Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1315368 > unrolled thread

[3.13.y-ckt stable] Linux 3.13.11-ckt33 stable review

Back to article view | Back to linux.kernel

Contents

  [3.13.y-ckt stable] Linux 3.13.11-ckt33 stable review Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 086/108] x86/mce: Ensure offline CPUs don't participate in rendezvous process Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 053/108] xhci: fix usb2 resume timing and races. Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 009/108] sh_eth: fix kernel oops in skb_put() Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 093/108] async_tx: use GFP_NOWAIT rather than GFP_IO Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 102/108] pinctrl: bcm2835: Fix initial value for direction_output Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 105/108] qlcnic: fix a timeout loop Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 095/108] ftrace/module: Call clean up function when module init fails early Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 088/108] ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2) Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 107/108] include/linux/mmdebug.h: should include linux/bug.h Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 090/108] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 075/108] xen-netback: use RING_COPY_REQUEST() throughout Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 096/108] vmstat: allocate vmstat_wq before it is used Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 103/108] mISDN: fix a loop count Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 092/108] tracing: Fix setting of start_index in find_next() Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 099/108] ipv6/addrlabel: fix ip6addrlbl_get() Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 091/108] ftrace/scripts: Fix incorrect use of sprintf in recordmcount Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 077/108] xen-blkback: read from indirect descriptors only once Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:40 +0100
    [PATCH 3.13.y-ckt 057/108] mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 076/108] xen-blkback: only read request operation from shared ring once Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 050/108] ses: Fix problems with simple enclosures Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 059/108] drivers/base/memory.c: prohibit offlining of memory blocks with missing sections Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 049/108] dm btree: fix bufio buffer leaks in dm_btree_del() error path Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 052/108] ses: fix additional element traversal bug Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 073/108] xen: Add RING_COPY_REQUEST() Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 072/108] s390/dis: Fix handling of format specifiers Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 070/108] ARC: dw2 unwind: Ignore CIE version !=1 gracefully instead of bailing Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 045/108] dm space map metadata: fix ref counting bug when bootstrapping a new space map Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 071/108] ALSA: hda - Set SKL+ hda controller power at freeze() and thaw() Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 068/108] ftrace/scripts: Have recordmcount copy the object file Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 066/108] spi: fix parent-device reference leak Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 064/108] ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 058/108] mm: hugetlb: call huge_pte_alloc() only if ptep is null Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 062/108] tty: Fix GPF in flush_to_ldisc() Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 082/108] xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled. Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 081/108] xen/pciback: Do not install an IRQ handler for MSI interrupts. Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 054/108] USB: add quirk for devices with broken LPM Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 083/108] xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set. Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 051/108] vgaarb: fix signal handling in vga_get() Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 046/108] ipmi: move timer init to before irq is setup Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 069/108] ARC: dw2 unwind: Reinstante unwinding out of modules Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 074/108] xen-netback: don't use last request to determine minimum Tx credit Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 063/108] genirq: Prevent chip buslock deadlock Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 060/108] sh64: fix __NR_fgetxattr Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 048/108] rfkill: copy the name into the rfkill struct Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 078/108] xen/pciback: Save xen_pci_op commands before processing it Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 079/108] xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 061/108] n_tty: Fix poll() after buffer-limited eof push read Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 056/108] parisc iommu: fix panic due to trying to allocate too large region Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 055/108] powercap / RAPL: fix BIOS lock check Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 080/108] xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled Kamal Mostafa <kamal@canonical.com> - 2016-01-23 00:50 +0100
    [PATCH 3.13.y-ckt 022/108] USB: cdc_acm: Ignore Infineon Flash Loader utility Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 015/108] tools: Add a "make all" rule Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 020/108] iio: fix some warning messages Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 031/108] irqchip/versatile-fpga: Fix PCI IRQ mapping on Versatile PB Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 014/108] KVM: x86: Reload pit counters for all channels when restoring state Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 026/108] drm/ttm: Fixed a read/write lock imbalance Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 023/108] USB: serial: Another Infineon flash loader USB ID Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 042/108] radeon/cik: Fix GFX IB test on Big-Endian Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 025/108] jbd2: Fix unreclaimed pages after truncate in data=journal mode Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 021/108] USB: cp210x: Remove CP2110 ID from compatibility list Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 038/108] ALSA: rme96: Fix unexpected volume reset after rate changes Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 017/108] net: ipmr: fix static mfc/dev leaks on table destruction Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 036/108] SCSI: Fix NULL pointer dereference in runtime PM Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 007/108] ipv6: sctp: clone options to avoid use after free Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 018/108] fuse: break infinite loop in fuse_fill_write_pages() Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 041/108] 9p: ->evict_inode() should kick out ->i_data, not ->i_mapping Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 029/108] sata_sil: disable trim Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 040/108] virtio: fix memory leak of virtio ida cache layers Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 010/108] pptp: verify sockaddr_len in pptp_bind() and pptp_connect() Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 043/108] crypto: skcipher - Copy iv from desc even for 0-len walks Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 019/108] usb: gadget: pxa27x: fix suspend callback Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 030/108] staging: lustre: echo_copy.._lsm() dereferences userland pointers directly Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 037/108] usb: xhci: fix config fail of FS hub behind a HS hub with MTT Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 034/108] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 027/108] i2c: mv64xxx: The n clockdiv factor is 0 based on sunxi SoCs Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 035/108] dm btree: fix leak of bufio-backed block in btree_split_sibling error path Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 033/108] USB: whci-hcd: add check for dma mapping error Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 016/108] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 008/108] net: add validation for the socket syscall protocol argument Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 028/108] AHCI: Fix softreset failed issue of Port Multiplier Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 044/108] dm thin metadata: fix bug when taking a metadata snapshot Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 011/108] bluetooth: Validate socket address length in sco_sock_bind(). Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 012/108] af_unix: Revert 'lock_interruptible' in stream receive code Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:00 +0100
    [PATCH 3.13.y-ckt 005/108] sctp: use the same clock as if sock source timestamps were on Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:10 +0100
    [PATCH 3.13.y-ckt 003/108] gre6: allow to update all parameters via rtnl Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:10 +0100
    [PATCH 3.13.y-ckt 004/108] atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:10 +0100
    [PATCH 3.13.y-ckt 001/108] ARC: Fix silly typo in MAINTAINERS file Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:10 +0100
    [PATCH 3.13.y-ckt 006/108] sctp: update the netstamp_needed counter when copying sockets Kamal Mostafa <kamal@canonical.com> - 2016-01-23 01:10 +0100

Page 3 of 5 — ← Prev page 1 2 [3] 4 5  Next page →

#1315410 — [PATCH 3.13.y-ckt 069/108] ARC: dw2 unwind: Reinstante unwinding out of modules

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Vineet Gupta <vgupta@synopsys.com>

commit bc79c9a7216562a2035d2f64f73626613c1300d0 upstream.

The fix which removed linear searching of dwarf (because binary lookup
data always exists) missed out on the fact that modules don't get the
binary lookup tables info. This caused unwinding out of modules to stop
working.

So add binary lookup header setup (equivalent of eh_frame_hdr setup) to
modules as well.

While at it, confine the header setup to within unwinder code,
reducing one API exposed out of unwinder code.

Fixes: 2e22502c080f ARC: dw2 unwind: Remove falllback linear search thru FDE entries
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/arc/include/asm/unwind.h |  4 ----
 arch/arc/kernel/setup.c       |  1 -
 arch/arc/kernel/unwind.c      | 40 ++++++++++++++++++++++++++--------------
 3 files changed, 26 insertions(+), 19 deletions(-)

diff --git a/arch/arc/include/asm/unwind.h b/arch/arc/include/asm/unwind.h
index 7ca628b..c11a25b 100644
--- a/arch/arc/include/asm/unwind.h
+++ b/arch/arc/include/asm/unwind.h
@@ -112,7 +112,6 @@ struct unwind_frame_info {
 
 extern int arc_unwind(struct unwind_frame_info *frame);
 extern void arc_unwind_init(void);
-extern void arc_unwind_setup(void);
 extern void *unwind_add_table(struct module *module, const void *table_start,
 			      unsigned long table_size);
 extern void unwind_remove_table(void *handle, int init_only);
@@ -152,9 +151,6 @@ static inline void arc_unwind_init(void)
 {
 }
 
-static inline void arc_unwind_setup(void)
-{
-}
 #define unwind_add_table(a, b, c)
 #define unwind_remove_table(a, b)
 
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 643eae4..8cf1cfc 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -356,7 +356,6 @@ void __init setup_arch(char **cmdline_p)
 #endif
 
 	arc_unwind_init();
-	arc_unwind_setup();
 }
 
 static int __init customize_machine(void)
diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
index 2d6a36e..5c1d071 100644
--- a/arch/arc/kernel/unwind.c
+++ b/arch/arc/kernel/unwind.c
@@ -170,6 +170,23 @@ static struct unwind_table *find_table(unsigned long pc)
 
 static unsigned long read_pointer(const u8 **pLoc,
 				  const void *end, signed ptrType);
+static void init_unwind_hdr(struct unwind_table *table,
+			    void *(*alloc) (unsigned long));
+
+/*
+ * wrappers for header alloc (vs. calling one vs. other at call site)
+ * to elide section mismatches warnings
+ */
+static void *__init unw_hdr_alloc_early(unsigned long sz)
+{
+	return __alloc_bootmem_nopanic(sz, sizeof(unsigned int),
+				       MAX_DMA_ADDRESS);
+}
+
+static void *unw_hdr_alloc(unsigned long sz)
+{
+	return kmalloc(sz, GFP_KERNEL);
+}
 
 static void init_unwind_table(struct unwind_table *table, const char *name,
 			      const void *core_start, unsigned long core_size,
@@ -209,6 +226,8 @@ void __init arc_unwind_init(void)
 			  __start_unwind, __end_unwind - __start_unwind,
 			  NULL, 0);
 	  /*__start_unwind_hdr, __end_unwind_hdr - __start_unwind_hdr);*/
+
+	init_unwind_hdr(&root_table, unw_hdr_alloc_early);
 }
 
 static const u32 bad_cie, not_fde;
@@ -241,8 +260,8 @@ static void swap_eh_frame_hdr_table_entries(void *p1, void *p2, int size)
 	e2->fde = v;
 }
 
-static void __init setup_unwind_table(struct unwind_table *table,
-				      void *(*alloc) (unsigned long))
+static void init_unwind_hdr(struct unwind_table *table,
+			    void *(*alloc) (unsigned long))
 {
 	const u8 *ptr;
 	unsigned long tableSize = table->size, hdrSize;
@@ -300,9 +319,11 @@ static void __init setup_unwind_table(struct unwind_table *table,
 
 	hdrSize = 4 + sizeof(unsigned long) + sizeof(unsigned int)
 	    + 2 * n * sizeof(unsigned long);
+
 	header = alloc(hdrSize);
 	if (!header)
 		return;
+
 	header->version = 1;
 	header->eh_frame_ptr_enc = DW_EH_PE_abs | DW_EH_PE_native;
 	header->fde_count_enc = DW_EH_PE_abs | DW_EH_PE_data4;
@@ -342,18 +363,6 @@ static void __init setup_unwind_table(struct unwind_table *table,
 	table->header = (const void *)header;
 }
 
-static void *__init balloc(unsigned long sz)
-{
-	return __alloc_bootmem_nopanic(sz,
-				       sizeof(unsigned int),
-				       __pa(MAX_DMA_ADDRESS));
-}
-
-void __init arc_unwind_setup(void)
-{
-	setup_unwind_table(&root_table, balloc);
-}
-
 #ifdef CONFIG_MODULES
 
 static struct unwind_table *last_table;
@@ -377,6 +386,8 @@ void *unwind_add_table(struct module *module, const void *table_start,
 			  table_start, table_size,
 			  NULL, 0);
 
+	init_unwind_hdr(table, unw_hdr_alloc);
+
 #ifdef UNWIND_DEBUG
 	unw_debug("Table added for [%s] %lx %lx\n",
 		module->name, table->core.pc, table->core.range);
@@ -439,6 +450,7 @@ void unwind_remove_table(void *handle, int init_only)
 	info.init_only = init_only;
 
 	unlink_table(&info); /* XXX: SMP */
+	kfree(table->header);
 	kfree(table);
 }
 
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315411 — [PATCH 3.13.y-ckt 074/108] xen-netback: don't use last request to determine minimum Tx credit

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: David Vrabel <david.vrabel@citrix.com>

commit 0f589967a73f1f30ab4ac4dd9ce0bb399b4d6357 upstream.

The last from guest transmitted request gives no indication about the
minimum amount of credit that the guest might need to send a packet
since the last packet might have been a small one.

Instead allow for the worst case 128 KiB packet.

This is part of XSA155.

Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
[ kamal: backport to 3.13-stable: context ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/xen-netback/netback.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index b898c6b..7d76d28 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -716,9 +716,7 @@ static void tx_add_credit(struct xenvif *vif)
 	 * Allow a burst big enough to transmit a jumbo packet of up to 128kB.
 	 * Otherwise the interface can seize up due to insufficient credit.
 	 */
-	max_burst = RING_GET_REQUEST(&vif->tx, vif->tx.req_cons)->size;
-	max_burst = min(max_burst, 131072UL);
-	max_burst = max(max_burst, vif->credit_bytes);
+	max_burst = max(131072UL, vif->credit_bytes);
 
 	/* Take care that adding a new chunk of credit doesn't wrap to zero. */
 	max_credit = vif->remaining_credit + vif->credit_bytes;
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315412 — [PATCH 3.13.y-ckt 063/108] genirq: Prevent chip buslock deadlock

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Thomas Gleixner <tglx@linutronix.de>

commit abc7e40c81d113ef4bacb556f0a77ca63ac81d85 upstream.

If a interrupt chip utilizes chip->buslock then free_irq() can
deadlock in the following way:

CPU0				CPU1
				interrupt(X) (Shared or spurious)
free_irq(X)			interrupt_thread(X)
chip_bus_lock(X)
				   irq_finalize_oneshot(X)
				     chip_bus_lock(X)
synchronize_irq(X)

synchronize_irq() waits for the interrupt thread to complete,
i.e. forever.

Solution is simple: Drop chip_bus_lock() before calling
synchronize_irq() as we do with the irq_desc lock. There is nothing to
be protected after the point where irq_desc lock has been released.

This adds chip_bus_lock/unlock() to the remove_irq() code path, but
that's actually correct in the case where remove_irq() is called on
such an interrupt. The current users of remove_irq() are not affected
as none of those interrupts is on a chip which requires buslock.

Reported-by: Fredrik Markström <fredrik.markstrom@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 kernel/irq/manage.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index ebb8a9e..2c2e5e7 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1230,6 +1230,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
 	if (!desc)
 		return NULL;
 
+	chip_bus_lock(desc);
 	raw_spin_lock_irqsave(&desc->lock, flags);
 
 	/*
@@ -1243,7 +1244,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
 		if (!action) {
 			WARN(1, "Trying to free already-free IRQ %d\n", irq);
 			raw_spin_unlock_irqrestore(&desc->lock, flags);
-
+			chip_bus_sync_unlock(desc);
 			return NULL;
 		}
 
@@ -1266,6 +1267,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
 #endif
 
 	raw_spin_unlock_irqrestore(&desc->lock, flags);
+	chip_bus_sync_unlock(desc);
 
 	unregister_handler_proc(irq, action);
 
@@ -1339,9 +1341,7 @@ void free_irq(unsigned int irq, void *dev_id)
 		desc->affinity_notify = NULL;
 #endif
 
-	chip_bus_lock(desc);
 	kfree(__free_irq(irq, dev_id));
-	chip_bus_sync_unlock(desc);
 }
 EXPORT_SYMBOL(free_irq);
 
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315413 — [PATCH 3.13.y-ckt 060/108] sh64: fix __NR_fgetxattr

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: "Dmitry V. Levin" <ldv@altlinux.org>

commit 2d33fa1059da4c8e816627a688d950b613ec0474 upstream.

According to arch/sh/kernel/syscalls_64.S and common sense, __NR_fgetxattr
has to be defined to 259, but it doesn't.  Instead, it's defined to 269,
which is of course used by another syscall, __NR_sched_setaffinity in this
case.

This bug was found by strace test suite.

Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Acked-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/sh/include/uapi/asm/unistd_64.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sh/include/uapi/asm/unistd_64.h b/arch/sh/include/uapi/asm/unistd_64.h
index e6820c8..47ebd5b 100644
--- a/arch/sh/include/uapi/asm/unistd_64.h
+++ b/arch/sh/include/uapi/asm/unistd_64.h
@@ -278,7 +278,7 @@
 #define __NR_fsetxattr		256
 #define __NR_getxattr		257
 #define __NR_lgetxattr		258
-#define __NR_fgetxattr		269
+#define __NR_fgetxattr		259
 #define __NR_listxattr		260
 #define __NR_llistxattr		261
 #define __NR_flistxattr		262
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315414 — [PATCH 3.13.y-ckt 048/108] rfkill: copy the name into the rfkill struct

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Johannes Berg <johannes.berg@intel.com>

commit b7bb110008607a915298bf0f47d25886ecb94477 upstream.

Some users of rfkill, like NFC and cfg80211, use a dynamic name when
allocating rfkill, in those cases dev_name(). Therefore, the pointer
passed to rfkill_alloc() might not be valid forever, I specifically
found the case that the rfkill name was quite obviously an invalid
pointer (or at least garbage) when the wiphy had been renamed.

Fix this by making a copy of the rfkill name in rfkill_alloc().

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/rfkill/core.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 1bacc10..5a14f55 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -51,7 +51,6 @@
 struct rfkill {
 	spinlock_t		lock;
 
-	const char		*name;
 	enum rfkill_type	type;
 
 	unsigned long		state;
@@ -75,6 +74,7 @@ struct rfkill {
 	struct delayed_work	poll_work;
 	struct work_struct	uevent_work;
 	struct work_struct	sync_work;
+	char			name[];
 };
 #define to_rfkill(d)	container_of(d, struct rfkill, dev)
 
@@ -863,14 +863,14 @@ struct rfkill * __must_check rfkill_alloc(const char *name,
 	if (WARN_ON(type == RFKILL_TYPE_ALL || type >= NUM_RFKILL_TYPES))
 		return NULL;
 
-	rfkill = kzalloc(sizeof(*rfkill), GFP_KERNEL);
+	rfkill = kzalloc(sizeof(*rfkill) + strlen(name) + 1, GFP_KERNEL);
 	if (!rfkill)
 		return NULL;
 
 	spin_lock_init(&rfkill->lock);
 	INIT_LIST_HEAD(&rfkill->node);
 	rfkill->type = type;
-	rfkill->name = name;
+	strcpy(rfkill->name, name);
 	rfkill->ops = ops;
 	rfkill->data = ops_data;
 
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315415 — [PATCH 3.13.y-ckt 078/108] xen/pciback: Save xen_pci_op commands before processing it

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

commit 8135cf8b092723dbfcc611fe6fdcb3a36c9951c5 upstream.

Double fetch vulnerabilities that happen when a variable is
fetched twice from shared memory but a security check is only
performed the first time.

The xen_pcibk_do_op function performs a switch statements on the op->cmd
value which is stored in shared memory. Interestingly this can result
in a double fetch vulnerability depending on the performed compiler
optimization.

This patch fixes it by saving the xen_pci_op command before
processing it. We also use 'barrier' to make sure that the
compiler does not perform any optimization.

This is part of XSA155.

Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Jan Beulich <JBeulich@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/xen/xen-pciback/pciback.h     |  1 +
 drivers/xen/xen-pciback/pciback_ops.c | 15 ++++++++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/xen/xen-pciback/pciback.h b/drivers/xen/xen-pciback/pciback.h
index f72af87..560b3ec 100644
--- a/drivers/xen/xen-pciback/pciback.h
+++ b/drivers/xen/xen-pciback/pciback.h
@@ -37,6 +37,7 @@ struct xen_pcibk_device {
 	struct xen_pci_sharedinfo *sh_info;
 	unsigned long flags;
 	struct work_struct op_work;
+	struct xen_pci_op op;
 };
 
 struct xen_pcibk_dev_data {
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 64eb0cd..c58a8fc 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -298,9 +298,11 @@ void xen_pcibk_do_op(struct work_struct *data)
 		container_of(data, struct xen_pcibk_device, op_work);
 	struct pci_dev *dev;
 	struct xen_pcibk_dev_data *dev_data = NULL;
-	struct xen_pci_op *op = &pdev->sh_info->op;
+	struct xen_pci_op *op = &pdev->op;
 	int test_intx = 0;
 
+	*op = pdev->sh_info->op;
+	barrier();
 	dev = xen_pcibk_get_pci_dev(pdev, op->domain, op->bus, op->devfn);
 
 	if (dev == NULL)
@@ -342,6 +344,17 @@ void xen_pcibk_do_op(struct work_struct *data)
 		if ((dev_data->enable_intx != test_intx))
 			xen_pcibk_control_isr(dev, 0 /* no reset */);
 	}
+	pdev->sh_info->op.err = op->err;
+	pdev->sh_info->op.value = op->value;
+#ifdef CONFIG_PCI_MSI
+	if (op->cmd == XEN_PCI_OP_enable_msix && op->err == 0) {
+		unsigned int i;
+
+		for (i = 0; i < op->value; i++)
+			pdev->sh_info->op.msix_entries[i].vector =
+				op->msix_entries[i].vector;
+	}
+#endif
 	/* Tell the driver domain that we're done. */
 	wmb();
 	clear_bit(_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags);
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315416 — [PATCH 3.13.y-ckt 079/108] xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

commit 56441f3c8e5bd45aab10dd9f8c505dd4bec03b0d upstream.

The guest sequence of:

 a) XEN_PCI_OP_enable_msi
 b) XEN_PCI_OP_enable_msi
 c) XEN_PCI_OP_disable_msi

results in hitting an BUG_ON condition in the msi.c code.

The MSI code uses an dev->msi_list to which it adds MSI entries.
Under the above conditions an BUG_ON() can be hit. The device
passed in the guest MUST have MSI capability.

The a) adds the entry to the dev->msi_list and sets msi_enabled.
The b) adds a second entry but adding in to SysFS fails (duplicate entry)
and deletes all of the entries from msi_list and returns (with msi_enabled
is still set).  c) pci_disable_msi passes the msi_enabled checks and hits:

BUG_ON(list_empty(dev_to_msi_list(&dev->dev)));

and blows up.

The patch adds a simple check in the XEN_PCI_OP_enable_msi to guard
against that. The check for msix_enabled is not stricly neccessary.

This is part of XSA-157.

Reviewed-by: David Vrabel <david.vrabel@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/xen/xen-pciback/pciback_ops.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index c58a8fc..a036e05 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -144,7 +144,12 @@ int xen_pcibk_enable_msi(struct xen_pcibk_device *pdev,
 	if (unlikely(verbose_request))
 		printk(KERN_DEBUG DRV_NAME ": %s: enable MSI\n", pci_name(dev));
 
-	status = pci_enable_msi(dev);
+	if (dev->msi_enabled)
+		status = -EALREADY;
+	else if (dev->msix_enabled)
+		status = -ENXIO;
+	else
+		status = pci_enable_msi(dev);
 
 	if (status) {
 		pr_warn_ratelimited("%s: error enabling MSI for guest %u: err %d\n",
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315417 — [PATCH 3.13.y-ckt 061/108] n_tty: Fix poll() after buffer-limited eof push read

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Peter Hurley <peter@hurleysoftware.com>

commit ac8f3bf8832a405cc6e4dccb1d26d5cb2994d234 upstream.

commit 40d5e0905a03 ("n_tty: Fix EOF push handling") fixed EOF push
for reads. However, that approach still allows a condition mismatch
between poll() and read(), where poll() returns POLLIN but read()
blocks. This state can happen when a previous read() returned because
the user buffer was full and the next character was an EOF not at the
beginning of the line. While the next read() will properly identify
the condition and advance the read buffer tail without improperly
indicating an EOF file condition (ie., read() will not mistakenly
return 0), poll() will mistakenly indicate POLLIN.

Although a possible solution would be to peek at the input buffer
in n_tty_poll(), the better solution in this patch is to eat the
EOF during the previous read() (ie., fix the problem by eliminating
the condition).

The current canon line buffer copy limits the scan for next end-of-line
to the smaller of either,
   a. the remaining user buffer size
   b. completed lines in the input buffer
When the remaining user buffer size is exactly one less than the
end-of-line marked by EOF push, the EOF is not scanned nor skipped
but left for subsequent reads. In the example below, the scan
index 'eol' has stopped at the EOF because it is past the scan
limit of 5 (not because it has found the next set bit in read_flags)

   user buffer [*nr = 5]    _ _ _ _ _

   read_flags               0 0 0 0 0   1
   input buffer             h e l l o [EOF]
                            ^           ^
                           /           /
                         tail        eol

   result: found = 0, tail += 5, *nr += 5

Instead, allow the scan to peek ahead 1 byte (while still limiting the
scan to completed lines in the input buffer). For the example above,

   result: found = 1, tail += 6, *nr += 5

Because the scan limit is now bumped +1 byte, when the scan is
completed, the tail advance and the user buffer copy limit is
re-clamped to *nr when EOF is _not_ found.

Fixes: 40d5e0905a03 ("n_tty: Fix EOF push handling")
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
[ kamal: backported to 3.13: adjusted context ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/tty/n_tty.c | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index d40c9e3..efc4075 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2034,13 +2034,13 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
 	size_t eol;
 	size_t tail;
 	int ret, found = 0;
-	bool eof_push = 0;
 
 	/* N.B. avoid overrun if nr == 0 */
-	n = min(*nr, read_cnt(ldata));
-	if (!n)
+	if (!*nr)
 		return 0;
 
+	n = min(*nr + 1, read_cnt(ldata));
+
 	tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
 	size = min_t(size_t, tail + n, N_TTY_BUF_SIZE);
 
@@ -2061,12 +2061,11 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
 	n = eol - tail;
 	if (n > 4096)
 		n += 4096;
-	n += found;
-	c = n;
+	c = n + found;
 
-	if (found && read_buf(ldata, eol) == __DISABLED_CHAR) {
-		n--;
-		eof_push = !n && ldata->read_tail != ldata->line_start;
+	if (!found || read_buf(ldata, eol) != __DISABLED_CHAR) {
+		c = min(*nr, c);
+		n = c;
 	}
 
 	n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu size:%zu more:%zu\n",
@@ -2094,7 +2093,7 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
 		ldata->line_start = ldata->read_tail;
 		tty_audit_push(tty);
 	}
-	return eof_push ? -EAGAIN : 0;
+	return 0;
 }
 
 extern ssize_t redirected_tty_write(struct file *, const char __user *,
@@ -2282,10 +2281,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
 
 		if (ldata->icanon && !L_EXTPROC(tty)) {
 			retval = canon_copy_from_read_buf(tty, &b, &nr);
-			if (retval == -EAGAIN) {
-				retval = 0;
-				continue;
-			} else if (retval)
+			if (retval)
 				break;
 		} else {
 			int uncopied;
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315419 — [PATCH 3.13.y-ckt 056/108] parisc iommu: fix panic due to trying to allocate too large region

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Mikulas Patocka <mpatocka@redhat.com>

commit e46e31a3696ae2d66f32c207df3969613726e636 upstream.

When using the Promise TX2+ SATA controller on PA-RISC, the system often
crashes with kernel panic, for example just writing data with the dd
utility will make it crash.

Kernel panic - not syncing: drivers/parisc/sba_iommu.c: I/O MMU @ 000000000000a000 is out of mapping resources

CPU: 0 PID: 18442 Comm: mkspadfs Not tainted 4.4.0-rc2 #2
Backtrace:
 [<000000004021497c>] show_stack+0x14/0x20
 [<0000000040410bf0>] dump_stack+0x88/0x100
 [<000000004023978c>] panic+0x124/0x360
 [<0000000040452c18>] sba_alloc_range+0x698/0x6a0
 [<0000000040453150>] sba_map_sg+0x260/0x5b8
 [<000000000c18dbb4>] ata_qc_issue+0x264/0x4a8 [libata]
 [<000000000c19535c>] ata_scsi_translate+0xe4/0x220 [libata]
 [<000000000c19a93c>] ata_scsi_queuecmd+0xbc/0x320 [libata]
 [<0000000040499bbc>] scsi_dispatch_cmd+0xfc/0x130
 [<000000004049da34>] scsi_request_fn+0x6e4/0x970
 [<00000000403e95a8>] __blk_run_queue+0x40/0x60
 [<00000000403e9d8c>] blk_run_queue+0x3c/0x68
 [<000000004049a534>] scsi_run_queue+0x2a4/0x360
 [<000000004049be68>] scsi_end_request+0x1a8/0x238
 [<000000004049de84>] scsi_io_completion+0xfc/0x688
 [<0000000040493c74>] scsi_finish_command+0x17c/0x1d0

The cause of the crash is not exhaustion of the IOMMU space, there is
plenty of free pages. The function sba_alloc_range is called with size
0x11000, thus the pages_needed variable is 0x11. The function
sba_search_bitmap is called with bits_wanted 0x11 and boundary size is
0x10 (because dma_get_seg_boundary(dev) returns 0xffff).

The function sba_search_bitmap attempts to allocate 17 pages that must not
cross 16-page boundary - it can't satisfy this requirement
(iommu_is_span_boundary always returns true) and fails even if there are
many free entries in the IOMMU space.

How did it happen that we try to allocate 17 pages that don't cross
16-page boundary? The cause is in the function iommu_coalesce_chunks. This
function tries to coalesce adjacent entries in the scatterlist. The
function does several checks if it may coalesce one entry with the next,
one of those checks is this:

	if (startsg->length + dma_len > max_seg_size)
		break;

When it finishes coalescing adjacent entries, it allocates the mapping:

sg_dma_len(contig_sg) = dma_len;
dma_len = ALIGN(dma_len + dma_offset, IOVP_SIZE);
sg_dma_address(contig_sg) =
	PIDE_FLAG
	| (iommu_alloc_range(ioc, dev, dma_len) << IOVP_SHIFT)
	| dma_offset;

It is possible that (startsg->length + dma_len > max_seg_size) is false
(we are just near the 0x10000 max_seg_size boundary), so the funcion
decides to coalesce this entry with the next entry. When the coalescing
succeeds, the function performs
	dma_len = ALIGN(dma_len + dma_offset, IOVP_SIZE);
And now, because of non-zero dma_offset, dma_len is greater than 0x10000.
iommu_alloc_range (a pointer to sba_alloc_range) is called and it attempts
to allocate 17 pages for a device that must not cross 16-page boundary.

To fix the bug, we must make sure that dma_len after addition of
dma_offset and alignment doesn't cross the segment boundary. I.e. change
	if (startsg->length + dma_len > max_seg_size)
		break;
to
	if (ALIGN(dma_len + dma_offset + startsg->length, IOVP_SIZE) > max_seg_size)
		break;

This patch makes this change (it precalculates max_seg_boundary at the
beginning of the function iommu_coalesce_chunks). I also added a check
that the mapping length doesn't exceed dma_get_seg_boundary(dev) (it is
not needed for Promise TX2+ SATA, but it may be needed for other devices
that have dma_get_seg_boundary lower than dma_get_max_seg_size).

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/parisc/iommu-helpers.h | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
index 8c33491..c6aa388 100644
--- a/drivers/parisc/iommu-helpers.h
+++ b/drivers/parisc/iommu-helpers.h
@@ -104,7 +104,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev,
 	struct scatterlist *contig_sg;	   /* contig chunk head */
 	unsigned long dma_offset, dma_len; /* start/len of DMA stream */
 	unsigned int n_mappings = 0;
-	unsigned int max_seg_size = dma_get_max_seg_size(dev);
+	unsigned int max_seg_size = min(dma_get_max_seg_size(dev),
+					(unsigned)DMA_CHUNK_SIZE);
+	unsigned int max_seg_boundary = dma_get_seg_boundary(dev) + 1;
+	if (max_seg_boundary)	/* check if the addition above didn't overflow */
+		max_seg_size = min(max_seg_size, max_seg_boundary);
 
 	while (nents > 0) {
 
@@ -139,14 +143,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev,
 
 			/*
 			** First make sure current dma stream won't
-			** exceed DMA_CHUNK_SIZE if we coalesce the
+			** exceed max_seg_size if we coalesce the
 			** next entry.
 			*/   
-			if(unlikely(ALIGN(dma_len + dma_offset + startsg->length,
-					    IOVP_SIZE) > DMA_CHUNK_SIZE))
-				break;
-
-			if (startsg->length + dma_len > max_seg_size)
+			if (unlikely(ALIGN(dma_len + dma_offset + startsg->length, IOVP_SIZE) >
+				     max_seg_size))
 				break;
 
 			/*
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315420 — [PATCH 3.13.y-ckt 055/108] powercap / RAPL: fix BIOS lock check

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Prarit Bhargava <prarit@redhat.com>

commit 79a21dbfae3cd40d5a801778071a9967b79c2c20 upstream.

Intel RAPL initialized on several systems where the BIOS lock bit (msr
0x610, bit 63) was set.  This occured because the return value of
rapl_read_data_raw() was being checked, rather than the value of the variable
passed in, locked.

This patch properly implments the rapl_read_data_raw() call to check the
variable locked, and now the Intel RAPL driver outputs the warning:

	intel_rapl: RAPL package 0 domain package locked by BIOS

and does not initialize for the package.

Signed-off-by: Prarit Bhargava <prarit@redhat.com>
Acked-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/powercap/intel_rapl.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
index 3c67683..4048d7f 100644
--- a/drivers/powercap/intel_rapl.c
+++ b/drivers/powercap/intel_rapl.c
@@ -1194,10 +1194,13 @@ static int rapl_detect_domains(struct rapl_package *rp, int cpu)
 
 	for (rd = rp->domains; rd < rp->domains + rp->nr_domains; rd++) {
 		/* check if the domain is locked by BIOS */
-		if (rapl_read_data_raw(rd, FW_LOCK, false, &locked)) {
+		ret = rapl_read_data_raw(rd, FW_LOCK, false, &locked);
+		if (ret)
+			return ret;
+		if (locked) {
 			pr_info("RAPL package %d domain %s locked by BIOS\n",
 				rp->id, rd->name);
-				rd->state |= DOMAIN_STATE_BIOS_LOCKED;
+			rd->state |= DOMAIN_STATE_BIOS_LOCKED;
 		}
 	}
 
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315421 — [PATCH 3.13.y-ckt 080/108] xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

commit 5e0ce1455c09dd61d029b8ad45d82e1ac0b6c4c9 upstream.

The guest sequence of:

  a) XEN_PCI_OP_enable_msix
  b) XEN_PCI_OP_enable_msix

results in hitting an NULL pointer due to using freed pointers.

The device passed in the guest MUST have MSI-X capability.

The a) constructs and SysFS representation of MSI and MSI groups.
The b) adds a second set of them but adding in to SysFS fails (duplicate entry).
'populate_msi_sysfs' frees the newly allocated msi_irq_groups (note that
in a) pdev->msi_irq_groups is still set) and also free's ALL of the
MSI-X entries of the device (the ones allocated in step a) and b)).

The unwind code: 'free_msi_irqs' deletes all the entries and tries to
delete the pdev->msi_irq_groups (which hasn't been set to NULL).
However the pointers in the SysFS are already freed and we hit an
NULL pointer further on when 'strlen' is attempted on a freed pointer.

The patch adds a simple check in the XEN_PCI_OP_enable_msix to guard
against that. The check for msi_enabled is not stricly neccessary.

This is part of XSA-157

Reviewed-by: David Vrabel <david.vrabel@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/xen/xen-pciback/pciback_ops.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index a036e05..564d9d1 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -206,9 +206,16 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
 	if (unlikely(verbose_request))
 		printk(KERN_DEBUG DRV_NAME ": %s: enable MSI-X\n",
 		       pci_name(dev));
+
 	if (op->value > SH_INFO_MAX_VEC)
 		return -EINVAL;
 
+	if (dev->msix_enabled)
+		return -EALREADY;
+
+	if (dev->msi_enabled)
+		return -ENXIO;
+
 	entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL);
 	if (entries == NULL)
 		return -ENOMEM;
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315422 — [PATCH 3.13.y-ckt 022/108] USB: cdc_acm: Ignore Infineon Flash Loader utility

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Jonas Jonsson <jonas@ludd.ltu.se>

commit f33a7f72e5fc033daccbb8d4753d7c5c41a4d67b upstream.

Some modems, such as the Telit UE910, are using an Infineon Flash Loader
utility. It has two interfaces, 2/2/0 (Abstract Modem) and 10/0/0 (CDC
Data). The latter can be used as a serial interface to upgrade the
firmware of the modem. However, that isn't possible when the cdc-acm
driver takes control of the device.

The following is an explanation of the behaviour by Daniele Palmas during
discussion on linux-usb.

"This is what happens when the device is turned on (without modifying
the drivers):

[155492.352031] usb 1-3: new high-speed USB device number 27 using ehci-pci
[155492.485429] usb 1-3: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11
[155492.485436] usb 1-3: New USB device found, idVendor=058b, idProduct=0041
[155492.485439] usb 1-3: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[155492.485952] cdc_acm 1-3:1.0: ttyACM0: USB ACM device

This is the flashing device that is caught by the cdc-acm driver. Once
the ttyACM appears, the application starts sending a magic string
(simple write on the file descriptor) to keep the device in flashing
mode. If this magic string is not properly received in a certain time
interval, the modem goes on in normal operative mode:

[155493.748094] usb 1-3: USB disconnect, device number 27
[155494.916025] usb 1-3: new high-speed USB device number 28 using ehci-pci
[155495.059978] usb 1-3: New USB device found, idVendor=1bc7, idProduct=0021
[155495.059983] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[155495.059986] usb 1-3: Product: 6 CDC-ACM + 1 CDC-ECM
[155495.059989] usb 1-3: Manufacturer: Telit
[155495.059992] usb 1-3: SerialNumber: 359658044004697
[155495.138958] cdc_acm 1-3:1.0: ttyACM0: USB ACM device
[155495.140832] cdc_acm 1-3:1.2: ttyACM1: USB ACM device
[155495.142827] cdc_acm 1-3:1.4: ttyACM2: USB ACM device
[155495.144462] cdc_acm 1-3:1.6: ttyACM3: USB ACM device
[155495.145967] cdc_acm 1-3:1.8: ttyACM4: USB ACM device
[155495.147588] cdc_acm 1-3:1.10: ttyACM5: USB ACM device
[155495.154322] cdc_ether 1-3:1.12 wwan0: register 'cdc_ether' at usb-0000:00:1a.7-3, Mobile Broadband Network Device, 00:00:11:12:13:14

Using the cdc-acm driver, the string, though being sent in the same way
than using the usb-serial-simple driver (I can confirm that the data is
passing properly since I used an hw usb sniffer), does not make the
device to stay in flashing mode."

Signed-off-by: Jonas Jonsson <jonas@ludd.ltu.se>
Tested-by: Daniele Palmas <dnlplm@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/usb/class/cdc-acm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 06cdbb4..87f216d 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1719,6 +1719,11 @@ static const struct usb_device_id acm_ids[] = {
 	},
 #endif
 
+	/* Exclude Infineon Flash Loader utility */
+	{ USB_DEVICE(0x058b, 0x0041),
+	.driver_info = IGNORE_DEVICE,
+	},
+
 	/* control interfaces without any protocol set */
 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
 		USB_CDC_PROTO_NONE) },
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315423 — [PATCH 3.13.y-ckt 015/108] tools: Add a "make all" rule

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Kamal Mostafa <kamal@canonical.com>

commit f6ba98c5dc78708cb7fd29950c4a50c4c7e88f95 upstream.

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Jonathan Cameron <jic23@kernel.org>
Cc: Pali Rohar <pali.rohar@gmail.com>
Cc: Roberta Dobrescu <roberta.dobrescu@gmail.com>
Link: http://lkml.kernel.org/r/1447280736-2161-2-git-send-email-kamal@canonical.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
[ kamal: backport to 3.13-stable: build all tools for this version ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 tools/Makefile | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tools/Makefile b/tools/Makefile
index a9b0200..0f28b09 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -23,6 +23,10 @@ help:
 	@echo '  from the kernel command line to build and install one of'
 	@echo '  the tools above'
 	@echo ''
+	@echo '  $$ make tools/all'
+	@echo ''
+	@echo '  builds all tools.'
+	@echo ''
 	@echo '  $$ make tools/install'
 	@echo ''
 	@echo '  installs all tools.'
@@ -54,6 +58,11 @@ turbostat x86_energy_perf_policy: FORCE
 tmon: FORCE
 	$(call descend,thermal/$@)
 
+all: cgroup cpupower firewire lguest \
+		perf selftests turbostat usb \
+		virtio vm net x86_energy_perf_policy \
+		tmon
+
 cpupower_install:
 	$(call descend,power/$(@:_install=),install)
 
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315424 — [PATCH 3.13.y-ckt 020/108] iio: fix some warning messages

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 231bfe53c57e89857753c940192acba933cba56c upstream.

WARN_ON() only takes a condition argument.  I have changed these to
WARN() instead.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/iio/industrialio-buffer.c | 2 +-
 drivers/iio/industrialio-core.c   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 1d05805..477534d 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -801,7 +801,7 @@ int iio_scan_mask_set(struct iio_dev *indio_dev,
 	if (trialmask == NULL)
 		return -ENOMEM;
 	if (!indio_dev->masklength) {
-		WARN_ON("Trying to set scanmask prior to registering buffer\n");
+		WARN(1, "Trying to set scanmask prior to registering buffer\n");
 		goto err_invalid_mask;
 	}
 	bitmap_copy(trialmask, buffer->scan_mask, indio_dev->masklength);
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 6e4858d..0694ecd 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -583,7 +583,7 @@ int __iio_device_attr_init(struct device_attribute *dev_attr,
 			break;
 		case IIO_SEPARATE:
 			if (!chan->indexed) {
-				WARN_ON("Differential channels must be indexed\n");
+				WARN(1, "Differential channels must be indexed\n");
 				ret = -EINVAL;
 				goto error_free_full_postfix;
 			}
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315425 — [PATCH 3.13.y-ckt 031/108] irqchip/versatile-fpga: Fix PCI IRQ mapping on Versatile PB

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Guillaume Delbergue <guillaume.delbergue@greensocs.com>

commit d5d4fdd86f5759924fe54efa793e22eccf508db6 upstream.

This patch is specifically for PCI support on the Versatile PB board using
a DT. Currently, the dynamic IRQ mapping is broken when using DTs. For
example, on QEMU, the SCSI driver is unable to request the IRQ. To fix
this issue, this patch replaces the current dynamic mechanism with a
static value as is done in the non-DT case.

Signed-off-by: Guillaume Delbergue <guillaume.delbergue@greensocs.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
[ kamal: backport to 3.13-stable: no parent_irq ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/irqchip/irq-versatile-fpga.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/irqchip/irq-versatile-fpga.c b/drivers/irqchip/irq-versatile-fpga.c
index 47a52ab..c12b81d 100644
--- a/drivers/irqchip/irq-versatile-fpga.c
+++ b/drivers/irqchip/irq-versatile-fpga.c
@@ -193,7 +193,12 @@ int __init fpga_irq_of_init(struct device_node *node,
 	if (of_property_read_u32(node, "valid-mask", &valid_mask))
 		valid_mask = 0;
 
+#ifdef CONFIG_ARCH_VERSATILE
+	fpga_irq_init(base, node->name, IRQ_SIC_START, -1, valid_mask,
+				  node);
+#else
 	fpga_irq_init(base, node->name, 0, -1, valid_mask, node);
+#endif
 
 	writel(clear_mask, base + IRQ_ENABLE_CLEAR);
 	writel(clear_mask, base + FIQ_ENABLE_CLEAR);
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315426 — [PATCH 3.13.y-ckt 014/108] KVM: x86: Reload pit counters for all channels when restoring state

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Andrew Honig <ahonig@google.com>

commit 0185604c2d82c560dab2f2933a18f797e74ab5a8 upstream.

Currently if userspace restores the pit counters with a count of 0
on channels 1 or 2 and the guest attempts to read the count on those
channels, then KVM will perform a mod of 0 and crash.  This will ensure
that 0 values are converted to 65536 as per the spec.

This is CVE-2015-7513.

Signed-off-by: Andy Honig <ahonig@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: Moritz Muehlenhoff <jmm@inutil.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/x86/kvm/x86.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 8f83ea4..20ced12 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3505,10 +3505,12 @@ static int kvm_vm_ioctl_get_pit(struct kvm *kvm, struct kvm_pit_state *ps)
 static int kvm_vm_ioctl_set_pit(struct kvm *kvm, struct kvm_pit_state *ps)
 {
 	int r = 0;
+	int i;
 
 	mutex_lock(&kvm->arch.vpit->pit_state.lock);
 	memcpy(&kvm->arch.vpit->pit_state, ps, sizeof(struct kvm_pit_state));
-	kvm_pit_load_count(kvm, 0, ps->channels[0].count, 0);
+	for (i = 0; i < 3; i++)
+		kvm_pit_load_count(kvm, i, ps->channels[i].count, 0);
 	mutex_unlock(&kvm->arch.vpit->pit_state.lock);
 	return r;
 }
@@ -3529,6 +3531,7 @@ static int kvm_vm_ioctl_get_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps)
 static int kvm_vm_ioctl_set_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps)
 {
 	int r = 0, start = 0;
+	int i;
 	u32 prev_legacy, cur_legacy;
 	mutex_lock(&kvm->arch.vpit->pit_state.lock);
 	prev_legacy = kvm->arch.vpit->pit_state.flags & KVM_PIT_FLAGS_HPET_LEGACY;
@@ -3538,7 +3541,8 @@ static int kvm_vm_ioctl_set_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps)
 	memcpy(&kvm->arch.vpit->pit_state.channels, &ps->channels,
 	       sizeof(kvm->arch.vpit->pit_state.channels));
 	kvm->arch.vpit->pit_state.flags = ps->flags;
-	kvm_pit_load_count(kvm, 0, kvm->arch.vpit->pit_state.channels[0].count, start);
+	for (i = 0; i < 3; i++)
+		kvm_pit_load_count(kvm, i, kvm->arch.vpit->pit_state.channels[i].count, start);
 	mutex_unlock(&kvm->arch.vpit->pit_state.lock);
 	return r;
 }
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315427 — [PATCH 3.13.y-ckt 026/108] drm/ttm: Fixed a read/write lock imbalance

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Thomas Hellstrom <thellstrom@vmware.com>

commit 025af189fb44250206dd8a32fa4a682392af3301 upstream.

In ttm_write_lock(), the uninterruptible path should call
__ttm_write_lock() not __ttm_read_lock().  This fixes a vmwgfx hang
on F23 start up.

syeh: Extracted this from one of Thomas' internal patches.

Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/gpu/drm/ttm/ttm_lock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/ttm/ttm_lock.c b/drivers/gpu/drm/ttm/ttm_lock.c
index 3daa9a3..9b7cb11 100644
--- a/drivers/gpu/drm/ttm/ttm_lock.c
+++ b/drivers/gpu/drm/ttm/ttm_lock.c
@@ -180,7 +180,7 @@ int ttm_write_lock(struct ttm_lock *lock, bool interruptible)
 			spin_unlock(&lock->lock);
 		}
 	} else
-		wait_event(lock->queue, __ttm_read_lock(lock));
+		wait_event(lock->queue, __ttm_write_lock(lock));
 
 	return ret;
 }
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315428 — [PATCH 3.13.y-ckt 023/108] USB: serial: Another Infineon flash loader USB ID

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Jonas Jonsson <jonas@ludd.ltu.se>

commit a0e80fbd56b4573de997c9a088a33abbc1121400 upstream.

The flash loader has been seen on a Telit UE910 modem. The flash loader
is a bit special, it presents both an ACM and CDC Data interface but
only the latter is useful. Unless a magic string is sent to the device
it will disappear and the regular modem device appears instead.

Signed-off-by: Jonas Jonsson <jonas@ludd.ltu.se>
Tested-by: Daniele Palmas <dnlplm@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/usb/serial/usb-serial-simple.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index 147f019..2008329 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -48,6 +48,7 @@ DEVICE(funsoft, FUNSOFT_IDS);
 
 /* Infineon Flashloader driver */
 #define FLASHLOADER_IDS()		\
+	{ USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
 	{ USB_DEVICE(0x8087, 0x0716) }
 DEVICE(flashloader, FLASHLOADER_IDS);
 
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315429 — [PATCH 3.13.y-ckt 042/108] radeon/cik: Fix GFX IB test on Big-Endian

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Oded Gabbay <oded.gabbay@gmail.com>

commit 5f3e226f511ec98d70c970f09cdb4ec46511cc5e upstream.

This patch makes the IB test on the GFX ring pass for CI-based cards
installed in Big-Endian machines.

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/gpu/drm/radeon/cik.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 9ee6440..442ca95 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3726,11 +3726,7 @@ void cik_ring_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib)
 		(ib->vm ? (ib->vm->id << 24) : 0);
 
 	radeon_ring_write(ring, header);
-	radeon_ring_write(ring,
-#ifdef __BIG_ENDIAN
-			  (2 << 0) |
-#endif
-			  (ib->gpu_addr & 0xFFFFFFFC));
+	radeon_ring_write(ring, (ib->gpu_addr & 0xFFFFFFFC));
 	radeon_ring_write(ring, upper_32_bits(ib->gpu_addr) & 0xFFFF);
 	radeon_ring_write(ring, control);
 }
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1315430 — [PATCH 3.13.y-ckt 025/108] jbd2: Fix unreclaimed pages after truncate in data=journal mode

3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Jan Kara <jack@suse.cz>

commit bc23f0c8d7ccd8d924c4e70ce311288cb3e61ea8 upstream.

Ted and Namjae have reported that truncated pages don't get timely
reclaimed after being truncated in data=journal mode. The following test
triggers the issue easily:

for (i = 0; i < 1000; i++) {
	pwrite(fd, buf, 1024*1024, 0);
	fsync(fd);
	fsync(fd);
	ftruncate(fd, 0);
}

The reason is that journal_unmap_buffer() finds that truncated buffers
are not journalled (jh->b_transaction == NULL), they are part of
checkpoint list of a transaction (jh->b_cp_transaction != NULL) and have
been already written out (!buffer_dirty(bh)). We clean such buffers but
we leave them in the checkpoint list. Since checkpoint transaction holds
a reference to the journal head, these buffers cannot be released until
the checkpoint transaction is cleaned up. And at that point we don't
call release_buffer_page() anymore so pages detached from mapping are
lingering in the system waiting for reclaim to find them and free them.

Fix the problem by removing buffers from transaction checkpoint lists
when journal_unmap_buffer() finds out they don't have to be there
anymore.

Reported-and-tested-by: Namjae Jeon <namjae.jeon@samsung.com>
Fixes: de1b794130b130e77ffa975bb58cb843744f9ae5
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 fs/jbd2/transaction.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index ecc5707..a8c6553 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -2066,6 +2066,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
 
 		if (!buffer_dirty(bh)) {
 			/* bdflush has written it.  We can drop it now */
+			__jbd2_journal_remove_checkpoint(jh);
 			goto zap_buffer;
 		}
 
@@ -2095,6 +2096,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
 				/* The orphan record's transaction has
 				 * committed.  We can cleanse this buffer */
 				clear_buffer_jbddirty(bh);
+				__jbd2_journal_remove_checkpoint(jh);
 				goto zap_buffer;
 			}
 		}
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

Page 3 of 5 — ← Prev page 1 2 [3] 4 5  Next page →

Back to top | Article view | linux.kernel

csiph-web