diff --git a/kernel/drivers/module-bbswitch/pspec.xml b/kernel/drivers/module-bbswitch/pspec.xml index 29134444..922cfc8d 100644 --- a/kernel/drivers/module-bbswitch/pspec.xml +++ b/kernel/drivers/module-bbswitch/pspec.xml @@ -11,7 +11,7 @@ Kernel module allowing to switch dedicated graphics card on Optimus laptops kernel module allowing to switch dedicated graphics card on Optimus laptops - kernel-module-headers + kernel-module-headers https://github.com/Bumblebee-Project/bbswitch/archive/v0.8.tar.gz @@ -20,7 +20,7 @@ module-bbswitch - kernel + kernel /lib/modules @@ -34,6 +34,13 @@ + + 2015-09-18 + 0.8 + Rebuild for kernel-4.1.7. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-08-18 0.8 diff --git a/kernel/drivers/module-broadcom-wl/pspec.xml b/kernel/drivers/module-broadcom-wl/pspec.xml index 3cb9e328..06dc2432 100644 --- a/kernel/drivers/module-broadcom-wl/pspec.xml +++ b/kernel/drivers/module-broadcom-wl/pspec.xml @@ -15,7 +15,7 @@ http://www.broadcom.com/docs/linux_sta/hybrid-v35-nodebug-pcoem-6_30_223_248.tar.gz http://www.broadcom.com/docs/linux_sta/hybrid-v35_64-nodebug-pcoem-6_30_223_248.tar.gz - kernel-module-headers + kernel-module-headers patch/linux-40.patch @@ -30,7 +30,7 @@ module-broadcom-wl - kernel + kernel module-broadcom-wl-userspace @@ -62,6 +62,13 @@ + + 2015-09-18 + 6.30.223.248 + Rebuild for kernel 4.1.7. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-08-18 6.30.223.248 diff --git a/kernel/drivers/module-virtualbox-guest/pspec.xml b/kernel/drivers/module-virtualbox-guest/pspec.xml index 8a82d576..734a0576 100644 --- a/kernel/drivers/module-virtualbox-guest/pspec.xml +++ b/kernel/drivers/module-virtualbox-guest/pspec.xml @@ -14,14 +14,14 @@ This package provides the kernel modules needed for mouse integration and shared folder support between VirtualBox host and guest systems. http://source.pisilinux.org/1.0/module-virtualbox-guest-4.3.28.tar.xz - kernel-module-headers + kernel-module-headers module-virtualbox-guest - kernel + kernel baselayout module-virtualbox-guest-userspace @@ -55,7 +55,7 @@ 2015-08-18 4.3.28 - Rebuild for kernel-4.1.6. + Rebuild for kernel-4.1.7. Ertuğrul Erata ertugrulerata@gmail.com diff --git a/kernel/drivers/module-virtualbox/pspec.xml b/kernel/drivers/module-virtualbox/pspec.xml index 0a90bc3d..5b0de905 100644 --- a/kernel/drivers/module-virtualbox/pspec.xml +++ b/kernel/drivers/module-virtualbox/pspec.xml @@ -14,14 +14,14 @@ This package provides the kernel support for VirtualBox. http://source.pisilinux.org/1.0/module-virtualbox-4.3.28.tar.xz - kernel-module-headers + kernel-module-headers module-virtualbox - kernel + kernel module-virtualbox-userspace @@ -47,6 +47,13 @@ + + 2015-09-18 + 4.3.28 + Rebuild for kernel-4.1.7. + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-08-18 4.3.28 diff --git a/kernel/kernel/files/configs/kernel-x86_64-config b/kernel/kernel/files/configs/kernel-x86_64-config index ac6c09d2..39d4fc93 100644 --- a/kernel/kernel/files/configs/kernel-x86_64-config +++ b/kernel/kernel/files/configs/kernel-x86_64-config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 4.1.6 Kernel Configuration +# Linux/x86_64 4.1.7 Kernel Configuration # CONFIG_64BIT=y CONFIG_X86_64=y diff --git a/kernel/kernel/files/patches/linux/patch-4.1.7.xz b/kernel/kernel/files/patches/linux/patch-4.1.7.xz new file mode 100644 index 00000000..056b9d3c Binary files /dev/null and b/kernel/kernel/files/patches/linux/patch-4.1.7.xz differ diff --git a/kernel/kernel/files/patches/mageia/Input-evdev-do-not-report-errors-form-flush.patch b/kernel/kernel/files/patches/mageia/Input-evdev-do-not-report-errors-form-flush.patch new file mode 100644 index 00000000..dc0b728c --- /dev/null +++ b/kernel/kernel/files/patches/mageia/Input-evdev-do-not-report-errors-form-flush.patch @@ -0,0 +1,64 @@ +From eb38f3a4f6e86f8bb10a3217ebd85ecc5d763aae Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 3 Sep 2015 22:20:00 -0700 +Subject: [PATCH] Input: evdev - do not report errors form flush() + +We've got bug reports showing the old systemd-logind (at least +system-210) aborting unexpectedly, and this turned out to be because +of an invalid error code from close() call to evdev devices. close() +is supposed to return only either EINTR or EBADFD, while the device +returned ENODEV. logind was overreacting to it and decided to kill +itself when an unexpected error code was received. What a tragedy. + +The bad error code comes from flush fops, and actually evdev_flush() +returns ENODEV when device is disconnected or client's access to it is +revoked. But in these cases the fact that flush did not actually happen is +not an error, but rather normal behavior. For non-disconnected devices +result of flush is also not that interesting as there is no potential of +data loss and even if it fails application has no way of handling the +error. Because of that we are better off always returning success from +evdev_flush(). + +Also returning EINTR from flush()/close() is discouraged (as it is not +clear how application should handle this error), so let's stop taking +evdev->mutex interruptibly. + +Bugzilla: http://bugzilla.suse.com/show_bug.cgi?id=939834 +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Dmitry Torokhov +--- + drivers/input/evdev.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c +index 9d35499..08d4964 100644 +--- a/drivers/input/evdev.c ++++ b/drivers/input/evdev.c +@@ -290,19 +290,14 @@ static int evdev_flush(struct file *file, fl_owner_t id) + { + struct evdev_client *client = file->private_data; + struct evdev *evdev = client->evdev; +- int retval; + +- retval = mutex_lock_interruptible(&evdev->mutex); +- if (retval) +- return retval; ++ mutex_lock(&evdev->mutex); + +- if (!evdev->exist || client->revoked) +- retval = -ENODEV; +- else +- retval = input_flush_device(&evdev->handle, file); ++ if (evdev->exist && !client->revoked) ++ input_flush_device(&evdev->handle, file); + + mutex_unlock(&evdev->mutex); +- return retval; ++ return 0; + } + + static void evdev_free(struct device *dev) +-- +2.3.8 + diff --git a/kernel/kernel/files/patches/mageia/Revert-sched-x86_64-Don-t-save-flags-on-context-swit.patch b/kernel/kernel/files/patches/mageia/Revert-sched-x86_64-Don-t-save-flags-on-context-swit.patch deleted file mode 100644 index 12178194..00000000 --- a/kernel/kernel/files/patches/mageia/Revert-sched-x86_64-Don-t-save-flags-on-context-swit.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 512255a2ad2c832ca7d4de9f31245f73781922d0 Mon Sep 17 00:00:00 2001 -From: Andy Lutomirski -Date: Mon, 17 Aug 2015 12:22:50 -0700 -Subject: [PATCH] Revert "sched/x86_64: Don't save flags on context switch" - -This reverts commit: - - 2c7577a75837 ("sched/x86_64: Don't save flags on context switch") - -It was a nice speedup. It's also not quite correct: SYSENTER -enables interrupts too early. - -We can re-add this optimization once the SYSENTER code is beaten -into shape, which should happen in 4.3 or 4.4. - -Signed-off-by: Andy Lutomirski -Cc: Linus Torvalds -Cc: Peter Zijlstra -Cc: Thomas Gleixner -Cc: stable@vger.kernel.org # v3.19 -Link: http://lkml.kernel.org/r/85f56651f59f76624e80785a8fd3bdfdd089a818.1439838962.git.luto@kernel.org -Signed-off-by: Ingo Molnar ---- - arch/x86/include/asm/switch_to.h | 12 ++++-------- - 1 file changed, 4 insertions(+), 8 deletions(-) - -diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h -index 751bf4b..d7f3b3b 100644 ---- a/arch/x86/include/asm/switch_to.h -+++ b/arch/x86/include/asm/switch_to.h -@@ -79,12 +79,12 @@ do { \ - #else /* CONFIG_X86_32 */ - - /* frame pointer must be last for get_wchan */ --#define SAVE_CONTEXT "pushq %%rbp ; movq %%rsi,%%rbp\n\t" --#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp\t" -+#define SAVE_CONTEXT "pushf ; pushq %%rbp ; movq %%rsi,%%rbp\n\t" -+#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp ; popf\t" - - #define __EXTRA_CLOBBER \ - , "rcx", "rbx", "rdx", "r8", "r9", "r10", "r11", \ -- "r12", "r13", "r14", "r15", "flags" -+ "r12", "r13", "r14", "r15" - - #ifdef CONFIG_CC_STACKPROTECTOR - #define __switch_canary \ -@@ -100,11 +100,7 @@ do { \ - #define __switch_canary_iparam - #endif /* CC_STACKPROTECTOR */ - --/* -- * There is no need to save or restore flags, because flags are always -- * clean in kernel mode, with the possible exception of IOPL. Kernel IOPL -- * has no effect. -- */ -+/* Save restore flags to clear handle leaking NT */ - #define switch_to(prev, next, last) \ - asm volatile(SAVE_CONTEXT \ - "movq %%rsp,%P[threadrsp](%[prev])\n\t" /* save RSP */ \ --- -2.4.5 - diff --git a/kernel/kernel/files/patches/mageia/SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch b/kernel/kernel/files/patches/mageia/SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch deleted file mode 100644 index e7623744..00000000 --- a/kernel/kernel/files/patches/mageia/SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch +++ /dev/null @@ -1,83 +0,0 @@ -From 49718f0fb8c9af192b33d8af3a2826db04025371 Mon Sep 17 00:00:00 2001 -From: Alan Stern -Date: Mon, 17 Aug 2015 11:02:42 -0400 -Subject: [PATCH] SCSI: Fix NULL pointer dereference in runtime PM -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The routines in scsi_rpm.c assume that if a runtime-PM callback is -invoked for a SCSI device, it can only mean that the device's driver -has asked the block layer to handle the runtime power management (by -calling blk_pm_runtime_init(), which among other things sets q->dev). - -However, this assumption turns out to be wrong for things like the ses -driver. Normally ses devices are not allowed to do runtime PM, but -userspace can override this setting. If this happens, the kernel gets -a NULL pointer dereference when blk_post_runtime_resume() tries to use -the uninitialized q->dev pointer. - -This patch fixes the problem by calling the block layer's runtime-PM -routines only if the device's driver really does have a runtime-PM -callback routine. Since ses doesn't define any such callbacks, the -crash won't occur. - -This fixes Bugzilla #101371. - -Signed-off-by: Alan Stern -Reported-by: Stanisław Pitucha -Reported-by: Ilan Cohen -Tested-by: Ilan Cohen -Reviewed-by: Johannes Thumshirn -Cc: stable@vger.kernel.org -Signed-off-by: James Bottomley ---- - drivers/scsi/scsi_pm.c | 22 +++++++++++----------- - 1 file changed, 11 insertions(+), 11 deletions(-) - -diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c -index 9e43ae1..e4b7998 100644 ---- a/drivers/scsi/scsi_pm.c -+++ b/drivers/scsi/scsi_pm.c -@@ -217,15 +217,15 @@ static int sdev_runtime_suspend(struct device *dev) - { - const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL; - struct scsi_device *sdev = to_scsi_device(dev); -- int err; -+ int err = 0; - -- err = blk_pre_runtime_suspend(sdev->request_queue); -- if (err) -- return err; -- if (pm && pm->runtime_suspend) -+ if (pm && pm->runtime_suspend) { -+ err = blk_pre_runtime_suspend(sdev->request_queue); -+ if (err) -+ return err; - err = pm->runtime_suspend(dev); -- blk_post_runtime_suspend(sdev->request_queue, err); -- -+ blk_post_runtime_suspend(sdev->request_queue, err); -+ } - return err; - } - -@@ -248,11 +248,11 @@ static int sdev_runtime_resume(struct device *dev) - const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL; - int err = 0; - -- blk_pre_runtime_resume(sdev->request_queue); -- if (pm && pm->runtime_resume) -+ if (pm && pm->runtime_resume) { -+ blk_pre_runtime_resume(sdev->request_queue); - err = pm->runtime_resume(dev); -- blk_post_runtime_resume(sdev->request_queue, err); -- -+ blk_post_runtime_resume(sdev->request_queue, err); -+ } - return err; - } - --- -2.4.5 - diff --git a/kernel/kernel/files/patches/mageia/ata-Revert-libata-Implement-NCQ-autosense.patch b/kernel/kernel/files/patches/mageia/ata-Revert-libata-Implement-NCQ-autosense.patch deleted file mode 100644 index dbb919f3..00000000 --- a/kernel/kernel/files/patches/mageia/ata-Revert-libata-Implement-NCQ-autosense.patch +++ /dev/null @@ -1,120 +0,0 @@ -From 74a80d67b8316eb3fbeb73dafc060a5a0a708587 Mon Sep 17 00:00:00 2001 -From: Tejun Heo -Date: Mon, 3 Aug 2015 11:46:39 -0400 -Subject: [PATCH] Revert "libata: Implement NCQ autosense" - -This reverts commit 42b966fbf35da9c87f08d98f9b8978edf9e717cf. - -As implemented, ACS-4 sense reporting for ATA devices bypasses error -diagnosis and handling in libata degrading EH behavior significantly. -Revert the related changes for now. - -Signed-off-by: Tejun Heo -Cc: Hannes Reinecke -Cc: stable@vger.kernel.org #v4.1+ ---- - drivers/ata/libata-eh.c | 18 ------------------ - drivers/ata/libata-scsi.c | 9 ++------- - drivers/ata/libata.h | 1 - - include/linux/ata.h | 2 -- - 4 files changed, 2 insertions(+), 28 deletions(-) - -diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c -index 16125be..cb0508a 100644 ---- a/drivers/ata/libata-eh.c -+++ b/drivers/ata/libata-eh.c -@@ -1592,8 +1592,6 @@ static int ata_eh_read_log_10h(struct ata_device *dev, - tf->hob_lbah = buf[10]; - tf->nsect = buf[12]; - tf->hob_nsect = buf[13]; -- if (ata_id_has_ncq_autosense(dev->id)) -- tf->auxiliary = buf[14] << 16 | buf[15] << 8 | buf[16]; - - return 0; - } -@@ -1791,18 +1789,6 @@ void ata_eh_analyze_ncq_error(struct ata_link *link) - memcpy(&qc->result_tf, &tf, sizeof(tf)); - qc->result_tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_LBA | ATA_TFLAG_LBA48; - qc->err_mask |= AC_ERR_DEV | AC_ERR_NCQ; -- if (qc->result_tf.auxiliary) { -- char sense_key, asc, ascq; -- -- sense_key = (qc->result_tf.auxiliary >> 16) & 0xff; -- asc = (qc->result_tf.auxiliary >> 8) & 0xff; -- ascq = qc->result_tf.auxiliary & 0xff; -- ata_dev_dbg(dev, "NCQ Autosense %02x/%02x/%02x\n", -- sense_key, asc, ascq); -- ata_scsi_set_sense(qc->scsicmd, sense_key, asc, ascq); -- qc->flags |= ATA_QCFLAG_SENSE_VALID; -- } -- - ehc->i.err_mask &= ~AC_ERR_DEV; - } - -@@ -1832,10 +1818,6 @@ static unsigned int ata_eh_analyze_tf(struct ata_queued_cmd *qc, - return ATA_EH_RESET; - } - -- /* Set by NCQ autosense */ -- if (qc->flags & ATA_QCFLAG_SENSE_VALID) -- return 0; -- - if (stat & (ATA_ERR | ATA_DF)) - qc->err_mask |= AC_ERR_DEV; - else -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index e1ecd2a..0d7f0da 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -270,11 +270,8 @@ DEVICE_ATTR(unload_heads, S_IRUGO | S_IWUSR, - ata_scsi_park_show, ata_scsi_park_store); - EXPORT_SYMBOL_GPL(dev_attr_unload_heads); - --void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq) -+static void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq) - { -- if (!cmd) -- return; -- - cmd->result = (DRIVER_SENSE << 24) | SAM_STAT_CHECK_CONDITION; - - scsi_build_sense_buffer(0, cmd->sense_buffer, sk, asc, ascq); -@@ -1780,9 +1777,7 @@ static void ata_scsi_qc_complete(struct ata_queued_cmd *qc) - ((cdb[2] & 0x20) || need_sense)) { - ata_gen_passthru_sense(qc); - } else { -- if (qc->flags & ATA_QCFLAG_SENSE_VALID) { -- cmd->result = SAM_STAT_CHECK_CONDITION; -- } else if (!need_sense) { -+ if (!need_sense) { - cmd->result = SAM_STAT_GOOD; - } else { - /* TODO: decide which descriptor format to use -diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h -index 8cfdd96..f840ca1 100644 ---- a/drivers/ata/libata.h -+++ b/drivers/ata/libata.h -@@ -137,7 +137,6 @@ extern int ata_scsi_add_hosts(struct ata_host *host, - struct scsi_host_template *sht); - extern void ata_scsi_scan_host(struct ata_port *ap, int sync); - extern int ata_scsi_offline_dev(struct ata_device *dev); --extern void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq); - extern void ata_scsi_media_change_notify(struct ata_device *dev); - extern void ata_scsi_hotplug(struct work_struct *work); - extern void ata_schedule_scsi_eh(struct Scsi_Host *shost); -diff --git a/include/linux/ata.h b/include/linux/ata.h -index 0e6a782..d2992bf 100644 ---- a/include/linux/ata.h -+++ b/include/linux/ata.h -@@ -528,8 +528,6 @@ struct ata_bmdma_prd { - #define ata_id_cdb_intr(id) (((id)[ATA_ID_CONFIG] & 0x60) == 0x20) - #define ata_id_has_da(id) ((id)[ATA_ID_SATA_CAPABILITY_2] & (1 << 4)) - #define ata_id_has_devslp(id) ((id)[ATA_ID_FEATURE_SUPP] & (1 << 8)) --#define ata_id_has_ncq_autosense(id) \ -- ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7)) - - static inline bool ata_id_has_hipm(const u16 *id) - { --- -2.4.5 - diff --git a/kernel/kernel/files/patches/mageia/ata-Revert-libata-Implement-support-for-sense-data-repor.patch b/kernel/kernel/files/patches/mageia/ata-Revert-libata-Implement-support-for-sense-data-repor.patch deleted file mode 100644 index 69533d57..00000000 --- a/kernel/kernel/files/patches/mageia/ata-Revert-libata-Implement-support-for-sense-data-repor.patch +++ /dev/null @@ -1,212 +0,0 @@ -From 84ded2f8e7dda336fc2fb3570726ceb3b3b3590f Mon Sep 17 00:00:00 2001 -From: Tejun Heo -Date: Mon, 3 Aug 2015 11:45:34 -0400 -Subject: [PATCH] Revert "libata: Implement support for sense data reporting" - -This reverts commit fe7173c206de63fc28475ee6ae42ff95c05692de. - -As implemented, ACS-4 sense reporting for ATA devices bypasses error -diagnosis and handling in libata degrading EH behavior significantly. -Revert the related changes for now. - -ATA_ID_COMMAND_SET_3/4 constants are not reverted as they're used by -later changes. - -Signed-off-by: Tejun Heo -Cc: Hannes Reinecke -Cc: stable@vger.kernel.org #v4.1+ ---- - drivers/ata/libata-core.c | 20 +---------- - drivers/ata/libata-eh.c | 86 ++--------------------------------------------- - include/linux/ata.h | 16 --------- - 3 files changed, 4 insertions(+), 118 deletions(-) - -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index 426bc12..19bcb80 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -2147,24 +2147,6 @@ static int ata_dev_config_ncq(struct ata_device *dev, - return 0; - } - --static void ata_dev_config_sense_reporting(struct ata_device *dev) --{ -- unsigned int err_mask; -- -- if (!ata_id_has_sense_reporting(dev->id)) -- return; -- -- if (ata_id_sense_reporting_enabled(dev->id)) -- return; -- -- err_mask = ata_dev_set_feature(dev, SETFEATURE_SENSE_DATA, 0x1); -- if (err_mask) { -- ata_dev_dbg(dev, -- "failed to enable Sense Data Reporting, Emask 0x%x\n", -- err_mask); -- } --} -- - /** - * ata_dev_configure - Configure the specified ATA/ATAPI device - * @dev: Target device to configure -@@ -2387,7 +2369,7 @@ int ata_dev_configure(struct ata_device *dev) - dev->devslp_timing[i] = sata_setting[j]; - } - } -- ata_dev_config_sense_reporting(dev); -+ - dev->cdb_len = 16; - } - -diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c -index af08d32..16125be 100644 ---- a/drivers/ata/libata-eh.c -+++ b/drivers/ata/libata-eh.c -@@ -1630,70 +1630,6 @@ unsigned int atapi_eh_tur(struct ata_device *dev, u8 *r_sense_key) - } - - /** -- * ata_eh_request_sense - perform REQUEST_SENSE_DATA_EXT -- * @dev: device to perform REQUEST_SENSE_SENSE_DATA_EXT to -- * @sense_buf: result sense data buffer (SCSI_SENSE_BUFFERSIZE bytes long) -- * @dfl_sense_key: default sense key to use -- * -- * Perform REQUEST_SENSE_DATA_EXT after the device reported CHECK -- * SENSE. This function is EH helper. -- * -- * LOCKING: -- * Kernel thread context (may sleep). -- * -- * RETURNS: -- * encoded sense data on success, 0 on failure or if sense data -- * is not available. -- */ --static u32 ata_eh_request_sense(struct ata_queued_cmd *qc, -- struct scsi_cmnd *cmd) --{ -- struct ata_device *dev = qc->dev; -- struct ata_taskfile tf; -- unsigned int err_mask; -- -- if (!cmd) -- return 0; -- -- DPRINTK("ATA request sense\n"); -- ata_dev_warn(dev, "request sense\n"); -- if (!ata_id_sense_reporting_enabled(dev->id)) { -- ata_dev_warn(qc->dev, "sense data reporting disabled\n"); -- return 0; -- } -- ata_tf_init(dev, &tf); -- -- tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE; -- tf.flags |= ATA_TFLAG_LBA | ATA_TFLAG_LBA48; -- tf.command = ATA_CMD_REQ_SENSE_DATA; -- tf.protocol = ATA_PROT_NODATA; -- -- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0); -- /* -- * ACS-4 states: -- * The device may set the SENSE DATA AVAILABLE bit to one in the -- * STATUS field and clear the ERROR bit to zero in the STATUS field -- * to indicate that the command returned completion without an error -- * and the sense data described in table 306 is available. -- * -- * IOW the 'ATA_SENSE' bit might not be set even though valid -- * sense data is available. -- * So check for both. -- */ -- if ((tf.command & ATA_SENSE) || -- tf.lbah != 0 || tf.lbam != 0 || tf.lbal != 0) { -- ata_scsi_set_sense(cmd, tf.lbah, tf.lbam, tf.lbal); -- qc->flags |= ATA_QCFLAG_SENSE_VALID; -- ata_dev_warn(dev, "sense data %02x/%02x/%02x\n", -- tf.lbah, tf.lbam, tf.lbal); -- } else { -- ata_dev_warn(dev, "request sense failed stat %02x emask %x\n", -- tf.command, err_mask); -- } -- return err_mask; --} -- --/** - * atapi_eh_request_sense - perform ATAPI REQUEST_SENSE - * @dev: device to perform REQUEST_SENSE to - * @sense_buf: result sense data buffer (SCSI_SENSE_BUFFERSIZE bytes long) -@@ -1896,22 +1832,7 @@ static unsigned int ata_eh_analyze_tf(struct ata_queued_cmd *qc, - return ATA_EH_RESET; - } - -- /* -- * Sense data reporting does not work if the -- * device fault bit is set. -- */ -- if ((stat & ATA_SENSE) && !(stat & ATA_DF) && -- !(qc->flags & ATA_QCFLAG_SENSE_VALID)) { -- if (!(qc->ap->pflags & ATA_PFLAG_FROZEN)) { -- tmp = ata_eh_request_sense(qc, qc->scsicmd); -- if (tmp) -- qc->err_mask |= tmp; -- } else { -- ata_dev_warn(qc->dev, "sense data available but port frozen\n"); -- } -- } -- -- /* Set by NCQ autosense or request sense above */ -+ /* Set by NCQ autosense */ - if (qc->flags & ATA_QCFLAG_SENSE_VALID) - return 0; - -@@ -2658,15 +2579,14 @@ static void ata_eh_link_report(struct ata_link *link) - - #ifdef CONFIG_ATA_VERBOSE_ERROR - if (res->command & (ATA_BUSY | ATA_DRDY | ATA_DF | ATA_DRQ | -- ATA_SENSE | ATA_ERR)) { -+ ATA_ERR)) { - if (res->command & ATA_BUSY) - ata_dev_err(qc->dev, "status: { Busy }\n"); - else -- ata_dev_err(qc->dev, "status: { %s%s%s%s%s}\n", -+ ata_dev_err(qc->dev, "status: { %s%s%s%s}\n", - res->command & ATA_DRDY ? "DRDY " : "", - res->command & ATA_DF ? "DF " : "", - res->command & ATA_DRQ ? "DRQ " : "", -- res->command & ATA_SENSE ? "SENSE " : "", - res->command & ATA_ERR ? "ERR " : ""); - } - -diff --git a/include/linux/ata.h b/include/linux/ata.h -index 6c78956..0e6a782 100644 ---- a/include/linux/ata.h -+++ b/include/linux/ata.h -@@ -385,8 +385,6 @@ enum { - SATA_SSP = 0x06, /* Software Settings Preservation */ - SATA_DEVSLP = 0x09, /* Device Sleep */ - -- SETFEATURE_SENSE_DATA = 0xC3, /* Sense Data Reporting feature */ -- - /* feature values for SET_MAX */ - ATA_SET_MAX_ADDR = 0x00, - ATA_SET_MAX_PASSWD = 0x01, -@@ -710,20 +708,6 @@ static inline bool ata_id_has_read_log_d - return id[ATA_ID_COMMAND_SET_3] & (1 << 3); - } - --static inline bool ata_id_has_sense_reporting(const u16 *id) --{ -- if (!(id[ATA_ID_CFS_ENABLE_2] & (1 << 15))) -- return false; -- return id[ATA_ID_COMMAND_SET_3] & (1 << 6); --} -- --static inline bool ata_id_sense_reporting_enabled(const u16 *id) --{ -- if (!(id[ATA_ID_CFS_ENABLE_2] & (1 << 15))) -- return false; -- return id[ATA_ID_COMMAND_SET_4] & (1 << 6); --} -- - /** - * ata_id_major_version - get ATA level of drive - * @id: Identify data diff --git a/kernel/kernel/files/patches/mageia/ata-Revert-libata-eh-Set-information-field-for-autosense.patch b/kernel/kernel/files/patches/mageia/ata-Revert-libata-eh-Set-information-field-for-autosense.patch deleted file mode 100644 index f51f3667..00000000 --- a/kernel/kernel/files/patches/mageia/ata-Revert-libata-eh-Set-information-field-for-autosense.patch +++ /dev/null @@ -1,169 +0,0 @@ -From fe16d4f202c59a560533a223bc6375739ee30944 Mon Sep 17 00:00:00 2001 -From: Tejun Heo -Date: Mon, 3 Aug 2015 11:41:33 -0400 -Subject: [PATCH] Revert "libata-eh: Set 'information' field for autosense" - -This reverts commit a1524f226a02aa6edebd90ae0752e97cfd78b159. - -As implemented, ACS-4 sense reporting for ATA devices bypasses error -diagnosis and handling in libata degrading EH behavior significantly. -Revert the related changes for now. - -Signed-off-by: Tejun Heo -Cc: Hannes Reinecke -Cc: stable@vger.kernel.org #v4.1+ ---- - drivers/ata/libata-core.c | 4 ++-- - drivers/ata/libata-eh.c | 3 --- - drivers/ata/libata-scsi.c | 12 ------------ - drivers/ata/libata.h | 5 +---- - drivers/scsi/scsi_error.c | 31 ------------------------------- - include/scsi/scsi_eh.h | 1 - - 6 files changed, 3 insertions(+), 53 deletions(-) - -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index db5d9f7..426bc12 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -694,11 +694,11 @@ static int ata_rwcmd_protocol(struct ata_taskfile *tf, struct ata_device *dev) - * RETURNS: - * Block address read from @tf. - */ --u64 ata_tf_read_block(const struct ata_taskfile *tf, struct ata_device *dev) -+u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev) - { - u64 block = 0; - -- if (!dev || tf->flags & ATA_TFLAG_LBA) { -+ if (tf->flags & ATA_TFLAG_LBA) { - if (tf->flags & ATA_TFLAG_LBA48) { - block |= (u64)tf->hob_lbah << 40; - block |= (u64)tf->hob_lbam << 32; -diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c -index 7465031..af08d32 100644 ---- a/drivers/ata/libata-eh.c -+++ b/drivers/ata/libata-eh.c -@@ -1864,7 +1864,6 @@ void ata_eh_analyze_ncq_error(struct ata_link *link) - ata_dev_dbg(dev, "NCQ Autosense %02x/%02x/%02x\n", - sense_key, asc, ascq); - ata_scsi_set_sense(qc->scsicmd, sense_key, asc, ascq); -- ata_scsi_set_sense_information(qc->scsicmd, &qc->result_tf); - qc->flags |= ATA_QCFLAG_SENSE_VALID; - } - -@@ -1907,8 +1906,6 @@ static unsigned int ata_eh_analyze_tf(struct ata_queued_cmd *qc, - tmp = ata_eh_request_sense(qc, qc->scsicmd); - if (tmp) - qc->err_mask |= tmp; -- else -- ata_scsi_set_sense_information(qc->scsicmd, tf); - } else { - ata_dev_warn(qc->dev, "sense data available but port frozen\n"); - } -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index 641a61a..e1ecd2a 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -280,18 +280,6 @@ void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq) - scsi_build_sense_buffer(0, cmd->sense_buffer, sk, asc, ascq); - } - --void ata_scsi_set_sense_information(struct scsi_cmnd *cmd, -- const struct ata_taskfile *tf) --{ -- u64 information; -- -- if (!cmd) -- return; -- -- information = ata_tf_read_block(tf, NULL); -- scsi_set_sense_information(cmd->sense_buffer, information); --} -- - static ssize_t - ata_scsi_em_message_store(struct device *dev, struct device_attribute *attr, - const char *buf, size_t count) -diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h -index a998a17..8cfdd96 100644 ---- a/drivers/ata/libata.h -+++ b/drivers/ata/libata.h -@@ -67,8 +67,7 @@ extern struct ata_queued_cmd *ata_qc_new_init(struct ata_device *dev, int tag); - extern int ata_build_rw_tf(struct ata_taskfile *tf, struct ata_device *dev, - u64 block, u32 n_block, unsigned int tf_flags, - unsigned int tag); --extern u64 ata_tf_read_block(const struct ata_taskfile *tf, -- struct ata_device *dev); -+extern u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev); - extern unsigned ata_exec_internal(struct ata_device *dev, - struct ata_taskfile *tf, const u8 *cdb, - int dma_dir, void *buf, unsigned int buflen, -@@ -139,8 +138,6 @@ extern int ata_scsi_add_hosts(struct ata_host *host, - extern void ata_scsi_scan_host(struct ata_port *ap, int sync); - extern int ata_scsi_offline_dev(struct ata_device *dev); - extern void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq); --extern void ata_scsi_set_sense_information(struct scsi_cmnd *cmd, -- const struct ata_taskfile *tf); - extern void ata_scsi_media_change_notify(struct ata_device *dev); - extern void ata_scsi_hotplug(struct work_struct *work); - extern void ata_schedule_scsi_eh(struct Scsi_Host *shost); -diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c -index 106884a..b79bbea 100644 ---- a/drivers/scsi/scsi_error.c -+++ b/drivers/scsi/scsi_error.c -@@ -26,7 +26,6 @@ - #include - #include - #include --#include - - #include - #include -@@ -2523,33 +2522,3 @@ void scsi_build_sense_buffer(int desc, u8 *buf, u8 key, u8 asc, u8 ascq) - } - } - EXPORT_SYMBOL(scsi_build_sense_buffer); -- --/** -- * scsi_set_sense_information - set the information field in a -- * formatted sense data buffer -- * @buf: Where to build sense data -- * @info: 64-bit information value to be set -- * -- **/ --void scsi_set_sense_information(u8 *buf, u64 info) --{ -- if ((buf[0] & 0x7f) == 0x72) { -- u8 *ucp, len; -- -- len = buf[7]; -- ucp = (char *)scsi_sense_desc_find(buf, len + 8, 0); -- if (!ucp) { -- buf[7] = len + 0xa; -- ucp = buf + 8 + len; -- } -- ucp[0] = 0; -- ucp[1] = 0xa; -- ucp[2] = 0x80; /* Valid bit */ -- ucp[3] = 0; -- put_unaligned_be64(info, &ucp[4]); -- } else if ((buf[0] & 0x7f) == 0x70) { -- buf[0] |= 0x80; -- put_unaligned_be64(info, &buf[3]); -- } --} --EXPORT_SYMBOL(scsi_set_sense_information); -diff --git a/include/scsi/scsi_eh.h b/include/scsi/scsi_eh.h -index 4942710..8d1d7fa 100644 ---- a/include/scsi/scsi_eh.h -+++ b/include/scsi/scsi_eh.h -@@ -28,7 +28,6 @@ extern int scsi_get_sense_info_fld(const u8 * sense_buffer, int sb_len, - u64 * info_out); - - extern void scsi_build_sense_buffer(int desc, u8 *buf, u8 key, u8 asc, u8 ascq); --extern void scsi_set_sense_information(u8 *buf, u64 info); - - extern int scsi_ioctl_reset(struct scsi_device *, int __user *); - --- -2.4.5 - diff --git a/kernel/kernel/files/patches/mageia/ata-jmicron-disable-broken-async_suspend.patch b/kernel/kernel/files/patches/mageia/ata-jmicron-disable-broken-async_suspend.patch deleted file mode 100644 index f0787f4f..00000000 --- a/kernel/kernel/files/patches/mageia/ata-jmicron-disable-broken-async_suspend.patch +++ /dev/null @@ -1,29 +0,0 @@ - -Fix broken async_suspend - -https://bugzilla.kernel.org/show_bug.cgi?id=81551 - ---- a/drivers/pci/quirks.c -+++ a/drivers/pci/quirks.c -@@ -29,6 +29,21 @@ - #include "pci.h" - - /* -+ * For JMicron chips, we need to disable the async_suspend method, otherwise -+ * they will hit the power-on issue when doing device resume, add one quick -+ * solution to disable the async_suspend method. -+ */ -+static void pci_async_suspend_fixup(struct pci_dev *pdev) -+{ -+ /* -+ * disabling the async_suspend method for JMicron chips to -+ * avoid device resuming issue. -+ */ -+ device_disable_async_suspend(&pdev->dev); -+} -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, pci_async_suspend_fixup); -+ -+/* - * Decoding should be disabled for a PCI device during BAR sizing to avoid - * conflict. But doing so may cause problems on host bridge and perhaps other - * key system devices. For devices that need to have mmio decoding always-on, diff --git a/kernel/kernel/files/patches/mageia/ata-revert-Disabling-the-async-PM-for-JMicron-chip-363-361.patch b/kernel/kernel/files/patches/mageia/ata-revert-Disabling-the-async-PM-for-JMicron-chip-363-361.patch deleted file mode 100644 index 687066be..00000000 --- a/kernel/kernel/files/patches/mageia/ata-revert-Disabling-the-async-PM-for-JMicron-chip-363-361.patch +++ /dev/null @@ -1,68 +0,0 @@ - -This patch reverts: - -From e6b7e41cdd8cae0591e04d9519b65470110e2d44 Mon Sep 17 00:00:00 2001 -From: Chuansheng Liu -Date: Mon, 1 Sep 2014 08:38:03 +0800 -Subject: [PATCH] ata: Disabling the async PM for JMicron chip 363/361 - - -in favour of the pci quirks based patch: -https://bugzilla.kernel.org/show_bug.cgi?id=81551 - -Signed-off-by: Thomas Backlund - ---- - drivers/ata/ahci.c | 12 ------------ - drivers/ata/pata_jmicron.c | 12 ------------ - 2 files changed, 24 deletions(-) - -diff --git b/drivers/ata/ahci.c a/drivers/ata/ahci.c -index f7da21b..bca3d64 100644 ---- b/drivers/ata/ahci.c -+++ a/drivers/ata/ahci.c -@@ -1337,18 +1337,6 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) - else if (pdev->vendor == 0x1c44 && pdev->device == 0x8000) - ahci_pci_bar = AHCI_PCI_BAR_ENMOTUS; - -- /* -- * The JMicron chip 361/363 contains one SATA controller and one -- * PATA controller,for powering on these both controllers, we must -- * follow the sequence one by one, otherwise one of them can not be -- * powered on successfully, so here we disable the async suspend -- * method for these chips. -- */ -- if (pdev->vendor == PCI_VENDOR_ID_JMICRON && -- (pdev->device == PCI_DEVICE_ID_JMICRON_JMB363 || -- pdev->device == PCI_DEVICE_ID_JMICRON_JMB361)) -- device_disable_async_suspend(&pdev->dev); -- - /* acquire resources */ - rc = pcim_enable_device(pdev); - if (rc) -diff --git b/drivers/ata/pata_jmicron.c a/drivers/ata/pata_jmicron.c -index 47e418b..4d1a5d2 100644 ---- b/drivers/ata/pata_jmicron.c -+++ a/drivers/ata/pata_jmicron.c -@@ -143,18 +143,6 @@ static int jmicron_init_one (struct pci_dev *pdev, const struct pci_device_id *i - }; - const struct ata_port_info *ppi[] = { &info, NULL }; - -- /* -- * The JMicron chip 361/363 contains one SATA controller and one -- * PATA controller,for powering on these both controllers, we must -- * follow the sequence one by one, otherwise one of them can not be -- * powered on successfully, so here we disable the async suspend -- * method for these chips. -- */ -- if (pdev->vendor == PCI_VENDOR_ID_JMICRON && -- (pdev->device == PCI_DEVICE_ID_JMICRON_JMB363 || -- pdev->device == PCI_DEVICE_ID_JMICRON_JMB361)) -- device_disable_async_suspend(&pdev->dev); -- - return ata_pci_bmdma_init_one(pdev, ppi, &jmicron_sht, NULL, 0); - } - --- -1.8.5.6 - diff --git a/kernel/kernel/files/patches/mageia/gpu-drm-i915-Avoid-TP3-on-CHV.patch b/kernel/kernel/files/patches/mageia/gpu-drm-i915-Avoid-TP3-on-CHV.patch deleted file mode 100644 index 8fb32d99..00000000 --- a/kernel/kernel/files/patches/mageia/gpu-drm-i915-Avoid-TP3-on-CHV.patch +++ /dev/null @@ -1,81 +0,0 @@ -From ed63baaf849e91c84ac3e042b1fd6a0af07c16f3 Mon Sep 17 00:00:00 2001 -From: "Thulasimani,Sivakumar" -Date: Tue, 18 Aug 2015 15:30:37 +0530 -Subject: [PATCH] drm/i915: Avoid TP3 on CHV -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This patch removes TP3 support on CHV since there is no support -for HBR2 on this platform. - -v2: rename the function to indicate it checks source rates (Jani) -v3: update comment to indicate TP3 dependency on HBR2 supported - hardware (Jani) - -Cc: stable@vger.kernel.org # v4.1+ -Reviewed-by: Ville Syrjälä -Signed-off-by: Sivakumar Thulasimani -[Jani: fixed a couple of checkpatch warnings.] -Signed-off-by: Jani Nikula - -diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c -index 7ad0e0b..1df0e1f 100644 ---- a/drivers/gpu/drm/i915/intel_dp.c -+++ b/drivers/gpu/drm/i915/intel_dp.c -@@ -1166,6 +1166,19 @@ intel_dp_sink_rates(struct intel_dp *intel_dp, const int **sink_rates) - return (intel_dp_max_link_bw(intel_dp) >> 3) + 1; - } - -+static bool intel_dp_source_supports_hbr2(struct drm_device *dev) -+{ -+ /* WaDisableHBR2:skl */ -+ if (IS_SKYLAKE(dev) && INTEL_REVID(dev) <= SKL_REVID_B0) -+ return false; -+ -+ if ((IS_HASWELL(dev) && !IS_HSW_ULX(dev)) || IS_BROADWELL(dev) || -+ (INTEL_INFO(dev)->gen >= 9)) -+ return true; -+ else -+ return false; -+} -+ - static int - intel_dp_source_rates(struct drm_device *dev, const int **source_rates) - { -@@ -1176,12 +1189,8 @@ intel_dp_source_rates(struct drm_device *dev, const int **source_rates) - - *source_rates = default_rates; - -- /* WaDisableHBR2:skl */ -- if (IS_SKYLAKE(dev) && INTEL_REVID(dev) <= SKL_REVID_B0) -- return (DP_LINK_BW_2_7 >> 3) + 1; -- -- if ((IS_HASWELL(dev) && !IS_HSW_ULX(dev)) || IS_BROADWELL(dev) || -- (INTEL_INFO(dev)->gen >= 9)) -+ /* This depends on the fact that 5.4 is last value in the array */ -+ if (intel_dp_source_supports_hbr2(dev)) - return (DP_LINK_BW_5_4 >> 3) + 1; - else - return (DP_LINK_BW_2_7 >> 3) + 1; -@@ -3936,10 +3945,15 @@ intel_dp_get_dpcd(struct intel_dp *intel_dp) - } - } - -- /* Training Pattern 3 support, both source and sink */ -+ /* Training Pattern 3 support, Intel platforms that support HBR2 alone -+ * have support for TP3 hence that check is used along with dpcd check -+ * to ensure TP3 can be enabled. -+ * SKL < B0: due it's WaDisableHBR2 is the only exception where TP3 is -+ * supported but still not enabled. -+ */ - if (intel_dp->dpcd[DP_DPCD_REV] >= 0x12 && - intel_dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED && -- (IS_HASWELL(dev_priv) || INTEL_INFO(dev_priv)->gen >= 8)) { -+ intel_dp_source_supports_hbr2(dev)) { - intel_dp->use_tps3 = true; - DRM_DEBUG_KMS("Displayport TPS3 supported\n"); - } else --- -2.4.5 - diff --git a/kernel/kernel/files/patches/mageia/gpu-drm-i915-remove-HBR2-from-chv-supported-list.patch b/kernel/kernel/files/patches/mageia/gpu-drm-i915-remove-HBR2-from-chv-supported-list.patch deleted file mode 100644 index 892f4d25..00000000 --- a/kernel/kernel/files/patches/mageia/gpu-drm-i915-remove-HBR2-from-chv-supported-list.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 5e86dfe39f54ab13fd8079ac3d6cb100318909a3 Mon Sep 17 00:00:00 2001 -From: "Thulasimani,Sivakumar" -Date: Tue, 18 Aug 2015 11:07:57 +0530 -Subject: [PATCH] drm/i915: remove HBR2 from chv supported list -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This patch removes 5.4Gbps from supported link rate for CHV since -it is not supported in it. - -v2: change the ordering for better readability (Ville) - -Cc: stable@vger.kernel.org # v4.1+ -Reviewed-by: Ville Syrjälä -Signed-off-by: Sivakumar Thulasimani -Signed-off-by: Jani Nikula ---- - drivers/gpu/drm/i915/intel_dp.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c -index 6c8bf34..7ad0e0b 100644 ---- a/drivers/gpu/drm/i915/intel_dp.c -+++ b/drivers/gpu/drm/i915/intel_dp.c -@@ -1176,11 +1176,12 @@ intel_dp_source_rates(struct drm_device *dev, const int **source_rates) - - *source_rates = default_rates; - -+ /* WaDisableHBR2:skl */ - if (IS_SKYLAKE(dev) && INTEL_REVID(dev) <= SKL_REVID_B0) -- /* WaDisableHBR2:skl */ - return (DP_LINK_BW_2_7 >> 3) + 1; -- else if (INTEL_INFO(dev)->gen >= 8 || -- (IS_HASWELL(dev) && !IS_HSW_ULX(dev))) -+ -+ if ((IS_HASWELL(dev) && !IS_HSW_ULX(dev)) || IS_BROADWELL(dev) || -+ (INTEL_INFO(dev)->gen >= 9)) - return (DP_LINK_BW_5_4 >> 3) + 1; - else - return (DP_LINK_BW_2_7 >> 3) + 1; --- -2.4.5 - diff --git a/kernel/kernel/files/patches/mageia/scsi-Fix-NULL-pointer-dereference-in-RTPM-of-block-layer.patch b/kernel/kernel/files/patches/mageia/scsi-Fix-NULL-pointer-dereference-in-RTPM-of-block-layer.patch new file mode 100644 index 00000000..49928d17 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/scsi-Fix-NULL-pointer-dereference-in-RTPM-of-block-layer.patch @@ -0,0 +1,74 @@ +SCSI: Fix NULL pointer dereference in RTPM of block layer + +The routines in scsi_pm.c assume that if a runtime-PM callback is +invoked for a SCSI device, it can only mean that the device's driver +has asked the block layer to handle the runtime power management (by +calling blk_pm_runtime_init(), which among other things sets q->dev). + +However, this assumption turns out to be wrong for things like the ses +driver. Normally ses devices are not allowed to do runtime PM, but +userspace can override this setting. If this happens, the kernel gets +a NULL pointer dereference when blk_post_runtime_resume() tries to use +the uninitialized q->dev pointer. + +This patch fixes the problem by checking q->dev in block layer before +handle runtime PM. Since ses doesn't define any PM callbacks and call +blk_pm_runtime_init(), the crash won't occur. + +This fixes Bugzilla #101371. +https://bugzilla.kernel.org/show_bug.cgi?id=101371 + +Signed-off-by: Ken Xue +Acked-by: Alan Stern +Cc: stable@vger.kernel.org + +--- + block/blk-core.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/block/blk-core.c b/block/blk-core.c +index 60912e9..a07ab18 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -3280,6 +3280,9 @@ int blk_pre_runtime_suspend(struct request_queue *q) + { + int ret = 0; + ++ if (!q->dev) ++ return ret; ++ + spin_lock_irq(q->queue_lock); + if (q->nr_pending) { + ret = -EBUSY; +@@ -3307,6 +3310,9 @@ EXPORT_SYMBOL(blk_pre_runtime_suspend); + */ + void blk_post_runtime_suspend(struct request_queue *q, int err) + { ++ if (!q->dev) ++ return; ++ + spin_lock_irq(q->queue_lock); + if (!err) { + q->rpm_status = RPM_SUSPENDED; +@@ -3331,6 +3337,9 @@ EXPORT_SYMBOL(blk_post_runtime_suspend); + */ + void blk_pre_runtime_resume(struct request_queue *q) + { ++ if (!q->dev) ++ return; ++ + spin_lock_irq(q->queue_lock); + q->rpm_status = RPM_RESUMING; + spin_unlock_irq(q->queue_lock); +@@ -3353,6 +3362,9 @@ EXPORT_SYMBOL(blk_pre_runtime_resume); + */ + void blk_post_runtime_resume(struct request_queue *q, int err) + { ++ if (!q->dev) ++ return; ++ + spin_lock_irq(q->queue_lock); + if (!err) { + q->rpm_status = RPM_ACTIVE; +-- +1.9.1 diff --git a/kernel/kernel/files/patches/mageia/scsi-Revert-SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch b/kernel/kernel/files/patches/mageia/scsi-Revert-SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch new file mode 100644 index 00000000..dc20be03 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/scsi-Revert-SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch @@ -0,0 +1,64 @@ +Revert "SCSI: Fix NULL pointer dereference in runtime PM" + +This reverts commit 49718f0fb8c9 ("SCSI: Fix NULL pointer dereference in +runtime PM") + +The old commit may lead to a issue that blk_{pre|post}_runtime_suspend and +blk_{pre|post}_runtime_resume can not be called in pairs. + +Take sr device as example, when sr device goes to runtime suspend, +blk_{pre|post}_runtime_suspend will be called since sr device defined +pm->runtime_suspend. But blk_{pre|post}_runtime_resume will not be called +since sr device doesn't have pm->runtime_resume. Then sr device can not +resume correctly anymore. + +Signed-off-by: Ken Xue +Acked-by: Alan Stern +Cc: stable@vger.kernel.org + +--- + drivers/scsi/scsi_pm.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c +index e4b7998..459abe1 100644 +--- a/drivers/scsi/scsi_pm.c ++++ b/drivers/scsi/scsi_pm.c +@@ -219,13 +219,13 @@ static int sdev_runtime_suspend(struct device *dev) + struct scsi_device *sdev = to_scsi_device(dev); + int err = 0; + +- if (pm && pm->runtime_suspend) { +- err = blk_pre_runtime_suspend(sdev->request_queue); +- if (err) +- return err; ++ err = blk_pre_runtime_suspend(sdev->request_queue); ++ if (err) ++ return err; ++ if (pm && pm->runtime_suspend) + err = pm->runtime_suspend(dev); +- blk_post_runtime_suspend(sdev->request_queue, err); +- } ++ blk_post_runtime_suspend(sdev->request_queue, err); ++ + return err; + } + +@@ -248,11 +248,11 @@ static int sdev_runtime_resume(struct device *dev) + const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL; + int err = 0; + +- if (pm && pm->runtime_resume) { +- blk_pre_runtime_resume(sdev->request_queue); ++ blk_pre_runtime_resume(sdev->request_queue); ++ if (pm && pm->runtime_resume) + err = pm->runtime_resume(dev); +- blk_post_runtime_resume(sdev->request_queue, err); +- } ++ blk_post_runtime_resume(sdev->request_queue, err); ++ + return err; + } + +-- +1.9.1 diff --git a/kernel/kernel/files/patches/mageia/series b/kernel/kernel/files/patches/mageia/series index f1c2fe31..b96a67db 100644 --- a/kernel/kernel/files/patches/mageia/series +++ b/kernel/kernel/files/patches/mageia/series @@ -14,33 +14,72 @@ ### ### Stable Queue ### -stable-ipc-sem-fix-use-after-free-on-ipc_rmid-after-a-task-using-same-semaphore-set-exits.patch -stable-ipc-sem.c-update-correct-memory-barriers.patch -stable-mm-hwpoison-fix-page-refcount-of-unknown-non-lru-page.patch -stable-mm-hwpoison-fix-fail-isolate-hugetlbfs-page-w-refcount-held.patch -stable-clk-pxa-pxa3xx-fix-cken-register-access.patch -stable-xen-blkfront-don-t-add-indirect-pages-to-list-when.patch -stable-xen-blkback-replace-work_pending-with-work_busy-in-purge_persistent_gnt.patch -stable-rsi-fix-failure-to-load-firmware-after-memory-leak-fix-and-fix-the-leak.patch -stable-perf-fix-fasync-handling-on-inherited-events.patch -stable-perf-fix-running-time-accounting.patch -stable-perf-fix-double-free-of-the-aux-buffer.patch -stable-perf-fix-perf_event_ioc_period-migration-race.patch -stable-iwlwifi-pcie-fix-prepare-card-flow.patch -stable-rtlwifi-rtl8723be-add-module-parameter-for-msi-interrupts.patch -stable-rtlwifi-fix-null-dereference-when-pci-driver-used-as-an-ap.patch -stable-x86-xen-build-xen-pv-apic-driver-for-domu-as-well.patch -stable-xen-xenbus-don-t-leak-memory-when-unmapping-the-ring-on-hvm-backend.patch -stable-dm-thin-metadata-delete-btrees-when-releasing-metadata-snapshot.patch -stable-localmodconfig-use-kbuild-files-too.patch -stable-edac-ppc4xx-access-mci-csrows-array-elements-properly.patch -stable-hid-hid-input-fix-accessing-freed-memory-during-device-disconnect.patch -stable-hid-uclogic-fix-limit-in-uclogic_tablet_enable.patch -stable-drm-radeon-add-new-oland-pci-id.patch -stable-drm-vmwgfx-fix-execbuf-locking-issues.patch - -# DaveM -stable-net_41.mbox.patch +stable-x86-ldt-make-modify_ldt-synchronous.patch +stable-x86-ldt-correct-ldt-access-in-single-stepping-logic.patch +stable-x86-ldt-correct-fpu-emulation-access-to-ldt.patch +stable-x86-ldt-further-fix-fpu-emulation.patch +stable-drm-radeon-don-t-link-train-displayport-on-hpd-until-we-get-the-dpcd.patch +stable-drm-i915-apply-the-pci_d0-d3-hibernation-workaround-everywhere-on-pre-gen6.patch +stable-drm-i915-check-dp-link-status-on-long-hpd-too.patch +stable-drm-radeon-atom-send-out-the-full-aux-address.patch +stable-drm-radeon-native-send-out-the-full-aux-address.patch +stable-drm-radeon-fix-hdmi-quantization_range-for-pre-dce5-asics.patch +stable-drm-i915-preserve-ssc-earlier.patch +stable-drm-qxl-validate-monitors-config-modes.patch +stable-drm-i915-allow-dsi-dual-link-to-be-configured-on-any-pipe.patch +stable-drm-i915-always-mark-the-object-as-dirty-when-used-by-the-gpu.patch +stable-drm-i915-limit-the-number-of-loops-for-reading-a-split-64bit-register.patch +stable-s390-sclp-fix-compile-error.patch +stable-s390-setup-fix-novx-parameter.patch +stable-iio-bmg160-iio_buffer-and-iio_triggered_buffer-are-required.patch +stable-iio-event-remove-negative-error-code-from-iio_event_poll.patch +stable-iio-industrialio-buffer-fix-iio_buffer_poll-return-value.patch +stable-iio-adis16400-fix-adis16448-gyroscope-scale.patch +stable-iio-add-inverse-unit-conversion-macros.patch +stable-iio-adis16480-fix-scale-factors.patch +stable-sched-fix-cpu_active_mask-cpu_online_mask-race.patch +stable-staging-comedi-adl_pci7x3x-fix-digital-output-on-pci-7230.patch +stable-staging-comedi-usbduxsigma-don-t-clobber-ai_timer-in-command-test.patch +stable-staging-comedi-usbduxsigma-don-t-clobber-ao_timer-in-command-test.patch +stable-pm-clk-don-t-return-int-on-__pm_clk_enable.patch +stable-clk-rockchip-rk3288-add-clk_set_rate_parent-to-sclk_mac.patch +stable-clk-exynos4-fix-wrong-clock-for-exynos4x12-adc.patch +stable-clk-s5pv210-add-missing-call-to.patch +stable-clk-pistachio-fix-override-of-clk-pll-settings-from-boot-loader.patch +stable-clk-pistachio-correct-critical-clock-list.patch +stable-clk-versatile-off-by-one-in-clk_sp810_timerclken_of_get.patch +stable-clk-pxa-fix-core-frequency-reporting-unit.patch +stable-clk-qcom-set-clk_set_rate_parent-on-ce1-clocks.patch +stable-clk-qcom-fix-msm8916-prng-clock-enable-bit.patch +stable-pci-fix-ti816x-class-code-quirk.patch +stable-pci-add-dev_flags-bit-to-access-vpd-through-function-0.patch +stable-pci-add-vpd-function-0-quirk-for-intel-ethernet-devices.patch +stable-pci-disable-async-suspend-resume-for-jmicron-multi-function-sata-ahci.patch +stable-spi-bcm2835-set-up-spi-mode-before-asserting-cs-gpio.patch +stable-spi-fix-regression-in-spi-bitbang-txrx.h.patch +stable-spi-sh-msiof-fix-fifo-size-to-64-word-from-256-word.patch +stable-spi-img-spfi-check-for-timeout-error-before-proceeding.patch +stable-spi-img-spfi-fix-multiple-calls-to-request-gpio.patch +stable-spi-img-spfi-fix-kbuild-test-robot-warning.patch +stable-spi-dw-allow-interface-drivers-to-limit-data-i-o-to-word-sizes.patch +stable-usb-symbolserial-use-usb_get_serial_port_data.patch +stable-usb-qcserial-add-hp-lt4111-lte-ev-do-hspa-gobi-4g-module.patch +stable-usb-ftdi_sio-added-custom-pid-for-customware-products.patch +stable-usb-pl2303-fix-baud-rate-divisor-calculations.patch +stable-libxfs-readahead-of-dir3-data-blocks-should-use-the-read-verifier.patch +stable-xfs-fix-xfs_attr_leafblock-definition.patch +stable-xfs-fix-file-type-directory-corruption-for-btree-directories.patch +stable-usb-gadget-m66592-udc-forever-loop-in-set_feature.patch +stable-doc-usb-gadget-testing-using-the-updated-testusb.c.patch +stable-usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch +stable-usb-gadget-f_uac2-finalize-wmaxpacketsize-according-to-bandwidth.patch +stable-usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch +stable-tty-serial-men_z135_uart.c-fix-race-between-irq-and-set_termios.patch +stable-asoc-rt5640-fix-line-out-no-sound-issue.patch +stable-asoc-samsung-remove-redundant-arndale_audio_remove.patch +stable-asoc-adav80x-remove-.read_flag_mask-setting-from-adav80x_regmap_config.patch +stable-asoc-arizona-fix-gain-settings-of-fll-in-free-run-mode.patch +stable-asoc-arizona-poll-for-fll-clock-ok-rather-than-use-interrupts.patch ### ### Arch x86 @@ -65,15 +104,6 @@ x86-increase-default-minimum-vmalloc-area-by-64MB-to-192MB.patch # slows down boot Revert-cpufreq-pcc-Enable-autoload-of-pcc-cpufreq-fo.patch -# wrong optimization -Revert-sched-x86_64-Don-t-save-flags-on-context-swit.patch - -# fix unbootable systems -x86-apic-Fix-fallout-from-x2apic-cleanup.patch - -# fixes powertop -x86-idle-Restore-trace_cpu_idle-to-mwait_idle-calls.patch - ### ### Core ### @@ -148,21 +178,13 @@ block-floppy-disable-pnp-modalias.patch # prefer ata over ide drivers ata-prefer-ata-drivers-over-ide-drivers-when-both-are-built.patch -# korg #81551 -ata-revert-Disabling-the-async-PM-for-JMicron-chip-363-361.patch -ata-jmicron-disable-broken-async_suspend.patch - # Nice SSD speedup block-Make-CFQ-default-to-IOPS-mode-on-SSDs.patch block-cfq-iosched-fix-the-setting-of-IOPS-mode-on-SSDs.patch -# libata eh breakage -ata-Revert-libata-eh-Set-information-field-for-autosense.patch -ata-Revert-libata-Implement-support-for-sense-data-repor.patch -ata-Revert-libata-Implement-NCQ-autosense.patch - -# ses driver crash -SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch +# properly fix null pointer deref introduced in 4.1.7 +scsi-Revert-SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch +scsi-Fix-NULL-pointer-dereference-in-RTPM-of-block-layer.patch ### ### File-system @@ -208,10 +230,6 @@ gpu-drm-mach64-linux-3.14-buildfix.patch gpu-drm-mach64-3.17-buildfix.patch gpu-drm-mach64-3.18-buildfix.patch -# i915 -gpu-drm-i915-remove-HBR2-from-chv-supported-list.patch -gpu-drm-i915-Avoid-TP3-on-CHV.patch - ### ### Hardware Monitoring ### @@ -222,6 +240,9 @@ gpu-drm-i915-Avoid-TP3-on-CHV.patch input-i8042-quirks-for-Fujitsu-Lifebook-A544-and-Lif.patch +# fixes systemd-logind killing itself +Input-evdev-do-not-report-errors-form-flush.patch + ### ### idle ### diff --git a/kernel/kernel/files/patches/mageia/stable-asoc-adav80x-remove-.read_flag_mask-setting-from-adav80x_regmap_config.patch b/kernel/kernel/files/patches/mageia/stable-asoc-adav80x-remove-.read_flag_mask-setting-from-adav80x_regmap_config.patch new file mode 100644 index 00000000..9fdd46c7 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-asoc-adav80x-remove-.read_flag_mask-setting-from-adav80x_regmap_config.patch @@ -0,0 +1,31 @@ +From 9d8352864907f0ad76124c5b28f65b5a382d7d7c Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Fri, 14 Aug 2015 17:54:07 +0800 +Subject: ASoC: adav80x: Remove .read_flag_mask setting from adav80x_regmap_config + +From: Axel Lin + +commit 9d8352864907f0ad76124c5b28f65b5a382d7d7c upstream. + +Don't set .read_flag_mask for adav803, it's for adav801 only. + +Fixes: 0c2d69645628 ("ASoC: adav80x: Split SPI and I2C code into different modules") +Signed-off-by: Axel Lin +Acked-by: Lars-Peter Clausen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/adav80x.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/sound/soc/codecs/adav80x.c ++++ b/sound/soc/codecs/adav80x.c +@@ -864,7 +864,6 @@ const struct regmap_config adav80x_regma + .val_bits = 8, + .pad_bits = 1, + .reg_bits = 7, +- .read_flag_mask = 0x01, + + .max_register = ADAV80X_PLL_OUTE, + diff --git a/kernel/kernel/files/patches/mageia/stable-asoc-arizona-fix-gain-settings-of-fll-in-free-run-mode.patch b/kernel/kernel/files/patches/mageia/stable-asoc-arizona-fix-gain-settings-of-fll-in-free-run-mode.patch new file mode 100644 index 00000000..49961f20 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-asoc-arizona-fix-gain-settings-of-fll-in-free-run-mode.patch @@ -0,0 +1,33 @@ +From 1cf5a330c05ae37a0a98ac7c9800a6f50d5579ec Mon Sep 17 00:00:00 2001 +From: Nikesh Oswal +Date: Wed, 19 Aug 2015 16:02:24 +0100 +Subject: ASoC: arizona: Fix gain settings of FLL in free-run mode + +From: Nikesh Oswal + +commit 1cf5a330c05ae37a0a98ac7c9800a6f50d5579ec upstream. + +The wrong register was used to set the gain of ref loop, when changing +the FLL output on an active FLL. This patch corrects the offset of the +gain register. + +Signed-off-by: Nikesh Oswal +Signed-off-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/arizona.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/arizona.c ++++ b/sound/soc/codecs/arizona.c +@@ -1912,7 +1912,7 @@ static int arizona_enable_fll(struct ari + + if (already_enabled) { + /* Facilitate smooth refclk across the transition */ +- regmap_update_bits_async(fll->arizona->regmap, fll->base + 0x7, ++ regmap_update_bits_async(fll->arizona->regmap, fll->base + 0x9, + ARIZONA_FLL1_GAIN_MASK, 0); + regmap_update_bits_async(fll->arizona->regmap, fll->base + 1, + ARIZONA_FLL1_FREERUN, diff --git a/kernel/kernel/files/patches/mageia/stable-asoc-arizona-poll-for-fll-clock-ok-rather-than-use-interrupts.patch b/kernel/kernel/files/patches/mageia/stable-asoc-arizona-poll-for-fll-clock-ok-rather-than-use-interrupts.patch new file mode 100644 index 00000000..1ae728a8 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-asoc-arizona-poll-for-fll-clock-ok-rather-than-use-interrupts.patch @@ -0,0 +1,141 @@ +From 0e7659712836ca59b4735bc5cc94de38698a5e01 Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Tue, 25 Aug 2015 12:43:48 +0100 +Subject: ASoC: arizona: Poll for FLL clock OK rather than use interrupts + +From: Charles Keepax + +commit 0e7659712836ca59b4735bc5cc94de38698a5e01 upstream. + +The extcon driver takes the DAPM mutex from within the interrupt thread +in several places, which makes it possible to get into a situation where +the interrupt thread is blocked waiting on the DAPM mutex whilst a DAPM +sequence is running which is attempting to configure the FLL. In this +case the FLL completion can't be completed as as the IRQ handler is +ONE_SHOT, which cause the FLL lock to use the full time out (250mS) and +report that the process timed out. + +It is not really practical to make the extcon driver not take the DAPM +mutex from within the interrupt thread, at least not without extensive +modification. So this patch fixes the issue by switching the wait for +the FLL lock to polling. A few fast polls are done first as the FLL +should lock quickly for a good quality reference clock, (indeed it hits +on the first poll on my system) and it will poll every 20mS after that +until it times out. + +Signed-off-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/arizona.c | 47 ++++++++++++++++++--------------------------- + sound/soc/codecs/arizona.h | 1 + 2 files changed, 19 insertions(+), 29 deletions(-) + +--- a/sound/soc/codecs/arizona.c ++++ b/sound/soc/codecs/arizona.c +@@ -1610,17 +1610,6 @@ int arizona_init_dai(struct arizona_priv + } + EXPORT_SYMBOL_GPL(arizona_init_dai); + +-static irqreturn_t arizona_fll_clock_ok(int irq, void *data) +-{ +- struct arizona_fll *fll = data; +- +- arizona_fll_dbg(fll, "clock OK\n"); +- +- complete(&fll->ok); +- +- return IRQ_HANDLED; +-} +- + static struct { + unsigned int min; + unsigned int max; +@@ -1902,10 +1891,11 @@ static int arizona_is_enabled_fll(struct + static int arizona_enable_fll(struct arizona_fll *fll) + { + struct arizona *arizona = fll->arizona; +- unsigned long time_left; + bool use_sync = false; + int already_enabled = arizona_is_enabled_fll(fll); + struct arizona_fll_cfg cfg; ++ int i; ++ unsigned int val; + + if (already_enabled < 0) + return already_enabled; +@@ -1964,9 +1954,6 @@ static int arizona_enable_fll(struct ari + if (!already_enabled) + pm_runtime_get(arizona->dev); + +- /* Clear any pending completions */ +- try_wait_for_completion(&fll->ok); +- + regmap_update_bits_async(arizona->regmap, fll->base + 1, + ARIZONA_FLL1_ENA, ARIZONA_FLL1_ENA); + if (use_sync) +@@ -1978,10 +1965,24 @@ static int arizona_enable_fll(struct ari + regmap_update_bits_async(arizona->regmap, fll->base + 1, + ARIZONA_FLL1_FREERUN, 0); + +- time_left = wait_for_completion_timeout(&fll->ok, +- msecs_to_jiffies(250)); +- if (time_left == 0) ++ arizona_fll_dbg(fll, "Waiting for FLL lock...\n"); ++ val = 0; ++ for (i = 0; i < 15; i++) { ++ if (i < 5) ++ usleep_range(200, 400); ++ else ++ msleep(20); ++ ++ regmap_read(arizona->regmap, ++ ARIZONA_INTERRUPT_RAW_STATUS_5, ++ &val); ++ if (val & (ARIZONA_FLL1_CLOCK_OK_STS << (fll->id - 1))) ++ break; ++ } ++ if (i == 15) + arizona_fll_warn(fll, "Timed out waiting for lock\n"); ++ else ++ arizona_fll_dbg(fll, "FLL locked (%d polls)\n", i); + + return 0; + } +@@ -2066,11 +2067,8 @@ EXPORT_SYMBOL_GPL(arizona_set_fll); + int arizona_init_fll(struct arizona *arizona, int id, int base, int lock_irq, + int ok_irq, struct arizona_fll *fll) + { +- int ret; + unsigned int val; + +- init_completion(&fll->ok); +- + fll->id = id; + fll->base = base; + fll->arizona = arizona; +@@ -2092,13 +2090,6 @@ int arizona_init_fll(struct arizona *ari + snprintf(fll->clock_ok_name, sizeof(fll->clock_ok_name), + "FLL%d clock OK", id); + +- ret = arizona_request_irq(arizona, ok_irq, fll->clock_ok_name, +- arizona_fll_clock_ok, fll); +- if (ret != 0) { +- dev_err(arizona->dev, "Failed to get FLL%d clock OK IRQ: %d\n", +- id, ret); +- } +- + regmap_update_bits(arizona->regmap, fll->base + 1, + ARIZONA_FLL1_FREERUN, 0); + +--- a/sound/soc/codecs/arizona.h ++++ b/sound/soc/codecs/arizona.h +@@ -233,7 +233,6 @@ struct arizona_fll { + int id; + unsigned int base; + unsigned int vco_mult; +- struct completion ok; + + unsigned int fout; + int sync_src; diff --git a/kernel/kernel/files/patches/mageia/stable-asoc-rt5640-fix-line-out-no-sound-issue.patch b/kernel/kernel/files/patches/mageia/stable-asoc-rt5640-fix-line-out-no-sound-issue.patch new file mode 100644 index 00000000..c26be5c7 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-asoc-rt5640-fix-line-out-no-sound-issue.patch @@ -0,0 +1,89 @@ +From 9b850ca4f1c5acd7fcbbd4b38a2d27132801a8d5 Mon Sep 17 00:00:00 2001 +From: John Lin +Date: Tue, 11 Aug 2015 14:27:25 +0800 +Subject: ASoC: rt5640: fix line out no sound issue + +From: John Lin + +commit 9b850ca4f1c5acd7fcbbd4b38a2d27132801a8d5 upstream. + +The power for line out was not turned on when line out is enabled. +So we add "LOUT amp" widget to turn on the power for line out. + +Signed-off-by: John Lin +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/rt5640.c | 40 +++++++++++++++++++++++++++++++++++++--- + 1 file changed, 37 insertions(+), 3 deletions(-) + +--- a/sound/soc/codecs/rt5640.c ++++ b/sound/soc/codecs/rt5640.c +@@ -985,6 +985,35 @@ static int rt5640_hp_event(struct snd_so + return 0; + } + ++static int rt5640_lout_event(struct snd_soc_dapm_widget *w, ++ struct snd_kcontrol *kcontrol, int event) ++{ ++ struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm); ++ ++ switch (event) { ++ case SND_SOC_DAPM_POST_PMU: ++ hp_amp_power_on(codec); ++ snd_soc_update_bits(codec, RT5640_PWR_ANLG1, ++ RT5640_PWR_LM, RT5640_PWR_LM); ++ snd_soc_update_bits(codec, RT5640_OUTPUT, ++ RT5640_L_MUTE | RT5640_R_MUTE, 0); ++ break; ++ ++ case SND_SOC_DAPM_PRE_PMD: ++ snd_soc_update_bits(codec, RT5640_OUTPUT, ++ RT5640_L_MUTE | RT5640_R_MUTE, ++ RT5640_L_MUTE | RT5640_R_MUTE); ++ snd_soc_update_bits(codec, RT5640_PWR_ANLG1, ++ RT5640_PWR_LM, 0); ++ break; ++ ++ default: ++ return 0; ++ } ++ ++ return 0; ++} ++ + static int rt5640_hp_power_event(struct snd_soc_dapm_widget *w, + struct snd_kcontrol *kcontrol, int event) + { +@@ -1180,13 +1209,16 @@ static const struct snd_soc_dapm_widget + 0, rt5640_spo_l_mix, ARRAY_SIZE(rt5640_spo_l_mix)), + SND_SOC_DAPM_MIXER("SPOR MIX", SND_SOC_NOPM, 0, + 0, rt5640_spo_r_mix, ARRAY_SIZE(rt5640_spo_r_mix)), +- SND_SOC_DAPM_MIXER("LOUT MIX", RT5640_PWR_ANLG1, RT5640_PWR_LM_BIT, 0, ++ SND_SOC_DAPM_MIXER("LOUT MIX", SND_SOC_NOPM, 0, 0, + rt5640_lout_mix, ARRAY_SIZE(rt5640_lout_mix)), + SND_SOC_DAPM_SUPPLY_S("Improve HP Amp Drv", 1, SND_SOC_NOPM, + 0, 0, rt5640_hp_power_event, SND_SOC_DAPM_POST_PMU), + SND_SOC_DAPM_PGA_S("HP Amp", 1, SND_SOC_NOPM, 0, 0, + rt5640_hp_event, + SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU), ++ SND_SOC_DAPM_PGA_S("LOUT amp", 1, SND_SOC_NOPM, 0, 0, ++ rt5640_lout_event, ++ SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU), + SND_SOC_DAPM_SUPPLY("HP L Amp", RT5640_PWR_ANLG1, + RT5640_PWR_HP_L_BIT, 0, NULL, 0), + SND_SOC_DAPM_SUPPLY("HP R Amp", RT5640_PWR_ANLG1, +@@ -1501,8 +1533,10 @@ static const struct snd_soc_dapm_route r + {"HP R Playback", "Switch", "HP Amp"}, + {"HPOL", NULL, "HP L Playback"}, + {"HPOR", NULL, "HP R Playback"}, +- {"LOUTL", NULL, "LOUT MIX"}, +- {"LOUTR", NULL, "LOUT MIX"}, ++ ++ {"LOUT amp", NULL, "LOUT MIX"}, ++ {"LOUTL", NULL, "LOUT amp"}, ++ {"LOUTR", NULL, "LOUT amp"}, + }; + + static const struct snd_soc_dapm_route rt5640_specific_dapm_routes[] = { diff --git a/kernel/kernel/files/patches/mageia/stable-asoc-samsung-remove-redundant-arndale_audio_remove.patch b/kernel/kernel/files/patches/mageia/stable-asoc-samsung-remove-redundant-arndale_audio_remove.patch new file mode 100644 index 00000000..ea815142 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-asoc-samsung-remove-redundant-arndale_audio_remove.patch @@ -0,0 +1,48 @@ +From 14a500fe1396934c6b3ed8f009459a4723da7862 Mon Sep 17 00:00:00 2001 +From: Vaishali Thakkar +Date: Thu, 20 Aug 2015 22:11:15 +0530 +Subject: ASoC: samsung: Remove redundant arndale_audio_remove + +From: Vaishali Thakkar + +commit 14a500fe1396934c6b3ed8f009459a4723da7862 upstream. + +There is no use of snd_soc_unregister_card in remove function +as devm_snd_soc_register_card in probe function automatically +handles it. So, remove use of snd_soc_unregister_card and with +this change remove arndale_audio_remove as it is now redundant. + +Signed-off-by: Vaishali Thakkar +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/samsung/arndale_rt5631.c | 10 ---------- + 1 file changed, 10 deletions(-) + +--- a/sound/soc/samsung/arndale_rt5631.c ++++ b/sound/soc/samsung/arndale_rt5631.c +@@ -116,15 +116,6 @@ static int arndale_audio_probe(struct pl + return ret; + } + +-static int arndale_audio_remove(struct platform_device *pdev) +-{ +- struct snd_soc_card *card = platform_get_drvdata(pdev); +- +- snd_soc_unregister_card(card); +- +- return 0; +-} +- + static const struct of_device_id samsung_arndale_rt5631_of_match[] __maybe_unused = { + { .compatible = "samsung,arndale-rt5631", }, + { .compatible = "samsung,arndale-alc5631", }, +@@ -139,7 +130,6 @@ static struct platform_driver arndale_au + .of_match_table = of_match_ptr(samsung_arndale_rt5631_of_match), + }, + .probe = arndale_audio_probe, +- .remove = arndale_audio_remove, + }; + + module_platform_driver(arndale_audio_driver); diff --git a/kernel/kernel/files/patches/mageia/stable-clk-exynos4-fix-wrong-clock-for-exynos4x12-adc.patch b/kernel/kernel/files/patches/mageia/stable-clk-exynos4-fix-wrong-clock-for-exynos4x12-adc.patch new file mode 100644 index 00000000..60bdcac4 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-clk-exynos4-fix-wrong-clock-for-exynos4x12-adc.patch @@ -0,0 +1,55 @@ +From e323d56eb06b266b77c2b430cb5f1977ba549e03 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 12 Jun 2015 10:53:25 +0900 +Subject: clk: exynos4: Fix wrong clock for Exynos4x12 ADC + +From: Krzysztof Kozlowski + +commit e323d56eb06b266b77c2b430cb5f1977ba549e03 upstream. + +The TSADC gate clock was used in Exynos4x12 DTSI for exynos-adc driver. +However TSADC is present only on Exynos4210 so on Trats2 board (with +Exynos4412 SoC) the exynos-adc driver could not be probed: + ERROR: could not get clock /adc@126C0000:adc(0) + exynos-adc 126c0000.adc: failed getting clock, err = -2 + exynos-adc: probe of 126c0000.adc failed with error -2 + +Instead on Exynos4x12 SoCs the main clock used by Analog to Digital +Converter is located in different register and it is named in datasheet +as PCLK_ADC. Regardless of the name the purpose of this PCLK_ADC clock +is the same as purpose of TSADC from Exynos4210. + +The patch adds gate clock for Exynos4x12 using the proper register so +backward compatibility is preserved. This fixes the probe of exynos-adc +driver on Exynos4x12 boards and allows accessing sensors connected to it +on Trats2 board (ntc,ncp15wb473 AP and battery thermistors). + +Signed-off-by: Krzysztof Kozlowski +Fixes: c63c57433003 ("ARM: dts: Add ADC's dt data to read raw data for exynos4x12") +Reviewed-by: Javier Martinez Canillas +Acked-by: Tomasz Figa +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/samsung/clk-exynos4.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/clk/samsung/clk-exynos4.c ++++ b/drivers/clk/samsung/clk-exynos4.c +@@ -85,6 +85,7 @@ + #define DIV_PERIL4 0xc560 + #define DIV_PERIL5 0xc564 + #define E4X12_DIV_CAM1 0xc568 ++#define E4X12_GATE_BUS_FSYS1 0xc744 + #define GATE_SCLK_CAM 0xc820 + #define GATE_IP_CAM 0xc920 + #define GATE_IP_TV 0xc924 +@@ -1095,6 +1096,7 @@ static struct samsung_gate_clock exynos4 + 0), + GATE(CLK_PPMUIMAGE, "ppmuimage", "aclk200", E4X12_GATE_IP_IMAGE, 9, 0, + 0), ++ GATE(CLK_TSADC, "tsadc", "aclk133", E4X12_GATE_BUS_FSYS1, 16, 0, 0), + GATE(CLK_MIPI_HSI, "mipi_hsi", "aclk133", GATE_IP_FSYS, 10, 0, 0), + GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, 0, 0), + GATE(CLK_SYSREG, "sysreg", "aclk100", E4X12_GATE_IP_PERIR, 1, diff --git a/kernel/kernel/files/patches/mageia/stable-clk-pistachio-correct-critical-clock-list.patch b/kernel/kernel/files/patches/mageia/stable-clk-pistachio-correct-critical-clock-list.patch new file mode 100644 index 00000000..b711f795 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-clk-pistachio-correct-critical-clock-list.patch @@ -0,0 +1,81 @@ +From d31ff5f7f3b142b8d1ebb3da89187c54cdf2bc71 Mon Sep 17 00:00:00 2001 +From: "Damien.Horsley" +Date: Wed, 26 Aug 2015 17:11:40 +0100 +Subject: clk: pistachio: correct critical clock list + +From: "Damien.Horsley" + +commit d31ff5f7f3b142b8d1ebb3da89187c54cdf2bc71 upstream. + +Current critical clock list for pistachio enables +only mips and sys clocks by default but there are +also other clocks that are not claimed by anyone and +needs to be enabled by default. + +This patch updates the critical clocks that need +to be enabled by default. + +Add a separate struct to distinguish the critical clocks +as listed: +1.) core clocks: + a.) mips clock +2.) peripheral system clocks: + a.) sys clock + b.) sys_bus clock + c.) DDR clock + d.) ROM clock + +Fixes: b35d7c33419c("CLK: Pistachio: Register core clocks") +Reviewed-by: Andrew Bresticker +Signed-off-by: Ezequiel Garcia +Signed-off-by: Damien.Horsley +Signed-off-by: Govindraj Raja +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/pistachio/clk-pistachio.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/clk/pistachio/clk-pistachio.c ++++ b/drivers/clk/pistachio/clk-pistachio.c +@@ -159,9 +159,15 @@ PNAME(mux_debug) = { "mips_pll_mux", "rp + "wifi_pll_mux", "bt_pll_mux" }; + static u32 mux_debug_idx[] = { 0x0, 0x1, 0x2, 0x4, 0x8, 0x10 }; + +-static unsigned int pistachio_critical_clks[] __initdata = { +- CLK_MIPS, +- CLK_PERIPH_SYS, ++static unsigned int pistachio_critical_clks_core[] __initdata = { ++ CLK_MIPS ++}; ++ ++static unsigned int pistachio_critical_clks_sys[] __initdata = { ++ PERIPH_CLK_SYS, ++ PERIPH_CLK_SYS_BUS, ++ PERIPH_CLK_DDR, ++ PERIPH_CLK_ROM, + }; + + static void __init pistachio_clk_init(struct device_node *np) +@@ -193,8 +199,8 @@ static void __init pistachio_clk_init(st + + pistachio_clk_register_provider(p); + +- pistachio_clk_force_enable(p, pistachio_critical_clks, +- ARRAY_SIZE(pistachio_critical_clks)); ++ pistachio_clk_force_enable(p, pistachio_critical_clks_core, ++ ARRAY_SIZE(pistachio_critical_clks_core)); + } + CLK_OF_DECLARE(pistachio_clk, "img,pistachio-clk", pistachio_clk_init); + +@@ -261,6 +267,9 @@ static void __init pistachio_clk_periph_ + ARRAY_SIZE(pistachio_periph_gates)); + + pistachio_clk_register_provider(p); ++ ++ pistachio_clk_force_enable(p, pistachio_critical_clks_sys, ++ ARRAY_SIZE(pistachio_critical_clks_sys)); + } + CLK_OF_DECLARE(pistachio_clk_periph, "img,pistachio-clk-periph", + pistachio_clk_periph_init); diff --git a/kernel/kernel/files/patches/mageia/stable-clk-pistachio-fix-override-of-clk-pll-settings-from-boot-loader.patch b/kernel/kernel/files/patches/mageia/stable-clk-pistachio-fix-override-of-clk-pll-settings-from-boot-loader.patch new file mode 100644 index 00000000..2264f79c --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-clk-pistachio-fix-override-of-clk-pll-settings-from-boot-loader.patch @@ -0,0 +1,54 @@ +From e53f21c761d141bbcbce06e9ddab3b4e0a828f2c Mon Sep 17 00:00:00 2001 +From: Zdenko Pulitika +Date: Wed, 26 Aug 2015 17:11:38 +0100 +Subject: clk: pistachio: Fix override of clk-pll settings from boot loader + +From: Zdenko Pulitika + +commit e53f21c761d141bbcbce06e9ddab3b4e0a828f2c upstream. + +PLL enable callbacks are overriding PLL mode (int/frac) and +Noise reduction (on/off) settings set by the boot loader which +results in the incorrect clock rate. + +PLL mode and noise reduction are defined by the DSMPD and DACPD bits +of the PLL control register. PLL .enable() callbacks enable PLL +by deasserting all power-down bits of the PLL control register, +including DSMPD and DACPD bits, which is not necessary since +these bits don't actually enable/disable PLL. + +This commit fixes the problem by removing DSMPD and DACPD bits +from the "PLL enable" mask. + +Fixes: 43049b0c83f17("CLK: Pistachio: Add PLL driver") +Reviewed-by: Andrew Bresitcker +Signed-off-by: Zdenko Pulitika +Signed-off-by: Govindraj Raja +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/pistachio/clk-pll.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/clk/pistachio/clk-pll.c ++++ b/drivers/clk/pistachio/clk-pll.c +@@ -115,8 +115,7 @@ static int pll_gf40lp_frac_enable(struct + u32 val; + + val = pll_readl(pll, PLL_CTRL3); +- val &= ~(PLL_FRAC_CTRL3_PD | PLL_FRAC_CTRL3_DACPD | +- PLL_FRAC_CTRL3_DSMPD | PLL_FRAC_CTRL3_FOUTPOSTDIVPD | ++ val &= ~(PLL_FRAC_CTRL3_PD | PLL_FRAC_CTRL3_FOUTPOSTDIVPD | + PLL_FRAC_CTRL3_FOUT4PHASEPD | PLL_FRAC_CTRL3_FOUTVCOPD); + pll_writel(pll, val, PLL_CTRL3); + +@@ -233,7 +232,7 @@ static int pll_gf40lp_laint_enable(struc + u32 val; + + val = pll_readl(pll, PLL_CTRL1); +- val &= ~(PLL_INT_CTRL1_PD | PLL_INT_CTRL1_DSMPD | ++ val &= ~(PLL_INT_CTRL1_PD | + PLL_INT_CTRL1_FOUTPOSTDIVPD | PLL_INT_CTRL1_FOUTVCOPD); + pll_writel(pll, val, PLL_CTRL1); + diff --git a/kernel/kernel/files/patches/mageia/stable-clk-pxa-fix-core-frequency-reporting-unit.patch b/kernel/kernel/files/patches/mageia/stable-clk-pxa-fix-core-frequency-reporting-unit.patch new file mode 100644 index 00000000..6e08e1fe --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-clk-pxa-fix-core-frequency-reporting-unit.patch @@ -0,0 +1,61 @@ +From 4b5fb7dc9096d949a22651370bb6bf11f21edb30 Mon Sep 17 00:00:00 2001 +From: Robert Jarzmik +Date: Sun, 12 Jul 2015 22:49:53 +0200 +Subject: clk: pxa: fix core frequency reporting unit + +From: Robert Jarzmik + +commit 4b5fb7dc9096d949a22651370bb6bf11f21edb30 upstream. + +Legacy drivers which are not yet ported, such as cpufreq-pxa[23]xx, rely +on pxaXXx_get_clk_frequency_khz() to find the CPU core frequency. + +This reporting was broken because the expected unit is kHz and not +Hz. Fix the reporting for pxa25x, pxa27x and pxa3xx. + +Fixes: fe7710fae477 ("clk: add pxa25x clock drivers") +Fixes: d40670dc6169 ("clk: add pxa27x clock drivers") +Fixes: 9bbb8a338fb2 ("clk: pxa: add pxa3xx clock driver") +Signed-off-by: Robert Jarzmik +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/pxa/clk-pxa25x.c | 2 +- + drivers/clk/pxa/clk-pxa27x.c | 2 +- + drivers/clk/pxa/clk-pxa3xx.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/clk/pxa/clk-pxa25x.c ++++ b/drivers/clk/pxa/clk-pxa25x.c +@@ -79,7 +79,7 @@ unsigned int pxa25x_get_clk_frequency_kh + clks[3] / 1000000, (clks[3] % 1000000) / 10000); + } + +- return (unsigned int)clks[0]; ++ return (unsigned int)clks[0] / KHz; + } + + static unsigned long clk_pxa25x_memory_get_rate(struct clk_hw *hw, +--- a/drivers/clk/pxa/clk-pxa27x.c ++++ b/drivers/clk/pxa/clk-pxa27x.c +@@ -80,7 +80,7 @@ unsigned int pxa27x_get_clk_frequency_kh + pr_info("System bus clock: %ld.%02ldMHz\n", + clks[4] / 1000000, (clks[4] % 1000000) / 10000); + } +- return (unsigned int)clks[0]; ++ return (unsigned int)clks[0] / KHz; + } + + bool pxa27x_is_ppll_disabled(void) +--- a/drivers/clk/pxa/clk-pxa3xx.c ++++ b/drivers/clk/pxa/clk-pxa3xx.c +@@ -78,7 +78,7 @@ unsigned int pxa3xx_get_clk_frequency_kh + pr_info("System bus clock: %ld.%02ldMHz\n", + clks[4] / 1000000, (clks[4] % 1000000) / 10000); + } +- return (unsigned int)clks[0]; ++ return (unsigned int)clks[0] / KHz; + } + + static unsigned long clk_pxa3xx_ac97_get_rate(struct clk_hw *hw, diff --git a/kernel/kernel/files/patches/mageia/stable-clk-pxa-pxa3xx-fix-cken-register-access.patch b/kernel/kernel/files/patches/mageia/stable-clk-pxa-pxa3xx-fix-cken-register-access.patch deleted file mode 100644 index 203cd5f0..00000000 --- a/kernel/kernel/files/patches/mageia/stable-clk-pxa-pxa3xx-fix-cken-register-access.patch +++ /dev/null @@ -1,38 +0,0 @@ -From b93028c9af807b9474789e6aba34a6135b6cb708 Mon Sep 17 00:00:00 2001 -From: Robert Jarzmik -Date: Tue, 4 Aug 2015 08:21:33 +0200 -Subject: clk: pxa: pxa3xx: fix CKEN register access - -From: Robert Jarzmik - -commit b93028c9af807b9474789e6aba34a6135b6cb708 upstream. - -Clocks 0 to 31 are on CKENA, and not CKENB. The clock register names -were inadequately inverted. As a consequence, all clock operations were -happening on CKENB, because almost all but 2 clocks are on CKENA. - -As the clocks were activated by the bootloader in the former tests, it -escaped the testing that the wrong clock gate was manipulated. The error -was revealed by changing the pxa3xx-nand driver to a module, where upon -unloading, the wrong clock was disabled in CKENB. - -Fixes: 9bbb8a338fb2 ("clk: pxa: add pxa3xx clock driver") -Signed-off-by: Robert Jarzmik -Signed-off-by: Stephen Boyd -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/clk/pxa/clk-pxa3xx.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/clk/pxa/clk-pxa3xx.c -+++ b/drivers/clk/pxa/clk-pxa3xx.c -@@ -126,7 +126,7 @@ PARENTS(pxa3xx_ac97_bus) = { "ring_osc_6 - PARENTS(pxa3xx_sbus) = { "ring_osc_60mhz", "system_bus" }; - PARENTS(pxa3xx_smemcbus) = { "ring_osc_60mhz", "smemc" }; - --#define CKEN_AB(bit) ((CKEN_ ## bit > 31) ? &CKENA : &CKENB) -+#define CKEN_AB(bit) ((CKEN_ ## bit > 31) ? &CKENB : &CKENA) - #define PXA3XX_CKEN(dev_id, con_id, parents, mult_lp, div_lp, mult_hp, \ - div_hp, bit, is_lp, flags) \ - PXA_CKEN(dev_id, con_id, bit, parents, mult_lp, div_lp, \ diff --git a/kernel/kernel/files/patches/mageia/stable-clk-qcom-fix-msm8916-prng-clock-enable-bit.patch b/kernel/kernel/files/patches/mageia/stable-clk-qcom-fix-msm8916-prng-clock-enable-bit.patch new file mode 100644 index 00000000..d2d00d7e --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-clk-qcom-fix-msm8916-prng-clock-enable-bit.patch @@ -0,0 +1,32 @@ +From 1c4b4b0eb1909010b8ebda1ef208bf3ed62e7487 Mon Sep 17 00:00:00 2001 +From: Georgi Djakov +Date: Tue, 25 Aug 2015 15:27:43 +0300 +Subject: clk: qcom: Fix MSM8916 prng clock enable bit + +From: Georgi Djakov + +commit 1c4b4b0eb1909010b8ebda1ef208bf3ed62e7487 upstream. + +Fix the enable bit of the pseudorandom number generator clock. + +Reported-by: Stanimir Varbanov +Fixes: 3966fab8b6ab "clk: qcom: Add MSM8916 Global Clock Controller support" +Signed-off-by: Georgi Djakov +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/qcom/gcc-msm8916.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/qcom/gcc-msm8916.c ++++ b/drivers/clk/qcom/gcc-msm8916.c +@@ -2278,7 +2278,7 @@ static struct clk_branch gcc_prng_ahb_cl + .halt_check = BRANCH_HALT_VOTED, + .clkr = { + .enable_reg = 0x45004, +- .enable_mask = BIT(0), ++ .enable_mask = BIT(8), + .hw.init = &(struct clk_init_data){ + .name = "gcc_prng_ahb_clk", + .parent_names = (const char *[]){ diff --git a/kernel/kernel/files/patches/mageia/stable-clk-qcom-set-clk_set_rate_parent-on-ce1-clocks.patch b/kernel/kernel/files/patches/mageia/stable-clk-qcom-set-clk_set_rate_parent-on-ce1-clocks.patch new file mode 100644 index 00000000..2e3f0458 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-clk-qcom-set-clk_set_rate_parent-on-ce1-clocks.patch @@ -0,0 +1,45 @@ +From d7a304e9d018c99dda80f4c16ec0fe817b5be4a1 Mon Sep 17 00:00:00 2001 +From: Stephen Boyd +Date: Tue, 14 Jul 2015 16:57:29 -0700 +Subject: clk: qcom: Set CLK_SET_RATE_PARENT on ce1 clocks + +From: Stephen Boyd + +commit d7a304e9d018c99dda80f4c16ec0fe817b5be4a1 upstream. + +The other ce clocks have the flag set, but ce1 doesn't, so +clk_set_rate() doesn't propagate up the tree to the ce1_src_clk. +Set the flag as this is supported. + +Reported-by: Bjorn Andersson +Tested-by: Bjorn Andersson +Fixes: 02824653200b ("clk: qcom: Add APQ8084 Global Clock Controller support") +Fixes: d33faa9ead8d ("clk: qcom: Add support for MSM8974's global clock controller (GCC)") +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/qcom/gcc-apq8084.c | 1 + + drivers/clk/qcom/gcc-msm8974.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/clk/qcom/gcc-apq8084.c ++++ b/drivers/clk/qcom/gcc-apq8084.c +@@ -2105,6 +2105,7 @@ static struct clk_branch gcc_ce1_clk = { + "ce1_clk_src", + }, + .num_parents = 1, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +--- a/drivers/clk/qcom/gcc-msm8974.c ++++ b/drivers/clk/qcom/gcc-msm8974.c +@@ -1783,6 +1783,7 @@ static struct clk_branch gcc_ce1_clk = { + "ce1_clk_src", + }, + .num_parents = 1, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, diff --git a/kernel/kernel/files/patches/mageia/stable-clk-rockchip-rk3288-add-clk_set_rate_parent-to-sclk_mac.patch b/kernel/kernel/files/patches/mageia/stable-clk-rockchip-rk3288-add-clk_set_rate_parent-to-sclk_mac.patch new file mode 100644 index 00000000..0b070dc1 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-clk-rockchip-rk3288-add-clk_set_rate_parent-to-sclk_mac.patch @@ -0,0 +1,39 @@ +From 4791eb61dbe8100ccac59fecfac9d93a15db1447 Mon Sep 17 00:00:00 2001 +From: Heiko Stuebner +Date: Thu, 18 Jun 2015 16:18:28 +0200 +Subject: clk: rockchip: rk3288: add CLK_SET_RATE_PARENT to sclk_mac + +From: Heiko Stuebner + +commit 4791eb61dbe8100ccac59fecfac9d93a15db1447 upstream. + +The dwmac ethernet controller on the rk3288 supports phys connected +via rgmii and rmii. With rgmii phys it is expected that the mac clock +is provided externally while with rmii phys the clock can be external +but also generated from the plls. In the later case it of course needs +be at 50MHz, which gets set from the dwmac_rk driver. +As most devices use a rgmii phy it never surfaced so far that the mac +clk mux, doesn't go up one lever to the pll clock in the rmii case with +internal clock generation, as it is missing the CLK_SET_RATE_PARENT flag, +and thus will not set the correct frequency in most cases. + +Fixes: b9e4ba541607 ("clk: rockchip: add clock controller for rk3288") +Signed-off-by: Heiko Stuebner +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/rockchip/clk-rk3288.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/rockchip/clk-rk3288.c ++++ b/drivers/clk/rockchip/clk-rk3288.c +@@ -578,7 +578,7 @@ static struct rockchip_clk_branch rk3288 + COMPOSITE(0, "mac_pll_src", mux_pll_src_npll_cpll_gpll_p, 0, + RK3288_CLKSEL_CON(21), 0, 2, MFLAGS, 8, 5, DFLAGS, + RK3288_CLKGATE_CON(2), 5, GFLAGS), +- MUX(SCLK_MAC, "mac_clk", mux_mac_p, 0, ++ MUX(SCLK_MAC, "mac_clk", mux_mac_p, CLK_SET_RATE_PARENT, + RK3288_CLKSEL_CON(21), 4, 1, MFLAGS), + GATE(SCLK_MACREF_OUT, "sclk_macref_out", "mac_clk", 0, + RK3288_CLKGATE_CON(5), 3, GFLAGS), diff --git a/kernel/kernel/files/patches/mageia/stable-clk-s5pv210-add-missing-call-to.patch b/kernel/kernel/files/patches/mageia/stable-clk-s5pv210-add-missing-call-to.patch new file mode 100644 index 00000000..fb96a551 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-clk-s5pv210-add-missing-call-to.patch @@ -0,0 +1,37 @@ +From ba30011577330b7e29ecb5916d89c6db9fbc5b3d Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Wed, 12 Aug 2015 10:58:22 +0200 +Subject: clk: s5pv210: add missing call to + samsung_clk_of_add_provider() + +From: Marek Szyprowski + +commit ba30011577330b7e29ecb5916d89c6db9fbc5b3d upstream. + +Commit d5e136a21b2028fb1f45143ea7112d5869bfc6c7 ("clk: samsung: Register +clk provider only after registering its all clocks", merged to v3.17-rc1) +modified a way that driver registers registers to core framework. This +change has not been applied to s5pv210 clocks driver, which has been +merged in parallel to that commit. This patch adds a missing call to +samsung_clk_of_add_provider(), so the driver is operational again. + +Signed-off-by: Marek Szyprowski +Acked-by: Tomasz Figa +Signed-off-by: Michael Turquette +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/samsung/clk-s5pv210.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/clk/samsung/clk-s5pv210.c ++++ b/drivers/clk/samsung/clk-s5pv210.c +@@ -828,6 +828,8 @@ static void __init __s5pv210_clk_init(st + + s5pv210_clk_sleep_init(); + ++ samsung_clk_of_add_provider(np, ctx); ++ + pr_info("%s clocks: mout_apll = %ld, mout_mpll = %ld\n" + "\tmout_epll = %ld, mout_vpll = %ld\n", + is_s5p6442 ? "S5P6442" : "S5PV210", diff --git a/kernel/kernel/files/patches/mageia/stable-clk-versatile-off-by-one-in-clk_sp810_timerclken_of_get.patch b/kernel/kernel/files/patches/mageia/stable-clk-versatile-off-by-one-in-clk_sp810_timerclken_of_get.patch new file mode 100644 index 00000000..dcd5f48d --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-clk-versatile-off-by-one-in-clk_sp810_timerclken_of_get.patch @@ -0,0 +1,34 @@ +From 3294bee87091be5f179474f6c39d1d87769635e2 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 29 Jul 2015 13:17:06 +0300 +Subject: clk: versatile: off by one in clk_sp810_timerclken_of_get() + +From: Dan Carpenter + +commit 3294bee87091be5f179474f6c39d1d87769635e2 upstream. + +The ">" should be ">=" or we end up reading beyond the end of the array. + +Fixes: 6e973d2c4385 ('clk: vexpress: Add separate SP810 driver') +Signed-off-by: Dan Carpenter +Acked-by: Pawel Moll +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/versatile/clk-sp810.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/clk/versatile/clk-sp810.c ++++ b/drivers/clk/versatile/clk-sp810.c +@@ -128,8 +128,8 @@ static struct clk *clk_sp810_timerclken_ + { + struct clk_sp810 *sp810 = data; + +- if (WARN_ON(clkspec->args_count != 1 || clkspec->args[0] > +- ARRAY_SIZE(sp810->timerclken))) ++ if (WARN_ON(clkspec->args_count != 1 || ++ clkspec->args[0] >= ARRAY_SIZE(sp810->timerclken))) + return NULL; + + return sp810->timerclken[clkspec->args[0]].clk; diff --git a/kernel/kernel/files/patches/mageia/stable-dm-thin-metadata-delete-btrees-when-releasing-metadata-snapshot.patch b/kernel/kernel/files/patches/mageia/stable-dm-thin-metadata-delete-btrees-when-releasing-metadata-snapshot.patch deleted file mode 100644 index 3f3678c8..00000000 --- a/kernel/kernel/files/patches/mageia/stable-dm-thin-metadata-delete-btrees-when-releasing-metadata-snapshot.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 7f518ad0a212e2a6fd68630e176af1de395070a7 Mon Sep 17 00:00:00 2001 -From: Joe Thornber -Date: Wed, 12 Aug 2015 15:10:21 +0100 -Subject: dm thin metadata: delete btrees when releasing metadata snapshot - -From: Joe Thornber - -commit 7f518ad0a212e2a6fd68630e176af1de395070a7 upstream. - -The device details and mapping trees were just being decremented -before. Now btree_del() is called to do a deep delete. - -Signed-off-by: Joe Thornber -Signed-off-by: Mike Snitzer -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/md/dm-thin-metadata.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/md/dm-thin-metadata.c -+++ b/drivers/md/dm-thin-metadata.c -@@ -1295,8 +1295,8 @@ static int __release_metadata_snap(struc - return r; - - disk_super = dm_block_data(copy); -- dm_sm_dec_block(pmd->metadata_sm, le64_to_cpu(disk_super->data_mapping_root)); -- dm_sm_dec_block(pmd->metadata_sm, le64_to_cpu(disk_super->device_details_root)); -+ dm_btree_del(&pmd->info, le64_to_cpu(disk_super->data_mapping_root)); -+ dm_btree_del(&pmd->details_info, le64_to_cpu(disk_super->device_details_root)); - dm_sm_dec_block(pmd->metadata_sm, held_root); - - return dm_tm_unlock(pmd->tm, copy); diff --git a/kernel/kernel/files/patches/mageia/stable-doc-usb-gadget-testing-using-the-updated-testusb.c.patch b/kernel/kernel/files/patches/mageia/stable-doc-usb-gadget-testing-using-the-updated-testusb.c.patch new file mode 100644 index 00000000..0864b1a3 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-doc-usb-gadget-testing-using-the-updated-testusb.c.patch @@ -0,0 +1,44 @@ +From f811a38300be3cdb603171aea5ad3fb42b71ca53 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Fri, 31 Jul 2015 16:36:30 +0800 +Subject: doc: usb: gadget-testing: using the updated testusb.c + +From: Peter Chen + +commit f811a38300be3cdb603171aea5ad3fb42b71ca53 upstream. + +testusb.c at http://www.linux-usb.org/usbtest/ is out of date, +using the one at the kernel source folder. + +Signed-off-by: Peter Chen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/usb/gadget-testing.txt | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +--- a/Documentation/usb/gadget-testing.txt ++++ b/Documentation/usb/gadget-testing.txt +@@ -237,9 +237,7 @@ Testing the LOOPBACK function + ----------------------------- + + device: run the gadget +-host: test-usb +- +-http://www.linux-usb.org/usbtest/testusb.c ++host: test-usb (tools/usb/testusb.c) + + 8. MASS STORAGE function + ======================== +@@ -588,9 +586,8 @@ Testing the SOURCESINK function + ------------------------------- + + device: run the gadget +-host: test-usb ++host: test-usb (tools/usb/testusb.c) + +-http://www.linux-usb.org/usbtest/testusb.c + + 16. UAC1 function + ================= diff --git a/kernel/kernel/files/patches/mageia/stable-drm-i915-allow-dsi-dual-link-to-be-configured-on-any-pipe.patch b/kernel/kernel/files/patches/mageia/stable-drm-i915-allow-dsi-dual-link-to-be-configured-on-any-pipe.patch new file mode 100644 index 00000000..c545c5a9 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-i915-allow-dsi-dual-link-to-be-configured-on-any-pipe.patch @@ -0,0 +1,58 @@ +From 824257857fd81f5e749831ff9cd63566b5a86abe Mon Sep 17 00:00:00 2001 +From: Gaurav K Singh +Date: Mon, 3 Aug 2015 15:45:32 +0530 +Subject: drm/i915: Allow DSI dual link to be configured on any pipe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Gaurav K Singh + +commit 824257857fd81f5e749831ff9cd63566b5a86abe upstream. + +Just like single link MIPI panels, similarly for dual link panels, pipe +to be configured is based on the DVO port from VBT Block 2. In hardware, +Port A is mapped with Pipe A and Port C is mapped with Pipe B. + +This issue got introduced in - + +commit 7e9804fdcffc650515c60f524b8b2076ee59e710 +Author: Jani Nikula +Date: Fri Jan 16 14:27:23 2015 +0200 + + drm/i915/dsi: add drm mipi dsi host support + +Signed-off-by: Gaurav K Singh +Reviewed-by: Ville Syrjälä +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_dsi.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_dsi.c ++++ b/drivers/gpu/drm/i915/intel_dsi.c +@@ -1036,11 +1036,7 @@ void intel_dsi_init(struct drm_device *d + intel_connector->unregister = intel_connector_unregister; + + /* Pipe A maps to MIPI DSI port A, pipe B maps to MIPI DSI port C */ +- if (dev_priv->vbt.dsi.config->dual_link) { +- /* XXX: does dual link work on either pipe? */ +- intel_encoder->crtc_mask = (1 << PIPE_A); +- intel_dsi->ports = ((1 << PORT_A) | (1 << PORT_C)); +- } else if (dev_priv->vbt.dsi.port == DVO_PORT_MIPIA) { ++ if (dev_priv->vbt.dsi.port == DVO_PORT_MIPIA) { + intel_encoder->crtc_mask = (1 << PIPE_A); + intel_dsi->ports = (1 << PORT_A); + } else if (dev_priv->vbt.dsi.port == DVO_PORT_MIPIC) { +@@ -1048,6 +1044,9 @@ void intel_dsi_init(struct drm_device *d + intel_dsi->ports = (1 << PORT_C); + } + ++ if (dev_priv->vbt.dsi.config->dual_link) ++ intel_dsi->ports = ((1 << PORT_A) | (1 << PORT_C)); ++ + /* Create a DSI host (and a device) for each port. */ + for_each_dsi_port(port, intel_dsi->ports) { + struct intel_dsi_host *host; diff --git a/kernel/kernel/files/patches/mageia/stable-drm-i915-always-mark-the-object-as-dirty-when-used-by-the-gpu.patch b/kernel/kernel/files/patches/mageia/stable-drm-i915-always-mark-the-object-as-dirty-when-used-by-the-gpu.patch new file mode 100644 index 00000000..59d9b821 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-i915-always-mark-the-object-as-dirty-when-used-by-the-gpu.patch @@ -0,0 +1,58 @@ +From 51bc140431e233284660b1d22c47dec9ecdb521e Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 31 Aug 2015 15:10:39 +0100 +Subject: drm/i915: Always mark the object as dirty when used by the GPU +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chris Wilson + +commit 51bc140431e233284660b1d22c47dec9ecdb521e upstream. + +There have been many hard to track down bugs whereby userspace forgot to +flag a write buffer and then cause graphics corruption or a hung GPU +when that buffer was later purged under memory pressure (as the buffer +appeared clean, its pages would have been evicted rather than preserved +and any changes more recent than in the backing storage would be lost). +In retrospect this is a rare optimisation against memory pressure, +already the slow path. If we always mark the buffer as dirty when +accessed by the GPU, anything not used can still be evicted cheaply +(ideal behaviour for mark-and-sweep eviction) but we do not run the risk +of corruption. For correct read serialisation, userspace still has to +notify when the GPU writes to an object. However, there are certain +situations under which userspace may wish to tell white lies to the +kernel... + +Signed-off-by: Chris Wilson +Cc: Daniel Vetter +Cc: Kristian Høgsberg +Cc: Jesse Barnes +Cc: "Goel, Akash" +Cc: Michał Winiarski +Reviewed-by: Daniel Vetter +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_gem_execbuffer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +@@ -1025,6 +1025,7 @@ i915_gem_execbuffer_move_to_active(struc + u32 old_read = obj->base.read_domains; + u32 old_write = obj->base.write_domain; + ++ obj->dirty = 1; /* be paranoid */ + obj->base.write_domain = obj->base.pending_write_domain; + if (obj->base.write_domain == 0) + obj->base.pending_read_domains |= obj->base.read_domains; +@@ -1032,7 +1033,6 @@ i915_gem_execbuffer_move_to_active(struc + + i915_vma_move_to_active(vma, ring); + if (obj->base.write_domain) { +- obj->dirty = 1; + i915_gem_request_assign(&obj->last_write_req, req); + + intel_fb_obj_invalidate(obj, ring, ORIGIN_CS); diff --git a/kernel/kernel/files/patches/mageia/stable-drm-i915-apply-the-pci_d0-d3-hibernation-workaround-everywhere-on-pre-gen6.patch b/kernel/kernel/files/patches/mageia/stable-drm-i915-apply-the-pci_d0-d3-hibernation-workaround-everywhere-on-pre-gen6.patch new file mode 100644 index 00000000..b425285d --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-i915-apply-the-pci_d0-d3-hibernation-workaround-everywhere-on-pre-gen6.patch @@ -0,0 +1,79 @@ +From 54875571bbfde00fc63741715c531cbb5246c3b2 Mon Sep 17 00:00:00 2001 +From: Imre Deak +Date: Tue, 30 Jun 2015 17:06:47 +0300 +Subject: drm/i915: apply the PCI_D0/D3 hibernation workaround everywhere on pre GEN6 + +From: Imre Deak + +commit 54875571bbfde00fc63741715c531cbb5246c3b2 upstream. + +commit da2bc1b9db3351addd293e5b82757efe1f77ed1d +Author: Imre Deak +Date: Thu Oct 23 19:23:26 2014 +0300 + + drm/i915: add poweroff_late handler + +introduced a regression on old platforms during hibernation. A workaround was +added in + +commit ab3be73fa7b43f4c3648ce29b5fd649ea54d3adb +Author: Imre Deak +Date: Mon Mar 2 13:04:41 2015 +0200 + + drm/i915: gen4: work around hang during hibernation + +using an explicit blacklist for the GENs/BIOS vendors where the issue was +reported. Later there we had reports of the same failure on platforms not on +this list. + +To my best knowledge the correct thing to do is still to put the device to PCI +D3 state during hibernation, see [1] and [2] for the reasons. This also aligns +with our future plans to unify more the runtime and system suspend/resume +paths. Since an exact blacklist seems to be impractical (multiple GENs and +BIOS vendors are affected) apply the workaround on everything pre GEN6. + +[1] http://lists.freedesktop.org/archives/intel-gfx/2015-February/060710.html +[2] https://lkml.org/lkml/2015/6/22/274 + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=95061 +Reported-by: Ilya Tumaykin +Reported-by: Dirk Griesbach +Reported-by: Pavel Machek +Reported-by: Mikko Rapeli +Tested-by: Mikko Rapeli +Reported-by: Paul Bolle +Signed-off-by: Imre Deak +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_drv.c ++++ b/drivers/gpu/drm/i915/i915_drv.c +@@ -647,15 +647,18 @@ static int i915_drm_suspend_late(struct + + pci_disable_device(drm_dev->pdev); + /* +- * During hibernation on some GEN4 platforms the BIOS may try to access ++ * During hibernation on some platforms the BIOS may try to access + * the device even though it's already in D3 and hang the machine. So + * leave the device in D0 on those platforms and hope the BIOS will +- * power down the device properly. Platforms where this was seen: +- * Lenovo Thinkpad X301, X61s ++ * power down the device properly. The issue was seen on multiple old ++ * GENs with different BIOS vendors, so having an explicit blacklist ++ * is inpractical; apply the workaround on everything pre GEN6. The ++ * platforms where the issue was seen: ++ * Lenovo Thinkpad X301, X61s, X60, T60, X41 ++ * Fujitsu FSC S7110 ++ * Acer Aspire 1830T + */ +- if (!(hibernation && +- drm_dev->pdev->subsystem_vendor == PCI_VENDOR_ID_LENOVO && +- INTEL_INFO(dev_priv)->gen == 4)) ++ if (!(hibernation && INTEL_INFO(dev_priv)->gen < 6)) + pci_set_power_state(drm_dev->pdev, PCI_D3hot); + + return 0; diff --git a/kernel/kernel/files/patches/mageia/stable-drm-i915-check-dp-link-status-on-long-hpd-too.patch b/kernel/kernel/files/patches/mageia/stable-drm-i915-check-dp-link-status-on-long-hpd-too.patch new file mode 100644 index 00000000..fd5d79d6 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-i915-check-dp-link-status-on-long-hpd-too.patch @@ -0,0 +1,75 @@ +From d14e7b6d1d8747826cb900db852351c550e00fdd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Thu, 20 Aug 2015 19:37:29 +0300 +Subject: drm/i915: Check DP link status on long hpd too +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= + +commit d14e7b6d1d8747826cb900db852351c550e00fdd upstream. + +We are no longer checkling the DP link status on long hpd. We used to do +that from the .hot_plug() handler, but it was removed when MST got +introduced. + +If there's no userspace we now fail to retrain the link if the sink +power is toggled (or cable yanked and replugged), meaning the user is +left staring at a blank screen. With the retraining put back that should +be fixed. + +Also remove the leftover comment that referred to the old retraining +from .hot_plug(). + +Fixes a regression introduced in: +commit 0e32b39ceed665bfa4a77a4bc307b6652b991632 +Author: Dave Airlie +Date: Fri May 2 14:02:48 2014 +1000 + + drm/i915: add DP 1.2 MST support (v0.7) + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=89453 +Tested-by: Palmer Dabbelt +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91407 +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=89461 +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=89594 +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=85641 +Cc: Dave Airlie +Signed-off-by: Ville Syrjälä +Reviewed-by: Daniel Vetter +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_dp.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -4691,9 +4691,12 @@ intel_dp_hpd_pulse(struct intel_digital_ + + intel_dp_probe_oui(intel_dp); + +- if (!intel_dp_probe_mst(intel_dp)) ++ if (!intel_dp_probe_mst(intel_dp)) { ++ drm_modeset_lock(&dev->mode_config.connection_mutex, NULL); ++ intel_dp_check_link_status(intel_dp); ++ drm_modeset_unlock(&dev->mode_config.connection_mutex); + goto mst_fail; +- ++ } + } else { + if (intel_dp->is_mst) { + if (intel_dp_check_mst_status(intel_dp) == -EINVAL) +@@ -4701,10 +4704,6 @@ intel_dp_hpd_pulse(struct intel_digital_ + } + + if (!intel_dp->is_mst) { +- /* +- * we'll check the link status via the normal hot plug path later - +- * but for short hpds we should check it now +- */ + drm_modeset_lock(&dev->mode_config.connection_mutex, NULL); + intel_dp_check_link_status(intel_dp); + drm_modeset_unlock(&dev->mode_config.connection_mutex); diff --git a/kernel/kernel/files/patches/mageia/stable-drm-i915-limit-the-number-of-loops-for-reading-a-split-64bit-register.patch b/kernel/kernel/files/patches/mageia/stable-drm-i915-limit-the-number-of-loops-for-reading-a-split-64bit-register.patch new file mode 100644 index 00000000..8dd737f1 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-i915-limit-the-number-of-loops-for-reading-a-split-64bit-register.patch @@ -0,0 +1,57 @@ +From acd29f7b22262d9e848393b9b6ae13eb42d22514 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Tue, 8 Sep 2015 14:17:13 +0100 +Subject: drm/i915: Limit the number of loops for reading a split 64bit register +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chris Wilson + +commit acd29f7b22262d9e848393b9b6ae13eb42d22514 upstream. + +In I915_READ64_2x32 we attempt to read a 64bit register using 2 32bit +reads. Due to the nature of the registers we try to read in this manner, +they may increment between the two instruction (e.g. a timestamp +counter). To keep the result accurate, we repeat the read if we detect +an overflow (i.e. the upper value varies). However, some hardware is just +plain flaky and may endless loop as the the upper 32bits are not stable. +Just give up after a couple of tries and report whatever we read last. + +v2: Use the most recent values when erring out on an unstable register. + +Reported-by: russianneuromancer@ya.ru +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91906 +Signed-off-by: Chris Wilson +Cc: Michał Winiarski +Cc: Daniel Vetter +Cc: Jani Nikula +Reviewed-by: Daniel Vetter +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.h | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -3190,13 +3190,13 @@ int intel_freq_opcode(struct drm_i915_pr + #define I915_READ64(reg) dev_priv->uncore.funcs.mmio_readq(dev_priv, (reg), true) + + #define I915_READ64_2x32(lower_reg, upper_reg) ({ \ +- u32 upper, lower, tmp; \ +- tmp = I915_READ(upper_reg); \ ++ u32 upper, lower, old_upper, loop = 0; \ ++ upper = I915_READ(upper_reg); \ + do { \ +- upper = tmp; \ ++ old_upper = upper; \ + lower = I915_READ(lower_reg); \ +- tmp = I915_READ(upper_reg); \ +- } while (upper != tmp); \ ++ upper = I915_READ(upper_reg); \ ++ } while (upper != old_upper && loop++ < 2); \ + (u64)upper << 32 | lower; }) + + #define POSTING_READ(reg) (void)I915_READ_NOTRACE(reg) diff --git a/kernel/kernel/files/patches/mageia/stable-drm-i915-preserve-ssc-earlier.patch b/kernel/kernel/files/patches/mageia/stable-drm-i915-preserve-ssc-earlier.patch new file mode 100644 index 00000000..ba74fa2d --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-i915-preserve-ssc-earlier.patch @@ -0,0 +1,117 @@ +From 69f92f67b68ab7028ffe15f0eea76b59f8859383 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Wed, 15 Jul 2015 13:57:35 +0200 +Subject: drm/i915: Preserve SSC earlier + +From: Lukas Wunner + +commit 69f92f67b68ab7028ffe15f0eea76b59f8859383 upstream. + +Commit 92122789b2d6 ("drm/i915: preserve SSC if previously set v3") +added code to intel_modeset_gem_init to override the SSC status read +from VBT with the SSC status set by BIOS. + +However, intel_modeset_gem_init is invoked *after* intel_modeset_init, +which calls intel_setup_outputs, which *modifies* SSC status by way of +intel_init_pch_refclk. So unlike advertised, intel_modeset_gem_init +doesn't preserve the SSC status set by BIOS but whatever +intel_init_pch_refclk decided on. + +This is a problem on dual gpu laptops such as the MacBook Pro which +require either a handler to switch DDC lines, or the discrete gpu +to proxy DDC/AUX communication: Both the handler and the discrete +gpu may initialize after the i915 driver, and consequently, an LVDS +connector may initially seem disconnected and the SSC therefore +is disabled by intel_init_pch_refclk, but on reprobe the connector +may turn out to be connected and the SSC must then be enabled. + +Due to 92122789b2d6 however, the SSC is not enabled on reprobe since +it is assumed BIOS disabled it while in fact it was disabled by +intel_init_pch_refclk. + +Also, because the SSC status is preserved so late, the preserved value +only ever gets used on resume but not on panel initialization: +intel_modeset_init calls intel_init_display which indirectly calls +intel_panel_use_ssc via multiple subroutines, *before* the BIOS value +overrides the VBT value in intel_modeset_gem_init (intel_panel_use_ssc +is the sole user of dev_priv->vbt.lvds_use_ssc). + +Fix this by moving the code introduced by 92122789b2d6 from +intel_modeset_gem_init to intel_modeset_init before the invocation +of intel_setup_outputs and intel_init_display. + +Add a DRM_DEBUG_KMS as suggested way back by Jani: +http://lists.freedesktop.org/archives/intel-gfx/2014-June/046666.html + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88861 +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=61115 +Tested-by: Paul Hordiienko + [MBP 6,2 2010 intel ILK + nvidia GT216 pre-retina] +Tested-by: William Brown + [MBP 8,2 2011 intel SNB + amd turks pre-retina] +Tested-by: Lukas Wunner + [MBP 9,1 2012 intel IVB + nvidia GK107 pre-retina] +Tested-by: Bruno Bierbaumer + [MBP 11,3 2013 intel HSW + nvidia GK107 retina -- work in progress] +Fixes: 92122789b2d6 ("drm/i915: preserve SSC if previously set v3") +Signed-off-by: Lukas Wunner +Reviewed-by: Jesse Barnes +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_display.c | 29 ++++++++++++++++++----------- + 1 file changed, 18 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -13781,6 +13781,24 @@ void intel_modeset_init(struct drm_devic + if (INTEL_INFO(dev)->num_pipes == 0) + return; + ++ /* ++ * There may be no VBT; and if the BIOS enabled SSC we can ++ * just keep using it to avoid unnecessary flicker. Whereas if the ++ * BIOS isn't using it, don't assume it will work even if the VBT ++ * indicates as much. ++ */ ++ if (HAS_PCH_IBX(dev) || HAS_PCH_CPT(dev)) { ++ bool bios_lvds_use_ssc = !!(I915_READ(PCH_DREF_CONTROL) & ++ DREF_SSC1_ENABLE); ++ ++ if (dev_priv->vbt.lvds_use_ssc != bios_lvds_use_ssc) { ++ DRM_DEBUG_KMS("SSC %sabled by BIOS, overriding VBT which says %sabled\n", ++ bios_lvds_use_ssc ? "en" : "dis", ++ dev_priv->vbt.lvds_use_ssc ? "en" : "dis"); ++ dev_priv->vbt.lvds_use_ssc = bios_lvds_use_ssc; ++ } ++ } ++ + intel_init_display(dev); + intel_init_audio(dev); + +@@ -14266,7 +14284,6 @@ void intel_modeset_setup_hw_state(struct + + void intel_modeset_gem_init(struct drm_device *dev) + { +- struct drm_i915_private *dev_priv = dev->dev_private; + struct drm_crtc *c; + struct drm_i915_gem_object *obj; + int ret; +@@ -14275,16 +14292,6 @@ void intel_modeset_gem_init(struct drm_d + intel_init_gt_powersave(dev); + mutex_unlock(&dev->struct_mutex); + +- /* +- * There may be no VBT; and if the BIOS enabled SSC we can +- * just keep using it to avoid unnecessary flicker. Whereas if the +- * BIOS isn't using it, don't assume it will work even if the VBT +- * indicates as much. +- */ +- if (HAS_PCH_IBX(dev) || HAS_PCH_CPT(dev)) +- dev_priv->vbt.lvds_use_ssc = !!(I915_READ(PCH_DREF_CONTROL) & +- DREF_SSC1_ENABLE); +- + intel_modeset_init_hw(dev); + + intel_setup_overlay(dev); diff --git a/kernel/kernel/files/patches/mageia/stable-drm-qxl-validate-monitors-config-modes.patch b/kernel/kernel/files/patches/mageia/stable-drm-qxl-validate-monitors-config-modes.patch new file mode 100644 index 00000000..2ee9e873 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-qxl-validate-monitors-config-modes.patch @@ -0,0 +1,147 @@ +From bd3e1c7c6de9f5f70d97cdb6c817151c0477c5e3 Mon Sep 17 00:00:00 2001 +From: Jonathon Jongsma +Date: Thu, 20 Aug 2015 14:04:32 -0500 +Subject: drm/qxl: validate monitors config modes + +From: Jonathon Jongsma + +commit bd3e1c7c6de9f5f70d97cdb6c817151c0477c5e3 upstream. + +Due to some recent changes in +drm_helper_probe_single_connector_modes_merge_bits(), old custom modes +were not being pruned properly. In current kernels, +drm_mode_validate_basic() is called to sanity-check each mode in the +list. If the sanity-check passes, the mode's status gets set to to +MODE_OK. In older kernels this check was not done, so old custom modes +would still have a status of MODE_UNVERIFIED at this point, and would +therefore be pruned later in the function. + +As a result of this new behavior, the list of modes for a device always +includes every custom mode ever configured for the device, with the +largest one listed first. Since desktop environments usually choose the +first preferred mode when a hotplug event is emitted, this had the +result of making it very difficult for the user to reduce the size of +the display. + +The qxl driver did implement the mode_valid connector function, but it +was empty. In order to restore the old behavior where old custom modes +are pruned, we implement a proper mode_valid function for the qxl +driver. This function now checks each mode against the last configured +custom mode and the list of standard modes. If the mode doesn't match +any of these, its status is set to MODE_BAD so that it will be pruned as +expected. + +Signed-off-by: Jonathon Jongsma +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/qxl/qxl_display.c | 66 +++++++++++++++++++++++--------------- + drivers/gpu/drm/qxl/qxl_drv.h | 2 + + 2 files changed, 42 insertions(+), 26 deletions(-) + +--- a/drivers/gpu/drm/qxl/qxl_display.c ++++ b/drivers/gpu/drm/qxl/qxl_display.c +@@ -160,9 +160,35 @@ static int qxl_add_monitors_config_modes + *pwidth = head->width; + *pheight = head->height; + drm_mode_probed_add(connector, mode); ++ /* remember the last custom size for mode validation */ ++ qdev->monitors_config_width = mode->hdisplay; ++ qdev->monitors_config_height = mode->vdisplay; + return 1; + } + ++static struct mode_size { ++ int w; ++ int h; ++} common_modes[] = { ++ { 640, 480}, ++ { 720, 480}, ++ { 800, 600}, ++ { 848, 480}, ++ {1024, 768}, ++ {1152, 768}, ++ {1280, 720}, ++ {1280, 800}, ++ {1280, 854}, ++ {1280, 960}, ++ {1280, 1024}, ++ {1440, 900}, ++ {1400, 1050}, ++ {1680, 1050}, ++ {1600, 1200}, ++ {1920, 1080}, ++ {1920, 1200} ++}; ++ + static int qxl_add_common_modes(struct drm_connector *connector, + unsigned pwidth, + unsigned pheight) +@@ -170,29 +196,6 @@ static int qxl_add_common_modes(struct d + struct drm_device *dev = connector->dev; + struct drm_display_mode *mode = NULL; + int i; +- struct mode_size { +- int w; +- int h; +- } common_modes[] = { +- { 640, 480}, +- { 720, 480}, +- { 800, 600}, +- { 848, 480}, +- {1024, 768}, +- {1152, 768}, +- {1280, 720}, +- {1280, 800}, +- {1280, 854}, +- {1280, 960}, +- {1280, 1024}, +- {1440, 900}, +- {1400, 1050}, +- {1680, 1050}, +- {1600, 1200}, +- {1920, 1080}, +- {1920, 1200} +- }; +- + for (i = 0; i < ARRAY_SIZE(common_modes); i++) { + mode = drm_cvt_mode(dev, common_modes[i].w, common_modes[i].h, + 60, false, false, false); +@@ -823,11 +826,22 @@ static int qxl_conn_get_modes(struct drm + static int qxl_conn_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { ++ struct drm_device *ddev = connector->dev; ++ struct qxl_device *qdev = ddev->dev_private; ++ int i; ++ + /* TODO: is this called for user defined modes? (xrandr --add-mode) + * TODO: check that the mode fits in the framebuffer */ +- DRM_DEBUG("%s: %dx%d status=%d\n", mode->name, mode->hdisplay, +- mode->vdisplay, mode->status); +- return MODE_OK; ++ ++ if(qdev->monitors_config_width == mode->hdisplay && ++ qdev->monitors_config_height == mode->vdisplay) ++ return MODE_OK; ++ ++ for (i = 0; i < ARRAY_SIZE(common_modes); i++) { ++ if (common_modes[i].w == mode->hdisplay && common_modes[i].h == mode->vdisplay) ++ return MODE_OK; ++ } ++ return MODE_BAD; + } + + static struct drm_encoder *qxl_best_encoder(struct drm_connector *connector) +--- a/drivers/gpu/drm/qxl/qxl_drv.h ++++ b/drivers/gpu/drm/qxl/qxl_drv.h +@@ -325,6 +325,8 @@ struct qxl_device { + struct work_struct fb_work; + + struct drm_property *hotplug_mode_update_property; ++ int monitors_config_width; ++ int monitors_config_height; + }; + + /* forward declaration for QXL_INFO_IO */ diff --git a/kernel/kernel/files/patches/mageia/stable-drm-radeon-add-new-oland-pci-id.patch b/kernel/kernel/files/patches/mageia/stable-drm-radeon-add-new-oland-pci-id.patch deleted file mode 100644 index fc3b4431..00000000 --- a/kernel/kernel/files/patches/mageia/stable-drm-radeon-add-new-oland-pci-id.patch +++ /dev/null @@ -1,26 +0,0 @@ -From e037239e5e7b61007763984aa35a8329596d8c88 Mon Sep 17 00:00:00 2001 -From: Alex Deucher -Date: Mon, 10 Aug 2015 15:28:49 -0400 -Subject: drm/radeon: add new OLAND pci id - -From: Alex Deucher - -commit e037239e5e7b61007763984aa35a8329596d8c88 upstream. - -Signed-off-by: Alex Deucher -Signed-off-by: Greg Kroah-Hartman - ---- - include/drm/drm_pciids.h | 1 + - 1 file changed, 1 insertion(+) - ---- a/include/drm/drm_pciids.h -+++ b/include/drm/drm_pciids.h -@@ -172,6 +172,7 @@ - {0x1002, 0x6610, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x6611, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x6613, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \ -+ {0x1002, 0x6617, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x6620, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x6621, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ - {0x1002, 0x6623, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ diff --git a/kernel/kernel/files/patches/mageia/stable-drm-radeon-atom-send-out-the-full-aux-address.patch b/kernel/kernel/files/patches/mageia/stable-drm-radeon-atom-send-out-the-full-aux-address.patch new file mode 100644 index 00000000..7c961fcb --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-radeon-atom-send-out-the-full-aux-address.patch @@ -0,0 +1,39 @@ +From 3f8340cc72c9a1a4b49bce7802afd7f248400ef5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Thu, 27 Aug 2015 17:23:31 +0300 +Subject: drm/radeon/atom: Send out the full AUX address +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= + +commit 3f8340cc72c9a1a4b49bce7802afd7f248400ef5 upstream. + +AUX addresses are 20 bits long. Send out the entire address instead of +just the low 16 bits. + +Cc: Alex Deucher +Cc: "Christian König" +Signed-off-by: Ville Syrjälä +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/atombios_dp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/radeon/atombios_dp.c ++++ b/drivers/gpu/drm/radeon/atombios_dp.c +@@ -171,8 +171,9 @@ radeon_dp_aux_transfer_atom(struct drm_d + return -E2BIG; + + tx_buf[0] = msg->address & 0xff; +- tx_buf[1] = msg->address >> 8; +- tx_buf[2] = msg->request << 4; ++ tx_buf[1] = (msg->address >> 8) & 0xff; ++ tx_buf[2] = (msg->request << 4) | ++ ((msg->address >> 16) & 0xf); + tx_buf[3] = msg->size ? (msg->size - 1) : 0; + + switch (msg->request & ~DP_AUX_I2C_MOT) { diff --git a/kernel/kernel/files/patches/mageia/stable-drm-radeon-don-t-link-train-displayport-on-hpd-until-we-get-the-dpcd.patch b/kernel/kernel/files/patches/mageia/stable-drm-radeon-don-t-link-train-displayport-on-hpd-until-we-get-the-dpcd.patch new file mode 100644 index 00000000..fee261a2 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-radeon-don-t-link-train-displayport-on-hpd-until-we-get-the-dpcd.patch @@ -0,0 +1,75 @@ +From 924f92bf12bfbef3662619e3ed24a1cea7c1cbcd Mon Sep 17 00:00:00 2001 +From: Stephen Chandler Paul +Date: Fri, 21 Aug 2015 14:16:12 -0400 +Subject: DRM - radeon: Don't link train DisplayPort on HPD until we get the dpcd + +From: Stephen Chandler Paul + +commit 924f92bf12bfbef3662619e3ed24a1cea7c1cbcd upstream. + +Most of the time this isn't an issue since hotplugging an adaptor will +trigger a crtc mode change which in turn, causes the driver to probe +every DisplayPort for a dpcd. However, in cases where hotplugging +doesn't cause a mode change (specifically when one unplugs a monitor +from a DisplayPort connector, then plugs that same monitor back in +seconds later on the same port without any other monitors connected), we +never probe for the dpcd before starting the initial link training. What +happens from there looks like this: + + - GPU has only one monitor connected. It's connected via + DisplayPort, and does not go through an adaptor of any sort. + + - User unplugs DisplayPort connector from GPU. + + - Change in HPD is detected by the driver, we probe every + DisplayPort for a possible connection. + + - Probe the port the user originally had the monitor connected + on for it's dpcd. This fails, and we clear the first (and only + the first) byte of the dpcd to indicate we no longer have a + dpcd for this port. + + - User plugs the previously disconnected monitor back into the + same DisplayPort. + + - radeon_connector_hotplug() is called before everyone else, + and tries to handle the link training. Since only the first + byte of the dpcd is zeroed, the driver is able to complete + link training but does so against the wrong dpcd, causing it + to initialize the link with the wrong settings. + + - Display stays blank (usually), dpcd is probed after the + initial link training, and the driver prints no obvious + messages to the log. + +In theory, since only one byte of the dpcd is chopped off (specifically, +the byte that contains the revision information for DisplayPort), it's +not entirely impossible that this bug may not show on certain monitors. +For instance, the only reason this bug was visible on my ASUS PB238 +monitor was due to the fact that this monitor using the enhanced framing +symbol sequence, the flag for which is ignored if the radeon driver +thinks that the DisplayPort version is below 1.1. + +Signed-off-by: Stephen Chandler Paul +Reviewed-by: Jerome Glisse +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_connectors.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -95,6 +95,11 @@ void radeon_connector_hotplug(struct drm + if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) { + drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); + } else if (radeon_dp_needs_link_train(radeon_connector)) { ++ /* Don't try to start link training before we ++ * have the dpcd */ ++ if (!radeon_dp_getdpcd(radeon_connector)) ++ return; ++ + /* set it to OFF so that drm_helper_connector_dpms() + * won't return immediately since the current state + * is ON at this point. diff --git a/kernel/kernel/files/patches/mageia/stable-drm-radeon-fix-hdmi-quantization_range-for-pre-dce5-asics.patch b/kernel/kernel/files/patches/mageia/stable-drm-radeon-fix-hdmi-quantization_range-for-pre-dce5-asics.patch new file mode 100644 index 00000000..90a2ec0c --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-radeon-fix-hdmi-quantization_range-for-pre-dce5-asics.patch @@ -0,0 +1,47 @@ +From 86b7709d48f0df8796bddd7e1ce45c6fb7a7c6ec Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 27 Aug 2015 09:52:22 -0400 +Subject: drm/radeon: fix HDMI quantization_range for pre-DCE5 asics + +From: Alex Deucher + +commit 86b7709d48f0df8796bddd7e1ce45c6fb7a7c6ec upstream. + +Support for output_csc is only available on DCE5 and newer so +don't mess with the HDMI quantization_range on pre-DCE5 asics. + +bug: +https://bugs.freedesktop.org/show_bug.cgi?id=83226 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_audio.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_audio.c ++++ b/drivers/gpu/drm/radeon/radeon_audio.c +@@ -522,13 +522,15 @@ static int radeon_audio_set_avi_packet(s + return err; + } + +- if (drm_rgb_quant_range_selectable(radeon_connector_edid(connector))) { +- if (radeon_encoder->output_csc == RADEON_OUTPUT_CSC_TVRGB) +- frame.quantization_range = HDMI_QUANTIZATION_RANGE_LIMITED; +- else +- frame.quantization_range = HDMI_QUANTIZATION_RANGE_FULL; +- } else { +- frame.quantization_range = HDMI_QUANTIZATION_RANGE_DEFAULT; ++ if (radeon_encoder->output_csc != RADEON_OUTPUT_CSC_BYPASS) { ++ if (drm_rgb_quant_range_selectable(radeon_connector_edid(connector))) { ++ if (radeon_encoder->output_csc == RADEON_OUTPUT_CSC_TVRGB) ++ frame.quantization_range = HDMI_QUANTIZATION_RANGE_LIMITED; ++ else ++ frame.quantization_range = HDMI_QUANTIZATION_RANGE_FULL; ++ } else { ++ frame.quantization_range = HDMI_QUANTIZATION_RANGE_DEFAULT; ++ } + } + + err = hdmi_avi_infoframe_pack(&frame, buffer, sizeof(buffer)); diff --git a/kernel/kernel/files/patches/mageia/stable-drm-radeon-native-send-out-the-full-aux-address.patch b/kernel/kernel/files/patches/mageia/stable-drm-radeon-native-send-out-the-full-aux-address.patch new file mode 100644 index 00000000..d89b354a --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-radeon-native-send-out-the-full-aux-address.patch @@ -0,0 +1,40 @@ +From 7040c399aea2b0213a9aefd73e507369a6d641d6 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 31 Aug 2015 11:15:05 -0400 +Subject: drm/radeon/native: Send out the full AUX address +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 7040c399aea2b0213a9aefd73e507369a6d641d6 upstream. + +AUX addresses are 20 bits long. Send out the entire address instead of +just the low 16 bits. + +Port of: +drm/radeon/atom: Send out the full AUX address +to radeon non-atom aux path + +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_dp_auxch.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_dp_auxch.c ++++ b/drivers/gpu/drm/radeon/radeon_dp_auxch.c +@@ -116,8 +116,8 @@ radeon_dp_aux_transfer_native(struct drm + AUX_SW_WR_BYTES(bytes)); + + /* write the data header into the registers */ +- /* request, addres, msg size */ +- byte = (msg->request << 4); ++ /* request, address, msg size */ ++ byte = (msg->request << 4) | ((msg->address >> 16) & 0xf); + WREG32(AUX_SW_DATA + aux_offset[instance], + AUX_SW_DATA_MASK(byte) | AUX_SW_AUTOINCREMENT_DISABLE); + diff --git a/kernel/kernel/files/patches/mageia/stable-drm-vmwgfx-fix-execbuf-locking-issues.patch b/kernel/kernel/files/patches/mageia/stable-drm-vmwgfx-fix-execbuf-locking-issues.patch deleted file mode 100644 index c8232310..00000000 --- a/kernel/kernel/files/patches/mageia/stable-drm-vmwgfx-fix-execbuf-locking-issues.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 3e04e2fe6d87807d27521ad6ebb9e7919d628f25 Mon Sep 17 00:00:00 2001 -From: Thomas Hellstrom -Date: Tue, 11 Aug 2015 22:31:17 -0700 -Subject: drm/vmwgfx: Fix execbuf locking issues - -From: Thomas Hellstrom - -commit 3e04e2fe6d87807d27521ad6ebb9e7919d628f25 upstream. - -This addresses two issues that cause problems with viewperf maya-03 in -situation with memory pressure. - -The first issue causes attempts to unreserve buffers if batched -reservation fails due to, for example, a signal pending. While previously -the ttm_eu api was resistant against this type of error, it is no longer -and the lockdep code will complain about attempting to unreserve buffers -that are not reserved. The issue is resolved by avoid calling -ttm_eu_backoff_reservation in the buffer reserve error path. - -The second issue is that the binding_mutex may be held when user-space -fence objects are created and hence during memory reclaims. This may cause -recursive attempts to grab the binding mutex. The issue is resolved by not -holding the binding mutex across fence creation and submission. - -Signed-off-by: Thomas Hellstrom -Reviewed-by: Sinclair Yeh -Signed-off-by: Dave Airlie -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -@@ -2492,7 +2492,7 @@ int vmw_execbuf_process(struct drm_file - ret = ttm_eu_reserve_buffers(&ticket, &sw_context->validate_nodes, - true, NULL); - if (unlikely(ret != 0)) -- goto out_err; -+ goto out_err_nores; - - ret = vmw_validate_buffers(dev_priv, sw_context); - if (unlikely(ret != 0)) -@@ -2536,6 +2536,7 @@ int vmw_execbuf_process(struct drm_file - vmw_resource_relocations_free(&sw_context->res_relocations); - - vmw_fifo_commit(dev_priv, command_size); -+ mutex_unlock(&dev_priv->binding_mutex); - - vmw_query_bo_switch_commit(dev_priv, sw_context); - ret = vmw_execbuf_fence_commands(file_priv, dev_priv, -@@ -2551,7 +2552,6 @@ int vmw_execbuf_process(struct drm_file - DRM_ERROR("Fence submission error. Syncing.\n"); - - vmw_resource_list_unreserve(&sw_context->resource_list, false); -- mutex_unlock(&dev_priv->binding_mutex); - - ttm_eu_fence_buffer_objects(&ticket, &sw_context->validate_nodes, - (void *) fence); diff --git a/kernel/kernel/files/patches/mageia/stable-edac-ppc4xx-access-mci-csrows-array-elements-properly.patch b/kernel/kernel/files/patches/mageia/stable-edac-ppc4xx-access-mci-csrows-array-elements-properly.patch deleted file mode 100644 index bc5b51c9..00000000 --- a/kernel/kernel/files/patches/mageia/stable-edac-ppc4xx-access-mci-csrows-array-elements-properly.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 5c16179b550b9fd8114637a56b153c9768ea06a5 Mon Sep 17 00:00:00 2001 -From: Michael Walle -Date: Tue, 21 Jul 2015 11:00:53 +0200 -Subject: EDAC, ppc4xx: Access mci->csrows array elements properly - -From: Michael Walle - -commit 5c16179b550b9fd8114637a56b153c9768ea06a5 upstream. - -The commit - - de3910eb79ac ("edac: change the mem allocation scheme to - make Documentation/kobject.txt happy") - -changed the memory allocation for the csrows member. But ppc4xx_edac was -forgotten in the patch. Fix it. - -Signed-off-by: Michael Walle -Cc: linux-edac -Cc: Mauro Carvalho Chehab -Link: http://lkml.kernel.org/r/1437469253-8611-1-git-send-email-michael@walle.cc -Signed-off-by: Borislav Petkov -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/edac/ppc4xx_edac.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/edac/ppc4xx_edac.c -+++ b/drivers/edac/ppc4xx_edac.c -@@ -920,7 +920,7 @@ static int ppc4xx_edac_init_csrows(struc - */ - - for (row = 0; row < mci->nr_csrows; row++) { -- struct csrow_info *csi = &mci->csrows[row]; -+ struct csrow_info *csi = mci->csrows[row]; - - /* - * Get the configuration settings for this diff --git a/kernel/kernel/files/patches/mageia/stable-hid-hid-input-fix-accessing-freed-memory-during-device-disconnect.patch b/kernel/kernel/files/patches/mageia/stable-hid-hid-input-fix-accessing-freed-memory-during-device-disconnect.patch deleted file mode 100644 index a1548fe1..00000000 --- a/kernel/kernel/files/patches/mageia/stable-hid-hid-input-fix-accessing-freed-memory-during-device-disconnect.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 0621809e37936e7c2b3eac9165cf2aad7f9189eb Mon Sep 17 00:00:00 2001 -From: Krzysztof Kozlowski -Date: Mon, 3 Aug 2015 14:57:30 +0900 -Subject: HID: hid-input: Fix accessing freed memory during device disconnect - -From: Krzysztof Kozlowski - -commit 0621809e37936e7c2b3eac9165cf2aad7f9189eb upstream. - -During unbinding the driver was dereferencing a pointer to memory -already freed by power_supply_unregister(). - -Driver was freeing its internal description of battery through pointers -stored in power_supply structure. However, because the core owns the -power supply instance, after calling power_supply_unregister() this -memory is freed and the driver cannot access these members. - -Fix this by storing the pointer to internal description of battery in a -local variable before calling power_supply_unregister(), so the pointer -remains valid. - -Signed-off-by: Krzysztof Kozlowski -Reported-by: H.J. Lu -Fixes: 297d716f6260 ("power_supply: Change ownership from driver to core") -Reviewed-by: Dmitry Torokhov -Signed-off-by: Jiri Kosina -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/hid/hid-input.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -462,12 +462,15 @@ out: - - static void hidinput_cleanup_battery(struct hid_device *dev) - { -+ const struct power_supply_desc *psy_desc; -+ - if (!dev->battery) - return; - -+ psy_desc = dev->battery->desc; - power_supply_unregister(dev->battery); -- kfree(dev->battery->desc->name); -- kfree(dev->battery->desc); -+ kfree(psy_desc->name); -+ kfree(psy_desc); - dev->battery = NULL; - } - #else /* !CONFIG_HID_BATTERY_STRENGTH */ diff --git a/kernel/kernel/files/patches/mageia/stable-hid-uclogic-fix-limit-in-uclogic_tablet_enable.patch b/kernel/kernel/files/patches/mageia/stable-hid-uclogic-fix-limit-in-uclogic_tablet_enable.patch deleted file mode 100644 index 54b4f47c..00000000 --- a/kernel/kernel/files/patches/mageia/stable-hid-uclogic-fix-limit-in-uclogic_tablet_enable.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 4a8e70f5d0d80675fc17b9ba1e62db8ca6b91775 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter -Date: Wed, 29 Jul 2015 13:16:06 +0300 -Subject: HID: uclogic: fix limit in uclogic_tablet_enable() - -From: Dan Carpenter - -commit 4a8e70f5d0d80675fc17b9ba1e62db8ca6b91775 upstream. - -The limit should be ARRAY_SIZE(params) (5 elements) here instead of -sizeof(params) (20 bytes). - -Fixes: 08177f40bd00 ('HID: uclogic: merge hid-huion driver in hid-uclogic') -Signed-off-by: Dan Carpenter -Reviewed-by: Nikolai Kondrashov -Signed-off-by: Jiri Kosina -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/hid/hid-uclogic.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/hid/hid-uclogic.c -+++ b/drivers/hid/hid-uclogic.c -@@ -858,7 +858,7 @@ static int uclogic_tablet_enable(struct - for (p = drvdata->rdesc; - p <= drvdata->rdesc + drvdata->rsize - 4;) { - if (p[0] == 0xFE && p[1] == 0xED && p[2] == 0x1D && -- p[3] < sizeof(params)) { -+ p[3] < ARRAY_SIZE(params)) { - v = params[p[3]]; - put_unaligned(cpu_to_le32(v), (s32 *)p); - p += 4; diff --git a/kernel/kernel/files/patches/mageia/stable-iio-add-inverse-unit-conversion-macros.patch b/kernel/kernel/files/patches/mageia/stable-iio-add-inverse-unit-conversion-macros.patch new file mode 100644 index 00000000..caabd831 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-iio-add-inverse-unit-conversion-macros.patch @@ -0,0 +1,70 @@ +From c689a923c867eac40ed3826c1d9328edea8b6bc7 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Wed, 5 Aug 2015 15:38:14 +0200 +Subject: iio: Add inverse unit conversion macros + +From: Lars-Peter Clausen + +commit c689a923c867eac40ed3826c1d9328edea8b6bc7 upstream. + +Add inverse unit conversion macro to convert from standard IIO units to +units that might be used by some devices. + +Those are useful in combination with scale factors that are specified as +IIO_VAL_FRACTIONAL. Typically the denominator for those specifications will +contain the maximum raw value the sensor will generate and the numerator +the value it maps to in a specific unit. Sometimes datasheets specify those +in different units than the standard IIO units (e.g. degree/s instead of +rad/s) and so we need to do a unit conversion. + +From a mathematical point of view it does not make a difference whether we +apply the unit conversion to the numerator or the inverse unit conversion +to the denominator since (x / y) / z = x / (y * z). But as the denominator +is typically a larger value and we are rounding both the numerator and +denominator to integer values using the later method gives us a better +precision (E.g. the relative error is smaller if we round 8000.3 to 8000 +rather than rounding 8.3 to 8). + +This is where in inverse unit conversion macros will be used. + +Marked for stable as used by some upcoming fixes. + +Signed-off-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/iio/iio.h | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/include/linux/iio/iio.h ++++ b/include/linux/iio/iio.h +@@ -642,6 +642,15 @@ int iio_str_to_fixpoint(const char *str, + #define IIO_DEGREE_TO_RAD(deg) (((deg) * 314159ULL + 9000000ULL) / 18000000ULL) + + /** ++ * IIO_RAD_TO_DEGREE() - Convert rad to degree ++ * @rad: A value in rad ++ * ++ * Returns the given value converted from rad to degree ++ */ ++#define IIO_RAD_TO_DEGREE(rad) \ ++ (((rad) * 18000000ULL + 314159ULL / 2) / 314159ULL) ++ ++/** + * IIO_G_TO_M_S_2() - Convert g to meter / second**2 + * @g: A value in g + * +@@ -649,4 +658,12 @@ int iio_str_to_fixpoint(const char *str, + */ + #define IIO_G_TO_M_S_2(g) ((g) * 980665ULL / 100000ULL) + ++/** ++ * IIO_M_S_2_TO_G() - Convert meter / second**2 to g ++ * @ms2: A value in meter / second**2 ++ * ++ * Returns the given value converted from meter / second**2 to g ++ */ ++#define IIO_M_S_2_TO_G(ms2) (((ms2) * 100000ULL + 980665ULL / 2) / 980665ULL) ++ + #endif /* _INDUSTRIAL_IO_H_ */ diff --git a/kernel/kernel/files/patches/mageia/stable-iio-adis16400-fix-adis16448-gyroscope-scale.patch b/kernel/kernel/files/patches/mageia/stable-iio-adis16400-fix-adis16448-gyroscope-scale.patch new file mode 100644 index 00000000..a04deb53 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-iio-adis16400-fix-adis16448-gyroscope-scale.patch @@ -0,0 +1,30 @@ +From 8166537283b31d7abaae9e56bd48fbbc30cdc579 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Wed, 5 Aug 2015 15:38:13 +0200 +Subject: iio: adis16400: Fix adis16448 gyroscope scale + +From: Lars-Peter Clausen + +commit 8166537283b31d7abaae9e56bd48fbbc30cdc579 upstream. + +Use the correct scale for the adis16448 gyroscope output. + +Signed-off-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/imu/adis16400_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/imu/adis16400_core.c ++++ b/drivers/iio/imu/adis16400_core.c +@@ -780,7 +780,7 @@ static struct adis16400_chip_info adis16 + .flags = ADIS16400_HAS_PROD_ID | + ADIS16400_HAS_SERIAL_NUMBER | + ADIS16400_BURST_DIAG_STAT, +- .gyro_scale_micro = IIO_DEGREE_TO_RAD(10000), /* 0.01 deg/s */ ++ .gyro_scale_micro = IIO_DEGREE_TO_RAD(40000), /* 0.04 deg/s */ + .accel_scale_micro = IIO_G_TO_M_S_2(833), /* 1/1200 g */ + .temp_scale_nano = 73860000, /* 0.07386 C */ + .temp_offset = 31000000 / 73860, /* 31 C = 0x00 */ diff --git a/kernel/kernel/files/patches/mageia/stable-iio-adis16480-fix-scale-factors.patch b/kernel/kernel/files/patches/mageia/stable-iio-adis16480-fix-scale-factors.patch new file mode 100644 index 00000000..0fe17053 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-iio-adis16480-fix-scale-factors.patch @@ -0,0 +1,101 @@ +From 7abad1063deb0f77d275c61f58863ec319c58c5c Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Wed, 5 Aug 2015 15:38:15 +0200 +Subject: iio: adis16480: Fix scale factors + +From: Lars-Peter Clausen + +commit 7abad1063deb0f77d275c61f58863ec319c58c5c upstream. + +The different devices support by the adis16480 driver have slightly +different scales for the gyroscope and accelerometer channels. + +Signed-off-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/imu/adis16480.c | 39 +++++++++++++++++++++++++++++++++------ + 1 file changed, 33 insertions(+), 6 deletions(-) + +--- a/drivers/iio/imu/adis16480.c ++++ b/drivers/iio/imu/adis16480.c +@@ -110,6 +110,10 @@ + struct adis16480_chip_info { + unsigned int num_channels; + const struct iio_chan_spec *channels; ++ unsigned int gyro_max_val; ++ unsigned int gyro_max_scale; ++ unsigned int accel_max_val; ++ unsigned int accel_max_scale; + }; + + struct adis16480 { +@@ -497,19 +501,21 @@ static int adis16480_set_filter_freq(str + static int adis16480_read_raw(struct iio_dev *indio_dev, + const struct iio_chan_spec *chan, int *val, int *val2, long info) + { ++ struct adis16480 *st = iio_priv(indio_dev); ++ + switch (info) { + case IIO_CHAN_INFO_RAW: + return adis_single_conversion(indio_dev, chan, 0, val); + case IIO_CHAN_INFO_SCALE: + switch (chan->type) { + case IIO_ANGL_VEL: +- *val = 0; +- *val2 = IIO_DEGREE_TO_RAD(20000); /* 0.02 degree/sec */ +- return IIO_VAL_INT_PLUS_MICRO; ++ *val = st->chip_info->gyro_max_scale; ++ *val2 = st->chip_info->gyro_max_val; ++ return IIO_VAL_FRACTIONAL; + case IIO_ACCEL: +- *val = 0; +- *val2 = IIO_G_TO_M_S_2(800); /* 0.8 mg */ +- return IIO_VAL_INT_PLUS_MICRO; ++ *val = st->chip_info->accel_max_scale; ++ *val2 = st->chip_info->accel_max_val; ++ return IIO_VAL_FRACTIONAL; + case IIO_MAGN: + *val = 0; + *val2 = 100; /* 0.0001 gauss */ +@@ -674,18 +680,39 @@ static const struct adis16480_chip_info + [ADIS16375] = { + .channels = adis16485_channels, + .num_channels = ARRAY_SIZE(adis16485_channels), ++ /* ++ * storing the value in rad/degree and the scale in degree ++ * gives us the result in rad and better precession than ++ * storing the scale directly in rad. ++ */ ++ .gyro_max_val = IIO_RAD_TO_DEGREE(22887), ++ .gyro_max_scale = 300, ++ .accel_max_val = IIO_M_S_2_TO_G(21973), ++ .accel_max_scale = 18, + }, + [ADIS16480] = { + .channels = adis16480_channels, + .num_channels = ARRAY_SIZE(adis16480_channels), ++ .gyro_max_val = IIO_RAD_TO_DEGREE(22500), ++ .gyro_max_scale = 450, ++ .accel_max_val = IIO_M_S_2_TO_G(12500), ++ .accel_max_scale = 5, + }, + [ADIS16485] = { + .channels = adis16485_channels, + .num_channels = ARRAY_SIZE(adis16485_channels), ++ .gyro_max_val = IIO_RAD_TO_DEGREE(22500), ++ .gyro_max_scale = 450, ++ .accel_max_val = IIO_M_S_2_TO_G(20000), ++ .accel_max_scale = 5, + }, + [ADIS16488] = { + .channels = adis16480_channels, + .num_channels = ARRAY_SIZE(adis16480_channels), ++ .gyro_max_val = IIO_RAD_TO_DEGREE(22500), ++ .gyro_max_scale = 450, ++ .accel_max_val = IIO_M_S_2_TO_G(22500), ++ .accel_max_scale = 18, + }, + }; + diff --git a/kernel/kernel/files/patches/mageia/stable-iio-bmg160-iio_buffer-and-iio_triggered_buffer-are-required.patch b/kernel/kernel/files/patches/mageia/stable-iio-bmg160-iio_buffer-and-iio_triggered_buffer-are-required.patch new file mode 100644 index 00000000..7983e463 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-iio-bmg160-iio_buffer-and-iio_triggered_buffer-are-required.patch @@ -0,0 +1,33 @@ +From 06d2f6ca5a38abe92f1f3a132b331eee773868c3 Mon Sep 17 00:00:00 2001 +From: Markus Pargmann +Date: Wed, 29 Jul 2015 15:46:03 +0200 +Subject: iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required + +From: Markus Pargmann + +commit 06d2f6ca5a38abe92f1f3a132b331eee773868c3 upstream. + +This patch adds selects for IIO_BUFFER and IIO_TRIGGERED_BUFFER. Without +IIO_BUFFER, the driver does not compile. + +Signed-off-by: Markus Pargmann +Reviewed-by: Srinivas Pandruvada +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/gyro/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/iio/gyro/Kconfig ++++ b/drivers/iio/gyro/Kconfig +@@ -53,7 +53,8 @@ config ADXRS450 + config BMG160 + tristate "BOSCH BMG160 Gyro Sensor" + depends on I2C +- select IIO_TRIGGERED_BUFFER if IIO_BUFFER ++ select IIO_BUFFER ++ select IIO_TRIGGERED_BUFFER + help + Say yes here to build support for Bosch BMG160 Tri-axis Gyro Sensor + driver. This driver also supports BMI055 gyroscope. diff --git a/kernel/kernel/files/patches/mageia/stable-iio-event-remove-negative-error-code-from-iio_event_poll.patch b/kernel/kernel/files/patches/mageia/stable-iio-event-remove-negative-error-code-from-iio_event_poll.patch new file mode 100644 index 00000000..3fa720d9 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-iio-event-remove-negative-error-code-from-iio_event_poll.patch @@ -0,0 +1,33 @@ +From 41d903c00051d8f31c98a8136edbac67e6f8688f Mon Sep 17 00:00:00 2001 +From: Cristina Opriceana +Date: Mon, 3 Aug 2015 13:00:47 +0300 +Subject: iio: event: Remove negative error code from iio_event_poll + +From: Cristina Opriceana + +commit 41d903c00051d8f31c98a8136edbac67e6f8688f upstream. + +Negative return values are not supported by iio_event_poll since +its return type is unsigned int. + +Fixes: f18e7a068a0a3 ("iio: Return -ENODEV for file operations if the device has been unregistered") + +Signed-off-by: Cristina Opriceana +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/industrialio-event.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/industrialio-event.c ++++ b/drivers/iio/industrialio-event.c +@@ -84,7 +84,7 @@ static unsigned int iio_event_poll(struc + unsigned int events = 0; + + if (!indio_dev->info) +- return -ENODEV; ++ return events; + + poll_wait(filep, &ev_int->wait, wait); + diff --git a/kernel/kernel/files/patches/mageia/stable-iio-industrialio-buffer-fix-iio_buffer_poll-return-value.patch b/kernel/kernel/files/patches/mageia/stable-iio-industrialio-buffer-fix-iio_buffer_poll-return-value.patch new file mode 100644 index 00000000..4549873a --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-iio-industrialio-buffer-fix-iio_buffer_poll-return-value.patch @@ -0,0 +1,34 @@ +From 1bdc0293901cbea23c6dc29432e81919d4719844 Mon Sep 17 00:00:00 2001 +From: Cristina Opriceana +Date: Mon, 3 Aug 2015 13:37:40 +0300 +Subject: iio: industrialio-buffer: Fix iio_buffer_poll return value + +From: Cristina Opriceana + +commit 1bdc0293901cbea23c6dc29432e81919d4719844 upstream. + +Change return value to 0 if no device is bound since +unsigned int cannot support negative error codes. + +Fixes: f18e7a068 ("iio: Return -ENODEV for file operations if the +device has been unregistered") + +Signed-off-by: Cristina Opriceana +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/industrialio-buffer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/industrialio-buffer.c ++++ b/drivers/iio/industrialio-buffer.c +@@ -151,7 +151,7 @@ unsigned int iio_buffer_poll(struct file + struct iio_buffer *rb = indio_dev->buffer; + + if (!indio_dev->info) +- return -ENODEV; ++ return 0; + + poll_wait(filp, &rb->pollq, wait); + if (iio_buffer_ready(indio_dev, rb, rb->watermark, 0)) diff --git a/kernel/kernel/files/patches/mageia/stable-ipc-sem-fix-use-after-free-on-ipc_rmid-after-a-task-using-same-semaphore-set-exits.patch b/kernel/kernel/files/patches/mageia/stable-ipc-sem-fix-use-after-free-on-ipc_rmid-after-a-task-using-same-semaphore-set-exits.patch deleted file mode 100644 index 22323f88..00000000 --- a/kernel/kernel/files/patches/mageia/stable-ipc-sem-fix-use-after-free-on-ipc_rmid-after-a-task-using-same-semaphore-set-exits.patch +++ /dev/null @@ -1,254 +0,0 @@ -From 602b8593d2b4138c10e922eeaafe306f6b51817b Mon Sep 17 00:00:00 2001 -From: "Herton R. Krzesinski" -Date: Fri, 14 Aug 2015 15:35:02 -0700 -Subject: ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits - -From: "Herton R. Krzesinski" - -commit 602b8593d2b4138c10e922eeaafe306f6b51817b upstream. - -The current semaphore code allows a potential use after free: in -exit_sem we may free the task's sem_undo_list while there is still -another task looping through the same semaphore set and cleaning the -sem_undo list at freeary function (the task called IPC_RMID for the same -semaphore set). - -For example, with a test program [1] running which keeps forking a lot -of processes (which then do a semop call with SEM_UNDO flag), and with -the parent right after removing the semaphore set with IPC_RMID, and a -kernel built with CONFIG_SLAB, CONFIG_SLAB_DEBUG and -CONFIG_DEBUG_SPINLOCK, you can easily see something like the following -in the kernel log: - - Slab corruption (Not tainted): kmalloc-64 start=ffff88003b45c1c0, len=64 - 000: 6b 6b 6b 6b 6b 6b 6b 6b 00 6b 6b 6b 6b 6b 6b 6b kkkkkkkk.kkkkkkk - 010: ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff ....kkkk........ - Prev obj: start=ffff88003b45c180, len=64 - 000: 00 00 00 00 ad 4e ad de ff ff ff ff 5a 5a 5a 5a .....N......ZZZZ - 010: ff ff ff ff ff ff ff ff c0 fb 01 37 00 88 ff ff ...........7.... - Next obj: start=ffff88003b45c200, len=64 - 000: 00 00 00 00 ad 4e ad de ff ff ff ff 5a 5a 5a 5a .....N......ZZZZ - 010: ff ff ff ff ff ff ff ff 68 29 a7 3c 00 88 ff ff ........h).<.... - BUG: spinlock wrong CPU on CPU#2, test/18028 - general protection fault: 0000 [#1] SMP - Modules linked in: 8021q mrp garp stp llc nf_conntrack_ipv4 nf_defrag_ipv4 ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables binfmt_misc ppdev input_leds joydev parport_pc parport floppy serio_raw virtio_balloon virtio_rng virtio_console virtio_net iosf_mbi crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr qxl ttm drm_kms_helper drm snd_hda_codec_generic i2c_piix4 snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore crc32c_intel virtio_pci virtio_ring virtio pata_acpi ata_generic [last unloaded: speedstep_lib] - CPU: 2 PID: 18028 Comm: test Not tainted 4.2.0-rc5+ #1 - Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014 - RIP: spin_dump+0x53/0xc0 - Call Trace: - spin_bug+0x30/0x40 - do_raw_spin_unlock+0x71/0xa0 - _raw_spin_unlock+0xe/0x10 - freeary+0x82/0x2a0 - ? _raw_spin_lock+0xe/0x10 - semctl_down.clone.0+0xce/0x160 - ? __do_page_fault+0x19a/0x430 - ? __audit_syscall_entry+0xa8/0x100 - SyS_semctl+0x236/0x2c0 - ? syscall_trace_leave+0xde/0x130 - entry_SYSCALL_64_fastpath+0x12/0x71 - Code: 8b 80 88 03 00 00 48 8d 88 60 05 00 00 48 c7 c7 a0 2c a4 81 31 c0 65 8b 15 eb 40 f3 7e e8 08 31 68 00 4d 85 e4 44 8b 4b 08 74 5e <45> 8b 84 24 88 03 00 00 49 8d 8c 24 60 05 00 00 8b 53 04 48 89 - RIP [] spin_dump+0x53/0xc0 - RSP - ---[ end trace 783ebb76612867a0 ]--- - NMI watchdog: BUG: soft lockup - CPU#3 stuck for 22s! [test:18053] - Modules linked in: 8021q mrp garp stp llc nf_conntrack_ipv4 nf_defrag_ipv4 ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables binfmt_misc ppdev input_leds joydev parport_pc parport floppy serio_raw virtio_balloon virtio_rng virtio_console virtio_net iosf_mbi crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr qxl ttm drm_kms_helper drm snd_hda_codec_generic i2c_piix4 snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore crc32c_intel virtio_pci virtio_ring virtio pata_acpi ata_generic [last unloaded: speedstep_lib] - CPU: 3 PID: 18053 Comm: test Tainted: G D 4.2.0-rc5+ #1 - Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014 - RIP: native_read_tsc+0x0/0x20 - Call Trace: - ? delay_tsc+0x40/0x70 - __delay+0xf/0x20 - do_raw_spin_lock+0x96/0x140 - _raw_spin_lock+0xe/0x10 - sem_lock_and_putref+0x11/0x70 - SYSC_semtimedop+0x7bf/0x960 - ? handle_mm_fault+0xbf6/0x1880 - ? dequeue_task_fair+0x79/0x4a0 - ? __do_page_fault+0x19a/0x430 - ? kfree_debugcheck+0x16/0x40 - ? __do_page_fault+0x19a/0x430 - ? __audit_syscall_entry+0xa8/0x100 - ? do_audit_syscall_entry+0x66/0x70 - ? syscall_trace_enter_phase1+0x139/0x160 - SyS_semtimedop+0xe/0x10 - SyS_semop+0x10/0x20 - entry_SYSCALL_64_fastpath+0x12/0x71 - Code: 47 10 83 e8 01 85 c0 89 47 10 75 08 65 48 89 3d 1f 74 ff 7e c9 c3 0f 1f 44 00 00 55 48 89 e5 e8 87 17 04 00 66 90 c9 c3 0f 1f 00 <55> 48 89 e5 0f 31 89 c1 48 89 d0 48 c1 e0 20 89 c9 48 09 c8 c9 - Kernel panic - not syncing: softlockup: hung tasks - -I wasn't able to trigger any badness on a recent kernel without the -proper config debugs enabled, however I have softlockup reports on some -kernel versions, in the semaphore code, which are similar as above (the -scenario is seen on some servers running IBM DB2 which uses semaphore -syscalls). - -The patch here fixes the race against freeary, by acquiring or waiting -on the sem_undo_list lock as necessary (exit_sem can race with freeary, -while freeary sets un->semid to -1 and removes the same sem_undo from -list_proc or when it removes the last sem_undo). - -After the patch I'm unable to reproduce the problem using the test case -[1]. - -[1] Test case used below: - - #include - #include - #include - #include - #include - #include - #include - #include - #include - - #define NSEM 1 - #define NSET 5 - - int sid[NSET]; - - void thread() - { - struct sembuf op; - int s; - uid_t pid = getuid(); - - s = rand() % NSET; - op.sem_num = pid % NSEM; - op.sem_op = 1; - op.sem_flg = SEM_UNDO; - - semop(sid[s], &op, 1); - exit(EXIT_SUCCESS); - } - - void create_set() - { - int i, j; - pid_t p; - union { - int val; - struct semid_ds *buf; - unsigned short int *array; - struct seminfo *__buf; - } un; - - /* Create and initialize semaphore set */ - for (i = 0; i < NSET; i++) { - sid[i] = semget(IPC_PRIVATE , NSEM, 0644 | IPC_CREAT); - if (sid[i] < 0) { - perror("semget"); - exit(EXIT_FAILURE); - } - } - un.val = 0; - for (i = 0; i < NSET; i++) { - for (j = 0; j < NSEM; j++) { - if (semctl(sid[i], j, SETVAL, un) < 0) - perror("semctl"); - } - } - - /* Launch threads that operate on semaphore set */ - for (i = 0; i < NSEM * NSET * NSET; i++) { - p = fork(); - if (p < 0) - perror("fork"); - if (p == 0) - thread(); - } - - /* Free semaphore set */ - for (i = 0; i < NSET; i++) { - if (semctl(sid[i], NSEM, IPC_RMID)) - perror("IPC_RMID"); - } - - /* Wait for forked processes to exit */ - while (wait(NULL)) { - if (errno == ECHILD) - break; - }; - } - - int main(int argc, char **argv) - { - pid_t p; - - srand(time(NULL)); - - while (1) { - p = fork(); - if (p < 0) { - perror("fork"); - exit(EXIT_FAILURE); - } - if (p == 0) { - create_set(); - goto end; - } - - /* Wait for forked processes to exit */ - while (wait(NULL)) { - if (errno == ECHILD) - break; - }; - } - end: - return 0; - } - -[akpm@linux-foundation.org: use normal comment layout] -Signed-off-by: Herton R. Krzesinski -Acked-by: Manfred Spraul -Cc: Davidlohr Bueso -Cc: Rafael Aquini -CC: Aristeu Rozanski -Cc: David Jeffery -Signed-off-by: Andrew Morton -Signed-off-by: Greg Kroah-Hartman - -Signed-off-by: Linus Torvalds - ---- - ipc/sem.c | 23 +++++++++++++++++------ - 1 file changed, 17 insertions(+), 6 deletions(-) - ---- a/ipc/sem.c -+++ b/ipc/sem.c -@@ -2074,17 +2074,28 @@ void exit_sem(struct task_struct *tsk) - rcu_read_lock(); - un = list_entry_rcu(ulp->list_proc.next, - struct sem_undo, list_proc); -- if (&un->list_proc == &ulp->list_proc) -- semid = -1; -- else -- semid = un->semid; -+ if (&un->list_proc == &ulp->list_proc) { -+ /* -+ * We must wait for freeary() before freeing this ulp, -+ * in case we raced with last sem_undo. There is a small -+ * possibility where we exit while freeary() didn't -+ * finish unlocking sem_undo_list. -+ */ -+ spin_unlock_wait(&ulp->lock); -+ rcu_read_unlock(); -+ break; -+ } -+ spin_lock(&ulp->lock); -+ semid = un->semid; -+ spin_unlock(&ulp->lock); - -+ /* exit_sem raced with IPC_RMID, nothing to do */ - if (semid == -1) { - rcu_read_unlock(); -- break; -+ continue; - } - -- sma = sem_obtain_object_check(tsk->nsproxy->ipc_ns, un->semid); -+ sma = sem_obtain_object_check(tsk->nsproxy->ipc_ns, semid); - /* exit_sem raced with IPC_RMID, nothing to do */ - if (IS_ERR(sma)) { - rcu_read_unlock(); diff --git a/kernel/kernel/files/patches/mageia/stable-ipc-sem.c-update-correct-memory-barriers.patch b/kernel/kernel/files/patches/mageia/stable-ipc-sem.c-update-correct-memory-barriers.patch deleted file mode 100644 index c5fbdbfd..00000000 --- a/kernel/kernel/files/patches/mageia/stable-ipc-sem.c-update-correct-memory-barriers.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 3ed1f8a99d70ea1cd1508910eb107d0edcae5009 Mon Sep 17 00:00:00 2001 -From: Manfred Spraul -Date: Fri, 14 Aug 2015 15:35:10 -0700 -Subject: ipc/sem.c: update/correct memory barriers - -From: Manfred Spraul - -commit 3ed1f8a99d70ea1cd1508910eb107d0edcae5009 upstream. - -sem_lock() did not properly pair memory barriers: - -!spin_is_locked() and spin_unlock_wait() are both only control barriers. -The code needs an acquire barrier, otherwise the cpu might perform read -operations before the lock test. - -As no primitive exists inside and since it seems -noone wants another primitive, the code creates a local primitive within -ipc/sem.c. - -With regards to -stable: - -The change of sem_wait_array() is a bugfix, the change to sem_lock() is a -nop (just a preprocessor redefinition to improve the readability). The -bugfix is necessary for all kernels that use sem_wait_array() (i.e.: -starting from 3.10). - -Signed-off-by: Manfred Spraul -Reported-by: Oleg Nesterov -Acked-by: Peter Zijlstra (Intel) -Cc: "Paul E. McKenney" -Cc: Kirill Tkhai -Cc: Ingo Molnar -Cc: Josh Poimboeuf -Cc: Davidlohr Bueso -Signed-off-by: Andrew Morton -Signed-off-by: Linus Torvalds -Signed-off-by: Greg Kroah-Hartman - ---- - ipc/sem.c | 18 ++++++++++++++---- - 1 file changed, 14 insertions(+), 4 deletions(-) - ---- a/ipc/sem.c -+++ b/ipc/sem.c -@@ -253,6 +253,16 @@ static void sem_rcu_free(struct rcu_head - } - - /* -+ * spin_unlock_wait() and !spin_is_locked() are not memory barriers, they -+ * are only control barriers. -+ * The code must pair with spin_unlock(&sem->lock) or -+ * spin_unlock(&sem_perm.lock), thus just the control barrier is insufficient. -+ * -+ * smp_rmb() is sufficient, as writes cannot pass the control barrier. -+ */ -+#define ipc_smp_acquire__after_spin_is_unlocked() smp_rmb() -+ -+/* - * Wait until all currently ongoing simple ops have completed. - * Caller must own sem_perm.lock. - * New simple ops cannot start, because simple ops first check -@@ -275,6 +285,7 @@ static void sem_wait_array(struct sem_ar - sem = sma->sem_base + i; - spin_unlock_wait(&sem->lock); - } -+ ipc_smp_acquire__after_spin_is_unlocked(); - } - - /* -@@ -327,13 +338,12 @@ static inline int sem_lock(struct sem_ar - /* Then check that the global lock is free */ - if (!spin_is_locked(&sma->sem_perm.lock)) { - /* -- * The ipc object lock check must be visible on all -- * cores before rechecking the complex count. Otherwise -- * we can race with another thread that does: -+ * We need a memory barrier with acquire semantics, -+ * otherwise we can race with another thread that does: - * complex_count++; - * spin_unlock(sem_perm.lock); - */ -- smp_rmb(); -+ ipc_smp_acquire__after_spin_is_unlocked(); - - /* - * Now repeat the test of complex_count: diff --git a/kernel/kernel/files/patches/mageia/stable-iwlwifi-pcie-fix-prepare-card-flow.patch b/kernel/kernel/files/patches/mageia/stable-iwlwifi-pcie-fix-prepare-card-flow.patch deleted file mode 100644 index 6aa67a1e..00000000 --- a/kernel/kernel/files/patches/mageia/stable-iwlwifi-pcie-fix-prepare-card-flow.patch +++ /dev/null @@ -1,83 +0,0 @@ -From c9fdec9f3970eeaa1b176422f46167f5f5158804 Mon Sep 17 00:00:00 2001 -From: Emmanuel Grumbach -Date: Mon, 20 Jul 2015 12:14:39 +0300 -Subject: iwlwifi: pcie: fix prepare card flow - -From: Emmanuel Grumbach - -commit c9fdec9f3970eeaa1b176422f46167f5f5158804 upstream. - -When the card is not owned by the PCIe bus, we need to -acquire ownership first. This flow is implemented in -iwl_pcie_prepare_card_hw. Because of a hardware bug, we -need to disable link power management before we can -request ownership otherwise the other user of the device -won't get notified that we are requesting the device which -will prevent us from acquire ownership. - -Same holds for the down flow where we need to make sure -that any other potential user is notified that the driver -is going down. - -Signed-off-by: Emmanuel Grumbach -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/net/wireless/iwlwifi/pcie/trans.c | 22 +++++++++++++++++++--- - 1 file changed, 19 insertions(+), 3 deletions(-) - ---- a/drivers/net/wireless/iwlwifi/pcie/trans.c -+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c -@@ -457,10 +457,16 @@ static void iwl_pcie_apm_stop(struct iwl - if (trans->cfg->device_family == IWL_DEVICE_FAMILY_7000) - iwl_set_bits_prph(trans, APMG_PCIDEV_STT_REG, - APMG_PCIDEV_STT_VAL_WAKE_ME); -- else if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) -+ else if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) { -+ iwl_set_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG, -+ CSR_RESET_LINK_PWR_MGMT_DISABLED); - iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG, - CSR_HW_IF_CONFIG_REG_PREPARE | - CSR_HW_IF_CONFIG_REG_ENABLE_PME); -+ mdelay(1); -+ iwl_clear_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG, -+ CSR_RESET_LINK_PWR_MGMT_DISABLED); -+ } - mdelay(5); - } - -@@ -555,6 +561,10 @@ static int iwl_pcie_prepare_card_hw(stru - if (ret >= 0) - return 0; - -+ iwl_set_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG, -+ CSR_RESET_LINK_PWR_MGMT_DISABLED); -+ msleep(1); -+ - for (iter = 0; iter < 10; iter++) { - /* If HW is not ready, prepare the conditions to check again */ - iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG, -@@ -562,8 +572,10 @@ static int iwl_pcie_prepare_card_hw(stru - - do { - ret = iwl_pcie_set_hw_ready(trans); -- if (ret >= 0) -- return 0; -+ if (ret >= 0) { -+ ret = 0; -+ goto out; -+ } - - usleep_range(200, 1000); - t += 200; -@@ -573,6 +585,10 @@ static int iwl_pcie_prepare_card_hw(stru - - IWL_ERR(trans, "Couldn't prepare the card\n"); - -+out: -+ iwl_clear_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG, -+ CSR_RESET_LINK_PWR_MGMT_DISABLED); -+ - return ret; - } - diff --git a/kernel/kernel/files/patches/mageia/stable-libxfs-readahead-of-dir3-data-blocks-should-use-the-read-verifier.patch b/kernel/kernel/files/patches/mageia/stable-libxfs-readahead-of-dir3-data-blocks-should-use-the-read-verifier.patch new file mode 100644 index 00000000..9c225d16 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-libxfs-readahead-of-dir3-data-blocks-should-use-the-read-verifier.patch @@ -0,0 +1,37 @@ +From 2f123bce18943fff819bc10f8868ffb9149fc622 Mon Sep 17 00:00:00 2001 +From: "Darrick J. Wong" +Date: Wed, 19 Aug 2015 10:33:58 +1000 +Subject: libxfs: readahead of dir3 data blocks should use the read verifier + +From: "Darrick J. Wong" + +commit 2f123bce18943fff819bc10f8868ffb9149fc622 upstream. + +In the dir3 data block readahead function, use the regular read +verifier to check the block's CRC and spot-check the block contents +instead of directly calling only the spot-checking routine. This +prevents corrupted directory data blocks from being read into the +kernel, which can lead to garbage ls output and directory loops (if +say one of the entries contains slashes and other junk). + +Signed-off-by: Darrick J. Wong +Reviewed-by: Dave Chinner +Signed-off-by: Dave Chinner +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/libxfs/xfs_dir2_data.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/xfs/libxfs/xfs_dir2_data.c ++++ b/fs/xfs/libxfs/xfs_dir2_data.c +@@ -252,7 +252,8 @@ xfs_dir3_data_reada_verify( + return; + case cpu_to_be32(XFS_DIR2_DATA_MAGIC): + case cpu_to_be32(XFS_DIR3_DATA_MAGIC): +- xfs_dir3_data_verify(bp); ++ bp->b_ops = &xfs_dir3_data_buf_ops; ++ bp->b_ops->verify_read(bp); + return; + default: + xfs_buf_ioerror(bp, -EFSCORRUPTED); diff --git a/kernel/kernel/files/patches/mageia/stable-localmodconfig-use-kbuild-files-too.patch b/kernel/kernel/files/patches/mageia/stable-localmodconfig-use-kbuild-files-too.patch deleted file mode 100644 index 8fd1677b..00000000 --- a/kernel/kernel/files/patches/mageia/stable-localmodconfig-use-kbuild-files-too.patch +++ /dev/null @@ -1,36 +0,0 @@ -From c0ddc8c745b7f89c50385fd7aa03c78dc543fa7a Mon Sep 17 00:00:00 2001 -From: Richard Weinberger -Date: Mon, 27 Jul 2015 00:06:55 +0200 -Subject: localmodconfig: Use Kbuild files too - -From: Richard Weinberger - -commit c0ddc8c745b7f89c50385fd7aa03c78dc543fa7a upstream. - -In kbuild it is allowed to define objects in files named "Makefile" -and "Kbuild". -Currently localmodconfig reads objects only from "Makefile"s and misses -modules like nouveau. - -Link: http://lkml.kernel.org/r/1437948415-16290-1-git-send-email-richard@nod.at - -Reported-and-tested-by: Leonidas Spyropoulos -Signed-off-by: Richard Weinberger -Signed-off-by: Steven Rostedt -Signed-off-by: Greg Kroah-Hartman - ---- - scripts/kconfig/streamline_config.pl | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/scripts/kconfig/streamline_config.pl -+++ b/scripts/kconfig/streamline_config.pl -@@ -137,7 +137,7 @@ my $ksource = ($ARGV[0] ? $ARGV[0] : '.' - my $kconfig = $ARGV[1]; - my $lsmod_file = $ENV{'LSMOD'}; - --my @makefiles = `find $ksource -name Makefile 2>/dev/null`; -+my @makefiles = `find $ksource -name Makefile -or -name Kbuild 2>/dev/null`; - chomp @makefiles; - - my %depends; diff --git a/kernel/kernel/files/patches/mageia/stable-mm-hwpoison-fix-fail-isolate-hugetlbfs-page-w-refcount-held.patch b/kernel/kernel/files/patches/mageia/stable-mm-hwpoison-fix-fail-isolate-hugetlbfs-page-w-refcount-held.patch deleted file mode 100644 index 66962bb1..00000000 --- a/kernel/kernel/files/patches/mageia/stable-mm-hwpoison-fix-fail-isolate-hugetlbfs-page-w-refcount-held.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 036138080a4376e5f3e5d0cca8ac99084c5cf06e Mon Sep 17 00:00:00 2001 -From: Wanpeng Li -Date: Fri, 14 Aug 2015 15:34:59 -0700 -Subject: mm/hwpoison: fix fail isolate hugetlbfs page w/ refcount held - -From: Wanpeng Li - -commit 036138080a4376e5f3e5d0cca8ac99084c5cf06e upstream. - -Hugetlbfs pages will get a refcount in get_any_page() or -madvise_hwpoison() if soft offlining through madvise. The refcount which -is held by the soft offline path should be released if we fail to isolate -hugetlbfs pages. - -Fix it by reducing the refcount for both isolation success and failure. - -Signed-off-by: Wanpeng Li -Acked-by: Naoya Horiguchi -Signed-off-by: Andrew Morton -Signed-off-by: Linus Torvalds -Signed-off-by: Greg Kroah-Hartman - ---- - mm/memory-failure.c | 13 ++++++------- - 1 file changed, 6 insertions(+), 7 deletions(-) - ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -1589,13 +1589,12 @@ static int soft_offline_huge_page(struct - unlock_page(hpage); - - ret = isolate_huge_page(hpage, &pagelist); -- if (ret) { -- /* -- * get_any_page() and isolate_huge_page() takes a refcount each, -- * so need to drop one here. -- */ -- put_page(hpage); -- } else { -+ /* -+ * get_any_page() and isolate_huge_page() takes a refcount each, -+ * so need to drop one here. -+ */ -+ put_page(hpage); -+ if (!ret) { - pr_info("soft offline: %#lx hugepage failed to isolate\n", pfn); - return -EBUSY; - } diff --git a/kernel/kernel/files/patches/mageia/stable-mm-hwpoison-fix-page-refcount-of-unknown-non-lru-page.patch b/kernel/kernel/files/patches/mageia/stable-mm-hwpoison-fix-page-refcount-of-unknown-non-lru-page.patch deleted file mode 100644 index 5179e96a..00000000 --- a/kernel/kernel/files/patches/mageia/stable-mm-hwpoison-fix-page-refcount-of-unknown-non-lru-page.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 4f32be677b124a49459e2603321c7a5605ceb9f8 Mon Sep 17 00:00:00 2001 -From: Wanpeng Li -Date: Fri, 14 Aug 2015 15:34:56 -0700 -Subject: mm/hwpoison: fix page refcount of unknown non LRU page - -From: Wanpeng Li - -commit 4f32be677b124a49459e2603321c7a5605ceb9f8 upstream. - -After trying to drain pages from pagevec/pageset, we try to get reference -count of the page again, however, the reference count of the page is not -reduced if the page is still not on LRU list. - -Fix it by adding the put_page() to drop the page reference which is from -__get_any_page(). - -Signed-off-by: Wanpeng Li -Acked-by: Naoya Horiguchi -Signed-off-by: Andrew Morton -Signed-off-by: Linus Torvalds -Signed-off-by: Greg Kroah-Hartman - ---- - mm/memory-failure.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -1558,6 +1558,8 @@ static int get_any_page(struct page *pag - */ - ret = __get_any_page(page, pfn, 0); - if (!PageLRU(page)) { -+ /* Drop page reference which is from __get_any_page() */ -+ put_page(page); - pr_info("soft_offline: %#lx: unknown non LRU page type %lx\n", - pfn, page->flags); - return -EIO; diff --git a/kernel/kernel/files/patches/mageia/stable-net_41.mbox.patch b/kernel/kernel/files/patches/mageia/stable-net_41.mbox.patch deleted file mode 100644 index 0b56b06b..00000000 --- a/kernel/kernel/files/patches/mageia/stable-net_41.mbox.patch +++ /dev/null @@ -1,3345 +0,0 @@ -From 8c2854df13fbdfb163bc66939d6d09bb0ca306f6 Mon Sep 17 00:00:00 2001 -From: Angga -Date: Fri, 3 Jul 2015 14:40:52 +1200 -Subject: [PATCH 01/46] ipv6: Make MLD packets to only be processed locally - -[ Upstream commit 4c938d22c88a9ddccc8c55a85e0430e9c62b1ac5 ] - -Before commit daad151263cf ("ipv6: Make ipv6_is_mld() inline and use it -from ip6_mc_input().") MLD packets were only processed locally. After the -change, a copy of MLD packet goes through ip6_mr_input, causing -MRT6MSG_NOCACHE message to be generated to user space. - -Make MLD packet only processed locally. - -Fixes: daad151263cf ("ipv6: Make ipv6_is_mld() inline and use it from ip6_mc_input().") -Signed-off-by: Hermin Anggawijaya -Signed-off-by: David S. Miller ---- - net/ipv6/ip6_input.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c -index f2e464e..57990c9 100644 ---- a/net/ipv6/ip6_input.c -+++ b/net/ipv6/ip6_input.c -@@ -331,10 +331,10 @@ int ip6_mc_input(struct sk_buff *skb) - if (offset < 0) - goto out; - -- if (!ipv6_is_mld(skb, nexthdr, offset)) -- goto out; -+ if (ipv6_is_mld(skb, nexthdr, offset)) -+ deliver = true; - -- deliver = true; -+ goto out; - } - /* unknown RA - process it normally */ - } --- -2.1.0 - - -From b8c2c9a2ae175da385649f0855b9b9fb03b6a799 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Mon, 6 Jul 2015 15:51:20 +0200 -Subject: [PATCH 02/46] rhashtable: fix for resize events during table walk - -[ Upstream commit 142b942a75cb10ede1b42bf85368d41449ab4e3b ] - -If rhashtable_walk_next detects a resize operation in progress, it jumps -to the new table and continues walking that one. But it misses to drop -the reference to it's current item, leading it to continue traversing -the new table's bucket in which the current item is sorted into, and -after reaching that bucket's end continues traversing the new table's -second bucket instead of the first one, thereby potentially missing -items. - -This fixes the rhashtable runtime test for me. Bug probably introduced -by Herbert Xu's patch eddee5ba ("rhashtable: Fix walker behaviour during -rehash") although not explicitly tested. - -Fixes: eddee5ba ("rhashtable: Fix walker behaviour during rehash") -Signed-off-by: Phil Sutter -Acked-by: Herbert Xu -Signed-off-by: David S. Miller ---- - lib/rhashtable.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/lib/rhashtable.c b/lib/rhashtable.c -index 8609378..cf910e4 100644 ---- a/lib/rhashtable.c -+++ b/lib/rhashtable.c -@@ -612,6 +612,8 @@ next: - iter->skip = 0; - } - -+ iter->p = NULL; -+ - /* Ensure we see any new tables. */ - smp_rmb(); - -@@ -622,8 +624,6 @@ next: - return ERR_PTR(-EAGAIN); - } - -- iter->p = NULL; -- - out: - - return obj; --- -2.1.0 - - -From 1ab639a7e8ab4f2263a5fdd611b33e0b9aff6b09 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Mon, 6 Jul 2015 17:13:26 +0200 -Subject: [PATCH 03/46] net: graceful exit from netif_alloc_netdev_queues() - -[ Upstream commit d339727c2b1a10f25e6636670ab6e1841170e328 ] - -User space can crash kernel with - -ip link add ifb10 numtxqueues 100000 type ifb - -We must replace a BUG_ON() by proper test and return -EINVAL for -crazy values. - -Fixes: 60877a32bce00 ("net: allow large number of tx queues") -Signed-off-by: Eric Dumazet -Signed-off-by: David S. Miller ---- - net/core/dev.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/core/dev.c b/net/core/dev.c -index aa82f9a..4723914 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -6297,7 +6297,8 @@ static int netif_alloc_netdev_queues(struct net_device *dev) - struct netdev_queue *tx; - size_t sz = count * sizeof(*tx); - -- BUG_ON(count < 1 || count > 0xffff); -+ if (count < 1 || count > 0xffff) -+ return -EINVAL; - - tx = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT); - if (!tx) { --- -2.1.0 - - -From fa72557a85e0032a819bcd857de185da10799dd4 Mon Sep 17 00:00:00 2001 -From: Nicolas Dichtel -Date: Mon, 6 Jul 2015 17:25:10 +0200 -Subject: [PATCH 04/46] Revert "dev: set iflink to 0 for virtual interfaces" - -[ Upstream commit 95ec655bc465ccb2a3329d4aff9a45e3c8188db5 ] - -This reverts commit e1622baf54df8cc958bf29d71de5ad545ea7d93c. - -The side effect of this commit is to add a '@NONE' after each virtual -interface name with a 'ip link'. It may break existing scripts. - -Reported-by: Olivier Hartkopp -Signed-off-by: Nicolas Dichtel -Tested-by: Oliver Hartkopp -Signed-off-by: David S. Miller ---- - net/core/dev.c | 4 ---- - 1 file changed, 4 deletions(-) - -diff --git a/net/core/dev.c b/net/core/dev.c -index 4723914..877ec57 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -672,10 +672,6 @@ int dev_get_iflink(const struct net_device *dev) - if (dev->netdev_ops && dev->netdev_ops->ndo_get_iflink) - return dev->netdev_ops->ndo_get_iflink(dev); - -- /* If dev->rtnl_link_ops is set, it's a virtual interface. */ -- if (dev->rtnl_link_ops) -- return 0; -- - return dev->ifindex; - } - EXPORT_SYMBOL(dev_get_iflink); --- -2.1.0 - - -From 75cead319911eab1b9813c55274b391128329d9b Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann -Date: Tue, 7 Jul 2015 00:07:52 +0200 -Subject: [PATCH 05/46] rtnetlink: verify IFLA_VF_INFO attributes before - passing them to driver - -[ Upstream commit 4f7d2cdfdde71ffe962399b7020c674050329423 ] - -Jason Gunthorpe reported that since commit c02db8c6290b ("rtnetlink: make -SR-IOV VF interface symmetric"), we don't verify IFLA_VF_INFO attributes -anymore with respect to their policy, that is, ifla_vfinfo_policy[]. - -Before, they were part of ifla_policy[], but they have been nested since -placed under IFLA_VFINFO_LIST, that contains the attribute IFLA_VF_INFO, -which is another nested attribute for the actual VF attributes such as -IFLA_VF_MAC, IFLA_VF_VLAN, etc. - -Despite the policy being split out from ifla_policy[] in this commit, -it's never applied anywhere. nla_for_each_nested() only does basic nla_ok() -testing for struct nlattr, but it doesn't know about the data context and -their requirements. - -Fix, on top of Jason's initial work, does 1) parsing of the attributes -with the right policy, and 2) using the resulting parsed attribute table -from 1) instead of the nla_for_each_nested() loop (just like we used to -do when still part of ifla_policy[]). - -Reference: http://thread.gmane.org/gmane.linux.network/368913 -Fixes: c02db8c6290b ("rtnetlink: make SR-IOV VF interface symmetric") -Reported-by: Jason Gunthorpe -Cc: Chris Wright -Cc: Sucheta Chakraborty -Cc: Greg Rose -Cc: Jeff Kirsher -Cc: Rony Efraim -Cc: Vlad Zolotarov -Cc: Nicolas Dichtel -Cc: Thomas Graf -Signed-off-by: Jason Gunthorpe -Signed-off-by: Daniel Borkmann -Acked-by: Vlad Zolotarov -Signed-off-by: David S. Miller ---- - net/core/rtnetlink.c | 187 ++++++++++++++++++++++++++------------------------- - 1 file changed, 96 insertions(+), 91 deletions(-) - -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 8de3682..fe95cb7 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -1287,10 +1287,6 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = { - [IFLA_INFO_SLAVE_DATA] = { .type = NLA_NESTED }, - }; - --static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = { -- [IFLA_VF_INFO] = { .type = NLA_NESTED }, --}; -- - static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = { - [IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) }, - [IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) }, -@@ -1437,96 +1433,98 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[]) - return 0; - } - --static int do_setvfinfo(struct net_device *dev, struct nlattr *attr) -+static int do_setvfinfo(struct net_device *dev, struct nlattr **tb) - { -- int rem, err = -EINVAL; -- struct nlattr *vf; - const struct net_device_ops *ops = dev->netdev_ops; -+ int err = -EINVAL; - -- nla_for_each_nested(vf, attr, rem) { -- switch (nla_type(vf)) { -- case IFLA_VF_MAC: { -- struct ifla_vf_mac *ivm; -- ivm = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_mac) -- err = ops->ndo_set_vf_mac(dev, ivm->vf, -- ivm->mac); -- break; -- } -- case IFLA_VF_VLAN: { -- struct ifla_vf_vlan *ivv; -- ivv = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_vlan) -- err = ops->ndo_set_vf_vlan(dev, ivv->vf, -- ivv->vlan, -- ivv->qos); -- break; -- } -- case IFLA_VF_TX_RATE: { -- struct ifla_vf_tx_rate *ivt; -- struct ifla_vf_info ivf; -- ivt = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_get_vf_config) -- err = ops->ndo_get_vf_config(dev, ivt->vf, -- &ivf); -- if (err) -- break; -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_rate) -- err = ops->ndo_set_vf_rate(dev, ivt->vf, -- ivf.min_tx_rate, -- ivt->rate); -- break; -- } -- case IFLA_VF_RATE: { -- struct ifla_vf_rate *ivt; -- ivt = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_rate) -- err = ops->ndo_set_vf_rate(dev, ivt->vf, -- ivt->min_tx_rate, -- ivt->max_tx_rate); -- break; -- } -- case IFLA_VF_SPOOFCHK: { -- struct ifla_vf_spoofchk *ivs; -- ivs = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_spoofchk) -- err = ops->ndo_set_vf_spoofchk(dev, ivs->vf, -- ivs->setting); -- break; -- } -- case IFLA_VF_LINK_STATE: { -- struct ifla_vf_link_state *ivl; -- ivl = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_link_state) -- err = ops->ndo_set_vf_link_state(dev, ivl->vf, -- ivl->link_state); -- break; -- } -- case IFLA_VF_RSS_QUERY_EN: { -- struct ifla_vf_rss_query_en *ivrssq_en; -+ if (tb[IFLA_VF_MAC]) { -+ struct ifla_vf_mac *ivm = nla_data(tb[IFLA_VF_MAC]); - -- ivrssq_en = nla_data(vf); -- err = -EOPNOTSUPP; -- if (ops->ndo_set_vf_rss_query_en) -- err = ops->ndo_set_vf_rss_query_en(dev, -- ivrssq_en->vf, -- ivrssq_en->setting); -- break; -- } -- default: -- err = -EINVAL; -- break; -- } -- if (err) -- break; -+ err = -EOPNOTSUPP; -+ if (ops->ndo_set_vf_mac) -+ err = ops->ndo_set_vf_mac(dev, ivm->vf, -+ ivm->mac); -+ if (err < 0) -+ return err; -+ } -+ -+ if (tb[IFLA_VF_VLAN]) { -+ struct ifla_vf_vlan *ivv = nla_data(tb[IFLA_VF_VLAN]); -+ -+ err = -EOPNOTSUPP; -+ if (ops->ndo_set_vf_vlan) -+ err = ops->ndo_set_vf_vlan(dev, ivv->vf, ivv->vlan, -+ ivv->qos); -+ if (err < 0) -+ return err; -+ } -+ -+ if (tb[IFLA_VF_TX_RATE]) { -+ struct ifla_vf_tx_rate *ivt = nla_data(tb[IFLA_VF_TX_RATE]); -+ struct ifla_vf_info ivf; -+ -+ err = -EOPNOTSUPP; -+ if (ops->ndo_get_vf_config) -+ err = ops->ndo_get_vf_config(dev, ivt->vf, &ivf); -+ if (err < 0) -+ return err; -+ -+ err = -EOPNOTSUPP; -+ if (ops->ndo_set_vf_rate) -+ err = ops->ndo_set_vf_rate(dev, ivt->vf, -+ ivf.min_tx_rate, -+ ivt->rate); -+ if (err < 0) -+ return err; -+ } -+ -+ if (tb[IFLA_VF_RATE]) { -+ struct ifla_vf_rate *ivt = nla_data(tb[IFLA_VF_RATE]); -+ -+ err = -EOPNOTSUPP; -+ if (ops->ndo_set_vf_rate) -+ err = ops->ndo_set_vf_rate(dev, ivt->vf, -+ ivt->min_tx_rate, -+ ivt->max_tx_rate); -+ if (err < 0) -+ return err; - } -+ -+ if (tb[IFLA_VF_SPOOFCHK]) { -+ struct ifla_vf_spoofchk *ivs = nla_data(tb[IFLA_VF_SPOOFCHK]); -+ -+ err = -EOPNOTSUPP; -+ if (ops->ndo_set_vf_spoofchk) -+ err = ops->ndo_set_vf_spoofchk(dev, ivs->vf, -+ ivs->setting); -+ if (err < 0) -+ return err; -+ } -+ -+ if (tb[IFLA_VF_LINK_STATE]) { -+ struct ifla_vf_link_state *ivl = nla_data(tb[IFLA_VF_LINK_STATE]); -+ -+ err = -EOPNOTSUPP; -+ if (ops->ndo_set_vf_link_state) -+ err = ops->ndo_set_vf_link_state(dev, ivl->vf, -+ ivl->link_state); -+ if (err < 0) -+ return err; -+ } -+ -+ if (tb[IFLA_VF_RSS_QUERY_EN]) { -+ struct ifla_vf_rss_query_en *ivrssq_en; -+ -+ err = -EOPNOTSUPP; -+ ivrssq_en = nla_data(tb[IFLA_VF_RSS_QUERY_EN]); -+ if (ops->ndo_set_vf_rss_query_en) -+ err = ops->ndo_set_vf_rss_query_en(dev, ivrssq_en->vf, -+ ivrssq_en->setting); -+ if (err < 0) -+ return err; -+ } -+ - return err; - } - -@@ -1722,14 +1720,21 @@ static int do_setlink(const struct sk_buff *skb, - } - - if (tb[IFLA_VFINFO_LIST]) { -+ struct nlattr *vfinfo[IFLA_VF_MAX + 1]; - struct nlattr *attr; - int rem; -+ - nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) { -- if (nla_type(attr) != IFLA_VF_INFO) { -+ if (nla_type(attr) != IFLA_VF_INFO || -+ nla_len(attr) < NLA_HDRLEN) { - err = -EINVAL; - goto errout; - } -- err = do_setvfinfo(dev, attr); -+ err = nla_parse_nested(vfinfo, IFLA_VF_MAX, attr, -+ ifla_vf_policy); -+ if (err < 0) -+ goto errout; -+ err = do_setvfinfo(dev, vfinfo); - if (err < 0) - goto errout; - status |= DO_SETLINK_NOTIFY; --- -2.1.0 - - -From e2205c42c1e82d357f7c5007f1507e0b9f341092 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Timo=20Ter=C3=A4s?= -Date: Tue, 7 Jul 2015 08:34:13 +0300 -Subject: [PATCH 06/46] ip_tunnel: fix ipv4 pmtu check to honor inner ip header - df -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -[ Upstream commit fc24f2b2094366da8786f59f2606307e934cea17 ] - -Frag needed should be sent only if the inner header asked -to not fragment. Currently fragmentation is broken if the -tunnel has df set, but df was not asked in the original -packet. The tunnel's df needs to be still checked to update -internally the pmtu cache. - -Commit 23a3647bc4f93bac broke it, and this commit fixes -the ipv4 df check back to the way it was. - -Fixes: 23a3647bc4f93bac ("ip_tunnels: Use skb-len to PMTU check.") -Cc: Pravin B Shelar -Signed-off-by: Timo Teräs -Acked-by: Pravin B Shelar -Signed-off-by: David S. Miller ---- - net/ipv4/ip_tunnel.c | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - -diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c -index 4c2c3ba..626d9e5 100644 ---- a/net/ipv4/ip_tunnel.c -+++ b/net/ipv4/ip_tunnel.c -@@ -586,7 +586,8 @@ int ip_tunnel_encap(struct sk_buff *skb, struct ip_tunnel *t, - EXPORT_SYMBOL(ip_tunnel_encap); - - static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, -- struct rtable *rt, __be16 df) -+ struct rtable *rt, __be16 df, -+ const struct iphdr *inner_iph) - { - struct ip_tunnel *tunnel = netdev_priv(dev); - int pkt_size = skb->len - tunnel->hlen - dev->hard_header_len; -@@ -603,7 +604,8 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, - - if (skb->protocol == htons(ETH_P_IP)) { - if (!skb_is_gso(skb) && -- (df & htons(IP_DF)) && mtu < pkt_size) { -+ (inner_iph->frag_off & htons(IP_DF)) && -+ mtu < pkt_size) { - memset(IPCB(skb), 0, sizeof(*IPCB(skb))); - icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu)); - return -E2BIG; -@@ -737,7 +739,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, - goto tx_error; - } - -- if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off)) { -+ if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off, inner_iph)) { - ip_rt_put(rt); - goto tx_error; - } --- -2.1.0 - - -From b663e59e521c92aec57078e512f54fa6cabe998a Mon Sep 17 00:00:00 2001 -From: Stephen Smalley -Date: Tue, 7 Jul 2015 09:43:45 -0400 -Subject: [PATCH 07/46] net/tipc: initialize security state for new connection - socket - -[ Upstream commit fdd75ea8df370f206a8163786e7470c1277a5064 ] - -Calling connect() with an AF_TIPC socket would trigger a series -of error messages from SELinux along the lines of: -SELinux: Invalid class 0 -type=AVC msg=audit(1434126658.487:34500): avc: denied { } - for pid=292 comm="kworker/u16:5" scontext=system_u:system_r:kernel_t:s0 - tcontext=system_u:object_r:unlabeled_t:s0 tclass= - permissive=0 - -This was due to a failure to initialize the security state of the new -connection sock by the tipc code, leaving it with junk in the security -class field and an unlabeled secid. Add a call to security_sk_clone() -to inherit the security state from the parent socket. - -Reported-by: Tim Shearer -Signed-off-by: Stephen Smalley -Acked-by: Paul Moore -Acked-by: Ying Xue -Signed-off-by: David S. Miller ---- - net/tipc/socket.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/net/tipc/socket.c b/net/tipc/socket.c -index f485600..20cc6df 100644 ---- a/net/tipc/socket.c -+++ b/net/tipc/socket.c -@@ -2009,6 +2009,7 @@ static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags) - res = tipc_sk_create(sock_net(sock->sk), new_sock, 0, 1); - if (res) - goto exit; -+ security_sk_clone(sock->sk, new_sock->sk); - - new_sk = new_sock->sk; - new_tsock = tipc_sk(new_sk); --- -2.1.0 - - -From b5e30ebfbf8c2b93970492ab66be1778b3114332 Mon Sep 17 00:00:00 2001 -From: Nikolay Aleksandrov -Date: Tue, 7 Jul 2015 15:55:56 +0200 -Subject: [PATCH 08/46] bridge: mdb: zero out the local br_ip variable before - use - -[ Upstream commit f1158b74e54f2e2462ba5e2f45a118246d9d5b43 ] - -Since commit b0e9a30dd669 ("bridge: Add vlan id to multicast groups") -there's a check in br_ip_equal() for a matching vlan id, but the mdb -functions were not modified to use (or at least zero it) so when an -entry was added it would have a garbage vlan id (from the local br_ip -variable in __br_mdb_add/del) and this would prevent it from being -matched and also deleted. So zero out the whole local ip var to protect -ourselves from future changes and also to fix the current bug, since -there's no vlan id support in the mdb uapi - use always vlan id 0. -Example before patch: -root@debian:~# bridge mdb add dev br0 port eth1 grp 239.0.0.1 permanent -root@debian:~# bridge mdb -dev br0 port eth1 grp 239.0.0.1 permanent -root@debian:~# bridge mdb del dev br0 port eth1 grp 239.0.0.1 permanent -RTNETLINK answers: Invalid argument - -After patch: -root@debian:~# bridge mdb add dev br0 port eth1 grp 239.0.0.1 permanent -root@debian:~# bridge mdb -dev br0 port eth1 grp 239.0.0.1 permanent -root@debian:~# bridge mdb del dev br0 port eth1 grp 239.0.0.1 permanent -root@debian:~# bridge mdb - -Signed-off-by: Nikolay Aleksandrov -Fixes: b0e9a30dd669 ("bridge: Add vlan id to multicast groups") -Signed-off-by: David S. Miller ---- - net/bridge/br_mdb.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c -index e29ad70..cc00066 100644 ---- a/net/bridge/br_mdb.c -+++ b/net/bridge/br_mdb.c -@@ -371,6 +371,7 @@ static int __br_mdb_add(struct net *net, struct net_bridge *br, - if (!p || p->br != br || p->state == BR_STATE_DISABLED) - return -EINVAL; - -+ memset(&ip, 0, sizeof(ip)); - ip.proto = entry->addr.proto; - if (ip.proto == htons(ETH_P_IP)) - ip.u.ip4 = entry->addr.u.ip4; -@@ -417,6 +418,7 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry) - if (!netif_running(br->dev) || br->multicast_disabled) - return -EINVAL; - -+ memset(&ip, 0, sizeof(ip)); - ip.proto = entry->addr.proto; - if (ip.proto == htons(ETH_P_IP)) { - if (timer_pending(&br->ip4_other_query.timer)) --- -2.1.0 - - -From fe98c4431957e308595cc5af799cb9f86c0875d1 Mon Sep 17 00:00:00 2001 -From: Oleg Nesterov -Date: Wed, 8 Jul 2015 21:42:11 +0200 -Subject: [PATCH 09/46] net: pktgen: fix race between pktgen_thread_worker() - and kthread_stop() - -[ Upstream commit fecdf8be2d91e04b0a9a4f79ff06499a36f5d14f ] - -pktgen_thread_worker() is obviously racy, kthread_stop() can come -between the kthread_should_stop() check and set_current_state(). - -Signed-off-by: Oleg Nesterov -Reported-by: Jan Stancek -Reported-by: Marcelo Leitner -Signed-off-by: David S. Miller ---- - net/core/pktgen.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/net/core/pktgen.c b/net/core/pktgen.c -index 508155b..043ea186 100644 ---- a/net/core/pktgen.c -+++ b/net/core/pktgen.c -@@ -3490,8 +3490,10 @@ static int pktgen_thread_worker(void *arg) - pktgen_rem_thread(t); - - /* Wait for kthread_stop */ -- while (!kthread_should_stop()) { -+ for (;;) { - set_current_state(TASK_INTERRUPTIBLE); -+ if (kthread_should_stop()) -+ break; - schedule(); - } - __set_current_state(TASK_RUNNING); --- -2.1.0 - - -From 15d50c4f295d8403f6fd818391e04b2c4f3e9637 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Thu, 9 Jul 2015 18:56:07 +0200 -Subject: [PATCH 10/46] bridge: fix potential crash in __netdev_pick_tx() - -[ Upstream commit a7d35f9d73e9ffa74a02304b817e579eec632f67 ] - -Commit c29390c6dfee ("xps: must clear sender_cpu before forwarding") -fixed an issue in normal forward path, caused by sender_cpu & napi_id -skb fields being an union. - -Bridge is another point where skb can be forwarded, so we need -the same cure. - -Bug triggers if packet was received on a NIC using skb_mark_napi_id() - -Fixes: 2bd82484bb4c ("xps: fix xps for stacked devices") -Signed-off-by: Eric Dumazet -Reported-by: Bob Liu -Tested-by: Bob Liu -Signed-off-by: David S. Miller ---- - net/bridge/br_forward.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c -index e97572b..0ff6e1b 100644 ---- a/net/bridge/br_forward.c -+++ b/net/bridge/br_forward.c -@@ -42,6 +42,7 @@ int br_dev_queue_push_xmit(struct sock *sk, struct sk_buff *skb) - } else { - skb_push(skb, ETH_HLEN); - br_drop_fake_rtable(skb); -+ skb_sender_cpu_clear(skb); - dev_queue_xmit(skb); - } - --- -2.1.0 - - -From 7bb85c2bd072511dd095c3c8ecbe063064ba2c5f Mon Sep 17 00:00:00 2001 -From: Julian Anastasov -Date: Thu, 9 Jul 2015 09:59:09 +0300 -Subject: [PATCH 11/46] net: do not process device backlog during - unregistration - -[ Upstream commit e9e4dd3267d0c5234c5c0f47440456b10875dec9 ] - -commit 381c759d9916 ("ipv4: Avoid crashing in ip_error") -fixes a problem where processed packet comes from device -with destroyed inetdev (dev->ip_ptr). This is not expected -because inetdev_destroy is called in NETDEV_UNREGISTER -phase and packets should not be processed after -dev_close_many() and synchronize_net(). Above fix is still -required because inetdev_destroy can be called for other -reasons. But it shows the real problem: backlog can keep -packets for long time and they do not hold reference to -device. Such packets are then delivered to upper levels -at the same time when device is unregistered. -Calling flush_backlog after NETDEV_UNREGISTER_FINAL still -accounts all packets from backlog but before that some packets -continue to be delivered to upper levels long after the -synchronize_net call which is supposed to wait the last -ones. Also, as Eric pointed out, processed packets, mostly -from other devices, can continue to add new packets to backlog. - -Fix the problem by moving flush_backlog early, after the -device driver is stopped and before the synchronize_net() call. -Then use netif_running check to make sure we do not add more -packets to backlog. We have to do it in enqueue_to_backlog -context when the local IRQ is disabled. As result, after the -flush_backlog and synchronize_net sequence all packets -should be accounted. - -Thanks to Eric W. Biederman for the test script and his -valuable feedback! - -Reported-by: Vittorio Gambaletta -Fixes: 6e583ce5242f ("net: eliminate refcounting in backlog queue") -Cc: Eric W. Biederman -Cc: Stephen Hemminger -Signed-off-by: Julian Anastasov -Signed-off-by: David S. Miller ---- - net/core/dev.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/net/core/dev.c b/net/core/dev.c -index 877ec57..cb49e01 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -3337,6 +3337,8 @@ static int enqueue_to_backlog(struct sk_buff *skb, int cpu, - local_irq_save(flags); - - rps_lock(sd); -+ if (!netif_running(skb->dev)) -+ goto drop; - qlen = skb_queue_len(&sd->input_pkt_queue); - if (qlen <= netdev_max_backlog && !skb_flow_limit(skb, qlen)) { - if (qlen) { -@@ -3358,6 +3360,7 @@ enqueue: - goto enqueue; - } - -+drop: - sd->dropped++; - rps_unlock(sd); - -@@ -6023,6 +6026,7 @@ static void rollback_registered_many(struct list_head *head) - unlist_netdevice(dev); - - dev->reg_state = NETREG_UNREGISTERING; -+ on_each_cpu(flush_backlog, dev, 1); - } - - synchronize_net(); -@@ -6647,8 +6651,6 @@ void netdev_run_todo(void) - - dev->reg_state = NETREG_UNREGISTERED; - -- on_each_cpu(flush_backlog, dev, 1); -- - netdev_wait_allrefs(dev); - - /* paranoia */ --- -2.1.0 - - -From c979c0e11800c79634b6b9d33ddb8f4cc03c81fa Mon Sep 17 00:00:00 2001 -From: Julian Anastasov -Date: Thu, 9 Jul 2015 09:59:10 +0300 -Subject: [PATCH 12/46] net: call rcu_read_lock early in process_backlog - -[ Upstream commit 2c17d27c36dcce2b6bf689f41a46b9e909877c21 ] - -Incoming packet should be either in backlog queue or -in RCU read-side section. Otherwise, the final sequence of -flush_backlog() and synchronize_net() may miss packets -that can run without device reference: - -CPU 1 CPU 2 - skb->dev: no reference - process_backlog:__skb_dequeue - process_backlog:local_irq_enable - -on_each_cpu for -flush_backlog => IPI(hardirq): flush_backlog - - packet not found in backlog - - CPU delayed ... -synchronize_net -- no ongoing RCU -read-side sections - -netdev_run_todo, -rcu_barrier: no -ongoing callbacks - __netif_receive_skb_core:rcu_read_lock - - too late -free dev - process packet for freed dev - -Fixes: 6e583ce5242f ("net: eliminate refcounting in backlog queue") -Cc: Eric W. Biederman -Cc: Stephen Hemminger -Signed-off-by: Julian Anastasov -Signed-off-by: David S. Miller ---- - net/core/dev.c | 30 +++++++++++++++--------------- - 1 file changed, 15 insertions(+), 15 deletions(-) - -diff --git a/net/core/dev.c b/net/core/dev.c -index cb49e01..a42b232 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -3666,8 +3666,6 @@ static int __netif_receive_skb_core(struct sk_buff *skb, bool pfmemalloc) - - pt_prev = NULL; - -- rcu_read_lock(); -- - another_round: - skb->skb_iif = skb->dev->ifindex; - -@@ -3677,7 +3675,7 @@ another_round: - skb->protocol == cpu_to_be16(ETH_P_8021AD)) { - skb = skb_vlan_untag(skb); - if (unlikely(!skb)) -- goto unlock; -+ goto out; - } - - #ifdef CONFIG_NET_CLS_ACT -@@ -3707,7 +3705,7 @@ skip_taps: - if (static_key_false(&ingress_needed)) { - skb = handle_ing(skb, &pt_prev, &ret, orig_dev); - if (!skb) -- goto unlock; -+ goto out; - } - - skb->tc_verd = 0; -@@ -3724,7 +3722,7 @@ ncls: - if (vlan_do_receive(&skb)) - goto another_round; - else if (unlikely(!skb)) -- goto unlock; -+ goto out; - } - - rx_handler = rcu_dereference(skb->dev->rx_handler); -@@ -3736,7 +3734,7 @@ ncls: - switch (rx_handler(&skb)) { - case RX_HANDLER_CONSUMED: - ret = NET_RX_SUCCESS; -- goto unlock; -+ goto out; - case RX_HANDLER_ANOTHER: - goto another_round; - case RX_HANDLER_EXACT: -@@ -3790,8 +3788,7 @@ drop: - ret = NET_RX_DROP; - } - --unlock: -- rcu_read_unlock(); -+out: - return ret; - } - -@@ -3822,29 +3819,30 @@ static int __netif_receive_skb(struct sk_buff *skb) - - static int netif_receive_skb_internal(struct sk_buff *skb) - { -+ int ret; -+ - net_timestamp_check(netdev_tstamp_prequeue, skb); - - if (skb_defer_rx_timestamp(skb)) - return NET_RX_SUCCESS; - -+ rcu_read_lock(); -+ - #ifdef CONFIG_RPS - if (static_key_false(&rps_needed)) { - struct rps_dev_flow voidflow, *rflow = &voidflow; -- int cpu, ret; -- -- rcu_read_lock(); -- -- cpu = get_rps_cpu(skb->dev, skb, &rflow); -+ int cpu = get_rps_cpu(skb->dev, skb, &rflow); - - if (cpu >= 0) { - ret = enqueue_to_backlog(skb, cpu, &rflow->last_qtail); - rcu_read_unlock(); - return ret; - } -- rcu_read_unlock(); - } - #endif -- return __netif_receive_skb(skb); -+ ret = __netif_receive_skb(skb); -+ rcu_read_unlock(); -+ return ret; - } - - /** -@@ -4389,8 +4387,10 @@ static int process_backlog(struct napi_struct *napi, int quota) - struct sk_buff *skb; - - while ((skb = __skb_dequeue(&sd->process_queue))) { -+ rcu_read_lock(); - local_irq_enable(); - __netif_receive_skb(skb); -+ rcu_read_unlock(); - local_irq_disable(); - input_queue_head_incr(sd); - if (++work >= quota) { --- -2.1.0 - - -From 9648a7edaa4326282fef3dbb8de9756d8edbfd0a Mon Sep 17 00:00:00 2001 -From: Dan Carpenter -Date: Sun, 12 Jul 2015 01:20:55 +0300 -Subject: [PATCH 13/46] net/xen-netback: off by one in BUG_ON() condition - -[ Upstream commit 50c2e4dd6749725338621fff456b26d3a592259f ] - -The > should be >=. I also added spaces around the '-' operations so -the code is a little more consistent and matches the condition better. - -Fixes: f53c3fe8dad7 ('xen-netback: Introduce TX grant mapping') -Signed-off-by: Dan Carpenter -Signed-off-by: David S. Miller ---- - drivers/net/xen-netback/netback.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c -index 0d25943..0866c5d 100644 ---- a/drivers/net/xen-netback/netback.c -+++ b/drivers/net/xen-netback/netback.c -@@ -1571,13 +1571,13 @@ static inline void xenvif_tx_dealloc_action(struct xenvif_queue *queue) - smp_rmb(); - - while (dc != dp) { -- BUG_ON(gop - queue->tx_unmap_ops > MAX_PENDING_REQS); -+ BUG_ON(gop - queue->tx_unmap_ops >= MAX_PENDING_REQS); - pending_idx = - queue->dealloc_ring[pending_index(dc++)]; - -- pending_idx_release[gop-queue->tx_unmap_ops] = -+ pending_idx_release[gop - queue->tx_unmap_ops] = - pending_idx; -- queue->pages_to_unmap[gop-queue->tx_unmap_ops] = -+ queue->pages_to_unmap[gop - queue->tx_unmap_ops] = - queue->mmap_pages[pending_idx]; - gnttab_set_unmap_op(gop, - idx_to_kaddr(queue, pending_idx), --- -2.1.0 - - -From d015db1b0649539f4473113aec24589a84c49dda Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Mon, 13 Jul 2015 16:04:13 +0800 -Subject: [PATCH 14/46] net: Clone skb before setting peeked flag - -[ Upstream commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec ] - -Shared skbs must not be modified and this is crucial for broadcast -and/or multicast paths where we use it as an optimisation to avoid -unnecessary cloning. - -The function skb_recv_datagram breaks this rule by setting peeked -without cloning the skb first. This causes funky races which leads -to double-free. - -This patch fixes this by cloning the skb and replacing the skb -in the list when setting skb->peeked. - -Fixes: a59322be07c9 ("[UDP]: Only increment counter on first peek/recv") -Reported-by: Konstantin Khlebnikov -Signed-off-by: Herbert Xu -Signed-off-by: David S. Miller ---- - net/core/datagram.c | 41 ++++++++++++++++++++++++++++++++++++++--- - 1 file changed, 38 insertions(+), 3 deletions(-) - -diff --git a/net/core/datagram.c b/net/core/datagram.c -index b80fb91..4e9a3f6 100644 ---- a/net/core/datagram.c -+++ b/net/core/datagram.c -@@ -131,6 +131,35 @@ out_noerr: - goto out; - } - -+static int skb_set_peeked(struct sk_buff *skb) -+{ -+ struct sk_buff *nskb; -+ -+ if (skb->peeked) -+ return 0; -+ -+ /* We have to unshare an skb before modifying it. */ -+ if (!skb_shared(skb)) -+ goto done; -+ -+ nskb = skb_clone(skb, GFP_ATOMIC); -+ if (!nskb) -+ return -ENOMEM; -+ -+ skb->prev->next = nskb; -+ skb->next->prev = nskb; -+ nskb->prev = skb->prev; -+ nskb->next = skb->next; -+ -+ consume_skb(skb); -+ skb = nskb; -+ -+done: -+ skb->peeked = 1; -+ -+ return 0; -+} -+ - /** - * __skb_recv_datagram - Receive a datagram skbuff - * @sk: socket -@@ -165,7 +194,9 @@ out_noerr: - struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, - int *peeked, int *off, int *err) - { -+ struct sk_buff_head *queue = &sk->sk_receive_queue; - struct sk_buff *skb, *last; -+ unsigned long cpu_flags; - long timeo; - /* - * Caller is allowed not to check sk->sk_err before skb_recv_datagram() -@@ -184,8 +215,6 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, - * Look at current nfs client by the way... - * However, this function was correct in any case. 8) - */ -- unsigned long cpu_flags; -- struct sk_buff_head *queue = &sk->sk_receive_queue; - int _off = *off; - - last = (struct sk_buff *)queue; -@@ -199,7 +228,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, - _off -= skb->len; - continue; - } -- skb->peeked = 1; -+ -+ error = skb_set_peeked(skb); -+ if (error) -+ goto unlock_err; -+ - atomic_inc(&skb->users); - } else - __skb_unlink(skb, queue); -@@ -223,6 +256,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, - - return NULL; - -+unlock_err: -+ spin_unlock_irqrestore(&queue->lock, cpu_flags); - no_packet: - *err = error; - return NULL; --- -2.1.0 - - -From cf2492918d52dee5f35b16cbba65d7000ff35ce2 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Mon, 13 Jul 2015 20:01:42 +0800 -Subject: [PATCH 15/46] net: Fix skb csum races when peeking - -[ Upstream commit 89c22d8c3b278212eef6a8cc66b570bc840a6f5a ] - -When we calculate the checksum on the recv path, we store the -result in the skb as an optimisation in case we need the checksum -again down the line. - -This is in fact bogus for the MSG_PEEK case as this is done without -any locking. So multiple threads can peek and then store the result -to the same skb, potentially resulting in bogus skb states. - -This patch fixes this by only storing the result if the skb is not -shared. This preserves the optimisations for the few cases where -it can be done safely due to locking or other reasons, e.g., SIOCINQ. - -Signed-off-by: Herbert Xu -Acked-by: Eric Dumazet -Signed-off-by: David S. Miller ---- - net/core/datagram.c | 15 +++++++++------ - 1 file changed, 9 insertions(+), 6 deletions(-) - -diff --git a/net/core/datagram.c b/net/core/datagram.c -index 4e9a3f6..4967262 100644 ---- a/net/core/datagram.c -+++ b/net/core/datagram.c -@@ -657,7 +657,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len) - !skb->csum_complete_sw) - netdev_rx_csum_fault(skb->dev); - } -- skb->csum_valid = !sum; -+ if (!skb_shared(skb)) -+ skb->csum_valid = !sum; - return sum; - } - EXPORT_SYMBOL(__skb_checksum_complete_head); -@@ -677,11 +678,13 @@ __sum16 __skb_checksum_complete(struct sk_buff *skb) - netdev_rx_csum_fault(skb->dev); - } - -- /* Save full packet checksum */ -- skb->csum = csum; -- skb->ip_summed = CHECKSUM_COMPLETE; -- skb->csum_complete_sw = 1; -- skb->csum_valid = !sum; -+ if (!skb_shared(skb)) { -+ /* Save full packet checksum */ -+ skb->csum = csum; -+ skb->ip_summed = CHECKSUM_COMPLETE; -+ skb->csum_complete_sw = 1; -+ skb->csum_valid = !sum; -+ } - - return sum; - } --- -2.1.0 - - -From e2d3e7bcf6679da22c3a68837c4b3c78db3ec110 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Tue, 4 Aug 2015 15:42:47 +0800 -Subject: [PATCH 16/46] net: Fix skb_set_peeked use-after-free bug - -[ Upstream commit a0a2a6602496a45ae838a96db8b8173794b5d398 ] - -The commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec ("net: Clone -skb before setting peeked flag") introduced a use-after-free bug -in skb_recv_datagram. This is because skb_set_peeked may create -a new skb and free the existing one. As it stands the caller will -continue to use the old freed skb. - -This patch fixes it by making skb_set_peeked return the new skb -(or the old one if unchanged). - -Fixes: 738ac1ebb96d ("net: Clone skb before setting peeked flag") -Reported-by: Brenden Blanco -Signed-off-by: Herbert Xu -Tested-by: Brenden Blanco -Reviewed-by: Konstantin Khlebnikov -Signed-off-by: David S. Miller ---- - net/core/datagram.c | 13 +++++++------ - 1 file changed, 7 insertions(+), 6 deletions(-) - -diff --git a/net/core/datagram.c b/net/core/datagram.c -index 4967262..617088a 100644 ---- a/net/core/datagram.c -+++ b/net/core/datagram.c -@@ -131,12 +131,12 @@ out_noerr: - goto out; - } - --static int skb_set_peeked(struct sk_buff *skb) -+static struct sk_buff *skb_set_peeked(struct sk_buff *skb) - { - struct sk_buff *nskb; - - if (skb->peeked) -- return 0; -+ return skb; - - /* We have to unshare an skb before modifying it. */ - if (!skb_shared(skb)) -@@ -144,7 +144,7 @@ static int skb_set_peeked(struct sk_buff *skb) - - nskb = skb_clone(skb, GFP_ATOMIC); - if (!nskb) -- return -ENOMEM; -+ return ERR_PTR(-ENOMEM); - - skb->prev->next = nskb; - skb->next->prev = nskb; -@@ -157,7 +157,7 @@ static int skb_set_peeked(struct sk_buff *skb) - done: - skb->peeked = 1; - -- return 0; -+ return skb; - } - - /** -@@ -229,8 +229,9 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, - continue; - } - -- error = skb_set_peeked(skb); -- if (error) -+ skb = skb_set_peeked(skb); -+ error = PTR_ERR(skb); -+ if (IS_ERR(skb)) - goto unlock_err; - - atomic_inc(&skb->users); --- -2.1.0 - - -From f82e3fd078652a9b64f6b129d5b8eddb76481093 Mon Sep 17 00:00:00 2001 -From: Nikolay Aleksandrov -Date: Mon, 13 Jul 2015 06:36:19 -0700 -Subject: [PATCH 17/46] bridge: mdb: fix double add notification - -[ Upstream commit 5ebc784625ea68a9570d1f70557e7932988cd1b4 ] - -Since the mdb add/del code was introduced there have been 2 br_mdb_notify -calls when doing br_mdb_add() resulting in 2 notifications on each add. - -Example: - Command: bridge mdb add dev br0 port eth1 grp 239.0.0.1 permanent - Before patch: - root@debian:~# bridge monitor all - [MDB]dev br0 port eth1 grp 239.0.0.1 permanent - [MDB]dev br0 port eth1 grp 239.0.0.1 permanent - - After patch: - root@debian:~# bridge monitor all - [MDB]dev br0 port eth1 grp 239.0.0.1 permanent - -Signed-off-by: Nikolay Aleksandrov -Fixes: cfd567543590 ("bridge: add support of adding and deleting mdb entries") -Signed-off-by: David S. Miller ---- - net/bridge/br_mdb.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c -index cc00066..d1f910c 100644 ---- a/net/bridge/br_mdb.c -+++ b/net/bridge/br_mdb.c -@@ -348,7 +348,6 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port, - return -ENOMEM; - rcu_assign_pointer(*pp, p); - -- br_mdb_notify(br->dev, port, group, RTM_NEWMDB); - return 0; - } - --- -2.1.0 - - -From 8e96bd6de5d8c4acd2faeb9b950bd2ff42a8275a Mon Sep 17 00:00:00 2001 -From: WANG Cong -Date: Mon, 13 Jul 2015 12:30:07 -0700 -Subject: [PATCH 18/46] fq_codel: fix a use-after-free - -[ Upstream commit 052cbda41fdc243a8d40cce7ab3a6327b4b2887e ] - -Fixes: 25331d6ce42b ("net: sched: implement qstat helper routines") -Cc: John Fastabend -Signed-off-by: Cong Wang -Signed-off-by: Cong Wang -Acked-by: Eric Dumazet -Signed-off-by: David S. Miller ---- - net/sched/sch_fq_codel.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c -index c244c45b..9291598 100644 ---- a/net/sched/sch_fq_codel.c -+++ b/net/sched/sch_fq_codel.c -@@ -162,10 +162,10 @@ static unsigned int fq_codel_drop(struct Qdisc *sch) - skb = dequeue_head(flow); - len = qdisc_pkt_len(skb); - q->backlogs[idx] -= len; -- kfree_skb(skb); - sch->q.qlen--; - qdisc_qstats_drop(sch); - qdisc_qstats_backlog_dec(sch, skb); -+ kfree_skb(skb); - flow->dropped++; - return idx; - } --- -2.1.0 - - -From d4657581d01faad94a50b03f31bbe33c3b6dcb14 Mon Sep 17 00:00:00 2001 -From: Tilman Schmidt -Date: Tue, 14 Jul 2015 00:37:13 +0200 -Subject: [PATCH 19/46] isdn/gigaset: reset tty->receive_room when attaching - ser_gigaset - -[ Upstream commit fd98e9419d8d622a4de91f76b306af6aa627aa9c ] - -Commit 79901317ce80 ("n_tty: Don't flush buffer when closing ldisc"), -first merged in kernel release 3.10, caused the following regression -in the Gigaset M101 driver: - -Before that commit, when closing the N_TTY line discipline in -preparation to switching to N_GIGASET_M101, receive_room would be -reset to a non-zero value by the call to n_tty_flush_buffer() in -n_tty's close method. With the removal of that call, receive_room -might be left at zero, blocking data reception on the serial line. - -The present patch fixes that regression by setting receive_room -to an appropriate value in the ldisc open method. - -Fixes: 79901317ce80 ("n_tty: Don't flush buffer when closing ldisc") -Signed-off-by: Tilman Schmidt -Signed-off-by: David S. Miller ---- - drivers/isdn/gigaset/ser-gigaset.c | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - -diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c -index 8c91fd5..3ac9c41 100644 ---- a/drivers/isdn/gigaset/ser-gigaset.c -+++ b/drivers/isdn/gigaset/ser-gigaset.c -@@ -524,9 +524,18 @@ gigaset_tty_open(struct tty_struct *tty) - cs->hw.ser->tty = tty; - atomic_set(&cs->hw.ser->refcnt, 1); - init_completion(&cs->hw.ser->dead_cmp); -- - tty->disc_data = cs; - -+ /* Set the amount of data we're willing to receive per call -+ * from the hardware driver to half of the input buffer size -+ * to leave some reserve. -+ * Note: We don't do flow control towards the hardware driver. -+ * If more data is received than will fit into the input buffer, -+ * it will be dropped and an error will be logged. This should -+ * never happen as the device is slow and the buffer size ample. -+ */ -+ tty->receive_room = RBUFSIZE/2; -+ - /* OK.. Initialization of the datastructures and the HW is done.. Now - * startup system and notify the LL that we are ready to run - */ --- -2.1.0 - - -From a5802a78d70219bb1f2e5f6726486e3834b1270d Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Tue, 14 Jul 2015 08:10:22 +0200 -Subject: [PATCH 20/46] ipv6: lock socket in ip6_datagram_connect() - -[ Upstream commit 03645a11a570d52e70631838cb786eb4253eb463 ] - -ip6_datagram_connect() is doing a lot of socket changes without -socket being locked. - -This looks wrong, at least for udp_lib_rehash() which could corrupt -lists because of concurrent udp_sk(sk)->udp_portaddr_hash accesses. - -Signed-off-by: Eric Dumazet -Acked-by: Herbert Xu -Signed-off-by: David S. Miller ---- - include/net/ip.h | 1 + - net/ipv4/datagram.c | 16 ++++++++++++---- - net/ipv6/datagram.c | 20 +++++++++++++++----- - 3 files changed, 28 insertions(+), 9 deletions(-) - -diff --git a/include/net/ip.h b/include/net/ip.h -index d14af7e..f41fc49 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -161,6 +161,7 @@ static inline __u8 get_rtconn_flags(struct ipcm_cookie* ipc, struct sock* sk) - } - - /* datagram.c */ -+int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len); - int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len); - - void ip4_datagram_release_cb(struct sock *sk); -diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c -index 90c0e83..574fad9 100644 ---- a/net/ipv4/datagram.c -+++ b/net/ipv4/datagram.c -@@ -20,7 +20,7 @@ - #include - #include - --int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) -+int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - { - struct inet_sock *inet = inet_sk(sk); - struct sockaddr_in *usin = (struct sockaddr_in *) uaddr; -@@ -39,8 +39,6 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - - sk_dst_reset(sk); - -- lock_sock(sk); -- - oif = sk->sk_bound_dev_if; - saddr = inet->inet_saddr; - if (ipv4_is_multicast(usin->sin_addr.s_addr)) { -@@ -82,9 +80,19 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - sk_dst_set(sk, &rt->dst); - err = 0; - out: -- release_sock(sk); - return err; - } -+EXPORT_SYMBOL(__ip4_datagram_connect); -+ -+int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) -+{ -+ int res; -+ -+ lock_sock(sk); -+ res = __ip4_datagram_connect(sk, uaddr, addr_len); -+ release_sock(sk); -+ return res; -+} - EXPORT_SYMBOL(ip4_datagram_connect); - - /* Because UDP xmit path can manipulate sk_dst_cache without holding -diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c -index 62d908e..b10a889 100644 ---- a/net/ipv6/datagram.c -+++ b/net/ipv6/datagram.c -@@ -40,7 +40,7 @@ static bool ipv6_mapped_addr_any(const struct in6_addr *a) - return ipv6_addr_v4mapped(a) && (a->s6_addr32[3] == 0); - } - --int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) -+static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - { - struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr; - struct inet_sock *inet = inet_sk(sk); -@@ -56,7 +56,7 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - if (usin->sin6_family == AF_INET) { - if (__ipv6_only_sock(sk)) - return -EAFNOSUPPORT; -- err = ip4_datagram_connect(sk, uaddr, addr_len); -+ err = __ip4_datagram_connect(sk, uaddr, addr_len); - goto ipv4_connected; - } - -@@ -98,9 +98,9 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - sin.sin_addr.s_addr = daddr->s6_addr32[3]; - sin.sin_port = usin->sin6_port; - -- err = ip4_datagram_connect(sk, -- (struct sockaddr *) &sin, -- sizeof(sin)); -+ err = __ip4_datagram_connect(sk, -+ (struct sockaddr *) &sin, -+ sizeof(sin)); - - ipv4_connected: - if (err) -@@ -204,6 +204,16 @@ out: - fl6_sock_release(flowlabel); - return err; - } -+ -+int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) -+{ -+ int res; -+ -+ lock_sock(sk); -+ res = __ip6_datagram_connect(sk, uaddr, addr_len); -+ release_sock(sk); -+ return res; -+} - EXPORT_SYMBOL_GPL(ip6_datagram_connect); - - int ip6_datagram_connect_v6_only(struct sock *sk, struct sockaddr *uaddr, --- -2.1.0 - - -From 1c0df6bdc731f7692a1fafd9c606135ba714e7c6 Mon Sep 17 00:00:00 2001 -From: Nikolay Aleksandrov -Date: Wed, 15 Jul 2015 21:52:51 +0200 -Subject: [PATCH 21/46] bonding: fix destruction of bond with devices different - from arphrd_ether - -[ Upstream commit 06f6d1094aa0992432b1e2a0920b0ee86ccd83bf ] - -When the bonding is being unloaded and the netdevice notifier is -unregistered it executes NETDEV_UNREGISTER for each device which should -remove the bond's proc entry but if the device enslaved is not of -ARPHRD_ETHER type and is in front of the bonding, it may execute -bond_release_and_destroy() first which would release the last slave and -destroy the bond device leaving the proc entry and thus we will get the -following error (with dynamic debug on for bond_netdev_event to see the -events order): -[ 908.963051] eql: event: 9 -[ 908.963052] eql: IFF_SLAVE -[ 908.963054] eql: event: 2 -[ 908.963056] eql: IFF_SLAVE -[ 908.963058] eql: event: 6 -[ 908.963059] eql: IFF_SLAVE -[ 908.963110] bond0: Releasing active interface eql -[ 908.976168] bond0: Destroying bond bond0 -[ 908.976266] bond0 (unregistering): Released all slaves -[ 908.984097] ------------[ cut here ]------------ -[ 908.984107] WARNING: CPU: 0 PID: 1787 at fs/proc/generic.c:575 -remove_proc_entry+0x112/0x160() -[ 908.984110] remove_proc_entry: removing non-empty directory -'net/bonding', leaking at least 'bond0' -[ 908.984111] Modules linked in: bonding(-) eql(O) 9p nfsd auth_rpcgss -oid_registry nfs_acl nfs lockd grace fscache sunrpc crct10dif_pclmul -crc32_pclmul crc32c_intel ghash_clmulni_intel ppdev qxl drm_kms_helper -snd_hda_codec_generic aesni_intel ttm aes_x86_64 glue_helper pcspkr lrw -gf128mul ablk_helper cryptd snd_hda_intel virtio_console snd_hda_codec -psmouse serio_raw snd_hwdep snd_hda_core 9pnet_virtio 9pnet evdev joydev -drm virtio_balloon snd_pcm snd_timer snd soundcore i2c_piix4 i2c_core -pvpanic acpi_cpufreq parport_pc parport processor thermal_sys button -autofs4 ext4 crc16 mbcache jbd2 hid_generic usbhid hid sg sr_mod cdrom -ata_generic virtio_blk virtio_net floppy ata_piix e1000 libata ehci_pci -virtio_pci scsi_mod uhci_hcd ehci_hcd virtio_ring virtio usbcore -usb_common [last unloaded: bonding] - -[ 908.984168] CPU: 0 PID: 1787 Comm: rmmod Tainted: G W O -4.2.0-rc2+ #8 -[ 908.984170] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 -[ 908.984172] 0000000000000000 ffffffff81732d41 ffffffff81525b34 -ffff8800358dfda8 -[ 908.984175] ffffffff8106c521 ffff88003595af78 ffff88003595af40 -ffff88003e3a4280 -[ 908.984178] ffffffffa058d040 0000000000000000 ffffffff8106c59a -ffffffff8172ebd0 -[ 908.984181] Call Trace: -[ 908.984188] [] ? dump_stack+0x40/0x50 -[ 908.984193] [] ? warn_slowpath_common+0x81/0xb0 -[ 908.984196] [] ? warn_slowpath_fmt+0x4a/0x50 -[ 908.984199] [] ? remove_proc_entry+0x112/0x160 -[ 908.984205] [] ? bond_destroy_proc_dir+0x26/0x30 -[bonding] -[ 908.984208] [] ? bond_net_exit+0x8e/0xa0 [bonding] -[ 908.984217] [] ? ops_exit_list.isra.4+0x37/0x70 -[ 908.984225] [] ? -unregister_pernet_operations+0x8d/0xd0 -[ 908.984228] [] ? -unregister_pernet_subsys+0x1d/0x30 -[ 908.984232] [] ? bonding_exit+0x23/0xdba [bonding] -[ 908.984236] [] ? SyS_delete_module+0x18a/0x250 -[ 908.984241] [] ? task_work_run+0x89/0xc0 -[ 908.984244] [] ? -entry_SYSCALL_64_fastpath+0x16/0x75 -[ 908.984247] ---[ end trace 7c006ed4abbef24b ]--- - -Thus remove the proc entry manually if bond_release_and_destroy() is -used. Because of the checks in bond_remove_proc_entry() it's not a -problem for a bond device to change namespaces (the bug fixed by the -Fixes commit) but since commit -f9399814927ad ("bonding: Don't allow bond devices to change network -namespaces.") that can't happen anyway. - -Reported-by: Carol Soto -Signed-off-by: Nikolay Aleksandrov -Fixes: a64d49c3dd50 ("bonding: Manage /proc/net/bonding/ entries from - the netdev events") -Tested-by: Carol L Soto -Signed-off-by: David S. Miller ---- - drivers/net/bonding/bond_main.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index d5fe5d5..6a4e523 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -1902,6 +1902,7 @@ static int bond_release_and_destroy(struct net_device *bond_dev, - bond_dev->priv_flags |= IFF_DISABLE_NETPOLL; - netdev_info(bond_dev, "Destroying bond %s\n", - bond_dev->name); -+ bond_remove_proc_entry(bond); - unregister_netdevice(bond_dev); - } - return ret; --- -2.1.0 - - -From 69200c77f33e23a81609bc618659a4859c188a98 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Mon, 20 Jul 2015 17:55:38 +0800 -Subject: [PATCH 22/46] Revert "sit: Add gro callbacks to sit_offload" - -[ Upstream commit fdbf5b097bbd9693a86c0b8bfdd071a9a2117cfc ] - -This patch reverts 19424e052fb44da2f00d1a868cbb51f3e9f4bbb5 ("sit: -Add gro callbacks to sit_offload") because it generates packets -that cannot be handled even by our own GSO. - -Reported-by: Wolfgang Walter -Signed-off-by: Herbert Xu -Signed-off-by: David S. Miller ---- - net/ipv6/ip6_offload.c | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c -index e893cd1..08b6204 100644 ---- a/net/ipv6/ip6_offload.c -+++ b/net/ipv6/ip6_offload.c -@@ -292,8 +292,6 @@ static struct packet_offload ipv6_packet_offload __read_mostly = { - static const struct net_offload sit_offload = { - .callbacks = { - .gso_segment = ipv6_gso_segment, -- .gro_receive = ipv6_gro_receive, -- .gro_complete = ipv6_gro_complete, - }, - }; - --- -2.1.0 - - -From 0479ad88a4eb6dd0d05a5712ff1d489fc27feaa4 Mon Sep 17 00:00:00 2001 -From: dingtianhong -Date: Thu, 16 Jul 2015 16:30:02 +0800 -Subject: [PATCH 23/46] bonding: correct the MAC address for "follow" - fail_over_mac policy - -[ Upstream commit a951bc1e6ba58f11df5ed5ddc41311e10f5fd20b ] - -The "follow" fail_over_mac policy is useful for multiport devices that -either become confused or incur a performance penalty when multiple -ports are programmed with the same MAC address, but the same MAC -address still may happened by this steps for this policy: - -1) echo +eth0 > /sys/class/net/bond0/bonding/slaves - bond0 has the same mac address with eth0, it is MAC1. - -2) echo +eth1 > /sys/class/net/bond0/bonding/slaves - eth1 is backup, eth1 has MAC2. - -3) ifconfig eth0 down - eth1 became active slave, bond will swap MAC for eth0 and eth1, - so eth1 has MAC1, and eth0 has MAC2. - -4) ifconfig eth1 down - there is no active slave, and eth1 still has MAC1, eth2 has MAC2. - -5) ifconfig eth0 up - the eth0 became active slave again, the bond set eth0 to MAC1. - -Something wrong here, then if you set eth1 up, the eth0 and eth1 will have the same -MAC address, it will break this policy for ACTIVE_BACKUP mode. - -This patch will fix this problem by finding the old active slave and -swap them MAC address before change active slave. - -Signed-off-by: Ding Tianhong -Tested-by: Nikolay Aleksandrov -Signed-off-by: David S. Miller ---- - drivers/net/bonding/bond_main.c | 20 ++++++++++++++++++++ - 1 file changed, 20 insertions(+) - -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 6a4e523..16d87bf 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -625,6 +625,23 @@ static void bond_set_dev_addr(struct net_device *bond_dev, - call_netdevice_notifiers(NETDEV_CHANGEADDR, bond_dev); - } - -+static struct slave *bond_get_old_active(struct bonding *bond, -+ struct slave *new_active) -+{ -+ struct slave *slave; -+ struct list_head *iter; -+ -+ bond_for_each_slave(bond, slave, iter) { -+ if (slave == new_active) -+ continue; -+ -+ if (ether_addr_equal(bond->dev->dev_addr, slave->dev->dev_addr)) -+ return slave; -+ } -+ -+ return NULL; -+} -+ - /* bond_do_fail_over_mac - * - * Perform special MAC address swapping for fail_over_mac settings -@@ -652,6 +669,9 @@ static void bond_do_fail_over_mac(struct bonding *bond, - if (!new_active) - return; - -+ if (!old_active) -+ old_active = bond_get_old_active(bond, new_active); -+ - if (old_active) { - ether_addr_copy(tmp_mac, new_active->dev->dev_addr); - ether_addr_copy(saddr.sa_data, --- -2.1.0 - - -From 6fef6e2a4f97d67ea0c20473d228e755e3f96a21 Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann -Date: Fri, 17 Jul 2015 22:38:43 +0200 -Subject: [PATCH 24/46] sched: cls_bpf: fix panic on filter replace - -[ Upstream commit f6bfc46da6292b630ba389592123f0dd02066172 ] - -The following test case causes a NULL pointer dereference in cls_bpf: - - FOO="1,6 0 0 4294967295," - tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action ok - tc filter replace dev foo parent 1: pref 49152 handle 0x1 \ - bpf bytecode "$FOO" flowid 1:1 action drop - -The problem is that commit 1f947bf151e9 ("net: sched: rcu'ify cls_bpf") -accidentally swapped the arguments of list_replace_rcu(), the old -element needs to be the first argument and the new element the second. - -Fixes: 1f947bf151e9 ("net: sched: rcu'ify cls_bpf") -Signed-off-by: Daniel Borkmann -Acked-by: John Fastabend -Acked-by: Alexei Starovoitov -Signed-off-by: David S. Miller ---- - net/sched/cls_bpf.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c -index 91bd9c1..c0b86f2 100644 ---- a/net/sched/cls_bpf.c -+++ b/net/sched/cls_bpf.c -@@ -364,7 +364,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb, - goto errout; - - if (oldprog) { -- list_replace_rcu(&prog->link, &oldprog->link); -+ list_replace_rcu(&oldprog->link, &prog->link); - tcf_unbind_filter(tp, &oldprog->res); - call_rcu(&oldprog->rcu, __cls_bpf_delete_prog); - } else { --- -2.1.0 - - -From 8c2111406c9cc807767ecc64ae29a409cf486c94 Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann -Date: Fri, 17 Jul 2015 22:38:45 +0200 -Subject: [PATCH 25/46] sched: cls_flow: fix panic on filter replace - -[ Upstream commit 32b2f4b196b37695fdb42b31afcbc15399d6ef91 ] - -The following test case causes a NULL pointer dereference in cls_flow: - - tc filter add dev foo parent 1: handle 0x1 flow hash keys dst action ok - tc filter replace dev foo parent 1: pref 49152 handle 0x1 \ - flow hash keys mark action drop - -To be more precise, actually two different panics are fixed, the first -occurs because tcf_exts_init() is not called on the newly allocated -filter when we do a replace. And the second panic uncovered after that -happens since the arguments of list_replace_rcu() are swapped, the old -element needs to be the first argument and the new element the second. - -Fixes: 70da9f0bf999 ("net: sched: cls_flow use RCU") -Signed-off-by: Daniel Borkmann -Acked-by: John Fastabend -Signed-off-by: David S. Miller ---- - net/sched/cls_flow.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c -index a620c4e..75df923 100644 ---- a/net/sched/cls_flow.c -+++ b/net/sched/cls_flow.c -@@ -419,6 +419,8 @@ static int flow_change(struct net *net, struct sk_buff *in_skb, - if (!fnew) - goto err2; - -+ tcf_exts_init(&fnew->exts, TCA_FLOW_ACT, TCA_FLOW_POLICE); -+ - fold = (struct flow_filter *)*arg; - if (fold) { - err = -EINVAL; -@@ -480,7 +482,6 @@ static int flow_change(struct net *net, struct sk_buff *in_skb, - fnew->mask = ~0U; - fnew->tp = tp; - get_random_bytes(&fnew->hashrnd, 4); -- tcf_exts_init(&fnew->exts, TCA_FLOW_ACT, TCA_FLOW_POLICE); - } - - fnew->perturb_timer.function = flow_perturbation; -@@ -520,7 +521,7 @@ static int flow_change(struct net *net, struct sk_buff *in_skb, - if (*arg == 0) - list_add_tail_rcu(&fnew->list, &head->filters); - else -- list_replace_rcu(&fnew->list, &fold->list); -+ list_replace_rcu(&fold->list, &fnew->list); - - *arg = (unsigned long)fnew; - --- -2.1.0 - - -From fe0e0574a708320517330ca57865f1d4d2530cfc Mon Sep 17 00:00:00 2001 -From: Edward Hyunkoo Jee -Date: Tue, 21 Jul 2015 09:43:59 +0200 -Subject: [PATCH 26/46] inet: frags: fix defragmented packet's IP header for - af_packet - -[ Upstream commit 0848f6428ba3a2e42db124d41ac6f548655735bf ] - -When ip_frag_queue() computes positions, it assumes that the passed -sk_buff does not contain L2 headers. - -However, when PACKET_FANOUT_FLAG_DEFRAG is used, IP reassembly -functions can be called on outgoing packets that contain L2 headers. - -Also, IPv4 checksum is not corrected after reassembly. - -Fixes: 7736d33f4262 ("packet: Add pre-defragmentation support for ipv4 fanouts.") -Signed-off-by: Edward Hyunkoo Jee -Signed-off-by: Eric Dumazet -Cc: Willem de Bruijn -Cc: Jerry Chu -Signed-off-by: David S. Miller ---- - net/ipv4/ip_fragment.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c -index cc1da6d..cae22a1 100644 ---- a/net/ipv4/ip_fragment.c -+++ b/net/ipv4/ip_fragment.c -@@ -342,7 +342,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) - ihl = ip_hdrlen(skb); - - /* Determine the position of this fragment. */ -- end = offset + skb->len - ihl; -+ end = offset + skb->len - skb_network_offset(skb) - ihl; - err = -EINVAL; - - /* Is this the final fragment? */ -@@ -372,7 +372,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) - goto err; - - err = -ENOMEM; -- if (!pskb_pull(skb, ihl)) -+ if (!pskb_pull(skb, skb_network_offset(skb) + ihl)) - goto err; - - err = pskb_trim_rcsum(skb, end - offset); -@@ -613,6 +613,9 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, - iph->frag_off = qp->q.max_size ? htons(IP_DF) : 0; - iph->tot_len = htons(len); - iph->tos |= ecn; -+ -+ ip_send_check(iph); -+ - IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS); - qp->q.fragments = NULL; - qp->q.fragments_tail = NULL; --- -2.1.0 - - -From 5dfcd4a0749d9d421ec04dedf37d9f07a0c22f3a Mon Sep 17 00:00:00 2001 -From: Florian Westphal -Date: Tue, 21 Jul 2015 16:33:50 +0200 -Subject: [PATCH 27/46] netlink: don't hold mutex in rcu callback when - releasing mmapd ring - -[ Upstream commit 0470eb99b4721586ccac954faac3fa4472da0845 ] - -Kirill A. Shutemov says: - -This simple test-case trigers few locking asserts in kernel: - -int main(int argc, char **argv) -{ - unsigned int block_size = 16 * 4096; - struct nl_mmap_req req = { - .nm_block_size = block_size, - .nm_block_nr = 64, - .nm_frame_size = 16384, - .nm_frame_nr = 64 * block_size / 16384, - }; - unsigned int ring_size; - int fd; - - fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); - if (setsockopt(fd, SOL_NETLINK, NETLINK_RX_RING, &req, sizeof(req)) < 0) - exit(1); - if (setsockopt(fd, SOL_NETLINK, NETLINK_TX_RING, &req, sizeof(req)) < 0) - exit(1); - - ring_size = req.nm_block_nr * req.nm_block_size; - mmap(NULL, 2 * ring_size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0); - return 0; -} - -+++ exited with 0 +++ -BUG: sleeping function called from invalid context at /home/kas/git/public/linux-mm/kernel/locking/mutex.c:616 -in_atomic(): 1, irqs_disabled(): 0, pid: 1, name: init -3 locks held by init/1: - #0: (reboot_mutex){+.+...}, at: [] SyS_reboot+0xa9/0x220 - #1: ((reboot_notifier_list).rwsem){.+.+..}, at: [] __blocking_notifier_call_chain+0x39/0x70 - #2: (rcu_callback){......}, at: [] rcu_do_batch.isra.49+0x160/0x10c0 -Preemption disabled at:[] __delay+0xf/0x20 - -CPU: 1 PID: 1 Comm: init Not tainted 4.1.0-00009-gbddf4c4818e0 #253 -Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Debian-1.8.2-1 04/01/2014 - ffff88017b3d8000 ffff88027bc03c38 ffffffff81929ceb 0000000000000102 - 0000000000000000 ffff88027bc03c68 ffffffff81085a9d 0000000000000002 - ffffffff81ca2a20 0000000000000268 0000000000000000 ffff88027bc03c98 -Call Trace: - [] dump_stack+0x4f/0x7b - [] ___might_sleep+0x16d/0x270 - [] __might_sleep+0x4d/0x90 - [] mutex_lock_nested+0x2f/0x430 - [] ? _raw_spin_unlock_irqrestore+0x5d/0x80 - [] ? __this_cpu_preempt_check+0x13/0x20 - [] netlink_set_ring+0x1ed/0x350 - [] ? netlink_undo_bind+0x70/0x70 - [] netlink_sock_destruct+0x80/0x150 - [] __sk_free+0x1d/0x160 - [] sk_free+0x19/0x20 -[..] - -Cong Wang says: - -We can't hold mutex lock in a rcu callback, [..] - -Thomas Graf says: - -The socket should be dead at this point. It might be simpler to -add a netlink_release_ring() function which doesn't require -locking at all. - -Reported-by: "Kirill A. Shutemov" -Diagnosed-by: Cong Wang -Suggested-by: Thomas Graf -Signed-off-by: Florian Westphal -Signed-off-by: David S. Miller ---- - net/netlink/af_netlink.c | 79 ++++++++++++++++++++++++++++-------------------- - 1 file changed, 47 insertions(+), 32 deletions(-) - -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index bf6e766..ea5ed7a 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -355,25 +355,52 @@ err1: - return NULL; - } - -+ -+static void -+__netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec, -+ unsigned int order) -+{ -+ struct netlink_sock *nlk = nlk_sk(sk); -+ struct sk_buff_head *queue; -+ struct netlink_ring *ring; -+ -+ queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue; -+ ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring; -+ -+ spin_lock_bh(&queue->lock); -+ -+ ring->frame_max = req->nm_frame_nr - 1; -+ ring->head = 0; -+ ring->frame_size = req->nm_frame_size; -+ ring->pg_vec_pages = req->nm_block_size / PAGE_SIZE; -+ -+ swap(ring->pg_vec_len, req->nm_block_nr); -+ swap(ring->pg_vec_order, order); -+ swap(ring->pg_vec, pg_vec); -+ -+ __skb_queue_purge(queue); -+ spin_unlock_bh(&queue->lock); -+ -+ WARN_ON(atomic_read(&nlk->mapped)); -+ -+ if (pg_vec) -+ free_pg_vec(pg_vec, order, req->nm_block_nr); -+} -+ - static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, -- bool closing, bool tx_ring) -+ bool tx_ring) - { - struct netlink_sock *nlk = nlk_sk(sk); - struct netlink_ring *ring; -- struct sk_buff_head *queue; - void **pg_vec = NULL; - unsigned int order = 0; -- int err; - - ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring; -- queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue; - -- if (!closing) { -- if (atomic_read(&nlk->mapped)) -- return -EBUSY; -- if (atomic_read(&ring->pending)) -- return -EBUSY; -- } -+ if (atomic_read(&nlk->mapped)) -+ return -EBUSY; -+ if (atomic_read(&ring->pending)) -+ return -EBUSY; - - if (req->nm_block_nr) { - if (ring->pg_vec != NULL) -@@ -405,31 +432,19 @@ static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, - return -EINVAL; - } - -- err = -EBUSY; - mutex_lock(&nlk->pg_vec_lock); -- if (closing || atomic_read(&nlk->mapped) == 0) { -- err = 0; -- spin_lock_bh(&queue->lock); -- -- ring->frame_max = req->nm_frame_nr - 1; -- ring->head = 0; -- ring->frame_size = req->nm_frame_size; -- ring->pg_vec_pages = req->nm_block_size / PAGE_SIZE; -- -- swap(ring->pg_vec_len, req->nm_block_nr); -- swap(ring->pg_vec_order, order); -- swap(ring->pg_vec, pg_vec); -- -- __skb_queue_purge(queue); -- spin_unlock_bh(&queue->lock); -- -- WARN_ON(atomic_read(&nlk->mapped)); -+ if (atomic_read(&nlk->mapped) == 0) { -+ __netlink_set_ring(sk, req, tx_ring, pg_vec, order); -+ mutex_unlock(&nlk->pg_vec_lock); -+ return 0; - } -+ - mutex_unlock(&nlk->pg_vec_lock); - - if (pg_vec) - free_pg_vec(pg_vec, order, req->nm_block_nr); -- return err; -+ -+ return -EBUSY; - } - - static void netlink_mm_open(struct vm_area_struct *vma) -@@ -898,10 +913,10 @@ static void netlink_sock_destruct(struct sock *sk) - - memset(&req, 0, sizeof(req)); - if (nlk->rx_ring.pg_vec) -- netlink_set_ring(sk, &req, true, false); -+ __netlink_set_ring(sk, &req, false, NULL, 0); - memset(&req, 0, sizeof(req)); - if (nlk->tx_ring.pg_vec) -- netlink_set_ring(sk, &req, true, true); -+ __netlink_set_ring(sk, &req, true, NULL, 0); - } - #endif /* CONFIG_NETLINK_MMAP */ - -@@ -2197,7 +2212,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname, - return -EINVAL; - if (copy_from_user(&req, optval, sizeof(req))) - return -EFAULT; -- err = netlink_set_ring(sk, &req, false, -+ err = netlink_set_ring(sk, &req, - optname == NETLINK_TX_RING); - break; - } --- -2.1.0 - - -From c8a958d63443e2d143d1710ee437c17438fd12e5 Mon Sep 17 00:00:00 2001 -From: "Michael S. Tsirkin" -Date: Wed, 15 Jul 2015 15:26:19 +0300 -Subject: [PATCH 28/46] virtio_net: don't require ANY_LAYOUT with VERSION_1 - -[ Upstream commit 75993300d008f418ee2569a632185fc1d7d50674 ] - -ANY_LAYOUT is a compatibility feature. It's implied -for VERSION_1 devices, and non-transitional devices -might not offer it. Change code to behave accordingly. - -Signed-off-by: Michael S. Tsirkin -Reviewed-by: Paolo Bonzini -Reviewed-by: Stefan Hajnoczi -Signed-off-by: David S. Miller ---- - drivers/net/virtio_net.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c -index 63c7810..7fbca37 100644 ---- a/drivers/net/virtio_net.c -+++ b/drivers/net/virtio_net.c -@@ -1828,7 +1828,8 @@ static int virtnet_probe(struct virtio_device *vdev) - else - vi->hdr_len = sizeof(struct virtio_net_hdr); - -- if (virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) -+ if (virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT) || -+ virtio_has_feature(vdev, VIRTIO_F_VERSION_1)) - vi->any_header_sg = true; - - if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ)) --- -2.1.0 - - -From d5df2abc93d5027ec62fb714d6bb9b14bed65548 Mon Sep 17 00:00:00 2001 -From: Nikolay Aleksandrov -Date: Wed, 22 Jul 2015 13:03:40 +0200 -Subject: [PATCH 29/46] bridge: netlink: fix slave_changelink/br_setport race - conditions - -[ Upstream commit 963ad94853000ab100f5ff19eea80095660d41b4 ] - -Since slave_changelink support was added there have been a few race -conditions when using br_setport() since some of the port functions it -uses require the bridge lock. It is very easy to trigger a lockup due to -some internal spin_lock() usage without bh disabled, also it's possible to -get the bridge into an inconsistent state. - -Signed-off-by: Nikolay Aleksandrov -Fixes: 3ac636b8591c ("bridge: implement rtnl_link_ops->slave_changelink") -Reviewed-by: Jiri Pirko -Signed-off-by: David S. Miller ---- - net/bridge/br_netlink.c | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - -diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c -index 4b5c236..20e06a9 100644 ---- a/net/bridge/br_netlink.c -+++ b/net/bridge/br_netlink.c -@@ -711,9 +711,17 @@ static int br_port_slave_changelink(struct net_device *brdev, - struct nlattr *tb[], - struct nlattr *data[]) - { -+ struct net_bridge *br = netdev_priv(brdev); -+ int ret; -+ - if (!data) - return 0; -- return br_setport(br_port_get_rtnl(dev), data); -+ -+ spin_lock_bh(&br->lock); -+ ret = br_setport(br_port_get_rtnl(dev), data); -+ spin_unlock_bh(&br->lock); -+ -+ return ret; - } - - static int br_port_fill_slave_info(struct sk_buff *skb, --- -2.1.0 - - -From 8002540aec64b57e8a2a93adf4ad893b085f9ae6 Mon Sep 17 00:00:00 2001 -From: Jack Morgenstein -Date: Wed, 22 Jul 2015 16:53:47 +0300 -Subject: [PATCH 30/46] net/mlx4_core: Fix wrong index in propagating port - change event to VFs - -[ Upstream commit 1c1bf34951e8d17941bf708d1901c47e81b15d55 ] - -The port-change event processing in procedure mlx4_eq_int() uses "slave" -as the vf_oper array index. Since the value of "slave" is the PF function -index, the result is that the PF link state is used for deciding to -propagate the event for all the VFs. The VF link state should be used, -so the VF function index should be used here. - -Fixes: 948e306d7d64 ('net/mlx4: Add VF link state support') -Signed-off-by: Jack Morgenstein -Signed-off-by: Matan Barak -Signed-off-by: Or Gerlitz -Signed-off-by: David S. Miller ---- - drivers/net/ethernet/mellanox/mlx4/eq.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c -index 2619c9f..983b1d5 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/eq.c -+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c -@@ -573,7 +573,7 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq) - continue; - mlx4_dbg(dev, "%s: Sending MLX4_PORT_CHANGE_SUBTYPE_DOWN to slave: %d, port:%d\n", - __func__, i, port); -- s_info = &priv->mfunc.master.vf_oper[slave].vport[port].state; -+ s_info = &priv->mfunc.master.vf_oper[i].vport[port].state; - if (IFLA_VF_LINK_STATE_AUTO == s_info->link_state) { - eqe->event.port_change.port = - cpu_to_be32( -@@ -608,7 +608,7 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq) - continue; - if (i == mlx4_master_func_num(dev)) - continue; -- s_info = &priv->mfunc.master.vf_oper[slave].vport[port].state; -+ s_info = &priv->mfunc.master.vf_oper[i].vport[port].state; - if (IFLA_VF_LINK_STATE_AUTO == s_info->link_state) { - eqe->event.port_change.port = - cpu_to_be32( --- -2.1.0 - - -From 9df9bb9ae0c1579a4e6e63fc6ebfb7d1e0a16ebb Mon Sep 17 00:00:00 2001 -From: Alexander Duyck -Date: Mon, 27 Jul 2015 13:08:06 -0700 -Subject: [PATCH 31/46] fib_trie: Drop unnecessary calls to leaf_pull_suffix - -[ Upstream commit 1513069edcf8dd86cfd8d5daef482b97d6b93df6 ] - -It was reported that update_suffix was taking a long time on systems where -a large number of leaves were attached to a single node. As it turns out -fib_table_flush was calling update_suffix for each leaf that didn't have all -of the aliases stripped from it. As a result, on this large node removing -one leaf would result in us calling update_suffix for every other leaf on -the node. - -The fix is to just remove the calls to leaf_pull_suffix since they are -redundant as we already have a call in resize that will go through and -update the suffix length for the node before we exit out of -fib_table_flush or fib_table_flush_external. - -Reported-by: David Ahern -Signed-off-by: Alexander Duyck -Tested-by: David Ahern -Signed-off-by: David S. Miller ---- - net/ipv4/fib_trie.c | 4 ---- - 1 file changed, 4 deletions(-) - -diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c -index 09b62e1..210ceca 100644 ---- a/net/ipv4/fib_trie.c -+++ b/net/ipv4/fib_trie.c -@@ -1780,8 +1780,6 @@ void fib_table_flush_external(struct fib_table *tb) - if (hlist_empty(&n->leaf)) { - put_child_root(pn, n->key, NULL); - node_free(n); -- } else { -- leaf_pull_suffix(pn, n); - } - } - } -@@ -1852,8 +1850,6 @@ int fib_table_flush(struct fib_table *tb) - if (hlist_empty(&n->leaf)) { - put_child_root(pn, n->key, NULL); - node_free(n); -- } else { -- leaf_pull_suffix(pn, n); - } - } - --- -2.1.0 - - -From 9119c5bc8f4ef473506590477e0dc196c2bc496d Mon Sep 17 00:00:00 2001 -From: Lars Westerhoff -Date: Tue, 28 Jul 2015 01:32:21 +0300 -Subject: [PATCH 32/46] packet: missing dev_put() in packet_do_bind() - -[ Upstream commit 158cd4af8dedbda0d612d448c724c715d0dda649 ] - -When binding a PF_PACKET socket, the use count of the bound interface is -always increased with dev_hold in dev_get_by_{index,name}. However, -when rebound with the same protocol and device as in the previous bind -the use count of the interface was not decreased. Ultimately, this -caused the deletion of the interface to fail with the following message: - -unregister_netdevice: waiting for dummy0 to become free. Usage count = 1 - -This patch moves the dev_put out of the conditional part that was only -executed when either the protocol or device changed on a bind. - -Fixes: 902fefb82ef7 ('packet: improve socket create/bind latency in some cases') -Signed-off-by: Lars Westerhoff -Signed-off-by: Dan Carpenter -Reviewed-by: Daniel Borkmann -Signed-off-by: David S. Miller ---- - net/packet/af_packet.c | 8 +++----- - 1 file changed, 3 insertions(+), 5 deletions(-) - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index fe1610d..733ef5a 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2688,7 +2688,7 @@ static int packet_release(struct socket *sock) - static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) - { - struct packet_sock *po = pkt_sk(sk); -- const struct net_device *dev_curr; -+ struct net_device *dev_curr; - __be16 proto_curr; - bool need_rehook; - -@@ -2712,15 +2712,13 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) - - po->num = proto; - po->prot_hook.type = proto; -- -- if (po->prot_hook.dev) -- dev_put(po->prot_hook.dev); -- - po->prot_hook.dev = dev; - - po->ifindex = dev ? dev->ifindex : 0; - packet_cached_dev_assign(po, dev); - } -+ if (dev_curr) -+ dev_put(dev_curr); - - if (proto == 0 || !need_rehook) - goto out_unlock; --- -2.1.0 - - -From dbd3501b0f680161110947cb7ba49b308a2d182e Mon Sep 17 00:00:00 2001 -From: Alexander Drozdov -Date: Tue, 28 Jul 2015 13:57:01 +0300 -Subject: [PATCH 33/46] packet: tpacket_snd(): fix signed/unsigned comparison - -[ Upstream commit dbd46ab412b8fb395f2b0ff6f6a7eec9df311550 ] - -tpacket_fill_skb() can return a negative value (-errno) which -is stored in tp_len variable. In that case the following -condition will be (but shouldn't be) true: - -tp_len > dev->mtu + dev->hard_header_len - -as dev->mtu and dev->hard_header_len are both unsigned. - -That may lead to just returning an incorrect EMSGSIZE errno -to the user. - -Fixes: 52f1454f629fa ("packet: allow to transmit +4 byte in TX_RING slot for VLAN case") -Signed-off-by: Alexander Drozdov -Acked-by: Daniel Borkmann -Signed-off-by: David S. Miller ---- - net/packet/af_packet.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 733ef5a..e1ea5d4 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2307,7 +2307,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) - } - tp_len = tpacket_fill_skb(po, skb, ph, dev, size_max, proto, - addr, hlen); -- if (tp_len > dev->mtu + dev->hard_header_len) { -+ if (likely(tp_len >= 0) && -+ tp_len > dev->mtu + dev->hard_header_len) { - struct ethhdr *ehdr; - /* Earlier code assumed this would be a VLAN pkt, - * double-check this now that we have the actual --- -2.1.0 - - -From 9f07a1825bac3efa34dcb2d50944377edcf39d38 Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann -Date: Wed, 29 Jul 2015 18:40:56 +0200 -Subject: [PATCH 34/46] act_bpf: fix memory leaks when replacing bpf programs - -[ Upstream commit f4eaed28c7834fc049c754f63e6988bbd73778d9 ] - -We currently trigger multiple memory leaks when replacing bpf -actions, besides others: - - comm "tc", pid 1909, jiffies 4294851310 (age 1602.796s) - hex dump (first 32 bytes): - 01 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 ................ - 18 b0 98 6d 00 88 ff ff 00 00 00 00 00 00 00 00 ...m............ - backtrace: - [] kmemleak_alloc+0x4e/0xb0 - [] __vmalloc_node_range+0x1bd/0x2c0 - [] __vmalloc+0x4a/0x50 - [] bpf_prog_alloc+0x3a/0xa0 - [] bpf_prog_create+0x44/0xa0 - [] tcf_bpf_init+0x28b/0x3c0 [act_bpf] - [] tcf_action_init_1+0x191/0x1b0 - [] tcf_action_init+0x82/0xf0 - [] tcf_exts_validate+0xb2/0xc0 - [] cls_bpf_modify_existing+0x98/0x340 [cls_bpf] - [] cls_bpf_change+0x1a6/0x274 [cls_bpf] - [] tc_ctl_tfilter+0x335/0x910 - [] rtnetlink_rcv_msg+0x95/0x240 - [] netlink_rcv_skb+0xaf/0xc0 - [] rtnetlink_rcv+0x2e/0x40 - [] netlink_unicast+0xef/0x1b0 - -Issue is that the old content from tcf_bpf is allocated and needs -to be released when we replace it. We seem to do that since the -beginning of act_bpf on the filter and insns, later on the name as -well. - -Example test case, after patch: - - # FOO="1,6 0 0 4294967295," - # BAR="1,6 0 0 4294967294," - # tc actions add action bpf bytecode "$FOO" index 2 - # tc actions show action bpf - action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe - index 2 ref 1 bind 0 - # tc actions replace action bpf bytecode "$BAR" index 2 - # tc actions show action bpf - action order 0: bpf bytecode '1,6 0 0 4294967294' default-action pipe - index 2 ref 1 bind 0 - # tc actions replace action bpf bytecode "$FOO" index 2 - # tc actions show action bpf - action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe - index 2 ref 1 bind 0 - # tc actions del action bpf index 2 - [...] - # echo "scan" > /sys/kernel/debug/kmemleak - # cat /sys/kernel/debug/kmemleak | grep "comm \"tc\"" | wc -l - 0 - -Fixes: d23b8ad8ab23 ("tc: add BPF based action") -Signed-off-by: Daniel Borkmann -Signed-off-by: David S. Miller ---- - net/sched/act_bpf.c | 50 +++++++++++++++++++++++++++++++++++--------------- - 1 file changed, 35 insertions(+), 15 deletions(-) - -diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c -index dc6a2d3..521ffca 100644 ---- a/net/sched/act_bpf.c -+++ b/net/sched/act_bpf.c -@@ -27,9 +27,10 @@ - struct tcf_bpf_cfg { - struct bpf_prog *filter; - struct sock_filter *bpf_ops; -- char *bpf_name; -+ const char *bpf_name; - u32 bpf_fd; - u16 bpf_num_ops; -+ bool is_ebpf; - }; - - static int tcf_bpf(struct sk_buff *skb, const struct tc_action *act, -@@ -200,6 +201,7 @@ static int tcf_bpf_init_from_ops(struct nlattr **tb, struct tcf_bpf_cfg *cfg) - cfg->bpf_ops = bpf_ops; - cfg->bpf_num_ops = bpf_num_ops; - cfg->filter = fp; -+ cfg->is_ebpf = false; - - return 0; - } -@@ -234,18 +236,40 @@ static int tcf_bpf_init_from_efd(struct nlattr **tb, struct tcf_bpf_cfg *cfg) - cfg->bpf_fd = bpf_fd; - cfg->bpf_name = name; - cfg->filter = fp; -+ cfg->is_ebpf = true; - - return 0; - } - -+static void tcf_bpf_cfg_cleanup(const struct tcf_bpf_cfg *cfg) -+{ -+ if (cfg->is_ebpf) -+ bpf_prog_put(cfg->filter); -+ else -+ bpf_prog_destroy(cfg->filter); -+ -+ kfree(cfg->bpf_ops); -+ kfree(cfg->bpf_name); -+} -+ -+static void tcf_bpf_prog_fill_cfg(const struct tcf_bpf *prog, -+ struct tcf_bpf_cfg *cfg) -+{ -+ cfg->is_ebpf = tcf_bpf_is_ebpf(prog); -+ cfg->filter = prog->filter; -+ -+ cfg->bpf_ops = prog->bpf_ops; -+ cfg->bpf_name = prog->bpf_name; -+} -+ - static int tcf_bpf_init(struct net *net, struct nlattr *nla, - struct nlattr *est, struct tc_action *act, - int replace, int bind) - { - struct nlattr *tb[TCA_ACT_BPF_MAX + 1]; -+ struct tcf_bpf_cfg cfg, old; - struct tc_act_bpf *parm; - struct tcf_bpf *prog; -- struct tcf_bpf_cfg cfg; - bool is_bpf, is_ebpf; - int ret; - -@@ -294,6 +318,9 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla, - prog = to_bpf(act); - spin_lock_bh(&prog->tcf_lock); - -+ if (ret != ACT_P_CREATED) -+ tcf_bpf_prog_fill_cfg(prog, &old); -+ - prog->bpf_ops = cfg.bpf_ops; - prog->bpf_name = cfg.bpf_name; - -@@ -309,29 +336,22 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla, - - if (ret == ACT_P_CREATED) - tcf_hash_insert(act); -+ else -+ tcf_bpf_cfg_cleanup(&old); - - return ret; - - destroy_fp: -- if (is_ebpf) -- bpf_prog_put(cfg.filter); -- else -- bpf_prog_destroy(cfg.filter); -- -- kfree(cfg.bpf_ops); -- kfree(cfg.bpf_name); -- -+ tcf_bpf_cfg_cleanup(&cfg); - return ret; - } - - static void tcf_bpf_cleanup(struct tc_action *act, int bind) - { -- const struct tcf_bpf *prog = act->priv; -+ struct tcf_bpf_cfg tmp; - -- if (tcf_bpf_is_ebpf(prog)) -- bpf_prog_put(prog->filter); -- else -- bpf_prog_destroy(prog->filter); -+ tcf_bpf_prog_fill_cfg(act->priv, &tmp); -+ tcf_bpf_cfg_cleanup(&tmp); - } - - static struct tc_action_ops act_bpf_ops __read_mostly = { --- -2.1.0 - - -From a376fa38ddfa431270ed3127873550282d677fe7 Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann -Date: Wed, 29 Jul 2015 23:35:25 +0200 -Subject: [PATCH 35/46] net: sched: fix refcount imbalance in actions - -[ Upstream commit 28e6b67f0b292f557468c139085303b15f1a678f ] - -Since commit 55334a5db5cd ("net_sched: act: refuse to remove bound action -outside"), we end up with a wrong reference count for a tc action. - -Test case 1: - - FOO="1,6 0 0 4294967295," - BAR="1,6 0 0 4294967294," - tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 \ - action bpf bytecode "$FOO" - tc actions show action bpf - action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe - index 1 ref 1 bind 1 - tc actions replace action bpf bytecode "$BAR" index 1 - tc actions show action bpf - action order 0: bpf bytecode '1,6 0 0 4294967294' default-action pipe - index 1 ref 2 bind 1 - tc actions replace action bpf bytecode "$FOO" index 1 - tc actions show action bpf - action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe - index 1 ref 3 bind 1 - -Test case 2: - - FOO="1,6 0 0 4294967295," - tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action ok - tc actions show action gact - action order 0: gact action pass - random type none pass val 0 - index 1 ref 1 bind 1 - tc actions add action drop index 1 - RTNETLINK answers: File exists [...] - tc actions show action gact - action order 0: gact action pass - random type none pass val 0 - index 1 ref 2 bind 1 - tc actions add action drop index 1 - RTNETLINK answers: File exists [...] - tc actions show action gact - action order 0: gact action pass - random type none pass val 0 - index 1 ref 3 bind 1 - -What happens is that in tcf_hash_check(), we check tcf_common for a given -index and increase tcfc_refcnt and conditionally tcfc_bindcnt when we've -found an existing action. Now there are the following cases: - - 1) We do a late binding of an action. In that case, we leave the - tcfc_refcnt/tcfc_bindcnt increased and are done with the ->init() - handler. This is correctly handeled. - - 2) We replace the given action, or we try to add one without replacing - and find out that the action at a specific index already exists - (thus, we go out with error in that case). - -In case of 2), we have to undo the reference count increase from -tcf_hash_check() in the tcf_hash_check() function. Currently, we fail to -do so because of the 'tcfc_bindcnt > 0' check which bails out early with -an -EPERM error. - -Now, while commit 55334a5db5cd prevents 'tc actions del action ...' on an -already classifier-bound action to drop the reference count (which could -then become negative, wrap around etc), this restriction only accounts for -invocations outside a specific action's ->init() handler. - -One possible solution would be to add a flag thus we possibly trigger -the -EPERM ony in situations where it is indeed relevant. - -After the patch, above test cases have correct reference count again. - -Fixes: 55334a5db5cd ("net_sched: act: refuse to remove bound action outside") -Signed-off-by: Daniel Borkmann -Reviewed-by: Cong Wang -Signed-off-by: David S. Miller ---- - include/net/act_api.h | 8 +++++++- - net/sched/act_api.c | 11 ++++++----- - 2 files changed, 13 insertions(+), 6 deletions(-) - -diff --git a/include/net/act_api.h b/include/net/act_api.h -index 3ee4c92..931738b 100644 ---- a/include/net/act_api.h -+++ b/include/net/act_api.h -@@ -99,7 +99,6 @@ struct tc_action_ops { - - int tcf_hash_search(struct tc_action *a, u32 index); - void tcf_hash_destroy(struct tc_action *a); --int tcf_hash_release(struct tc_action *a, int bind); - u32 tcf_hash_new_index(struct tcf_hashinfo *hinfo); - int tcf_hash_check(u32 index, struct tc_action *a, int bind); - int tcf_hash_create(u32 index, struct nlattr *est, struct tc_action *a, -@@ -107,6 +106,13 @@ int tcf_hash_create(u32 index, struct nlattr *est, struct tc_action *a, - void tcf_hash_cleanup(struct tc_action *a, struct nlattr *est); - void tcf_hash_insert(struct tc_action *a); - -+int __tcf_hash_release(struct tc_action *a, bool bind, bool strict); -+ -+static inline int tcf_hash_release(struct tc_action *a, bool bind) -+{ -+ return __tcf_hash_release(a, bind, false); -+} -+ - int tcf_register_action(struct tc_action_ops *a, unsigned int mask); - int tcf_unregister_action(struct tc_action_ops *a); - int tcf_action_destroy(struct list_head *actions, int bind); -diff --git a/net/sched/act_api.c b/net/sched/act_api.c -index 3d43e49..f8d9c2a 100644 ---- a/net/sched/act_api.c -+++ b/net/sched/act_api.c -@@ -45,7 +45,7 @@ void tcf_hash_destroy(struct tc_action *a) - } - EXPORT_SYMBOL(tcf_hash_destroy); - --int tcf_hash_release(struct tc_action *a, int bind) -+int __tcf_hash_release(struct tc_action *a, bool bind, bool strict) - { - struct tcf_common *p = a->priv; - int ret = 0; -@@ -53,7 +53,7 @@ int tcf_hash_release(struct tc_action *a, int bind) - if (p) { - if (bind) - p->tcfc_bindcnt--; -- else if (p->tcfc_bindcnt > 0) -+ else if (strict && p->tcfc_bindcnt > 0) - return -EPERM; - - p->tcfc_refcnt--; -@@ -64,9 +64,10 @@ int tcf_hash_release(struct tc_action *a, int bind) - ret = 1; - } - } -+ - return ret; - } --EXPORT_SYMBOL(tcf_hash_release); -+EXPORT_SYMBOL(__tcf_hash_release); - - static int tcf_dump_walker(struct sk_buff *skb, struct netlink_callback *cb, - struct tc_action *a) -@@ -136,7 +137,7 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a) - head = &hinfo->htab[tcf_hash(i, hinfo->hmask)]; - hlist_for_each_entry_safe(p, n, head, tcfc_head) { - a->priv = p; -- ret = tcf_hash_release(a, 0); -+ ret = __tcf_hash_release(a, false, true); - if (ret == ACT_P_DELETED) { - module_put(a->ops->owner); - n_i++; -@@ -413,7 +414,7 @@ int tcf_action_destroy(struct list_head *actions, int bind) - int ret = 0; - - list_for_each_entry_safe(a, tmp, actions, list) { -- ret = tcf_hash_release(a, bind); -+ ret = __tcf_hash_release(a, bind, true); - if (ret == ACT_P_DELETED) - module_put(a->ops->owner); - else if (ret < 0) --- -2.1.0 - - -From 40df9588f4415a976f1b67f344757d26f157e4f8 Mon Sep 17 00:00:00 2001 -From: Ido Schimmel -Date: Sun, 2 Aug 2015 19:29:16 +0200 -Subject: [PATCH 36/46] rocker: free netdevice during netdevice removal - -[ Upstream commit 1ebd47efa4e17391dfac8caa349c6a8d35f996d1 ] - -When removing a port's netdevice in 'rocker_remove_ports', we should -also free the allocated 'net_device' structure. Do that by calling -'free_netdev' after unregistering it. - -Signed-off-by: Ido Schimmel -Signed-off-by: Jiri Pirko -Fixes: 4b8ac9660af ("rocker: introduce rocker switch driver") -Acked-by: Scott Feldman -Signed-off-by: David S. Miller ---- - drivers/net/ethernet/rocker/rocker.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c -index cf98cc9..73b6fc2 100644 ---- a/drivers/net/ethernet/rocker/rocker.c -+++ b/drivers/net/ethernet/rocker/rocker.c -@@ -4587,6 +4587,7 @@ static void rocker_remove_ports(struct rocker *rocker) - rocker_port = rocker->ports[i]; - rocker_port_ig_tbl(rocker_port, ROCKER_OP_FLAG_REMOVE); - unregister_netdev(rocker_port->dev); -+ free_netdev(rocker_port->dev); - } - kfree(rocker->ports); - } --- -2.1.0 - - -From b2c177c64de1f863de832da667ef6f626ccddb48 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter -Date: Sat, 1 Aug 2015 15:33:26 +0300 -Subject: [PATCH 37/46] rds: fix an integer overflow test in - rds_info_getsockopt() - -[ Upstream commit 468b732b6f76b138c0926eadf38ac88467dcd271 ] - -"len" is a signed integer. We check that len is not negative, so it -goes from zero to INT_MAX. PAGE_SIZE is unsigned long so the comparison -is type promoted to unsigned long. ULONG_MAX - 4095 is a higher than -INT_MAX so the condition can never be true. - -I don't know if this is harmful but it seems safe to limit "len" to -INT_MAX - 4095. - -Fixes: a8c879a7ee98 ('RDS: Info and stats') -Signed-off-by: Dan Carpenter -Signed-off-by: David S. Miller ---- - net/rds/info.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/rds/info.c b/net/rds/info.c -index 9a6b4f6..140a44a 100644 ---- a/net/rds/info.c -+++ b/net/rds/info.c -@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval, - - /* check for all kinds of wrapping and the like */ - start = (unsigned long)optval; -- if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) { -+ if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) { - ret = -EINVAL; - goto out; - } --- -2.1.0 - - -From 346f0535765909d0f5fda364f365e05f8e602879 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Sat, 1 Aug 2015 12:14:33 +0200 -Subject: [PATCH 38/46] udp: fix dst races with multicast early demux -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -[ Upstream commit 10e2eb878f3ca07ac2f05fa5ca5e6c4c9174a27a ] - -Multicast dst are not cached. They carry DST_NOCACHE. - -As mentioned in commit f8864972126899 ("ipv4: fix dst race in -sk_dst_get()"), these dst need special care before caching them -into a socket. - -Caching them is allowed only if their refcnt was not 0, ie we -must use atomic_inc_not_zero() - -Also, we must use READ_ONCE() to fetch sk->sk_rx_dst, as mentioned -in commit d0c294c53a771 ("tcp: prevent fetching dst twice in early demux -code") - -Fixes: 421b3885bf6d ("udp: ipv4: Add udp early demux") -Tested-by: Gregory Hoggarth -Signed-off-by: Eric Dumazet -Reported-by: Gregory Hoggarth -Reported-by: Alex Gartrell -Cc: Michal Kubeček -Signed-off-by: David S. Miller ---- - net/ipv4/udp.c | 13 ++++++++++--- - 1 file changed, 10 insertions(+), 3 deletions(-) - -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 83aa604..1b8c5ba 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -1995,12 +1995,19 @@ void udp_v4_early_demux(struct sk_buff *skb) - - skb->sk = sk; - skb->destructor = sock_efree; -- dst = sk->sk_rx_dst; -+ dst = READ_ONCE(sk->sk_rx_dst); - - if (dst) - dst = dst_check(dst, 0); -- if (dst) -- skb_dst_set_noref(skb, dst); -+ if (dst) { -+ /* DST_NOCACHE can not be used without taking a reference */ -+ if (dst->flags & DST_NOCACHE) { -+ if (likely(atomic_inc_not_zero(&dst->__refcnt))) -+ skb_dst_set(skb, dst); -+ } else { -+ skb_dst_set_noref(skb, dst); -+ } -+ } - } - - int udp_rcv(struct sk_buff *skb) --- -2.1.0 - - -From 469e1ebf7f9f83516cd805f0a8f2392d1b8298a3 Mon Sep 17 00:00:00 2001 -From: Nikolay Aleksandrov -Date: Tue, 4 Aug 2015 19:06:32 +0200 -Subject: [PATCH 39/46] bridge: netlink: account for the IFLA_BRPORT_PROXYARP - attribute size and policy - -[ Upstream commit 355b9f9df1f0311f20087350aee8ad96eedca8a9 ] - -The attribute size wasn't accounted for in the get_slave_size() callback -(br_port_get_slave_size) when it was introduced, so fix it now. Also add -a policy entry for it in br_port_policy. - -Signed-off-by: Nikolay Aleksandrov -Fixes: 958501163ddd ("bridge: Add support for IEEE 802.11 Proxy ARP") -Signed-off-by: David S. Miller ---- - net/bridge/br_netlink.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c -index 20e06a9..95ef032 100644 ---- a/net/bridge/br_netlink.c -+++ b/net/bridge/br_netlink.c -@@ -112,6 +112,7 @@ static inline size_t br_port_info_size(void) - + nla_total_size(1) /* IFLA_BRPORT_FAST_LEAVE */ - + nla_total_size(1) /* IFLA_BRPORT_LEARNING */ - + nla_total_size(1) /* IFLA_BRPORT_UNICAST_FLOOD */ -+ + nla_total_size(1) /* IFLA_BRPORT_PROXYARP */ - + 0; - } - -@@ -504,6 +505,7 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = { - [IFLA_BRPORT_FAST_LEAVE]= { .type = NLA_U8 }, - [IFLA_BRPORT_LEARNING] = { .type = NLA_U8 }, - [IFLA_BRPORT_UNICAST_FLOOD] = { .type = NLA_U8 }, -+ [IFLA_BRPORT_PROXYARP] = { .type = NLA_U8 }, - }; - - /* Change the state of the port and notify spanning tree */ --- -2.1.0 - - -From 7cea8ba728e377145ddb3c0c449beca792171109 Mon Sep 17 00:00:00 2001 -From: Nikolay Aleksandrov -Date: Tue, 4 Aug 2015 19:06:33 +0200 -Subject: [PATCH 40/46] bridge: netlink: account for the - IFLA_BRPORT_PROXYARP_WIFI attribute size and policy - -[ Upstream commit 786c2077ec8e9eab37a88fc14aac4309a8061e18 ] - -The attribute size wasn't accounted for in the get_slave_size() callback -(br_port_get_slave_size) when it was introduced, so fix it now. Also add -a policy entry for it in br_port_policy. - -Signed-off-by: Nikolay Aleksandrov -Fixes: 842a9ae08a25 ("bridge: Extend Proxy ARP design to allow optional rules for Wi-Fi") -Signed-off-by: David S. Miller ---- - net/bridge/br_netlink.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c -index 95ef032..a7559ef 100644 ---- a/net/bridge/br_netlink.c -+++ b/net/bridge/br_netlink.c -@@ -113,6 +113,7 @@ static inline size_t br_port_info_size(void) - + nla_total_size(1) /* IFLA_BRPORT_LEARNING */ - + nla_total_size(1) /* IFLA_BRPORT_UNICAST_FLOOD */ - + nla_total_size(1) /* IFLA_BRPORT_PROXYARP */ -+ + nla_total_size(1) /* IFLA_BRPORT_PROXYARP_WIFI */ - + 0; - } - -@@ -506,6 +507,7 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = { - [IFLA_BRPORT_LEARNING] = { .type = NLA_U8 }, - [IFLA_BRPORT_UNICAST_FLOOD] = { .type = NLA_U8 }, - [IFLA_BRPORT_PROXYARP] = { .type = NLA_U8 }, -+ [IFLA_BRPORT_PROXYARP_WIFI] = { .type = NLA_U8 }, - }; - - /* Change the state of the port and notify spanning tree */ --- -2.1.0 - - -From 61c226cb391165314b5ee42cc6f72bc9b29bc897 Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Thu, 6 Aug 2015 22:48:23 +0200 -Subject: [PATCH 41/46] bna: fix interrupts storm caused by erroneous packets - -[ Upstream commit ade4dc3e616e33c80d7e62855fe1b6f9895bc7c3 ] - -The commit "e29aa33 bna: Enable Multi Buffer RX" moved packets counter -increment from the beginning of the NAPI processing loop after the check -for erroneous packets so they are never accounted. This counter is used -to inform firmware about number of processed completions (packets). -As these packets are never acked the firmware fires IRQs for them again -and again. - -Fixes: e29aa33 ("bna: Enable Multi Buffer RX") -Signed-off-by: Ivan Vecera -Acked-by: Rasesh Mody -Signed-off-by: David S. Miller ---- - drivers/net/ethernet/brocade/bna/bnad.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c -index caae6cb..a1c30ee 100644 ---- a/drivers/net/ethernet/brocade/bna/bnad.c -+++ b/drivers/net/ethernet/brocade/bna/bnad.c -@@ -675,6 +675,7 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget) - if (!next_cmpl->valid) - break; - } -+ packets++; - - /* TODO: BNA_CQ_EF_LOCAL ? */ - if (unlikely(flags & (BNA_CQ_EF_MAC_ERROR | -@@ -691,7 +692,6 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget) - else - bnad_cq_setup_skb_frags(rcb, skb, sop_ci, nvecs, len); - -- packets++; - rcb->rxq->rx_packets++; - rcb->rxq->rx_bytes += totlen; - ccb->bytes_per_intr += totlen; --- -2.1.0 - - -From a4f50b7501f98b5e76e695bb3f8c892429082f90 Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann -Date: Fri, 7 Aug 2015 00:26:41 +0200 -Subject: [PATCH 42/46] netlink: make sure -EBUSY won't escape from - netlink_insert - -[ Upstream commit 4e7c1330689e27556de407d3fdadc65ffff5eb12 ] - -Linus reports the following deadlock on rtnl_mutex; triggered only -once so far (extract): - -[12236.694209] NetworkManager D 0000000000013b80 0 1047 1 0x00000000 -[12236.694218] ffff88003f902640 0000000000000000 ffffffff815d15a9 0000000000000018 -[12236.694224] ffff880119538000 ffff88003f902640 ffffffff81a8ff84 00000000ffffffff -[12236.694230] ffffffff81a8ff88 ffff880119c47f00 ffffffff815d133a ffffffff81a8ff80 -[12236.694235] Call Trace: -[12236.694250] [] ? schedule_preempt_disabled+0x9/0x10 -[12236.694257] [] ? schedule+0x2a/0x70 -[12236.694263] [] ? schedule_preempt_disabled+0x9/0x10 -[12236.694271] [] ? __mutex_lock_slowpath+0x7f/0xf0 -[12236.694280] [] ? mutex_lock+0x16/0x30 -[12236.694291] [] ? rtnetlink_rcv+0x10/0x30 -[12236.694299] [] ? netlink_unicast+0xfb/0x180 -[12236.694309] [] ? rtnl_getlink+0x113/0x190 -[12236.694319] [] ? rtnetlink_rcv_msg+0x7a/0x210 -[12236.694331] [] ? sock_has_perm+0x5c/0x70 -[12236.694339] [] ? rtnetlink_rcv+0x30/0x30 -[12236.694346] [] ? netlink_rcv_skb+0x9c/0xc0 -[12236.694354] [] ? rtnetlink_rcv+0x1f/0x30 -[12236.694360] [] ? netlink_unicast+0xfb/0x180 -[12236.694367] [] ? netlink_sendmsg+0x484/0x5d0 -[12236.694376] [] ? __wake_up+0x2f/0x50 -[12236.694387] [] ? sock_sendmsg+0x33/0x40 -[12236.694396] [] ? ___sys_sendmsg+0x22e/0x240 -[12236.694405] [] ? ___sys_recvmsg+0x135/0x1a0 -[12236.694415] [] ? eventfd_write+0x82/0x210 -[12236.694423] [] ? fsnotify+0x32e/0x4c0 -[12236.694429] [] ? wake_up_q+0x60/0x60 -[12236.694434] [] ? __sys_sendmsg+0x39/0x70 -[12236.694440] [] ? entry_SYSCALL_64_fastpath+0x12/0x6a - -It seems so far plausible that the recursive call into rtnetlink_rcv() -looks suspicious. One way, where this could trigger is that the senders -NETLINK_CB(skb).portid was wrongly 0 (which is rtnetlink socket), so -the rtnl_getlink() request's answer would be sent to the kernel instead -to the actual user process, thus grabbing rtnl_mutex() twice. - -One theory would be that netlink_autobind() triggered via netlink_sendmsg() -internally overwrites the -EBUSY error to 0, but where it is wrongly -originating from __netlink_insert() instead. That would reset the -socket's portid to 0, which is then filled into NETLINK_CB(skb).portid -later on. As commit d470e3b483dc ("[NETLINK]: Fix two socket hashing bugs.") -also puts it, -EBUSY should not be propagated from netlink_insert(). - -It looks like it's very unlikely to reproduce. We need to trigger the -rhashtable_insert_rehash() handler under a situation where rehashing -currently occurs (one /rare/ way would be to hit ht->elasticity limits -while not filled enough to expand the hashtable, but that would rather -require a specifically crafted bind() sequence with knowledge about -destination slots, seems unlikely). It probably makes sense to guard -__netlink_insert() in any case and remap that error. It was suggested -that EOVERFLOW might be better than an already overloaded ENOMEM. - -Reference: http://thread.gmane.org/gmane.linux.network/372676 -Reported-by: Linus Torvalds -Signed-off-by: Daniel Borkmann -Acked-by: Herbert Xu -Acked-by: Thomas Graf -Signed-off-by: David S. Miller ---- - net/netlink/af_netlink.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index ea5ed7a..4856d97 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -1094,6 +1094,11 @@ static int netlink_insert(struct sock *sk, u32 portid) - - err = __netlink_insert(table, sk); - if (err) { -+ /* In case the hashtable backend returns with -EBUSY -+ * from here, it must not escape to the caller. -+ */ -+ if (unlikely(err == -EBUSY)) -+ err = -EOVERFLOW; - if (err == -EEXIST) - err = -EADDRINUSE; - nlk_sk(sk)->portid = 0; --- -2.1.0 - - -From 538c509b7f2287f77363c6410216160d082dba22 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Mon, 10 Aug 2015 15:07:34 -0700 -Subject: [PATCH 43/46] inet: fix possible request socket leak - -[ Upstream commit 3257d8b12f954c462d29de6201664a846328a522 ] - -In commit b357a364c57c9 ("inet: fix possible panic in -reqsk_queue_unlink()"), I missed fact that tcp_check_req() -can return the listener socket in one case, and that we must -release the request socket refcount or we leak it. - -Tested: - - Following packetdrill test template shows the issue - -0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 -+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 -+0 bind(3, ..., ...) = 0 -+0 listen(3, 1) = 0 - -+0 < S 0:0(0) win 2920 -+0 > S. 0:0(0) ack 1 -+.002 < . 1:1(0) ack 21 win 2920 -+0 > R 21:21(0) - -Fixes: b357a364c57c9 ("inet: fix possible panic in reqsk_queue_unlink()") -Signed-off-by: Eric Dumazet -Signed-off-by: David S. Miller ---- - net/ipv4/tcp_ipv4.c | 2 +- - net/ipv6/tcp_ipv6.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index fc1c658..441ca6f 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -1348,7 +1348,7 @@ static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb) - req = inet_csk_search_req(sk, th->source, iph->saddr, iph->daddr); - if (req) { - nsk = tcp_check_req(sk, skb, req, false); -- if (!nsk) -+ if (!nsk || nsk == sk) - reqsk_put(req); - return nsk; - } -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 3adffb3..e541d68 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -946,7 +946,7 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk, struct sk_buff *skb) - &ipv6_hdr(skb)->daddr, tcp_v6_iif(skb)); - if (req) { - nsk = tcp_check_req(sk, skb, req, false); -- if (!nsk) -+ if (!nsk || nsk == sk) - reqsk_put(req); - return nsk; - } --- -2.1.0 - - -From 5712cc9fa64a51b05baa1fa1e7a56e911ad47e3e Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Mon, 10 Aug 2015 09:09:13 -0700 -Subject: [PATCH 44/46] inet: fix races with reqsk timers - -[ Upstream commit 2235f2ac75fd2501c251b0b699a9632e80239a6d ] - -reqsk_queue_destroy() and reqsk_queue_unlink() should use -del_timer_sync() instead of del_timer() before calling reqsk_put(), -otherwise we could free a req still used by another cpu. - -But before doing so, reqsk_queue_destroy() must release syn_wait_lock -spinlock or risk a dead lock, as reqsk_timer_handler() might -need to take this same spinlock from reqsk_queue_unlink() (called from -inet_csk_reqsk_queue_drop()) - -Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer") -Signed-off-by: Eric Dumazet -Signed-off-by: David S. Miller ---- - net/core/request_sock.c | 8 +++++++- - net/ipv4/inet_connection_sock.c | 2 +- - 2 files changed, 8 insertions(+), 2 deletions(-) - -diff --git a/net/core/request_sock.c b/net/core/request_sock.c -index 87b22c0..b42f0e2 100644 ---- a/net/core/request_sock.c -+++ b/net/core/request_sock.c -@@ -103,10 +103,16 @@ void reqsk_queue_destroy(struct request_sock_queue *queue) - spin_lock_bh(&queue->syn_wait_lock); - while ((req = lopt->syn_table[i]) != NULL) { - lopt->syn_table[i] = req->dl_next; -+ /* Because of following del_timer_sync(), -+ * we must release the spinlock here -+ * or risk a dead lock. -+ */ -+ spin_unlock_bh(&queue->syn_wait_lock); - atomic_inc(&lopt->qlen_dec); -- if (del_timer(&req->rsk_timer)) -+ if (del_timer_sync(&req->rsk_timer)) - reqsk_put(req); - reqsk_put(req); -+ spin_lock_bh(&queue->syn_wait_lock); - } - spin_unlock_bh(&queue->syn_wait_lock); - } -diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c -index 8976ca4..b27fc40 100644 ---- a/net/ipv4/inet_connection_sock.c -+++ b/net/ipv4/inet_connection_sock.c -@@ -584,7 +584,7 @@ static bool reqsk_queue_unlink(struct request_sock_queue *queue, - } - - spin_unlock(&queue->syn_wait_lock); -- if (del_timer(&req->rsk_timer)) -+ if (del_timer_sync(&req->rsk_timer)) - reqsk_put(req); - return found; - } --- -2.1.0 - - -From 6f5087e42a1d9b2ebb7340eeea948b9524e54862 Mon Sep 17 00:00:00 2001 -From: Florian Fainelli -Date: Sat, 8 Aug 2015 12:58:57 -0700 -Subject: [PATCH 45/46] net: dsa: Do not override PHY interface if already - configured - -[ Upstream commit 211c504a444710b1d8ce3431ac19f2578602ca27 ] - -In case we need to divert reads/writes using the slave MII bus, we may have -already fetched a valid PHY interface property from Device Tree, and that -mode is used by the PHY driver to make configuration decisions. - -If we could not fetch the "phy-mode" property, we will assign p->phy_interface -to PHY_INTERFACE_MODE_NA, such that we can actually check for that condition as -to whether or not we should override the interface value. - -Fixes: 19334920eaf7 ("net: dsa: Set valid phy interface type") -Signed-off-by: Florian Fainelli -Signed-off-by: David S. Miller ---- - net/dsa/slave.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/dsa/slave.c b/net/dsa/slave.c -index 827cda56..57978c5 100644 ---- a/net/dsa/slave.c -+++ b/net/dsa/slave.c -@@ -732,7 +732,8 @@ static int dsa_slave_phy_connect(struct dsa_slave_priv *p, - return -ENODEV; - - /* Use already configured phy mode */ -- p->phy_interface = p->phy->interface; -+ if (p->phy_interface == PHY_INTERFACE_MODE_NA) -+ p->phy_interface = p->phy->interface; - phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link, - p->phy_interface); - --- -2.1.0 - - -From 75eefed4fed0fd630556144eedcfed7e017ca96a Mon Sep 17 00:00:00 2001 -From: Andy Whitcroft -Date: Thu, 13 Aug 2015 20:49:01 +0100 -Subject: [PATCH 46/46] ipv4: off-by-one in continuation handling in - /proc/net/route - -[ Upstream commit 25b97c016b26039982daaa2c11d83979f93b71ab ] - -When generating /proc/net/route we emit a header followed by a line for -each route. When a short read is performed we will restart this process -based on the open file descriptor. When calculating the start point we -fail to take into account that the 0th entry is the header. This leads -us to skip the first entry when doing a continuation read. - -This can be easily seen with the comparison below: - - while read l; do echo "$l"; done A - cat /proc/net/route >B - diff -bu A B | grep '^[+-]' - -On my example machine I have approximatly 10KB of route output. There we -see the very first non-title element is lost in the while read case, -and an entry around the 8K mark in the cat case: - - +wlan0 00000000 02021EAC 0003 0 0 400 00000000 0 0 0 - -tun1 00C0AC0A 00000000 0001 0 0 950 00C0FFFF 0 0 0 - -Fix up the off-by-one when reaquiring position on continuation. - -Fixes: 8be33e955cb9 ("fib_trie: Fib walk rcu should take a tnode and key instead of a trie and a leaf") -BugLink: http://bugs.launchpad.net/bugs/1483440 -Acked-by: Alexander Duyck -Signed-off-by: Andy Whitcroft -Signed-off-by: David S. Miller ---- - net/ipv4/fib_trie.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c -index 210ceca..0ca933d 100644 ---- a/net/ipv4/fib_trie.c -+++ b/net/ipv4/fib_trie.c -@@ -2453,7 +2453,7 @@ static struct key_vector *fib_route_get_idx(struct fib_route_iter *iter, - key = l->key + 1; - iter->pos++; - -- if (pos-- <= 0) -+ if (--pos <= 0) - break; - - l = NULL; --- -2.1.0 - diff --git a/kernel/kernel/files/patches/mageia/stable-pci-add-dev_flags-bit-to-access-vpd-through-function-0.patch b/kernel/kernel/files/patches/mageia/stable-pci-add-dev_flags-bit-to-access-vpd-through-function-0.patch new file mode 100644 index 00000000..f7bd065f --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-pci-add-dev_flags-bit-to-access-vpd-through-function-0.patch @@ -0,0 +1,135 @@ +From 932c435caba8a2ce473a91753bad0173269ef334 Mon Sep 17 00:00:00 2001 +From: Mark Rustad +Date: Mon, 13 Jul 2015 11:40:02 -0700 +Subject: PCI: Add dev_flags bit to access VPD through function 0 + +From: Mark Rustad + +commit 932c435caba8a2ce473a91753bad0173269ef334 upstream. + +Add a dev_flags bit, PCI_DEV_FLAGS_VPD_REF_F0, to access VPD through +function 0 to provide VPD access on other functions. This is for hardware +devices that provide copies of the same VPD capability registers in +multiple functions. Because the kernel expects that each function has its +own registers, both the locking and the state tracking are affected by VPD +accesses to different functions. + +On such devices for example, if a VPD write is performed on function 0, +*any* later attempt to read VPD from any other function of that device will +hang. This has to do with how the kernel tracks the expected value of the +F bit per function. + +Concurrent accesses to different functions of the same device can not only +hang but also corrupt both read and write VPD data. + +When hangs occur, typically the error message: + + vpd r/w failed. This is likely a firmware bug on this device. + +will be seen. + +Never set this bit on function 0 or there will be an infinite recursion. + +Signed-off-by: Mark Rustad +Signed-off-by: Bjorn Helgaas +Acked-by: Alexander Duyck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/access.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++- + include/linux/pci.h | 2 + + 2 files changed, 62 insertions(+), 1 deletion(-) + +--- a/drivers/pci/access.c ++++ b/drivers/pci/access.c +@@ -439,6 +439,56 @@ static const struct pci_vpd_ops pci_vpd_ + .release = pci_vpd_pci22_release, + }; + ++static ssize_t pci_vpd_f0_read(struct pci_dev *dev, loff_t pos, size_t count, ++ void *arg) ++{ ++ struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn)); ++ ssize_t ret; ++ ++ if (!tdev) ++ return -ENODEV; ++ ++ ret = pci_read_vpd(tdev, pos, count, arg); ++ pci_dev_put(tdev); ++ return ret; ++} ++ ++static ssize_t pci_vpd_f0_write(struct pci_dev *dev, loff_t pos, size_t count, ++ const void *arg) ++{ ++ struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn)); ++ ssize_t ret; ++ ++ if (!tdev) ++ return -ENODEV; ++ ++ ret = pci_write_vpd(tdev, pos, count, arg); ++ pci_dev_put(tdev); ++ return ret; ++} ++ ++static const struct pci_vpd_ops pci_vpd_f0_ops = { ++ .read = pci_vpd_f0_read, ++ .write = pci_vpd_f0_write, ++ .release = pci_vpd_pci22_release, ++}; ++ ++static int pci_vpd_f0_dev_check(struct pci_dev *dev) ++{ ++ struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn)); ++ int ret = 0; ++ ++ if (!tdev) ++ return -ENODEV; ++ if (!tdev->vpd || !tdev->multifunction || ++ dev->class != tdev->class || dev->vendor != tdev->vendor || ++ dev->device != tdev->device) ++ ret = -ENODEV; ++ ++ pci_dev_put(tdev); ++ return ret; ++} ++ + int pci_vpd_pci22_init(struct pci_dev *dev) + { + struct pci_vpd_pci22 *vpd; +@@ -447,12 +497,21 @@ int pci_vpd_pci22_init(struct pci_dev *d + cap = pci_find_capability(dev, PCI_CAP_ID_VPD); + if (!cap) + return -ENODEV; ++ if (dev->dev_flags & PCI_DEV_FLAGS_VPD_REF_F0) { ++ int ret = pci_vpd_f0_dev_check(dev); ++ ++ if (ret) ++ return ret; ++ } + vpd = kzalloc(sizeof(*vpd), GFP_ATOMIC); + if (!vpd) + return -ENOMEM; + + vpd->base.len = PCI_VPD_PCI22_SIZE; +- vpd->base.ops = &pci_vpd_pci22_ops; ++ if (dev->dev_flags & PCI_DEV_FLAGS_VPD_REF_F0) ++ vpd->base.ops = &pci_vpd_f0_ops; ++ else ++ vpd->base.ops = &pci_vpd_pci22_ops; + mutex_init(&vpd->lock); + vpd->cap = cap; + vpd->busy = false; +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -180,6 +180,8 @@ enum pci_dev_flags { + PCI_DEV_FLAGS_NO_BUS_RESET = (__force pci_dev_flags_t) (1 << 6), + /* Do not use PM reset even if device advertises NoSoftRst- */ + PCI_DEV_FLAGS_NO_PM_RESET = (__force pci_dev_flags_t) (1 << 7), ++ /* Get VPD from function 0 VPD */ ++ PCI_DEV_FLAGS_VPD_REF_F0 = (__force pci_dev_flags_t) (1 << 8), + }; + + enum pci_irq_reroute_variant { diff --git a/kernel/kernel/files/patches/mageia/stable-pci-add-vpd-function-0-quirk-for-intel-ethernet-devices.patch b/kernel/kernel/files/patches/mageia/stable-pci-add-vpd-function-0-quirk-for-intel-ethernet-devices.patch new file mode 100644 index 00000000..b31bb387 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-pci-add-vpd-function-0-quirk-for-intel-ethernet-devices.patch @@ -0,0 +1,41 @@ +From 7aa6ca4d39edf01f997b9e02cf6d2fdeb224f351 Mon Sep 17 00:00:00 2001 +From: Mark Rustad +Date: Mon, 13 Jul 2015 11:40:07 -0700 +Subject: PCI: Add VPD function 0 quirk for Intel Ethernet devices + +From: Mark Rustad + +commit 7aa6ca4d39edf01f997b9e02cf6d2fdeb224f351 upstream. + +Set the PCI_DEV_FLAGS_VPD_REF_F0 flag on all Intel Ethernet device +functions other than function 0, so that on multi-function devices, we will +always read VPD from function 0 instead of from the other functions. + +[bhelgaas: changelog] +Signed-off-by: Mark Rustad +Signed-off-by: Bjorn Helgaas +Acked-by: Alexander Duyck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1903,6 +1903,15 @@ static void quirk_netmos(struct pci_dev + DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_NETMOS, PCI_ANY_ID, + PCI_CLASS_COMMUNICATION_SERIAL, 8, quirk_netmos); + ++static void quirk_f0_vpd_link(struct pci_dev *dev) ++{ ++ if (!dev->multifunction || !PCI_FUNC(dev->devfn)) ++ return; ++ dev->dev_flags |= PCI_DEV_FLAGS_VPD_REF_F0; ++} ++DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, ++ PCI_CLASS_NETWORK_ETHERNET, 8, quirk_f0_vpd_link); ++ + static void quirk_e100_interrupt(struct pci_dev *dev) + { + u16 command, pmcsr; diff --git a/kernel/kernel/files/patches/mageia/stable-pci-disable-async-suspend-resume-for-jmicron-multi-function-sata-ahci.patch b/kernel/kernel/files/patches/mageia/stable-pci-disable-async-suspend-resume-for-jmicron-multi-function-sata-ahci.patch new file mode 100644 index 00000000..ab31953c --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-pci-disable-async-suspend-resume-for-jmicron-multi-function-sata-ahci.patch @@ -0,0 +1,120 @@ +From 91f15fb30c77d4a0d0d9b97e5cec647650853145 Mon Sep 17 00:00:00 2001 +From: Zhang Rui +Date: Mon, 24 Aug 2015 15:27:11 -0500 +Subject: PCI: Disable async suspend/resume for JMicron multi-function SATA/AHCI + +From: Zhang Rui + +commit 91f15fb30c77d4a0d0d9b97e5cec647650853145 upstream. + +On multi-function JMicron SATA/PATA/AHCI devices, the PATA controller at +function 1 doesn't work if it is powered on before the SATA controller at +function 0. The result is that PATA doesn't work after resume, and we +print messages like this: + + pata_jmicron 0000:02:00.1: Refused to change power state, currently in D3 + irq 17: nobody cared (try booting with the "irqpoll" option) + +Async resume was introduced in v3.15 by 76569faa62c4 ("PM / sleep: +Asynchronous threads for resume_noirq"). Prior to that, we powered on +the functions in order, so this problem shouldn't happen. + +e6b7e41cdd8c ("ata: Disabling the async PM for JMicron chip 363/361") +solved the problem for JMicron 361 and 363 devices. With async suspend +disabled, we always power on function 0 before function 1. + +Barto then reported the same problem with a JMicron 368 (see comment #57 in +the bugzilla). + +Rather than extending the blacklist piecemeal, disable async suspend for +all JMicron multi-function SATA/PATA/AHCI devices. + +This quirk could stay in the ahci and pata_jmicron drivers, but it's likely +the problem will occur even if pata_jmicron isn't loaded until after the +suspend/resume. Making it a PCI quirk ensures that we'll preserve the +power-on order even if the drivers aren't loaded. + +[bhelgaas: changelog, limit to multi-function, limit to IDE/ATA] +Link: https://bugzilla.kernel.org/show_bug.cgi?id=81551 +Reported-and-tested-by: Barto +Signed-off-by: Zhang Rui +Signed-off-by: Bjorn Helgaas +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ahci.c | 13 +------------ + drivers/ata/pata_jmicron.c | 12 ------------ + drivers/pci/quirks.c | 12 ++++++++++++ + 3 files changed, 13 insertions(+), 24 deletions(-) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -349,6 +349,7 @@ static const struct pci_device_id ahci_p + /* JMicron 362B and 362C have an AHCI function with IDE class code */ + { PCI_VDEVICE(JMICRON, 0x2362), board_ahci_ign_iferr }, + { PCI_VDEVICE(JMICRON, 0x236f), board_ahci_ign_iferr }, ++ /* May need to update quirk_jmicron_async_suspend() for additions */ + + /* ATI */ + { PCI_VDEVICE(ATI, 0x4380), board_ahci_sb600 }, /* ATI SB600 */ +@@ -1377,18 +1378,6 @@ static int ahci_init_one(struct pci_dev + else if (pdev->vendor == 0x1c44 && pdev->device == 0x8000) + ahci_pci_bar = AHCI_PCI_BAR_ENMOTUS; + +- /* +- * The JMicron chip 361/363 contains one SATA controller and one +- * PATA controller,for powering on these both controllers, we must +- * follow the sequence one by one, otherwise one of them can not be +- * powered on successfully, so here we disable the async suspend +- * method for these chips. +- */ +- if (pdev->vendor == PCI_VENDOR_ID_JMICRON && +- (pdev->device == PCI_DEVICE_ID_JMICRON_JMB363 || +- pdev->device == PCI_DEVICE_ID_JMICRON_JMB361)) +- device_disable_async_suspend(&pdev->dev); +- + /* acquire resources */ + rc = pcim_enable_device(pdev); + if (rc) +--- a/drivers/ata/pata_jmicron.c ++++ b/drivers/ata/pata_jmicron.c +@@ -143,18 +143,6 @@ static int jmicron_init_one (struct pci_ + }; + const struct ata_port_info *ppi[] = { &info, NULL }; + +- /* +- * The JMicron chip 361/363 contains one SATA controller and one +- * PATA controller,for powering on these both controllers, we must +- * follow the sequence one by one, otherwise one of them can not be +- * powered on successfully, so here we disable the async suspend +- * method for these chips. +- */ +- if (pdev->vendor == PCI_VENDOR_ID_JMICRON && +- (pdev->device == PCI_DEVICE_ID_JMICRON_JMB363 || +- pdev->device == PCI_DEVICE_ID_JMICRON_JMB361)) +- device_disable_async_suspend(&pdev->dev); +- + return ata_pci_bmdma_init_one(pdev, ppi, &jmicron_sht, NULL, 0); + } + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1576,6 +1576,18 @@ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDO + + #endif + ++static void quirk_jmicron_async_suspend(struct pci_dev *dev) ++{ ++ if (dev->multifunction) { ++ device_disable_async_suspend(&dev->dev); ++ dev_info(&dev->dev, "async suspend disabled to avoid multi-function power-on ordering issue\n"); ++ } ++} ++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_CLASS_STORAGE_IDE, 8, quirk_jmicron_async_suspend); ++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_CLASS_STORAGE_SATA_AHCI, 0, quirk_jmicron_async_suspend); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_JMICRON, 0x2362, quirk_jmicron_async_suspend); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_JMICRON, 0x236f, quirk_jmicron_async_suspend); ++ + #ifdef CONFIG_X86_IO_APIC + static void quirk_alder_ioapic(struct pci_dev *pdev) + { diff --git a/kernel/kernel/files/patches/mageia/stable-pci-fix-ti816x-class-code-quirk.patch b/kernel/kernel/files/patches/mageia/stable-pci-fix-ti816x-class-code-quirk.patch new file mode 100644 index 00000000..cb1d71e3 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-pci-fix-ti816x-class-code-quirk.patch @@ -0,0 +1,45 @@ +From d1541dc977d376406f4584d8eb055488655c98ec Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Fri, 19 Jun 2015 15:58:24 -0500 +Subject: PCI: Fix TI816X class code quirk + +From: Bjorn Helgaas + +commit d1541dc977d376406f4584d8eb055488655c98ec upstream. + +In fixup_ti816x_class(), we assigned "class = PCI_CLASS_MULTIMEDIA_VIDEO". +But PCI_CLASS_MULTIMEDIA_VIDEO is only the two-byte base class/sub-class +and needs to be shifted to make space for the low-order interface byte. + +Shift PCI_CLASS_MULTIMEDIA_VIDEO to set the correct class code. + +Fixes: 63c4408074cb ("PCI: Add quirk for setting valid class for TI816X Endpoint") +Signed-off-by: Bjorn Helgaas +CC: Hemant Pedanekar +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -2838,12 +2838,15 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_IN + + static void fixup_ti816x_class(struct pci_dev *dev) + { ++ u32 class = dev->class; ++ + /* TI 816x devices do not have class code set when in PCIe boot mode */ +- dev_info(&dev->dev, "Setting PCI class for 816x PCIe device\n"); +- dev->class = PCI_CLASS_MULTIMEDIA_VIDEO; ++ dev->class = PCI_CLASS_MULTIMEDIA_VIDEO << 8; ++ dev_info(&dev->dev, "PCI class overridden (%#08x -> %#08x)\n", ++ class, dev->class); + } + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_TI, 0xb800, +- PCI_CLASS_NOT_DEFINED, 0, fixup_ti816x_class); ++ PCI_CLASS_NOT_DEFINED, 0, fixup_ti816x_class); + + /* Some PCIe devices do not work reliably with the claimed maximum + * payload size supported. diff --git a/kernel/kernel/files/patches/mageia/stable-perf-fix-double-free-of-the-aux-buffer.patch b/kernel/kernel/files/patches/mageia/stable-perf-fix-double-free-of-the-aux-buffer.patch deleted file mode 100644 index ec441704..00000000 --- a/kernel/kernel/files/patches/mageia/stable-perf-fix-double-free-of-the-aux-buffer.patch +++ /dev/null @@ -1,49 +0,0 @@ -From ee9397a6fb9bc4e52677f5e33eed4abee0f515e6 Mon Sep 17 00:00:00 2001 -From: Ben Hutchings -Date: Mon, 27 Jul 2015 00:31:08 +0100 -Subject: perf: Fix double-free of the AUX buffer - -From: Ben Hutchings - -commit ee9397a6fb9bc4e52677f5e33eed4abee0f515e6 upstream. - -If rb->aux_refcount is decremented to zero before rb->refcount, -__rb_free_aux() may be called twice resulting in a double free of -rb->aux_pages. Fix this by adding a check to __rb_free_aux(). - -Signed-off-by: Ben Hutchings -Signed-off-by: Peter Zijlstra (Intel) -Cc: Alexander Shishkin -Cc: Arnaldo Carvalho de Melo -Cc: Linus Torvalds -Cc: Peter Zijlstra -Cc: Thomas Gleixner -Fixes: 57ffc5ca679f ("perf: Fix AUX buffer refcounting") -Link: http://lkml.kernel.org/r/1437953468.12842.17.camel@decadent.org.uk -Signed-off-by: Ingo Molnar -Signed-off-by: Greg Kroah-Hartman - ---- - kernel/events/ring_buffer.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - ---- a/kernel/events/ring_buffer.c -+++ b/kernel/events/ring_buffer.c -@@ -547,11 +547,13 @@ static void __rb_free_aux(struct ring_bu - rb->aux_priv = NULL; - } - -- for (pg = 0; pg < rb->aux_nr_pages; pg++) -- rb_free_aux_page(rb, pg); -+ if (rb->aux_nr_pages) { -+ for (pg = 0; pg < rb->aux_nr_pages; pg++) -+ rb_free_aux_page(rb, pg); - -- kfree(rb->aux_pages); -- rb->aux_nr_pages = 0; -+ kfree(rb->aux_pages); -+ rb->aux_nr_pages = 0; -+ } - } - - void rb_free_aux(struct ring_buffer *rb) diff --git a/kernel/kernel/files/patches/mageia/stable-perf-fix-fasync-handling-on-inherited-events.patch b/kernel/kernel/files/patches/mageia/stable-perf-fix-fasync-handling-on-inherited-events.patch deleted file mode 100644 index c9c5315b..00000000 --- a/kernel/kernel/files/patches/mageia/stable-perf-fix-fasync-handling-on-inherited-events.patch +++ /dev/null @@ -1,69 +0,0 @@ -From fed66e2cdd4f127a43fd11b8d92a99bdd429528c Mon Sep 17 00:00:00 2001 -From: Peter Zijlstra -Date: Thu, 11 Jun 2015 10:32:01 +0200 -Subject: perf: Fix fasync handling on inherited events - -From: Peter Zijlstra - -commit fed66e2cdd4f127a43fd11b8d92a99bdd429528c upstream. - -Vince reported that the fasync signal stuff doesn't work proper for -inherited events. So fix that. - -Installing fasync allocates memory and sets filp->f_flags |= FASYNC, -which upon the demise of the file descriptor ensures the allocation is -freed and state is updated. - -Now for perf, we can have the events stick around for a while after the -original FD is dead because of references from child events. So we -cannot copy the fasync pointer around. We can however consistently use -the parent's fasync, as that will be updated. - -Reported-and-Tested-by: Vince Weaver -Signed-off-by: Peter Zijlstra (Intel) -Cc: Arnaldo Carvalho deMelo -Cc: Linus Torvalds -Cc: Peter Zijlstra -Cc: Thomas Gleixner -Cc: eranian@google.com -Link: http://lkml.kernel.org/r/1434011521.1495.71.camel@twins -Signed-off-by: Ingo Molnar -Signed-off-by: Greg Kroah-Hartman - ---- - kernel/events/core.c | 12 ++++++++++-- - 1 file changed, 10 insertions(+), 2 deletions(-) - ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -4766,12 +4766,20 @@ static const struct file_operations perf - * to user-space before waking everybody up. - */ - -+static inline struct fasync_struct **perf_event_fasync(struct perf_event *event) -+{ -+ /* only the parent has fasync state */ -+ if (event->parent) -+ event = event->parent; -+ return &event->fasync; -+} -+ - void perf_event_wakeup(struct perf_event *event) - { - ring_buffer_wakeup(event); - - if (event->pending_kill) { -- kill_fasync(&event->fasync, SIGIO, event->pending_kill); -+ kill_fasync(perf_event_fasync(event), SIGIO, event->pending_kill); - event->pending_kill = 0; - } - } -@@ -6117,7 +6125,7 @@ static int __perf_event_overflow(struct - else - perf_event_output(event, data, regs); - -- if (event->fasync && event->pending_kill) { -+ if (*perf_event_fasync(event) && event->pending_kill) { - event->pending_wakeup = 1; - irq_work_queue(&event->pending); - } diff --git a/kernel/kernel/files/patches/mageia/stable-perf-fix-perf_event_ioc_period-migration-race.patch b/kernel/kernel/files/patches/mageia/stable-perf-fix-perf_event_ioc_period-migration-race.patch deleted file mode 100644 index 15f3ac35..00000000 --- a/kernel/kernel/files/patches/mageia/stable-perf-fix-perf_event_ioc_period-migration-race.patch +++ /dev/null @@ -1,125 +0,0 @@ -From c7999c6f3fed9e383d3131474588f282ae6d56b9 Mon Sep 17 00:00:00 2001 -From: Peter Zijlstra -Date: Tue, 4 Aug 2015 19:22:49 +0200 -Subject: perf: Fix PERF_EVENT_IOC_PERIOD migration race - -From: Peter Zijlstra - -commit c7999c6f3fed9e383d3131474588f282ae6d56b9 upstream. - -I ran the perf fuzzer, which triggered some WARN()s which are due to -trying to stop/restart an event on the wrong CPU. - -Use the normal IPI pattern to ensure we run the code on the correct CPU. - -Signed-off-by: Peter Zijlstra (Intel) -Cc: Vince Weaver -Cc: Linus Torvalds -Cc: Peter Zijlstra -Cc: Thomas Gleixner -Fixes: bad7192b842c ("perf: Fix PERF_EVENT_IOC_PERIOD to force-reset the period") -Signed-off-by: Ingo Molnar -Signed-off-by: Greg Kroah-Hartman - ---- - kernel/events/core.c | 75 +++++++++++++++++++++++++++++++++++++-------------- - 1 file changed, 55 insertions(+), 20 deletions(-) - ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -3976,28 +3976,21 @@ static void perf_event_for_each(struct p - perf_event_for_each_child(sibling, func); - } - --static int perf_event_period(struct perf_event *event, u64 __user *arg) --{ -- struct perf_event_context *ctx = event->ctx; -- int ret = 0, active; -+struct period_event { -+ struct perf_event *event; - u64 value; -+}; - -- if (!is_sampling_event(event)) -- return -EINVAL; -- -- if (copy_from_user(&value, arg, sizeof(value))) -- return -EFAULT; -- -- if (!value) -- return -EINVAL; -+static int __perf_event_period(void *info) -+{ -+ struct period_event *pe = info; -+ struct perf_event *event = pe->event; -+ struct perf_event_context *ctx = event->ctx; -+ u64 value = pe->value; -+ bool active; - -- raw_spin_lock_irq(&ctx->lock); -+ raw_spin_lock(&ctx->lock); - if (event->attr.freq) { -- if (value > sysctl_perf_event_sample_rate) { -- ret = -EINVAL; -- goto unlock; -- } -- - event->attr.sample_freq = value; - } else { - event->attr.sample_period = value; -@@ -4016,11 +4009,53 @@ static int perf_event_period(struct perf - event->pmu->start(event, PERF_EF_RELOAD); - perf_pmu_enable(ctx->pmu); - } -+ raw_spin_unlock(&ctx->lock); -+ -+ return 0; -+} -+ -+static int perf_event_period(struct perf_event *event, u64 __user *arg) -+{ -+ struct period_event pe = { .event = event, }; -+ struct perf_event_context *ctx = event->ctx; -+ struct task_struct *task; -+ u64 value; -+ -+ if (!is_sampling_event(event)) -+ return -EINVAL; -+ -+ if (copy_from_user(&value, arg, sizeof(value))) -+ return -EFAULT; -+ -+ if (!value) -+ return -EINVAL; -+ -+ if (event->attr.freq && value > sysctl_perf_event_sample_rate) -+ return -EINVAL; -+ -+ task = ctx->task; -+ pe.value = value; -+ -+ if (!task) { -+ cpu_function_call(event->cpu, __perf_event_period, &pe); -+ return 0; -+ } -+ -+retry: -+ if (!task_function_call(task, __perf_event_period, &pe)) -+ return 0; -+ -+ raw_spin_lock_irq(&ctx->lock); -+ if (ctx->is_active) { -+ raw_spin_unlock_irq(&ctx->lock); -+ task = ctx->task; -+ goto retry; -+ } - --unlock: -+ __perf_event_period(&pe); - raw_spin_unlock_irq(&ctx->lock); - -- return ret; -+ return 0; - } - - static const struct file_operations perf_fops; diff --git a/kernel/kernel/files/patches/mageia/stable-perf-fix-running-time-accounting.patch b/kernel/kernel/files/patches/mageia/stable-perf-fix-running-time-accounting.patch deleted file mode 100644 index 7fae9b52..00000000 --- a/kernel/kernel/files/patches/mageia/stable-perf-fix-running-time-accounting.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 00a2916f7f82c348a2a94dbb572874173bc308a3 Mon Sep 17 00:00:00 2001 -From: Peter Zijlstra -Date: Mon, 27 Jul 2015 10:35:07 +0200 -Subject: perf: Fix running time accounting - -From: Peter Zijlstra - -commit 00a2916f7f82c348a2a94dbb572874173bc308a3 upstream. - -A recent fix to the shadow timestamp inadvertly broke the running time -accounting. - -We must not update the running timestamp if we fail to schedule the -event, the event will not have ran. This can (and did) result in -negative total runtime because the stopped timestamp was before the -running timestamp (we 'started' but never stopped the event -- because -it never really started we didn't have to stop it either). - -Reported-and-Tested-by: Vince Weaver -Fixes: 72f669c0086f ("perf: Update shadow timestamp before add event") -Signed-off-by: Peter Zijlstra (Intel) -Cc: Shaohua Li -Signed-off-by: Thomas Gleixner -Signed-off-by: Greg Kroah-Hartman - ---- - kernel/events/core.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -1886,8 +1886,6 @@ event_sched_in(struct perf_event *event, - - perf_pmu_disable(event->pmu); - -- event->tstamp_running += tstamp - event->tstamp_stopped; -- - perf_set_shadow_time(event, ctx, tstamp); - - perf_log_itrace_start(event); -@@ -1899,6 +1897,8 @@ event_sched_in(struct perf_event *event, - goto out; - } - -+ event->tstamp_running += tstamp - event->tstamp_stopped; -+ - if (!is_software_event(event)) - cpuctx->active_oncpu++; - if (!ctx->nr_active++) diff --git a/kernel/kernel/files/patches/mageia/stable-pm-clk-don-t-return-int-on-__pm_clk_enable.patch b/kernel/kernel/files/patches/mageia/stable-pm-clk-don-t-return-int-on-__pm_clk_enable.patch new file mode 100644 index 00000000..36cb2f78 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-pm-clk-don-t-return-int-on-__pm_clk_enable.patch @@ -0,0 +1,48 @@ +From f4745a92781b872455f32feb01d1dce92aefcb6c Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Mon, 29 Jun 2015 22:13:38 +0100 +Subject: PM / clk: don't return int on __pm_clk_enable() + +From: Colin Ian King + +commit f4745a92781b872455f32feb01d1dce92aefcb6c upstream. + +Static analysis by cppcheck found an issue that was recently introduced by +commit 471f7707b6f0b1 ("PM / clock_ops: make __pm_clk_enable more generic") +where a return status in ret was not being initialised and garbage +being returned when ce->status >= PCE_STATUS_ERROR. + +The fact that ret is not being checked by the caller and that +ret is only used internally __pm_clk_enable() to check if clk_enable() +was OK means we can ignore returning it instead turn +__pm_clk_enable() into function with a void return. + +Fixes: 471f7707b6f0b1 ("PM / clock_ops: make __pm_clk_enable more generic") +Signed-off-by: Colin Ian King +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/power/clock_ops.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/base/power/clock_ops.c ++++ b/drivers/base/power/clock_ops.c +@@ -37,7 +37,7 @@ struct pm_clock_entry { + * @dev: The device for the given clock + * @ce: PM clock entry corresponding to the clock. + */ +-static inline int __pm_clk_enable(struct device *dev, struct pm_clock_entry *ce) ++static inline void __pm_clk_enable(struct device *dev, struct pm_clock_entry *ce) + { + int ret; + +@@ -49,8 +49,6 @@ static inline int __pm_clk_enable(struct + dev_err(dev, "%s: failed to enable clk %p, error %d\n", + __func__, ce->clk, ret); + } +- +- return ret; + } + + /** diff --git a/kernel/kernel/files/patches/mageia/stable-rsi-fix-failure-to-load-firmware-after-memory-leak-fix-and-fix-the-leak.patch b/kernel/kernel/files/patches/mageia/stable-rsi-fix-failure-to-load-firmware-after-memory-leak-fix-and-fix-the-leak.patch deleted file mode 100644 index a20f3929..00000000 --- a/kernel/kernel/files/patches/mageia/stable-rsi-fix-failure-to-load-firmware-after-memory-leak-fix-and-fix-the-leak.patch +++ /dev/null @@ -1,88 +0,0 @@ -From 5d5cd85ff441534a52f23f821d0a7c644d3b6cce Mon Sep 17 00:00:00 2001 -From: Mike Looijmans -Date: Tue, 28 Jul 2015 07:51:01 +0200 -Subject: rsi: Fix failure to load firmware after memory leak fix and fix the leak - -From: Mike Looijmans - -commit 5d5cd85ff441534a52f23f821d0a7c644d3b6cce upstream. - -Fixes commit eae79b4f3e82 ("rsi: fix memory leak in rsi_load_ta_instructions()") -which stopped the driver from functioning. - -Firmware data has been allocated using vmalloc(), resulting in memory -that cannot be used for DMA. Hence the firmware was first copied to a -buffer allocated with kmalloc() in the original code. This patch reverts -the commit and only calls "kfree()" to release the buffer after sending -the data. This fixes the memory leak without breaking the driver. - -Add a comment to the kmemdup() calls to explain why this is done, and abort -if memory allocation fails. - -Tested on a Topic Miami-Florida board which contains the rsi SDIO chip. - -Also added the same kfree() call to the USB glue driver. This was not -tested on actual hardware though, as I only have the SDIO version. - -Fixes: eae79b4f3e82 ("rsi: fix memory leak in rsi_load_ta_instructions()") -Signed-off-by: Mike Looijmans -Signed-off-by: Kalle Valo -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/net/wireless/rsi/rsi_91x_sdio_ops.c | 8 +++++++- - drivers/net/wireless/rsi/rsi_91x_usb_ops.c | 4 ++++ - 2 files changed, 11 insertions(+), 1 deletion(-) - ---- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c -+++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c -@@ -172,6 +172,7 @@ static int rsi_load_ta_instructions(stru - (struct rsi_91x_sdiodev *)adapter->rsi_dev; - u32 len; - u32 num_blocks; -+ const u8 *fw; - const struct firmware *fw_entry = NULL; - u32 block_size = dev->tx_blk_size; - int status = 0; -@@ -200,6 +201,10 @@ static int rsi_load_ta_instructions(stru - return status; - } - -+ /* Copy firmware into DMA-accessible memory */ -+ fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL); -+ if (!fw) -+ return -ENOMEM; - len = fw_entry->size; - - if (len % 4) -@@ -210,7 +215,8 @@ static int rsi_load_ta_instructions(stru - rsi_dbg(INIT_ZONE, "%s: Instruction size:%d\n", __func__, len); - rsi_dbg(INIT_ZONE, "%s: num blocks: %d\n", __func__, num_blocks); - -- status = rsi_copy_to_card(common, fw_entry->data, len, num_blocks); -+ status = rsi_copy_to_card(common, fw, len, num_blocks); -+ kfree(fw); - release_firmware(fw_entry); - return status; - } ---- a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c -+++ b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c -@@ -146,7 +146,10 @@ static int rsi_load_ta_instructions(stru - return status; - } - -+ /* Copy firmware into DMA-accessible memory */ - fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL); -+ if (!fw) -+ return -ENOMEM; - len = fw_entry->size; - - if (len % 4) -@@ -158,6 +161,7 @@ static int rsi_load_ta_instructions(stru - rsi_dbg(INIT_ZONE, "%s: num blocks: %d\n", __func__, num_blocks); - - status = rsi_copy_to_card(common, fw, len, num_blocks); -+ kfree(fw); - release_firmware(fw_entry); - return status; - } diff --git a/kernel/kernel/files/patches/mageia/stable-rtlwifi-fix-null-dereference-when-pci-driver-used-as-an-ap.patch b/kernel/kernel/files/patches/mageia/stable-rtlwifi-fix-null-dereference-when-pci-driver-used-as-an-ap.patch deleted file mode 100644 index e15d8bb4..00000000 --- a/kernel/kernel/files/patches/mageia/stable-rtlwifi-fix-null-dereference-when-pci-driver-used-as-an-ap.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 7c62940165e9ae4004ce4e6b5117330bab94df68 Mon Sep 17 00:00:00 2001 -From: Luis Felipe Dominguez Vega -Date: Wed, 29 Jul 2015 21:11:20 -0500 -Subject: rtlwifi: Fix NULL dereference when PCI driver used as an AP - -From: Luis Felipe Dominguez Vega - -commit 7c62940165e9ae4004ce4e6b5117330bab94df68 upstream. - -In commit 33511b157bbcebaef853cc1811992b664a2e5862 ("rtlwifi: add support to -send beacon frame"), the mechanism for sending beacons was established. That -patch works correctly for rtl8192cu, but there is a possibility of getting -the following warnings in the PCI drivers: - -WARNING: CPU: 1 PID: 2439 at net/mac80211/driver-ops.h:12 -ieee80211_bss_info_change_notify+0x179/0x1d0 [mac80211]() -wlp5s0: Failed check-sdata-in-driver check, flags: 0x0 - -The warning is followed by a NULL pointer dereference as follows: - -BUG: unable to handle kernel NULL pointer dereference at 0000000000000006 -IP: [] rtl_get_tcb_desc+0x5e/0x760 [rtlwifi] - -This problem was reported at http://thread.gmane.org/gmane.linux.kernel.wireless.general/138645, -but no solution was found at that time. - -The problem was also reported at https://bugzilla.kernel.org/show_bug.cgi?id=9744 -and this solution was developed and tested there. - -The USB driver works with a NULL final argument in the adapter_tx() callback; -however, the PCI drivers need a struct rtl_tcb_desc in that position. - -Fixes: 33511b157bbc ("rtlwifi: add support to send beacon frame.") -Signed-off-by: Luis Felipe Dominguez Vega -Signed-off-by: Larry Finger -Signed-off-by: Kalle Valo -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/net/wireless/rtlwifi/core.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - ---- a/drivers/net/wireless/rtlwifi/core.c -+++ b/drivers/net/wireless/rtlwifi/core.c -@@ -1015,9 +1015,12 @@ static void send_beacon_frame(struct iee - { - struct rtl_priv *rtlpriv = rtl_priv(hw); - struct sk_buff *skb = ieee80211_beacon_get(hw, vif); -+ struct rtl_tcb_desc tcb_desc; - -- if (skb) -- rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, NULL); -+ if (skb) { -+ memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc)); -+ rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, &tcb_desc); -+ } - } - - static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, diff --git a/kernel/kernel/files/patches/mageia/stable-rtlwifi-rtl8723be-add-module-parameter-for-msi-interrupts.patch b/kernel/kernel/files/patches/mageia/stable-rtlwifi-rtl8723be-add-module-parameter-for-msi-interrupts.patch deleted file mode 100644 index 2ab05f5e..00000000 --- a/kernel/kernel/files/patches/mageia/stable-rtlwifi-rtl8723be-add-module-parameter-for-msi-interrupts.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 741e3b9902d11585e18bfc7f8d47e913616bb070 Mon Sep 17 00:00:00 2001 -From: Larry Finger -Date: Sun, 2 Aug 2015 13:24:13 -0500 -Subject: rtlwifi: rtl8723be: Add module parameter for MSI interrupts - -From: Larry Finger - -commit 741e3b9902d11585e18bfc7f8d47e913616bb070 upstream. - -The driver code allows for the disabling of MSI interrupts; however the -module_parm line was missed and the option fails to show with modinfo. - -Signed-off-by: Larry Finger -Signed-off-by: Kalle Valo -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/net/wireless/rtlwifi/rtl8723be/sw.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c -+++ b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c -@@ -385,6 +385,7 @@ module_param_named(debug, rtl8723be_mod_ - module_param_named(ips, rtl8723be_mod_params.inactiveps, bool, 0444); - module_param_named(swlps, rtl8723be_mod_params.swctrl_lps, bool, 0444); - module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444); -+module_param_named(msi, rtl8723be_mod_params.msi_support, bool, 0444); - module_param_named(disable_watchdog, rtl8723be_mod_params.disable_watchdog, - bool, 0444); - MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n"); diff --git a/kernel/kernel/files/patches/mageia/stable-s390-sclp-fix-compile-error.patch b/kernel/kernel/files/patches/mageia/stable-s390-sclp-fix-compile-error.patch new file mode 100644 index 00000000..92376b16 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-s390-sclp-fix-compile-error.patch @@ -0,0 +1,35 @@ +From a313bdc5310dd807655d3ca3eb2219cd65dfe45a Mon Sep 17 00:00:00 2001 +From: Sebastian Ott +Date: Thu, 25 Jun 2015 09:32:22 +0200 +Subject: s390/sclp: fix compile error + +From: Sebastian Ott + +commit a313bdc5310dd807655d3ca3eb2219cd65dfe45a upstream. + +Fix this error when compiling with CONFIG_SMP=n and +CONFIG_DYNAMIC_DEBUG=y: + +drivers/s390/char/sclp_early.c: In function 'sclp_read_info_early': +drivers/s390/char/sclp_early.c:87:19: error: 'EBUSY' undeclared (first use in this function) + } while (rc == -EBUSY); + ^ + +Signed-off-by: Sebastian Ott +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/char/sclp_early.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/s390/char/sclp_early.c ++++ b/drivers/s390/char/sclp_early.c +@@ -7,6 +7,7 @@ + #define KMSG_COMPONENT "sclp_early" + #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt + ++#include + #include + #include + #include diff --git a/kernel/kernel/files/patches/mageia/stable-s390-setup-fix-novx-parameter.patch b/kernel/kernel/files/patches/mageia/stable-s390-setup-fix-novx-parameter.patch new file mode 100644 index 00000000..1ed34af3 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-s390-setup-fix-novx-parameter.patch @@ -0,0 +1,74 @@ +From 89b1145e93771d727645c96e323539c029b63f1c Mon Sep 17 00:00:00 2001 +From: Martin Schwidefsky +Date: Fri, 14 Aug 2015 13:20:28 +0200 +Subject: s390/setup: fix novx parameter + +From: Martin Schwidefsky + +commit 89b1145e93771d727645c96e323539c029b63f1c upstream. + +The novx parameter disables the vector facility but the HWCAP_S390_VXRS +bit in the ELf hardware capabilies is always set if the machine has +the vector facility. If the user space program uses the "vx" string +in the features field of /proc/cpuinfo to utilize vector instruction +it will crash if the novx kernel paramter is set. + +Convert setup_hwcaps to an arch_initcall and use MACHINE_HAS_VX to +decide if the HWCAPS_S390_VXRS bit needs to be set. + +Reported-by: Ulrich Weigand +Reviewed-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/setup.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -683,7 +683,7 @@ static void __init setup_memory(void) + /* + * Setup hardware capabilities. + */ +-static void __init setup_hwcaps(void) ++static int __init setup_hwcaps(void) + { + static const int stfl_bits[6] = { 0, 2, 7, 17, 19, 21 }; + struct cpuid cpu_id; +@@ -749,9 +749,11 @@ static void __init setup_hwcaps(void) + elf_hwcap |= HWCAP_S390_TE; + + /* +- * Vector extension HWCAP_S390_VXRS is bit 11. ++ * Vector extension HWCAP_S390_VXRS is bit 11. The Vector extension ++ * can be disabled with the "novx" parameter. Use MACHINE_HAS_VX ++ * instead of facility bit 129. + */ +- if (test_facility(129)) ++ if (MACHINE_HAS_VX) + elf_hwcap |= HWCAP_S390_VXRS; + get_cpu_id(&cpu_id); + add_device_randomness(&cpu_id, sizeof(cpu_id)); +@@ -788,7 +790,9 @@ static void __init setup_hwcaps(void) + strcpy(elf_platform, "z13"); + break; + } ++ return 0; + } ++arch_initcall(setup_hwcaps); + + /* + * Add system information as device randomness +@@ -871,11 +875,6 @@ void __init setup_arch(char **cmdline_p) + cpu_init(); + + /* +- * Setup capabilities (ELF_HWCAP & ELF_PLATFORM). +- */ +- setup_hwcaps(); +- +- /* + * Create kernel page tables and switch to virtual addressing. + */ + paging_init(); diff --git a/kernel/kernel/files/patches/mageia/stable-sched-fix-cpu_active_mask-cpu_online_mask-race.patch b/kernel/kernel/files/patches/mageia/stable-sched-fix-cpu_active_mask-cpu_online_mask-race.patch new file mode 100644 index 00000000..bee7ec3b --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-sched-fix-cpu_active_mask-cpu_online_mask-race.patch @@ -0,0 +1,146 @@ +From dd9d3843755da95f63dd3a376f62b3e45c011210 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20H=2E=20Sch=C3=B6nherr?= +Date: Wed, 12 Aug 2015 21:35:56 +0200 +Subject: sched: Fix cpu_active_mask/cpu_online_mask race +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Jan=20H=2E=20Sch=C3=B6nherr?= + +commit dd9d3843755da95f63dd3a376f62b3e45c011210 upstream. + +There is a race condition in SMP bootup code, which may result +in + + WARNING: CPU: 0 PID: 1 at kernel/workqueue.c:4418 + workqueue_cpu_up_callback() +or + kernel BUG at kernel/smpboot.c:135! + +It can be triggered with a bit of luck in Linux guests running +on busy hosts. + + CPU0 CPUn + ==== ==== + + _cpu_up() + __cpu_up() + start_secondary() + set_cpu_online() + cpumask_set_cpu(cpu, + to_cpumask(cpu_online_bits)); + cpu_notify(CPU_ONLINE) + + cpumask_set_cpu(cpu, + to_cpumask(cpu_active_bits)); + +During the various CPU_ONLINE callbacks CPUn is online but not +active. Several things can go wrong at that point, depending on +the scheduling of tasks on CPU0. + +Variant 1: + + cpu_notify(CPU_ONLINE) + workqueue_cpu_up_callback() + rebind_workers() + set_cpus_allowed_ptr() + + This call fails because it requires an active CPU; rebind_workers() + ends with a warning: + + WARNING: CPU: 0 PID: 1 at kernel/workqueue.c:4418 + workqueue_cpu_up_callback() + +Variant 2: + + cpu_notify(CPU_ONLINE) + smpboot_thread_call() + smpboot_unpark_threads() + .. + __kthread_unpark() + __kthread_bind() + wake_up_state() + .. + select_task_rq() + select_fallback_rq() + + The ->wake_cpu of the unparked thread is not allowed, making a call + to select_fallback_rq() necessary. Then, select_fallback_rq() cannot + find an allowed, active CPU and promptly resets the allowed CPUs, so + that the task in question ends up on CPU0. + + When those unparked tasks are eventually executed, they run + immediately into a BUG: + + kernel BUG at kernel/smpboot.c:135! + +Just changing the order in which the online/active bits are set +(and adding some memory barriers), would solve the two issues +above. However, it would change the order of operations back to +the one before commit 6acbfb96976f ("sched: Fix hotplug vs. +set_cpus_allowed_ptr()"), thus, reintroducing that particular +problem. + +Going further back into history, we have at least the following +commits touching this topic: +- commit 2baab4e90495 ("sched: Fix select_fallback_rq() vs cpu_active/cpu_online") +- commit 5fbd036b552f ("sched: Cleanup cpu_active madness") + +Together, these give us the following non-working solutions: + + - secondary CPU sets active before online, because active is assumed to + be a subset of online; + + - secondary CPU sets online before active, because the primary CPU + assumes that an online CPU is also active; + + - secondary CPU sets online and waits for primary CPU to set active, + because it might deadlock. + +Commit 875ebe940d77 ("powerpc/smp: Wait until secondaries are +active & online") introduces an arch-specific solution to this +arch-independent problem. + +Now, go for a more general solution without explicit waiting and +simply set active twice: once on the secondary CPU after online +was set and once on the primary CPU after online was seen. + +set_cpus_allowed_ptr()") + +Signed-off-by: Jan H. Schönherr +Acked-by: Peter Zijlstra +Cc: Anton Blanchard +Cc: Borislav Petkov +Cc: Joerg Roedel +Cc: Linus Torvalds +Cc: Matt Wilson +Cc: Michael Ellerman +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: 6acbfb96976f ("sched: Fix hotplug vs. set_cpus_allowed_ptr()") +Link: http://lkml.kernel.org/r/1439408156-18840-1-git-send-email-jschoenh@amazon.de +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched/core.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5328,6 +5328,14 @@ static int sched_cpu_active(struct notif + case CPU_STARTING: + set_cpu_rq_start_time(); + return NOTIFY_OK; ++ case CPU_ONLINE: ++ /* ++ * At this point a starting CPU has marked itself as online via ++ * set_cpu_online(). But it might not yet have marked itself ++ * as active, which is essential from here on. ++ * ++ * Thus, fall-through and help the starting CPU along. ++ */ + case CPU_DOWN_FAILED: + set_cpu_active((long)hcpu, true); + return NOTIFY_OK; diff --git a/kernel/kernel/files/patches/mageia/stable-spi-bcm2835-set-up-spi-mode-before-asserting-cs-gpio.patch b/kernel/kernel/files/patches/mageia/stable-spi-bcm2835-set-up-spi-mode-before-asserting-cs-gpio.patch new file mode 100644 index 00000000..f72761db --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-spi-bcm2835-set-up-spi-mode-before-asserting-cs-gpio.patch @@ -0,0 +1,88 @@ +From acace73df2c1913a526c1b41e4741a4a6704c863 Mon Sep 17 00:00:00 2001 +From: Martin Sperl +Date: Tue, 28 Jul 2015 14:03:12 +0000 +Subject: spi: bcm2835: set up spi-mode before asserting cs-gpio + +From: Martin Sperl + +commit acace73df2c1913a526c1b41e4741a4a6704c863 upstream. + +When using reverse polarity for clock (spi-cpol) on a device +the clock line gets altered after chip-select has been asserted +resulting in an additional clock beat, which confuses hardware. + +This did not show when using native-CS, as the same register +is used to control cs as well as polarity, so the changes came +into effect at the same time. Unfortunately this is not true +with gpio-cs. + +To avoid this situation this patch moves the setup of polarity +(spi-cpol and spi-cpha) outside of the chip-select into +prepare_message, which is run prior to asserting chip-select. + +Also fixes resetting 3-wire mode after use of rx-mode, so that +a 3-Wire sequence TX, RX, TX works as well (right now it runs +TX, RX, RX instead) + +Reported-by: Noralf Tronnes +Signed-off-by: Martin Sperl +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-bcm2835.c | 28 +++++++++++++++++++++++----- + 1 file changed, 23 insertions(+), 5 deletions(-) + +--- a/drivers/spi/spi-bcm2835.c ++++ b/drivers/spi/spi-bcm2835.c +@@ -257,13 +257,11 @@ static int bcm2835_spi_transfer_one(stru + spi_used_hz = cdiv ? (clk_hz / cdiv) : (clk_hz / 65536); + bcm2835_wr(bs, BCM2835_SPI_CLK, cdiv); + +- /* handle all the modes */ ++ /* handle all the 3-wire mode */ + if ((spi->mode & SPI_3WIRE) && (tfr->rx_buf)) + cs |= BCM2835_SPI_CS_REN; +- if (spi->mode & SPI_CPOL) +- cs |= BCM2835_SPI_CS_CPOL; +- if (spi->mode & SPI_CPHA) +- cs |= BCM2835_SPI_CS_CPHA; ++ else ++ cs &= ~BCM2835_SPI_CS_REN; + + /* for gpio_cs set dummy CS so that no HW-CS get changed + * we can not run this in bcm2835_spi_set_cs, as it does +@@ -291,6 +289,25 @@ static int bcm2835_spi_transfer_one(stru + return bcm2835_spi_transfer_one_irq(master, spi, tfr, cs); + } + ++static int bcm2835_spi_prepare_message(struct spi_master *master, ++ struct spi_message *msg) ++{ ++ struct spi_device *spi = msg->spi; ++ struct bcm2835_spi *bs = spi_master_get_devdata(master); ++ u32 cs = bcm2835_rd(bs, BCM2835_SPI_CS); ++ ++ cs &= ~(BCM2835_SPI_CS_CPOL | BCM2835_SPI_CS_CPHA); ++ ++ if (spi->mode & SPI_CPOL) ++ cs |= BCM2835_SPI_CS_CPOL; ++ if (spi->mode & SPI_CPHA) ++ cs |= BCM2835_SPI_CS_CPHA; ++ ++ bcm2835_wr(bs, BCM2835_SPI_CS, cs); ++ ++ return 0; ++} ++ + static void bcm2835_spi_handle_err(struct spi_master *master, + struct spi_message *msg) + { +@@ -429,6 +446,7 @@ static int bcm2835_spi_probe(struct plat + master->set_cs = bcm2835_spi_set_cs; + master->transfer_one = bcm2835_spi_transfer_one; + master->handle_err = bcm2835_spi_handle_err; ++ master->prepare_message = bcm2835_spi_prepare_message; + master->dev.of_node = pdev->dev.of_node; + + bs = spi_master_get_devdata(master); diff --git a/kernel/kernel/files/patches/mageia/stable-spi-dw-allow-interface-drivers-to-limit-data-i-o-to-word-sizes.patch b/kernel/kernel/files/patches/mageia/stable-spi-dw-allow-interface-drivers-to-limit-data-i-o-to-word-sizes.patch new file mode 100644 index 00000000..092f7550 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-spi-dw-allow-interface-drivers-to-limit-data-i-o-to-word-sizes.patch @@ -0,0 +1,129 @@ +From c4fe57f76269dbb2af135071513f260ca40229a3 Mon Sep 17 00:00:00 2001 +From: Michael van der Westhuizen +Date: Tue, 18 Aug 2015 22:21:53 +0200 +Subject: spi: dw: Allow interface drivers to limit data I/O to word sizes + +From: Michael van der Westhuizen + +commit c4fe57f76269dbb2af135071513f260ca40229a3 upstream. + +The commit dd11444327ce ("spi: dw-spi: Convert 16bit accesses to 32bit +accesses") changed all 16bit accesses in the DW_apb_ssi driver to 32bit. +This, unfortunately, breaks data register access on picoXcell, where the +DW IP needs data register accesses to be word accesses (all other +accesses appear to be OK). + +This change introduces a new master variable to allow interface drivers +to specify that 16bit data transfer I/O is required. This change also +introduces the ability to set this variable via device tree bindings in +the MMIO interface driver. Both the core and the MMIO interface driver +default to the current 32bit behaviour. + +Before this change, on a picoXcell pc3x3: + spi_master spi32766: interrupt_transfer: fifo overrun/underrun + m25p80 spi32766.0: error -5 reading 9f + m25p80: probe of spi32766.0 failed with error -5 + +After this change: + m25p80 spi32766.0: m25p40 (512 Kbytes) + +Fixes: dd11444327ce ("spi: dw-spi: Convert 16bit accesses to 32bit accesses") +Signed-off-by: Michael van der Westhuizen +Reviewed-by: Andy Shevchenko +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-dw-mmio.c | 3 +++ + drivers/spi/spi-dw.c | 4 ++-- + drivers/spi/spi-dw.h | 35 +++++++++++++++++++++++++++++++++++ + 3 files changed, 40 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi-dw-mmio.c ++++ b/drivers/spi/spi-dw-mmio.c +@@ -74,6 +74,9 @@ static int dw_spi_mmio_probe(struct plat + + dws->max_freq = clk_get_rate(dwsmmio->clk); + ++ of_property_read_u32(pdev->dev.of_node, "reg-io-width", ++ &dws->reg_io_width); ++ + num_cs = 4; + + if (pdev->dev.of_node) +--- a/drivers/spi/spi-dw.c ++++ b/drivers/spi/spi-dw.c +@@ -194,7 +194,7 @@ static void dw_writer(struct dw_spi *dws + else + txw = *(u16 *)(dws->tx); + } +- dw_writel(dws, DW_SPI_DR, txw); ++ dw_write_io_reg(dws, DW_SPI_DR, txw); + dws->tx += dws->n_bytes; + } + } +@@ -205,7 +205,7 @@ static void dw_reader(struct dw_spi *dws + u16 rxw; + + while (max--) { +- rxw = dw_readl(dws, DW_SPI_DR); ++ rxw = dw_read_io_reg(dws, DW_SPI_DR); + /* Care rx only if the transfer's original "rx" is not null */ + if (dws->rx_end - dws->len) { + if (dws->n_bytes == 1) +--- a/drivers/spi/spi-dw.h ++++ b/drivers/spi/spi-dw.h +@@ -109,6 +109,7 @@ struct dw_spi { + u32 fifo_len; /* depth of the FIFO buffer */ + u32 max_freq; /* max bus freq supported */ + ++ u32 reg_io_width; /* DR I/O width in bytes */ + u16 bus_num; + u16 num_cs; /* supported slave numbers */ + +@@ -145,11 +146,45 @@ static inline u32 dw_readl(struct dw_spi + return __raw_readl(dws->regs + offset); + } + ++static inline u16 dw_readw(struct dw_spi *dws, u32 offset) ++{ ++ return __raw_readw(dws->regs + offset); ++} ++ + static inline void dw_writel(struct dw_spi *dws, u32 offset, u32 val) + { + __raw_writel(val, dws->regs + offset); + } + ++static inline void dw_writew(struct dw_spi *dws, u32 offset, u16 val) ++{ ++ __raw_writew(val, dws->regs + offset); ++} ++ ++static inline u32 dw_read_io_reg(struct dw_spi *dws, u32 offset) ++{ ++ switch (dws->reg_io_width) { ++ case 2: ++ return dw_readw(dws, offset); ++ case 4: ++ default: ++ return dw_readl(dws, offset); ++ } ++} ++ ++static inline void dw_write_io_reg(struct dw_spi *dws, u32 offset, u32 val) ++{ ++ switch (dws->reg_io_width) { ++ case 2: ++ dw_writew(dws, offset, val); ++ break; ++ case 4: ++ default: ++ dw_writel(dws, offset, val); ++ break; ++ } ++} ++ + static inline void spi_enable_chip(struct dw_spi *dws, int enable) + { + dw_writel(dws, DW_SPI_SSIENR, (enable ? 1 : 0)); diff --git a/kernel/kernel/files/patches/mageia/stable-spi-fix-regression-in-spi-bitbang-txrx.h.patch b/kernel/kernel/files/patches/mageia/stable-spi-fix-regression-in-spi-bitbang-txrx.h.patch new file mode 100644 index 00000000..696409b6 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-spi-fix-regression-in-spi-bitbang-txrx.h.patch @@ -0,0 +1,43 @@ +From 26a67ec47a4c58fe79c6421c3dc3d697d322d2d6 Mon Sep 17 00:00:00 2001 +From: Lars Persson +Date: Wed, 29 Jul 2015 09:32:02 +0200 +Subject: spi: Fix regression in spi-bitbang-txrx.h + +From: Lars Persson + +commit 26a67ec47a4c58fe79c6421c3dc3d697d322d2d6 upstream. + +This patch fixes a regression introduced by commit 232a5adc5199 ("spi: +bitbang: only toggle bitchanges"). The attempt to optimize writes of +consecutive bit patterns broke most of the combinations of word size +and SPI modes due to selecting the wrong bit as the MSB value. + +Fixes: 232a5adc5199 (spi: bitbang: only toggle bitchanges) +Signed-off-by: Lars Persson +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-bitbang-txrx.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi-bitbang-txrx.h ++++ b/drivers/spi/spi-bitbang-txrx.h +@@ -49,7 +49,7 @@ bitbang_txrx_be_cpha0(struct spi_device + { + /* if (cpol == 0) this is SPI_MODE_0; else this is SPI_MODE_2 */ + +- bool oldbit = !(word & 1); ++ u32 oldbit = (!(word & (1<<(bits-1)))) << 31; + /* clock starts at inactive polarity */ + for (word <<= (32 - bits); likely(bits); bits--) { + +@@ -81,7 +81,7 @@ bitbang_txrx_be_cpha1(struct spi_device + { + /* if (cpol == 0) this is SPI_MODE_1; else this is SPI_MODE_3 */ + +- bool oldbit = !(word & (1 << 31)); ++ u32 oldbit = (!(word & (1<<(bits-1)))) << 31; + /* clock starts at inactive polarity */ + for (word <<= (32 - bits); likely(bits); bits--) { + diff --git a/kernel/kernel/files/patches/mageia/stable-spi-img-spfi-check-for-timeout-error-before-proceeding.patch b/kernel/kernel/files/patches/mageia/stable-spi-img-spfi-check-for-timeout-error-before-proceeding.patch new file mode 100644 index 00000000..78224133 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-spi-img-spfi-check-for-timeout-error-before-proceeding.patch @@ -0,0 +1,48 @@ +From 011710e2ab659c7ad6e5e554806414bd7a9508be Mon Sep 17 00:00:00 2001 +From: Sifan Naeem +Date: Mon, 27 Jul 2015 13:11:15 +0100 +Subject: spi: img-spfi: check for timeout error before proceeding + +From: Sifan Naeem + +commit 011710e2ab659c7ad6e5e554806414bd7a9508be upstream. + +Calling spfi_wait_all_done is not required if the transfer has timed +out before all data is transferred. + +spfi_wait_all_done polls for Alldone interrupt which is triggered to +mark the transfer as complete and to indicate it is now safe to issue +a new transfer. + +Fixes: 8c2c8c0 ("spi: img-spfi: Control CS lines with GPIO") +Signed-off-by: Sifan Naeem +Reviewed-by: Andrew Bresticker +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-img-spfi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/spi/spi-img-spfi.c ++++ b/drivers/spi/spi-img-spfi.c +@@ -267,15 +267,15 @@ static int img_spfi_start_pio(struct spi + cpu_relax(); + } + +- ret = spfi_wait_all_done(spfi); +- if (ret < 0) +- return ret; +- + if (rx_bytes > 0 || tx_bytes > 0) { + dev_err(spfi->dev, "PIO transfer timed out\n"); + return -ETIMEDOUT; + } + ++ ret = spfi_wait_all_done(spfi); ++ if (ret < 0) ++ return ret; ++ + return 0; + } + diff --git a/kernel/kernel/files/patches/mageia/stable-spi-img-spfi-fix-kbuild-test-robot-warning.patch b/kernel/kernel/files/patches/mageia/stable-spi-img-spfi-fix-kbuild-test-robot-warning.patch new file mode 100644 index 00000000..af8febbe --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-spi-img-spfi-fix-kbuild-test-robot-warning.patch @@ -0,0 +1,33 @@ +From 9176c6657b5c313cf504d157e6d91496ee5c8708 Mon Sep 17 00:00:00 2001 +From: Sifan Naeem +Date: Thu, 6 Aug 2015 10:33:01 +0100 +Subject: spi: img-spfi: fix kbuild test robot warning + +From: Sifan Naeem + +commit 9176c6657b5c313cf504d157e6d91496ee5c8708 upstream. + +drivers/spi/spi-img-spfi.c: In function 'img_spfi_setup': +drivers/spi/spi-img-spfi.c:446: warning: 'ret' may be used +uninitialized in this function. + +Fixes: commit b03ba9e314c1 ("spi: img-spfi: fix multiple calls to request gpio") +Signed-off-by: Sifan Naeem +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-img-spfi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-img-spfi.c ++++ b/drivers/spi/spi-img-spfi.c +@@ -444,7 +444,7 @@ static int img_spfi_unprepare(struct spi + + static int img_spfi_setup(struct spi_device *spi) + { +- int ret; ++ int ret = -EINVAL; + struct img_spfi_device_data *spfi_data = spi_get_ctldata(spi); + + if (!spfi_data) { diff --git a/kernel/kernel/files/patches/mageia/stable-spi-img-spfi-fix-multiple-calls-to-request-gpio.patch b/kernel/kernel/files/patches/mageia/stable-spi-img-spfi-fix-multiple-calls-to-request-gpio.patch new file mode 100644 index 00000000..68160468 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-spi-img-spfi-fix-multiple-calls-to-request-gpio.patch @@ -0,0 +1,97 @@ +From b03ba9e314c12b2127243145b5c1f41b2408de62 Mon Sep 17 00:00:00 2001 +From: Sifan Naeem +Date: Wed, 29 Jul 2015 11:55:26 +0100 +Subject: spi: img-spfi: fix multiple calls to request gpio + +From: Sifan Naeem + +commit b03ba9e314c12b2127243145b5c1f41b2408de62 upstream. + +spfi_setup may be called many times by the spi framework, but +gpio_request_one can only be called once without freeing, repeatedly +calling gpio_request_one will cause an error to be thrown, which +causes the request to spi_setup to be marked as failed. + +We can have a per-spi_device flag that indicates whether or not the +gpio has been requested. If the gpio has already been requested use +gpio_direction_output to set the direction of the gpio. + +Fixes: 8c2c8c03cdcb ("spi: img-spfi: Control CS lines with GPIO") +Signed-off-by: Sifan Naeem +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-img-spfi.c | 47 ++++++++++++++++++++++++++++++++++++++------- + 1 file changed, 40 insertions(+), 7 deletions(-) + +--- a/drivers/spi/spi-img-spfi.c ++++ b/drivers/spi/spi-img-spfi.c +@@ -105,6 +105,10 @@ struct img_spfi { + bool rx_dma_busy; + }; + ++struct img_spfi_device_data { ++ bool gpio_requested; ++}; ++ + static inline u32 spfi_readl(struct img_spfi *spfi, u32 reg) + { + return readl(spfi->regs + reg); +@@ -441,20 +445,49 @@ static int img_spfi_unprepare(struct spi + static int img_spfi_setup(struct spi_device *spi) + { + int ret; ++ struct img_spfi_device_data *spfi_data = spi_get_ctldata(spi); + +- ret = gpio_request_one(spi->cs_gpio, (spi->mode & SPI_CS_HIGH) ? +- GPIOF_OUT_INIT_LOW : GPIOF_OUT_INIT_HIGH, +- dev_name(&spi->dev)); +- if (ret) +- dev_err(&spi->dev, "can't request chipselect gpio %d\n", ++ if (!spfi_data) { ++ spfi_data = kzalloc(sizeof(*spfi_data), GFP_KERNEL); ++ if (!spfi_data) ++ return -ENOMEM; ++ spfi_data->gpio_requested = false; ++ spi_set_ctldata(spi, spfi_data); ++ } ++ if (!spfi_data->gpio_requested) { ++ ret = gpio_request_one(spi->cs_gpio, ++ (spi->mode & SPI_CS_HIGH) ? ++ GPIOF_OUT_INIT_LOW : GPIOF_OUT_INIT_HIGH, ++ dev_name(&spi->dev)); ++ if (ret) ++ dev_err(&spi->dev, "can't request chipselect gpio %d\n", + spi->cs_gpio); +- ++ else ++ spfi_data->gpio_requested = true; ++ } else { ++ if (gpio_is_valid(spi->cs_gpio)) { ++ int mode = ((spi->mode & SPI_CS_HIGH) ? ++ GPIOF_OUT_INIT_LOW : GPIOF_OUT_INIT_HIGH); ++ ++ ret = gpio_direction_output(spi->cs_gpio, mode); ++ if (ret) ++ dev_err(&spi->dev, "chipselect gpio %d setup failed (%d)\n", ++ spi->cs_gpio, ret); ++ } ++ } + return ret; + } + + static void img_spfi_cleanup(struct spi_device *spi) + { +- gpio_free(spi->cs_gpio); ++ struct img_spfi_device_data *spfi_data = spi_get_ctldata(spi); ++ ++ if (spfi_data) { ++ if (spfi_data->gpio_requested) ++ gpio_free(spi->cs_gpio); ++ kfree(spfi_data); ++ spi_set_ctldata(spi, NULL); ++ } + } + + static void img_spfi_config(struct spi_master *master, struct spi_device *spi, diff --git a/kernel/kernel/files/patches/mageia/stable-spi-sh-msiof-fix-fifo-size-to-64-word-from-256-word.patch b/kernel/kernel/files/patches/mageia/stable-spi-sh-msiof-fix-fifo-size-to-64-word-from-256-word.patch new file mode 100644 index 00000000..d29a9886 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-spi-sh-msiof-fix-fifo-size-to-64-word-from-256-word.patch @@ -0,0 +1,66 @@ +From fe78d0b7691c02744004b15f6979b3f106464bc4 Mon Sep 17 00:00:00 2001 +From: Koji Matsuoka +Date: Mon, 15 Jun 2015 02:25:05 +0900 +Subject: spi: sh-msiof: Fix FIFO size to 64 word from 256 word + +From: Koji Matsuoka + +commit fe78d0b7691c02744004b15f6979b3f106464bc4 upstream. + +The upper limit of Tx/Rx FIFO size is 64 word by the +specification of H/W. This patch corrects to 64 word from 256 word. + +Signed-off-by: Koji Matsuoka +Signed-off-by: Yoshihiro Kaneko +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-sh-msiof.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -48,8 +48,8 @@ struct sh_msiof_spi_priv { + const struct sh_msiof_chipdata *chipdata; + struct sh_msiof_spi_info *info; + struct completion done; +- int tx_fifo_size; +- int rx_fifo_size; ++ unsigned int tx_fifo_size; ++ unsigned int rx_fifo_size; + void *tx_dma_page; + void *rx_dma_page; + dma_addr_t tx_dma_addr; +@@ -95,8 +95,6 @@ struct sh_msiof_spi_priv { + #define MDR2_WDLEN1(i) (((i) - 1) << 16) /* Word Count (1-64/256 (SH, A1))) */ + #define MDR2_GRPMASK1 0x00000001 /* Group Output Mask 1 (SH, A1) */ + +-#define MAX_WDLEN 256U +- + /* TSCR and RSCR */ + #define SCR_BRPS_MASK 0x1f00 /* Prescaler Setting (1-32) */ + #define SCR_BRPS(i) (((i) - 1) << 8) +@@ -850,7 +848,12 @@ static int sh_msiof_transfer_one(struct + * DMA supports 32-bit words only, hence pack 8-bit and 16-bit + * words, with byte resp. word swapping. + */ +- unsigned int l = min(len, MAX_WDLEN * 4); ++ unsigned int l = 0; ++ ++ if (tx_buf) ++ l = min(len, p->tx_fifo_size * 4); ++ if (rx_buf) ++ l = min(len, p->rx_fifo_size * 4); + + if (bits <= 8) { + if (l & 3) +@@ -963,7 +966,7 @@ static const struct sh_msiof_chipdata sh + + static const struct sh_msiof_chipdata r8a779x_data = { + .tx_fifo_size = 64, +- .rx_fifo_size = 256, ++ .rx_fifo_size = 64, + .master_flags = SPI_MASTER_MUST_TX, + }; + diff --git a/kernel/kernel/files/patches/mageia/stable-staging-comedi-adl_pci7x3x-fix-digital-output-on-pci-7230.patch b/kernel/kernel/files/patches/mageia/stable-staging-comedi-adl_pci7x3x-fix-digital-output-on-pci-7230.patch new file mode 100644 index 00000000..ea8b2f90 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-staging-comedi-adl_pci7x3x-fix-digital-output-on-pci-7230.patch @@ -0,0 +1,56 @@ +From ad83dbd974feb2e2a8cc071a1d28782bd4d2c70e Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Tue, 11 Aug 2015 13:05:10 +0100 +Subject: staging: comedi: adl_pci7x3x: fix digital output on PCI-7230 + +From: Ian Abbott + +commit ad83dbd974feb2e2a8cc071a1d28782bd4d2c70e upstream. + +The "adl_pci7x3x" driver replaced the "adl_pci7230" and "adl_pci7432" +drivers in commits 8f567c373c4b ("staging: comedi: new adl_pci7x3x +driver") and 657f77d173d3 ("staging: comedi: remove adl_pci7230 and +adl_pci7432 drivers"). Although the new driver code agrees with the +user manuals for the respective boards, digital outputs stopped working +on the PCI-7230. This has 16 digital output channels and the previous +adl_pci7230 driver shifted the 16 bit output state left by 16 bits +before writing to the hardware register. The new adl_pci7x3x driver +doesn't do that. Fix it in `adl_pci7x3x_do_insn_bits()` by checking +for the special case of the subdevice having only 16 channels and +duplicating the 16 bit output state into both halves of the 32-bit +register. That should work both for what the board actually does and +for what the user manual says it should do. + +Fixes: 8f567c373c4b ("staging: comedi: new adl_pci7x3x driver") +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/adl_pci7x3x.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/staging/comedi/drivers/adl_pci7x3x.c ++++ b/drivers/staging/comedi/drivers/adl_pci7x3x.c +@@ -120,8 +120,20 @@ static int adl_pci7x3x_do_insn_bits(stru + { + unsigned long reg = (unsigned long)s->private; + +- if (comedi_dio_update_state(s, data)) +- outl(s->state, dev->iobase + reg); ++ if (comedi_dio_update_state(s, data)) { ++ unsigned int val = s->state; ++ ++ if (s->n_chan == 16) { ++ /* ++ * It seems the PCI-7230 needs the 16-bit DO state ++ * to be shifted left by 16 bits before being written ++ * to the 32-bit register. Set the value in both ++ * halves of the register to be sure. ++ */ ++ val |= val << 16; ++ } ++ outl(val, dev->iobase + reg); ++ } + + data[1] = s->state; + diff --git a/kernel/kernel/files/patches/mageia/stable-staging-comedi-usbduxsigma-don-t-clobber-ai_timer-in-command-test.patch b/kernel/kernel/files/patches/mageia/stable-staging-comedi-usbduxsigma-don-t-clobber-ai_timer-in-command-test.patch new file mode 100644 index 00000000..6e6149cb --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-staging-comedi-usbduxsigma-don-t-clobber-ai_timer-in-command-test.patch @@ -0,0 +1,87 @@ +From 423b24c37dd5794a674c74b0ed56392003a69891 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Thu, 23 Jul 2015 16:46:57 +0100 +Subject: staging: comedi: usbduxsigma: don't clobber ai_timer in command test + +From: Ian Abbott + +commit 423b24c37dd5794a674c74b0ed56392003a69891 upstream. + +`devpriv->ai_timer` is used while an asynchronous command is running on +the AI subdevice. It also gets modified by the subdevice's `cmdtest` +handler for checking new asynchronous commands +(`usbduxsigma_ai_cmdtest()`), which is not correct as it's allowed to +check new commands while an old command is still running. Fix it by +moving the code which sets up `devpriv->ai_timer` and +`devpriv->ai_interval` into the subdevice's `cmd` handler, +`usbduxsigma_ai_cmd()`. + +Note that the removed code in `usbduxsigma_ai_cmdtest()` checked that +`devpriv->ai_timer` did not end up less than than 1, but that could not +happen because `cmd->scan_begin_arg` had already been checked to be at +least the minimum required value (at least when `cmd->scan_begin_src == +TRIG_TIMER`, which had also been checked to be the case). + +Fixes: b986be8527c7 ("staging: comedi: usbduxsigma: tidy up analog input command support) +Signed-off-by: Ian Abbott +Reviewed-by: Bernd Porr +Reviewed-by: H Hartley Sweeten +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/usbduxsigma.c | 37 +++++++++++---------------- + 1 file changed, 16 insertions(+), 21 deletions(-) + +--- a/drivers/staging/comedi/drivers/usbduxsigma.c ++++ b/drivers/staging/comedi/drivers/usbduxsigma.c +@@ -550,27 +550,6 @@ static int usbduxsigma_ai_cmdtest(struct + if (err) + return 3; + +- /* Step 4: fix up any arguments */ +- +- if (high_speed) { +- /* +- * every 2 channels get a time window of 125us. Thus, if we +- * sample all 16 channels we need 1ms. If we sample only one +- * channel we need only 125us +- */ +- devpriv->ai_interval = interval; +- devpriv->ai_timer = cmd->scan_begin_arg / (125000 * interval); +- } else { +- /* interval always 1ms */ +- devpriv->ai_interval = 1; +- devpriv->ai_timer = cmd->scan_begin_arg / 1000000; +- } +- if (devpriv->ai_timer < 1) +- err |= -EINVAL; +- +- if (err) +- return 4; +- + return 0; + } + +@@ -668,6 +647,22 @@ static int usbduxsigma_ai_cmd(struct com + + down(&devpriv->sem); + ++ if (devpriv->high_speed) { ++ /* ++ * every 2 channels get a time window of 125us. Thus, if we ++ * sample all 16 channels we need 1ms. If we sample only one ++ * channel we need only 125us ++ */ ++ unsigned int interval = usbduxsigma_chans_to_interval(len); ++ ++ devpriv->ai_interval = interval; ++ devpriv->ai_timer = cmd->scan_begin_arg / (125000 * interval); ++ } else { ++ /* interval always 1ms */ ++ devpriv->ai_interval = 1; ++ devpriv->ai_timer = cmd->scan_begin_arg / 1000000; ++ } ++ + for (i = 0; i < len; i++) { + unsigned int chan = CR_CHAN(cmd->chanlist[i]); + diff --git a/kernel/kernel/files/patches/mageia/stable-staging-comedi-usbduxsigma-don-t-clobber-ao_timer-in-command-test.patch b/kernel/kernel/files/patches/mageia/stable-staging-comedi-usbduxsigma-don-t-clobber-ao_timer-in-command-test.patch new file mode 100644 index 00000000..7442682e --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-staging-comedi-usbduxsigma-don-t-clobber-ao_timer-in-command-test.patch @@ -0,0 +1,90 @@ +From c04a1f17803e0d3eeada586ca34a6b436959bc20 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Thu, 23 Jul 2015 16:46:58 +0100 +Subject: staging: comedi: usbduxsigma: don't clobber ao_timer in command test + +From: Ian Abbott + +commit c04a1f17803e0d3eeada586ca34a6b436959bc20 upstream. + +`devpriv->ao_timer` is used while an asynchronous command is running on +the AO subdevice. It also gets modified by the subdevice's `cmdtest` +handler for checking new asynchronous commands, +`usbduxsigma_ao_cmdtest()`, which is not correct as it's allowed to +check new commands while an old command is still running. Fix it by +moving the code which sets up `devpriv->ao_timer` into the subdevice's +`cmd` handler, `usbduxsigma_ao_cmd()`. + +Note that the removed code in `usbduxsigma_ao_cmdtest()` checked that +`devpriv->ao_timer` did not end up less that 1, but that could not +happen due because `cmd->scan_begin_arg` or `cmd->convert_arg` had +already been range-checked. + +Also note that we tested the `high_speed` variable in the old code, but +that is currently always 0 and means that we always use "scan" timing +(`cmd->scan_begin_src == TRIG_TIMER` and `cmd->convert_src == TRIG_NOW`) +and never "convert" (individual sample) timing (`cmd->scan_begin_src == +TRIG_FOLLOW` and `cmd->convert_src == TRIG_TIMER`). The moved code +tests `cmd->convert_src` instead to decide whether "scan" or "convert" +timing is being used, although currently only "scan" timing is +supported. + +Fixes: fb1ef622e7a3 ("staging: comedi: usbduxsigma: tidy up analog output command support") +Signed-off-by: Ian Abbott +Reviewed-by: Bernd Porr +Reviewed-by: H Hartley Sweeten +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/usbduxsigma.c | 33 +++++++++++---------------- + 1 file changed, 14 insertions(+), 19 deletions(-) + +--- a/drivers/staging/comedi/drivers/usbduxsigma.c ++++ b/drivers/staging/comedi/drivers/usbduxsigma.c +@@ -912,25 +912,6 @@ static int usbduxsigma_ao_cmdtest(struct + if (err) + return 3; + +- /* Step 4: fix up any arguments */ +- +- /* we count in timer steps */ +- if (high_speed) { +- /* timing of the conversion itself: every 125 us */ +- devpriv->ao_timer = cmd->convert_arg / 125000; +- } else { +- /* +- * timing of the scan: every 1ms +- * we get all channels at once +- */ +- devpriv->ao_timer = cmd->scan_begin_arg / 1000000; +- } +- if (devpriv->ao_timer < 1) +- err |= -EINVAL; +- +- if (err) +- return 4; +- + return 0; + } + +@@ -943,6 +924,20 @@ static int usbduxsigma_ao_cmd(struct com + + down(&devpriv->sem); + ++ if (cmd->convert_src == TRIG_TIMER) { ++ /* ++ * timing of the conversion itself: every 125 us ++ * at high speed (not used yet) ++ */ ++ devpriv->ao_timer = cmd->convert_arg / 125000; ++ } else { ++ /* ++ * timing of the scan: every 1ms ++ * we get all channels at once ++ */ ++ devpriv->ao_timer = cmd->scan_begin_arg / 1000000; ++ } ++ + devpriv->ao_counter = devpriv->ao_timer; + + if (cmd->start_src == TRIG_NOW) { diff --git a/kernel/kernel/files/patches/mageia/stable-tty-serial-men_z135_uart.c-fix-race-between-irq-and-set_termios.patch b/kernel/kernel/files/patches/mageia/stable-tty-serial-men_z135_uart.c-fix-race-between-irq-and-set_termios.patch new file mode 100644 index 00000000..9cf49bd7 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-tty-serial-men_z135_uart.c-fix-race-between-irq-and-set_termios.patch @@ -0,0 +1,75 @@ +From 8117e347406278fd399b077add4e638cd017ae2d Mon Sep 17 00:00:00 2001 +From: Johannes Thumshirn +Date: Thu, 6 Aug 2015 09:16:37 +0200 +Subject: tty: serial: men_z135_uart.c: Fix race between IRQ and set_termios() + +From: Johannes Thumshirn + +commit 8117e347406278fd399b077add4e638cd017ae2d upstream. + +Fix panic caused by a race between men_z135_intr() and men_z135_set_termios(). + +men_z135_intr() and men_z135_set_termios() both hold the struct uart_port::lock +spinlock, but men_z135_intr() does a spin_lock_irqsave() and +men_z135_set_termios() does a normal spin_lock(), which can lead to a deadlock +when an interrupt is called while the lock is being helt by +men_z135_set_termios(). + +This was discovered using a insmod, hardware looppback send/receive, rmmod +stress test. + +Signed-off-by: Johannes Thumshirn +Reviewed-by: Peter Hurley +Cc: Andreas Werner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/men_z135_uart.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/drivers/tty/serial/men_z135_uart.c ++++ b/drivers/tty/serial/men_z135_uart.c +@@ -392,7 +392,6 @@ static irqreturn_t men_z135_intr(int irq + struct men_z135_port *uart = (struct men_z135_port *)data; + struct uart_port *port = &uart->port; + bool handled = false; +- unsigned long flags; + int irq_id; + + uart->stat_reg = ioread32(port->membase + MEN_Z135_STAT_REG); +@@ -401,7 +400,7 @@ static irqreturn_t men_z135_intr(int irq + if (!irq_id) + goto out; + +- spin_lock_irqsave(&port->lock, flags); ++ spin_lock(&port->lock); + /* It's save to write to IIR[7:6] RXC[9:8] */ + iowrite8(irq_id, port->membase + MEN_Z135_STAT_REG); + +@@ -427,7 +426,7 @@ static irqreturn_t men_z135_intr(int irq + handled = true; + } + +- spin_unlock_irqrestore(&port->lock, flags); ++ spin_unlock(&port->lock); + out: + return IRQ_RETVAL(handled); + } +@@ -717,7 +716,7 @@ static void men_z135_set_termios(struct + + baud = uart_get_baud_rate(port, termios, old, 0, uart_freq / 16); + +- spin_lock(&port->lock); ++ spin_lock_irq(&port->lock); + if (tty_termios_baud_rate(termios)) + tty_termios_encode_baud_rate(termios, baud, baud); + +@@ -725,7 +724,7 @@ static void men_z135_set_termios(struct + iowrite32(bd_reg, port->membase + MEN_Z135_BAUD_REG); + + uart_update_timeout(port, termios->c_cflag, baud); +- spin_unlock(&port->lock); ++ spin_unlock_irq(&port->lock); + } + + static const char *men_z135_type(struct uart_port *port) diff --git a/kernel/kernel/files/patches/mageia/stable-usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch b/kernel/kernel/files/patches/mageia/stable-usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch new file mode 100644 index 00000000..3828d961 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-usb-dwc3-ep0-fix-mem-corruption-on-out-transfers-of-more-than-512-bytes.patch @@ -0,0 +1,58 @@ +From b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e Mon Sep 17 00:00:00 2001 +From: Kishon Vijay Abraham I +Date: Mon, 27 Jul 2015 12:25:27 +0530 +Subject: usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes + +From: Kishon Vijay Abraham I + +commit b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e upstream. + +DWC3 uses bounce buffer to handle non max packet aligned OUT transfers and +the size of bounce buffer is 512 bytes. However if the host initiates OUT +transfers of size more than 512 bytes (and non max packet aligned), the +driver throws a WARN dump but still programs the TRB to receive more than +512 bytes. This will cause bounce buffer to overflow and corrupt the +adjacent memory locations which can be fatal. + +Fix it by programming the TRB to receive a maximum of DWC3_EP0_BOUNCE_SIZE +(512) bytes. + +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/ep0.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -820,6 +820,11 @@ static void dwc3_ep0_complete_data(struc + unsigned maxp = ep0->endpoint.maxpacket; + + transfer_size += (maxp - (transfer_size % maxp)); ++ ++ /* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */ ++ if (transfer_size > DWC3_EP0_BOUNCE_SIZE) ++ transfer_size = DWC3_EP0_BOUNCE_SIZE; ++ + transferred = min_t(u32, ur->length, + transfer_size - length); + memcpy(ur->buf, dwc->ep0_bounce, transferred); +@@ -941,11 +946,14 @@ static void __dwc3_ep0_do_control_data(s + return; + } + +- WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE); +- + maxpacket = dep->endpoint.maxpacket; + transfer_size = roundup(req->request.length, maxpacket); + ++ if (transfer_size > DWC3_EP0_BOUNCE_SIZE) { ++ dev_WARN(dwc->dev, "bounce buf can't handle req len\n"); ++ transfer_size = DWC3_EP0_BOUNCE_SIZE; ++ } ++ + dwc->ep0_bounced = true; + + /* diff --git a/kernel/kernel/files/patches/mageia/stable-usb-ftdi_sio-added-custom-pid-for-customware-products.patch b/kernel/kernel/files/patches/mageia/stable-usb-ftdi_sio-added-custom-pid-for-customware-products.patch new file mode 100644 index 00000000..9529398b --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-usb-ftdi_sio-added-custom-pid-for-customware-products.patch @@ -0,0 +1,51 @@ +From 1fb8dc36384ae1140ee6ccc470de74397606a9d5 Mon Sep 17 00:00:00 2001 +From: Matthijs Kooijman +Date: Tue, 18 Aug 2015 10:33:56 +0200 +Subject: USB: ftdi_sio: Added custom PID for CustomWare products + +From: Matthijs Kooijman + +commit 1fb8dc36384ae1140ee6ccc470de74397606a9d5 upstream. + +CustomWare uses the FTDI VID with custom PIDs for their ShipModul MiniPlex +products. + +Signed-off-by: Matthijs Kooijman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 4 ++++ + drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++ + 2 files changed, 12 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -605,6 +605,10 @@ static const struct usb_device_id id_tab + { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2WI_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX3_PID) }, + /* + * ELV devices: + */ +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -568,6 +568,14 @@ + */ + #define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */ + ++/* ++ * CustomWare / ShipModul NMEA multiplexers product ids (FTDI_VID) ++ */ ++#define FTDI_CUSTOMWARE_MINIPLEX_PID 0xfd48 /* MiniPlex first generation NMEA Multiplexer */ ++#define FTDI_CUSTOMWARE_MINIPLEX2_PID 0xfd49 /* MiniPlex-USB and MiniPlex-2 series */ ++#define FTDI_CUSTOMWARE_MINIPLEX2WI_PID 0xfd4a /* MiniPlex-2Wi */ ++#define FTDI_CUSTOMWARE_MINIPLEX3_PID 0xfd4b /* MiniPlex-3 series */ ++ + + /********************************/ + /** third-party VID/PID combos **/ diff --git a/kernel/kernel/files/patches/mageia/stable-usb-gadget-f_uac2-finalize-wmaxpacketsize-according-to-bandwidth.patch b/kernel/kernel/files/patches/mageia/stable-usb-gadget-f_uac2-finalize-wmaxpacketsize-according-to-bandwidth.patch new file mode 100644 index 00000000..4dd324c3 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-usb-gadget-f_uac2-finalize-wmaxpacketsize-according-to-bandwidth.patch @@ -0,0 +1,87 @@ +From 913e4a90b6f9687ac0f543e7b632753e4f51c441 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Thu, 30 Jul 2015 13:13:03 +0800 +Subject: usb: gadget: f_uac2: finalize wMaxPacketSize according to bandwidth + +From: Peter Chen + +commit 913e4a90b6f9687ac0f543e7b632753e4f51c441 upstream. + +According to USB Audio Device 2.0 Spec, Ch4.10.1.1: +wMaxPacketSize is defined as follows: +Maximum packet size this endpoint is capable of sending or receiving +when this configuration is selected. +This is determined by the audio bandwidth constraints of the endpoint. + +In current code, the wMaxPacketSize is defined as the maximum packet size +for ISO endpoint, and it will let the host reserve much more space than +it really needs, so that we can't let more endpoints work together at +one frame. + +We find this issue when we try to let 4 f_uac2 gadgets work together [1] +at FS connection. + +[1]http://www.spinics.net/lists/linux-usb/msg123478.html + +Acked-by: Daniel Mack +Cc: andrzej.p@samsung.com +Cc: Daniel Mack +Cc: tiwai@suse.de +Cc: Alan Stern +Signed-off-by: Peter Chen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_uac2.c | 31 +++++++++++++++++++++++++++++-- + 1 file changed, 29 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/function/f_uac2.c ++++ b/drivers/usb/gadget/function/f_uac2.c +@@ -975,6 +975,29 @@ free_ep(struct uac2_rtd_params *prm, str + "%s:%d Error!\n", __func__, __LINE__); + } + ++static void set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts, ++ struct usb_endpoint_descriptor *ep_desc, ++ unsigned int factor, bool is_playback) ++{ ++ int chmask, srate, ssize; ++ u16 max_packet_size; ++ ++ if (is_playback) { ++ chmask = uac2_opts->p_chmask; ++ srate = uac2_opts->p_srate; ++ ssize = uac2_opts->p_ssize; ++ } else { ++ chmask = uac2_opts->c_chmask; ++ srate = uac2_opts->c_srate; ++ ssize = uac2_opts->c_ssize; ++ } ++ ++ max_packet_size = num_channels(chmask) * ssize * ++ DIV_ROUND_UP(srate, factor / (1 << (ep_desc->bInterval - 1))); ++ ep_desc->wMaxPacketSize = cpu_to_le16(min(max_packet_size, ++ le16_to_cpu(ep_desc->wMaxPacketSize))); ++} ++ + static int + afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) + { +@@ -1070,10 +1093,14 @@ afunc_bind(struct usb_configuration *cfg + uac2->p_prm.uac2 = uac2; + uac2->c_prm.uac2 = uac2; + ++ /* Calculate wMaxPacketSize according to audio bandwidth */ ++ set_ep_max_packet_size(uac2_opts, &fs_epin_desc, 1000, true); ++ set_ep_max_packet_size(uac2_opts, &fs_epout_desc, 1000, false); ++ set_ep_max_packet_size(uac2_opts, &hs_epin_desc, 8000, true); ++ set_ep_max_packet_size(uac2_opts, &hs_epout_desc, 8000, false); ++ + hs_epout_desc.bEndpointAddress = fs_epout_desc.bEndpointAddress; +- hs_epout_desc.wMaxPacketSize = fs_epout_desc.wMaxPacketSize; + hs_epin_desc.bEndpointAddress = fs_epin_desc.bEndpointAddress; +- hs_epin_desc.wMaxPacketSize = fs_epin_desc.wMaxPacketSize; + + ret = usb_assign_descriptors(fn, fs_audio_desc, hs_audio_desc, NULL); + if (ret) diff --git a/kernel/kernel/files/patches/mageia/stable-usb-gadget-m66592-udc-forever-loop-in-set_feature.patch b/kernel/kernel/files/patches/mageia/stable-usb-gadget-m66592-udc-forever-loop-in-set_feature.patch new file mode 100644 index 00000000..49845a10 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-usb-gadget-m66592-udc-forever-loop-in-set_feature.patch @@ -0,0 +1,32 @@ +From 5feb5d2003499b1094d898c010a7604d7afddc4c Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 30 Jul 2015 00:30:58 +0300 +Subject: usb: gadget: m66592-udc: forever loop in set_feature() + +From: Dan Carpenter + +commit 5feb5d2003499b1094d898c010a7604d7afddc4c upstream. + +There is an "&&" vs "||" typo here so this loops 3000 times or if we get +unlucky it could loop forever. + +Fixes: ceaa0a6eeadf ('usb: gadget: m66592-udc: add support for TEST_MODE') +Signed-off-by: Dan Carpenter +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/m66592-udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/udc/m66592-udc.c ++++ b/drivers/usb/gadget/udc/m66592-udc.c +@@ -1052,7 +1052,7 @@ static void set_feature(struct m66592 *m + tmp = m66592_read(m66592, M66592_INTSTS0) & + M66592_CTSQ; + udelay(1); +- } while (tmp != M66592_CS_IDST || timeout-- > 0); ++ } while (tmp != M66592_CS_IDST && timeout-- > 0); + + if (tmp == M66592_CS_IDST) + m66592_bset(m66592, diff --git a/kernel/kernel/files/patches/mageia/stable-usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch b/kernel/kernel/files/patches/mageia/stable-usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch new file mode 100644 index 00000000..67707230 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-usb-host-ehci-sys-delete-useless-bus_to_hcd-conversion.patch @@ -0,0 +1,58 @@ +From 0521cfd06e1ebcd575e7ae36aab068b38df23850 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Mon, 17 Aug 2015 10:23:03 +0800 +Subject: usb: host: ehci-sys: delete useless bus_to_hcd conversion + +From: Peter Chen + +commit 0521cfd06e1ebcd575e7ae36aab068b38df23850 upstream. + +The ehci platform device's drvdata is the pointer of struct usb_hcd +already, so we doesn't need to call bus_to_hcd conversion again. + +Signed-off-by: Peter Chen +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-sysfs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/ehci-sysfs.c ++++ b/drivers/usb/host/ehci-sysfs.c +@@ -29,7 +29,7 @@ static ssize_t show_companion(struct dev + int count = PAGE_SIZE; + char *ptr = buf; + +- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); ++ ehci = hcd_to_ehci(dev_get_drvdata(dev)); + nports = HCS_N_PORTS(ehci->hcs_params); + + for (index = 0; index < nports; ++index) { +@@ -54,7 +54,7 @@ static ssize_t store_companion(struct de + struct ehci_hcd *ehci; + int portnum, new_owner; + +- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); ++ ehci = hcd_to_ehci(dev_get_drvdata(dev)); + new_owner = PORT_OWNER; /* Owned by companion */ + if (sscanf(buf, "%d", &portnum) != 1) + return -EINVAL; +@@ -85,7 +85,7 @@ static ssize_t show_uframe_periodic_max( + struct ehci_hcd *ehci; + int n; + +- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); ++ ehci = hcd_to_ehci(dev_get_drvdata(dev)); + n = scnprintf(buf, PAGE_SIZE, "%d\n", ehci->uframe_periodic_max); + return n; + } +@@ -101,7 +101,7 @@ static ssize_t store_uframe_periodic_max + unsigned long flags; + ssize_t ret; + +- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev))); ++ ehci = hcd_to_ehci(dev_get_drvdata(dev)); + if (kstrtouint(buf, 0, &uframe_periodic_max) < 0) + return -EINVAL; + diff --git a/kernel/kernel/files/patches/mageia/stable-usb-pl2303-fix-baud-rate-divisor-calculations.patch b/kernel/kernel/files/patches/mageia/stable-usb-pl2303-fix-baud-rate-divisor-calculations.patch new file mode 100644 index 00000000..c9a2fc29 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-usb-pl2303-fix-baud-rate-divisor-calculations.patch @@ -0,0 +1,97 @@ +From 49bda21266fdf195142e8b5dea057f09e96ada9f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Pecio?= +Date: Sun, 26 Jul 2015 11:14:34 +0200 +Subject: USB: pl2303: fix baud-rate divisor calculations + +From: =?UTF-8?q?Micha=C5=82=20Pecio?= + +commit 49bda21266fdf195142e8b5dea057f09e96ada9f upstream. + +This commit fixes the following issues: + +1. The 9th bit of buf was believed to be the LSB of divisor's +exponent, but the hardware interprets it as MSB (9th bit) of the +mantissa. The exponent is actually one bit shorter and applies +to base 4, not 2 as previously believed. + +2. Loop iterations doubled the exponent instead of incrementing. + +3. The exponent wasn't checked for overflow. + +4. The function returned requested rate instead of actual rate. + +Due to issue #2, the old code deviated from the wrong formula +described in #1 and actually yielded correct rates when divisor +was lower than 4096 by using exponents of 0, 2 or 4 base-2, +interpreted as 0, 1, 2 base-4 with the 9th mantissa bit clear. +However, at 93.75 kbaud or less the rate turned out too slow +due to #2 or too fast due to #2 and #3. + +I tested this patch by sending and validating 0x00,0x01,..,0xff +to an FTDI dongle at 234, 987, 2401, 9601, 31415, 115199, 250k, +500k, 750k, 1M, 1.5M, 3M+1 baud. All rates passed. + +I also used pv to check speed at some rates unsupported by FTDI: +45 (the lowest possible), 2M, 4M, 5M and 6M-1. Looked sane. + +Signed-off-by: Michal Pecio +Fixes: 399aa9a75ad3 ("USB: pl2303: use divisors for unsupported baud +rates") +[johan: update summary ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/pl2303.c | 35 ++++++++++++++++++++++++++--------- + 1 file changed, 26 insertions(+), 9 deletions(-) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -362,21 +362,38 @@ static speed_t pl2303_encode_baud_rate_d + static speed_t pl2303_encode_baud_rate_divisor(unsigned char buf[4], + speed_t baud) + { +- unsigned int tmp; ++ unsigned int baseline, mantissa, exponent; + + /* + * Apparently the formula is: +- * baudrate = 12M * 32 / (2^buf[1]) / buf[0] ++ * baudrate = 12M * 32 / (mantissa * 4^exponent) ++ * where ++ * mantissa = buf[8:0] ++ * exponent = buf[11:9] + */ +- tmp = 12000000 * 32 / baud; ++ baseline = 12000000 * 32; ++ mantissa = baseline / baud; ++ if (mantissa == 0) ++ mantissa = 1; /* Avoid dividing by zero if baud > 32*12M. */ ++ exponent = 0; ++ while (mantissa >= 512) { ++ if (exponent < 7) { ++ mantissa >>= 2; /* divide by 4 */ ++ exponent++; ++ } else { ++ /* Exponent is maxed. Trim mantissa and leave. */ ++ mantissa = 511; ++ break; ++ } ++ } ++ + buf[3] = 0x80; + buf[2] = 0; +- buf[1] = (tmp >= 256); +- while (tmp >= 256) { +- tmp >>= 2; +- buf[1] <<= 1; +- } +- buf[0] = tmp; ++ buf[1] = exponent << 1 | mantissa >> 8; ++ buf[0] = mantissa & 0xff; ++ ++ /* Calculate and return the exact baud rate. */ ++ baud = (baseline / mantissa) >> (exponent << 1); + + return baud; + } diff --git a/kernel/kernel/files/patches/mageia/stable-usb-qcserial-add-hp-lt4111-lte-ev-do-hspa-gobi-4g-module.patch b/kernel/kernel/files/patches/mageia/stable-usb-qcserial-add-hp-lt4111-lte-ev-do-hspa-gobi-4g-module.patch new file mode 100644 index 00000000..b07e2064 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-usb-qcserial-add-hp-lt4111-lte-ev-do-hspa-gobi-4g-module.patch @@ -0,0 +1,30 @@ +From 44840dec6127e4d7c5074f75d2dd96bc4ab85fe3 Mon Sep 17 00:00:00 2001 +From: David Ward +Date: Tue, 18 Aug 2015 10:36:23 +0200 +Subject: USB: qcserial: add HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module + +From: David Ward + +commit 44840dec6127e4d7c5074f75d2dd96bc4ab85fe3 upstream. + +This is an HP-branded Sierra Wireless EM7355: +https://bugzilla.redhat.com/show_bug.cgi?id=1223646#c2 + +Signed-off-by: David Ward +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/qcserial.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -139,6 +139,7 @@ static const struct usb_device_id id_tab + {USB_DEVICE(0x0AF0, 0x8120)}, /* Option GTM681W */ + + /* non-Gobi Sierra Wireless devices */ ++ {DEVICE_SWI(0x03f0, 0x4e1d)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */ + {DEVICE_SWI(0x0f3d, 0x68a2)}, /* Sierra Wireless MC7700 */ + {DEVICE_SWI(0x114f, 0x68a2)}, /* Sierra Wireless MC7750 */ + {DEVICE_SWI(0x1199, 0x68a2)}, /* Sierra Wireless MC7710 */ diff --git a/kernel/kernel/files/patches/mageia/stable-usb-symbolserial-use-usb_get_serial_port_data.patch b/kernel/kernel/files/patches/mageia/stable-usb-symbolserial-use-usb_get_serial_port_data.patch new file mode 100644 index 00000000..e5e182bb --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-usb-symbolserial-use-usb_get_serial_port_data.patch @@ -0,0 +1,52 @@ +From 951d3793bbfc0a441d791d820183aa3085c83ea9 Mon Sep 17 00:00:00 2001 +From: Philipp Hachtmann +Date: Mon, 17 Aug 2015 17:31:46 +0200 +Subject: USB: symbolserial: Use usb_get_serial_port_data + +From: Philipp Hachtmann + +commit 951d3793bbfc0a441d791d820183aa3085c83ea9 upstream. + +The driver used usb_get_serial_data(port->serial) which compiled but resulted +in a NULL pointer being returned (and subsequently used). I did not go deeper +into this but I guess this is a regression. + +Signed-off-by: Philipp Hachtmann +Fixes: a85796ee5149 ("USB: symbolserial: move private-data allocation to +port_probe") +Acked-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/symbolserial.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/serial/symbolserial.c ++++ b/drivers/usb/serial/symbolserial.c +@@ -94,7 +94,7 @@ exit: + + static int symbol_open(struct tty_struct *tty, struct usb_serial_port *port) + { +- struct symbol_private *priv = usb_get_serial_data(port->serial); ++ struct symbol_private *priv = usb_get_serial_port_data(port); + unsigned long flags; + int result = 0; + +@@ -120,7 +120,7 @@ static void symbol_close(struct usb_seri + static void symbol_throttle(struct tty_struct *tty) + { + struct usb_serial_port *port = tty->driver_data; +- struct symbol_private *priv = usb_get_serial_data(port->serial); ++ struct symbol_private *priv = usb_get_serial_port_data(port); + + spin_lock_irq(&priv->lock); + priv->throttled = true; +@@ -130,7 +130,7 @@ static void symbol_throttle(struct tty_s + static void symbol_unthrottle(struct tty_struct *tty) + { + struct usb_serial_port *port = tty->driver_data; +- struct symbol_private *priv = usb_get_serial_data(port->serial); ++ struct symbol_private *priv = usb_get_serial_port_data(port); + int result; + bool was_throttled; + diff --git a/kernel/kernel/files/patches/mageia/stable-x86-ldt-correct-fpu-emulation-access-to-ldt.patch b/kernel/kernel/files/patches/mageia/stable-x86-ldt-correct-fpu-emulation-access-to-ldt.patch new file mode 100644 index 00000000..6dda3314 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-x86-ldt-correct-fpu-emulation-access-to-ldt.patch @@ -0,0 +1,98 @@ +From 4809146b86c3d41ce588fdb767d021e2a80600dd Mon Sep 17 00:00:00 2001 +From: Juergen Gross +Date: Thu, 6 Aug 2015 19:54:34 +0200 +Subject: x86/ldt: Correct FPU emulation access to LDT + +From: Juergen Gross + +commit 4809146b86c3d41ce588fdb767d021e2a80600dd upstream. + +Commit 37868fe113ff ("x86/ldt: Make modify_ldt synchronous") +introduced a new struct ldt_struct anchored at mm->context.ldt. + +Adapt the x86 fpu emulation code to use that new structure. + +Signed-off-by: Juergen Gross +Reviewed-by: Andy Lutomirski +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: billm@melbpc.org.au +Link: http://lkml.kernel.org/r/1438883674-1240-1-git-send-email-jgross@suse.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/math-emu/fpu_entry.c | 3 +-- + arch/x86/math-emu/fpu_system.h | 21 ++++++++++++++++++--- + arch/x86/math-emu/get_address.c | 3 +-- + 3 files changed, 20 insertions(+), 7 deletions(-) + +--- a/arch/x86/math-emu/fpu_entry.c ++++ b/arch/x86/math-emu/fpu_entry.c +@@ -29,7 +29,6 @@ + + #include + #include +-#include + #include + #include + +@@ -185,7 +184,7 @@ void math_emulate(struct math_emu_info * + math_abort(FPU_info, SIGILL); + } + +- code_descriptor = LDT_DESCRIPTOR(FPU_CS); ++ code_descriptor = FPU_get_ldt_descriptor(FPU_CS); + if (SEG_D_SIZE(code_descriptor)) { + /* The above test may be wrong, the book is not clear */ + /* Segmented 32 bit protected mode */ +--- a/arch/x86/math-emu/fpu_system.h ++++ b/arch/x86/math-emu/fpu_system.h +@@ -16,9 +16,24 @@ + #include + #include + +-/* s is always from a cpu register, and the cpu does bounds checking +- * during register load --> no further bounds checks needed */ +-#define LDT_DESCRIPTOR(s) (((struct desc_struct *)current->mm->context.ldt)[(s) >> 3]) ++#include ++#include ++ ++static inline struct desc_struct FPU_get_ldt_descriptor(unsigned seg) ++{ ++ static struct desc_struct zero_desc; ++ struct desc_struct ret = zero_desc; ++ ++#ifdef CONFIG_MODIFY_LDT_SYSCALL ++ seg >>= 3; ++ mutex_lock(¤t->mm->context.lock); ++ if (current->mm->context.ldt && seg < current->mm->context.ldt->size) ++ ret = current->mm->context.ldt->entries[seg]; ++ mutex_unlock(¤t->mm->context.lock); ++#endif ++ return ret; ++} ++ + #define SEG_D_SIZE(x) ((x).b & (3 << 21)) + #define SEG_G_BIT(x) ((x).b & (1 << 23)) + #define SEG_GRANULARITY(x) (((x).b & (1 << 23)) ? 4096 : 1) +--- a/arch/x86/math-emu/get_address.c ++++ b/arch/x86/math-emu/get_address.c +@@ -20,7 +20,6 @@ + #include + + #include +-#include + + #include "fpu_system.h" + #include "exception.h" +@@ -158,7 +157,7 @@ static long pm_address(u_char FPU_modrm, + addr->selector = PM_REG_(segment); + } + +- descriptor = LDT_DESCRIPTOR(PM_REG_(segment)); ++ descriptor = FPU_get_ldt_descriptor(segment); + base_address = SEG_BASE_ADDR(descriptor); + address = base_address + offset; + limit = base_address diff --git a/kernel/kernel/files/patches/mageia/stable-x86-ldt-correct-ldt-access-in-single-stepping-logic.patch b/kernel/kernel/files/patches/mageia/stable-x86-ldt-correct-ldt-access-in-single-stepping-logic.patch new file mode 100644 index 00000000..e0619146 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-x86-ldt-correct-ldt-access-in-single-stepping-logic.patch @@ -0,0 +1,45 @@ +From 136d9d83c07c5e30ac49fc83b27e8c4842f108fc Mon Sep 17 00:00:00 2001 +From: Juergen Gross +Date: Thu, 6 Aug 2015 10:04:38 +0200 +Subject: x86/ldt: Correct LDT access in single stepping logic + +From: Juergen Gross + +commit 136d9d83c07c5e30ac49fc83b27e8c4842f108fc upstream. + +Commit 37868fe113ff ("x86/ldt: Make modify_ldt synchronous") +introduced a new struct ldt_struct anchored at mm->context.ldt. + +convert_ip_to_linear() was changed to reflect this, but indexing +into the ldt has to be changed as the pointer is no longer void *. + +Signed-off-by: Juergen Gross +Reviewed-by: Andy Lutomirski +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: bp@suse.de +Link: http://lkml.kernel.org/r/1438848278-12906-1-git-send-email-jgross@suse.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/step.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/step.c ++++ b/arch/x86/kernel/step.c +@@ -28,11 +28,11 @@ unsigned long convert_ip_to_linear(struc + struct desc_struct *desc; + unsigned long base; + +- seg &= ~7UL; ++ seg >>= 3; + + mutex_lock(&child->mm->context.lock); + if (unlikely(!child->mm->context.ldt || +- (seg >> 3) >= child->mm->context.ldt->size)) ++ seg >= child->mm->context.ldt->size)) + addr = -1L; /* bogus selector, access would fault */ + else { + desc = &child->mm->context.ldt->entries[seg]; diff --git a/kernel/kernel/files/patches/mageia/stable-x86-ldt-further-fix-fpu-emulation.patch b/kernel/kernel/files/patches/mageia/stable-x86-ldt-further-fix-fpu-emulation.patch new file mode 100644 index 00000000..af7eb5cd --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-x86-ldt-further-fix-fpu-emulation.patch @@ -0,0 +1,35 @@ +From 12e244f4b550498bbaf654a52f93633f7dde2dc7 Mon Sep 17 00:00:00 2001 +From: Andy Lutomirski +Date: Fri, 14 Aug 2015 15:02:55 -0700 +Subject: x86/ldt: Further fix FPU emulation + +From: Andy Lutomirski + +commit 12e244f4b550498bbaf654a52f93633f7dde2dc7 upstream. + +The previous fix confused a selector with a segment prefix. Fix it. + +Compile-tested only. + +Cc: Juergen Gross +Reported-by: Linus Torvalds +Fixes: 4809146b86c3 ("x86/ldt: Correct FPU emulation access to LDT") +Signed-off-by: Andy Lutomirski +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/math-emu/get_address.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/math-emu/get_address.c ++++ b/arch/x86/math-emu/get_address.c +@@ -157,7 +157,7 @@ static long pm_address(u_char FPU_modrm, + addr->selector = PM_REG_(segment); + } + +- descriptor = FPU_get_ldt_descriptor(segment); ++ descriptor = FPU_get_ldt_descriptor(addr->selector); + base_address = SEG_BASE_ADDR(descriptor); + address = base_address + offset; + limit = base_address diff --git a/kernel/kernel/files/patches/mageia/stable-x86-ldt-make-modify_ldt-synchronous.patch b/kernel/kernel/files/patches/mageia/stable-x86-ldt-make-modify_ldt-synchronous.patch new file mode 100644 index 00000000..2729cf7e --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-x86-ldt-make-modify_ldt-synchronous.patch @@ -0,0 +1,628 @@ +From 37868fe113ff2ba814b3b4eb12df214df555f8dc Mon Sep 17 00:00:00 2001 +From: Andy Lutomirski +Date: Thu, 30 Jul 2015 14:31:32 -0700 +Subject: x86/ldt: Make modify_ldt synchronous + +From: Andy Lutomirski + +commit 37868fe113ff2ba814b3b4eb12df214df555f8dc upstream. + +modify_ldt() has questionable locking and does not synchronize +threads. Improve it: redesign the locking and synchronize all +threads' LDTs using an IPI on all modifications. + +This will dramatically slow down modify_ldt in multithreaded +programs, but there shouldn't be any multithreaded programs that +care about modify_ldt's performance in the first place. + +This fixes some fallout from the CVE-2015-5157 fixes. + +Signed-off-by: Andy Lutomirski +Reviewed-by: Borislav Petkov +Cc: Andrew Cooper +Cc: Andy Lutomirski +Cc: Boris Ostrovsky +Cc: Borislav Petkov +Cc: Brian Gerst +Cc: Denys Vlasenko +Cc: H. Peter Anvin +Cc: Jan Beulich +Cc: Konrad Rzeszutek Wilk +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Sasha Levin +Cc: Steven Rostedt +Cc: Thomas Gleixner +Cc: security@kernel.org +Cc: xen-devel +Link: http://lkml.kernel.org/r/4c6978476782160600471bd865b318db34c7b628.1438291540.git.luto@kernel.org +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/desc.h | 15 -- + arch/x86/include/asm/mmu.h | 3 + arch/x86/include/asm/mmu_context.h | 54 ++++++- + arch/x86/kernel/cpu/common.c | 4 + arch/x86/kernel/cpu/perf_event.c | 12 + + arch/x86/kernel/ldt.c | 264 ++++++++++++++++++++----------------- + arch/x86/kernel/process_64.c | 4 + arch/x86/kernel/step.c | 6 + arch/x86/power/cpu.c | 3 + 9 files changed, 211 insertions(+), 154 deletions(-) + +--- a/arch/x86/include/asm/desc.h ++++ b/arch/x86/include/asm/desc.h +@@ -280,21 +280,6 @@ static inline void clear_LDT(void) + set_ldt(NULL, 0); + } + +-/* +- * load one particular LDT into the current CPU +- */ +-static inline void load_LDT_nolock(mm_context_t *pc) +-{ +- set_ldt(pc->ldt, pc->size); +-} +- +-static inline void load_LDT(mm_context_t *pc) +-{ +- preempt_disable(); +- load_LDT_nolock(pc); +- preempt_enable(); +-} +- + static inline unsigned long get_desc_base(const struct desc_struct *desc) + { + return (unsigned)(desc->base0 | ((desc->base1) << 16) | ((desc->base2) << 24)); +--- a/arch/x86/include/asm/mmu.h ++++ b/arch/x86/include/asm/mmu.h +@@ -9,8 +9,7 @@ + * we put the segment information here. + */ + typedef struct { +- void *ldt; +- int size; ++ struct ldt_struct *ldt; + + #ifdef CONFIG_X86_64 + /* True if mm supports a task running in 32 bit compatibility mode. */ +--- a/arch/x86/include/asm/mmu_context.h ++++ b/arch/x86/include/asm/mmu_context.h +@@ -34,6 +34,50 @@ static inline void load_mm_cr4(struct mm + #endif + + /* ++ * ldt_structs can be allocated, used, and freed, but they are never ++ * modified while live. ++ */ ++struct ldt_struct { ++ /* ++ * Xen requires page-aligned LDTs with special permissions. This is ++ * needed to prevent us from installing evil descriptors such as ++ * call gates. On native, we could merge the ldt_struct and LDT ++ * allocations, but it's not worth trying to optimize. ++ */ ++ struct desc_struct *entries; ++ int size; ++}; ++ ++static inline void load_mm_ldt(struct mm_struct *mm) ++{ ++ struct ldt_struct *ldt; ++ ++ /* lockless_dereference synchronizes with smp_store_release */ ++ ldt = lockless_dereference(mm->context.ldt); ++ ++ /* ++ * Any change to mm->context.ldt is followed by an IPI to all ++ * CPUs with the mm active. The LDT will not be freed until ++ * after the IPI is handled by all such CPUs. This means that, ++ * if the ldt_struct changes before we return, the values we see ++ * will be safe, and the new values will be loaded before we run ++ * any user code. ++ * ++ * NB: don't try to convert this to use RCU without extreme care. ++ * We would still need IRQs off, because we don't want to change ++ * the local LDT after an IPI loaded a newer value than the one ++ * that we can see. ++ */ ++ ++ if (unlikely(ldt)) ++ set_ldt(ldt->entries, ldt->size); ++ else ++ clear_LDT(); ++ ++ DEBUG_LOCKS_WARN_ON(preemptible()); ++} ++ ++/* + * Used for LDT copy/destruction. + */ + int init_new_context(struct task_struct *tsk, struct mm_struct *mm); +@@ -78,12 +122,12 @@ static inline void switch_mm(struct mm_s + * was called and then modify_ldt changed + * prev->context.ldt but suppressed an IPI to this CPU. + * In this case, prev->context.ldt != NULL, because we +- * never free an LDT while the mm still exists. That +- * means that next->context.ldt != prev->context.ldt, +- * because mms never share an LDT. ++ * never set context.ldt to NULL while the mm still ++ * exists. That means that next->context.ldt != ++ * prev->context.ldt, because mms never share an LDT. + */ + if (unlikely(prev->context.ldt != next->context.ldt)) +- load_LDT_nolock(&next->context); ++ load_mm_ldt(next); + } + #ifdef CONFIG_SMP + else { +@@ -106,7 +150,7 @@ static inline void switch_mm(struct mm_s + load_cr3(next->pgd); + trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL); + load_mm_cr4(next); +- load_LDT_nolock(&next->context); ++ load_mm_ldt(next); + } + } + #endif +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1434,7 +1434,7 @@ void cpu_init(void) + load_sp0(t, ¤t->thread); + set_tss_desc(cpu, t); + load_TR_desc(); +- load_LDT(&init_mm.context); ++ load_mm_ldt(&init_mm); + + clear_all_debug_regs(); + dbg_restore_debug_regs(); +@@ -1483,7 +1483,7 @@ void cpu_init(void) + load_sp0(t, thread); + set_tss_desc(cpu, t); + load_TR_desc(); +- load_LDT(&init_mm.context); ++ load_mm_ldt(&init_mm); + + t->x86_tss.io_bitmap_base = offsetof(struct tss_struct, io_bitmap); + +--- a/arch/x86/kernel/cpu/perf_event.c ++++ b/arch/x86/kernel/cpu/perf_event.c +@@ -2170,21 +2170,25 @@ static unsigned long get_segment_base(un + int idx = segment >> 3; + + if ((segment & SEGMENT_TI_MASK) == SEGMENT_LDT) { ++ struct ldt_struct *ldt; ++ + if (idx > LDT_ENTRIES) + return 0; + +- if (idx > current->active_mm->context.size) ++ /* IRQs are off, so this synchronizes with smp_store_release */ ++ ldt = lockless_dereference(current->active_mm->context.ldt); ++ if (!ldt || idx > ldt->size) + return 0; + +- desc = current->active_mm->context.ldt; ++ desc = &ldt->entries[idx]; + } else { + if (idx > GDT_ENTRIES) + return 0; + +- desc = raw_cpu_ptr(gdt_page.gdt); ++ desc = raw_cpu_ptr(gdt_page.gdt) + idx; + } + +- return get_desc_base(desc + idx); ++ return get_desc_base(desc); + } + + #ifdef CONFIG_COMPAT +--- a/arch/x86/kernel/ldt.c ++++ b/arch/x86/kernel/ldt.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -20,82 +21,82 @@ + #include + #include + +-#ifdef CONFIG_SMP ++/* context.lock is held for us, so we don't need any locking. */ + static void flush_ldt(void *current_mm) + { +- if (current->active_mm == current_mm) +- load_LDT(¤t->active_mm->context); ++ mm_context_t *pc; ++ ++ if (current->active_mm != current_mm) ++ return; ++ ++ pc = ¤t->active_mm->context; ++ set_ldt(pc->ldt->entries, pc->ldt->size); + } +-#endif + +-static int alloc_ldt(mm_context_t *pc, int mincount, int reload) ++/* The caller must call finalize_ldt_struct on the result. LDT starts zeroed. */ ++static struct ldt_struct *alloc_ldt_struct(int size) + { +- void *oldldt, *newldt; +- int oldsize; ++ struct ldt_struct *new_ldt; ++ int alloc_size; + +- if (mincount <= pc->size) +- return 0; +- oldsize = pc->size; +- mincount = (mincount + (PAGE_SIZE / LDT_ENTRY_SIZE - 1)) & +- (~(PAGE_SIZE / LDT_ENTRY_SIZE - 1)); +- if (mincount * LDT_ENTRY_SIZE > PAGE_SIZE) +- newldt = vmalloc(mincount * LDT_ENTRY_SIZE); +- else +- newldt = (void *)__get_free_page(GFP_KERNEL); ++ if (size > LDT_ENTRIES) ++ return NULL; + +- if (!newldt) +- return -ENOMEM; ++ new_ldt = kmalloc(sizeof(struct ldt_struct), GFP_KERNEL); ++ if (!new_ldt) ++ return NULL; ++ ++ BUILD_BUG_ON(LDT_ENTRY_SIZE != sizeof(struct desc_struct)); ++ alloc_size = size * LDT_ENTRY_SIZE; ++ ++ /* ++ * Xen is very picky: it requires a page-aligned LDT that has no ++ * trailing nonzero bytes in any page that contains LDT descriptors. ++ * Keep it simple: zero the whole allocation and never allocate less ++ * than PAGE_SIZE. ++ */ ++ if (alloc_size > PAGE_SIZE) ++ new_ldt->entries = vzalloc(alloc_size); ++ else ++ new_ldt->entries = kzalloc(PAGE_SIZE, GFP_KERNEL); + +- if (oldsize) +- memcpy(newldt, pc->ldt, oldsize * LDT_ENTRY_SIZE); +- oldldt = pc->ldt; +- memset(newldt + oldsize * LDT_ENTRY_SIZE, 0, +- (mincount - oldsize) * LDT_ENTRY_SIZE); +- +- paravirt_alloc_ldt(newldt, mincount); +- +-#ifdef CONFIG_X86_64 +- /* CHECKME: Do we really need this ? */ +- wmb(); +-#endif +- pc->ldt = newldt; +- wmb(); +- pc->size = mincount; +- wmb(); +- +- if (reload) { +-#ifdef CONFIG_SMP +- preempt_disable(); +- load_LDT(pc); +- if (!cpumask_equal(mm_cpumask(current->mm), +- cpumask_of(smp_processor_id()))) +- smp_call_function(flush_ldt, current->mm, 1); +- preempt_enable(); +-#else +- load_LDT(pc); +-#endif +- } +- if (oldsize) { +- paravirt_free_ldt(oldldt, oldsize); +- if (oldsize * LDT_ENTRY_SIZE > PAGE_SIZE) +- vfree(oldldt); +- else +- put_page(virt_to_page(oldldt)); ++ if (!new_ldt->entries) { ++ kfree(new_ldt); ++ return NULL; + } +- return 0; ++ ++ new_ldt->size = size; ++ return new_ldt; + } + +-static inline int copy_ldt(mm_context_t *new, mm_context_t *old) ++/* After calling this, the LDT is immutable. */ ++static void finalize_ldt_struct(struct ldt_struct *ldt) + { +- int err = alloc_ldt(new, old->size, 0); +- int i; ++ paravirt_alloc_ldt(ldt->entries, ldt->size); ++} ++ ++/* context.lock is held */ ++static void install_ldt(struct mm_struct *current_mm, ++ struct ldt_struct *ldt) ++{ ++ /* Synchronizes with lockless_dereference in load_mm_ldt. */ ++ smp_store_release(¤t_mm->context.ldt, ldt); ++ ++ /* Activate the LDT for all CPUs using current_mm. */ ++ on_each_cpu_mask(mm_cpumask(current_mm), flush_ldt, current_mm, true); ++} + +- if (err < 0) +- return err; ++static void free_ldt_struct(struct ldt_struct *ldt) ++{ ++ if (likely(!ldt)) ++ return; + +- for (i = 0; i < old->size; i++) +- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE); +- return 0; ++ paravirt_free_ldt(ldt->entries, ldt->size); ++ if (ldt->size * LDT_ENTRY_SIZE > PAGE_SIZE) ++ vfree(ldt->entries); ++ else ++ kfree(ldt->entries); ++ kfree(ldt); + } + + /* +@@ -104,17 +105,37 @@ static inline int copy_ldt(mm_context_t + */ + int init_new_context(struct task_struct *tsk, struct mm_struct *mm) + { ++ struct ldt_struct *new_ldt; + struct mm_struct *old_mm; + int retval = 0; + + mutex_init(&mm->context.lock); +- mm->context.size = 0; + old_mm = current->mm; +- if (old_mm && old_mm->context.size > 0) { +- mutex_lock(&old_mm->context.lock); +- retval = copy_ldt(&mm->context, &old_mm->context); +- mutex_unlock(&old_mm->context.lock); ++ if (!old_mm) { ++ mm->context.ldt = NULL; ++ return 0; + } ++ ++ mutex_lock(&old_mm->context.lock); ++ if (!old_mm->context.ldt) { ++ mm->context.ldt = NULL; ++ goto out_unlock; ++ } ++ ++ new_ldt = alloc_ldt_struct(old_mm->context.ldt->size); ++ if (!new_ldt) { ++ retval = -ENOMEM; ++ goto out_unlock; ++ } ++ ++ memcpy(new_ldt->entries, old_mm->context.ldt->entries, ++ new_ldt->size * LDT_ENTRY_SIZE); ++ finalize_ldt_struct(new_ldt); ++ ++ mm->context.ldt = new_ldt; ++ ++out_unlock: ++ mutex_unlock(&old_mm->context.lock); + return retval; + } + +@@ -125,53 +146,47 @@ int init_new_context(struct task_struct + */ + void destroy_context(struct mm_struct *mm) + { +- if (mm->context.size) { +-#ifdef CONFIG_X86_32 +- /* CHECKME: Can this ever happen ? */ +- if (mm == current->active_mm) +- clear_LDT(); +-#endif +- paravirt_free_ldt(mm->context.ldt, mm->context.size); +- if (mm->context.size * LDT_ENTRY_SIZE > PAGE_SIZE) +- vfree(mm->context.ldt); +- else +- put_page(virt_to_page(mm->context.ldt)); +- mm->context.size = 0; +- } ++ free_ldt_struct(mm->context.ldt); ++ mm->context.ldt = NULL; + } + + static int read_ldt(void __user *ptr, unsigned long bytecount) + { +- int err; ++ int retval; + unsigned long size; + struct mm_struct *mm = current->mm; + +- if (!mm->context.size) +- return 0; ++ mutex_lock(&mm->context.lock); ++ ++ if (!mm->context.ldt) { ++ retval = 0; ++ goto out_unlock; ++ } ++ + if (bytecount > LDT_ENTRY_SIZE * LDT_ENTRIES) + bytecount = LDT_ENTRY_SIZE * LDT_ENTRIES; + +- mutex_lock(&mm->context.lock); +- size = mm->context.size * LDT_ENTRY_SIZE; ++ size = mm->context.ldt->size * LDT_ENTRY_SIZE; + if (size > bytecount) + size = bytecount; + +- err = 0; +- if (copy_to_user(ptr, mm->context.ldt, size)) +- err = -EFAULT; +- mutex_unlock(&mm->context.lock); +- if (err < 0) +- goto error_return; ++ if (copy_to_user(ptr, mm->context.ldt->entries, size)) { ++ retval = -EFAULT; ++ goto out_unlock; ++ } ++ + if (size != bytecount) { +- /* zero-fill the rest */ +- if (clear_user(ptr + size, bytecount - size) != 0) { +- err = -EFAULT; +- goto error_return; ++ /* Zero-fill the rest and pretend we read bytecount bytes. */ ++ if (clear_user(ptr + size, bytecount - size)) { ++ retval = -EFAULT; ++ goto out_unlock; + } + } +- return bytecount; +-error_return: +- return err; ++ retval = bytecount; ++ ++out_unlock: ++ mutex_unlock(&mm->context.lock); ++ return retval; + } + + static int read_default_ldt(void __user *ptr, unsigned long bytecount) +@@ -195,6 +210,8 @@ static int write_ldt(void __user *ptr, u + struct desc_struct ldt; + int error; + struct user_desc ldt_info; ++ int oldsize, newsize; ++ struct ldt_struct *new_ldt, *old_ldt; + + error = -EINVAL; + if (bytecount != sizeof(ldt_info)) +@@ -213,34 +230,39 @@ static int write_ldt(void __user *ptr, u + goto out; + } + +- mutex_lock(&mm->context.lock); +- if (ldt_info.entry_number >= mm->context.size) { +- error = alloc_ldt(¤t->mm->context, +- ldt_info.entry_number + 1, 1); +- if (error < 0) +- goto out_unlock; +- } +- +- /* Allow LDTs to be cleared by the user. */ +- if (ldt_info.base_addr == 0 && ldt_info.limit == 0) { +- if (oldmode || LDT_empty(&ldt_info)) { +- memset(&ldt, 0, sizeof(ldt)); +- goto install; ++ if ((oldmode && !ldt_info.base_addr && !ldt_info.limit) || ++ LDT_empty(&ldt_info)) { ++ /* The user wants to clear the entry. */ ++ memset(&ldt, 0, sizeof(ldt)); ++ } else { ++ if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) { ++ error = -EINVAL; ++ goto out; + } ++ ++ fill_ldt(&ldt, &ldt_info); ++ if (oldmode) ++ ldt.avl = 0; + } + +- if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) { +- error = -EINVAL; ++ mutex_lock(&mm->context.lock); ++ ++ old_ldt = mm->context.ldt; ++ oldsize = old_ldt ? old_ldt->size : 0; ++ newsize = max((int)(ldt_info.entry_number + 1), oldsize); ++ ++ error = -ENOMEM; ++ new_ldt = alloc_ldt_struct(newsize); ++ if (!new_ldt) + goto out_unlock; +- } + +- fill_ldt(&ldt, &ldt_info); +- if (oldmode) +- ldt.avl = 0; +- +- /* Install the new entry ... */ +-install: +- write_ldt_entry(mm->context.ldt, ldt_info.entry_number, &ldt); ++ if (old_ldt) ++ memcpy(new_ldt->entries, old_ldt->entries, oldsize * LDT_ENTRY_SIZE); ++ new_ldt->entries[ldt_info.entry_number] = ldt; ++ finalize_ldt_struct(new_ldt); ++ ++ install_ldt(mm, new_ldt); ++ free_ldt_struct(old_ldt); + error = 0; + + out_unlock: +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -122,11 +122,11 @@ void __show_regs(struct pt_regs *regs, i + void release_thread(struct task_struct *dead_task) + { + if (dead_task->mm) { +- if (dead_task->mm->context.size) { ++ if (dead_task->mm->context.ldt) { + pr_warn("WARNING: dead process %s still has LDT? <%p/%d>\n", + dead_task->comm, + dead_task->mm->context.ldt, +- dead_task->mm->context.size); ++ dead_task->mm->context.ldt->size); + BUG(); + } + } +--- a/arch/x86/kernel/step.c ++++ b/arch/x86/kernel/step.c +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include + + unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *regs) + { +@@ -30,10 +31,11 @@ unsigned long convert_ip_to_linear(struc + seg &= ~7UL; + + mutex_lock(&child->mm->context.lock); +- if (unlikely((seg >> 3) >= child->mm->context.size)) ++ if (unlikely(!child->mm->context.ldt || ++ (seg >> 3) >= child->mm->context.ldt->size)) + addr = -1L; /* bogus selector, access would fault */ + else { +- desc = child->mm->context.ldt + seg; ++ desc = &child->mm->context.ldt->entries[seg]; + base = get_desc_base(desc); + + /* 16-bit code segment? */ +--- a/arch/x86/power/cpu.c ++++ b/arch/x86/power/cpu.c +@@ -23,6 +23,7 @@ + #include + #include /* pcntxt_mask */ + #include ++#include + + #ifdef CONFIG_X86_32 + __visible unsigned long saved_context_ebx; +@@ -154,7 +155,7 @@ static void fix_processor_context(void) + syscall_init(); /* This sets MSR_*STAR and related */ + #endif + load_TR_desc(); /* This does ltr */ +- load_LDT(¤t->active_mm->context); /* This does lldt */ ++ load_mm_ldt(current->active_mm); /* This does lldt */ + } + + /** diff --git a/kernel/kernel/files/patches/mageia/stable-x86-xen-build-xen-pv-apic-driver-for-domu-as-well.patch b/kernel/kernel/files/patches/mageia/stable-x86-xen-build-xen-pv-apic-driver-for-domu-as-well.patch deleted file mode 100644 index d2672797..00000000 --- a/kernel/kernel/files/patches/mageia/stable-x86-xen-build-xen-pv-apic-driver-for-domu-as-well.patch +++ /dev/null @@ -1,87 +0,0 @@ -From fc5fee86bdd3d720e2d1d324e4fae0c35845fa63 Mon Sep 17 00:00:00 2001 -From: "Jason A. Donenfeld" -Date: Mon, 10 Aug 2015 15:40:27 +0200 -Subject: x86/xen: build "Xen PV" APIC driver for domU as well - -From: "Jason A. Donenfeld" - -commit fc5fee86bdd3d720e2d1d324e4fae0c35845fa63 upstream. - -It turns out that a PV domU also requires the "Xen PV" APIC -driver. Otherwise, the flat driver is used and we get stuck in busy -loops that never exit, such as in this stack trace: - -(gdb) target remote localhost:9999 -Remote debugging using localhost:9999 -__xapic_wait_icr_idle () at ./arch/x86/include/asm/ipi.h:56 -56 while (native_apic_mem_read(APIC_ICR) & APIC_ICR_BUSY) -(gdb) bt - #0 __xapic_wait_icr_idle () at ./arch/x86/include/asm/ipi.h:56 - #1 __default_send_IPI_shortcut (shortcut=, -dest=, vector=) at -./arch/x86/include/asm/ipi.h:75 - #2 apic_send_IPI_self (vector=246) at arch/x86/kernel/apic/probe_64.c:54 - #3 0xffffffff81011336 in arch_irq_work_raise () at -arch/x86/kernel/irq_work.c:47 - #4 0xffffffff8114990c in irq_work_queue (work=0xffff88000fc0e400) at -kernel/irq_work.c:100 - #5 0xffffffff8110c29d in wake_up_klogd () at kernel/printk/printk.c:2633 - #6 0xffffffff8110ca60 in vprintk_emit (facility=0, level=, dict=0x0 , dictlen=, -fmt=, args=) - at kernel/printk/printk.c:1778 - #7 0xffffffff816010c8 in printk (fmt=) at -kernel/printk/printk.c:1868 - #8 0xffffffffc00013ea in ?? () - #9 0x0000000000000000 in ?? () - -Mailing-list-thread: https://lkml.org/lkml/2015/8/4/755 -Signed-off-by: Jason A. Donenfeld -Signed-off-by: David Vrabel -Signed-off-by: Greg Kroah-Hartman - ---- - arch/x86/xen/Makefile | 4 ++-- - arch/x86/xen/xen-ops.h | 6 ++---- - 2 files changed, 4 insertions(+), 6 deletions(-) - ---- a/arch/x86/xen/Makefile -+++ b/arch/x86/xen/Makefile -@@ -13,13 +13,13 @@ CFLAGS_mmu.o := $(nostackp) - obj-y := enlighten.o setup.o multicalls.o mmu.o irq.o \ - time.o xen-asm.o xen-asm_$(BITS).o \ - grant-table.o suspend.o platform-pci-unplug.o \ -- p2m.o -+ p2m.o apic.o - - obj-$(CONFIG_EVENT_TRACING) += trace.o - - obj-$(CONFIG_SMP) += smp.o - obj-$(CONFIG_PARAVIRT_SPINLOCKS)+= spinlock.o - obj-$(CONFIG_XEN_DEBUG_FS) += debugfs.o --obj-$(CONFIG_XEN_DOM0) += apic.o vga.o -+obj-$(CONFIG_XEN_DOM0) += vga.o - obj-$(CONFIG_SWIOTLB_XEN) += pci-swiotlb-xen.o - obj-$(CONFIG_XEN_EFI) += efi.o ---- a/arch/x86/xen/xen-ops.h -+++ b/arch/x86/xen/xen-ops.h -@@ -101,17 +101,15 @@ struct dom0_vga_console_info; - - #ifdef CONFIG_XEN_DOM0 - void __init xen_init_vga(const struct dom0_vga_console_info *, size_t size); --void __init xen_init_apic(void); - #else - static inline void __init xen_init_vga(const struct dom0_vga_console_info *info, - size_t size) - { - } --static inline void __init xen_init_apic(void) --{ --} - #endif - -+void __init xen_init_apic(void); -+ - #ifdef CONFIG_XEN_EFI - extern void xen_efi_init(void); - #else diff --git a/kernel/kernel/files/patches/mageia/stable-xen-blkback-replace-work_pending-with-work_busy-in-purge_persistent_gnt.patch b/kernel/kernel/files/patches/mageia/stable-xen-blkback-replace-work_pending-with-work_busy-in-purge_persistent_gnt.patch deleted file mode 100644 index 770bcb0a..00000000 --- a/kernel/kernel/files/patches/mageia/stable-xen-blkback-replace-work_pending-with-work_busy-in-purge_persistent_gnt.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 53bc7dc004fecf39e0ba70f2f8d120a1444315d3 Mon Sep 17 00:00:00 2001 -From: Bob Liu -Date: Wed, 22 Jul 2015 14:40:10 +0800 -Subject: xen-blkback: replace work_pending with work_busy in purge_persistent_gnt() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Bob Liu - -commit 53bc7dc004fecf39e0ba70f2f8d120a1444315d3 upstream. - -The BUG_ON() in purge_persistent_gnt() will be triggered when previous purge -work haven't finished. - -There is a work_pending() before this BUG_ON, but it doesn't account if the work -is still currently running. - -Acked-by: Roger Pau Monné -Signed-off-by: Bob Liu -Signed-off-by: Konrad Rzeszutek Wilk -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/block/xen-blkback/blkback.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/block/xen-blkback/blkback.c -+++ b/drivers/block/xen-blkback/blkback.c -@@ -362,8 +362,8 @@ static void purge_persistent_gnt(struct - return; - } - -- if (work_pending(&blkif->persistent_purge_work)) { -- pr_alert_ratelimited("Scheduled work from previous purge is still pending, cannot purge list\n"); -+ if (work_busy(&blkif->persistent_purge_work)) { -+ pr_alert_ratelimited("Scheduled work from previous purge is still busy, cannot purge list\n"); - return; - } - diff --git a/kernel/kernel/files/patches/mageia/stable-xen-blkfront-don-t-add-indirect-pages-to-list-when.patch b/kernel/kernel/files/patches/mageia/stable-xen-blkfront-don-t-add-indirect-pages-to-list-when.patch deleted file mode 100644 index aeb4f074..00000000 --- a/kernel/kernel/files/patches/mageia/stable-xen-blkfront-don-t-add-indirect-pages-to-list-when.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 7b0767502b5db11cb1f0daef2d01f6d71b1192dc Mon Sep 17 00:00:00 2001 -From: Bob Liu -Date: Wed, 22 Jul 2015 14:40:09 +0800 -Subject: xen-blkfront: don't add indirect pages to list when - !feature_persistent -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Bob Liu - -commit 7b0767502b5db11cb1f0daef2d01f6d71b1192dc upstream. - -We should consider info->feature_persistent when adding indirect page to list -info->indirect_pages, else the BUG_ON() in blkif_free() would be triggered. - -When we are using persistent grants the indirect_pages list -should always be empty because blkfront has pre-allocated enough -persistent pages to fill all requests on the ring. - -Acked-by: Roger Pau Monné -Signed-off-by: Bob Liu -Signed-off-by: Konrad Rzeszutek Wilk -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/block/xen-blkfront.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - ---- a/drivers/block/xen-blkfront.c -+++ b/drivers/block/xen-blkfront.c -@@ -1118,8 +1118,10 @@ static void blkif_completion(struct blk_ - * Add the used indirect page back to the list of - * available pages for indirect grefs. - */ -- indirect_page = pfn_to_page(s->indirect_grants[i]->pfn); -- list_add(&indirect_page->lru, &info->indirect_pages); -+ if (!info->feature_persistent) { -+ indirect_page = pfn_to_page(s->indirect_grants[i]->pfn); -+ list_add(&indirect_page->lru, &info->indirect_pages); -+ } - s->indirect_grants[i]->gref = GRANT_INVALID_REF; - list_add_tail(&s->indirect_grants[i]->node, &info->grants); - } diff --git a/kernel/kernel/files/patches/mageia/stable-xen-xenbus-don-t-leak-memory-when-unmapping-the-ring-on-hvm-backend.patch b/kernel/kernel/files/patches/mageia/stable-xen-xenbus-don-t-leak-memory-when-unmapping-the-ring-on-hvm-backend.patch deleted file mode 100644 index 68e0e3e1..00000000 --- a/kernel/kernel/files/patches/mageia/stable-xen-xenbus-don-t-leak-memory-when-unmapping-the-ring-on-hvm-backend.patch +++ /dev/null @@ -1,40 +0,0 @@ -From c22fe519e7e2b94ad173e0ea3b89c1a7d8be8d00 Mon Sep 17 00:00:00 2001 -From: Julien Grall -Date: Mon, 10 Aug 2015 19:10:38 +0100 -Subject: xen/xenbus: Don't leak memory when unmapping the ring on HVM backend - -From: Julien Grall - -commit c22fe519e7e2b94ad173e0ea3b89c1a7d8be8d00 upstream. - -The commit ccc9d90a9a8b5c4ad7e9708ec41f75ff9e98d61d "xenbus_client: -Extend interface to support multi-page ring" removes the call to -free_xenballooned_pages() in xenbus_unmap_ring_vfree_hvm(), leaking a -page for every shared ring. - -Only with backends running in HVM domains were affected. - -Signed-off-by: Julien Grall -Reviewed-by: Boris Ostrovsky -Reviewed-by: Wei Liu -Signed-off-by: David Vrabel -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/xen/xenbus/xenbus_client.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/drivers/xen/xenbus/xenbus_client.c -+++ b/drivers/xen/xenbus/xenbus_client.c -@@ -814,8 +814,10 @@ static int xenbus_unmap_ring_vfree_hvm(s - - rv = xenbus_unmap_ring(dev, node->handles, node->nr_handles, - addrs); -- if (!rv) -+ if (!rv) { - vunmap(vaddr); -+ free_xenballooned_pages(node->nr_handles, node->hvm.pages); -+ } - else - WARN(1, "Leaking %p, size %u page(s)\n", vaddr, - node->nr_handles); diff --git a/kernel/kernel/files/patches/mageia/stable-xfs-fix-file-type-directory-corruption-for-btree-directories.patch b/kernel/kernel/files/patches/mageia/stable-xfs-fix-file-type-directory-corruption-for-btree-directories.patch new file mode 100644 index 00000000..1db4d92a --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-xfs-fix-file-type-directory-corruption-for-btree-directories.patch @@ -0,0 +1,65 @@ +From 037542345a82aaaa228ec280fe6ddff1568d169f Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Tue, 25 Aug 2015 10:05:13 +1000 +Subject: xfs: Fix file type directory corruption for btree directories + +From: Jan Kara + +commit 037542345a82aaaa228ec280fe6ddff1568d169f upstream. + +Users have occasionally reported that file type for some directory +entries is wrong. This mostly happened after updating libraries some +libraries. After some debugging the problem was traced down to +xfs_dir2_node_replace(). The function uses args->filetype as a file type +to store in the replaced directory entry however it also calls +xfs_da3_node_lookup_int() which will store file type of the current +directory entry in args->filetype. Thus we fail to change file type of a +directory entry to a proper type. + +Fix the problem by storing new file type in a local variable before +calling xfs_da3_node_lookup_int(). + +Reported-by: Giacomo Comes +Signed-off-by: Jan Kara +Reviewed-by: Dave Chinner +Signed-off-by: Dave Chinner +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/libxfs/xfs_dir2_node.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/fs/xfs/libxfs/xfs_dir2_node.c ++++ b/fs/xfs/libxfs/xfs_dir2_node.c +@@ -2132,6 +2132,7 @@ xfs_dir2_node_replace( + int error; /* error return value */ + int i; /* btree level */ + xfs_ino_t inum; /* new inode number */ ++ int ftype; /* new file type */ + xfs_dir2_leaf_t *leaf; /* leaf structure */ + xfs_dir2_leaf_entry_t *lep; /* leaf entry being changed */ + int rval; /* internal return value */ +@@ -2145,7 +2146,14 @@ xfs_dir2_node_replace( + state = xfs_da_state_alloc(); + state->args = args; + state->mp = args->dp->i_mount; ++ ++ /* ++ * We have to save new inode number and ftype since ++ * xfs_da3_node_lookup_int() is going to overwrite them ++ */ + inum = args->inumber; ++ ftype = args->filetype; ++ + /* + * Lookup the entry to change in the btree. + */ +@@ -2183,7 +2191,7 @@ xfs_dir2_node_replace( + * Fill in the new inode number and log the entry. + */ + dep->inumber = cpu_to_be64(inum); +- args->dp->d_ops->data_put_ftype(dep, args->filetype); ++ args->dp->d_ops->data_put_ftype(dep, ftype); + xfs_dir2_data_log_entry(args, state->extrablk.bp, dep); + rval = 0; + } diff --git a/kernel/kernel/files/patches/mageia/stable-xfs-fix-xfs_attr_leafblock-definition.patch b/kernel/kernel/files/patches/mageia/stable-xfs-fix-xfs_attr_leafblock-definition.patch new file mode 100644 index 00000000..f6edaf25 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-xfs-fix-xfs_attr_leafblock-definition.patch @@ -0,0 +1,47 @@ +From ffeecc5213024ae663377b442eedcfbacf6d0c5d Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 19 Aug 2015 10:34:32 +1000 +Subject: xfs: Fix xfs_attr_leafblock definition + +From: Jan Kara + +commit ffeecc5213024ae663377b442eedcfbacf6d0c5d upstream. + +struct xfs_attr_leafblock contains 'entries' array which is declared +with size 1 altough it can in fact contain much more entries. Since this +array is followed by further struct members, gcc (at least in version +4.8.3) thinks that the array has the fixed size of 1 element and thus +may optimize away all accesses beyond the end of array resulting in +non-working code. This problem was only observed with userspace code in +xfsprogs, however it's better to be safe in kernel as well and have +matching kernel and xfsprogs definitions. + +Signed-off-by: Jan Kara +Reviewed-by: Dave Chinner +Signed-off-by: Dave Chinner +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/libxfs/xfs_da_format.h | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/fs/xfs/libxfs/xfs_da_format.h ++++ b/fs/xfs/libxfs/xfs_da_format.h +@@ -680,8 +680,15 @@ typedef struct xfs_attr_leaf_name_remote + typedef struct xfs_attr_leafblock { + xfs_attr_leaf_hdr_t hdr; /* constant-structure header block */ + xfs_attr_leaf_entry_t entries[1]; /* sorted on key, not name */ +- xfs_attr_leaf_name_local_t namelist; /* grows from bottom of buf */ +- xfs_attr_leaf_name_remote_t valuelist; /* grows from bottom of buf */ ++ /* ++ * The rest of the block contains the following structures after the ++ * leaf entries, growing from the bottom up. The variables are never ++ * referenced and definining them can actually make gcc optimize away ++ * accesses to the 'entries' array above index 0 so don't do that. ++ * ++ * xfs_attr_leaf_name_local_t namelist; ++ * xfs_attr_leaf_name_remote_t valuelist; ++ */ + } xfs_attr_leafblock_t; + + /* diff --git a/kernel/kernel/files/patches/mageia/x86-apic-Fix-fallout-from-x2apic-cleanup.patch b/kernel/kernel/files/patches/mageia/x86-apic-Fix-fallout-from-x2apic-cleanup.patch deleted file mode 100644 index 6899f63a..00000000 --- a/kernel/kernel/files/patches/mageia/x86-apic-Fix-fallout-from-x2apic-cleanup.patch +++ /dev/null @@ -1,81 +0,0 @@ -From a57e456a7b28431b55e407e5ab78ebd5b378d19e Mon Sep 17 00:00:00 2001 -From: Thomas Gleixner -Date: Sat, 22 Aug 2015 16:41:17 +0200 -Subject: [PATCH] x86/apic: Fix fallout from x2apic cleanup - -In the recent x2apic cleanup I got two things really wrong: -1) The safety check in __disable_x2apic which allows the function to - be called unconditionally is backwards. The check is there to - prevent access to the apic MSR in case that the machine has no - apic. Though right now it returns if the machine has an apic and - therefor the disabling of x2apic is never invoked. - -2) x2apic_disable() sets x2apic_mode to 0 after registering the local - apic. That's wrong, because register_lapic_address() checks x2apic - mode and therefor takes the wrong code path. - -This results in boot failures on machines with x2apic preenabled by -BIOS and can also lead to an fatal MSR access on machines without -apic. - -The solutions are simple: -1) Correct the sanity check for apic availability -2) Clear x2apic_mode _before_ calling register_lapic_address() - -Fixes: 659006bf3ae3 'x86/x2apic: Split enable and setup function' -Reported-and-tested-by: Javier Monteagudo -Signed-off-by: Thomas Gleixner -Link: https://bugzilla.redhat.com/show_bug.cgi?id=1224764 -Cc: stable@vger.kernel.org # 4.0+ -Cc: Laura Abbott -Cc: Jiang Liu -Cc: Joerg Roedel -Cc: Tony Luck -Cc: Borislav Petkov ---- - arch/x86/kernel/apic/apic.c | 14 +++++++------- - 1 file changed, 7 insertions(+), 7 deletions(-) - -diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c -index dcb5285..cde732c 100644 ---- a/arch/x86/kernel/apic/apic.c -+++ b/arch/x86/kernel/apic/apic.c -@@ -1424,7 +1424,7 @@ static inline void __x2apic_disable(void) - { - u64 msr; - -- if (cpu_has_apic) -+ if (!cpu_has_apic) - return; - - rdmsrl(MSR_IA32_APICBASE, msr); -@@ -1483,10 +1483,13 @@ void x2apic_setup(void) - - static __init void x2apic_disable(void) - { -- u32 x2apic_id; -+ u32 x2apic_id, state = x2apic_state; - -- if (x2apic_state != X2APIC_ON) -- goto out; -+ x2apic_mode = 0; -+ x2apic_state = X2APIC_DISABLED; -+ -+ if (state != X2APIC_ON) -+ return; - - x2apic_id = read_apic_id(); - if (x2apic_id >= 255) -@@ -1494,9 +1497,6 @@ static __init void x2apic_disable(void) - - __x2apic_disable(); - register_lapic_address(mp_lapic_addr); --out: -- x2apic_state = X2APIC_DISABLED; -- x2apic_mode = 0; - } - - static __init void x2apic_enable(void) --- -2.4.5 - diff --git a/kernel/kernel/files/patches/mageia/x86-idle-Restore-trace_cpu_idle-to-mwait_idle-calls.patch b/kernel/kernel/files/patches/mageia/x86-idle-Restore-trace_cpu_idle-to-mwait_idle-calls.patch deleted file mode 100644 index ee6f69f6..00000000 --- a/kernel/kernel/files/patches/mageia/x86-idle-Restore-trace_cpu_idle-to-mwait_idle-calls.patch +++ /dev/null @@ -1,46 +0,0 @@ -From e43d0189ac02415fe4487f79fc35e8f147e9ea0d Mon Sep 17 00:00:00 2001 -From: Jisheng Zhang -Date: Thu, 20 Aug 2015 12:54:39 +0800 -Subject: [PATCH] x86/idle: Restore trace_cpu_idle to mwait_idle() calls - -Commit b253149b843f ("sched/idle/x86: Restore mwait_idle() to fix boot -hangs, to improve power savings and to improve performance") restores -mwait_idle(), but the trace_cpu_idle related calls are missing. This -causes powertop on my old desktop powered by Intel Core2 E6550 to -report zero wakeups and zero events. - -Add them back to restore the proper behaviour. - -Fixes: b253149b843f ("sched/idle/x86: Restore mwait_idle() to ...") -Signed-off-by: Jisheng Zhang -Cc: -Cc: stable@vger.kernel.org # 4.1 -Link: http://lkml.kernel.org/r/1440046479-4262-1-git-send-email-jszhang@marvell.com -Signed-off-by: Thomas Gleixner ---- - arch/x86/kernel/process.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c -index 397688b..c27cad7 100644 ---- a/arch/x86/kernel/process.c -+++ b/arch/x86/kernel/process.c -@@ -408,6 +408,7 @@ static int prefer_mwait_c1_over_halt(const struct cpuinfo_x86 *c) - static void mwait_idle(void) - { - if (!current_set_polling_and_test()) { -+ trace_cpu_idle_rcuidle(1, smp_processor_id()); - if (this_cpu_has(X86_BUG_CLFLUSH_MONITOR)) { - smp_mb(); /* quirk */ - clflush((void *)¤t_thread_info()->flags); -@@ -419,6 +420,7 @@ static void mwait_idle(void) - __sti_mwait(0, 0); - else - local_irq_enable(); -+ trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id()); - } else { - local_irq_enable(); - } --- -2.4.5 - diff --git a/kernel/kernel/pspec.xml b/kernel/kernel/pspec.xml index babc173e..485dd269 100644 --- a/kernel/kernel/pspec.xml +++ b/kernel/kernel/pspec.xml @@ -1,4 +1,4 @@ -i + @@ -29,8 +29,8 @@ i - patches/linux/patch-4.1.6.xz - + patches/linux/patch-4.1.7.xz + patches/mageia/x86-pci-toshiba-equium-a60-assign-busses.patch patches/mageia/x86-boot-video-80x25-if-break.patch patches/mageia/x86-default_poweroff_up_machines.patch @@ -53,8 +53,6 @@ i patches/mageia/dm-raid-aliases.patch patches/mageia/block-floppy-disable-pnp-modalias.patch patches/mageia/ata-prefer-ata-drivers-over-ide-drivers-when-both-are-built.patch - patches/mageia/ata-revert-Disabling-the-async-PM-for-JMicron-chip-363-361.patch - patches/mageia/ata-jmicron-disable-broken-async_suspend.patch patches/mageia/block-Make-CFQ-default-to-IOPS-mode-on-SSDs.patch patches/mageia/block-cfq-iosched-fix-the-setting-of-IOPS-mode-on-SSDs.patch patches/mageia/fs-aufs4.patch @@ -124,16 +122,10 @@ i patches/mageia/3rd-rtl8723bs.patch patches/mageia/3rd-rtl8723bs-buildfix.patch patches/mageia/3rd-rtl8723bs-updates.patch - patches/mageia/Revert-sched-x86_64-Don-t-save-flags-on-context-swit.patch - patches/mageia/SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch - patches/mageia/ata-Revert-libata-eh-Set-information-field-for-autosense.patch - patches/mageia/ata-Revert-libata-Implement-support-for-sense-data-repor.patch - patches/mageia/ata-Revert-libata-Implement-NCQ-autosense.patch patches/mageia/fs-Revert-ext4-remove-block_device_ejected.patch - patches/mageia/gpu-drm-i915-remove-HBR2-from-chv-supported-list.patch - patches/mageia/gpu-drm-i915-Avoid-TP3-on-CHV.patch - patches/mageia/x86-apic-Fix-fallout-from-x2apic-cleanup.patch - patches/mageia/x86-idle-Restore-trace_cpu_idle-to-mwait_idle-calls.patch + patches/mageia/Input-evdev-do-not-report-errors-form-flush.patch + patches/mageia/scsi-Fix-NULL-pointer-dereference-in-RTPM-of-block-layer.patch + patches/mageia/scsi-Revert-SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch @@ -188,14 +180,14 @@ i - + 2015-09-05 4.1.6