diff options
| author | Zefan Li <lizefan@huawei.com> | 2015-04-14 17:34:54 +0800 |
|---|---|---|
| committer | Zefan Li <lizefan@huawei.com> | 2015-04-14 17:34:54 +0800 |
| commit | 0b38a5e578410bd569ce4f49f523caaded72c815 (patch) | |
| tree | a0d3b44ad4864a2c1f955822e7047f05b67ec9ad | |
| parent | 7ce75f1e04fa9e428d2767ab6b68cf3d9bebcc0a (diff) | |
| download | linux-3.4.y-queue-0b38a5e578410bd569ce4f49f523caaded72c815.tar.gz | |
Release 3.4.107
177 files changed, 0 insertions, 14271 deletions
diff --git a/patches/add-a-new-pid-vid-0227-0930-for-ar3012.patch b/patches/add-a-new-pid-vid-0227-0930-for-ar3012.patch deleted file mode 100644 index e1ad386..0000000 --- a/patches/add-a-new-pid-vid-0227-0930-for-ar3012.patch +++ /dev/null @@ -1,74 +0,0 @@ -From 89d2975fa06e66ea0d3665d91f799fb1ce4b8bad Mon Sep 17 00:00:00 2001 -From: Vincent Zwanenburg <vincentz@topmail.ie> -Date: Fri, 8 Aug 2014 12:33:56 +0100 -Subject: Add a new PID/VID 0227/0930 for AR3012. - -commit 89d2975fa06e66ea0d3665d91f799fb1ce4b8bad upstream. - -usb devices info: - -T: Bus=01 Lev=02 Prnt=05 Port=00 Cnt=01 Dev#= 20 Spd=12 MxCh= 0 -D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 -P: Vendor=0930 ProdID=0227 Rev= 0.02 -C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA -A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 -I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms -E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms -E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms -I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms -I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms -I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms -I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms -I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms -I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms - -Signed-off-by: Vincent Zwanenburg <vincentz@topmail.ie> -Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/bluetooth/ath3k.c | 2 ++ - drivers/bluetooth/btusb.c | 1 + - 2 files changed, 3 insertions(+) - ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -83,6 +83,7 @@ static struct usb_device_id ath3k_table[ - { USB_DEVICE(0x04CA, 0x3006) }, - { USB_DEVICE(0x04CA, 0x3008) }, - { USB_DEVICE(0x0930, 0x0219) }, -+ { USB_DEVICE(0x0930, 0x0227) }, - { USB_DEVICE(0x0b05, 0x17d0) }, - { USB_DEVICE(0x0CF3, 0x0036) }, - { USB_DEVICE(0x0CF3, 0x3004) }, -@@ -127,6 +128,7 @@ static struct usb_device_id ath3k_blist_ - { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -161,6 +161,7 @@ static struct usb_device_id blacklist_ta - { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, diff --git a/patches/ahci-add-deviceids-for-sunrise-point-lp-sata-controller.patch b/patches/ahci-add-deviceids-for-sunrise-point-lp-sata-controller.patch deleted file mode 100644 index 32b360e..0000000 --- a/patches/ahci-add-deviceids-for-sunrise-point-lp-sata-controller.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 249cd0a187ed4ef1d0af7f74362cc2791ec5581b Mon Sep 17 00:00:00 2001 -From: Devin Ryles <devin.ryles@intel.com> -Date: Fri, 7 Nov 2014 17:59:05 -0500 -Subject: AHCI: Add DeviceIDs for Sunrise Point-LP SATA controller - -commit 249cd0a187ed4ef1d0af7f74362cc2791ec5581b upstream. - -This patch adds DeviceIDs for Sunrise Point-LP. - -Signed-off-by: Devin Ryles <devin.ryles@intel.com> -Signed-off-by: Tejun Heo <tj@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/ata/ahci.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/ata/ahci.c -+++ b/drivers/ata/ahci.c -@@ -313,6 +313,9 @@ static const struct pci_device_id ahci_p - { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */ - { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */ - { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */ -+ { PCI_VDEVICE(INTEL, 0x9d03), board_ahci }, /* Sunrise Point-LP AHCI */ -+ { PCI_VDEVICE(INTEL, 0x9d05), board_ahci }, /* Sunrise Point-LP RAID */ -+ { PCI_VDEVICE(INTEL, 0x9d07), board_ahci }, /* Sunrise Point-LP RAID */ - { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */ - { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H RAID */ - { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */ diff --git a/patches/ahci-disable-msi-instead-of-ncq-on-samsung-pci-e-ssds-on-macbooks.patch b/patches/ahci-disable-msi-instead-of-ncq-on-samsung-pci-e-ssds-on-macbooks.patch deleted file mode 100644 index bd507cc..0000000 --- a/patches/ahci-disable-msi-instead-of-ncq-on-samsung-pci-e-ssds-on-macbooks.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 66a7cbc303f4d28f201529b06061944d51ab530c Mon Sep 17 00:00:00 2001 -From: Tejun Heo <tj@kernel.org> -Date: Mon, 27 Oct 2014 10:22:56 -0400 -Subject: ahci: disable MSI instead of NCQ on Samsung pci-e SSDs on macbooks - -commit 66a7cbc303f4d28f201529b06061944d51ab530c upstream. - -Samsung pci-e SSDs on macbooks failed miserably on NCQ commands, so -67809f85d31e ("ahci: disable NCQ on Samsung pci-e SSDs on macbooks") -disabled NCQ on them. It turns out that NCQ is fine as long as MSI is -not used, so let's turn off MSI and leave NCQ on. - -Signed-off-by: Tejun Heo <tj@kernel.org> -Link: https://bugzilla.kernel.org/show_bug.cgi?id=60731 -Tested-by: <dorin@i51.org> -Tested-by: Imre Kaloz <kaloz@openwrt.org> -Fixes: 67809f85d31e ("ahci: disable NCQ on Samsung pci-e SSDs on macbooks") -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/ata/ahci.c | 14 +++++++++++--- - 1 file changed, 11 insertions(+), 3 deletions(-) - ---- a/drivers/ata/ahci.c -+++ b/drivers/ata/ahci.c -@@ -61,6 +61,7 @@ enum board_ids { - /* board IDs by feature in alphabetical order */ - board_ahci, - board_ahci_ign_iferr, -+ board_ahci_nomsi, - board_ahci_noncq, - board_ahci_nosntf, - board_ahci_yes_fbs, -@@ -122,6 +123,13 @@ static const struct ata_port_info ahci_p - .udma_mask = ATA_UDMA6, - .port_ops = &ahci_ops, - }, -+ [board_ahci_nomsi] = { -+ AHCI_HFLAGS (AHCI_HFLAG_NO_MSI), -+ .flags = AHCI_FLAG_COMMON, -+ .pio_mask = ATA_PIO4, -+ .udma_mask = ATA_UDMA6, -+ .port_ops = &ahci_ops, -+ }, - [board_ahci_noncq] = { - AHCI_HFLAGS (AHCI_HFLAG_NO_NCQ), - .flags = AHCI_FLAG_COMMON, -@@ -481,10 +489,10 @@ static const struct pci_device_id ahci_p - { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci }, /* ASM1062 */ - - /* -- * Samsung SSDs found on some macbooks. NCQ times out. -- * https://bugzilla.kernel.org/show_bug.cgi?id=60731 -+ * Samsung SSDs found on some macbooks. NCQ times out if MSI is -+ * enabled. https://bugzilla.kernel.org/show_bug.cgi?id=60731 - */ -- { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_noncq }, -+ { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_nomsi }, - - /* Enmotus */ - { PCI_DEVICE(0x1c44, 0x8000), board_ahci }, diff --git a/patches/ahci-disable-msi-on-samsung-0xa800-ssd.patch b/patches/ahci-disable-msi-on-samsung-0xa800-ssd.patch deleted file mode 100644 index 824b74d..0000000 --- a/patches/ahci-disable-msi-on-samsung-0xa800-ssd.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 2b21ef0aae65f22f5ba86b13c4588f6f0c2dbefb Mon Sep 17 00:00:00 2001 -From: Tejun Heo <tj@kernel.org> -Date: Thu, 4 Dec 2014 13:13:28 -0500 -Subject: ahci: disable MSI on SAMSUNG 0xa800 SSD - -commit 2b21ef0aae65f22f5ba86b13c4588f6f0c2dbefb upstream. - -Just like 0x1600 which got blacklisted by 66a7cbc303f4 ("ahci: disable -MSI instead of NCQ on Samsung pci-e SSDs on macbooks"), 0xa800 chokes -on NCQ commands if MSI is enabled. Disable MSI. - -Signed-off-by: Tejun Heo <tj@kernel.org> -Reported-by: Dominik Mierzejewski <dominik@greysector.net> -Link: https://bugzilla.kernel.org/show_bug.cgi?id=89171 -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/ata/ahci.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/ata/ahci.c -+++ b/drivers/ata/ahci.c -@@ -493,6 +493,7 @@ static const struct pci_device_id ahci_p - * enabled. https://bugzilla.kernel.org/show_bug.cgi?id=60731 - */ - { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_nomsi }, -+ { PCI_VDEVICE(SAMSUNG, 0xa800), board_ahci_nomsi }, - - /* Enmotus */ - { PCI_DEVICE(0x1c44, 0x8000), board_ahci }, diff --git a/patches/ahci-disable-ncq-on-samsung-pci-e-ssds-on-macbooks.patch b/patches/ahci-disable-ncq-on-samsung-pci-e-ssds-on-macbooks.patch deleted file mode 100644 index 6b345fb..0000000 --- a/patches/ahci-disable-ncq-on-samsung-pci-e-ssds-on-macbooks.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 67809f85d31eac600f6b28defa5386c9d2a13b1d Mon Sep 17 00:00:00 2001 -From: Levente Kurusa <levex@linux.com> -Date: Tue, 18 Feb 2014 10:22:17 -0500 -Subject: ahci: disable NCQ on Samsung pci-e SSDs on macbooks - -commit 67809f85d31eac600f6b28defa5386c9d2a13b1d upstream. - -Samsung's pci-e SSDs with device ID 0x1600 which are found on some -macbooks time out on NCQ commands. Blacklist NCQ on the device so -that the affected machines can at least boot. - -Original-patch-by: Levente Kurusa <levex@linux.com> -Signed-off-by: Tejun Heo <tj@kernel.org> -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=60731 -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/ata/ahci.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - ---- a/drivers/ata/ahci.c -+++ b/drivers/ata/ahci.c -@@ -61,6 +61,7 @@ enum board_ids { - /* board IDs by feature in alphabetical order */ - board_ahci, - board_ahci_ign_iferr, -+ board_ahci_noncq, - board_ahci_nosntf, - board_ahci_yes_fbs, - -@@ -121,6 +122,13 @@ static const struct ata_port_info ahci_p - .udma_mask = ATA_UDMA6, - .port_ops = &ahci_ops, - }, -+ [board_ahci_noncq] = { -+ AHCI_HFLAGS (AHCI_HFLAG_NO_NCQ), -+ .flags = AHCI_FLAG_COMMON, -+ .pio_mask = ATA_PIO4, -+ .udma_mask = ATA_UDMA6, -+ .port_ops = &ahci_ops, -+ }, - [board_ahci_nosntf] = - { - AHCI_HFLAGS (AHCI_HFLAG_NO_SNTF), -@@ -472,6 +480,12 @@ static const struct pci_device_id ahci_p - { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci }, /* ASM1061 */ - { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci }, /* ASM1062 */ - -+ /* -+ * Samsung SSDs found on some macbooks. NCQ times out. -+ * https://bugzilla.kernel.org/show_bug.cgi?id=60731 -+ */ -+ { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_noncq }, -+ - /* Enmotus */ - { PCI_DEVICE(0x1c44, 0x8000), board_ahci }, - diff --git a/patches/alsa-ak411x-fix-stall-in-work-callback.patch b/patches/alsa-ak411x-fix-stall-in-work-callback.patch deleted file mode 100644 index 696821f..0000000 --- a/patches/alsa-ak411x-fix-stall-in-work-callback.patch +++ /dev/null @@ -1,150 +0,0 @@ -From 4161b4505f1690358ac0a9ee59845a7887336b21 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 13 Jan 2015 10:53:20 +0100 -Subject: ALSA: ak411x: Fix stall in work callback - -commit 4161b4505f1690358ac0a9ee59845a7887336b21 upstream. - -When ak4114 work calls its callback and the callback invokes -ak4114_reinit(), it stalls due to flush_delayed_work(). For avoiding -this, control the reentrance by introducing a refcount. Also -flush_delayed_work() is replaced with cancel_delayed_work_sync(). - -The exactly same bug is present in ak4113.c and fixed as well. - -Reported-by: Pavel Hofman <pavel.hofman@ivitera.com> -Acked-by: Jaroslav Kysela <perex@perex.cz> -Tested-by: Pavel Hofman <pavel.hofman@ivitera.com> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -[lizf: Backported to 3.4: snd_ak4113_reinit() and snd_ak4114_reinit() -used flush_delayed_work_sync() instead of flush_delayed_work()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - include/sound/ak4113.h | 2 +- - include/sound/ak4114.h | 2 +- - sound/i2c/other/ak4113.c | 17 ++++++++--------- - sound/i2c/other/ak4114.c | 18 ++++++++---------- - 4 files changed, 18 insertions(+), 21 deletions(-) - ---- a/include/sound/ak4113.h -+++ b/include/sound/ak4113.h -@@ -286,7 +286,7 @@ struct ak4113 { - ak4113_write_t *write; - ak4113_read_t *read; - void *private_data; -- unsigned int init:1; -+ atomic_t wq_processing; - spinlock_t lock; - unsigned char regmap[AK4113_WRITABLE_REGS]; - struct snd_kcontrol *kctls[AK4113_CONTROLS]; ---- a/include/sound/ak4114.h -+++ b/include/sound/ak4114.h -@@ -168,7 +168,7 @@ struct ak4114 { - ak4114_write_t * write; - ak4114_read_t * read; - void * private_data; -- unsigned int init: 1; -+ atomic_t wq_processing; - spinlock_t lock; - unsigned char regmap[7]; - unsigned char txcsb[5]; ---- a/sound/i2c/other/ak4113.c -+++ b/sound/i2c/other/ak4113.c -@@ -56,8 +56,7 @@ static inline unsigned char reg_read(str - - static void snd_ak4113_free(struct ak4113 *chip) - { -- chip->init = 1; /* don't schedule new work */ -- mb(); -+ atomic_inc(&chip->wq_processing); /* don't schedule new work */ - cancel_delayed_work_sync(&chip->work); - kfree(chip); - } -@@ -89,6 +88,7 @@ int snd_ak4113_create(struct snd_card *c - chip->write = write; - chip->private_data = private_data; - INIT_DELAYED_WORK(&chip->work, ak4113_stats); -+ atomic_set(&chip->wq_processing, 0); - - for (reg = 0; reg < AK4113_WRITABLE_REGS ; reg++) - chip->regmap[reg] = pgm[reg]; -@@ -139,13 +139,11 @@ static void ak4113_init_regs(struct ak41 - - void snd_ak4113_reinit(struct ak4113 *chip) - { -- chip->init = 1; -- mb(); -- flush_delayed_work_sync(&chip->work); -+ if (atomic_inc_return(&chip->wq_processing) == 1) -+ cancel_delayed_work_sync(&chip->work); - ak4113_init_regs(chip); - /* bring up statistics / event queing */ -- chip->init = 0; -- if (chip->kctls[0]) -+ if (atomic_dec_and_test(&chip->wq_processing)) - schedule_delayed_work(&chip->work, HZ / 10); - } - EXPORT_SYMBOL_GPL(snd_ak4113_reinit); -@@ -632,8 +630,9 @@ static void ak4113_stats(struct work_str - { - struct ak4113 *chip = container_of(work, struct ak4113, work.work); - -- if (!chip->init) -+ if (atomic_inc_return(&chip->wq_processing) == 1) - snd_ak4113_check_rate_and_errors(chip, chip->check_flags); - -- schedule_delayed_work(&chip->work, HZ / 10); -+ if (atomic_dec_and_test(&chip->wq_processing)) -+ schedule_delayed_work(&chip->work, HZ / 10); - } ---- a/sound/i2c/other/ak4114.c -+++ b/sound/i2c/other/ak4114.c -@@ -66,8 +66,7 @@ static void reg_dump(struct ak4114 *ak41 - - static void snd_ak4114_free(struct ak4114 *chip) - { -- chip->init = 1; /* don't schedule new work */ -- mb(); -+ atomic_inc(&chip->wq_processing); /* don't schedule new work */ - cancel_delayed_work_sync(&chip->work); - kfree(chip); - } -@@ -100,6 +99,7 @@ int snd_ak4114_create(struct snd_card *c - chip->write = write; - chip->private_data = private_data; - INIT_DELAYED_WORK(&chip->work, ak4114_stats); -+ atomic_set(&chip->wq_processing, 0); - - for (reg = 0; reg < 7; reg++) - chip->regmap[reg] = pgm[reg]; -@@ -152,13 +152,11 @@ static void ak4114_init_regs(struct ak41 - - void snd_ak4114_reinit(struct ak4114 *chip) - { -- chip->init = 1; -- mb(); -- flush_delayed_work_sync(&chip->work); -+ if (atomic_inc_return(&chip->wq_processing) == 1) -+ cancel_delayed_work_sync(&chip->work); - ak4114_init_regs(chip); - /* bring up statistics / event queing */ -- chip->init = 0; -- if (chip->kctls[0]) -+ if (atomic_dec_and_test(&chip->wq_processing)) - schedule_delayed_work(&chip->work, HZ / 10); - } - -@@ -612,10 +610,10 @@ static void ak4114_stats(struct work_str - { - struct ak4114 *chip = container_of(work, struct ak4114, work.work); - -- if (!chip->init) -+ if (atomic_inc_return(&chip->wq_processing) == 1) - snd_ak4114_check_rate_and_errors(chip, chip->check_flags); -- -- schedule_delayed_work(&chip->work, HZ / 10); -+ if (atomic_dec_and_test(&chip->wq_processing)) -+ schedule_delayed_work(&chip->work, HZ / 10); - } - - EXPORT_SYMBOL(snd_ak4114_create); diff --git a/patches/alsa-hda-fix-wrong-gpio_dir-gpio_mask-hint-setups-for-idt-stac-codecs.patch b/patches/alsa-hda-fix-wrong-gpio_dir-gpio_mask-hint-setups-for-idt-stac-codecs.patch deleted file mode 100644 index 0432b5a..0000000 --- a/patches/alsa-hda-fix-wrong-gpio_dir-gpio_mask-hint-setups-for-idt-stac-codecs.patch +++ /dev/null @@ -1,33 +0,0 @@ -From c507de88f6a336bd7296c9ec0073b2d4af8b4f5e Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Mon, 5 Jan 2015 13:27:33 +0100 -Subject: ALSA: hda - Fix wrong gpio_dir & gpio_mask hint setups for IDT/STAC - codecs - -commit c507de88f6a336bd7296c9ec0073b2d4af8b4f5e upstream. - -stac_store_hints() does utterly wrong for masking the values for -gpio_dir and gpio_data, likely due to copy&paste errors. Fortunately, -this feature is used very rarely, so the impact must be really small. - -Reported-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/pci/hda/patch_sigmatel.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/sound/pci/hda/patch_sigmatel.c -+++ b/sound/pci/hda/patch_sigmatel.c -@@ -4246,9 +4246,9 @@ static void stac_store_hints(struct hda_ - spec->gpio_mask; - } - if (get_int_hint(codec, "gpio_dir", &spec->gpio_dir)) -- spec->gpio_mask &= spec->gpio_mask; -- if (get_int_hint(codec, "gpio_data", &spec->gpio_data)) - spec->gpio_dir &= spec->gpio_mask; -+ if (get_int_hint(codec, "gpio_data", &spec->gpio_data)) -+ spec->gpio_data &= spec->gpio_mask; - if (get_int_hint(codec, "eapd_mask", &spec->eapd_mask)) - spec->eapd_mask &= spec->gpio_mask; - if (get_int_hint(codec, "gpio_mute", &spec->gpio_mute)) diff --git a/patches/alsa-hda-limit-40bit-dma-for-amd-hdmi-controllers.patch b/patches/alsa-hda-limit-40bit-dma-for-amd-hdmi-controllers.patch deleted file mode 100644 index d56455e..0000000 --- a/patches/alsa-hda-limit-40bit-dma-for-amd-hdmi-controllers.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 413cbf469a19e7662ba5025695bf5a573927105a Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Wed, 1 Oct 2014 10:30:53 +0200 -Subject: ALSA: hda - Limit 40bit DMA for AMD HDMI controllers - -commit 413cbf469a19e7662ba5025695bf5a573927105a upstream. - -AMD/ATI HDMI controller chip models, we already have a filter to lower -to 32bit DMA, but the rest are supposed to be working with 64bit -although the hardware doesn't really work with 63bit but only with 40 -or 48bit DMA. In this patch, we take 40bit DMA for safety for the -AMD/ATI controllers as the graphics drivers does. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> -[lizf: Backported to 3.4: - - adjust context - - s/AZX_GCAP_640K/ICH6_GCAP_64OK] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/pci/hda/hda_intel.c | 14 +++++++++++--- - 1 file changed, 11 insertions(+), 3 deletions(-) - ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2685,6 +2685,7 @@ static int __devinit azx_create(struct s - struct azx *chip; - int i, err; - unsigned short gcap; -+ unsigned int dma_bits = 64; - static struct snd_device_ops ops = { - .dev_free = azx_dev_free, - }; -@@ -2780,9 +2781,14 @@ static int __devinit azx_create(struct s - gcap = azx_readw(chip, GCAP); - snd_printdd(SFX "chipset global capabilities = 0x%x\n", gcap); - -+ /* AMD devices support 40 or 48bit DMA, take the safe one */ -+ if (chip->pci->vendor == PCI_VENDOR_ID_AMD) -+ dma_bits = 40; -+ - /* disable SB600 64bit support for safety */ - if (chip->pci->vendor == PCI_VENDOR_ID_ATI) { - struct pci_dev *p_smbus; -+ dma_bits = 40; - p_smbus = pci_get_device(PCI_VENDOR_ID_ATI, - PCI_DEVICE_ID_ATI_SBX00_SMBUS, - NULL); -@@ -2812,9 +2818,11 @@ static int __devinit azx_create(struct s - } - - /* allow 64bit DMA address if supported by H/W */ -- if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64))) -- pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64)); -- else { -+ if (!(gcap & ICH6_GCAP_64OK)) -+ dma_bits = 32; -+ if (!pci_set_dma_mask(pci, DMA_BIT_MASK(dma_bits))) { -+ pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(dma_bits)); -+ } else { - pci_set_dma_mask(pci, DMA_BIT_MASK(32)); - pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(32)); - } diff --git a/patches/alsa-seq-dummy-remove-deadlock-causing-events-on-close.patch b/patches/alsa-seq-dummy-remove-deadlock-causing-events-on-close.patch deleted file mode 100644 index bb115e4..0000000 --- a/patches/alsa-seq-dummy-remove-deadlock-causing-events-on-close.patch +++ /dev/null @@ -1,71 +0,0 @@ -From 0767e95bb96d7fdddcd590fb809e6975d93aebc5 Mon Sep 17 00:00:00 2001 -From: Clemens Ladisch <clemens@ladisch.de> -Date: Sun, 25 Jan 2015 14:34:29 +0100 -Subject: ALSA: seq-dummy: remove deadlock-causing events on close - -commit 0767e95bb96d7fdddcd590fb809e6975d93aebc5 upstream. - -When the last subscriber to a "Through" port has been removed, the -subscribed destination ports might still be active, so it would be -wrong to send "all sounds off" and "reset controller" events to them. -The proper place for such a shutdown would be the closing of the actual -MIDI port (and close_substream() in rawmidi.c already can do this). - -This also fixes a deadlock when dummy_unuse() tries to send events to -its own port that is already locked because it is being freed. - -Reported-by: Peter Billam <peter@www.pjb.com.au> -Signed-off-by: Clemens Ladisch <clemens@ladisch.de> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/core/seq/seq_dummy.c | 31 ------------------------------- - 1 file changed, 31 deletions(-) - ---- a/sound/core/seq/seq_dummy.c -+++ b/sound/core/seq/seq_dummy.c -@@ -82,36 +82,6 @@ struct snd_seq_dummy_port { - static int my_client = -1; - - /* -- * unuse callback - send ALL_SOUNDS_OFF and RESET_CONTROLLERS events -- * to subscribers. -- * Note: this callback is called only after all subscribers are removed. -- */ --static int --dummy_unuse(void *private_data, struct snd_seq_port_subscribe *info) --{ -- struct snd_seq_dummy_port *p; -- int i; -- struct snd_seq_event ev; -- -- p = private_data; -- memset(&ev, 0, sizeof(ev)); -- if (p->duplex) -- ev.source.port = p->connect; -- else -- ev.source.port = p->port; -- ev.dest.client = SNDRV_SEQ_ADDRESS_SUBSCRIBERS; -- ev.type = SNDRV_SEQ_EVENT_CONTROLLER; -- for (i = 0; i < 16; i++) { -- ev.data.control.channel = i; -- ev.data.control.param = MIDI_CTL_ALL_SOUNDS_OFF; -- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0); -- ev.data.control.param = MIDI_CTL_RESET_CONTROLLERS; -- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0); -- } -- return 0; --} -- --/* - * event input callback - just redirect events to subscribers - */ - static int -@@ -175,7 +145,6 @@ create_port(int idx, int type) - | SNDRV_SEQ_PORT_TYPE_PORT; - memset(&pcb, 0, sizeof(pcb)); - pcb.owner = THIS_MODULE; -- pcb.unuse = dummy_unuse; - pcb.event_input = dummy_input; - pcb.private_free = dummy_free; - pcb.private_data = rec; diff --git a/patches/alsa-usb-audio-add-mic-volume-fix-quirk-for-logitech-webcam-c210.patch b/patches/alsa-usb-audio-add-mic-volume-fix-quirk-for-logitech-webcam-c210.patch deleted file mode 100644 index aa67be2..0000000 --- a/patches/alsa-usb-audio-add-mic-volume-fix-quirk-for-logitech-webcam-c210.patch +++ /dev/null @@ -1,24 +0,0 @@ -From 6455931186bff407493135e74c5f32efd30860e2 Mon Sep 17 00:00:00 2001 -From: Jason Lee Cragg <jcragg@gmail.com> -Date: Sat, 17 Jan 2015 12:28:29 -0500 -Subject: ALSA: usb-audio: Add mic volume fix quirk for Logitech Webcam C210 - -commit 6455931186bff407493135e74c5f32efd30860e2 upstream. - -Signed-off-by: Jason Lee Cragg <jcragg@gmail.com> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/usb/mixer.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -834,6 +834,7 @@ static void volume_control_quirks(struct - case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */ - case USB_ID(0x046d, 0x0808): - case USB_ID(0x046d, 0x0809): -+ case USB_ID(0x046d, 0x0819): /* Logitech Webcam C210 */ - case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */ - case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */ - case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */ diff --git a/patches/alsa-usb-audio-don-t-resubmit-pending-urbs-at-midi-error-recovery.patch b/patches/alsa-usb-audio-don-t-resubmit-pending-urbs-at-midi-error-recovery.patch deleted file mode 100644 index 8bb988a..0000000 --- a/patches/alsa-usb-audio-don-t-resubmit-pending-urbs-at-midi-error-recovery.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 66139a48cee1530c91f37c145384b4ee7043f0b7 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Sat, 6 Dec 2014 18:02:55 +0100 -Subject: ALSA: usb-audio: Don't resubmit pending URBs at MIDI error recovery - -commit 66139a48cee1530c91f37c145384b4ee7043f0b7 upstream. - -In snd_usbmidi_error_timer(), the driver tries to resubmit MIDI input -URBs to reactivate the MIDI stream, but this causes the error when -some of URBs are still pending like: - - WARNING: CPU: 0 PID: 0 at ../drivers/usb/core/urb.c:339 usb_submit_urb+0x5f/0x70() - URB ef705c40 submitted while active - CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.16.6-2-desktop #1 - Hardware name: FOXCONN TPS01/TPS01, BIOS 080015 03/23/2010 - c0984bfa f4009ed4 c078deaf f4009ee4 c024c884 c09a135c f4009f00 00000000 - c0984bfa 00000153 c061ac4f c061ac4f 00000009 00000001 ef705c40 e854d1c0 - f4009eec c024c8d3 00000009 f4009ee4 c09a135c f4009f00 f4009f04 c061ac4f - Call Trace: - [<c0205df6>] try_stack_unwind+0x156/0x170 - [<c020482a>] dump_trace+0x5a/0x1b0 - [<c0205e56>] show_trace_log_lvl+0x46/0x50 - [<c02049d1>] show_stack_log_lvl+0x51/0xe0 - [<c0205eb7>] show_stack+0x27/0x50 - [<c078deaf>] dump_stack+0x45/0x65 - [<c024c884>] warn_slowpath_common+0x84/0xa0 - [<c024c8d3>] warn_slowpath_fmt+0x33/0x40 - [<c061ac4f>] usb_submit_urb+0x5f/0x70 - [<f7974104>] snd_usbmidi_submit_urb+0x14/0x60 [snd_usbmidi_lib] - [<f797483a>] snd_usbmidi_error_timer+0x6a/0xa0 [snd_usbmidi_lib] - [<c02570c0>] call_timer_fn+0x30/0x130 - [<c0257442>] run_timer_softirq+0x1c2/0x260 - [<c0251493>] __do_softirq+0xc3/0x270 - [<c0204732>] do_softirq_own_stack+0x22/0x30 - [<c025186d>] irq_exit+0x8d/0xa0 - [<c0795228>] smp_apic_timer_interrupt+0x38/0x50 - [<c0794a3c>] apic_timer_interrupt+0x34/0x3c - [<c0673d9e>] cpuidle_enter_state+0x3e/0xd0 - [<c028bb8d>] cpu_idle_loop+0x29d/0x3e0 - [<c028bd23>] cpu_startup_entry+0x53/0x60 - [<c0bfac1e>] start_kernel+0x415/0x41a - -For avoiding these errors, check the pending URBs and skip -resubmitting such ones. - -Reported-and-tested-by: Stefan Seyfried <stefan.seyfried@googlemail.com> -Acked-by: Clemens Ladisch <clemens@ladisch.de> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/usb/midi.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/sound/usb/midi.c -+++ b/sound/usb/midi.c -@@ -364,6 +364,8 @@ static void snd_usbmidi_error_timer(unsi - if (in && in->error_resubmit) { - in->error_resubmit = 0; - for (j = 0; j < INPUT_URBS; ++j) { -+ if (atomic_read(&in->urbs[j]->use_count)) -+ continue; - in->urbs[j]->dev = umidi->dev; - snd_usbmidi_submit_urb(in->urbs[j], GFP_ATOMIC); - } diff --git a/patches/alsa-usb-audio-extend-kef-x300a-fu-10-tweak-to-arcam-rpac.patch b/patches/alsa-usb-audio-extend-kef-x300a-fu-10-tweak-to-arcam-rpac.patch deleted file mode 100644 index 6291bea..0000000 --- a/patches/alsa-usb-audio-extend-kef-x300a-fu-10-tweak-to-arcam-rpac.patch +++ /dev/null @@ -1,57 +0,0 @@ -From d70a1b9893f820fdbcdffac408c909c50f2e6b43 Mon Sep 17 00:00:00 2001 -From: Jiri Jaburek <jjaburek@redhat.com> -Date: Thu, 18 Dec 2014 02:03:19 +0100 -Subject: ALSA: usb-audio: extend KEF X300A FU 10 tweak to Arcam rPAC - -commit d70a1b9893f820fdbcdffac408c909c50f2e6b43 upstream. - -The Arcam rPAC seems to have the same problem - whenever anything -(alsamixer, udevd, 3.9+ kernel from 60af3d037eb8c, ..) attempts to -access mixer / control interface of the card, the firmware "locks up" -the entire device, resulting in - SNDRV_PCM_IOCTL_HW_PARAMS failed (-5): Input/output error -from alsa-lib. - -Other operating systems can somehow read the mixer (there seems to be -playback volume/mute), but any manipulation is ignored by the device -(which has hardware volume controls). - -Signed-off-by: Jiri Jaburek <jjaburek@redhat.com> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/usb/mixer_maps.c | 15 ++++++++++++--- - 1 file changed, 12 insertions(+), 3 deletions(-) - ---- a/sound/usb/mixer_maps.c -+++ b/sound/usb/mixer_maps.c -@@ -304,8 +304,11 @@ static struct usbmix_name_map hercules_u - { 0 } /* terminator */ - }; - --static const struct usbmix_name_map kef_x300a_map[] = { -- { 10, NULL }, /* firmware locks up (?) when we try to access this FU */ -+/* some (all?) SCMS USB3318 devices are affected by a firmware lock up -+ * when anything attempts to access FU 10 (control) -+ */ -+static const struct usbmix_name_map scms_usb3318_map[] = { -+ { 10, NULL }, - { 0 } - }; - -@@ -377,8 +380,14 @@ static struct usbmix_ctl_map usbmix_ctl_ - .ignore_ctl_error = 1, - }, - { -+ /* KEF X300A */ - .id = USB_ID(0x27ac, 0x1000), -- .map = kef_x300a_map, -+ .map = scms_usb3318_map, -+ }, -+ { -+ /* Arcam rPAC */ -+ .id = USB_ID(0x25c4, 0x0003), -+ .map = scms_usb3318_map, - }, - { 0 } /* terminator */ - }; diff --git a/patches/arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch b/patches/arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch deleted file mode 100644 index 5305ba9..0000000 --- a/patches/arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch +++ /dev/null @@ -1,48 +0,0 @@ -From ef59a20ba375aeb97b3150a118318884743452a8 Mon Sep 17 00:00:00 2001 -From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> -Date: Fri, 21 Nov 2014 15:29:00 +0100 -Subject: ARM: 8216/1: xscale: correct auxiliary register in suspend/resume - -commit ef59a20ba375aeb97b3150a118318884743452a8 upstream. - -According to the manuals I have, XScale auxiliary register should be -reached with opc_2 = 1 instead of crn = 1. cpu_xscale_proc_init -correctly uses c1, c0, 1 arguments, but cpu_xscale_do_suspend and -cpu_xscale_do_resume use c1, c1, 0. Correct suspend/resume functions to -also use c1, c0, 1. - -The issue was primarily noticed thanks to qemu reporing "unsupported -instruction" on the pxa suspend path. Confirmed in PXA210/250 and PXA255 -XScale Core manuals and in PXA270 and PXA320 Developers Guides. - -Harware tested by me on tosa (pxa255). Robert confirmed on pxa270 board. - -Tested-by: Robert Jarzmik <robert.jarzmik@free.fr> -Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> -Acked-by: Robert Jarzmik <robert.jarzmik@free.fr> -Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/arm/mm/proc-xscale.S | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/arch/arm/mm/proc-xscale.S -+++ b/arch/arm/mm/proc-xscale.S -@@ -531,7 +531,7 @@ ENTRY(cpu_xscale_do_suspend) - mrc p15, 0, r5, c15, c1, 0 @ CP access reg - mrc p15, 0, r6, c13, c0, 0 @ PID - mrc p15, 0, r7, c3, c0, 0 @ domain ID -- mrc p15, 0, r8, c1, c1, 0 @ auxiliary control reg -+ mrc p15, 0, r8, c1, c0, 1 @ auxiliary control reg - mrc p15, 0, r9, c1, c0, 0 @ control reg - bic r4, r4, #2 @ clear frequency change bit - stmia r0, {r4 - r9} @ store cp regs -@@ -548,7 +548,7 @@ ENTRY(cpu_xscale_do_resume) - mcr p15, 0, r6, c13, c0, 0 @ PID - mcr p15, 0, r7, c3, c0, 0 @ domain ID - mcr p15, 0, r1, c2, c0, 0 @ translation table base addr -- mcr p15, 0, r8, c1, c1, 0 @ auxiliary control reg -+ mcr p15, 0, r8, c1, c0, 1 @ auxiliary control reg - mov r0, r9 @ control register - b cpu_resume_mmu - ENDPROC(cpu_xscale_do_resume) diff --git a/patches/asoc-atmel_ssc_dai-fix-start-event-for-i2s-mode.patch b/patches/asoc-atmel_ssc_dai-fix-start-event-for-i2s-mode.patch deleted file mode 100644 index 8479dd1..0000000 --- a/patches/asoc-atmel_ssc_dai-fix-start-event-for-i2s-mode.patch +++ /dev/null @@ -1,77 +0,0 @@ -From a43bd7e125143b875caae6d4f9938855b440faaf Mon Sep 17 00:00:00 2001 -From: Bo Shen <voice.shen@atmel.com> -Date: Tue, 20 Jan 2015 15:43:16 +0800 -Subject: ASoC: atmel_ssc_dai: fix start event for I2S mode - -commit a43bd7e125143b875caae6d4f9938855b440faaf upstream. - -According to the I2S specification information as following: - - WS = 0, channel 1 (left) - - WS = 1, channel 2 (right) -So, the start event should be TF/RF falling edge. - -Reported-by: Songjun Wu <songjun.wu@atmel.com> -Signed-off-by: Bo Shen <voice.shen@atmel.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/atmel/atmel_ssc_dai.c | 18 ++++-------------- - 1 file changed, 4 insertions(+), 14 deletions(-) - ---- a/sound/soc/atmel/atmel_ssc_dai.c -+++ b/sound/soc/atmel/atmel_ssc_dai.c -@@ -341,7 +341,6 @@ static int atmel_ssc_hw_params(struct sn - struct atmel_pcm_dma_params *dma_params; - int dir, channels, bits; - u32 tfmr, rfmr, tcmr, rcmr; -- int start_event; - int ret; - - /* -@@ -460,19 +459,10 @@ static int atmel_ssc_hw_params(struct sn - * The SSC transmit clock is obtained from the BCLK signal on - * on the TK line, and the SSC receive clock is - * generated from the transmit clock. -- * -- * For single channel data, one sample is transferred -- * on the falling edge of the LRC clock. -- * For two channel data, one sample is -- * transferred on both edges of the LRC clock. - */ -- start_event = ((channels == 1) -- ? SSC_START_FALLING_RF -- : SSC_START_EDGE_RF); -- - rcmr = SSC_BF(RCMR_PERIOD, 0) - | SSC_BF(RCMR_STTDLY, START_DELAY) -- | SSC_BF(RCMR_START, start_event) -+ | SSC_BF(RCMR_START, SSC_START_FALLING_RF) - | SSC_BF(RCMR_CKI, SSC_CKI_RISING) - | SSC_BF(RCMR_CKO, SSC_CKO_NONE) - | SSC_BF(RCMR_CKS, SSC_CKS_CLOCK); -@@ -480,14 +470,14 @@ static int atmel_ssc_hw_params(struct sn - rfmr = SSC_BF(RFMR_FSEDGE, SSC_FSEDGE_POSITIVE) - | SSC_BF(RFMR_FSOS, SSC_FSOS_NONE) - | SSC_BF(RFMR_FSLEN, 0) -- | SSC_BF(RFMR_DATNB, 0) -+ | SSC_BF(RFMR_DATNB, (channels - 1)) - | SSC_BIT(RFMR_MSBF) - | SSC_BF(RFMR_LOOP, 0) - | SSC_BF(RFMR_DATLEN, (bits - 1)); - - tcmr = SSC_BF(TCMR_PERIOD, 0) - | SSC_BF(TCMR_STTDLY, START_DELAY) -- | SSC_BF(TCMR_START, start_event) -+ | SSC_BF(TCMR_START, SSC_START_FALLING_RF) - | SSC_BF(TCMR_CKI, SSC_CKI_FALLING) - | SSC_BF(TCMR_CKO, SSC_CKO_NONE) - | SSC_BF(TCMR_CKS, SSC_CKS_PIN); -@@ -496,7 +486,7 @@ static int atmel_ssc_hw_params(struct sn - | SSC_BF(TFMR_FSDEN, 0) - | SSC_BF(TFMR_FSOS, SSC_FSOS_NONE) - | SSC_BF(TFMR_FSLEN, 0) -- | SSC_BF(TFMR_DATNB, 0) -+ | SSC_BF(TFMR_DATNB, (channels - 1)) - | SSC_BIT(TFMR_MSBF) - | SSC_BF(TFMR_DATDEF, 0) - | SSC_BF(TFMR_DATLEN, (bits - 1)); diff --git a/patches/asoc-sgtl5000-add-delay-before-first-i2c-access.patch b/patches/asoc-sgtl5000-add-delay-before-first-i2c-access.patch deleted file mode 100644 index 5d69b81..0000000 --- a/patches/asoc-sgtl5000-add-delay-before-first-i2c-access.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 58cc9c9a175885bbf6bae3acf18233d0a8229a84 Mon Sep 17 00:00:00 2001 -From: Eric Nelson <eric.nelson@boundarydevices.com> -Date: Fri, 30 Jan 2015 14:07:55 -0700 -Subject: ASoC: sgtl5000: add delay before first I2C access - -commit 58cc9c9a175885bbf6bae3acf18233d0a8229a84 upstream. - -To quote from section 1.3.1 of the data sheet: - The SGTL5000 has an internal reset that is deasserted - 8 SYS_MCLK cycles after all power rails have been brought - up. After this time, communication can start - - ... - 1.0us represents 8 SYS_MCLK cycles at the minimum 8.0 MHz SYS_MCLK. - -Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com> -Reviewed-by: Fabio Estevam <fabio.estevam@freescale.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/sgtl5000.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/sound/soc/codecs/sgtl5000.c -+++ b/sound/soc/codecs/sgtl5000.c -@@ -1238,6 +1238,9 @@ static int sgtl5000_enable_regulators(st - /* wait for all power rails bring up */ - udelay(10); - -+ /* Need 8 clocks before I2C accesses */ -+ udelay(1); -+ - /* read chip information */ - reg = snd_soc_read(codec, SGTL5000_CHIP_ID); - if (((reg & SGTL5000_PARTID_MASK) >> SGTL5000_PARTID_SHIFT) != diff --git a/patches/asoc-sigmadsp-refuse-to-load-firmware-files-with-a-non-supported-version.patch b/patches/asoc-sigmadsp-refuse-to-load-firmware-files-with-a-non-supported-version.patch deleted file mode 100644 index 8c0a092..0000000 --- a/patches/asoc-sigmadsp-refuse-to-load-firmware-files-with-a-non-supported-version.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 50c0f21b42dd4cd02b51f82274f66912d9a7fa32 Mon Sep 17 00:00:00 2001 -From: Lars-Peter Clausen <lars@metafoo.de> -Date: Wed, 19 Nov 2014 18:29:02 +0100 -Subject: ASoC: sigmadsp: Refuse to load firmware files with a non-supported - version - -commit 50c0f21b42dd4cd02b51f82274f66912d9a7fa32 upstream. - -Make sure to check the version field of the firmware header to make sure to -not accidentally try to parse a firmware file with a different layout. -Trying to do so can result in loading invalid firmware code to the device. - -Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/sigmadsp.c | 7 +++++++ - 1 file changed, 7 insertions(+) - ---- a/sound/soc/codecs/sigmadsp.c -+++ b/sound/soc/codecs/sigmadsp.c -@@ -176,6 +176,13 @@ static int _process_sigma_firmware(struc - goto done; - } - -+ if (ssfw_head->version != 1) { -+ dev_err(dev, -+ "Failed to load firmware: Invalid version %d. Supported firmware versions: 1\n", -+ ssfw_head->version); -+ goto done; -+ } -+ - crc = crc32(0, fw->data + sizeof(*ssfw_head), - fw->size - sizeof(*ssfw_head)); - pr_debug("%s: crc=%x\n", __func__, crc); diff --git a/patches/asoc-wm8960-fix-capture-sample-rate-from-11250-to-11025.patch b/patches/asoc-wm8960-fix-capture-sample-rate-from-11250-to-11025.patch deleted file mode 100644 index b249494..0000000 --- a/patches/asoc-wm8960-fix-capture-sample-rate-from-11250-to-11025.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 22ee76daddb87f88d2336d1b4737ef27c4f307ac Mon Sep 17 00:00:00 2001 -From: Zidan Wang <b50113@freescale.com> -Date: Wed, 31 Dec 2014 11:39:14 +0800 -Subject: ASoC: wm8960: Fix capture sample rate from 11250 to 11025 - -commit 22ee76daddb87f88d2336d1b4737ef27c4f307ac upstream. - -wm8960 codec can't support sample rate 11250, it must be 11025. - -Signed-off-by: Zidan Wang <b50113@freescale.com> -Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/wm8960.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/sound/soc/codecs/wm8960.c -+++ b/sound/soc/codecs/wm8960.c -@@ -496,7 +496,7 @@ static struct { - { 22050, 2 }, - { 24000, 2 }, - { 16000, 3 }, -- { 11250, 4 }, -+ { 11025, 4 }, - { 12000, 4 }, - { 8000, 5 }, - }; diff --git a/patches/ath5k-fix-hardware-queue-index-assignment.patch b/patches/ath5k-fix-hardware-queue-index-assignment.patch deleted file mode 100644 index e2bc79e..0000000 --- a/patches/ath5k-fix-hardware-queue-index-assignment.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 9e4982f6a51a2442f1bb588fee42521b44b4531c Mon Sep 17 00:00:00 2001 -From: Felix Fietkau <nbd@openwrt.org> -Date: Sun, 30 Nov 2014 21:52:57 +0100 -Subject: ath5k: fix hardware queue index assignment - -commit 9e4982f6a51a2442f1bb588fee42521b44b4531c upstream. - -Like with ath9k, ath5k queues also need to be ordered by priority. -queue_info->tqi_subtype already contains the correct index, so use it -instead of relying on the order of ath5k_hw_setup_tx_queue calls. - -Signed-off-by: Felix Fietkau <nbd@openwrt.org> -Signed-off-by: John W. Linville <linville@tuxdriver.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/wireless/ath/ath5k/qcu.c | 8 +------- - 1 file changed, 1 insertion(+), 7 deletions(-) - ---- a/drivers/net/wireless/ath/ath5k/qcu.c -+++ b/drivers/net/wireless/ath/ath5k/qcu.c -@@ -223,13 +223,7 @@ ath5k_hw_setup_tx_queue(struct ath5k_hw - } else { - switch (queue_type) { - case AR5K_TX_QUEUE_DATA: -- for (queue = AR5K_TX_QUEUE_ID_DATA_MIN; -- ah->ah_txq[queue].tqi_type != -- AR5K_TX_QUEUE_INACTIVE; queue++) { -- -- if (queue > AR5K_TX_QUEUE_ID_DATA_MAX) -- return -EINVAL; -- } -+ queue = queue_info->tqi_subtype; - break; - case AR5K_TX_QUEUE_UAPSD: - queue = AR5K_TX_QUEUE_ID_UAPSD; diff --git a/patches/ath9k-fix-be-bk-queue-order.patch b/patches/ath9k-fix-be-bk-queue-order.patch deleted file mode 100644 index d13a399..0000000 --- a/patches/ath9k-fix-be-bk-queue-order.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 78063d81d353e10cbdd279c490593113b8fdae1c Mon Sep 17 00:00:00 2001 -From: Felix Fietkau <nbd@openwrt.org> -Date: Sun, 30 Nov 2014 20:38:41 +0100 -Subject: ath9k: fix BE/BK queue order - -commit 78063d81d353e10cbdd279c490593113b8fdae1c upstream. - -Hardware queues are ordered by priority. Use queue index 0 for BK, which -has lower priority than BE. - -Signed-off-by: Felix Fietkau <nbd@openwrt.org> -Signed-off-by: John W. Linville <linville@tuxdriver.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/wireless/ath/ath9k/hw.h | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/net/wireless/ath/ath9k/hw.h -+++ b/drivers/net/wireless/ath/ath9k/hw.h -@@ -181,8 +181,8 @@ - #define PAPRD_IDEAL_AGC2_PWR_RANGE 0xe0 - - enum ath_hw_txq_subtype { -- ATH_TXQ_AC_BE = 0, -- ATH_TXQ_AC_BK = 1, -+ ATH_TXQ_AC_BK = 0, -+ ATH_TXQ_AC_BE = 1, - ATH_TXQ_AC_VI = 2, - ATH_TXQ_AC_VO = 3, - }; diff --git a/patches/ath9k_hw-fix-hardware-queue-allocation.patch b/patches/ath9k_hw-fix-hardware-queue-allocation.patch deleted file mode 100644 index 7a68739..0000000 --- a/patches/ath9k_hw-fix-hardware-queue-allocation.patch +++ /dev/null @@ -1,37 +0,0 @@ -From ad8fdccf9c197a89e2d2fa78c453283dcc2c343f Mon Sep 17 00:00:00 2001 -From: Felix Fietkau <nbd@openwrt.org> -Date: Sun, 30 Nov 2014 20:38:40 +0100 -Subject: ath9k_hw: fix hardware queue allocation - -commit ad8fdccf9c197a89e2d2fa78c453283dcc2c343f upstream. - -The driver passes the desired hardware queue index for a WMM data queue -in qinfo->tqi_subtype. This was ignored in ath9k_hw_setuptxqueue, which -instead relied on the order in which the function is called. - -Reported-by: Hubert Feurstein <h.feurstein@gmail.com> -Signed-off-by: Felix Fietkau <nbd@openwrt.org> -Signed-off-by: John W. Linville <linville@tuxdriver.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/wireless/ath/ath9k/mac.c | 9 +-------- - 1 file changed, 1 insertion(+), 8 deletions(-) - ---- a/drivers/net/wireless/ath/ath9k/mac.c -+++ b/drivers/net/wireless/ath/ath9k/mac.c -@@ -303,14 +303,7 @@ int ath9k_hw_setuptxqueue(struct ath_hw - q = ATH9K_NUM_TX_QUEUES - 3; - break; - case ATH9K_TX_QUEUE_DATA: -- for (q = 0; q < ATH9K_NUM_TX_QUEUES; q++) -- if (ah->txq[q].tqi_type == -- ATH9K_TX_QUEUE_INACTIVE) -- break; -- if (q == ATH9K_NUM_TX_QUEUES) { -- ath_err(common, "No available TX queue\n"); -- return -1; -- } -+ q = qinfo->tqi_subtype; - break; - default: - ath_err(common, "Invalid TX queue type: %u\n", type); diff --git a/patches/bluetooth-add-support-for-acer-0489-e078.patch b/patches/bluetooth-add-support-for-acer-0489-e078.patch deleted file mode 100644 index 759b84a..0000000 --- a/patches/bluetooth-add-support-for-acer-0489-e078.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 4b552bc9edfdc947862af225a0e2521edb5d37a0 Mon Sep 17 00:00:00 2001 -From: Anantha Krishnan <ananthk@codeaurora.org> -Date: Mon, 6 Oct 2014 16:31:49 +0530 -Subject: Bluetooth: Add support for Acer [0489:e078] - -commit 4b552bc9edfdc947862af225a0e2521edb5d37a0 upstream. - -Add support for the QCA6174 chip. - - T: Bus=06 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 - D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 - P: Vendor=0489 ProdID=e078 Rev=00.01 - C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA - I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb - I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb - -Signed-off-by: Anantha Krishnan <ananthk@codeaurora.org> -Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -Cc: Joseph Salisbury <joseph.salisbury@canonical.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/bluetooth/ath3k.c | 2 ++ - drivers/bluetooth/btusb.c | 1 + - 2 files changed, 3 insertions(+) - ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -77,6 +77,7 @@ static struct usb_device_id ath3k_table[ - { USB_DEVICE(0x0489, 0xe04e) }, - { USB_DEVICE(0x0489, 0xe057) }, - { USB_DEVICE(0x0489, 0xe056) }, -+ { USB_DEVICE(0x0489, 0xe078) }, - { USB_DEVICE(0x04c5, 0x1330) }, - { USB_DEVICE(0x04CA, 0x3004) }, - { USB_DEVICE(0x04CA, 0x3005) }, -@@ -122,6 +123,7 @@ static struct usb_device_id ath3k_blist_ - { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -155,6 +155,7 @@ static struct usb_device_id blacklist_ta - { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, diff --git a/patches/bluetooth-add-support-for-acer-13d3-3432.patch b/patches/bluetooth-add-support-for-acer-13d3-3432.patch deleted file mode 100644 index c20d2cb..0000000 --- a/patches/bluetooth-add-support-for-acer-13d3-3432.patch +++ /dev/null @@ -1,52 +0,0 @@ -From fa2f1394fe9c1a217213f02df77812701de6362f Mon Sep 17 00:00:00 2001 -From: Anantha Krishnan <ananthk@codeaurora.org> -Date: Tue, 8 Jul 2014 19:25:08 +0530 -Subject: Bluetooth: Add support for Acer [13D3:3432] - -commit fa2f1394fe9c1a217213f02df77812701de6362f upstream. - -Add support for the QCA6174 chip. - - T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 30 Spd=12 MxCh= 0 - D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 - P: Vendor=13d3 ProdID=3432 Rev=00.02 - C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA - I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb - I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb - -Signed-off-by: Anantha Krishnan <ananthk@codeaurora.org> -Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/bluetooth/ath3k.c | 2 ++ - drivers/bluetooth/btusb.c | 1 + - 2 files changed, 3 insertions(+) - ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -97,6 +97,7 @@ static struct usb_device_id ath3k_table[ - { USB_DEVICE(0x13d3, 0x3375) }, - { USB_DEVICE(0x13d3, 0x3393) }, - { USB_DEVICE(0x13d3, 0x3402) }, -+ { USB_DEVICE(0x13d3, 0x3432) }, - - /* Atheros AR5BBU12 with sflash firmware */ - { USB_DEVICE(0x0489, 0xE02C) }, -@@ -140,6 +141,7 @@ static struct usb_device_id ath3k_blist_ - { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU22 with sflash firmware */ - { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 }, ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -172,6 +172,7 @@ static struct usb_device_id blacklist_ta - { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU12 with sflash firmware */ - { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, diff --git a/patches/bluetooth-add-support-for-broadcom-device-of-asus-z97-deluxe-motherboard.patch b/patches/bluetooth-add-support-for-broadcom-device-of-asus-z97-deluxe-motherboard.patch deleted file mode 100644 index 7092888..0000000 --- a/patches/bluetooth-add-support-for-broadcom-device-of-asus-z97-deluxe-motherboard.patch +++ /dev/null @@ -1,67 +0,0 @@ -From c2aef6e8cbebd60f79555baeb9266e220f135a44 Mon Sep 17 00:00:00 2001 -From: Marcel Holtmann <marcel@holtmann.org> -Date: Mon, 21 Jul 2014 14:02:33 +0200 -Subject: Bluetooth: Add support for Broadcom device of Asus Z97-DELUXE - motherboard - -commit c2aef6e8cbebd60f79555baeb9266e220f135a44 upstream. - -The Asus Z97-DELUXE motherboard contains a Broadcom based Bluetooth -controller on the USB bus. However vendor and product ID are listed -as ASUSTek Computer. - -T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 -D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 -P: Vendor=0b05 ProdID=17cf Rev= 1.12 -S: Manufacturer=Broadcom Corp -S: Product=BCM20702A0 -S: SerialNumber=54271E910064 -C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA -I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb -E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms -E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms -E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms -I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms -I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms -I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms -I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms -I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms -I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms -I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) -E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms -E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms -I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none) - -Reported-by: Jerome Leclanche <jerome@leclan.ch> -Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/bluetooth/btusb.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -120,6 +120,9 @@ static struct usb_device_id btusb_table[ - /* Broadcom devices with vendor specific id */ - { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) }, - -+ /* ASUSTek Computer - Broadcom based */ -+ { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01) }, -+ - /* Intel Bluetooth USB Bootloader (RAM module) */ - { USB_DEVICE(0x8087, 0x0a5a), - .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC }, diff --git a/patches/bluetooth-add-support-for-intel-bootloader-devices.patch b/patches/bluetooth-add-support-for-intel-bootloader-devices.patch deleted file mode 100644 index 8972224..0000000 --- a/patches/bluetooth-add-support-for-intel-bootloader-devices.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 40df783d1ef1989ac454e3dfcda017270b8950e6 Mon Sep 17 00:00:00 2001 -From: Marcel Holtmann <marcel@holtmann.org> -Date: Sun, 6 Jul 2014 13:29:58 +0200 -Subject: Bluetooth: Add support for Intel bootloader devices - -commit 40df783d1ef1989ac454e3dfcda017270b8950e6 upstream. - -Intel Bluetooth devices that boot up in bootloader mode can not -be used as generic HCI devices, but their HCI transport is still -valuable and so bring that up as raw-only devices. - -T: Bus=02 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#= 14 Spd=12 MxCh= 0 -D: Ver= 1.10 Cls=ff(vend.) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 -P: Vendor=8087 ProdID=0a5a Rev= 0.00 -S: Manufacturer=Intel(R) Corporation -S: Product=Intel(R) Wilkins Peak 2x2 -S: SerialNumber=001122334455 WP_A0 -C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA -I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) -E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms -E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms -E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms -I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) -E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms -E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms -I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) -E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms -E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms -I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) -E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms -E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms -I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) -E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms -E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms -I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) -E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms -E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms -I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) -E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms -E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms - -Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> -[lizf: Backported to 3.4: there's no BTUSB_BCM_PATCHRAM] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/bluetooth/btusb.c | 7 +++++++ - 1 file changed, 7 insertions(+) - ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -55,6 +55,7 @@ static struct usb_driver btusb_driver; - #define BTUSB_BROKEN_ISOC 0x20 - #define BTUSB_WRONG_SCO_MTU 0x40 - #define BTUSB_ATH3012 0x80 -+#define BTUSB_INTEL_BOOT 0x200 - - static struct usb_device_id btusb_table[] = { - /* Generic Bluetooth USB device */ -@@ -119,6 +120,9 @@ static struct usb_device_id btusb_table[ - /* Broadcom devices with vendor specific id */ - { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) }, - -+ /* Intel Bluetooth USB Bootloader (RAM module) */ -+ { USB_DEVICE(0x8087, 0x0a5a), .driver_info = BTUSB_INTEL_BOOT }, -+ - { } /* Terminating entry */ - }; - -@@ -1051,6 +1055,9 @@ static int btusb_probe(struct usb_interf - hdev->send = btusb_send_frame; - hdev->notify = btusb_notify; - -+ if (id->driver_info & BTUSB_INTEL_BOOT) -+ set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); -+ - /* Interface numbers are hardcoded in the specification */ - data->isoc = usb_ifnum_to_if(data->udev, 1); - diff --git a/patches/bluetooth-add-usb-device-04ca-3010-as-atheros-ar3012.patch b/patches/bluetooth-add-usb-device-04ca-3010-as-atheros-ar3012.patch deleted file mode 100644 index b7f561b..0000000 --- a/patches/bluetooth-add-usb-device-04ca-3010-as-atheros-ar3012.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 134d3b3550f050b9bec37111824452064d1ed928 Mon Sep 17 00:00:00 2001 -From: Janne Heikkinen <janne.m.heikkinen@gmail.com> -Date: Tue, 9 Dec 2014 07:44:51 +0200 -Subject: Bluetooth: Add USB device 04ca:3010 as Atheros AR3012 - -commit 134d3b3550f050b9bec37111824452064d1ed928 upstream. - -Asus X553MA has USB device 04ca:3010 that is Atheros AR3012 -or compatible. - -Device from /sys/kernel/debug/usb/devices: - -T: Bus=01 Lev=02 Prnt=02 Port=03 Cnt=02 Dev#= 27 Spd=12 MxCh= 0 -D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 -P: Vendor=04ca ProdID=3010 Rev= 0.02 -C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA -A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 -I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms -E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms -E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms -I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms -I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms -I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms -I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms -I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms -I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms - -Signed-off-by: Janne Heikkinen <janne.m.heikkinen@gmail.com> -Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/bluetooth/ath3k.c | 2 ++ - drivers/bluetooth/btusb.c | 1 + - 2 files changed, 3 insertions(+) - ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -83,6 +83,7 @@ static struct usb_device_id ath3k_table[ - { USB_DEVICE(0x04CA, 0x3005) }, - { USB_DEVICE(0x04CA, 0x3006) }, - { USB_DEVICE(0x04CA, 0x3008) }, -+ { USB_DEVICE(0x04CA, 0x3010) }, - { USB_DEVICE(0x0930, 0x0219) }, - { USB_DEVICE(0x0930, 0x0227) }, - { USB_DEVICE(0x0b05, 0x17d0) }, -@@ -130,6 +131,7 @@ static struct usb_device_id ath3k_blist_ - { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -161,6 +161,7 @@ static struct usb_device_id blacklist_ta - { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, diff --git a/patches/bluetooth-append-new-supported-device-to-the-list-0b05-17d0.patch b/patches/bluetooth-append-new-supported-device-to-the-list-0b05-17d0.patch deleted file mode 100644 index a2c4a20..0000000 --- a/patches/bluetooth-append-new-supported-device-to-the-list-0b05-17d0.patch +++ /dev/null @@ -1,54 +0,0 @@ -From a735f9e22432899cee188d167966782c29246390 Mon Sep 17 00:00:00 2001 -From: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Date: Tue, 18 Feb 2014 18:26:20 +0200 -Subject: Bluetooth: append new supported device to the list [0b05:17d0] - -commit a735f9e22432899cee188d167966782c29246390 upstream. - -The device found on Asus Z87 Expert motherboard requires firmware to work -correctly. - -T: Bus=03 Lev=01 Prnt=01 Port=03 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 -D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 -P: Vendor=0b05 ProdID=17d0 Rev=00.02 -C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA -I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb - -Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/bluetooth/ath3k.c | 2 ++ - drivers/bluetooth/btusb.c | 1 + - 2 files changed, 3 insertions(+) - ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -153,6 +153,7 @@ static struct usb_device_id blacklist_ta - { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -83,6 +83,7 @@ static struct usb_device_id ath3k_table[ - { USB_DEVICE(0x04CA, 0x3006) }, - { USB_DEVICE(0x04CA, 0x3008) }, - { USB_DEVICE(0x0930, 0x0219) }, -+ { USB_DEVICE(0x0b05, 0x17d0) }, - { USB_DEVICE(0x0CF3, 0x0036) }, - { USB_DEVICE(0x0CF3, 0x3004) }, - { USB_DEVICE(0x0CF3, 0x3008) }, -@@ -125,6 +126,7 @@ static struct usb_device_id ath3k_blist_ - { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, diff --git a/patches/bluetooth-ath3k-add-support-of-mci-13d3-3408-bt-device.patch b/patches/bluetooth-ath3k-add-support-of-mci-13d3-3408-bt-device.patch deleted file mode 100644 index 40f84b7..0000000 --- a/patches/bluetooth-ath3k-add-support-of-mci-13d3-3408-bt-device.patch +++ /dev/null @@ -1,74 +0,0 @@ -From 3bb30a7cdf9242aca90d49aa41baebf9458f96f0 Mon Sep 17 00:00:00 2001 -From: Dmitry Tunin <hanipouspilot@gmail.com> -Date: Tue, 25 Nov 2014 20:19:52 +0300 -Subject: Bluetooth: ath3k: Add support of MCI 13d3:3408 bt device - -commit 3bb30a7cdf9242aca90d49aa41baebf9458f96f0 upstream. - -Add support for Bluetooth MCI WB335 (AR9565) Wi-Fi+bt module. This -Bluetooth module requires loading patch and sysconfig by ath3k driver. - -T: Bus=01 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#= 20 Spd=12 MxCh= 0 -D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 -P: Vendor=13d3 ProdID=3408 Rev= 0.02 -C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA -A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 -I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms -E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms -E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms -I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms -I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms -I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms -I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms -I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms -I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms - -Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com> -Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/bluetooth/ath3k.c | 2 ++ - drivers/bluetooth/btusb.c | 1 + - 2 files changed, 3 insertions(+) - ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -99,6 +99,7 @@ static struct usb_device_id ath3k_table[ - { USB_DEVICE(0x13d3, 0x3375) }, - { USB_DEVICE(0x13d3, 0x3393) }, - { USB_DEVICE(0x13d3, 0x3402) }, -+ { USB_DEVICE(0x13d3, 0x3408) }, - { USB_DEVICE(0x13d3, 0x3432) }, - - /* Atheros AR5BBU12 with sflash firmware */ -@@ -145,6 +146,7 @@ static struct usb_device_id ath3k_blist_ - { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU22 with sflash firmware */ ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -177,6 +177,7 @@ static struct usb_device_id blacklist_ta - { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU12 with sflash firmware */ diff --git a/patches/bluetooth-ath3k-workaround-the-compatibility-issue-with-xhci-controller.patch b/patches/bluetooth-ath3k-workaround-the-compatibility-issue-with-xhci-controller.patch deleted file mode 100644 index 5dabdd7..0000000 --- a/patches/bluetooth-ath3k-workaround-the-compatibility-issue-with-xhci-controller.patch +++ /dev/null @@ -1,56 +0,0 @@ -From c561a5753dd631920c4459a067d22679b3d110d6 Mon Sep 17 00:00:00 2001 -From: Adam Lee <adam.lee@canonical.com> -Date: Wed, 28 Jan 2015 15:30:27 -0500 -Subject: Bluetooth: ath3k: workaround the compatibility issue with xHCI - controller - -commit c561a5753dd631920c4459a067d22679b3d110d6 upstream. - -BugLink: https://bugs.launchpad.net/bugs/1400215 - -ath3k devices fail to load firmwares on xHCI buses, but work well on -EHCI, this might be a compatibility issue between xHCI and ath3k chips. -As my testing result, those chips will work on xHCI buses again with -this patch. - -This workaround is from Qualcomm, they also did some workarounds in -Windows driver. - -Signed-off-by: Adam Lee <adam.lee@canonical.com> -Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/bluetooth/ath3k.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -161,6 +161,8 @@ static struct usb_device_id ath3k_blist_ - #define USB_REQ_DFU_DNLOAD 1 - #define BULK_SIZE 4096 - #define FW_HDR_SIZE 20 -+#define TIMEGAP_USEC_MIN 50 -+#define TIMEGAP_USEC_MAX 100 - - static int ath3k_load_firmware(struct usb_device *udev, - const struct firmware *firmware) -@@ -191,6 +193,9 @@ static int ath3k_load_firmware(struct us - count -= 20; - - while (count) { -+ /* workaround the compatibility issue with xHCI controller*/ -+ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX); -+ - size = min_t(uint, count, BULK_SIZE); - pipe = usb_sndbulkpipe(udev, 0x02); - memcpy(send_buf, firmware->data + sent, size); -@@ -267,6 +272,9 @@ static int ath3k_load_fwfile(struct usb_ - count -= size; - - while (count) { -+ /* workaround the compatibility issue with xHCI controller*/ -+ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX); -+ - size = min_t(uint, count, BULK_SIZE); - pipe = usb_sndbulkpipe(udev, 0x02); - diff --git a/patches/bluetooth-fix-invalid-length-check-in-l2cap_informat.patch b/patches/bluetooth-fix-invalid-length-check-in-l2cap_informat.patch deleted file mode 100644 index 601a9cc..0000000 --- a/patches/bluetooth-fix-invalid-length-check-in-l2cap_informat.patch +++ /dev/null @@ -1,61 +0,0 @@ -From bd352dcbb6ead879fb5079affd723b8cafef7500 Mon Sep 17 00:00:00 2001 -From: Tim Niemeyer <tim.niemeyer@corscience.de> -Date: Mon, 30 Mar 2015 11:27:37 +0200 -Subject: Bluetooth: Fix invalid length check in l2cap_information_rsp() - -first backport commit 6ec88fcb4aa2c33fe2fe2a23c576a7e2581c5c3d changes -l2cap_move_channel_confirm_rsp and not the l2cap_information_rsp. So -revert this and fix at the correct position. - -commit 3f6fa3d489e127ca5a5b298eabac3ff5dbe0e112 upstream. - -The length check is invalid since the length varies with type of -info response. - -This was introduced by the commit cb3b3152b2f5939d67005cff841a1ca748b19888 - -Because of this, l2cap info rsp is not handled and command reject is sent. - -> ACL data: handle 11 flags 0x02 dlen 16 - L2CAP(s): Info rsp: type 2 result 0 - Extended feature mask 0x00b8 - Enhanced Retransmission mode - Streaming mode - FCS Option - Fixed Channels -< ACL data: handle 11 flags 0x00 dlen 10 - L2CAP(s): Command rej: reason 0 - Command not understood - -Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com> -Signed-off-by: Chan-Yeol Park <chanyeol.park@samsung.com> -Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> -Cc: Jianguo Wu <wujianguo@huawei.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Tim Niemeyer <tim.niemeyer@corscience.de> -Acked-by: Johan Hedberg <johan.hedberg@intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/bluetooth/l2cap_core.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -3239,7 +3239,7 @@ static inline int l2cap_information_rsp( - struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data; - u16 type, result; - -- if (cmd_len != sizeof(*rsp)) -+ if (cmd_len < sizeof(*rsp)) - return -EPROTO; - - type = __le16_to_cpu(rsp->type); -@@ -3445,7 +3445,7 @@ static inline int l2cap_move_channel_con - struct l2cap_move_chan_cfm_rsp *rsp = data; - u16 icid; - -- if (cmd_len < sizeof(*rsp)) -+ if (cmd_len != sizeof(*rsp)) - return -EPROTO; - - icid = le16_to_cpu(rsp->icid); diff --git a/patches/bluetooth-ignore-isochronous-endpoints-for-intel-usb-bootloader.patch b/patches/bluetooth-ignore-isochronous-endpoints-for-intel-usb-bootloader.patch deleted file mode 100644 index b38675f..0000000 --- a/patches/bluetooth-ignore-isochronous-endpoints-for-intel-usb-bootloader.patch +++ /dev/null @@ -1,30 +0,0 @@ -From d92f2df0565ea04101d6ac04bdc10feeb1d93c94 Mon Sep 17 00:00:00 2001 -From: Marcel Holtmann <marcel@holtmann.org> -Date: Sun, 6 Jul 2014 14:53:55 +0200 -Subject: Bluetooth: Ignore isochronous endpoints for Intel USB bootloader - -commit d92f2df0565ea04101d6ac04bdc10feeb1d93c94 upstream. - -The isochronous endpoints are not valid when the Intel Bluetooth -controller boots up in bootloader mode. So just mark these endpoints -as broken and then they will not be configured. - -Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/bluetooth/btusb.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -121,7 +121,8 @@ static struct usb_device_id btusb_table[ - { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) }, - - /* Intel Bluetooth USB Bootloader (RAM module) */ -- { USB_DEVICE(0x8087, 0x0a5a), .driver_info = BTUSB_INTEL_BOOT }, -+ { USB_DEVICE(0x8087, 0x0a5a), -+ .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC }, - - { } /* Terminating entry */ - }; diff --git a/patches/bluetooth-sort-the-list-of-ids-in-the-source-code.patch b/patches/bluetooth-sort-the-list-of-ids-in-the-source-code.patch deleted file mode 100644 index fb44e97..0000000 --- a/patches/bluetooth-sort-the-list-of-ids-in-the-source-code.patch +++ /dev/null @@ -1,227 +0,0 @@ -From 0b8800623d3f12dd40a039aa191d52bfa4eef5b4 Mon Sep 17 00:00:00 2001 -From: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Date: Tue, 18 Feb 2014 18:26:19 +0200 -Subject: Bluetooth: sort the list of IDs in the source code - -commit 0b8800623d3f12dd40a039aa191d52bfa4eef5b4 upstream. - -This will help to manage table of supported IDs. - -There is no functional change. - -Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -[lizf: Backported to 3.4: sort the list by myself] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/bluetooth/ath3k.c | 64 +++++++++++++++++++++++----------------------- - drivers/bluetooth/btusb.c | 46 ++++++++++++++++----------------- - 2 files changed, 55 insertions(+), 55 deletions(-) - ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -62,47 +62,47 @@ static struct usb_device_id ath3k_table[ - { USB_DEVICE(0x0CF3, 0x3000) }, - - /* Atheros AR3011 with sflash firmware*/ -+ { USB_DEVICE(0x0489, 0xE027) }, -+ { USB_DEVICE(0x0489, 0xE03D) }, -+ { USB_DEVICE(0x0930, 0x0215) }, - { USB_DEVICE(0x0CF3, 0x3002) }, - { USB_DEVICE(0x0CF3, 0xE019) }, - { USB_DEVICE(0x13d3, 0x3304) }, -- { USB_DEVICE(0x0930, 0x0215) }, -- { USB_DEVICE(0x0489, 0xE03D) }, -- { USB_DEVICE(0x0489, 0xE027) }, - - /* Atheros AR9285 Malbec with sflash firmware */ - { USB_DEVICE(0x03F0, 0x311D) }, - - /* Atheros AR3012 with sflash firmware*/ -+ { USB_DEVICE(0x0489, 0xe04d) }, -+ { USB_DEVICE(0x0489, 0xe04e) }, -+ { USB_DEVICE(0x0489, 0xe057) }, -+ { USB_DEVICE(0x0489, 0xe056) }, -+ { USB_DEVICE(0x04c5, 0x1330) }, -+ { USB_DEVICE(0x04CA, 0x3004) }, -+ { USB_DEVICE(0x04CA, 0x3005) }, -+ { USB_DEVICE(0x04CA, 0x3006) }, -+ { USB_DEVICE(0x04CA, 0x3008) }, -+ { USB_DEVICE(0x0930, 0x0219) }, - { USB_DEVICE(0x0CF3, 0x0036) }, - { USB_DEVICE(0x0CF3, 0x3004) }, - { USB_DEVICE(0x0CF3, 0x3008) }, - { USB_DEVICE(0x0CF3, 0x311D) }, -+ { USB_DEVICE(0x0cf3, 0x3121) }, - { USB_DEVICE(0x0CF3, 0x817a) }, -- { USB_DEVICE(0x13d3, 0x3375) }, -- { USB_DEVICE(0x04CA, 0x3004) }, -- { USB_DEVICE(0x04CA, 0x3005) }, -- { USB_DEVICE(0x04CA, 0x3006) }, -- { USB_DEVICE(0x04CA, 0x3008) }, -- { USB_DEVICE(0x13d3, 0x3362) }, -+ { USB_DEVICE(0x0cf3, 0xe003) }, - { USB_DEVICE(0x0CF3, 0xE004) }, - { USB_DEVICE(0x0CF3, 0xE005) }, -- { USB_DEVICE(0x0930, 0x0219) }, -- { USB_DEVICE(0x0489, 0xe057) }, -+ { USB_DEVICE(0x13d3, 0x3362) }, -+ { USB_DEVICE(0x13d3, 0x3375) }, - { USB_DEVICE(0x13d3, 0x3393) }, -- { USB_DEVICE(0x0489, 0xe04e) }, -- { USB_DEVICE(0x0489, 0xe056) }, -- { USB_DEVICE(0x0489, 0xe04d) }, -- { USB_DEVICE(0x04c5, 0x1330) }, - { USB_DEVICE(0x13d3, 0x3402) }, -- { USB_DEVICE(0x0cf3, 0x3121) }, -- { USB_DEVICE(0x0cf3, 0xe003) }, - - /* Atheros AR5BBU12 with sflash firmware */ - { USB_DEVICE(0x0489, 0xE02C) }, - - /* Atheros AR5BBU22 with sflash firmware */ -- { USB_DEVICE(0x0489, 0xE03C) }, - { USB_DEVICE(0x0489, 0xE036) }, -+ { USB_DEVICE(0x0489, 0xE03C) }, - - { } /* Terminating entry */ - }; -@@ -115,29 +115,29 @@ MODULE_DEVICE_TABLE(usb, ath3k_table); - static struct usb_device_id ath3k_blist_tbl[] = { - - /* Atheros AR3012 with sflash firmware*/ -+ { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU22 with sflash firmware */ - { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 }, ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -107,16 +107,16 @@ static struct usb_device_id btusb_table[ - { USB_DEVICE(0x0c10, 0x0000) }, - - /* Broadcom BCM20702A0 */ -+ { USB_DEVICE(0x0489, 0xe042) }, -+ { USB_DEVICE(0x04ca, 0x2003) }, - { USB_DEVICE(0x0b05, 0x17b5) }, - { USB_DEVICE(0x0b05, 0x17cb) }, -- { USB_DEVICE(0x04ca, 0x2003) }, -- { USB_DEVICE(0x0489, 0xe042) }, - { USB_DEVICE(0x413c, 0x8197) }, - - /* Foxconn - Hon Hai */ - { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) }, - -- /*Broadcom devices with vendor specific id */ -+ /* Broadcom devices with vendor specific id */ - { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) }, - - { } /* Terminating entry */ -@@ -132,52 +132,52 @@ static struct usb_device_id blacklist_ta - { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE }, - - /* Atheros 3011 with sflash firmware */ -+ { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, -+ { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, -+ { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, - { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, - { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, - { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE }, -- { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, -- { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, -- { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, - - /* Atheros AR9285 Malbec with sflash firmware */ - { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE }, - - /* Atheros 3012 with sflash firmware */ -+ { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, -- { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU12 with sflash firmware */ - { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, - - /* Atheros AR5BBU12 with sflash firmware */ -- { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, - - /* Broadcom BCM2035 */ -- { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU }, -- { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU }, - { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, -+ { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU }, -+ { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU }, - - /* Broadcom BCM2045 */ - { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU }, diff --git a/patches/bnx2fc-do-not-add-shared-skbs-to-the-fcoe_rx_list.patch b/patches/bnx2fc-do-not-add-shared-skbs-to-the-fcoe_rx_list.patch deleted file mode 100644 index cebc10d..0000000 --- a/patches/bnx2fc-do-not-add-shared-skbs-to-the-fcoe_rx_list.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 01a4cc4d0cd6a836c7b923760e8eb1cbb6a47258 Mon Sep 17 00:00:00 2001 -From: Maurizio Lombardi <mlombard@redhat.com> -Date: Thu, 20 Nov 2014 11:17:33 +0100 -Subject: bnx2fc: do not add shared skbs to the fcoe_rx_list - -commit 01a4cc4d0cd6a836c7b923760e8eb1cbb6a47258 upstream. - -In some cases, the fcoe_rx_list may contains multiple instances -of the same skb (the so called "shared skbs"). - -the bnx2fc_l2_rcv thread is a loop that extracts a skb from the list, -modifies (and destroys) its content and then proceed to the next one. -The problem is that if the skb is shared, the remaining instances will -be corrupted. - -The solution is to use skb_share_check() before adding the skb to the -fcoe_rx_list. - -[ 6286.808725] ------------[ cut here ]------------ -[ 6286.808729] WARNING: at include/scsi/fc_frame.h:173 bnx2fc_l2_rcv_thread+0x425/0x450 [bnx2fc]() -[ 6286.808748] Modules linked in: bnx2x(-) mdio dm_service_time bnx2fc cnic uio fcoe libfcoe 8021q garp stp mrp libfc llc scsi_transport_fc scsi_tgt sg iTCO_wdt iTCO_vendor_support coretemp kvm_intel kvm crct10dif_pclmul crc32_pclmul crc32c_intel e1000e ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper ptp cryptd hpilo serio_raw hpwdt lpc_ich pps_core ipmi_si pcspkr mfd_core ipmi_msghandler shpchp pcc_cpufreq mperf nfsd auth_rpcgss nfs_acl lockd sunrpc dm_multipath xfs libcrc32c ata_generic pata_acpi sd_mod crc_t10dif crct10dif_common mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit ata_piix drm_kms_helper ttm drm libata i2c_core hpsa dm_mirror dm_region_hash dm_log dm_mod [last unloaded: mdio] -[ 6286.808750] CPU: 3 PID: 1304 Comm: bnx2fc_l2_threa Not tainted 3.10.0-121.el7.x86_64 #1 -[ 6286.808750] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013 -[ 6286.808752] 0000000000000000 000000000b36e715 ffff8800deba1e00 ffffffff815ec0ba -[ 6286.808753] ffff8800deba1e38 ffffffff8105dee1 ffffffffa05618c0 ffff8801e4c81888 -[ 6286.808754] ffffe8ffff663868 ffff8801f402b180 ffff8801f56bc000 ffff8800deba1e48 -[ 6286.808754] Call Trace: -[ 6286.808759] [<ffffffff815ec0ba>] dump_stack+0x19/0x1b -[ 6286.808762] [<ffffffff8105dee1>] warn_slowpath_common+0x61/0x80 -[ 6286.808763] [<ffffffff8105e00a>] warn_slowpath_null+0x1a/0x20 -[ 6286.808765] [<ffffffffa054f415>] bnx2fc_l2_rcv_thread+0x425/0x450 [bnx2fc] -[ 6286.808767] [<ffffffffa054eff0>] ? bnx2fc_disable+0x90/0x90 [bnx2fc] -[ 6286.808769] [<ffffffff81085aef>] kthread+0xcf/0xe0 -[ 6286.808770] [<ffffffff81085a20>] ? kthread_create_on_node+0x140/0x140 -[ 6286.808772] [<ffffffff815fc76c>] ret_from_fork+0x7c/0xb0 -[ 6286.808773] [<ffffffff81085a20>] ? kthread_create_on_node+0x140/0x140 -[ 6286.808774] ---[ end trace c6cdb939184ccb4e ]--- - -Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> -Acked-by: Chad Dupuis <chad.dupuis@qlogic.com> -Signed-off-by: Christoph Hellwig <hch@lst.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 7 +++++++ - 1 file changed, 7 insertions(+) - ---- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c -+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c -@@ -406,6 +406,7 @@ static int bnx2fc_rcv(struct sk_buff *sk - struct fc_frame_header *fh; - struct fcoe_rcv_info *fr; - struct fcoe_percpu_s *bg; -+ struct sk_buff *tmp_skb; - unsigned short oxid; - - interface = container_of(ptype, struct bnx2fc_interface, -@@ -417,6 +418,12 @@ static int bnx2fc_rcv(struct sk_buff *sk - goto err; - } - -+ tmp_skb = skb_share_check(skb, GFP_ATOMIC); -+ if (!tmp_skb) -+ goto err; -+ -+ skb = tmp_skb; -+ - if (unlikely(eth_hdr(skb)->h_proto != htons(ETH_P_FCOE))) { - printk(KERN_ERR PFX "bnx2fc_rcv: Wrong FC type frame\n"); - goto err; diff --git a/patches/btrfs-fix-fs-corruption-on-transaction-abort-if-device-supports-discard.patch b/patches/btrfs-fix-fs-corruption-on-transaction-abort-if-device-supports-discard.patch deleted file mode 100644 index d5219a6..0000000 --- a/patches/btrfs-fix-fs-corruption-on-transaction-abort-if-device-supports-discard.patch +++ /dev/null @@ -1,170 +0,0 @@ -From 678886bdc6378c1cbd5072da2c5a3035000214e3 Mon Sep 17 00:00:00 2001 -From: Filipe Manana <fdmanana@suse.com> -Date: Sun, 7 Dec 2014 21:31:47 +0000 -Subject: Btrfs: fix fs corruption on transaction abort if device supports - discard - -commit 678886bdc6378c1cbd5072da2c5a3035000214e3 upstream. - -When we abort a transaction we iterate over all the ranges marked as dirty -in fs_info->freed_extents[0] and fs_info->freed_extents[1], clear them -from those trees, add them back (unpin) to the free space caches and, if -the fs was mounted with "-o discard", perform a discard on those regions. -Also, after adding the regions to the free space caches, a fitrim ioctl call -can see those ranges in a block group's free space cache and perform a discard -on the ranges, so the same issue can happen without "-o discard" as well. - -This causes corruption, affecting one or multiple btree nodes (in the worst -case leaving the fs unmountable) because some of those ranges (the ones in -the fs_info->pinned_extents tree) correspond to btree nodes/leafs that are -referred by the last committed super block - breaking the rule that anything -that was committed by a transaction is untouched until the next transaction -commits successfully. - -I ran into this while running in a loop (for several hours) the fstest that -I recently submitted: - - [PATCH] fstests: add btrfs test to stress chunk allocation/removal and fstrim - -The corruption always happened when a transaction aborted and then fsck complained -like this: - - _check_btrfs_filesystem: filesystem on /dev/sdc is inconsistent - *** fsck.btrfs output *** - Check tree block failed, want=94945280, have=0 - Check tree block failed, want=94945280, have=0 - Check tree block failed, want=94945280, have=0 - Check tree block failed, want=94945280, have=0 - Check tree block failed, want=94945280, have=0 - read block failed check_tree_block - Couldn't open file system - -In this case 94945280 corresponded to the root of a tree. -Using frace what I observed was the following sequence of steps happened: - - 1) transaction N started, fs_info->pinned_extents pointed to - fs_info->freed_extents[0]; - - 2) node/eb 94945280 is created; - - 3) eb is persisted to disk; - - 4) transaction N commit starts, fs_info->pinned_extents now points to - fs_info->freed_extents[1], and transaction N completes; - - 5) transaction N + 1 starts; - - 6) eb is COWed, and btrfs_free_tree_block() called for this eb; - - 7) eb range (94945280 to 94945280 + 16Kb) is added to - fs_info->pinned_extents (fs_info->freed_extents[1]); - - 8) Something goes wrong in transaction N + 1, like hitting ENOSPC - for example, and the transaction is aborted, turning the fs into - readonly mode. The stack trace I got for example: - - [112065.253935] [<ffffffff8140c7b6>] dump_stack+0x4d/0x66 - [112065.254271] [<ffffffff81042984>] warn_slowpath_common+0x7f/0x98 - [112065.254567] [<ffffffffa0325990>] ? __btrfs_abort_transaction+0x50/0x10b [btrfs] - [112065.261674] [<ffffffff810429e5>] warn_slowpath_fmt+0x48/0x50 - [112065.261922] [<ffffffffa032949e>] ? btrfs_free_path+0x26/0x29 [btrfs] - [112065.262211] [<ffffffffa0325990>] __btrfs_abort_transaction+0x50/0x10b [btrfs] - [112065.262545] [<ffffffffa036b1d6>] btrfs_remove_chunk+0x537/0x58b [btrfs] - [112065.262771] [<ffffffffa033840f>] btrfs_delete_unused_bgs+0x1de/0x21b [btrfs] - [112065.263105] [<ffffffffa0343106>] cleaner_kthread+0x100/0x12f [btrfs] - (...) - [112065.264493] ---[ end trace dd7903a975a31a08 ]--- - [112065.264673] BTRFS: error (device sdc) in btrfs_remove_chunk:2625: errno=-28 No space left - [112065.264997] BTRFS info (device sdc): forced readonly - - 9) The clear kthread sees that the BTRFS_FS_STATE_ERROR bit is set in - fs_info->fs_state and calls btrfs_cleanup_transaction(), which in - turn calls btrfs_destroy_pinned_extent(); - - 10) Then btrfs_destroy_pinned_extent() iterates over all the ranges - marked as dirty in fs_info->freed_extents[], and for each one - it calls discard, if the fs was mounted with "-o discard", and - adds the range to the free space cache of the respective block - group; - - 11) btrfs_trim_block_group(), invoked from the fitrim ioctl code path, - sees the free space entries and performs a discard; - - 12) After an umount and mount (or fsck), our eb's location on disk was full - of zeroes, and it should have been untouched, because it was marked as - dirty in the fs_info->pinned_extents tree, and therefore used by the - trees that the last committed superblock points to. - -Fix this by not performing a discard and not adding the ranges to the free space -caches - it's useless from this point since the fs is now in readonly mode and -we won't write free space caches to disk anymore (otherwise we would leak space) -nor any new superblock. By not adding the ranges to the free space caches, it -prevents other code paths from allocating that space and write to it as well, -therefore being safer and simpler. - -This isn't a new problem, as it's been present since 2011 (git commit -acce952b0263825da32cf10489413dec78053347). - -Signed-off-by: Filipe Manana <fdmanana@suse.com> -Signed-off-by: Chris Mason <clm@fb.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/btrfs/disk-io.c | 6 ------ - fs/btrfs/extent-tree.c | 10 ++++++---- - 2 files changed, 6 insertions(+), 10 deletions(-) - ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -3556,12 +3556,6 @@ static int btrfs_destroy_pinned_extent(s - if (ret) - break; - -- /* opt_discard */ -- if (btrfs_test_opt(root, DISCARD)) -- ret = btrfs_error_discard_extent(root, start, -- end + 1 - start, -- NULL); -- - clear_extent_dirty(unpin, start, end, GFP_NOFS); - btrfs_error_unpin_extent_range(root, start, end); - cond_resched(); ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -4892,7 +4892,8 @@ void btrfs_prepare_extent_commit(struct - update_global_block_rsv(fs_info); - } - --static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end) -+static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end, -+ const bool return_free_space) - { - struct btrfs_fs_info *fs_info = root->fs_info; - struct btrfs_block_group_cache *cache = NULL; -@@ -4912,7 +4913,8 @@ static int unpin_extent_range(struct btr - - if (start < cache->last_byte_to_unpin) { - len = min(len, cache->last_byte_to_unpin - start); -- btrfs_add_free_space(cache, start, len); -+ if (return_free_space) -+ btrfs_add_free_space(cache, start, len); - } - - start += len; -@@ -4960,7 +4962,7 @@ int btrfs_finish_extent_commit(struct bt - end + 1 - start, NULL); - - clear_extent_dirty(unpin, start, end, GFP_NOFS); -- unpin_extent_range(root, start, end); -+ unpin_extent_range(root, start, end, true); - cond_resched(); - } - -@@ -8008,7 +8010,7 @@ out: - - int btrfs_error_unpin_extent_range(struct btrfs_root *root, u64 start, u64 end) - { -- return unpin_extent_range(root, start, end); -+ return unpin_extent_range(root, start, end, false); - } - - int btrfs_error_discard_extent(struct btrfs_root *root, u64 bytenr, diff --git a/patches/caif-remove-wrong-dev_net_set-call.patch b/patches/caif-remove-wrong-dev_net_set-call.patch deleted file mode 100644 index 081aa45..0000000 --- a/patches/caif-remove-wrong-dev_net_set-call.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 8997c27ec41127bf57421cc0205413d525421ddc Mon Sep 17 00:00:00 2001 -From: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Date: Mon, 26 Jan 2015 22:28:13 +0100 -Subject: caif: remove wrong dev_net_set() call -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 8997c27ec41127bf57421cc0205413d525421ddc upstream. - -src_net points to the netns where the netlink message has been received. This -netns may be different from the netns where the interface is created (because -the user may add IFLA_NET_NS_[PID|FD]). In this case, src_net is the link netns. - -It seems wrong to override the netns in the newlink() handler because if it -was not already src_net, it means that the user explicitly asks to create the -netdevice in another netns. - -CC: Sjur Brændeland <sjur.brandeland@stericsson.com> -CC: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no> -Fixes: 8391c4aab1aa ("caif: Bugfixes in CAIF netdevice for close and flow control") -Fixes: c41254006377 ("caif-hsi: Add rtnl support") -Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -[lizf: Backported to 3.4: drop the change to drivers/net/caif/caif_hsi.c] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/caif/chnl_net.c | 1 - - 1 file changed, 1 deletion(-) - ---- a/net/caif/chnl_net.c -+++ b/net/caif/chnl_net.c -@@ -467,7 +467,6 @@ static int ipcaif_newlink(struct net *sr - ASSERT_RTNL(); - caifdev = netdev_priv(dev); - caif_netlink_parms(data, &caifdev->conn_req); -- dev_net_set(caifdev->netdev, src_net); - - ret = register_netdevice(dev); - if (ret) diff --git a/patches/can-dev-fix-crtlmode_supported-check.patch b/patches/can-dev-fix-crtlmode_supported-check.patch deleted file mode 100644 index f0411ae..0000000 --- a/patches/can-dev-fix-crtlmode_supported-check.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 9b1087aa5e86448fe6ad40a58964e35f3ba423d5 Mon Sep 17 00:00:00 2001 -From: Oliver Hartkopp <socketcan@hartkopp.net> -Date: Mon, 5 Jan 2015 18:40:15 +0100 -Subject: can: dev: fix crtlmode_supported check - -commit 9b1087aa5e86448fe6ad40a58964e35f3ba423d5 upstream. - -When changing flags in the CAN drivers ctrlmode the provided new content has to -be checked whether the bits are allowed to be changed. The bits that are to be -changed are given as a bitfield in cm->mask. Therefore checking against -cm->flags is wrong as the content can hold any kind of values. - -The iproute2 tool sets the bits in cm->mask and cm->flags depending on the -detected command line options. To be robust against bogus user space -applications additionally sanitize the provided flags with the provided mask. - -Cc: Wolfgang Grandegger <wg@grandegger.com> -Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> -Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/can/dev.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - ---- a/drivers/net/can/dev.c -+++ b/drivers/net/can/dev.c -@@ -612,10 +612,14 @@ static int can_changelink(struct net_dev - if (dev->flags & IFF_UP) - return -EBUSY; - cm = nla_data(data[IFLA_CAN_CTRLMODE]); -- if (cm->flags & ~priv->ctrlmode_supported) -+ -+ /* check whether changed bits are allowed to be modified */ -+ if (cm->mask & ~priv->ctrlmode_supported) - return -EOPNOTSUPP; -+ -+ /* clear bits to be modified and copy the flag values */ - priv->ctrlmode &= ~cm->mask; -- priv->ctrlmode |= cm->flags; -+ priv->ctrlmode |= (cm->flags & cm->mask); - } - - if (data[IFLA_CAN_BITTIMING]) { diff --git a/patches/can-peak_usb-fix-cleanup-sequence-order-in-case-of-error-during-init.patch b/patches/can-peak_usb-fix-cleanup-sequence-order-in-case-of-error-during-init.patch deleted file mode 100644 index f7d3c15..0000000 --- a/patches/can-peak_usb-fix-cleanup-sequence-order-in-case-of-error-during-init.patch +++ /dev/null @@ -1,75 +0,0 @@ -From af35d0f1cce7a990286e2b94c260a2c2d2a0e4b0 Mon Sep 17 00:00:00 2001 -From: Stephane Grosjean <s.grosjean@peak-system.com> -Date: Fri, 28 Nov 2014 13:49:10 +0100 -Subject: can: peak_usb: fix cleanup sequence order in case of error during - init - -commit af35d0f1cce7a990286e2b94c260a2c2d2a0e4b0 upstream. - -This patch sets the correct reverse sequence order to the instructions -set to run, when any failure occurs during the initialization steps. -It also adds the missing unregistration call of the can device if the -failure appears after having been registered. - -Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com> -Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/can/usb/peak_usb/pcan_usb_core.c | 17 ++++++++++------- - 1 file changed, 10 insertions(+), 7 deletions(-) - ---- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c -@@ -737,7 +737,7 @@ static int peak_usb_create_dev(struct pe - dev_err(&intf->dev, "%s: couldn't alloc cmd buffer\n", - PCAN_USB_DRIVER_NAME); - err = -ENOMEM; -- goto lbl_set_intf_data; -+ goto lbl_free_candev; - } - - dev->udev = usb_dev; -@@ -776,7 +776,7 @@ static int peak_usb_create_dev(struct pe - err = register_candev(netdev); - if (err) { - dev_err(&intf->dev, "couldn't register CAN device: %d\n", err); -- goto lbl_free_cmd_buf; -+ goto lbl_restore_intf_data; - } - - if (dev->prev_siblings) -@@ -789,14 +789,14 @@ static int peak_usb_create_dev(struct pe - if (dev->adapter->dev_init) { - err = dev->adapter->dev_init(dev); - if (err) -- goto lbl_free_cmd_buf; -+ goto lbl_unregister_candev; - } - - /* set bus off */ - if (dev->adapter->dev_set_bus) { - err = dev->adapter->dev_set_bus(dev, 0); - if (err) -- goto lbl_free_cmd_buf; -+ goto lbl_unregister_candev; - } - - /* get device number early */ -@@ -808,11 +808,14 @@ static int peak_usb_create_dev(struct pe - - return 0; - --lbl_free_cmd_buf: -- kfree(dev->cmd_buf); -+lbl_unregister_candev: -+ unregister_candev(netdev); - --lbl_set_intf_data: -+lbl_restore_intf_data: - usb_set_intfdata(intf, dev->prev_siblings); -+ kfree(dev->cmd_buf); -+ -+lbl_free_candev: - free_candev(netdev); - - return err; diff --git a/patches/can-peak_usb-fix-memset-usage.patch b/patches/can-peak_usb-fix-memset-usage.patch deleted file mode 100644 index 05ab21d..0000000 --- a/patches/can-peak_usb-fix-memset-usage.patch +++ /dev/null @@ -1,40 +0,0 @@ -From dc50ddcd4c58a5a0226038307d6ef884bec9f8c2 Mon Sep 17 00:00:00 2001 -From: Stephane Grosjean <s.grosjean@peak-system.com> -Date: Fri, 28 Nov 2014 14:08:48 +0100 -Subject: can: peak_usb: fix memset() usage - -commit dc50ddcd4c58a5a0226038307d6ef884bec9f8c2 upstream. - -This patchs fixes a misplaced call to memset() that fills the request -buffer with 0. The problem was with sending PCAN_USBPRO_REQ_FCT -requests, the content set by the caller was thus lost. - -With this patch, the memory area is zeroed only when requesting info -from the device. - -Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com> -Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - ---- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c -@@ -333,8 +333,6 @@ static int pcan_usb_pro_send_req(struct - if (!(dev->state & PCAN_USB_STATE_CONNECTED)) - return 0; - -- memset(req_addr, '\0', req_size); -- - req_type = USB_TYPE_VENDOR | USB_RECIP_OTHER; - - switch (req_id) { -@@ -345,6 +343,7 @@ static int pcan_usb_pro_send_req(struct - default: - p = usb_rcvctrlpipe(dev->udev, 0); - req_type |= USB_DIR_IN; -+ memset(req_addr, '\0', req_size); - break; - } - diff --git a/patches/cdc-acm-memory-leak-in-error-case.patch b/patches/cdc-acm-memory-leak-in-error-case.patch deleted file mode 100644 index 5ed9d2e..0000000 --- a/patches/cdc-acm-memory-leak-in-error-case.patch +++ /dev/null @@ -1,28 +0,0 @@ -From d908f8478a8d18e66c80a12adb27764920c1f1ca Mon Sep 17 00:00:00 2001 -From: Oliver Neukum <oneukum@suse.de> -Date: Thu, 20 Nov 2014 14:54:35 +0100 -Subject: cdc-acm: memory leak in error case - -commit d908f8478a8d18e66c80a12adb27764920c1f1ca upstream. - -If probe() fails not only the attributes need to be removed -but also the memory freed. - -Reported-by: Ahmed Tamrawi <ahmedtamrawi@gmail.com> -Signed-off-by: Oliver Neukum <oneukum@suse.de> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/class/cdc-acm.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1429,6 +1429,7 @@ static void acm_disconnect(struct usb_in - &dev_attr_wCountryCodes); - device_remove_file(&acm->control->dev, - &dev_attr_iCountryCodeRelDate); -+ kfree(acm->country_codes); - } - device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities); - usb_set_intfdata(acm->control, NULL); diff --git a/patches/crypto-af_alg-fix-backlog-handling.patch b/patches/crypto-af_alg-fix-backlog-handling.patch deleted file mode 100644 index 33b35bf..0000000 --- a/patches/crypto-af_alg-fix-backlog-handling.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 7e77bdebff5cb1e9876c561f69710b9ab8fa1f7e Mon Sep 17 00:00:00 2001 -From: Rabin Vincent <rabin.vincent@axis.com> -Date: Fri, 19 Dec 2014 13:36:08 +0100 -Subject: crypto: af_alg - fix backlog handling - -commit 7e77bdebff5cb1e9876c561f69710b9ab8fa1f7e upstream. - -If a request is backlogged, it's complete() handler will get called -twice: once with -EINPROGRESS, and once with the final error code. - -af_alg's complete handler, unlike other users, does not handle the --EINPROGRESS but instead always completes the completion that recvmsg() -is waiting on. This can lead to a return to user space while the -request is still pending in the driver. If userspace closes the sockets -before the requests are handled by the driver, this will lead to -use-after-frees (and potential crashes) in the kernel due to the tfm -having been freed. - -The crashes can be easily reproduced (for example) by reducing the max -queue length in cryptod.c and running the following (from -http://www.chronox.de/libkcapi.html) on AES-NI capable hardware: - - $ while true; do kcapi -x 1 -e -c '__ecb-aes-aesni' \ - -k 00000000000000000000000000000000 \ - -p 00000000000000000000000000000000 >/dev/null & done - -Signed-off-by: Rabin Vincent <rabin.vincent@axis.com> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - crypto/af_alg.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -449,6 +449,9 @@ void af_alg_complete(struct crypto_async - { - struct af_alg_completion *completion = req->data; - -+ if (err == -EINPROGRESS) -+ return; -+ - completion->err = err; - complete(&completion->completion); - } diff --git a/patches/deal-with-deadlock-in-d_walk.patch b/patches/deal-with-deadlock-in-d_walk.patch deleted file mode 100644 index 6ccf578..0000000 --- a/patches/deal-with-deadlock-in-d_walk.patch +++ /dev/null @@ -1,225 +0,0 @@ -From 2d5a2e6775fadc4ac5b7a1a5cbcdec1bffc0b142 Mon Sep 17 00:00:00 2001 -From: Al Viro <viro@zeniv.linux.org.uk> -Date: Sun, 26 Oct 2014 19:31:10 -0400 -Subject: deal with deadlock in d_walk() - -commit ca5358ef75fc69fee5322a38a340f5739d997c10 upstream. - -... by not hitting rename_retry for reasons other than rename having -happened. In other words, do _not_ restart when finding that -between unlocking the child and locking the parent the former got -into __dentry_kill(). Skip the killed siblings instead... - -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -[bwh: Backported to 3.2: - - As we only have try_to_ascend() and not d_walk(), apply this - change to all callers of try_to_ascend() - - Adjust context to make __dentry_kill() apply to d_kill()] -Signed-off-by: Ben Hutchings <ben@decadent.org.uk> -[lizf: Backported to 3.4: fold the fix 2d5a2e6775fa in 3.2.y into this patch] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/dcache.c | 105 +++++++++++++++++++++++++++++++++++++----------------------- - 1 file changed, 65 insertions(+), 40 deletions(-) - ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -368,9 +368,9 @@ static struct dentry *d_kill(struct dent - __releases(parent->d_lock) - __releases(dentry->d_inode->i_lock) - { -- list_del(&dentry->d_child); -+ __list_del_entry(&dentry->d_child); - /* -- * Inform try_to_ascend() that we are no longer attached to the -+ * Inform ascending readers that we are no longer attached to the - * dentry tree - */ - dentry->d_flags |= DCACHE_DENTRY_KILLED; -@@ -1011,34 +1011,6 @@ void shrink_dcache_for_umount(struct sup - } - } - --/* -- * This tries to ascend one level of parenthood, but -- * we can race with renaming, so we need to re-check -- * the parenthood after dropping the lock and check -- * that the sequence number still matches. -- */ --static struct dentry *try_to_ascend(struct dentry *old, int locked, unsigned seq) --{ -- struct dentry *new = old->d_parent; -- -- rcu_read_lock(); -- spin_unlock(&old->d_lock); -- spin_lock(&new->d_lock); -- -- /* -- * might go back up the wrong parent if we have had a rename -- * or deletion -- */ -- if (new != old->d_parent || -- (old->d_flags & DCACHE_DENTRY_KILLED) || -- (!locked && read_seqretry(&rename_lock, seq))) { -- spin_unlock(&new->d_lock); -- new = NULL; -- } -- rcu_read_unlock(); -- return new; --} -- - - /* - * Search for at least 1 mount point in the dentry's subdirs. -@@ -1094,30 +1066,48 @@ resume: - /* - * All done at this level ... ascend and resume the search. - */ -+ rcu_read_lock(); -+ascend: - if (this_parent != parent) { - struct dentry *child = this_parent; -- this_parent = try_to_ascend(this_parent, locked, seq); -- if (!this_parent) -+ this_parent = child->d_parent; -+ -+ spin_unlock(&child->d_lock); -+ spin_lock(&this_parent->d_lock); -+ -+ /* might go back up the wrong parent if we have had a rename */ -+ if (!locked && read_seqretry(&rename_lock, seq)) - goto rename_retry; - next = child->d_child.next; -+ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { -+ if (next == &this_parent->d_subdirs) -+ goto ascend; -+ child = list_entry(next, struct dentry, d_child); -+ next = next->next; -+ } -+ rcu_read_unlock(); - goto resume; - } -- spin_unlock(&this_parent->d_lock); - if (!locked && read_seqretry(&rename_lock, seq)) - goto rename_retry; -+ spin_unlock(&this_parent->d_lock); -+ rcu_read_unlock(); - if (locked) - write_sequnlock(&rename_lock); - return 0; /* No mount points found in tree */ - positive: - if (!locked && read_seqretry(&rename_lock, seq)) -- goto rename_retry; -+ goto rename_retry_unlocked; - if (locked) - write_sequnlock(&rename_lock); - return 1; - - rename_retry: -+ spin_unlock(&this_parent->d_lock); -+ rcu_read_unlock(); - if (locked) - goto again; -+rename_retry_unlocked: - locked = 1; - write_seqlock(&rename_lock); - goto again; -@@ -1182,6 +1172,7 @@ resume: - */ - if (found && need_resched()) { - spin_unlock(&dentry->d_lock); -+ rcu_read_lock(); - goto out; - } - -@@ -1201,23 +1192,40 @@ resume: - /* - * All done at this level ... ascend and resume the search. - */ -+ rcu_read_lock(); -+ascend: - if (this_parent != parent) { - struct dentry *child = this_parent; -- this_parent = try_to_ascend(this_parent, locked, seq); -- if (!this_parent) -+ this_parent = child->d_parent; -+ -+ spin_unlock(&child->d_lock); -+ spin_lock(&this_parent->d_lock); -+ -+ /* might go back up the wrong parent if we have had a rename */ -+ if (!locked && read_seqretry(&rename_lock, seq)) - goto rename_retry; - next = child->d_child.next; -+ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { -+ if (next == &this_parent->d_subdirs) -+ goto ascend; -+ child = list_entry(next, struct dentry, d_child); -+ next = next->next; -+ } -+ rcu_read_unlock(); - goto resume; - } - out: -- spin_unlock(&this_parent->d_lock); - if (!locked && read_seqretry(&rename_lock, seq)) - goto rename_retry; -+ spin_unlock(&this_parent->d_lock); -+ rcu_read_unlock(); - if (locked) - write_sequnlock(&rename_lock); - return found; - - rename_retry: -+ spin_unlock(&this_parent->d_lock); -+ rcu_read_unlock(); - if (found) - return found; - if (locked) -@@ -2955,26 +2963,43 @@ resume: - } - spin_unlock(&dentry->d_lock); - } -+ rcu_read_lock(); -+ascend: - if (this_parent != root) { - struct dentry *child = this_parent; - if (!(this_parent->d_flags & DCACHE_GENOCIDE)) { - this_parent->d_flags |= DCACHE_GENOCIDE; - this_parent->d_count--; - } -- this_parent = try_to_ascend(this_parent, locked, seq); -- if (!this_parent) -+ this_parent = child->d_parent; -+ -+ spin_unlock(&child->d_lock); -+ spin_lock(&this_parent->d_lock); -+ -+ /* might go back up the wrong parent if we have had a rename */ -+ if (!locked && read_seqretry(&rename_lock, seq)) - goto rename_retry; - next = child->d_child.next; -+ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { -+ if (next == &this_parent->d_subdirs) -+ goto ascend; -+ child = list_entry(next, struct dentry, d_child); -+ next = next->next; -+ } -+ rcu_read_unlock(); - goto resume; - } -- spin_unlock(&this_parent->d_lock); - if (!locked && read_seqretry(&rename_lock, seq)) - goto rename_retry; -+ spin_unlock(&this_parent->d_lock); -+ rcu_read_unlock(); - if (locked) - write_sequnlock(&rename_lock); - return; - - rename_retry: -+ spin_unlock(&this_parent->d_lock); -+ rcu_read_unlock(); - if (locked) - goto again; - locked = 1; diff --git a/patches/drbd-merge_bvec_fn-properly-remap-bvm-bi_bdev.patch b/patches/drbd-merge_bvec_fn-properly-remap-bvm-bi_bdev.patch deleted file mode 100644 index 5237186..0000000 --- a/patches/drbd-merge_bvec_fn-properly-remap-bvm-bi_bdev.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 3b9d35d744bb5139f9fed57f38c019bb8c7d351c Mon Sep 17 00:00:00 2001 -From: Lars Ellenberg <lars.ellenberg@linbit.com> -Date: Mon, 10 Nov 2014 17:21:13 +0100 -Subject: drbd: merge_bvec_fn: properly remap bvm->bi_bdev - -commit 3b9d35d744bb5139f9fed57f38c019bb8c7d351c upstream. - -This was not noticed for many years. Affects operation if -md raid is used a backing device for DRBD. - -Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com> -Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com> -Signed-off-by: Jens Axboe <axboe@fb.com> -[lizf: Backported to 3.4: s/device/mdev] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/block/drbd/drbd_req.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/block/drbd/drbd_req.c -+++ b/drivers/block/drbd/drbd_req.c -@@ -1184,6 +1184,7 @@ int drbd_merge_bvec(struct request_queue - struct request_queue * const b = - mdev->ldev->backing_bdev->bd_disk->queue; - if (b->merge_bvec_fn) { -+ bvm->bi_bdev = mdev->ldev->backing_bdev; - backing_limit = b->merge_bvec_fn(b, bvm, bvec); - limit = min(limit, backing_limit); - } diff --git a/patches/driver-core-fix-unbalanced-device-reference-in-drivers_probe.patch b/patches/driver-core-fix-unbalanced-device-reference-in-drivers_probe.patch deleted file mode 100644 index c8ea90f..0000000 --- a/patches/driver-core-fix-unbalanced-device-reference-in-drivers_probe.patch +++ /dev/null @@ -1,78 +0,0 @@ -From bb34cb6bbd287b57e955bc5cfd42fcde6aaca279 Mon Sep 17 00:00:00 2001 -From: Alex Williamson <alex.williamson@redhat.com> -Date: Fri, 31 Oct 2014 11:13:07 -0600 -Subject: driver core: Fix unbalanced device reference in drivers_probe - -commit bb34cb6bbd287b57e955bc5cfd42fcde6aaca279 upstream. - -bus_find_device_by_name() acquires a device reference which is never -released. This results in an object leak, which on older kernels -results in failure to release all resources of PCI devices. libvirt -uses drivers_probe to re-attach devices to the host after assignment -and is therefore a common trigger for this leak. - -Example: - -# cd /sys/bus/pci/ -# dmesg -C -# echo 1 > devices/0000\:01\:00.0/sriov_numvfs -# echo 0 > devices/0000\:01\:00.0/sriov_numvfs -# dmesg | grep 01:10 - pci 0000:01:10.0: [8086:10ca] type 00 class 0x020000 - kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_add_internal: parent: '0000:00:01.0', set: 'devices' - kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env - kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' - kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env - kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' - kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_uevent_env - kobject: '0000:01:10.0' (ffff8801d79cd0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' - kobject: '0000:01:10.0' (ffff8801d79cd0a8): kobject_cleanup, parent (null) - kobject: '0000:01:10.0' (ffff8801d79cd0a8): calling ktype release - kobject: '0000:01:10.0': free name - -[kobject freed as expected] - -# dmesg -C -# echo 1 > devices/0000\:01\:00.0/sriov_numvfs -# echo 0000:01:10.0 > drivers_probe -# echo 0 > devices/0000\:01\:00.0/sriov_numvfs -# dmesg | grep 01:10 - pci 0000:01:10.0: [8086:10ca] type 00 class 0x020000 - kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_add_internal: parent: '0000:00:01.0', set: 'devices' - kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env - kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' - kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env - kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' - kobject: '0000:01:10.0' (ffff8801d79ce0a8): kobject_uevent_env - kobject: '0000:01:10.0' (ffff8801d79ce0a8): fill_kobj_path: path = '/devices/pci0000:00/0000:00:01.0/0000:01:10.0' - -[no free] - -Signed-off-by: Alex Williamson <alex.williamson@redhat.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/base/bus.c | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - ---- a/drivers/base/bus.c -+++ b/drivers/base/bus.c -@@ -245,13 +245,15 @@ static ssize_t store_drivers_probe(struc - const char *buf, size_t count) - { - struct device *dev; -+ int err = -EINVAL; - - dev = bus_find_device_by_name(bus, NULL, buf); - if (!dev) - return -ENODEV; -- if (bus_rescan_devices_helper(dev, NULL) != 0) -- return -EINVAL; -- return count; -+ if (bus_rescan_devices_helper(dev, NULL) == 0) -+ err = count; -+ put_device(dev); -+ return err; - } - #endif - diff --git a/patches/driver-core-introduce-device_create_groups.patch b/patches/driver-core-introduce-device_create_groups.patch deleted file mode 100644 index be44ba4..0000000 --- a/patches/driver-core-introduce-device_create_groups.patch +++ /dev/null @@ -1,179 +0,0 @@ -From 39ef311204941ddd01ea2950d6220c8ccc710d15 Mon Sep 17 00:00:00 2001 -From: Guenter Roeck <linux@roeck-us.net> -Date: Sun, 14 Jul 2013 16:05:57 -0700 -Subject: driver core: Introduce device_create_groups - -commit 39ef311204941ddd01ea2950d6220c8ccc710d15 upstream. - -device_create_groups lets callers create devices as well as associated -sysfs attributes with a single call. This avoids race conditions seen -if sysfs attributes on new devices are created later. - -[fixed up comment block placement and add checks for printk buffer -formats - gregkh] - -Signed-off-by: Guenter Roeck <linux@roeck-us.net> -Cc: Jean Delvare <khali@linux-fr.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/base/core.c | 111 ++++++++++++++++++++++++++++++++++++------------- - include/linux/device.h | 5 ++ - 2 files changed, 88 insertions(+), 28 deletions(-) - ---- a/drivers/base/core.c -+++ b/drivers/base/core.c -@@ -1494,34 +1494,11 @@ static void device_create_release(struct - kfree(dev); - } - --/** -- * device_create_vargs - creates a device and registers it with sysfs -- * @class: pointer to the struct class that this device should be registered to -- * @parent: pointer to the parent struct device of this new device, if any -- * @devt: the dev_t for the char device to be added -- * @drvdata: the data to be added to the device for callbacks -- * @fmt: string for the device's name -- * @args: va_list for the device's name -- * -- * This function can be used by char device classes. A struct device -- * will be created in sysfs, registered to the specified class. -- * -- * A "dev" file will be created, showing the dev_t for the device, if -- * the dev_t is not 0,0. -- * If a pointer to a parent struct device is passed in, the newly created -- * struct device will be a child of that device in sysfs. -- * The pointer to the struct device will be returned from the call. -- * Any further sysfs files that might be required can be created using this -- * pointer. -- * -- * Returns &struct device pointer on success, or ERR_PTR() on error. -- * -- * Note: the struct class passed to this function must have previously -- * been created with a call to class_create(). -- */ --struct device *device_create_vargs(struct class *class, struct device *parent, -- dev_t devt, void *drvdata, const char *fmt, -- va_list args) -+static struct device * -+device_create_groups_vargs(struct class *class, struct device *parent, -+ dev_t devt, void *drvdata, -+ const struct attribute_group **groups, -+ const char *fmt, va_list args) - { - struct device *dev = NULL; - int retval = -ENODEV; -@@ -1538,6 +1515,7 @@ struct device *device_create_vargs(struc - dev->devt = devt; - dev->class = class; - dev->parent = parent; -+ dev->groups = groups; - dev->release = device_create_release; - dev_set_drvdata(dev, drvdata); - -@@ -1555,6 +1533,39 @@ error: - put_device(dev); - return ERR_PTR(retval); - } -+ -+/** -+ * device_create_vargs - creates a device and registers it with sysfs -+ * @class: pointer to the struct class that this device should be registered to -+ * @parent: pointer to the parent struct device of this new device, if any -+ * @devt: the dev_t for the char device to be added -+ * @drvdata: the data to be added to the device for callbacks -+ * @fmt: string for the device's name -+ * @args: va_list for the device's name -+ * -+ * This function can be used by char device classes. A struct device -+ * will be created in sysfs, registered to the specified class. -+ * -+ * A "dev" file will be created, showing the dev_t for the device, if -+ * the dev_t is not 0,0. -+ * If a pointer to a parent struct device is passed in, the newly created -+ * struct device will be a child of that device in sysfs. -+ * The pointer to the struct device will be returned from the call. -+ * Any further sysfs files that might be required can be created using this -+ * pointer. -+ * -+ * Returns &struct device pointer on success, or ERR_PTR() on error. -+ * -+ * Note: the struct class passed to this function must have previously -+ * been created with a call to class_create(). -+ */ -+struct device *device_create_vargs(struct class *class, struct device *parent, -+ dev_t devt, void *drvdata, const char *fmt, -+ va_list args) -+{ -+ return device_create_groups_vargs(class, parent, devt, drvdata, NULL, -+ fmt, args); -+} - EXPORT_SYMBOL_GPL(device_create_vargs); - - /** -@@ -1594,6 +1605,50 @@ struct device *device_create(struct clas - } - EXPORT_SYMBOL_GPL(device_create); - -+/** -+ * device_create_with_groups - creates a device and registers it with sysfs -+ * @class: pointer to the struct class that this device should be registered to -+ * @parent: pointer to the parent struct device of this new device, if any -+ * @devt: the dev_t for the char device to be added -+ * @drvdata: the data to be added to the device for callbacks -+ * @groups: NULL-terminated list of attribute groups to be created -+ * @fmt: string for the device's name -+ * -+ * This function can be used by char device classes. A struct device -+ * will be created in sysfs, registered to the specified class. -+ * Additional attributes specified in the groups parameter will also -+ * be created automatically. -+ * -+ * A "dev" file will be created, showing the dev_t for the device, if -+ * the dev_t is not 0,0. -+ * If a pointer to a parent struct device is passed in, the newly created -+ * struct device will be a child of that device in sysfs. -+ * The pointer to the struct device will be returned from the call. -+ * Any further sysfs files that might be required can be created using this -+ * pointer. -+ * -+ * Returns &struct device pointer on success, or ERR_PTR() on error. -+ * -+ * Note: the struct class passed to this function must have previously -+ * been created with a call to class_create(). -+ */ -+struct device *device_create_with_groups(struct class *class, -+ struct device *parent, dev_t devt, -+ void *drvdata, -+ const struct attribute_group **groups, -+ const char *fmt, ...) -+{ -+ va_list vargs; -+ struct device *dev; -+ -+ va_start(vargs, fmt); -+ dev = device_create_groups_vargs(class, parent, devt, drvdata, groups, -+ fmt, vargs); -+ va_end(vargs); -+ return dev; -+} -+EXPORT_SYMBOL_GPL(device_create_with_groups); -+ - static int __match_devt(struct device *dev, void *data) - { - dev_t *devt = data; ---- a/include/linux/device.h -+++ b/include/linux/device.h -@@ -835,6 +835,11 @@ extern __printf(5, 6) - struct device *device_create(struct class *cls, struct device *parent, - dev_t devt, void *drvdata, - const char *fmt, ...); -+extern __printf(6, 7) -+struct device *device_create_with_groups(struct class *cls, -+ struct device *parent, dev_t devt, void *drvdata, -+ const struct attribute_group **groups, -+ const char *fmt, ...); - extern void device_destroy(struct class *cls, dev_t devt); - - /* diff --git a/patches/drivers-hv-vmbus-incorrect-device-name-is-printed-when-child-device-is-unregistered.patch b/patches/drivers-hv-vmbus-incorrect-device-name-is-printed-when-child-device-is-unregistered.patch deleted file mode 100644 index f8e8e13..0000000 --- a/patches/drivers-hv-vmbus-incorrect-device-name-is-printed-when-child-device-is-unregistered.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 84672369ffb98a51d4ddf74c20a23636da3ad615 Mon Sep 17 00:00:00 2001 -From: Fernando Soto <fsoto@bluecatnetworks.com> -Date: Fri, 14 Jun 2013 23:13:35 +0000 -Subject: Drivers: hv: vmbus: incorrect device name is printed when child - device is unregistered -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 84672369ffb98a51d4ddf74c20a23636da3ad615 upstream. - -Whenever a device is unregistered in vmbus_device_unregister (drivers/hv/vmbus_drv.c), the device name in the log message may contain garbage as the memory has already been freed by the time pr_info is called. Log example: - [ 3149.170475] hv_vmbus: child device à õsèè0_5 unregistered - -By logging the message just before calling device_unregister, the correct device name is printed: -[ 3145.034652] hv_vmbus: child device vmbus_0_5 unregistered - -Also changing register & unregister messages to debug to avoid unnecessarily cluttering the kernel log. - -Signed-off-by: Fernando M Soto <fsoto@bluecatnetworks.com> -Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Cc: Joseph Salisbury <joseph.salisbury@canonical.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/hv/vmbus_drv.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - ---- a/drivers/hv/vmbus_drv.c -+++ b/drivers/hv/vmbus_drv.c -@@ -681,7 +681,7 @@ int vmbus_device_register(struct hv_devi - if (ret) - pr_err("Unable to register child device\n"); - else -- pr_info("child device %s registered\n", -+ pr_debug("child device %s registered\n", - dev_name(&child_device_obj->device)); - - return ret; -@@ -693,14 +693,14 @@ int vmbus_device_register(struct hv_devi - */ - void vmbus_device_unregister(struct hv_device *device_obj) - { -+ pr_debug("child device %s unregistered\n", -+ dev_name(&device_obj->device)); -+ - /* - * Kick off the process of unregistering the device. - * This will call vmbus_remove() and eventually vmbus_device_release() - */ - device_unregister(&device_obj->device); -- -- pr_info("child device %s unregistered\n", -- dev_name(&device_obj->device)); - } - - diff --git a/patches/drm-i915-only-fence-tiled-region-of-object.patch b/patches/drm-i915-only-fence-tiled-region-of-object.patch deleted file mode 100644 index 00e88c9..0000000 --- a/patches/drm-i915-only-fence-tiled-region-of-object.patch +++ /dev/null @@ -1,62 +0,0 @@ -From af1a7301c7cf8912dca03065d448c4437c5c239f Mon Sep 17 00:00:00 2001 -From: Bob Paauwe <bob.j.paauwe@intel.com> -Date: Thu, 18 Dec 2014 09:51:26 -0800 -Subject: drm/i915: Only fence tiled region of object. - -commit af1a7301c7cf8912dca03065d448c4437c5c239f upstream. - -When creating a fence for a tiled object, only fence the area that -makes up the actual tiles. The object may be larger than the tiled -area and if we allow those extra addresses to be fenced, they'll -get converted to addresses beyond where the object is mapped. This -opens up the possiblity of writes beyond the end of object. - -To prevent this, we adjust the size of the fence to only encompass -the area that makes up the actual tiles. The extra space is considered -un-tiled and now behaves as if it was a linear object. - -Testcase: igt/gem_tiled_fence_overflow -Reported-by: Dan Hettena <danh@ghs.com> -Signed-off-by: Bob Paauwe <bob.j.paauwe@intel.com> -Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> -Signed-off-by: Jani Nikula <jani.nikula@intel.com> -[lizf: Backported to 3.4: - - adjust context - - adjust indentation - - make the same change to both sandybridge_write_fence_reg() - and i965_write_fence_reg()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/i915/i915_gem.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - ---- a/drivers/gpu/drm/i915/i915_gem.c -+++ b/drivers/gpu/drm/i915/i915_gem.c -@@ -2193,6 +2193,13 @@ static int sandybridge_write_fence_reg(s - int regnum = obj->fence_reg; - uint64_t val; - -+ /* Adjust fence size to match tiled area */ -+ if (obj->tiling_mode != I915_TILING_NONE) { -+ uint32_t row_size = obj->stride * -+ (obj->tiling_mode == I915_TILING_Y ? 32 : 8); -+ size = (size / row_size) * row_size; -+ } -+ - val = (uint64_t)((obj->gtt_offset + size - 4096) & - 0xfffff000) << 32; - val |= obj->gtt_offset & 0xfffff000; -@@ -2230,6 +2237,13 @@ static int i965_write_fence_reg(struct d - int regnum = obj->fence_reg; - uint64_t val; - -+ /* Adjust fence size to match tiled area */ -+ if (obj->tiling_mode != I915_TILING_NONE) { -+ uint32_t row_size = obj->stride * -+ (obj->tiling_mode == I915_TILING_Y ? 32 : 8); -+ size = (size / row_size) * row_size; -+ } -+ - val = (uint64_t)((obj->gtt_offset + size - 4096) & - 0xfffff000) << 32; - val |= obj->gtt_offset & 0xfffff000; diff --git a/patches/drm-i915-unlock-panel-even-when-lvds-is-disabled.patch b/patches/drm-i915-unlock-panel-even-when-lvds-is-disabled.patch deleted file mode 100644 index 5d597be..0000000 --- a/patches/drm-i915-unlock-panel-even-when-lvds-is-disabled.patch +++ /dev/null @@ -1,70 +0,0 @@ -From b0616c5306b342ceca07044dbc4f917d95c4f825 Mon Sep 17 00:00:00 2001 -From: Daniel Vetter <daniel.vetter@ffwll.ch> -Date: Mon, 1 Dec 2014 17:56:54 +0100 -Subject: drm/i915: Unlock panel even when LVDS is disabled - -commit b0616c5306b342ceca07044dbc4f917d95c4f825 upstream. - -Otherwise we'll have backtraces in assert_panel_unlocked because the -BIOS locks the register. In the reporter's case this regression was -introduced in - -commit c31407a3672aaebb4acddf90944a114fa5c8af7b -Author: Chris Wilson <chris@chris-wilson.co.uk> -Date: Thu Oct 18 21:07:01 2012 +0100 - - drm/i915: Add no-lvds quirk for Supermicro X7SPA-H - -Reported-by: Alexey Orishko <alexey.orishko@gmail.com> -Cc: Alexey Orishko <alexey.orishko@gmail.com> -Cc: Chris Wilson <chris@chris-wilson.co.uk> -Cc: Francois Tigeot <ftigeot@wolfpond.org> -Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> -Tested-by: Alexey Orishko <alexey.orishko@gmail.com> -Signed-off-by: Jani Nikula <jani.nikula@intel.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/i915/intel_lvds.c | 24 +++++++++++------------- - 1 file changed, 11 insertions(+), 13 deletions(-) - ---- a/drivers/gpu/drm/i915/intel_lvds.c -+++ b/drivers/gpu/drm/i915/intel_lvds.c -@@ -932,6 +932,17 @@ bool intel_lvds_init(struct drm_device * - int pipe; - u8 pin; - -+ /* -+ * Unlock registers and just leave them unlocked. Do this before -+ * checking quirk lists to avoid bogus WARNINGs. -+ */ -+ if (HAS_PCH_SPLIT(dev)) { -+ I915_WRITE(PCH_PP_CONTROL, -+ I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS); -+ } else { -+ I915_WRITE(PP_CONTROL, -+ I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS); -+ } - if (!intel_lvds_supported(dev)) - return false; - -@@ -1109,19 +1120,6 @@ out: - pwm = I915_READ(BLC_PWM_PCH_CTL1); - pwm |= PWM_PCH_ENABLE; - I915_WRITE(BLC_PWM_PCH_CTL1, pwm); -- /* -- * Unlock registers and just -- * leave them unlocked -- */ -- I915_WRITE(PCH_PP_CONTROL, -- I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS); -- } else { -- /* -- * Unlock registers and just -- * leave them unlocked -- */ -- I915_WRITE(PP_CONTROL, -- I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS); - } - dev_priv->lid_notifier.notifier_call = intel_lid_notify; - if (acpi_lid_notifier_register(&dev_priv->lid_notifier)) { diff --git a/patches/drm-radeon-check-the-right-ring-in-radeon_evict_flags.patch b/patches/drm-radeon-check-the-right-ring-in-radeon_evict_flags.patch deleted file mode 100644 index 2817431..0000000 --- a/patches/drm-radeon-check-the-right-ring-in-radeon_evict_flags.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 5e5c21cac1001089007260c48b0c89ebaace0e71 Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Wed, 3 Dec 2014 00:03:49 -0500 -Subject: drm/radeon: check the right ring in radeon_evict_flags() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 5e5c21cac1001089007260c48b0c89ebaace0e71 upstream. - -Check the that ring we are using for copies is functional -rather than the GFX ring. On newer asics we use the DMA -ring for bo moves. - -Reviewed-by: Christian König <christian.koenig@amd.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/radeon/radeon_ttm.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/gpu/drm/radeon/radeon_ttm.c -+++ b/drivers/gpu/drm/radeon/radeon_ttm.c -@@ -188,7 +188,7 @@ static void radeon_evict_flags(struct tt - rbo = container_of(bo, struct radeon_bo, tbo); - switch (bo->mem.mem_type) { - case TTM_PL_VRAM: -- if (rbo->rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ready == false) -+ if (rbo->rdev->ring[radeon_copy_ring_index(rbo->rdev)].ready == false) - radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU); - else - radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT); diff --git a/patches/drm-radeon-kernel-panic-in-drm_calc_vbltimestamp_from_scanoutpos-with-3.18.0-rc6.patch b/patches/drm-radeon-kernel-panic-in-drm_calc_vbltimestamp_from_scanoutpos-with-3.18.0-rc6.patch deleted file mode 100644 index 8ed28e6..0000000 --- a/patches/drm-radeon-kernel-panic-in-drm_calc_vbltimestamp_from_scanoutpos-with-3.18.0-rc6.patch +++ /dev/null @@ -1,131 +0,0 @@ -From f5475cc43c899e33098d4db44b7c5e710f16589d Mon Sep 17 00:00:00 2001 -From: Petr Mladek <pmladek@suse.cz> -Date: Thu, 27 Nov 2014 16:57:21 +0100 -Subject: drm/radeon: kernel panic in drm_calc_vbltimestamp_from_scanoutpos - with 3.18.0-rc6 - -commit f5475cc43c899e33098d4db44b7c5e710f16589d upstream. - -I was unable too boot 3.18.0-rc6 because of the following kernel -panic in drm_calc_vbltimestamp_from_scanoutpos(): - - [drm] Initialized drm 1.1.0 20060810 - [drm] radeon kernel modesetting enabled. - [drm] initializing kernel modesetting (RV100 0x1002:0x515E 0x15D9:0x8080). - [drm] register mmio base: 0xC8400000 - [drm] register mmio size: 65536 - radeon 0000:0b:01.0: VRAM: 128M 0x00000000D0000000 - 0x00000000D7FFFFFF (16M used) - radeon 0000:0b:01.0: GTT: 512M 0x00000000B0000000 - 0x00000000CFFFFFFF - [drm] Detected VRAM RAM=128M, BAR=128M - [drm] RAM width 16bits DDR - [TTM] Zone kernel: Available graphics memory: 3829346 kiB - [TTM] Zone dma32: Available graphics memory: 2097152 kiB - [TTM] Initializing pool allocator - [TTM] Initializing DMA pool allocator - [drm] radeon: 16M of VRAM memory ready - [drm] radeon: 512M of GTT memory ready. - [drm] GART: num cpu pages 131072, num gpu pages 131072 - [drm] PCI GART of 512M enabled (table at 0x0000000037880000). - radeon 0000:0b:01.0: WB disabled - radeon 0000:0b:01.0: fence driver on ring 0 use gpu addr 0x00000000b0000000 and cpu addr 0xffff8800bbbfa000 - [drm] Supports vblank timestamp caching Rev 2 (21.10.2013). - [drm] Driver supports precise vblank timestamp query. - [drm] radeon: irq initialized. - [drm] Loading R100 Microcode - radeon 0000:0b:01.0: Direct firmware load for radeon/R100_cp.bin failed with error -2 - radeon_cp: Failed to load firmware "radeon/R100_cp.bin" - [drm:r100_cp_init] *ERROR* Failed to load firmware! - radeon 0000:0b:01.0: failed initializing CP (-2). - radeon 0000:0b:01.0: Disabling GPU acceleration - [drm] radeon: cp finalized - BUG: unable to handle kernel NULL pointer dereference at 000000000000025c - IP: [<ffffffff8150423b>] drm_calc_vbltimestamp_from_scanoutpos+0x4b/0x320 - PGD 0 - Oops: 0000 [#1] SMP - Modules linked in: - CPU: 1 PID: 1 Comm: swapper/0 Not tainted 3.18.0-rc6-4-default #2649 - Hardware name: Supermicro X7DB8/X7DB8, BIOS 6.00 07/26/2006 - task: ffff880234da2010 ti: ffff880234da4000 task.ti: ffff880234da4000 - RIP: 0010:[<ffffffff8150423b>] [<ffffffff8150423b>] drm_calc_vbltimestamp_from_scanoutpos+0x4b/0x320 - RSP: 0000:ffff880234da7918 EFLAGS: 00010086 - RAX: ffffffff81557890 RBX: 0000000000000000 RCX: ffff880234da7a48 - RDX: ffff880234da79f4 RSI: 0000000000000000 RDI: ffff880232e15000 - RBP: ffff880234da79b8 R08: 0000000000000000 R09: 0000000000000000 - R10: 000000000000000a R11: 0000000000000001 R12: ffff880232dda1c0 - R13: ffff880232e1518c R14: 0000000000000292 R15: ffff880232e15000 - FS: 0000000000000000(0000) GS:ffff88023fc40000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b - CR2: 000000000000025c CR3: 0000000002014000 CR4: 00000000000007e0 - Stack: - ffff880234da79d8 0000000000000286 ffff880232dcbc00 0000000000002480 - ffff880234da7958 0000000000000296 ffff880234da7998 ffffffff8151b51d - ffff880234da7a48 0000000032dcbeb0 ffff880232dcbc00 ffff880232dcbc58 - Call Trace: - [<ffffffff8151b51d>] ? drm_vma_offset_remove+0x1d/0x110 - [<ffffffff8152dc98>] radeon_get_vblank_timestamp_kms+0x38/0x60 - [<ffffffff8152076a>] ? ttm_bo_release_list+0xba/0x180 - [<ffffffff81503751>] drm_get_last_vbltimestamp+0x41/0x70 - [<ffffffff81503933>] vblank_disable_and_save+0x73/0x1d0 - [<ffffffff81106b2f>] ? try_to_del_timer_sync+0x4f/0x70 - [<ffffffff81505245>] drm_vblank_cleanup+0x65/0xa0 - [<ffffffff815604fa>] radeon_irq_kms_fini+0x1a/0x70 - [<ffffffff8156c07e>] r100_init+0x26e/0x410 - [<ffffffff8152ae3e>] radeon_device_init+0x7ae/0xb50 - [<ffffffff8152d57f>] radeon_driver_load_kms+0x8f/0x210 - [<ffffffff81506965>] drm_dev_register+0xb5/0x110 - [<ffffffff8150998f>] drm_get_pci_dev+0x8f/0x200 - [<ffffffff815291cd>] radeon_pci_probe+0xad/0xe0 - [<ffffffff8141a365>] local_pci_probe+0x45/0xa0 - [<ffffffff8141b741>] pci_device_probe+0xd1/0x130 - [<ffffffff81633dad>] driver_probe_device+0x12d/0x3e0 - [<ffffffff8163413b>] __driver_attach+0x9b/0xa0 - [<ffffffff816340a0>] ? __device_attach+0x40/0x40 - [<ffffffff81631cd3>] bus_for_each_dev+0x63/0xa0 - [<ffffffff8163378e>] driver_attach+0x1e/0x20 - [<ffffffff81633390>] bus_add_driver+0x180/0x240 - [<ffffffff81634914>] driver_register+0x64/0xf0 - [<ffffffff81419cac>] __pci_register_driver+0x4c/0x50 - [<ffffffff81509bf5>] drm_pci_init+0xf5/0x120 - [<ffffffff821dc871>] ? ttm_init+0x6a/0x6a - [<ffffffff821dc908>] radeon_init+0x97/0xb5 - [<ffffffff810002fc>] do_one_initcall+0xbc/0x1f0 - [<ffffffff810e3278>] ? __wake_up+0x48/0x60 - [<ffffffff8218e256>] kernel_init_freeable+0x18a/0x215 - [<ffffffff8218d983>] ? initcall_blacklist+0xc0/0xc0 - [<ffffffff818a78f0>] ? rest_init+0x80/0x80 - [<ffffffff818a78fe>] kernel_init+0xe/0xf0 - [<ffffffff818c0c3c>] ret_from_fork+0x7c/0xb0 - [<ffffffff818a78f0>] ? rest_init+0x80/0x80 - Code: 45 ac 0f 88 a8 01 00 00 3b b7 d0 01 00 00 49 89 ff 0f 83 99 01 00 00 48 8b 47 20 48 8b 80 88 00 00 00 48 85 c0 0f 84 cd 01 00 00 <41> 8b b1 5c 02 00 00 41 8b 89 58 02 00 00 89 75 98 41 8b b1 60 - RIP [<ffffffff8150423b>] drm_calc_vbltimestamp_from_scanoutpos+0x4b/0x320 - RSP <ffff880234da7918> - CR2: 000000000000025c - ---[ end trace ad2c0aadf48e2032 ]--- - Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 - -It has helped me to add a NULL pointer check that was suggested at -http://lists.freedesktop.org/archives/dri-devel/2014-October/070663.html - -I am not familiar with the code. But the change looks sane -and we need something fast at this stage of 3.18 development. - -Suggested-by: Helge Deller <deller@gmx.de> -Signed-off-by: Petr Mladek <pmladek@suse.cz> -Tested-by: Petr Mladek <pmladek@suse.cz> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/radeon/radeon_kms.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/drivers/gpu/drm/radeon/radeon_kms.c -+++ b/drivers/gpu/drm/radeon/radeon_kms.c -@@ -428,6 +428,8 @@ int radeon_get_vblank_timestamp_kms(stru - - /* Get associated drm_crtc: */ - drmcrtc = &rdev->mode_info.crtcs[crtc]->base; -+ if (!drmcrtc) -+ return -EINVAL; - - /* Helper routine in DRM core does all the work: */ - return drm_calc_vbltimestamp_from_scanoutpos(dev, crtc, max_error, diff --git a/patches/drm-vmwgfx-don-t-use-memory-accounting-for-kernel-side-fence-objects.patch b/patches/drm-vmwgfx-don-t-use-memory-accounting-for-kernel-side-fence-objects.patch deleted file mode 100644 index 5543816..0000000 --- a/patches/drm-vmwgfx-don-t-use-memory-accounting-for-kernel-side-fence-objects.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 1f563a6a46544602183e7493b6ef69769d3d76d9 Mon Sep 17 00:00:00 2001 -From: Thomas Hellstrom <thellstrom@vmware.com> -Date: Tue, 2 Dec 2014 03:32:24 -0800 -Subject: drm/vmwgfx: Don't use memory accounting for kernel-side fence objects - -commit 1f563a6a46544602183e7493b6ef69769d3d76d9 upstream. - -Kernel side fence objects are used when unbinding resources and may thus be -created as part of a memory reclaim operation. This might trigger recursive -memory reclaims and result in the kernel running out of stack space. - -So a simple way out is to avoid accounting of these fence objects. -In principle this is OK since while user-space can trigger the creation of -such objects, it can't really hold on to them. However, their lifetime is -quite long, so some form of accounting should perhaps be implemented in the -future. - -Fixes kernel crashes when running, for example viewperf11 ensight-04 test 3 -with low system memory settings. - -Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> -Reviewed-by: Jakob Bornecrantz <jakob@vmware.com> -Reviewed-by: Sinclair Yeh <syeh@vmware.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 21 ++------------------- - 1 file changed, 2 insertions(+), 19 deletions(-) - ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c -@@ -485,14 +485,7 @@ void vmw_fence_obj_flush(struct vmw_fenc - - static void vmw_fence_destroy(struct vmw_fence_obj *fence) - { -- struct vmw_fence_manager *fman = fence->fman; -- - kfree(fence); -- /* -- * Free kernel space accounting. -- */ -- ttm_mem_global_free(vmw_mem_glob(fman->dev_priv), -- fman->fence_size); - } - - int vmw_fence_create(struct vmw_fence_manager *fman, -@@ -500,20 +493,12 @@ int vmw_fence_create(struct vmw_fence_ma - uint32_t mask, - struct vmw_fence_obj **p_fence) - { -- struct ttm_mem_global *mem_glob = vmw_mem_glob(fman->dev_priv); - struct vmw_fence_obj *fence; - int ret; - -- ret = ttm_mem_global_alloc(mem_glob, fman->fence_size, -- false, false); -- if (unlikely(ret != 0)) -- return ret; -- - fence = kzalloc(sizeof(*fence), GFP_KERNEL); -- if (unlikely(fence == NULL)) { -- ret = -ENOMEM; -- goto out_no_object; -- } -+ if (unlikely(fence == NULL)) -+ return -ENOMEM; - - ret = vmw_fence_obj_init(fman, fence, seqno, mask, - vmw_fence_destroy); -@@ -525,8 +510,6 @@ int vmw_fence_create(struct vmw_fence_ma - - out_err_init: - kfree(fence); --out_no_object: -- ttm_mem_global_free(mem_glob, fman->fence_size); - return ret; - } - diff --git a/patches/drm-vmwgfx-fix-fence-event-code.patch b/patches/drm-vmwgfx-fix-fence-event-code.patch deleted file mode 100644 index 9bb3cec..0000000 --- a/patches/drm-vmwgfx-fix-fence-event-code.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 89669e7a7f96be3ee8d9a22a071d7c0d3b4428fc Mon Sep 17 00:00:00 2001 -From: Thomas Hellstrom <thellstrom@vmware.com> -Date: Tue, 2 Dec 2014 03:36:57 -0800 -Subject: drm/vmwgfx: Fix fence event code - -commit 89669e7a7f96be3ee8d9a22a071d7c0d3b4428fc upstream. - -The commit "vmwgfx: Rework fence event action" introduced a number of bugs -that are fixed with this commit: - -a) A forgotten return stateemnt. -b) An if statement with identical branches. - -Reported-by: Rob Clark <robdclark@gmail.com> -Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> -Reviewed-by: Jakob Bornecrantz <jakob@vmware.com> -Reviewed-by: Sinclair Yeh <syeh@vmware.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 17 ++++++----------- - 1 file changed, 6 insertions(+), 11 deletions(-) - ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c -@@ -1032,6 +1032,8 @@ int vmw_event_fence_action_create(struct - if (ret != 0) - goto out_no_queue; - -+ return 0; -+ - out_no_queue: - event->base.destroy(&event->base); - out_no_event: -@@ -1106,17 +1108,10 @@ int vmw_fence_event_ioctl(struct drm_dev - - BUG_ON(fence == NULL); - -- if (arg->flags & DRM_VMW_FE_FLAG_REQ_TIME) -- ret = vmw_event_fence_action_create(file_priv, fence, -- arg->flags, -- arg->user_data, -- true); -- else -- ret = vmw_event_fence_action_create(file_priv, fence, -- arg->flags, -- arg->user_data, -- true); -- -+ ret = vmw_event_fence_action_create(file_priv, fence, -+ arg->flags, -+ arg->user_data, -+ true); - if (unlikely(ret != 0)) { - if (ret != -ERESTARTSYS) - DRM_ERROR("Failed to attach event to fence.\n"); diff --git a/patches/ecryptfs-force-ro-mount-when-encrypted-view-is-enabled.patch b/patches/ecryptfs-force-ro-mount-when-encrypted-view-is-enabled.patch deleted file mode 100644 index 645b763..0000000 --- a/patches/ecryptfs-force-ro-mount-when-encrypted-view-is-enabled.patch +++ /dev/null @@ -1,102 +0,0 @@ -From 332b122d39c9cbff8b799007a825d94b2e7c12f2 Mon Sep 17 00:00:00 2001 -From: Tyler Hicks <tyhicks@canonical.com> -Date: Tue, 7 Oct 2014 15:51:55 -0500 -Subject: eCryptfs: Force RO mount when encrypted view is enabled - -commit 332b122d39c9cbff8b799007a825d94b2e7c12f2 upstream. - -The ecryptfs_encrypted_view mount option greatly changes the -functionality of an eCryptfs mount. Instead of encrypting and decrypting -lower files, it provides a unified view of the encrypted files in the -lower filesystem. The presence of the ecryptfs_encrypted_view mount -option is intended to force a read-only mount and modifying files is not -supported when the feature is in use. See the following commit for more -information: - - e77a56d [PATCH] eCryptfs: Encrypted passthrough - -This patch forces the mount to be read-only when the -ecryptfs_encrypted_view mount option is specified by setting the -MS_RDONLY flag on the superblock. Additionally, this patch removes some -broken logic in ecryptfs_open() that attempted to prevent modifications -of files when the encrypted view feature was in use. The check in -ecryptfs_open() was not sufficient to prevent file modifications using -system calls that do not operate on a file descriptor. - -Signed-off-by: Tyler Hicks <tyhicks@canonical.com> -Reported-by: Priya Bansal <p.bansal@samsung.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/ecryptfs/file.c | 12 ------------ - fs/ecryptfs/main.c | 16 +++++++++++++--- - 2 files changed, 13 insertions(+), 15 deletions(-) - ---- a/fs/ecryptfs/file.c -+++ b/fs/ecryptfs/file.c -@@ -195,24 +195,12 @@ static int ecryptfs_open(struct inode *i - { - int rc = 0; - struct ecryptfs_crypt_stat *crypt_stat = NULL; -- struct ecryptfs_mount_crypt_stat *mount_crypt_stat; - struct dentry *ecryptfs_dentry = file->f_path.dentry; - /* Private value of ecryptfs_dentry allocated in - * ecryptfs_lookup() */ - struct dentry *lower_dentry; - struct ecryptfs_file_info *file_info; - -- mount_crypt_stat = &ecryptfs_superblock_to_private( -- ecryptfs_dentry->d_sb)->mount_crypt_stat; -- if ((mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) -- && ((file->f_flags & O_WRONLY) || (file->f_flags & O_RDWR) -- || (file->f_flags & O_CREAT) || (file->f_flags & O_TRUNC) -- || (file->f_flags & O_APPEND))) { -- printk(KERN_WARNING "Mount has encrypted view enabled; " -- "files may only be read\n"); -- rc = -EPERM; -- goto out; -- } - /* Released in ecryptfs_release or end of function if failure */ - file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL); - ecryptfs_set_file_private(file, file_info); ---- a/fs/ecryptfs/main.c -+++ b/fs/ecryptfs/main.c -@@ -494,6 +494,7 @@ static struct dentry *ecryptfs_mount(str - { - struct super_block *s; - struct ecryptfs_sb_info *sbi; -+ struct ecryptfs_mount_crypt_stat *mount_crypt_stat; - struct ecryptfs_dentry_info *root_info; - const char *err = "Getting sb failed"; - struct inode *inode; -@@ -512,6 +513,7 @@ static struct dentry *ecryptfs_mount(str - err = "Error parsing options"; - goto out; - } -+ mount_crypt_stat = &sbi->mount_crypt_stat; - - s = sget(fs_type, NULL, set_anon_super, NULL); - if (IS_ERR(s)) { -@@ -557,11 +559,19 @@ static struct dentry *ecryptfs_mount(str - - /** - * Set the POSIX ACL flag based on whether they're enabled in the lower -- * mount. Force a read-only eCryptfs mount if the lower mount is ro. -- * Allow a ro eCryptfs mount even when the lower mount is rw. -+ * mount. - */ - s->s_flags = flags & ~MS_POSIXACL; -- s->s_flags |= path.dentry->d_sb->s_flags & (MS_RDONLY | MS_POSIXACL); -+ s->s_flags |= path.dentry->d_sb->s_flags & MS_POSIXACL; -+ -+ /** -+ * Force a read-only eCryptfs mount when: -+ * 1) The lower mount is ro -+ * 2) The ecryptfs_encrypted_view mount option is specified -+ */ -+ if (path.dentry->d_sb->s_flags & MS_RDONLY || -+ mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) -+ s->s_flags |= MS_RDONLY; - - s->s_maxbytes = path.dentry->d_sb->s_maxbytes; - s->s_blocksize = path.dentry->d_sb->s_blocksize; diff --git a/patches/ecryptfs-remove-buggy-and-unnecessary-write-in-file-name-decode-routine.patch b/patches/ecryptfs-remove-buggy-and-unnecessary-write-in-file-name-decode-routine.patch deleted file mode 100644 index add0aa9..0000000 --- a/patches/ecryptfs-remove-buggy-and-unnecessary-write-in-file-name-decode-routine.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 942080643bce061c3dd9d5718d3b745dcb39a8bc Mon Sep 17 00:00:00 2001 -From: Michael Halcrow <mhalcrow@google.com> -Date: Wed, 26 Nov 2014 09:09:16 -0800 -Subject: eCryptfs: Remove buggy and unnecessary write in file name decode - routine - -commit 942080643bce061c3dd9d5718d3b745dcb39a8bc upstream. - -Dmitry Chernenkov used KASAN to discover that eCryptfs writes past the -end of the allocated buffer during encrypted filename decoding. This -fix corrects the issue by getting rid of the unnecessary 0 write when -the current bit offset is 2. - -Signed-off-by: Michael Halcrow <mhalcrow@google.com> -Reported-by: Dmitry Chernenkov <dmitryc@google.com> -Suggested-by: Kees Cook <keescook@chromium.org> -Signed-off-by: Tyler Hicks <tyhicks@canonical.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/ecryptfs/crypto.c | 1 - - 1 file changed, 1 deletion(-) - ---- a/fs/ecryptfs/crypto.c -+++ b/fs/ecryptfs/crypto.c -@@ -2044,7 +2044,6 @@ ecryptfs_decode_from_filename(unsigned c - break; - case 2: - dst[dst_byte_offset++] |= (src_byte); -- dst[dst_byte_offset] = 0; - current_bit_offset = 0; - break; - } diff --git a/patches/fsnotify-next_i-is-freed-during-fsnotify_unmount_inodes.patch b/patches/fsnotify-next_i-is-freed-during-fsnotify_unmount_inodes.patch deleted file mode 100644 index f4aa9b9..0000000 --- a/patches/fsnotify-next_i-is-freed-during-fsnotify_unmount_inodes.patch +++ /dev/null @@ -1,105 +0,0 @@ -From 6424babfd68dd8a83d9c60a5242d27038856599f Mon Sep 17 00:00:00 2001 -From: Jerry Hoemann <jerry.hoemann@hp.com> -Date: Wed, 29 Oct 2014 14:50:22 -0700 -Subject: fsnotify: next_i is freed during fsnotify_unmount_inodes. - -commit 6424babfd68dd8a83d9c60a5242d27038856599f upstream. - -During file system stress testing on 3.10 and 3.12 based kernels, the -umount command occasionally hung in fsnotify_unmount_inodes in the -section of code: - - spin_lock(&inode->i_lock); - if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) { - spin_unlock(&inode->i_lock); - continue; - } - -As this section of code holds the global inode_sb_list_lock, eventually -the system hangs trying to acquire the lock. - -Multiple crash dumps showed: - -The inode->i_state == 0x60 and i_count == 0 and i_sb_list would point -back at itself. As this is not the value of list upon entry to the -function, the kernel never exits the loop. - -To help narrow down problem, the call to list_del_init in -inode_sb_list_del was changed to list_del. This poisons the pointers in -the i_sb_list and causes a kernel to panic if it transverse a freed -inode. - -Subsequent stress testing paniced in fsnotify_unmount_inodes at the -bottom of the list_for_each_entry_safe loop showing next_i had become -free. - -We believe the root cause of the problem is that next_i is being freed -during the window of time that the list_for_each_entry_safe loop -temporarily releases inode_sb_list_lock to call fsnotify and -fsnotify_inode_delete. - -The code in fsnotify_unmount_inodes attempts to prevent the freeing of -inode and next_i by calling __iget. However, the code doesn't do the -__iget call on next_i - - if i_count == 0 or - if i_state & (I_FREEING | I_WILL_FREE) - -The patch addresses this issue by advancing next_i in the above two cases -until we either find a next_i which we can __iget or we reach the end of -the list. This makes the handling of next_i more closely match the -handling of the variable "inode." - -The time to reproduce the hang is highly variable (from hours to days.) We -ran the stress test on a 3.10 kernel with the proposed patch for a week -without failure. - -During list_for_each_entry_safe, next_i is becoming free causing -the loop to never terminate. Advance next_i in those cases where -__iget is not done. - -Signed-off-by: Jerry Hoemann <jerry.hoemann@hp.com> -Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com> -Cc: Ken Helias <kenhelias@firemail.de> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Cc: Jan Kara <jack@suse.cz> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/notify/inode_mark.c | 17 +++++++++++------ - 1 file changed, 11 insertions(+), 6 deletions(-) - ---- a/fs/notify/inode_mark.c -+++ b/fs/notify/inode_mark.c -@@ -282,20 +282,25 @@ void fsnotify_unmount_inodes(struct list - spin_unlock(&inode->i_lock); - - /* In case the dropping of a reference would nuke next_i. */ -- if ((&next_i->i_sb_list != list) && -- atomic_read(&next_i->i_count)) { -+ while (&next_i->i_sb_list != list) { - spin_lock(&next_i->i_lock); -- if (!(next_i->i_state & (I_FREEING | I_WILL_FREE))) { -+ if (!(next_i->i_state & (I_FREEING | I_WILL_FREE)) && -+ atomic_read(&next_i->i_count)) { - __iget(next_i); - need_iput = next_i; -+ spin_unlock(&next_i->i_lock); -+ break; - } - spin_unlock(&next_i->i_lock); -+ next_i = list_entry(next_i->i_sb_list.next, -+ struct inode, i_sb_list); - } - - /* -- * We can safely drop inode_sb_list_lock here because we hold -- * references on both inode and next_i. Also no new inodes -- * will be added since the umount has begun. -+ * We can safely drop inode_sb_list_lock here because either -+ * we actually hold references on both inode and next_i or -+ * end of list. Also no new inodes will be added since the -+ * umount has begun. - */ - spin_unlock(&inode_sb_list_lock); - diff --git a/patches/ftrace-jprobes-x86-fix-conflict-between-jprobes-and-function-graph-tracing.patch b/patches/ftrace-jprobes-x86-fix-conflict-between-jprobes-and-function-graph-tracing.patch deleted file mode 100644 index 15314aa..0000000 --- a/patches/ftrace-jprobes-x86-fix-conflict-between-jprobes-and-function-graph-tracing.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 237d28db036e411f22c03cfd5b0f6dc2aa9bf3bc Mon Sep 17 00:00:00 2001 -From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org> -Date: Mon, 12 Jan 2015 12:12:03 -0500 -Subject: ftrace/jprobes/x86: Fix conflict between jprobes and function graph - tracing - -commit 237d28db036e411f22c03cfd5b0f6dc2aa9bf3bc upstream. - -If the function graph tracer traces a jprobe callback, the system will -crash. This can easily be demonstrated by compiling the jprobe -sample module that is in the kernel tree, loading it and running the -function graph tracer. - - # modprobe jprobe_example.ko - # echo function_graph > /sys/kernel/debug/tracing/current_tracer - # ls - -The first two commands end up in a nice crash after the first fork. -(do_fork has a jprobe attached to it, so "ls" just triggers that fork) - -The problem is caused by the jprobe_return() that all jprobe callbacks -must end with. The way jprobes works is that the function a jprobe -is attached to has a breakpoint placed at the start of it (or it uses -ftrace if fentry is supported). The breakpoint handler (or ftrace callback) -will copy the stack frame and change the ip address to return to the -jprobe handler instead of the function. The jprobe handler must end -with jprobe_return() which swaps the stack and does an int3 (breakpoint). -This breakpoint handler will then put back the saved stack frame, -simulate the instruction at the beginning of the function it added -a breakpoint to, and then continue on. - -For function tracing to work, it hijakes the return address from the -stack frame, and replaces it with a hook function that will trace -the end of the call. This hook function will restore the return -address of the function call. - -If the function tracer traces the jprobe handler, the hook function -for that handler will not be called, and its saved return address -will be used for the next function. This will result in a kernel crash. - -To solve this, pause function tracing before the jprobe handler is called -and unpause it before it returns back to the function it probed. - -Some other updates: - -Used a variable "saved_sp" to hold kcb->jprobe_saved_sp. This makes the -code look a bit cleaner and easier to understand (various tries to fix -this bug required this change). - -Note, if fentry is being used, jprobes will change the ip address before -the function graph tracer runs and it will not be able to trace the -function that the jprobe is probing. - -Link: http://lkml.kernel.org/r/20150114154329.552437962@goodmis.org - -Acked-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com> -Signed-off-by: Steven Rostedt <rostedt@goodmis.org> -[lizf: Backported to 3.4: - - adjust filename - - adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/kernel/kprobes.c | 20 +++++++++++++++----- - 1 file changed, 15 insertions(+), 5 deletions(-) - ---- a/arch/x86/kernel/kprobes.c -+++ b/arch/x86/kernel/kprobes.c -@@ -1003,6 +1003,15 @@ int __kprobes setjmp_pre_handler(struct - regs->flags &= ~X86_EFLAGS_IF; - trace_hardirqs_off(); - regs->ip = (unsigned long)(jp->entry); -+ -+ /* -+ * jprobes use jprobe_return() which skips the normal return -+ * path of the function, and this messes up the accounting of the -+ * function graph tracer to get messed up. -+ * -+ * Pause function graph tracing while performing the jprobe function. -+ */ -+ pause_graph_tracing(); - return 1; - } - -@@ -1028,24 +1037,25 @@ int __kprobes longjmp_break_handler(stru - struct kprobe_ctlblk *kcb = get_kprobe_ctlblk(); - u8 *addr = (u8 *) (regs->ip - 1); - struct jprobe *jp = container_of(p, struct jprobe, kp); -+ void *saved_sp = kcb->jprobe_saved_sp; - - if ((addr > (u8 *) jprobe_return) && - (addr < (u8 *) jprobe_return_end)) { -- if (stack_addr(regs) != kcb->jprobe_saved_sp) { -+ if (stack_addr(regs) != saved_sp) { - struct pt_regs *saved_regs = &kcb->jprobe_saved_regs; - printk(KERN_ERR - "current sp %p does not match saved sp %p\n", -- stack_addr(regs), kcb->jprobe_saved_sp); -+ stack_addr(regs), saved_sp); - printk(KERN_ERR "Saved registers for jprobe %p\n", jp); - show_registers(saved_regs); - printk(KERN_ERR "Current registers\n"); - show_registers(regs); - BUG(); - } -+ /* It's OK to start function graph tracing again */ -+ unpause_graph_tracing(); - *regs = kcb->jprobe_saved_regs; -- memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp), -- kcb->jprobes_stack, -- MIN_STACK_SIZE(kcb->jprobe_saved_sp)); -+ memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp)); - preempt_enable_no_resched(); - return 1; - } diff --git a/patches/genhd-check-for-int-overflow-in-disk_expand_part_tbl.patch b/patches/genhd-check-for-int-overflow-in-disk_expand_part_tbl.patch deleted file mode 100644 index 0178ae5..0000000 --- a/patches/genhd-check-for-int-overflow-in-disk_expand_part_tbl.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 5fabcb4c33fe11c7e3afdf805fde26c1a54d0953 Mon Sep 17 00:00:00 2001 -From: Jens Axboe <axboe@fb.com> -Date: Wed, 19 Nov 2014 13:06:22 -0700 -Subject: genhd: check for int overflow in disk_expand_part_tbl() - -commit 5fabcb4c33fe11c7e3afdf805fde26c1a54d0953 upstream. - -We can get here from blkdev_ioctl() -> blkpg_ioctl() -> add_partition() -with a user passed in partno value. If we pass in 0x7fffffff, the -new target in disk_expand_part_tbl() overflows the 'int' and we -access beyond the end of ptbl->part[] and even write to it when we -do the rcu_assign_pointer() to assign the new partition. - -Reported-by: David Ramos <daramos@stanford.edu> -Signed-off-by: Jens Axboe <axboe@fb.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - block/genhd.c | 11 +++++++++-- - 1 file changed, 9 insertions(+), 2 deletions(-) - ---- a/block/genhd.c -+++ b/block/genhd.c -@@ -1069,9 +1069,16 @@ int disk_expand_part_tbl(struct gendisk - struct disk_part_tbl *old_ptbl = disk->part_tbl; - struct disk_part_tbl *new_ptbl; - int len = old_ptbl ? old_ptbl->len : 0; -- int target = partno + 1; -+ int i, target; - size_t size; -- int i; -+ -+ /* -+ * check for int overflow, since we can get here from blkpg_ioctl() -+ * with a user passed 'partno'. -+ */ -+ target = partno + 1; -+ if (target < 0) -+ return -EINVAL; - - /* disk_max_parts() is zero during initialization, ignore if so */ - if (disk_max_parts(disk) && target > disk_max_parts(disk)) diff --git a/patches/genirq-prevent-proc-race-against-freeing-of-irq-descriptors.patch b/patches/genirq-prevent-proc-race-against-freeing-of-irq-descriptors.patch deleted file mode 100644 index a99fe6d..0000000 --- a/patches/genirq-prevent-proc-race-against-freeing-of-irq-descriptors.patch +++ /dev/null @@ -1,235 +0,0 @@ -From c291ee622165cb2c8d4e7af63fffd499354a23be Mon Sep 17 00:00:00 2001 -From: Thomas Gleixner <tglx@linutronix.de> -Date: Thu, 11 Dec 2014 23:01:41 +0100 -Subject: genirq: Prevent proc race against freeing of irq descriptors - -commit c291ee622165cb2c8d4e7af63fffd499354a23be upstream. - -Since the rework of the sparse interrupt code to actually free the -unused interrupt descriptors there exists a race between the /proc -interfaces to the irq subsystem and the code which frees the interrupt -descriptor. - -CPU0 CPU1 - show_interrupts() - desc = irq_to_desc(X); -free_desc(desc) - remove_from_radix_tree(); - kfree(desc); - raw_spinlock_irq(&desc->lock); - -/proc/interrupts is the only interface which can actively corrupt -kernel memory via the lock access. /proc/stat can only read from freed -memory. Extremly hard to trigger, but possible. - -The interfaces in /proc/irq/N/ are not affected by this because the -removal of the proc file is serialized in procfs against concurrent -readers/writers. The removal happens before the descriptor is freed. - -For architectures which have CONFIG_SPARSE_IRQ=n this is a non issue -as the descriptor is never freed. It's merely cleared out with the irq -descriptor lock held. So any concurrent proc access will either see -the old correct value or the cleared out ones. - -Protect the lookup and access to the irq descriptor in -show_interrupts() with the sparse_irq_lock. - -Provide kstat_irqs_usr() which is protecting the lookup and access -with sparse_irq_lock and switch /proc/stat to use it. - -Document the existing kstat_irqs interfaces so it's clear that the -caller needs to take care about protection. The users of these -interfaces are either not affected due to SPARSE_IRQ=n or already -protected against removal. - -Fixes: 1f5a5b87f78f "genirq: Implement a sane sparse_irq allocator" -Signed-off-by: Thomas Gleixner <tglx@linutronix.de> -[lizf: Backported to 3.4: - - define kstat_irqs() for CONFIG_GENERIC_HARDIRQS - - add ifdef/endif CONFIG_SPARSE_IRQ] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/proc/stat.c | 2 - - include/linux/kernel_stat.h | 5 ++++ - kernel/irq/internals.h | 8 ++++++ - kernel/irq/irqdesc.c | 52 ++++++++++++++++++++++++++++++++++++++++++++ - kernel/irq/proc.c | 22 +++++++++++++++++- - 5 files changed, 87 insertions(+), 2 deletions(-) - ---- a/fs/proc/stat.c -+++ b/fs/proc/stat.c -@@ -159,7 +159,7 @@ static int show_stat(struct seq_file *p, - - /* sum again ? it could be updated? */ - for_each_irq_nr(j) -- seq_put_decimal_ull(p, ' ', kstat_irqs(j)); -+ seq_put_decimal_ull(p, ' ', kstat_irqs_usr(j)); - - seq_printf(p, - "\nctxt %llu\n" ---- a/include/linux/kernel_stat.h -+++ b/include/linux/kernel_stat.h -@@ -104,8 +104,13 @@ static inline unsigned int kstat_irqs(un - - return sum; - } -+static inline unsigned int kstat_irqs_usr(unsigned int irq) -+{ -+ return kstat_irqs(irq); -+} - #else - extern unsigned int kstat_irqs(unsigned int irq); -+extern unsigned int kstat_irqs_usr(unsigned int irq); - #endif - - /* ---- a/kernel/irq/internals.h -+++ b/kernel/irq/internals.h -@@ -74,6 +74,14 @@ extern void irq_percpu_disable(struct ir - extern void mask_irq(struct irq_desc *desc); - extern void unmask_irq(struct irq_desc *desc); - -+#ifdef CONFIG_SPARSE_IRQ -+extern void irq_lock_sparse(void); -+extern void irq_unlock_sparse(void); -+#else -+static inline void irq_lock_sparse(void) { } -+static inline void irq_unlock_sparse(void) { } -+#endif -+ - extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr); - - irqreturn_t handle_irq_event_percpu(struct irq_desc *desc, struct irqaction *action); ---- a/kernel/irq/irqdesc.c -+++ b/kernel/irq/irqdesc.c -@@ -131,6 +131,16 @@ static void free_masks(struct irq_desc * - static inline void free_masks(struct irq_desc *desc) { } - #endif - -+void irq_lock_sparse(void) -+{ -+ mutex_lock(&sparse_irq_lock); -+} -+ -+void irq_unlock_sparse(void) -+{ -+ mutex_unlock(&sparse_irq_lock); -+} -+ - static struct irq_desc *alloc_desc(int irq, int node, struct module *owner) - { - struct irq_desc *desc; -@@ -167,6 +177,12 @@ static void free_desc(unsigned int irq) - - unregister_irq_proc(irq, desc); - -+ /* -+ * sparse_irq_lock protects also show_interrupts() and -+ * kstat_irq_usr(). Once we deleted the descriptor from the -+ * sparse tree we can free it. Access in proc will fail to -+ * lookup the descriptor. -+ */ - mutex_lock(&sparse_irq_lock); - delete_irq_desc(irq); - mutex_unlock(&sparse_irq_lock); -@@ -489,6 +505,15 @@ void dynamic_irq_cleanup(unsigned int ir - raw_spin_unlock_irqrestore(&desc->lock, flags); - } - -+/** -+ * kstat_irqs_cpu - Get the statistics for an interrupt on a cpu -+ * @irq: The interrupt number -+ * @cpu: The cpu number -+ * -+ * Returns the sum of interrupt counts on @cpu since boot for -+ * @irq. The caller must ensure that the interrupt is not removed -+ * concurrently. -+ */ - unsigned int kstat_irqs_cpu(unsigned int irq, int cpu) - { - struct irq_desc *desc = irq_to_desc(irq); -@@ -497,6 +522,14 @@ unsigned int kstat_irqs_cpu(unsigned int - *per_cpu_ptr(desc->kstat_irqs, cpu) : 0; - } - -+/** -+ * kstat_irqs - Get the statistics for an interrupt -+ * @irq: The interrupt number -+ * -+ * Returns the sum of interrupt counts on all cpus since boot for -+ * @irq. The caller must ensure that the interrupt is not removed -+ * concurrently. -+ */ - unsigned int kstat_irqs(unsigned int irq) - { - struct irq_desc *desc = irq_to_desc(irq); -@@ -509,3 +542,22 @@ unsigned int kstat_irqs(unsigned int irq - sum += *per_cpu_ptr(desc->kstat_irqs, cpu); - return sum; - } -+ -+/** -+ * kstat_irqs_usr - Get the statistics for an interrupt -+ * @irq: The interrupt number -+ * -+ * Returns the sum of interrupt counts on all cpus since boot for -+ * @irq. Contrary to kstat_irqs() this can be called from any -+ * preemptible context. It's protected against concurrent removal of -+ * an interrupt descriptor when sparse irqs are enabled. -+ */ -+unsigned int kstat_irqs_usr(unsigned int irq) -+{ -+ int sum; -+ -+ irq_lock_sparse(); -+ sum = kstat_irqs(irq); -+ irq_unlock_sparse(); -+ return sum; -+} ---- a/kernel/irq/proc.c -+++ b/kernel/irq/proc.c -@@ -15,6 +15,23 @@ - - #include "internals.h" - -+/* -+ * Access rules: -+ * -+ * procfs protects read/write of /proc/irq/N/ files against a -+ * concurrent free of the interrupt descriptor. remove_proc_entry() -+ * immediately prevents new read/writes to happen and waits for -+ * already running read/write functions to complete. -+ * -+ * We remove the proc entries first and then delete the interrupt -+ * descriptor from the radix tree and free it. So it is guaranteed -+ * that irq_to_desc(N) is valid as long as the read/writes are -+ * permitted by procfs. -+ * -+ * The read from /proc/interrupts is a different problem because there -+ * is no protection. So the lookup and the access to irqdesc -+ * information must be protected by sparse_irq_lock. -+ */ - static struct proc_dir_entry *root_irq_dir; - - #ifdef CONFIG_SMP -@@ -441,9 +458,10 @@ int show_interrupts(struct seq_file *p, - seq_putc(p, '\n'); - } - -+ irq_lock_sparse(); - desc = irq_to_desc(i); - if (!desc) -- return 0; -+ goto outsparse; - - raw_spin_lock_irqsave(&desc->lock, flags); - for_each_online_cpu(j) -@@ -481,6 +499,8 @@ int show_interrupts(struct seq_file *p, - seq_putc(p, '\n'); - out: - raw_spin_unlock_irqrestore(&desc->lock, flags); -+outsparse: -+ irq_unlock_sparse(); - return 0; - } - #endif diff --git a/patches/gpio-fix-memory-and-reference-leaks-in-gpiochip_add-error-path.patch b/patches/gpio-fix-memory-and-reference-leaks-in-gpiochip_add-error-path.patch deleted file mode 100644 index ab7e5bc..0000000 --- a/patches/gpio-fix-memory-and-reference-leaks-in-gpiochip_add-error-path.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 5539b3c938d64a60cb1fc442ac3ce9263d52de0c Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Mon, 12 Jan 2015 17:12:24 +0100 -Subject: gpio: fix memory and reference leaks in gpiochip_add error path - -commit 5539b3c938d64a60cb1fc442ac3ce9263d52de0c upstream. - -Memory allocated and references taken by of_gpiochip_add and -acpi_gpiochip_add were never released on errors in gpiochip_add (e.g. -failure to find free gpio range). - -Fixes: 391c970c0dd1 ("of/gpio: add default of_xlate function if device -has a node pointer") -Fixes: 664e3e5ac64c ("gpio / ACPI: register to ACPI events -automatically") - -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Linus Walleij <linus.walleij@linaro.org> -[lizf: Backported to 3.4: - - move the call to of_gpiochip_add() into the above if condition. - - remove the call to acpi_gpiochip_remove()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpio/gpiolib.c | 11 +++++------ - 1 file changed, 5 insertions(+), 6 deletions(-) - ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -1081,19 +1081,18 @@ int gpiochip_add(struct gpio_chip *chip) - ? (1 << FLAG_IS_OUT) - : 0; - } -- } - -- of_gpiochip_add(chip); -+ of_gpiochip_add(chip); -+ } - - unlock: - spin_unlock_irqrestore(&gpio_lock, flags); - -- if (status) -- goto fail; -- - status = gpiochip_export(chip); -- if (status) -+ if (status) { -+ of_gpiochip_remove(chip); - goto fail; -+ } - - pr_info("gpiochip_add: registered GPIOs %d to %d on device: %s\n", - chip->base, chip->base + chip->ngpio - 1, diff --git a/patches/gpio-sysfs-fix-gpio-attribute-creation-race.patch b/patches/gpio-sysfs-fix-gpio-attribute-creation-race.patch deleted file mode 100644 index 90a2459..0000000 --- a/patches/gpio-sysfs-fix-gpio-attribute-creation-race.patch +++ /dev/null @@ -1,137 +0,0 @@ -From ebbeba120ab2ec6ac5f3afc1425ec6ff0b77ad6f Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Tue, 13 Jan 2015 13:00:06 +0100 -Subject: gpio: sysfs: fix gpio attribute-creation race - -commit ebbeba120ab2ec6ac5f3afc1425ec6ff0b77ad6f upstream. - -Fix attribute-creation race with userspace by using the default group -to create also the contingent gpio device attributes. - -Fixes: d8f388d8dc8d ("gpio: sysfs interface") -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Linus Walleij <linus.walleij@linaro.org> -[lizf: - - adjust filename - - call gpio_to_irq() instead of gpiod_to_irq] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpio/gpiolib.c | 63 +++++++++++++++++++++++++++++++------------------ - 1 file changed, 41 insertions(+), 22 deletions(-) - ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -60,6 +60,7 @@ struct gpio_desc { - #define FLAG_ACTIVE_LOW 7 /* sysfs value has active low */ - #define FLAG_OPEN_DRAIN 8 /* Gpio is open drain type */ - #define FLAG_OPEN_SOURCE 9 /* Gpio is open source type */ -+#define FLAG_SYSFS_DIR 10 /* show sysfs direction attribute */ - - #define ID_SHIFT 16 /* add new flags before this one */ - -@@ -545,12 +546,45 @@ static ssize_t gpio_active_low_store(str - static DEVICE_ATTR(active_low, 0644, - gpio_active_low_show, gpio_active_low_store); - -+static umode_t gpio_is_visible(struct kobject *kobj, struct attribute *attr, -+ int n) -+{ -+ struct device *dev = container_of(kobj, struct device, kobj); -+ struct gpio_desc *desc = dev_get_drvdata(dev); -+ unsigned gpio = desc - gpio_desc; -+ umode_t mode = attr->mode; -+ bool show_direction = test_bit(FLAG_SYSFS_DIR, &desc->flags); -+ -+ if (attr == &dev_attr_direction.attr) { -+ if (!show_direction) -+ mode = 0; -+ } else if (attr == &dev_attr_edge.attr) { -+ if (gpio_to_irq(gpio) < 0) -+ mode = 0; -+ if (!show_direction && test_bit(FLAG_IS_OUT, &desc->flags)) -+ mode = 0; -+ } -+ -+ return mode; -+} -+ - static struct attribute *gpio_attrs[] = { -+ &dev_attr_direction.attr, -+ &dev_attr_edge.attr, - &dev_attr_value.attr, - &dev_attr_active_low.attr, - NULL, - }; --ATTRIBUTE_GROUPS(gpio); -+ -+static const struct attribute_group gpio_group = { -+ .attrs = gpio_attrs, -+ .is_visible = gpio_is_visible, -+}; -+ -+static const struct attribute_group *gpio_groups[] = { -+ &gpio_group, -+ NULL -+}; - - /* - * /sys/class/gpio/gpiochipN/ -@@ -727,8 +761,11 @@ int gpio_export(unsigned gpio, bool dire - return -EPERM; - } - -- if (!desc->chip->direction_input || !desc->chip->direction_output) -- direction_may_change = false; -+ if (desc->chip->direction_input && desc->chip->direction_output && -+ direction_may_change) { -+ set_bit(FLAG_SYSFS_DIR, &desc->flags); -+ } -+ - spin_unlock_irqrestore(&gpio_lock, flags); - - if (desc->chip->names && desc->chip->names[gpio - desc->chip->base]) -@@ -742,27 +779,10 @@ int gpio_export(unsigned gpio, bool dire - goto fail_unlock; - } - -- if (direction_may_change) { -- status = device_create_file(dev, &dev_attr_direction); -- if (status) -- goto fail_unregister_device; -- } -- -- if (gpio_to_irq(gpio) >= 0 && (direction_may_change || -- !test_bit(FLAG_IS_OUT, &desc->flags))) { -- status = device_create_file(dev, &dev_attr_edge); -- if (status) -- goto fail_remove_attr_direction; -- } -- - set_bit(FLAG_EXPORT, &desc->flags); - mutex_unlock(&sysfs_lock); - return 0; - --fail_remove_attr_direction: -- device_remove_file(dev, &dev_attr_direction); --fail_unregister_device: -- device_unregister(dev); - fail_unlock: - mutex_unlock(&sysfs_lock); - pr_debug("%s: gpio%d status %d\n", __func__, gpio, status); -@@ -893,6 +913,7 @@ void gpio_unexport(unsigned gpio) - dev = class_find_device(&gpio_class, NULL, desc, match_export); - if (dev) { - gpio_setup_irq(desc, dev, 0); -+ clear_bit(FLAG_SYSFS_DIR, &desc->flags); - clear_bit(FLAG_EXPORT, &desc->flags); - } else - status = -ENODEV; -@@ -900,8 +921,6 @@ void gpio_unexport(unsigned gpio) - - mutex_unlock(&sysfs_lock); - if (dev) { -- device_remove_file(dev, &dev_attr_edge); -- device_remove_file(dev, &dev_attr_direction); - device_unregister(dev); - put_device(dev); - } diff --git a/patches/gpio-sysfs-fix-gpio-chip-device-attribute-leak.patch b/patches/gpio-sysfs-fix-gpio-chip-device-attribute-leak.patch deleted file mode 100644 index 6d4875c..0000000 --- a/patches/gpio-sysfs-fix-gpio-chip-device-attribute-leak.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 121b6a79955a3a3fd7bbb9b8cb88d5b9dad6283d Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Tue, 13 Jan 2015 13:00:04 +0100 -Subject: gpio: sysfs: fix gpio-chip device-attribute leak - -commit 121b6a79955a3a3fd7bbb9b8cb88d5b9dad6283d upstream. - -The gpio-chip device attributes were never destroyed when the device was -removed. - -Fix by using device_create_with_groups() to create the device attributes -of the chip class device. - -Note that this also fixes the attribute-creation race with userspace. - -Fixes: d8f388d8dc8d ("gpio: sysfs interface") -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Linus Walleij <linus.walleij@linaro.org> -[lizf: Backported to 3.4: adjust filename] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpio/gpiolib.c | 19 ++++++++----------- - 1 file changed, 8 insertions(+), 11 deletions(-) - ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -589,16 +589,13 @@ static ssize_t chip_ngpio_show(struct de - } - static DEVICE_ATTR(ngpio, 0444, chip_ngpio_show, NULL); - --static const struct attribute *gpiochip_attrs[] = { -+static struct attribute *gpiochip_attrs[] = { - &dev_attr_base.attr, - &dev_attr_label.attr, - &dev_attr_ngpio.attr, - NULL, - }; -- --static const struct attribute_group gpiochip_attr_group = { -- .attrs = (struct attribute **) gpiochip_attrs, --}; -+ATTRIBUTE_GROUPS(gpiochip); - - /* - * /sys/class/gpio/export ... write-only -@@ -924,13 +921,13 @@ static int gpiochip_export(struct gpio_c - - /* use chip->base for the ID; it's already known to be unique */ - mutex_lock(&sysfs_lock); -- dev = device_create(&gpio_class, chip->dev, MKDEV(0, 0), chip, -- "gpiochip%d", chip->base); -- if (!IS_ERR(dev)) { -- status = sysfs_create_group(&dev->kobj, -- &gpiochip_attr_group); -- } else -+ dev = device_create_with_groups(&gpio_class, chip->dev, MKDEV(0, 0), -+ chip, gpiochip_groups, -+ "gpiochip%d", chip->base); -+ if (IS_ERR(dev)) - status = PTR_ERR(dev); -+ else -+ status = 0; - chip->exported = (status == 0); - mutex_unlock(&sysfs_lock); - diff --git a/patches/gpio-sysfs-fix-gpio-device-attribute-leak.patch b/patches/gpio-sysfs-fix-gpio-device-attribute-leak.patch deleted file mode 100644 index cf9f47e..0000000 --- a/patches/gpio-sysfs-fix-gpio-device-attribute-leak.patch +++ /dev/null @@ -1,107 +0,0 @@ -From 0915e6feb38de8d3601819992a5bd050201a56fa Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Tue, 13 Jan 2015 13:00:05 +0100 -Subject: gpio: sysfs: fix gpio device-attribute leak - -commit 0915e6feb38de8d3601819992a5bd050201a56fa upstream. - -The gpio device attributes were never destroyed when the gpio was -unexported (or on export failures). - -Use device_create_with_groups() to create the default device attributes -of the gpio class device. Note that this also fixes the -attribute-creation race with userspace for these attributes. - -Remove contingent attributes in export error path and on unexport. - -Fixes: d8f388d8dc8d ("gpio: sysfs interface") -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Linus Walleij <linus.walleij@linaro.org> -[lizf: Backported to 3.4: - - adjust filename - - adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpio/gpiolib.c | 26 ++++++++++++-------------- - 1 file changed, 12 insertions(+), 14 deletions(-) - ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -319,7 +319,7 @@ static ssize_t gpio_value_store(struct d - return status; - } - --static const DEVICE_ATTR(value, 0644, -+static DEVICE_ATTR(value, 0644, - gpio_value_show, gpio_value_store); - - static irqreturn_t gpio_sysfs_irq(int irq, void *priv) -@@ -542,18 +542,15 @@ static ssize_t gpio_active_low_store(str - return status ? : size; - } - --static const DEVICE_ATTR(active_low, 0644, -+static DEVICE_ATTR(active_low, 0644, - gpio_active_low_show, gpio_active_low_store); - --static const struct attribute *gpio_attrs[] = { -+static struct attribute *gpio_attrs[] = { - &dev_attr_value.attr, - &dev_attr_active_low.attr, - NULL, - }; -- --static const struct attribute_group gpio_attr_group = { -- .attrs = (struct attribute **) gpio_attrs, --}; -+ATTRIBUTE_GROUPS(gpio); - - /* - * /sys/class/gpio/gpiochipN/ -@@ -737,17 +734,14 @@ int gpio_export(unsigned gpio, bool dire - if (desc->chip->names && desc->chip->names[gpio - desc->chip->base]) - ioname = desc->chip->names[gpio - desc->chip->base]; - -- dev = device_create(&gpio_class, desc->chip->dev, MKDEV(0, 0), -- desc, ioname ? ioname : "gpio%u", gpio); -+ dev = device_create_with_groups(&gpio_class, desc->chip->dev, -+ MKDEV(0, 0), desc, gpio_groups, -+ ioname ? ioname : "gpio%u", gpio); - if (IS_ERR(dev)) { - status = PTR_ERR(dev); - goto fail_unlock; - } - -- status = sysfs_create_group(&dev->kobj, &gpio_attr_group); -- if (status) -- goto fail_unregister_device; -- - if (direction_may_change) { - status = device_create_file(dev, &dev_attr_direction); - if (status) -@@ -758,13 +752,15 @@ int gpio_export(unsigned gpio, bool dire - !test_bit(FLAG_IS_OUT, &desc->flags))) { - status = device_create_file(dev, &dev_attr_edge); - if (status) -- goto fail_unregister_device; -+ goto fail_remove_attr_direction; - } - - set_bit(FLAG_EXPORT, &desc->flags); - mutex_unlock(&sysfs_lock); - return 0; - -+fail_remove_attr_direction: -+ device_remove_file(dev, &dev_attr_direction); - fail_unregister_device: - device_unregister(dev); - fail_unlock: -@@ -904,6 +900,8 @@ void gpio_unexport(unsigned gpio) - - mutex_unlock(&sysfs_lock); - if (dev) { -+ device_remove_file(dev, &dev_attr_edge); -+ device_remove_file(dev, &dev_attr_direction); - device_unregister(dev); - put_device(dev); - } diff --git a/patches/gpio-sysfs-fix-memory-leak-in-gpiod_export_link.patch b/patches/gpio-sysfs-fix-memory-leak-in-gpiod_export_link.patch deleted file mode 100644 index 2ec07c0..0000000 --- a/patches/gpio-sysfs-fix-memory-leak-in-gpiod_export_link.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 0f303db08df0df9bd0966443ad6001e63960af16 Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Mon, 26 Jan 2015 12:02:45 +0100 -Subject: gpio: sysfs: fix memory leak in gpiod_export_link - -commit 0f303db08df0df9bd0966443ad6001e63960af16 upstream. - -Fix memory leak in the gpio sysfs interface due to failure to drop -reference to device returned by class_find_device when creating a link. - -Fixes: a4177ee7f1a8 ("gpiolib: allow exported GPIO nodes to be named -using sysfs links") -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Linus Walleij <linus.walleij@linaro.org> -[lizf: Backported to 3.4: adjust filename] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpio/gpiolib.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -825,6 +825,7 @@ int gpio_export_link(struct device *dev, - if (tdev != NULL) { - status = sysfs_create_link(&dev->kobj, &tdev->kobj, - name); -+ put_device(tdev); - } else { - status = -ENODEV; - } diff --git a/patches/gpio-sysfs-fix-memory-leak-in-gpiod_sysfs_set_active_low.patch b/patches/gpio-sysfs-fix-memory-leak-in-gpiod_sysfs_set_active_low.patch deleted file mode 100644 index 5e41cde..0000000 --- a/patches/gpio-sysfs-fix-memory-leak-in-gpiod_sysfs_set_active_low.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 49d2ca84e433dab854c7a866bc6add09cfab682d Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Mon, 26 Jan 2015 12:02:46 +0100 -Subject: gpio: sysfs: fix memory leak in gpiod_sysfs_set_active_low - -commit 49d2ca84e433dab854c7a866bc6add09cfab682d upstream. - -Fix memory leak in the gpio sysfs interface due to failure to drop -reference to device returned by class_find_device when setting the -gpio-line polarity. - -Fixes: 0769746183ca ("gpiolib: add support for changing value polarity -in sysfs") -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Linus Walleij <linus.walleij@linaro.org> -[lizf: Backported to 3.4: adjust filename] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpio/gpiolib.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -876,7 +876,7 @@ int gpio_sysfs_set_active_low(unsigned g - } - - status = sysfs_set_active_low(desc, dev, value); -- -+ put_device(dev); - unlock: - mutex_unlock(&sysfs_lock); - diff --git a/patches/gpiolib-refactor-gpio_export.patch b/patches/gpiolib-refactor-gpio_export.patch deleted file mode 100644 index 190d329..0000000 --- a/patches/gpiolib-refactor-gpio_export.patch +++ /dev/null @@ -1,137 +0,0 @@ -From fc4e2514995d9cd7f3e1a67098ce65d72acf8ec7 Mon Sep 17 00:00:00 2001 -From: Ryan Mallon <rmallon@gmail.com> -Date: Mon, 22 Oct 2012 11:39:12 +1100 -Subject: gpiolib: Refactor gpio_export - -commit fc4e2514995d9cd7f3e1a67098ce65d72acf8ec7 upstream. - -The gpio_export function uses nested if statements and the status -variable to handle the failure cases. This makes the function logic -difficult to follow. Refactor the code to abort immediately on failure -using goto. This makes the code slightly longer, but significantly -reduces the nesting and number of split lines and makes the code easier -to read. - -Signed-off-by: Ryan Mallon <rmallon@gmail.com> -Signed-off-by: Linus Walleij <linus.walleij@linaro.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpio/gpiolib.c | 83 ++++++++++++++++++++++++++----------------------- - 1 file changed, 45 insertions(+), 38 deletions(-) - ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -701,8 +701,9 @@ int gpio_export(unsigned gpio, bool dire - { - unsigned long flags; - struct gpio_desc *desc; -- int status = -EINVAL; -+ int status; - const char *ioname = NULL; -+ struct device *dev; - - /* can't export until sysfs is available ... */ - if (!gpio_class.p) { -@@ -710,59 +711,65 @@ int gpio_export(unsigned gpio, bool dire - return -ENOENT; - } - -- if (!gpio_is_valid(gpio)) -- goto done; -+ if (!gpio_is_valid(gpio)) { -+ pr_debug("%s: gpio %d is not valid\n", __func__, gpio); -+ return -EINVAL; -+ } - - mutex_lock(&sysfs_lock); - - spin_lock_irqsave(&gpio_lock, flags); - desc = &gpio_desc[gpio]; -- if (test_bit(FLAG_REQUESTED, &desc->flags) -- && !test_bit(FLAG_EXPORT, &desc->flags)) { -- status = 0; -- if (!desc->chip->direction_input -- || !desc->chip->direction_output) -- direction_may_change = false; -+ if (!test_bit(FLAG_REQUESTED, &desc->flags) || -+ test_bit(FLAG_EXPORT, &desc->flags)) { -+ spin_unlock_irqrestore(&gpio_lock, flags); -+ pr_debug("%s: gpio %d unavailable (requested=%d, exported=%d)\n", -+ __func__, gpio, -+ test_bit(FLAG_REQUESTED, &desc->flags), -+ test_bit(FLAG_EXPORT, &desc->flags)); -+ return -EPERM; - } -+ -+ if (!desc->chip->direction_input || !desc->chip->direction_output) -+ direction_may_change = false; - spin_unlock_irqrestore(&gpio_lock, flags); - - if (desc->chip->names && desc->chip->names[gpio - desc->chip->base]) - ioname = desc->chip->names[gpio - desc->chip->base]; - -- if (status == 0) { -- struct device *dev; -+ dev = device_create(&gpio_class, desc->chip->dev, MKDEV(0, 0), -+ desc, ioname ? ioname : "gpio%u", gpio); -+ if (IS_ERR(dev)) { -+ status = PTR_ERR(dev); -+ goto fail_unlock; -+ } -+ -+ status = sysfs_create_group(&dev->kobj, &gpio_attr_group); -+ if (status) -+ goto fail_unregister_device; -+ -+ if (direction_may_change) { -+ status = device_create_file(dev, &dev_attr_direction); -+ if (status) -+ goto fail_unregister_device; -+ } - -- dev = device_create(&gpio_class, desc->chip->dev, MKDEV(0, 0), -- desc, ioname ? ioname : "gpio%u", gpio); -- if (!IS_ERR(dev)) { -- status = sysfs_create_group(&dev->kobj, -- &gpio_attr_group); -- -- if (!status && direction_may_change) -- status = device_create_file(dev, -- &dev_attr_direction); -- -- if (!status && gpio_to_irq(gpio) >= 0 -- && (direction_may_change -- || !test_bit(FLAG_IS_OUT, -- &desc->flags))) -- status = device_create_file(dev, -- &dev_attr_edge); -- -- if (status != 0) -- device_unregister(dev); -- } else -- status = PTR_ERR(dev); -- if (status == 0) -- set_bit(FLAG_EXPORT, &desc->flags); -+ if (gpio_to_irq(gpio) >= 0 && (direction_may_change || -+ !test_bit(FLAG_IS_OUT, &desc->flags))) { -+ status = device_create_file(dev, &dev_attr_edge); -+ if (status) -+ goto fail_unregister_device; - } - -+ set_bit(FLAG_EXPORT, &desc->flags); - mutex_unlock(&sysfs_lock); -+ return 0; - --done: -- if (status) -- pr_debug("%s: gpio%d status %d\n", __func__, gpio, status); -- -+fail_unregister_device: -+ device_unregister(dev); -+fail_unlock: -+ mutex_unlock(&sysfs_lock); -+ pr_debug("%s: gpio%d status %d\n", __func__, gpio, status); - return status; - } - EXPORT_SYMBOL_GPL(gpio_export); diff --git a/patches/hid-roccat-potential-out-of-bounds-in-pyra_sysfs_write_settings.patch b/patches/hid-roccat-potential-out-of-bounds-in-pyra_sysfs_write_settings.patch deleted file mode 100644 index de78096..0000000 --- a/patches/hid-roccat-potential-out-of-bounds-in-pyra_sysfs_write_settings.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 606185b20caf4c57d7e41e5a5ea4aff460aef2ab Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@oracle.com> -Date: Fri, 9 Jan 2015 15:32:31 +0300 -Subject: HID: roccat: potential out of bounds in pyra_sysfs_write_settings() - -commit 606185b20caf4c57d7e41e5a5ea4aff460aef2ab upstream. - -This is a static checker fix. We write some binary settings to the -sysfs file. One of the settings is the "->startup_profile". There -isn't any checking to make sure it fits into the -pyra->profile_settings[] array in the profile_activated() function. - -I added a check to pyra_sysfs_write_settings() in both places because -I wasn't positive that the other callers were correct. - -Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -Signed-off-by: Jiri Kosina <jkosina@suse.cz> -[lizf: Backported to 3.4: define the variable @settings] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/hid/hid-roccat-pyra.c | 7 +++++++ - 1 file changed, 7 insertions(+) - ---- a/drivers/hid/hid-roccat-pyra.c -+++ b/drivers/hid/hid-roccat-pyra.c -@@ -35,6 +35,8 @@ static struct class *pyra_class; - static void profile_activated(struct pyra_device *pyra, - unsigned int new_profile) - { -+ if (new_profile >= ARRAY_SIZE(pyra->profile_settings)) -+ return; - pyra->actual_profile = new_profile; - pyra->actual_cpi = pyra->profile_settings[pyra->actual_profile].y_cpi; - } -@@ -299,10 +301,15 @@ static ssize_t pyra_sysfs_write_settings - int retval = 0; - int difference; - struct pyra_roccat_report roccat_report; -+ struct pyra_settings const *settings; - - if (off != 0 || count != sizeof(struct pyra_settings)) - return -EINVAL; - -+ settings = (struct pyra_settings const *)buf; -+ if (settings->startup_profile >= ARRAY_SIZE(pyra->profile_settings)) -+ return -EINVAL; -+ - mutex_lock(&pyra->pyra_lock); - difference = memcmp(buf, &pyra->settings, sizeof(struct pyra_settings)); - if (difference) { diff --git a/patches/hp_accel-add-support-for-hp-zbook-15.patch b/patches/hp_accel-add-support-for-hp-zbook-15.patch deleted file mode 100644 index 8199b81..0000000 --- a/patches/hp_accel-add-support-for-hp-zbook-15.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 6583659e0f92e38079a8dd081e0a1181a0f37747 Mon Sep 17 00:00:00 2001 -From: Dominique Leuenberger <dimstar@opensuse.org> -Date: Thu, 13 Nov 2014 20:57:37 +0100 -Subject: hp_accel: Add support for HP ZBook 15 - -commit 6583659e0f92e38079a8dd081e0a1181a0f37747 upstream. - -HP ZBook 15 laptop needs a non-standard mapping (x_inverted). - -BugLink: http://bugzilla.opensuse.org/show_bug.cgi?id=905329 -Signed-off-by: Dominique Leuenberger <dimstar@opensuse.org> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Darren Hart <dvhart@linux.intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/platform/x86/hp_accel.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/platform/x86/hp_accel.c -+++ b/drivers/platform/x86/hp_accel.c -@@ -237,6 +237,7 @@ static struct dmi_system_id lis3lv02d_dm - AXIS_DMI_MATCH("HPB64xx", "HP ProBook 64", xy_swap), - AXIS_DMI_MATCH("HPB64xx", "HP EliteBook 84", xy_swap), - AXIS_DMI_MATCH("HPB65xx", "HP ProBook 65", x_inverted), -+ AXIS_DMI_MATCH("HPZBook15", "HP ZBook 15", x_inverted), - { NULL, } - /* Laptop models without axis info (yet): - * "NC6910" "HP Compaq 6910" diff --git a/patches/i2c-davinci-generate-stp-always-when-nack-is-received.patch b/patches/i2c-davinci-generate-stp-always-when-nack-is-received.patch deleted file mode 100644 index f017014..0000000 --- a/patches/i2c-davinci-generate-stp-always-when-nack-is-received.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 9ea359f7314132cbcb5a502d2d8ef095be1f45e4 Mon Sep 17 00:00:00 2001 -From: Grygorii Strashko <grygorii.strashko@ti.com> -Date: Mon, 1 Dec 2014 17:34:04 +0200 -Subject: i2c: davinci: generate STP always when NACK is received -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 9ea359f7314132cbcb5a502d2d8ef095be1f45e4 upstream. - -According to I2C specification the NACK should be handled as follows: -"When SDA remains HIGH during this ninth clock pulse, this is defined as the Not -Acknowledge signal. The master can then generate either a STOP condition to -abort the transfer, or a repeated START condition to start a new transfer." -[I2C spec Rev. 6, 3.1.6: http://www.nxp.com/documents/user_manual/UM10204.pdf] - -Currently the Davinci i2c driver interrupts the transfer on receipt of a -NACK but fails to send a STOP in some situations and so makes the bus -stuck until next I2C IP reset (idle/enable). - -For example, the issue will happen during SMBus read transfer which -consists from two i2c messages write command/address and read data: - -S Slave Address Wr A Command Code A Sr Slave Address Rd A D1..Dn A P -<--- write -----------------------> <--- read ---------------------> - -The I2C client device will send NACK if it can't recognize "Command Code" -and it's expected from I2C master to generate STP in this case. -But now, Davinci i2C driver will just exit with -EREMOTEIO and STP will -not be generated. - -Hence, fix it by generating Stop condition (STP) always when NACK is received. - -This patch fixes Davinci I2C in the same way it was done for OMAP I2C -commit cda2109a26eb ("i2c: omap: query STP always when NACK is received"). - -Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> -Reported-by: Hein Tibosch <hein_tibosch@yahoo.es> -Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com> -Signed-off-by: Wolfram Sang <wsa@the-dreams.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/i2c/busses/i2c-davinci.c | 8 +++----- - 1 file changed, 3 insertions(+), 5 deletions(-) - ---- a/drivers/i2c/busses/i2c-davinci.c -+++ b/drivers/i2c/busses/i2c-davinci.c -@@ -416,11 +416,9 @@ i2c_davinci_xfer_msg(struct i2c_adapter - if (dev->cmd_err & DAVINCI_I2C_STR_NACK) { - if (msg->flags & I2C_M_IGNORE_NAK) - return msg->len; -- if (stop) { -- w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG); -- w |= DAVINCI_I2C_MDR_STP; -- davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w); -- } -+ w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG); -+ w |= DAVINCI_I2C_MDR_STP; -+ davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w); - return -EREMOTEIO; - } - return -EIO; diff --git a/patches/iio-fix-iio_event_code_extract_dir-bit-mask.patch b/patches/iio-fix-iio_event_code_extract_dir-bit-mask.patch deleted file mode 100644 index ced3b8e..0000000 --- a/patches/iio-fix-iio_event_code_extract_dir-bit-mask.patch +++ /dev/null @@ -1,29 +0,0 @@ -From ccf54555da9a5e91e454b909ca6a5303c7d6b910 Mon Sep 17 00:00:00 2001 -From: Cristina Ciocan <cristina.ciocan@intel.com> -Date: Tue, 11 Nov 2014 16:07:42 +0200 -Subject: iio: Fix IIO_EVENT_CODE_EXTRACT_DIR bit mask - -commit ccf54555da9a5e91e454b909ca6a5303c7d6b910 upstream. - -The direction field is set on 7 bits, thus we need to AND it with 0111 111 mask -in order to retrieve it, that is 0x7F, not 0xCF as it is now. - -Fixes: ade7ef7ba (staging:iio: Differential channel handling) -Signed-off-by: Cristina Ciocan <cristina.ciocan@intel.com> -Signed-off-by: Jonathan Cameron <jic23@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/staging/iio/events.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/staging/iio/events.h -+++ b/drivers/staging/iio/events.h -@@ -90,7 +90,7 @@ enum iio_event_direction { - - #define IIO_EVENT_CODE_EXTRACT_TYPE(mask) ((mask >> 56) & 0xFF) - --#define IIO_EVENT_CODE_EXTRACT_DIR(mask) ((mask >> 48) & 0xCF) -+#define IIO_EVENT_CODE_EXTRACT_DIR(mask) ((mask >> 48) & 0x7F) - - #define IIO_EVENT_CODE_EXTRACT_CHAN_TYPE(mask) ((mask >> 32) & 0xFF) - diff --git a/patches/input-i8042-add-acer-aspire-7738-to-the-nomux-list.patch b/patches/input-i8042-add-acer-aspire-7738-to-the-nomux-list.patch deleted file mode 100644 index 2c5f8c0..0000000 --- a/patches/input-i8042-add-acer-aspire-7738-to-the-nomux-list.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 9333caeaeae4f831054e0e127a6ed3948b604d3e Mon Sep 17 00:00:00 2001 -From: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Date: Thu, 8 Jan 2015 14:53:23 -0800 -Subject: Input: I8042 - add Acer Aspire 7738 to the nomux list - -commit 9333caeaeae4f831054e0e127a6ed3948b604d3e upstream. - -When KBC is in active multiplexing mode the touchpad on this laptop does -not work. - -Reported-by: Bilal Koc <koc.bilo@googlemail.com> -Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ - 1 file changed, 7 insertions(+) - ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -408,6 +408,13 @@ static const struct dmi_system_id __init - }, - }, - { -+ /* Acer Aspire 7738 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"), -+ }, -+ }, -+ { - /* Gericom Bellagio */ - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Gericom"), diff --git a/patches/input-i8042-reset-keyboard-to-fix-elantech-touchpad-detection.patch b/patches/input-i8042-reset-keyboard-to-fix-elantech-touchpad-detection.patch deleted file mode 100644 index 011fd3f..0000000 --- a/patches/input-i8042-reset-keyboard-to-fix-elantech-touchpad-detection.patch +++ /dev/null @@ -1,121 +0,0 @@ -From 148e9a711e034e06310a8c36b64957934ebe30f2 Mon Sep 17 00:00:00 2001 -From: Srihari Vijayaraghavan <linux.bug.reporting@gmail.com> -Date: Wed, 7 Jan 2015 16:25:53 -0800 -Subject: Input: i8042 - reset keyboard to fix Elantech touchpad detection -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 148e9a711e034e06310a8c36b64957934ebe30f2 upstream. - -On some laptops, keyboard needs to be reset in order to successfully detect -touchpad (e.g., some Gigabyte laptop models with Elantech touchpads). -Without resettin keyboard touchpad pretends to be completely dead. - -Based on the original patch by Mateusz JoÅ„czyk this version has been -expanded to include DMI based detection & application of the fix -automatically on the affected models of laptops. This has been confirmed to -fix problem by three users already on three different models of laptops. - -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81331 -Signed-off-by: Srihari Vijayaraghavan <linux.bug.reporting@gmail.com> -Acked-by: Mateusz JoÅ„czyk <mat.jonczyk@o2.pl> -Tested-by: Srihari Vijayaraghavan <linux.bug.reporting@gmail.com> -Tested by: Zakariya Dehlawi <zdehlawi@gmail.com> -Tested-by: Guillaum Bouchard <guillaum.bouchard@gmail.com> -Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - Documentation/kernel-parameters.txt | 1 + - drivers/input/serio/i8042-x86ia64io.h | 32 ++++++++++++++++++++++++++++++++ - drivers/input/serio/i8042.c | 14 ++++++++++++++ - 3 files changed, 47 insertions(+) - ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -979,6 +979,7 @@ bytes respectively. Such letter suffixes - i8042.notimeout [HW] Ignore timeout condition signalled by controller - i8042.reset [HW] Reset the controller during init and cleanup - i8042.unlock [HW] Unlock (ignore) the keylock -+ i8042.kbdreset [HW] Reset device connected to KBD port - - i810= [HW,DRM] - ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -721,6 +721,35 @@ static const struct dmi_system_id __init - { } - }; - -+/* -+ * Some laptops need keyboard reset before probing for the trackpad to get -+ * it detected, initialised & finally work. -+ */ -+static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = { -+ { -+ /* Gigabyte P35 v2 - Elantech touchpad */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"), -+ }, -+ }, -+ { -+ /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "X3"), -+ }, -+ }, -+ { -+ /* Gigabyte P34 - Elantech touchpad */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "P34"), -+ }, -+ }, -+ { } -+}; -+ - #endif /* CONFIG_X86 */ - - #ifdef CONFIG_PNP -@@ -1001,6 +1030,9 @@ static int __init i8042_platform_init(vo - if (dmi_check_system(i8042_dmi_dritek_table)) - i8042_dritek = true; - -+ if (dmi_check_system(i8042_dmi_kbdreset_table)) -+ i8042_kbdreset = true; -+ - /* - * A20 was already enabled during early kernel init. But some buggy - * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to ---- a/drivers/input/serio/i8042.c -+++ b/drivers/input/serio/i8042.c -@@ -67,6 +67,10 @@ static bool i8042_notimeout; - module_param_named(notimeout, i8042_notimeout, bool, 0); - MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042"); - -+static bool i8042_kbdreset; -+module_param_named(kbdreset, i8042_kbdreset, bool, 0); -+MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port"); -+ - #ifdef CONFIG_X86 - static bool i8042_dritek; - module_param_named(dritek, i8042_dritek, bool, 0); -@@ -783,6 +787,16 @@ static int __init i8042_check_aux(void) - return -1; - - /* -+ * Reset keyboard (needed on some laptops to successfully detect -+ * touchpad, e.g., some Gigabyte laptop models with Elantech -+ * touchpads). -+ */ -+ if (i8042_kbdreset) { -+ pr_warn("Attempting to reset device connected to KBD port\n"); -+ i8042_kbd_write(NULL, (unsigned char) 0xff); -+ } -+ -+/* - * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and - * used it for a PCI card or somethig else. - */ diff --git a/patches/input-xpad-use-proper-endpoint-type.patch b/patches/input-xpad-use-proper-endpoint-type.patch deleted file mode 100644 index 8dd738a..0000000 --- a/patches/input-xpad-use-proper-endpoint-type.patch +++ /dev/null @@ -1,47 +0,0 @@ -From a1f9a4072655843fc03186acbad65990cc05dd2d Mon Sep 17 00:00:00 2001 -From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Date: Tue, 25 Nov 2014 00:38:17 -0800 -Subject: Input: xpad - use proper endpoint type - -commit a1f9a4072655843fc03186acbad65990cc05dd2d upstream. - -The xpad wireless endpoint is not a bulk endpoint on my devices, but -rather an interrupt one, so the USB core complains when it is submitted. -I'm guessing that the author really did mean that this should be an -interrupt urb, but as there are a zillion different xpad devices out -there, let's cover out bases and handle both bulk and interrupt -endpoints just as easily. - -Signed-off-by: "Pierre-Loup A. Griffais" <pgriffais@valvesoftware.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/input/joystick/xpad.c | 16 +++++++++++++--- - 1 file changed, 13 insertions(+), 3 deletions(-) - ---- a/drivers/input/joystick/xpad.c -+++ b/drivers/input/joystick/xpad.c -@@ -979,9 +979,19 @@ static int xpad_probe(struct usb_interfa - } - - ep_irq_in = &intf->cur_altsetting->endpoint[1].desc; -- usb_fill_bulk_urb(xpad->bulk_out, udev, -- usb_sndbulkpipe(udev, ep_irq_in->bEndpointAddress), -- xpad->bdata, XPAD_PKT_LEN, xpad_bulk_out, xpad); -+ if (usb_endpoint_is_bulk_out(ep_irq_in)) { -+ usb_fill_bulk_urb(xpad->bulk_out, udev, -+ usb_sndbulkpipe(udev, -+ ep_irq_in->bEndpointAddress), -+ xpad->bdata, XPAD_PKT_LEN, -+ xpad_bulk_out, xpad); -+ } else { -+ usb_fill_int_urb(xpad->bulk_out, udev, -+ usb_sndintpipe(udev, -+ ep_irq_in->bEndpointAddress), -+ xpad->bdata, XPAD_PKT_LEN, -+ xpad_bulk_out, xpad, 0); -+ } - - /* - * Submit the int URB immediately rather than waiting for open diff --git a/patches/iommu-vt-d-fix-an-off-by-one-bug-in-__domain_mapping.patch b/patches/iommu-vt-d-fix-an-off-by-one-bug-in-__domain_mapping.patch deleted file mode 100644 index ec0bf6d..0000000 --- a/patches/iommu-vt-d-fix-an-off-by-one-bug-in-__domain_mapping.patch +++ /dev/null @@ -1,52 +0,0 @@ -From cc4f14aa170d895c9a43bdb56f62070c8a6da908 Mon Sep 17 00:00:00 2001 -From: Jiang Liu <jiang.liu@linux.intel.com> -Date: Wed, 26 Nov 2014 09:42:10 +0800 -Subject: iommu/vt-d: Fix an off-by-one bug in __domain_mapping() - -commit cc4f14aa170d895c9a43bdb56f62070c8a6da908 upstream. - -There's an off-by-one bug in function __domain_mapping(), which may -trigger the BUG_ON(nr_pages < lvl_pages) when - (nr_pages + 1) & superpage_mask == 0 - -The issue was introduced by commit 9051aa0268dc "intel-iommu: Combine -domain_pfn_mapping() and domain_sg_mapping()", which sets sg_res to -"nr_pages + 1" to avoid some of the 'sg_res==0' code paths. - -It's safe to remove extra "+1" because sg_res is only used to calculate -page size now. - -Reported-And-Tested-by: Sudeep Dutt <sudeep.dutt@intel.com> -Signed-off-by: Jiang Liu <jiang.liu@linux.intel.com> -Acked-By: David Woodhouse <David.Woodhouse@intel.com> -Signed-off-by: Joerg Roedel <jroedel@suse.de> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/iommu/intel-iommu.c | 8 +++----- - 1 file changed, 3 insertions(+), 5 deletions(-) - ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -1792,7 +1792,7 @@ static int __domain_mapping(struct dmar_ - struct dma_pte *first_pte = NULL, *pte = NULL; - phys_addr_t uninitialized_var(pteval); - int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT; -- unsigned long sg_res; -+ unsigned long sg_res = 0; - unsigned int largepage_lvl = 0; - unsigned long lvl_pages = 0; - -@@ -1803,10 +1803,8 @@ static int __domain_mapping(struct dmar_ - - prot &= DMA_PTE_READ | DMA_PTE_WRITE | DMA_PTE_SNP; - -- if (sg) -- sg_res = 0; -- else { -- sg_res = nr_pages + 1; -+ if (!sg) { -+ sg_res = nr_pages; - pteval = ((phys_addr_t)phys_pfn << VTD_PAGE_SHIFT) | prot; - } - diff --git a/patches/ipv6-replacing-a-rt6_info-needs-to-purge-possible-propagated-rt6_infos-too.patch b/patches/ipv6-replacing-a-rt6_info-needs-to-purge-possible-propagated-rt6_infos-too.patch deleted file mode 100644 index 700251b..0000000 --- a/patches/ipv6-replacing-a-rt6_info-needs-to-purge-possible-propagated-rt6_infos-too.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 6e9e16e6143b725662e47026a1d0f270721cdd24 Mon Sep 17 00:00:00 2001 -From: Hannes Frederic Sowa <hannes@stressinduktion.org> -Date: Mon, 26 Jan 2015 15:11:17 +0100 -Subject: ipv6: replacing a rt6_info needs to purge possible propagated - rt6_infos too - -commit 6e9e16e6143b725662e47026a1d0f270721cdd24 upstream. - -Lubomir Rintel reported that during replacing a route the interface -reference counter isn't correctly decremented. - -To quote bug <https://bugzilla.kernel.org/show_bug.cgi?id=91941>: -| [root@rhel7-5 lkundrak]# sh -x lal -| + ip link add dev0 type dummy -| + ip link set dev0 up -| + ip link add dev1 type dummy -| + ip link set dev1 up -| + ip addr add 2001:db8:8086::2/64 dev dev0 -| + ip route add 2001:db8:8086::/48 dev dev0 proto static metric 20 -| + ip route add 2001:db8:8088::/48 dev dev1 proto static metric 10 -| + ip route replace 2001:db8:8086::/48 dev dev1 proto static metric 20 -| + ip link del dev0 type dummy -| Message from syslogd@rhel7-5 at Jan 23 10:54:41 ... -| kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2 -| -| Message from syslogd@rhel7-5 at Jan 23 10:54:51 ... -| kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2 - -During replacement of a rt6_info we must walk all parent nodes and check -if the to be replaced rt6_info got propagated. If so, replace it with -an alive one. - -Fixes: 4a287eba2de3957 ("IPv6 routing, NLM_F_* flag support: REPLACE and EXCL flags support, warn about missing CREATE flag") -Reported-by: Lubomir Rintel <lkundrak@v3.sk> -Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> -Tested-by: Lubomir Rintel <lkundrak@v3.sk> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/ipv6/ip6_fib.c | 45 ++++++++++++++++++++++++++------------------- - 1 file changed, 26 insertions(+), 19 deletions(-) - ---- a/net/ipv6/ip6_fib.c -+++ b/net/ipv6/ip6_fib.c -@@ -633,6 +633,29 @@ insert_above: - return ln; - } - -+static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn, -+ struct net *net) -+{ -+ if (atomic_read(&rt->rt6i_ref) != 1) { -+ /* This route is used as dummy address holder in some split -+ * nodes. It is not leaked, but it still holds other resources, -+ * which must be released in time. So, scan ascendant nodes -+ * and replace dummy references to this route with references -+ * to still alive ones. -+ */ -+ while (fn) { -+ if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) { -+ fn->leaf = fib6_find_prefix(net, fn); -+ atomic_inc(&fn->leaf->rt6i_ref); -+ rt6_release(rt); -+ } -+ fn = fn->parent; -+ } -+ /* No more references are possible at this point. */ -+ BUG_ON(atomic_read(&rt->rt6i_ref) != 1); -+ } -+} -+ - /* - * Insert routing information in a node. - */ -@@ -723,11 +746,12 @@ add: - rt->dst.rt6_next = iter->dst.rt6_next; - atomic_inc(&rt->rt6i_ref); - inet6_rt_notify(RTM_NEWROUTE, rt, info); -- rt6_release(iter); - if (!(fn->fn_flags & RTN_RTINFO)) { - info->nl_net->ipv6.rt6_stats->fib_route_nodes++; - fn->fn_flags |= RTN_RTINFO; - } -+ fib6_purge_rt(iter, fn, info->nl_net); -+ rt6_release(iter); - } - - return 0; -@@ -1229,24 +1253,7 @@ static void fib6_del_route(struct fib6_n - fn = fib6_repair_tree(net, fn); - } - -- if (atomic_read(&rt->rt6i_ref) != 1) { -- /* This route is used as dummy address holder in some split -- * nodes. It is not leaked, but it still holds other resources, -- * which must be released in time. So, scan ascendant nodes -- * and replace dummy references to this route with references -- * to still alive ones. -- */ -- while (fn) { -- if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) { -- fn->leaf = fib6_find_prefix(net, fn); -- atomic_inc(&fn->leaf->rt6i_ref); -- rt6_release(rt); -- } -- fn = fn->parent; -- } -- /* No more references are possible at this point. */ -- BUG_ON(atomic_read(&rt->rt6i_ref) != 1); -- } -+ fib6_purge_rt(rt, fn, net); - - inet6_rt_notify(RTM_DELROUTE, rt, info); - rt6_release(rt); diff --git a/patches/ipvs-rerouting-to-local-clients-is-not-needed-anymore.patch b/patches/ipvs-rerouting-to-local-clients-is-not-needed-anymore.patch deleted file mode 100644 index e039773..0000000 --- a/patches/ipvs-rerouting-to-local-clients-is-not-needed-anymore.patch +++ /dev/null @@ -1,126 +0,0 @@ -From 579eb62ac35845686a7c4286c0a820b4eb1f96aa Mon Sep 17 00:00:00 2001 -From: Julian Anastasov <ja@ssi.bg> -Date: Thu, 18 Dec 2014 22:41:23 +0200 -Subject: ipvs: rerouting to local clients is not needed anymore - -commit 579eb62ac35845686a7c4286c0a820b4eb1f96aa upstream. - -commit f5a41847acc5 ("ipvs: move ip_route_me_harder for ICMP") -from 2.6.37 introduced ip_route_me_harder() call for responses to -local clients, so that we can provide valid rt_src after SNAT. -It was used by TCP to provide valid daddr for ip_send_reply(). -After commit 0a5ebb8000c5 ("ipv4: Pass explicit daddr arg to -ip_send_reply()." from 3.0 this rerouting is not needed anymore -and should be avoided, especially in LOCAL_IN. - -Fixes 3.12.33 crash in xfrm reported by Florian Wiessner: -"3.12.33 - BUG xfrm_selector_match+0x25/0x2f6" - -Reported-by: Smart Weblications GmbH - Florian Wiessner <f.wiessner@smart-weblications.de> -Tested-by: Smart Weblications GmbH - Florian Wiessner <f.wiessner@smart-weblications.de> -Signed-off-by: Julian Anastasov <ja@ssi.bg> -Signed-off-by: Simon Horman <horms@verge.net.au> -[Julian: Backported to 3.4] -Signed-off-by: Julian Anastasov <ja@ssi.bg> -Acked-by: Simon Horman <horms@verge.net.au> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/netfilter/ipvs/ip_vs_core.c | 32 +++++++++++++++++++++----------- - 1 file changed, 21 insertions(+), 11 deletions(-) - ---- a/net/netfilter/ipvs/ip_vs_core.c -+++ b/net/netfilter/ipvs/ip_vs_core.c -@@ -662,16 +662,24 @@ static inline int ip_vs_gather_frags_v6( - } - #endif - --static int ip_vs_route_me_harder(int af, struct sk_buff *skb) -+static int ip_vs_route_me_harder(int af, struct sk_buff *skb, -+ unsigned int hooknum) - { -+ if (!sysctl_snat_reroute(skb)) -+ return 0; -+ /* Reroute replies only to remote clients (FORWARD and LOCAL_OUT) */ -+ if (NF_INET_LOCAL_IN == hooknum) -+ return 0; - #ifdef CONFIG_IP_VS_IPV6 - if (af == AF_INET6) { -- if (sysctl_snat_reroute(skb) && ip6_route_me_harder(skb) != 0) -+ struct dst_entry *dst = skb_dst(skb); -+ -+ if (dst->dev && !(dst->dev->flags & IFF_LOOPBACK) && -+ ip6_route_me_harder(skb) != 0) - return 1; - } else - #endif -- if ((sysctl_snat_reroute(skb) || -- skb_rtable(skb)->rt_flags & RTCF_LOCAL) && -+ if (!(skb_rtable(skb)->rt_flags & RTCF_LOCAL) && - ip_route_me_harder(skb, RTN_LOCAL) != 0) - return 1; - -@@ -782,7 +790,8 @@ static int handle_response_icmp(int af, - union nf_inet_addr *snet, - __u8 protocol, struct ip_vs_conn *cp, - struct ip_vs_protocol *pp, -- unsigned int offset, unsigned int ihl) -+ unsigned int offset, unsigned int ihl, -+ unsigned int hooknum) - { - unsigned int verdict = NF_DROP; - -@@ -812,7 +821,7 @@ static int handle_response_icmp(int af, - #endif - ip_vs_nat_icmp(skb, pp, cp, 1); - -- if (ip_vs_route_me_harder(af, skb)) -+ if (ip_vs_route_me_harder(af, skb, hooknum)) - goto out; - - /* do the statistics and put it back */ -@@ -908,7 +917,7 @@ static int ip_vs_out_icmp(struct sk_buff - - snet.ip = iph->saddr; - return handle_response_icmp(AF_INET, skb, &snet, cih->protocol, cp, -- pp, offset, ihl); -+ pp, offset, ihl, hooknum); - } - - #ifdef CONFIG_IP_VS_IPV6 -@@ -985,7 +994,8 @@ static int ip_vs_out_icmp_v6(struct sk_b - - snet.in6 = iph->saddr; - return handle_response_icmp(AF_INET6, skb, &snet, cih->nexthdr, cp, -- pp, offset, sizeof(struct ipv6hdr)); -+ pp, offset, sizeof(struct ipv6hdr), -+ hooknum); - } - #endif - -@@ -1018,7 +1028,7 @@ static inline int is_tcp_reset(const str - */ - static unsigned int - handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd, -- struct ip_vs_conn *cp, int ihl) -+ struct ip_vs_conn *cp, int ihl, unsigned int hooknum) - { - struct ip_vs_protocol *pp = pd->pp; - -@@ -1056,7 +1066,7 @@ handle_response(int af, struct sk_buff * - * if it came from this machine itself. So re-compute - * the routing information. - */ -- if (ip_vs_route_me_harder(af, skb)) -+ if (ip_vs_route_me_harder(af, skb, hooknum)) - goto drop; - - IP_VS_DBG_PKT(10, af, pp, skb, 0, "After SNAT"); -@@ -1169,7 +1179,7 @@ ip_vs_out(unsigned int hooknum, struct s - cp = pp->conn_out_get(af, skb, &iph, iph.len, 0); - - if (likely(cp)) -- return handle_response(af, skb, pd, cp, iph.len); -+ return handle_response(af, skb, pd, cp, iph.len, hooknum); - if (sysctl_nat_icmp_send(net) && - (pp->protocol == IPPROTO_TCP || - pp->protocol == IPPROTO_UDP || diff --git a/patches/iscsi-target-fail-connection-on-short-sendmsg-writes.patch b/patches/iscsi-target-fail-connection-on-short-sendmsg-writes.patch deleted file mode 100644 index b50c750..0000000 --- a/patches/iscsi-target-fail-connection-on-short-sendmsg-writes.patch +++ /dev/null @@ -1,83 +0,0 @@ -From 6bf6ca7515c1df06f5c03737537f5e0eb191e29e Mon Sep 17 00:00:00 2001 -From: Nicholas Bellinger <nab@linux-iscsi.org> -Date: Thu, 20 Nov 2014 20:50:07 -0800 -Subject: iscsi-target: Fail connection on short sendmsg writes - -commit 6bf6ca7515c1df06f5c03737537f5e0eb191e29e upstream. - -This patch changes iscsit_do_tx_data() to fail on short writes -when kernel_sendmsg() returns a value different than requested -transfer length, returning -EPIPE and thus causing a connection -reset to occur. - -This avoids a potential bug in the original code where a short -write would result in kernel_sendmsg() being called again with -the original iovec base + length. - -In practice this has not been an issue because iscsit_do_tx_data() -is only used for transferring 48 byte headers + 4 byte digests, -along with seldom used control payloads from NOPIN + TEXT_RSP + -REJECT with less than 32k of data. - -So following Al's audit of iovec consumers, go ahead and fail -the connection on short writes for now, and remove the bogus -logic ahead of his proper upstream fix. - -Reported-by: Al Viro <viro@zeniv.linux.org.uk> -Cc: David S. Miller <davem@davemloft.net> -Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/target/iscsi/iscsi_target_util.c | 26 +++++++++++--------------- - 1 file changed, 11 insertions(+), 15 deletions(-) - ---- a/drivers/target/iscsi/iscsi_target_util.c -+++ b/drivers/target/iscsi/iscsi_target_util.c -@@ -1480,15 +1480,15 @@ static int iscsit_do_tx_data( - struct iscsi_conn *conn, - struct iscsi_data_count *count) - { -- int data = count->data_length, total_tx = 0, tx_loop = 0, iov_len; -+ int ret, iov_len; - struct kvec *iov_p; - struct msghdr msg; - - if (!conn || !conn->sock || !conn->conn_ops) - return -1; - -- if (data <= 0) { -- pr_err("Data length is: %d\n", data); -+ if (count->data_length <= 0) { -+ pr_err("Data length is: %d\n", count->data_length); - return -1; - } - -@@ -1497,20 +1497,16 @@ static int iscsit_do_tx_data( - iov_p = count->iov; - iov_len = count->iov_count; - -- while (total_tx < data) { -- tx_loop = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len, -- (data - total_tx)); -- if (tx_loop <= 0) { -- pr_debug("tx_loop: %d total_tx %d\n", -- tx_loop, total_tx); -- return tx_loop; -- } -- total_tx += tx_loop; -- pr_debug("tx_loop: %d, total_tx: %d, data: %d\n", -- tx_loop, total_tx, data); -+ ret = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len, -+ count->data_length); -+ if (ret != count->data_length) { -+ pr_err("Unexpected ret: %d send data %d\n", -+ ret, count->data_length); -+ return -EPIPE; - } -+ pr_debug("ret: %d, sent data: %d\n", ret, count->data_length); - -- return total_tx; -+ return ret; - } - - int rx_data( diff --git a/patches/isofs-fix-infinite-looping-over-ce-entries.patch b/patches/isofs-fix-infinite-looping-over-ce-entries.patch deleted file mode 100644 index e19dfe7..0000000 --- a/patches/isofs-fix-infinite-looping-over-ce-entries.patch +++ /dev/null @@ -1,52 +0,0 @@ -From f54e18f1b831c92f6512d2eedb224cd63d607d3d Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.cz> -Date: Mon, 15 Dec 2014 14:22:46 +0100 -Subject: isofs: Fix infinite looping over CE entries - -commit f54e18f1b831c92f6512d2eedb224cd63d607d3d upstream. - -Rock Ridge extensions define so called Continuation Entries (CE) which -define where is further space with Rock Ridge data. Corrupted isofs -image can contain arbitrarily long chain of these, including a one -containing loop and thus causing kernel to end in an infinite loop when -traversing these entries. - -Limit the traversal to 32 entries which should be more than enough space -to store all the Rock Ridge data. - -Reported-by: P J P <ppandit@redhat.com> -Signed-off-by: Jan Kara <jack@suse.cz> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/isofs/rock.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/fs/isofs/rock.c -+++ b/fs/isofs/rock.c -@@ -30,6 +30,7 @@ struct rock_state { - int cont_size; - int cont_extent; - int cont_offset; -+ int cont_loops; - struct inode *inode; - }; - -@@ -73,6 +74,9 @@ static void init_rock_state(struct rock_ - rs->inode = inode; - } - -+/* Maximum number of Rock Ridge continuation entries */ -+#define RR_MAX_CE_ENTRIES 32 -+ - /* - * Returns 0 if the caller should continue scanning, 1 if the scan must end - * and -ve on error. -@@ -105,6 +109,8 @@ static int rock_continue(struct rock_sta - goto out; - } - ret = -EIO; -+ if (++rs->cont_loops >= RR_MAX_CE_ENTRIES) -+ goto out; - bh = sb_bread(rs->inode->i_sb, rs->cont_extent); - if (bh) { - memcpy(rs->buffer, bh->b_data + rs->cont_offset, diff --git a/patches/isofs-fix-unchecked-printing-of-er-records.patch b/patches/isofs-fix-unchecked-printing-of-er-records.patch deleted file mode 100644 index d702b9b..0000000 --- a/patches/isofs-fix-unchecked-printing-of-er-records.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 4e2024624e678f0ebb916e6192bd23c1f9fdf696 Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.cz> -Date: Thu, 18 Dec 2014 17:26:10 +0100 -Subject: isofs: Fix unchecked printing of ER records - -commit 4e2024624e678f0ebb916e6192bd23c1f9fdf696 upstream. - -We didn't check length of rock ridge ER records before printing them. -Thus corrupted isofs image can cause us to access and print some memory -behind the buffer with obvious consequences. - -Reported-and-tested-by: Carl Henrik Lunde <chlunde@ping.uio.no> -Signed-off-by: Jan Kara <jack@suse.cz> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/isofs/rock.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/fs/isofs/rock.c -+++ b/fs/isofs/rock.c -@@ -362,6 +362,9 @@ repeat: - rs.cont_size = isonum_733(rr->u.CE.size); - break; - case SIG('E', 'R'): -+ /* Invalid length of ER tag id? */ -+ if (rr->u.ER.len_id + offsetof(struct rock_ridge, u.ER.data) > rr->len) -+ goto out; - ISOFS_SB(inode->i_sb)->s_rock = 1; - printk(KERN_DEBUG "ISO 9660 Extensions: "); - { diff --git a/patches/jfs-fix-readdir-regression.patch b/patches/jfs-fix-readdir-regression.patch deleted file mode 100644 index edd47d4..0000000 --- a/patches/jfs-fix-readdir-regression.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 20021040880c347c5e1b5a9eb447f0b0c39ce138 Mon Sep 17 00:00:00 2001 -From: Dave Kleikamp <dave.kleikamp@oracle.com> -Date: Mon, 23 Mar 2015 16:06:26 -0500 -Subject: jfs: fix readdir regression - -Upstream commit 44512449, "jfs: fix readdir cookie incompatibility -with NFSv4", was backported incorrectly into the stable trees which -used the filldir callback (rather than dir_emit). The position is -being incorrectly passed to filldir for the . and .. entries. - -The still-maintained stable trees that need to be fixed are 3.2.y, -3.4.y and 3.10.y. - -https://bugzilla.kernel.org/show_bug.cgi?id=94741 - -Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com> -Cc: jfs-discussion@lists.sourceforge.net -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/jfs/jfs_dtree.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/fs/jfs/jfs_dtree.c -+++ b/fs/jfs/jfs_dtree.c -@@ -3103,7 +3103,7 @@ int jfs_readdir(struct file *filp, void - * self "." - */ - filp->f_pos = 1; -- if (filldir(dirent, ".", 1, 0, ip->i_ino, -+ if (filldir(dirent, ".", 1, 1, ip->i_ino, - DT_DIR)) - return 0; - } -@@ -3111,7 +3111,7 @@ int jfs_readdir(struct file *filp, void - * parent ".." - */ - filp->f_pos = 2; -- if (filldir(dirent, "..", 2, 1, PARENT(ip), DT_DIR)) -+ if (filldir(dirent, "..", 2, 2, PARENT(ip), DT_DIR)) - return 0; - - /* diff --git a/patches/keys-close-race-between-key-lookup-and-freeing.patch b/patches/keys-close-race-between-key-lookup-and-freeing.patch deleted file mode 100644 index eb83326..0000000 --- a/patches/keys-close-race-between-key-lookup-and-freeing.patch +++ /dev/null @@ -1,46 +0,0 @@ -From a3a8784454692dd72e5d5d34dcdab17b4420e74c Mon Sep 17 00:00:00 2001 -From: Sasha Levin <sasha.levin@oracle.com> -Date: Mon, 29 Dec 2014 09:39:01 -0500 -Subject: KEYS: close race between key lookup and freeing - -commit a3a8784454692dd72e5d5d34dcdab17b4420e74c upstream. - -When a key is being garbage collected, it's key->user would get put before -the ->destroy() callback is called, where the key is removed from it's -respective tracking structures. - -This leaves a key hanging in a semi-invalid state which leaves a window open -for a different task to try an access key->user. An example is -find_keyring_by_name() which would dereference key->user for a key that is -in the process of being garbage collected (where key->user was freed but -->destroy() wasn't called yet - so it's still present in the linked list). - -This would cause either a panic, or corrupt memory. - -Fixes CVE-2014-9529. - -Signed-off-by: Sasha Levin <sasha.levin@oracle.com> -Signed-off-by: David Howells <dhowells@redhat.com> -[lizf: Backported to 3.4: adjust indentation] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - security/keys/gc.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/security/keys/gc.c -+++ b/security/keys/gc.c -@@ -188,12 +188,12 @@ static noinline void key_gc_unused_key(s - if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) - atomic_dec(&key->user->nikeys); - -- key_user_put(key->user); -- - /* now throw away the key memory */ - if (key->type->destroy) - key->type->destroy(key); - -+ key_user_put(key->user); -+ - kfree(key->description); - - #ifdef KEY_DEBUGGING diff --git a/patches/keys-fix-stale-key-registration-at-error-path.patch b/patches/keys-fix-stale-key-registration-at-error-path.patch deleted file mode 100644 index 11ded8e..0000000 --- a/patches/keys-fix-stale-key-registration-at-error-path.patch +++ /dev/null @@ -1,42 +0,0 @@ -From b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Thu, 4 Dec 2014 18:25:19 +0100 -Subject: KEYS: Fix stale key registration at error path - -commit b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 upstream. - -When loading encrypted-keys module, if the last check of -aes_get_sizes() in init_encrypted() fails, the driver just returns an -error without unregistering its key type. This results in the stale -entry in the list. In addition to memory leaks, this leads to a kernel -crash when registering a new key type later. - -This patch fixes the problem by swapping the calls of aes_get_sizes() -and register_key_type(), and releasing resources properly at the error -paths. - -Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=908163 -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - security/keys/encrypted-keys/encrypted.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - ---- a/security/keys/encrypted-keys/encrypted.c -+++ b/security/keys/encrypted-keys/encrypted.c -@@ -1016,10 +1016,13 @@ static int __init init_encrypted(void) - ret = encrypted_shash_alloc(); - if (ret < 0) - return ret; -+ ret = aes_get_sizes(); -+ if (ret < 0) -+ goto out; - ret = register_key_type(&key_type_encrypted); - if (ret < 0) - goto out; -- return aes_get_sizes(); -+ return 0; - out: - encrypted_shash_release(); - return ret; diff --git a/patches/lib-checksum.c-fix-build-for-generic-csum_tcpudp_nofold.patch b/patches/lib-checksum.c-fix-build-for-generic-csum_tcpudp_nofold.patch deleted file mode 100644 index ea68b54..0000000 --- a/patches/lib-checksum.c-fix-build-for-generic-csum_tcpudp_nofold.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 9ce357795ef208faa0d59894d9d119a7434e37f3 Mon Sep 17 00:00:00 2001 -From: karl beldan <karl.beldan@gmail.com> -Date: Thu, 29 Jan 2015 11:10:22 +0100 -Subject: lib/checksum.c: fix build for generic csum_tcpudp_nofold - -commit 9ce357795ef208faa0d59894d9d119a7434e37f3 upstream. - -Fixed commit added from64to32 under _#ifndef do_csum_ but used it -under _#ifndef csum_tcpudp_nofold_, breaking some builds (Fengguang's -robot reported TILEGX's). Move from64to32 under the latter. - -Fixes: 150ae0e94634 ("lib/checksum.c: fix carry in csum_tcpudp_nofold") -Reported-by: kbuild test robot <fengguang.wu@intel.com> -Signed-off-by: Karl Beldan <karl.beldan@rivierawaves.com> -Cc: Eric Dumazet <edumazet@google.com> -Cc: David S. Miller <davem@davemloft.net> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - lib/checksum.c | 18 +++++++++--------- - 1 file changed, 9 insertions(+), 9 deletions(-) - ---- a/lib/checksum.c -+++ b/lib/checksum.c -@@ -47,15 +47,6 @@ static inline unsigned short from32to16( - return x; - } - --static inline u32 from64to32(u64 x) --{ -- /* add up 32-bit and 32-bit for 32+c bit */ -- x = (x & 0xffffffff) + (x >> 32); -- /* add up carry.. */ -- x = (x & 0xffffffff) + (x >> 32); -- return (u32)x; --} -- - static unsigned int do_csum(const unsigned char *buff, int len) - { - int odd; -@@ -188,6 +179,15 @@ csum_partial_copy(const void *src, void - EXPORT_SYMBOL(csum_partial_copy); - - #ifndef csum_tcpudp_nofold -+static inline u32 from64to32(u64 x) -+{ -+ /* add up 32-bit and 32-bit for 32+c bit */ -+ x = (x & 0xffffffff) + (x >> 32); -+ /* add up carry.. */ -+ x = (x & 0xffffffff) + (x >> 32); -+ return (u32)x; -+} -+ - __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr, - unsigned short len, - unsigned short proto, diff --git a/patches/lib-checksum.c-fix-carry-in-csum_tcpudp_nofold.patch b/patches/lib-checksum.c-fix-carry-in-csum_tcpudp_nofold.patch deleted file mode 100644 index d4fe668..0000000 --- a/patches/lib-checksum.c-fix-carry-in-csum_tcpudp_nofold.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 150ae0e94634714b23919f0c333fee28a5b199d5 Mon Sep 17 00:00:00 2001 -From: karl beldan <karl.beldan@gmail.com> -Date: Wed, 28 Jan 2015 10:58:11 +0100 -Subject: lib/checksum.c: fix carry in csum_tcpudp_nofold - -commit 150ae0e94634714b23919f0c333fee28a5b199d5 upstream. - -The carry from the 64->32bits folding was dropped, e.g with: -saddr=0xFFFFFFFF daddr=0xFF0000FF len=0xFFFF proto=0 sum=1, -csum_tcpudp_nofold returned 0 instead of 1. - -Signed-off-by: Karl Beldan <karl.beldan@rivierawaves.com> -Cc: Al Viro <viro@ZenIV.linux.org.uk> -Cc: Eric Dumazet <eric.dumazet@gmail.com> -Cc: Arnd Bergmann <arnd@arndb.de> -Cc: Mike Frysinger <vapier@gentoo.org> -Cc: netdev@vger.kernel.org -Cc: linux-kernel@vger.kernel.org -Signed-off-by: Eric Dumazet <edumazet@google.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - lib/checksum.c | 12 ++++++++++-- - 1 file changed, 10 insertions(+), 2 deletions(-) - ---- a/lib/checksum.c -+++ b/lib/checksum.c -@@ -47,6 +47,15 @@ static inline unsigned short from32to16( - return x; - } - -+static inline u32 from64to32(u64 x) -+{ -+ /* add up 32-bit and 32-bit for 32+c bit */ -+ x = (x & 0xffffffff) + (x >> 32); -+ /* add up carry.. */ -+ x = (x & 0xffffffff) + (x >> 32); -+ return (u32)x; -+} -+ - static unsigned int do_csum(const unsigned char *buff, int len) - { - int odd; -@@ -193,8 +202,7 @@ __wsum csum_tcpudp_nofold(__be32 saddr, - #else - s += (proto + len) << 8; - #endif -- s += (s >> 32); -- return (__force __wsum)s; -+ return (__force __wsum)from64to32(s); - } - EXPORT_SYMBOL(csum_tcpudp_nofold); - #endif diff --git a/patches/libata-allow-sata_sil24-to-opt-out-of-tag-ordered-submission.patch b/patches/libata-allow-sata_sil24-to-opt-out-of-tag-ordered-submission.patch deleted file mode 100644 index 8f03660..0000000 --- a/patches/libata-allow-sata_sil24-to-opt-out-of-tag-ordered-submission.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 72dd299d5039a336493993dcc63413cf31d0e662 Mon Sep 17 00:00:00 2001 -From: Dan Williams <dan.j.williams@intel.com> -Date: Fri, 16 Jan 2015 15:13:02 -0800 -Subject: libata: allow sata_sil24 to opt-out of tag ordered submission - -commit 72dd299d5039a336493993dcc63413cf31d0e662 upstream. - -Ronny reports: https://bugzilla.kernel.org/show_bug.cgi?id=87101 - "Since commit 8a4aeec8d "libata/ahci: accommodate tag ordered - controllers" the access to the harddisk on the first SATA-port is - failing on its first access. The access to the harddisk on the - second port is working normal. - - When reverting the above commit, access to both harddisks is working - fine again." - -Maintain tag ordered submission as the default, but allow sata_sil24 to -continue with the old behavior. - -Cc: Tejun Heo <tj@kernel.org> -Reported-by: Ronny Hegewald <Ronny.Hegewald@online.de> -Signed-off-by: Dan Williams <dan.j.williams@intel.com> -Signed-off-by: Tejun Heo <tj@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/ata/libata-core.c | 5 ++++- - drivers/ata/sata_sil24.c | 2 +- - include/linux/libata.h | 1 + - 3 files changed, 6 insertions(+), 2 deletions(-) - ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4712,7 +4712,10 @@ static struct ata_queued_cmd *ata_qc_new - return NULL; - - for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) { -- tag = tag < max_queue ? tag : 0; -+ if (ap->flags & ATA_FLAG_LOWTAG) -+ tag = i; -+ else -+ tag = tag < max_queue ? tag : 0; - - /* the last tag is reserved for internal command. */ - if (tag == ATA_TAG_INTERNAL) ---- a/drivers/ata/sata_sil24.c -+++ b/drivers/ata/sata_sil24.c -@@ -246,7 +246,7 @@ enum { - /* host flags */ - SIL24_COMMON_FLAGS = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA | - ATA_FLAG_NCQ | ATA_FLAG_ACPI_SATA | -- ATA_FLAG_AN | ATA_FLAG_PMP, -+ ATA_FLAG_AN | ATA_FLAG_PMP | ATA_FLAG_LOWTAG, - SIL24_FLAG_PCIX_IRQ_WOC = (1 << 24), /* IRQ loss errata on PCI-X */ - - IRQ_STAT_4PORTS = 0xf, ---- a/include/linux/libata.h -+++ b/include/linux/libata.h -@@ -207,6 +207,7 @@ enum { - ATA_FLAG_SW_ACTIVITY = (1 << 22), /* driver supports sw activity - * led */ - ATA_FLAG_NO_DIPM = (1 << 23), /* host not happy with DIPM */ -+ ATA_FLAG_LOWTAG = (1 << 24), /* host wants lowest available tag */ - - /* bits 24:31 of ap->flags are reserved for LLD specific flags */ - diff --git a/patches/libata-prevent-hsm-state-change-race-between-isr-and-pio.patch b/patches/libata-prevent-hsm-state-change-race-between-isr-and-pio.patch deleted file mode 100644 index 44f3635..0000000 --- a/patches/libata-prevent-hsm-state-change-race-between-isr-and-pio.patch +++ /dev/null @@ -1,70 +0,0 @@ -From ce7514526742c0898b837d4395f515b79dfb5a12 Mon Sep 17 00:00:00 2001 -From: David Jeffery <djeffery@redhat.com> -Date: Mon, 19 Jan 2015 13:03:25 -0600 -Subject: libata: prevent HSM state change race between ISR and PIO - -commit ce7514526742c0898b837d4395f515b79dfb5a12 upstream. - -It is possible for ata_sff_flush_pio_task() to set ap->hsm_task_state to -HSM_ST_IDLE in between the time __ata_sff_port_intr() checks for HSM_ST_IDLE -and before it calls ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG(). - -This problem is hard to reproduce making this patch hard to verify, but this -fix will prevent the race. - -I have not been able to reproduce the problem, but here is a crash dump from -a 2.6.32 kernel. - -On examining the ata port's state, its hsm_task_state field has a value of HSM_ST_IDLE: - -crash> struct ata_port.hsm_task_state ffff881c1121c000 - hsm_task_state = 0 - -Normally, this should not be possible as ata_sff_hsm_move() was called from ata_sff_host_intr(), -which checks hsm_task_state and won't call ata_sff_hsm_move() if it has a HSM_ST_IDLE value. - -PID: 11053 TASK: ffff8816e846cae0 CPU: 0 COMMAND: "sshd" - #0 [ffff88008ba03960] machine_kexec at ffffffff81038f3b - #1 [ffff88008ba039c0] crash_kexec at ffffffff810c5d92 - #2 [ffff88008ba03a90] oops_end at ffffffff8152b510 - #3 [ffff88008ba03ac0] die at ffffffff81010e0b - #4 [ffff88008ba03af0] do_trap at ffffffff8152ad74 - #5 [ffff88008ba03b50] do_invalid_op at ffffffff8100cf95 - #6 [ffff88008ba03bf0] invalid_op at ffffffff8100bf9b - [exception RIP: ata_sff_hsm_move+317] - RIP: ffffffff813a77ad RSP: ffff88008ba03ca0 RFLAGS: 00010097 - RAX: 0000000000000000 RBX: ffff881c1121dc60 RCX: 0000000000000000 - RDX: ffff881c1121dd10 RSI: ffff881c1121dc60 RDI: ffff881c1121c000 - RBP: ffff88008ba03d00 R8: 0000000000000000 R9: 000000000000002e - R10: 000000000001003f R11: 000000000000009b R12: ffff881c1121c000 - R13: 0000000000000000 R14: 0000000000000050 R15: ffff881c1121dd78 - ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 - #7 [ffff88008ba03d08] ata_sff_host_intr at ffffffff813a7fbd - #8 [ffff88008ba03d38] ata_sff_interrupt at ffffffff813a821e - #9 [ffff88008ba03d78] handle_IRQ_event at ffffffff810e6ec0 ---- - drivers/ata/libata-sff.c | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - ---- a/drivers/ata/libata-sff.c -+++ b/drivers/ata/libata-sff.c -@@ -1333,7 +1333,19 @@ void ata_sff_flush_pio_task(struct ata_p - DPRINTK("ENTER\n"); - - cancel_delayed_work_sync(&ap->sff_pio_task); -+ -+ /* -+ * We wanna reset the HSM state to IDLE. If we do so without -+ * grabbing the port lock, critical sections protected by it which -+ * expect the HSM state to stay stable may get surprised. For -+ * example, we may set IDLE in between the time -+ * __ata_sff_port_intr() checks for HSM_ST_IDLE and before it calls -+ * ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG(). -+ */ -+ spin_lock_irq(ap->lock); - ap->hsm_task_state = HSM_ST_IDLE; -+ spin_unlock_irq(ap->lock); -+ - ap->sff_pio_task_link = NULL; - - if (ata_msg_ctl(ap)) diff --git a/patches/mac80211-fix-multicast-led-blinking-and-counter.patch b/patches/mac80211-fix-multicast-led-blinking-and-counter.patch deleted file mode 100644 index 3b5663e..0000000 --- a/patches/mac80211-fix-multicast-led-blinking-and-counter.patch +++ /dev/null @@ -1,60 +0,0 @@ -From d025933e29872cb1fe19fc54d80e4dfa4ee5779c Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Andreas=20M=C3=BCller?= <goo@stapelspeicher.org> -Date: Fri, 12 Dec 2014 12:11:11 +0100 -Subject: mac80211: fix multicast LED blinking and counter -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit d025933e29872cb1fe19fc54d80e4dfa4ee5779c upstream. - -As multicast-frames can't be fragmented, "dot11MulticastReceivedFrameCount" -stopped being incremented after the use-after-free fix. Furthermore, the -RX-LED will be triggered by every multicast frame (which wouldn't happen -before) which wouldn't allow the LED to rest at all. - -Fixes https://bugzilla.kernel.org/show_bug.cgi?id=89431 which also had the -patch. - -Fixes: b8fff407a180 ("mac80211: fix use-after-free in defragmentation") -Signed-off-by: Andreas Müller <goo@stapelspeicher.org> -[rewrite commit message] -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/mac80211/rx.c | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -1486,14 +1486,14 @@ ieee80211_rx_h_defragment(struct ieee802 - sc = le16_to_cpu(hdr->seq_ctrl); - frag = sc & IEEE80211_SCTL_FRAG; - -- if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) -- goto out; -- - if (is_multicast_ether_addr(hdr->addr1)) { - rx->local->dot11MulticastReceivedFrameCount++; -- goto out; -+ goto out_no_led; - } - -+ if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) -+ goto out; -+ - I802_DEBUG_INC(rx->local->rx_handlers_fragments); - - if (skb_linearize(rx->skb)) -@@ -1584,9 +1584,10 @@ ieee80211_rx_h_defragment(struct ieee802 - status->rx_flags |= IEEE80211_RX_FRAGMENTED; - - out: -+ ieee80211_led_rx(rx->local); -+ out_no_led: - if (rx->sta) - rx->sta->rx_packets++; -- ieee80211_led_rx(rx->local); - return RX_CONTINUE; - } - diff --git a/patches/megaraid_sas-corrected-return-of-wait_event-from-abort-frame-path.patch b/patches/megaraid_sas-corrected-return-of-wait_event-from-abort-frame-path.patch deleted file mode 100644 index d39eba0..0000000 --- a/patches/megaraid_sas-corrected-return-of-wait_event-from-abort-frame-path.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 170c238701ec38b1829321b17c70671c101bac55 Mon Sep 17 00:00:00 2001 -From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com> -Date: Mon, 17 Nov 2014 15:24:23 +0530 -Subject: megaraid_sas: corrected return of wait_event from abort frame path - -commit 170c238701ec38b1829321b17c70671c101bac55 upstream. - -Corrected wait_event() call which was waiting for wrong completion -status (0xFF). - -Signed-off-by: Sumit Saxena <sumit.saxena@avagotech.com> -Signed-off-by: Kashyap Desai <kashyap.desai@avagotech.com> -Reviewed-by: Tomas Henzl <thenzl@redhat.com> -Signed-off-by: Christoph Hellwig <hch@lst.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/megaraid/megaraid_sas_base.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -919,7 +919,7 @@ megasas_issue_blocked_abort_cmd(struct m - abort_fr->abort_mfi_phys_addr_hi = 0; - - cmd->sync_cmd = 1; -- cmd->cmd_status = 0xFF; -+ cmd->cmd_status = ENODATA; - - instance->instancet->issue_dcmd(instance, cmd); - diff --git a/patches/mfd-tc6393xb-fail-ohci-suspend-if-full-state-restore-is-required.patch b/patches/mfd-tc6393xb-fail-ohci-suspend-if-full-state-restore-is-required.patch deleted file mode 100644 index 05472ca..0000000 --- a/patches/mfd-tc6393xb-fail-ohci-suspend-if-full-state-restore-is-required.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 1a5fb99de4850cba710d91becfa2c65653048589 Mon Sep 17 00:00:00 2001 -From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> -Date: Fri, 24 Oct 2014 21:19:57 +0400 -Subject: mfd: tc6393xb: Fail ohci suspend if full state restore is required - -commit 1a5fb99de4850cba710d91becfa2c65653048589 upstream. - -Some boards with TC6393XB chip require full state restore during system -resume thanks to chip's VCC being cut off during suspend (Sharp SL-6000 -tosa is one of them). Failing to do so would result in ohci Oops on -resume due to internal memory contentes being changed. Fail ohci suspend -on tc6393xb is full state restore is required. - -Recommended workaround is to unbind tmio-ohci driver before suspend and -rebind it after resume. - -Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> -Signed-off-by: Lee Jones <lee.jones@linaro.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/mfd/tc6393xb.c | 13 ++++++++++++- - 1 file changed, 12 insertions(+), 1 deletion(-) - ---- a/drivers/mfd/tc6393xb.c -+++ b/drivers/mfd/tc6393xb.c -@@ -263,6 +263,17 @@ static int tc6393xb_ohci_disable(struct - return 0; - } - -+static int tc6393xb_ohci_suspend(struct platform_device *dev) -+{ -+ struct tc6393xb_platform_data *tcpd = dev_get_platdata(dev->dev.parent); -+ -+ /* We can't properly store/restore OHCI state, so fail here */ -+ if (tcpd->resume_restore) -+ return -EBUSY; -+ -+ return tc6393xb_ohci_disable(dev); -+} -+ - static int tc6393xb_fb_enable(struct platform_device *dev) - { - struct tc6393xb *tc6393xb = dev_get_drvdata(dev->dev.parent); -@@ -403,7 +414,7 @@ static struct mfd_cell __devinitdata tc6 - .num_resources = ARRAY_SIZE(tc6393xb_ohci_resources), - .resources = tc6393xb_ohci_resources, - .enable = tc6393xb_ohci_enable, -- .suspend = tc6393xb_ohci_disable, -+ .suspend = tc6393xb_ohci_suspend, - .resume = tc6393xb_ohci_enable, - .disable = tc6393xb_ohci_disable, - }, diff --git a/patches/mips-fix-kernel-lockup-or-crash-after-cpu-offline-online.patch b/patches/mips-fix-kernel-lockup-or-crash-after-cpu-offline-online.patch deleted file mode 100644 index 01f6b6c..0000000 --- a/patches/mips-fix-kernel-lockup-or-crash-after-cpu-offline-online.patch +++ /dev/null @@ -1,45 +0,0 @@ -From c7754e75100ed5e3068ac5085747f2bfc386c8d6 Mon Sep 17 00:00:00 2001 -From: Hemmo Nieminen <hemmo.nieminen@iki.fi> -Date: Thu, 15 Jan 2015 23:01:59 +0200 -Subject: MIPS: Fix kernel lockup or crash after CPU offline/online - -commit c7754e75100ed5e3068ac5085747f2bfc386c8d6 upstream. - -As printk() invocation can cause e.g. a TLB miss, printk() cannot be -called before the exception handlers have been properly initialized. -This can happen e.g. when netconsole has been loaded as a kernel module -and the TLB table has been cleared when a CPU was offline. - -Call cpu_report() in start_secondary() only after the exception handlers -have been initialized to fix this. - -Without the patch the kernel will randomly either lockup or crash -after a CPU is onlined and the console driver is a module. - -Signed-off-by: Hemmo Nieminen <hemmo.nieminen@iki.fi> -Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi> -Cc: David Daney <david.daney@cavium.com> -Cc: linux-mips@linux-mips.org -Cc: linux-kernel@vger.kernel.org -Patchwork: https://patchwork.linux-mips.org/patch/8953/ -Signed-off-by: Ralf Baechle <ralf@linux-mips.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/mips/kernel/smp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/arch/mips/kernel/smp.c -+++ b/arch/mips/kernel/smp.c -@@ -105,10 +105,10 @@ asmlinkage __cpuinit void start_secondar - if ((read_c0_tcbind() & TCBIND_CURTC) == 0) - #endif /* CONFIG_MIPS_MT_SMTC */ - cpu_probe(); -- cpu_report(); - per_cpu_trap_init(); - mips_clockevent_init(); - mp_ops->init_secondary(); -+ cpu_report(); - - /* - * XXX parity protection should be folded in here when it's converted diff --git a/patches/mips-irq-fix-disable_irq-on-cpu-irqs.patch b/patches/mips-irq-fix-disable_irq-on-cpu-irqs.patch deleted file mode 100644 index 40d1196..0000000 --- a/patches/mips-irq-fix-disable_irq-on-cpu-irqs.patch +++ /dev/null @@ -1,47 +0,0 @@ -From a3e6c1eff54878506b2dddcc202df9cc8180facb Mon Sep 17 00:00:00 2001 -From: Felix Fietkau <nbd@openwrt.org> -Date: Thu, 15 Jan 2015 19:05:28 +0100 -Subject: MIPS: IRQ: Fix disable_irq on CPU IRQs - -commit a3e6c1eff54878506b2dddcc202df9cc8180facb upstream. - -If the irq_chip does not define .irq_disable, any call to disable_irq -will defer disabling the IRQ until it fires while marked as disabled. -This assumes that the handler function checks for this condition, which -handle_percpu_irq does not. In this case, calling disable_irq leads to -an IRQ storm, if the interrupt fires while disabled. - -This optimization is only useful when disabling the IRQ is slow, which -is not true for the MIPS CPU IRQ. - -Disable this optimization by implementing .irq_disable and .irq_enable - -Signed-off-by: Felix Fietkau <nbd@openwrt.org> -Cc: linux-mips@linux-mips.org -Patchwork: https://patchwork.linux-mips.org/patch/8949/ -Signed-off-by: Ralf Baechle <ralf@linux-mips.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/mips/kernel/irq_cpu.c | 4 ++++ - 1 file changed, 4 insertions(+) - ---- a/arch/mips/kernel/irq_cpu.c -+++ b/arch/mips/kernel/irq_cpu.c -@@ -55,6 +55,8 @@ static struct irq_chip mips_cpu_irq_cont - .irq_mask_ack = mask_mips_irq, - .irq_unmask = unmask_mips_irq, - .irq_eoi = unmask_mips_irq, -+ .irq_disable = mask_mips_irq, -+ .irq_enable = unmask_mips_irq, - }; - - /* -@@ -91,6 +93,8 @@ static struct irq_chip mips_mt_cpu_irq_c - .irq_mask_ack = mips_mt_cpu_irq_ack, - .irq_unmask = unmask_mips_irq, - .irq_eoi = unmask_mips_irq, -+ .irq_disable = mask_mips_irq, -+ .irq_enable = unmask_mips_irq, - }; - - void __init mips_cpu_irq_init(void) diff --git a/patches/mips-loongson-make-platform-serial-setup-always-built-in.patch b/patches/mips-loongson-make-platform-serial-setup-always-built-in.patch deleted file mode 100644 index 50ace4a..0000000 --- a/patches/mips-loongson-make-platform-serial-setup-always-built-in.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 26927f76499849e095714452b8a4e09350f6a3b9 Mon Sep 17 00:00:00 2001 -From: Aaro Koskinen <aaro.koskinen@iki.fi> -Date: Thu, 20 Nov 2014 01:05:38 +0200 -Subject: MIPS: Loongson: Make platform serial setup always built-in. - -commit 26927f76499849e095714452b8a4e09350f6a3b9 upstream. - -If SERIAL_8250 is compiled as a module, the platform specific setup -for Loongson will be a module too, and it will not work very well. -At least on Loongson 3 it will trigger a build failure, -since loongson_sysconf is not exported to modules. - -Fix by making the platform specific serial code always built-in. - -Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi> -Reported-by: Ralf Baechle <ralf@linux-mips.org> -Cc: linux-mips@linux-mips.org -Cc: Huacai Chen <chenhc@lemote.com> -Cc: Markos Chandras <Markos.Chandras@imgtec.com> -Patchwork: https://patchwork.linux-mips.org/patch/8533/ -Signed-off-by: Ralf Baechle <ralf@linux-mips.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/mips/loongson/common/Makefile | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/arch/mips/loongson/common/Makefile -+++ b/arch/mips/loongson/common/Makefile -@@ -10,7 +10,8 @@ obj-$(CONFIG_GENERIC_GPIO) += gpio.o - # Serial port support - # - obj-$(CONFIG_EARLY_PRINTK) += early_printk.o --obj-$(CONFIG_SERIAL_8250) += serial.o -+loongson-serial-$(CONFIG_SERIAL_8250) := serial.o -+obj-y += $(loongson-serial-m) $(loongson-serial-y) - obj-$(CONFIG_LOONGSON_UART_BASE) += uart_base.o - obj-$(CONFIG_LOONGSON_MC146818) += rtc.o - diff --git a/patches/mm-don-t-count-the-stack-guard-page-towards-rlimit_stack.patch b/patches/mm-don-t-count-the-stack-guard-page-towards-rlimit_stack.patch deleted file mode 100644 index cbbf267..0000000 --- a/patches/mm-don-t-count-the-stack-guard-page-towards-rlimit_stack.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 690eac53daff34169a4d74fc7bfbd388c4896abb Mon Sep 17 00:00:00 2001 -From: Linus Torvalds <torvalds@linux-foundation.org> -Date: Sun, 11 Jan 2015 11:33:57 -0800 -Subject: mm: Don't count the stack guard page towards RLIMIT_STACK - -commit 690eac53daff34169a4d74fc7bfbd388c4896abb upstream. - -Commit fee7e49d4514 ("mm: propagate error from stack expansion even for -guard page") made sure that we return the error properly for stack -growth conditions. It also theorized that counting the guard page -towards the stack limit might break something, but also said "Let's see -if anybody notices". - -Somebody did notice. Apparently android-x86 sets the stack limit very -close to the limit indeed, and including the guard page in the rlimit -check causes the android 'zygote' process problems. - -So this adds the (fairly trivial) code to make the stack rlimit check be -against the actual real stack size, rather than the size of the vma that -includes the guard page. - -Reported-and-tested-by: Chih-Wei Huang <cwhuang@android-x86.org> -Cc: Jay Foad <jay.foad@gmail.com> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/mmap.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -1727,14 +1727,17 @@ static int acct_stack_growth(struct vm_a - { - struct mm_struct *mm = vma->vm_mm; - struct rlimit *rlim = current->signal->rlim; -- unsigned long new_start; -+ unsigned long new_start, actual_size; - - /* address space limit tests */ - if (!may_expand_vm(mm, grow)) - return -ENOMEM; - - /* Stack limit test */ -- if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur)) -+ actual_size = size; -+ if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN))) -+ actual_size -= PAGE_SIZE; -+ if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur)) - return -ENOMEM; - - /* mlock limit tests */ diff --git a/patches/mm-fix-anon_vma-degree-underflow-in-anon_vma-endless-growing-prevention.patch b/patches/mm-fix-anon_vma-degree-underflow-in-anon_vma-endless-growing-prevention.patch deleted file mode 100644 index 5ca98fa..0000000 --- a/patches/mm-fix-anon_vma-degree-underflow-in-anon_vma-endless-growing-prevention.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 3fe89b3e2a7bbf3e97657104b9b33a9d81b950b3 Mon Sep 17 00:00:00 2001 -From: Leon Yu <chianglungyu@gmail.com> -Date: Wed, 25 Mar 2015 15:55:11 -0700 -Subject: mm: fix anon_vma->degree underflow in anon_vma endless growing - prevention - -commit 3fe89b3e2a7bbf3e97657104b9b33a9d81b950b3 upstream. - -I have constantly stumbled upon "kernel BUG at mm/rmap.c:399!" after -upgrading to 3.19 and had no luck with 4.0-rc1 neither. - -So, after looking into new logic introduced by commit 7a3ef208e662 ("mm: -prevent endless growth of anon_vma hierarchy"), I found chances are that -unlink_anon_vmas() is called without incrementing dst->anon_vma->degree -in anon_vma_clone() due to allocation failure. If dst->anon_vma is not -NULL in error path, its degree will be incorrectly decremented in -unlink_anon_vmas() and eventually underflow when exiting as a result of -another call to unlink_anon_vmas(). That's how "kernel BUG at -mm/rmap.c:399!" is triggered for me. - -This patch fixes the underflow by dropping dst->anon_vma when allocation -fails. It's safe to do so regardless of original value of dst->anon_vma -because dst->anon_vma doesn't have valid meaning if anon_vma_clone() -fails. Besides, callers don't care dst->anon_vma in such case neither. - -Also suggested by Michal Hocko, we can clean up vma_adjust() a bit as -anon_vma_clone() now does the work. - -[akpm@linux-foundation.org: tweak comment] -Fixes: 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy") -Signed-off-by: Leon Yu <chianglungyu@gmail.com> -Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com> -Reviewed-by: Michal Hocko <mhocko@suse.cz> -Acked-by: Rik van Riel <riel@redhat.com> -Acked-by: David Rientjes <rientjes@google.com> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/mmap.c | 4 +--- - mm/rmap.c | 7 +++++++ - 2 files changed, 8 insertions(+), 3 deletions(-) - ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -571,10 +571,8 @@ again: remove_next = 1 + (end > next-> - - importer->anon_vma = exporter->anon_vma; - error = anon_vma_clone(importer, exporter); -- if (error) { -- importer->anon_vma = NULL; -+ if (error) - return error; -- } - } - } - ---- a/mm/rmap.c -+++ b/mm/rmap.c -@@ -292,6 +292,13 @@ int anon_vma_clone(struct vm_area_struct - return 0; - - enomem_failure: -+ /* -+ * dst->anon_vma is dropped here otherwise its degree can be incorrectly -+ * decremented in unlink_anon_vmas(). -+ * We can safely do this because callers of anon_vma_clone() don't care -+ * about dst->anon_vma if anon_vma_clone() failed. -+ */ -+ dst->anon_vma = NULL; - unlink_anon_vmas(dst); - return -ENOMEM; - } diff --git a/patches/mm-fix-corner-case-in-anon_vma-endless-growing-prevention.patch b/patches/mm-fix-corner-case-in-anon_vma-endless-growing-prevention.patch deleted file mode 100644 index a18cb4e..0000000 --- a/patches/mm-fix-corner-case-in-anon_vma-endless-growing-prevention.patch +++ /dev/null @@ -1,59 +0,0 @@ -From b800c91a0517071156e772d4fb329ad33590da62 Mon Sep 17 00:00:00 2001 -From: Konstantin Khlebnikov <koct9i@gmail.com> -Date: Sun, 11 Jan 2015 16:54:06 +0300 -Subject: mm: fix corner case in anon_vma endless growing prevention - -commit b800c91a0517071156e772d4fb329ad33590da62 upstream. - -Fix for BUG_ON(anon_vma->degree) splashes in unlink_anon_vmas() ("kernel -BUG at mm/rmap.c:399!") caused by commit 7a3ef208e662 ("mm: prevent -endless growth of anon_vma hierarchy") - -Anon_vma_clone() is usually called for a copy of source vma in -destination argument. If source vma has anon_vma it should be already -in dst->anon_vma. NULL in dst->anon_vma is used as a sign that it's -called from anon_vma_fork(). In this case anon_vma_clone() finds -anon_vma for reusing. - -Vma_adjust() calls it differently and this breaks anon_vma reusing -logic: anon_vma_clone() links vma to old anon_vma and updates degree -counters but vma_adjust() overrides vma->anon_vma right after that. As -a result final unlink_anon_vmas() decrements degree for wrong anon_vma. - -This patch assigns ->anon_vma before calling anon_vma_clone(). - -Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com> -Reported-and-tested-by: Chris Clayton <chris2553@googlemail.com> -Reported-and-tested-by: Oded Gabbay <oded.gabbay@amd.com> -Reported-and-tested-by: Chih-Wei Huang <cwhuang@android-x86.org> -Acked-by: Rik van Riel <riel@redhat.com> -Acked-by: Vlastimil Babka <vbabka@suse.cz> -Cc: Daniel Forrest <dan.forrest@ssec.wisc.edu> -Cc: Michal Hocko <mhocko@suse.cz> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -[lizf: Backported to 3.4: define variable @error and return this instead - of returning -ENOMEM] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/mmap.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -567,9 +567,14 @@ again: remove_next = 1 + (end > next-> - * shrinking vma had, to cover any anon pages imported. - */ - if (exporter && exporter->anon_vma && !importer->anon_vma) { -- if (anon_vma_clone(importer, exporter)) -- return -ENOMEM; -+ int error; -+ - importer->anon_vma = exporter->anon_vma; -+ error = anon_vma_clone(importer, exporter); -+ if (error) { -+ importer->anon_vma = NULL; -+ return error; -+ } - } - } - diff --git a/patches/mm-fix-swapoff-hang-after-page-migration-and-fork.patch b/patches/mm-fix-swapoff-hang-after-page-migration-and-fork.patch deleted file mode 100644 index 408dd8a..0000000 --- a/patches/mm-fix-swapoff-hang-after-page-migration-and-fork.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 2022b4d18a491a578218ce7a4eca8666db895a73 Mon Sep 17 00:00:00 2001 -From: Hugh Dickins <hughd@google.com> -Date: Tue, 2 Dec 2014 15:59:39 -0800 -Subject: mm: fix swapoff hang after page migration and fork - -commit 2022b4d18a491a578218ce7a4eca8666db895a73 upstream. - -I've been seeing swapoff hangs in recent testing: it's cycling around -trying unsuccessfully to find an mm for some remaining pages of swap. - -I have been exercising swap and page migration more heavily recently, -and now notice a long-standing error in copy_one_pte(): it's trying to -add dst_mm to swapoff's mmlist when it finds a swap entry, but is doing -so even when it's a migration entry or an hwpoison entry. - -Which wouldn't matter much, except it adds dst_mm next to src_mm, -assuming src_mm is already on the mmlist: which may not be so. Then if -pages are later swapped out from dst_mm, swapoff won't be able to find -where to replace them. - -There's already a !non_swap_entry() test for stats: move that up before -the swap_duplicate() and the addition to mmlist. - -Signed-off-by: Hugh Dickins <hughd@google.com> -Cc: Kelley Nielsen <kelleynnn@gmail.com> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/memory.c | 24 ++++++++++++------------ - 1 file changed, 12 insertions(+), 12 deletions(-) - ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -847,20 +847,20 @@ copy_one_pte(struct mm_struct *dst_mm, s - if (!pte_file(pte)) { - swp_entry_t entry = pte_to_swp_entry(pte); - -- if (swap_duplicate(entry) < 0) -- return entry.val; -+ if (likely(!non_swap_entry(entry))) { -+ if (swap_duplicate(entry) < 0) -+ return entry.val; - -- /* make sure dst_mm is on swapoff's mmlist. */ -- if (unlikely(list_empty(&dst_mm->mmlist))) { -- spin_lock(&mmlist_lock); -- if (list_empty(&dst_mm->mmlist)) -- list_add(&dst_mm->mmlist, -- &src_mm->mmlist); -- spin_unlock(&mmlist_lock); -- } -- if (likely(!non_swap_entry(entry))) -+ /* make sure dst_mm is on swapoff's mmlist. */ -+ if (unlikely(list_empty(&dst_mm->mmlist))) { -+ spin_lock(&mmlist_lock); -+ if (list_empty(&dst_mm->mmlist)) -+ list_add(&dst_mm->mmlist, -+ &src_mm->mmlist); -+ spin_unlock(&mmlist_lock); -+ } - rss[MM_SWAPENTS]++; -- else if (is_migration_entry(entry)) { -+ } else if (is_migration_entry(entry)) { - page = migration_entry_to_page(entry); - - if (PageAnon(page)) diff --git a/patches/mm-prevent-endless-growth-of-anon_vma-hierarchy.patch b/patches/mm-prevent-endless-growth-of-anon_vma-hierarchy.patch deleted file mode 100644 index 8d91d91..0000000 --- a/patches/mm-prevent-endless-growth-of-anon_vma-hierarchy.patch +++ /dev/null @@ -1,180 +0,0 @@ -From 7a3ef208e662f4b63d43a23f61a64a129c525bbc Mon Sep 17 00:00:00 2001 -From: Konstantin Khlebnikov <koct9i@gmail.com> -Date: Thu, 8 Jan 2015 14:32:15 -0800 -Subject: mm: prevent endless growth of anon_vma hierarchy - -commit 7a3ef208e662f4b63d43a23f61a64a129c525bbc upstream. - -Constantly forking task causes unlimited grow of anon_vma chain. Each -next child allocates new level of anon_vmas and links vma to all -previous levels because pages might be inherited from any level. - -This patch adds heuristic which decides to reuse existing anon_vma -instead of forking new one. It adds counter anon_vma->degree which -counts linked vmas and directly descending anon_vmas and reuses anon_vma -if counter is lower than two. As a result each anon_vma has either vma -or at least two descending anon_vmas. In such trees half of nodes are -leafs with alive vmas, thus count of anon_vmas is no more than two times -bigger than count of vmas. - -This heuristic reuses anon_vmas as few as possible because each reuse -adds false aliasing among vmas and rmap walker ought to scan more ptes -when it searches where page is might be mapped. - -Link: http://lkml.kernel.org/r/20120816024610.GA5350@evergreen.ssec.wisc.edu -Fixes: 5beb49305251 ("mm: change anon_vma linking to fix multi-process server scalability issue") -[akpm@linux-foundation.org: fix typo, per Rik] -Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com> -Reported-by: Daniel Forrest <dan.forrest@ssec.wisc.edu> -Tested-by: Michal Hocko <mhocko@suse.cz> -Tested-by: Jerome Marchand <jmarchan@redhat.com> -Reviewed-by: Michal Hocko <mhocko@suse.cz> -Reviewed-by: Rik van Riel <riel@redhat.com> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - include/linux/rmap.h | 10 ++++++++++ - mm/rmap.c | 42 +++++++++++++++++++++++++++++++++++++++++- - 2 files changed, 51 insertions(+), 1 deletion(-) - ---- a/mm/rmap.c -+++ b/mm/rmap.c -@@ -72,6 +72,8 @@ static inline struct anon_vma *anon_vma_ - anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL); - if (anon_vma) { - atomic_set(&anon_vma->refcount, 1); -+ anon_vma->degree = 1; /* Reference for first vma */ -+ anon_vma->parent = anon_vma; - /* - * Initialise the anon_vma root to point to itself. If called - * from fork, the root will be reset to the parents anon_vma. -@@ -193,6 +195,8 @@ int anon_vma_prepare(struct vm_area_stru - if (likely(!vma->anon_vma)) { - vma->anon_vma = anon_vma; - anon_vma_chain_link(vma, avc, anon_vma); -+ /* vma reference or self-parent link for new root */ -+ anon_vma->degree++; - allocated = NULL; - avc = NULL; - } -@@ -241,6 +245,14 @@ static inline void unlock_anon_vma_root( - /* - * Attach the anon_vmas from src to dst. - * Returns 0 on success, -ENOMEM on failure. -+ * -+ * If dst->anon_vma is NULL this function tries to find and reuse existing -+ * anon_vma which has no vmas and only one child anon_vma. This prevents -+ * degradation of anon_vma hierarchy to endless linear chain in case of -+ * constantly forking task. On the other hand, an anon_vma with more than one -+ * child isn't reused even if there was no alive vma, thus rmap walker has a -+ * good chance of avoiding scanning the whole hierarchy when it searches where -+ * page is mapped. - */ - int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) - { -@@ -261,7 +273,21 @@ int anon_vma_clone(struct vm_area_struct - anon_vma = pavc->anon_vma; - root = lock_anon_vma_root(root, anon_vma); - anon_vma_chain_link(dst, avc, anon_vma); -+ -+ /* -+ * Reuse existing anon_vma if its degree lower than two, -+ * that means it has no vma and only one anon_vma child. -+ * -+ * Do not chose parent anon_vma, otherwise first child -+ * will always reuse it. Root anon_vma is never reused: -+ * it has self-parent reference and at least one child. -+ */ -+ if (!dst->anon_vma && anon_vma != src->anon_vma && -+ anon_vma->degree < 2) -+ dst->anon_vma = anon_vma; - } -+ if (dst->anon_vma) -+ dst->anon_vma->degree++; - unlock_anon_vma_root(root); - return 0; - -@@ -329,6 +355,9 @@ int anon_vma_fork(struct vm_area_struct - if (!pvma->anon_vma) - return 0; - -+ /* Drop inherited anon_vma, we'll reuse existing or allocate new. */ -+ vma->anon_vma = NULL; -+ - /* - * First, attach the new VMA to the parent VMA's anon_vmas, - * so rmap can find non-COWed pages in child processes. -@@ -336,6 +365,10 @@ int anon_vma_fork(struct vm_area_struct - if (anon_vma_clone(vma, pvma)) - return -ENOMEM; - -+ /* An existing anon_vma has been reused, all done then. */ -+ if (vma->anon_vma) -+ return 0; -+ - /* Then add our own anon_vma. */ - anon_vma = anon_vma_alloc(); - if (!anon_vma) -@@ -349,6 +382,7 @@ int anon_vma_fork(struct vm_area_struct - * lock any of the anon_vmas in this anon_vma tree. - */ - anon_vma->root = pvma->anon_vma->root; -+ anon_vma->parent = pvma->anon_vma; - /* - * With refcounts, an anon_vma can stay around longer than the - * process it belongs to. The root anon_vma needs to be pinned until -@@ -359,6 +393,7 @@ int anon_vma_fork(struct vm_area_struct - vma->anon_vma = anon_vma; - anon_vma_lock(anon_vma); - anon_vma_chain_link(vma, avc, anon_vma); -+ anon_vma->parent->degree++; - anon_vma_unlock(anon_vma); - - return 0; -@@ -389,12 +424,16 @@ void unlink_anon_vmas(struct vm_area_str - * Leave empty anon_vmas on the list - we'll need - * to free them outside the lock. - */ -- if (list_empty(&anon_vma->head)) -+ if (list_empty(&anon_vma->head)) { -+ anon_vma->parent->degree--; - continue; -+ } - - list_del(&avc->same_vma); - anon_vma_chain_free(avc); - } -+ if (vma->anon_vma) -+ vma->anon_vma->degree--; - unlock_anon_vma_root(root); - - /* -@@ -405,6 +444,7 @@ void unlink_anon_vmas(struct vm_area_str - list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) { - struct anon_vma *anon_vma = avc->anon_vma; - -+ BUG_ON(anon_vma->degree); - put_anon_vma(anon_vma); - - list_del(&avc->same_vma); ---- a/include/linux/rmap.h -+++ b/include/linux/rmap.h -@@ -37,6 +37,16 @@ struct anon_vma { - atomic_t refcount; - - /* -+ * Count of child anon_vmas and VMAs which points to this anon_vma. -+ * -+ * This counter is used for making decision about reusing anon_vma -+ * instead of forking new one. See comments in function anon_vma_clone. -+ */ -+ unsigned degree; -+ -+ struct anon_vma *parent; /* Parent of this anon_vma */ -+ -+ /* - * NOTE: the LSB of the head.next is set by - * mm_take_all_locks() _after_ taking the above lock. So the - * head must only be read/written after taking the above lock diff --git a/patches/mm-propagate-error-from-stack-expansion-even-for-guard-page.patch b/patches/mm-propagate-error-from-stack-expansion-even-for-guard-page.patch deleted file mode 100644 index 3ba9b5f..0000000 --- a/patches/mm-propagate-error-from-stack-expansion-even-for-guard-page.patch +++ /dev/null @@ -1,67 +0,0 @@ -From fee7e49d45149fba60156f5b59014f764d3e3728 Mon Sep 17 00:00:00 2001 -From: Linus Torvalds <torvalds@linux-foundation.org> -Date: Tue, 6 Jan 2015 13:00:05 -0800 -Subject: mm: propagate error from stack expansion even for guard page - -commit fee7e49d45149fba60156f5b59014f764d3e3728 upstream. - -Jay Foad reports that the address sanitizer test (asan) sometimes gets -confused by a stack pointer that ends up being outside the stack vma -that is reported by /proc/maps. - -This happens due to an interaction between RLIMIT_STACK and the guard -page: when we do the guard page check, we ignore the potential error -from the stack expansion, which effectively results in a missing guard -page, since the expected stack expansion won't have been done. - -And since /proc/maps explicitly ignores the guard page (commit -d7824370e263: "mm: fix up some user-visible effects of the stack guard -page"), the stack pointer ends up being outside the reported stack area. - -This is the minimal patch: it just propagates the error. It also -effectively makes the guard page part of the stack limit, which in turn -measn that the actual real stack is one page less than the stack limit. - -Let's see if anybody notices. We could teach acct_stack_growth() to -allow an extra page for a grow-up/grow-down stack in the rlimit test, -but I don't want to add more complexity if it isn't needed. - -Reported-and-tested-by: Jay Foad <jay.foad@gmail.com> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - include/linux/mm.h | 2 +- - mm/memory.c | 4 ++-- - 2 files changed, 3 insertions(+), 3 deletions(-) - ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -1456,7 +1456,7 @@ extern int expand_downwards(struct vm_ar - #if VM_GROWSUP - extern int expand_upwards(struct vm_area_struct *vma, unsigned long address); - #else -- #define expand_upwards(vma, address) do { } while (0) -+ #define expand_upwards(vma, address) (0) - #endif - - /* Look up the first VMA which satisfies addr < vm_end, NULL if none. */ ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -3137,7 +3137,7 @@ static inline int check_stack_guard_page - if (prev && prev->vm_end == address) - return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM; - -- expand_downwards(vma, address - PAGE_SIZE); -+ return expand_downwards(vma, address - PAGE_SIZE); - } - if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) { - struct vm_area_struct *next = vma->vm_next; -@@ -3146,7 +3146,7 @@ static inline int check_stack_guard_page - if (next && next->vm_start == address + PAGE_SIZE) - return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM; - -- expand_upwards(vma, address + PAGE_SIZE); -+ return expand_upwards(vma, address + PAGE_SIZE); - } - return 0; - } diff --git a/patches/mm-protect-set_page_dirty-from-ongoing-truncation.patch b/patches/mm-protect-set_page_dirty-from-ongoing-truncation.patch deleted file mode 100644 index 52b6f9e..0000000 --- a/patches/mm-protect-set_page_dirty-from-ongoing-truncation.patch +++ /dev/null @@ -1,176 +0,0 @@ -From 2d6d7f98284648c5ed113fe22a132148950b140f Mon Sep 17 00:00:00 2001 -From: Johannes Weiner <hannes@cmpxchg.org> -Date: Thu, 8 Jan 2015 14:32:18 -0800 -Subject: mm: protect set_page_dirty() from ongoing truncation - -commit 2d6d7f98284648c5ed113fe22a132148950b140f upstream. - -Tejun, while reviewing the code, spotted the following race condition -between the dirtying and truncation of a page: - -__set_page_dirty_nobuffers() __delete_from_page_cache() - if (TestSetPageDirty(page)) - page->mapping = NULL - if (PageDirty()) - dec_zone_page_state(page, NR_FILE_DIRTY); - dec_bdi_stat(mapping->backing_dev_info, BDI_RECLAIMABLE); - if (page->mapping) - account_page_dirtied(page) - __inc_zone_page_state(page, NR_FILE_DIRTY); - __inc_bdi_stat(mapping->backing_dev_info, BDI_RECLAIMABLE); - -which results in an imbalance of NR_FILE_DIRTY and BDI_RECLAIMABLE. - -Dirtiers usually lock out truncation, either by holding the page lock -directly, or in case of zap_pte_range(), by pinning the mapcount with -the page table lock held. The notable exception to this rule, though, -is do_wp_page(), for which this race exists. However, do_wp_page() -already waits for a locked page to unlock before setting the dirty bit, -in order to prevent a race where clear_page_dirty() misses the page bit -in the presence of dirty ptes. Upgrade that wait to a fully locked -set_page_dirty() to also cover the situation explained above. - -Afterwards, the code in set_page_dirty() dealing with a truncation race -is no longer needed. Remove it. - -Reported-by: Tejun Heo <tj@kernel.org> -Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> -Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> -Reviewed-by: Jan Kara <jack@suse.cz> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -[lizf: Backported to 3.4: - - adjust context - - use VM_BUG_ON() instead of VM_BUG_ON_PAGE()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - include/linux/writeback.h | 1 - - mm/memory.c | 27 +++++++++++++++++---------- - mm/page-writeback.c | 43 ++++++++++++------------------------------- - 3 files changed, 29 insertions(+), 42 deletions(-) - ---- a/include/linux/writeback.h -+++ b/include/linux/writeback.h -@@ -186,7 +186,6 @@ int write_cache_pages(struct address_spa - struct writeback_control *wbc, writepage_t writepage, - void *data); - int do_writepages(struct address_space *mapping, struct writeback_control *wbc); --void set_page_dirty_balance(struct page *page, int page_mkwrite); - void writeback_set_ratelimit(void); - void tag_pages_for_writeback(struct address_space *mapping, - pgoff_t start, pgoff_t end); ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -2681,18 +2681,25 @@ reuse: - if (!dirty_page) - return ret; - -- /* -- * Yes, Virginia, this is actually required to prevent a race -- * with clear_page_dirty_for_io() from clearing the page dirty -- * bit after it clear all dirty ptes, but before a racing -- * do_wp_page installs a dirty pte. -- * -- * __do_fault is protected similarly. -- */ - if (!page_mkwrite) { -- wait_on_page_locked(dirty_page); -- set_page_dirty_balance(dirty_page, page_mkwrite); -+ struct address_space *mapping; -+ int dirtied; -+ -+ lock_page(dirty_page); -+ dirtied = set_page_dirty(dirty_page); -+ VM_BUG_ON(dirty_page); -+ mapping = dirty_page->mapping; -+ unlock_page(dirty_page); -+ -+ if (dirtied && mapping) { -+ /* -+ * Some device drivers do not set page.mapping -+ * but still dirty their pages -+ */ -+ balance_dirty_pages_ratelimited(mapping); -+ } - } -+ - put_page(dirty_page); - if (page_mkwrite) { - struct address_space *mapping = dirty_page->mapping; ---- a/mm/page-writeback.c -+++ b/mm/page-writeback.c -@@ -1394,16 +1394,6 @@ pause: - bdi_start_background_writeback(bdi); - } - --void set_page_dirty_balance(struct page *page, int page_mkwrite) --{ -- if (set_page_dirty(page) || page_mkwrite) { -- struct address_space *mapping = page_mapping(page); -- -- if (mapping) -- balance_dirty_pages_ratelimited(mapping); -- } --} -- - static DEFINE_PER_CPU(int, bdp_ratelimits); - - /* -@@ -1981,32 +1971,25 @@ EXPORT_SYMBOL(account_page_writeback); - * page dirty in that case, but not all the buffers. This is a "bottom-up" - * dirtying, whereas __set_page_dirty_buffers() is a "top-down" dirtying. - * -- * Most callers have locked the page, which pins the address_space in memory. -- * But zap_pte_range() does not lock the page, however in that case the -- * mapping is pinned by the vma's ->vm_file reference. -- * -- * We take care to handle the case where the page was truncated from the -- * mapping by re-checking page_mapping() inside tree_lock. -+ * The caller must ensure this doesn't race with truncation. Most will simply -+ * hold the page lock, but e.g. zap_pte_range() calls with the page mapped and -+ * the pte lock held, which also locks out truncat - */ - int __set_page_dirty_nobuffers(struct page *page) - { - if (!TestSetPageDirty(page)) { - struct address_space *mapping = page_mapping(page); -- struct address_space *mapping2; - unsigned long flags; - - if (!mapping) - return 1; - - spin_lock_irqsave(&mapping->tree_lock, flags); -- mapping2 = page_mapping(page); -- if (mapping2) { /* Race with truncate? */ -- BUG_ON(mapping2 != mapping); -- WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page)); -- account_page_dirtied(page, mapping); -- radix_tree_tag_set(&mapping->page_tree, -- page_index(page), PAGECACHE_TAG_DIRTY); -- } -+ BUG_ON(page_mapping(page) != mapping); -+ WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page)); -+ account_page_dirtied(page, mapping); -+ radix_tree_tag_set(&mapping->page_tree, page_index(page), -+ PAGECACHE_TAG_DIRTY); - spin_unlock_irqrestore(&mapping->tree_lock, flags); - if (mapping->host) { - /* !PageAnon && !swapper_space */ -@@ -2163,12 +2146,10 @@ int clear_page_dirty_for_io(struct page - /* - * We carefully synchronise fault handlers against - * installing a dirty pte and marking the page dirty -- * at this point. We do this by having them hold the -- * page lock at some point after installing their -- * pte, but before marking the page dirty. -- * Pages are always locked coming in here, so we get -- * the desired exclusion. See mm/memory.c:do_wp_page() -- * for more comments. -+ * at this point. We do this by having them hold the -+ * page lock while dirtying the page, and pages are -+ * always locked coming in here, so we get the desired -+ * exclusion. - */ - if (TestClearPageDirty(page)) { - dec_zone_page_state(page, NR_FILE_DIRTY); diff --git a/patches/move-d_rcu-from-overlapping-d_child-to-overlapping-d_alias.patch b/patches/move-d_rcu-from-overlapping-d_child-to-overlapping-d_alias.patch deleted file mode 100644 index 1148421..0000000 --- a/patches/move-d_rcu-from-overlapping-d_child-to-overlapping-d_alias.patch +++ /dev/null @@ -1,794 +0,0 @@ -From 026181647a6262f4ba6d60c0847d306ad685468c Mon Sep 17 00:00:00 2001 -From: Al Viro <viro@zeniv.linux.org.uk> -Date: Sun, 26 Oct 2014 19:19:16 -0400 -Subject: move d_rcu from overlapping d_child to overlapping d_alias - -commit 946e51f2bf37f1656916eb75bd0742ba33983c28 upstream. - -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -[bwh: Backported to 3.2: - - Apply name changes in all the different places we use d_alias and d_child - - Move the WARN_ON() in __d_free() to d_free() as we don't have dentry_free()] -Signed-off-by: Ben Hutchings <ben@decadent.org.uk> -[lizf: Backported to 3.4: - - adjust context - - need one more name change in debugfs] ---- - arch/powerpc/platforms/cell/spufs/inode.c | 4 - - drivers/usb/core/inode.c | 6 +- - fs/9p/vfs_inode_dotl.c | 2 - fs/affs/amigaffs.c | 2 - fs/autofs4/expire.c | 10 +-- - fs/autofs4/root.c | 2 - fs/ceph/dir.c | 8 +-- - fs/ceph/inode.c | 6 +- - fs/cifs/inode.c | 2 - fs/coda/cache.c | 2 - fs/dcache.c | 80 +++++++++++++++--------------- - fs/debugfs/inode.c | 6 +- - fs/exportfs/expfs.c | 2 - fs/ext4/fsync.c | 2 - fs/libfs.c | 12 ++-- - fs/ncpfs/dir.c | 2 - fs/ncpfs/ncplib_kernel.h | 4 - - fs/nfs/getroot.c | 2 - fs/notify/fsnotify.c | 4 - - fs/ocfs2/dcache.c | 2 - include/linux/dcache.h | 8 +-- - kernel/cgroup.c | 4 - - security/selinux/selinuxfs.c | 6 +- - 23 files changed, 89 insertions(+), 89 deletions(-) - ---- a/arch/powerpc/platforms/cell/spufs/inode.c -+++ b/arch/powerpc/platforms/cell/spufs/inode.c -@@ -164,7 +164,7 @@ static void spufs_prune_dir(struct dentr - struct dentry *dentry, *tmp; - - mutex_lock(&dir->d_inode->i_mutex); -- list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_u.d_child) { -+ list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_child) { - spin_lock(&dentry->d_lock); - if (!(d_unhashed(dentry)) && dentry->d_inode) { - dget_dlock(dentry); -@@ -222,7 +222,7 @@ out: - * - free child's inode if possible - * - free child - */ -- list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_u.d_child) { -+ list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_child) { - dput(dentry); - } - ---- a/drivers/usb/core/inode.c -+++ b/drivers/usb/core/inode.c -@@ -211,7 +211,7 @@ static void update_bus(struct dentry *bu - - mutex_lock(&bus->d_inode->i_mutex); - -- list_for_each_entry(dev, &bus->d_subdirs, d_u.d_child) -+ list_for_each_entry(dev, &bus->d_subdirs, d_child) - if (dev->d_inode) - update_dev(dev); - -@@ -228,7 +228,7 @@ static void update_sb(struct super_block - - mutex_lock_nested(&root->d_inode->i_mutex, I_MUTEX_PARENT); - -- list_for_each_entry(bus, &root->d_subdirs, d_u.d_child) { -+ list_for_each_entry(bus, &root->d_subdirs, d_child) { - if (bus->d_inode) { - switch (S_IFMT & bus->d_inode->i_mode) { - case S_IFDIR: -@@ -342,7 +342,7 @@ static int usbfs_empty (struct dentry *d - - spin_lock(&dentry->d_lock); - list_for_each(list, &dentry->d_subdirs) { -- struct dentry *de = list_entry(list, struct dentry, d_u.d_child); -+ struct dentry *de = list_entry(list, struct dentry, d_child); - - spin_lock_nested(&de->d_lock, DENTRY_D_LOCK_NESTED); - if (usbfs_positive(de)) { ---- a/fs/9p/vfs_inode_dotl.c -+++ b/fs/9p/vfs_inode_dotl.c -@@ -81,7 +81,7 @@ static struct dentry *v9fs_dentry_from_d - spin_lock(&inode->i_lock); - /* Directory should have only one entry. */ - BUG_ON(S_ISDIR(inode->i_mode) && !list_is_singular(&inode->i_dentry)); -- dentry = list_entry(inode->i_dentry.next, struct dentry, d_alias); -+ dentry = list_entry(inode->i_dentry.next, struct dentry, d_u.d_alias); - spin_unlock(&inode->i_lock); - return dentry; - } ---- a/fs/affs/amigaffs.c -+++ b/fs/affs/amigaffs.c -@@ -132,7 +132,7 @@ affs_fix_dcache(struct dentry *dentry, u - head = &inode->i_dentry; - next = head->next; - while (next != head) { -- dentry = list_entry(next, struct dentry, d_alias); -+ dentry = list_entry(next, struct dentry, d_u.d_alias); - if (entry_ino == (u32)(long)dentry->d_fsdata) { - dentry->d_fsdata = data; - break; ---- a/fs/autofs4/expire.c -+++ b/fs/autofs4/expire.c -@@ -100,7 +100,7 @@ static struct dentry *get_next_positive_ - p = prev; - spin_lock(&p->d_lock); - again: -- next = p->d_u.d_child.next; -+ next = p->d_child.next; - start: - if (next == &root->d_subdirs) { - spin_unlock(&p->d_lock); -@@ -109,7 +109,7 @@ start: - return NULL; - } - -- q = list_entry(next, struct dentry, d_u.d_child); -+ q = list_entry(next, struct dentry, d_child); - - spin_lock_nested(&q->d_lock, DENTRY_D_LOCK_NESTED); - /* Negative dentry - try next */ -@@ -166,13 +166,13 @@ again: - goto relock; - } - spin_unlock(&p->d_lock); -- next = p->d_u.d_child.next; -+ next = p->d_child.next; - p = parent; - if (next != &parent->d_subdirs) - break; - } - } -- ret = list_entry(next, struct dentry, d_u.d_child); -+ ret = list_entry(next, struct dentry, d_child); - - spin_lock_nested(&ret->d_lock, DENTRY_D_LOCK_NESTED); - /* Negative dentry - try next */ -@@ -457,7 +457,7 @@ found: - spin_lock(&sbi->lookup_lock); - spin_lock(&expired->d_parent->d_lock); - spin_lock_nested(&expired->d_lock, DENTRY_D_LOCK_NESTED); -- list_move(&expired->d_parent->d_subdirs, &expired->d_u.d_child); -+ list_move(&expired->d_parent->d_subdirs, &expired->d_child); - spin_unlock(&expired->d_lock); - spin_unlock(&expired->d_parent->d_lock); - spin_unlock(&sbi->lookup_lock); ---- a/fs/autofs4/root.c -+++ b/fs/autofs4/root.c -@@ -651,7 +651,7 @@ static void autofs_clear_leaf_automount_ - /* only consider parents below dentrys in the root */ - if (IS_ROOT(parent->d_parent)) - return; -- d_child = &dentry->d_u.d_child; -+ d_child = &dentry->d_child; - /* Set parent managed if it's becoming empty */ - if (d_child->next == &parent->d_subdirs && - d_child->prev == &parent->d_subdirs) ---- a/fs/ceph/dir.c -+++ b/fs/ceph/dir.c -@@ -104,7 +104,7 @@ static unsigned fpos_off(loff_t p) - /* - * When possible, we try to satisfy a readdir by peeking at the - * dcache. We make this work by carefully ordering dentries on -- * d_u.d_child when we initially get results back from the MDS, and -+ * d_child when we initially get results back from the MDS, and - * falling back to a "normal" sync readdir if any dentries in the dir - * are dropped. - * -@@ -140,11 +140,11 @@ static int __dcache_readdir(struct file - p = parent->d_subdirs.prev; - dout(" initial p %p/%p\n", p->prev, p->next); - } else { -- p = last->d_u.d_child.prev; -+ p = last->d_child.prev; - } - - more: -- dentry = list_entry(p, struct dentry, d_u.d_child); -+ dentry = list_entry(p, struct dentry, d_child); - di = ceph_dentry(dentry); - while (1) { - dout(" p %p/%p %s d_subdirs %p/%p\n", p->prev, p->next, -@@ -166,7 +166,7 @@ more: - !dentry->d_inode ? " null" : ""); - spin_unlock(&dentry->d_lock); - p = p->prev; -- dentry = list_entry(p, struct dentry, d_u.d_child); -+ dentry = list_entry(p, struct dentry, d_child); - di = ceph_dentry(dentry); - } - ---- a/fs/ceph/inode.c -+++ b/fs/ceph/inode.c -@@ -869,9 +869,9 @@ static void ceph_set_dentry_offset(struc - - spin_lock(&dir->d_lock); - spin_lock_nested(&dn->d_lock, DENTRY_D_LOCK_NESTED); -- list_move(&dn->d_u.d_child, &dir->d_subdirs); -+ list_move(&dn->d_child, &dir->d_subdirs); - dout("set_dentry_offset %p %lld (%p %p)\n", dn, di->offset, -- dn->d_u.d_child.prev, dn->d_u.d_child.next); -+ dn->d_child.prev, dn->d_child.next); - spin_unlock(&dn->d_lock); - spin_unlock(&dir->d_lock); - } -@@ -1262,7 +1262,7 @@ retry_lookup: - /* reorder parent's d_subdirs */ - spin_lock(&parent->d_lock); - spin_lock_nested(&dn->d_lock, DENTRY_D_LOCK_NESTED); -- list_move(&dn->d_u.d_child, &parent->d_subdirs); -+ list_move(&dn->d_child, &parent->d_subdirs); - spin_unlock(&dn->d_lock); - spin_unlock(&parent->d_lock); - } ---- a/fs/cifs/inode.c -+++ b/fs/cifs/inode.c -@@ -833,7 +833,7 @@ inode_has_hashed_dentries(struct inode * - struct dentry *dentry; - - spin_lock(&inode->i_lock); -- list_for_each_entry(dentry, &inode->i_dentry, d_alias) { -+ list_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) { - if (!d_unhashed(dentry) || IS_ROOT(dentry)) { - spin_unlock(&inode->i_lock); - return true; ---- a/fs/coda/cache.c -+++ b/fs/coda/cache.c -@@ -95,7 +95,7 @@ static void coda_flag_children(struct de - spin_lock(&parent->d_lock); - list_for_each(child, &parent->d_subdirs) - { -- de = list_entry(child, struct dentry, d_u.d_child); -+ de = list_entry(child, struct dentry, d_child); - /* don't know what to do with negative dentries */ - if ( ! de->d_inode ) - continue; ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -43,7 +43,7 @@ - /* - * Usage: - * dcache->d_inode->i_lock protects: -- * - i_dentry, d_alias, d_inode of aliases -+ * - i_dentry, d_u.d_alias, d_inode of aliases - * dcache_hash_bucket lock protects: - * - the dcache hash table - * s_anon bl list spinlock protects: -@@ -58,7 +58,7 @@ - * - d_unhashed() - * - d_parent and d_subdirs - * - childrens' d_child and d_parent -- * - d_alias, d_inode -+ * - d_u.d_alias, d_inode - * - * Ordering: - * dentry->d_inode->i_lock -@@ -202,7 +202,6 @@ static void __d_free(struct rcu_head *he - { - struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu); - -- WARN_ON(!list_empty(&dentry->d_alias)); - if (dname_external(dentry)) - kfree(dentry->d_name.name); - kmem_cache_free(dentry_cache, dentry); -@@ -213,6 +212,7 @@ static void __d_free(struct rcu_head *he - */ - static void d_free(struct dentry *dentry) - { -+ WARN_ON(!list_empty(&dentry->d_u.d_alias)); - BUG_ON(dentry->d_count); - this_cpu_dec(nr_dentry); - if (dentry->d_op && dentry->d_op->d_release) -@@ -251,7 +251,7 @@ static void dentry_iput(struct dentry * - struct inode *inode = dentry->d_inode; - if (inode) { - dentry->d_inode = NULL; -- list_del_init(&dentry->d_alias); -+ list_del_init(&dentry->d_u.d_alias); - spin_unlock(&dentry->d_lock); - spin_unlock(&inode->i_lock); - if (!inode->i_nlink) -@@ -275,7 +275,7 @@ static void dentry_unlink_inode(struct d - { - struct inode *inode = dentry->d_inode; - dentry->d_inode = NULL; -- list_del_init(&dentry->d_alias); -+ list_del_init(&dentry->d_u.d_alias); - dentry_rcuwalk_barrier(dentry); - spin_unlock(&dentry->d_lock); - spin_unlock(&inode->i_lock); -@@ -368,7 +368,7 @@ static struct dentry *d_kill(struct dent - __releases(parent->d_lock) - __releases(dentry->d_inode->i_lock) - { -- list_del(&dentry->d_u.d_child); -+ list_del(&dentry->d_child); - /* - * Inform try_to_ascend() that we are no longer attached to the - * dentry tree -@@ -686,7 +686,7 @@ static struct dentry *__d_find_alias(str - - again: - discon_alias = NULL; -- list_for_each_entry(alias, &inode->i_dentry, d_alias) { -+ list_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) { - spin_lock(&alias->d_lock); - if (S_ISDIR(inode->i_mode) || !d_unhashed(alias)) { - if (IS_ROOT(alias) && -@@ -739,7 +739,7 @@ void d_prune_aliases(struct inode *inode - struct dentry *dentry; - restart: - spin_lock(&inode->i_lock); -- list_for_each_entry(dentry, &inode->i_dentry, d_alias) { -+ list_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) { - spin_lock(&dentry->d_lock); - if (!dentry->d_count) { - __dget_dlock(dentry); -@@ -919,7 +919,7 @@ static void shrink_dcache_for_umount_sub - /* descend to the first leaf in the current subtree */ - while (!list_empty(&dentry->d_subdirs)) - dentry = list_entry(dentry->d_subdirs.next, -- struct dentry, d_u.d_child); -+ struct dentry, d_child); - - /* consume the dentries from this leaf up through its parents - * until we find one with children or run out altogether */ -@@ -951,17 +951,17 @@ static void shrink_dcache_for_umount_sub - - if (IS_ROOT(dentry)) { - parent = NULL; -- list_del(&dentry->d_u.d_child); -+ list_del(&dentry->d_child); - } else { - parent = dentry->d_parent; - parent->d_count--; -- list_del(&dentry->d_u.d_child); -+ list_del(&dentry->d_child); - } - - inode = dentry->d_inode; - if (inode) { - dentry->d_inode = NULL; -- list_del_init(&dentry->d_alias); -+ list_del_init(&dentry->d_u.d_alias); - if (dentry->d_op && dentry->d_op->d_iput) - dentry->d_op->d_iput(dentry, inode); - else -@@ -979,7 +979,7 @@ static void shrink_dcache_for_umount_sub - } while (list_empty(&dentry->d_subdirs)); - - dentry = list_entry(dentry->d_subdirs.next, -- struct dentry, d_u.d_child); -+ struct dentry, d_child); - } - } - -@@ -1072,7 +1072,7 @@ repeat: - resume: - while (next != &this_parent->d_subdirs) { - struct list_head *tmp = next; -- struct dentry *dentry = list_entry(tmp, struct dentry, d_u.d_child); -+ struct dentry *dentry = list_entry(tmp, struct dentry, d_child); - next = tmp->next; - - spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); -@@ -1099,7 +1099,7 @@ resume: - this_parent = try_to_ascend(this_parent, locked, seq); - if (!this_parent) - goto rename_retry; -- next = child->d_u.d_child.next; -+ next = child->d_child.next; - goto resume; - } - spin_unlock(&this_parent->d_lock); -@@ -1155,7 +1155,7 @@ repeat: - resume: - while (next != &this_parent->d_subdirs) { - struct list_head *tmp = next; -- struct dentry *dentry = list_entry(tmp, struct dentry, d_u.d_child); -+ struct dentry *dentry = list_entry(tmp, struct dentry, d_child); - next = tmp->next; - - spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); -@@ -1206,7 +1206,7 @@ resume: - this_parent = try_to_ascend(this_parent, locked, seq); - if (!this_parent) - goto rename_retry; -- next = child->d_u.d_child.next; -+ next = child->d_child.next; - goto resume; - } - out: -@@ -1292,8 +1292,8 @@ struct dentry *__d_alloc(struct super_bl - INIT_HLIST_BL_NODE(&dentry->d_hash); - INIT_LIST_HEAD(&dentry->d_lru); - INIT_LIST_HEAD(&dentry->d_subdirs); -- INIT_LIST_HEAD(&dentry->d_alias); -- INIT_LIST_HEAD(&dentry->d_u.d_child); -+ INIT_LIST_HEAD(&dentry->d_u.d_alias); -+ INIT_LIST_HEAD(&dentry->d_child); - d_set_d_op(dentry, dentry->d_sb->s_d_op); - - this_cpu_inc(nr_dentry); -@@ -1323,7 +1323,7 @@ struct dentry *d_alloc(struct dentry * p - */ - __dget_dlock(parent); - dentry->d_parent = parent; -- list_add(&dentry->d_u.d_child, &parent->d_subdirs); -+ list_add(&dentry->d_child, &parent->d_subdirs); - spin_unlock(&parent->d_lock); - - return dentry; -@@ -1380,7 +1380,7 @@ static void __d_instantiate(struct dentr - if (inode) { - if (unlikely(IS_AUTOMOUNT(inode))) - dentry->d_flags |= DCACHE_NEED_AUTOMOUNT; -- list_add(&dentry->d_alias, &inode->i_dentry); -+ list_add(&dentry->d_u.d_alias, &inode->i_dentry); - } - dentry->d_inode = inode; - dentry_rcuwalk_barrier(dentry); -@@ -1405,7 +1405,7 @@ static void __d_instantiate(struct dentr - - void d_instantiate(struct dentry *entry, struct inode * inode) - { -- BUG_ON(!list_empty(&entry->d_alias)); -+ BUG_ON(!list_empty(&entry->d_u.d_alias)); - if (inode) - spin_lock(&inode->i_lock); - __d_instantiate(entry, inode); -@@ -1444,7 +1444,7 @@ static struct dentry *__d_instantiate_un - return NULL; - } - -- list_for_each_entry(alias, &inode->i_dentry, d_alias) { -+ list_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) { - struct qstr *qstr = &alias->d_name; - - /* -@@ -1470,7 +1470,7 @@ struct dentry *d_instantiate_unique(stru - { - struct dentry *result; - -- BUG_ON(!list_empty(&entry->d_alias)); -+ BUG_ON(!list_empty(&entry->d_u.d_alias)); - - if (inode) - spin_lock(&inode->i_lock); -@@ -1513,7 +1513,7 @@ static struct dentry * __d_find_any_alia - - if (list_empty(&inode->i_dentry)) - return NULL; -- alias = list_first_entry(&inode->i_dentry, struct dentry, d_alias); -+ alias = list_first_entry(&inode->i_dentry, struct dentry, d_u.d_alias); - __dget(alias); - return alias; - } -@@ -1587,7 +1587,7 @@ struct dentry *d_obtain_alias(struct ino - spin_lock(&tmp->d_lock); - tmp->d_inode = inode; - tmp->d_flags |= DCACHE_DISCONNECTED; -- list_add(&tmp->d_alias, &inode->i_dentry); -+ list_add(&tmp->d_u.d_alias, &inode->i_dentry); - hlist_bl_lock(&tmp->d_sb->s_anon); - hlist_bl_add_head(&tmp->d_hash, &tmp->d_sb->s_anon); - hlist_bl_unlock(&tmp->d_sb->s_anon); -@@ -1996,7 +1996,7 @@ int d_validate(struct dentry *dentry, st - struct dentry *child; - - spin_lock(&dparent->d_lock); -- list_for_each_entry(child, &dparent->d_subdirs, d_u.d_child) { -+ list_for_each_entry(child, &dparent->d_subdirs, d_child) { - if (dentry == child) { - spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); - __dget_dlock(dentry); -@@ -2243,8 +2243,8 @@ static void __d_move(struct dentry * den - /* Unhash the target: dput() will then get rid of it */ - __d_drop(target); - -- list_del(&dentry->d_u.d_child); -- list_del(&target->d_u.d_child); -+ list_del(&dentry->d_child); -+ list_del(&target->d_child); - - /* Switch the names.. */ - switch_names(dentry, target); -@@ -2254,15 +2254,15 @@ static void __d_move(struct dentry * den - if (IS_ROOT(dentry)) { - dentry->d_parent = target->d_parent; - target->d_parent = target; -- INIT_LIST_HEAD(&target->d_u.d_child); -+ INIT_LIST_HEAD(&target->d_child); - } else { - swap(dentry->d_parent, target->d_parent); - - /* And add them back to the (new) parent lists */ -- list_add(&target->d_u.d_child, &target->d_parent->d_subdirs); -+ list_add(&target->d_child, &target->d_parent->d_subdirs); - } - -- list_add(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs); -+ list_add(&dentry->d_child, &dentry->d_parent->d_subdirs); - - write_seqcount_end(&target->d_seq); - write_seqcount_end(&dentry->d_seq); -@@ -2369,18 +2369,18 @@ static void __d_materialise_dentry(struc - swap(dentry->d_name.hash, anon->d_name.hash); - - dentry->d_parent = (aparent == anon) ? dentry : aparent; -- list_del(&dentry->d_u.d_child); -+ list_del(&dentry->d_child); - if (!IS_ROOT(dentry)) -- list_add(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs); -+ list_add(&dentry->d_child, &dentry->d_parent->d_subdirs); - else -- INIT_LIST_HEAD(&dentry->d_u.d_child); -+ INIT_LIST_HEAD(&dentry->d_child); - - anon->d_parent = (dparent == dentry) ? anon : dparent; -- list_del(&anon->d_u.d_child); -+ list_del(&anon->d_child); - if (!IS_ROOT(anon)) -- list_add(&anon->d_u.d_child, &anon->d_parent->d_subdirs); -+ list_add(&anon->d_child, &anon->d_parent->d_subdirs); - else -- INIT_LIST_HEAD(&anon->d_u.d_child); -+ INIT_LIST_HEAD(&anon->d_child); - - write_seqcount_end(&dentry->d_seq); - write_seqcount_end(&anon->d_seq); -@@ -2934,7 +2934,7 @@ repeat: - resume: - while (next != &this_parent->d_subdirs) { - struct list_head *tmp = next; -- struct dentry *dentry = list_entry(tmp, struct dentry, d_u.d_child); -+ struct dentry *dentry = list_entry(tmp, struct dentry, d_child); - next = tmp->next; - - spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); -@@ -2964,7 +2964,7 @@ resume: - this_parent = try_to_ascend(this_parent, locked, seq); - if (!this_parent) - goto rename_retry; -- next = child->d_u.d_child.next; -+ next = child->d_child.next; - goto resume; - } - spin_unlock(&this_parent->d_lock); ---- a/fs/debugfs/inode.c -+++ b/fs/debugfs/inode.c -@@ -539,7 +539,7 @@ void debugfs_remove_recursive(struct den - parent = dentry; - down: - mutex_lock(&parent->d_inode->i_mutex); -- list_for_each_entry_safe(child, next, &parent->d_subdirs, d_u.d_child) { -+ list_for_each_entry_safe(child, next, &parent->d_subdirs, d_child) { - if (!debugfs_positive(child)) - continue; - -@@ -560,8 +560,8 @@ void debugfs_remove_recursive(struct den - mutex_lock(&parent->d_inode->i_mutex); - - if (child != dentry) { -- next = list_entry(child->d_u.d_child.next, struct dentry, -- d_u.d_child); -+ next = list_entry(child->d_child.next, struct dentry, -+ d_child); - goto up; - } - ---- a/fs/exportfs/expfs.c -+++ b/fs/exportfs/expfs.c -@@ -50,7 +50,7 @@ find_acceptable_alias(struct dentry *res - - inode = result->d_inode; - spin_lock(&inode->i_lock); -- list_for_each_entry(dentry, &inode->i_dentry, d_alias) { -+ list_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) { - dget(dentry); - spin_unlock(&inode->i_lock); - if (toput) ---- a/fs/ext4/fsync.c -+++ b/fs/ext4/fsync.c -@@ -139,7 +139,7 @@ static int ext4_sync_parent(struct inode - spin_lock(&inode->i_lock); - if (!list_empty(&inode->i_dentry)) { - dentry = list_first_entry(&inode->i_dentry, -- struct dentry, d_alias); -+ struct dentry, d_u.d_alias); - dget(dentry); - } - spin_unlock(&inode->i_lock); ---- a/fs/libfs.c -+++ b/fs/libfs.c -@@ -104,18 +104,18 @@ loff_t dcache_dir_lseek(struct file *fil - - spin_lock(&dentry->d_lock); - /* d_lock not required for cursor */ -- list_del(&cursor->d_u.d_child); -+ list_del(&cursor->d_child); - p = dentry->d_subdirs.next; - while (n && p != &dentry->d_subdirs) { - struct dentry *next; -- next = list_entry(p, struct dentry, d_u.d_child); -+ next = list_entry(p, struct dentry, d_child); - spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED); - if (simple_positive(next)) - n--; - spin_unlock(&next->d_lock); - p = p->next; - } -- list_add_tail(&cursor->d_u.d_child, p); -+ list_add_tail(&cursor->d_child, p); - spin_unlock(&dentry->d_lock); - } - } -@@ -139,7 +139,7 @@ int dcache_readdir(struct file * filp, v - { - struct dentry *dentry = filp->f_path.dentry; - struct dentry *cursor = filp->private_data; -- struct list_head *p, *q = &cursor->d_u.d_child; -+ struct list_head *p, *q = &cursor->d_child; - ino_t ino; - int i = filp->f_pos; - -@@ -165,7 +165,7 @@ int dcache_readdir(struct file * filp, v - - for (p=q->next; p != &dentry->d_subdirs; p=p->next) { - struct dentry *next; -- next = list_entry(p, struct dentry, d_u.d_child); -+ next = list_entry(p, struct dentry, d_child); - spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED); - if (!simple_positive(next)) { - spin_unlock(&next->d_lock); -@@ -289,7 +289,7 @@ int simple_empty(struct dentry *dentry) - int ret = 0; - - spin_lock(&dentry->d_lock); -- list_for_each_entry(child, &dentry->d_subdirs, d_u.d_child) { -+ list_for_each_entry(child, &dentry->d_subdirs, d_child) { - spin_lock_nested(&child->d_lock, DENTRY_D_LOCK_NESTED); - if (simple_positive(child)) { - spin_unlock(&child->d_lock); ---- a/fs/ncpfs/dir.c -+++ b/fs/ncpfs/dir.c -@@ -391,7 +391,7 @@ ncp_dget_fpos(struct dentry *dentry, str - spin_lock(&parent->d_lock); - next = parent->d_subdirs.next; - while (next != &parent->d_subdirs) { -- dent = list_entry(next, struct dentry, d_u.d_child); -+ dent = list_entry(next, struct dentry, d_child); - if ((unsigned long)dent->d_fsdata == fpos) { - if (dent->d_inode) - dget(dent); ---- a/fs/ncpfs/ncplib_kernel.h -+++ b/fs/ncpfs/ncplib_kernel.h -@@ -194,7 +194,7 @@ ncp_renew_dentries(struct dentry *parent - spin_lock(&parent->d_lock); - next = parent->d_subdirs.next; - while (next != &parent->d_subdirs) { -- dentry = list_entry(next, struct dentry, d_u.d_child); -+ dentry = list_entry(next, struct dentry, d_child); - - if (dentry->d_fsdata == NULL) - ncp_age_dentry(server, dentry); -@@ -216,7 +216,7 @@ ncp_invalidate_dircache_entries(struct d - spin_lock(&parent->d_lock); - next = parent->d_subdirs.next; - while (next != &parent->d_subdirs) { -- dentry = list_entry(next, struct dentry, d_u.d_child); -+ dentry = list_entry(next, struct dentry, d_child); - dentry->d_fsdata = NULL; - ncp_age_dentry(server, dentry); - next = next->next; ---- a/fs/nfs/getroot.c -+++ b/fs/nfs/getroot.c -@@ -62,7 +62,7 @@ static int nfs_superblock_set_dummy_root - */ - spin_lock(&sb->s_root->d_inode->i_lock); - spin_lock(&sb->s_root->d_lock); -- list_del_init(&sb->s_root->d_alias); -+ list_del_init(&sb->s_root->d_u.d_alias); - spin_unlock(&sb->s_root->d_lock); - spin_unlock(&sb->s_root->d_inode->i_lock); - } ---- a/fs/notify/fsnotify.c -+++ b/fs/notify/fsnotify.c -@@ -63,14 +63,14 @@ void __fsnotify_update_child_dentry_flag - spin_lock(&inode->i_lock); - /* run all of the dentries associated with this inode. Since this is a - * directory, there damn well better only be one item on this list */ -- list_for_each_entry(alias, &inode->i_dentry, d_alias) { -+ list_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) { - struct dentry *child; - - /* run all of the children of the original inode and fix their - * d_flags to indicate parental interest (their parent is the - * original inode) */ - spin_lock(&alias->d_lock); -- list_for_each_entry(child, &alias->d_subdirs, d_u.d_child) { -+ list_for_each_entry(child, &alias->d_subdirs, d_child) { - if (!child->d_inode) - continue; - ---- a/fs/ocfs2/dcache.c -+++ b/fs/ocfs2/dcache.c -@@ -175,7 +175,7 @@ struct dentry *ocfs2_find_local_alias(st - - spin_lock(&inode->i_lock); - list_for_each(p, &inode->i_dentry) { -- dentry = list_entry(p, struct dentry, d_alias); -+ dentry = list_entry(p, struct dentry, d_u.d_alias); - - spin_lock(&dentry->d_lock); - if (ocfs2_match_dentry(dentry, parent_blkno, skip_unhashed)) { ---- a/include/linux/dcache.h -+++ b/include/linux/dcache.h -@@ -105,15 +105,15 @@ struct dentry { - void *d_fsdata; /* fs-specific data */ - - struct list_head d_lru; /* LRU list */ -+ struct list_head d_child; /* child of parent list */ -+ struct list_head d_subdirs; /* our children */ - /* -- * d_child and d_rcu can share memory -+ * d_alias and d_rcu can share memory - */ - union { -- struct list_head d_child; /* child of parent list */ -+ struct list_head d_alias; /* inode alias list */ - struct rcu_head d_rcu; - } d_u; -- struct list_head d_subdirs; /* our children */ -- struct list_head d_alias; /* inode alias list */ - }; - - /* ---- a/kernel/cgroup.c -+++ b/kernel/cgroup.c -@@ -898,7 +898,7 @@ static void cgroup_clear_directory(struc - spin_lock(&dentry->d_lock); - node = dentry->d_subdirs.next; - while (node != &dentry->d_subdirs) { -- struct dentry *d = list_entry(node, struct dentry, d_u.d_child); -+ struct dentry *d = list_entry(node, struct dentry, d_child); - - spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED); - list_del_init(node); -@@ -932,7 +932,7 @@ static void cgroup_d_remove_dir(struct d - parent = dentry->d_parent; - spin_lock(&parent->d_lock); - spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); -- list_del_init(&dentry->d_u.d_child); -+ list_del_init(&dentry->d_child); - spin_unlock(&dentry->d_lock); - spin_unlock(&parent->d_lock); - remove_dir(dentry); ---- a/security/selinux/selinuxfs.c -+++ b/security/selinux/selinuxfs.c -@@ -1191,7 +1191,7 @@ static void sel_remove_entries(struct de - spin_lock(&de->d_lock); - node = de->d_subdirs.next; - while (node != &de->d_subdirs) { -- struct dentry *d = list_entry(node, struct dentry, d_u.d_child); -+ struct dentry *d = list_entry(node, struct dentry, d_child); - - spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED); - list_del_init(node); -@@ -1694,12 +1694,12 @@ static void sel_remove_classes(void) - - list_for_each(class_node, &class_dir->d_subdirs) { - struct dentry *class_subdir = list_entry(class_node, -- struct dentry, d_u.d_child); -+ struct dentry, d_child); - struct list_head *class_subdir_node; - - list_for_each(class_subdir_node, &class_subdir->d_subdirs) { - struct dentry *d = list_entry(class_subdir_node, -- struct dentry, d_u.d_child); -+ struct dentry, d_child); - - if (d->d_inode) - if (d->d_inode->i_mode & S_IFDIR) diff --git a/patches/ncpfs-return-proper-error-from-ncp_ioc_setroot-ioctl.patch b/patches/ncpfs-return-proper-error-from-ncp_ioc_setroot-ioctl.patch deleted file mode 100644 index e2006e8..0000000 --- a/patches/ncpfs-return-proper-error-from-ncp_ioc_setroot-ioctl.patch +++ /dev/null @@ -1,36 +0,0 @@ -From a682e9c28cac152e6e54c39efcf046e0c8cfcf63 Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.cz> -Date: Wed, 10 Dec 2014 15:52:22 -0800 -Subject: ncpfs: return proper error from NCP_IOC_SETROOT ioctl - -commit a682e9c28cac152e6e54c39efcf046e0c8cfcf63 upstream. - -If some error happens in NCP_IOC_SETROOT ioctl, the appropriate error -return value is then (in most cases) just overwritten before we return. -This can result in reporting success to userspace although error happened. - -This bug was introduced by commit 2e54eb96e2c8 ("BKL: Remove BKL from -ncpfs"). Propagate the errors correctly. - -Coverity id: 1226925. - -Fixes: 2e54eb96e2c80 ("BKL: Remove BKL from ncpfs") -Signed-off-by: Jan Kara <jack@suse.cz> -Cc: Petr Vandrovec <petr@vandrovec.name> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/ncpfs/ioctl.c | 1 - - 1 file changed, 1 deletion(-) - ---- a/fs/ncpfs/ioctl.c -+++ b/fs/ncpfs/ioctl.c -@@ -445,7 +445,6 @@ static long __ncp_ioctl(struct inode *in - result = -EIO; - } - } -- result = 0; - } - mutex_unlock(&server->root_setup_lock); - diff --git a/patches/net-compat-update-get_compat_msghdr-to-match-copy_msghdr_from_user-behaviour.patch b/patches/net-compat-update-get_compat_msghdr-to-match-copy_msghdr_from_user-behaviour.patch deleted file mode 100644 index 05757b8..0000000 --- a/patches/net-compat-update-get_compat_msghdr-to-match-copy_msghdr_from_user-behaviour.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 91edd096e224941131f896b86838b1e59553696a Mon Sep 17 00:00:00 2001 -From: Catalin Marinas <catalin.marinas@arm.com> -Date: Fri, 20 Mar 2015 16:48:13 +0000 -Subject: net: compat: Update get_compat_msghdr() to match - copy_msghdr_from_user() behaviour - -commit 91edd096e224941131f896b86838b1e59553696a upstream. - -Commit db31c55a6fb2 (net: clamp ->msg_namelen instead of returning an -error) introduced the clamping of msg_namelen when the unsigned value -was larger than sizeof(struct sockaddr_storage). This caused a -msg_namelen of -1 to be valid. The native code was subsequently fixed by -commit dbb490b96584 (net: socket: error on a negative msg_namelen). - -In addition, the native code sets msg_namelen to 0 when msg_name is -NULL. This was done in commit (6a2a2b3ae075 net:socket: set msg_namelen -to 0 if msg_name is passed as NULL in msghdr struct from userland) and -subsequently updated by 08adb7dabd48 (fold verify_iovec() into -copy_msghdr_from_user()). - -This patch brings the get_compat_msghdr() in line with -copy_msghdr_from_user(). - -Fixes: db31c55a6fb2 (net: clamp ->msg_namelen instead of returning an error) -Cc: David S. Miller <davem@davemloft.net> -Cc: Dan Carpenter <dan.carpenter@oracle.com> -Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -[lizf: Backported to 3.4: s/uaddr/tmp1/] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/compat.c | 7 +++++++ - 1 file changed, 7 insertions(+) - ---- a/net/compat.c -+++ b/net/compat.c -@@ -71,6 +71,13 @@ int get_compat_msghdr(struct msghdr *kms - __get_user(kmsg->msg_controllen, &umsg->msg_controllen) || - __get_user(kmsg->msg_flags, &umsg->msg_flags)) - return -EFAULT; -+ -+ if (!tmp1) -+ kmsg->msg_namelen = 0; -+ -+ if (kmsg->msg_namelen < 0) -+ return -EINVAL; -+ - if (kmsg->msg_namelen > sizeof(struct sockaddr_storage)) - kmsg->msg_namelen = sizeof(struct sockaddr_storage); - kmsg->msg_name = compat_ptr(tmp1); diff --git a/patches/net-fix-stacked-vlan-offload-features-computation.patch b/patches/net-fix-stacked-vlan-offload-features-computation.patch deleted file mode 100644 index 83dbe05..0000000 --- a/patches/net-fix-stacked-vlan-offload-features-computation.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 796f2da81bead71ffc91ef70912cd8d1827bf756 Mon Sep 17 00:00:00 2001 -From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp> -Date: Mon, 22 Dec 2014 19:04:14 +0900 -Subject: net: Fix stacked vlan offload features computation - -commit 796f2da81bead71ffc91ef70912cd8d1827bf756 upstream. - -When vlan tags are stacked, it is very likely that the outer tag is stored -in skb->vlan_tci and skb->protocol shows the inner tag's vlan_proto. -Currently netif_skb_features() first looks at skb->protocol even if there -is the outer tag in vlan_tci, thus it incorrectly retrieves the protocol -encapsulated by the inner vlan instead of the inner vlan protocol. -This allows GSO packets to be passed to HW and they end up being -corrupted. - -Fixes: 58e998c6d239 ("offloading: Force software GSO for multiple vlan tags.") -Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp> -Signed-off-by: David S. Miller <davem@davemloft.net> -[lizf: Backported to 3.4: - - remove ETH_P_8021AD - - pass protocol to harmonize_features()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/core/dev.c | 14 ++++++++------ - 1 file changed, 8 insertions(+), 6 deletions(-) - ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -2143,12 +2143,14 @@ netdev_features_t netif_skb_features(str - if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs) - features &= ~NETIF_F_GSO_MASK; - -- if (protocol == htons(ETH_P_8021Q)) { -- struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; -- protocol = veh->h_vlan_encapsulated_proto; -- } else if (!vlan_tx_tag_present(skb)) { -- return harmonize_features(skb, protocol, features); -- } -+ if (!vlan_tx_tag_present(skb)) { -+ if (unlikely(protocol == htons(ETH_P_8021Q))) { -+ struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; -+ protocol = veh->h_vlan_encapsulated_proto; -+ } else { -+ return harmonize_features(skb, protocol, features); -+ } -+ } - - features &= (skb->dev->vlan_features | NETIF_F_HW_VLAN_TX); - diff --git a/patches/net-sctp-fix-null-pointer-dereference-in-af-from_addr_param-on-malformed-packet.patch b/patches/net-sctp-fix-null-pointer-dereference-in-af-from_addr_param-on-malformed-packet.patch deleted file mode 100644 index 4fd1b9d..0000000 --- a/patches/net-sctp-fix-null-pointer-dereference-in-af-from_addr_param-on-malformed-packet.patch +++ /dev/null @@ -1,76 +0,0 @@ -From e40607cbe270a9e8360907cb1e62ddf0736e4864 Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann <dborkman@redhat.com> -Date: Mon, 10 Nov 2014 17:54:26 +0100 -Subject: net: sctp: fix NULL pointer dereference in af->from_addr_param on - malformed packet - -commit e40607cbe270a9e8360907cb1e62ddf0736e4864 upstream. - -An SCTP server doing ASCONF will panic on malformed INIT ping-of-death -in the form of: - - ------------ INIT[PARAM: SET_PRIMARY_IP] ------------> - -While the INIT chunk parameter verification dissects through many things -in order to detect malformed input, it misses to actually check parameters -inside of parameters. E.g. RFC5061, section 4.2.4 proposes a 'set primary -IP address' parameter in ASCONF, which has as a subparameter an address -parameter. - -So an attacker may send a parameter type other than SCTP_PARAM_IPV4_ADDRESS -or SCTP_PARAM_IPV6_ADDRESS, param_type2af() will subsequently return 0 -and thus sctp_get_af_specific() returns NULL, too, which we then happily -dereference unconditionally through af->from_addr_param(). - -The trace for the log: - -BUG: unable to handle kernel NULL pointer dereference at 0000000000000078 -IP: [<ffffffffa01e9c62>] sctp_process_init+0x492/0x990 [sctp] -PGD 0 -Oops: 0000 [#1] SMP -[...] -Pid: 0, comm: swapper Not tainted 2.6.32-504.el6.x86_64 #1 Bochs Bochs -RIP: 0010:[<ffffffffa01e9c62>] [<ffffffffa01e9c62>] sctp_process_init+0x492/0x990 [sctp] -[...] -Call Trace: - <IRQ> - [<ffffffffa01f2add>] ? sctp_bind_addr_copy+0x5d/0xe0 [sctp] - [<ffffffffa01e1fcb>] sctp_sf_do_5_1B_init+0x21b/0x340 [sctp] - [<ffffffffa01e3751>] sctp_do_sm+0x71/0x1210 [sctp] - [<ffffffffa01e5c09>] ? sctp_endpoint_lookup_assoc+0xc9/0xf0 [sctp] - [<ffffffffa01e61f6>] sctp_endpoint_bh_rcv+0x116/0x230 [sctp] - [<ffffffffa01ee986>] sctp_inq_push+0x56/0x80 [sctp] - [<ffffffffa01fcc42>] sctp_rcv+0x982/0xa10 [sctp] - [<ffffffffa01d5123>] ? ipt_local_in_hook+0x23/0x28 [iptable_filter] - [<ffffffff8148bdc9>] ? nf_iterate+0x69/0xb0 - [<ffffffff81496d10>] ? ip_local_deliver_finish+0x0/0x2d0 - [<ffffffff8148bf86>] ? nf_hook_slow+0x76/0x120 - [<ffffffff81496d10>] ? ip_local_deliver_finish+0x0/0x2d0 -[...] - -A minimal way to address this is to check for NULL as we do on all -other such occasions where we know sctp_get_af_specific() could -possibly return with NULL. - -Fixes: d6de3097592b ("[SCTP]: Add the handling of "Set Primary IP Address" parameter to INIT") -Signed-off-by: Daniel Borkmann <dborkman@redhat.com> -Cc: Vlad Yasevich <vyasevich@gmail.com> -Acked-by: Neil Horman <nhorman@tuxdriver.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/sctp/sm_make_chunk.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/net/sctp/sm_make_chunk.c -+++ b/net/sctp/sm_make_chunk.c -@@ -2570,6 +2570,9 @@ do_addr_param: - addr_param = param.v + sizeof(sctp_addip_param_t); - - af = sctp_get_af_specific(param_type2af(param.p->type)); -+ if (af == NULL) -+ break; -+ - af->from_addr_param(&addr, addr_param, - htons(asoc->peer.port), 0); - diff --git a/patches/net-sctp-fix-panic-on-duplicate-asconf-chunks.patch b/patches/net-sctp-fix-panic-on-duplicate-asconf-chunks.patch deleted file mode 100644 index ed3610b..0000000 --- a/patches/net-sctp-fix-panic-on-duplicate-asconf-chunks.patch +++ /dev/null @@ -1,90 +0,0 @@ -From b69040d8e39f20d5215a03502a8e8b4c6ab78395 Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann <dborkman@redhat.com> -Date: Thu, 9 Oct 2014 22:55:32 +0200 -Subject: net: sctp: fix panic on duplicate ASCONF chunks - -commit b69040d8e39f20d5215a03502a8e8b4c6ab78395 upstream. - -When receiving a e.g. semi-good formed connection scan in the -form of ... - - -------------- INIT[ASCONF; ASCONF_ACK] -------------> - <----------- INIT-ACK[ASCONF; ASCONF_ACK] ------------ - -------------------- COOKIE-ECHO --------------------> - <-------------------- COOKIE-ACK --------------------- - ---------------- ASCONF_a; ASCONF_b -----------------> - -... where ASCONF_a equals ASCONF_b chunk (at least both serials -need to be equal), we panic an SCTP server! - -The problem is that good-formed ASCONF chunks that we reply with -ASCONF_ACK chunks are cached per serial. Thus, when we receive a -same ASCONF chunk twice (e.g. through a lost ASCONF_ACK), we do -not need to process them again on the server side (that was the -idea, also proposed in the RFC). Instead, we know it was cached -and we just resend the cached chunk instead. So far, so good. - -Where things get nasty is in SCTP's side effect interpreter, that -is, sctp_cmd_interpreter(): - -While incoming ASCONF_a (chunk = event_arg) is being marked -!end_of_packet and !singleton, and we have an association context, -we do not flush the outqueue the first time after processing the -ASCONF_ACK singleton chunk via SCTP_CMD_REPLY. Instead, we keep it -queued up, although we set local_cork to 1. Commit 2e3216cd54b1 -changed the precedence, so that as long as we get bundled, incoming -chunks we try possible bundling on outgoing queue as well. Before -this commit, we would just flush the output queue. - -Now, while ASCONF_a's ASCONF_ACK sits in the corked outq, we -continue to process the same ASCONF_b chunk from the packet. As -we have cached the previous ASCONF_ACK, we find it, grab it and -do another SCTP_CMD_REPLY command on it. So, effectively, we rip -the chunk->list pointers and requeue the same ASCONF_ACK chunk -another time. Since we process ASCONF_b, it's correctly marked -with end_of_packet and we enforce an uncork, and thus flush, thus -crashing the kernel. - -Fix it by testing if the ASCONF_ACK is currently pending and if -that is the case, do not requeue it. When flushing the output -queue we may relink the chunk for preparing an outgoing packet, -but eventually unlink it when it's copied into the skb right -before transmission. - -Joint work with Vlad Yasevich. - -Fixes: 2e3216cd54b1 ("sctp: Follow security requirement of responding with 1 packet") -Signed-off-by: Daniel Borkmann <dborkman@redhat.com> -Signed-off-by: Vlad Yasevich <vyasevich@gmail.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - include/net/sctp/sctp.h | 5 +++++ - net/sctp/associola.c | 2 ++ - 2 files changed, 7 insertions(+) - ---- a/include/net/sctp/sctp.h -+++ b/include/net/sctp/sctp.h -@@ -524,6 +524,11 @@ static inline void sctp_assoc_pending_pm - asoc->pmtu_pending = 0; - } - -+static inline bool sctp_chunk_pending(const struct sctp_chunk *chunk) -+{ -+ return !list_empty(&chunk->list); -+} -+ - /* Walk through a list of TLV parameters. Don't trust the - * individual parameter lengths and instead depend on - * the chunk length to indicate when to stop. Make sure ---- a/net/sctp/associola.c -+++ b/net/sctp/associola.c -@@ -1637,6 +1637,8 @@ struct sctp_chunk *sctp_assoc_lookup_asc - * ack chunk whose serial number matches that of the request. - */ - list_for_each_entry(ack, &asoc->asconf_ack_list, transmitted_list) { -+ if (sctp_chunk_pending(ack)) -+ continue; - if (ack->subh.addip_hdr->serial == serial) { - sctp_chunk_hold(ack); - return ack; diff --git a/patches/net-sctp-fix-passing-wrong-parameter-header-to-param_type2af-in-sctp_process_param.patch b/patches/net-sctp-fix-passing-wrong-parameter-header-to-param_type2af-in-sctp_process_param.patch deleted file mode 100644 index cdc90f2..0000000 --- a/patches/net-sctp-fix-passing-wrong-parameter-header-to-param_type2af-in-sctp_process_param.patch +++ /dev/null @@ -1,42 +0,0 @@ -From cfbf654efc6d78dc9812e030673b86f235bf677d Mon Sep 17 00:00:00 2001 -From: Saran Maruti Ramanara <saran.neti@telus.com> -Date: Thu, 29 Jan 2015 11:05:58 +0100 -Subject: net: sctp: fix passing wrong parameter header to param_type2af in - sctp_process_param - -commit cfbf654efc6d78dc9812e030673b86f235bf677d upstream. - -When making use of RFC5061, section 4.2.4. for setting the primary IP -address, we're passing a wrong parameter header to param_type2af(), -resulting always in NULL being returned. - -At this point, param.p points to a sctp_addip_param struct, containing -a sctp_paramhdr (type = 0xc004, length = var), and crr_id as a correlation -id. Followed by that, as also presented in RFC5061 section 4.2.4., comes -the actual sctp_addr_param, which also contains a sctp_paramhdr, but -this time with the correct type SCTP_PARAM_IPV{4,6}_ADDRESS that -param_type2af() can make use of. Since we already hold a pointer to -addr_param from previous line, just reuse it for param_type2af(). - -Fixes: d6de3097592b ("[SCTP]: Add the handling of "Set Primary IP Address" parameter to INIT") -Signed-off-by: Saran Maruti Ramanara <saran.neti@telus.com> -Signed-off-by: Daniel Borkmann <dborkman@redhat.com> -Acked-by: Vlad Yasevich <vyasevich@gmail.com> -Acked-by: Neil Horman <nhorman@tuxdriver.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/sctp/sm_make_chunk.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/net/sctp/sm_make_chunk.c -+++ b/net/sctp/sm_make_chunk.c -@@ -2569,7 +2569,7 @@ do_addr_param: - - addr_param = param.v + sizeof(sctp_addip_param_t); - -- af = sctp_get_af_specific(param_type2af(param.p->type)); -+ af = sctp_get_af_specific(param_type2af(addr_param->p.type)); - if (af == NULL) - break; - diff --git a/patches/net-sctp-fix-skb_over_panic-when-receiving-malformed-asconf-chunks.patch b/patches/net-sctp-fix-skb_over_panic-when-receiving-malformed-asconf-chunks.patch deleted file mode 100644 index 59ed324..0000000 --- a/patches/net-sctp-fix-skb_over_panic-when-receiving-malformed-asconf-chunks.patch +++ /dev/null @@ -1,334 +0,0 @@ -From 9de7922bc709eee2f609cd01d98aaedc4cf5ea74 Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann <dborkman@redhat.com> -Date: Thu, 9 Oct 2014 22:55:31 +0200 -Subject: net: sctp: fix skb_over_panic when receiving malformed ASCONF chunks - -commit 9de7922bc709eee2f609cd01d98aaedc4cf5ea74 upstream. - -Commit 6f4c618ddb0 ("SCTP : Add paramters validity check for -ASCONF chunk") added basic verification of ASCONF chunks, however, -it is still possible to remotely crash a server by sending a -special crafted ASCONF chunk, even up to pre 2.6.12 kernels: - -skb_over_panic: text:ffffffffa01ea1c3 len:31056 put:30768 - head:ffff88011bd81800 data:ffff88011bd81800 tail:0x7950 - end:0x440 dev:<NULL> - ------------[ cut here ]------------ -kernel BUG at net/core/skbuff.c:129! -[...] -Call Trace: - <IRQ> - [<ffffffff8144fb1c>] skb_put+0x5c/0x70 - [<ffffffffa01ea1c3>] sctp_addto_chunk+0x63/0xd0 [sctp] - [<ffffffffa01eadaf>] sctp_process_asconf+0x1af/0x540 [sctp] - [<ffffffff8152d025>] ? _read_unlock_bh+0x15/0x20 - [<ffffffffa01e0038>] sctp_sf_do_asconf+0x168/0x240 [sctp] - [<ffffffffa01e3751>] sctp_do_sm+0x71/0x1210 [sctp] - [<ffffffff8147645d>] ? fib_rules_lookup+0xad/0xf0 - [<ffffffffa01e6b22>] ? sctp_cmp_addr_exact+0x32/0x40 [sctp] - [<ffffffffa01e8393>] sctp_assoc_bh_rcv+0xd3/0x180 [sctp] - [<ffffffffa01ee986>] sctp_inq_push+0x56/0x80 [sctp] - [<ffffffffa01fcc42>] sctp_rcv+0x982/0xa10 [sctp] - [<ffffffffa01d5123>] ? ipt_local_in_hook+0x23/0x28 [iptable_filter] - [<ffffffff8148bdc9>] ? nf_iterate+0x69/0xb0 - [<ffffffff81496d10>] ? ip_local_deliver_finish+0x0/0x2d0 - [<ffffffff8148bf86>] ? nf_hook_slow+0x76/0x120 - [<ffffffff81496d10>] ? ip_local_deliver_finish+0x0/0x2d0 - [<ffffffff81496ded>] ip_local_deliver_finish+0xdd/0x2d0 - [<ffffffff81497078>] ip_local_deliver+0x98/0xa0 - [<ffffffff8149653d>] ip_rcv_finish+0x12d/0x440 - [<ffffffff81496ac5>] ip_rcv+0x275/0x350 - [<ffffffff8145c88b>] __netif_receive_skb+0x4ab/0x750 - [<ffffffff81460588>] netif_receive_skb+0x58/0x60 - -This can be triggered e.g., through a simple scripted nmap -connection scan injecting the chunk after the handshake, for -example, ... - - -------------- INIT[ASCONF; ASCONF_ACK] -------------> - <----------- INIT-ACK[ASCONF; ASCONF_ACK] ------------ - -------------------- COOKIE-ECHO --------------------> - <-------------------- COOKIE-ACK --------------------- - ------------------ ASCONF; UNKNOWN ------------------> - -... where ASCONF chunk of length 280 contains 2 parameters ... - - 1) Add IP address parameter (param length: 16) - 2) Add/del IP address parameter (param length: 255) - -... followed by an UNKNOWN chunk of e.g. 4 bytes. Here, the -Address Parameter in the ASCONF chunk is even missing, too. -This is just an example and similarly-crafted ASCONF chunks -could be used just as well. - -The ASCONF chunk passes through sctp_verify_asconf() as all -parameters passed sanity checks, and after walking, we ended -up successfully at the chunk end boundary, and thus may invoke -sctp_process_asconf(). Parameter walking is done with -WORD_ROUND() to take padding into account. - -In sctp_process_asconf()'s TLV processing, we may fail in -sctp_process_asconf_param() e.g., due to removal of the IP -address that is also the source address of the packet containing -the ASCONF chunk, and thus we need to add all TLVs after the -failure to our ASCONF response to remote via helper function -sctp_add_asconf_response(), which basically invokes a -sctp_addto_chunk() adding the error parameters to the given -skb. - -When walking to the next parameter this time, we proceed -with ... - - length = ntohs(asconf_param->param_hdr.length); - asconf_param = (void *)asconf_param + length; - -... instead of the WORD_ROUND()'ed length, thus resulting here -in an off-by-one that leads to reading the follow-up garbage -parameter length of 12336, and thus throwing an skb_over_panic -for the reply when trying to sctp_addto_chunk() next time, -which implicitly calls the skb_put() with that length. - -Fix it by using sctp_walk_params() [ which is also used in -INIT parameter processing ] macro in the verification *and* -in ASCONF processing: it will make sure we don't spill over, -that we walk parameters WORD_ROUND()'ed. Moreover, we're being -more defensive and guard against unknown parameter types and -missized addresses. - -Joint work with Vlad Yasevich. - -Fixes: b896b82be4ae ("[SCTP] ADDIP: Support for processing incoming ASCONF_ACK chunks.") -Signed-off-by: Daniel Borkmann <dborkman@redhat.com> -Signed-off-by: Vlad Yasevich <vyasevich@gmail.com> -Acked-by: Neil Horman <nhorman@tuxdriver.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - include/net/sctp/sm.h | 6 +- - net/sctp/sm_make_chunk.c | 99 ++++++++++++++++++++++++++--------------------- - net/sctp/sm_statefuns.c | 18 -------- - 3 files changed, 60 insertions(+), 63 deletions(-) - ---- a/include/net/sctp/sm.h -+++ b/include/net/sctp/sm.h -@@ -251,9 +251,9 @@ struct sctp_chunk *sctp_make_asconf_upda - int, __be16); - struct sctp_chunk *sctp_make_asconf_set_prim(struct sctp_association *asoc, - union sctp_addr *addr); --int sctp_verify_asconf(const struct sctp_association *asoc, -- struct sctp_paramhdr *param_hdr, void *chunk_end, -- struct sctp_paramhdr **errp); -+bool sctp_verify_asconf(const struct sctp_association *asoc, -+ struct sctp_chunk *chunk, bool addr_param_needed, -+ struct sctp_paramhdr **errp); - struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, - struct sctp_chunk *asconf); - int sctp_process_asconf_ack(struct sctp_association *asoc, ---- a/net/sctp/sm_make_chunk.c -+++ b/net/sctp/sm_make_chunk.c -@@ -3068,50 +3068,63 @@ static __be16 sctp_process_asconf_param( - return SCTP_ERROR_NO_ERROR; - } - --/* Verify the ASCONF packet before we process it. */ --int sctp_verify_asconf(const struct sctp_association *asoc, -- struct sctp_paramhdr *param_hdr, void *chunk_end, -- struct sctp_paramhdr **errp) { -- sctp_addip_param_t *asconf_param; -+/* Verify the ASCONF packet before we process it. */ -+bool sctp_verify_asconf(const struct sctp_association *asoc, -+ struct sctp_chunk *chunk, bool addr_param_needed, -+ struct sctp_paramhdr **errp) -+{ -+ sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) chunk->chunk_hdr; - union sctp_params param; -- int length, plen; -- -- param.v = (sctp_paramhdr_t *) param_hdr; -- while (param.v <= chunk_end - sizeof(sctp_paramhdr_t)) { -- length = ntohs(param.p->length); -- *errp = param.p; -+ bool addr_param_seen = false; - -- if (param.v > chunk_end - length || -- length < sizeof(sctp_paramhdr_t)) -- return 0; -+ sctp_walk_params(param, addip, addip_hdr.params) { -+ size_t length = ntohs(param.p->length); - -+ *errp = param.p; - switch (param.p->type) { -+ case SCTP_PARAM_ERR_CAUSE: -+ break; -+ case SCTP_PARAM_IPV4_ADDRESS: -+ if (length != sizeof(sctp_ipv4addr_param_t)) -+ return false; -+ addr_param_seen = true; -+ break; -+ case SCTP_PARAM_IPV6_ADDRESS: -+ if (length != sizeof(sctp_ipv6addr_param_t)) -+ return false; -+ addr_param_seen = true; -+ break; - case SCTP_PARAM_ADD_IP: - case SCTP_PARAM_DEL_IP: - case SCTP_PARAM_SET_PRIMARY: -- asconf_param = (sctp_addip_param_t *)param.v; -- plen = ntohs(asconf_param->param_hdr.length); -- if (plen < sizeof(sctp_addip_param_t) + -- sizeof(sctp_paramhdr_t)) -- return 0; -+ /* In ASCONF chunks, these need to be first. */ -+ if (addr_param_needed && !addr_param_seen) -+ return false; -+ length = ntohs(param.addip->param_hdr.length); -+ if (length < sizeof(sctp_addip_param_t) + -+ sizeof(sctp_paramhdr_t)) -+ return false; - break; - case SCTP_PARAM_SUCCESS_REPORT: - case SCTP_PARAM_ADAPTATION_LAYER_IND: - if (length != sizeof(sctp_addip_param_t)) -- return 0; -- -+ return false; - break; - default: -- break; -+ /* This is unkown to us, reject! */ -+ return false; - } -- -- param.v += WORD_ROUND(length); - } - -- if (param.v != chunk_end) -- return 0; -+ /* Remaining sanity checks. */ -+ if (addr_param_needed && !addr_param_seen) -+ return false; -+ if (!addr_param_needed && addr_param_seen) -+ return false; -+ if (param.v != chunk->chunk_end) -+ return false; - -- return 1; -+ return true; - } - - /* Process an incoming ASCONF chunk with the next expected serial no. and -@@ -3120,16 +3133,17 @@ int sctp_verify_asconf(const struct sctp - struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, - struct sctp_chunk *asconf) - { -+ sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) asconf->chunk_hdr; -+ bool all_param_pass = true; -+ union sctp_params param; - sctp_addiphdr_t *hdr; - union sctp_addr_param *addr_param; - sctp_addip_param_t *asconf_param; - struct sctp_chunk *asconf_ack; -- - __be16 err_code; - int length = 0; - int chunk_len; - __u32 serial; -- int all_param_pass = 1; - - chunk_len = ntohs(asconf->chunk_hdr->length) - sizeof(sctp_chunkhdr_t); - hdr = (sctp_addiphdr_t *)asconf->skb->data; -@@ -3157,9 +3171,14 @@ struct sctp_chunk *sctp_process_asconf(s - goto done; - - /* Process the TLVs contained within the ASCONF chunk. */ -- while (chunk_len > 0) { -+ sctp_walk_params(param, addip, addip_hdr.params) { -+ /* Skip preceeding address parameters. */ -+ if (param.p->type == SCTP_PARAM_IPV4_ADDRESS || -+ param.p->type == SCTP_PARAM_IPV6_ADDRESS) -+ continue; -+ - err_code = sctp_process_asconf_param(asoc, asconf, -- asconf_param); -+ param.addip); - /* ADDIP 4.1 A7) - * If an error response is received for a TLV parameter, - * all TLVs with no response before the failed TLV are -@@ -3167,28 +3186,20 @@ struct sctp_chunk *sctp_process_asconf(s - * the failed response are considered unsuccessful unless - * a specific success indication is present for the parameter. - */ -- if (SCTP_ERROR_NO_ERROR != err_code) -- all_param_pass = 0; -- -+ if (err_code != SCTP_ERROR_NO_ERROR) -+ all_param_pass = false; - if (!all_param_pass) -- sctp_add_asconf_response(asconf_ack, -- asconf_param->crr_id, err_code, -- asconf_param); -+ sctp_add_asconf_response(asconf_ack, param.addip->crr_id, -+ err_code, param.addip); - - /* ADDIP 4.3 D11) When an endpoint receiving an ASCONF to add - * an IP address sends an 'Out of Resource' in its response, it - * MUST also fail any subsequent add or delete requests bundled - * in the ASCONF. - */ -- if (SCTP_ERROR_RSRC_LOW == err_code) -+ if (err_code == SCTP_ERROR_RSRC_LOW) - goto done; -- -- /* Move to the next ASCONF param. */ -- length = ntohs(asconf_param->param_hdr.length); -- asconf_param = (void *)asconf_param + length; -- chunk_len -= length; - } -- - done: - asoc->peer.addip_serial++; - ---- a/net/sctp/sm_statefuns.c -+++ b/net/sctp/sm_statefuns.c -@@ -3516,9 +3516,7 @@ sctp_disposition_t sctp_sf_do_asconf(con - struct sctp_chunk *asconf_ack = NULL; - struct sctp_paramhdr *err_param = NULL; - sctp_addiphdr_t *hdr; -- union sctp_addr_param *addr_param; - __u32 serial; -- int length; - - if (!sctp_vtag_verify(chunk, asoc)) { - sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG, -@@ -3543,17 +3541,8 @@ sctp_disposition_t sctp_sf_do_asconf(con - hdr = (sctp_addiphdr_t *)chunk->skb->data; - serial = ntohl(hdr->serial); - -- addr_param = (union sctp_addr_param *)hdr->params; -- length = ntohs(addr_param->p.length); -- if (length < sizeof(sctp_paramhdr_t)) -- return sctp_sf_violation_paramlen(ep, asoc, type, arg, -- (void *)addr_param, commands); -- - /* Verify the ASCONF chunk before processing it. */ -- if (!sctp_verify_asconf(asoc, -- (sctp_paramhdr_t *)((void *)addr_param + length), -- (void *)chunk->chunk_end, -- &err_param)) -+ if (!sctp_verify_asconf(asoc, chunk, true, &err_param)) - return sctp_sf_violation_paramlen(ep, asoc, type, arg, - (void *)err_param, commands); - -@@ -3670,10 +3659,7 @@ sctp_disposition_t sctp_sf_do_asconf_ack - rcvd_serial = ntohl(addip_hdr->serial); - - /* Verify the ASCONF-ACK chunk before processing it. */ -- if (!sctp_verify_asconf(asoc, -- (sctp_paramhdr_t *)addip_hdr->params, -- (void *)asconf_ack->chunk_end, -- &err_param)) -+ if (!sctp_verify_asconf(asoc, asconf_ack, false, &err_param)) - return sctp_sf_violation_paramlen(ep, asoc, type, arg, - (void *)err_param, commands); - diff --git a/patches/net-sctp-fix-slab-corruption-from-use-after-free-on-init-collisions.patch b/patches/net-sctp-fix-slab-corruption-from-use-after-free-on-init-collisions.patch deleted file mode 100644 index 36d70b1..0000000 --- a/patches/net-sctp-fix-slab-corruption-from-use-after-free-on-init-collisions.patch +++ /dev/null @@ -1,129 +0,0 @@ -From 600ddd6825543962fb807884169e57b580dba208 Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann <dborkman@redhat.com> -Date: Thu, 22 Jan 2015 18:26:54 +0100 -Subject: net: sctp: fix slab corruption from use after free on INIT collisions - -commit 600ddd6825543962fb807884169e57b580dba208 upstream. - -When hitting an INIT collision case during the 4WHS with AUTH enabled, as -already described in detail in commit 1be9a950c646 ("net: sctp: inherit -auth_capable on INIT collisions"), it can happen that we occasionally -still remotely trigger the following panic on server side which seems to -have been uncovered after the fix from commit 1be9a950c646 ... - -[ 533.876389] BUG: unable to handle kernel paging request at 00000000ffffffff -[ 533.913657] IP: [<ffffffff811ac385>] __kmalloc+0x95/0x230 -[ 533.940559] PGD 5030f2067 PUD 0 -[ 533.957104] Oops: 0000 [#1] SMP -[ 533.974283] Modules linked in: sctp mlx4_en [...] -[ 534.939704] Call Trace: -[ 534.951833] [<ffffffff81294e30>] ? crypto_init_shash_ops+0x60/0xf0 -[ 534.984213] [<ffffffff81294e30>] crypto_init_shash_ops+0x60/0xf0 -[ 535.015025] [<ffffffff8128c8ed>] __crypto_alloc_tfm+0x6d/0x170 -[ 535.045661] [<ffffffff8128d12c>] crypto_alloc_base+0x4c/0xb0 -[ 535.074593] [<ffffffff8160bd42>] ? _raw_spin_lock_bh+0x12/0x50 -[ 535.105239] [<ffffffffa0418c11>] sctp_inet_listen+0x161/0x1e0 [sctp] -[ 535.138606] [<ffffffff814e43bd>] SyS_listen+0x9d/0xb0 -[ 535.166848] [<ffffffff816149a9>] system_call_fastpath+0x16/0x1b - -... or depending on the the application, for example this one: - -[ 1370.026490] BUG: unable to handle kernel paging request at 00000000ffffffff -[ 1370.026506] IP: [<ffffffff811ab455>] kmem_cache_alloc+0x75/0x1d0 -[ 1370.054568] PGD 633c94067 PUD 0 -[ 1370.070446] Oops: 0000 [#1] SMP -[ 1370.085010] Modules linked in: sctp kvm_amd kvm [...] -[ 1370.963431] Call Trace: -[ 1370.974632] [<ffffffff8120f7cf>] ? SyS_epoll_ctl+0x53f/0x960 -[ 1371.000863] [<ffffffff8120f7cf>] SyS_epoll_ctl+0x53f/0x960 -[ 1371.027154] [<ffffffff812100d3>] ? anon_inode_getfile+0xd3/0x170 -[ 1371.054679] [<ffffffff811e3d67>] ? __alloc_fd+0xa7/0x130 -[ 1371.080183] [<ffffffff816149a9>] system_call_fastpath+0x16/0x1b - -With slab debugging enabled, we can see that the poison has been overwritten: - -[ 669.826368] BUG kmalloc-128 (Tainted: G W ): Poison overwritten -[ 669.826385] INFO: 0xffff880228b32e50-0xffff880228b32e50. First byte 0x6a instead of 0x6b -[ 669.826414] INFO: Allocated in sctp_auth_create_key+0x23/0x50 [sctp] age=3 cpu=0 pid=18494 -[ 669.826424] __slab_alloc+0x4bf/0x566 -[ 669.826433] __kmalloc+0x280/0x310 -[ 669.826453] sctp_auth_create_key+0x23/0x50 [sctp] -[ 669.826471] sctp_auth_asoc_create_secret+0xcb/0x1e0 [sctp] -[ 669.826488] sctp_auth_asoc_init_active_key+0x68/0xa0 [sctp] -[ 669.826505] sctp_do_sm+0x29d/0x17c0 [sctp] [...] -[ 669.826629] INFO: Freed in kzfree+0x31/0x40 age=1 cpu=0 pid=18494 -[ 669.826635] __slab_free+0x39/0x2a8 -[ 669.826643] kfree+0x1d6/0x230 -[ 669.826650] kzfree+0x31/0x40 -[ 669.826666] sctp_auth_key_put+0x19/0x20 [sctp] -[ 669.826681] sctp_assoc_update+0x1ee/0x2d0 [sctp] -[ 669.826695] sctp_do_sm+0x674/0x17c0 [sctp] - -Since this only triggers in some collision-cases with AUTH, the problem at -heart is that sctp_auth_key_put() on asoc->asoc_shared_key is called twice -when having refcnt 1, once directly in sctp_assoc_update() and yet again -from within sctp_auth_asoc_init_active_key() via sctp_assoc_update() on -the already kzfree'd memory, which is also consistent with the observation -of the poison decrease from 0x6b to 0x6a (note: the overwrite is detected -at a later point in time when poison is checked on new allocation). - -Reference counting of auth keys revisited: - -Shared keys for AUTH chunks are being stored in endpoints and associations -in endpoint_shared_keys list. On endpoint creation, a null key is being -added; on association creation, all endpoint shared keys are being cached -and thus cloned over to the association. struct sctp_shared_key only holds -a pointer to the actual key bytes, that is, struct sctp_auth_bytes which -keeps track of users internally through refcounting. Naturally, on assoc -or enpoint destruction, sctp_shared_key are being destroyed directly and -the reference on sctp_auth_bytes dropped. - -User space can add keys to either list via setsockopt(2) through struct -sctp_authkey and by passing that to sctp_auth_set_key() which replaces or -adds a new auth key. There, sctp_auth_create_key() creates a new sctp_auth_bytes -with refcount 1 and in case of replacement drops the reference on the old -sctp_auth_bytes. A key can be set active from user space through setsockopt() -on the id via sctp_auth_set_active_key(), which iterates through either -endpoint_shared_keys and in case of an assoc, invokes (one of various places) -sctp_auth_asoc_init_active_key(). - -sctp_auth_asoc_init_active_key() computes the actual secret from local's -and peer's random, hmac and shared key parameters and returns a new key -directly as sctp_auth_bytes, that is asoc->asoc_shared_key, plus drops -the reference if there was a previous one. The secret, which where we -eventually double drop the ref comes from sctp_auth_asoc_set_secret() with -intitial refcount of 1, which also stays unchanged eventually in -sctp_assoc_update(). This key is later being used for crypto layer to -set the key for the hash in crypto_hash_setkey() from sctp_auth_calculate_hmac(). - -To close the loop: asoc->asoc_shared_key is freshly allocated secret -material and independant of the sctp_shared_key management keeping track -of only shared keys in endpoints and assocs. Hence, also commit 4184b2a79a76 -("net: sctp: fix memory leak in auth key management") is independant of -this bug here since it concerns a different layer (though same structures -being used eventually). asoc->asoc_shared_key is reference dropped correctly -on assoc destruction in sctp_association_free() and when active keys are -being replaced in sctp_auth_asoc_init_active_key(), it always has a refcount -of 1. Hence, it's freed prematurely in sctp_assoc_update(). Simple fix is -to remove that sctp_auth_key_put() from there which fixes these panics. - -Fixes: 730fc3d05cd4 ("[SCTP]: Implete SCTP-AUTH parameter processing") -Signed-off-by: Daniel Borkmann <dborkman@redhat.com> -Acked-by: Vlad Yasevich <vyasevich@gmail.com> -Acked-by: Neil Horman <nhorman@tuxdriver.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/sctp/associola.c | 1 - - 1 file changed, 1 deletion(-) - ---- a/net/sctp/associola.c -+++ b/net/sctp/associola.c -@@ -1272,7 +1272,6 @@ void sctp_assoc_update(struct sctp_assoc - asoc->peer.peer_hmacs = new->peer.peer_hmacs; - new->peer.peer_hmacs = NULL; - -- sctp_auth_key_put(asoc->asoc_shared_key); - sctp_auth_asoc_init_active_key(asoc, GFP_ATOMIC); - } - diff --git a/patches/net-socket-set-msg_namelen-to-0-if-msg_name-is-passed-as-null-in-msghdr-struct-from-userland.patch b/patches/net-socket-set-msg_namelen-to-0-if-msg_name-is-passed-as-null-in-msghdr-struct-from-userland.patch deleted file mode 100644 index c66105d..0000000 --- a/patches/net-socket-set-msg_namelen-to-0-if-msg_name-is-passed-as-null-in-msghdr-struct-from-userland.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 6a2a2b3ae0759843b22c929881cc184b00cc63ff Mon Sep 17 00:00:00 2001 -From: Ani Sinha <ani@arista.com> -Date: Mon, 8 Sep 2014 14:49:59 -0700 -Subject: net:socket: set msg_namelen to 0 if msg_name is passed as NULL in - msghdr struct from userland. - -commit 6a2a2b3ae0759843b22c929881cc184b00cc63ff upstream. - -Linux manpage for recvmsg and sendmsg calls does not explicitly mention setting msg_namelen to 0 when -msg_name passed set as NULL. When developers don't set msg_namelen member in msghdr, it might contain garbage -value which will fail the validation check and sendmsg and recvmsg calls from kernel will return EINVAL. This will -break old binaries and any code for which there is no access to source code. -To fix this, we set msg_namelen to 0 when msg_name is passed as NULL from userland. - -Signed-off-by: Ani Sinha <ani@arista.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Cc: Michal Marek <mmarek@suse.cz> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/socket.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/net/socket.c -+++ b/net/socket.c -@@ -1908,6 +1908,9 @@ static int copy_msghdr_from_user(struct - if (copy_from_user(kmsg, umsg, sizeof(struct msghdr))) - return -EFAULT; - -+ if (kmsg->msg_name == NULL) -+ kmsg->msg_namelen = 0; -+ - if (kmsg->msg_namelen < 0) - return -EINVAL; - diff --git a/patches/nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch b/patches/nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch deleted file mode 100644 index 5b69ac2..0000000 --- a/patches/nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch +++ /dev/null @@ -1,47 +0,0 @@ -From c6c15e1ed303ffc47e696ea1c9a9df1761c1f603 Mon Sep 17 00:00:00 2001 -From: Trond Myklebust <trond.myklebust@primarydata.com> -Date: Wed, 19 Nov 2014 12:47:50 -0500 -Subject: nfsd: Fix slot wake up race in the nfsv4.1 callback code - -commit c6c15e1ed303ffc47e696ea1c9a9df1761c1f603 upstream. - -The currect code for nfsd41_cb_get_slot() and nfsd4_cb_done() has no -locking in order to guarantee atomicity, and so allows for races of -the form. - -Task 1 Task 2 -====== ====== -if (test_and_set_bit(0) != 0) { - clear_bit(0) - rpc_wake_up_next(queue) - rpc_sleep_on(queue) - return false; -} - -This patch breaks the race condition by adding a retest of the bit -after the call to rpc_sleep_on(). - -Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com> -Signed-off-by: J. Bruce Fields <bfields@redhat.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/nfsd/nfs4callback.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - ---- a/fs/nfsd/nfs4callback.c -+++ b/fs/nfsd/nfs4callback.c -@@ -784,8 +784,12 @@ static bool nfsd41_cb_get_slot(struct nf - { - if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) { - rpc_sleep_on(&clp->cl_cb_waitq, task, NULL); -- dprintk("%s slot is busy\n", __func__); -- return false; -+ /* Race breaker */ -+ if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) { -+ dprintk("%s slot is busy\n", __func__); -+ return false; -+ } -+ rpc_wake_up_queued_task(&clp->cl_cb_waitq, task); - } - return true; - } diff --git a/patches/nilfs2-fix-deadlock-of-segment-constructor-during-recovery.patch b/patches/nilfs2-fix-deadlock-of-segment-constructor-during-recovery.patch deleted file mode 100644 index 19e069c..0000000 --- a/patches/nilfs2-fix-deadlock-of-segment-constructor-during-recovery.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 283ee1482f349d6c0c09dfb725db5880afc56813 Mon Sep 17 00:00:00 2001 -From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> -Date: Thu, 12 Mar 2015 16:26:00 -0700 -Subject: nilfs2: fix deadlock of segment constructor during recovery - -commit 283ee1482f349d6c0c09dfb725db5880afc56813 upstream. - -According to a report from Yuxuan Shui, nilfs2 in kernel 3.19 got stuck -during recovery at mount time. The code path that caused the deadlock was -as follows: - - nilfs_fill_super() - load_nilfs() - nilfs_salvage_orphan_logs() - * Do roll-forwarding, attach segment constructor for recovery, - and kick it. - - nilfs_segctor_thread() - nilfs_segctor_thread_construct() - * A lock is held with nilfs_transaction_lock() - nilfs_segctor_do_construct() - nilfs_segctor_drop_written_files() - iput() - iput_final() - write_inode_now() - writeback_single_inode() - __writeback_single_inode() - do_writepages() - nilfs_writepage() - nilfs_construct_dsync_segment() - nilfs_transaction_lock() --> deadlock - -This can happen if commit 7ef3ff2fea8b ("nilfs2: fix deadlock of segment -constructor over I_SYNC flag") is applied and roll-forward recovery was -performed at mount time. The roll-forward recovery can happen if datasync -write is done and the file system crashes immediately after that. For -instance, we can reproduce the issue with the following steps: - - < nilfs2 is mounted on /nilfs (device: /dev/sdb1) > - # dd if=/dev/zero of=/nilfs/test bs=4k count=1 && sync - # dd if=/dev/zero of=/nilfs/test conv=notrunc oflag=dsync bs=4k - count=1 && reboot -nfh - < the system will immediately reboot > - # mount -t nilfs2 /dev/sdb1 /nilfs - -The deadlock occurs because iput() can run segment constructor through -writeback_single_inode() if MS_ACTIVE flag is not set on sb->s_flags. The -above commit changed segment constructor so that it calls iput() -asynchronously for inodes with i_nlink == 0, but that change was -imperfect. - -This fixes the another deadlock by deferring iput() in segment constructor -even for the case that mount is not finished, that is, for the case that -MS_ACTIVE flag is not set. - -Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> -Reported-by: Yuxuan Shui <yshuiv7@gmail.com> -Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> -Cc: Al Viro <viro@zeniv.linux.org.uk> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/nilfs2/segment.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - ---- a/fs/nilfs2/segment.c -+++ b/fs/nilfs2/segment.c -@@ -1903,6 +1903,7 @@ static void nilfs_segctor_drop_written_f - struct the_nilfs *nilfs) - { - struct nilfs_inode_info *ii, *n; -+ int during_mount = !(sci->sc_super->s_flags & MS_ACTIVE); - int defer_iput = false; - - spin_lock(&nilfs->ns_inode_lock); -@@ -1915,10 +1916,10 @@ static void nilfs_segctor_drop_written_f - brelse(ii->i_bh); - ii->i_bh = NULL; - list_del_init(&ii->i_dirty); -- if (!ii->vfs_inode.i_nlink) { -+ if (!ii->vfs_inode.i_nlink || during_mount) { - /* -- * Defer calling iput() to avoid a deadlock -- * over I_SYNC flag for inodes with i_nlink == 0 -+ * Defer calling iput() to avoid deadlocks if -+ * i_nlink == 0 or mount is not yet finished. - */ - list_add_tail(&ii->i_dirty, &sci->sc_iput_queue); - defer_iput = true; diff --git a/patches/nilfs2-fix-deadlock-of-segment-constructor-over-i_sync-flag.patch b/patches/nilfs2-fix-deadlock-of-segment-constructor-over-i_sync-flag.patch deleted file mode 100644 index ca8fd3a..0000000 --- a/patches/nilfs2-fix-deadlock-of-segment-constructor-over-i_sync-flag.patch +++ /dev/null @@ -1,217 +0,0 @@ -From 7ef3ff2fea8bf5e4a21cef47ad87710a3d0fdb52 Mon Sep 17 00:00:00 2001 -From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> -Date: Thu, 5 Feb 2015 12:25:20 -0800 -Subject: nilfs2: fix deadlock of segment constructor over I_SYNC flag - -commit 7ef3ff2fea8bf5e4a21cef47ad87710a3d0fdb52 upstream. - -Nilfs2 eventually hangs in a stress test with fsstress program. This -issue was caused by the following deadlock over I_SYNC flag between -nilfs_segctor_thread() and writeback_sb_inodes(): - - nilfs_segctor_thread() - nilfs_segctor_thread_construct() - nilfs_segctor_unlock() - nilfs_dispose_list() - iput() - iput_final() - evict() - inode_wait_for_writeback() * wait for I_SYNC flag - - writeback_sb_inodes() - * set I_SYNC flag on inode->i_state - __writeback_single_inode() - do_writepages() - nilfs_writepages() - nilfs_construct_dsync_segment() - nilfs_segctor_sync() - * wait for completion of segment constructor - inode_sync_complete() - * clear I_SYNC flag after __writeback_single_inode() completed - -writeback_sb_inodes() calls do_writepages() for dirty inodes after -setting I_SYNC flag on inode->i_state. do_writepages() in turn calls -nilfs_writepages(), which can run segment constructor and wait for its -completion. On the other hand, segment constructor calls iput(), which -can call evict() and wait for the I_SYNC flag on -inode_wait_for_writeback(). - -Since segment constructor doesn't know when I_SYNC will be set, it -cannot know whether iput() will block or not unless inode->i_nlink has a -non-zero count. We can prevent evict() from being called in iput() by -implementing sop->drop_inode(), but it's not preferable to leave inodes -with i_nlink == 0 for long periods because it even defers file -truncation and inode deallocation. So, this instead resolves the -deadlock by calling iput() asynchronously with a workqueue for inodes -with i_nlink == 0. - -Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> -Cc: Al Viro <viro@zeniv.linux.org.uk> -Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/nilfs2/nilfs.h | 2 -- - fs/nilfs2/segment.c | 44 +++++++++++++++++++++++++++++++++++++++----- - fs/nilfs2/segment.h | 5 +++++ - 3 files changed, 44 insertions(+), 7 deletions(-) - ---- a/fs/nilfs2/nilfs.h -+++ b/fs/nilfs2/nilfs.h -@@ -128,7 +128,6 @@ enum { - * @ti_save: Backup of journal_info field of task_struct - * @ti_flags: Flags - * @ti_count: Nest level -- * @ti_garbage: List of inode to be put when releasing semaphore - */ - struct nilfs_transaction_info { - u32 ti_magic; -@@ -137,7 +136,6 @@ struct nilfs_transaction_info { - one of other filesystems has a bug. */ - unsigned short ti_flags; - unsigned short ti_count; -- struct list_head ti_garbage; - }; - - /* ti_magic */ ---- a/fs/nilfs2/segment.c -+++ b/fs/nilfs2/segment.c -@@ -302,7 +302,6 @@ static void nilfs_transaction_lock(struc - ti->ti_count = 0; - ti->ti_save = cur_ti; - ti->ti_magic = NILFS_TI_MAGIC; -- INIT_LIST_HEAD(&ti->ti_garbage); - current->journal_info = ti; - - for (;;) { -@@ -329,8 +328,6 @@ static void nilfs_transaction_unlock(str - - up_write(&nilfs->ns_segctor_sem); - current->journal_info = ti->ti_save; -- if (!list_empty(&ti->ti_garbage)) -- nilfs_dispose_list(nilfs, &ti->ti_garbage, 0); - } - - static void *nilfs_segctor_map_segsum_entry(struct nilfs_sc_info *sci, -@@ -743,6 +740,15 @@ static void nilfs_dispose_list(struct th - } - } - -+static void nilfs_iput_work_func(struct work_struct *work) -+{ -+ struct nilfs_sc_info *sci = container_of(work, struct nilfs_sc_info, -+ sc_iput_work); -+ struct the_nilfs *nilfs = sci->sc_super->s_fs_info; -+ -+ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 0); -+} -+ - static int nilfs_test_metadata_dirty(struct the_nilfs *nilfs, - struct nilfs_root *root) - { -@@ -1896,8 +1902,8 @@ static int nilfs_segctor_collect_dirty_f - static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci, - struct the_nilfs *nilfs) - { -- struct nilfs_transaction_info *ti = current->journal_info; - struct nilfs_inode_info *ii, *n; -+ int defer_iput = false; - - spin_lock(&nilfs->ns_inode_lock); - list_for_each_entry_safe(ii, n, &sci->sc_dirty_files, i_dirty) { -@@ -1908,9 +1914,24 @@ static void nilfs_segctor_drop_written_f - clear_bit(NILFS_I_BUSY, &ii->i_state); - brelse(ii->i_bh); - ii->i_bh = NULL; -- list_move_tail(&ii->i_dirty, &ti->ti_garbage); -+ list_del_init(&ii->i_dirty); -+ if (!ii->vfs_inode.i_nlink) { -+ /* -+ * Defer calling iput() to avoid a deadlock -+ * over I_SYNC flag for inodes with i_nlink == 0 -+ */ -+ list_add_tail(&ii->i_dirty, &sci->sc_iput_queue); -+ defer_iput = true; -+ } else { -+ spin_unlock(&nilfs->ns_inode_lock); -+ iput(&ii->vfs_inode); -+ spin_lock(&nilfs->ns_inode_lock); -+ } - } - spin_unlock(&nilfs->ns_inode_lock); -+ -+ if (defer_iput) -+ schedule_work(&sci->sc_iput_work); - } - - /* -@@ -2577,6 +2598,8 @@ static struct nilfs_sc_info *nilfs_segct - INIT_LIST_HEAD(&sci->sc_segbufs); - INIT_LIST_HEAD(&sci->sc_write_logs); - INIT_LIST_HEAD(&sci->sc_gc_inodes); -+ INIT_LIST_HEAD(&sci->sc_iput_queue); -+ INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func); - init_timer(&sci->sc_timer); - - sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT; -@@ -2603,6 +2626,8 @@ static void nilfs_segctor_write_out(stru - ret = nilfs_segctor_construct(sci, SC_LSEG_SR); - nilfs_transaction_unlock(sci->sc_super); - -+ flush_work(&sci->sc_iput_work); -+ - } while (ret && retrycount-- > 0); - } - -@@ -2627,6 +2652,9 @@ static void nilfs_segctor_destroy(struct - || sci->sc_seq_request != sci->sc_seq_done); - spin_unlock(&sci->sc_state_lock); - -+ if (flush_work(&sci->sc_iput_work)) -+ flag = true; -+ - if (flag || !nilfs_segctor_confirm(sci)) - nilfs_segctor_write_out(sci); - -@@ -2636,6 +2664,12 @@ static void nilfs_segctor_destroy(struct - nilfs_dispose_list(nilfs, &sci->sc_dirty_files, 1); - } - -+ if (!list_empty(&sci->sc_iput_queue)) { -+ nilfs_warning(sci->sc_super, __func__, -+ "iput queue is not empty\n"); -+ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 1); -+ } -+ - WARN_ON(!list_empty(&sci->sc_segbufs)); - WARN_ON(!list_empty(&sci->sc_write_logs)); - ---- a/fs/nilfs2/segment.h -+++ b/fs/nilfs2/segment.h -@@ -26,6 +26,7 @@ - #include <linux/types.h> - #include <linux/fs.h> - #include <linux/buffer_head.h> -+#include <linux/workqueue.h> - #include <linux/nilfs2_fs.h> - #include "nilfs.h" - -@@ -92,6 +93,8 @@ struct nilfs_segsum_pointer { - * @sc_nblk_inc: Block count of current generation - * @sc_dirty_files: List of files to be written - * @sc_gc_inodes: List of GC inodes having blocks to be written -+ * @sc_iput_queue: list of inodes for which iput should be done -+ * @sc_iput_work: work struct to defer iput call - * @sc_freesegs: array of segment numbers to be freed - * @sc_nfreesegs: number of segments on @sc_freesegs - * @sc_dsync_inode: inode whose data pages are written for a sync operation -@@ -135,6 +138,8 @@ struct nilfs_sc_info { - - struct list_head sc_dirty_files; - struct list_head sc_gc_inodes; -+ struct list_head sc_iput_queue; -+ struct work_struct sc_iput_work; - - __u64 *sc_freesegs; - size_t sc_nfreesegs; diff --git a/patches/nl80211-fix-per-station-group-key-get-del-and-memory-leak.patch b/patches/nl80211-fix-per-station-group-key-get-del-and-memory-leak.patch deleted file mode 100644 index 60c7c5e..0000000 --- a/patches/nl80211-fix-per-station-group-key-get-del-and-memory-leak.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 0fa7b39131576dd1baa6ca17fca53c65d7f62249 Mon Sep 17 00:00:00 2001 -From: Johannes Berg <johannes.berg@intel.com> -Date: Fri, 23 Jan 2015 11:10:12 +0100 -Subject: nl80211: fix per-station group key get/del and memory leak - -commit 0fa7b39131576dd1baa6ca17fca53c65d7f62249 upstream. - -In case userspace attempts to obtain key information for or delete a -unicast key, this is currently erroneously rejected unless the driver -sets the WIPHY_FLAG_IBSS_RSN flag. Apparently enough drivers do so it -was never noticed. - -Fix that, and while at it fix a potential memory leak: the error path -in the get_key() function was placed after allocating a message but -didn't free it - move it to a better place. Luckily admin permissions -are needed to call this operation. - -Fixes: e31b82136d1ad ("cfg80211/mac80211: allow per-station GTKs") -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/wireless/nl80211.c | 9 ++++----- - 1 file changed, 4 insertions(+), 5 deletions(-) - ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -1868,6 +1868,9 @@ static int nl80211_get_key(struct sk_buf - if (!rdev->ops->get_key) - return -EOPNOTSUPP; - -+ if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) -+ return -ENOENT; -+ - msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); - if (!msg) - return -ENOMEM; -@@ -1885,10 +1888,6 @@ static int nl80211_get_key(struct sk_buf - if (mac_addr) - NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr); - -- if (pairwise && mac_addr && -- !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) -- return -ENOENT; -- - err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise, - mac_addr, &cookie, get_key_callback); - -@@ -2060,7 +2059,7 @@ static int nl80211_del_key(struct sk_buf - wdev_lock(dev->ieee80211_ptr); - err = nl80211_key_allowed(dev->ieee80211_ptr); - -- if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr && -+ if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && - !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) - err = -ENOENT; - diff --git a/patches/ntp-fixup-adjtimex-freq-validation-on-32-bit-systems.patch b/patches/ntp-fixup-adjtimex-freq-validation-on-32-bit-systems.patch deleted file mode 100644 index e7a16d2..0000000 --- a/patches/ntp-fixup-adjtimex-freq-validation-on-32-bit-systems.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 29183a70b0b828500816bd794b3fe192fce89f73 Mon Sep 17 00:00:00 2001 -From: John Stultz <john.stultz@linaro.org> -Date: Mon, 9 Feb 2015 23:30:36 -0800 -Subject: ntp: Fixup adjtimex freq validation on 32-bit systems - -commit 29183a70b0b828500816bd794b3fe192fce89f73 upstream. - -Additional validation of adjtimex freq values to avoid -potential multiplication overflows were added in commit -5e5aeb4367b (time: adjtimex: Validate the ADJ_FREQUENCY values) - -Unfortunately the patch used LONG_MAX/MIN instead of -LLONG_MAX/MIN, which was fine on 64-bit systems, but being -much smaller on 32-bit systems caused false positives -resulting in most direct frequency adjustments to fail w/ -EINVAL. - -ntpd only does direct frequency adjustments at startup, so -the issue was not as easily observed there, but other time -sync applications like ptpd and chrony were more effected by -the bug. - -See bugs: - - https://bugzilla.kernel.org/show_bug.cgi?id=92481 - https://bugzilla.redhat.com/show_bug.cgi?id=1188074 - -This patch changes the checks to use LLONG_MAX for -clarity, and additionally the checks are disabled -on 32-bit systems since LLONG_MAX/PPM_SCALE is always -larger then the 32-bit long freq value, so multiplication -overflows aren't possible there. - -Reported-by: Josh Boyer <jwboyer@fedoraproject.org> -Reported-by: George Joseph <george.joseph@fairview5.com> -Tested-by: George Joseph <george.joseph@fairview5.com> -Signed-off-by: John Stultz <john.stultz@linaro.org> -Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Cc: Sasha Levin <sasha.levin@oracle.com> -Link: http://lkml.kernel.org/r/1423553436-29747-1-git-send-email-john.stultz@linaro.org -[ Prettified the changelog and the comments a bit. ] -Signed-off-by: Ingo Molnar <mingo@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/time/ntp.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - ---- a/kernel/time/ntp.c -+++ b/kernel/time/ntp.c -@@ -660,10 +660,14 @@ int do_adjtimex(struct timex *txc) - return result; - } - -- if (txc->modes & ADJ_FREQUENCY) { -- if (LONG_MIN / PPM_SCALE > txc->freq) -+ /* -+ * Check for potential multiplication overflows that can -+ * only happen on 64-bit systems: -+ */ -+ if ((txc->modes & ADJ_FREQUENCY) && (BITS_PER_LONG == 64)) { -+ if (LLONG_MIN / PPM_SCALE > txc->freq) - return -EINVAL; -- if (LONG_MAX / PPM_SCALE < txc->freq) -+ if (LLONG_MAX / PPM_SCALE < txc->freq) - return -EINVAL; - } - diff --git a/patches/ocfs2-fix-journal-commit-deadlock.patch b/patches/ocfs2-fix-journal-commit-deadlock.patch deleted file mode 100644 index ece83af..0000000 --- a/patches/ocfs2-fix-journal-commit-deadlock.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 136f49b9171074872f2a14ad0ab10486d1ba13ca Mon Sep 17 00:00:00 2001 -From: Junxiao Bi <junxiao.bi@oracle.com> -Date: Thu, 18 Dec 2014 16:17:37 -0800 -Subject: ocfs2: fix journal commit deadlock - -commit 136f49b9171074872f2a14ad0ab10486d1ba13ca upstream. - -For buffer write, page lock will be got in write_begin and released in -write_end, in ocfs2_write_end_nolock(), before it unlock the page in -ocfs2_free_write_ctxt(), it calls ocfs2_run_deallocs(), this will ask -for the read lock of journal->j_trans_barrier. Holding page lock and -ask for journal->j_trans_barrier breaks the locking order. - -This will cause a deadlock with journal commit threads, ocfs2cmt will -get write lock of journal->j_trans_barrier first, then it wakes up -kjournald2 to do the commit work, at last it waits until done. To -commit journal, kjournald2 needs flushing data first, it needs get the -cache page lock. - -Since some ocfs2 cluster locks are holding by write process, this -deadlock may hung the whole cluster. - -unlock pages before ocfs2_run_deallocs() can fix the locking order, also -put unlock before ocfs2_commit_trans() to make page lock is unlocked -before j_trans_barrier to preserve unlocking order. - -Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com> -Reviewed-by: Wengang Wang <wen.gang.wang@oracle.com> -Reviewed-by: Mark Fasheh <mfasheh@suse.de> -Cc: Joel Becker <jlbec@evilplan.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/ocfs2/aops.c | 16 ++++++++++++++-- - 1 file changed, 14 insertions(+), 2 deletions(-) - ---- a/fs/ocfs2/aops.c -+++ b/fs/ocfs2/aops.c -@@ -917,7 +917,7 @@ void ocfs2_unlock_and_free_pages(struct - } - } - --static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc) -+static void ocfs2_unlock_pages(struct ocfs2_write_ctxt *wc) - { - int i; - -@@ -938,7 +938,11 @@ static void ocfs2_free_write_ctxt(struct - page_cache_release(wc->w_target_page); - } - ocfs2_unlock_and_free_pages(wc->w_pages, wc->w_num_pages); -+} - -+static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc) -+{ -+ ocfs2_unlock_pages(wc); - brelse(wc->w_di_bh); - kfree(wc); - } -@@ -2059,11 +2063,19 @@ out_write_size: - di->i_mtime_nsec = di->i_ctime_nsec = cpu_to_le32(inode->i_mtime.tv_nsec); - ocfs2_journal_dirty(handle, wc->w_di_bh); - -+ /* unlock pages before dealloc since it needs acquiring j_trans_barrier -+ * lock, or it will cause a deadlock since journal commit threads holds -+ * this lock and will ask for the page lock when flushing the data. -+ * put it here to preserve the unlock order. -+ */ -+ ocfs2_unlock_pages(wc); -+ - ocfs2_commit_trans(osb, handle); - - ocfs2_run_deallocs(osb, &wc->w_dealloc); - -- ocfs2_free_write_ctxt(wc); -+ brelse(wc->w_di_bh); -+ kfree(wc); - - return copied; - } diff --git a/patches/ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch b/patches/ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch deleted file mode 100644 index 79446bd..0000000 --- a/patches/ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 56abcab833fafcfaeb2f5b25e0364c1dec45f53e Mon Sep 17 00:00:00 2001 -From: Arseny Solokha <asolokha@kb.kras.ru> -Date: Sat, 6 Dec 2014 09:54:06 +0700 -Subject: OHCI: add a quirk for ULi M5237 blocking on reset - -commit 56abcab833fafcfaeb2f5b25e0364c1dec45f53e upstream. - -Commit 8dccddbc2368 ("OHCI: final fix for NVIDIA problems (I hope)") -introduced into 3.1.9 broke boot on e.g. Freescale P2020DS development -board. The code path that was previously specific to NVIDIA controllers -had then become taken for all chips. - -However, the M5237 installed on the board wedges solid when accessing -its base+OHCI_FMINTERVAL register, making it impossible to boot any -kernel newer than 3.1.8 on this particular and apparently other similar -machines. - -Don't readl() and writel() base+OHCI_FMINTERVAL on PCI ID 10b9:5237. - -The patch is suitable for the -next tree as well as all maintained -kernels up to 3.2 inclusive. - -Signed-off-by: Arseny Solokha <asolokha@kb.kras.ru> -Acked-by: Alan Stern <stern@rowland.harvard.edu> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/host/pci-quirks.c | 18 +++++++++++++++--- - 1 file changed, 15 insertions(+), 3 deletions(-) - ---- a/drivers/usb/host/pci-quirks.c -+++ b/drivers/usb/host/pci-quirks.c -@@ -470,7 +470,8 @@ static void __devinit quirk_usb_handoff_ - { - void __iomem *base; - u32 control; -- u32 fminterval; -+ u32 fminterval = 0; -+ bool no_fminterval = false; - int cnt; - - if (!mmio_resource_enabled(pdev, 0)) -@@ -480,6 +481,13 @@ static void __devinit quirk_usb_handoff_ - if (base == NULL) - return; - -+ /* -+ * ULi M5237 OHCI controller locks the whole system when accessing -+ * the OHCI_FMINTERVAL offset. -+ */ -+ if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237) -+ no_fminterval = true; -+ - control = readl(base + OHCI_CONTROL); - - /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */ -@@ -518,7 +526,9 @@ static void __devinit quirk_usb_handoff_ - } - - /* software reset of the controller, preserving HcFmInterval */ -- fminterval = readl(base + OHCI_FMINTERVAL); -+ if (!no_fminterval) -+ fminterval = readl(base + OHCI_FMINTERVAL); -+ - writel(OHCI_HCR, base + OHCI_CMDSTATUS); - - /* reset requires max 10 us delay */ -@@ -527,7 +537,9 @@ static void __devinit quirk_usb_handoff_ - break; - udelay(1); - } -- writel(fminterval, base + OHCI_FMINTERVAL); -+ -+ if (!no_fminterval) -+ writel(fminterval, base + OHCI_FMINTERVAL); - - /* Now the controller is safely in SUSPEND and nothing can wake it up */ - iounmap(base); diff --git a/patches/pagemap-do-not-leak-physical-addresses-to-non-privileged-userspace.patch b/patches/pagemap-do-not-leak-physical-addresses-to-non-privileged-userspace.patch deleted file mode 100644 index 061d378..0000000 --- a/patches/pagemap-do-not-leak-physical-addresses-to-non-privileged-userspace.patch +++ /dev/null @@ -1,54 +0,0 @@ -From ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce Mon Sep 17 00:00:00 2001 -From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> -Date: Mon, 9 Mar 2015 23:11:12 +0200 -Subject: pagemap: do not leak physical addresses to non-privileged userspace - -commit ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce upstream. - -As pointed by recent post[1] on exploiting DRAM physical imperfection, -/proc/PID/pagemap exposes sensitive information which can be used to do -attacks. - -This disallows anybody without CAP_SYS_ADMIN to read the pagemap. - -[1] http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html - -[ Eventually we might want to do anything more finegrained, but for now - this is the simple model. - Linus ] - -Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> -Acked-by: Konstantin Khlebnikov <khlebnikov@openvz.org> -Acked-by: Andy Lutomirski <luto@amacapital.net> -Cc: Pavel Emelyanov <xemul@parallels.com> -Cc: Andrew Morton <akpm@linux-foundation.org> -Cc: Mark Seaborn <mseaborn@chromium.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> -[mancha: Backported to 3.10] -Signed-off-by: mancha security <mancha1@zoho.com> ---- - fs/proc/task_mmu.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - ---- a/fs/proc/task_mmu.c -+++ b/fs/proc/task_mmu.c -@@ -985,9 +985,19 @@ out: - return ret; - } - -+static int pagemap_open(struct inode *inode, struct file *file) -+{ -+ /* do not disclose physical addresses to unprivileged -+ userspace (closes a rowhammer attack vector) */ -+ if (!capable(CAP_SYS_ADMIN)) -+ return -EPERM; -+ return 0; -+} -+ - const struct file_operations proc_pagemap_operations = { - .llseek = mem_lseek, /* borrow this */ - .read = pagemap_read, -+ .open = pagemap_open, - }; - #endif /* CONFIG_PROC_PAGE_MONITOR */ - diff --git a/patches/pci-handle-read-only-bars-on-amd-cs553x-devices.patch b/patches/pci-handle-read-only-bars-on-amd-cs553x-devices.patch deleted file mode 100644 index 576ab00..0000000 --- a/patches/pci-handle-read-only-bars-on-amd-cs553x-devices.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 06cf35f903aa6da0cc8d9f81e9bcd1f7e1b534bb Mon Sep 17 00:00:00 2001 -From: Myron Stowe <myron.stowe@redhat.com> -Date: Tue, 3 Feb 2015 16:01:24 -0700 -Subject: PCI: Handle read-only BARs on AMD CS553x devices - -commit 06cf35f903aa6da0cc8d9f81e9bcd1f7e1b534bb upstream. - -Some AMD CS553x devices have read-only BARs because of a firmware or -hardware defect. There's a workaround in quirk_cs5536_vsa(), but it no -longer works after 36e8164882ca ("PCI: Restore detection of read-only -BARs"). Prior to 36e8164882ca, we filled in res->start; afterwards we -leave it zeroed out. The quirk only updated the size, so the driver tried -to use a region starting at zero, which didn't work. - -Expand quirk_cs5536_vsa() to read the base addresses from the BARs and -hard-code the sizes. - -On Nix's system BAR 2's read-only value is 0x6200. Prior to 36e8164882ca, -we interpret that as a 512-byte BAR based on the lowest-order bit set. Per -datasheet sec 5.6.1, that BAR (MFGPT) requires only 64 bytes; use that to -avoid clearing any address bits if a platform uses only 64-byte alignment. - -[bhelgaas: changelog, reduce BAR 2 size to 64] -Fixes: 36e8164882ca ("PCI: Restore detection of read-only BARs") -Link: https://bugzilla.kernel.org/show_bug.cgi?id=85991#c4 -Link: http://support.amd.com/TechDocs/31506_cs5535_databook.pdf -Link: http://support.amd.com/TechDocs/33238G_cs5536_db.pdf -Reported-and-tested-by: Nix <nix@esperi.org.uk> -Signed-off-by: Myron Stowe <myron.stowe@redhat.com> -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/pci/quirks.c | 41 +++++++++++++++++++++++++++++++++++++---- - 1 file changed, 37 insertions(+), 4 deletions(-) - ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -327,19 +327,52 @@ static void __devinit quirk_s3_64M(struc - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3, PCI_DEVICE_ID_S3_868, quirk_s3_64M); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3, PCI_DEVICE_ID_S3_968, quirk_s3_64M); - -+static void quirk_io(struct pci_dev *dev, int pos, unsigned size, -+ const char *name) -+{ -+ u32 region; -+ struct pci_bus_region bus_region; -+ struct resource *res = dev->resource + pos; -+ -+ pci_read_config_dword(dev, PCI_BASE_ADDRESS_0 + (pos << 2), ®ion); -+ -+ if (!region) -+ return; -+ -+ res->name = pci_name(dev); -+ res->flags = region & ~PCI_BASE_ADDRESS_IO_MASK; -+ res->flags |= -+ (IORESOURCE_IO | IORESOURCE_PCI_FIXED | IORESOURCE_SIZEALIGN); -+ region &= ~(size - 1); -+ -+ /* Convert from PCI bus to resource space */ -+ bus_region.start = region; -+ bus_region.end = region + size - 1; -+ pcibios_bus_to_resource(dev->bus, res, &bus_region); -+ -+ dev_info(&dev->dev, FW_BUG "%s quirk: reg 0x%x: %pR\n", -+ name, PCI_BASE_ADDRESS_0 + (pos << 2), res); -+} -+ - /* - * Some CS5536 BIOSes (for example, the Soekris NET5501 board w/ comBIOS - * ver. 1.33 20070103) don't set the correct ISA PCI region header info. - * BAR0 should be 8 bytes; instead, it may be set to something like 8k - * (which conflicts w/ BAR1's memory range). -+ * -+ * CS553x's ISA PCI BARs may also be read-only (ref: -+ * https://bugzilla.kernel.org/show_bug.cgi?id=85991 - Comment #4 forward). - */ - static void __devinit quirk_cs5536_vsa(struct pci_dev *dev) - { -+ static char *name = "CS5536 ISA bridge"; -+ - if (pci_resource_len(dev, 0) != 8) { -- struct resource *res = &dev->resource[0]; -- res->end = res->start + 8 - 1; -- dev_info(&dev->dev, "CS5536 ISA bridge bug detected " -- "(incorrect header); workaround applied.\n"); -+ quirk_io(dev, 0, 8, name); /* SMB */ -+ quirk_io(dev, 1, 256, name); /* GPIO */ -+ quirk_io(dev, 2, 64, name); /* MFGPT */ -+ dev_info(&dev->dev, "%s bug detected (incorrect header); workaround applied\n", -+ name); - } - } - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA, quirk_cs5536_vsa); diff --git a/patches/pci-restore-detection-of-read-only-bars.patch b/patches/pci-restore-detection-of-read-only-bars.patch deleted file mode 100644 index 6edaf20..0000000 --- a/patches/pci-restore-detection-of-read-only-bars.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 36e8164882ca6d3c41cb91e6f09a3ed236841f80 Mon Sep 17 00:00:00 2001 -From: Myron Stowe <myron.stowe@redhat.com> -Date: Thu, 30 Oct 2014 11:54:37 -0600 -Subject: PCI: Restore detection of read-only BARs - -commit 36e8164882ca6d3c41cb91e6f09a3ed236841f80 upstream. - -Commit 6ac665c63dca ("PCI: rewrite PCI BAR reading code") masked off -low-order bits from 'l', but not from 'sz'. Both are passed to pci_size(), -which compares 'base == maxbase' to check for read-only BARs. The masking -of 'l' means that comparison will never be 'true', so the check for -read-only BARs no longer works. - -Resolve this by also masking off the low-order bits of 'sz' before passing -it into pci_size() as 'maxbase'. With this change, pci_size() will once -again catch the problems that have been encountered to date: - - - AGP aperture BAR of AMD-7xx host bridges: if the AGP window is - disabled, this BAR is read-only and read as 0x00000008 [1] - - - BARs 0-4 of ALi IDE controllers can be non-zero and read-only [1] - - - Intel Sandy Bridge - Thermal Management Controller [8086:0103]; - BAR 0 returning 0xfed98004 [2] - - - Intel Xeon E5 v3/Core i7 Power Control Unit [8086:2fc0]; - Bar 0 returning 0x00001a [3] - -Link: [1] https://git.kernel.org/cgit/linux/kernel/git/tglx/history.git/commit/drivers/pci/probe.c?id=1307ef6621991f1c4bc3cec1b5a4ebd6fd3d66b9 ("PCI: probing read-only BARs" (pre-git)) -Link: [2] https://bugzilla.kernel.org/show_bug.cgi?id=43331 -Link: [3] https://bugzilla.kernel.org/show_bug.cgi?id=85991 -Reported-by: William Unruh <unruh@physics.ubc.ca> -Reported-by: Martin Lucina <martin@lucina.net> -Signed-off-by: Myron Stowe <myron.stowe@redhat.com> -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -CC: Matthew Wilcox <willy@linux.intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/pci/probe.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/pci/probe.c -+++ b/drivers/pci/probe.c -@@ -254,14 +254,17 @@ int __pci_read_base(struct pci_dev *dev, - res->flags |= IORESOURCE_SIZEALIGN; - if (res->flags & IORESOURCE_IO) { - l &= PCI_BASE_ADDRESS_IO_MASK; -+ sz &= PCI_BASE_ADDRESS_IO_MASK; - mask = PCI_BASE_ADDRESS_IO_MASK & (u32) IO_SPACE_LIMIT; - } else { - l &= PCI_BASE_ADDRESS_MEM_MASK; -+ sz &= PCI_BASE_ADDRESS_MEM_MASK; - mask = (u32)PCI_BASE_ADDRESS_MEM_MASK; - } - } else { - res->flags |= (l & IORESOURCE_ROM_ENABLE); - l &= PCI_ROM_ADDRESS_MASK; -+ sz &= PCI_ROM_ADDRESS_MASK; - mask = (u32)PCI_ROM_ADDRESS_MASK; - } - diff --git a/patches/powerpc-pseries-fix-endiannes-issue-in-rtas-call-from-xmon.patch b/patches/powerpc-pseries-fix-endiannes-issue-in-rtas-call-from-xmon.patch deleted file mode 100644 index 906ae7b..0000000 --- a/patches/powerpc-pseries-fix-endiannes-issue-in-rtas-call-from-xmon.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 3b8a3c01096925a824ed3272601082289d9c23a5 Mon Sep 17 00:00:00 2001 -From: Laurent Dufour <ldufour@linux.vnet.ibm.com> -Date: Mon, 24 Nov 2014 15:07:53 +0100 -Subject: powerpc/pseries: Fix endiannes issue in RTAS call from xmon - -commit 3b8a3c01096925a824ed3272601082289d9c23a5 upstream. - -On pseries system (LPAR) xmon failed to enter when running in LE mode, -system is hunging. Inititating xmon will lead to such an output on the -console: - -SysRq : Entering xmon -cpu 0x15: Vector: 0 at [c0000003f39ffb10] - pc: c00000000007ed7c: sysrq_handle_xmon+0x5c/0x70 - lr: c00000000007ed7c: sysrq_handle_xmon+0x5c/0x70 - sp: c0000003f39ffc70 - msr: 8000000000009033 - current = 0xc0000003fafa7180 - paca = 0xc000000007d75e80 softe: 0 irq_happened: 0x01 - pid = 14617, comm = bash -Bad kernel stack pointer fafb4b0 at eca7cc4 -cpu 0x15: Vector: 300 (Data Access) at [c000000007f07d40] - pc: 000000000eca7cc4 - lr: 000000000eca7c44 - sp: fafb4b0 - msr: 8000000000001000 - dar: 10000000 - dsisr: 42000000 - current = 0xc0000003fafa7180 - paca = 0xc000000007d75e80 softe: 0 irq_happened: 0x01 - pid = 14617, comm = bash -cpu 0x15: Exception 300 (Data Access) in xmon, returning to main loop -xmon: WARNING: bad recursive fault on cpu 0x15 - -The root cause is that xmon is calling RTAS to turn off the surveillance -when entering xmon, and RTAS is requiring big endian parameters. - -This patch is byte swapping the RTAS arguments when running in LE mode. - -Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/powerpc/xmon/xmon.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - ---- a/arch/powerpc/xmon/xmon.c -+++ b/arch/powerpc/xmon/xmon.c -@@ -285,10 +285,10 @@ static inline void disable_surveillance( - args.token = rtas_token("set-indicator"); - if (args.token == RTAS_UNKNOWN_SERVICE) - return; -- args.nargs = 3; -- args.nret = 1; -+ args.nargs = cpu_to_be32(3); -+ args.nret = cpu_to_be32(1); - args.rets = &args.args[3]; -- args.args[0] = SURVEILLANCE_TOKEN; -+ args.args[0] = cpu_to_be32(SURVEILLANCE_TOKEN); - args.args[1] = 0; - args.args[2] = 0; - enter_rtas(__pa(&args)); diff --git a/patches/powerpc-xmon-fix-another-endiannes-issue-in-rtas-call-from-xmon.patch b/patches/powerpc-xmon-fix-another-endiannes-issue-in-rtas-call-from-xmon.patch deleted file mode 100644 index 166228a..0000000 --- a/patches/powerpc-xmon-fix-another-endiannes-issue-in-rtas-call-from-xmon.patch +++ /dev/null @@ -1,36 +0,0 @@ -From e6eb2eba494d6f99e69ca3c3748cd37a2544ab38 Mon Sep 17 00:00:00 2001 -From: Laurent Dufour <ldufour@linux.vnet.ibm.com> -Date: Thu, 15 Jan 2015 18:23:47 +0100 -Subject: powerpc/xmon: Fix another endiannes issue in RTAS call from xmon - -commit e6eb2eba494d6f99e69ca3c3748cd37a2544ab38 upstream. - -The commit 3b8a3c010969 ("powerpc/pseries: Fix endiannes issue in RTAS -call from xmon") was fixing an endianness issue in the call made from -xmon to RTAS. - -However, as Michael Ellerman noticed, this fix was not complete, the -token value was not byte swapped. This lead to call an unexpected and -most of the time unexisting RTAS function, which is silently ignored by -RTAS. - -This fix addresses this hole. - -Reported-by: Michael Ellerman <mpe@ellerman.id.au> -Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com> -Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/powerpc/xmon/xmon.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/arch/powerpc/xmon/xmon.c -+++ b/arch/powerpc/xmon/xmon.c -@@ -285,6 +285,7 @@ static inline void disable_surveillance( - args.token = rtas_token("set-indicator"); - if (args.token == RTAS_UNKNOWN_SERVICE) - return; -+ args.token = cpu_to_be32(args.token); - args.nargs = cpu_to_be32(3); - args.nret = cpu_to_be32(1); - args.rets = &args.args[3]; diff --git a/patches/regulator-core-fix-race-condition-in-regulator_put.patch b/patches/regulator-core-fix-race-condition-in-regulator_put.patch deleted file mode 100644 index 149982a..0000000 --- a/patches/regulator-core-fix-race-condition-in-regulator_put.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 83b0302d347a49f951e904184afe57ac3723476e Mon Sep 17 00:00:00 2001 -From: Ashay Jaiswal <ashayj@codeaurora.org> -Date: Thu, 8 Jan 2015 18:54:25 +0530 -Subject: regulator: core: fix race condition in regulator_put() - -commit 83b0302d347a49f951e904184afe57ac3723476e upstream. - -The regulator framework maintains a list of consumer regulators -for a regulator device and protects it from concurrent access using -the regulator device's mutex lock. - -In the case of regulator_put() the consumer is removed and regulator -device's parameters are updated without holding the regulator device's -mutex. This would lead to a race condition between the regulator_put() -and any function which traverses the consumer list or modifies regulator -device's parameters. -Fix this race condition by holding the regulator device's mutex in case -of regulator_put. - -Signed-off-by: Ashay Jaiswal <ashayj@codeaurora.org> -Signed-off-by: Mark Brown <broonie@kernel.org> -[lizf: Backported to 3.4: - - adjust context - - no need to change the comment] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/regulator/core.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -1395,12 +1395,14 @@ void regulator_put(struct regulator *reg - device_remove_file(regulator->dev, ®ulator->dev_attr); - kfree(regulator->dev_attr.attr.name); - } -+ mutex_lock(&rdev->mutex); - kfree(regulator->supply_name); - list_del(®ulator->list); - kfree(regulator); - - rdev->open_count--; - rdev->exclusive = 0; -+ mutex_unlock(&rdev->mutex); - - module_put(rdev->owner); - mutex_unlock(®ulator_list_mutex); diff --git a/patches/s390-3215-fix-tty-output-containing-tabs.patch b/patches/s390-3215-fix-tty-output-containing-tabs.patch deleted file mode 100644 index 5885757..0000000 --- a/patches/s390-3215-fix-tty-output-containing-tabs.patch +++ /dev/null @@ -1,67 +0,0 @@ -From e512d56c799517f33b301d81e9a5e0ebf30c2d1e Mon Sep 17 00:00:00 2001 -From: Martin Schwidefsky <schwidefsky@de.ibm.com> -Date: Wed, 13 Aug 2014 12:01:30 +0200 -Subject: s390/3215: fix tty output containing tabs - -commit e512d56c799517f33b301d81e9a5e0ebf30c2d1e upstream. - -git commit 37f81fa1f63ad38e16125526bb2769ae0ea8d332 -"n_tty: do O_ONLCR translation as a single write" -surfaced a bug in the 3215 device driver. In combination this -broke tab expansion for tty ouput. - -The cause is an asymmetry in the behaviour of tty3215_ops->write -vs tty3215_ops->put_char. The put_char function scans for '\t' -but the write function does not. - -As the driver has logic for the '\t' expansion remove XTABS -from c_oflag of the initial termios as well. - -Reported-by: Stephen Powell <zlinuxman@wowway.com> -Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> -Cc: Ben Hutchings <ben@decadent.org.uk> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/s390/char/con3215.c | 20 +++++++++++++++++--- - 1 file changed, 17 insertions(+), 3 deletions(-) - ---- a/drivers/s390/char/con3215.c -+++ b/drivers/s390/char/con3215.c -@@ -997,12 +997,26 @@ static int tty3215_write(struct tty_stru - const unsigned char *buf, int count) - { - struct raw3215_info *raw; -+ int i, written; - - if (!tty) - return 0; - raw = (struct raw3215_info *) tty->driver_data; -- raw3215_write(raw, buf, count); -- return count; -+ written = count; -+ while (count > 0) { -+ for (i = 0; i < count; i++) -+ if (buf[i] == '\t' || buf[i] == '\n') -+ break; -+ raw3215_write(raw, buf, i); -+ count -= i; -+ buf += i; -+ if (count > 0) { -+ raw3215_putchar(raw, *buf); -+ count--; -+ buf++; -+ } -+ } -+ return written; - } - - /* -@@ -1149,7 +1163,7 @@ static int __init tty3215_init(void) - driver->subtype = SYSTEM_TYPE_TTY; - driver->init_termios = tty_std_termios; - driver->init_termios.c_iflag = IGNBRK | IGNPAR; -- driver->init_termios.c_oflag = ONLCR | XTABS; -+ driver->init_termios.c_oflag = ONLCR; - driver->init_termios.c_lflag = ISIG; - driver->flags = TTY_DRIVER_REAL_RAW; - tty_set_operations(driver, &tty3215_ops); diff --git a/patches/sata_dwc_460ex-fix-resource-leak-on-error-path.patch b/patches/sata_dwc_460ex-fix-resource-leak-on-error-path.patch deleted file mode 100644 index 86b750f..0000000 --- a/patches/sata_dwc_460ex-fix-resource-leak-on-error-path.patch +++ /dev/null @@ -1,108 +0,0 @@ -From 4aaa71873ddb9faf4b0c4826579e2f6d18ff9ab4 Mon Sep 17 00:00:00 2001 -From: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Date: Wed, 7 Jan 2015 15:24:19 +0200 -Subject: sata_dwc_460ex: fix resource leak on error path - -commit 4aaa71873ddb9faf4b0c4826579e2f6d18ff9ab4 upstream. - -DMA mapped IO should be unmapped on the error path in probe() and -unconditionally on remove(). - -Fixes: 62936009f35a ([libata] Add 460EX on-chip SATA driver, sata_dwc_460ex) -Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Signed-off-by: Tejun Heo <tj@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/ata/sata_dwc_460ex.c | 26 ++++++++++++-------------- - 1 file changed, 12 insertions(+), 14 deletions(-) - ---- a/drivers/ata/sata_dwc_460ex.c -+++ b/drivers/ata/sata_dwc_460ex.c -@@ -791,7 +791,7 @@ static int dma_dwc_init(struct sata_dwc_ - if (err) { - dev_err(host_pvt.dwc_dev, "%s: dma_request_interrupts returns" - " %d\n", __func__, err); -- goto error_out; -+ return err; - } - - /* Enabe DMA */ -@@ -802,11 +802,6 @@ static int dma_dwc_init(struct sata_dwc_ - sata_dma_regs); - - return 0; -- --error_out: -- dma_dwc_exit(hsdev); -- -- return err; - } - - static int sata_dwc_scr_read(struct ata_link *link, unsigned int scr, u32 *val) -@@ -1634,7 +1629,7 @@ static int sata_dwc_probe(struct platfor - char *ver = (char *)&versionr; - u8 *base = NULL; - int err = 0; -- int irq, rc; -+ int irq; - struct ata_host *host; - struct ata_port_info pi = sata_dwc_port_info[0]; - const struct ata_port_info *ppi[] = { &pi, NULL }; -@@ -1688,7 +1683,7 @@ static int sata_dwc_probe(struct platfor - if (irq == NO_IRQ) { - dev_err(&ofdev->dev, "no SATA DMA irq\n"); - err = -ENODEV; -- goto error_out; -+ goto error_iomap; - } - - /* Get physical SATA DMA register base address */ -@@ -1697,14 +1692,16 @@ static int sata_dwc_probe(struct platfor - dev_err(&ofdev->dev, "ioremap failed for AHBDMA register" - " address\n"); - err = -ENODEV; -- goto error_out; -+ goto error_iomap; - } - - /* Save dev for later use in dev_xxx() routines */ - host_pvt.dwc_dev = &ofdev->dev; - - /* Initialize AHB DMAC */ -- dma_dwc_init(hsdev, irq); -+ err = dma_dwc_init(hsdev, irq); -+ if (err) -+ goto error_dma_iomap; - - /* Enable SATA Interrupts */ - sata_dwc_enable_interrupts(hsdev); -@@ -1722,9 +1719,8 @@ static int sata_dwc_probe(struct platfor - * device discovery process, invoking our port_start() handler & - * error_handler() to execute a dummy Softreset EH session - */ -- rc = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht); -- -- if (rc != 0) -+ err = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht); -+ if (err) - dev_err(&ofdev->dev, "failed to activate host"); - - dev_set_drvdata(&ofdev->dev, host); -@@ -1733,7 +1729,8 @@ static int sata_dwc_probe(struct platfor - error_out: - /* Free SATA DMA resources */ - dma_dwc_exit(hsdev); -- -+error_dma_iomap: -+ iounmap((void __iomem *)host_pvt.sata_dma_regs); - error_iomap: - iounmap(base); - error_kmalloc: -@@ -1754,6 +1751,7 @@ static int sata_dwc_remove(struct platfo - /* Free SATA DMA resources */ - dma_dwc_exit(hsdev); - -+ iounmap((void __iomem *)host_pvt.sata_dma_regs); - iounmap(hsdev->reg_base); - kfree(hsdev); - kfree(host); diff --git a/patches/sata_fsl-fix-error-handling-of-irq_of_parse_and_map.patch b/patches/sata_fsl-fix-error-handling-of-irq_of_parse_and_map.patch deleted file mode 100644 index 2f64bad..0000000 --- a/patches/sata_fsl-fix-error-handling-of-irq_of_parse_and_map.patch +++ /dev/null @@ -1,28 +0,0 @@ -From aad0b624129709c94c2e19e583b6053520353fa8 Mon Sep 17 00:00:00 2001 -From: Dmitry Torokhov <dtor@chromium.org> -Date: Fri, 14 Nov 2014 13:39:05 -0800 -Subject: sata_fsl: fix error handling of irq_of_parse_and_map - -commit aad0b624129709c94c2e19e583b6053520353fa8 upstream. - -irq_of_parse_and_map() returns 0 on error (the result is unsigned int), -so testing for negative result never works. - -Signed-off-by: Dmitry Torokhov <dtor@chromium.org> -Signed-off-by: Tejun Heo <tj@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/ata/sata_fsl.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/ata/sata_fsl.c -+++ b/drivers/ata/sata_fsl.c -@@ -1426,7 +1426,7 @@ static int sata_fsl_probe(struct platfor - host_priv->csr_base = csr_base; - - irq = irq_of_parse_and_map(ofdev->dev.of_node, 0); -- if (irq < 0) { -+ if (!irq) { - dev_err(&ofdev->dev, "invalid irq from platform\n"); - goto error_exit_with_cleanup; - } diff --git a/patches/sched-rt-reduce-rq-lock-contention-by-eliminating-locking-of-non-feasible-target.patch b/patches/sched-rt-reduce-rq-lock-contention-by-eliminating-locking-of-non-feasible-target.patch deleted file mode 100644 index 1705fba..0000000 --- a/patches/sched-rt-reduce-rq-lock-contention-by-eliminating-locking-of-non-feasible-target.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 80e3d87b2c5582db0ab5e39610ce3707d97ba409 Mon Sep 17 00:00:00 2001 -From: Tim Chen <tim.c.chen@linux.intel.com> -Date: Fri, 12 Dec 2014 15:38:12 -0800 -Subject: sched/rt: Reduce rq lock contention by eliminating locking of - non-feasible target - -commit 80e3d87b2c5582db0ab5e39610ce3707d97ba409 upstream. - -This patch adds checks that prevens futile attempts to move rt tasks -to a CPU with active tasks of equal or higher priority. - -This reduces run queue lock contention and improves the performance of -a well known OLTP benchmark by 0.7%. - -Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com> -Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> -Cc: Shawn Bohrer <sbohrer@rgmadvisors.com> -Cc: Suruchi Kadu <suruchi.a.kadu@intel.com> -Cc: Doug Nelson<doug.nelson@intel.com> -Cc: Steven Rostedt <rostedt@goodmis.org> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Link: http://lkml.kernel.org/r/1421430374.2399.27.camel@schen9-desk2.jf.intel.com -Signed-off-by: Ingo Molnar <mingo@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/sched/rt.c | 17 ++++++++++++++++- - 1 file changed, 16 insertions(+), 1 deletion(-) - ---- a/kernel/sched/rt.c -+++ b/kernel/sched/rt.c -@@ -1293,7 +1293,12 @@ select_task_rq_rt(struct task_struct *p, - (p->rt.nr_cpus_allowed > 1)) { - int target = find_lowest_rq(p); - -- if (target != -1) -+ /* -+ * Don't bother moving it if the destination CPU is -+ * not running a lower priority task. -+ */ -+ if (target != -1 && -+ p->prio < cpu_rq(target)->rt.highest_prio.curr) - cpu = target; - } - rcu_read_unlock(); -@@ -1570,6 +1575,16 @@ static struct rq *find_lock_lowest_rq(st - - lowest_rq = cpu_rq(cpu); - -+ if (lowest_rq->rt.highest_prio.curr <= task->prio) { -+ /* -+ * Target rq has tasks of equal or higher priority, -+ * retrying does not release any lock and is unlikely -+ * to yield a different result. -+ */ -+ lowest_rq = NULL; -+ break; -+ } -+ - /* if the prio of this runqueue changed, try again */ - if (double_lock_balance(rq, lowest_rq)) { - /* diff --git a/patches/scripts-recordmcount.pl-there-is-no-m32-gcc-option-on-super-h-anymore.patch b/patches/scripts-recordmcount.pl-there-is-no-m32-gcc-option-on-super-h-anymore.patch deleted file mode 100644 index 366aea9..0000000 --- a/patches/scripts-recordmcount.pl-there-is-no-m32-gcc-option-on-super-h-anymore.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 1caf6aaaa47471831d77c75f094d4e00ad1ec808 Mon Sep 17 00:00:00 2001 -From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de> -Date: Sun, 18 Jan 2015 00:36:15 +0100 -Subject: scripts/recordmcount.pl: There is no -m32 gcc option on Super-H - anymore - -commit 1caf6aaaa47471831d77c75f094d4e00ad1ec808 upstream. - -Compiling SH with gcc-4.8 fails due to the -m32 option not being -supported. - -From http://buildd.debian-ports.org/status/fetch.php?pkg=linux&arch=sh4&ver=3.16.7-ckt4-1&stamp=1421425783 - - CC init/main.o - gcc-4.8: error: unrecognized command line option '-m32' - ld: cannot find init/.tmp_mc_main.o: No such file or directory - objcopy: 'init/.tmp_mx_main.o': No such file - rm: cannot remove 'init/.tmp_mx_main.o': No such file or directory - rm: cannot remove 'init/.tmp_mc_main.o': No such file or directory - -Link: http://lkml.kernel.org/r/1421537778-29001-1-git-send-email-kernel@mkarcher.dialup.fu-berlin.de -Link: http://lkml.kernel.org/r/54BCBDD4.10102@physik.fu-berlin.de - -Cc: Matt Fleming <matt@console-pimps.org> -Reported-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> -Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de> -Signed-off-by: Steven Rostedt <rostedt@goodmis.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - scripts/recordmcount.pl | 1 - - 1 file changed, 1 deletion(-) - ---- a/scripts/recordmcount.pl -+++ b/scripts/recordmcount.pl -@@ -262,7 +262,6 @@ if ($arch eq "x86_64") { - # force flags for this arch - $ld .= " -m shlelf_linux"; - $objcopy .= " -O elf32-sh-linux"; -- $cc .= " -m32"; - - } elsif ($arch eq "powerpc") { - $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)"; diff --git a/patches/scsi-correct-return-values-for-.eh_abort_handler-implementations.patch b/patches/scsi-correct-return-values-for-.eh_abort_handler-implementations.patch deleted file mode 100644 index d73a4a9..0000000 --- a/patches/scsi-correct-return-values-for-.eh_abort_handler-implementations.patch +++ /dev/null @@ -1,134 +0,0 @@ -From b6c92b7e0af575e2b8b05bdf33633cf9e1661cbf Mon Sep 17 00:00:00 2001 -From: Hannes Reinecke <hare@suse.de> -Date: Thu, 30 Oct 2014 09:44:36 +0100 -Subject: scsi: correct return values for .eh_abort_handler implementations - -commit b6c92b7e0af575e2b8b05bdf33633cf9e1661cbf upstream. - -The .eh_abort_handler needs to return SUCCESS, FAILED, or -FAST_IO_FAIL. So fixup all callers to adhere to this requirement. - -Reviewed-by: Robert Elliott <elliott@hp.com> -Signed-off-by: Hannes Reinecke <hare@suse.de> -Signed-off-by: Christoph Hellwig <hch@lst.de> -[lizf: Backported to 3.4: drop changes to esas2r_main.c] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/NCR5380.c | 12 ++++++------ - drivers/scsi/aha1740.c | 2 +- - drivers/scsi/atari_NCR5380.c | 2 +- - drivers/scsi/megaraid.c | 8 ++++---- - drivers/scsi/sun3_NCR5380.c | 10 +++++----- - 5 files changed, 17 insertions(+), 17 deletions(-) - ---- a/drivers/scsi/NCR5380.c -+++ b/drivers/scsi/NCR5380.c -@@ -2662,14 +2662,14 @@ static void NCR5380_dma_complete(NCR5380 - * - * Purpose : abort a command - * -- * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the -- * host byte of the result field to, if zero DID_ABORTED is -+ * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the -+ * host byte of the result field to, if zero DID_ABORTED is - * used. - * -- * Returns : 0 - success, -1 on failure. -+ * Returns : SUCCESS - success, FAILED on failure. - * -- * XXX - there is no way to abort the command that is currently -- * connected, you have to wait for it to complete. If this is -+ * XXX - there is no way to abort the command that is currently -+ * connected, you have to wait for it to complete. If this is - * a problem, we could implement longjmp() / setjmp(), setjmp() - * called where the loop started in NCR5380_main(). - * -@@ -2719,7 +2719,7 @@ static int NCR5380_abort(Scsi_Cmnd * cmd - * aborted flag and get back into our main loop. - */ - -- return 0; -+ return SUCCESS; - } - #endif - ---- a/drivers/scsi/aha1740.c -+++ b/drivers/scsi/aha1740.c -@@ -550,7 +550,7 @@ static int aha1740_eh_abort_handler (Scs - * quiet as possible... - */ - -- return 0; -+ return SUCCESS; - } - - static struct scsi_host_template aha1740_template = { ---- a/drivers/scsi/atari_NCR5380.c -+++ b/drivers/scsi/atari_NCR5380.c -@@ -2638,7 +2638,7 @@ static void NCR5380_reselect(struct Scsi - * host byte of the result field to, if zero DID_ABORTED is - * used. - * -- * Returns : 0 - success, -1 on failure. -+ * Returns : SUCCESS - success, FAILED on failure. - * - * XXX - there is no way to abort the command that is currently - * connected, you have to wait for it to complete. If this is ---- a/drivers/scsi/megaraid.c -+++ b/drivers/scsi/megaraid.c -@@ -1967,7 +1967,7 @@ megaraid_abort_and_reset(adapter_t *adap - cmd->device->id, cmd->device->lun); - - if(list_empty(&adapter->pending_list)) -- return FALSE; -+ return FAILED; - - list_for_each_safe(pos, next, &adapter->pending_list) { - -@@ -1990,7 +1990,7 @@ megaraid_abort_and_reset(adapter_t *adap - (aor==SCB_ABORT) ? "ABORTING":"RESET", - scb->idx); - -- return FALSE; -+ return FAILED; - } - else { - -@@ -2015,12 +2015,12 @@ megaraid_abort_and_reset(adapter_t *adap - list_add_tail(SCSI_LIST(cmd), - &adapter->completed_list); - -- return TRUE; -+ return SUCCESS; - } - } - } - -- return FALSE; -+ return FAILED; - } - - static inline int ---- a/drivers/scsi/sun3_NCR5380.c -+++ b/drivers/scsi/sun3_NCR5380.c -@@ -2624,15 +2624,15 @@ static void NCR5380_reselect (struct Scs - * Purpose : abort a command - * - * Inputs : cmd - the struct scsi_cmnd to abort, code - code to set the -- * host byte of the result field to, if zero DID_ABORTED is -+ * host byte of the result field to, if zero DID_ABORTED is - * used. - * -- * Returns : 0 - success, -1 on failure. -+ * Returns : SUCCESS - success, FAILED on failure. - * -- * XXX - there is no way to abort the command that is currently -- * connected, you have to wait for it to complete. If this is -+ * XXX - there is no way to abort the command that is currently -+ * connected, you have to wait for it to complete. If this is - * a problem, we could implement longjmp() / setjmp(), setjmp() -- * called where the loop started in NCR5380_main(). -+ * called where the loop started in NCR5380_main(). - */ - - static int NCR5380_abort(struct scsi_cmnd *cmd) diff --git a/patches/serial-samsung-wait-for-transfer-completion-before-clock-disable.patch b/patches/serial-samsung-wait-for-transfer-completion-before-clock-disable.patch deleted file mode 100644 index 043547e..0000000 --- a/patches/serial-samsung-wait-for-transfer-completion-before-clock-disable.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 1ff383a4c3eda8893ec61b02831826e1b1f46b41 Mon Sep 17 00:00:00 2001 -From: Robert Baldyga <r.baldyga@samsung.com> -Date: Mon, 24 Nov 2014 07:56:21 +0100 -Subject: serial: samsung: wait for transfer completion before clock disable - -commit 1ff383a4c3eda8893ec61b02831826e1b1f46b41 upstream. - -This patch adds waiting until transmit buffer and shifter will be empty -before clock disabling. - -Without this fix it's possible to have clock disabled while data was -not transmited yet, which causes unproper state of TX line and problems -in following data transfers. - -Signed-off-by: Robert Baldyga <r.baldyga@samsung.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/tty/serial/samsung.c | 4 ++++ - 1 file changed, 4 insertions(+) - ---- a/drivers/tty/serial/samsung.c -+++ b/drivers/tty/serial/samsung.c -@@ -524,11 +524,15 @@ static void s3c24xx_serial_pm(struct uar - unsigned int old) - { - struct s3c24xx_uart_port *ourport = to_ourport(port); -+ int timeout = 10000; - - ourport->pm_level = level; - - switch (level) { - case 3: -+ while (--timeout && !s3c24xx_serial_txempty_nofifo(port)) -+ udelay(100); -+ - if (!IS_ERR(ourport->baudclk) && ourport->baudclk != NULL) - clk_disable(ourport->baudclk); - diff --git a/patches/series b/patches/series index 5f86d85..e69de29 100644 --- a/patches/series +++ b/patches/series @@ -1,176 +0,0 @@ -spi-dw-fix-dynamic-speed-change.patch -usb-serial-cp210x-add-ids-for-cel-meshconnect-usb-stick.patch -iio-fix-iio_event_code_extract_dir-bit-mask.patch -usb-serial-ftdi_sio-add-pids-for-matrix-orbital-products.patch -usb-keyspan-fix-tty-line-status-reporting.patch -usb-keyspan-fix-overrun-error-reporting.patch -usb-ssu100-fix-overrun-error-reporting.patch -sunrpc-fix-locking-around-callback-channel-reply-receive.patch -nfsd-fix-slot-wake-up-race-in-the-nfsv4.1-callback-code.patch -bnx2fc-do-not-add-shared-skbs-to-the-fcoe_rx_list.patch -arm-8216-1-xscale-correct-auxiliary-register-in-suspend-resume.patch -usb-xhci-don-t-start-a-halted-endpoint-before-its-new-dequeue-is-set.patch -usb-xhci-reset-a-halted-endpoint-immediately-when-we-encounter-a-stall.patch -usb-xhci-rework-root-port-wake-bits-if-controller-isn-t-allowed-to-wakeup.patch -alsa-hda-limit-40bit-dma-for-amd-hdmi-controllers.patch -mips-loongson-make-platform-serial-setup-always-built-in.patch -usb-quirks-add-reset-resume-quirk-for-ms-wireless-laser-mouse-6000.patch -input-xpad-use-proper-endpoint-type.patch -powerpc-pseries-fix-endiannes-issue-in-rtas-call-from-xmon.patch -drm-i915-unlock-panel-even-when-lvds-is-disabled.patch -ahci-add-deviceids-for-sunrise-point-lp-sata-controller.patch -sata_fsl-fix-error-handling-of-irq_of_parse_and_map.patch -drm-radeon-kernel-panic-in-drm_calc_vbltimestamp_from_scanoutpos-with-3.18.0-rc6.patch -mm-fix-swapoff-hang-after-page-migration-and-fork.patch -ahci-disable-ncq-on-samsung-pci-e-ssds-on-macbooks.patch -ahci-disable-msi-instead-of-ncq-on-samsung-pci-e-ssds-on-macbooks.patch -ahci-disable-msi-on-samsung-0xa800-ssd.patch -i2c-davinci-generate-stp-always-when-nack-is-received.patch -ecryptfs-force-ro-mount-when-encrypted-view-is-enabled.patch -writeback-move-i_dirty_pages-handling.patch -writeback-fix-a-subtle-race-condition-in-i_dirty-clearing.patch -usb-renesas_usbhs-gadget-fix-null-pointer-dereference-in-ep_disable.patch -ubi-fix-invalid-vfree.patch -driver-core-fix-unbalanced-device-reference-in-drivers_probe.patch -drbd-merge_bvec_fn-properly-remap-bvm-bi_bdev.patch -pci-restore-detection-of-read-only-bars.patch -scsi-correct-return-values-for-.eh_abort_handler-implementations.patch -genhd-check-for-int-overflow-in-disk_expand_part_tbl.patch -asoc-sigmadsp-refuse-to-load-firmware-files-with-a-non-supported-version.patch -megaraid_sas-corrected-return-of-wait_event-from-abort-frame-path.patch -cdc-acm-memory-leak-in-error-case.patch -usb-cdc-acm-check-for-valid-interfaces.patch -mfd-tc6393xb-fail-ohci-suspend-if-full-state-restore-is-required.patch -serial-samsung-wait-for-transfer-completion-before-clock-disable.patch -ecryptfs-remove-buggy-and-unnecessary-write-in-file-name-decode-routine.patch -ath9k_hw-fix-hardware-queue-allocation.patch -ath9k-fix-be-bk-queue-order.patch -ath5k-fix-hardware-queue-index-assignment.patch -iommu-vt-d-fix-an-off-by-one-bug-in-__domain_mapping.patch -drm-vmwgfx-don-t-use-memory-accounting-for-kernel-side-fence-objects.patch -drm-vmwgfx-fix-fence-event-code.patch -hp_accel-add-support-for-hp-zbook-15.patch -drm-radeon-check-the-right-ring-in-radeon_evict_flags.patch -can-peak_usb-fix-memset-usage.patch -can-peak_usb-fix-cleanup-sequence-order-in-case-of-error-during-init.patch -alsa-usb-audio-don-t-resubmit-pending-urbs-at-midi-error-recovery.patch -keys-fix-stale-key-registration-at-error-path.patch -btrfs-fix-fs-corruption-on-transaction-abort-if-device-supports-discard.patch -ncpfs-return-proper-error-from-ncp_ioc_setroot-ioctl.patch -x86_64-switch_to-load-tls-descriptors-before-switching-ds-and-es.patch -genirq-prevent-proc-race-against-freeing-of-irq-descriptors.patch -x86-tls-disallow-unusual-tls-segments.patch -x86-tls-don-t-validate-lm-in-set_thread_area-after-all.patch -storvsc-ring-buffer-failures-may-result-in-i-o-freeze.patch -isofs-fix-infinite-looping-over-ce-entries.patch -iscsi-target-fail-connection-on-short-sendmsg-writes.patch -alsa-usb-audio-extend-kef-x300a-fu-10-tweak-to-arcam-rpac.patch -ocfs2-fix-journal-commit-deadlock.patch -isofs-fix-unchecked-printing-of-er-records.patch -udf-verify-i_size-when-loading-inode.patch -udf-verify-symlink-size-before-loading-it.patch -udf-check-path-length-when-reading-symlink.patch -x86_64-vdso-fix-the-vdso-address-randomization-algorithm.patch -udf-check-component-length-before-reading-it.patch -crypto-af_alg-fix-backlog-handling.patch -net-fix-stacked-vlan-offload-features-computation.patch -video-logo-prevent-use-of-logos-after-they-have-been-freed.patch -usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch -x86-um-actually-mark-system-call-tables-readonly.patch -alsa-hda-fix-wrong-gpio_dir-gpio_mask-hint-setups-for-idt-stac-codecs.patch -virtio-use-dev_to_virtio-wrapper-in-virtio.patch -virtio_pci-defer-kfree-until-release-callback.patch -virtio_pci-document-why-we-defer-kfree.patch -usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch -mm-propagate-error-from-stack-expansion-even-for-guard-page.patch -sata_dwc_460ex-fix-resource-leak-on-error-path.patch -time-settimeofday-validate-the-values-of-tv-from-user.patch -time-adjtimex-validate-the-adj_frequency-values.patch -input-i8042-reset-keyboard-to-fix-elantech-touchpad-detection.patch -input-i8042-add-acer-aspire-7738-to-the-nomux-list.patch -mac80211-fix-multicast-led-blinking-and-counter.patch -mm-prevent-endless-growth-of-anon_vma-hierarchy.patch -mm-protect-set_page_dirty-from-ongoing-truncation.patch -hid-roccat-potential-out-of-bounds-in-pyra_sysfs_write_settings.patch -ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch -usb-console-fix-potential-use-after-free.patch -mm-don-t-count-the-stack-guard-page-towards-rlimit_stack.patch -mm-fix-corner-case-in-anon_vma-endless-growing-prevention.patch -gpio-fix-memory-and-reference-leaks-in-gpiochip_add-error-path.patch -usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch -ftrace-jprobes-x86-fix-conflict-between-jprobes-and-function-graph-tracing.patch -can-dev-fix-crtlmode_supported-check.patch -sysfs.h-add-attribute_groups-macro.patch -driver-core-introduce-device_create_groups.patch -gpio-sysfs-fix-gpio-chip-device-attribute-leak.patch -gpiolib-refactor-gpio_export.patch -gpio-sysfs-fix-gpio-device-attribute-leak.patch -gpio-sysfs-fix-gpio-attribute-creation-race.patch -alsa-usb-audio-add-mic-volume-fix-quirk-for-logitech-webcam-c210.patch -libata-allow-sata_sil24-to-opt-out-of-tag-ordered-submission.patch -scripts-recordmcount.pl-there-is-no-m32-gcc-option-on-super-h-anymore.patch -libata-prevent-hsm-state-change-race-between-isr-and-pio.patch -x86-hyperv-mark-the-hyper-v-clocksource-as-being-continuous.patch -spi-dw-fix-detecting-fifo-depth.patch -spi-dw-mid-fix-fifo-size.patch -asoc-wm8960-fix-capture-sample-rate-from-11250-to-11025.patch -regulator-core-fix-race-condition-in-regulator_put.patch -powerpc-xmon-fix-another-endiannes-issue-in-rtas-call-from-xmon.patch -nl80211-fix-per-station-group-key-get-del-and-memory-leak.patch -usb-storage-scsi-add-broken_fua-blacklist-flag.patch -usb-storage-scsi-blacklist-fua-on-jmicron-152d-2566-usb-sata-controller.patch -usb-core-binterval-quirk.patch -usb-add-otg-pet-device-to-tpl.patch -drm-i915-only-fence-tiled-region-of-object.patch -alsa-seq-dummy-remove-deadlock-causing-events-on-close.patch -net-sctp-fix-slab-corruption-from-use-after-free-on-init-collisions.patch -ipv6-replacing-a-rt6_info-needs-to-purge-possible-propagated-rt6_infos-too.patch -vm-add-vm_fault_sigsegv-handling-support.patch -vm-make-stack-guard-page-errors-return-vm_fault_sigsegv-rather-than-sigbus.patch -net-sctp-fix-panic-on-duplicate-asconf-chunks.patch -net-sctp-fix-skb_over_panic-when-receiving-malformed-asconf-chunks.patch -x86-mm-aslr-fix-stack-randomization-on-64-bit-systems.patch -keys-close-race-between-key-lookup-and-freeing.patch -move-d_rcu-from-overlapping-d_child-to-overlapping-d_alias.patch -deal-with-deadlock-in-d_walk.patch -mips-irq-fix-disable_irq-on-cpu-irqs.patch -asoc-atmel_ssc_dai-fix-start-event-for-i2s-mode.patch -alsa-ak411x-fix-stall-in-work-callback.patch -lib-checksum.c-fix-carry-in-csum_tcpudp_nofold.patch -caif-remove-wrong-dev_net_set-call.patch -mips-fix-kernel-lockup-or-crash-after-cpu-offline-online.patch -gpio-sysfs-fix-memory-leak-in-gpiod_export_link.patch -gpio-sysfs-fix-memory-leak-in-gpiod_sysfs_set_active_low.patch -net-sctp-fix-null-pointer-dereference-in-af-from_addr_param-on-malformed-packet.patch -net-sctp-fix-passing-wrong-parameter-header-to-param_type2af-in-sctp_process_param.patch -asoc-sgtl5000-add-delay-before-first-i2c-access.patch -nilfs2-fix-deadlock-of-segment-constructor-over-i_sync-flag.patch -drivers-hv-vmbus-incorrect-device-name-is-printed-when-child-device-is-unregistered.patch -bluetooth-sort-the-list-of-ids-in-the-source-code.patch -bluetooth-append-new-supported-device-to-the-list-0b05-17d0.patch -bluetooth-add-support-for-intel-bootloader-devices.patch -bluetooth-ignore-isochronous-endpoints-for-intel-usb-bootloader.patch -bluetooth-add-support-for-acer-13d3-3432.patch -bluetooth-add-support-for-broadcom-device-of-asus-z97-deluxe-motherboard.patch -add-a-new-pid-vid-0227-0930-for-ar3012.patch -bluetooth-add-support-for-acer-0489-e078.patch -bluetooth-ath3k-add-support-of-mci-13d3-3408-bt-device.patch -bluetooth-add-usb-device-04ca-3010-as-atheros-ar3012.patch -pagemap-do-not-leak-physical-addresses-to-non-privileged-userspace.patch -bluetooth-fix-invalid-length-check-in-l2cap_informat.patch -jfs-fix-readdir-regression.patch -ipvs-rerouting-to-local-clients-is-not-needed-anymore.patch -staging-comedi-cb_pcidas64-fix-incorrect-ai-range-code-handling.patch -bluetooth-ath3k-workaround-the-compatibility-issue-with-xhci-controller.patch -sched-rt-reduce-rq-lock-contention-by-eliminating-locking-of-non-feasible-target.patch -net-socket-set-msg_namelen-to-0-if-msg_name-is-passed-as-null-in-msghdr-struct-from-userland.patch -fsnotify-next_i-is-freed-during-fsnotify_unmount_inodes.patch -x86-cpu-amd-add-workaround-for-family-16h-erratum-793.patch -s390-3215-fix-tty-output-containing-tabs.patch -ntp-fixup-adjtimex-freq-validation-on-32-bit-systems.patch -spi-dw-revisit-fifo-size-detection-again.patch -nilfs2-fix-deadlock-of-segment-constructor-during-recovery.patch -net-compat-update-get_compat_msghdr-to-match-copy_msghdr_from_user-behaviour.patch -mm-fix-anon_vma-degree-underflow-in-anon_vma-endless-growing-prevention.patch -lib-checksum.c-fix-build-for-generic-csum_tcpudp_nofold.patch -pci-handle-read-only-bars-on-amd-cs553x-devices.patch diff --git a/patches/spi-dw-fix-detecting-fifo-depth.patch b/patches/spi-dw-fix-detecting-fifo-depth.patch deleted file mode 100644 index 37f5eae..0000000 --- a/patches/spi-dw-fix-detecting-fifo-depth.patch +++ /dev/null @@ -1,44 +0,0 @@ -From d297933cc7fcfbaaf2d37570baac73287bf0357d Mon Sep 17 00:00:00 2001 -From: Axel Lin <axel.lin@ingics.com> -Date: Mon, 5 Jan 2015 09:32:56 +0800 -Subject: spi: dw: Fix detecting FIFO depth - -commit d297933cc7fcfbaaf2d37570baac73287bf0357d upstream. - -Current code tries to find the highest valid fifo depth by checking the value -it wrote to DW_SPI_TXFLTR. There are a few problems in current code: -1) There is an off-by-one in dws->fifo_len setting because it assumes the latest - register write fails so the latest valid value should be fifo - 1. -2) We know the depth could be from 2 to 256 from HW spec, so it is not necessary - to test fifo == 257. In the case fifo is 257, it means the latest valid - setting is fifo = 256. So after the for loop iteration, we should check - fifo == 2 case instead of fifo == 257 if detecting the FIFO depth fails. -This patch fixes above issues. - -Signed-off-by: Axel Lin <axel.lin@ingics.com> -Reviewed-and-tested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/spi/spi-dw.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/spi/spi-dw.c -+++ b/drivers/spi/spi-dw.c -@@ -780,13 +780,13 @@ static void spi_hw_init(struct dw_spi *d - */ - if (!dws->fifo_len) { - u32 fifo; -- for (fifo = 2; fifo <= 257; fifo++) { -+ for (fifo = 2; fifo <= 256; fifo++) { - dw_writew(dws, DW_SPI_TXFLTR, fifo); - if (fifo != dw_readw(dws, DW_SPI_TXFLTR)) - break; - } - -- dws->fifo_len = (fifo == 257) ? 0 : fifo; -+ dws->fifo_len = (fifo == 2) ? 0 : fifo - 1; - dw_writew(dws, DW_SPI_TXFLTR, 0); - } - } diff --git a/patches/spi-dw-fix-dynamic-speed-change.patch b/patches/spi-dw-fix-dynamic-speed-change.patch deleted file mode 100644 index 148edfc..0000000 --- a/patches/spi-dw-fix-dynamic-speed-change.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 0a8727e69778683495058852f783eeda141a754e Mon Sep 17 00:00:00 2001 -From: Thor Thayer <tthayer@opensource.altera.com> -Date: Thu, 6 Nov 2014 13:54:27 -0600 -Subject: spi: dw: Fix dynamic speed change. - -commit 0a8727e69778683495058852f783eeda141a754e upstream. - -An IOCTL call that calls spi_setup() and then dw_spi_setup() will -overwrite the persisted last transfer speed. On each transfer, the -SPI speed is compared to the last transfer speed to determine if the -clock divider registers need to be updated (did the speed change?). -This bug was observed with the spidev driver using spi-config to -update the max transfer speed. - -This fix: Don't overwrite the persisted last transaction clock speed -when updating the SPI parameters in dw_spi_setup(). On the next -transaction, the new speed won't match the persisted last speed -and the hardware registers will be updated. -On initialization, the persisted last transaction clock -speed will be 0 but will be updated after the first SPI -transaction. - -Move zeroed clock divider check into clock change test because -chip->clk_div is zero on startup and would cause a divide-by-zero -error. The calculation was wrong as well (can't support odd #). - -Reported-by: Vlastimil Setka <setka@vsis.cz> -Signed-off-by: Vlastimil Setka <setka@vsis.cz> -Signed-off-by: Thor Thayer <tthayer@opensource.altera.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/spi/spi-dw.c | 6 +----- - 1 file changed, 1 insertion(+), 5 deletions(-) - ---- a/drivers/spi/spi-dw.c -+++ b/drivers/spi/spi-dw.c -@@ -394,9 +394,6 @@ static void pump_transfers(unsigned long - chip = dws->cur_chip; - spi = message->spi; - -- if (unlikely(!chip->clk_div)) -- chip->clk_div = dws->max_freq / chip->speed_hz; -- - if (message->state == ERROR_STATE) { - message->status = -EIO; - goto early_exit; -@@ -438,7 +435,7 @@ static void pump_transfers(unsigned long - if (transfer->speed_hz) { - speed = chip->speed_hz; - -- if (transfer->speed_hz != speed) { -+ if ((transfer->speed_hz != speed) || (!chip->clk_div)) { - speed = transfer->speed_hz; - if (speed > dws->max_freq) { - printk(KERN_ERR "MRST SPI0: unsupported" -@@ -677,7 +674,6 @@ static int dw_spi_setup(struct spi_devic - dev_err(&spi->dev, "No max speed HZ parameter\n"); - return -EINVAL; - } -- chip->speed_hz = spi->max_speed_hz; - - chip->tmode = 0; /* Tx & Rx */ - /* Default SPI mode is SCPOL = 0, SCPH = 0 */ diff --git a/patches/spi-dw-mid-fix-fifo-size.patch b/patches/spi-dw-mid-fix-fifo-size.patch deleted file mode 100644 index 1ed49a3..0000000 --- a/patches/spi-dw-mid-fix-fifo-size.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 67bf9cda4b498b8cea4a40be67a470afe57d2e88 Mon Sep 17 00:00:00 2001 -From: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Date: Fri, 2 Jan 2015 17:48:51 +0200 -Subject: spi: dw-mid: fix FIFO size - -commit 67bf9cda4b498b8cea4a40be67a470afe57d2e88 upstream. - -The FIFO size is 40 accordingly to the specifications, but this means 0x40, -i.e. 64 bytes. This patch fixes the typo and enables FIFO size autodetection -for Intel MID devices. - -Fixes: 7063c0d942a1 (spi/dw_spi: add DMA support) -Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/spi/spi-dw-mid.c | 1 - - 1 file changed, 1 deletion(-) - ---- a/drivers/spi/spi-dw-mid.c -+++ b/drivers/spi/spi-dw-mid.c -@@ -219,7 +219,6 @@ int dw_spi_mid_init(struct dw_spi *dws) - iounmap(clk_reg); - - dws->num_cs = 16; -- dws->fifo_len = 40; /* FIFO has 40 words buffer */ - - #ifdef CONFIG_SPI_DW_MID_DMA - dws->dma_priv = kzalloc(sizeof(struct mid_dma), GFP_KERNEL); diff --git a/patches/spi-dw-revisit-fifo-size-detection-again.patch b/patches/spi-dw-revisit-fifo-size-detection-again.patch deleted file mode 100644 index 6f8dcc0..0000000 --- a/patches/spi-dw-revisit-fifo-size-detection-again.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 9d239d353c319f9ff884c287ce47feb7cdf60ddc Mon Sep 17 00:00:00 2001 -From: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Date: Wed, 25 Feb 2015 11:39:36 +0200 -Subject: spi: dw: revisit FIFO size detection again - -commit 9d239d353c319f9ff884c287ce47feb7cdf60ddc upstream. - -The commit d297933cc7fc (spi: dw: Fix detecting FIFO depth) tries to fix the -logic of the FIFO detection based on the description on the comments. However, -there is a slight difference between numbers in TX Level and TX FIFO size. - -So, by specification the FIFO size would be in a range 2-256 bytes. From TX -Level prospective it means we can set threshold in the range 0-(FIFO size - 1) -bytes. Hence there are currently two issues: - a) FIFO size 2 bytes is actually skipped since TX Level is 1 bit and could be - either 0 or 1 byte; - b) FIFO size is incorrectly decreased by 1 which already done by meaning of - TX Level register. - -This patch fixes it eventually right. - -Fixes: d297933cc7fc (spi: dw: Fix detecting FIFO depth) -Reviewed-by: Axel Lin <axel.lin@ingics.com> -Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/spi/spi-dw.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/spi/spi-dw.c -+++ b/drivers/spi/spi-dw.c -@@ -780,13 +780,13 @@ static void spi_hw_init(struct dw_spi *d - */ - if (!dws->fifo_len) { - u32 fifo; -- for (fifo = 2; fifo <= 256; fifo++) { -+ for (fifo = 1; fifo < 256; fifo++) { - dw_writew(dws, DW_SPI_TXFLTR, fifo); - if (fifo != dw_readw(dws, DW_SPI_TXFLTR)) - break; - } - -- dws->fifo_len = (fifo == 2) ? 0 : fifo - 1; -+ dws->fifo_len = (fifo == 1) ? 0 : fifo; - dw_writew(dws, DW_SPI_TXFLTR, 0); - } - } diff --git a/patches/staging-comedi-cb_pcidas64-fix-incorrect-ai-range-code-handling.patch b/patches/staging-comedi-cb_pcidas64-fix-incorrect-ai-range-code-handling.patch deleted file mode 100644 index 916a471..0000000 --- a/patches/staging-comedi-cb_pcidas64-fix-incorrect-ai-range-code-handling.patch +++ /dev/null @@ -1,386 +0,0 @@ -From be8e89087ec2d2c8a1ad1e3db64bf4efdfc3c298 Mon Sep 17 00:00:00 2001 -From: Ian Abbott <abbotti@mev.co.uk> -Date: Mon, 19 Jan 2015 14:47:27 +0000 -Subject: staging: comedi: cb_pcidas64: fix incorrect AI range code handling - -commit be8e89087ec2d2c8a1ad1e3db64bf4efdfc3c298 upstream. - -The hardware range code values and list of valid ranges for the AI -subdevice is incorrect for several supported boards. The hardware range -code values for all boards except PCI-DAS4020/12 is determined by -calling `ai_range_bits_6xxx()` based on the maximum voltage of the range -and whether it is bipolar or unipolar, however it only returns the -correct hardware range code for the PCI-DAS60xx boards. For -PCI-DAS6402/16 (and /12) it returns the wrong code for the unipolar -ranges. For PCI-DAS64/Mx/16 it returns the wrong code for all the -ranges and the comedi range table is incorrect. - -Change `ai_range_bits_6xxx()` to use a look-up table pointed to by new -member `ai_range_codes` of `struct pcidas64_board` to map the comedi -range table indices to the hardware range codes. Use a new comedi range -table for the PCI-DAS64/Mx/16 boards (and the commented out variants). - -Signed-off-by: Ian Abbott <abbotti@mev.co.uk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -[Ian: Backported to 3.4] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/staging/comedi/drivers/cb_pcidas64.c | 123 ++++++++++++++++----------- - 1 file changed, 75 insertions(+), 48 deletions(-) - ---- a/drivers/staging/comedi/drivers/cb_pcidas64.c -+++ b/drivers/staging/comedi/drivers/cb_pcidas64.c -@@ -423,6 +423,29 @@ static const struct comedi_lrange ai_ran - } - }; - -+static const uint8_t ai_range_code_64xx[8] = { -+ 0x0, 0x1, 0x2, 0x3, /* bipolar 10, 5, 2,5, 1.25 */ -+ 0x8, 0x9, 0xa, 0xb /* unipolar 10, 5, 2.5, 1.25 */ -+}; -+ -+/* analog input ranges for 64-Mx boards */ -+static const struct comedi_lrange ai_ranges_64_mx = { -+ 7, { -+ BIP_RANGE(5), -+ BIP_RANGE(2.5), -+ BIP_RANGE(1.25), -+ BIP_RANGE(0.625), -+ UNI_RANGE(5), -+ UNI_RANGE(2.5), -+ UNI_RANGE(1.25) -+ } -+}; -+ -+static const uint8_t ai_range_code_64_mx[7] = { -+ 0x0, 0x1, 0x2, 0x3, /* bipolar 5, 2.5, 1.25, 0.625 */ -+ 0x9, 0xa, 0xb /* unipolar 5, 2.5, 1.25 */ -+}; -+ - /* analog input ranges for 60xx boards */ - static const struct comedi_lrange ai_ranges_60xx = { - 4, -@@ -434,6 +457,10 @@ static const struct comedi_lrange ai_ran - } - }; - -+static const uint8_t ai_range_code_60xx[4] = { -+ 0x0, 0x1, 0x4, 0x7 /* bipolar 10, 5, 0.5, 0.05 */ -+}; -+ - /* analog input ranges for 6030, etc boards */ - static const struct comedi_lrange ai_ranges_6030 = { - 14, -@@ -455,6 +482,11 @@ static const struct comedi_lrange ai_ran - } - }; - -+static const uint8_t ai_range_code_6030[14] = { -+ 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, /* bip 10, 5, 2, 1, 0.5, 0.2, 0.1 */ -+ 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf /* uni 10, 5, 2, 1, 0.5, 0.2, 0.1 */ -+}; -+ - /* analog input ranges for 6052, etc boards */ - static const struct comedi_lrange ai_ranges_6052 = { - 15, -@@ -477,6 +509,11 @@ static const struct comedi_lrange ai_ran - } - }; - -+static const uint8_t ai_range_code_6052[15] = { -+ 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, /* bipolar 10 ... 0.05 */ -+ 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf /* unipolar 10 ... 0.1 */ -+}; -+ - /* analog input ranges for 4020 board */ - static const struct comedi_lrange ai_ranges_4020 = { - 2, -@@ -561,6 +598,7 @@ struct pcidas64_board { - int ai_bits; /* analog input resolution */ - int ai_speed; /* fastest conversion period in ns */ - const struct comedi_lrange *ai_range_table; -+ const uint8_t *ai_range_code; - int ao_nchan; /* number of analog out channels */ - int ao_bits; /* analog output resolution */ - int ao_scan_speed; /* analog output speed (for a scan, not conversion) */ -@@ -619,6 +657,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, - .ai_range_table = &ai_ranges_64xx, -+ .ai_range_code = ai_range_code_64xx, - .ao_range_table = &ao_ranges_64xx, - .ao_range_code = ao_range_code_64xx, - .ai_fifo = &ai_fifo_64xx, -@@ -635,6 +674,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, - .ai_range_table = &ai_ranges_64xx, -+ .ai_range_code = ai_range_code_64xx, - .ao_range_table = &ao_ranges_64xx, - .ao_range_code = ao_range_code_64xx, - .ai_fifo = &ai_fifo_64xx, -@@ -650,7 +690,8 @@ static const struct pcidas64_board pcida - .ao_bits = 16, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ao_range_table = &ao_ranges_64xx, - .ao_range_code = ao_range_code_64xx, - .ai_fifo = &ai_fifo_64xx, -@@ -666,7 +707,8 @@ static const struct pcidas64_board pcida - .ao_bits = 16, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ao_range_table = &ao_ranges_64xx, - .ao_range_code = ao_range_code_64xx, - .ai_fifo = &ai_fifo_64xx, -@@ -682,7 +724,8 @@ static const struct pcidas64_board pcida - .ao_bits = 16, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ao_range_table = &ao_ranges_64xx, - .ao_range_code = ao_range_code_64xx, - .ai_fifo = &ai_fifo_64xx, -@@ -698,6 +741,7 @@ static const struct pcidas64_board pcida - .ao_bits = 16, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_60xx, -+ .ai_range_code = ai_range_code_60xx, - .ao_range_table = &ao_ranges_60xx, - .ao_range_code = ao_range_code_60xx, - .ai_fifo = &ai_fifo_60xx, -@@ -714,6 +758,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 100000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_60xx, -+ .ai_range_code = ai_range_code_60xx, - .ao_range_table = &ao_ranges_60xx, - .ao_range_code = ao_range_code_60xx, - .ai_fifo = &ai_fifo_60xx, -@@ -729,6 +774,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 100000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_60xx, -+ .ai_range_code = ai_range_code_60xx, - .ao_range_table = &ao_ranges_60xx, - .ao_range_code = ao_range_code_60xx, - .ai_fifo = &ai_fifo_60xx, -@@ -745,6 +791,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 100000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_60xx, -+ .ai_range_code = ai_range_code_60xx, - .ao_range_table = &ao_ranges_60xx, - .ao_range_code = ao_range_code_60xx, - .ai_fifo = &ai_fifo_60xx, -@@ -761,6 +808,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 10000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6030, -+ .ai_range_code = ai_range_code_6030, - .ao_range_table = &ao_ranges_6030, - .ao_range_code = ao_range_code_6030, - .ai_fifo = &ai_fifo_60xx, -@@ -777,6 +825,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 10000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6030, -+ .ai_range_code = ai_range_code_6030, - .ao_range_table = &ao_ranges_6030, - .ao_range_code = ao_range_code_6030, - .ai_fifo = &ai_fifo_60xx, -@@ -791,6 +840,7 @@ static const struct pcidas64_board pcida - .ao_nchan = 0, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6030, -+ .ai_range_code = ai_range_code_6030, - .ai_fifo = &ai_fifo_60xx, - .has_8255 = 0, - }, -@@ -803,6 +853,7 @@ static const struct pcidas64_board pcida - .ao_nchan = 0, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6030, -+ .ai_range_code = ai_range_code_6030, - .ai_fifo = &ai_fifo_60xx, - .has_8255 = 0, - }, -@@ -816,6 +867,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 0, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_60xx, -+ .ai_range_code = ai_range_code_60xx, - .ai_fifo = &ai_fifo_60xx, - .has_8255 = 0, - }, -@@ -830,6 +882,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 100000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_60xx, -+ .ai_range_code = ai_range_code_60xx, - .ao_range_table = &ao_ranges_60xx, - .ao_range_code = ao_range_code_60xx, - .ai_fifo = &ai_fifo_60xx, -@@ -846,6 +899,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 100000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_60xx, -+ .ai_range_code = ai_range_code_60xx, - .ao_range_table = &ao_ranges_60xx, - .ao_range_code = ao_range_code_60xx, - .ai_fifo = &ai_fifo_60xx, -@@ -862,6 +916,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 1000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6052, -+ .ai_range_code = ai_range_code_6052, - .ao_range_table = &ao_ranges_6030, - .ao_range_code = ao_range_code_6030, - .ai_fifo = &ai_fifo_60xx, -@@ -878,6 +933,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 3333, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6052, -+ .ai_range_code = ai_range_code_6052, - .ao_range_table = &ao_ranges_6030, - .ao_range_code = ao_range_code_6030, - .ai_fifo = &ai_fifo_60xx, -@@ -894,6 +950,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 1000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6052, -+ .ai_range_code = ai_range_code_6052, - .ao_range_table = &ao_ranges_6030, - .ao_range_code = ao_range_code_6030, - .ai_fifo = &ai_fifo_60xx, -@@ -910,6 +967,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 1000, - .layout = LAYOUT_60XX, - .ai_range_table = &ai_ranges_6052, -+ .ai_range_code = ai_range_code_6052, - .ao_range_table = &ao_ranges_6030, - .ao_range_code = ao_range_code_6030, - .ai_fifo = &ai_fifo_60xx, -@@ -942,6 +1000,7 @@ static const struct pcidas64_board pcida - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, - .ai_range_table = &ai_ranges_64xx, -+ .ai_range_code = ai_range_code_64xx, - .ai_fifo = ai_fifo_64xx, - .has_8255 = 1, - }, -@@ -954,7 +1013,8 @@ static const struct pcidas64_board pcida - .ao_nchan = 0, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ai_fifo = ai_fifo_64xx, - .has_8255 = 1, - }, -@@ -967,7 +1027,8 @@ static const struct pcidas64_board pcida - .ao_nchan = 0, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ai_fifo = ai_fifo_64xx, - .has_8255 = 1, - }, -@@ -980,7 +1041,8 @@ static const struct pcidas64_board pcida - .ao_nchan = 0, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ai_fifo = ai_fifo_64xx, - .has_8255 = 1, - }, -@@ -993,7 +1055,8 @@ static const struct pcidas64_board pcida - .ao_nchan = 2, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ai_fifo = ai_fifo_64xx, - .has_8255 = 1, - }, -@@ -1006,7 +1069,8 @@ static const struct pcidas64_board pcida - .ao_nchan = 2, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ai_fifo = ai_fifo_64xx, - .has_8255 = 1, - }, -@@ -1019,7 +1083,8 @@ static const struct pcidas64_board pcida - .ao_nchan = 2, - .ao_scan_speed = 10000, - .layout = LAYOUT_64XX, -- .ai_range_table = &ai_ranges_64xx, -+ .ai_range_table = &ai_ranges_64_mx, -+ .ai_range_code = ai_range_code_64_mx, - .ai_fifo = ai_fifo_64xx, - .has_8255 = 1, - }, -@@ -1257,45 +1322,7 @@ module_exit(driver_cb_pcidas_cleanup_mod - static unsigned int ai_range_bits_6xxx(const struct comedi_device *dev, - unsigned int range_index) - { -- const struct comedi_krange *range = -- &board(dev)->ai_range_table->range[range_index]; -- unsigned int bits = 0; -- -- switch (range->max) { -- case 10000000: -- bits = 0x000; -- break; -- case 5000000: -- bits = 0x100; -- break; -- case 2000000: -- case 2500000: -- bits = 0x200; -- break; -- case 1000000: -- case 1250000: -- bits = 0x300; -- break; -- case 500000: -- bits = 0x400; -- break; -- case 200000: -- case 250000: -- bits = 0x500; -- break; -- case 100000: -- bits = 0x600; -- break; -- case 50000: -- bits = 0x700; -- break; -- default: -- comedi_error(dev, "bug! in ai_range_bits_6xxx"); -- break; -- } -- if (range->min == 0) -- bits += 0x900; -- return bits; -+ return board(dev)->ai_range_code[range_index] << 8; - } - - static unsigned int hw_revision(const struct comedi_device *dev, diff --git a/patches/storvsc-ring-buffer-failures-may-result-in-i-o-freeze.patch b/patches/storvsc-ring-buffer-failures-may-result-in-i-o-freeze.patch deleted file mode 100644 index e7dea3d..0000000 --- a/patches/storvsc-ring-buffer-failures-may-result-in-i-o-freeze.patch +++ /dev/null @@ -1,39 +0,0 @@ -From e86fb5e8ab95f10ec5f2e9430119d5d35020c951 Mon Sep 17 00:00:00 2001 -From: Long Li <longli@microsoft.com> -Date: Fri, 5 Dec 2014 19:38:18 -0800 -Subject: storvsc: ring buffer failures may result in I/O freeze - -commit e86fb5e8ab95f10ec5f2e9430119d5d35020c951 upstream. - -When ring buffer returns an error indicating retry, storvsc may not -return a proper error code to SCSI when bounce buffer is not used. -This has introduced I/O freeze on RAID running atop storvsc devices. -This patch fixes it by always returning a proper error code. - -Signed-off-by: Long Li <longli@microsoft.com> -Reviewed-by: K. Y. Srinivasan <kys@microsoft.com> -Signed-off-by: Christoph Hellwig <hch@lst.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/storvsc_drv.c | 7 +++---- - 1 file changed, 3 insertions(+), 4 deletions(-) - ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -1359,13 +1359,12 @@ static int storvsc_queuecommand(struct S - if (ret == -EAGAIN) { - /* no more space */ - -- if (cmd_request->bounce_sgl_count) { -+ if (cmd_request->bounce_sgl_count) - destroy_bounce_buffer(cmd_request->bounce_sgl, - cmd_request->bounce_sgl_count); - -- ret = SCSI_MLQUEUE_DEVICE_BUSY; -- goto queue_error; -- } -+ ret = SCSI_MLQUEUE_DEVICE_BUSY; -+ goto queue_error; - } - - return 0; diff --git a/patches/sunrpc-fix-locking-around-callback-channel-reply-receive.patch b/patches/sunrpc-fix-locking-around-callback-channel-reply-receive.patch deleted file mode 100644 index c35d28e..0000000 --- a/patches/sunrpc-fix-locking-around-callback-channel-reply-receive.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 093a1468b6edb0e568be7311b8d2228d205702db Mon Sep 17 00:00:00 2001 -From: Trond Myklebust <trond.myklebust@primarydata.com> -Date: Wed, 12 Nov 2014 18:04:04 -0500 -Subject: SUNRPC: Fix locking around callback channel reply receive - -commit 093a1468b6edb0e568be7311b8d2228d205702db upstream. - -Both xprt_lookup_rqst() and xprt_complete_rqst() require that you -take the transport lock in order to avoid races with xprt_transmit(). - -Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com> -Reviewed-by: Jeff Layton <jlayton@primarydata.com> -Signed-off-by: J. Bruce Fields <bfields@redhat.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/sunrpc/svcsock.c | 27 ++++++++++++++++----------- - 1 file changed, 16 insertions(+), 11 deletions(-) - ---- a/net/sunrpc/svcsock.c -+++ b/net/sunrpc/svcsock.c -@@ -1055,17 +1055,12 @@ static int receive_cb_reply(struct svc_s - xid = *p++; - calldir = *p; - -- if (bc_xprt) -- req = xprt_lookup_rqst(bc_xprt, xid); -- -- if (!req) { -- printk(KERN_NOTICE -- "%s: Got unrecognized reply: " -- "calldir 0x%x xpt_bc_xprt %p xid %08x\n", -- __func__, ntohl(calldir), -- bc_xprt, xid); -+ if (!bc_xprt) - return -EAGAIN; -- } -+ spin_lock_bh(&bc_xprt->transport_lock); -+ req = xprt_lookup_rqst(bc_xprt, xid); -+ if (!req) -+ goto unlock_notfound; - - memcpy(&req->rq_private_buf, &req->rq_rcv_buf, sizeof(struct xdr_buf)); - /* -@@ -1076,11 +1071,21 @@ static int receive_cb_reply(struct svc_s - dst = &req->rq_private_buf.head[0]; - src = &rqstp->rq_arg.head[0]; - if (dst->iov_len < src->iov_len) -- return -EAGAIN; /* whatever; just giving up. */ -+ goto unlock_eagain; /* whatever; just giving up. */ - memcpy(dst->iov_base, src->iov_base, src->iov_len); - xprt_complete_rqst(req->rq_task, svsk->sk_reclen); - rqstp->rq_arg.len = 0; -+ spin_unlock_bh(&bc_xprt->transport_lock); - return 0; -+unlock_notfound: -+ printk(KERN_NOTICE -+ "%s: Got unrecognized reply: " -+ "calldir 0x%x xpt_bc_xprt %p xid %08x\n", -+ __func__, ntohl(calldir), -+ bc_xprt, ntohl(xid)); -+unlock_eagain: -+ spin_unlock_bh(&bc_xprt->transport_lock); -+ return -EAGAIN; - } - - static int copy_pages_to_kvecs(struct kvec *vec, struct page **pages, int len) diff --git a/patches/sysfs.h-add-attribute_groups-macro.patch b/patches/sysfs.h-add-attribute_groups-macro.patch deleted file mode 100644 index ca421e9..0000000 --- a/patches/sysfs.h-add-attribute_groups-macro.patch +++ /dev/null @@ -1,37 +0,0 @@ -From f2f37f58b1b933b06d6d84e80a31a1b500fb0db2 Mon Sep 17 00:00:00 2001 -From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Date: Sun, 14 Jul 2013 16:05:52 -0700 -Subject: sysfs.h: add ATTRIBUTE_GROUPS() macro - -commit f2f37f58b1b933b06d6d84e80a31a1b500fb0db2 upstream. - -To make it easier for driver subsystems to work with attribute groups, -create the ATTRIBUTE_GROUPS macro to remove some of the repetitive -typing for the most common use for attribute groups. - -Reviewed-by: Guenter Roeck <linux@roeck-us.net> -Tested-by: Guenter Roeck <linux@roeck-us.net> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - include/linux/sysfs.h | 9 +++++++++ - 1 file changed, 9 insertions(+) - ---- a/include/linux/sysfs.h -+++ b/include/linux/sysfs.h -@@ -80,6 +80,15 @@ struct attribute_group { - - #define __ATTR_NULL { .attr = { .name = NULL } } - -+#define ATTRIBUTE_GROUPS(name) \ -+static const struct attribute_group name##_group = { \ -+ .attrs = name##_attrs, \ -+}; \ -+static const struct attribute_group *name##_groups[] = { \ -+ &name##_group, \ -+ NULL, \ -+} -+ - #define attr_name(_attr) (_attr).attr.name - - struct file; diff --git a/patches/time-adjtimex-validate-the-adj_frequency-values.patch b/patches/time-adjtimex-validate-the-adj_frequency-values.patch deleted file mode 100644 index a1cbbfa..0000000 --- a/patches/time-adjtimex-validate-the-adj_frequency-values.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 5e5aeb4367b450a28f447f6d5ab57d8f2ab16a5f Mon Sep 17 00:00:00 2001 -From: Sasha Levin <sasha.levin@oracle.com> -Date: Wed, 3 Dec 2014 19:25:05 -0500 -Subject: time: adjtimex: Validate the ADJ_FREQUENCY values - -commit 5e5aeb4367b450a28f447f6d5ab57d8f2ab16a5f upstream. - -Verify that the frequency value from userspace is valid and makes sense. - -Unverified values can cause overflows later on. - -Cc: Thomas Gleixner <tglx@linutronix.de> -Cc: Ingo Molnar <mingo@kernel.org> -Signed-off-by: Sasha Levin <sasha.levin@oracle.com> -[jstultz: Fix up bug for negative values and drop redunent cap check] -Signed-off-by: John Stultz <john.stultz@linaro.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/time/ntp.c | 7 +++++++ - 1 file changed, 7 insertions(+) - ---- a/kernel/time/ntp.c -+++ b/kernel/time/ntp.c -@@ -660,6 +660,13 @@ int do_adjtimex(struct timex *txc) - return result; - } - -+ if (txc->modes & ADJ_FREQUENCY) { -+ if (LONG_MIN / PPM_SCALE > txc->freq) -+ return -EINVAL; -+ if (LONG_MAX / PPM_SCALE < txc->freq) -+ return -EINVAL; -+ } -+ - getnstimeofday(&ts); - - spin_lock_irq(&ntp_lock); diff --git a/patches/time-settimeofday-validate-the-values-of-tv-from-user.patch b/patches/time-settimeofday-validate-the-values-of-tv-from-user.patch deleted file mode 100644 index 19a46ca..0000000 --- a/patches/time-settimeofday-validate-the-values-of-tv-from-user.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 6ada1fc0e1c4775de0e043e1bd3ae9d065491aa5 Mon Sep 17 00:00:00 2001 -From: Sasha Levin <sasha.levin@oracle.com> -Date: Wed, 3 Dec 2014 19:22:48 -0500 -Subject: time: settimeofday: Validate the values of tv from user - -commit 6ada1fc0e1c4775de0e043e1bd3ae9d065491aa5 upstream. - -An unvalidated user input is multiplied by a constant, which can result in -an undefined behaviour for large values. While this is validated later, -we should avoid triggering undefined behaviour. - -Cc: Thomas Gleixner <tglx@linutronix.de> -Cc: Ingo Molnar <mingo@kernel.org> -Signed-off-by: Sasha Levin <sasha.levin@oracle.com> -[jstultz: include trivial milisecond->microsecond correction noticed -by Andy] -Signed-off-by: John Stultz <john.stultz@linaro.org> -[lizf: Backported to 3.4: adjust filename] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - include/linux/time.h | 13 +++++++++++++ - kernel/time.c | 4 ++++ - 2 files changed, 17 insertions(+) - ---- a/include/linux/time.h -+++ b/include/linux/time.h -@@ -189,6 +189,19 @@ extern void getboottime(struct timespec - extern void monotonic_to_bootbased(struct timespec *ts); - extern void get_monotonic_boottime(struct timespec *ts); - -+static inline bool timeval_valid(const struct timeval *tv) -+{ -+ /* Dates before 1970 are bogus */ -+ if (tv->tv_sec < 0) -+ return false; -+ -+ /* Can't have more microseconds then a second */ -+ if (tv->tv_usec < 0 || tv->tv_usec >= USEC_PER_SEC) -+ return false; -+ -+ return true; -+} -+ - extern struct timespec timespec_trunc(struct timespec t, unsigned gran); - extern int timekeeping_valid_for_hres(void); - extern u64 timekeeping_max_deferment(void); ---- a/kernel/time.c -+++ b/kernel/time.c -@@ -186,6 +186,10 @@ SYSCALL_DEFINE2(settimeofday, struct tim - if (tv) { - if (copy_from_user(&user_tv, tv, sizeof(*tv))) - return -EFAULT; -+ -+ if (!timeval_valid(&user_tv)) -+ return -EINVAL; -+ - new_ts.tv_sec = user_tv.tv_sec; - new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC; - } diff --git a/patches/ubi-fix-invalid-vfree.patch b/patches/ubi-fix-invalid-vfree.patch deleted file mode 100644 index 5fb0d1c..0000000 --- a/patches/ubi-fix-invalid-vfree.patch +++ /dev/null @@ -1,69 +0,0 @@ -From f38aed975c0c3645bbdfc5ebe35726e64caaf588 Mon Sep 17 00:00:00 2001 -From: Richard Weinberger <richard@nod.at> -Date: Mon, 27 Oct 2014 00:46:11 +0100 -Subject: UBI: Fix invalid vfree() - -commit f38aed975c0c3645bbdfc5ebe35726e64caaf588 upstream. - -The logic of vfree()'ing vol->upd_buf is tied to vol->updating. -In ubi_start_update() vol->updating is set long before vmalloc()'ing -vol->upd_buf. If we encounter a write failure in ubi_start_update() -before vmalloc() the UBI device release function will try to vfree() -vol->upd_buf because vol->updating is set. -Fix this by allocating vol->upd_buf directly after setting vol->updating. - -Fixes: -[ 31.559338] UBI warning: vol_cdev_release: update of volume 2 not finished, volume is damaged -[ 31.559340] ------------[ cut here ]------------ -[ 31.559343] WARNING: CPU: 1 PID: 2747 at mm/vmalloc.c:1446 __vunmap+0xe3/0x110() -[ 31.559344] Trying to vfree() nonexistent vm area (ffffc90001f2b000) -[ 31.559345] Modules linked in: -[ 31.565620] 0000000000000bba ffff88002a0cbdb0 ffffffff818f0497 ffff88003b9ba148 -[ 31.566347] ffff88002a0cbde0 ffffffff8156f515 ffff88003b9ba148 0000000000000bba -[ 31.567073] 0000000000000000 0000000000000000 ffff88002a0cbe88 ffffffff8156c10a -[ 31.567793] Call Trace: -[ 31.568034] [<ffffffff818f0497>] dump_stack+0x4e/0x7a -[ 31.568510] [<ffffffff8156f515>] ubi_io_write_vid_hdr+0x155/0x160 -[ 31.569084] [<ffffffff8156c10a>] ubi_eba_write_leb+0x23a/0x870 -[ 31.569628] [<ffffffff81569b36>] vol_cdev_write+0x226/0x380 -[ 31.570155] [<ffffffff81179265>] vfs_write+0xb5/0x1f0 -[ 31.570627] [<ffffffff81179f8a>] SyS_pwrite64+0x6a/0xa0 -[ 31.571123] [<ffffffff818fde12>] system_call_fastpath+0x16/0x1b - -Signed-off-by: Richard Weinberger <richard@nod.at> -Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/mtd/ubi/upd.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - ---- a/drivers/mtd/ubi/upd.c -+++ b/drivers/mtd/ubi/upd.c -@@ -135,6 +135,10 @@ int ubi_start_update(struct ubi_device * - ubi_assert(!vol->updating && !vol->changing_leb); - vol->updating = 1; - -+ vol->upd_buf = vmalloc(ubi->leb_size); -+ if (!vol->upd_buf) -+ return -ENOMEM; -+ - err = set_update_marker(ubi, vol); - if (err) - return err; -@@ -154,14 +158,12 @@ int ubi_start_update(struct ubi_device * - err = clear_update_marker(ubi, vol, 0); - if (err) - return err; -+ -+ vfree(vol->upd_buf); - vol->updating = 0; - return 0; - } - -- vol->upd_buf = vmalloc(ubi->leb_size); -- if (!vol->upd_buf) -- return -ENOMEM; -- - vol->upd_ebs = div_u64(bytes + vol->usable_leb_size - 1, - vol->usable_leb_size); - vol->upd_bytes = bytes; diff --git a/patches/udf-check-component-length-before-reading-it.patch b/patches/udf-check-component-length-before-reading-it.patch deleted file mode 100644 index 877bb78..0000000 --- a/patches/udf-check-component-length-before-reading-it.patch +++ /dev/null @@ -1,58 +0,0 @@ -From e237ec37ec154564f8690c5bd1795339955eeef9 Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.cz> -Date: Fri, 19 Dec 2014 14:27:55 +0100 -Subject: udf: Check component length before reading it - -commit e237ec37ec154564f8690c5bd1795339955eeef9 upstream. - -Check that length specified in a component of a symlink fits in the -input buffer we are reading. Also properly ignore component length for -component types that do not use it. Otherwise we read memory after end -of buffer for corrupted udf image. - -Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no> -Signed-off-by: Jan Kara <jack@suse.cz> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/udf/symlink.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - ---- a/fs/udf/symlink.c -+++ b/fs/udf/symlink.c -@@ -42,14 +42,17 @@ static int udf_pc_to_char(struct super_b - tolen--; - while (elen < fromlen) { - pc = (struct pathComponent *)(from + elen); -+ elen += sizeof(struct pathComponent); - switch (pc->componentType) { - case 1: - /* - * Symlink points to some place which should be agreed - * upon between originator and receiver of the media. Ignore. - */ -- if (pc->lengthComponentIdent > 0) -+ if (pc->lengthComponentIdent > 0) { -+ elen += pc->lengthComponentIdent; - break; -+ } - /* Fall through */ - case 2: - if (tolen == 0) -@@ -74,6 +77,9 @@ static int udf_pc_to_char(struct super_b - /* that would be . - just ignore */ - break; - case 5: -+ elen += pc->lengthComponentIdent; -+ if (elen > fromlen) -+ return -EIO; - comp_len = udf_get_filename(sb, pc->componentIdent, - pc->lengthComponentIdent, - p, tolen); -@@ -85,7 +91,6 @@ static int udf_pc_to_char(struct super_b - tolen--; - break; - } -- elen += sizeof(struct pathComponent) + pc->lengthComponentIdent; - } - if (p > to + 1) - p[-1] = '\0'; diff --git a/patches/udf-check-path-length-when-reading-symlink.patch b/patches/udf-check-path-length-when-reading-symlink.patch deleted file mode 100644 index d7f641e..0000000 --- a/patches/udf-check-path-length-when-reading-symlink.patch +++ /dev/null @@ -1,226 +0,0 @@ -From 0e5cc9a40ada6046e6bc3bdfcd0c0d7e4b706b14 Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.cz> -Date: Thu, 18 Dec 2014 22:37:50 +0100 -Subject: udf: Check path length when reading symlink - -commit 0e5cc9a40ada6046e6bc3bdfcd0c0d7e4b706b14 upstream. - -Symlink reading code does not check whether the resulting path fits into -the page provided by the generic code. This isn't as easy as just -checking the symlink size because of various encoding conversions we -perform on path. So we have to check whether there is still enough space -in the buffer on the fly. - -Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no> -Signed-off-by: Jan Kara <jack@suse.cz> -[lizf: Backported to 3.4: udf_get_filename() is called in do_udf_readdir()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/udf/dir.c | 3 ++- - fs/udf/namei.c | 3 ++- - fs/udf/symlink.c | 31 ++++++++++++++++++++++++++----- - fs/udf/udfdecl.h | 3 ++- - fs/udf/unicode.c | 28 ++++++++++++++++------------ - 5 files changed, 48 insertions(+), 20 deletions(-) - ---- a/fs/udf/dir.c -+++ b/fs/udf/dir.c -@@ -163,7 +163,8 @@ static int do_udf_readdir(struct inode * - struct kernel_lb_addr tloc = lelb_to_cpu(cfi.icb.extLocation); - - iblock = udf_get_lb_pblock(dir->i_sb, &tloc, 0); -- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi); -+ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname, -+ UDF_NAME_LEN); - dt_type = DT_UNKNOWN; - } - ---- a/fs/udf/namei.c -+++ b/fs/udf/namei.c -@@ -233,7 +233,8 @@ static struct fileIdentDesc *udf_find_en - if (!lfi) - continue; - -- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi); -+ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname, -+ UDF_NAME_LEN); - if (flen && udf_match(flen, fname, child->len, child->name)) - goto out_ok; - } ---- a/fs/udf/symlink.c -+++ b/fs/udf/symlink.c -@@ -30,13 +30,16 @@ - #include <linux/buffer_head.h> - #include "udf_i.h" - --static void udf_pc_to_char(struct super_block *sb, unsigned char *from, -- int fromlen, unsigned char *to) -+static int udf_pc_to_char(struct super_block *sb, unsigned char *from, -+ int fromlen, unsigned char *to, int tolen) - { - struct pathComponent *pc; - int elen = 0; -+ int comp_len; - unsigned char *p = to; - -+ /* Reserve one byte for terminating \0 */ -+ tolen--; - while (elen < fromlen) { - pc = (struct pathComponent *)(from + elen); - switch (pc->componentType) { -@@ -49,22 +52,37 @@ static void udf_pc_to_char(struct super_ - break; - /* Fall through */ - case 2: -+ if (tolen == 0) -+ return -ENAMETOOLONG; - p = to; - *p++ = '/'; -+ tolen--; - break; - case 3: -+ if (tolen < 3) -+ return -ENAMETOOLONG; - memcpy(p, "../", 3); - p += 3; -+ tolen -= 3; - break; - case 4: -+ if (tolen < 2) -+ return -ENAMETOOLONG; - memcpy(p, "./", 2); - p += 2; -+ tolen -= 2; - /* that would be . - just ignore */ - break; - case 5: -- p += udf_get_filename(sb, pc->componentIdent, p, -- pc->lengthComponentIdent); -+ comp_len = udf_get_filename(sb, pc->componentIdent, -+ pc->lengthComponentIdent, -+ p, tolen); -+ p += comp_len; -+ tolen -= comp_len; -+ if (tolen == 0) -+ return -ENAMETOOLONG; - *p++ = '/'; -+ tolen--; - break; - } - elen += sizeof(struct pathComponent) + pc->lengthComponentIdent; -@@ -73,6 +91,7 @@ static void udf_pc_to_char(struct super_ - p[-1] = '\0'; - else - p[0] = '\0'; -+ return 0; - } - - static int udf_symlink_filler(struct file *file, struct page *page) -@@ -108,8 +127,10 @@ static int udf_symlink_filler(struct fil - symlink = bh->b_data; - } - -- udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p); -+ err = udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p, PAGE_SIZE); - brelse(bh); -+ if (err) -+ goto out_unlock_inode; - - up_read(&iinfo->i_data_sem); - SetPageUptodate(page); ---- a/fs/udf/udfdecl.h -+++ b/fs/udf/udfdecl.h -@@ -207,7 +207,8 @@ udf_get_lb_pblock(struct super_block *sb - } - - /* unicode.c */ --extern int udf_get_filename(struct super_block *, uint8_t *, uint8_t *, int); -+extern int udf_get_filename(struct super_block *, uint8_t *, int, uint8_t *, -+ int); - extern int udf_put_filename(struct super_block *, const uint8_t *, uint8_t *, - int); - extern int udf_build_ustr(struct ustr *, dstring *, int); ---- a/fs/udf/unicode.c -+++ b/fs/udf/unicode.c -@@ -28,7 +28,8 @@ - - #include "udf_sb.h" - --static int udf_translate_to_linux(uint8_t *, uint8_t *, int, uint8_t *, int); -+static int udf_translate_to_linux(uint8_t *, int, uint8_t *, int, uint8_t *, -+ int); - - static int udf_char_to_ustr(struct ustr *dest, const uint8_t *src, int strlen) - { -@@ -333,8 +334,8 @@ try_again: - return u_len + 1; - } - --int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname, -- int flen) -+int udf_get_filename(struct super_block *sb, uint8_t *sname, int slen, -+ uint8_t *dname, int dlen) - { - struct ustr *filename, *unifilename; - int len = 0; -@@ -347,7 +348,7 @@ int udf_get_filename(struct super_block - if (!unifilename) - goto out1; - -- if (udf_build_ustr_exact(unifilename, sname, flen)) -+ if (udf_build_ustr_exact(unifilename, sname, slen)) - goto out2; - - if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) { -@@ -366,7 +367,8 @@ int udf_get_filename(struct super_block - } else - goto out2; - -- len = udf_translate_to_linux(dname, filename->u_name, filename->u_len, -+ len = udf_translate_to_linux(dname, dlen, -+ filename->u_name, filename->u_len, - unifilename->u_name, unifilename->u_len); - out2: - kfree(unifilename); -@@ -403,10 +405,12 @@ int udf_put_filename(struct super_block - #define EXT_MARK '.' - #define CRC_MARK '#' - #define EXT_SIZE 5 -+/* Number of chars we need to store generated CRC to make filename unique */ -+#define CRC_LEN 5 - --static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName, -- int udfLen, uint8_t *fidName, -- int fidNameLen) -+static int udf_translate_to_linux(uint8_t *newName, int newLen, -+ uint8_t *udfName, int udfLen, -+ uint8_t *fidName, int fidNameLen) - { - int index, newIndex = 0, needsCRC = 0; - int extIndex = 0, newExtIndex = 0, hasExt = 0; -@@ -440,7 +444,7 @@ static int udf_translate_to_linux(uint8_ - newExtIndex = newIndex; - } - } -- if (newIndex < 256) -+ if (newIndex < newLen) - newName[newIndex++] = curr; - else - needsCRC = 1; -@@ -468,13 +472,13 @@ static int udf_translate_to_linux(uint8_ - } - ext[localExtIndex++] = curr; - } -- maxFilenameLen = 250 - localExtIndex; -+ maxFilenameLen = newLen - CRC_LEN - localExtIndex; - if (newIndex > maxFilenameLen) - newIndex = maxFilenameLen; - else - newIndex = newExtIndex; -- } else if (newIndex > 250) -- newIndex = 250; -+ } else if (newIndex > newLen - CRC_LEN) -+ newIndex = newLen - CRC_LEN; - newName[newIndex++] = CRC_MARK; - valueCRC = crc_itu_t(0, fidName, fidNameLen); - newName[newIndex++] = hexChar[(valueCRC & 0xf000) >> 12]; diff --git a/patches/udf-verify-i_size-when-loading-inode.patch b/patches/udf-verify-i_size-when-loading-inode.patch deleted file mode 100644 index c5d276d..0000000 --- a/patches/udf-verify-i_size-when-loading-inode.patch +++ /dev/null @@ -1,42 +0,0 @@ -From e159332b9af4b04d882dbcfe1bb0117f0a6d4b58 Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.cz> -Date: Fri, 19 Dec 2014 12:03:53 +0100 -Subject: udf: Verify i_size when loading inode - -commit e159332b9af4b04d882dbcfe1bb0117f0a6d4b58 upstream. - -Verify that inode size is sane when loading inode with data stored in -ICB. Otherwise we may get confused later when working with the inode and -inode size is too big. - -Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no> -Signed-off-by: Jan Kara <jack@suse.cz> -[lizf: Backported to 3.4: just return on error, as there's no "out" label] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/udf/inode.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -1392,6 +1392,20 @@ static void udf_fill_inode(struct inode - iinfo->i_lenEAttr; - } - -+ /* Sanity checks for files in ICB so that we don't get confused later */ -+ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { -+ /* -+ * For file in ICB data is stored in allocation descriptor -+ * so sizes should match -+ */ -+ if (iinfo->i_lenAlloc != inode->i_size) -+ return; -+ /* File in ICB has to fit in there... */ -+ if (inode->i_size > inode->i_sb->s_blocksize - -+ udf_file_entry_alloc_offset(inode)) -+ return; -+ } -+ - switch (fe->icbTag.fileType) { - case ICBTAG_FILE_TYPE_DIRECTORY: - inode->i_op = &udf_dir_inode_operations; diff --git a/patches/udf-verify-symlink-size-before-loading-it.patch b/patches/udf-verify-symlink-size-before-loading-it.patch deleted file mode 100644 index e1da5fb..0000000 --- a/patches/udf-verify-symlink-size-before-loading-it.patch +++ /dev/null @@ -1,64 +0,0 @@ -From a1d47b262952a45aae62bd49cfaf33dd76c11a2c Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.cz> -Date: Fri, 19 Dec 2014 12:21:47 +0100 -Subject: udf: Verify symlink size before loading it - -commit a1d47b262952a45aae62bd49cfaf33dd76c11a2c upstream. - -UDF specification allows arbitrarily large symlinks. However we support -only symlinks at most one block large. Check the length of the symlink -so that we don't access memory beyond end of the symlink block. - -Reported-by: Carl Henrik Lunde <chlunde@gmail.com> -Signed-off-by: Jan Kara <jack@suse.cz> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/udf/symlink.c | 17 +++++++++++++---- - 1 file changed, 13 insertions(+), 4 deletions(-) - ---- a/fs/udf/symlink.c -+++ b/fs/udf/symlink.c -@@ -80,11 +80,17 @@ static int udf_symlink_filler(struct fil - struct inode *inode = page->mapping->host; - struct buffer_head *bh = NULL; - unsigned char *symlink; -- int err = -EIO; -+ int err; - unsigned char *p = kmap(page); - struct udf_inode_info *iinfo; - uint32_t pos; - -+ /* We don't support symlinks longer than one block */ -+ if (inode->i_size > inode->i_sb->s_blocksize) { -+ err = -ENAMETOOLONG; -+ goto out_unmap; -+ } -+ - iinfo = UDF_I(inode); - pos = udf_block_map(inode, 0); - -@@ -94,8 +100,10 @@ static int udf_symlink_filler(struct fil - } else { - bh = sb_bread(inode->i_sb, pos); - -- if (!bh) -- goto out; -+ if (!bh) { -+ err = -EIO; -+ goto out_unlock_inode; -+ } - - symlink = bh->b_data; - } -@@ -109,9 +117,10 @@ static int udf_symlink_filler(struct fil - unlock_page(page); - return 0; - --out: -+out_unlock_inode: - up_read(&iinfo->i_data_sem); - SetPageError(page); -+out_unmap: - kunmap(page); - unlock_page(page); - return err; diff --git a/patches/usb-add-otg-pet-device-to-tpl.patch b/patches/usb-add-otg-pet-device-to-tpl.patch deleted file mode 100644 index 52de43e..0000000 --- a/patches/usb-add-otg-pet-device-to-tpl.patch +++ /dev/null @@ -1,47 +0,0 @@ -From e5dff0e80463cc3fa236e898ef1491b40be70b19 Mon Sep 17 00:00:00 2001 -From: Macpaul Lin <macpaul@gmail.com> -Date: Fri, 23 Jan 2015 14:39:02 +0800 -Subject: USB: Add OTG PET device to TPL - -commit e5dff0e80463cc3fa236e898ef1491b40be70b19 upstream. - -OTG device shall support this device for allowing compliance automated testing. -The modification is derived from Pavankumar and Vijayavardhans' previous work. - -Signed-off-by: Macpaul Lin <macpaul@gmail.com> -Cc: Pavankumar Kondeti <pkondeti@codeaurora.org> -Cc: Vijayavardhan Vennapusa <vvreddy@codeaurora.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/core/otg_whitelist.h | 5 +++++ - drivers/usb/core/quirks.c | 4 ++++ - 2 files changed, 9 insertions(+) - ---- a/drivers/usb/core/otg_whitelist.h -+++ b/drivers/usb/core/otg_whitelist.h -@@ -59,6 +59,11 @@ static int is_targeted(struct usb_device - le16_to_cpu(dev->descriptor.idProduct) == 0xbadd)) - return 0; - -+ /* OTG PET device is always targeted (see OTG 2.0 ECN 6.4.2) */ -+ if ((le16_to_cpu(dev->descriptor.idVendor) == 0x1a0a && -+ le16_to_cpu(dev->descriptor.idProduct) == 0x0200)) -+ return 1; -+ - /* NOTE: can't use usb_match_id() since interface caches - * aren't set up yet. this is cut/paste from that code. - */ ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -175,6 +175,10 @@ static const struct usb_device_id usb_in - { USB_DEVICE(0x0b05, 0x17e0), .driver_info = - USB_QUIRK_IGNORE_REMOTE_WAKEUP }, - -+ /* Protocol and OTG Electrical Test Device */ -+ { USB_DEVICE(0x1a0a, 0x0200), .driver_info = -+ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, -+ - { } /* terminating entry must be last */ - }; - diff --git a/patches/usb-cdc-acm-check-for-valid-interfaces.patch b/patches/usb-cdc-acm-check-for-valid-interfaces.patch deleted file mode 100644 index d2baf18..0000000 --- a/patches/usb-cdc-acm-check-for-valid-interfaces.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 403dff4e2c94f275e24fd85f40b2732ffec268a1 Mon Sep 17 00:00:00 2001 -From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Date: Fri, 7 Nov 2014 08:48:15 -0800 -Subject: USB: cdc-acm: check for valid interfaces - -commit 403dff4e2c94f275e24fd85f40b2732ffec268a1 upstream. - -We need to check that we have both a valid data and control inteface for both -types of headers (union and not union.) - -References: https://bugzilla.kernel.org/show_bug.cgi?id=83551 -Reported-by: Simon Schubert <2+kernel@0x2c.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/class/cdc-acm.c | 9 +++++---- - 1 file changed, 5 insertions(+), 4 deletions(-) - ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1108,10 +1108,11 @@ next_desc: - } else { - control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0); - data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = union_header->bSlaveInterface0)); -- if (!control_interface || !data_interface) { -- dev_dbg(&intf->dev, "no interfaces\n"); -- return -ENODEV; -- } -+ } -+ -+ if (!control_interface || !data_interface) { -+ dev_dbg(&intf->dev, "no interfaces\n"); -+ return -ENODEV; - } - - if (data_interface_num != call_interface_num) diff --git a/patches/usb-console-fix-potential-use-after-free.patch b/patches/usb-console-fix-potential-use-after-free.patch deleted file mode 100644 index a0c69c1..0000000 --- a/patches/usb-console-fix-potential-use-after-free.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Mon, 5 Jan 2015 16:04:13 +0100 -Subject: USB: console: fix potential use after free - -commit 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad upstream. - -Use tty kref to release the fake tty in usb_console_setup to avoid use -after free if the underlying serial driver has acquired a reference. - -Note that using the tty destructor release_one_tty requires some more -state to be initialised. - -Fixes: 4a90f09b20f4 ("tty: usb-serial krefs") -Signed-off-by: Johan Hovold <johan@kernel.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/console.c | 15 ++++++++++----- - 1 file changed, 10 insertions(+), 5 deletions(-) - ---- a/drivers/usb/serial/console.c -+++ b/drivers/usb/serial/console.c -@@ -47,6 +47,8 @@ static struct console usbcons; - * ------------------------------------------------------------ - */ - -+static const struct tty_operations usb_console_fake_tty_ops = { -+}; - - /* - * The parsing of the command line works exactly like the -@@ -141,14 +143,17 @@ static int usb_console_setup(struct cons - goto reset_open_count; - } - kref_init(&tty->kref); -- tty_port_tty_set(&port->port, tty); - tty->driver = usb_serial_tty_driver; - tty->index = co->index; -+ INIT_LIST_HEAD(&tty->tty_files); -+ kref_get(&tty->driver->kref); -+ tty->ops = &usb_console_fake_tty_ops; - if (tty_init_termios(tty)) { - retval = -ENOMEM; - err("no more memory"); -- goto free_tty; -+ goto put_tty; - } -+ tty_port_tty_set(&port->port, tty); - } - - /* only call the device specific open if this -@@ -170,7 +175,7 @@ static int usb_console_setup(struct cons - serial->type->set_termios(tty, port, &dummy); - - tty_port_tty_set(&port->port, NULL); -- kfree(tty); -+ tty_kref_put(tty); - } - set_bit(ASYNCB_INITIALIZED, &port->port.flags); - } -@@ -186,8 +191,8 @@ static int usb_console_setup(struct cons - - fail: - tty_port_tty_set(&port->port, NULL); -- free_tty: -- kfree(tty); -+ put_tty: -+ tty_kref_put(tty); - reset_open_count: - port->port.count = 0; - usb_autopm_put_interface(serial->interface); diff --git a/patches/usb-core-binterval-quirk.patch b/patches/usb-core-binterval-quirk.patch deleted file mode 100644 index f17848f..0000000 --- a/patches/usb-core-binterval-quirk.patch +++ /dev/null @@ -1,81 +0,0 @@ -From cd83ce9e6195aa3ea15ab4db92892802c20df5d0 Mon Sep 17 00:00:00 2001 -From: James P Michels III <james.p.michels@gmail.com> -Date: Sun, 27 Jul 2014 13:28:04 -0400 -Subject: usb-core bInterval quirk - -commit cd83ce9e6195aa3ea15ab4db92892802c20df5d0 upstream. - -This patch adds a usb quirk to support devices with interupt endpoints -and bInterval values expressed as microframes. The quirk causes the -parse endpoint function to modify the reported bInterval to a standards -conforming value. - -There is currently code in the endpoint parser that checks for -bIntervals that are outside of the valid range (1-16 for USB 2+ high -speed and super speed interupt endpoints). In this case, the code assumes -the bInterval is being reported in 1ms frames. As well, the correction -is only applied if the original bInterval value is out of the 1-16 range. - -With this quirk applied to the device, the bInterval will be -accurately adjusted from microframes to an exponent. - -Signed-off-by: James P Michels III <james.p.michels@gmail.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/core/config.c | 11 +++++++++++ - drivers/usb/core/quirks.c | 4 ++++ - include/linux/usb/quirks.h | 11 +++++++++++ - 3 files changed, 26 insertions(+) - ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -201,6 +201,17 @@ static int usb_parse_endpoint(struct dev - if (n == 0) - n = 9; /* 32 ms = 2^(9-1) uframes */ - j = 16; -+ -+ /* -+ * Adjust bInterval for quirked devices. -+ * This quirk fixes bIntervals reported in -+ * linear microframes. -+ */ -+ if (to_usb_device(ddev)->quirks & -+ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL) { -+ n = clamp(fls(d->bInterval), i, j); -+ i = j = n; -+ } - break; - default: /* USB_SPEED_FULL or _LOW */ - /* For low-speed, 10 ms is the official minimum. ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -152,6 +152,10 @@ static const struct usb_device_id usb_qu - /* SKYMEDI USB_DRIVE */ - { USB_DEVICE(0x1516, 0x8628), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* Razer - Razer Blade Keyboard */ -+ { USB_DEVICE(0x1532, 0x0116), .driver_info = -+ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, -+ - /* BUILDWIN Photo Frame */ - { USB_DEVICE(0x1908, 0x1315), .driver_info = - USB_QUIRK_HONOR_BNUMINTERFACES }, ---- a/include/linux/usb/quirks.h -+++ b/include/linux/usb/quirks.h -@@ -36,4 +36,15 @@ - /* device can't handle device_qualifier descriptor requests */ - #define USB_QUIRK_DEVICE_QUALIFIER 0x00000100 - -+/* -+ * For high speed and super speed interupt endpoints, the USB 2.0 and -+ * USB 3.0 spec require the interval in microframes -+ * (1 microframe = 125 microseconds) to be calculated as -+ * interval = 2 ^ (bInterval-1). -+ * -+ * Devices with this quirk report their bInterval as the result of this -+ * calculation instead of the exponent variable used in the calculation. -+ */ -+#define USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL 0x00000080 -+ - #endif /* __LINUX_USB_QUIRKS_H */ diff --git a/patches/usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch b/patches/usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch deleted file mode 100644 index f8e257d..0000000 --- a/patches/usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 1ae78a4870989a354028cb17dabf819b595e70e3 Mon Sep 17 00:00:00 2001 -From: David Peterson <david.peterson@cel.com> -Date: Tue, 6 Jan 2015 15:00:52 +0000 -Subject: USB: cp210x: add IDs for CEL USB sticks and MeshWorks devices - -commit 1ae78a4870989a354028cb17dabf819b595e70e3 upstream. - -Added virtual com port VID/PID entries for CEL USB sticks and MeshWorks -devices. - -Signed-off-by: David Peterson <david.peterson@cel.com> -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/cp210x.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -126,10 +126,12 @@ static const struct usb_device_id id_tab - { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ - { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ - { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ -- { USB_DEVICE(0x10C4, 0x8857) }, /* CEL MeshConnect USB Stick */ -+ { USB_DEVICE(0x10C4, 0x8856) }, /* CEL EM357 ZigBee USB Stick - LR */ -+ { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */ - { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ -+ { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ - { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ diff --git a/patches/usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch b/patches/usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch deleted file mode 100644 index 1ca4615..0000000 --- a/patches/usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 90441b4dbe90ba0c38111ea89fa093a8c9627801 Mon Sep 17 00:00:00 2001 -From: Preston Fick <pffick@gmail.com> -Date: Sat, 27 Dec 2014 01:32:41 -0600 -Subject: USB: cp210x: fix ID for production CEL MeshConnect USB Stick - -commit 90441b4dbe90ba0c38111ea89fa093a8c9627801 upstream. - -Fixing typo for MeshConnect IDs. The original PID (0x8875) is not in -production and is not needed. Instead it has been changed to the -official production PID (0x8857). - -Signed-off-by: Preston Fick <pffick@gmail.com> -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/cp210x.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -126,7 +126,7 @@ static const struct usb_device_id id_tab - { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ - { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ - { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ -- { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */ -+ { USB_DEVICE(0x10C4, 0x8857) }, /* CEL MeshConnect USB Stick */ - { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ diff --git a/patches/usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch b/patches/usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch deleted file mode 100644 index 735ab97..0000000 --- a/patches/usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 39e60635a01520e8c8ed3946a28c2b98e6a46f79 Mon Sep 17 00:00:00 2001 -From: Amit Virdi <amit.virdi@st.com> -Date: Tue, 13 Jan 2015 14:27:21 +0530 -Subject: usb: dwc3: gadget: Stop TRB preparation after limit is reached - -commit 39e60635a01520e8c8ed3946a28c2b98e6a46f79 upstream. - -DWC3 gadget sets up a pool of 32 TRBs for each EP during initialization. This -means, the max TRBs that can be submitted for an EP is fixed to 32. Since the -request queue for an EP is a linked list, any number of requests can be queued -to it by the gadget layer. However, the dwc3 driver must not submit TRBs more -than the pool it has created for. This limit wasn't respected when SG was used -resulting in submitting more than the max TRBs, eventually leading to -non-transfer of the TRBs submitted over the max limit. - -Root cause: -When SG is used, there are two loops iterating to prepare TRBs: - - Outer loop over the request_list - - Inner loop over the SG list -The code was missing break to get out of the outer loop. - -Fixes: eeb720fb21d6 (usb: dwc3: gadget: add support for SG lists) -Signed-off-by: Amit Virdi <amit.virdi@st.com> -Signed-off-by: Felipe Balbi <balbi@ti.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/dwc3/gadget.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -851,6 +851,9 @@ static void dwc3_prepare_trbs(struct dwc - if (last_one) - break; - } -+ -+ if (last_one) -+ break; - } else { - dma = req->request.dma; - length = req->request.length; diff --git a/patches/usb-keyspan-fix-overrun-error-reporting.patch b/patches/usb-keyspan-fix-overrun-error-reporting.patch deleted file mode 100644 index c2eed11..0000000 --- a/patches/usb-keyspan-fix-overrun-error-reporting.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 855515a6d3731242d85850a206f2ec084c917338 Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Tue, 18 Nov 2014 11:25:20 +0100 -Subject: USB: keyspan: fix overrun-error reporting - -commit 855515a6d3731242d85850a206f2ec084c917338 upstream. - -Fix reporting of overrun errors, which are not associated with a -character. Instead insert a null character and report only once. - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Signed-off-by: Johan Hovold <johan@kernel.org> -[lizf: Backported to 3.4: - - s/&port->port/tty - - adjust context - - adjust indentation] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/keyspan.c | 19 +++++++++---------- - 1 file changed, 9 insertions(+), 10 deletions(-) - ---- a/drivers/usb/serial/keyspan.c -+++ b/drivers/usb/serial/keyspan.c -@@ -323,12 +323,11 @@ static void usa26_indat_callback(struct - if ((data[0] & 0x80) == 0) { - /* no errors on individual bytes, only - possible overrun err */ -- if (data[0] & RXERROR_OVERRUN) -- err = TTY_OVERRUN; -- else -- err = 0; -+ if (data[0] & RXERROR_OVERRUN) { -+ tty_insert_flip_char(tty, 0, TTY_OVERRUN); -+ } - for (i = 1; i < urb->actual_length ; ++i) -- tty_insert_flip_char(tty, data[i], err); -+ tty_insert_flip_char(tty, data[i], TTY_NORMAL); - } else { - /* some bytes had errors, every byte has status */ - dbg("%s - RX error!!!!", __func__); -@@ -859,13 +858,13 @@ static void usa90_indat_callback(struct - if ((data[0] & 0x80) == 0) { - /* no errors on individual bytes, only - possible overrun err*/ -- if (data[0] & RXERROR_OVERRUN) -- err = TTY_OVERRUN; -- else -- err = 0; -+ if (data[0] & RXERROR_OVERRUN) { -+ tty_insert_flip_char(tty, 0, -+ TTY_OVERRUN); -+ } - for (i = 1; i < urb->actual_length ; ++i) - tty_insert_flip_char(tty, data[i], -- err); -+ TTY_NORMAL); - } else { - /* some bytes had errors, every byte has status */ - dbg("%s - RX error!!!!", __func__); diff --git a/patches/usb-keyspan-fix-tty-line-status-reporting.patch b/patches/usb-keyspan-fix-tty-line-status-reporting.patch deleted file mode 100644 index 06a8961..0000000 --- a/patches/usb-keyspan-fix-tty-line-status-reporting.patch +++ /dev/null @@ -1,137 +0,0 @@ -From 5d1678a33c731b56e245e888fdae5e88efce0997 Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Tue, 18 Nov 2014 11:25:19 +0100 -Subject: USB: keyspan: fix tty line-status reporting - -commit 5d1678a33c731b56e245e888fdae5e88efce0997 upstream. - -Fix handling of TTY error flags, which are not bitmasks and must -specifically not be ORed together as this prevents the line discipline -from recognising them. - -Also insert null characters when reporting overrun errors as these are -not associated with the received character. - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Signed-off-by: Johan Hovold <johan@kernel.org> -[lizf: Backported to 3.4: - - s/&port->port/tty/ - - adjust context - - adjust indentation] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/keyspan.c | 78 +++++++++++++++++++++++++++---------------- - 1 file changed, 50 insertions(+), 28 deletions(-) - ---- a/drivers/usb/serial/keyspan.c -+++ b/drivers/usb/serial/keyspan.c -@@ -333,14 +333,19 @@ static void usa26_indat_callback(struct - /* some bytes had errors, every byte has status */ - dbg("%s - RX error!!!!", __func__); - for (i = 0; i + 1 < urb->actual_length; i += 2) { -- int stat = data[i], flag = 0; -- if (stat & RXERROR_OVERRUN) -- flag |= TTY_OVERRUN; -- if (stat & RXERROR_FRAMING) -- flag |= TTY_FRAME; -- if (stat & RXERROR_PARITY) -- flag |= TTY_PARITY; -+ int stat = data[i]; -+ int flag = TTY_NORMAL; -+ -+ if (stat & RXERROR_OVERRUN) { -+ tty_insert_flip_char(tty, 0, -+ TTY_OVERRUN); -+ } - /* XXX should handle break (0x10) */ -+ if (stat & RXERROR_PARITY) -+ flag = TTY_PARITY; -+ else if (stat & RXERROR_FRAMING) -+ flag = TTY_FRAME; -+ - tty_insert_flip_char(tty, data[i+1], flag); - } - } -@@ -712,14 +717,19 @@ static void usa49_indat_callback(struct - } else { - /* some bytes had errors, every byte has status */ - for (i = 0; i + 1 < urb->actual_length; i += 2) { -- int stat = data[i], flag = 0; -- if (stat & RXERROR_OVERRUN) -- flag |= TTY_OVERRUN; -- if (stat & RXERROR_FRAMING) -- flag |= TTY_FRAME; -- if (stat & RXERROR_PARITY) -- flag |= TTY_PARITY; -+ int stat = data[i]; -+ int flag = TTY_NORMAL; -+ -+ if (stat & RXERROR_OVERRUN) { -+ tty_insert_flip_char(tty, 0, -+ TTY_OVERRUN); -+ } - /* XXX should handle break (0x10) */ -+ if (stat & RXERROR_PARITY) -+ flag = TTY_PARITY; -+ else if (stat & RXERROR_FRAMING) -+ flag = TTY_FRAME; -+ - tty_insert_flip_char(tty, data[i+1], flag); - } - } -@@ -779,14 +789,19 @@ static void usa49wg_indat_callback(struc - * some bytes had errors, every byte has status - */ - for (x = 0; x + 1 < len; x += 2) { -- int stat = data[i], flag = 0; -- if (stat & RXERROR_OVERRUN) -- flag |= TTY_OVERRUN; -- if (stat & RXERROR_FRAMING) -- flag |= TTY_FRAME; -- if (stat & RXERROR_PARITY) -- flag |= TTY_PARITY; -+ int stat = data[i]; -+ int flag = TTY_NORMAL; -+ -+ if (stat & RXERROR_OVERRUN) { -+ tty_insert_flip_char(tty, 0, -+ TTY_OVERRUN); -+ } - /* XXX should handle break (0x10) */ -+ if (stat & RXERROR_PARITY) -+ flag = TTY_PARITY; -+ else if (stat & RXERROR_FRAMING) -+ flag = TTY_FRAME; -+ - tty_insert_flip_char(tty, - data[i+1], flag); - i += 2; -@@ -855,14 +870,21 @@ static void usa90_indat_callback(struct - /* some bytes had errors, every byte has status */ - dbg("%s - RX error!!!!", __func__); - for (i = 0; i + 1 < urb->actual_length; i += 2) { -- int stat = data[i], flag = 0; -- if (stat & RXERROR_OVERRUN) -- flag |= TTY_OVERRUN; -- if (stat & RXERROR_FRAMING) -- flag |= TTY_FRAME; -- if (stat & RXERROR_PARITY) -- flag |= TTY_PARITY; -+ int stat = data[i]; -+ int flag = TTY_NORMAL; -+ -+ if (stat & RXERROR_OVERRUN) { -+ tty_insert_flip_char( -+ tty, 0, -+ TTY_OVERRUN); -+ } -+ - /* XXX should handle break (0x10) */ -+ if (stat & RXERROR_PARITY) -+ flag = TTY_PARITY; -+ else if (stat & RXERROR_FRAMING) -+ flag = TTY_FRAME; -+ - tty_insert_flip_char(tty, data[i+1], - flag); - } diff --git a/patches/usb-quirks-add-reset-resume-quirk-for-ms-wireless-laser-mouse-6000.patch b/patches/usb-quirks-add-reset-resume-quirk-for-ms-wireless-laser-mouse-6000.patch deleted file mode 100644 index 5d7175e..0000000 --- a/patches/usb-quirks-add-reset-resume-quirk-for-ms-wireless-laser-mouse-6000.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 263e80b43559a6103e178a9176938ce171b23872 Mon Sep 17 00:00:00 2001 -From: Hans de Goede <hdegoede@redhat.com> -Date: Mon, 24 Nov 2014 11:22:38 +0100 -Subject: usb-quirks: Add reset-resume quirk for MS Wireless Laser Mouse 6000 - -commit 263e80b43559a6103e178a9176938ce171b23872 upstream. - -This wireless mouse receiver needs a reset-resume quirk to properly come -out of reset. - -BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1165206 -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/core/quirks.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -43,6 +43,9 @@ static const struct usb_device_id usb_qu - /* Creative SB Audigy 2 NX */ - { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* Microsoft Wireless Laser Mouse 6000 Receiver */ -+ { USB_DEVICE(0x045e, 0x00e1), .driver_info = USB_QUIRK_RESET_RESUME }, -+ - /* Microsoft LifeCam-VX700 v2.0 */ - { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME }, - diff --git a/patches/usb-renesas_usbhs-gadget-fix-null-pointer-dereference-in-ep_disable.patch b/patches/usb-renesas_usbhs-gadget-fix-null-pointer-dereference-in-ep_disable.patch deleted file mode 100644 index e2ebdcd..0000000 --- a/patches/usb-renesas_usbhs-gadget-fix-null-pointer-dereference-in-ep_disable.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 11432050f070810ba139d0226344eef120c3a559 Mon Sep 17 00:00:00 2001 -From: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com> -Date: Tue, 4 Nov 2014 10:05:42 +0900 -Subject: usb: renesas_usbhs: gadget: fix NULL pointer dereference in - ep_disable() - -commit 11432050f070810ba139d0226344eef120c3a559 upstream. - -This patch fixes an issue that the NULL pointer dereference happens -when we uses g_audio driver. Since the g_audio driver will call -usb_ep_disable() in afunc_set_alt() before it calls usb_ep_enable(), -the uep->pipe of renesas usbhs driver will be NULL. So, this patch -adds a condition to avoid the oops. - -Signed-off-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com> -Signed-off-by: Takeshi Kihara <takeshi.kihara.df@renesas.com> -Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> -Fixes: 2f98382dc (usb: renesas_usbhs: Add Renesas USBHS Gadget) -Signed-off-by: Felipe Balbi <balbi@ti.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/renesas_usbhs/mod_gadget.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/usb/renesas_usbhs/mod_gadget.c -+++ b/drivers/usb/renesas_usbhs/mod_gadget.c -@@ -672,6 +672,9 @@ static int __usbhsg_ep_set_halt_wedge(st - struct device *dev = usbhsg_gpriv_to_dev(gpriv); - unsigned long flags; - -+ if (!pipe) -+ return -EINVAL; -+ - usbhsg_pipe_disable(uep); - - dev_dbg(dev, "set halt %d (pipe %d)\n", diff --git a/patches/usb-serial-cp210x-add-ids-for-cel-meshconnect-usb-stick.patch b/patches/usb-serial-cp210x-add-ids-for-cel-meshconnect-usb-stick.patch deleted file mode 100644 index 6ffda61..0000000 --- a/patches/usb-serial-cp210x-add-ids-for-cel-meshconnect-usb-stick.patch +++ /dev/null @@ -1,24 +0,0 @@ -From ffcfe30ebd8dd703d0fc4324ffe56ea21f5479f4 Mon Sep 17 00:00:00 2001 -From: Preston Fick <pffick@gmail.com> -Date: Fri, 7 Nov 2014 23:26:11 -0600 -Subject: USB: serial: cp210x: add IDs for CEL MeshConnect USB Stick - -commit ffcfe30ebd8dd703d0fc4324ffe56ea21f5479f4 upstream. - -Signed-off-by: Preston Fick <pffick@gmail.com> -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/cp210x.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -126,6 +126,7 @@ static const struct usb_device_id id_tab - { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ - { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ - { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ -+ { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */ - { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ diff --git a/patches/usb-serial-ftdi_sio-add-pids-for-matrix-orbital-products.patch b/patches/usb-serial-ftdi_sio-add-pids-for-matrix-orbital-products.patch deleted file mode 100644 index 4313175..0000000 --- a/patches/usb-serial-ftdi_sio-add-pids-for-matrix-orbital-products.patch +++ /dev/null @@ -1,115 +0,0 @@ -From 204ec6e07ea7aff863df0f7c53301f9cbbfbb9d3 Mon Sep 17 00:00:00 2001 -From: Troy Clark <tclark@matrixorbital.ca> -Date: Mon, 17 Nov 2014 14:33:17 -0800 -Subject: usb: serial: ftdi_sio: add PIDs for Matrix Orbital products - -commit 204ec6e07ea7aff863df0f7c53301f9cbbfbb9d3 upstream. - -Add PIDs for new Matrix Orbital GTT series products. - -Signed-off-by: Troy Clark <tclark@matrixorbital.ca> -[johan: shorten commit message ] -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/ftdi_sio.c | 33 ++++++++++++++++++++++++++++++++ - drivers/usb/serial/ftdi_sio_ids.h | 39 ++++++++++++++++++++++++++++++++++---- - 2 files changed, 68 insertions(+), 4 deletions(-) - ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -494,6 +494,39 @@ static struct usb_device_id id_table_com - { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FD_PID) }, - { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FE_PID) }, - { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FF_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_4701_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9300_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9301_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9302_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9303_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9304_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9305_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9306_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9307_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9308_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9309_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930A_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930B_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930C_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930D_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930E_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930F_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9310_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9311_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9312_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9313_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9314_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9315_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9316_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9317_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9318_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9319_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931A_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931B_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931C_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931D_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931E_PID) }, -+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931F_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_PERLE_ULTRAPORT_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_PIEGROUP_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_TNC_X_PID) }, ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -920,8 +920,8 @@ - #define BAYER_CONTOUR_CABLE_PID 0x6001 - - /* -- * The following are the values for the Matrix Orbital FTDI Range -- * Anything in this range will use an FT232RL. -+ * Matrix Orbital Intelligent USB displays. -+ * http://www.matrixorbital.com - */ - #define MTXORB_VID 0x1B3D - #define MTXORB_FTDI_RANGE_0100_PID 0x0100 -@@ -1180,8 +1180,39 @@ - #define MTXORB_FTDI_RANGE_01FD_PID 0x01FD - #define MTXORB_FTDI_RANGE_01FE_PID 0x01FE - #define MTXORB_FTDI_RANGE_01FF_PID 0x01FF -- -- -+#define MTXORB_FTDI_RANGE_4701_PID 0x4701 -+#define MTXORB_FTDI_RANGE_9300_PID 0x9300 -+#define MTXORB_FTDI_RANGE_9301_PID 0x9301 -+#define MTXORB_FTDI_RANGE_9302_PID 0x9302 -+#define MTXORB_FTDI_RANGE_9303_PID 0x9303 -+#define MTXORB_FTDI_RANGE_9304_PID 0x9304 -+#define MTXORB_FTDI_RANGE_9305_PID 0x9305 -+#define MTXORB_FTDI_RANGE_9306_PID 0x9306 -+#define MTXORB_FTDI_RANGE_9307_PID 0x9307 -+#define MTXORB_FTDI_RANGE_9308_PID 0x9308 -+#define MTXORB_FTDI_RANGE_9309_PID 0x9309 -+#define MTXORB_FTDI_RANGE_930A_PID 0x930A -+#define MTXORB_FTDI_RANGE_930B_PID 0x930B -+#define MTXORB_FTDI_RANGE_930C_PID 0x930C -+#define MTXORB_FTDI_RANGE_930D_PID 0x930D -+#define MTXORB_FTDI_RANGE_930E_PID 0x930E -+#define MTXORB_FTDI_RANGE_930F_PID 0x930F -+#define MTXORB_FTDI_RANGE_9310_PID 0x9310 -+#define MTXORB_FTDI_RANGE_9311_PID 0x9311 -+#define MTXORB_FTDI_RANGE_9312_PID 0x9312 -+#define MTXORB_FTDI_RANGE_9313_PID 0x9313 -+#define MTXORB_FTDI_RANGE_9314_PID 0x9314 -+#define MTXORB_FTDI_RANGE_9315_PID 0x9315 -+#define MTXORB_FTDI_RANGE_9316_PID 0x9316 -+#define MTXORB_FTDI_RANGE_9317_PID 0x9317 -+#define MTXORB_FTDI_RANGE_9318_PID 0x9318 -+#define MTXORB_FTDI_RANGE_9319_PID 0x9319 -+#define MTXORB_FTDI_RANGE_931A_PID 0x931A -+#define MTXORB_FTDI_RANGE_931B_PID 0x931B -+#define MTXORB_FTDI_RANGE_931C_PID 0x931C -+#define MTXORB_FTDI_RANGE_931D_PID 0x931D -+#define MTXORB_FTDI_RANGE_931E_PID 0x931E -+#define MTXORB_FTDI_RANGE_931F_PID 0x931F - - /* - * The Mobility Lab (TML) diff --git a/patches/usb-ssu100-fix-overrun-error-reporting.patch b/patches/usb-ssu100-fix-overrun-error-reporting.patch deleted file mode 100644 index 103b116..0000000 --- a/patches/usb-ssu100-fix-overrun-error-reporting.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 75bcbf29c284dd0154c3e895a0bd1ef0e796160e Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Tue, 18 Nov 2014 11:25:21 +0100 -Subject: USB: ssu100: fix overrun-error reporting - -commit 75bcbf29c284dd0154c3e895a0bd1ef0e796160e upstream. - -Fix reporting of overrun errors, which should only be reported once -using the inserted null character. - -Fixes: 6b8f1ca5581b ("USB: ssu100: set tty_flags in ssu100_process_packet") -Signed-off-by: Johan Hovold <johan@kernel.org> -[lizf: Backported to 3.4: - - adjust context - - lookup tty using tty_port_tty_get()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/ssu100.c | 11 ++++------- - 1 file changed, 4 insertions(+), 7 deletions(-) - ---- a/drivers/usb/serial/ssu100.c -+++ b/drivers/usb/serial/ssu100.c -@@ -598,10 +598,10 @@ static void ssu100_update_lsr(struct usb - if (*tty_flag == TTY_NORMAL) - *tty_flag = TTY_FRAME; - } -- if (lsr & UART_LSR_OE){ -+ if (lsr & UART_LSR_OE) { - priv->icount.overrun++; -- if (*tty_flag == TTY_NORMAL) -- *tty_flag = TTY_OVERRUN; -+ tty_insert_flip_char(tty_port_tty_get(&port->port), -+ 0, TTY_OVERRUN); - } - } - -@@ -622,11 +622,8 @@ static int ssu100_process_packet(struct - if ((len >= 4) && - (packet[0] == 0x1b) && (packet[1] == 0x1b) && - ((packet[2] == 0x00) || (packet[2] == 0x01))) { -- if (packet[2] == 0x00) { -+ if (packet[2] == 0x00) - ssu100_update_lsr(port, packet[3], &flag); -- if (flag == TTY_OVERRUN) -- tty_insert_flip_char(tty, 0, TTY_OVERRUN); -- } - if (packet[2] == 0x01) - ssu100_update_msr(port, packet[3]); - diff --git a/patches/usb-storage-scsi-add-broken_fua-blacklist-flag.patch b/patches/usb-storage-scsi-add-broken_fua-blacklist-flag.patch deleted file mode 100644 index 756ab75..0000000 --- a/patches/usb-storage-scsi-add-broken_fua-blacklist-flag.patch +++ /dev/null @@ -1,95 +0,0 @@ -From b14bf2d0c0358140041d1c1805a674376964d0e0 Mon Sep 17 00:00:00 2001 -From: Alan Stern <stern@rowland.harvard.edu> -Date: Mon, 30 Jun 2014 11:04:21 -0400 -Subject: usb-storage/SCSI: Add broken_fua blacklist flag -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit b14bf2d0c0358140041d1c1805a674376964d0e0 upstream. - -Some buggy JMicron USB-ATA bridges don't know how to translate the FUA -bit in READs or WRITEs. This patch adds an entry in unusual_devs.h -and a blacklist flag to tell the sd driver not to use FUA. - -Signed-off-by: Alan Stern <stern@rowland.harvard.edu> -Reported-by: Michael Büsch <m@bues.ch> -Tested-by: Michael Büsch <m@bues.ch> -Acked-by: James Bottomley <James.Bottomley@HansenPartnership.com> -CC: Matthew Dharm <mdharm-usb@one-eyed-alien.net> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/sd.c | 5 ++++- - drivers/usb/storage/scsiglue.c | 4 ++++ - drivers/usb/storage/unusual_devs.h | 7 +++++++ - include/linux/usb_usual.h | 4 +++- - include/scsi/scsi_device.h | 1 + - 5 files changed, 19 insertions(+), 2 deletions(-) - ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -2238,7 +2238,10 @@ sd_read_cache_type(struct scsi_disk *sdk - } - - sdkp->DPOFUA = (data.device_specific & 0x10) != 0; -- if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) { -+ if (sdp->broken_fua) { -+ sd_printk(KERN_NOTICE, sdkp, "Disabling FUA\n"); -+ sdkp->DPOFUA = 0; -+ } else if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) { - sd_printk(KERN_NOTICE, sdkp, - "Uses READ/WRITE(6), disabling FUA\n"); - sdkp->DPOFUA = 0; ---- a/drivers/usb/storage/scsiglue.c -+++ b/drivers/usb/storage/scsiglue.c -@@ -242,6 +242,10 @@ static int slave_configure(struct scsi_d - US_FL_SCM_MULT_TARG)) && - us->protocol == USB_PR_BULK) - us->use_last_sector_hacks = 1; -+ -+ /* A few buggy USB-ATA bridges don't understand FUA */ -+ if (us->fflags & US_FL_BROKEN_FUA) -+ sdev->broken_fua = 1; - } else { - - /* Non-disk-type devices don't need to blacklist any pages ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -1940,6 +1940,13 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_IGNORE_RESIDUE ), - -+/* Reported by Michael Büsch <m@bues.ch> */ -+UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0114, -+ "JMicron", -+ "USB to ATA/ATAPI Bridge", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_BROKEN_FUA ), -+ - /* Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br> - * JMicron responds to USN and several other SCSI ioctls with a - * residue that causes subsequent I/O requests to fail. */ ---- a/include/linux/usb_usual.h -+++ b/include/linux/usb_usual.h -@@ -64,7 +64,9 @@ - US_FLAG(NO_READ_CAPACITY_16, 0x00080000) \ - /* cannot handle READ_CAPACITY_16 */ \ - US_FLAG(INITIAL_READ10, 0x00100000) \ -- /* Initial READ(10) (and others) must be retried */ -+ /* Initial READ(10) (and others) must be retried */ \ -+ US_FLAG(BROKEN_FUA, 0x01000000) \ -+ /* Cannot handle FUA in WRITE or READ CDBs */ \ - - #define US_FLAG(name, value) US_FL_##name = value , - enum { US_DO_ALL_FLAGS }; ---- a/include/scsi/scsi_device.h -+++ b/include/scsi/scsi_device.h -@@ -153,6 +153,7 @@ struct scsi_device { - unsigned no_read_capacity_16:1; /* Avoid READ_CAPACITY_16 cmds */ - unsigned try_rc_10_first:1; /* Try READ_CAPACACITY_10 first */ - unsigned is_visible:1; /* is the device visible in sysfs */ -+ unsigned broken_fua:1; /* Don't set FUA bit */ - - DECLARE_BITMAP(supported_events, SDEV_EVT_MAXBITS); /* supported events */ - struct list_head event_list; /* asserted events */ diff --git a/patches/usb-storage-scsi-blacklist-fua-on-jmicron-152d-2566-usb-sata-controller.patch b/patches/usb-storage-scsi-blacklist-fua-on-jmicron-152d-2566-usb-sata-controller.patch deleted file mode 100644 index c4e4121..0000000 --- a/patches/usb-storage-scsi-blacklist-fua-on-jmicron-152d-2566-usb-sata-controller.patch +++ /dev/null @@ -1,51 +0,0 @@ -From bf5c4136fa5ce471bdbf4cf59a813e32755fd014 Mon Sep 17 00:00:00 2001 -From: Dmitry Nezhevenko <dion@dion.org.ua> -Date: Mon, 12 Jan 2015 19:13:01 +0200 -Subject: usb-storage/SCSI: blacklist FUA on JMicron 152d:2566 USB-SATA - controller - -commit bf5c4136fa5ce471bdbf4cf59a813e32755fd014 upstream. - -It looks like FUA support is broken on JMicron 152d:2566 bridge: - -[223159.885704] sd 7:0:0:0: [sdc] Write Protect is off -[223159.885706] sd 7:0:0:0: [sdc] Mode Sense: 47 00 10 08 -[223159.885942] sd 7:0:0:0: [sdc] Write cache: enabled, read cache: enabled, supports DPO and FUA - -[223283.691677] sd 7:0:0:0: [sdc] -[223283.691680] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE -[223283.691681] sd 7:0:0:0: [sdc] -[223283.691682] Sense Key : Illegal Request [current] -[223283.691684] sd 7:0:0:0: [sdc] -[223283.691685] Add. Sense: Invalid field in cdb -[223283.691686] sd 7:0:0:0: [sdc] CDB: -[223283.691687] Write(10): 2a 08 15 d0 83 0d 00 00 01 00 -[223283.691690] blk_update_request: critical target error, dev sdc, sector 2927892584 - -This patch adds blacklist flag so that sd will not use FUA - -Signed-off-by: Dmitry Nezhevenko <dion@dion.org.ua> -Cc: Phil Dibowitz <phil@ipom.com> -Cc: Alan Stern <stern@rowland.harvard.edu> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/storage/unusual_devs.h | 7 +++++++ - 1 file changed, 7 insertions(+) - ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -1956,6 +1956,13 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ), - -+/* Reported by Dmitry Nezhevenko <dion@dion.org.ua> */ -+UNUSUAL_DEV( 0x152d, 0x2566, 0x0114, 0x0114, -+ "JMicron", -+ "USB to ATA/ATAPI Bridge", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_BROKEN_FUA ), -+ - /* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI) - * and Mac USB Dock USB-SCSI */ - UNUSUAL_DEV( 0x1645, 0x0007, 0x0100, 0x0133, diff --git a/patches/usb-xhci-don-t-start-a-halted-endpoint-before-its-new-dequeue-is-set.patch b/patches/usb-xhci-don-t-start-a-halted-endpoint-before-its-new-dequeue-is-set.patch deleted file mode 100644 index 6e0c8c7..0000000 --- a/patches/usb-xhci-don-t-start-a-halted-endpoint-before-its-new-dequeue-is-set.patch +++ /dev/null @@ -1,43 +0,0 @@ -From c3492dbfa1050debf23a5b5cd2bc7514c5b37896 Mon Sep 17 00:00:00 2001 -From: Mathias Nyman <mathias.nyman@linux.intel.com> -Date: Tue, 18 Nov 2014 11:27:11 +0200 -Subject: USB: xhci: don't start a halted endpoint before its new dequeue is - set - -commit c3492dbfa1050debf23a5b5cd2bc7514c5b37896 upstream. - -A halted endpoint ring must first be reset, then move the ring -dequeue pointer past the problematic TRB. If we start the ring too -early after reset, but before moving the dequeue pointer we -will end up executing the same problematic TRB again. - -As we always issue a set transfer dequeue command after a reset -endpoint command we can skip starting endpoint rings at reset endpoint -command completion. - -Without this fix we end up trying to handle the same faulty TD for -contol endpoints. causing timeout, and failing testusb ctrl_out write -tests. - -Fixes: e9df17e (USB: xhci: Correct assumptions about number of rings per endpoint.) -Tested-by: Felipe Balbi <balbi@ti.com> -Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/host/xhci-ring.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -1178,9 +1178,8 @@ static void handle_reset_ep_completion(s - false); - xhci_ring_cmd_db(xhci); - } else { -- /* Clear our internal halted state and restart the ring(s) */ -+ /* Clear our internal halted state */ - xhci->devs[slot_id]->eps[ep_index].ep_state &= ~EP_HALTED; -- ring_doorbell_for_active_rings(xhci, slot_id, ep_index); - } - } - diff --git a/patches/usb-xhci-reset-a-halted-endpoint-immediately-when-we-encounter-a-stall.patch b/patches/usb-xhci-reset-a-halted-endpoint-immediately-when-we-encounter-a-stall.patch deleted file mode 100644 index 50bc9ea..0000000 --- a/patches/usb-xhci-reset-a-halted-endpoint-immediately-when-we-encounter-a-stall.patch +++ /dev/null @@ -1,174 +0,0 @@ -From 8e71a322fdb127814bcba423a512914ca5bc6cf5 Mon Sep 17 00:00:00 2001 -From: Mathias Nyman <mathias.nyman@linux.intel.com> -Date: Tue, 18 Nov 2014 11:27:12 +0200 -Subject: USB: xhci: Reset a halted endpoint immediately when we encounter a - stall. - -commit 8e71a322fdb127814bcba423a512914ca5bc6cf5 upstream. - -If a device is halted and reuturns a STALL, then the halted endpoint -needs to be cleared both on the host and device side. The host -side halt is cleared by issueing a xhci reset endpoint command. The device side -is cleared with a ClearFeature(ENDPOINT_HALT) request, which should -be issued by the device driver if a URB reruen -EPIPE. - -Previously we cleared the host side halt after the device side was cleared. -To make sure the host side halt is cleared in time we want to issue the -reset endpoint command immedialtely when a STALL status is encountered. - -Otherwise we end up not following the specs and not returning -EPIPE -several times in a row when trying to transfer data to a halted endpoint. - -Fixes: bcef3fd (USB: xhci: Handle errors that cause endpoint halts.) -Tested-by: Felipe Balbi <balbi@ti.com> -Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/host/xhci-ring.c | 40 ++++++---------------------- - drivers/usb/host/xhci.c | 60 ++++++++++--------------------------------- - 2 files changed, 24 insertions(+), 76 deletions(-) - ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -1915,23 +1915,12 @@ static int finish_td(struct xhci_hcd *xh - ep->stopped_trb = event_trb; - return 0; - } else { -- if (trb_comp_code == COMP_STALL) { -- /* The transfer is completed from the driver's -- * perspective, but we need to issue a set dequeue -- * command for this stalled endpoint to move the dequeue -- * pointer past the TD. We can't do that here because -- * the halt condition must be cleared first. Let the -- * USB class driver clear the stall later. -- */ -- ep->stopped_td = td; -- ep->stopped_trb = event_trb; -- ep->stopped_stream = ep_ring->stream_id; -- } else if (xhci_requires_manual_halt_cleanup(xhci, -- ep_ctx, trb_comp_code)) { -- /* Other types of errors halt the endpoint, but the -- * class driver doesn't call usb_reset_endpoint() unless -- * the error is -EPIPE. Clear the halted status in the -- * xHCI hardware manually. -+ if (trb_comp_code == COMP_STALL || -+ xhci_requires_manual_halt_cleanup(xhci, ep_ctx, -+ trb_comp_code)) { -+ /* Issue a reset endpoint command to clear the host side * halt, followed by a set dequeue command to move the -+ * dequeue pointer past the TD. -+ * The class driver clears the device side halt later. - */ - xhci_cleanup_halted_endpoint(xhci, - slot_id, ep_index, ep_ring->stream_id, -@@ -2051,9 +2040,7 @@ static int process_ctrl_td(struct xhci_h - else - td->urb->actual_length = 0; - -- xhci_cleanup_halted_endpoint(xhci, -- slot_id, ep_index, 0, td, event_trb); -- return finish_td(xhci, td, event_trb, event, ep, status, true); -+ return finish_td(xhci, td, event_trb, event, ep, status, false); - } - /* - * Did we transfer any data, despite the errors that might have -@@ -2605,17 +2592,8 @@ cleanup: - if (ret) { - urb = td->urb; - urb_priv = urb->hcpriv; -- /* Leave the TD around for the reset endpoint function -- * to use(but only if it's not a control endpoint, -- * since we already queued the Set TR dequeue pointer -- * command for stalled control endpoints). -- */ -- if (usb_endpoint_xfer_control(&urb->ep->desc) || -- (trb_comp_code != COMP_STALL && -- trb_comp_code != COMP_BABBLE)) -- xhci_urb_free_priv(xhci, urb_priv); -- else -- kfree(urb_priv); -+ -+ xhci_urb_free_priv(xhci, urb_priv); - - usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb->dev->bus), urb); - if ((urb->actual_length != urb->transfer_buffer_length && ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -2851,61 +2851,31 @@ void xhci_cleanup_stalled_ring(struct xh - } - } - --/* Deal with stalled endpoints. The core should have sent the control message -- * to clear the halt condition. However, we need to make the xHCI hardware -- * reset its sequence number, since a device will expect a sequence number of -- * zero after the halt condition is cleared. -+/* Called when clearing halted device. The core should have sent the control -+ * message to clear the device halt condition. The host side of the halt should -+ * already be cleared with a reset endpoint command issued when the STALL tx -+ * event was received. -+ * - * Context: in_interrupt - */ -+ - void xhci_endpoint_reset(struct usb_hcd *hcd, - struct usb_host_endpoint *ep) - { - struct xhci_hcd *xhci; -- struct usb_device *udev; -- unsigned int ep_index; -- unsigned long flags; -- int ret; -- struct xhci_virt_ep *virt_ep; - - xhci = hcd_to_xhci(hcd); -- udev = (struct usb_device *) ep->hcpriv; -- /* Called with a root hub endpoint (or an endpoint that wasn't added -- * with xhci_add_endpoint() -- */ -- if (!ep->hcpriv) -- return; -- ep_index = xhci_get_endpoint_index(&ep->desc); -- virt_ep = &xhci->devs[udev->slot_id]->eps[ep_index]; -- if (!virt_ep->stopped_td) { -- xhci_dbg(xhci, "Endpoint 0x%x not halted, refusing to reset.\n", -- ep->desc.bEndpointAddress); -- return; -- } -- if (usb_endpoint_xfer_control(&ep->desc)) { -- xhci_dbg(xhci, "Control endpoint stall already handled.\n"); -- return; -- } -- -- xhci_dbg(xhci, "Queueing reset endpoint command\n"); -- spin_lock_irqsave(&xhci->lock, flags); -- ret = xhci_queue_reset_ep(xhci, udev->slot_id, ep_index); - /* -- * Can't change the ring dequeue pointer until it's transitioned to the -- * stopped state, which is only upon a successful reset endpoint -- * command. Better hope that last command worked! -+ * We might need to implement the config ep cmd in xhci 4.8.1 note: -+ * The Reset Endpoint Command may only be issued to endpoints in the -+ * Halted state. If software wishes reset the Data Toggle or Sequence -+ * Number of an endpoint that isn't in the Halted state, then software -+ * may issue a Configure Endpoint Command with the Drop and Add bits set -+ * for the target endpoint. that is in the Stopped state. - */ -- if (!ret) { -- xhci_cleanup_stalled_ring(xhci, udev, ep_index); -- kfree(virt_ep->stopped_td); -- xhci_ring_cmd_db(xhci); -- } -- virt_ep->stopped_td = NULL; -- virt_ep->stopped_trb = NULL; -- virt_ep->stopped_stream = 0; -- spin_unlock_irqrestore(&xhci->lock, flags); -- -- if (ret) -- xhci_warn(xhci, "FIXME allocate a new ring segment\n"); -+ /* For now just print debug to follow the situation */ -+ xhci_dbg(xhci, "Endpoint 0x%x ep reset callback called\n", -+ ep->desc.bEndpointAddress); - } - - static int xhci_check_streams_endpoint(struct xhci_hcd *xhci, diff --git a/patches/usb-xhci-rework-root-port-wake-bits-if-controller-isn-t-allowed-to-wakeup.patch b/patches/usb-xhci-rework-root-port-wake-bits-if-controller-isn-t-allowed-to-wakeup.patch deleted file mode 100644 index b7ddec9..0000000 --- a/patches/usb-xhci-rework-root-port-wake-bits-if-controller-isn-t-allowed-to-wakeup.patch +++ /dev/null @@ -1,124 +0,0 @@ -From a1377e5397ab321e21b793ec8cd2b6f12bd3c718 Mon Sep 17 00:00:00 2001 -From: Lu Baolu <baolu.lu@linux.intel.com> -Date: Tue, 18 Nov 2014 11:27:14 +0200 -Subject: usb: xhci: rework root port wake bits if controller isn't allowed to - wakeup - -commit a1377e5397ab321e21b793ec8cd2b6f12bd3c718 upstream. - -When system is being suspended, if host device is not allowed to do wakeup, -xhci_suspend() needs to clear all root port wake on bits. Otherwise, some -platforms may generate spurious wakeup, even if PCI PME# is disabled. - -The initial commit ff8cbf250b44 ("xhci: clear root port wake on bits"), -which also got into stable, turned out to not work correctly and had to -be reverted, and is now rewritten. - -Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> -Suggested-by: Alan Stern <stern@rowland.harvard.edu> -Acked-by: Alan Stern <stern@rowland.harvard.edu> -[Mathias Nyman: reword commit message] -Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -[lizf: Backported to 3.4: - - adjust context - - drop changes to xhci_plat_suspend()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/host/xhci-pci.c | 2 +- - drivers/usb/host/xhci.c | 42 +++++++++++++++++++++++++++++++++++++++++- - drivers/usb/host/xhci.h | 2 +- - 3 files changed, 43 insertions(+), 3 deletions(-) - ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -238,7 +238,7 @@ static int xhci_pci_suspend(struct usb_h - xhci->shared_hcd->state != HC_STATE_SUSPENDED) - return -EINVAL; - -- retval = xhci_suspend(xhci); -+ retval = xhci_suspend(xhci, do_wakeup); - - return retval; - } ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -33,6 +33,8 @@ - #define DRIVER_AUTHOR "Sarah Sharp" - #define DRIVER_DESC "'eXtensible' Host Controller (xHC) Driver" - -+#define PORT_WAKE_BITS (PORT_WKOC_E | PORT_WKDISC_E | PORT_WKCONN_E) -+ - /* Some 0.95 hardware can't handle the chain bit on a Link TRB being cleared */ - static int link_quirk; - module_param(link_quirk, int, S_IRUGO | S_IWUSR); -@@ -884,19 +886,57 @@ static void xhci_clear_command_ring(stru - xhci_set_cmd_ring_deq(xhci); - } - -+static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci) -+{ -+ int port_index; -+ __le32 __iomem **port_array; -+ unsigned long flags; -+ u32 t1, t2; -+ -+ spin_lock_irqsave(&xhci->lock, flags); -+ -+ /* disble usb3 ports Wake bits*/ -+ port_index = xhci->num_usb3_ports; -+ port_array = xhci->usb3_ports; -+ while (port_index--) { -+ t1 = readl(port_array[port_index]); -+ t1 = xhci_port_state_to_neutral(t1); -+ t2 = t1 & ~PORT_WAKE_BITS; -+ if (t1 != t2) -+ writel(t2, port_array[port_index]); -+ } -+ -+ /* disble usb2 ports Wake bits*/ -+ port_index = xhci->num_usb2_ports; -+ port_array = xhci->usb2_ports; -+ while (port_index--) { -+ t1 = readl(port_array[port_index]); -+ t1 = xhci_port_state_to_neutral(t1); -+ t2 = t1 & ~PORT_WAKE_BITS; -+ if (t1 != t2) -+ writel(t2, port_array[port_index]); -+ } -+ -+ spin_unlock_irqrestore(&xhci->lock, flags); -+} -+ - /* - * Stop HC (not bus-specific) - * - * This is called when the machine transition into S3/S4 mode. - * - */ --int xhci_suspend(struct xhci_hcd *xhci) -+int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup) - { - int rc = 0; - unsigned int delay = XHCI_MAX_HALT_USEC; - struct usb_hcd *hcd = xhci_to_hcd(xhci); - u32 command; - -+ /* Clear root port wake on bits if wakeup not allowed. */ -+ if (!do_wakeup) -+ xhci_disable_port_wake_on_bits(xhci); -+ - /* Don't poll the roothubs on bus suspend. */ - xhci_dbg(xhci, "%s: stopping port polling.\n", __func__); - clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1729,7 +1729,7 @@ void xhci_shutdown(struct usb_hcd *hcd); - int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); - - #ifdef CONFIG_PM --int xhci_suspend(struct xhci_hcd *xhci); -+int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup); - int xhci_resume(struct xhci_hcd *xhci, bool hibernated); - #else - #define xhci_suspend NULL diff --git a/patches/video-logo-prevent-use-of-logos-after-they-have-been-freed.patch b/patches/video-logo-prevent-use-of-logos-after-they-have-been-freed.patch deleted file mode 100644 index 4b3b2d9..0000000 --- a/patches/video-logo-prevent-use-of-logos-after-they-have-been-freed.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 92b004d1aa9f367c372511ca0330f58216b25703 Mon Sep 17 00:00:00 2001 -From: Tomi Valkeinen <tomi.valkeinen@ti.com> -Date: Thu, 18 Dec 2014 13:40:06 +0200 -Subject: video/logo: prevent use of logos after they have been freed - -commit 92b004d1aa9f367c372511ca0330f58216b25703 upstream. - -If the probe of an fb driver has been deferred due to missing -dependencies, and the probe is later ran when a module is loaded, the -fbdev framework will try to find a logo to use. - -However, the logos are __initdata, and have already been freed. This -causes sometimes page faults, if the logo memory is not mapped, -sometimes other random crashes as the logo data is invalid, and -sometimes nothing, if the fbdev decides to reject the logo (e.g. the -random value depicting the logo's height is too big). - -This patch adds a late_initcall function to mark the logos as freed. In -reality the logos are freed later, and fbdev probe may be ran between -this late_initcall and the freeing of the logos. In that case we will -miss drawing the logo, even if it would be possible. - -Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/video/logo/logo.c | 17 ++++++++++++++++- - 1 file changed, 16 insertions(+), 1 deletion(-) - ---- a/drivers/video/logo/logo.c -+++ b/drivers/video/logo/logo.c -@@ -25,6 +25,21 @@ static bool nologo; - module_param(nologo, bool, 0); - MODULE_PARM_DESC(nologo, "Disables startup logo"); - -+/* -+ * Logos are located in the initdata, and will be freed in kernel_init. -+ * Use late_init to mark the logos as freed to prevent any further use. -+ */ -+ -+static bool logos_freed; -+ -+static int __init fb_logo_late_init(void) -+{ -+ logos_freed = true; -+ return 0; -+} -+ -+late_initcall(fb_logo_late_init); -+ - /* logo's are marked __initdata. Use __init_refok to tell - * modpost that it is intended that this function uses data - * marked __initdata. -@@ -33,7 +48,7 @@ const struct linux_logo * __init_refok f - { - const struct linux_logo *logo = NULL; - -- if (nologo) -+ if (nologo || logos_freed) - return NULL; - - if (depth >= 1) { diff --git a/patches/virtio-use-dev_to_virtio-wrapper-in-virtio.patch b/patches/virtio-use-dev_to_virtio-wrapper-in-virtio.patch deleted file mode 100644 index e83f2ea..0000000 --- a/patches/virtio-use-dev_to_virtio-wrapper-in-virtio.patch +++ /dev/null @@ -1,111 +0,0 @@ -From 9bffdca8c64a72ac54c47a552734ab457bc720d4 Mon Sep 17 00:00:00 2001 -From: Wanlong Gao <gaowanlong@cn.fujitsu.com> -Date: Tue, 11 Dec 2012 11:04:50 +1030 -Subject: virtio: use dev_to_virtio wrapper in virtio - -commit 9bffdca8c64a72ac54c47a552734ab457bc720d4 upstream. - -Use dev_to_virtio wrapper in virtio to make code clearly. - -Cc: Rusty Russell <rusty@rustcorp.com.au> -Cc: "Michael S. Tsirkin" <mst@redhat.com> -Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> -Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/virtio/virtio.c | 19 +++++++++---------- - include/linux/virtio.h | 6 +++++- - 2 files changed, 14 insertions(+), 11 deletions(-) - ---- a/drivers/virtio/virtio.c -+++ b/drivers/virtio/virtio.c -@@ -9,33 +9,32 @@ static unsigned int dev_index; - static ssize_t device_show(struct device *_d, - struct device_attribute *attr, char *buf) - { -- struct virtio_device *dev = container_of(_d,struct virtio_device,dev); -+ struct virtio_device *dev = dev_to_virtio(_d); - return sprintf(buf, "0x%04x\n", dev->id.device); - } - static ssize_t vendor_show(struct device *_d, - struct device_attribute *attr, char *buf) - { -- struct virtio_device *dev = container_of(_d,struct virtio_device,dev); -+ struct virtio_device *dev = dev_to_virtio(_d); - return sprintf(buf, "0x%04x\n", dev->id.vendor); - } - static ssize_t status_show(struct device *_d, - struct device_attribute *attr, char *buf) - { -- struct virtio_device *dev = container_of(_d,struct virtio_device,dev); -+ struct virtio_device *dev = dev_to_virtio(_d); - return sprintf(buf, "0x%08x\n", dev->config->get_status(dev)); - } - static ssize_t modalias_show(struct device *_d, - struct device_attribute *attr, char *buf) - { -- struct virtio_device *dev = container_of(_d,struct virtio_device,dev); -- -+ struct virtio_device *dev = dev_to_virtio(_d); - return sprintf(buf, "virtio:d%08Xv%08X\n", - dev->id.device, dev->id.vendor); - } - static ssize_t features_show(struct device *_d, - struct device_attribute *attr, char *buf) - { -- struct virtio_device *dev = container_of(_d, struct virtio_device, dev); -+ struct virtio_device *dev = dev_to_virtio(_d); - unsigned int i; - ssize_t len = 0; - -@@ -70,7 +69,7 @@ static inline int virtio_id_match(const - static int virtio_dev_match(struct device *_dv, struct device_driver *_dr) - { - unsigned int i; -- struct virtio_device *dev = container_of(_dv,struct virtio_device,dev); -+ struct virtio_device *dev = dev_to_virtio(_dv); - const struct virtio_device_id *ids; - - ids = container_of(_dr, struct virtio_driver, driver)->id_table; -@@ -82,7 +81,7 @@ static int virtio_dev_match(struct devic - - static int virtio_uevent(struct device *_dv, struct kobj_uevent_env *env) - { -- struct virtio_device *dev = container_of(_dv,struct virtio_device,dev); -+ struct virtio_device *dev = dev_to_virtio(_dv); - - return add_uevent_var(env, "MODALIAS=virtio:d%08Xv%08X", - dev->id.device, dev->id.vendor); -@@ -110,7 +109,7 @@ EXPORT_SYMBOL_GPL(virtio_check_driver_of - static int virtio_dev_probe(struct device *_d) - { - int err, i; -- struct virtio_device *dev = container_of(_d,struct virtio_device,dev); -+ struct virtio_device *dev = dev_to_virtio(_d); - struct virtio_driver *drv = container_of(dev->dev.driver, - struct virtio_driver, driver); - u32 device_features; -@@ -148,7 +147,7 @@ static int virtio_dev_probe(struct devic - - static int virtio_dev_remove(struct device *_d) - { -- struct virtio_device *dev = container_of(_d,struct virtio_device,dev); -+ struct virtio_device *dev = dev_to_virtio(_d); - struct virtio_driver *drv = container_of(dev->dev.driver, - struct virtio_driver, driver); - ---- a/include/linux/virtio.h -+++ b/include/linux/virtio.h -@@ -75,7 +75,11 @@ struct virtio_device { - void *priv; - }; - --#define dev_to_virtio(dev) container_of(dev, struct virtio_device, dev) -+static inline struct virtio_device *dev_to_virtio(struct device *_dev) -+{ -+ return container_of(_dev, struct virtio_device, dev); -+} -+ - int register_virtio_device(struct virtio_device *dev); - void unregister_virtio_device(struct virtio_device *dev); - diff --git a/patches/virtio_pci-defer-kfree-until-release-callback.patch b/patches/virtio_pci-defer-kfree-until-release-callback.patch deleted file mode 100644 index 5630aa1..0000000 --- a/patches/virtio_pci-defer-kfree-until-release-callback.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 63bd62a08ca45a0c804c3c89777edc7f76a2d6da Mon Sep 17 00:00:00 2001 -From: Sasha Levin <sasha.levin@oracle.com> -Date: Fri, 2 Jan 2015 14:47:40 -0500 -Subject: virtio_pci: defer kfree until release callback - -commit 63bd62a08ca45a0c804c3c89777edc7f76a2d6da upstream. - -A struct device which has just been unregistered can live on past the -point at which a driver decides to drop it's initial reference to the -kobject gained on allocation. - -This implies that when releasing a virtio device, we can't free a struct -virtio_device until the underlying struct device has been released, -which might not happen immediately on device_unregister(). - -Unfortunately, this is exactly what virtio pci does: -it has an empty release callback, and frees memory immediately -after unregistering the device. - -This causes an easy to reproduce crash if CONFIG_DEBUG_KOBJECT_RELEASE -it enabled. - -To fix, free the memory only once we know the device is gone in the release -callback. - -Signed-off-by: Sasha Levin <sasha.levin@oracle.com> -Signed-off-by: Michael S. Tsirkin <mst@redhat.com> -[lizf: Backported to 3.4: adjust filename] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/virtio/virtio_pci.c | 10 ++++------ - 1 file changed, 4 insertions(+), 6 deletions(-) - ---- a/drivers/virtio/virtio_pci.c -+++ b/drivers/virtio/virtio_pci.c -@@ -624,11 +624,10 @@ static struct virtio_config_ops virtio_p - - static void virtio_pci_release_dev(struct device *_d) - { -- /* -- * No need for a release method as we allocate/free -- * all devices together with the pci devices. -- * Provide an empty one to avoid getting a warning from core. -- */ -+ struct virtio_device *vdev = dev_to_virtio(_d); -+ struct virtio_pci_device *vp_dev = to_vp_device(vdev); -+ -+ kfree(vp_dev); - } - - /* the PCI probing function */ -@@ -716,7 +715,6 @@ static void __devexit virtio_pci_remove( - pci_iounmap(pci_dev, vp_dev->ioaddr); - pci_release_regions(pci_dev); - pci_disable_device(pci_dev); -- kfree(vp_dev); - } - - #ifdef CONFIG_PM diff --git a/patches/virtio_pci-document-why-we-defer-kfree.patch b/patches/virtio_pci-document-why-we-defer-kfree.patch deleted file mode 100644 index ea7825f..0000000 --- a/patches/virtio_pci-document-why-we-defer-kfree.patch +++ /dev/null @@ -1,32 +0,0 @@ -From a1eb03f546d651a8f39c7d0692b1f7f5b4e7e3cd Mon Sep 17 00:00:00 2001 -From: "Michael S. Tsirkin" <mst@redhat.com> -Date: Sun, 4 Jan 2015 17:28:27 +0200 -Subject: virtio_pci: document why we defer kfree - -commit a1eb03f546d651a8f39c7d0692b1f7f5b4e7e3cd upstream. - -The reason we defer kfree until release function is because it's a -general rule for kobjects: kfree of the reference counter itself is only -legal in the release function. - -Previous patch didn't make this clear, document this in code. - -Signed-off-by: Michael S. Tsirkin <mst@redhat.com> -[lizf: Backported to 3.4: adjust filename] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/virtio/virtio_pci.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/virtio/virtio_pci.c -+++ b/drivers/virtio/virtio_pci.c -@@ -627,6 +627,9 @@ static void virtio_pci_release_dev(struc - struct virtio_device *vdev = dev_to_virtio(_d); - struct virtio_pci_device *vp_dev = to_vp_device(vdev); - -+ /* As struct device is a kobject, it's not safe to -+ * free the memory (including the reference counter itself) -+ * until it's release callback. */ - kfree(vp_dev); - } - diff --git a/patches/vm-add-vm_fault_sigsegv-handling-support.patch b/patches/vm-add-vm_fault_sigsegv-handling-support.patch deleted file mode 100644 index 85d0fa8..0000000 --- a/patches/vm-add-vm_fault_sigsegv-handling-support.patch +++ /dev/null @@ -1,414 +0,0 @@ -From 219a047eb9a3cde86b5a341f9f8d4f6cf7e8cd56 Mon Sep 17 00:00:00 2001 -From: Linus Torvalds <torvalds@linux-foundation.org> -Date: Thu, 29 Jan 2015 10:51:32 -0800 -Subject: vm: add VM_FAULT_SIGSEGV handling support - -commit 33692f27597fcab536d7cbbcc8f52905133e4aa7 upstream. - -The core VM already knows about VM_FAULT_SIGBUS, but cannot return a -"you should SIGSEGV" error, because the SIGSEGV case was generally -handled by the caller - usually the architecture fault handler. - -That results in lots of duplication - all the architecture fault -handlers end up doing very similar "look up vma, check permissions, do -retries etc" - but it generally works. However, there are cases where -the VM actually wants to SIGSEGV, and applications _expect_ SIGSEGV. - -In particular, when accessing the stack guard page, libsigsegv expects a -SIGSEGV. And it usually got one, because the stack growth is handled by -that duplicated architecture fault handler. - -However, when the generic VM layer started propagating the error return -from the stack expansion in commit fee7e49d4514 ("mm: propagate error -from stack expansion even for guard page"), that now exposed the -existing VM_FAULT_SIGBUS result to user space. And user space really -expected SIGSEGV, not SIGBUS. - -To fix that case, we need to add a VM_FAULT_SIGSEGV, and teach all those -duplicate architecture fault handlers about it. They all already have -the code to handle SIGSEGV, so it's about just tying that new return -value to the existing code, but it's all a bit annoying. - -This is the mindless minimal patch to do this. A more extensive patch -would be to try to gather up the mostly shared fault handling logic into -one generic helper routine, and long-term we really should do that -cleanup. - -Just from this patch, you can generally see that most architectures just -copied (directly or indirectly) the old x86 way of doing things, but in -the meantime that original x86 model has been improved to hold the VM -semaphore for shorter times etc and to handle VM_FAULT_RETRY and other -"newer" things, so it would be a good idea to bring all those -improvements to the generic case and teach other architectures about -them too. - -Reported-and-tested-by: Takashi Iwai <tiwai@suse.de> -Tested-by: Jan Engelhardt <jengelh@inai.de> -Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com> # "s390 still compiles and boots" -Cc: linux-arch@vger.kernel.org -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -[bwh: Backported to 3.2: - - Adjust filenames, context - - Drop arc, metag, nios2 and lustre changes - - For sh, patch both 32-bit and 64-bit implementations to use goto bad_area - - For s390, pass int_code and trans_exc_code as arguments to do_no_context() - and do_sigsegv()] -Signed-off-by: Ben Hutchings <ben@decadent.org.uk> -[lizf: Backported to 3.4: - - adjust context in arch/power/mm/fault.c - - apply the original change in upstream commit for s390] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/alpha/mm/fault.c | 2 ++ - arch/avr32/mm/fault.c | 2 ++ - arch/cris/mm/fault.c | 2 ++ - arch/frv/mm/fault.c | 2 ++ - arch/ia64/mm/fault.c | 2 ++ - arch/m32r/mm/fault.c | 2 ++ - arch/m68k/mm/fault.c | 2 ++ - arch/microblaze/mm/fault.c | 2 ++ - arch/mips/mm/fault.c | 2 ++ - arch/mn10300/mm/fault.c | 2 ++ - arch/openrisc/mm/fault.c | 2 ++ - arch/parisc/mm/fault.c | 2 ++ - arch/powerpc/mm/fault.c | 6 +++++- - arch/powerpc/platforms/cell/spu_fault.c | 2 +- - arch/s390/mm/fault.c | 6 ++++++ - arch/score/mm/fault.c | 2 ++ - arch/sh/mm/fault_32.c | 2 ++ - arch/sh/mm/tlbflush_64.c | 2 ++ - arch/sparc/mm/fault_32.c | 2 ++ - arch/sparc/mm/fault_64.c | 2 ++ - arch/tile/mm/fault.c | 2 ++ - arch/um/kernel/trap.c | 2 ++ - arch/x86/mm/fault.c | 2 ++ - arch/xtensa/mm/fault.c | 2 ++ - include/linux/mm.h | 5 +++-- - mm/ksm.c | 2 +- - mm/memory.c | 4 ++-- - 27 files changed, 60 insertions(+), 7 deletions(-) - ---- a/arch/alpha/mm/fault.c -+++ b/arch/alpha/mm/fault.c -@@ -149,6 +149,8 @@ do_page_fault(unsigned long address, uns - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); ---- a/arch/avr32/mm/fault.c -+++ b/arch/avr32/mm/fault.c -@@ -136,6 +136,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); ---- a/arch/cris/mm/fault.c -+++ b/arch/cris/mm/fault.c -@@ -167,6 +167,8 @@ do_page_fault(unsigned long address, str - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); ---- a/arch/frv/mm/fault.c -+++ b/arch/frv/mm/fault.c -@@ -166,6 +166,8 @@ asmlinkage void do_page_fault(int datamm - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); ---- a/arch/ia64/mm/fault.c -+++ b/arch/ia64/mm/fault.c -@@ -162,6 +162,8 @@ ia64_do_page_fault (unsigned long addres - */ - if (fault & VM_FAULT_OOM) { - goto out_of_memory; -+ } else if (fault & VM_FAULT_SIGSEGV) { -+ goto bad_area; - } else if (fault & VM_FAULT_SIGBUS) { - signal = SIGBUS; - goto bad_area; ---- a/arch/m32r/mm/fault.c -+++ b/arch/m32r/mm/fault.c -@@ -198,6 +198,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); ---- a/arch/m68k/mm/fault.c -+++ b/arch/m68k/mm/fault.c -@@ -146,6 +146,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto map_err; - else if (fault & VM_FAULT_SIGBUS) - goto bus_err; - BUG(); ---- a/arch/microblaze/mm/fault.c -+++ b/arch/microblaze/mm/fault.c -@@ -214,6 +214,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); ---- a/arch/mips/mm/fault.c -+++ b/arch/mips/mm/fault.c -@@ -155,6 +155,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); ---- a/arch/mn10300/mm/fault.c -+++ b/arch/mn10300/mm/fault.c -@@ -255,6 +255,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); ---- a/arch/openrisc/mm/fault.c -+++ b/arch/openrisc/mm/fault.c -@@ -163,6 +163,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); ---- a/arch/parisc/mm/fault.c -+++ b/arch/parisc/mm/fault.c -@@ -210,6 +210,8 @@ good_area: - */ - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto bad_area; - BUG(); ---- a/arch/powerpc/mm/fault.c -+++ b/arch/powerpc/mm/fault.c -@@ -419,7 +419,11 @@ good_area: - */ - fault = handle_mm_fault(mm, vma, address, flags); - if (unlikely(fault & (VM_FAULT_RETRY|VM_FAULT_ERROR))) { -- int rc = mm_fault_error(regs, address, fault); -+ int rc; -+ -+ if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; -+ rc = mm_fault_error(regs, address, fault); - if (rc >= MM_FAULT_RETURN) - return rc; - } ---- a/arch/powerpc/platforms/cell/spu_fault.c -+++ b/arch/powerpc/platforms/cell/spu_fault.c -@@ -75,7 +75,7 @@ int spu_handle_mm_fault(struct mm_struct - if (*flt & VM_FAULT_OOM) { - ret = -ENOMEM; - goto out_unlock; -- } else if (*flt & VM_FAULT_SIGBUS) { -+ } else if (*flt & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) { - ret = -EFAULT; - goto out_unlock; - } ---- a/arch/s390/mm/fault.c -+++ b/arch/s390/mm/fault.c -@@ -237,6 +237,12 @@ static noinline void do_fault_error(stru - do_no_context(regs); - else - pagefault_out_of_memory(); -+ } else if (fault & VM_FAULT_SIGSEGV) { -+ /* Kernel mode? Handle exceptions or die */ -+ if (!user_mode(regs)) -+ do_no_context(regs); -+ else -+ do_sigsegv(regs, SEGV_MAPERR); - } else if (fault & VM_FAULT_SIGBUS) { - /* Kernel mode? Handle exceptions or die */ - if (!(regs->psw.mask & PSW_MASK_PSTATE)) ---- a/arch/score/mm/fault.c -+++ b/arch/score/mm/fault.c -@@ -110,6 +110,8 @@ survive: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); ---- a/arch/sh/mm/fault_32.c -+++ b/arch/sh/mm/fault_32.c -@@ -206,6 +206,8 @@ good_area: - goto out_of_memory; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - BUG(); - } - if (fault & VM_FAULT_MAJOR) { ---- a/arch/sh/mm/tlbflush_64.c -+++ b/arch/sh/mm/tlbflush_64.c -@@ -194,6 +194,8 @@ good_area: - goto out_of_memory; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - BUG(); - } - ---- a/arch/sparc/mm/fault_32.c -+++ b/arch/sparc/mm/fault_32.c -@@ -300,6 +300,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); ---- a/arch/sparc/mm/fault_64.c -+++ b/arch/sparc/mm/fault_64.c -@@ -443,6 +443,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); ---- a/arch/tile/mm/fault.c -+++ b/arch/tile/mm/fault.c -@@ -433,6 +433,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); ---- a/arch/um/kernel/trap.c -+++ b/arch/um/kernel/trap.c -@@ -69,6 +69,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) { - goto out_of_memory; -+ } else if (fault & VM_FAULT_SIGSEGV) { -+ goto out; - } else if (fault & VM_FAULT_SIGBUS) { - err = -EACCES; - goto out; ---- a/arch/x86/mm/fault.c -+++ b/arch/x86/mm/fault.c -@@ -887,6 +887,8 @@ mm_fault_error(struct pt_regs *regs, uns - if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON| - VM_FAULT_HWPOISON_LARGE)) - do_sigbus(regs, error_code, address, fault); -+ else if (fault & VM_FAULT_SIGSEGV) -+ bad_area_nosemaphore(regs, error_code, address); - else - BUG(); - } ---- a/arch/xtensa/mm/fault.c -+++ b/arch/xtensa/mm/fault.c -@@ -108,6 +108,8 @@ good_area: - if (unlikely(fault & VM_FAULT_ERROR)) { - if (fault & VM_FAULT_OOM) - goto out_of_memory; -+ else if (fault & VM_FAULT_SIGSEGV) -+ goto bad_area; - else if (fault & VM_FAULT_SIGBUS) - goto do_sigbus; - BUG(); ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -841,6 +841,7 @@ static inline int page_mapped(struct pag - #define VM_FAULT_WRITE 0x0008 /* Special case for get_user_pages */ - #define VM_FAULT_HWPOISON 0x0010 /* Hit poisoned small page */ - #define VM_FAULT_HWPOISON_LARGE 0x0020 /* Hit poisoned large page. Index encoded in upper bits */ -+#define VM_FAULT_SIGSEGV 0x0040 - - #define VM_FAULT_NOPAGE 0x0100 /* ->fault installed the pte, not return page */ - #define VM_FAULT_LOCKED 0x0200 /* ->fault locked the returned page */ -@@ -848,8 +849,8 @@ static inline int page_mapped(struct pag - - #define VM_FAULT_HWPOISON_LARGE_MASK 0xf000 /* encodes hpage index for large hwpoison */ - --#define VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_HWPOISON | \ -- VM_FAULT_HWPOISON_LARGE) -+#define VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | \ -+ VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE) - - /* Encode hstate index for a hwpoisoned large page */ - #define VM_FAULT_SET_HINDEX(x) ((x) << 12) ---- a/mm/ksm.c -+++ b/mm/ksm.c -@@ -342,7 +342,7 @@ static int break_ksm(struct vm_area_stru - else - ret = VM_FAULT_WRITE; - put_page(page); -- } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_OOM))); -+ } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | VM_FAULT_OOM))); - /* - * We must loop because handle_mm_fault() may back out if there's - * any difficulty e.g. if pte accessed bit gets updated concurrently. ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -1787,7 +1787,7 @@ int __get_user_pages(struct task_struct - else - return -EFAULT; - } -- if (ret & VM_FAULT_SIGBUS) -+ if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) - return i ? i : -EFAULT; - BUG(); - } -@@ -1891,7 +1891,7 @@ int fixup_user_fault(struct task_struct - return -ENOMEM; - if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE)) - return -EHWPOISON; -- if (ret & VM_FAULT_SIGBUS) -+ if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) - return -EFAULT; - BUG(); - } diff --git a/patches/vm-make-stack-guard-page-errors-return-vm_fault_sigsegv-rather-than-sigbus.patch b/patches/vm-make-stack-guard-page-errors-return-vm_fault_sigsegv-rather-than-sigbus.patch deleted file mode 100644 index f87c629..0000000 --- a/patches/vm-make-stack-guard-page-errors-return-vm_fault_sigsegv-rather-than-sigbus.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 9c145c56d0c8a0b62e48c8d71e055ad0fb2012ba Mon Sep 17 00:00:00 2001 -From: Linus Torvalds <torvalds@linux-foundation.org> -Date: Thu, 29 Jan 2015 11:15:17 -0800 -Subject: vm: make stack guard page errors return VM_FAULT_SIGSEGV rather than - SIGBUS - -commit 9c145c56d0c8a0b62e48c8d71e055ad0fb2012ba upstream. - -The stack guard page error case has long incorrectly caused a SIGBUS -rather than a SIGSEGV, but nobody actually noticed until commit -fee7e49d4514 ("mm: propagate error from stack expansion even for guard -page") because that error case was never actually triggered in any -normal situations. - -Now that we actually report the error, people noticed the wrong signal -that resulted. So far, only the test suite of libsigsegv seems to have -actually cared, but there are real applications that use libsigsegv, so -let's not wait for any of those to break. - -Reported-and-tested-by: Takashi Iwai <tiwai@suse.de> -Tested-by: Jan Engelhardt <jengelh@inai.de> -Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com> # "s390 still compiles and boots" -Cc: linux-arch@vger.kernel.org -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/memory.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -3175,7 +3175,7 @@ static int do_anonymous_page(struct mm_s - - /* Check if we need to add a guard page to the stack */ - if (check_stack_guard_page(vma, address) < 0) -- return VM_FAULT_SIGBUS; -+ return VM_FAULT_SIGSEGV; - - /* Use the zero-page for reads */ - if (!(flags & FAULT_FLAG_WRITE)) { diff --git a/patches/writeback-fix-a-subtle-race-condition-in-i_dirty-clearing.patch b/patches/writeback-fix-a-subtle-race-condition-in-i_dirty-clearing.patch deleted file mode 100644 index 6e38b4f..0000000 --- a/patches/writeback-fix-a-subtle-race-condition-in-i_dirty-clearing.patch +++ /dev/null @@ -1,123 +0,0 @@ -From 9c6ac78eb3521c5937b2dd8a7d1b300f41092f45 Mon Sep 17 00:00:00 2001 -From: Tejun Heo <tj@kernel.org> -Date: Fri, 24 Oct 2014 15:38:21 -0400 -Subject: writeback: fix a subtle race condition in I_DIRTY clearing - -commit 9c6ac78eb3521c5937b2dd8a7d1b300f41092f45 upstream. - -After invoking ->dirty_inode(), __mark_inode_dirty() does smp_mb() and -tests inode->i_state locklessly to see whether it already has all the -necessary I_DIRTY bits set. The comment above the barrier doesn't -contain any useful information - memory barriers can't ensure "changes -are seen by all cpus" by itself. - -And it sure enough was broken. Please consider the following -scenario. - - CPU 0 CPU 1 - ------------------------------------------------------------------------------- - - enters __writeback_single_inode() - grabs inode->i_lock - tests PAGECACHE_TAG_DIRTY which is clear - enters __set_page_dirty() - grabs mapping->tree_lock - sets PAGECACHE_TAG_DIRTY - releases mapping->tree_lock - leaves __set_page_dirty() - - enters __mark_inode_dirty() - smp_mb() - sees I_DIRTY_PAGES set - leaves __mark_inode_dirty() - clears I_DIRTY_PAGES - releases inode->i_lock - -Now @inode has dirty pages w/ I_DIRTY_PAGES clear. This doesn't seem -to lead to an immediately critical problem because requeue_inode() -later checks PAGECACHE_TAG_DIRTY instead of I_DIRTY_PAGES when -deciding whether the inode needs to be requeued for IO and there are -enough unintentional memory barriers inbetween, so while the inode -ends up with inconsistent I_DIRTY_PAGES flag, it doesn't fall off the -IO list. - -The lack of explicit barrier may also theoretically affect the other -I_DIRTY bits which deal with metadata dirtiness. There is no -guarantee that a strong enough barrier exists between -I_DIRTY_[DATA]SYNC clearing and write_inode() writing out the dirtied -inode. Filesystem inode writeout path likely has enough stuff which -can behave as full barrier but it's theoretically possible that the -writeout may not see all the updates from ->dirty_inode(). - -Fix it by adding an explicit smp_mb() after I_DIRTY clearing. Note -that I_DIRTY_PAGES needs a special treatment as it always needs to be -cleared to be interlocked with the lockless test on -__mark_inode_dirty() side. It's cleared unconditionally and -reinstated after smp_mb() if the mapping still has dirty pages. - -Also add comments explaining how and why the barriers are paired. - -Lightly tested. - -Signed-off-by: Tejun Heo <tj@kernel.org> -Cc: Jan Kara <jack@suse.cz> -Cc: Mikulas Patocka <mpatocka@redhat.com> -Cc: Jens Axboe <axboe@kernel.dk> -Cc: Al Viro <viro@zeniv.linux.org.uk> -Reviewed-by: Jan Kara <jack@suse.cz> -Signed-off-by: Jens Axboe <axboe@fb.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/fs-writeback.c | 29 ++++++++++++++++++++++------- - 1 file changed, 22 insertions(+), 7 deletions(-) - ---- a/fs/fs-writeback.c -+++ b/fs/fs-writeback.c -@@ -424,12 +424,28 @@ writeback_single_inode(struct inode *ino - * write_inode() - */ - spin_lock(&inode->i_lock); -- /* Clear I_DIRTY_PAGES if we've written out all dirty pages */ -- if (!mapping_tagged(mapping, PAGECACHE_TAG_DIRTY)) -- inode->i_state &= ~I_DIRTY_PAGES; -+ - dirty = inode->i_state & I_DIRTY; -- inode->i_state &= ~(I_DIRTY_SYNC | I_DIRTY_DATASYNC); -+ inode->i_state &= ~I_DIRTY; -+ -+ /* -+ * Paired with smp_mb() in __mark_inode_dirty(). This allows -+ * __mark_inode_dirty() to test i_state without grabbing i_lock - -+ * either they see the I_DIRTY bits cleared or we see the dirtied -+ * inode. -+ * -+ * I_DIRTY_PAGES is always cleared together above even if @mapping -+ * still has dirty pages. The flag is reinstated after smp_mb() if -+ * necessary. This guarantees that either __mark_inode_dirty() -+ * sees clear I_DIRTY_PAGES or we see PAGECACHE_TAG_DIRTY. -+ */ -+ smp_mb(); -+ -+ if (mapping_tagged(mapping, PAGECACHE_TAG_DIRTY)) -+ inode->i_state |= I_DIRTY_PAGES; -+ - spin_unlock(&inode->i_lock); -+ - /* Don't write the inode if only I_DIRTY_PAGES was set */ - if (dirty & (I_DIRTY_SYNC | I_DIRTY_DATASYNC)) { - int err = write_inode(inode, wbc); -@@ -1075,12 +1091,11 @@ void __mark_inode_dirty(struct inode *in - } - - /* -- * make sure that changes are seen by all cpus before we test i_state -- * -- mikulas -+ * Paired with smp_mb() in __writeback_single_inode() for the -+ * following lockless i_state test. See there for details. - */ - smp_mb(); - -- /* avoid the locking if we can */ - if ((inode->i_state & flags) == flags) - return; - diff --git a/patches/writeback-move-i_dirty_pages-handling.patch b/patches/writeback-move-i_dirty_pages-handling.patch deleted file mode 100644 index 8c1ab43..0000000 --- a/patches/writeback-move-i_dirty_pages-handling.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 6290be1c1dc6589eeda213aa40946b27fa4faac8 Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.cz> -Date: Thu, 3 May 2012 14:47:57 +0200 -Subject: writeback: Move I_DIRTY_PAGES handling - -commit 6290be1c1dc6589eeda213aa40946b27fa4faac8 upstream. - -Instead of clearing I_DIRTY_PAGES and resetting it when we didn't succeed in -writing them all, just clear the bit only when we succeeded writing all the -pages. We also move the clearing of the bit close to other i_state handling to -separate it from writeback list handling. This is desirable because list -handling will differ for flusher thread and other writeback_single_inode() -callers in future. No filesystem plays any tricks with I_DIRTY_PAGES (like -checking it in ->writepages or ->write_inode implementation) so this movement -is safe. - -Signed-off-by: Jan Kara <jack@suse.cz> -Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/fs-writeback.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - ---- a/fs/fs-writeback.c -+++ b/fs/fs-writeback.c -@@ -402,7 +402,6 @@ writeback_single_inode(struct inode *ino - - /* Set I_SYNC, reset I_DIRTY_PAGES */ - inode->i_state |= I_SYNC; -- inode->i_state &= ~I_DIRTY_PAGES; - spin_unlock(&inode->i_lock); - spin_unlock(&wb->list_lock); - -@@ -425,6 +424,9 @@ writeback_single_inode(struct inode *ino - * write_inode() - */ - spin_lock(&inode->i_lock); -+ /* Clear I_DIRTY_PAGES if we've written out all dirty pages */ -+ if (!mapping_tagged(mapping, PAGECACHE_TAG_DIRTY)) -+ inode->i_state &= ~I_DIRTY_PAGES; - dirty = inode->i_state & I_DIRTY; - inode->i_state &= ~(I_DIRTY_SYNC | I_DIRTY_DATASYNC); - spin_unlock(&inode->i_lock); -@@ -453,7 +455,6 @@ writeback_single_inode(struct inode *ino - * We didn't write back all the pages. nfs_writepages() - * sometimes bales out without doing anything. - */ -- inode->i_state |= I_DIRTY_PAGES; - if (wbc->nr_to_write <= 0) { - /* - * slice used up: queue for next turn diff --git a/patches/x86-cpu-amd-add-workaround-for-family-16h-erratum-793.patch b/patches/x86-cpu-amd-add-workaround-for-family-16h-erratum-793.patch deleted file mode 100644 index da89765..0000000 --- a/patches/x86-cpu-amd-add-workaround-for-family-16h-erratum-793.patch +++ /dev/null @@ -1,88 +0,0 @@ -From 3b56496865f9f7d9bcb2f93b44c63f274f08e3b6 Mon Sep 17 00:00:00 2001 -From: Borislav Petkov <bp@suse.de> -Date: Wed, 15 Jan 2014 00:07:11 +0100 -Subject: x86, cpu, amd: Add workaround for family 16h, erratum 793 - -commit 3b56496865f9f7d9bcb2f93b44c63f274f08e3b6 upstream. - -This adds the workaround for erratum 793 as a precaution in case not -every BIOS implements it. This addresses CVE-2013-6885. - -Erratum text: - -[Revision Guide for AMD Family 16h Models 00h-0Fh Processors, -document 51810 Rev. 3.04 November 2013] - -793 Specific Combination of Writes to Write Combined Memory Types and -Locked Instructions May Cause Core Hang - -Description - -Under a highly specific and detailed set of internal timing -conditions, a locked instruction may trigger a timing sequence whereby -the write to a write combined memory type is not flushed, causing the -locked instruction to stall indefinitely. - -Potential Effect on System - -Processor core hang. - -Suggested Workaround - -BIOS should set MSR -C001_1020[15] = 1b. - -Fix Planned - -No fix planned - -[ hpa: updated description, fixed typo in MSR name ] - -Signed-off-by: Borislav Petkov <bp@suse.de> -Link: http://lkml.kernel.org/r/20140114230711.GS29865@pd.tnic -Tested-by: Aravind Gopalakrishnan <aravind.gopalakrishnan@amd.com> -Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> -[bwh: Backported to 3.2: - - Adjust filename - - Venkatesh Srinivas pointed out we should use {rd,wr}msrl_safe() to - avoid crashing on KVM. This was fixed upstream by commit 8f86a7373a1c - ("x86, AMD: Convert to the new bit access MSR accessors") but that's too - much trouble to backport. Here we must use {rd,wr}msrl_amd_safe().] -Signed-off-by: Ben Hutchings <ben@decadent.org.uk> -Cc: Moritz Muehlenhoff <jmm@debian.org> -Cc: Venkatesh Srinivas <venkateshs@google.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/include/asm/msr-index.h | 1 + - arch/x86/kernel/cpu/amd.c | 10 ++++++++++ - 2 files changed, 11 insertions(+) - ---- a/arch/x86/include/asm/msr-index.h -+++ b/arch/x86/include/asm/msr-index.h -@@ -130,6 +130,7 @@ - #define MSR_AMD64_PATCH_LOADER 0xc0010020 - #define MSR_AMD64_OSVW_ID_LENGTH 0xc0010140 - #define MSR_AMD64_OSVW_STATUS 0xc0010141 -+#define MSR_AMD64_LS_CFG 0xc0011020 - #define MSR_AMD64_DC_CFG 0xc0011022 - #define MSR_AMD64_IBSFETCHCTL 0xc0011030 - #define MSR_AMD64_IBSFETCHLINAD 0xc0011031 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -417,6 +417,16 @@ static void __cpuinit early_init_amd_mc( - - c->x86_coreid_bits = bits; - #endif -+ -+ /* F16h erratum 793, CVE-2013-6885 */ -+ if (c->x86 == 0x16 && c->x86_model <= 0xf) { -+ u64 val; -+ -+ if (!rdmsrl_amd_safe(MSR_AMD64_LS_CFG, &val) && -+ !(val & BIT(15))) -+ wrmsrl_amd_safe(MSR_AMD64_LS_CFG, val | BIT(15)); -+ } -+ - } - - static void __cpuinit bsp_init_amd(struct cpuinfo_x86 *c) diff --git a/patches/x86-hyperv-mark-the-hyper-v-clocksource-as-being-continuous.patch b/patches/x86-hyperv-mark-the-hyper-v-clocksource-as-being-continuous.patch deleted file mode 100644 index eef6daf..0000000 --- a/patches/x86-hyperv-mark-the-hyper-v-clocksource-as-being-continuous.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 32c6590d126836a062b3140ed52d898507987017 Mon Sep 17 00:00:00 2001 -From: "K. Y. Srinivasan" <kys@microsoft.com> -Date: Mon, 12 Jan 2015 16:26:02 -0800 -Subject: x86, hyperv: Mark the Hyper-V clocksource as being continuous - -commit 32c6590d126836a062b3140ed52d898507987017 upstream. - -The Hyper-V clocksource is continuous; mark it accordingly. - -Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> -Acked-by: jasowang@redhat.com -Cc: gregkh@linuxfoundation.org -Cc: devel@linuxdriverproject.org -Cc: olaf@aepfle.de -Cc: apw@canonical.com -Link: http://lkml.kernel.org/r/1421108762-3331-1-git-send-email-kys@microsoft.com -Signed-off-by: Thomas Gleixner <tglx@linutronix.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/kernel/cpu/mshyperv.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/arch/x86/kernel/cpu/mshyperv.c -+++ b/arch/x86/kernel/cpu/mshyperv.c -@@ -55,6 +55,7 @@ static struct clocksource hyperv_cs = { - .rating = 400, /* use this when running on Hyperv*/ - .read = read_hv_clock, - .mask = CLOCKSOURCE_MASK(64), -+ .flags = CLOCK_SOURCE_IS_CONTINUOUS, - }; - - static void __init ms_hyperv_init_platform(void) diff --git a/patches/x86-mm-aslr-fix-stack-randomization-on-64-bit-systems.patch b/patches/x86-mm-aslr-fix-stack-randomization-on-64-bit-systems.patch deleted file mode 100644 index 08e5e08..0000000 --- a/patches/x86-mm-aslr-fix-stack-randomization-on-64-bit-systems.patch +++ /dev/null @@ -1,107 +0,0 @@ -From 4e7c22d447bb6d7e37bfe39ff658486ae78e8d77 Mon Sep 17 00:00:00 2001 -From: Hector Marco-Gisbert <hecmargi@upv.es> -Date: Sat, 14 Feb 2015 09:33:50 -0800 -Subject: x86, mm/ASLR: Fix stack randomization on 64-bit systems - -commit 4e7c22d447bb6d7e37bfe39ff658486ae78e8d77 upstream. - -The issue is that the stack for processes is not properly randomized on -64 bit architectures due to an integer overflow. - -The affected function is randomize_stack_top() in file -"fs/binfmt_elf.c": - - static unsigned long randomize_stack_top(unsigned long stack_top) - { - unsigned int random_variable = 0; - - if ((current->flags & PF_RANDOMIZE) && - !(current->personality & ADDR_NO_RANDOMIZE)) { - random_variable = get_random_int() & STACK_RND_MASK; - random_variable <<= PAGE_SHIFT; - } - return PAGE_ALIGN(stack_top) + random_variable; - return PAGE_ALIGN(stack_top) - random_variable; - } - -Note that, it declares the "random_variable" variable as "unsigned int". -Since the result of the shifting operation between STACK_RND_MASK (which -is 0x3fffff on x86_64, 22 bits) and PAGE_SHIFT (which is 12 on x86_64): - - random_variable <<= PAGE_SHIFT; - -then the two leftmost bits are dropped when storing the result in the -"random_variable". This variable shall be at least 34 bits long to hold -the (22+12) result. - -These two dropped bits have an impact on the entropy of process stack. -Concretely, the total stack entropy is reduced by four: from 2^28 to -2^30 (One fourth of expected entropy). - -This patch restores back the entropy by correcting the types involved -in the operations in the functions randomize_stack_top() and -stack_maxrandom_size(). - -The successful fix can be tested with: - - $ for i in `seq 1 10`; do cat /proc/self/maps | grep stack; done - 7ffeda566000-7ffeda587000 rw-p 00000000 00:00 0 [stack] - 7fff5a332000-7fff5a353000 rw-p 00000000 00:00 0 [stack] - 7ffcdb7a1000-7ffcdb7c2000 rw-p 00000000 00:00 0 [stack] - 7ffd5e2c4000-7ffd5e2e5000 rw-p 00000000 00:00 0 [stack] - ... - -Once corrected, the leading bytes should be between 7ffc and 7fff, -rather than always being 7fff. - -Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es> -Signed-off-by: Ismael Ripoll <iripoll@upv.es> -[ Rebased, fixed 80 char bugs, cleaned up commit message, added test example and CVE ] -Signed-off-by: Kees Cook <keescook@chromium.org> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Cc: Andrew Morton <akpm@linux-foundation.org> -Cc: Al Viro <viro@zeniv.linux.org.uk> -Fixes: CVE-2015-1593 -Link: http://lkml.kernel.org/r/20150214173350.GA18393@www.outflux.net -Signed-off-by: Borislav Petkov <bp@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/mm/mmap.c | 6 +++--- - fs/binfmt_elf.c | 5 +++-- - 2 files changed, 6 insertions(+), 5 deletions(-) - ---- a/arch/x86/mm/mmap.c -+++ b/arch/x86/mm/mmap.c -@@ -35,12 +35,12 @@ struct __read_mostly va_alignment va_ali - .flags = -1, - }; - --static unsigned int stack_maxrandom_size(void) -+static unsigned long stack_maxrandom_size(void) - { -- unsigned int max = 0; -+ unsigned long max = 0; - if ((current->flags & PF_RANDOMIZE) && - !(current->personality & ADDR_NO_RANDOMIZE)) { -- max = ((-1U) & STACK_RND_MASK) << PAGE_SHIFT; -+ max = ((-1UL) & STACK_RND_MASK) << PAGE_SHIFT; - } - - return max; ---- a/fs/binfmt_elf.c -+++ b/fs/binfmt_elf.c -@@ -539,11 +539,12 @@ out: - - static unsigned long randomize_stack_top(unsigned long stack_top) - { -- unsigned int random_variable = 0; -+ unsigned long random_variable = 0; - - if ((current->flags & PF_RANDOMIZE) && - !(current->personality & ADDR_NO_RANDOMIZE)) { -- random_variable = get_random_int() & STACK_RND_MASK; -+ random_variable = (unsigned long) get_random_int(); -+ random_variable &= STACK_RND_MASK; - random_variable <<= PAGE_SHIFT; - } - #ifdef CONFIG_STACK_GROWSUP diff --git a/patches/x86-tls-disallow-unusual-tls-segments.patch b/patches/x86-tls-disallow-unusual-tls-segments.patch deleted file mode 100644 index cb3a728..0000000 --- a/patches/x86-tls-disallow-unusual-tls-segments.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 0e58af4e1d2166e9e33375a0f121e4867010d4f8 Mon Sep 17 00:00:00 2001 -From: Andy Lutomirski <luto@amacapital.net> -Date: Thu, 4 Dec 2014 16:48:17 -0800 -Subject: x86/tls: Disallow unusual TLS segments - -commit 0e58af4e1d2166e9e33375a0f121e4867010d4f8 upstream. - -Users have no business installing custom code segments into the -GDT, and segments that are not present but are otherwise valid -are a historical source of interesting attacks. - -For completeness, block attempts to set the L bit. (Prior to -this patch, the L bit would have been silently dropped.) - -This is an ABI break. I've checked glibc, musl, and Wine, and -none of them look like they'll have any trouble. - -Note to stable maintainers: this is a hardening patch that fixes -no known bugs. Given the possibility of ABI issues, this -probably shouldn't be backported quickly. - -Signed-off-by: Andy Lutomirski <luto@amacapital.net> -Acked-by: H. Peter Anvin <hpa@zytor.com> -Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Cc: security@kernel.org <security@kernel.org> -Cc: Willy Tarreau <w@1wt.eu> -Signed-off-by: Ingo Molnar <mingo@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/kernel/tls.c | 22 ++++++++++++++++++++++ - 1 file changed, 22 insertions(+) - ---- a/arch/x86/kernel/tls.c -+++ b/arch/x86/kernel/tls.c -@@ -60,6 +60,28 @@ static bool tls_desc_okay(const struct u - if (!info->seg_32bit) - return false; - -+ /* Only allow data segments in the TLS array. */ -+ if (info->contents > 1) -+ return false; -+ -+ /* -+ * Non-present segments with DPL 3 present an interesting attack -+ * surface. The kernel should handle such segments correctly, -+ * but TLS is very difficult to protect in a sandbox, so prevent -+ * such segments from being created. -+ * -+ * If userspace needs to remove a TLS entry, it can still delete -+ * it outright. -+ */ -+ if (info->seg_not_present) -+ return false; -+ -+#ifdef CONFIG_X86_64 -+ /* The L bit makes no sense for data. */ -+ if (info->lm) -+ return false; -+#endif -+ - return true; - } - diff --git a/patches/x86-tls-don-t-validate-lm-in-set_thread_area-after-all.patch b/patches/x86-tls-don-t-validate-lm-in-set_thread_area-after-all.patch deleted file mode 100644 index f9f025b..0000000 --- a/patches/x86-tls-don-t-validate-lm-in-set_thread_area-after-all.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 3fb2f4237bb452eb4e98f6a5dbd5a445b4fed9d0 Mon Sep 17 00:00:00 2001 -From: Andy Lutomirski <luto@amacapital.net> -Date: Wed, 17 Dec 2014 14:48:30 -0800 -Subject: x86/tls: Don't validate lm in set_thread_area() after all - -commit 3fb2f4237bb452eb4e98f6a5dbd5a445b4fed9d0 upstream. - -It turns out that there's a lurking ABI issue. GCC, when -compiling this in a 32-bit program: - -struct user_desc desc = { - .entry_number = idx, - .base_addr = base, - .limit = 0xfffff, - .seg_32bit = 1, - .contents = 0, /* Data, grow-up */ - .read_exec_only = 0, - .limit_in_pages = 1, - .seg_not_present = 0, - .useable = 0, -}; - -will leave .lm uninitialized. This means that anything in the -kernel that reads user_desc.lm for 32-bit tasks is unreliable. - -Revert the .lm check in set_thread_area(). The value never did -anything in the first place. - -Fixes: 0e58af4e1d21 ("x86/tls: Disallow unusual TLS segments") -Signed-off-by: Andy Lutomirski <luto@amacapital.net> -Acked-by: Thomas Gleixner <tglx@linutronix.de> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Link: http://lkml.kernel.org/r/d7875b60e28c512f6a6fc0baf5714d58e7eaadbb.1418856405.git.luto@amacapital.net -Signed-off-by: Ingo Molnar <mingo@kernel.org> -[lizf: Backported to 3.4: adjust filename] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/include/asm/ldt.h | 7 +++++++ - arch/x86/kernel/tls.c | 6 ------ - 2 files changed, 7 insertions(+), 6 deletions(-) - ---- a/arch/x86/include/asm/ldt.h -+++ b/arch/x86/include/asm/ldt.h -@@ -28,6 +28,13 @@ struct user_desc { - unsigned int seg_not_present:1; - unsigned int useable:1; - #ifdef __x86_64__ -+ /* -+ * Because this bit is not present in 32-bit user code, user -+ * programs can pass uninitialized values here. Therefore, in -+ * any context in which a user_desc comes from a 32-bit program, -+ * the kernel must act as though lm == 0, regardless of the -+ * actual value. -+ */ - unsigned int lm:1; - #endif - }; ---- a/arch/x86/kernel/tls.c -+++ b/arch/x86/kernel/tls.c -@@ -76,12 +76,6 @@ static bool tls_desc_okay(const struct u - if (info->seg_not_present) - return false; - --#ifdef CONFIG_X86_64 -- /* The L bit makes no sense for data. */ -- if (info->lm) -- return false; --#endif -- - return true; - } - diff --git a/patches/x86-um-actually-mark-system-call-tables-readonly.patch b/patches/x86-um-actually-mark-system-call-tables-readonly.patch deleted file mode 100644 index e6bea37..0000000 --- a/patches/x86-um-actually-mark-system-call-tables-readonly.patch +++ /dev/null @@ -1,61 +0,0 @@ -From b485342bd79af363c77ef1a421c4a0aef2de9812 Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann <dborkman@redhat.com> -Date: Sat, 3 Jan 2015 13:11:10 +0100 -Subject: x86, um: actually mark system call tables readonly - -commit b485342bd79af363c77ef1a421c4a0aef2de9812 upstream. - -Commit a074335a370e ("x86, um: Mark system call tables readonly") was -supposed to mark the sys_call_table in UML as RO by adding the const, -but it doesn't have the desired effect as it's nevertheless being placed -into the data section since __cacheline_aligned enforces sys_call_table -being placed into .data..cacheline_aligned instead. We need to use -the ____cacheline_aligned version instead to fix this issue. - -Before: - -$ nm -v arch/x86/um/sys_call_table_64.o | grep -1 "sys_call_table" - U sys_writev -0000000000000000 D sys_call_table -0000000000000000 D syscall_table_size - -After: - -$ nm -v arch/x86/um/sys_call_table_64.o | grep -1 "sys_call_table" - U sys_writev -0000000000000000 R sys_call_table -0000000000000000 D syscall_table_size - -Fixes: a074335a370e ("x86, um: Mark system call tables readonly") -Cc: H. Peter Anvin <hpa@zytor.com> -Cc: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Daniel Borkmann <dborkman@redhat.com> -Signed-off-by: Richard Weinberger <richard@nod.at> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/um/sys_call_table_32.c | 2 +- - arch/x86/um/sys_call_table_64.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - ---- a/arch/x86/um/sys_call_table_32.c -+++ b/arch/x86/um/sys_call_table_32.c -@@ -43,7 +43,7 @@ typedef asmlinkage void (*sys_call_ptr_t - - extern asmlinkage void sys_ni_syscall(void); - --const sys_call_ptr_t sys_call_table[] __cacheline_aligned = { -+const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = { - /* - * Smells like a compiler bug -- it doesn't work - * when the & below is removed. ---- a/arch/x86/um/sys_call_table_64.c -+++ b/arch/x86/um/sys_call_table_64.c -@@ -48,7 +48,7 @@ typedef void (*sys_call_ptr_t)(void); - - extern void sys_ni_syscall(void); - --const sys_call_ptr_t sys_call_table[] __cacheline_aligned = { -+const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = { - /* - * Smells like a compiler bug -- it doesn't work - * when the & below is removed. diff --git a/patches/x86_64-switch_to-load-tls-descriptors-before-switching-ds-and-es.patch b/patches/x86_64-switch_to-load-tls-descriptors-before-switching-ds-and-es.patch deleted file mode 100644 index 9d26dc9..0000000 --- a/patches/x86_64-switch_to-load-tls-descriptors-before-switching-ds-and-es.patch +++ /dev/null @@ -1,306 +0,0 @@ -From f647d7c155f069c1a068030255c300663516420e Mon Sep 17 00:00:00 2001 -From: Andy Lutomirski <luto@amacapital.net> -Date: Mon, 8 Dec 2014 13:55:20 -0800 -Subject: x86_64, switch_to(): Load TLS descriptors before switching DS and ES - -commit f647d7c155f069c1a068030255c300663516420e upstream. - -Otherwise, if buggy user code points DS or ES into the TLS -array, they would be corrupted after a context switch. - -This also significantly improves the comments and documents some -gotchas in the code. - -Before this patch, the both tests below failed. With this -patch, the es test passes, although the gsbase test still fails. - - ----- begin es test ----- - -/* - * Copyright (c) 2014 Andy Lutomirski - * GPL v2 - */ - -static unsigned short GDT3(int idx) -{ - return (idx << 3) | 3; -} - -static int create_tls(int idx, unsigned int base) -{ - struct user_desc desc = { - .entry_number = idx, - .base_addr = base, - .limit = 0xfffff, - .seg_32bit = 1, - .contents = 0, /* Data, grow-up */ - .read_exec_only = 0, - .limit_in_pages = 1, - .seg_not_present = 0, - .useable = 0, - }; - - if (syscall(SYS_set_thread_area, &desc) != 0) - err(1, "set_thread_area"); - - return desc.entry_number; -} - -int main() -{ - int idx = create_tls(-1, 0); - printf("Allocated GDT index %d\n", idx); - - unsigned short orig_es; - asm volatile ("mov %%es,%0" : "=rm" (orig_es)); - - int errors = 0; - int total = 1000; - for (int i = 0; i < total; i++) { - asm volatile ("mov %0,%%es" : : "rm" (GDT3(idx))); - usleep(100); - - unsigned short es; - asm volatile ("mov %%es,%0" : "=rm" (es)); - asm volatile ("mov %0,%%es" : : "rm" (orig_es)); - if (es != GDT3(idx)) { - if (errors == 0) - printf("[FAIL]\tES changed from 0x%hx to 0x%hx\n", - GDT3(idx), es); - errors++; - } - } - - if (errors) { - printf("[FAIL]\tES was corrupted %d/%d times\n", errors, total); - return 1; - } else { - printf("[OK]\tES was preserved\n"); - return 0; - } -} - - ----- end es test ----- - - ----- begin gsbase test ----- - -/* - * gsbase.c, a gsbase test - * Copyright (c) 2014 Andy Lutomirski - * GPL v2 - */ - -static unsigned char *testptr, *testptr2; - -static unsigned char read_gs_testvals(void) -{ - unsigned char ret; - asm volatile ("movb %%gs:%1, %0" : "=r" (ret) : "m" (*testptr)); - return ret; -} - -int main() -{ - int errors = 0; - - testptr = mmap((void *)0x200000000UL, 1, PROT_READ | PROT_WRITE, - MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS, -1, 0); - if (testptr == MAP_FAILED) - err(1, "mmap"); - - testptr2 = mmap((void *)0x300000000UL, 1, PROT_READ | PROT_WRITE, - MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS, -1, 0); - if (testptr2 == MAP_FAILED) - err(1, "mmap"); - - *testptr = 0; - *testptr2 = 1; - - if (syscall(SYS_arch_prctl, ARCH_SET_GS, - (unsigned long)testptr2 - (unsigned long)testptr) != 0) - err(1, "ARCH_SET_GS"); - - usleep(100); - - if (read_gs_testvals() == 1) { - printf("[OK]\tARCH_SET_GS worked\n"); - } else { - printf("[FAIL]\tARCH_SET_GS failed\n"); - errors++; - } - - asm volatile ("mov %0,%%gs" : : "r" (0)); - - if (read_gs_testvals() == 0) { - printf("[OK]\tWriting 0 to gs worked\n"); - } else { - printf("[FAIL]\tWriting 0 to gs failed\n"); - errors++; - } - - usleep(100); - - if (read_gs_testvals() == 0) { - printf("[OK]\tgsbase is still zero\n"); - } else { - printf("[FAIL]\tgsbase was corrupted\n"); - errors++; - } - - return errors == 0 ? 0 : 1; -} - - ----- end gsbase test ----- - -Signed-off-by: Andy Lutomirski <luto@amacapital.net> -Cc: Andi Kleen <andi@firstfloor.org> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Link: http://lkml.kernel.org/r/509d27c9fec78217691c3dad91cec87e1006b34a.1418075657.git.luto@amacapital.net -Signed-off-by: Ingo Molnar <mingo@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/kernel/process_64.c | 101 +++++++++++++++++++++++++++++++------------ - 1 file changed, 73 insertions(+), 28 deletions(-) - ---- a/arch/x86/kernel/process_64.c -+++ b/arch/x86/kernel/process_64.c -@@ -286,24 +286,9 @@ __switch_to(struct task_struct *prev_p, - - fpu = switch_fpu_prepare(prev_p, next_p, cpu); - -- /* -- * Reload esp0, LDT and the page table pointer: -- */ -+ /* Reload esp0 and ss1. */ - load_sp0(tss, next); - -- /* -- * Switch DS and ES. -- * This won't pick up thread selector changes, but I guess that is ok. -- */ -- savesegment(es, prev->es); -- if (unlikely(next->es | prev->es)) -- loadsegment(es, next->es); -- -- savesegment(ds, prev->ds); -- if (unlikely(next->ds | prev->ds)) -- loadsegment(ds, next->ds); -- -- - /* We must save %fs and %gs before load_TLS() because - * %fs and %gs may be cleared by load_TLS(). - * -@@ -312,41 +297,101 @@ __switch_to(struct task_struct *prev_p, - savesegment(fs, fsindex); - savesegment(gs, gsindex); - -+ /* -+ * Load TLS before restoring any segments so that segment loads -+ * reference the correct GDT entries. -+ */ - load_TLS(next, cpu); - - /* -- * Leave lazy mode, flushing any hypercalls made here. -- * This must be done before restoring TLS segments so -- * the GDT and LDT are properly updated, and must be -- * done before math_state_restore, so the TS bit is up -- * to date. -+ * Leave lazy mode, flushing any hypercalls made here. This -+ * must be done after loading TLS entries in the GDT but before -+ * loading segments that might reference them, and and it must -+ * be done before math_state_restore, so the TS bit is up to -+ * date. - */ - arch_end_context_switch(next_p); - -+ /* Switch DS and ES. -+ * -+ * Reading them only returns the selectors, but writing them (if -+ * nonzero) loads the full descriptor from the GDT or LDT. The -+ * LDT for next is loaded in switch_mm, and the GDT is loaded -+ * above. -+ * -+ * We therefore need to write new values to the segment -+ * registers on every context switch unless both the new and old -+ * values are zero. -+ * -+ * Note that we don't need to do anything for CS and SS, as -+ * those are saved and restored as part of pt_regs. -+ */ -+ savesegment(es, prev->es); -+ if (unlikely(next->es | prev->es)) -+ loadsegment(es, next->es); -+ -+ savesegment(ds, prev->ds); -+ if (unlikely(next->ds | prev->ds)) -+ loadsegment(ds, next->ds); -+ - /* - * Switch FS and GS. - * -- * Segment register != 0 always requires a reload. Also -- * reload when it has changed. When prev process used 64bit -- * base always reload to avoid an information leak. -+ * These are even more complicated than FS and GS: they have -+ * 64-bit bases are that controlled by arch_prctl. Those bases -+ * only differ from the values in the GDT or LDT if the selector -+ * is 0. -+ * -+ * Loading the segment register resets the hidden base part of -+ * the register to 0 or the value from the GDT / LDT. If the -+ * next base address zero, writing 0 to the segment register is -+ * much faster than using wrmsr to explicitly zero the base. -+ * -+ * The thread_struct.fs and thread_struct.gs values are 0 -+ * if the fs and gs bases respectively are not overridden -+ * from the values implied by fsindex and gsindex. They -+ * are nonzero, and store the nonzero base addresses, if -+ * the bases are overridden. -+ * -+ * (fs != 0 && fsindex != 0) || (gs != 0 && gsindex != 0) should -+ * be impossible. -+ * -+ * Therefore we need to reload the segment registers if either -+ * the old or new selector is nonzero, and we need to override -+ * the base address if next thread expects it to be overridden. -+ * -+ * This code is unnecessarily slow in the case where the old and -+ * new indexes are zero and the new base is nonzero -- it will -+ * unnecessarily write 0 to the selector before writing the new -+ * base address. -+ * -+ * Note: This all depends on arch_prctl being the only way that -+ * user code can override the segment base. Once wrfsbase and -+ * wrgsbase are enabled, most of this code will need to change. - */ - if (unlikely(fsindex | next->fsindex | prev->fs)) { - loadsegment(fs, next->fsindex); -+ - /* -- * Check if the user used a selector != 0; if yes -- * clear 64bit base, since overloaded base is always -- * mapped to the Null selector -+ * If user code wrote a nonzero value to FS, then it also -+ * cleared the overridden base address. -+ * -+ * XXX: if user code wrote 0 to FS and cleared the base -+ * address itself, we won't notice and we'll incorrectly -+ * restore the prior base address next time we reschdule -+ * the process. - */ - if (fsindex) - prev->fs = 0; - } -- /* when next process has a 64bit base use it */ - if (next->fs) - wrmsrl(MSR_FS_BASE, next->fs); - prev->fsindex = fsindex; - - if (unlikely(gsindex | next->gsindex | prev->gs)) { - load_gs_index(next->gsindex); -+ -+ /* This works (and fails) the same way as fsindex above. */ - if (gsindex) - prev->gs = 0; - } diff --git a/patches/x86_64-vdso-fix-the-vdso-address-randomization-algorithm.patch b/patches/x86_64-vdso-fix-the-vdso-address-randomization-algorithm.patch deleted file mode 100644 index bab6f52..0000000 --- a/patches/x86_64-vdso-fix-the-vdso-address-randomization-algorithm.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 394f56fe480140877304d342dec46d50dc823d46 Mon Sep 17 00:00:00 2001 -From: Andy Lutomirski <luto@amacapital.net> -Date: Fri, 19 Dec 2014 16:04:11 -0800 -Subject: x86_64, vdso: Fix the vdso address randomization algorithm - -commit 394f56fe480140877304d342dec46d50dc823d46 upstream. - -The theory behind vdso randomization is that it's mapped at a random -offset above the top of the stack. To avoid wasting a page of -memory for an extra page table, the vdso isn't supposed to extend -past the lowest PMD into which it can fit. Other than that, the -address should be a uniformly distributed address that meets all of -the alignment requirements. - -The current algorithm is buggy: the vdso has about a 50% probability -of being at the very end of a PMD. The current algorithm also has a -decent chance of failing outright due to incorrect handling of the -case where the top of the stack is near the top of its PMD. - -This fixes the implementation. The paxtest estimate of vdso -"randomisation" improves from 11 bits to 18 bits. (Disclaimer: I -don't know what the paxtest code is actually calculating.) - -It's worth noting that this algorithm is inherently biased: the vdso -is more likely to end up near the end of its PMD than near the -beginning. Ideally we would either nix the PMD sharing requirement -or jointly randomize the vdso and the stack to reduce the bias. - -In the mean time, this is a considerable improvement with basically -no risk of compatibility issues, since the allowed outputs of the -algorithm are unchanged. - -As an easy test, doing this: - -for i in `seq 10000` - do grep -P vdso /proc/self/maps |cut -d- -f1 -done |sort |uniq -d - -used to produce lots of output (1445 lines on my most recent run). -A tiny subset looks like this: - -7fffdfffe000 -7fffe01fe000 -7fffe05fe000 -7fffe07fe000 -7fffe09fe000 -7fffe0bfe000 -7fffe0dfe000 - -Note the suspicious fe000 endings. With the fix, I get a much more -palatable 76 repeated addresses. - -Reviewed-by: Kees Cook <keescook@chromium.org> -Signed-off-by: Andy Lutomirski <luto@amacapital.net> -[lizf: Backported to 3.4: - - adjust context - - adjust comment] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/vdso/vma.c | 36 ++++++++++++++++++++++++++---------- - 1 file changed, 26 insertions(+), 10 deletions(-) - ---- a/arch/x86/vdso/vma.c -+++ b/arch/x86/vdso/vma.c -@@ -117,23 +117,39 @@ subsys_initcall(init_vdso); - - struct linux_binprm; - --/* Put the vdso above the (randomized) stack with another randomized offset. -- This way there is no hole in the middle of address space. -- To save memory make sure it is still in the same PTE as the stack top. -- This doesn't give that many random bits */ -+/* -+ * Put the vdso above the (randomized) stack with another randomized -+ * offset. This way there is no hole in the middle of address space. -+ * To save memory make sure it is still in the same PTE as the stack -+ * top. This doesn't give that many random bits. -+ * -+ * Note that this algorithm is imperfect: the distribution of the vdso -+ * start address within a PMD is biased toward the end. -+ * -+ */ - static unsigned long vdso_addr(unsigned long start, unsigned len) - { - unsigned long addr, end; - unsigned offset; -- end = (start + PMD_SIZE - 1) & PMD_MASK; -+ -+ /* -+ * Round up the start address. It can start out unaligned as a result -+ * of stack start randomization. -+ */ -+ start = PAGE_ALIGN(start); -+ -+ /* Round the lowest possible end address up to a PMD boundary. */ -+ end = (start + len + PMD_SIZE - 1) & PMD_MASK; - if (end >= TASK_SIZE_MAX) - end = TASK_SIZE_MAX; - end -= len; -- /* This loses some more bits than a modulo, but is cheaper */ -- offset = get_random_int() & (PTRS_PER_PTE - 1); -- addr = start + (offset << PAGE_SHIFT); -- if (addr >= end) -- addr = end; -+ -+ if (end > start) { -+ offset = get_random_int() % (((end - start) >> PAGE_SHIFT) + 1); -+ addr = start + (offset << PAGE_SHIFT); -+ } else { -+ addr = start; -+ } - - /* - * page-align it here so that get_unmapped_area doesn't |