iommu_for_device(iommu, i); +@@ -1094,7 +1094,7 @@ static int __init init_memory_definitions(struct acpi_table_header *table) + */ + static void init_device_table(void) + { +- u16 devid; ++ u32 devid; + + for (devid = 0; devid <= amd_iommu_last_bdf; ++devid) { + set_dev_entry_bit(devid, DEV_ENTRY_VALID); +-- +1.7.9.3 + diff --git a/next_round/xen-Use-IRQF_FORCE_RESUME.patch b/next_round/xen-Use-IRQF_FORCE_RESUME.patch new file mode 100644 index 0000000..6afefcc --- /dev/null +++ b/next_round/xen-Use-IRQF_FORCE_RESUME.patch @@ -0,0 +1,64 @@ +From 7c62853704de3012841eb36fcec1a924a1df37e2 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner <tglx@linutronix.de> +Date: Sat, 5 Feb 2011 20:08:59 +0000 +Subject: [PATCH] xen: Use IRQF_FORCE_RESUME + +commit 676dc3cf5bc36a9e129a3ad8fe3bd7b2ebf20f5d upstream. + +Mark the IRQF_NO_SUSPEND interrupts IRQF_FORCE_RESUME and remove the extra +walk through the interrupt descriptors. + +Signed-off-by: Thomas Gleixner <tglx@linutronix.de> +Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/xen/events.c | 19 +------------------ + 1 file changed, 1 insertion(+), 18 deletions(-) + +diff --git a/drivers/xen/events.c b/drivers/xen/events.c +index 9c66deb..9b471cc 100644 +--- a/drivers/xen/events.c ++++ b/drivers/xen/events.c +@@ -537,7 +537,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi, + if (irq < 0) + return irq; + +- irqflags |= IRQF_NO_SUSPEND; ++ irqflags |= IRQF_NO_SUSPEND | IRQF_FORCE_RESUME; + retval = request_irq(irq, handler, irqflags, devname, dev_id); + if (retval != 0) { + unbind_from_irq(irq); +@@ -896,7 +896,6 @@ void xen_poll_irq(int irq) + void xen_irq_resume(void) + { + unsigned int cpu, irq, evtchn; +- struct irq_desc *desc; + + init_evtchn_cpu_bindings(); + +@@ -916,22 +915,6 @@ void xen_irq_resume(void) + restore_cpu_ipis(cpu); + } + +- /* +- * Unmask any IRQF_NO_SUSPEND IRQs which are enabled. These +- * are not handled by the IRQ core. +- */ +- for_each_irq_desc(irq, desc) { +- if (!desc->action || !(desc->action->flags & IRQF_NO_SUSPEND)) +- continue; +- if (desc->status & IRQ_DISABLED) +- continue; +- +- evtchn = evtchn_from_irq(irq); +- if (evtchn == -1) +- continue; +- +- unmask_evtchn(evtchn); +- } + } + + static struct irq_chip xen_dynamic_chip __read_mostly = { +-- +1.7.9.3 + diff --git a/next_round/xen-events-do-not-unmask-event-channels-on-resume.patch b/next_round/xen-events-do-not-unmask-event-channels-on-resume.patch new file mode 100644 index 0000000..f573672 --- /dev/null +++ b/next_round/xen-events-do-not-unmask-event-channels-on-resume.patch @@ -0,0 +1,124 @@ +From 032cc00ddcb705b0a3b65eb2ba5ce1ee1c20942a Mon Sep 17 00:00:00 2001 +From: Ian Campbell <ian.campbell@citrix.com> +Date: Mon, 1 Nov 2010 16:30:09 +0000 +Subject: [PATCH] xen: events: do not unmask event channels on resume + +commit 6903591f314b8947d0e362bda7715e90eb9df75e upstream. + +The IRQ core code will take care of disabling and reenabling +interrupts over suspend resume automatically, therefore we do not need +to do this in the Xen event channel code. + +The only exception is those event channels marked IRQF_NO_SUSPEND +which the IRQ core ignores. We must unmask these ourselves, taking +care to obey the current IRQ_DISABLED status. Failure check for +IRQ_DISABLED leads to enabling polled only event channels, such as +that associated with the pv spinlocks, which must never be enabled: + +[ 21.970432] ------------[ cut here ]------------ +[ 21.970432] kernel BUG at arch/x86/xen/spinlock.c:343! +[ 21.970432] invalid opcode: 0000 [#1] SMP +[ 21.970432] last sysfs file: /sys/devices/virtual/net/lo/operstate +[ 21.970432] Modules linked in: +[ 21.970432] +[ 21.970432] Pid: 0, comm: swapper Not tainted (2.6.32.24-x86_32p-xen-01034-g787c727 #34) +[ 21.970432] EIP: 0061:[<c102e209>] EFLAGS: 00010046 CPU: 3 +[ 21.970432] EIP is at dummy_handler+0x3/0x7 +[ 21.970432] EAX: 0000021c EBX: dfc16880 ECX: 0000001a EDX: 00000000 +[ 21.970432] ESI: dfc02c00 EDI: 00000001 EBP: dfc47e10 ESP: dfc47e10 +[ 21.970432] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0069 +[ 21.970432] Process swapper (pid: 0, ti=dfc46000 task=dfc39440 task.ti=dfc46000) +[ 21.970432] Stack: +[ 21.970432] dfc47e30 c10a39f0 0000021c 00000000 00000000 dfc16880 0000021c 00000001 +[ 21.970432] <0> dfc47e40 c10a4f08 0000021c 00000000 dfc47e78 c12240a7 c1839284 c1839284 +[ 21.970432] <0> 00000200 00000000 00000000 f5720000 c1f3d028 c1f3d02c 00000180 dfc47e90 +[ 21.970432] Call Trace: +[ 21.970432] [<c10a39f0>] ? handle_IRQ_event+0x5f/0x122 +[ 21.970432] [<c10a4f08>] ? handle_percpu_irq+0x2f/0x55 +[ 21.970432] [<c12240a7>] ? __xen_evtchn_do_upcall+0xdb/0x15f +[ 21.970432] [<c122481e>] ? xen_evtchn_do_upcall+0x20/0x30 +[ 21.970432] [<c1030d47>] ? xen_do_upcall+0x7/0xc +[ 21.970432] [<c102007b>] ? apic_reg_read+0xd3/0x22d +[ 21.970432] [<c1002227>] ? hypercall_page+0x227/0x1005 +[ 21.970432] [<c102d30b>] ? xen_force_evtchn_callback+0xf/0x14 +[ 21.970432] [<c102da7c>] ? check_events+0x8/0xc +[ 21.970432] [<c102da3b>] ? xen_irq_enable_direct_end+0x0/0x1 +[ 21.970432] [<c105e485>] ? finish_task_switch+0x62/0xba +[ 21.970432] [<c14e3f84>] ? schedule+0x808/0x89d +[ 21.970432] [<c1084dc5>] ? hrtimer_start_expires+0x1a/0x22 +[ 21.970432] [<c1085154>] ? tick_nohz_restart_sched_tick+0x15a/0x162 +[ 21.970432] [<c102f43a>] ? cpu_idle+0x6d/0x6f +[ 21.970432] [<c14db29e>] ? cpu_bringup_and_idle+0xd/0xf +[ 21.970432] Code: 5d 0f 95 c0 0f b6 c0 c3 55 66 83 78 02 00 89 e5 5d 0f 95 \ +c0 0f b6 c0 c3 55 b2 01 86 10 31 c0 84 d2 89 e5 0f 94 c0 5d c3 55 89 e5 <0f> 0b \ +eb fe 55 80 3d 4c ce 84 c1 00 89 e5 57 56 89 c6 53 74 15 +[ 21.970432] EIP: [<c102e209>] dummy_handler+0x3/0x7 SS:ESP 0069:dfc47e10 +[ 21.970432] ---[ end trace c0b71f7e12cf3011 ]--- + +Signed-off-by: Ian Campbell <ian.campbell@citrix.com> +Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/xen/events.c | 25 ++++++++++++++++++------- + 1 file changed, 18 insertions(+), 7 deletions(-) + +diff --git a/drivers/xen/events.c b/drivers/xen/events.c +index 0769108..9c66deb 100644 +--- a/drivers/xen/events.c ++++ b/drivers/xen/events.c +@@ -819,9 +819,6 @@ static void restore_cpu_virqs(unsigned int cpu) + evtchn_to_irq[evtchn] = irq; + irq_info[irq] = mk_virq_info(evtchn, virq); + bind_evtchn_to_cpu(evtchn, cpu); +- +- /* Ready for use. */ +- unmask_evtchn(evtchn); + } + } + +@@ -847,10 +844,6 @@ static void restore_cpu_ipis(unsigned int cpu) + evtchn_to_irq[evtchn] = irq; + irq_info[irq] = mk_ipi_info(evtchn, ipi); + bind_evtchn_to_cpu(evtchn, cpu); +- +- /* Ready for use. */ +- unmask_evtchn(evtchn); +- + } + } + +@@ -903,6 +896,7 @@ void xen_poll_irq(int irq) + void xen_irq_resume(void) + { + unsigned int cpu, irq, evtchn; ++ struct irq_desc *desc; + + init_evtchn_cpu_bindings(); + +@@ -921,6 +915,23 @@ void xen_irq_resume(void) + restore_cpu_virqs(cpu); + restore_cpu_ipis(cpu); + } ++ ++ /* ++ * Unmask any IRQF_NO_SUSPEND IRQs which are enabled. These ++ * are not handled by the IRQ core. ++ */ ++ for_each_irq_desc(irq, desc) { ++ if (!desc->action || !(desc->action->flags & IRQF_NO_SUSPEND)) ++ continue; ++ if (desc->status & IRQ_DISABLED) ++ continue; ++ ++ evtchn = evtchn_from_irq(irq); ++ if (evtchn == -1) ++ continue; ++ ++ unmask_evtchn(evtchn); ++ } + } + + static struct irq_chip xen_dynamic_chip __read_mostly = { +-- +1.7.9.3 + diff --git a/next_round/xen-mmu-fix-a-race-window-causing-leave_mm-BUG.patch b/next_round/xen-mmu-fix-a-race-window-causing-leave_mm-BUG.patch new file mode 100644 index 0000000..3f0a645 --- /dev/null +++ b/next_round/xen-mmu-fix-a-race-window-causing-leave_mm-BUG.patch @@ -0,0 +1,104 @@ +From 756f0cc88f007db6b11eb23c9cc28bbb82344350 Mon Sep 17 00:00:00 2001 +From: "Tian, Kevin" <kevin.tian@intel.com> +Date: Thu, 12 May 2011 10:56:08 +0800 +Subject: [PATCH] xen mmu: fix a race window causing leave_mm BUG() + +commit 7899891c7d161752f29abcc9bc0a9c6c3a3af26c upstream. + +There's a race window in xen_drop_mm_ref, where remote cpu may exit +dirty bitmap between the check on this cpu and the point where remote +cpu handles drop request. So in drop_other_mm_ref we need check +whether TLB state is still lazy before calling into leave_mm. This +bug is rarely observed in earlier kernel, but exaggerated by the +commit 831d52bc153971b70e64eccfbed2b232394f22f8 +("x86, mm: avoid possible bogus tlb entries by clearing prev mm_cpumask after switching mm") +which clears bitmap after changing the TLB state. the call trace is as below: + +--------------------------------- +kernel BUG at arch/x86/mm/tlb.c:61! +invalid opcode: 0000 [#1] SMP +last sysfs file: /sys/devices/system/xen_memory/xen_memory0/info/current_kb +CPU 1 +Modules linked in: 8021q garp xen_netback xen_blkback blktap blkback_pagemap nbd bridge stp llc autofs4 ipmi_devintf ipmi_si ipmi_msghandler lockd sunrpc bonding ipv6 xenfs dm_multipath video output sbs sbshc parport_pc lp parport ses enclosure snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device serio_raw bnx2 snd_pcm_oss snd_mixer_oss snd_pcm snd_timer iTCO_wdt snd soundcore snd_page_alloc i2c_i801 iTCO_vendor_support i2c_core pcs pkr pata_acpi ata_generic ata_piix shpchp mptsas mptscsih mptbase [last unloaded: freq_table] +Pid: 25581, comm: khelper Not tainted 2.6.32.36fixxen #1 Tecal RH2285 +RIP: e030:[<ffffffff8103a3cb>] [<ffffffff8103a3cb>] leave_mm+0x15/0x46 +RSP: e02b:ffff88002805be48 EFLAGS: 00010046 +RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88015f8e2da0 +RDX: ffff88002805be78 RSI: 0000000000000000 RDI: 0000000000000001 +RBP: ffff88002805be48 R08: ffff88009d662000 R09: dead000000200200 +R10: dead000000100100 R11: ffffffff814472b2 R12: ffff88009bfc1880 +R13: ffff880028063020 R14: 00000000000004f6 R15: 0000000000000000 +FS: 00007f62362d66e0(0000) GS:ffff880028058000(0000) knlGS:0000000000000000 +CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b +CR2: 0000003aabc11909 CR3: 000000009b8ca000 CR4: 0000000000002660 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000000 00 +DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 +Process khelper (pid: 25581, threadinfo ffff88007691e000, task ffff88009b92db40) +Stack: + ffff88002805be68 ffffffff8100e4ae 0000000000000001 ffff88009d733b88 +<0> ffff88002805be98 ffffffff81087224 ffff88002805be78 ffff88002805be78 +<0> ffff88015f808360 00000000000004f6 ffff88002805bea8 ffffffff81010108 +Call Trace: + <IRQ> + [<ffffffff8100e4ae>] drop_other_mm_ref+0x2a/0x53 + [<ffffffff81087224>] generic_smp_call_function_single_interrupt+0xd8/0xfc + [<ffffffff81010108>] xen_call_function_single_interrupt+0x13/0x28 + [<ffffffff810a936a>] handle_IRQ_event+0x66/0x120 + [<ffffffff810aac5b>] handle_percpu_irq+0x41/0x6e + [<ffffffff8128c1c0>] __xen_evtchn_do_upcall+0x1ab/0x27d + [<ffffffff8128dd11>] xen_evtchn_do_upcall+0x33/0x46 + [<ffffffff81013efe>] xen_do_hyper visor_callback+0x1e/0x30 + <EOI> + [<ffffffff814472b2>] ? _spin_unlock_irqrestore+0x15/0x17 + [<ffffffff8100f8cf>] ? xen_restore_fl_direct_end+0x0/0x1 + [<ffffffff81113f71>] ? flush_old_exec+0x3ac/0x500 + [<ffffffff81150dc5>] ? load_elf_binary+0x0/0x17ef + [<ffffffff81150dc5>] ? load_elf_binary+0x0/0x17ef + [<ffffffff8115115d>] ? load_elf_binary+0x398/0x17ef + [<ffffffff81042fcf>] ? need_resched+0x23/0x2d + [<ffffffff811f4648>] ? process_measurement+0xc0/0xd7 + [<ffffffff81150dc5>] ? load_elf_binary+0x0/0x17ef + [<ffffffff81113094>] ? search_binary_handler+0xc8/0x255 + [<ffffffff81114362>] ? do_execve+0x1c3/0x29e + [<ffffffff8101155d>] ? sys_execve+0x43/0x5d + [<ffffffff8106fc45>] ? __call_usermodehelper+0x0/0x6f + [<ffffffff81013e28>] ? kernel_execve+0x68/0xd0 + [<ffffffff 8106fc45>] ? __call_usermodehelper+0x0/0x6f + [<ffffffff8100f8cf>] ? xen_restore_fl_direct_end+0x0/0x1 + [<ffffffff8106fb64>] ? ____call_usermodehelper+0x113/0x11e + [<ffffffff81013daa>] ? child_rip+0xa/0x20 + [<ffffffff8106fc45>] ? __call_usermodehelper+0x0/0x6f + [<ffffffff81012f91>] ? int_ret_from_sys_call+0x7/0x1b + [<ffffffff8101371d>] ? retint_restore_args+0x5/0x6 + [<ffffffff81013da0>] ? child_rip+0x0/0x20 +Code: 41 5e 41 5f c9 c3 55 48 89 e5 0f 1f 44 00 00 e8 17 ff ff ff c9 c3 55 48 89 e5 0f 1f 44 00 00 65 8b 04 25 c8 55 01 00 ff c8 75 04 <0f> 0b eb fe 65 48 8b 34 25 c0 55 01 00 48 81 c6 b8 02 00 00 e8 +RIP [<ffffffff8103a3cb>] leave_mm+0x15/0x46 + RSP <ffff88002805be48> +---[ end trace ce9cee6832a9c503 ]--- + +Tested-by: Maoxiaoyun<tinnycloud@hotmail.com> +Signed-off-by: Kevin Tian <kevin.tian@intel.com> +[v1: Fleshed out the git description a bit] +Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> + +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + arch/x86/xen/mmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c +index 6adff93..4916176 100644 +--- a/arch/x86/xen/mmu.c ++++ b/arch/x86/xen/mmu.c +@@ -1142,7 +1142,7 @@ static void drop_other_mm_ref(void *info) + + active_mm = percpu_read(cpu_tlbstate.active_mm); + +- if (active_mm == mm) ++ if (active_mm == mm && percpu_read(cpu_tlbstate.state) != TLBSTATE_OK) + leave_mm(smp_processor_id()); + + /* If this cpu still has a stale cr3 reference, then make sure +-- +1.7.9.3 + diff --git a/next_round/xen-off-by-one-errors-in-multicalls.c.patch b/next_round/xen-off-by-one-errors-in-multicalls.c.patch new file mode 100644 index 0000000..ca53f55 --- /dev/null +++ b/next_round/xen-off-by-one-errors-in-multicalls.c.patch @@ -0,0 +1,74 @@ +From 8d9089cc5093010623e4b630e56bfc377f822e14 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter <error27@gmail.com> +Date: Fri, 3 Jun 2011 07:45:28 +0300 +Subject: [PATCH] xen: off by one errors in multicalls.c + +commit f124c6ae59e193705c9ddac57684d50006d710e6 upstream. + +b->args[] has MC_ARGS elements, so the comparison here should be +">=" instead of ">". Otherwise we read past the end of the array +one space. + +Signed-off-by: Dan Carpenter <error27@gmail.com> +Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> +Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + arch/x86/xen/multicalls.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/x86/xen/multicalls.c b/arch/x86/xen/multicalls.c +index 8bff7e7..1b2b73f 100644 +--- a/arch/x86/xen/multicalls.c ++++ b/arch/x86/xen/multicalls.c +@@ -189,10 +189,10 @@ struct multicall_space __xen_mc_entry(size_t args) + unsigned argidx = roundup(b->argidx, sizeof(u64)); + + BUG_ON(preemptible()); +- BUG_ON(b->argidx > MC_ARGS); ++ BUG_ON(b->argidx >= MC_ARGS); + + if (b->mcidx == MC_BATCH || +- (argidx + args) > MC_ARGS) { ++ (argidx + args) >= MC_ARGS) { + mc_stats_flush(b->mcidx == MC_BATCH ? FL_SLOTS : FL_ARGS); + xen_mc_flush(); + argidx = roundup(b->argidx, sizeof(u64)); +@@ -206,7 +206,7 @@ struct multicall_space __xen_mc_entry(size_t args) + ret.args = &b->args[argidx]; + b->argidx = argidx + args; + +- BUG_ON(b->argidx > MC_ARGS); ++ BUG_ON(b->argidx >= MC_ARGS); + return ret; + } + +@@ -216,7 +216,7 @@ struct multicall_space xen_mc_extend_args(unsigned long op, size_t size) + struct multicall_space ret = { NULL, NULL }; + + BUG_ON(preemptible()); +- BUG_ON(b->argidx > MC_ARGS); ++ BUG_ON(b->argidx >= MC_ARGS); + + if (b->mcidx == 0) + return ret; +@@ -224,14 +224,14 @@ struct multicall_space xen_mc_extend_args(unsigned long op, size_t size) + if (b->entries[b->mcidx - 1].op != op) + return ret; + +- if ((b->argidx + size) > MC_ARGS) ++ if ((b->argidx + size) >= MC_ARGS) + return ret; + + ret.mc = &b->entries[b->mcidx - 1]; + ret.args = &b->args[b->argidx]; + b->argidx += size; + +- BUG_ON(b->argidx > MC_ARGS); ++ BUG_ON(b->argidx >= MC_ARGS); + return ret; + } + +-- +1.7.9.3 + diff --git a/next_round/xfs-properly-account-for-reclaimed-inodes.patch b/next_round/xfs-properly-account-for-reclaimed-inodes.patch new file mode 100644 index 0000000..4ee1e25 --- /dev/null +++ b/next_round/xfs-properly-account-for-reclaimed-inodes.patch @@ -0,0 +1,103 @@ +From 7ed1216ca70b21480dbd0ca6b10c0660efb06d22 Mon Sep 17 00:00:00 2001 +From: Johannes Weiner <hannes@cmpxchg.org> +Date: Fri, 1 Oct 2010 07:43:54 +0000 +Subject: [PATCH] xfs: properly account for reclaimed inodes + +commit 081003fff467ea0e727f66d5d435b4f473a789b3 upstream. + +When marking an inode reclaimable, a per-AG counter is increased, the +inode is tagged reclaimable in its per-AG tree, and, when this is the +first reclaimable inode in the AG, the AG entry in the per-mount tree +is also tagged. + +When an inode is finally reclaimed, however, it is only deleted from +the per-AG tree. Neither the counter is decreased, nor is the parent +tree's AG entry untagged properly. + +Since the tags in the per-mount tree are not cleared, the inode +shrinker iterates over all AGs that have had reclaimable inodes at one +point in time. + +The counters on the other hand signal an increasing amount of slab +objects to reclaim. Since "70e60ce xfs: convert inode shrinker to +per-filesystem context" this is not a real issue anymore because the +shrinker bails out after one iteration. + +But the problem was observable on a machine running v2.6.34, where the +reclaimable work increased and each process going into direct reclaim +eventually got stuck on the xfs inode shrinking path, trying to scan +several million objects. + +Fix this by properly unwinding the reclaimable-state tracking of an +inode when it is reclaimed. + +[PG: upstream has xfs_reclaim_inode in fs/xfs/linux-2.6/xfs_sync.c + but in 34 baseline, it is xfs_ireclaim in fs/xfs/xfs_iget.c so + drop the STATIC and add a prototype for it. ] + +Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> +Reviewed-by: Dave Chinner <dchinner@redhat.com> +Signed-off-by: Alex Elder <aelder@sgi.com> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + fs/xfs/linux-2.6/xfs_sync.c | 10 +++++++++- + fs/xfs/linux-2.6/xfs_sync.h | 2 ++ + fs/xfs/xfs_iget.c | 1 + + 3 files changed, 12 insertions(+), 1 deletion(-) + +diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c +index a427c63..c5a69a4 100644 +--- a/fs/xfs/linux-2.6/xfs_sync.c ++++ b/fs/xfs/linux-2.6/xfs_sync.c +@@ -707,6 +707,14 @@ xfs_inode_set_reclaim_tag( + } + + void ++__xfs_inode_clear_reclaim( ++ xfs_perag_t *pag, ++ xfs_inode_t *ip) ++{ ++ pag->pag_ici_reclaimable--; ++} ++ ++void + __xfs_inode_clear_reclaim_tag( + xfs_mount_t *mp, + xfs_perag_t *pag, +@@ -714,7 +722,7 @@ __xfs_inode_clear_reclaim_tag( + { + radix_tree_tag_clear(&pag->pag_ici_root, + XFS_INO_TO_AGINO(mp, ip->i_ino), XFS_ICI_RECLAIM_TAG); +- pag->pag_ici_reclaimable--; ++ __xfs_inode_clear_reclaim(pag, ip); + } + + /* +diff --git a/fs/xfs/linux-2.6/xfs_sync.h b/fs/xfs/linux-2.6/xfs_sync.h +index cdcbaac..bf82419 100644 +--- a/fs/xfs/linux-2.6/xfs_sync.h ++++ b/fs/xfs/linux-2.6/xfs_sync.h +@@ -49,6 +49,8 @@ void xfs_inode_set_reclaim_tag(struct xfs_inode *ip); + void __xfs_inode_set_reclaim_tag(struct xfs_perag *pag, struct xfs_inode *ip); + void __xfs_inode_clear_reclaim_tag(struct xfs_mount *mp, struct xfs_perag *pag, + struct xfs_inode *ip); ++void __xfs_inode_clear_reclaim(struct xfs_perag *pag, struct xfs_inode *ip); ++ + + int xfs_sync_inode_valid(struct xfs_inode *ip, struct xfs_perag *pag); + int xfs_inode_ag_iterator(struct xfs_mount *mp, +diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c +index 5ac3be0..14364c4 100644 +--- a/fs/xfs/xfs_iget.c ++++ b/fs/xfs/xfs_iget.c +@@ -495,6 +495,7 @@ xfs_ireclaim( + write_lock(&pag->pag_ici_lock); + if (!radix_tree_delete(&pag->pag_ici_root, agino)) + ASSERT(0); ++ __xfs_inode_clear_reclaim(pag, ip); + write_unlock(&pag->pag_ici_lock); + xfs_perag_put(pag); + +-- +1.7.9.3 + diff --git a/next_round/xhci-Fix-full-speed-bInterval-encoding.patch b/next_round/xhci-Fix-full-speed-bInterval-encoding.patch new file mode 100644 index 0000000..2cb8eaa --- /dev/null +++ b/next_round/xhci-Fix-full-speed-bInterval-encoding.patch @@ -0,0 +1,66 @@ +From 74e523db53c048eafb10d76a97e16dc2bbe8fc45 Mon Sep 17 00:00:00 2001 +From: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Date: Fri, 13 May 2011 13:10:01 -0700 +Subject: [PATCH] xhci: Fix full speed bInterval encoding. + +commit b513d44751bfb609a3c20463f764c8ce822d63e9 upstream. + +Dmitry's patch + +dfa49c4ad120a784ef1ff0717168aa79f55a483a USB: xhci - fix math in xhci_get_endpoint_interval() + +introduced a bug. The USB 2.0 spec says that full speed isochronous endpoints' +bInterval must be decoded as an exponent to a power of two (e.g. interval = +2^(bInterval - 1)). Full speed interrupt endpoints, on the other hand, don't +use exponents, and the interval in frames is encoded straight into bInterval. + +Dmitry's patch was supposed to fix up the full speed isochronous to parse +bInterval as an exponent, but instead it changed the *interrupt* endpoint +bInterval decoding. The isochronous endpoint encoding was the same. + +This caused full speed devices with interrupt endpoints (including mice, hubs, +and USB to ethernet devices) to fail under NEC 0.96 xHCI host controllers: + +[ 100.909818] xhci_hcd 0000:06:00.0: add ep 0x83, slot id 1, new drop flags = 0x0, new add flags = 0x99, new slot info = 0x38100000 +[ 100.909821] xhci_hcd 0000:06:00.0: xhci_check_bandwidth called for udev ffff88011f0ea000 +... +[ 100.910187] xhci_hcd 0000:06:00.0: ERROR: unexpected command completion code 0x11. +[ 100.910190] xhci_hcd 0000:06:00.0: xhci_reset_bandwidth called for udev ffff88011f0ea000 + +When the interrupt endpoint was added and a Configure Endpoint command was +issued to the host, the host controller would return a very odd error message +(0x11 means "Slot Not Enabled", which isn't true because the slot was enabled). +Probably the host controller was getting very confused with the bad encoding. + +Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Cc: Dmitry Torokhov <dtor@vmware.com> +Reported-by: Thomas Lindroth <thomas.lindroth@gmail.com> +Tested-by: Thomas Lindroth <thomas.lindroth@gmail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> +--- + drivers/usb/host/xhci-mem.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 54a538d..05b5c34 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -608,12 +608,12 @@ static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev, + break; + + case USB_SPEED_FULL: +- if (usb_endpoint_xfer_int(&ep->desc)) { ++ if (usb_endpoint_xfer_isoc(&ep->desc)) { + interval = xhci_parse_exponent_interval(udev, ep); + break; + } + /* +- * Fall through for isochronous endpoint interval decoding ++ * Fall through for interrupt endpoint interval decoding + * since it uses the same rules as low speed interrupt + * endpoints. + */ +-- +1.7.9.3 + |