diff options
| author | Zefan Li <lizefan@huawei.com> | 2015-06-19 11:41:55 +0800 |
|---|---|---|
| committer | Zefan Li <lizefan@huawei.com> | 2015-06-19 11:41:55 +0800 |
| commit | e26a02a127c291254dfc5d3e6b87828b4bd5de38 (patch) | |
| tree | a0d3b44ad4864a2c1f955822e7047f05b67ec9ad | |
| parent | 2380cfa0587f7c25fc1fb772e5cdf6dd0f3917bd (diff) | |
| download | linux-3.4.y-queue-e26a02a127c291254dfc5d3e6b87828b4bd5de38.tar.gz | |
Release 3.4.108
174 files changed, 0 insertions, 11081 deletions
diff --git a/patches/acpi-video-load-the-module-even-if-acpi-is-disabled.patch b/patches/acpi-video-load-the-module-even-if-acpi-is-disabled.patch deleted file mode 100644 index ea48c9e..0000000 --- a/patches/acpi-video-load-the-module-even-if-acpi-is-disabled.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 6e17cb12881ba8d5e456b89f072dc6b70048af36 Mon Sep 17 00:00:00 2001 -From: Chris Wilson <chris@chris-wilson.co.uk> -Date: Sun, 1 Mar 2015 10:41:37 +0000 -Subject: ACPI / video: Load the module even if ACPI is disabled - -commit 6e17cb12881ba8d5e456b89f072dc6b70048af36 upstream. - -i915.ko depends upon the acpi/video.ko module and so refuses to load if -ACPI is disabled at runtime if for example the BIOS is broken beyond -repair. acpi/video provides an optional service for i915.ko and so we -should just allow the modules to load, but do no nothing in order to let -the machines boot correctly. - -Reported-by: Bill Augur <bill-auger@programmer.net> -Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> -Cc: Daniel Vetter <daniel.vetter@ffwll.ch> -Cc: Jani Nikula <jani.nikula@intel.com> -Acked-by: Aaron Lu <aaron.lu@intel.com> -[ rjw: Fixed up the new comment in acpi_video_init() ] -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/acpi/video.c | 11 +++++++++++ - 1 file changed, 11 insertions(+) - ---- a/drivers/acpi/video.c -+++ b/drivers/acpi/video.c -@@ -1872,6 +1872,17 @@ EXPORT_SYMBOL(acpi_video_unregister); - - static int __init acpi_video_init(void) - { -+ /* -+ * Let the module load even if ACPI is disabled (e.g. due to -+ * a broken BIOS) so that i915.ko can still be loaded on such -+ * old systems without an AcpiOpRegion. -+ * -+ * acpi_video_register() will report -ENODEV later as well due -+ * to acpi_disabled when i915.ko tries to register itself afterwards. -+ */ -+ if (acpi_disabled) -+ return 0; -+ - dmi_check_system(video_dmi_table); - - if (intel_opregion_present()) diff --git a/patches/alsa-control-add-sanity-checks-for-user-ctl-id-name-string.patch b/patches/alsa-control-add-sanity-checks-for-user-ctl-id-name-string.patch deleted file mode 100644 index 3643dae..0000000 --- a/patches/alsa-control-add-sanity-checks-for-user-ctl-id-name-string.patch +++ /dev/null @@ -1,30 +0,0 @@ -From be3bb8236db2d0fcd705062ae2e2a9d75131222f Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Wed, 11 Mar 2015 18:12:49 +0100 -Subject: ALSA: control: Add sanity checks for user ctl id name string - -commit be3bb8236db2d0fcd705062ae2e2a9d75131222f upstream. - -There was no check about the id string of user control elements, so we -accepted even a control element with an empty string, which is -obviously bogus. This patch adds more sanity checks of id strings. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/core/control.c | 4 ++++ - 1 file changed, 4 insertions(+) - ---- a/sound/core/control.c -+++ b/sound/core/control.c -@@ -1164,6 +1164,10 @@ static int snd_ctl_elem_add(struct snd_c - - if (info->count < 1) - return -EINVAL; -+ if (!*info->id.name) -+ return -EINVAL; -+ if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name)) -+ return -EINVAL; - access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE : - (info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE| - SNDRV_CTL_ELEM_ACCESS_INACTIVE| diff --git a/patches/alsa-hda-add-one-more-node-in-the-eapd-supporting-candidate-list.patch b/patches/alsa-hda-add-one-more-node-in-the-eapd-supporting-candidate-list.patch deleted file mode 100644 index ddb1886..0000000 --- a/patches/alsa-hda-add-one-more-node-in-the-eapd-supporting-candidate-list.patch +++ /dev/null @@ -1,31 +0,0 @@ -From af95b41426e0b58279f8ff0ebe420df49a4e96b8 Mon Sep 17 00:00:00 2001 -From: Hui Wang <hui.wang@canonical.com> -Date: Thu, 26 Mar 2015 17:14:55 +0800 -Subject: ALSA: hda - Add one more node in the EAPD supporting candidate list - -commit af95b41426e0b58279f8ff0ebe420df49a4e96b8 upstream. - -We have a HP machine which use the codec node 0x17 connecting the -internal speaker, and from the node capability, we saw the EAPD, -if we don't set the EAPD on for this node, the internal speaker -can't output any sound. - -BugLink: https://bugs.launchpad.net/bugs/1436745 -Signed-off-by: Hui Wang <hui.wang@canonical.com> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/pci/hda/patch_realtek.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -759,7 +759,7 @@ static void alc_auto_setup_eapd(struct h - { - /* We currently only handle front, HP */ - static hda_nid_t pins[] = { -- 0x0f, 0x10, 0x14, 0x15, 0 -+ 0x0f, 0x10, 0x14, 0x15, 0x17, 0 - }; - hda_nid_t *p; - for (p = pins; *p; p++) diff --git a/patches/alsa-hdspm-constrain-periods-to-2-on-older-cards.patch b/patches/alsa-hdspm-constrain-periods-to-2-on-older-cards.patch deleted file mode 100644 index d0476d2..0000000 --- a/patches/alsa-hdspm-constrain-periods-to-2-on-older-cards.patch +++ /dev/null @@ -1,44 +0,0 @@ -From f0153c3d948c1764f6c920a0675d86fc1d75813e Mon Sep 17 00:00:00 2001 -From: Adrian Knoth <adi@drcomp.erfurt.thur.de> -Date: Tue, 10 Feb 2015 11:33:50 +0100 -Subject: ALSA: hdspm - Constrain periods to 2 on older cards - -commit f0153c3d948c1764f6c920a0675d86fc1d75813e upstream. - -RME RayDAT and AIO use a fixed buffer size of 16384 samples. With period -sizes of 32-4096, this translates to 4-512 periods. - -The older RME cards have a variable buffer size but require exactly two -periods. - -This patch enforces nperiods=2 on those cards. - -Signed-off-by: Adrian Knoth <adi@drcomp.erfurt.thur.de> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/pci/rme9652/hdspm.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/sound/pci/rme9652/hdspm.c -+++ b/sound/pci/rme9652/hdspm.c -@@ -5968,6 +5968,9 @@ static int snd_hdspm_playback_open(struc - snd_pcm_hw_constraint_minmax(runtime, - SNDRV_PCM_HW_PARAM_PERIOD_SIZE, - 64, 8192); -+ snd_pcm_hw_constraint_minmax(runtime, -+ SNDRV_PCM_HW_PARAM_PERIODS, -+ 2, 2); - break; - } - -@@ -6042,6 +6045,9 @@ static int snd_hdspm_capture_open(struct - snd_pcm_hw_constraint_minmax(runtime, - SNDRV_PCM_HW_PARAM_PERIOD_SIZE, - 64, 8192); -+ snd_pcm_hw_constraint_minmax(runtime, -+ SNDRV_PCM_HW_PARAM_PERIODS, -+ 2, 2); - break; - } - diff --git a/patches/alsa-off-by-one-bug-in-snd_riptide_joystick_probe.patch b/patches/alsa-off-by-one-bug-in-snd_riptide_joystick_probe.patch deleted file mode 100644 index d925250..0000000 --- a/patches/alsa-off-by-one-bug-in-snd_riptide_joystick_probe.patch +++ /dev/null @@ -1,88 +0,0 @@ -From e4940626defdf6c92da1052ad3f12741c1a28c90 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@oracle.com> -Date: Mon, 9 Feb 2015 16:51:40 +0300 -Subject: ALSA: off by one bug in snd_riptide_joystick_probe() - -commit e4940626defdf6c92da1052ad3f12741c1a28c90 upstream. - -The problem here is that we check: - - if (dev >= SNDRV_CARDS) - -Then we increment "dev". - - if (!joystick_port[dev++]) - -Then we use it as an offset into a array with SNDRV_CARDS elements. - - if (!request_region(joystick_port[dev], 8, "Riptide gameport")) { - -This has 3 effects: -1) If you use the module option to specify the joystick port then it has - to be shifted one space over. -2) The wrong error message will be printed on failure if you have over - 32 cards. -3) Static checkers will correctly complain that are off by one. - -Fixes: db1005ec6ff8 ('ALSA: riptide - Fix joystick resource handling') -Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/pci/riptide/riptide.c | 27 +++++++++++++++++++-------- - 1 file changed, 19 insertions(+), 8 deletions(-) - ---- a/sound/pci/riptide/riptide.c -+++ b/sound/pci/riptide/riptide.c -@@ -2026,32 +2026,43 @@ snd_riptide_joystick_probe(struct pci_de - { - static int dev; - struct gameport *gameport; -+ int ret; - - if (dev >= SNDRV_CARDS) - return -ENODEV; -+ - if (!enable[dev]) { -- dev++; -- return -ENOENT; -+ ret = -ENOENT; -+ goto inc_dev; - } - -- if (!joystick_port[dev++]) -- return 0; -+ if (!joystick_port[dev]) { -+ ret = 0; -+ goto inc_dev; -+ } - - gameport = gameport_allocate_port(); -- if (!gameport) -- return -ENOMEM; -+ if (!gameport) { -+ ret = -ENOMEM; -+ goto inc_dev; -+ } - if (!request_region(joystick_port[dev], 8, "Riptide gameport")) { - snd_printk(KERN_WARNING - "Riptide: cannot grab gameport 0x%x\n", - joystick_port[dev]); - gameport_free_port(gameport); -- return -EBUSY; -+ ret = -EBUSY; -+ goto inc_dev; - } - - gameport->io = joystick_port[dev]; - gameport_register_port(gameport); - pci_set_drvdata(pci, gameport); -- return 0; -+ -+ ret = 0; -+inc_dev: -+ dev++; -+ return ret; - } - - static void __devexit snd_riptide_joystick_remove(struct pci_dev *pci) diff --git a/patches/alsa-pcm-don-t-leave-prepared-state-after-draining.patch b/patches/alsa-pcm-don-t-leave-prepared-state-after-draining.patch deleted file mode 100644 index 6b8017c..0000000 --- a/patches/alsa-pcm-don-t-leave-prepared-state-after-draining.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 70372a7566b5e552dbe48abdac08c275081d8558 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Thu, 18 Dec 2014 10:02:41 +0100 -Subject: ALSA: pcm: Don't leave PREPARED state after draining - -commit 70372a7566b5e552dbe48abdac08c275081d8558 upstream. - -When a PCM draining is performed to an empty stream that has been -already in PREPARED state, the current code just ignores and leaves as -it is, although the drain is supposed to set all such streams to SETUP -state. This patch covers that overlooked case. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/core/pcm_native.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/sound/core/pcm_native.c -+++ b/sound/core/pcm_native.c -@@ -1382,6 +1382,8 @@ static int snd_pcm_do_drain_init(struct - if (! snd_pcm_playback_empty(substream)) { - snd_pcm_do_start(substream, SNDRV_PCM_STATE_DRAINING); - snd_pcm_post_start(substream, SNDRV_PCM_STATE_DRAINING); -+ } else { -+ runtime->status->state = SNDRV_PCM_STATE_SETUP; - } - break; - case SNDRV_PCM_STATE_RUNNING: diff --git a/patches/alsa-snd-usb-add-quirks-for-roland-ua-22.patch b/patches/alsa-snd-usb-add-quirks-for-roland-ua-22.patch deleted file mode 100644 index 06ead57..0000000 --- a/patches/alsa-snd-usb-add-quirks-for-roland-ua-22.patch +++ /dev/null @@ -1,64 +0,0 @@ -From fcdcd1dec6d2c7b718385ec743ae5a9a233edad4 Mon Sep 17 00:00:00 2001 -From: Daniel Mack <daniel@zonque.org> -Date: Thu, 12 Mar 2015 09:41:32 +0100 -Subject: ALSA: snd-usb: add quirks for Roland UA-22 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit fcdcd1dec6d2c7b718385ec743ae5a9a233edad4 upstream. - -The device complies to the UAC1 standard but hides that fact with -proprietary descriptors. The autodetect quirk for Roland devices -catches the audio interface but misses the MIDI part, so a specific -quirk is needed. - -Signed-off-by: Daniel Mack <daniel@zonque.org> -Reported-by: Rafa Lafuente <rafalafuente@gmail.com> -Tested-by: Raphaël Doursenaud <raphael@doursenaud.fr> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/usb/quirks-table.h | 30 ++++++++++++++++++++++++++++++ - 1 file changed, 30 insertions(+) - ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -1871,6 +1871,36 @@ YAMAHA_DEVICE(0x7010, "UB99"), - } - } - }, -+{ -+ USB_DEVICE(0x0582, 0x0159), -+ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { -+ /* .vendor_name = "Roland", */ -+ /* .product_name = "UA-22", */ -+ .ifnum = QUIRK_ANY_INTERFACE, -+ .type = QUIRK_COMPOSITE, -+ .data = (const struct snd_usb_audio_quirk[]) { -+ { -+ .ifnum = 0, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 1, -+ .type = QUIRK_AUDIO_STANDARD_INTERFACE -+ }, -+ { -+ .ifnum = 2, -+ .type = QUIRK_MIDI_FIXED_ENDPOINT, -+ .data = & (const struct snd_usb_midi_endpoint_info) { -+ .out_cables = 0x0001, -+ .in_cables = 0x0001 -+ } -+ }, -+ { -+ .ifnum = -1 -+ } -+ } -+ } -+}, - - /* Guillemot devices */ - { diff --git a/patches/alsa-usb-creative-usb-x-fi-pro-sb1095-volume-knob-support.patch b/patches/alsa-usb-creative-usb-x-fi-pro-sb1095-volume-knob-support.patch deleted file mode 100644 index 0e88c4e..0000000 --- a/patches/alsa-usb-creative-usb-x-fi-pro-sb1095-volume-knob-support.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 3dc8523fa7412e731441c01fb33f003eb3cfece1 Mon Sep 17 00:00:00 2001 -From: "Dmitry M. Fedin" <dmitry.fedin@gmail.com> -Date: Thu, 9 Apr 2015 17:37:03 +0300 -Subject: ALSA: usb - Creative USB X-Fi Pro SB1095 volume knob support - -commit 3dc8523fa7412e731441c01fb33f003eb3cfece1 upstream. - -Adds an entry for Creative USB X-Fi to the rc_config array in -mixer_quirks.c to allow use of volume knob on the device. -Adds support for newer X-Fi Pro card, known as "Model No. SB1095" -with USB ID "041e:3237" - -Signed-off-by: Dmitry M. Fedin <dmitry.fedin@gmail.com> -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/usb/mixer_quirks.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -64,6 +64,7 @@ static const struct rc_config { - { USB_ID(0x041e, 0x3040), 2, 2, 6, 6, 2, 0x6e91 }, /* Live! 24-bit */ - { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */ - { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ -+ { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ - { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */ - }; - diff --git a/patches/arm-8284-1-sa1100-clear-rcsr_smr-on-resume.patch b/patches/arm-8284-1-sa1100-clear-rcsr_smr-on-resume.patch deleted file mode 100644 index 4e7fb3b..0000000 --- a/patches/arm-8284-1-sa1100-clear-rcsr_smr-on-resume.patch +++ /dev/null @@ -1,30 +0,0 @@ -From e461894dc2ce7778ccde1c3483c9b15a85a7fc5f Mon Sep 17 00:00:00 2001 -From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> -Date: Thu, 15 Jan 2015 03:06:22 +0100 -Subject: ARM: 8284/1: sa1100: clear RCSR_SMR on resume - -commit e461894dc2ce7778ccde1c3483c9b15a85a7fc5f upstream. - -StrongARM core uses RCSR SMR bit to tell to bootloader that it was reset -by entering the sleep mode. After we have resumed, there is little point -in having that bit enabled. Moreover, if this bit is set before reboot, -the bootloader can become confused. Thus clear the SMR bit on resume -just before clearing the scratchpad (resume address) register. - -Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> -Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/arm/mach-sa1100/pm.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/arch/arm/mach-sa1100/pm.c -+++ b/arch/arm/mach-sa1100/pm.c -@@ -80,6 +80,7 @@ static int sa11x0_pm_enter(suspend_state - /* - * Ensure not to come back here if it wasn't intended - */ -+ RCSR = RCSR_SMR; - PSPR = 0; - - /* diff --git a/patches/arm-at91-pm-fix-at91rm9200-standby.patch b/patches/arm-at91-pm-fix-at91rm9200-standby.patch deleted file mode 100644 index 2e9e6d5..0000000 --- a/patches/arm-at91-pm-fix-at91rm9200-standby.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 84e871660bebfddb9a62ebd6f19d02536e782f0a Mon Sep 17 00:00:00 2001 -From: Alexandre Belloni <alexandre.belloni@free-electrons.com> -Date: Tue, 3 Mar 2015 19:58:22 +0100 -Subject: ARM: at91: pm: fix at91rm9200 standby - -commit 84e871660bebfddb9a62ebd6f19d02536e782f0a upstream. - -at91rm9200 standby and suspend to ram has been broken since -00482a4078f4. It is wrongly using AT91_BASE_SYS which is a physical address -and actually doesn't correspond to any register on at91rm9200. - -Use the correct at91_ramc_base[0] instead. - -Fixes: 00482a4078f4 (ARM: at91: implement the standby function for pm/cpuidle) - -Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> -Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/arm/mach-at91/pm.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/arch/arm/mach-at91/pm.h -+++ b/arch/arm/mach-at91/pm.h -@@ -38,7 +38,7 @@ static inline void at91rm9200_standby(vo - " mcr p15, 0, %0, c7, c0, 4\n\t" - " str %5, [%1, %2]" - : -- : "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR), -+ : "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR), - "r" (1), "r" (AT91RM9200_SDRAMC_SRR), - "r" (lpr)); - } diff --git a/patches/arm-pxa-add-regulator_has_full_constraints-to-corgi-board-file.patch b/patches/arm-pxa-add-regulator_has_full_constraints-to-corgi-board-file.patch deleted file mode 100644 index 159423e..0000000 --- a/patches/arm-pxa-add-regulator_has_full_constraints-to-corgi-board-file.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 271e80176aae4e5b481f4bb92df9768c6075bbca Mon Sep 17 00:00:00 2001 -From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> -Date: Thu, 4 Dec 2014 14:10:00 +0300 -Subject: ARM: pxa: add regulator_has_full_constraints to corgi board file - -commit 271e80176aae4e5b481f4bb92df9768c6075bbca upstream. - -Add regulator_has_full_constraints() call to corgi board file to let -regulator core know that we do not have any additional regulators left. -This lets it substitute unprovided regulators with dummy ones. - -This fixes the following warnings that can be seen on corgi if -regulators are enabled: - -ads7846 spi1.0: unable to get regulator: -517 -spi spi1.0: Driver ads7846 requests probe deferral -wm8731 0-001b: Failed to get supply 'AVDD': -517 -wm8731 0-001b: Failed to request supplies: -517 -wm8731 0-001b: ASoC: failed to probe component -517 -corgi-audio corgi-audio: ASoC: failed to instantiate card -517 - -Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> -Acked-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/arm/mach-pxa/corgi.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/arch/arm/mach-pxa/corgi.c -+++ b/arch/arm/mach-pxa/corgi.c -@@ -26,6 +26,7 @@ - #include <linux/i2c.h> - #include <linux/i2c/pxa-i2c.h> - #include <linux/io.h> -+#include <linux/regulator/machine.h> - #include <linux/spi/spi.h> - #include <linux/spi/ads7846.h> - #include <linux/spi/corgi_lcd.h> -@@ -711,6 +712,8 @@ static void __init corgi_init(void) - sharpsl_nand_partitions[1].size = 53 * 1024 * 1024; - - platform_add_devices(devices, ARRAY_SIZE(devices)); -+ -+ regulator_has_full_constraints(); - } - - static void __init fixup_corgi(struct tag *tags, char **cmdline, diff --git a/patches/arm-pxa-add-regulator_has_full_constraints-to-poodle-board-file.patch b/patches/arm-pxa-add-regulator_has_full_constraints-to-poodle-board-file.patch deleted file mode 100644 index 1d89541..0000000 --- a/patches/arm-pxa-add-regulator_has_full_constraints-to-poodle-board-file.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 9bc78f32c2e430aebf6def965b316aa95e37a20c Mon Sep 17 00:00:00 2001 -From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> -Date: Thu, 4 Dec 2014 14:10:01 +0300 -Subject: ARM: pxa: add regulator_has_full_constraints to poodle board file - -commit 9bc78f32c2e430aebf6def965b316aa95e37a20c upstream. - -Add regulator_has_full_constraints() call to poodle board file to let -regulator core know that we do not have any additional regulators left. -This lets it substitute unprovided regulators with dummy ones. - -This fixes the following warnings that can be seen on poodle if -regulators are enabled: - -ads7846 spi1.0: unable to get regulator: -517 -spi spi1.0: Driver ads7846 requests probe deferral -wm8731 0-001b: Failed to get supply 'AVDD': -517 -wm8731 0-001b: Failed to request supplies: -517 -wm8731 0-001b: ASoC: failed to probe component -517 - -Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> -Acked-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/arm/mach-pxa/poodle.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/arch/arm/mach-pxa/poodle.c -+++ b/arch/arm/mach-pxa/poodle.c -@@ -25,6 +25,7 @@ - #include <linux/gpio.h> - #include <linux/i2c.h> - #include <linux/i2c/pxa-i2c.h> -+#include <linux/regulator/machine.h> - #include <linux/spi/spi.h> - #include <linux/spi/ads7846.h> - #include <linux/spi/pxa2xx_spi.h> -@@ -452,6 +453,7 @@ static void __init poodle_init(void) - pxa_set_i2c_info(NULL); - i2c_register_board_info(0, ARRAY_AND_SIZE(poodle_i2c_devices)); - poodle_init_spi(); -+ regulator_has_full_constraints(); - } - - static void __init fixup_poodle(struct tag *tags, char **cmdline, diff --git a/patches/arm-pxa-add-regulator_has_full_constraints-to-spitz-board-file.patch b/patches/arm-pxa-add-regulator_has_full_constraints-to-spitz-board-file.patch deleted file mode 100644 index 99e8f55..0000000 --- a/patches/arm-pxa-add-regulator_has_full_constraints-to-spitz-board-file.patch +++ /dev/null @@ -1,37 +0,0 @@ -From baad2dc49c5d970ea881d92981a1b76c94a7b7a1 Mon Sep 17 00:00:00 2001 -From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> -Date: Thu, 4 Dec 2014 14:10:02 +0300 -Subject: ARM: pxa: add regulator_has_full_constraints to spitz board file - -commit baad2dc49c5d970ea881d92981a1b76c94a7b7a1 upstream. - -Add regulator_has_full_constraints() call to spitz board file to let -regulator core know that we do not have any additional regulators left. -This lets it substitute unprovided regulators with dummy ones. - -This fixes the following warnings that can be seen on spitz if -regulators are enabled: - -ads7846 spi2.0: unable to get regulator: -517 -spi spi2.0: Driver ads7846 requests probe deferral - -Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> -Acked-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/arm/mach-pxa/spitz.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/arch/arm/mach-pxa/spitz.c -+++ b/arch/arm/mach-pxa/spitz.c -@@ -968,6 +968,8 @@ static void __init spitz_init(void) - spitz_nor_init(); - spitz_nand_init(); - spitz_i2c_init(); -+ -+ regulator_has_full_constraints(); - } - - static void __init spitz_fixup(struct tag *tags, char **cmdline, diff --git a/patches/asoc-adav80x-fix-wrong-value-references-for-boolean-kctl.patch b/patches/asoc-adav80x-fix-wrong-value-references-for-boolean-kctl.patch deleted file mode 100644 index 06bfd79..0000000 --- a/patches/asoc-adav80x-fix-wrong-value-references-for-boolean-kctl.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 2bf4c1d483d911cda5dd385527194d23e5cea73d Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 10 Mar 2015 12:39:03 +0100 -Subject: ASoC: adav80x: Fix wrong value references for boolean kctl - -commit 2bf4c1d483d911cda5dd385527194d23e5cea73d upstream. - -The correct values referred by a boolean control are -value.integer.value[], not value.enumerated.item[]. -The former is long while the latter is int, so it's even incompatible -on 64bit architectures. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Acked-by: Lars-Peter Clausen <lars@metafoo.de> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/adav80x.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/sound/soc/codecs/adav80x.c -+++ b/sound/soc/codecs/adav80x.c -@@ -307,7 +307,7 @@ static int adav80x_put_deemph(struct snd - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec); -- unsigned int deemph = ucontrol->value.enumerated.item[0]; -+ unsigned int deemph = ucontrol->value.integer.value[0]; - - if (deemph > 1) - return -EINVAL; -@@ -323,7 +323,7 @@ static int adav80x_get_deemph(struct snd - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = adav80x->deemph; -+ ucontrol->value.integer.value[0] = adav80x->deemph; - return 0; - }; - diff --git a/patches/asoc-ak4641-fix-wrong-value-references-for-boolean-kctl.patch b/patches/asoc-ak4641-fix-wrong-value-references-for-boolean-kctl.patch deleted file mode 100644 index 1a151d7..0000000 --- a/patches/asoc-ak4641-fix-wrong-value-references-for-boolean-kctl.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 08641d9b7bf915144a57a736b42642e13eb1167f Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 10 Mar 2015 12:39:04 +0100 -Subject: ASoC: ak4641: Fix wrong value references for boolean kctl - -commit 08641d9b7bf915144a57a736b42642e13eb1167f upstream. - -The correct values referred by a boolean control are -value.integer.value[], not value.enumerated.item[]. -The former is long while the latter is int, so it's even incompatible -on 64bit architectures. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/ak4641.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/sound/soc/codecs/ak4641.c -+++ b/sound/soc/codecs/ak4641.c -@@ -74,7 +74,7 @@ static int ak4641_put_deemph(struct snd_ - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec); -- int deemph = ucontrol->value.enumerated.item[0]; -+ int deemph = ucontrol->value.integer.value[0]; - - if (deemph > 1) - return -EINVAL; -@@ -90,7 +90,7 @@ static int ak4641_get_deemph(struct snd_ - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = ak4641->deemph; -+ ucontrol->value.integer.value[0] = ak4641->deemph; - return 0; - }; - diff --git a/patches/asoc-cs4271-fix-wrong-value-references-for-boolean-kctl.patch b/patches/asoc-cs4271-fix-wrong-value-references-for-boolean-kctl.patch deleted file mode 100644 index 489957e..0000000 --- a/patches/asoc-cs4271-fix-wrong-value-references-for-boolean-kctl.patch +++ /dev/null @@ -1,40 +0,0 @@ -From e8371aa0fecb73fb8a4b2e0296b025b11e7d6229 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 10 Mar 2015 12:39:05 +0100 -Subject: ASoC: cs4271: Fix wrong value references for boolean kctl - -commit e8371aa0fecb73fb8a4b2e0296b025b11e7d6229 upstream. - -The correct values referred by a boolean control are -value.integer.value[], not value.enumerated.item[]. -The former is long while the latter is int, so it's even incompatible -on 64bit architectures. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Acked-by: Paul Handrigan <Paul.Handrigan@cirrus.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/cs4271.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/sound/soc/codecs/cs4271.c -+++ b/sound/soc/codecs/cs4271.c -@@ -261,7 +261,7 @@ static int cs4271_get_deemph(struct snd_ - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = cs4271->deemph; -+ ucontrol->value.integer.value[0] = cs4271->deemph; - return 0; - } - -@@ -271,7 +271,7 @@ static int cs4271_put_deemph(struct snd_ - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec); - -- cs4271->deemph = ucontrol->value.enumerated.item[0]; -+ cs4271->deemph = ucontrol->value.integer.value[0]; - return cs4271_set_deemph(codec); - } - diff --git a/patches/asoc-omap-pcm-correct-dma-mask.patch b/patches/asoc-omap-pcm-correct-dma-mask.patch deleted file mode 100644 index 651ec19..0000000 --- a/patches/asoc-omap-pcm-correct-dma-mask.patch +++ /dev/null @@ -1,44 +0,0 @@ -From d51199a83a2cf82a291d19ee852c44caa511427d Mon Sep 17 00:00:00 2001 -From: Peter Ujfalusi <peter.ujfalusi@ti.com> -Date: Tue, 3 Mar 2015 13:38:14 +0200 -Subject: ASoC: omap-pcm: Correct dma mask - -commit d51199a83a2cf82a291d19ee852c44caa511427d upstream. - -DMA_BIT_MASK of 64 is not valid dma address mask for OMAPs, it should be -set to 32. -The 64 was introduced by commit (in 2009): -a152ff24b978 ASoC: OMAP: Make DMA 64 aligned - -But the dma_mask and coherent_dma_mask can not be used to specify alignment. - -Fixes: a152ff24b978 (ASoC: OMAP: Make DMA 64 aligned) -Reported-by: Grygorii Strashko <Grygorii.Strashko@linaro.org> -Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -[lizf: Backported to 3.4: there's no dma_coerce_mask_and_coherent()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/omap/omap-pcm.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/sound/soc/omap/omap-pcm.c -+++ b/sound/soc/omap/omap-pcm.c -@@ -333,7 +333,7 @@ static struct snd_pcm_ops omap_pcm_ops = - .mmap = omap_pcm_mmap, - }; - --static u64 omap_pcm_dmamask = DMA_BIT_MASK(64); -+static u64 omap_pcm_dmamask = DMA_BIT_MASK(32); - - static int omap_pcm_preallocate_dma_buffer(struct snd_pcm *pcm, - int stream) -@@ -384,7 +384,7 @@ static int omap_pcm_new(struct snd_soc_p - if (!card->dev->dma_mask) - card->dev->dma_mask = &omap_pcm_dmamask; - if (!card->dev->coherent_dma_mask) -- card->dev->coherent_dma_mask = DMA_BIT_MASK(64); -+ card->dev->coherent_dma_mask = DMA_BIT_MASK(32); - - if (pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream) { - ret = omap_pcm_preallocate_dma_buffer(pcm, diff --git a/patches/asoc-sgtl5000-remove-useless-register-write-clearing-chrgpump_powerup.patch b/patches/asoc-sgtl5000-remove-useless-register-write-clearing-chrgpump_powerup.patch deleted file mode 100644 index 4a650df..0000000 --- a/patches/asoc-sgtl5000-remove-useless-register-write-clearing-chrgpump_powerup.patch +++ /dev/null @@ -1,39 +0,0 @@ -From c7d910b87d3c8e9fcf4077089ca4327c12eee099 Mon Sep 17 00:00:00 2001 -From: Eric Nelson <eric.nelson@boundarydevices.com> -Date: Fri, 27 Feb 2015 08:06:45 -0700 -Subject: ASoC: sgtl5000: remove useless register write clearing - CHRGPUMP_POWERUP - -commit c7d910b87d3c8e9fcf4077089ca4327c12eee099 upstream. - -The SGTL5000_CHIP_ANA_POWER register is cached. Update the cached -value instead of writing it directly. - -Patch inspired by Russell King's more colorful remarks in this -patch: - https://github.com/SolidRun/linux-imx6-3.14/commit/dd4bf6a - -Signed-off-by: Eric Nelson <eric.nelson@boundarydevices.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/sgtl5000.c | 8 +------- - 1 file changed, 1 insertion(+), 7 deletions(-) - ---- a/sound/soc/codecs/sgtl5000.c -+++ b/sound/soc/codecs/sgtl5000.c -@@ -1107,13 +1107,7 @@ static int sgtl5000_set_power_regs(struc - /* Enable VDDC charge pump */ - ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP; - } else if (vddio >= 3100 && vdda >= 3100) { -- /* -- * if vddio and vddd > 3.1v, -- * charge pump should be clean before set ana_pwr -- */ -- snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER, -- SGTL5000_VDDC_CHRGPMP_POWERUP, 0); -- -+ ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP; - /* VDDC use VDDIO rail */ - lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD; - lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO << diff --git a/patches/asoc-wm2000-fix-wrong-value-references-for-boolean-kctl.patch b/patches/asoc-wm2000-fix-wrong-value-references-for-boolean-kctl.patch deleted file mode 100644 index 3cef06d..0000000 --- a/patches/asoc-wm2000-fix-wrong-value-references-for-boolean-kctl.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 00a14c2968e3d55817e0fa35c78106ca840537bf Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 10 Mar 2015 12:39:09 +0100 -Subject: ASoC: wm2000: Fix wrong value references for boolean kctl - -commit 00a14c2968e3d55817e0fa35c78106ca840537bf upstream. - -The correct values referred by a boolean control are -value.integer.value[], not value.enumerated.item[]. -The former is long while the latter is int, so it's even incompatible -on 64bit architectures. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/wm2000.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - ---- a/sound/soc/codecs/wm2000.c -+++ b/sound/soc/codecs/wm2000.c -@@ -581,7 +581,7 @@ static int wm2000_anc_mode_get(struct sn - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev); - -- ucontrol->value.enumerated.item[0] = wm2000->anc_active; -+ ucontrol->value.integer.value[0] = wm2000->anc_active; - - return 0; - } -@@ -591,7 +591,7 @@ static int wm2000_anc_mode_put(struct sn - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev); -- int anc_active = ucontrol->value.enumerated.item[0]; -+ int anc_active = ucontrol->value.integer.value[0]; - - if (anc_active > 1) - return -EINVAL; -@@ -607,7 +607,7 @@ static int wm2000_speaker_get(struct snd - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev); - -- ucontrol->value.enumerated.item[0] = wm2000->spk_ena; -+ ucontrol->value.integer.value[0] = wm2000->spk_ena; - - return 0; - } -@@ -617,7 +617,7 @@ static int wm2000_speaker_put(struct snd - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev); -- int val = ucontrol->value.enumerated.item[0]; -+ int val = ucontrol->value.integer.value[0]; - - if (val > 1) - return -EINVAL; diff --git a/patches/asoc-wm8731-fix-wrong-value-references-for-boolean-kctl.patch b/patches/asoc-wm8731-fix-wrong-value-references-for-boolean-kctl.patch deleted file mode 100644 index 7202fa7..0000000 --- a/patches/asoc-wm8731-fix-wrong-value-references-for-boolean-kctl.patch +++ /dev/null @@ -1,40 +0,0 @@ -From bd14016fbf31aa199026f1e2358eab695f374eb1 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 10 Mar 2015 12:39:10 +0100 -Subject: ASoC: wm8731: Fix wrong value references for boolean kctl - -commit bd14016fbf31aa199026f1e2358eab695f374eb1 upstream. - -The correct values referred by a boolean control are -value.integer.value[], not value.enumerated.item[]. -The former is long while the latter is int, so it's even incompatible -on 64bit architectures. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/wm8731.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/sound/soc/codecs/wm8731.c -+++ b/sound/soc/codecs/wm8731.c -@@ -120,7 +120,7 @@ static int wm8731_get_deemph(struct snd_ - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = wm8731->deemph; -+ ucontrol->value.integer.value[0] = wm8731->deemph; - - return 0; - } -@@ -130,7 +130,7 @@ static int wm8731_put_deemph(struct snd_ - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec); -- int deemph = ucontrol->value.enumerated.item[0]; -+ int deemph = ucontrol->value.integer.value[0]; - int ret = 0; - - if (deemph > 1) diff --git a/patches/asoc-wm8903-fix-wrong-value-references-for-boolean-kctl.patch b/patches/asoc-wm8903-fix-wrong-value-references-for-boolean-kctl.patch deleted file mode 100644 index c45ac91..0000000 --- a/patches/asoc-wm8903-fix-wrong-value-references-for-boolean-kctl.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 24cc883c1fd16df34211ae41624aa6d3cd906693 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 10 Mar 2015 12:39:11 +0100 -Subject: ASoC: wm8903: Fix wrong value references for boolean kctl - -commit 24cc883c1fd16df34211ae41624aa6d3cd906693 upstream. - -The correct values referred by a boolean control are -value.integer.value[], not value.enumerated.item[]. -The former is long while the latter is int, so it's even incompatible -on 64bit architectures. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/wm8903.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/sound/soc/codecs/wm8903.c -+++ b/sound/soc/codecs/wm8903.c -@@ -445,7 +445,7 @@ static int wm8903_get_deemph(struct snd_ - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = wm8903->deemph; -+ ucontrol->value.integer.value[0] = wm8903->deemph; - - return 0; - } -@@ -455,7 +455,7 @@ static int wm8903_put_deemph(struct snd_ - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec); -- int deemph = ucontrol->value.enumerated.item[0]; -+ int deemph = ucontrol->value.integer.value[0]; - int ret = 0; - - if (deemph > 1) diff --git a/patches/asoc-wm8904-fix-wrong-value-references-for-boolean-kctl.patch b/patches/asoc-wm8904-fix-wrong-value-references-for-boolean-kctl.patch deleted file mode 100644 index 5992ccb..0000000 --- a/patches/asoc-wm8904-fix-wrong-value-references-for-boolean-kctl.patch +++ /dev/null @@ -1,40 +0,0 @@ -From eaddf6fd959074f6a6e71deffe079c71eef35da6 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 10 Mar 2015 12:39:12 +0100 -Subject: ASoC: wm8904: Fix wrong value references for boolean kctl - -commit eaddf6fd959074f6a6e71deffe079c71eef35da6 upstream. - -The correct values referred by a boolean control are -value.integer.value[], not value.enumerated.item[]. -The former is long while the latter is int, so it's even incompatible -on 64bit architectures. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/wm8904.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/sound/soc/codecs/wm8904.c -+++ b/sound/soc/codecs/wm8904.c -@@ -528,7 +528,7 @@ static int wm8904_get_deemph(struct snd_ - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = wm8904->deemph; -+ ucontrol->value.integer.value[0] = wm8904->deemph; - return 0; - } - -@@ -537,7 +537,7 @@ static int wm8904_put_deemph(struct snd_ - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec); -- int deemph = ucontrol->value.enumerated.item[0]; -+ int deemph = ucontrol->value.integer.value[0]; - - if (deemph > 1) - return -EINVAL; diff --git a/patches/asoc-wm8955-fix-wrong-value-references-for-boolean-kctl.patch b/patches/asoc-wm8955-fix-wrong-value-references-for-boolean-kctl.patch deleted file mode 100644 index 686a840..0000000 --- a/patches/asoc-wm8955-fix-wrong-value-references-for-boolean-kctl.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 07892b10356f17717abdc578acbef72db86c880e Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 10 Mar 2015 12:39:13 +0100 -Subject: ASoC: wm8955: Fix wrong value references for boolean kctl - -commit 07892b10356f17717abdc578acbef72db86c880e upstream. - -The correct values referred by a boolean control are -value.integer.value[], not value.enumerated.item[]. -The former is long while the latter is int, so it's even incompatible -on 64bit architectures. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/wm8955.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/sound/soc/codecs/wm8955.c -+++ b/sound/soc/codecs/wm8955.c -@@ -393,7 +393,7 @@ static int wm8955_get_deemph(struct snd_ - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = wm8955->deemph; -+ ucontrol->value.integer.value[0] = wm8955->deemph; - return 0; - } - -@@ -402,7 +402,7 @@ static int wm8955_put_deemph(struct snd_ - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec); -- int deemph = ucontrol->value.enumerated.item[0]; -+ int deemph = ucontrol->value.integer.value[0]; - - if (deemph > 1) - return -EINVAL; diff --git a/patches/asoc-wm8960-fix-wrong-value-references-for-boolean-kctl.patch b/patches/asoc-wm8960-fix-wrong-value-references-for-boolean-kctl.patch deleted file mode 100644 index d5ff183..0000000 --- a/patches/asoc-wm8960-fix-wrong-value-references-for-boolean-kctl.patch +++ /dev/null @@ -1,40 +0,0 @@ -From b4a18c8b1af15ebfa9054a3d2aef7b0a7e6f2a05 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 10 Mar 2015 12:39:14 +0100 -Subject: ASoC: wm8960: Fix wrong value references for boolean kctl - -commit b4a18c8b1af15ebfa9054a3d2aef7b0a7e6f2a05 upstream. - -The correct values referred by a boolean control are -value.integer.value[], not value.enumerated.item[]. -The former is long while the latter is int, so it's even incompatible -on 64bit architectures. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> -Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com> -Signed-off-by: Mark Brown <broonie@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - sound/soc/codecs/wm8960.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/sound/soc/codecs/wm8960.c -+++ b/sound/soc/codecs/wm8960.c -@@ -132,7 +132,7 @@ static int wm8960_get_deemph(struct snd_ - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec); - -- ucontrol->value.enumerated.item[0] = wm8960->deemph; -+ ucontrol->value.integer.value[0] = wm8960->deemph; - return 0; - } - -@@ -141,7 +141,7 @@ static int wm8960_put_deemph(struct snd_ - { - struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); - struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec); -- int deemph = ucontrol->value.enumerated.item[0]; -+ int deemph = ucontrol->value.integer.value[0]; - - if (deemph > 1) - return -EINVAL; diff --git a/patches/ath5k-fix-spontaneus-ar5312-freezes.patch b/patches/ath5k-fix-spontaneus-ar5312-freezes.patch deleted file mode 100644 index 7fd50af..0000000 --- a/patches/ath5k-fix-spontaneus-ar5312-freezes.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 8bfae4f9938b6c1f033a5159febe97e441d6d526 Mon Sep 17 00:00:00 2001 -From: Sergey Ryazanov <ryazanov.s.a@gmail.com> -Date: Wed, 4 Feb 2015 00:21:13 +0300 -Subject: ath5k: fix spontaneus AR5312 freezes - -commit 8bfae4f9938b6c1f033a5159febe97e441d6d526 upstream. - -Sometimes while CPU have some load and ath5k doing the wireless -interface reset the whole WiSoC completely freezes. Set of tests shows -that using atomic delay function while we wait interface reset helps to -avoid such freezes. - -The easiest way to reproduce this issue: create a station interface, -start continous scan with wpa_supplicant and load CPU by something. Or -just create multiple station interfaces and put them all in continous -scan. - -This patch partially reverts the commit 1846ac3dbec0 ("ath5k: Use -usleep_range where possible"), which replaces initial udelay() -by usleep_range(). - -I do not know actual source of this issue, but all looks like that HW -freeze is caused by transaction on internal SoC bus, while wireless -block is in reset state. - -Also I should note that I do not know how many chips are affected, but I -did not see this issue with chips, other than AR5312. - -CC: Jiri Slaby <jirislaby@gmail.com> -CC: Nick Kossifidis <mickflemm@gmail.com> -CC: Luis R. Rodriguez <mcgrof@do-not-panic.com> -Fixes: 1846ac3dbec0 ("ath5k: Use usleep_range where possible") -Reported-by: Christophe Prevotaux <c.prevotaux@rural-networks.com> -Tested-by: Christophe Prevotaux <c.prevotaux@rural-networks.com> -Tested-by: Eric Bree <ebree@nltinc.com> -Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com> -Signed-off-by: Kalle Valo <kvalo@codeaurora.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/wireless/ath/ath5k/reset.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/net/wireless/ath/ath5k/reset.c -+++ b/drivers/net/wireless/ath/ath5k/reset.c -@@ -476,7 +476,7 @@ ath5k_hw_wisoc_reset(struct ath5k_hw *ah - regval = ioread32(reg); - iowrite32(regval | val, reg); - regval = ioread32(reg); -- usleep_range(100, 150); -+ udelay(100); /* NB: should be atomic */ - - /* Bring BB/MAC out of reset */ - iowrite32(regval & ~val, reg); diff --git a/patches/autofs4-check-dev-ioctl-size-before-allocating.patch b/patches/autofs4-check-dev-ioctl-size-before-allocating.patch deleted file mode 100644 index 2054350..0000000 --- a/patches/autofs4-check-dev-ioctl-size-before-allocating.patch +++ /dev/null @@ -1,35 +0,0 @@ -From e53d77eb8bb616e903e34cc7a918401bee3b5149 Mon Sep 17 00:00:00 2001 -From: Sasha Levin <sasha.levin@oracle.com> -Date: Tue, 8 Apr 2014 16:04:11 -0700 -Subject: autofs4: check dev ioctl size before allocating - -commit e53d77eb8bb616e903e34cc7a918401bee3b5149 upstream. - -There wasn't any check of the size passed from userspace before trying -to allocate the memory required. - -This meant that userspace might request more space than allowed, -triggering an OOM. - -Signed-off-by: Sasha Levin <sasha.levin@oracle.com> -Signed-off-by: Ian Kent <raven@themaw.net> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/autofs4/dev-ioctl.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/fs/autofs4/dev-ioctl.c -+++ b/fs/autofs4/dev-ioctl.c -@@ -103,6 +103,9 @@ static struct autofs_dev_ioctl *copy_dev - if (tmp.size < sizeof(tmp)) - return ERR_PTR(-EINVAL); - -+ if (tmp.size > (PATH_MAX + sizeof(tmp))) -+ return ERR_PTR(-ENAMETOOLONG); -+ - res = memdup_user(in, tmp.size); - if (!IS_ERR(res)) - res->size = tmp.size; diff --git a/patches/autofs4-copy_dev_ioctl-keep-the-value-of-size-we-d-used-for-allocation.patch b/patches/autofs4-copy_dev_ioctl-keep-the-value-of-size-we-d-used-for-allocation.patch deleted file mode 100644 index af152e9..0000000 --- a/patches/autofs4-copy_dev_ioctl-keep-the-value-of-size-we-d-used-for-allocation.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 0a280962dc6e117e0e4baa668453f753579265d9 Mon Sep 17 00:00:00 2001 -From: Al Viro <viro@zeniv.linux.org.uk> -Date: Sat, 21 Feb 2015 22:19:57 -0500 -Subject: autofs4 copy_dev_ioctl(): keep the value of ->size we'd used for - allocation - -commit 0a280962dc6e117e0e4baa668453f753579265d9 upstream. - -X-Coverup: just ask spender -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/autofs4/dev-ioctl.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - ---- a/fs/autofs4/dev-ioctl.c -+++ b/fs/autofs4/dev-ioctl.c -@@ -95,7 +95,7 @@ static int check_dev_ioctl_version(int c - */ - static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in) - { -- struct autofs_dev_ioctl tmp; -+ struct autofs_dev_ioctl tmp, *res; - - if (copy_from_user(&tmp, in, sizeof(tmp))) - return ERR_PTR(-EFAULT); -@@ -103,7 +103,11 @@ static struct autofs_dev_ioctl *copy_dev - if (tmp.size < sizeof(tmp)) - return ERR_PTR(-EINVAL); - -- return memdup_user(in, tmp.size); -+ res = memdup_user(in, tmp.size); -+ if (!IS_ERR(res)) -+ res->size = tmp.size; -+ -+ return res; - } - - static inline void free_dev_ioctl(struct autofs_dev_ioctl *param) diff --git a/patches/axonram-fix-bug-in-direct_access.patch b/patches/axonram-fix-bug-in-direct_access.patch deleted file mode 100644 index d84464c..0000000 --- a/patches/axonram-fix-bug-in-direct_access.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 91117a20245b59f70b563523edbf998a62fc6383 Mon Sep 17 00:00:00 2001 -From: Matthew Wilcox <matthew.r.wilcox@intel.com> -Date: Wed, 7 Jan 2015 18:04:18 +0200 -Subject: axonram: Fix bug in direct_access - -commit 91117a20245b59f70b563523edbf998a62fc6383 upstream. - -The 'pfn' returned by axonram was completely bogus, and has been since -2008. - -Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com> -Reviewed-by: Jan Kara <jack@suse.cz> -Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> -Signed-off-by: Jens Axboe <axboe@fb.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/powerpc/sysdev/axonram.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/arch/powerpc/sysdev/axonram.c -+++ b/arch/powerpc/sysdev/axonram.c -@@ -155,7 +155,7 @@ axon_ram_direct_access(struct block_devi - } - - *kaddr = (void *)(bank->ph_addr + offset); -- *pfn = virt_to_phys(kaddr) >> PAGE_SHIFT; -+ *pfn = virt_to_phys(*kaddr) >> PAGE_SHIFT; - - return 0; - } diff --git a/patches/be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch b/patches/be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch deleted file mode 100644 index 0cf7cdf..0000000 --- a/patches/be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 2e7cee027b26cbe7e6685a7a14bd2850bfe55d33 Mon Sep 17 00:00:00 2001 -From: John Soni Jose <sony.john-n@emulex.com> -Date: Thu, 12 Feb 2015 06:45:47 +0530 -Subject: be2iscsi: Fix kernel panic when device initialization fails - -commit 2e7cee027b26cbe7e6685a7a14bd2850bfe55d33 upstream. - -Kernel panic was happening as iscsi_host_remove() was called on -a host which was not yet added. - -Signed-off-by: John Soni Jose <sony.john-n@emulex.com> -Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> -Signed-off-by: James Bottomley <JBottomley@Odin.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/be2iscsi/be_main.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/scsi/be2iscsi/be_main.c -+++ b/drivers/scsi/be2iscsi/be_main.c -@@ -4398,9 +4398,9 @@ free_port: - hba_free: - if (phba->msix_enabled) - pci_disable_msix(phba->pcidev); -- iscsi_host_remove(phba->shost); - pci_dev_put(phba->pcidev); - iscsi_host_free(phba->shost); -+ pci_set_drvdata(pcidev, NULL); - disable_pci: - pci_disable_device(pcidev); - return ret; diff --git a/patches/bluetooth-ath3k-add-support-of-ar3012-bluetooth-13d3-3423-device.patch b/patches/bluetooth-ath3k-add-support-of-ar3012-bluetooth-13d3-3423-device.patch deleted file mode 100644 index 2431326..0000000 --- a/patches/bluetooth-ath3k-add-support-of-ar3012-bluetooth-13d3-3423-device.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 033efa920a7f22a8caf7a38d851a2f451781bbf7 Mon Sep 17 00:00:00 2001 -From: Dmitry Tunin <hanipouspilot@gmail.com> -Date: Sun, 18 Jan 2015 00:16:51 +0300 -Subject: Bluetooth: ath3k: Add support of AR3012 bluetooth 13d3:3423 device - -commit 033efa920a7f22a8caf7a38d851a2f451781bbf7 upstream. - -Add support of 13d3:3423 device. - -BugLink: https://bugs.launchpad.net/bugs/1411193 - -T: Bus=01 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#= 5 Spd=12 MxCh= 0 -D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 -P: Vendor=13d3 ProdID=3423 Rev= 0.01 -C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA -A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 -I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms -E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms -E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms -I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms -I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms -I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms -I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms -I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms -I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb -E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms -E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms - -Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com> -Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/bluetooth/ath3k.c | 2 ++ - drivers/bluetooth/btusb.c | 1 + - 2 files changed, 3 insertions(+) - ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -101,6 +101,7 @@ static struct usb_device_id ath3k_table[ - { USB_DEVICE(0x13d3, 0x3393) }, - { USB_DEVICE(0x13d3, 0x3402) }, - { USB_DEVICE(0x13d3, 0x3408) }, -+ { USB_DEVICE(0x13d3, 0x3423) }, - { USB_DEVICE(0x13d3, 0x3432) }, - - /* Atheros AR5BBU12 with sflash firmware */ -@@ -149,6 +150,7 @@ static struct usb_device_id ath3k_blist_ - { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU22 with sflash firmware */ ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -179,6 +179,7 @@ static struct usb_device_id blacklist_ta - { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, - - /* Atheros AR5BBU12 with sflash firmware */ diff --git a/patches/bnx2x-force-fundamental-reset-for-eeh-recovery.patch b/patches/bnx2x-force-fundamental-reset-for-eeh-recovery.patch deleted file mode 100644 index edf2e38..0000000 --- a/patches/bnx2x-force-fundamental-reset-for-eeh-recovery.patch +++ /dev/null @@ -1,33 +0,0 @@ -From da293700568ed3d96fcf062ac15d7d7c41377f11 Mon Sep 17 00:00:00 2001 -From: Brian King <brking@linux.vnet.ibm.com> -Date: Wed, 4 Mar 2015 08:09:44 -0600 -Subject: bnx2x: Force fundamental reset for EEH recovery - -commit da293700568ed3d96fcf062ac15d7d7c41377f11 upstream. - -EEH recovery for bnx2x based adapters is not reliable on all Power -systems using the default hot reset, which can result in an -unrecoverable EEH error. Forcing the use of fundamental reset -during EEH recovery fixes this. - -Signed-off-by: Brian King <brking@linux.vnet.ibm.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 4 ++++ - 1 file changed, 4 insertions(+) - ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -@@ -10934,6 +10934,10 @@ static int __devinit bnx2x_init_dev(stru - /* clean indirect addresses */ - pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS, - PCICFG_VENDOR_ID_OFFSET); -+ -+ /* Set PCIe reset type to fundamental for EEH recovery */ -+ pdev->needs_freset = 1; -+ - /* - * Clean the following indirect addresses for all functions since it - * is not used by the driver. diff --git a/patches/can-add-missing-initialisations-in-can-related-skbuffs.patch b/patches/can-add-missing-initialisations-in-can-related-skbuffs.patch deleted file mode 100644 index 3731983..0000000 --- a/patches/can-add-missing-initialisations-in-can-related-skbuffs.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 969439016d2cf61fef53a973d7e6d2061c3793b1 Mon Sep 17 00:00:00 2001 -From: Oliver Hartkopp <socketcan@hartkopp.net> -Date: Mon, 23 Feb 2015 20:37:54 +0100 -Subject: can: add missing initialisations in CAN related skbuffs - -commit 969439016d2cf61fef53a973d7e6d2061c3793b1 upstream. - -When accessing CAN network interfaces with AF_PACKET sockets e.g. by dhclient -this can lead to a skb_under_panic due to missing skb initialisations. - -Add the missing initialisations at the CAN skbuff creation times on driver -level (rx path) and in the network layer (tx path). - -Reported-by: Austin Schuh <austin@peloton-tech.com> -Reported-by: Daniel Steer <daniel.steer@mclaren.com> -Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> -Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> -[lizf: Backported to 3.4: - - adjust context - - drop changes to alloc_canfd_skb(), as there's no such function] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/can/dev.c | 5 +++++ - net/can/af_can.c | 3 +++ - 2 files changed, 8 insertions(+) - ---- a/drivers/net/can/dev.c -+++ b/drivers/net/can/dev.c -@@ -475,6 +475,11 @@ struct sk_buff *alloc_can_skb(struct net - skb->protocol = htons(ETH_P_CAN); - skb->pkt_type = PACKET_BROADCAST; - skb->ip_summed = CHECKSUM_UNNECESSARY; -+ -+ skb_reset_mac_header(skb); -+ skb_reset_network_header(skb); -+ skb_reset_transport_header(skb); -+ - *cf = (struct can_frame *)skb_put(skb, sizeof(struct can_frame)); - memset(*cf, 0, sizeof(struct can_frame)); - ---- a/net/can/af_can.c -+++ b/net/can/af_can.c -@@ -244,6 +244,9 @@ int can_send(struct sk_buff *skb, int lo - } - - skb->protocol = htons(ETH_P_CAN); -+ skb->ip_summed = CHECKSUM_UNNECESSARY; -+ -+ skb_reset_mac_header(skb); - skb_reset_network_header(skb); - skb_reset_transport_header(skb); - diff --git a/patches/cdc-acm-add-sanity-checks.patch b/patches/cdc-acm-add-sanity-checks.patch deleted file mode 100644 index fec2df1..0000000 --- a/patches/cdc-acm-add-sanity-checks.patch +++ /dev/null @@ -1,87 +0,0 @@ -From 7e860a6e7aa62b337a61110430cd633db5b0d2dd Mon Sep 17 00:00:00 2001 -From: Oliver Neukum <oneukum@suse.de> -Date: Wed, 28 Jan 2015 11:14:55 +0100 -Subject: cdc-acm: add sanity checks - -commit 7e860a6e7aa62b337a61110430cd633db5b0d2dd upstream. - -Check the special CDC headers for a plausible minimum length. -Another big operating systems ignores such garbage. - -Signed-off-by: Oliver Neukum <oneukum@suse.de> -Reviewed-by: Adam Lee <adam8157@gmail.com> -Tested-by: Adam Lee <adam8157@gmail.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/class/cdc-acm.c | 21 ++++++++++++++++----- - 1 file changed, 16 insertions(+), 5 deletions(-) - ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1008,6 +1008,7 @@ static int acm_probe(struct usb_interfac - unsigned long quirks; - int num_rx_buf; - int i; -+ unsigned int elength = 0; - int combined_interfaces = 0; - - /* normal quirks */ -@@ -1047,9 +1048,12 @@ static int acm_probe(struct usb_interfac - dev_err(&intf->dev, "skipping garbage\n"); - goto next_desc; - } -+ elength = buffer[0]; - - switch (buffer[2]) { - case USB_CDC_UNION_TYPE: /* we've found it */ -+ if (elength < sizeof(struct usb_cdc_union_desc)) -+ goto next_desc; - if (union_header) { - dev_err(&intf->dev, "More than one " - "union descriptor, skipping ...\n"); -@@ -1058,31 +1062,38 @@ static int acm_probe(struct usb_interfac - union_header = (struct usb_cdc_union_desc *)buffer; - break; - case USB_CDC_COUNTRY_TYPE: /* export through sysfs*/ -+ if (elength < sizeof(struct usb_cdc_country_functional_desc)) -+ goto next_desc; - cfd = (struct usb_cdc_country_functional_desc *)buffer; - break; - case USB_CDC_HEADER_TYPE: /* maybe check version */ - break; /* for now we ignore it */ - case USB_CDC_ACM_TYPE: -+ if (elength < 4) -+ goto next_desc; - ac_management_function = buffer[3]; - break; - case USB_CDC_CALL_MANAGEMENT_TYPE: -+ if (elength < 5) -+ goto next_desc; - call_management_function = buffer[3]; - call_interface_num = buffer[4]; - if ( (quirks & NOT_A_MODEM) == 0 && (call_management_function & 3) != 3) - dev_err(&intf->dev, "This device cannot do calls on its own. It is not a modem.\n"); - break; - default: -- /* there are LOTS more CDC descriptors that -+ /* -+ * there are LOTS more CDC descriptors that - * could legitimately be found here. - */ - dev_dbg(&intf->dev, "Ignoring descriptor: " -- "type %02x, length %d\n", -- buffer[2], buffer[0]); -+ "type %02x, length %ud\n", -+ buffer[2], elength); - break; - } - next_desc: -- buflen -= buffer[0]; -- buffer += buffer[0]; -+ buflen -= elength; -+ buffer += elength; - } - - if (!union_header) { diff --git a/patches/cdc-acm-prevent-infinite-loop-when-parsing-cdc-headers.patch b/patches/cdc-acm-prevent-infinite-loop-when-parsing-cdc-headers.patch deleted file mode 100644 index f07caee..0000000 --- a/patches/cdc-acm-prevent-infinite-loop-when-parsing-cdc-headers.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 0d3bba0287d4e284c3ec7d3397e81eec920d5e7e Mon Sep 17 00:00:00 2001 -From: Quentin Casasnovas <quentin.casasnovas@oracle.com> -Date: Tue, 14 Apr 2015 11:25:43 +0200 -Subject: cdc-acm: prevent infinite loop when parsing CDC headers. - -commit 0d3bba0287d4e284c3ec7d3397e81eec920d5e7e upstream. - -Phil and I found out a problem with commit: - - 7e860a6e7aa6 ("cdc-acm: add sanity checks") - -It added some sanity checks to ignore potential garbage in CDC headers but -also introduced a potential infinite loop. This can happen at the first -loop iteration (elength = 0 in that case) if the description isn't a -DT_CS_INTERFACE or later if 'buffer[0]' is zero. - -It should also be noted that the wrong length was being added to 'buffer' -in case 'buffer[1]' was not a DT_CS_INTERFACE descriptor, since elength was -assigned after that check in the loop. - -A specially crafted USB device could be used to trigger this infinite loop. - -Fixes: 7e860a6e7aa6 ("cdc-acm: add sanity checks") -Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com> -Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com> -CC: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> -CC: Oliver Neukum <oneukum@suse.de> -CC: Adam Lee <adam8157@gmail.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/class/cdc-acm.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1044,11 +1044,16 @@ static int acm_probe(struct usb_interfac - } - - while (buflen > 0) { -+ elength = buffer[0]; -+ if (!elength) { -+ dev_err(&intf->dev, "skipping garbage byte\n"); -+ elength = 1; -+ goto next_desc; -+ } - if (buffer[1] != USB_DT_CS_INTERFACE) { - dev_err(&intf->dev, "skipping garbage\n"); - goto next_desc; - } -- elength = buffer[0]; - - switch (buffer[2]) { - case USB_CDC_UNION_TYPE: /* we've found it */ diff --git a/patches/change-email-address-for-8250_pci.patch b/patches/change-email-address-for-8250_pci.patch deleted file mode 100644 index 27fc5b7..0000000 --- a/patches/change-email-address-for-8250_pci.patch +++ /dev/null @@ -1,28 +0,0 @@ -From f2e0ea861117bda073d1d7ffbd3120c07c0d5d34 Mon Sep 17 00:00:00 2001 -From: Russell King <rmk+kernel@arm.linux.org.uk> -Date: Fri, 6 Mar 2015 10:49:21 +0000 -Subject: Change email address for 8250_pci - -commit f2e0ea861117bda073d1d7ffbd3120c07c0d5d34 upstream. - -I'm still receiving reports to my email address, so let's point this -at the linux-serial mailing list instead. - -Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/tty/serial/8250/8250_pci.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -67,7 +67,7 @@ static void moan_device(const char *str, - "Please send the output of lspci -vv, this\n" - "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n" - "manufacturer and name of serial board or\n" -- "modem board to rmk+serial@arm.linux.org.uk.\n", -+ "modem board to <linux-serial@vger.kernel.org>.\n", - pci_name(dev), str, dev->vendor, dev->device, - dev->subsystem_vendor, dev->subsystem_device); - } diff --git a/patches/cifs-fix-use-after-free-bug-in-find_writable_file.patch b/patches/cifs-fix-use-after-free-bug-in-find_writable_file.patch deleted file mode 100644 index 624008f..0000000 --- a/patches/cifs-fix-use-after-free-bug-in-find_writable_file.patch +++ /dev/null @@ -1,76 +0,0 @@ -From e1e9bda22d7ddf88515e8fe401887e313922823e Mon Sep 17 00:00:00 2001 -From: David Disseldorp <ddiss@suse.de> -Date: Fri, 13 Mar 2015 14:20:29 +0100 -Subject: cifs: fix use-after-free bug in find_writable_file - -commit e1e9bda22d7ddf88515e8fe401887e313922823e upstream. - -Under intermittent network outages, find_writable_file() is susceptible -to the following race condition, which results in a user-after-free in -the cifs_writepages code-path: - -Thread 1 Thread 2 -======== ======== - -inv_file = NULL -refind = 0 -spin_lock(&cifs_file_list_lock) - -// invalidHandle found on openFileList - -inv_file = open_file -// inv_file->count currently 1 - -cifsFileInfo_get(inv_file) -// inv_file->count = 2 - -spin_unlock(&cifs_file_list_lock); - -cifs_reopen_file() cifs_close() -// fails (rc != 0) ->cifsFileInfo_put() - spin_lock(&cifs_file_list_lock) - // inv_file->count = 1 - spin_unlock(&cifs_file_list_lock) - -spin_lock(&cifs_file_list_lock); -list_move_tail(&inv_file->flist, - &cifs_inode->openFileList); -spin_unlock(&cifs_file_list_lock); - -cifsFileInfo_put(inv_file); -->spin_lock(&cifs_file_list_lock) - - // inv_file->count = 0 - list_del(&cifs_file->flist); - // cleanup!! - kfree(cifs_file); - - spin_unlock(&cifs_file_list_lock); - -spin_lock(&cifs_file_list_lock); -++refind; -// refind = 1 -goto refind_writable; - -At this point we loop back through with an invalid inv_file pointer -and a refind value of 1. On second pass, inv_file is not overwritten on -openFileList traversal, and is subsequently dereferenced. - -Signed-off-by: David Disseldorp <ddiss@suse.de> -Reviewed-by: Jeff Layton <jlayton@samba.org> -Signed-off-by: Steve French <smfrench@gmail.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/cifs/file.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -1613,6 +1613,7 @@ refind_writable: - cifsFileInfo_put(inv_file); - spin_lock(&cifs_file_list_lock); - ++refind; -+ inv_file = NULL; - goto refind_writable; - } - } diff --git a/patches/config-enable-need_dma_map_state-by-default-when-swiotlb-is-selected.patch b/patches/config-enable-need_dma_map_state-by-default-when-swiotlb-is-selected.patch deleted file mode 100644 index b0ea868..0000000 --- a/patches/config-enable-need_dma_map_state-by-default-when-swiotlb-is-selected.patch +++ /dev/null @@ -1,58 +0,0 @@ -From a6dfa128ce5c414ab46b1d690f7a1b8decb8526d Mon Sep 17 00:00:00 2001 -From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> -Date: Fri, 17 Apr 2015 15:04:48 -0400 -Subject: config: Enable NEED_DMA_MAP_STATE by default when SWIOTLB is selected - -commit a6dfa128ce5c414ab46b1d690f7a1b8decb8526d upstream. - -A huge amount of NIC drivers use the DMA API, however if -compiled under 32-bit an very important part of the DMA API can -be ommitted leading to the drivers not working at all -(especially if used with 'swiotlb=force iommu=soft'). - -As Prashant Sreedharan explains it: "the driver [tg3] uses -DEFINE_DMA_UNMAP_ADDR(), dma_unmap_addr_set() to keep a copy of -the dma "mapping" and dma_unmap_addr() to get the "mapping" -value. On most of the platforms this is a no-op, but ... with -"iommu=soft and swiotlb=force" this house keeping is required, -... otherwise we pass 0 while calling pci_unmap_/pci_dma_sync_ -instead of the DMA address." - -As such enable this even when using 32-bit kernels. - -Reported-by: Ian Jackson <Ian.Jackson@eu.citrix.com> -Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> -Acked-by: David S. Miller <davem@davemloft.net> -Acked-by: Prashant Sreedharan <prashant@broadcom.com> -Cc: Borislav Petkov <bp@alien8.de> -Cc: H. Peter Anvin <hpa@zytor.com> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Cc: Michael Chan <mchan@broadcom.com> -Cc: Thomas Gleixner <tglx@linutronix.de> -Cc: boris.ostrovsky@oracle.com -Cc: cascardo@linux.vnet.ibm.com -Cc: david.vrabel@citrix.com -Cc: sanjeevb@broadcom.com -Cc: siva.kallam@broadcom.com -Cc: vyasevich@gmail.com -Cc: xen-devel@lists.xensource.com -Link: http://lkml.kernel.org/r/20150417190448.GA9462@l.oracle.com -Signed-off-by: Ingo Molnar <mingo@kernel.org> -Cc: Ben Hutchings <ben@decadent.org.uk> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/Kconfig | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -129,7 +129,7 @@ config SBUS - bool - - config NEED_DMA_MAP_STATE -- def_bool (X86_64 || INTEL_IOMMU || DMA_API_DEBUG) -+ def_bool (X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB) - - config NEED_SG_DMA_LENGTH - def_bool y diff --git a/patches/console-fix-console-name-size-mismatch.patch b/patches/console-fix-console-name-size-mismatch.patch deleted file mode 100644 index 9f42cc3..0000000 --- a/patches/console-fix-console-name-size-mismatch.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 30a22c215a0007603ffc08021f2e8b64018517dd Mon Sep 17 00:00:00 2001 -From: Peter Hurley <peter@hurleysoftware.com> -Date: Sun, 1 Mar 2015 10:11:05 -0500 -Subject: console: Fix console name size mismatch - -commit 30a22c215a0007603ffc08021f2e8b64018517dd upstream. - -commit 6ae9200f2cab7 ("enlarge console.name") increased the storage -for the console name to 16 bytes, but not the corresponding -struct console_cmdline::name storage. Console names longer than -8 bytes cause read beyond end-of-string and failure to match -console; I'm not sure if there are other unexpected consequences. - -Signed-off-by: Peter Hurley <peter@hurleysoftware.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -[lizf: Backported to 3.4: - - adjust filename - - s/c->name/console_cmdline[i].name/] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/printk.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/kernel/printk.c -+++ b/kernel/printk.c -@@ -126,7 +126,7 @@ static struct console *exclusive_console - */ - struct console_cmdline - { -- char name[8]; /* Name of the driver */ -+ char name[16]; /* Name of the driver */ - int index; /* Minor dev. to use */ - char *options; /* Options for the driver */ - #ifdef CONFIG_A11Y_BRAILLE_CONSOLE -@@ -1498,6 +1498,7 @@ void register_console(struct console *ne - */ - for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; - i++) { -+ BUILD_BUG_ON(sizeof(console_cmdline[i].name) != sizeof(newcon->name)); - if (strcmp(console_cmdline[i].name, newcon->name) != 0) - continue; - if (newcon->index >= 0 && diff --git a/patches/cpufreq-speedstep-smi-enable-interrupts-when-waiting.patch b/patches/cpufreq-speedstep-smi-enable-interrupts-when-waiting.patch deleted file mode 100644 index d145ba6..0000000 --- a/patches/cpufreq-speedstep-smi-enable-interrupts-when-waiting.patch +++ /dev/null @@ -1,89 +0,0 @@ -From d4d4eda23794c701442e55129dd4f8f2fefd5e4d Mon Sep 17 00:00:00 2001 -From: Mikulas Patocka <mpatocka@redhat.com> -Date: Mon, 9 Feb 2015 13:38:17 -0500 -Subject: cpufreq: speedstep-smi: enable interrupts when waiting - -commit d4d4eda23794c701442e55129dd4f8f2fefd5e4d upstream. - -On Dell Latitude C600 laptop with Pentium 3 850MHz processor, the -speedstep-smi driver sometimes loads and sometimes doesn't load with -"change to state X failed" message. - -The hardware sometimes refuses to change frequency and in this case, we -need to retry later. I found out that we need to enable interrupts while -waiting. When we enable interrupts, the hardware blockage that prevents -frequency transition resolves and the transition is possible. With -disabled interrupts, the blockage doesn't resolve (no matter how long do -we wait). The exact reasons for this hardware behavior are unknown. - -This patch enables interrupts in the function speedstep_set_state that can -be called with disabled interrupts. However, this function is called with -disabled interrupts only from speedstep_get_freqs, so it shouldn't cause -any problem. - -Signed-off-by: Mikulas Patocka <mpatocka@redhat.com -Acked-by: Viresh Kumar <viresh.kumar@linaro.org> -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/cpufreq/speedstep-lib.c | 3 +++ - drivers/cpufreq/speedstep-smi.c | 12 ++++++++++++ - 2 files changed, 15 insertions(+) - ---- a/drivers/cpufreq/speedstep-lib.c -+++ b/drivers/cpufreq/speedstep-lib.c -@@ -400,6 +400,7 @@ unsigned int speedstep_get_freqs(enum sp - - pr_debug("previous speed is %u\n", prev_speed); - -+ preempt_disable(); - local_irq_save(flags); - - /* switch to low state */ -@@ -464,6 +465,8 @@ unsigned int speedstep_get_freqs(enum sp - - out: - local_irq_restore(flags); -+ preempt_enable(); -+ - return ret; - } - EXPORT_SYMBOL_GPL(speedstep_get_freqs); ---- a/drivers/cpufreq/speedstep-smi.c -+++ b/drivers/cpufreq/speedstep-smi.c -@@ -188,6 +188,7 @@ static void speedstep_set_state(unsigned - return; - - /* Disable IRQs */ -+ preempt_disable(); - local_irq_save(flags); - - command = (smi_sig & 0xffffff00) | (smi_cmd & 0xff); -@@ -198,9 +199,19 @@ static void speedstep_set_state(unsigned - - do { - if (retry) { -+ /* -+ * We need to enable interrupts, otherwise the blockage -+ * won't resolve. -+ * -+ * We disable preemption so that other processes don't -+ * run. If other processes were running, they could -+ * submit more DMA requests, making the blockage worse. -+ */ - pr_debug("retry %u, previous result %u, waiting...\n", - retry, result); -+ local_irq_enable(); - mdelay(retry * 50); -+ local_irq_disable(); - } - retry++; - __asm__ __volatile__( -@@ -217,6 +228,7 @@ static void speedstep_set_state(unsigned - - /* enable IRQs */ - local_irq_restore(flags); -+ preempt_enable(); - - if (new_state == state) - pr_debug("change to %u MHz succeeded after %u tries " diff --git a/patches/crypto-aesni-fix-memory-usage-in-gcm-decryption.patch b/patches/crypto-aesni-fix-memory-usage-in-gcm-decryption.patch deleted file mode 100644 index d3c65dc..0000000 --- a/patches/crypto-aesni-fix-memory-usage-in-gcm-decryption.patch +++ /dev/null @@ -1,62 +0,0 @@ -From ccfe8c3f7e52ae83155cb038753f4c75b774ca8a Mon Sep 17 00:00:00 2001 -From: Stephan Mueller <smueller@chronox.de> -Date: Thu, 12 Mar 2015 09:17:51 +0100 -Subject: crypto: aesni - fix memory usage in GCM decryption - -commit ccfe8c3f7e52ae83155cb038753f4c75b774ca8a upstream. - -The kernel crypto API logic requires the caller to provide the -length of (ciphertext || authentication tag) as cryptlen for the -AEAD decryption operation. Thus, the cipher implementation must -calculate the size of the plaintext output itself and cannot simply use -cryptlen. - -The RFC4106 GCM decryption operation tries to overwrite cryptlen memory -in req->dst. As the destination buffer for decryption only needs to hold -the plaintext memory but cryptlen references the input buffer holding -(ciphertext || authentication tag), the assumption of the destination -buffer length in RFC4106 GCM operation leads to a too large size. This -patch simply uses the already calculated plaintext size. - -In addition, this patch fixes the offset calculation of the AAD buffer -pointer: as mentioned before, cryptlen already includes the size of the -tag. Thus, the tag does not need to be added. With the addition, the AAD -will be written beyond the already allocated buffer. - -Note, this fixes a kernel crash that can be triggered from user space -via AF_ALG(aead) -- simply use the libkcapi test application -from [1] and update it to use rfc4106-gcm-aes. - -Using [1], the changes were tested using CAVS vectors to demonstrate -that the crypto operation still delivers the right results. - -[1] http://www.chronox.de/libkcapi.html - -CC: Tadeusz Struk <tadeusz.struk@intel.com> -Signed-off-by: Stephan Mueller <smueller@chronox.de> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/crypto/aesni-intel_glue.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/arch/x86/crypto/aesni-intel_glue.c -+++ b/arch/x86/crypto/aesni-intel_glue.c -@@ -1203,7 +1203,7 @@ static int __driver_rfc4106_decrypt(stru - src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC); - if (!src) - return -ENOMEM; -- assoc = (src + req->cryptlen + auth_tag_len); -+ assoc = (src + req->cryptlen); - scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0); - scatterwalk_map_and_copy(assoc, req->assoc, 0, - req->assoclen, 0); -@@ -1228,7 +1228,7 @@ static int __driver_rfc4106_decrypt(stru - scatterwalk_done(&src_sg_walk, 0, 0); - scatterwalk_done(&assoc_sg_walk, 0, 0); - } else { -- scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1); -+ scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1); - kfree(src); - } - return retval; diff --git a/patches/debugfs-leave-freeing-a-symlink-body-until-inode-eviction.patch b/patches/debugfs-leave-freeing-a-symlink-body-until-inode-eviction.patch deleted file mode 100644 index 1019486..0000000 --- a/patches/debugfs-leave-freeing-a-symlink-body-until-inode-eviction.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 0db59e59299f0b67450c5db21f7f316c8fb04e84 Mon Sep 17 00:00:00 2001 -From: Al Viro <viro@zeniv.linux.org.uk> -Date: Sat, 21 Feb 2015 22:05:11 -0500 -Subject: debugfs: leave freeing a symlink body until inode eviction - -commit 0db59e59299f0b67450c5db21f7f316c8fb04e84 upstream. - -As it is, we have debugfs_remove() racing with symlink traversals. -Supply ->evict_inode() and do freeing there - inode will remain -pinned until we are done with the symlink body. - -And rip the idiocy with checking if dentry is positive right after -we'd verified debugfs_positive(), which is a stronger check... - -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -[lizf: Backported to 3.4: - - call end_writeback() instead of clear_inode() - - call truncate_inode_pages() instead of truncate_inode_pages_final()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/debugfs/inode.c | 34 +++++++++++++++++----------------- - 1 file changed, 17 insertions(+), 17 deletions(-) - ---- a/fs/debugfs/inode.c -+++ b/fs/debugfs/inode.c -@@ -238,10 +238,19 @@ static int debugfs_show_options(struct s - return 0; - } - -+static void debugfs_evict_inode(struct inode *inode) -+{ -+ truncate_inode_pages(&inode->i_data, 0); -+ end_writeback(inode); -+ if (S_ISLNK(inode->i_mode)) -+ kfree(inode->i_private); -+} -+ - static const struct super_operations debugfs_super_operations = { - .statfs = simple_statfs, - .remount_fs = debugfs_remount, - .show_options = debugfs_show_options, -+ .evict_inode = debugfs_evict_inode, - }; - - static int debug_fill_super(struct super_block *sb, void *data, int silent) -@@ -459,23 +468,14 @@ static int __debugfs_remove(struct dentr - int ret = 0; - - if (debugfs_positive(dentry)) { -- if (dentry->d_inode) { -- dget(dentry); -- switch (dentry->d_inode->i_mode & S_IFMT) { -- case S_IFDIR: -- ret = simple_rmdir(parent->d_inode, dentry); -- break; -- case S_IFLNK: -- kfree(dentry->d_inode->i_private); -- /* fall through */ -- default: -- simple_unlink(parent->d_inode, dentry); -- break; -- } -- if (!ret) -- d_delete(dentry); -- dput(dentry); -- } -+ dget(dentry); -+ if (S_ISDIR(dentry->d_inode->i_mode)) -+ ret = simple_rmdir(parent->d_inode, dentry); -+ else -+ simple_unlink(parent->d_inode, dentry); -+ if (!ret) -+ d_delete(dentry); -+ dput(dentry); - } - return ret; - } diff --git a/patches/defer-processing-of-req_preempt-requests-for-blocked-devices.patch b/patches/defer-processing-of-req_preempt-requests-for-blocked-devices.patch deleted file mode 100644 index 55b2795..0000000 --- a/patches/defer-processing-of-req_preempt-requests-for-blocked-devices.patch +++ /dev/null @@ -1,76 +0,0 @@ -From bba0bdd7ad4713d82338bcd9b72d57e9335a664b Mon Sep 17 00:00:00 2001 -From: Bart Van Assche <bart.vanassche@sandisk.com> -Date: Wed, 4 Mar 2015 10:31:47 +0100 -Subject: Defer processing of REQ_PREEMPT requests for blocked devices - -commit bba0bdd7ad4713d82338bcd9b72d57e9335a664b upstream. - -SCSI transport drivers and SCSI LLDs block a SCSI device if the -transport layer is not operational. This means that in this state -no requests should be processed, even if the REQ_PREEMPT flag has -been set. This patch avoids that a rescan shortly after a cable -pull sporadically triggers the following kernel oops: - -BUG: unable to handle kernel paging request at ffffc9001a6bc084 -IP: [<ffffffffa04e08f2>] mlx4_ib_post_send+0xd2/0xb30 [mlx4_ib] -Process rescan-scsi-bus (pid: 9241, threadinfo ffff88053484a000, task ffff880534aae100) -Call Trace: - [<ffffffffa0718135>] srp_post_send+0x65/0x70 [ib_srp] - [<ffffffffa071b9df>] srp_queuecommand+0x1cf/0x3e0 [ib_srp] - [<ffffffffa0001ff1>] scsi_dispatch_cmd+0x101/0x280 [scsi_mod] - [<ffffffffa0009ad1>] scsi_request_fn+0x411/0x4d0 [scsi_mod] - [<ffffffff81223b37>] __blk_run_queue+0x27/0x30 - [<ffffffff8122a8d2>] blk_execute_rq_nowait+0x82/0x110 - [<ffffffff8122a9c2>] blk_execute_rq+0x62/0xf0 - [<ffffffffa000b0e8>] scsi_execute+0xe8/0x190 [scsi_mod] - [<ffffffffa000b2f3>] scsi_execute_req+0xa3/0x130 [scsi_mod] - [<ffffffffa000c1aa>] scsi_probe_lun+0x17a/0x450 [scsi_mod] - [<ffffffffa000ce86>] scsi_probe_and_add_lun+0x156/0x480 [scsi_mod] - [<ffffffffa000dc2f>] __scsi_scan_target+0xdf/0x1f0 [scsi_mod] - [<ffffffffa000dfa3>] scsi_scan_host_selected+0x183/0x1c0 [scsi_mod] - [<ffffffffa000edfb>] scsi_scan+0xdb/0xe0 [scsi_mod] - [<ffffffffa000ee13>] store_scan+0x13/0x20 [scsi_mod] - [<ffffffff811c8d9b>] sysfs_write_file+0xcb/0x160 - [<ffffffff811589de>] vfs_write+0xce/0x140 - [<ffffffff81158b53>] sys_write+0x53/0xa0 - [<ffffffff81464592>] system_call_fastpath+0x16/0x1b - [<00007f611c9d9300>] 0x7f611c9d92ff - -Reported-by: Max Gurtuvoy <maxg@mellanox.com> -Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> -Reviewed-by: Mike Christie <michaelc@cs.wisc.edu> -Signed-off-by: James Bottomley <JBottomley@Odin.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/scsi_lib.c | 4 +++- - include/linux/blk_types.h | 4 +++- - 2 files changed, 6 insertions(+), 2 deletions(-) - ---- a/drivers/scsi/scsi_lib.c -+++ b/drivers/scsi/scsi_lib.c -@@ -1209,9 +1209,11 @@ int scsi_prep_state_check(struct scsi_de - "rejecting I/O to dead device\n"); - ret = BLKPREP_KILL; - break; -- case SDEV_QUIESCE: - case SDEV_BLOCK: - case SDEV_CREATED_BLOCK: -+ ret = BLKPREP_DEFER; -+ break; -+ case SDEV_QUIESCE: - /* - * If the devices is blocked we defer normal commands. - */ ---- a/include/linux/blk_types.h -+++ b/include/linux/blk_types.h -@@ -144,7 +144,9 @@ enum rq_flag_bits { - __REQ_ELVPRIV, /* elevator private data attached */ - __REQ_FAILED, /* set if the request failed */ - __REQ_QUIET, /* don't worry about errors */ -- __REQ_PREEMPT, /* set for "ide_preempt" requests */ -+ __REQ_PREEMPT, /* set for "ide_preempt" requests and also -+ for requests for which the SCSI "quiesce" -+ state must be ignored. */ - __REQ_ALLOCED, /* request came from our alloc pool */ - __REQ_COPY_USER, /* contains copies of user pages */ - __REQ_FLUSH_SEQ, /* request for flush sequence */ diff --git a/patches/dm-fix-a-race-condition-in-dm_get_md.patch b/patches/dm-fix-a-race-condition-in-dm_get_md.patch deleted file mode 100644 index 5a7db3a..0000000 --- a/patches/dm-fix-a-race-condition-in-dm_get_md.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 2bec1f4a8832e74ebbe859f176d8a9cb20dd97f4 Mon Sep 17 00:00:00 2001 -From: Mikulas Patocka <mpatocka@redhat.com> -Date: Tue, 17 Feb 2015 14:30:53 -0500 -Subject: dm: fix a race condition in dm_get_md - -commit 2bec1f4a8832e74ebbe859f176d8a9cb20dd97f4 upstream. - -The function dm_get_md finds a device mapper device with a given dev_t, -increases the reference count and returns the pointer. - -dm_get_md calls dm_find_md, dm_find_md takes _minor_lock, finds the -device, tests that the device doesn't have DMF_DELETING or DMF_FREEING -flag, drops _minor_lock and returns pointer to the device. dm_get_md then -calls dm_get. dm_get calls BUG if the device has the DMF_FREEING flag, -otherwise it increments the reference count. - -There is a possible race condition - after dm_find_md exits and before -dm_get is called, there are no locks held, so the device may disappear or -DMF_FREEING flag may be set, which results in BUG. - -To fix this bug, we need to call dm_get while we hold _minor_lock. This -patch renames dm_find_md to dm_get_md and changes it so that it calls -dm_get while holding the lock. - -Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> -Signed-off-by: Mike Snitzer <snitzer@redhat.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/md/dm.c | 27 ++++++++++----------------- - 1 file changed, 10 insertions(+), 17 deletions(-) - ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -2232,7 +2232,7 @@ int dm_setup_md_queue(struct mapped_devi - return 0; - } - --static struct mapped_device *dm_find_md(dev_t dev) -+struct mapped_device *dm_get_md(dev_t dev) - { - struct mapped_device *md; - unsigned minor = MINOR(dev); -@@ -2243,12 +2243,15 @@ static struct mapped_device *dm_find_md( - spin_lock(&_minor_lock); - - md = idr_find(&_minor_idr, minor); -- if (md && (md == MINOR_ALLOCED || -- (MINOR(disk_devt(dm_disk(md))) != minor) || -- dm_deleting_md(md) || -- test_bit(DMF_FREEING, &md->flags))) { -- md = NULL; -- goto out; -+ if (md) { -+ if ((md == MINOR_ALLOCED || -+ (MINOR(disk_devt(dm_disk(md))) != minor) || -+ dm_deleting_md(md) || -+ test_bit(DMF_FREEING, &md->flags))) { -+ md = NULL; -+ goto out; -+ } -+ dm_get(md); - } - - out: -@@ -2256,16 +2259,6 @@ out: - - return md; - } -- --struct mapped_device *dm_get_md(dev_t dev) --{ -- struct mapped_device *md = dm_find_md(dev); -- -- if (md) -- dm_get(md); -- -- return md; --} - EXPORT_SYMBOL_GPL(dm_get_md); - - void *dm_get_mdptr(struct mapped_device *md) diff --git a/patches/dm-hold-suspend_lock-while-suspending-device-during-device-deletion.patch b/patches/dm-hold-suspend_lock-while-suspending-device-during-device-deletion.patch deleted file mode 100644 index 2d784d3..0000000 --- a/patches/dm-hold-suspend_lock-while-suspending-device-during-device-deletion.patch +++ /dev/null @@ -1,36 +0,0 @@ -From ab7c7bb6f4ab95dbca96fcfc4463cd69843e3e24 Mon Sep 17 00:00:00 2001 -From: Mikulas Patocka <mpatocka@redhat.com> -Date: Fri, 27 Feb 2015 14:04:27 -0500 -Subject: dm: hold suspend_lock while suspending device during device deletion - -commit ab7c7bb6f4ab95dbca96fcfc4463cd69843e3e24 upstream. - -__dm_destroy() must take the suspend_lock so that its presuspend and -postsuspend calls do not race with an internal suspend. - -Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> -Signed-off-by: Mike Snitzer <snitzer@redhat.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/md/dm.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -2295,10 +2295,16 @@ static void __dm_destroy(struct mapped_d - set_bit(DMF_FREEING, &md->flags); - spin_unlock(&_minor_lock); - -+ /* -+ * Take suspend_lock so that presuspend and postsuspend methods -+ * do not race with internal suspend. -+ */ -+ mutex_lock(&md->suspend_lock); - if (!dm_suspended_md(md)) { - dm_table_presuspend_targets(map); - dm_table_postsuspend_targets(map); - } -+ mutex_unlock(&md->suspend_lock); - - /* - * Rare, but there may be I/O requests still going to complete, diff --git a/patches/dm-io-deal-with-wandering-queue-limits-when-handling-req_discard-and-req_write_same.patch b/patches/dm-io-deal-with-wandering-queue-limits-when-handling-req_discard-and-req_write_same.patch deleted file mode 100644 index fac652d..0000000 --- a/patches/dm-io-deal-with-wandering-queue-limits-when-handling-req_discard-and-req_write_same.patch +++ /dev/null @@ -1,58 +0,0 @@ -From e5db29806b99ce2b2640d2e4d4fcb983cea115c5 Mon Sep 17 00:00:00 2001 -From: "Darrick J. Wong" <darrick.wong@oracle.com> -Date: Fri, 27 Feb 2015 10:44:38 -0800 -Subject: dm io: deal with wandering queue limits when handling REQ_DISCARD and - REQ_WRITE_SAME - -commit e5db29806b99ce2b2640d2e4d4fcb983cea115c5 upstream. - -Since it's possible for the discard and write same queue limits to -change while the upper level command is being sliced and diced, fix up -both of them (a) to reject IO if the special command is unsupported at -the start of the function and (b) read the limits once and let the -commands error out on their own if the status happens to change. - -Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> -Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> -Signed-off-by: Mike Snitzer <snitzer@redhat.com> -[lizf: Backported to 3.4: - - adjust context - - 3.4 doesn't support REQ_WRITE_SAME] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/md/dm-io.c | 16 +++++++++++----- - 1 file changed, 11 insertions(+), 5 deletions(-) - ---- a/drivers/md/dm-io.c -+++ b/drivers/md/dm-io.c -@@ -298,11 +298,17 @@ static void do_region(int rw, unsigned r - sector_t remaining = where->count; - struct request_queue *q = bdev_get_queue(where->bdev); - sector_t discard_sectors; -+ unsigned int uninitialized_var(special_cmd_max_sectors); - -- /* Reject unsupported discard requests */ -- if ((rw & REQ_DISCARD) && !blk_queue_discard(q)) { -- dec_count(io, region, -EOPNOTSUPP); -- return; -+ /* -+ * Reject unsupported discard and write same requests. -+ */ -+ if (rw & REQ_DISCARD) { -+ special_cmd_max_sectors = q->limits.max_discard_sectors; -+ if (special_cmd_max_sectors == 0) { -+ dec_count(io, region, -EOPNOTSUPP); -+ return; -+ } - } - - /* -@@ -327,7 +333,7 @@ static void do_region(int rw, unsigned r - store_io_and_region_in_bio(bio, io, region); - - if (rw & REQ_DISCARD) { -- discard_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining); -+ discard_sectors = min_t(sector_t, special_cmd_max_sectors, remaining); - bio->bi_size = discard_sectors << SECTOR_SHIFT; - remaining -= discard_sectors; - } else while (remaining) { diff --git a/patches/dm-io-reject-unsupported-discard-requests-with-eopnotsupp.patch b/patches/dm-io-reject-unsupported-discard-requests-with-eopnotsupp.patch deleted file mode 100644 index fc88a19..0000000 --- a/patches/dm-io-reject-unsupported-discard-requests-with-eopnotsupp.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 37527b869207ad4c208b1e13967d69b8bba1fbf9 Mon Sep 17 00:00:00 2001 -From: "Darrick J. Wong" <darrick.wong@oracle.com> -Date: Fri, 13 Feb 2015 11:05:37 -0800 -Subject: dm io: reject unsupported DISCARD requests with EOPNOTSUPP - -commit 37527b869207ad4c208b1e13967d69b8bba1fbf9 upstream. - -I created a dm-raid1 device backed by a device that supports DISCARD -and another device that does NOT support DISCARD with the following -dm configuration: - - # echo '0 2048 mirror core 1 512 2 /dev/sda 0 /dev/sdb 0' | dmsetup create moo - # lsblk -D - NAME DISC-ALN DISC-GRAN DISC-MAX DISC-ZERO - sda 0 4K 1G 0 - `-moo (dm-0) 0 4K 1G 0 - sdb 0 0B 0B 0 - `-moo (dm-0) 0 4K 1G 0 - -Notice that the mirror device /dev/mapper/moo advertises DISCARD -support even though one of the mirror halves doesn't. - -If I issue a DISCARD request (via fstrim, mount -o discard, or ioctl -BLKDISCARD) through the mirror, kmirrord gets stuck in an infinite -loop in do_region() when it tries to issue a DISCARD request to sdb. -The problem is that when we call do_region() against sdb, num_sectors -is set to zero because q->limits.max_discard_sectors is zero. -Therefore, "remaining" never decreases and the loop never terminates. - -To fix this: before entering the loop, check for the combination of -REQ_DISCARD and no discard and return -EOPNOTSUPP to avoid hanging up -the mirror device. - -This bug was found by the unfortunate coincidence of pvmove and a -discard operation in the RHEL 6.5 kernel; upstream is also affected. - -Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> -Acked-by: "Martin K. Petersen" <martin.petersen@oracle.com> -Signed-off-by: Mike Snitzer <snitzer@redhat.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/md/dm-io.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/drivers/md/dm-io.c -+++ b/drivers/md/dm-io.c -@@ -299,6 +299,12 @@ static void do_region(int rw, unsigned r - struct request_queue *q = bdev_get_queue(where->bdev); - sector_t discard_sectors; - -+ /* Reject unsupported discard requests */ -+ if ((rw & REQ_DISCARD) && !blk_queue_discard(q)) { -+ dec_count(io, region, -EOPNOTSUPP); -+ return; -+ } -+ - /* - * where->count may be zero if rw holds a flush and we need to - * send a zero-sized flush. diff --git a/patches/dm-mirror-do-not-degrade-the-mirror-on-discard-error.patch b/patches/dm-mirror-do-not-degrade-the-mirror-on-discard-error.patch deleted file mode 100644 index ac8efab..0000000 --- a/patches/dm-mirror-do-not-degrade-the-mirror-on-discard-error.patch +++ /dev/null @@ -1,44 +0,0 @@ -From f2ed51ac64611d717d1917820a01930174c2f236 Mon Sep 17 00:00:00 2001 -From: Mikulas Patocka <mpatocka@redhat.com> -Date: Thu, 12 Feb 2015 10:09:20 -0500 -Subject: dm mirror: do not degrade the mirror on discard error - -commit f2ed51ac64611d717d1917820a01930174c2f236 upstream. - -It may be possible that a device claims discard support but it rejects -discards with -EOPNOTSUPP. It happens when using loopback on ext2/ext3 -filesystem driven by the ext4 driver. It may also happen if the -underlying devices are moved from one disk on another. - -If discard error happens, we reject the bio with -EOPNOTSUPP, but we do -not degrade the array. - -This patch fixes failed test shell/lvconvert-repair-transient.sh in the -lvm2 testsuite if the testsuite is extracted on an ext2 or ext3 -filesystem and it is being driven by the ext4 driver. - -Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> -Signed-off-by: Mike Snitzer <snitzer@redhat.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/md/dm-raid1.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - ---- a/drivers/md/dm-raid1.c -+++ b/drivers/md/dm-raid1.c -@@ -603,6 +603,15 @@ static void write_callback(unsigned long - return; - } - -+ /* -+ * If the bio is discard, return an error, but do not -+ * degrade the array. -+ */ -+ if (bio->bi_rw & REQ_DISCARD) { -+ bio_endio(bio, -EOPNOTSUPP); -+ return; -+ } -+ - for (i = 0; i < ms->nr_mirrors; i++) - if (test_bit(i, &error)) - fail_mirror(ms->mirror + i, DM_RAID1_WRITE_ERROR); diff --git a/patches/dm-snapshot-fix-a-possible-invalid-memory-access-on-unload.patch b/patches/dm-snapshot-fix-a-possible-invalid-memory-access-on-unload.patch deleted file mode 100644 index 9f57d80..0000000 --- a/patches/dm-snapshot-fix-a-possible-invalid-memory-access-on-unload.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 22aa66a3ee5b61e0f4a0bfeabcaa567861109ec3 Mon Sep 17 00:00:00 2001 -From: Mikulas Patocka <mpatocka@redhat.com> -Date: Tue, 17 Feb 2015 14:34:00 -0500 -Subject: dm snapshot: fix a possible invalid memory access on unload - -commit 22aa66a3ee5b61e0f4a0bfeabcaa567861109ec3 upstream. - -When the snapshot target is unloaded, snapshot_dtr() waits until -pending_exceptions_count drops to zero. Then, it destroys the snapshot. -Therefore, the function that decrements pending_exceptions_count -should not touch the snapshot structure after the decrement. - -pending_complete() calls free_pending_exception(), which decrements -pending_exceptions_count, and then it performs up_write(&s->lock) and it -calls retry_origin_bios() which dereferences s->origin. These two -memory accesses to the fields of the snapshot may touch the dm_snapshot -struture after it is freed. - -This patch moves the call to free_pending_exception() to the end of -pending_complete(), so that the snapshot will not be destroyed while -pending_complete() is in progress. - -Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> -Signed-off-by: Mike Snitzer <snitzer@redhat.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/md/dm-snap.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/md/dm-snap.c -+++ b/drivers/md/dm-snap.c -@@ -1444,8 +1444,6 @@ out: - full_bio->bi_end_io = pe->full_bio_end_io; - full_bio->bi_private = pe->full_bio_private; - } -- free_pending_exception(pe); -- - increment_pending_exceptions_done_count(); - - up_write(&s->lock); -@@ -1462,6 +1460,8 @@ out: - } - - retry_origin_bios(s, origin_bios); -+ -+ free_pending_exception(pe); - } - - static void commit_callback(void *context, int success) diff --git a/patches/don-t-bugger-nd-seq-on-set_root_rcu-from-follow_dotdot_rcu.patch b/patches/don-t-bugger-nd-seq-on-set_root_rcu-from-follow_dotdot_rcu.patch deleted file mode 100644 index eedcf31..0000000 --- a/patches/don-t-bugger-nd-seq-on-set_root_rcu-from-follow_dotdot_rcu.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 7bd88377d482e1eae3c5329b12e33cfd664fa6a9 Mon Sep 17 00:00:00 2001 -From: Al Viro <viro@zeniv.linux.org.uk> -Date: Sat, 13 Sep 2014 21:55:46 -0400 -Subject: don't bugger nd->seq on set_root_rcu() from follow_dotdot_rcu() - -commit 7bd88377d482e1eae3c5329b12e33cfd664fa6a9 upstream. - -return the value instead, and have path_init() do the assignment. Broken by -"vfs: Fix absolute RCU path walk failures due to uninitialized seq number", -which was Cc-stable with 2.6.38+ as destination. This one should go where -it went. - -To avoid dummy value returned in case when root is already set (it would do -no harm, actually, since the only caller that doesn't ignore the return value -is guaranteed to have nd->root *not* set, but it's more obvious that way), -lift the check into callers. And do the same to set_root(), to keep them -in sync. - -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -Cc: Ian Jackson <ian.jackson@eu.citrix.com> -[lizf: the previous backport of this upstream commit is buggy. fix it] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/namei.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -579,7 +579,8 @@ static __always_inline int __vfs_follow_ - goto fail; - - if (*link == '/') { -- set_root(nd); -+ if (!nd->root.mnt) -+ set_root(nd); - path_put(&nd->path); - nd->path = nd->root; - path_get(&nd->root); diff --git a/patches/drm-radeon-do-a-posting-read-in-evergreen_set_irq.patch b/patches/drm-radeon-do-a-posting-read-in-evergreen_set_irq.patch deleted file mode 100644 index 6357ffa..0000000 --- a/patches/drm-radeon-do-a-posting-read-in-evergreen_set_irq.patch +++ /dev/null @@ -1,30 +0,0 @@ -From c320bb5f6dc0cb88a811cbaf839303e0a3916a92 Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Mon, 2 Mar 2015 20:42:53 -0500 -Subject: drm/radeon: do a posting read in evergreen_set_irq - -commit c320bb5f6dc0cb88a811cbaf839303e0a3916a92 upstream. - -To make sure the writes go through the pci bridge. - -bug: -https://bugzilla.kernel.org/show_bug.cgi?id=90741 - -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/radeon/evergreen.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/gpu/drm/radeon/evergreen.c -+++ b/drivers/gpu/drm/radeon/evergreen.c -@@ -3474,6 +3474,9 @@ int evergreen_init(struct radeon_device - } - } - -+ /* posting read */ -+ RREG32(SRBM_STATUS); -+ - return 0; - } - diff --git a/patches/drm-radeon-do-a-posting-read-in-r100_set_irq.patch b/patches/drm-radeon-do-a-posting-read-in-r100_set_irq.patch deleted file mode 100644 index 1e30e6b..0000000 --- a/patches/drm-radeon-do-a-posting-read-in-r100_set_irq.patch +++ /dev/null @@ -1,31 +0,0 @@ -From f957063fee6392bb9365370db6db74dc0b2dce0a Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Mon, 2 Mar 2015 20:36:26 -0500 -Subject: drm/radeon: do a posting read in r100_set_irq - -commit f957063fee6392bb9365370db6db74dc0b2dce0a upstream. - -To make sure the writes go through the pci bridge. - -bug: -https://bugzilla.kernel.org/show_bug.cgi?id=90741 - -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/radeon/r100.c | 4 ++++ - 1 file changed, 4 insertions(+) - ---- a/drivers/gpu/drm/radeon/r100.c -+++ b/drivers/gpu/drm/radeon/r100.c -@@ -726,6 +726,10 @@ int r100_irq_set(struct radeon_device *r - tmp |= RADEON_FP2_DETECT_MASK; - } - WREG32(RADEON_GEN_INT_CNTL, tmp); -+ -+ /* read back to post the write */ -+ RREG32(RADEON_GEN_INT_CNTL); -+ - return 0; - } - diff --git a/patches/drm-radeon-do-a-posting-read-in-r600_set_irq.patch b/patches/drm-radeon-do-a-posting-read-in-r600_set_irq.patch deleted file mode 100644 index f4e3d00..0000000 --- a/patches/drm-radeon-do-a-posting-read-in-r600_set_irq.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 9d1393f23d5656cdd5f368efd60694d4aeed81d3 Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Mon, 2 Mar 2015 20:41:31 -0500 -Subject: drm/radeon: do a posting read in r600_set_irq - -commit 9d1393f23d5656cdd5f368efd60694d4aeed81d3 upstream. - -To make sure the writes go through the pci bridge. - -bug: -https://bugzilla.kernel.org/show_bug.cgi?id=90741 - -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/radeon/r600.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/gpu/drm/radeon/r600.c -+++ b/drivers/gpu/drm/radeon/r600.c -@@ -3184,6 +3184,9 @@ int r600_irq_set(struct radeon_device *r - WREG32(DC_HOT_PLUG_DETECT3_INT_CONTROL, hpd3); - } - -+ /* posting read */ -+ RREG32(R_000E50_SRBM_STATUS); -+ - return 0; - } - diff --git a/patches/drm-radeon-do-a-posting-read-in-rs600_set_irq.patch b/patches/drm-radeon-do-a-posting-read-in-rs600_set_irq.patch deleted file mode 100644 index 3651673..0000000 --- a/patches/drm-radeon-do-a-posting-read-in-rs600_set_irq.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 54acf107e4e66d1f4a697e08a7f60dba9fcf07c3 Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Mon, 2 Mar 2015 20:39:56 -0500 -Subject: drm/radeon: do a posting read in rs600_set_irq - -commit 54acf107e4e66d1f4a697e08a7f60dba9fcf07c3 upstream. - -To make sure the writes go through the pci bridge. - -bug: -https://bugzilla.kernel.org/show_bug.cgi?id=90741 - -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/radeon/rs600.c | 4 ++++ - 1 file changed, 4 insertions(+) - ---- a/drivers/gpu/drm/radeon/rs600.c -+++ b/drivers/gpu/drm/radeon/rs600.c -@@ -585,6 +585,10 @@ int rs600_irq_set(struct radeon_device * - WREG32(R_006540_DxMODE_INT_MASK, mode_int); - WREG32(R_007D08_DC_HOT_PLUG_DETECT1_INT_CONTROL, hpd1); - WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2); -+ -+ /* posting read */ -+ RREG32(R_000040_GEN_INT_CNTL); -+ - return 0; - } - diff --git a/patches/drm-radeon-do-a-posting-read-in-si_set_irq.patch b/patches/drm-radeon-do-a-posting-read-in-si_set_irq.patch deleted file mode 100644 index 2ae33b5..0000000 --- a/patches/drm-radeon-do-a-posting-read-in-si_set_irq.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 0586915ec10d0ae60de5cd3381ad25a704760402 Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Mon, 2 Mar 2015 20:43:53 -0500 -Subject: drm/radeon: do a posting read in si_set_irq - -commit 0586915ec10d0ae60de5cd3381ad25a704760402 upstream. - -To make sure the writes go through the pci bridge. - -bug: -https://bugzilla.kernel.org/show_bug.cgi?id=90741 - -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/radeon/si.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/gpu/drm/radeon/si.c -+++ b/drivers/gpu/drm/radeon/si.c -@@ -4126,6 +4126,9 @@ int si_init(struct radeon_device *rdev) - return -EINVAL; - } - -+ /* posting read */ -+ RREG32(SRBM_STATUS); -+ - return 0; - } - diff --git a/patches/drm-radeon-dp-set-edp_configuration_set-for-bridge-chips-if-necessary.patch b/patches/drm-radeon-dp-set-edp_configuration_set-for-bridge-chips-if-necessary.patch deleted file mode 100644 index 06996f9..0000000 --- a/patches/drm-radeon-dp-set-edp_configuration_set-for-bridge-chips-if-necessary.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 66c2b84ba6256bc5399eed45582af9ebb3ba2c15 Mon Sep 17 00:00:00 2001 -From: Alex Deucher <alexander.deucher@amd.com> -Date: Wed, 11 Feb 2015 18:34:36 -0500 -Subject: drm/radeon/dp: Set EDP_CONFIGURATION_SET for bridge chips if - necessary - -commit 66c2b84ba6256bc5399eed45582af9ebb3ba2c15 upstream. - -Don't restrict it to just eDP panels. Some LVDS bridge chips require -this. Fixes blank panels on resume on certain laptops. Noticed -by mrnuke on IRC. - -bug: -https://bugs.freedesktop.org/show_bug.cgi?id=42960 - -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/radeon/atombios_dp.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - ---- a/drivers/gpu/drm/radeon/atombios_dp.c -+++ b/drivers/gpu/drm/radeon/atombios_dp.c -@@ -777,10 +777,8 @@ static int radeon_dp_link_train_init(str - radeon_write_dpcd_reg(dp_info->radeon_connector, - DP_DOWNSPREAD_CTRL, 0); - -- if ((dp_info->connector->connector_type == DRM_MODE_CONNECTOR_eDP) && -- (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)) { -+ if (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE) - radeon_write_dpcd_reg(dp_info->radeon_connector, DP_EDP_CONFIGURATION_SET, 1); -- } - - /* set the lane count on the sink */ - tmp = dp_info->dp_lane_count; diff --git a/patches/drm-radeon-fix-drm_ioctl_radeon_cs-oops.patch b/patches/drm-radeon-fix-drm_ioctl_radeon_cs-oops.patch deleted file mode 100644 index a54f2a7..0000000 --- a/patches/drm-radeon-fix-drm_ioctl_radeon_cs-oops.patch +++ /dev/null @@ -1,100 +0,0 @@ -From a28b2a47edcd0cb7c051b445f71a426000394606 Mon Sep 17 00:00:00 2001 -From: Tommi Rantala <tt.rantala@gmail.com> -Date: Mon, 2 Mar 2015 21:36:07 +0200 -Subject: drm/radeon: fix DRM_IOCTL_RADEON_CS oops -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit a28b2a47edcd0cb7c051b445f71a426000394606 upstream. - -Passing zeroed drm_radeon_cs struct to DRM_IOCTL_RADEON_CS produces the -following oops. - -Fix by always calling INIT_LIST_HEAD() to avoid the crash in list_sort(). - ----------------------------------- - - #include <stdint.h> - #include <fcntl.h> - #include <unistd.h> - #include <sys/ioctl.h> - #include <drm/radeon_drm.h> - - static const struct drm_radeon_cs cs; - - int main(int argc, char **argv) - { - return ioctl(open(argv[1], O_RDWR), DRM_IOCTL_RADEON_CS, &cs); - } - ----------------------------------- - -[ttrantal@test2 ~]$ ./main /dev/dri/card0 -[ 46.904650] BUG: unable to handle kernel NULL pointer dereference at (null) -[ 46.905022] IP: [<ffffffff814d6df2>] list_sort+0x42/0x240 -[ 46.905022] PGD 68f29067 PUD 688b5067 PMD 0 -[ 46.905022] Oops: 0002 [#1] SMP -[ 46.905022] CPU: 0 PID: 2413 Comm: main Not tainted 4.0.0-rc1+ #58 -[ 46.905022] Hardware name: Hewlett-Packard HP Compaq dc5750 Small Form Factor/0A64h, BIOS 786E3 v02.10 01/25/2007 -[ 46.905022] task: ffff880058e2bcc0 ti: ffff880058e64000 task.ti: ffff880058e64000 -[ 46.905022] RIP: 0010:[<ffffffff814d6df2>] [<ffffffff814d6df2>] list_sort+0x42/0x240 -[ 46.905022] RSP: 0018:ffff880058e67998 EFLAGS: 00010246 -[ 46.905022] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 -[ 46.905022] RDX: ffffffff81644410 RSI: ffff880058e67b40 RDI: ffff880058e67a58 -[ 46.905022] RBP: ffff880058e67a88 R08: 0000000000000000 R09: 0000000000000000 -[ 46.905022] R10: ffff880058e2bcc0 R11: ffffffff828e6ca0 R12: ffffffff81644410 -[ 46.905022] R13: ffff8800694b8018 R14: 0000000000000000 R15: ffff880058e679b0 -[ 46.905022] FS: 00007fdc65a65700(0000) GS:ffff88006d600000(0000) knlGS:0000000000000000 -[ 46.905022] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -[ 46.905022] CR2: 0000000000000000 CR3: 0000000058dd9000 CR4: 00000000000006f0 -[ 46.905022] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 -[ 46.905022] DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400 -[ 46.905022] Stack: -[ 46.905022] ffff880058e67b40 ffff880058e2bcc0 ffff880058e67a78 0000000000000000 -[ 46.905022] 0000000000000000 0000000000000000 0000000000000000 0000000000000000 -[ 46.905022] 0000000000000000 0000000000000000 0000000000000000 0000000000000000 -[ 46.905022] Call Trace: -[ 46.905022] [<ffffffff81644a65>] radeon_cs_parser_fini+0x195/0x220 -[ 46.905022] [<ffffffff81645069>] radeon_cs_ioctl+0xa9/0x960 -[ 46.905022] [<ffffffff815e1f7c>] drm_ioctl+0x19c/0x640 -[ 46.905022] [<ffffffff810f8fdd>] ? trace_hardirqs_on_caller+0xfd/0x1c0 -[ 46.905022] [<ffffffff810f90ad>] ? trace_hardirqs_on+0xd/0x10 -[ 46.905022] [<ffffffff8160c066>] radeon_drm_ioctl+0x46/0x80 -[ 46.905022] [<ffffffff81211868>] do_vfs_ioctl+0x318/0x570 -[ 46.905022] [<ffffffff81462ef6>] ? selinux_file_ioctl+0x56/0x110 -[ 46.905022] [<ffffffff81211b41>] SyS_ioctl+0x81/0xa0 -[ 46.905022] [<ffffffff81dc6312>] system_call_fastpath+0x12/0x17 -[ 46.905022] Code: 48 89 b5 10 ff ff ff 0f 84 03 01 00 00 4c 8d bd 28 ff ff -ff 31 c0 48 89 fb b9 15 00 00 00 49 89 d4 4c 89 ff f3 48 ab 48 8b 46 08 <48> c7 -00 00 00 00 00 48 8b 0e 48 85 c9 0f 84 7d 00 00 00 c7 85 -[ 46.905022] RIP [<ffffffff814d6df2>] list_sort+0x42/0x240 -[ 46.905022] RSP <ffff880058e67998> -[ 46.905022] CR2: 0000000000000000 -[ 47.149253] ---[ end trace 09576b4e8b2c20b8 ]--- - -Reviewed-by: Christian König <christian.koenig@amd.com> -Signed-off-by: Tommi Rantala <tt.rantala@gmail.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/radeon/radeon_cs.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/drivers/gpu/drm/radeon/radeon_cs.c -+++ b/drivers/gpu/drm/radeon/radeon_cs.c -@@ -167,11 +167,13 @@ int radeon_cs_parser_init(struct radeon_ - u32 ring = RADEON_CS_RING_GFX; - s32 priority = 0; - -+ INIT_LIST_HEAD(&p->validated); -+ - if (!cs->num_chunks) { - return 0; - } -+ - /* get chunks */ -- INIT_LIST_HEAD(&p->validated); - p->idx = 0; - p->chunk_ib_idx = -1; - p->chunk_relocs_idx = -1; diff --git a/patches/drm-vmwgfx-reorder-device-takedown-somewhat.patch b/patches/drm-vmwgfx-reorder-device-takedown-somewhat.patch deleted file mode 100644 index 01c5050..0000000 --- a/patches/drm-vmwgfx-reorder-device-takedown-somewhat.patch +++ /dev/null @@ -1,109 +0,0 @@ -From 3458390b9f0ba784481d23134798faee27b5f16f Mon Sep 17 00:00:00 2001 -From: Thomas Hellstrom <thellstrom@vmware.com> -Date: Thu, 5 Mar 2015 02:33:24 -0800 -Subject: drm/vmwgfx: Reorder device takedown somewhat - -commit 3458390b9f0ba784481d23134798faee27b5f16f upstream. - -To take down the MOB and GMR memory types, the driver may have to issue -fence objects and thus make sure that the fence manager is taken down -after those memory types. -Reorder device init accordingly. - -Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> -Reviewed-by: Sinclair Yeh <syeh@vmware.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 46 +++++++++++++++++++----------------- - 1 file changed, 25 insertions(+), 21 deletions(-) - ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -@@ -547,21 +547,6 @@ static int vmw_driver_load(struct drm_de - goto out_err1; - } - -- ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM, -- (dev_priv->vram_size >> PAGE_SHIFT)); -- if (unlikely(ret != 0)) { -- DRM_ERROR("Failed initializing memory manager for VRAM.\n"); -- goto out_err2; -- } -- -- dev_priv->has_gmr = true; -- if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR, -- dev_priv->max_gmr_ids) != 0) { -- DRM_INFO("No GMR memory available. " -- "Graphics memory resources are very limited.\n"); -- dev_priv->has_gmr = false; -- } -- - dev_priv->mmio_mtrr = drm_mtrr_add(dev_priv->mmio_start, - dev_priv->mmio_size, DRM_MTRR_WC); - -@@ -618,6 +603,22 @@ static int vmw_driver_load(struct drm_de - ret = vmw_3d_resource_inc(dev_priv, true); - if (unlikely(ret != 0)) - goto out_no_fifo; -+ -+ ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM, -+ (dev_priv->vram_size >> PAGE_SHIFT)); -+ if (unlikely(ret != 0)) { -+ DRM_ERROR("Failed initializing memory manager for VRAM.\n"); -+ goto out_no_vram; -+ } -+ -+ dev_priv->has_gmr = true; -+ if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR, -+ dev_priv->max_gmr_ids) != 0) { -+ DRM_INFO("No GMR memory available. " -+ "Graphics memory resources are very limited.\n"); -+ dev_priv->has_gmr = false; -+ } -+ - vmw_kms_save_vga(dev_priv); - - /* Start kms and overlay systems, needs fifo. */ -@@ -663,6 +664,10 @@ out_no_kms: - vmw_kms_restore_vga(dev_priv); - vmw_3d_resource_dec(dev_priv, false); - } -+out_no_vram: -+ if (dev_priv->has_gmr) -+ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR); -+ (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM); - out_no_fifo: - vmw_fence_manager_takedown(dev_priv->fman); - out_no_fman: -@@ -677,9 +682,6 @@ out_err4: - out_err3: - drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start, - dev_priv->mmio_size, DRM_MTRR_WC); -- if (dev_priv->has_gmr) -- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR); -- (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM); - out_err2: - (void)ttm_bo_device_release(&dev_priv->bdev); - out_err1: -@@ -709,6 +711,11 @@ static int vmw_driver_unload(struct drm_ - } - vmw_kms_close(dev_priv); - vmw_overlay_close(dev_priv); -+ -+ if (dev_priv->has_gmr) -+ (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR); -+ (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM); -+ - vmw_fence_manager_takedown(dev_priv->fman); - if (dev_priv->stealth) - pci_release_region(dev->pdev, 2); -@@ -719,9 +726,6 @@ static int vmw_driver_unload(struct drm_ - iounmap(dev_priv->mmio_virt); - drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start, - dev_priv->mmio_size, DRM_MTRR_WC); -- if (dev_priv->has_gmr) -- (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR); -- (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM); - (void)ttm_bo_device_release(&dev_priv->bdev); - vmw_ttm_global_release(dev_priv); - idr_destroy(&dev_priv->surface_idr); diff --git a/patches/ecryptfs-don-t-pass-fs-specific-ioctl-commands-through.patch b/patches/ecryptfs-don-t-pass-fs-specific-ioctl-commands-through.patch deleted file mode 100644 index bdbfd4c..0000000 --- a/patches/ecryptfs-don-t-pass-fs-specific-ioctl-commands-through.patch +++ /dev/null @@ -1,93 +0,0 @@ -From 6d65261a09adaa374c05de807f73a144d783669e Mon Sep 17 00:00:00 2001 -From: Tyler Hicks <tyhicks@canonical.com> -Date: Tue, 24 Feb 2015 19:28:10 -0600 -Subject: eCryptfs: don't pass fs-specific ioctl commands through - -commit 6d65261a09adaa374c05de807f73a144d783669e upstream. - -eCryptfs can't be aware of what to expect when after passing an -arbitrary ioctl command through to the lower filesystem. The ioctl -command may trigger an action in the lower filesystem that is -incompatible with eCryptfs. - -One specific example is when one attempts to use the Btrfs clone -ioctl command when the source file is in the Btrfs filesystem that -eCryptfs is mounted on top of and the destination fd is from a new file -created in the eCryptfs mount. The ioctl syscall incorrectly returns -success because the command is passed down to Btrfs which thinks that it -was able to do the clone operation. However, the result is an empty -eCryptfs file. - -This patch allows the trim, {g,s}etflags, and {g,s}etversion ioctl -commands through and then copies up the inode metadata from the lower -inode to the eCryptfs inode to catch any changes made to the lower -inode's metadata. Those five ioctl commands are mostly common across all -filesystems but the whitelist may need to be further pruned in the -future. - -https://bugzilla.kernel.org/show_bug.cgi?id=93691 -https://launchpad.net/bugs/1305335 - -Signed-off-by: Tyler Hicks <tyhicks@canonical.com> -Cc: Rocko <rockorequin@hotmail.com> -Cc: Colin Ian King <colin.king@canonical.com> -[lizf: Backported to 3.4: - - adjust context - - there's no file_inode(), so open-code it] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/ecryptfs/file.c | 34 ++++++++++++++++++++++++++++++---- - 1 file changed, 30 insertions(+), 4 deletions(-) - ---- a/fs/ecryptfs/file.c -+++ b/fs/ecryptfs/file.c -@@ -306,9 +306,22 @@ ecryptfs_unlocked_ioctl(struct file *fil - - if (ecryptfs_file_to_private(file)) - lower_file = ecryptfs_file_to_lower(file); -- if (lower_file && lower_file->f_op && lower_file->f_op->unlocked_ioctl) -+ if (!(lower_file && lower_file->f_op && lower_file->f_op->unlocked_ioctl)) -+ return rc; -+ -+ switch (cmd) { -+ case FITRIM: -+ case FS_IOC_GETFLAGS: -+ case FS_IOC_SETFLAGS: -+ case FS_IOC_GETVERSION: -+ case FS_IOC_SETVERSION: - rc = lower_file->f_op->unlocked_ioctl(lower_file, cmd, arg); -- return rc; -+ fsstack_copy_attr_all(file->f_path.dentry->d_inode, -+ lower_file->f_path.dentry->d_inode); -+ return rc; -+ default: -+ return rc; -+ } - } - - #ifdef CONFIG_COMPAT -@@ -320,9 +333,22 @@ ecryptfs_compat_ioctl(struct file *file, - - if (ecryptfs_file_to_private(file)) - lower_file = ecryptfs_file_to_lower(file); -- if (lower_file && lower_file->f_op && lower_file->f_op->compat_ioctl) -+ if (!(lower_file && lower_file->f_op && lower_file->f_op->compat_ioctl)) -+ return rc; -+ -+ switch (cmd) { -+ case FITRIM: -+ case FS_IOC32_GETFLAGS: -+ case FS_IOC32_SETFLAGS: -+ case FS_IOC32_GETVERSION: -+ case FS_IOC32_SETVERSION: - rc = lower_file->f_op->compat_ioctl(lower_file, cmd, arg); -- return rc; -+ fsstack_copy_attr_all(file->f_path.dentry->d_inode, -+ lower_file->f_path.dentry->d_inode); -+ return rc; -+ default: -+ return rc; -+ } - } - #endif - diff --git a/patches/fix-lockup-related-to-stop_machine-being-stuck-in-__do_softirq.patch b/patches/fix-lockup-related-to-stop_machine-being-stuck-in-__do_softirq.patch deleted file mode 100644 index 04179f8..0000000 --- a/patches/fix-lockup-related-to-stop_machine-being-stuck-in-__do_softirq.patch +++ /dev/null @@ -1,129 +0,0 @@ -From 34376a50fb1fa095b9d0636fa41ed2e73125f214 Mon Sep 17 00:00:00 2001 -From: Ben Greear <greearb@candelatech.com> -Date: Thu, 6 Jun 2013 14:29:49 -0700 -Subject: Fix lockup related to stop_machine being stuck in __do_softirq. - -commit 34376a50fb1fa095b9d0636fa41ed2e73125f214 upstream. - -The stop machine logic can lock up if all but one of the migration -threads make it through the disable-irq step and the one remaining -thread gets stuck in __do_softirq. The reason __do_softirq can hang is -that it has a bail-out based on jiffies timeout, but in the lockup case, -jiffies itself is not incremented. - -To work around this, re-add the max_restart counter in __do_irq and stop -processing irqs after 10 restarts. - -Thanks to Tejun Heo and Rusty Russell and others for helping me track -this down. - -This was introduced in 3.9 by commit c10d73671ad3 ("softirq: reduce -latencies"). - -It may be worth looking into ath9k to see if it has issues with its irq -handler at a later date. - -The hang stack traces look something like this: - - ------------[ cut here ]------------ - WARNING: at kernel/watchdog.c:245 watchdog_overflow_callback+0x9c/0xa7() - Watchdog detected hard LOCKUP on cpu 2 - Modules linked in: ath9k ath9k_common ath9k_hw ath mac80211 cfg80211 nfsv4 auth_rpcgss nfs fscache nf_nat_ipv4 nf_nat veth 8021q garp stp mrp llc pktgen lockd sunrpc] - Pid: 23, comm: migration/2 Tainted: G C 3.9.4+ #11 - Call Trace: - <NMI> warn_slowpath_common+0x85/0x9f - warn_slowpath_fmt+0x46/0x48 - watchdog_overflow_callback+0x9c/0xa7 - __perf_event_overflow+0x137/0x1cb - perf_event_overflow+0x14/0x16 - intel_pmu_handle_irq+0x2dc/0x359 - perf_event_nmi_handler+0x19/0x1b - nmi_handle+0x7f/0xc2 - do_nmi+0xbc/0x304 - end_repeat_nmi+0x1e/0x2e - <<EOE>> - cpu_stopper_thread+0xae/0x162 - smpboot_thread_fn+0x258/0x260 - kthread+0xc7/0xcf - ret_from_fork+0x7c/0xb0 - ---[ end trace 4947dfa9b0a4cec3 ]--- - BUG: soft lockup - CPU#1 stuck for 22s! [migration/1:17] - Modules linked in: ath9k ath9k_common ath9k_hw ath mac80211 cfg80211 nfsv4 auth_rpcgss nfs fscache nf_nat_ipv4 nf_nat veth 8021q garp stp mrp llc pktgen lockd sunrpc] - irq event stamp: 835637905 - hardirqs last enabled at (835637904): __do_softirq+0x9f/0x257 - hardirqs last disabled at (835637905): apic_timer_interrupt+0x6d/0x80 - softirqs last enabled at (5654720): __do_softirq+0x1ff/0x257 - softirqs last disabled at (5654725): irq_exit+0x5f/0xbb - CPU 1 - Pid: 17, comm: migration/1 Tainted: G WC 3.9.4+ #11 To be filled by O.E.M. To be filled by O.E.M./To be filled by O.E.M. - RIP: tasklet_hi_action+0xf0/0xf0 - Process migration/1 - Call Trace: - <IRQ> - __do_softirq+0x117/0x257 - irq_exit+0x5f/0xbb - smp_apic_timer_interrupt+0x8a/0x98 - apic_timer_interrupt+0x72/0x80 - <EOI> - printk+0x4d/0x4f - stop_machine_cpu_stop+0x22c/0x274 - cpu_stopper_thread+0xae/0x162 - smpboot_thread_fn+0x258/0x260 - kthread+0xc7/0xcf - ret_from_fork+0x7c/0xb0 - -Signed-off-by: Ben Greear <greearb@candelatech.com> -Acked-by: Tejun Heo <tj@kernel.org> -Acked-by: Pekka Riikonen <priikone@iki.fi> -Cc: Eric Dumazet <eric.dumazet@gmail.com> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -[xr: Backported to 3.4: Adjust context] -Signed-off-by: Rui Xiang <rui.xiang@huawei.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/softirq.c | 13 ++++++++++--- - 1 file changed, 10 insertions(+), 3 deletions(-) - ---- a/kernel/softirq.c -+++ b/kernel/softirq.c -@@ -194,8 +194,12 @@ void local_bh_enable_ip(unsigned long ip - EXPORT_SYMBOL(local_bh_enable_ip); - - /* -- * We restart softirq processing for at most 2 ms, -- * and if need_resched() is not set. -+ * We restart softirq processing for at most MAX_SOFTIRQ_RESTART times, -+ * but break the loop if need_resched() is set or after 2 ms. -+ * The MAX_SOFTIRQ_TIME provides a nice upper bound in most cases, but in -+ * certain cases, such as stop_machine(), jiffies may cease to -+ * increment and so we need the MAX_SOFTIRQ_RESTART limit as -+ * well to make sure we eventually return from this method. - * - * These limits have been established via experimentation. - * The two things to balance is latency against fairness - -@@ -203,6 +207,7 @@ EXPORT_SYMBOL(local_bh_enable_ip); - * should not be able to lock up the box. - */ - #define MAX_SOFTIRQ_TIME msecs_to_jiffies(2) -+#define MAX_SOFTIRQ_RESTART 10 - - asmlinkage void __do_softirq(void) - { -@@ -210,6 +215,7 @@ asmlinkage void __do_softirq(void) - __u32 pending; - unsigned long end = jiffies + MAX_SOFTIRQ_TIME; - int cpu; -+ int max_restart = MAX_SOFTIRQ_RESTART; - - pending = local_softirq_pending(); - account_system_vtime(current); -@@ -256,7 +262,8 @@ restart: - - pending = local_softirq_pending(); - if (pending) { -- if (time_before(jiffies, end) && !need_resched()) -+ if (time_before(jiffies, end) && !need_resched() && -+ --max_restart) - goto restart; - - wakeup_softirqd(); diff --git a/patches/fixed-invalid-assignment-of-64bit-mask-to-host-dma_boundary-for-scatter-gather-segment-boundary-limit.patch b/patches/fixed-invalid-assignment-of-64bit-mask-to-host-dma_boundary-for-scatter-gather-segment-boundary-limit.patch deleted file mode 100644 index 3f22fb1..0000000 --- a/patches/fixed-invalid-assignment-of-64bit-mask-to-host-dma_boundary-for-scatter-gather-segment-boundary-limit.patch +++ /dev/null @@ -1,32 +0,0 @@ -From f76a610a8b4b6280eaedf48f3af9d5d74e418b66 Mon Sep 17 00:00:00 2001 -From: Minh Duc Tran <MinhDuc.Tran@Emulex.Com> -Date: Mon, 9 Feb 2015 18:54:09 +0000 -Subject: fixed invalid assignment of 64bit mask to host dma_boundary for - scatter gather segment boundary limit. - -commit f76a610a8b4b6280eaedf48f3af9d5d74e418b66 upstream. - -In reference to bug https://bugzilla.redhat.com/show_bug.cgi?id=1097141 -Assert is seen with AMD cpu whenever calling pci_alloc_consistent. - -[ 29.406183] ------------[ cut here ]------------ -[ 29.410505] kernel BUG at lib/iommu-helper.c:13! - -Signed-off-by: Minh Tran <minh.tran@emulex.com> -Fixes: 6733b39a1301b0b020bbcbf3295852e93e624cb1 -Signed-off-by: James Bottomley <JBottomley@Parallels.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/be2iscsi/be_main.c | 1 - - 1 file changed, 1 deletion(-) - ---- a/drivers/scsi/be2iscsi/be_main.c -+++ b/drivers/scsi/be2iscsi/be_main.c -@@ -424,7 +424,6 @@ static struct beiscsi_hba *beiscsi_hba_a - "iscsi_host_alloc failed\n"); - return NULL; - } -- shost->dma_boundary = pcidev->dma_mask; - shost->max_id = BE2_MAX_SESSIONS; - shost->max_channel = 0; - shost->max_cmd_len = BEISCSI_MAX_CMD_LEN; diff --git a/patches/fs-take-i_mutex-during-prepare_binprm-for-set-ug-id-executables.patch b/patches/fs-take-i_mutex-during-prepare_binprm-for-set-ug-id-executables.patch deleted file mode 100644 index 0f91cc4..0000000 --- a/patches/fs-take-i_mutex-during-prepare_binprm-for-set-ug-id-executables.patch +++ /dev/null @@ -1,111 +0,0 @@ -From 8b01fc86b9f425899f8a3a8fc1c47d73c2c20543 Mon Sep 17 00:00:00 2001 -From: Jann Horn <jann@thejh.net> -Date: Sun, 19 Apr 2015 02:48:39 +0200 -Subject: fs: take i_mutex during prepare_binprm for set[ug]id executables - -commit 8b01fc86b9f425899f8a3a8fc1c47d73c2c20543 upstream. - -This prevents a race between chown() and execve(), where chowning a -setuid-user binary to root would momentarily make the binary setuid -root. - -This patch was mostly written by Linus Torvalds. - -Signed-off-by: Jann Horn <jann@thejh.net> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -[lizf: Backported to 3.4: - - adjust context - - remove task_no_new_priv and user namespace stuff - - open-code file_inode() - - s/READ_ONCE/ACCESS_ONCE] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/exec.c | 65 ++++++++++++++++++++++++++++++++++++++------------------------ - 1 file changed, 40 insertions(+), 25 deletions(-) - ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -1248,6 +1248,45 @@ void install_exec_creds(struct linux_bin - } - EXPORT_SYMBOL(install_exec_creds); - -+static void bprm_fill_uid(struct linux_binprm *bprm) -+{ -+ struct inode *inode; -+ unsigned int mode; -+ uid_t uid; -+ gid_t gid; -+ -+ /* clear any previous set[ug]id data from a previous binary */ -+ bprm->cred->euid = current_euid(); -+ bprm->cred->egid = current_egid(); -+ -+ if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) -+ return; -+ -+ inode = bprm->file->f_path.dentry->d_inode; -+ mode = ACCESS_ONCE(inode->i_mode); -+ if (!(mode & (S_ISUID|S_ISGID))) -+ return; -+ -+ /* Be careful if suid/sgid is set */ -+ mutex_lock(&inode->i_mutex); -+ -+ /* reload atomically mode/uid/gid now that lock held */ -+ mode = inode->i_mode; -+ uid = inode->i_uid; -+ gid = inode->i_gid; -+ mutex_unlock(&inode->i_mutex); -+ -+ if (mode & S_ISUID) { -+ bprm->per_clear |= PER_CLEAR_ON_SETID; -+ bprm->cred->euid = uid; -+ } -+ -+ if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) { -+ bprm->per_clear |= PER_CLEAR_ON_SETID; -+ bprm->cred->egid = gid; -+ } -+} -+ - /* - * determine how safe it is to execute the proposed program - * - the caller must hold ->cred_guard_mutex to protect against -@@ -1297,36 +1336,12 @@ static int check_unsafe_exec(struct linu - */ - int prepare_binprm(struct linux_binprm *bprm) - { -- umode_t mode; -- struct inode * inode = bprm->file->f_path.dentry->d_inode; - int retval; - -- mode = inode->i_mode; - if (bprm->file->f_op == NULL) - return -EACCES; - -- /* clear any previous set[ug]id data from a previous binary */ -- bprm->cred->euid = current_euid(); -- bprm->cred->egid = current_egid(); -- -- if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) { -- /* Set-uid? */ -- if (mode & S_ISUID) { -- bprm->per_clear |= PER_CLEAR_ON_SETID; -- bprm->cred->euid = inode->i_uid; -- } -- -- /* Set-gid? */ -- /* -- * If setgid is set but no group execute bit then this -- * is a candidate for mandatory locking, not a setgid -- * executable. -- */ -- if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) { -- bprm->per_clear |= PER_CLEAR_ON_SETID; -- bprm->cred->egid = inode->i_gid; -- } -- } -+ bprm_fill_uid(bprm); - - /* fill in binprm security blob */ - retval = security_bprm_set_creds(bprm); diff --git a/patches/fsnotify-fix-handling-of-renames-in-audit.patch b/patches/fsnotify-fix-handling-of-renames-in-audit.patch deleted file mode 100644 index 9aa5f62..0000000 --- a/patches/fsnotify-fix-handling-of-renames-in-audit.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 6ee8e25fc3e916193bce4ebb43d5439e1e2144ab Mon Sep 17 00:00:00 2001 -From: Jan Kara <jack@suse.cz> -Date: Tue, 10 Feb 2015 14:08:32 -0800 -Subject: fsnotify: fix handling of renames in audit - -commit 6ee8e25fc3e916193bce4ebb43d5439e1e2144ab upstream. - -Commit e9fd702a58c4 ("audit: convert audit watches to use fsnotify -instead of inotify") broke handling of renames in audit. Audit code -wants to update inode number of an inode corresponding to watched name -in a directory. When something gets renamed into a directory to a -watched name, inotify previously passed moved inode to audit code -however new fsnotify code passes directory inode where the change -happened. That confuses audit and it starts watching parent directory -instead of a file in a directory. - -This can be observed for example by doing: - - cd /tmp - touch foo bar - auditctl -w /tmp/foo - touch foo - mv bar foo - touch foo - -In audit log we see events like: - - type=CONFIG_CHANGE msg=audit(1423563584.155:90): auid=1000 ses=2 op="updated rules" path="/tmp/foo" key=(null) list=4 res=1 - ... - type=PATH msg=audit(1423563584.155:91): item=2 name="bar" inode=1046884 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE - type=PATH msg=audit(1423563584.155:91): item=3 name="foo" inode=1046842 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE - type=PATH msg=audit(1423563584.155:91): item=4 name="foo" inode=1046884 dev=08:0 2 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE - ... - -and that's it - we see event for the first touch after creating the -audit rule, we see events for rename but we don't see any event for the -last touch. However we start seeing events for unrelated stuff -happening in /tmp. - -Fix the problem by passing moved inode as data in the FS_MOVED_FROM and -FS_MOVED_TO events instead of the directory where the change happens. -This doesn't introduce any new problems because noone besides -audit_watch.c cares about the passed value: - - fs/notify/fanotify/fanotify.c cares only about FSNOTIFY_EVENT_PATH events. - fs/notify/dnotify/dnotify.c doesn't care about passed 'data' value at all. - fs/notify/inotify/inotify_fsnotify.c uses 'data' only for FSNOTIFY_EVENT_PATH. - kernel/audit_tree.c doesn't care about passed 'data' at all. - kernel/audit_watch.c expects moved inode as 'data'. - -Fixes: e9fd702a58c49db ("audit: convert audit watches to use fsnotify instead of inotify") -Signed-off-by: Jan Kara <jack@suse.cz> -Cc: Paul Moore <paul@paul-moore.com> -Cc: Eric Paris <eparis@redhat.com> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - include/linux/fsnotify.h | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - ---- a/include/linux/fsnotify.h -+++ b/include/linux/fsnotify.h -@@ -101,8 +101,10 @@ static inline void fsnotify_move(struct - new_dir_mask |= FS_ISDIR; - } - -- fsnotify(old_dir, old_dir_mask, old_dir, FSNOTIFY_EVENT_INODE, old_name, fs_cookie); -- fsnotify(new_dir, new_dir_mask, new_dir, FSNOTIFY_EVENT_INODE, new_name, fs_cookie); -+ fsnotify(old_dir, old_dir_mask, source, FSNOTIFY_EVENT_INODE, old_name, -+ fs_cookie); -+ fsnotify(new_dir, new_dir_mask, source, FSNOTIFY_EVENT_INODE, new_name, -+ fs_cookie); - - if (target) - fsnotify_link_count(target); diff --git a/patches/ftrace-fix-en-dis-able-graph-caller-when-en-dis-abling-record-via-sysctl.patch b/patches/ftrace-fix-en-dis-able-graph-caller-when-en-dis-abling-record-via-sysctl.patch deleted file mode 100644 index fc73561..0000000 --- a/patches/ftrace-fix-en-dis-able-graph-caller-when-en-dis-abling-record-via-sysctl.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 1619dc3f8f555ee1cdd3c75db3885d5715442b12 Mon Sep 17 00:00:00 2001 -From: Pratyush Anand <panand@redhat.com> -Date: Fri, 6 Mar 2015 23:58:06 +0530 -Subject: ftrace: Fix en(dis)able graph caller when en(dis)abling record via - sysctl - -commit 1619dc3f8f555ee1cdd3c75db3885d5715442b12 upstream. - -When ftrace is enabled globally through the proc interface, we must check if -ftrace_graph_active is set. If it is set, then we should also pass the -FTRACE_START_FUNC_RET command to ftrace_run_update_code(). Similarly, when -ftrace is disabled globally through the proc interface, we must check if -ftrace_graph_active is set. If it is set, then we should also pass the -FTRACE_STOP_FUNC_RET command to ftrace_run_update_code(). - -Consider the following situation. - - # echo 0 > /proc/sys/kernel/ftrace_enabled - -After this ftrace_enabled = 0. - - # echo function_graph > /sys/kernel/debug/tracing/current_tracer - -Since ftrace_enabled = 0, ftrace_enable_ftrace_graph_caller() is never -called. - - # echo 1 > /proc/sys/kernel/ftrace_enabled - -Now ftrace_enabled will be set to true, but still -ftrace_enable_ftrace_graph_caller() will not be called, which is not -desired. - -Further if we execute the following after this: - # echo nop > /sys/kernel/debug/tracing/current_tracer - -Now since ftrace_enabled is set it will call -ftrace_disable_ftrace_graph_caller(), which causes a kernel warning on -the ARM platform. - -On the ARM platform, when ftrace_enable_ftrace_graph_caller() is called, -it checks whether the old instruction is a nop or not. If it's not a nop, -then it returns an error. If it is a nop then it replaces instruction at -that address with a branch to ftrace_graph_caller. -ftrace_disable_ftrace_graph_caller() behaves just the opposite. Therefore, -if generic ftrace code ever calls either ftrace_enable_ftrace_graph_caller() -or ftrace_disable_ftrace_graph_caller() consecutively two times in a row, -then it will return an error, which will cause the generic ftrace code to -raise a warning. - -Note, x86 does not have an issue with this because the architecture -specific code for ftrace_enable_ftrace_graph_caller() and -ftrace_disable_ftrace_graph_caller() does not check the previous state, -and calling either of these functions twice in a row has no ill effect. - -Link: http://lkml.kernel.org/r/e4fbe64cdac0dd0e86a3bf914b0f83c0b419f146.1425666454.git.panand@redhat.com - -Signed-off-by: Pratyush Anand <panand@redhat.com> -[ - removed extra if (ftrace_start_up) and defined ftrace_graph_active as 0 - if CONFIG_FUNCTION_GRAPH_TRACER is not set. -] -Signed-off-by: Steven Rostedt <rostedt@goodmis.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/trace/ftrace.c | 27 ++++++++++++++++++++++----- - 1 file changed, 22 insertions(+), 5 deletions(-) - ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -1014,6 +1014,12 @@ ftrace_filter_lseek(struct file *file, l - return ret; - } - -+#ifdef CONFIG_FUNCTION_GRAPH_TRACER -+static int ftrace_graph_active; -+#else -+# define ftrace_graph_active 0 -+#endif -+ - #ifdef CONFIG_DYNAMIC_FTRACE - - #ifndef CONFIG_FTRACE_MCOUNT_RECORD -@@ -2056,24 +2062,36 @@ static int ftrace_shutdown(struct ftrace - - static void ftrace_startup_sysctl(void) - { -+ int command; -+ - if (unlikely(ftrace_disabled)) - return; - - /* Force update next time */ - saved_ftrace_func = NULL; - /* ftrace_start_up is true if we want ftrace running */ -- if (ftrace_start_up) -- ftrace_run_update_code(FTRACE_UPDATE_CALLS); -+ if (ftrace_start_up) { -+ command = FTRACE_UPDATE_CALLS; -+ if (ftrace_graph_active) -+ command |= FTRACE_START_FUNC_RET; -+ ftrace_run_update_code(command); -+ } - } - - static void ftrace_shutdown_sysctl(void) - { -+ int command; -+ - if (unlikely(ftrace_disabled)) - return; - - /* ftrace_start_up is true if ftrace is running */ -- if (ftrace_start_up) -- ftrace_run_update_code(FTRACE_DISABLE_CALLS); -+ if (ftrace_start_up) { -+ command = FTRACE_DISABLE_CALLS; -+ if (ftrace_graph_active) -+ command |= FTRACE_STOP_FUNC_RET; -+ ftrace_run_update_code(command); -+ } - } - - static cycle_t ftrace_update_time; -@@ -4465,7 +4483,6 @@ ftrace_enable_sysctl(struct ctl_table *t - - #ifdef CONFIG_FUNCTION_GRAPH_TRACER - --static int ftrace_graph_active; - static struct notifier_block ftrace_suspend_notifier; - - int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace) diff --git a/patches/ftrace-fix-ftrace-enable-ordering-of-sysctl-ftrace_enabled.patch b/patches/ftrace-fix-ftrace-enable-ordering-of-sysctl-ftrace_enabled.patch deleted file mode 100644 index 36656a9..0000000 --- a/patches/ftrace-fix-ftrace-enable-ordering-of-sysctl-ftrace_enabled.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 524a38682573b2e15ab6317ccfe50280441514be Mon Sep 17 00:00:00 2001 -From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org> -Date: Fri, 6 Mar 2015 19:55:13 -0500 -Subject: ftrace: Fix ftrace enable ordering of sysctl ftrace_enabled - -commit 524a38682573b2e15ab6317ccfe50280441514be upstream. - -Some archs (specifically PowerPC), are sensitive with the ordering of -the enabling of the calls to function tracing and setting of the -function to use to be traced. - -That is, update_ftrace_function() sets what function the ftrace_caller -trampoline should call. Some archs require this to be set before -calling ftrace_run_update_code(). - -Another bug was discovered, that ftrace_startup_sysctl() called -ftrace_run_update_code() directly. If the function the ftrace_caller -trampoline changes, then it will not be updated. Instead a call -to ftrace_startup_enable() should be called because it tests to see -if the callback changed since the code was disabled, and will -tell the arch to update appropriately. Most archs do not need this -notification, but PowerPC does. - -The problem could be seen by the following commands: - - # echo 0 > /proc/sys/kernel/ftrace_enabled - # echo function > /sys/kernel/debug/tracing/current_tracer - # echo 1 > /proc/sys/kernel/ftrace_enabled - # cat /sys/kernel/debug/tracing/trace - -The trace will show that function tracing was not active. - -Signed-off-by: Steven Rostedt <rostedt@goodmis.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/trace/ftrace.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -2074,7 +2074,7 @@ static void ftrace_startup_sysctl(void) - command = FTRACE_UPDATE_CALLS; - if (ftrace_graph_active) - command |= FTRACE_START_FUNC_RET; -- ftrace_run_update_code(command); -+ ftrace_startup_enable(command); - } - } - -@@ -4463,12 +4463,12 @@ ftrace_enable_sysctl(struct ctl_table *t - - if (ftrace_enabled) { - -- ftrace_startup_sysctl(); -- - /* we are starting ftrace again */ - if (ftrace_ops_list != &ftrace_list_end) - update_ftrace_function(); - -+ ftrace_startup_sysctl(); -+ - } else { - /* stopping ftrace calls (just send to ftrace_stub) */ - ftrace_trace_function = ftrace_stub; diff --git a/patches/fuse-notify-don-t-move-pages.patch b/patches/fuse-notify-don-t-move-pages.patch deleted file mode 100644 index cd7c5aa..0000000 --- a/patches/fuse-notify-don-t-move-pages.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 0d2783626a53d4c922f82d51fa675cb5d13f0d36 Mon Sep 17 00:00:00 2001 -From: Miklos Szeredi <mszeredi@suse.cz> -Date: Thu, 26 Feb 2015 11:45:47 +0100 -Subject: fuse: notify: don't move pages - -commit 0d2783626a53d4c922f82d51fa675cb5d13f0d36 upstream. - -fuse_try_move_page() is not prepared for replacing pages that have already -been read. - -Reported-by: Al Viro <viro@zeniv.linux.org.uk> -Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/fuse/dev.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/fs/fuse/dev.c -+++ b/fs/fuse/dev.c -@@ -1634,6 +1634,9 @@ copy_finish: - static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code, - unsigned int size, struct fuse_copy_state *cs) - { -+ /* Don't try to move pages (yet) */ -+ cs->move_pages = 0; -+ - switch (code) { - case FUSE_NOTIFY_POLL: - return fuse_notify_poll(fc, size, cs); diff --git a/patches/fuse-set-stolen-page-uptodate.patch b/patches/fuse-set-stolen-page-uptodate.patch deleted file mode 100644 index bfd385a..0000000 --- a/patches/fuse-set-stolen-page-uptodate.patch +++ /dev/null @@ -1,31 +0,0 @@ -From aa991b3b267e24f578bac7b09cc57579b660304b Mon Sep 17 00:00:00 2001 -From: Miklos Szeredi <mszeredi@suse.cz> -Date: Thu, 26 Feb 2015 11:45:47 +0100 -Subject: fuse: set stolen page uptodate - -commit aa991b3b267e24f578bac7b09cc57579b660304b upstream. - -Regular pipe buffers' ->steal method (generic_pipe_buf_steal()) doesn't set -PG_uptodate. - -Don't warn on this condition, just set the uptodate flag. - -Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/fuse/dev.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/fs/fuse/dev.c -+++ b/fs/fuse/dev.c -@@ -717,8 +717,8 @@ static int fuse_try_move_page(struct fus - - newpage = buf->page; - -- if (WARN_ON(!PageUptodate(newpage))) -- return -EIO; -+ if (!PageUptodate(newpage)) -+ SetPageUptodate(newpage); - - ClearPageMappedToDisk(newpage); - diff --git a/patches/gadgetfs-use-after-free-in-aio_read.patch b/patches/gadgetfs-use-after-free-in-aio_read.patch deleted file mode 100644 index 9f0da14..0000000 --- a/patches/gadgetfs-use-after-free-in-aio_read.patch +++ /dev/null @@ -1,78 +0,0 @@ -From f01d35a15fa04162a58b95970fc01fa70ec9dacd Mon Sep 17 00:00:00 2001 -From: Al Viro <viro@zeniv.linux.org.uk> -Date: Fri, 6 Feb 2015 02:07:45 -0500 -Subject: gadgetfs: use-after-free in ->aio_read() - -commit f01d35a15fa04162a58b95970fc01fa70ec9dacd upstream. - -AIO_PREAD requests call ->aio_read() with iovec on caller's stack, so if -we are going to access it asynchronously, we'd better get ourselves -a copy - the one on kernel stack of aio_run_iocb() won't be there -anymore. function/f_fs.c take care of doing that, legacy/inode.c -doesn't... - -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -[lizf: Backproted to 3.4: - - adjust context - - need kfree() after calling get_ready_ep()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/gadget/inode.c | 15 +++++++++++++-- - 1 file changed, 13 insertions(+), 2 deletions(-) - ---- a/drivers/usb/gadget/inode.c -+++ b/drivers/usb/gadget/inode.c -@@ -570,6 +570,7 @@ static ssize_t ep_aio_read_retry(struct - break; - } - kfree(priv->buf); -+ kfree(priv->iv); - kfree(priv); - return len; - } -@@ -591,6 +592,7 @@ static void ep_aio_complete(struct usb_e - */ - if (priv->iv == NULL || unlikely(req->actual == 0)) { - kfree(req->buf); -+ kfree(priv->iv); - kfree(priv); - iocb->private = NULL; - /* aio_complete() reports bytes-transferred _and_ faults */ -@@ -626,7 +628,7 @@ ep_aio_rwtail( - struct usb_request *req; - ssize_t value; - -- priv = kmalloc(sizeof *priv, GFP_KERNEL); -+ priv = kzalloc(sizeof *priv, GFP_KERNEL); - if (!priv) { - value = -ENOMEM; - fail: -@@ -634,11 +636,19 @@ fail: - return value; - } - iocb->private = priv; -- priv->iv = iv; -+ if (iv) { -+ priv->iv = kmemdup(iv, nr_segs * sizeof(struct iovec), -+ GFP_KERNEL); -+ if (!priv->iv) { -+ kfree(priv); -+ goto fail; -+ } -+ } - priv->nr_segs = nr_segs; - - value = get_ready_ep(iocb->ki_filp->f_flags, epdata); - if (unlikely(value < 0)) { -+ kfree(priv->iv); - kfree(priv); - goto fail; - } -@@ -672,6 +682,7 @@ fail: - mutex_unlock(&epdata->lock); - - if (unlikely(value)) { -+ kfree(priv->iv); - kfree(priv); - put_ep(epdata); - } else diff --git a/patches/gpio-tps65912-fix-wrong-container_of-arguments.patch b/patches/gpio-tps65912-fix-wrong-container_of-arguments.patch deleted file mode 100644 index ba3f61c..0000000 --- a/patches/gpio-tps65912-fix-wrong-container_of-arguments.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 2f97c20e5f7c3582c7310f65a04465bfb0fd0e85 Mon Sep 17 00:00:00 2001 -From: Nicolas Saenz Julienne <nicolassaenzj@gmail.com> -Date: Thu, 19 Feb 2015 01:52:25 +0000 -Subject: gpio: tps65912: fix wrong container_of arguments - -commit 2f97c20e5f7c3582c7310f65a04465bfb0fd0e85 upstream. - -The gpio_chip operations receive a pointer the gpio_chip struct which is -contained in the driver's private struct, yet the container_of call in those -functions point to the mfd struct defined in include/linux/mfd/tps65912.h. - -Signed-off-by: Nicolas Saenz Julienne <nicolassaenzj@gmail.com> -Signed-off-by: Linus Walleij <linus.walleij@linaro.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpio/gpio-tps65912.c | 14 ++++++++++---- - 1 file changed, 10 insertions(+), 4 deletions(-) - ---- a/drivers/gpio/gpio-tps65912.c -+++ b/drivers/gpio/gpio-tps65912.c -@@ -26,9 +26,12 @@ struct tps65912_gpio_data { - struct gpio_chip gpio_chip; - }; - -+#define to_tgd(gc) container_of(gc, struct tps65912_gpio_data, gpio_chip) -+ - static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset) - { -- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio); -+ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc); -+ struct tps65912 *tps65912 = tps65912_gpio->tps65912; - int val; - - val = tps65912_reg_read(tps65912, TPS65912_GPIO1 + offset); -@@ -42,7 +45,8 @@ static int tps65912_gpio_get(struct gpio - static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset, - int value) - { -- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio); -+ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc); -+ struct tps65912 *tps65912 = tps65912_gpio->tps65912; - - if (value) - tps65912_set_bits(tps65912, TPS65912_GPIO1 + offset, -@@ -55,7 +59,8 @@ static void tps65912_gpio_set(struct gpi - static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset, - int value) - { -- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio); -+ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc); -+ struct tps65912 *tps65912 = tps65912_gpio->tps65912; - - /* Set the initial value */ - tps65912_gpio_set(gc, offset, value); -@@ -66,7 +71,8 @@ static int tps65912_gpio_output(struct g - - static int tps65912_gpio_input(struct gpio_chip *gc, unsigned offset) - { -- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio); -+ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc); -+ struct tps65912 *tps65912 = tps65912_gpio->tps65912; - - return tps65912_clear_bits(tps65912, TPS65912_GPIO1 + offset, - GPIO_CFG_MASK); diff --git a/patches/hfsplus-fix-b-tree-corruption-after-insertion-at-position-0.patch b/patches/hfsplus-fix-b-tree-corruption-after-insertion-at-position-0.patch deleted file mode 100644 index 92144bd..0000000 --- a/patches/hfsplus-fix-b-tree-corruption-after-insertion-at-position-0.patch +++ /dev/null @@ -1,103 +0,0 @@ -From 98cf21c61a7f5419d82f847c4d77bf6e96a76f5f Mon Sep 17 00:00:00 2001 -From: Sergei Antonov <saproj@gmail.com> -Date: Wed, 25 Mar 2015 15:55:34 -0700 -Subject: hfsplus: fix B-tree corruption after insertion at position 0 - -commit 98cf21c61a7f5419d82f847c4d77bf6e96a76f5f upstream. - -Fix B-tree corruption when a new record is inserted at position 0 in the -node in hfs_brec_insert(). In this case a hfs_brec_update_parent() is -called to update the parent index node (if exists) and it is passed -hfs_find_data with a search_key containing a newly inserted key instead -of the key to be updated. This results in an inconsistent index node. -The bug reproduces on my machine after an extents overflow record for -the catalog file (CNID=4) is inserted into the extents overflow B-tree. -Because of a low (reserved) value of CNID=4, it has to become the first -record in the first leaf node. - -The resulting first leaf node is correct: - - ---------------------------------------------------- - | key0.CNID=4 | key1.CNID=123 | key2.CNID=456, ... | - ---------------------------------------------------- - -But the parent index key0 still contains the previous key CNID=123: - - ----------------------- - | key0.CNID=123 | ... | - ----------------------- - -A change in hfs_brec_insert() makes hfs_brec_update_parent() work -correctly by preventing it from getting fd->record=-1 value from -__hfs_brec_find(). - -Along the way, I removed duplicate code with unification of the if -condition. The resulting code is equivalent to the original code -because node is never 0. - -Also hfs_brec_update_parent() will now return an error after getting a -negative fd->record value. However, the return value of -hfs_brec_update_parent() is not checked anywhere in the file and I'm -leaving it unchanged by this patch. brec.c lacks error checking after -some other calls too, but this issue is of less importance than the one -being fixed by this patch. - -Signed-off-by: Sergei Antonov <saproj@gmail.com> -Cc: Joe Perches <joe@perches.com> -Reviewed-by: Vyacheslav Dubeyko <slava@dubeyko.com> -Acked-by: Hin-Tak Leung <htl10@users.sourceforge.net> -Cc: Anton Altaparmakov <aia21@cam.ac.uk> -Cc: Al Viro <viro@zeniv.linux.org.uk> -Cc: Christoph Hellwig <hch@infradead.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/hfsplus/brec.c | 20 +++++++++++--------- - 1 file changed, 11 insertions(+), 9 deletions(-) - ---- a/fs/hfsplus/brec.c -+++ b/fs/hfsplus/brec.c -@@ -130,13 +130,16 @@ skip: - hfs_bnode_write(node, entry, data_off + key_len, entry_len); - hfs_bnode_dump(node); - -- if (new_node) { -- /* update parent key if we inserted a key -- * at the start of the first node -- */ -- if (!rec && new_node != node) -- hfs_brec_update_parent(fd); -+ /* -+ * update parent key if we inserted a key -+ * at the start of the node and it is not the new node -+ */ -+ if (!rec && new_node != node) { -+ hfs_bnode_read_key(node, fd->search_key, data_off + size); -+ hfs_brec_update_parent(fd); -+ } - -+ if (new_node) { - hfs_bnode_put(fd->bnode); - if (!new_node->parent) { - hfs_btree_inc_height(tree); -@@ -166,9 +169,6 @@ skip: - goto again; - } - -- if (!rec) -- hfs_brec_update_parent(fd); -- - return 0; - } - -@@ -368,6 +368,8 @@ again: - if (IS_ERR(parent)) - return PTR_ERR(parent); - __hfs_brec_find(parent, fd); -+ if (fd->record < 0) -+ return -ENOENT; - hfs_bnode_dump(parent); - rec = fd->record; - diff --git a/patches/hpsa-add-missing-pci_set_master-in-kdump-path.patch b/patches/hpsa-add-missing-pci_set_master-in-kdump-path.patch deleted file mode 100644 index a7c3c80..0000000 --- a/patches/hpsa-add-missing-pci_set_master-in-kdump-path.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 859c75aba20264d87dd026bab0d0ca3bff385955 Mon Sep 17 00:00:00 2001 -From: Tomas Henzl <thenzl@redhat.com> -Date: Fri, 12 Sep 2014 14:44:15 +0200 -Subject: hpsa: add missing pci_set_master in kdump path - -commit 859c75aba20264d87dd026bab0d0ca3bff385955 upstream. - -Add a call to pci_set_master(...) missing in the previous -patch "hpsa: refine the pci enable/disable handling". -Found thanks to Rob Elliot. - -Signed-off-by: Tomas Henzl <thenzl@redhat.com> -Reviewed-by: Robert Elliott <elliott@hp.com> -Tested-by: Robert Elliott <elliott@hp.com> -Signed-off-by: Christoph Hellwig <hch@lst.de> -Cc: Vinson Lee <vlee@twopensource.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/hpsa.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/scsi/hpsa.c -+++ b/drivers/scsi/hpsa.c -@@ -4075,7 +4075,7 @@ static __devinit int hpsa_init_reset_dev - dev_warn(&pdev->dev, "failed to enable device.\n"); - return -ENODEV; - } -- -+ pci_set_master(pdev); - /* Reset the controller with a PCI power-cycle or via doorbell */ - rc = hpsa_kdump_hard_reset_controller(pdev); - diff --git a/patches/hpsa-fix-memory-leak-in-kdump-hard-reset.patch b/patches/hpsa-fix-memory-leak-in-kdump-hard-reset.patch deleted file mode 100644 index 012f1c9..0000000 --- a/patches/hpsa-fix-memory-leak-in-kdump-hard-reset.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 03741d956eaac31264952e0afa181b62713892a5 Mon Sep 17 00:00:00 2001 -From: Tomas Henzl <thenzl@redhat.com> -Date: Fri, 23 Jan 2015 16:41:14 -0600 -Subject: hpsa: fix memory leak in kdump hard reset - -commit 03741d956eaac31264952e0afa181b62713892a5 upstream. - -There is a potential memory leak in hpsa_kdump_hard_reset_controller. - -Reviewed-by: Don Brace <don.brace@pmcs.com> -Reviewed-by: Scott Teel <scott.teel@pmcs.com> -Signed-off-by: Tomas Henzl <thenzl@redhat.com> -Signed-off-by: Don Brace <don.brace@pmcs.com> -Signed-off-by: Christoph Hellwig <hch@lst.de> -Cc: Vinson Lee <vlee@twopensource.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/hpsa.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/scsi/hpsa.c -+++ b/drivers/scsi/hpsa.c -@@ -3530,7 +3530,7 @@ static __devinit int hpsa_kdump_hard_res - } - rc = write_driver_ver_to_cfgtable(cfgtable); - if (rc) -- goto unmap_vaddr; -+ goto unmap_cfgtable; - - /* If reset via doorbell register is supported, use that. - * There are two such methods. Favor the newest method. diff --git a/patches/hpsa-refine-the-pci-enable-disable-handling.patch b/patches/hpsa-refine-the-pci-enable-disable-handling.patch deleted file mode 100644 index 964e0d6..0000000 --- a/patches/hpsa-refine-the-pci-enable-disable-handling.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 132aa220b45d60e9b20def1e9d8be9422eed9616 Mon Sep 17 00:00:00 2001 -From: Tomas Henzl <thenzl@redhat.com> -Date: Thu, 14 Aug 2014 16:12:39 +0200 -Subject: hpsa: refine the pci enable/disable handling - -commit 132aa220b45d60e9b20def1e9d8be9422eed9616 upstream. - -When a second(kdump) kernel starts and the hard reset method is used -the driver calls pci_disable_device without previously enabling it, -so the kernel shows a warning - -[ 16.876248] WARNING: at drivers/pci/pci.c:1431 pci_disable_device+0x84/0x90() -[ 16.882686] Device hpsa -disabling already-disabled device -... -This patch fixes it, in addition to this I tried to balance also some other pairs -of enable/disable device in the driver. -Unfortunately I wasn't able to verify the functionality for the case of a sw reset, -because of a lack of proper hw. - -Signed-off-by: Tomas Henzl <thenzl@redhat.com> -Reviewed-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> -Signed-off-by: Christoph Hellwig <hch@lst.de> -Cc: Vinson Lee <vlee@twopensource.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/hpsa.c | 42 ++++++++++++++++++++++++++++-------------- - 1 file changed, 28 insertions(+), 14 deletions(-) - ---- a/drivers/scsi/hpsa.c -+++ b/drivers/scsi/hpsa.c -@@ -3507,10 +3507,6 @@ static __devinit int hpsa_kdump_hard_res - - /* Save the PCI command register */ - pci_read_config_word(pdev, 4, &command_register); -- /* Turn the board off. This is so that later pci_restore_state() -- * won't turn the board on before the rest of config space is ready. -- */ -- pci_disable_device(pdev); - pci_save_state(pdev); - - /* find the first memory BAR, so we can find the cfg table */ -@@ -3558,11 +3554,6 @@ static __devinit int hpsa_kdump_hard_res - goto unmap_cfgtable; - - pci_restore_state(pdev); -- rc = pci_enable_device(pdev); -- if (rc) { -- dev_warn(&pdev->dev, "failed to enable device.\n"); -- goto unmap_cfgtable; -- } - pci_write_config_word(pdev, 4, command_register); - - /* Some devices (notably the HP Smart Array 5i Controller) -@@ -4068,6 +4059,23 @@ static __devinit int hpsa_init_reset_dev - if (!reset_devices) - return 0; - -+ /* kdump kernel is loading, we don't know in which state is -+ * the pci interface. The dev->enable_cnt is equal zero -+ * so we call enable+disable, wait a while and switch it on. -+ */ -+ rc = pci_enable_device(pdev); -+ if (rc) { -+ dev_warn(&pdev->dev, "Failed to enable PCI device\n"); -+ return -ENODEV; -+ } -+ pci_disable_device(pdev); -+ msleep(260); /* a randomly chosen number */ -+ rc = pci_enable_device(pdev); -+ if (rc) { -+ dev_warn(&pdev->dev, "failed to enable device.\n"); -+ return -ENODEV; -+ } -+ - /* Reset the controller with a PCI power-cycle or via doorbell */ - rc = hpsa_kdump_hard_reset_controller(pdev); - -@@ -4076,10 +4084,11 @@ static __devinit int hpsa_init_reset_dev - * "performant mode". Or, it might be 640x, which can't reset - * due to concerns about shared bbwc between 6402/6404 pair. - */ -- if (rc == -ENOTSUPP) -- return rc; /* just try to do the kdump anyhow. */ -- if (rc) -- return -ENODEV; -+ if (rc) { -+ if (rc != -ENOTSUPP) /* just try to do the kdump anyhow. */ -+ rc = -ENODEV; -+ goto out_disable; -+ } - - /* Now try to get the controller to respond to a no-op */ - dev_warn(&pdev->dev, "Waiting for controller to respond to no-op\n"); -@@ -4090,7 +4099,11 @@ static __devinit int hpsa_init_reset_dev - dev_warn(&pdev->dev, "no-op failed%s\n", - (i < 11 ? "; re-trying" : "")); - } -- return 0; -+ -+out_disable: -+ -+ pci_disable_device(pdev); -+ return rc; - } - - static __devinit int hpsa_allocate_cmd_pool(struct ctlr_info *h) -@@ -4191,6 +4204,7 @@ static void hpsa_undo_allocations_after_ - iounmap(h->transtable); - if (h->cfgtable) - iounmap(h->cfgtable); -+ pci_disable_device(h->pdev); - pci_release_regions(h->pdev); - kfree(h); - } diff --git a/patches/hpsa-turn-off-interrupts-when-kdump-starts.patch b/patches/hpsa-turn-off-interrupts-when-kdump-starts.patch deleted file mode 100644 index 47c4481..0000000 --- a/patches/hpsa-turn-off-interrupts-when-kdump-starts.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 3b747298786355c6934b0892fc9ae4ca44105192 Mon Sep 17 00:00:00 2001 -From: Tomas Henzl <thenzl@redhat.com> -Date: Fri, 23 Jan 2015 16:41:20 -0600 -Subject: hpsa: turn off interrupts when kdump starts - -commit 3b747298786355c6934b0892fc9ae4ca44105192 upstream. - -Sometimes when the card is restarted it may cause - -"irq 16: nobody cared (try booting with the "irqpoll" option)" -that is likely caused so, that the card, after the hard reset -finishes, pulls on the irq. Disabling the ints before or after -the hpsa_kdump_hard_reset_controller fixes it. - -At this point we can't know in which state the card is, -so using SA5_INTR_OFF + SA5_REPLY_INTR_MASK_OFFSET defines directly, -instead of the function the drivers provides, seems to be apropriate. - -Reviewed-by: Scott Teel <scott.teel@pmcs.com> -Signed-off-by: Don Brace <don.brace@pmcs.com> -Signed-off-by: Christoph Hellwig <hch@lst.de> -Cc: Vinson Lee <vlee@twopensource.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/hpsa.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - ---- a/drivers/scsi/hpsa.c -+++ b/drivers/scsi/hpsa.c -@@ -4055,6 +4055,7 @@ static void __devinit hpsa_hba_inquiry(s - static __devinit int hpsa_init_reset_devices(struct pci_dev *pdev) - { - int rc, i; -+ void __iomem *vaddr; - - if (!reset_devices) - return 0; -@@ -4076,6 +4077,15 @@ static __devinit int hpsa_init_reset_dev - return -ENODEV; - } - pci_set_master(pdev); -+ -+ vaddr = pci_ioremap_bar(pdev, 0); -+ if (vaddr == NULL) { -+ rc = -ENOMEM; -+ goto out_disable; -+ } -+ writel(SA5_INTR_OFF, vaddr + SA5_REPLY_INTR_MASK_OFFSET); -+ iounmap(vaddr); -+ - /* Reset the controller with a PCI power-cycle or via doorbell */ - rc = hpsa_kdump_hard_reset_controller(pdev); - diff --git a/patches/hx4700-regulator-declare-full-constraints.patch b/patches/hx4700-regulator-declare-full-constraints.patch deleted file mode 100644 index 4e90fba..0000000 --- a/patches/hx4700-regulator-declare-full-constraints.patch +++ /dev/null @@ -1,29 +0,0 @@ -From a52d209336f8fc7483a8c7f4a8a7d2a8e1692a6c Mon Sep 17 00:00:00 2001 -From: Martin Vajnar <martin.vajnar@gmail.com> -Date: Wed, 24 Dec 2014 00:27:57 +0100 -Subject: hx4700: regulator: declare full constraints - -commit a52d209336f8fc7483a8c7f4a8a7d2a8e1692a6c upstream. - -Since the removal of CONFIG_REGULATOR_DUMMY option, the touchscreen stopped -working. This patch enables the "replacement" for REGULATOR_DUMMY and -allows the touchscreen to work even though there is no regulator for "vcc". - -Signed-off-by: Martin Vajnar <martin.vajnar@gmail.com> -Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/arm/mach-pxa/hx4700.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/arch/arm/mach-pxa/hx4700.c -+++ b/arch/arm/mach-pxa/hx4700.c -@@ -881,6 +881,8 @@ static void __init hx4700_init(void) - mdelay(10); - gpio_set_value(GPIO71_HX4700_ASIC3_nRESET, 1); - mdelay(10); -+ -+ regulator_has_full_constraints(); - } - - MACHINE_START(H4700, "HP iPAQ HX4700") diff --git a/patches/ib-core-avoid-leakage-from-kernel-to-user-space.patch b/patches/ib-core-avoid-leakage-from-kernel-to-user-space.patch deleted file mode 100644 index b5e2515..0000000 --- a/patches/ib-core-avoid-leakage-from-kernel-to-user-space.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 377b513485fd885dea1083a9a5430df65b35e048 Mon Sep 17 00:00:00 2001 -From: Eli Cohen <eli@dev.mellanox.co.il> -Date: Sun, 14 Sep 2014 16:47:52 +0300 -Subject: IB/core: Avoid leakage from kernel to user space - -commit 377b513485fd885dea1083a9a5430df65b35e048 upstream. - -Clear the reserved field of struct ib_uverbs_async_event_desc which is -copied to user space. - -Signed-off-by: Eli Cohen <eli@mellanox.com> -Reviewed-by: Yann Droneaud <ydroneaud@opteya.com> -Signed-off-by: Roland Dreier <roland@purestorage.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/infiniband/core/uverbs_main.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/infiniband/core/uverbs_main.c -+++ b/drivers/infiniband/core/uverbs_main.c -@@ -451,6 +451,7 @@ static void ib_uverbs_async_handler(stru - - entry->desc.async.element = element; - entry->desc.async.event_type = event; -+ entry->desc.async.reserved = 0; - entry->counter = counter; - - list_add_tail(&entry->list, &file->async_file->event_list); diff --git a/patches/ib-core-don-t-disallow-registering-region-starting-at-0x0.patch b/patches/ib-core-don-t-disallow-registering-region-starting-at-0x0.patch deleted file mode 100644 index c03f7d3..0000000 --- a/patches/ib-core-don-t-disallow-registering-region-starting-at-0x0.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 66578b0b2f69659f00b6169e6fe7377c4b100d18 Mon Sep 17 00:00:00 2001 -From: Yann Droneaud <ydroneaud@opteya.com> -Date: Mon, 13 Apr 2015 14:56:23 +0200 -Subject: IB/core: don't disallow registering region starting at 0x0 - -commit 66578b0b2f69659f00b6169e6fe7377c4b100d18 upstream. - -In a call to ib_umem_get(), if address is 0x0 and size is -already page aligned, check added in commit 8494057ab5e4 -("IB/uverbs: Prevent integer overflow in ib_umem_get address -arithmetic") will refuse to register a memory region that -could otherwise be valid (provided vm.mmap_min_addr sysctl -and mmap_low_allowed SELinux knobs allow userspace to map -something at address 0x0). - -This patch allows back such registration: ib_umem_get() -should probably don't care of the base address provided it -can be pinned with get_user_pages(). - -There's two possible overflows, in (addr + size) and in -PAGE_ALIGN(addr + size), this patch keep ensuring none -of them happen while allowing to pin memory at address -0x0. Anyway, the case of size equal 0 is no more (partially) -handled as 0-length memory region are disallowed by an -earlier check. - -Link: http://mid.gmane.org/cover.1428929103.git.ydroneaud@opteya.com -Cc: Shachar Raindel <raindel@mellanox.com> -Cc: Jack Morgenstein <jackm@mellanox.com> -Cc: Or Gerlitz <ogerlitz@mellanox.com> -Signed-off-by: Yann Droneaud <ydroneaud@opteya.com> -Reviewed-by: Sagi Grimberg <sagig@mellanox.com> -Reviewed-by: Haggai Eran <haggaie@mellanox.com> -Signed-off-by: Doug Ledford <dledford@redhat.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/infiniband/core/umem.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/infiniband/core/umem.c -+++ b/drivers/infiniband/core/umem.c -@@ -98,8 +98,8 @@ struct ib_umem *ib_umem_get(struct ib_uc - * If the combination of the addr and size requested for this memory - * region causes an integer overflow, return error. - */ -- if ((PAGE_ALIGN(addr + size) <= size) || -- (PAGE_ALIGN(addr + size) <= addr)) -+ if (((addr + size) < addr) || -+ PAGE_ALIGN(addr + size) < (addr + size)) - return ERR_PTR(-EINVAL); - - if (!can_do_mlock()) diff --git a/patches/ib-mlx4-saturate-roce-port-pma-counters-in-case-of-overflow.patch b/patches/ib-mlx4-saturate-roce-port-pma-counters-in-case-of-overflow.patch deleted file mode 100644 index 59061b5..0000000 --- a/patches/ib-mlx4-saturate-roce-port-pma-counters-in-case-of-overflow.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 61a3855bb726cbb062ef02a31a832dea455456e0 Mon Sep 17 00:00:00 2001 -From: Majd Dibbiny <majd@mellanox.com> -Date: Wed, 18 Mar 2015 16:51:37 +0200 -Subject: IB/mlx4: Saturate RoCE port PMA counters in case of overflow - -commit 61a3855bb726cbb062ef02a31a832dea455456e0 upstream. - -For RoCE ports, we set the u32 PMA values based on u64 HCA counters. In case of -overflow, according to the IB spec, we have to saturate a counter to its -max value, do that. - -Fixes: c37791349cc7 ('IB/mlx4: Support PMA counters for IBoE') -Signed-off-by: Majd Dibbiny <majd@mellanox.com> -Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com> -Signed-off-by: Hadar Hen Zion <hadarh@mellanox.com> -Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -[lizf: Backported to 3.4: - - adjust context - - open-code U32_MAX] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/infiniband/hw/mlx4/mad.c | 20 ++++++++++++++++---- - 1 file changed, 16 insertions(+), 4 deletions(-) - ---- a/drivers/infiniband/hw/mlx4/mad.c -+++ b/drivers/infiniband/hw/mlx4/mad.c -@@ -44,6 +44,14 @@ enum { - MLX4_IB_VENDOR_CLASS2 = 0xa - }; - -+/* Counters should be saturate once they reach their maximum value */ -+#define ASSIGN_32BIT_COUNTER(counter, value) do {\ -+ if ((value) > (u32)~0U) \ -+ counter = cpu_to_be32((u32)~0U); \ -+ else \ -+ counter = cpu_to_be32(value); \ -+} while (0) -+ - int mlx4_MAD_IFC(struct mlx4_ib_dev *dev, int ignore_mkey, int ignore_bkey, - int port, struct ib_wc *in_wc, struct ib_grh *in_grh, - void *in_mad, void *response_mad) -@@ -304,10 +312,14 @@ static int ib_process_mad(struct ib_devi - static void edit_counter(struct mlx4_counter *cnt, - struct ib_pma_portcounters *pma_cnt) - { -- pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2)); -- pma_cnt->port_rcv_data = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2)); -- pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames)); -- pma_cnt->port_rcv_packets = cpu_to_be32(be64_to_cpu(cnt->rx_frames)); -+ ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data, -+ (be64_to_cpu(cnt->tx_bytes) >> 2)); -+ ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data, -+ (be64_to_cpu(cnt->rx_bytes) >> 2)); -+ ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets, -+ be64_to_cpu(cnt->tx_frames)); -+ ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets, -+ be64_to_cpu(cnt->rx_frames)); - } - - static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num, diff --git a/patches/ib-qib-do-not-write-eeprom.patch b/patches/ib-qib-do-not-write-eeprom.patch deleted file mode 100644 index 1ed88b4..0000000 --- a/patches/ib-qib-do-not-write-eeprom.patch +++ /dev/null @@ -1,337 +0,0 @@ -From 18c0b82a3e4501511b08d0e8676fb08ac08734a3 Mon Sep 17 00:00:00 2001 -From: Mitko Haralanov <mitko.haralanov@intel.com> -Date: Fri, 16 Jan 2015 08:55:27 -0500 -Subject: IB/qib: Do not write EEPROM - -commit 18c0b82a3e4501511b08d0e8676fb08ac08734a3 upstream. - -This changeset removes all the code that allows the driver to write to -the EEPROM and update the recorded error counters and power on hours. - -These two stats are unused and writing them exposes a timing risk -which could leave the EEPROM in a bad state preventing further normal -operation of the HCA. - -Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com> -Signed-off-by: Mitko Haralanov <mitko.haralanov@intel.com> -Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com> -Signed-off-by: Roland Dreier <roland@purestorage.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/infiniband/hw/qib/qib.h | 9 - - drivers/infiniband/hw/qib/qib_eeprom.c | 181 -------------------------------- - drivers/infiniband/hw/qib/qib_iba6120.c | 2 - drivers/infiniband/hw/qib/qib_iba7220.c | 2 - drivers/infiniband/hw/qib/qib_iba7322.c | 2 - drivers/infiniband/hw/qib/qib_init.c | 1 - drivers/infiniband/hw/qib/qib_sysfs.c | 24 ---- - 7 files changed, 1 insertion(+), 220 deletions(-) - ---- a/drivers/infiniband/hw/qib/qib.h -+++ b/drivers/infiniband/hw/qib/qib.h -@@ -1013,12 +1013,6 @@ struct qib_devdata { - /* control high-level access to EEPROM */ - struct mutex eep_lock; - uint64_t traffic_wds; -- /* active time is kept in seconds, but logged in hours */ -- atomic_t active_time; -- /* Below are nominal shadow of EEPROM, new since last EEPROM update */ -- uint8_t eep_st_errs[QIB_EEP_LOG_CNT]; -- uint8_t eep_st_new_errs[QIB_EEP_LOG_CNT]; -- uint16_t eep_hrs; - /* - * masks for which bits of errs, hwerrs that cause - * each of the counters to increment. -@@ -1235,8 +1229,7 @@ int qib_twsi_blk_rd(struct qib_devdata * - int qib_twsi_blk_wr(struct qib_devdata *dd, int dev, int addr, - const void *buffer, int len); - void qib_get_eeprom_info(struct qib_devdata *); --int qib_update_eeprom_log(struct qib_devdata *dd); --void qib_inc_eeprom_err(struct qib_devdata *dd, u32 eidx, u32 incr); -+#define qib_inc_eeprom_err(dd, eidx, incr) - void qib_dump_lookup_output_queue(struct qib_devdata *); - void qib_force_pio_avail_update(struct qib_devdata *); - void qib_clear_symerror_on_linkup(unsigned long opaque); ---- a/drivers/infiniband/hw/qib/qib_eeprom.c -+++ b/drivers/infiniband/hw/qib/qib_eeprom.c -@@ -263,189 +263,8 @@ void qib_get_eeprom_info(struct qib_devd - qib_dev_err(dd, "Board SN %s did not pass functional " - "test: %s\n", dd->serial, ifp->if_comment); - -- memcpy(&dd->eep_st_errs, &ifp->if_errcntp, QIB_EEP_LOG_CNT); -- /* -- * Power-on (actually "active") hours are kept as little-endian value -- * in EEPROM, but as seconds in a (possibly as small as 24-bit) -- * atomic_t while running. -- */ -- atomic_set(&dd->active_time, 0); -- dd->eep_hrs = ifp->if_powerhour[0] | (ifp->if_powerhour[1] << 8); -- - done: - vfree(buf); - - bail:; - } -- --/** -- * qib_update_eeprom_log - copy active-time and error counters to eeprom -- * @dd: the qlogic_ib device -- * -- * Although the time is kept as seconds in the qib_devdata struct, it is -- * rounded to hours for re-write, as we have only 16 bits in EEPROM. -- * First-cut code reads whole (expected) struct qib_flash, modifies, -- * re-writes. Future direction: read/write only what we need, assuming -- * that the EEPROM had to have been "good enough" for driver init, and -- * if not, we aren't making it worse. -- * -- */ --int qib_update_eeprom_log(struct qib_devdata *dd) --{ -- void *buf; -- struct qib_flash *ifp; -- int len, hi_water; -- uint32_t new_time, new_hrs; -- u8 csum; -- int ret, idx; -- unsigned long flags; -- -- /* first, check if we actually need to do anything. */ -- ret = 0; -- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) { -- if (dd->eep_st_new_errs[idx]) { -- ret = 1; -- break; -- } -- } -- new_time = atomic_read(&dd->active_time); -- -- if (ret == 0 && new_time < 3600) -- goto bail; -- -- /* -- * The quick-check above determined that there is something worthy -- * of logging, so get current contents and do a more detailed idea. -- * read full flash, not just currently used part, since it may have -- * been written with a newer definition -- */ -- len = sizeof(struct qib_flash); -- buf = vmalloc(len); -- ret = 1; -- if (!buf) { -- qib_dev_err(dd, "Couldn't allocate memory to read %u " -- "bytes from eeprom for logging\n", len); -- goto bail; -- } -- -- /* Grab semaphore and read current EEPROM. If we get an -- * error, let go, but if not, keep it until we finish write. -- */ -- ret = mutex_lock_interruptible(&dd->eep_lock); -- if (ret) { -- qib_dev_err(dd, "Unable to acquire EEPROM for logging\n"); -- goto free_bail; -- } -- ret = qib_twsi_blk_rd(dd, dd->twsi_eeprom_dev, 0, buf, len); -- if (ret) { -- mutex_unlock(&dd->eep_lock); -- qib_dev_err(dd, "Unable read EEPROM for logging\n"); -- goto free_bail; -- } -- ifp = (struct qib_flash *)buf; -- -- csum = flash_csum(ifp, 0); -- if (csum != ifp->if_csum) { -- mutex_unlock(&dd->eep_lock); -- qib_dev_err(dd, "EEPROM cks err (0x%02X, S/B 0x%02X)\n", -- csum, ifp->if_csum); -- ret = 1; -- goto free_bail; -- } -- hi_water = 0; -- spin_lock_irqsave(&dd->eep_st_lock, flags); -- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) { -- int new_val = dd->eep_st_new_errs[idx]; -- if (new_val) { -- /* -- * If we have seen any errors, add to EEPROM values -- * We need to saturate at 0xFF (255) and we also -- * would need to adjust the checksum if we were -- * trying to minimize EEPROM traffic -- * Note that we add to actual current count in EEPROM, -- * in case it was altered while we were running. -- */ -- new_val += ifp->if_errcntp[idx]; -- if (new_val > 0xFF) -- new_val = 0xFF; -- if (ifp->if_errcntp[idx] != new_val) { -- ifp->if_errcntp[idx] = new_val; -- hi_water = offsetof(struct qib_flash, -- if_errcntp) + idx; -- } -- /* -- * update our shadow (used to minimize EEPROM -- * traffic), to match what we are about to write. -- */ -- dd->eep_st_errs[idx] = new_val; -- dd->eep_st_new_errs[idx] = 0; -- } -- } -- /* -- * Now update active-time. We would like to round to the nearest hour -- * but unless atomic_t are sure to be proper signed ints we cannot, -- * because we need to account for what we "transfer" to EEPROM and -- * if we log an hour at 31 minutes, then we would need to set -- * active_time to -29 to accurately count the _next_ hour. -- */ -- if (new_time >= 3600) { -- new_hrs = new_time / 3600; -- atomic_sub((new_hrs * 3600), &dd->active_time); -- new_hrs += dd->eep_hrs; -- if (new_hrs > 0xFFFF) -- new_hrs = 0xFFFF; -- dd->eep_hrs = new_hrs; -- if ((new_hrs & 0xFF) != ifp->if_powerhour[0]) { -- ifp->if_powerhour[0] = new_hrs & 0xFF; -- hi_water = offsetof(struct qib_flash, if_powerhour); -- } -- if ((new_hrs >> 8) != ifp->if_powerhour[1]) { -- ifp->if_powerhour[1] = new_hrs >> 8; -- hi_water = offsetof(struct qib_flash, if_powerhour) + 1; -- } -- } -- /* -- * There is a tiny possibility that we could somehow fail to write -- * the EEPROM after updating our shadows, but problems from holding -- * the spinlock too long are a much bigger issue. -- */ -- spin_unlock_irqrestore(&dd->eep_st_lock, flags); -- if (hi_water) { -- /* we made some change to the data, uopdate cksum and write */ -- csum = flash_csum(ifp, 1); -- ret = eeprom_write_with_enable(dd, 0, buf, hi_water + 1); -- } -- mutex_unlock(&dd->eep_lock); -- if (ret) -- qib_dev_err(dd, "Failed updating EEPROM\n"); -- --free_bail: -- vfree(buf); --bail: -- return ret; --} -- --/** -- * qib_inc_eeprom_err - increment one of the four error counters -- * that are logged to EEPROM. -- * @dd: the qlogic_ib device -- * @eidx: 0..3, the counter to increment -- * @incr: how much to add -- * -- * Each counter is 8-bits, and saturates at 255 (0xFF). They -- * are copied to the EEPROM (aka flash) whenever qib_update_eeprom_log() -- * is called, but it can only be called in a context that allows sleep. -- * This function can be called even at interrupt level. -- */ --void qib_inc_eeprom_err(struct qib_devdata *dd, u32 eidx, u32 incr) --{ -- uint new_val; -- unsigned long flags; -- -- spin_lock_irqsave(&dd->eep_st_lock, flags); -- new_val = dd->eep_st_new_errs[eidx] + incr; -- if (new_val > 255) -- new_val = 255; -- dd->eep_st_new_errs[eidx] = new_val; -- spin_unlock_irqrestore(&dd->eep_st_lock, flags); --} ---- a/drivers/infiniband/hw/qib/qib_iba6120.c -+++ b/drivers/infiniband/hw/qib/qib_iba6120.c -@@ -2674,8 +2674,6 @@ static void qib_get_6120_faststats(unsig - spin_lock_irqsave(&dd->eep_st_lock, flags); - traffic_wds -= dd->traffic_wds; - dd->traffic_wds += traffic_wds; -- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD) -- atomic_add(5, &dd->active_time); /* S/B #define */ - spin_unlock_irqrestore(&dd->eep_st_lock, flags); - - qib_chk_6120_errormask(dd); ---- a/drivers/infiniband/hw/qib/qib_iba7220.c -+++ b/drivers/infiniband/hw/qib/qib_iba7220.c -@@ -3292,8 +3292,6 @@ static void qib_get_7220_faststats(unsig - spin_lock_irqsave(&dd->eep_st_lock, flags); - traffic_wds -= dd->traffic_wds; - dd->traffic_wds += traffic_wds; -- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD) -- atomic_add(5, &dd->active_time); /* S/B #define */ - spin_unlock_irqrestore(&dd->eep_st_lock, flags); - done: - mod_timer(&dd->stats_timer, jiffies + HZ * ACTIVITY_TIMER); ---- a/drivers/infiniband/hw/qib/qib_iba7322.c -+++ b/drivers/infiniband/hw/qib/qib_iba7322.c -@@ -4841,8 +4841,6 @@ static void qib_get_7322_faststats(unsig - spin_lock_irqsave(&ppd->dd->eep_st_lock, flags); - traffic_wds -= ppd->dd->traffic_wds; - ppd->dd->traffic_wds += traffic_wds; -- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD) -- atomic_add(ACTIVITY_TIMER, &ppd->dd->active_time); - spin_unlock_irqrestore(&ppd->dd->eep_st_lock, flags); - if (ppd->cpspec->qdr_dfe_on && (ppd->link_speed_active & - QIB_IB_QDR) && ---- a/drivers/infiniband/hw/qib/qib_init.c -+++ b/drivers/infiniband/hw/qib/qib_init.c -@@ -765,7 +765,6 @@ static void qib_shutdown_device(struct q - dd->f_quiet_serdes(ppd); - } - -- qib_update_eeprom_log(dd); - } - - /** ---- a/drivers/infiniband/hw/qib/qib_sysfs.c -+++ b/drivers/infiniband/hw/qib/qib_sysfs.c -@@ -550,28 +550,6 @@ bail: - return ret < 0 ? ret : count; - } - --static ssize_t show_logged_errs(struct device *device, -- struct device_attribute *attr, char *buf) --{ -- struct qib_ibdev *dev = -- container_of(device, struct qib_ibdev, ibdev.dev); -- struct qib_devdata *dd = dd_from_dev(dev); -- int idx, count; -- -- /* force consistency with actual EEPROM */ -- if (qib_update_eeprom_log(dd) != 0) -- return -ENXIO; -- -- count = 0; -- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) { -- count += scnprintf(buf + count, PAGE_SIZE - count, "%d%c", -- dd->eep_st_errs[idx], -- idx == (QIB_EEP_LOG_CNT - 1) ? '\n' : ' '); -- } -- -- return count; --} -- - /* - * Dump tempsense regs. in decimal, to ease shell-scripts. - */ -@@ -618,7 +596,6 @@ static DEVICE_ATTR(nctxts, S_IRUGO, show - static DEVICE_ATTR(nfreectxts, S_IRUGO, show_nfreectxts, NULL); - static DEVICE_ATTR(serial, S_IRUGO, show_serial, NULL); - static DEVICE_ATTR(boardversion, S_IRUGO, show_boardversion, NULL); --static DEVICE_ATTR(logged_errors, S_IRUGO, show_logged_errs, NULL); - static DEVICE_ATTR(tempsense, S_IRUGO, show_tempsense, NULL); - static DEVICE_ATTR(localbus_info, S_IRUGO, show_localbus_info, NULL); - static DEVICE_ATTR(chip_reset, S_IWUSR, NULL, store_chip_reset); -@@ -632,7 +609,6 @@ static struct device_attribute *qib_attr - &dev_attr_nfreectxts, - &dev_attr_serial, - &dev_attr_boardversion, -- &dev_attr_logged_errors, - &dev_attr_tempsense, - &dev_attr_localbus_info, - &dev_attr_chip_reset, diff --git a/patches/ib-uverbs-prevent-integer-overflow-in-ib_umem_get-address-arithmetic.patch b/patches/ib-uverbs-prevent-integer-overflow-in-ib_umem_get-address-arithmetic.patch deleted file mode 100644 index b826cd3..0000000 --- a/patches/ib-uverbs-prevent-integer-overflow-in-ib_umem_get-address-arithmetic.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 8494057ab5e40df590ef6ef7d66324d3ae33356b Mon Sep 17 00:00:00 2001 -From: Shachar Raindel <raindel@mellanox.com> -Date: Wed, 18 Mar 2015 17:39:08 +0000 -Subject: IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic - -commit 8494057ab5e40df590ef6ef7d66324d3ae33356b upstream. - -Properly verify that the resulting page aligned end address is larger -than both the start address and the length of the memory area requested. - -Both the start and length arguments for ib_umem_get are controlled by -the user. A misbehaving user can provide values which will cause an -integer overflow when calculating the page aligned end address. - -This overflow can cause also miscalculation of the number of pages -mapped, and additional logic issues. - -Addresses: CVE-2014-8159 -Signed-off-by: Shachar Raindel <raindel@mellanox.com> -Signed-off-by: Jack Morgenstein <jackm@mellanox.com> -Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> -Signed-off-by: Roland Dreier <roland@purestorage.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/infiniband/core/umem.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - ---- a/drivers/infiniband/core/umem.c -+++ b/drivers/infiniband/core/umem.c -@@ -94,6 +94,14 @@ struct ib_umem *ib_umem_get(struct ib_uc - if (dmasync) - dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); - -+ /* -+ * If the combination of the addr and size requested for this memory -+ * region causes an integer overflow, return error. -+ */ -+ if ((PAGE_ALIGN(addr + size) <= size) || -+ (PAGE_ALIGN(addr + size) <= addr)) -+ return ERR_PTR(-EINVAL); -+ - if (!can_do_mlock()) - return ERR_PTR(-EPERM); - diff --git a/patches/input-synaptics-fix-middle-button-on-lenovo-2015-products.patch b/patches/input-synaptics-fix-middle-button-on-lenovo-2015-products.patch deleted file mode 100644 index d8f1191..0000000 --- a/patches/input-synaptics-fix-middle-button-on-lenovo-2015-products.patch +++ /dev/null @@ -1,99 +0,0 @@ -From dc5465dc8a6d5cae8a0e1d8826bdcb2e4cb261ab Mon Sep 17 00:00:00 2001 -From: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Date: Sun, 8 Mar 2015 22:30:43 -0700 -Subject: Input: synaptics - fix middle button on Lenovo 2015 products - -commit dc5465dc8a6d5cae8a0e1d8826bdcb2e4cb261ab upstream. - -On the X1 Carbon 3rd gen (with a 2015 broadwell cpu), the physical middle -button of the trackstick (attached to the touchpad serio device, of course) -seems to get lost. - -Actually, the touchpads reports 3 extra buttons, which falls in the switch -below to the '2' case. Let's handle the case of odd numbers also, so that -the middle button finds its way back. - -Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> -Acked-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> -[lizf: Backported to 3.4: open-code GENMASK] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/input/mouse/synaptics.c | 44 +++++++++++++++++++--------------------- - 1 file changed, 21 insertions(+), 23 deletions(-) - ---- a/drivers/input/mouse/synaptics.c -+++ b/drivers/input/mouse/synaptics.c -@@ -512,6 +512,18 @@ static void synaptics_parse_agm(const un - priv->agm_pending = true; - } - -+static void synaptics_parse_ext_buttons(const unsigned char buf[], -+ struct synaptics_data *priv, -+ struct synaptics_hw_state *hw) -+{ -+ unsigned int ext_bits = -+ (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1; -+ unsigned int ext_mask = (1U << ext_bits) - 1; -+ -+ hw->ext_buttons = buf[4] & ext_mask; -+ hw->ext_buttons |= (buf[5] & ext_mask) << ext_bits; -+} -+ - static bool is_forcepad; - - static int synaptics_parse_hw_state(const unsigned char buf[], -@@ -598,28 +610,9 @@ static int synaptics_parse_hw_state(cons - hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0; - } - -- if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) && -+ if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) > 0 && - ((buf[0] ^ buf[3]) & 0x02)) { -- switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) { -- default: -- /* -- * if nExtBtn is greater than 8 it should be -- * considered invalid and treated as 0 -- */ -- break; -- case 8: -- hw->ext_buttons |= ((buf[5] & 0x08)) ? 0x80 : 0; -- hw->ext_buttons |= ((buf[4] & 0x08)) ? 0x40 : 0; -- case 6: -- hw->ext_buttons |= ((buf[5] & 0x04)) ? 0x20 : 0; -- hw->ext_buttons |= ((buf[4] & 0x04)) ? 0x10 : 0; -- case 4: -- hw->ext_buttons |= ((buf[5] & 0x02)) ? 0x08 : 0; -- hw->ext_buttons |= ((buf[4] & 0x02)) ? 0x04 : 0; -- case 2: -- hw->ext_buttons |= ((buf[5] & 0x01)) ? 0x02 : 0; -- hw->ext_buttons |= ((buf[4] & 0x01)) ? 0x01 : 0; -- } -+ synaptics_parse_ext_buttons(buf, priv, hw); - } - } else { - hw->x = (((buf[1] & 0x1f) << 8) | buf[2]); -@@ -686,6 +679,7 @@ static void synaptics_report_buttons(str - { - struct input_dev *dev = psmouse->dev; - struct synaptics_data *priv = psmouse->private; -+ int ext_bits = (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1; - int i; - - input_report_key(dev, BTN_LEFT, hw->left); -@@ -699,8 +693,12 @@ static void synaptics_report_buttons(str - input_report_key(dev, BTN_BACK, hw->down); - } - -- for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++) -- input_report_key(dev, BTN_0 + i, hw->ext_buttons & (1 << i)); -+ for (i = 0; i < ext_bits; i++) { -+ input_report_key(dev, BTN_0 + 2 * i, -+ hw->ext_buttons & (1 << i)); -+ input_report_key(dev, BTN_1 + 2 * i, -+ hw->ext_buttons & (1 << (i + ext_bits))); -+ } - } - - static void synaptics_report_slot(struct input_dev *dev, int slot, diff --git a/patches/input-synaptics-handle-spurious-release-of-trackstick-buttons.patch b/patches/input-synaptics-handle-spurious-release-of-trackstick-buttons.patch deleted file mode 100644 index 30fe6f0..0000000 --- a/patches/input-synaptics-handle-spurious-release-of-trackstick-buttons.patch +++ /dev/null @@ -1,74 +0,0 @@ -From ebc80840b850db72f7ae84fbcf77630ae5409629 Mon Sep 17 00:00:00 2001 -From: Benjamin Tissoires <benjamin.tissoires@redhat.com> -Date: Sun, 8 Mar 2015 22:32:43 -0700 -Subject: Input: synaptics - handle spurious release of trackstick buttons - -commit ebc80840b850db72f7ae84fbcf77630ae5409629 upstream. - -The Fimware 8.1 has a bug in which the extra buttons are only sent when the -ExtBit is 1. This should be fixed in a future FW update which should have -a bump of the minor version. - -Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> -Acked-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/input/mouse/synaptics.c | 33 +++++++++++++++++++++++++-------- - 1 file changed, 25 insertions(+), 8 deletions(-) - ---- a/drivers/input/mouse/synaptics.c -+++ b/drivers/input/mouse/synaptics.c -@@ -674,14 +674,36 @@ static void synaptics_report_semi_mt_dat - } - } - --static void synaptics_report_buttons(struct psmouse *psmouse, -- const struct synaptics_hw_state *hw) -+static void synaptics_report_ext_buttons(struct psmouse *psmouse, -+ const struct synaptics_hw_state *hw) - { - struct input_dev *dev = psmouse->dev; - struct synaptics_data *priv = psmouse->private; - int ext_bits = (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1; - int i; - -+ if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap)) -+ return; -+ -+ /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */ -+ if (SYN_ID_FULL(priv->identity) == 0x801 && -+ !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02)) -+ return; -+ -+ for (i = 0; i < ext_bits; i++) { -+ input_report_key(dev, BTN_0 + 2 * i, -+ hw->ext_buttons & (1 << i)); -+ input_report_key(dev, BTN_1 + 2 * i, -+ hw->ext_buttons & (1 << (i + ext_bits))); -+ } -+} -+ -+static void synaptics_report_buttons(struct psmouse *psmouse, -+ const struct synaptics_hw_state *hw) -+{ -+ struct input_dev *dev = psmouse->dev; -+ struct synaptics_data *priv = psmouse->private; -+ - input_report_key(dev, BTN_LEFT, hw->left); - input_report_key(dev, BTN_RIGHT, hw->right); - -@@ -693,12 +715,7 @@ static void synaptics_report_buttons(str - input_report_key(dev, BTN_BACK, hw->down); - } - -- for (i = 0; i < ext_bits; i++) { -- input_report_key(dev, BTN_0 + 2 * i, -- hw->ext_buttons & (1 << i)); -- input_report_key(dev, BTN_1 + 2 * i, -- hw->ext_buttons & (1 << (i + ext_bits))); -- } -+ synaptics_report_ext_buttons(psmouse, hw); - } - - static void synaptics_report_slot(struct input_dev *dev, int slot, diff --git a/patches/input-synaptics-query-min-dimensions-for-fw-v8.1.patch b/patches/input-synaptics-query-min-dimensions-for-fw-v8.1.patch deleted file mode 100644 index ad49de2..0000000 --- a/patches/input-synaptics-query-min-dimensions-for-fw-v8.1.patch +++ /dev/null @@ -1,45 +0,0 @@ -From ac097930f0730a9b777737de2b51e0fc49d2be7a Mon Sep 17 00:00:00 2001 -From: Daniel Martin <consume.noise@gmail.com> -Date: Sun, 8 Mar 2015 22:28:40 -0700 -Subject: Input: synaptics - query min dimensions for fw v8.1 - -commit ac097930f0730a9b777737de2b51e0fc49d2be7a upstream. - -Query the min dimensions even if the check -SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 fails, but we know that the -firmware version 8.1 is safe. - -With that we don't need quirks for post-2013 models anymore as they expose -correct min and max dimensions. - -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=91541 - -Signed-off-by: Daniel Martin <consume.noise@gmail.com> - re-order the tests to check SYN_CAP_MIN_DIMENSIONS even on FW 8.1 -Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> -Acked-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/input/mouse/synaptics.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - ---- a/drivers/input/mouse/synaptics.c -+++ b/drivers/input/mouse/synaptics.c -@@ -274,8 +274,14 @@ static int synaptics_resolution(struct p - } - } - -- if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 && -- SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c)) { -+ if (SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c) && -+ (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 || -+ /* -+ * Firmware v8.1 does not report proper number of extended -+ * capabilities, but has been proven to report correct min -+ * coordinates. -+ */ -+ SYN_ID_FULL(priv->identity) == 0x801)) { - if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MIN_COORDS, resp)) { - psmouse_warn(psmouse, - "device claims to have min coordinates query, but I'm not able to read it.\n"); diff --git a/patches/ipv6-fix-ipv6_cow_metrics-for-non-dst_host-case.patch b/patches/ipv6-fix-ipv6_cow_metrics-for-non-dst_host-case.patch deleted file mode 100644 index c8ccbe1..0000000 --- a/patches/ipv6-fix-ipv6_cow_metrics-for-non-dst_host-case.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 3b4711757d7903ab6fa88a9e7ab8901b8227da60 Mon Sep 17 00:00:00 2001 -From: Martin KaFai Lau <kafai@fb.com> -Date: Thu, 12 Feb 2015 16:14:08 -0800 -Subject: ipv6: fix ipv6_cow_metrics for non DST_HOST case - -commit 3b4711757d7903ab6fa88a9e7ab8901b8227da60 upstream. - -ipv6_cow_metrics() currently assumes only DST_HOST routes require -dynamic metrics allocation from inetpeer. The assumption breaks -when ndisc discovered router with RTAX_MTU and RTAX_HOPLIMIT metric. -Refer to ndisc_router_discovery() in ndisc.c and note that dst_metric_set() -is called after the route is created. - -This patch creates the metrics array (by calling dst_cow_metrics_generic) in -ipv6_cow_metrics(). - -Test: -radvd.conf: -interface qemubr0 -{ - AdvLinkMTU 1300; - AdvCurHopLimit 30; - - prefix fd00:face:face:face::/64 - { - AdvOnLink on; - AdvAutonomous on; - AdvRouterAddr off; - }; -}; - -Before: -[root@qemu1 ~]# ip -6 r show | egrep -v unreachable -fd00:face:face:face::/64 dev eth0 proto kernel metric 256 expires 27sec -fe80::/64 dev eth0 proto kernel metric 256 -default via fe80::74df:d0ff:fe23:8ef2 dev eth0 proto ra metric 1024 expires 27sec - -After: -[root@qemu1 ~]# ip -6 r show | egrep -v unreachable -fd00:face:face:face::/64 dev eth0 proto kernel metric 256 expires 27sec mtu 1300 -fe80::/64 dev eth0 proto kernel metric 256 mtu 1300 -default via fe80::74df:d0ff:fe23:8ef2 dev eth0 proto ra metric 1024 expires 27sec mtu 1300 hoplimit 30 - -Fixes: 8e2ec639173f325 (ipv6: don't use inetpeer to store metrics for routes.) -Signed-off-by: Martin KaFai Lau <kafai@fb.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/ipv6/route.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -95,7 +95,7 @@ static u32 *ipv6_cow_metrics(struct dst_ - u32 *p = NULL; - - if (!(rt->dst.flags & DST_HOST)) -- return NULL; -+ return dst_cow_metrics_generic(dst, old); - - if (!rt->rt6i_peer) - rt6_bind_peer(rt, 1); diff --git a/patches/ipvs-add-missing-ip_vs_pe_put-in-sync-code.patch b/patches/ipvs-add-missing-ip_vs_pe_put-in-sync-code.patch deleted file mode 100644 index f79e276..0000000 --- a/patches/ipvs-add-missing-ip_vs_pe_put-in-sync-code.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 528c943f3bb919aef75ab2fff4f00176f09a4019 Mon Sep 17 00:00:00 2001 -From: Julian Anastasov <ja@ssi.bg> -Date: Sat, 21 Feb 2015 21:03:10 +0200 -Subject: ipvs: add missing ip_vs_pe_put in sync code - -commit 528c943f3bb919aef75ab2fff4f00176f09a4019 upstream. - -ip_vs_conn_fill_param_sync() gets in param.pe a module -reference for persistence engine from __ip_vs_pe_getbyname() -but forgets to put it. Problem occurs in backup for -sync protocol v1 (2.6.39). - -Also, pe_data usually comes in sync messages for -connection templates and ip_vs_conn_new() copies -the pointer only in this case. Make sure pe_data -is not leaked if it comes unexpectedly for normal -connections. Leak can happen only if bogus messages -are sent to backup server. - -Fixes: fe5e7a1efb66 ("IPVS: Backup, Adding Version 1 receive capability") -Signed-off-by: Julian Anastasov <ja@ssi.bg> -Signed-off-by: Simon Horman <horms@verge.net.au> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/netfilter/ipvs/ip_vs_sync.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/net/netfilter/ipvs/ip_vs_sync.c -+++ b/net/netfilter/ipvs/ip_vs_sync.c -@@ -763,6 +763,8 @@ static void ip_vs_proc_conn(struct net * - IP_VS_DBG(2, "BACKUP, add new conn. failed\n"); - return; - } -+ if (!(flags & IP_VS_CONN_F_TEMPLATE)) -+ kfree(param->pe_data); - } else if (!cp->dest) { - dest = ip_vs_try_bind_dest(cp); - if (dest) -@@ -1064,6 +1066,7 @@ static inline int ip_vs_proc_sync_conn(s - (opt_flags & IPVS_OPT_F_SEQ_DATA ? &opt : NULL) - ); - #endif -+ ip_vs_pe_put(param.pe); - return 0; - /* Error exit */ - out: diff --git a/patches/ipvs-uninitialized-data-with-ip_vs_ipv6.patch b/patches/ipvs-uninitialized-data-with-ip_vs_ipv6.patch deleted file mode 100644 index 65c430c..0000000 --- a/patches/ipvs-uninitialized-data-with-ip_vs_ipv6.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 3b05ac3824ed9648c0d9c02d51d9b54e4e7e874f Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@oracle.com> -Date: Sat, 6 Dec 2014 16:49:24 +0300 -Subject: ipvs: uninitialized data with IP_VS_IPV6 - -commit 3b05ac3824ed9648c0d9c02d51d9b54e4e7e874f upstream. - -The app_tcp_pkt_out() function expects "*diff" to be set and ends up -using uninitialized data if CONFIG_IP_VS_IPV6 is turned on. - -The same issue is there in app_tcp_pkt_in(). Thanks to Julian Anastasov -for noticing that. - -Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -Acked-by: Julian Anastasov <ja@ssi.bg> -Signed-off-by: Simon Horman <horms@verge.net.au> -Cc: Pablo Neira Ayuso <pablo@netfilter.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/netfilter/ipvs/ip_vs_ftp.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - ---- a/net/netfilter/ipvs/ip_vs_ftp.c -+++ b/net/netfilter/ipvs/ip_vs_ftp.c -@@ -183,6 +183,8 @@ static int ip_vs_ftp_out(struct ip_vs_ap - struct nf_conn *ct; - struct net *net; - -+ *diff = 0; -+ - #ifdef CONFIG_IP_VS_IPV6 - /* This application helper doesn't work with IPv6 yet, - * so turn this into a no-op for IPv6 packets -@@ -191,8 +193,6 @@ static int ip_vs_ftp_out(struct ip_vs_ap - return 1; - #endif - -- *diff = 0; -- - /* Only useful for established sessions */ - if (cp->state != IP_VS_TCP_S_ESTABLISHED) - return 1; -@@ -318,6 +318,9 @@ static int ip_vs_ftp_in(struct ip_vs_app - struct ip_vs_conn *n_cp; - struct net *net; - -+ /* no diff required for incoming packets */ -+ *diff = 0; -+ - #ifdef CONFIG_IP_VS_IPV6 - /* This application helper doesn't work with IPv6 yet, - * so turn this into a no-op for IPv6 packets -@@ -326,9 +329,6 @@ static int ip_vs_ftp_in(struct ip_vs_app - return 1; - #endif - -- /* no diff required for incoming packets */ -- *diff = 0; -- - /* Only useful for established sessions */ - if (cp->state != IP_VS_TCP_S_ESTABLISHED) - return 1; diff --git a/patches/iscsi-target-drop-problematic-active_ts_list-usage.patch b/patches/iscsi-target-drop-problematic-active_ts_list-usage.patch deleted file mode 100644 index 911eba9..0000000 --- a/patches/iscsi-target-drop-problematic-active_ts_list-usage.patch +++ /dev/null @@ -1,131 +0,0 @@ -From 3fd7b60f2c7418239d586e359e0c6d8503e10646 Mon Sep 17 00:00:00 2001 -From: Nicholas Bellinger <nab@linux-iscsi.org> -Date: Thu, 22 Jan 2015 00:56:53 -0800 -Subject: iscsi-target: Drop problematic active_ts_list usage - -commit 3fd7b60f2c7418239d586e359e0c6d8503e10646 upstream. - -This patch drops legacy active_ts_list usage within iscsi_target_tq.c -code. It was originally used to track the active thread sets during -iscsi-target shutdown, and is no longer used by modern upstream code. - -Two people have reported list corruption using traditional iscsi-target -and iser-target with the following backtrace, that appears to be related -to iscsi_thread_set->ts_list being used across both active_ts_list and -inactive_ts_list. - -[ 60.782534] ------------[ cut here ]------------ -[ 60.782543] WARNING: CPU: 0 PID: 9430 at lib/list_debug.c:53 __list_del_entry+0x63/0xd0() -[ 60.782545] list_del corruption, ffff88045b00d180->next is LIST_POISON1 (dead000000100100) -[ 60.782546] Modules linked in: ib_srpt tcm_qla2xxx qla2xxx tcm_loop tcm_fc libfc scsi_transport_fc scsi_tgt ib_isert rdma_cm iw_cm ib_addr iscsi_target_mod target_core_pscsi target_core_file target_core_iblock target_core_mod configfs ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables bridge stp llc autofs4 sunrpc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 ib_ipoib ib_cm ib_uverbs ib_umad mlx4_en mlx4_ib ib_sa ib_mad ib_core mlx4_core dm_mirror dm_region_hash dm_log dm_mod vhost_net macvtap macvlan vhost tun kvm_intel kvm uinput iTCO_wdt iTCO_vendor_support microcode serio_raw pcspkr sb_edac edac_core sg i2c_i801 lpc_ich mfd_core mtip32xx igb i2c_algo_bit i2c_core ptp pps_core ioatdma dca wmi ext3(F) jbd(F) mbcache(F) sd_mod(F) crc_t10dif(F) crct10dif_common(F) ahci(F) libahci(F) isci(F) libsas(F) scsi_transport_sas(F) [last unloaded: speedstep_lib] -[ 60.782597] CPU: 0 PID: 9430 Comm: iscsi_ttx Tainted: GF 3.12.19+ #2 -[ 60.782598] Hardware name: Supermicro X9DRX+-F/X9DRX+-F, BIOS 3.00 07/09/2013 -[ 60.782599] 0000000000000035 ffff88044de31d08 ffffffff81553ae7 0000000000000035 -[ 60.782602] ffff88044de31d58 ffff88044de31d48 ffffffff8104d1cc 0000000000000002 -[ 60.782605] ffff88045b00d180 ffff88045b00d0c0 ffff88045b00d0c0 ffff88044de31e58 -[ 60.782607] Call Trace: -[ 60.782611] [<ffffffff81553ae7>] dump_stack+0x49/0x62 -[ 60.782615] [<ffffffff8104d1cc>] warn_slowpath_common+0x8c/0xc0 -[ 60.782618] [<ffffffff8104d2b6>] warn_slowpath_fmt+0x46/0x50 -[ 60.782620] [<ffffffff81280933>] __list_del_entry+0x63/0xd0 -[ 60.782622] [<ffffffff812809b1>] list_del+0x11/0x40 -[ 60.782630] [<ffffffffa06e7cf9>] iscsi_del_ts_from_active_list+0x29/0x50 [iscsi_target_mod] -[ 60.782635] [<ffffffffa06e87b1>] iscsi_tx_thread_pre_handler+0xa1/0x180 [iscsi_target_mod] -[ 60.782642] [<ffffffffa06fb9ae>] iscsi_target_tx_thread+0x4e/0x220 [iscsi_target_mod] -[ 60.782647] [<ffffffffa06fb960>] ? iscsit_handle_snack+0x190/0x190 [iscsi_target_mod] -[ 60.782652] [<ffffffffa06fb960>] ? iscsit_handle_snack+0x190/0x190 [iscsi_target_mod] -[ 60.782655] [<ffffffff8106f99e>] kthread+0xce/0xe0 -[ 60.782657] [<ffffffff8106f8d0>] ? kthread_freezable_should_stop+0x70/0x70 -[ 60.782660] [<ffffffff8156026c>] ret_from_fork+0x7c/0xb0 -[ 60.782662] [<ffffffff8106f8d0>] ? kthread_freezable_should_stop+0x70/0x70 -[ 60.782663] ---[ end trace 9662f4a661d33965 ]--- - -Since this code is no longer used, go ahead and drop the problematic usage -all-together. - -Reported-by: Gavin Guo <gavin.guo@canonical.com> -Reported-by: Moussa Ba <moussaba@micron.com> -Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/target/iscsi/iscsi_target_tq.c | 28 +++++----------------------- - 1 file changed, 5 insertions(+), 23 deletions(-) - ---- a/drivers/target/iscsi/iscsi_target_tq.c -+++ b/drivers/target/iscsi/iscsi_target_tq.c -@@ -26,36 +26,22 @@ - #include "iscsi_target_tq.h" - #include "iscsi_target.h" - --static LIST_HEAD(active_ts_list); - static LIST_HEAD(inactive_ts_list); --static DEFINE_SPINLOCK(active_ts_lock); - static DEFINE_SPINLOCK(inactive_ts_lock); - static DEFINE_SPINLOCK(ts_bitmap_lock); - --static void iscsi_add_ts_to_active_list(struct iscsi_thread_set *ts) --{ -- spin_lock(&active_ts_lock); -- list_add_tail(&ts->ts_list, &active_ts_list); -- iscsit_global->active_ts++; -- spin_unlock(&active_ts_lock); --} -- - extern void iscsi_add_ts_to_inactive_list(struct iscsi_thread_set *ts) - { -+ if (!list_empty(&ts->ts_list)) { -+ WARN_ON(1); -+ return; -+ } - spin_lock(&inactive_ts_lock); - list_add_tail(&ts->ts_list, &inactive_ts_list); - iscsit_global->inactive_ts++; - spin_unlock(&inactive_ts_lock); - } - --static void iscsi_del_ts_from_active_list(struct iscsi_thread_set *ts) --{ -- spin_lock(&active_ts_lock); -- list_del(&ts->ts_list); -- iscsit_global->active_ts--; -- spin_unlock(&active_ts_lock); --} -- - static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void) - { - struct iscsi_thread_set *ts; -@@ -69,7 +55,7 @@ static struct iscsi_thread_set *iscsi_ge - list_for_each_entry(ts, &inactive_ts_list, ts_list) - break; - -- list_del(&ts->ts_list); -+ list_del_init(&ts->ts_list); - iscsit_global->inactive_ts--; - spin_unlock(&inactive_ts_lock); - -@@ -220,8 +206,6 @@ static void iscsi_deallocate_extra_threa - - void iscsi_activate_thread_set(struct iscsi_conn *conn, struct iscsi_thread_set *ts) - { -- iscsi_add_ts_to_active_list(ts); -- - spin_lock_bh(&ts->ts_state_lock); - conn->thread_set = ts; - ts->conn = conn; -@@ -424,7 +408,6 @@ struct iscsi_conn *iscsi_rx_thread_pre_h - - if (ts->delay_inactive && (--ts->thread_count == 0)) { - spin_unlock_bh(&ts->ts_state_lock); -- iscsi_del_ts_from_active_list(ts); - - if (!iscsit_global->in_shutdown) - iscsi_deallocate_extra_thread_sets(); -@@ -477,7 +460,6 @@ struct iscsi_conn *iscsi_tx_thread_pre_h - - if (ts->delay_inactive && (--ts->thread_count == 0)) { - spin_unlock_bh(&ts->ts_state_lock); -- iscsi_del_ts_from_active_list(ts); - - if (!iscsit_global->in_shutdown) - iscsi_deallocate_extra_thread_sets(); diff --git a/patches/jffs2-fix-handling-of-corrupted-summary-length.patch b/patches/jffs2-fix-handling-of-corrupted-summary-length.patch deleted file mode 100644 index 4c96d5c..0000000 --- a/patches/jffs2-fix-handling-of-corrupted-summary-length.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 164c24063a3eadee11b46575c5482b2f1417be49 Mon Sep 17 00:00:00 2001 -From: Chen Jie <chenjie6@huawei.com> -Date: Tue, 10 Feb 2015 12:49:48 -0800 -Subject: jffs2: fix handling of corrupted summary length - -commit 164c24063a3eadee11b46575c5482b2f1417be49 upstream. - -sm->offset maybe wrong but magic maybe right, the offset do not have CRC. - -Badness at c00c7580 [verbose debug info unavailable] -NIP: c00c7580 LR: c00c718c CTR: 00000014 -REGS: df07bb40 TRAP: 0700 Not tainted (2.6.34.13-WR4.3.0.0_standard) -MSR: 00029000 <EE,ME,CE> CR: 22084f84 XER: 00000000 -TASK = df84d6e0[908] 'mount' THREAD: df07a000 -GPR00: 00000001 df07bbf0 df84d6e0 00000000 00000001 00000000 df07bb58 00000041 -GPR08: 00000041 c0638860 00000000 00000010 22084f88 100636c8 df814ff8 00000000 -GPR16: df84d6e0 dfa558cc c05adb90 00000048 c0452d30 00000000 000240d0 000040d0 -GPR24: 00000014 c05ae734 c05be2e0 00000000 00000001 00000000 00000000 c05ae730 -NIP [c00c7580] __alloc_pages_nodemask+0x4d0/0x638 -LR [c00c718c] __alloc_pages_nodemask+0xdc/0x638 -Call Trace: -[df07bbf0] [c00c718c] __alloc_pages_nodemask+0xdc/0x638 (unreliable) -[df07bc90] [c00c7708] __get_free_pages+0x20/0x48 -[df07bca0] [c00f4a40] __kmalloc+0x15c/0x1ec -[df07bcd0] [c01fc880] jffs2_scan_medium+0xa58/0x14d0 -[df07bd70] [c01ff38c] jffs2_do_mount_fs+0x1f4/0x6b4 -[df07bdb0] [c020144c] jffs2_do_fill_super+0xa8/0x260 -[df07bdd0] [c020230c] jffs2_fill_super+0x104/0x184 -[df07be00] [c0335814] get_sb_mtd_aux+0x9c/0xec -[df07be20] [c033596c] get_sb_mtd+0x84/0x1e8 -[df07be60] [c0201ed0] jffs2_get_sb+0x1c/0x2c -[df07be70] [c0103898] vfs_kern_mount+0x78/0x1e8 -[df07bea0] [c0103a58] do_kern_mount+0x40/0x100 -[df07bec0] [c011fe90] do_mount+0x240/0x890 -[df07bf10] [c0120570] sys_mount+0x90/0xd8 -[df07bf40] [c00110d8] ret_from_syscall+0x0/0x4 - -=== Exception: c01 at 0xff61a34 - LR = 0x100135f0 -Instruction dump: -38800005 38600000 48010f41 4bfffe1c 4bfc2d15 4bfffe8c 72e90200 4082fc28 -3d20c064 39298860 8809000d 68000001 <0f000000> 2f800000 419efc0c 38000001 -mount: mounting /dev/mtdblock3 on /common failed: Input/output error - -Signed-off-by: Chen Jie <chenjie6@huawei.com> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/jffs2/scan.c | 5 +++++ - 1 file changed, 5 insertions(+) - ---- a/fs/jffs2/scan.c -+++ b/fs/jffs2/scan.c -@@ -510,6 +510,10 @@ static int jffs2_scan_eraseblock (struct - sumlen = c->sector_size - je32_to_cpu(sm->offset); - sumptr = buf + buf_size - sumlen; - -+ /* sm->offset maybe wrong but MAGIC maybe right */ -+ if (sumlen > c->sector_size) -+ goto full_scan; -+ - /* Now, make sure the summary itself is available */ - if (sumlen > buf_size) { - /* Need to kmalloc for this. */ -@@ -544,6 +548,7 @@ static int jffs2_scan_eraseblock (struct - } - } - -+full_scan: - buf_ofs = jeb->offset; - - if (!buf_size) { diff --git a/patches/kdb-fix-incorrect-counts-in-kdb-summary-command-output.patch b/patches/kdb-fix-incorrect-counts-in-kdb-summary-command-output.patch deleted file mode 100644 index 5ce45bc..0000000 --- a/patches/kdb-fix-incorrect-counts-in-kdb-summary-command-output.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 146755923262037fc4c54abc28c04b1103f3cc51 Mon Sep 17 00:00:00 2001 -From: Jay Lan <jlan@sgi.com> -Date: Mon, 29 Sep 2014 15:36:57 -0700 -Subject: kdb: fix incorrect counts in KDB summary command output - -commit 146755923262037fc4c54abc28c04b1103f3cc51 upstream. - -The output of KDB 'summary' command should report MemTotal, MemFree -and Buffers output in kB. Current codes report in unit of pages. - -A define of K(x) as -is defined in the code, but not used. - -This patch would apply the define to convert the values to kB. -Please include me on Cc on replies. I do not subscribe to linux-kernel. - -Signed-off-by: Jay Lan <jlan@sgi.com> -Signed-off-by: Jason Wessel <jason.wessel@windriver.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/debug/kdb/kdb_main.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/kernel/debug/kdb/kdb_main.c -+++ b/kernel/debug/kdb/kdb_main.c -@@ -2598,7 +2598,7 @@ static int kdb_summary(int argc, const c - #define K(x) ((x) << (PAGE_SHIFT - 10)) - kdb_printf("\nMemTotal: %8lu kB\nMemFree: %8lu kB\n" - "Buffers: %8lu kB\n", -- val.totalram, val.freeram, val.bufferram); -+ K(val.totalram), K(val.freeram), K(val.bufferram)); - return 0; - } - diff --git a/patches/kvm-emulate-fix-cmpxchg8b-on-32-bit-hosts.patch b/patches/kvm-emulate-fix-cmpxchg8b-on-32-bit-hosts.patch deleted file mode 100644 index 22e296a..0000000 --- a/patches/kvm-emulate-fix-cmpxchg8b-on-32-bit-hosts.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 4ff6f8e61eb7f96d3ca535c6d240f863ccd6fb7d Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini <pbonzini@redhat.com> -Date: Thu, 12 Feb 2015 17:04:47 +0100 -Subject: KVM: emulate: fix CMPXCHG8B on 32-bit hosts - -commit 4ff6f8e61eb7f96d3ca535c6d240f863ccd6fb7d upstream. - -This has been broken for a long time: it broke first in 2.6.35, then was -almost fixed in 2.6.36 but this one-liner slipped through the cracks. -The bug shows up as an infinite loop in Windows 7 (and newer) boot on -32-bit hosts without EPT. - -Windows uses CMPXCHG8B to write to page tables, which causes a -page fault if running without EPT; the emulator is then called from -kvm_mmu_page_fault. The loop then happens if the higher 4 bytes are -not 0; the common case for this is that the NX bit (bit 63) is 1. - -Fixes: 6550e1f165f384f3a46b60a1be9aba4bc3c2adad -Fixes: 16518d5ada690643453eb0aef3cc7841d3623c2d -Reported-by: Erik Rull <erik.rull@rdsoftware.de> -Tested-by: Erik Rull <erik.rull@rdsoftware.de> -Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/kvm/emulate.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -4246,7 +4246,8 @@ int x86_emulate_insn(struct x86_emulate_ - if (rc != X86EMUL_CONTINUE) - goto done; - } -- ctxt->dst.orig_val = ctxt->dst.val; -+ /* Copy full 64-bit value for CMPXCHG8B. */ -+ ctxt->dst.orig_val64 = ctxt->dst.val64; - - special_insn: - diff --git a/patches/kvm-s390-base-hrtimer-on-a-monotonic-clock.patch b/patches/kvm-s390-base-hrtimer-on-a-monotonic-clock.patch deleted file mode 100644 index cb5876a..0000000 --- a/patches/kvm-s390-base-hrtimer-on-a-monotonic-clock.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 0ac96caf0f9381088c673a16d910b1d329670edf Mon Sep 17 00:00:00 2001 -From: David Hildenbrand <dahi@linux.vnet.ibm.com> -Date: Fri, 12 Dec 2014 15:17:31 +0100 -Subject: KVM: s390: base hrtimer on a monotonic clock - -commit 0ac96caf0f9381088c673a16d910b1d329670edf upstream. - -The hrtimer that handles the wait with enabled timer interrupts -should not be disturbed by changes of the host time. - -This patch changes our hrtimer to be based on a monotonic clock. - -Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com> -Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> -Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/s390/kvm/kvm-s390.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/arch/s390/kvm/kvm-s390.c -+++ b/arch/s390/kvm/kvm-s390.c -@@ -347,7 +347,7 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu - vcpu->arch.sie_block->ecb = 6; - vcpu->arch.sie_block->eca = 0xC1002001U; - vcpu->arch.sie_block->fac = (int) (long) facilities; -- hrtimer_init(&vcpu->arch.ckc_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS); -+ hrtimer_init(&vcpu->arch.ckc_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); - tasklet_init(&vcpu->arch.tasklet, kvm_s390_tasklet, - (unsigned long) vcpu); - vcpu->arch.ckc_timer.function = kvm_s390_idle_wakeup; diff --git a/patches/libsas-fix-kernel-crash-in-smp_execute_task.patch b/patches/libsas-fix-kernel-crash-in-smp_execute_task.patch deleted file mode 100644 index 7f06c23..0000000 --- a/patches/libsas-fix-kernel-crash-in-smp_execute_task.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 6302ce4d80aa82b3fdb5c5cd68e7268037091b47 Mon Sep 17 00:00:00 2001 -From: James Bottomley <JBottomley@Parallels.com> -Date: Wed, 4 Mar 2015 16:18:33 -0800 -Subject: libsas: Fix Kernel Crash in smp_execute_task - -commit 6302ce4d80aa82b3fdb5c5cd68e7268037091b47 upstream. - -This crash was reported: - -[ 366.947370] sd 3:0:1:0: [sdb] Spinning up disk.... -[ 368.804046] BUG: unable to handle kernel NULL pointer dereference at (null) -[ 368.804072] IP: [<ffffffff81358457>] __mutex_lock_common.isra.7+0x9c/0x15b -[ 368.804098] PGD 0 -[ 368.804114] Oops: 0002 [#1] SMP -[ 368.804143] CPU 1 -[ 368.804151] Modules linked in: sg netconsole s3g(PO) uinput joydev hid_multitouch usbhid hid snd_hda_codec_via cpufreq_userspace cpufreq_powersave cpufreq_stats uhci_hcd cpufreq_conservative snd_hda_intel snd_hda_codec snd_hwdep snd_pcm sdhci_pci snd_page_alloc sdhci snd_timer snd psmouse evdev serio_raw pcspkr soundcore xhci_hcd shpchp s3g_drm(O) mvsas mmc_core ahci libahci drm i2c_core acpi_cpufreq mperf video processor button thermal_sys dm_dmirror exfat_fs exfat_core dm_zcache dm_mod padlock_aes aes_generic padlock_sha iscsi_target_mod target_core_mod configfs sswipe libsas libata scsi_transport_sas picdev via_cputemp hwmon_vid fuse parport_pc ppdev lp parport autofs4 ext4 crc16 mbcache jbd2 sd_mod crc_t10dif usb_storage scsi_mod ehci_hcd usbcore usb_common -[ 368.804749] -[ 368.804764] Pid: 392, comm: kworker/u:3 Tainted: P W O 3.4.87-logicube-ng.22 #1 To be filled by O.E.M. To be filled by O.E.M./EPIA-M920 -[ 368.804802] RIP: 0010:[<ffffffff81358457>] [<ffffffff81358457>] __mutex_lock_common.isra.7+0x9c/0x15b -[ 368.804827] RSP: 0018:ffff880117001cc0 EFLAGS: 00010246 -[ 368.804842] RAX: 0000000000000000 RBX: ffff8801185030d0 RCX: ffff88008edcb420 -[ 368.804857] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff8801185030d4 -[ 368.804873] RBP: ffff8801181531c0 R08: 0000000000000020 R09: 00000000fffffffe -[ 368.804885] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801185030d4 -[ 368.804899] R13: 0000000000000002 R14: ffff880117001fd8 R15: ffff8801185030d8 -[ 368.804916] FS: 0000000000000000(0000) GS:ffff88011fc80000(0000) knlGS:0000000000000000 -[ 368.804931] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b -[ 368.804946] CR2: 0000000000000000 CR3: 000000000160b000 CR4: 00000000000006e0 -[ 368.804962] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 -[ 368.804978] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 -[ 368.804995] Process kworker/u:3 (pid: 392, threadinfo ffff880117000000, task ffff8801181531c0) -[ 368.805009] Stack: -[ 368.805017] ffff8801185030d8 0000000000000000 ffffffff8161ddf0 ffffffff81056f7c -[ 368.805062] 000000000000b503 ffff8801185030d0 ffff880118503000 0000000000000000 -[ 368.805100] ffff8801185030d0 ffff8801188b8000 ffff88008edcb420 ffffffff813583ac -[ 368.805135] Call Trace: -[ 368.805153] [<ffffffff81056f7c>] ? up+0xb/0x33 -[ 368.805168] [<ffffffff813583ac>] ? mutex_lock+0x16/0x25 -[ 368.805194] [<ffffffffa018c414>] ? smp_execute_task+0x4e/0x222 [libsas] -[ 368.805217] [<ffffffffa018ce1c>] ? sas_find_bcast_dev+0x3c/0x15d [libsas] -[ 368.805240] [<ffffffffa018ce4f>] ? sas_find_bcast_dev+0x6f/0x15d [libsas] -[ 368.805264] [<ffffffffa018e989>] ? sas_ex_revalidate_domain+0x37/0x2ec [libsas] -[ 368.805280] [<ffffffff81355a2a>] ? printk+0x43/0x48 -[ 368.805296] [<ffffffff81359a65>] ? _raw_spin_unlock_irqrestore+0xc/0xd -[ 368.805318] [<ffffffffa018b767>] ? sas_revalidate_domain+0x85/0xb6 [libsas] -[ 368.805336] [<ffffffff8104e5d9>] ? process_one_work+0x151/0x27c -[ 368.805351] [<ffffffff8104f6cd>] ? worker_thread+0xbb/0x152 -[ 368.805366] [<ffffffff8104f612>] ? manage_workers.isra.29+0x163/0x163 -[ 368.805382] [<ffffffff81052c4e>] ? kthread+0x79/0x81 -[ 368.805399] [<ffffffff8135fea4>] ? kernel_thread_helper+0x4/0x10 -[ 368.805416] [<ffffffff81052bd5>] ? kthread_flush_work_fn+0x9/0x9 -[ 368.805431] [<ffffffff8135fea0>] ? gs_change+0x13/0x13 -[ 368.805442] Code: 83 7d 30 63 7e 04 f3 90 eb ab 4c 8d 63 04 4c 8d 7b 08 4c 89 e7 e8 fa 15 00 00 48 8b 43 10 4c 89 3c 24 48 89 63 10 48 89 44 24 08 <48> 89 20 83 c8 ff 48 89 6c 24 10 87 03 ff c8 74 35 4d 89 ee 41 -[ 368.805851] RIP [<ffffffff81358457>] __mutex_lock_common.isra.7+0x9c/0x15b -[ 368.805877] RSP <ffff880117001cc0> -[ 368.805886] CR2: 0000000000000000 -[ 368.805899] ---[ end trace b720682065d8f4cc ]--- - -It's directly caused by 89d3cf6 [SCSI] libsas: add mutex for SMP task -execution, but shows a deeper cause: expander functions expect to be able to -cast to and treat domain devices as expanders. The correct fix is to only do -expander discover when we know we've got an expander device to avoid wrongly -casting a non-expander device. - -Reported-by: Praveen Murali <pmurali@logicube.com> -Tested-by: Praveen Murali <pmurali@logicube.com> -Signed-off-by: James Bottomley <JBottomley@Parallels.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/libsas/sas_discover.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - ---- a/drivers/scsi/libsas/sas_discover.c -+++ b/drivers/scsi/libsas/sas_discover.c -@@ -446,6 +446,7 @@ static void sas_revalidate_domain(struct - struct sas_discovery_event *ev = to_sas_discovery_event(work); - struct asd_sas_port *port = ev->port; - struct sas_ha_struct *ha = port->ha; -+ struct domain_device *ddev = port->port_dev; - - /* prevent revalidation from finding sata links in recovery */ - mutex_lock(&ha->disco_mutex); -@@ -460,8 +461,9 @@ static void sas_revalidate_domain(struct - SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id, - task_pid_nr(current)); - -- if (port->port_dev) -- res = sas_ex_revalidate_domain(port->port_dev); -+ if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE || -+ ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE)) -+ res = sas_ex_revalidate_domain(ddev); - - SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n", - port->id, task_pid_nr(current), res); diff --git a/patches/mac80211-disable-u-apsd-queues-by-default.patch b/patches/mac80211-disable-u-apsd-queues-by-default.patch deleted file mode 100644 index 343ebe1..0000000 --- a/patches/mac80211-disable-u-apsd-queues-by-default.patch +++ /dev/null @@ -1,70 +0,0 @@ -From aa75ebc275b2a91b193654a177daf900ad6703f0 Mon Sep 17 00:00:00 2001 -From: Michal Kazior <michal.kazior@tieto.com> -Date: Tue, 10 Feb 2015 12:48:44 +0100 -Subject: mac80211: disable u-APSD queues by default - -commit aa75ebc275b2a91b193654a177daf900ad6703f0 upstream. - -Some APs experience problems when working with -U-APSD. Decreasing the probability of that -happening by using legacy mode for all ACs but VO -isn't enough. - -Cisco 4410N originally forced us to enable VO by -default only because it treated non-VO ACs as -legacy. - -However some APs (notably Netgear R7000) silently -reclassify packets to different ACs. Since u-APSD -ACs require trigger frames for frame retrieval -clients would never see some frames (e.g. ARP -responses) or would fetch them accidentally after -a long time. - -It makes little sense to enable u-APSD queues by -default because it needs userspace applications to -be aware of it to actually take advantage of the -possible additional powersavings. Implicitly -depending on driver autotrigger frame support -doesn't make much sense. - -Signed-off-by: Michal Kazior <michal.kazior@tieto.com> -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/mac80211/ieee80211_i.h | 23 +++++++++++++++++------ - 1 file changed, 17 insertions(+), 6 deletions(-) - ---- a/net/mac80211/ieee80211_i.h -+++ b/net/mac80211/ieee80211_i.h -@@ -55,13 +55,24 @@ struct ieee80211_local; - #define TU_TO_EXP_TIME(x) (jiffies + usecs_to_jiffies((x) * 1024)) - - /* -- * Some APs experience problems when working with U-APSD. Decrease the -- * probability of that happening by using legacy mode for all ACs but VO. -- * The AP that caused us trouble was a Cisco 4410N. It ignores our -- * setting, and always treats non-VO ACs as legacy. -+ * Some APs experience problems when working with U-APSD. Decreasing the -+ * probability of that happening by using legacy mode for all ACs but VO isn't -+ * enough. -+ * -+ * Cisco 4410N originally forced us to enable VO by default only because it -+ * treated non-VO ACs as legacy. -+ * -+ * However some APs (notably Netgear R7000) silently reclassify packets to -+ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval -+ * clients would never see some frames (e.g. ARP responses) or would fetch them -+ * accidentally after a long time. -+ * -+ * It makes little sense to enable u-APSD queues by default because it needs -+ * userspace applications to be aware of it to actually take advantage of the -+ * possible additional powersavings. Implicitly depending on driver autotrigger -+ * frame support doesn't make much sense. - */ --#define IEEE80211_DEFAULT_UAPSD_QUEUES \ -- IEEE80211_WMM_IE_STA_QOSINFO_AC_VO -+#define IEEE80211_DEFAULT_UAPSD_QUEUES 0 - - #define IEEE80211_DEFAULT_MAX_SP_LEN \ - IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL diff --git a/patches/mac80211-drop-unencrypted-frames-in-mesh-fwding.patch b/patches/mac80211-drop-unencrypted-frames-in-mesh-fwding.patch deleted file mode 100644 index e85a000..0000000 --- a/patches/mac80211-drop-unencrypted-frames-in-mesh-fwding.patch +++ /dev/null @@ -1,31 +0,0 @@ -From d0c22119f574b851e63360c6b8660fe9593bbc3c Mon Sep 17 00:00:00 2001 -From: Bob Copeland <me@bobcopeland.com> -Date: Mon, 2 Mar 2015 14:28:52 -0500 -Subject: mac80211: drop unencrypted frames in mesh fwding - -commit d0c22119f574b851e63360c6b8660fe9593bbc3c upstream. - -The mesh forwarding path was not checking that data -frames were protected when running an encrypted network; -add the necessary check. - -Reported-by: Johannes Berg <johannes@sipsolutions.net> -Signed-off-by: Bob Copeland <me@bobcopeland.com> -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/mac80211/rx.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -1926,6 +1926,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80 - hdr = (struct ieee80211_hdr *) skb->data; - mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); - -+ if (ieee80211_drop_unencrypted(rx, hdr->frame_control)) -+ return RX_DROP_MONITOR; -+ - /* frame is in RMC, don't forward */ - if (ieee80211_is_data(hdr->frame_control) && - is_multicast_ether_addr(hdr->addr1) && diff --git a/patches/mac80211-fix-rx-a-mpdu-session-reorder-timer-deletion.patch b/patches/mac80211-fix-rx-a-mpdu-session-reorder-timer-deletion.patch deleted file mode 100644 index f51206c..0000000 --- a/patches/mac80211-fix-rx-a-mpdu-session-reorder-timer-deletion.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 788211d81bfdf9b6a547d0530f206ba6ee76b107 Mon Sep 17 00:00:00 2001 -From: Johannes Berg <johannes.berg@intel.com> -Date: Wed, 1 Apr 2015 14:20:42 +0200 -Subject: mac80211: fix RX A-MPDU session reorder timer deletion - -commit 788211d81bfdf9b6a547d0530f206ba6ee76b107 upstream. - -There's an issue with the way the RX A-MPDU reorder timer is -deleted that can cause a kernel crash like this: - - * tid_rx is removed - call_rcu(ieee80211_free_tid_rx) - * station is destroyed - * reorder timer fires before ieee80211_free_tid_rx() runs, - accessing the station, thus potentially crashing due to - the use-after-free - -The station deletion is protected by synchronize_net(), but -that isn't enough -- ieee80211_free_tid_rx() need not have -run when that returns (it deletes the timer.) We could use -rcu_barrier() instead of synchronize_net(), but that's much -more expensive. - -Instead, to fix this, add a field tracking that the session -is being deleted. In this case, the only re-arming of the -timer happens with the reorder spinlock held, so make that -code not rearm it if the session is being deleted and also -delete the timer after setting that field. This ensures the -timer cannot fire after ___ieee80211_stop_rx_ba_session() -returns, which fixes the problem. - -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/mac80211/agg-rx.c | 8 ++++++-- - net/mac80211/rx.c | 7 ++++--- - net/mac80211/sta_info.h | 2 ++ - 3 files changed, 12 insertions(+), 5 deletions(-) - ---- a/net/mac80211/agg-rx.c -+++ b/net/mac80211/agg-rx.c -@@ -49,8 +49,6 @@ static void ieee80211_free_tid_rx(struct - container_of(h, struct tid_ampdu_rx, rcu_head); - int i; - -- del_timer_sync(&tid_rx->reorder_timer); -- - for (i = 0; i < tid_rx->buf_size; i++) - dev_kfree_skb(tid_rx->reorder_buf[i]); - kfree(tid_rx->reorder_buf); -@@ -94,6 +92,12 @@ void ___ieee80211_stop_rx_ba_session(str - - del_timer_sync(&tid_rx->session_timer); - -+ /* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */ -+ spin_lock_bh(&tid_rx->reorder_lock); -+ tid_rx->removed = true; -+ spin_unlock_bh(&tid_rx->reorder_lock); -+ del_timer_sync(&tid_rx->reorder_timer); -+ - call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx); - } - ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -668,9 +668,10 @@ static void ieee80211_sta_reorder_releas - - set_release_timer: - -- mod_timer(&tid_agg_rx->reorder_timer, -- tid_agg_rx->reorder_time[j] + 1 + -- HT_RX_REORDER_BUF_TIMEOUT); -+ if (!tid_agg_rx->removed) -+ mod_timer(&tid_agg_rx->reorder_timer, -+ tid_agg_rx->reorder_time[j] + 1 + -+ HT_RX_REORDER_BUF_TIMEOUT); - } else { - del_timer(&tid_agg_rx->reorder_timer); - } ---- a/net/mac80211/sta_info.h -+++ b/net/mac80211/sta_info.h -@@ -106,6 +106,7 @@ enum ieee80211_sta_info_flags { - * @buf_size: reorder buffer size at receiver - * @failed_bar_ssn: ssn of the last failed BAR tx attempt - * @bar_pending: BAR needs to be re-sent -+ * @removed: this session is removed (but might have been found due to RCU) - * - * This structure's lifetime is managed by RCU, assignments to - * the array holding it must hold the aggregation mutex. -@@ -169,6 +170,7 @@ struct tid_ampdu_rx { - u16 buf_size; - u16 timeout; - u8 dialog_token; -+ bool removed; - }; - - /** diff --git a/patches/mac80211-send-eapol-frames-at-lowest-rate.patch b/patches/mac80211-send-eapol-frames-at-lowest-rate.patch deleted file mode 100644 index cffb0a2..0000000 --- a/patches/mac80211-send-eapol-frames-at-lowest-rate.patch +++ /dev/null @@ -1,71 +0,0 @@ -From 9c1c98a3bb7b7593b60264b9a07e001e68b46697 Mon Sep 17 00:00:00 2001 -From: Jouni Malinen <jouni@qca.qualcomm.com> -Date: Thu, 26 Feb 2015 15:50:50 +0200 -Subject: mac80211: Send EAPOL frames at lowest rate - -commit 9c1c98a3bb7b7593b60264b9a07e001e68b46697 upstream. - -The current minstrel_ht rate control behavior is somewhat optimistic in -trying to find optimum TX rate. While this is usually fine for normal -Data frames, there are cases where a more conservative set of retry -parameters would be beneficial to make the connection more robust. - -EAPOL frames are critical to the authentication and especially the -EAPOL-Key message 4/4 (the last message in the 4-way handshake) is -important to get through to the AP. If that message is lost, the only -recovery mechanism in many cases is to reassociate with the AP and start -from scratch. This can often be avoided by trying to send the frame with -more conservative rate and/or with more link layer retries. - -In most cases, minstrel_ht is currently using the initial EAPOL-Key -frames for probing higher rates and this results in only five link layer -transmission attempts (one at high(ish) MCS and four at MCS0). While -this works with most APs, it looks like there are some deployed APs that -may have issues with the EAPOL frames using HT MCS immediately after -association. Similarly, there may be issues in cases where the signal -strength or radio environment is not good enough to be able to get -frames through even at couple of MCS 0 tries. - -The best approach for this would likely to be to reduce the TX rate for -the last rate (3rd rate parameter in the set) to a low basic rate (say, -6 Mbps on 5 GHz and 2 or 5.5 Mbps on 2.4 GHz), but doing that cleanly -requires some more effort. For now, we can start with a simple one-liner -that forces the minimum rate to be used for EAPOL frames similarly how -the TX rate is selected for the IEEE 802.11 Management frames. This does -result in a small extra latency added to the cases where the AP would be -able to receive the higher rate, but taken into account how small number -of EAPOL frames are used, this is likely to be insignificant. A future -optimization in the minstrel_ht design can also allow this patch to be -reverted to get back to the more optimized initial TX rate. - -It should also be noted that many drivers that do not use minstrel as -the rate control algorithm are already doing similar workarounds by -forcing the lowest TX rate to be used for EAPOL frames. - -Reported-by: Linus Torvalds <torvalds@linux-foundation.org> -Tested-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -[lizf: Backported to 3.4: adjust the if statement] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/mac80211/tx.c | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -544,9 +544,11 @@ ieee80211_tx_h_check_control_port_protoc - { - struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); - -- if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol && -- tx->sdata->control_port_no_encrypt)) -- info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; -+ if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol)) { -+ if (tx->sdata->control_port_no_encrypt) -+ info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; -+ info->flags |= IEEE80211_TX_CTL_USE_MINRATE; -+ } - - return TX_CONTINUE; - } diff --git a/patches/mac80211-set-only-vo-as-a-u-apsd-enabled-ac.patch b/patches/mac80211-set-only-vo-as-a-u-apsd-enabled-ac.patch deleted file mode 100644 index 8b9a87a..0000000 --- a/patches/mac80211-set-only-vo-as-a-u-apsd-enabled-ac.patch +++ /dev/null @@ -1,41 +0,0 @@ -From d6a4ed6fe0a0d4790941e7f13e56630b8b9b053d Mon Sep 17 00:00:00 2001 -From: Arik Nemtsov <arik@wizery.com> -Date: Mon, 18 Jun 2012 10:43:50 +0300 -Subject: mac80211: set only VO as a U-APSD enabled AC - -commit d6a4ed6fe0a0d4790941e7f13e56630b8b9b053d upstream. - -Some APs experience problems when working with U-APSD. Decrease the -probability of that happening by using legacy mode for all ACs but VO. - -The AP that caused us troubles was a Cisco 4410N. It ignores our -setting, and always treats non-VO ACs as legacy. - -Signed-off-by: Arik Nemtsov <arik@wizery.com> -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/mac80211/ieee80211_i.h | 11 +++++++---- - 1 file changed, 7 insertions(+), 4 deletions(-) - ---- a/net/mac80211/ieee80211_i.h -+++ b/net/mac80211/ieee80211_i.h -@@ -54,11 +54,14 @@ struct ieee80211_local; - - #define TU_TO_EXP_TIME(x) (jiffies + usecs_to_jiffies((x) * 1024)) - -+/* -+ * Some APs experience problems when working with U-APSD. Decrease the -+ * probability of that happening by using legacy mode for all ACs but VO. -+ * The AP that caused us trouble was a Cisco 4410N. It ignores our -+ * setting, and always treats non-VO ACs as legacy. -+ */ - #define IEEE80211_DEFAULT_UAPSD_QUEUES \ -- (IEEE80211_WMM_IE_STA_QOSINFO_AC_BK | \ -- IEEE80211_WMM_IE_STA_QOSINFO_AC_BE | \ -- IEEE80211_WMM_IE_STA_QOSINFO_AC_VI | \ -- IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) -+ IEEE80211_WMM_IE_STA_QOSINFO_AC_VO - - #define IEEE80211_DEFAULT_MAX_SP_LEN \ - IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL diff --git a/patches/mm-hugetlb-add-migration-entry-check-in-__unmap_hugepage_range.patch b/patches/mm-hugetlb-add-migration-entry-check-in-__unmap_hugepage_range.patch deleted file mode 100644 index f6db18b..0000000 --- a/patches/mm-hugetlb-add-migration-entry-check-in-__unmap_hugepage_range.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 9fbc1f635fd0bd28cb32550211bf095753ac637a Mon Sep 17 00:00:00 2001 -From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> -Date: Wed, 11 Feb 2015 15:25:32 -0800 -Subject: mm/hugetlb: add migration entry check in __unmap_hugepage_range - -commit 9fbc1f635fd0bd28cb32550211bf095753ac637a upstream. - -If __unmap_hugepage_range() tries to unmap the address range over which -hugepage migration is on the way, we get the wrong page because pte_page() -doesn't work for migration entries. This patch simply clears the pte for -migration entries as we do for hwpoison entries. - -Fixes: 290408d4a2 ("hugetlb: hugepage migration core") -Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> -Cc: Hugh Dickins <hughd@google.com> -Cc: James Hogan <james.hogan@imgtec.com> -Cc: David Rientjes <rientjes@google.com> -Cc: Mel Gorman <mel@csn.ul.ie> -Cc: Johannes Weiner <hannes@cmpxchg.org> -Cc: Michal Hocko <mhocko@suse.cz> -Cc: Rik van Riel <riel@redhat.com> -Cc: Andrea Arcangeli <aarcange@redhat.com> -Cc: Luiz Capitulino <lcapitulino@redhat.com> -Cc: Nishanth Aravamudan <nacc@linux.vnet.ibm.com> -Cc: Lee Schermerhorn <lee.schermerhorn@hp.com> -Cc: Steve Capper <steve.capper@linaro.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -[lizf: Backported to 3.4: - - adjust context - - update the comment that we doesn't clear pte here] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/hugetlb.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -2401,9 +2401,10 @@ void __unmap_hugepage_range(struct vm_ar - continue; - - /* -- * HWPoisoned hugepage is already unmapped and dropped reference -+ * Migrating hugepage or HWPoisoned hugepage is already -+ * unmapped and its refcount is dropped - */ -- if (unlikely(is_hugetlb_entry_hwpoisoned(pte))) -+ if (unlikely(!pte_present(pte))) - continue; - - page = pte_page(pte); diff --git a/patches/mm-hugetlb-add-migration-hwpoisoned-entry-check-in-hugetlb_change_protection.patch b/patches/mm-hugetlb-add-migration-hwpoisoned-entry-check-in-hugetlb_change_protection.patch deleted file mode 100644 index c241f51..0000000 --- a/patches/mm-hugetlb-add-migration-hwpoisoned-entry-check-in-hugetlb_change_protection.patch +++ /dev/null @@ -1,67 +0,0 @@ -From a8bda28d87c38c6aa93de28ba5d30cc18e865a11 Mon Sep 17 00:00:00 2001 -From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> -Date: Wed, 11 Feb 2015 15:25:28 -0800 -Subject: mm/hugetlb: add migration/hwpoisoned entry check in - hugetlb_change_protection - -commit a8bda28d87c38c6aa93de28ba5d30cc18e865a11 upstream. - -There is a race condition between hugepage migration and -change_protection(), where hugetlb_change_protection() doesn't care about -migration entries and wrongly overwrites them. That causes unexpected -results like kernel crash. HWPoison entries also can cause the same -problem. - -This patch adds is_hugetlb_entry_(migration|hwpoisoned) check in this -function to do proper actions. - -Fixes: 290408d4a2 ("hugetlb: hugepage migration core") -Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> -Cc: Hugh Dickins <hughd@google.com> -Cc: James Hogan <james.hogan@imgtec.com> -Cc: David Rientjes <rientjes@google.com> -Cc: Mel Gorman <mel@csn.ul.ie> -Cc: Johannes Weiner <hannes@cmpxchg.org> -Cc: Michal Hocko <mhocko@suse.cz> -Cc: Rik van Riel <riel@redhat.com> -Cc: Andrea Arcangeli <aarcange@redhat.com> -Cc: Luiz Capitulino <lcapitulino@redhat.com> -Cc: Nishanth Aravamudan <nacc@linux.vnet.ibm.com> -Cc: Lee Schermerhorn <lee.schermerhorn@hp.com> -Cc: Steve Capper <steve.capper@linaro.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -[lizf: Backported to 3.4: - - remove locking of ptl - - remove counting of pages] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/hugetlb.c | 17 ++++++++++++++++- - 1 file changed, 16 insertions(+), 1 deletion(-) - ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -3052,7 +3052,22 @@ void hugetlb_change_protection(struct vm - continue; - if (huge_pmd_unshare(mm, &address, ptep)) - continue; -- if (!huge_pte_none(huge_ptep_get(ptep))) { -+ pte = huge_ptep_get(ptep); -+ if (unlikely(is_hugetlb_entry_hwpoisoned(pte))) -+ continue; -+ if (unlikely(is_hugetlb_entry_migration(pte))) { -+ swp_entry_t entry = pte_to_swp_entry(pte); -+ -+ if (is_write_migration_entry(entry)) { -+ pte_t newpte; -+ -+ make_migration_entry_read(&entry); -+ newpte = swp_entry_to_pte(entry); -+ set_huge_pte_at(mm, address, ptep, newpte); -+ } -+ continue; -+ } -+ if (!huge_pte_none(pte)) { - pte = huge_ptep_get_and_clear(mm, address, ptep); - pte = pte_mkhuge(pte_modify(pte, newprot)); - set_huge_pte_at(mm, address, ptep, pte); diff --git a/patches/mm-hugetlb-fix-getting-refcount-0-page-in-hugetlb_fault.patch b/patches/mm-hugetlb-fix-getting-refcount-0-page-in-hugetlb_fault.patch deleted file mode 100644 index 97c0a7a..0000000 --- a/patches/mm-hugetlb-fix-getting-refcount-0-page-in-hugetlb_fault.patch +++ /dev/null @@ -1,123 +0,0 @@ -From 0f792cf949a0be506c2aa8bfac0605746b146dda Mon Sep 17 00:00:00 2001 -From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> -Date: Wed, 11 Feb 2015 15:25:25 -0800 -Subject: mm/hugetlb: fix getting refcount 0 page in hugetlb_fault() - -commit 0f792cf949a0be506c2aa8bfac0605746b146dda upstream. - -When running the test which causes the race as shown in the previous patch, -we can hit the BUG "get_page() on refcount 0 page" in hugetlb_fault(). - -This race happens when pte turns into migration entry just after the first -check of is_hugetlb_entry_migration() in hugetlb_fault() passed with false. -To fix this, we need to check pte_present() again after huge_ptep_get(). - -This patch also reorders taking ptl and doing pte_page(), because -pte_page() should be done in ptl. Due to this reordering, we need use -trylock_page() in page != pagecache_page case to respect locking order. - -Fixes: 66aebce747ea ("hugetlb: fix race condition in hugetlb_fault()") -Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> -Cc: Hugh Dickins <hughd@google.com> -Cc: James Hogan <james.hogan@imgtec.com> -Cc: David Rientjes <rientjes@google.com> -Cc: Mel Gorman <mel@csn.ul.ie> -Cc: Johannes Weiner <hannes@cmpxchg.org> -Cc: Michal Hocko <mhocko@suse.cz> -Cc: Rik van Riel <riel@redhat.com> -Cc: Andrea Arcangeli <aarcange@redhat.com> -Cc: Luiz Capitulino <lcapitulino@redhat.com> -Cc: Nishanth Aravamudan <nacc@linux.vnet.ibm.com> -Cc: Lee Schermerhorn <lee.schermerhorn@hp.com> -Cc: Steve Capper <steve.capper@linaro.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -[lizf: Backported to 3.4: - - adjust context - - there's no huge_pte_lock, so lock mm->page_table_lock directly - - the lable should be out_page_table_lock instead of out_ptl] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/hugetlb.c | 36 +++++++++++++++++++++++++++--------- - 1 file changed, 27 insertions(+), 9 deletions(-) - ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -2813,6 +2813,7 @@ int hugetlb_fault(struct mm_struct *mm, - struct page *pagecache_page = NULL; - static DEFINE_MUTEX(hugetlb_instantiation_mutex); - struct hstate *h = hstate_vma(vma); -+ int need_wait_lock = 0; - - address &= huge_page_mask(h); - -@@ -2846,6 +2847,16 @@ int hugetlb_fault(struct mm_struct *mm, - ret = 0; - - /* -+ * entry could be a migration/hwpoison entry at this point, so this -+ * check prevents the kernel from going below assuming that we have -+ * a active hugepage in pagecache. This goto expects the 2nd page fault, -+ * and is_hugetlb_entry_(migration|hwpoisoned) check will properly -+ * handle it. -+ */ -+ if (!pte_present(entry)) -+ goto out_mutex; -+ -+ /* - * If we are going to COW the mapping later, we examine the pending - * reservations for this page now. This will ensure that any - * allocations necessary to record that reservation occur outside the -@@ -2864,29 +2875,32 @@ int hugetlb_fault(struct mm_struct *mm, - vma, address); - } - -+ spin_lock(&mm->page_table_lock); -+ -+ /* Check for a racing update before calling hugetlb_cow */ -+ if (unlikely(!pte_same(entry, huge_ptep_get(ptep)))) -+ goto out_page_table_lock; -+ - /* - * hugetlb_cow() requires page locks of pte_page(entry) and - * pagecache_page, so here we need take the former one - * when page != pagecache_page or !pagecache_page. -- * Note that locking order is always pagecache_page -> page, -- * so no worry about deadlock. - */ - page = pte_page(entry); -- get_page(page); - if (page != pagecache_page) -- lock_page(page); -+ if (!trylock_page(page)) { -+ need_wait_lock = 1; -+ goto out_page_table_lock; -+ } - -- spin_lock(&mm->page_table_lock); -- /* Check for a racing update before calling hugetlb_cow */ -- if (unlikely(!pte_same(entry, huge_ptep_get(ptep)))) -- goto out_page_table_lock; -+ get_page(page); - - - if (flags & FAULT_FLAG_WRITE) { - if (!pte_write(entry)) { - ret = hugetlb_cow(mm, vma, address, ptep, entry, - pagecache_page); -- goto out_page_table_lock; -+ goto out_put_page; - } - entry = pte_mkdirty(entry); - } -@@ -2895,6 +2909,10 @@ int hugetlb_fault(struct mm_struct *mm, - flags & FAULT_FLAG_WRITE)) - update_mmu_cache(vma, address, ptep); - -+out_put_page: -+ if (page != pagecache_page) -+ unlock_page(page); -+ put_page(page); - out_page_table_lock: - spin_unlock(&mm->page_table_lock); - diff --git a/patches/mm-memory.c-actually-remap-enough-memory.patch b/patches/mm-memory.c-actually-remap-enough-memory.patch deleted file mode 100644 index 85c1dd8..0000000 --- a/patches/mm-memory.c-actually-remap-enough-memory.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 9cb12d7b4ccaa976f97ce0c5fd0f1b6a83bc2a75 Mon Sep 17 00:00:00 2001 -From: Grazvydas Ignotas <notasas@gmail.com> -Date: Thu, 12 Feb 2015 15:00:19 -0800 -Subject: mm/memory.c: actually remap enough memory - -commit 9cb12d7b4ccaa976f97ce0c5fd0f1b6a83bc2a75 upstream. - -For whatever reason, generic_access_phys() only remaps one page, but -actually allows to access arbitrary size. It's quite easy to trigger -large reads, like printing out large structure with gdb, which leads to a -crash. Fix it by remapping correct size. - -Fixes: 28b2ee20c7cb ("access_process_vm device memory infrastructure") -Signed-off-by: Grazvydas Ignotas <notasas@gmail.com> -Cc: Rik van Riel <riel@redhat.com> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/memory.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -3845,7 +3845,7 @@ int generic_access_phys(struct vm_area_s - if (follow_phys(vma, addr, write, &prot, &phys_addr)) - return -EINVAL; - -- maddr = ioremap_prot(phys_addr, PAGE_SIZE, prot); -+ maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot); - if (write) - memcpy_toio(maddr + offset, buf, len); - else diff --git a/patches/mm-mmap.c-fix-arithmetic-overflow-in-__vm_enough_memory.patch b/patches/mm-mmap.c-fix-arithmetic-overflow-in-__vm_enough_memory.patch deleted file mode 100644 index 8b1982b..0000000 --- a/patches/mm-mmap.c-fix-arithmetic-overflow-in-__vm_enough_memory.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 5703b087dc8eaf47bfb399d6cf512d471beff405 Mon Sep 17 00:00:00 2001 -From: Roman Gushchin <klamm@yandex-team.ru> -Date: Wed, 11 Feb 2015 15:28:39 -0800 -Subject: mm/mmap.c: fix arithmetic overflow in __vm_enough_memory() - -commit 5703b087dc8eaf47bfb399d6cf512d471beff405 upstream. - -I noticed, that "allowed" can easily overflow by falling below 0, -because (total_vm / 32) can be larger than "allowed". The problem -occurs in OVERCOMMIT_NONE mode. - -In this case, a huge allocation can success and overcommit the system -(despite OVERCOMMIT_NONE mode). All subsequent allocations will fall -(system-wide), so system become unusable. - -The problem was masked out by commit c9b1d0981fcc -("mm: limit growth of 3% hardcoded other user reserve"), -but it's easy to reproduce it on older kernels: -1) set overcommit_memory sysctl to 2 -2) mmap() large file multiple times (with VM_SHARED flag) -3) try to malloc() large amount of memory - -It also can be reproduced on newer kernels, but miss-configured -sysctl_user_reserve_kbytes is required. - -Fix this issue by switching to signed arithmetic here. - -[akpm@linux-foundation.org: use min_t] -Signed-off-by: Roman Gushchin <klamm@yandex-team.ru> -Cc: Andrew Shewmaker <agshew@gmail.com> -Cc: Rik van Riel <riel@redhat.com> -Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> -Reviewed-by: Michal Hocko <mhocko@suse.cz> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -[lizf: Backported to 3.4: - - adjust context - - there's no variable reserve] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/mmap.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -112,7 +112,7 @@ struct percpu_counter vm_committed_as __ - */ - int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin) - { -- unsigned long free, allowed; -+ long free, allowed; - - vm_acct_memory(pages); - diff --git a/patches/mm-nommu.c-fix-arithmetic-overflow-in-__vm_enough_memory.patch b/patches/mm-nommu.c-fix-arithmetic-overflow-in-__vm_enough_memory.patch deleted file mode 100644 index c118a0e..0000000 --- a/patches/mm-nommu.c-fix-arithmetic-overflow-in-__vm_enough_memory.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 8138a67a5557ffea3a21dfd6f037842d4e748513 Mon Sep 17 00:00:00 2001 -From: Roman Gushchin <klamm@yandex-team.ru> -Date: Wed, 11 Feb 2015 15:28:42 -0800 -Subject: mm/nommu.c: fix arithmetic overflow in __vm_enough_memory() - -commit 8138a67a5557ffea3a21dfd6f037842d4e748513 upstream. - -I noticed that "allowed" can easily overflow by falling below 0, because -(total_vm / 32) can be larger than "allowed". The problem occurs in -OVERCOMMIT_NONE mode. - -In this case, a huge allocation can success and overcommit the system -(despite OVERCOMMIT_NONE mode). All subsequent allocations will fall -(system-wide), so system become unusable. - -The problem was masked out by commit c9b1d0981fcc -("mm: limit growth of 3% hardcoded other user reserve"), -but it's easy to reproduce it on older kernels: -1) set overcommit_memory sysctl to 2 -2) mmap() large file multiple times (with VM_SHARED flag) -3) try to malloc() large amount of memory - -It also can be reproduced on newer kernels, but miss-configured -sysctl_user_reserve_kbytes is required. - -Fix this issue by switching to signed arithmetic here. - -Signed-off-by: Roman Gushchin <klamm@yandex-team.ru> -Cc: Andrew Shewmaker <agshew@gmail.com> -Cc: Rik van Riel <riel@redhat.com> -Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -[lizf: Backported to 3.4: - - adjust context - - there's no variable reserve] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/nommu.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/mm/nommu.c -+++ b/mm/nommu.c -@@ -1916,7 +1916,7 @@ EXPORT_SYMBOL(unmap_mapping_range); - */ - int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin) - { -- unsigned long free, allowed; -+ long free, allowed; - - vm_acct_memory(pages); - diff --git a/patches/nbd-fix-possible-memory-leak.patch b/patches/nbd-fix-possible-memory-leak.patch deleted file mode 100644 index 74b64f7..0000000 --- a/patches/nbd-fix-possible-memory-leak.patch +++ /dev/null @@ -1,42 +0,0 @@ -From ff6b8090e26ef7649ef0cc6b42389141ef48b0cf Mon Sep 17 00:00:00 2001 -From: Sudip Mukherjee <sudipm.mukherjee@gmail.com> -Date: Tue, 27 Jan 2015 18:08:22 +0530 -Subject: nbd: fix possible memory leak - -commit ff6b8090e26ef7649ef0cc6b42389141ef48b0cf upstream. - -we have already allocated memory for nbd_dev, but we were not -releasing that memory and just returning the error value. - -Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org> -Acked-by: Paul Clements <Paul.Clements@SteelEye.com> -Signed-off-by: Markus Pargmann <mpa@pengutronix.de> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/block/nbd.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -773,10 +773,6 @@ static int __init nbd_init(void) - return -EINVAL; - } - -- nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL); -- if (!nbd_dev) -- return -ENOMEM; -- - part_shift = 0; - if (max_part > 0) { - part_shift = fls(max_part); -@@ -798,6 +794,10 @@ static int __init nbd_init(void) - if (nbds_max > 1UL << (MINORBITS - part_shift)) - return -EINVAL; - -+ nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL); -+ if (!nbd_dev) -+ return -ENOMEM; -+ - for (i = 0; i < nbds_max; i++) { - struct gendisk *disk = alloc_disk(1 << part_shift); - if (!disk) diff --git a/patches/net-ethernet-pcnet32-setup-the-sram-and-nouflo-on-am79c97-3-5.patch b/patches/net-ethernet-pcnet32-setup-the-sram-and-nouflo-on-am79c97-3-5.patch deleted file mode 100644 index f0fb605..0000000 --- a/patches/net-ethernet-pcnet32-setup-the-sram-and-nouflo-on-am79c97-3-5.patch +++ /dev/null @@ -1,93 +0,0 @@ -From 87f966d97b89774162df04d2106c6350c8fe4cb3 Mon Sep 17 00:00:00 2001 -From: Markos Chandras <markos.chandras@imgtec.com> -Date: Thu, 19 Mar 2015 10:28:14 +0000 -Subject: net: ethernet: pcnet32: Setup the SRAM and NOUFLO on Am79C97{3, 5} - -commit 87f966d97b89774162df04d2106c6350c8fe4cb3 upstream. - -On a MIPS Malta board, tons of fifo underflow errors have been observed -when using u-boot as bootloader instead of YAMON. The reason for that -is that YAMON used to set the pcnet device to SRAM mode but u-boot does -not. As a result, the default Tx threshold (64 bytes) is now too small to -keep the fifo relatively used and it can result to Tx fifo underflow errors. -As a result of which, it's best to setup the SRAM on supported controllers -so we can always use the NOUFLO bit. - -Cc: <netdev@vger.kernel.org> -Cc: <linux-kernel@vger.kernel.org> -Cc: Don Fry <pcnet32@frontier.com> -Signed-off-by: Markos Chandras <markos.chandras@imgtec.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/ethernet/amd/pcnet32.c | 31 +++++++++++++++++++++++++++++-- - 1 file changed, 29 insertions(+), 2 deletions(-) - ---- a/drivers/net/ethernet/amd/pcnet32.c -+++ b/drivers/net/ethernet/amd/pcnet32.c -@@ -1526,7 +1526,7 @@ pcnet32_probe1(unsigned long ioaddr, int - { - struct pcnet32_private *lp; - int i, media; -- int fdx, mii, fset, dxsuflo; -+ int fdx, mii, fset, dxsuflo, sram; - int chip_version; - char *chipname; - struct net_device *dev; -@@ -1563,7 +1563,7 @@ pcnet32_probe1(unsigned long ioaddr, int - } - - /* initialize variables */ -- fdx = mii = fset = dxsuflo = 0; -+ fdx = mii = fset = dxsuflo = sram = 0; - chip_version = (chip_version >> 12) & 0xffff; - - switch (chip_version) { -@@ -1596,6 +1596,7 @@ pcnet32_probe1(unsigned long ioaddr, int - chipname = "PCnet/FAST III 79C973"; /* PCI */ - fdx = 1; - mii = 1; -+ sram = 1; - break; - case 0x2626: - chipname = "PCnet/Home 79C978"; /* PCI */ -@@ -1619,6 +1620,7 @@ pcnet32_probe1(unsigned long ioaddr, int - chipname = "PCnet/FAST III 79C975"; /* PCI */ - fdx = 1; - mii = 1; -+ sram = 1; - break; - case 0x2628: - chipname = "PCnet/PRO 79C976"; -@@ -1647,6 +1649,31 @@ pcnet32_probe1(unsigned long ioaddr, int - dxsuflo = 1; - } - -+ /* -+ * The Am79C973/Am79C975 controllers come with 12K of SRAM -+ * which we can use for the Tx/Rx buffers but most importantly, -+ * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid -+ * Tx fifo underflows. -+ */ -+ if (sram) { -+ /* -+ * The SRAM is being configured in two steps. First we -+ * set the SRAM size in the BCR25:SRAM_SIZE bits. According -+ * to the datasheet, each bit corresponds to a 512-byte -+ * page so we can have at most 24 pages. The SRAM_SIZE -+ * holds the value of the upper 8 bits of the 16-bit SRAM size. -+ * The low 8-bits start at 0x00 and end at 0xff. So the -+ * address range is from 0x0000 up to 0x17ff. Therefore, -+ * the SRAM_SIZE is set to 0x17. The next step is to set -+ * the BCR26:SRAM_BND midway through so the Tx and Rx -+ * buffers can share the SRAM equally. -+ */ -+ a->write_bcr(ioaddr, 25, 0x17); -+ a->write_bcr(ioaddr, 26, 0xc); -+ /* And finally enable the NOUFLO bit */ -+ a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11)); -+ } -+ - dev = alloc_etherdev(sizeof(*lp)); - if (!dev) { - ret = -ENOMEM; diff --git a/patches/net-irda-fix-wait_until_sent-poll-timeout.patch b/patches/net-irda-fix-wait_until_sent-poll-timeout.patch deleted file mode 100644 index f5b6ba7..0000000 --- a/patches/net-irda-fix-wait_until_sent-poll-timeout.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 2c3fbe3cf28fbd7001545a92a83b4f8acfd9fa36 Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Wed, 4 Mar 2015 10:39:03 +0100 -Subject: net: irda: fix wait_until_sent poll timeout - -commit 2c3fbe3cf28fbd7001545a92a83b4f8acfd9fa36 upstream. - -In case an infinite timeout (0) is requested, the irda wait_until_sent -implementation would use a zero poll timeout rather than the default -200ms. - -Note that wait_until_sent is currently never called with a 0-timeout -argument due to a bug in tty_wait_until_sent. - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/irda/ircomm/ircomm_tty.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/net/irda/ircomm/ircomm_tty.c -+++ b/net/irda/ircomm/ircomm_tty.c -@@ -843,7 +843,9 @@ static void ircomm_tty_wait_until_sent(s - orig_jiffies = jiffies; - - /* Set poll time to 200 ms */ -- poll_time = IRDA_MIN(timeout, msecs_to_jiffies(200)); -+ poll_time = msecs_to_jiffies(200); -+ if (timeout) -+ poll_time = min_t(unsigned long, timeout, poll_time); - - spin_lock_irqsave(&self->spinlock, flags); - while (self->tx_skb && self->tx_skb->len) { diff --git a/patches/net-make-skb_gso_segment-error-handling-more-robust.patch b/patches/net-make-skb_gso_segment-error-handling-more-robust.patch deleted file mode 100644 index 1802c52..0000000 --- a/patches/net-make-skb_gso_segment-error-handling-more-robust.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 330966e501ffe282d7184fde4518d5e0c24bc7f8 Mon Sep 17 00:00:00 2001 -From: Florian Westphal <fw@strlen.de> -Date: Mon, 20 Oct 2014 13:49:17 +0200 -Subject: net: make skb_gso_segment error handling more robust - -commit 330966e501ffe282d7184fde4518d5e0c24bc7f8 upstream. - -skb_gso_segment has three possible return values: -1. a pointer to the first segmented skb -2. an errno value (IS_ERR()) -3. NULL. This can happen when GSO is used for header verification. - -However, several callers currently test IS_ERR instead of IS_ERR_OR_NULL -and would oops when NULL is returned. - -Note that these call sites should never actually see such a NULL return -value; all callers mask out the GSO bits in the feature argument. - -However, there have been issues with some protocol handlers erronously not -respecting the specified feature mask in some cases. - -It is preferable to get 'have to turn off hw offloading, else slow' reports -rather than 'kernel crashes'. - -Signed-off-by: Florian Westphal <fw@strlen.de> -Signed-off-by: David S. Miller <davem@davemloft.net> -Cc: Ben Hutchings <ben@decadent.org.uk> -[lizf: Backported to 3.4: drop some hunks as there are fewer skb_gso_segment() - users in 3.4] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/netfilter/nf_queue.c | 2 +- - net/openvswitch/datapath.c | 2 ++ - net/xfrm/xfrm_output.c | 2 ++ - 3 files changed, 5 insertions(+), 1 deletion(-) - ---- a/net/openvswitch/datapath.c -+++ b/net/openvswitch/datapath.c -@@ -271,6 +271,8 @@ static int queue_gso_packets(int dp_ifin - segs = skb_gso_segment(skb, NETIF_F_SG | NETIF_F_HW_CSUM); - if (IS_ERR(segs)) - return PTR_ERR(segs); -+ if (segs == NULL) -+ return -EINVAL; - - /* Queue all of the segments. */ - skb = segs; ---- a/net/xfrm/xfrm_output.c -+++ b/net/xfrm/xfrm_output.c -@@ -151,6 +151,8 @@ static int xfrm_output_gso(struct sk_buf - kfree_skb(skb); - if (IS_ERR(segs)) - return PTR_ERR(segs); -+ if (segs == NULL) -+ return -EINVAL; - - do { - struct sk_buff *nskb = segs->next; ---- a/net/netfilter/nf_queue.c -+++ b/net/netfilter/nf_queue.c -@@ -255,7 +255,7 @@ int nf_queue(struct sk_buff *skb, - * returned by nf_queue. For instance, callers rely on -ECANCELED to mean - * 'ignore this hook'. - */ -- if (IS_ERR(segs)) -+ if (IS_ERR_OR_NULL(segs)) - goto out_err; - queued = 0; - err = 0; diff --git a/patches/net-use-for_each_netdev_safe-in-rtnl_group_changelink.patch b/patches/net-use-for_each_netdev_safe-in-rtnl_group_changelink.patch deleted file mode 100644 index 52b3b36..0000000 --- a/patches/net-use-for_each_netdev_safe-in-rtnl_group_changelink.patch +++ /dev/null @@ -1,97 +0,0 @@ -From d079535d5e1bf5e2e7c856bae2483414ea21e137 Mon Sep 17 00:00:00 2001 -From: WANG Cong <xiyou.wangcong@gmail.com> -Date: Mon, 23 Mar 2015 16:31:09 -0700 -Subject: net: use for_each_netdev_safe() in rtnl_group_changelink() - -commit d079535d5e1bf5e2e7c856bae2483414ea21e137 upstream. - -In case we move the whole dev group to another netns, -we should call for_each_netdev_safe(), otherwise we get -a soft lockup: - - NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [ip:798] - irq event stamp: 255424 - hardirqs last enabled at (255423): [<ffffffff81a2aa95>] restore_args+0x0/0x30 - hardirqs last disabled at (255424): [<ffffffff81a2ad5a>] apic_timer_interrupt+0x6a/0x80 - softirqs last enabled at (255422): [<ffffffff81079ebc>] __do_softirq+0x2c1/0x3a9 - softirqs last disabled at (255417): [<ffffffff8107a190>] irq_exit+0x41/0x95 - CPU: 0 PID: 798 Comm: ip Not tainted 4.0.0-rc4+ #881 - Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 - task: ffff8800d1b88000 ti: ffff880119530000 task.ti: ffff880119530000 - RIP: 0010:[<ffffffff810cad11>] [<ffffffff810cad11>] debug_lockdep_rcu_enabled+0x28/0x30 - RSP: 0018:ffff880119533778 EFLAGS: 00000246 - RAX: ffff8800d1b88000 RBX: 0000000000000002 RCX: 0000000000000038 - RDX: 0000000000000000 RSI: ffff8800d1b888c8 RDI: ffff8800d1b888c8 - RBP: ffff880119533778 R08: 0000000000000000 R09: 0000000000000000 - R10: 0000000000000000 R11: 000000000000b5c2 R12: 0000000000000246 - R13: ffff880119533708 R14: 00000000001d5a40 R15: ffff88011a7d5a40 - FS: 00007fc01315f740(0000) GS:ffff88011a600000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b - CR2: 00007f367a120988 CR3: 000000011849c000 CR4: 00000000000007f0 - Stack: - ffff880119533798 ffffffff811ac868 ffffffff811ac831 ffffffff811ac828 - ffff8801195337c8 ffffffff811ac8c9 ffff8801195339b0 ffff8801197633e0 - 0000000000000000 ffff8801195339b0 ffff8801195337d8 ffffffff811ad2d7 - Call Trace: - [<ffffffff811ac868>] rcu_read_lock+0x37/0x6e - [<ffffffff811ac831>] ? rcu_read_unlock+0x5f/0x5f - [<ffffffff811ac828>] ? rcu_read_unlock+0x56/0x5f - [<ffffffff811ac8c9>] __fget+0x2a/0x7a - [<ffffffff811ad2d7>] fget+0x13/0x15 - [<ffffffff811be732>] proc_ns_fget+0xe/0x38 - [<ffffffff817c7714>] get_net_ns_by_fd+0x11/0x59 - [<ffffffff817df359>] rtnl_link_get_net+0x33/0x3e - [<ffffffff817df3d7>] do_setlink+0x73/0x87b - [<ffffffff810b28ce>] ? trace_hardirqs_off+0xd/0xf - [<ffffffff81a2aa95>] ? retint_restore_args+0xe/0xe - [<ffffffff817e0301>] rtnl_newlink+0x40c/0x699 - [<ffffffff817dffe0>] ? rtnl_newlink+0xeb/0x699 - [<ffffffff81a29246>] ? _raw_spin_unlock+0x28/0x33 - [<ffffffff8143ed1e>] ? security_capable+0x18/0x1a - [<ffffffff8107da51>] ? ns_capable+0x4d/0x65 - [<ffffffff817de5ce>] rtnetlink_rcv_msg+0x181/0x194 - [<ffffffff817de407>] ? rtnl_lock+0x17/0x19 - [<ffffffff817de407>] ? rtnl_lock+0x17/0x19 - [<ffffffff817de44d>] ? __rtnl_unlock+0x17/0x17 - [<ffffffff818327c6>] netlink_rcv_skb+0x4d/0x93 - [<ffffffff817de42f>] rtnetlink_rcv+0x26/0x2d - [<ffffffff81830f18>] netlink_unicast+0xcb/0x150 - [<ffffffff8183198e>] netlink_sendmsg+0x501/0x523 - [<ffffffff8115cba9>] ? might_fault+0x59/0xa9 - [<ffffffff817b5398>] ? copy_from_user+0x2a/0x2c - [<ffffffff817b7b74>] sock_sendmsg+0x34/0x3c - [<ffffffff817b7f6d>] ___sys_sendmsg+0x1b8/0x255 - [<ffffffff8115c5eb>] ? handle_pte_fault+0xbd5/0xd4a - [<ffffffff8100a2b0>] ? native_sched_clock+0x35/0x37 - [<ffffffff8109e94b>] ? sched_clock_local+0x12/0x72 - [<ffffffff8109eb9c>] ? sched_clock_cpu+0x9e/0xb7 - [<ffffffff810cadbf>] ? rcu_read_lock_held+0x3b/0x3d - [<ffffffff811ac1d8>] ? __fcheck_files+0x4c/0x58 - [<ffffffff811ac946>] ? __fget_light+0x2d/0x52 - [<ffffffff817b8adc>] __sys_sendmsg+0x42/0x60 - [<ffffffff817b8b0c>] SyS_sendmsg+0x12/0x1c - [<ffffffff81a29e32>] system_call_fastpath+0x12/0x17 - -Fixes: e7ed828f10bd8 ("netlink: support setting devgroup parameters") -Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/core/rtnetlink.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -1694,10 +1694,10 @@ static int rtnl_group_changelink(struct - struct ifinfomsg *ifm, - struct nlattr **tb) - { -- struct net_device *dev; -+ struct net_device *dev, *aux; - int err; - -- for_each_netdev(net, dev) { -+ for_each_netdev_safe(net, dev, aux) { - if (dev->group == group) { - err = do_setlink(dev, ifm, tb, NULL, 0); - if (err < 0) diff --git a/patches/netfilter-xt_socket-fix-a-stack-corruption-bug.patch b/patches/netfilter-xt_socket-fix-a-stack-corruption-bug.patch deleted file mode 100644 index a71ff86..0000000 --- a/patches/netfilter-xt_socket-fix-a-stack-corruption-bug.patch +++ /dev/null @@ -1,83 +0,0 @@ -From 78296c97ca1fd3b104f12e1f1fbc06c46635990b Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Sun, 15 Feb 2015 19:03:45 -0800 -Subject: netfilter: xt_socket: fix a stack corruption bug - -commit 78296c97ca1fd3b104f12e1f1fbc06c46635990b upstream. - -As soon as extract_icmp6_fields() returns, its local storage (automatic -variables) is deallocated and can be overwritten. - -Lets add an additional parameter to make sure storage is valid long -enough. - -While we are at it, adds some const qualifiers. - -Signed-off-by: Eric Dumazet <edumazet@google.com> -Fixes: b64c9256a9b76 ("tproxy: added IPv6 support to the socket match") -Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/netfilter/xt_socket.c | 21 ++++++++++++--------- - 1 file changed, 12 insertions(+), 9 deletions(-) - ---- a/net/netfilter/xt_socket.c -+++ b/net/netfilter/xt_socket.c -@@ -205,12 +205,13 @@ static int - extract_icmp6_fields(const struct sk_buff *skb, - unsigned int outside_hdrlen, - int *protocol, -- struct in6_addr **raddr, -- struct in6_addr **laddr, -+ const struct in6_addr **raddr, -+ const struct in6_addr **laddr, - __be16 *rport, -- __be16 *lport) -+ __be16 *lport, -+ struct ipv6hdr *ipv6_var) - { -- struct ipv6hdr *inside_iph, _inside_iph; -+ const struct ipv6hdr *inside_iph; - struct icmp6hdr *icmph, _icmph; - __be16 *ports, _ports[2]; - u8 inside_nexthdr; -@@ -225,12 +226,14 @@ extract_icmp6_fields(const struct sk_buf - if (icmph->icmp6_type & ICMPV6_INFOMSG_MASK) - return 1; - -- inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), sizeof(_inside_iph), &_inside_iph); -+ inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), -+ sizeof(*ipv6_var), ipv6_var); - if (inside_iph == NULL) - return 1; - inside_nexthdr = inside_iph->nexthdr; - -- inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph), -+ inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + -+ sizeof(*ipv6_var), - &inside_nexthdr, &inside_fragoff); - if (inside_hdrlen < 0) - return 1; /* hjm: Packet has no/incomplete transport layer headers. */ -@@ -258,10 +261,10 @@ extract_icmp6_fields(const struct sk_buf - static bool - socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par) - { -- struct ipv6hdr *iph = ipv6_hdr(skb); -+ struct ipv6hdr ipv6_var, *iph = ipv6_hdr(skb); - struct udphdr _hdr, *hp = NULL; - struct sock *sk; -- struct in6_addr *daddr, *saddr; -+ const struct in6_addr *daddr, *saddr; - __be16 dport, sport; - int thoff, tproto; - const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo; -@@ -285,7 +288,7 @@ socket_mt6_v1(const struct sk_buff *skb, - - } else if (tproto == IPPROTO_ICMPV6) { - if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr, -- &sport, &dport)) -+ &sport, &dport, &ipv6_var)) - return false; - } else { - return false; diff --git a/patches/nfsv4-don-t-call-put_rpccred-under-the-rcu_read_lock.patch b/patches/nfsv4-don-t-call-put_rpccred-under-the-rcu_read_lock.patch deleted file mode 100644 index 9b04b52..0000000 --- a/patches/nfsv4-don-t-call-put_rpccred-under-the-rcu_read_lock.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 7c0af9ffb7bb4e5355470fa60b3eb711ddf226fa Mon Sep 17 00:00:00 2001 -From: Trond Myklebust <trond.myklebust@primarydata.com> -Date: Thu, 26 Feb 2015 12:54:46 -0500 -Subject: NFSv4: Don't call put_rpccred() under the rcu_read_lock() - -commit 7c0af9ffb7bb4e5355470fa60b3eb711ddf226fa upstream. - -put_rpccred() can sleep. - -Fixes: 8f649c3762547 ("NFSv4: Fix the locking in nfs_inode_reclaim_delegation()") -Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/nfs/delegation.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/fs/nfs/delegation.c -+++ b/fs/nfs/delegation.c -@@ -148,8 +148,8 @@ void nfs_inode_reclaim_delegation(struct - &delegation->flags); - NFS_I(inode)->delegation_state = delegation->type; - spin_unlock(&delegation->lock); -- put_rpccred(oldcred); - rcu_read_unlock(); -+ put_rpccred(oldcred); - } else { - /* We appear to have raced with a delegation return. */ - spin_unlock(&delegation->lock); diff --git a/patches/nfsv4.1-fix-a-kfree-of-uninitialised-pointers-in-decode_cb_sequence_args.patch b/patches/nfsv4.1-fix-a-kfree-of-uninitialised-pointers-in-decode_cb_sequence_args.patch deleted file mode 100644 index 64d9d77..0000000 --- a/patches/nfsv4.1-fix-a-kfree-of-uninitialised-pointers-in-decode_cb_sequence_args.patch +++ /dev/null @@ -1,34 +0,0 @@ -From d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 Mon Sep 17 00:00:00 2001 -From: Trond Myklebust <trond.myklebust@primarydata.com> -Date: Wed, 11 Feb 2015 17:27:55 -0500 -Subject: NFSv4.1: Fix a kfree() of uninitialised pointers in - decode_cb_sequence_args - -commit d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 upstream. - -If the call to decode_rc_list() fails due to a memory allocation error, -then we need to truncate the array size to ensure that we only call -kfree() on those pointer that were allocated. - -Reported-by: David Ramos <daramos@stanford.edu> -Fixes: 4aece6a19cf7f ("nfs41: cb_sequence xdr implementation") -Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/nfs/callback_xdr.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/fs/nfs/callback_xdr.c -+++ b/fs/nfs/callback_xdr.c -@@ -463,8 +463,10 @@ static __be32 decode_cb_sequence_args(st - - for (i = 0; i < args->csa_nrclists; i++) { - status = decode_rc_list(xdr, &args->csa_rclists[i]); -- if (status) -+ if (status) { -+ args->csa_nrclists = i; - goto out_free; -+ } - } - } - status = 0; diff --git a/patches/nilfs2-fix-potential-memory-overrun-on-inode.patch b/patches/nilfs2-fix-potential-memory-overrun-on-inode.patch deleted file mode 100644 index f9e8f3d..0000000 --- a/patches/nilfs2-fix-potential-memory-overrun-on-inode.patch +++ /dev/null @@ -1,119 +0,0 @@ -From 957ed60b53b519064a54988c4e31e0087e47d091 Mon Sep 17 00:00:00 2001 -From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> -Date: Fri, 27 Feb 2015 15:51:56 -0800 -Subject: nilfs2: fix potential memory overrun on inode - -commit 957ed60b53b519064a54988c4e31e0087e47d091 upstream. - -Each inode of nilfs2 stores a root node of a b-tree, and it turned out to -have a memory overrun issue: - -Each b-tree node of nilfs2 stores a set of key-value pairs and the number -of them (in "bn_nchildren" member of nilfs_btree_node struct), as well as -a few other "bn_*" members. - -Since the value of "bn_nchildren" is used for operations on the key-values -within the b-tree node, it can cause memory access overrun if a large -number is incorrectly set to "bn_nchildren". - -For instance, nilfs_btree_node_lookup() function determines the range of -binary search with it, and too large "bn_nchildren" leads -nilfs_btree_node_get_key() in that function to overrun. - -As for intermediate b-tree nodes, this is prevented by a sanity check -performed when each node is read from a drive, however, no sanity check -has been done for root nodes stored in inodes. - -This patch fixes the issue by adding missing sanity check against b-tree -root nodes so that it's called when on-memory inodes are read from ifile, -inode metadata file. - -Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/nilfs2/btree.c | 47 ++++++++++++++++++++++++++++++++++++++++++++--- - 1 file changed, 44 insertions(+), 3 deletions(-) - ---- a/fs/nilfs2/btree.c -+++ b/fs/nilfs2/btree.c -@@ -31,6 +31,8 @@ - #include "alloc.h" - #include "dat.h" - -+static void __nilfs_btree_init(struct nilfs_bmap *bmap); -+ - static struct nilfs_btree_path *nilfs_btree_alloc_path(void) - { - struct nilfs_btree_path *path; -@@ -368,6 +370,34 @@ static int nilfs_btree_node_broken(const - return ret; - } - -+/** -+ * nilfs_btree_root_broken - verify consistency of btree root node -+ * @node: btree root node to be examined -+ * @ino: inode number -+ * -+ * Return Value: If node is broken, 1 is returned. Otherwise, 0 is returned. -+ */ -+static int nilfs_btree_root_broken(const struct nilfs_btree_node *node, -+ unsigned long ino) -+{ -+ int level, flags, nchildren; -+ int ret = 0; -+ -+ level = nilfs_btree_node_get_level(node); -+ flags = nilfs_btree_node_get_flags(node); -+ nchildren = nilfs_btree_node_get_nchildren(node); -+ -+ if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN || -+ level > NILFS_BTREE_LEVEL_MAX || -+ nchildren < 0 || -+ nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) { -+ pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n", -+ ino, level, flags, nchildren); -+ ret = 1; -+ } -+ return ret; -+} -+ - int nilfs_btree_broken_node_block(struct buffer_head *bh) - { - int ret; -@@ -1713,7 +1743,7 @@ nilfs_btree_commit_convert_and_insert(st - - /* convert and insert */ - dat = NILFS_BMAP_USE_VBN(btree) ? nilfs_bmap_get_dat(btree) : NULL; -- nilfs_btree_init(btree); -+ __nilfs_btree_init(btree); - if (nreq != NULL) { - nilfs_bmap_commit_alloc_ptr(btree, dreq, dat); - nilfs_bmap_commit_alloc_ptr(btree, nreq, dat); -@@ -2294,12 +2324,23 @@ static const struct nilfs_bmap_operation - .bop_gather_data = NULL, - }; - --int nilfs_btree_init(struct nilfs_bmap *bmap) -+static void __nilfs_btree_init(struct nilfs_bmap *bmap) - { - bmap->b_ops = &nilfs_btree_ops; - bmap->b_nchildren_per_block = - NILFS_BTREE_NODE_NCHILDREN_MAX(nilfs_btree_node_size(bmap)); -- return 0; -+} -+ -+int nilfs_btree_init(struct nilfs_bmap *bmap) -+{ -+ int ret = 0; -+ -+ __nilfs_btree_init(bmap); -+ -+ if (nilfs_btree_root_broken(nilfs_btree_get_root(bmap), -+ bmap->b_inode->i_ino)) -+ ret = -EIO; -+ return ret; - } - - void nilfs_btree_init_gc(struct nilfs_bmap *bmap) diff --git a/patches/nl80211-ignore-ht-vht-capabilities-without-qos-wmm.patch b/patches/nl80211-ignore-ht-vht-capabilities-without-qos-wmm.patch deleted file mode 100644 index 027fff9..0000000 --- a/patches/nl80211-ignore-ht-vht-capabilities-without-qos-wmm.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 496fcc294daab18799e190c0264863d653588d1f Mon Sep 17 00:00:00 2001 -From: Johannes Berg <johannes.berg@intel.com> -Date: Thu, 12 Mar 2015 08:53:27 +0200 -Subject: nl80211: ignore HT/VHT capabilities without QoS/WMM - -commit 496fcc294daab18799e190c0264863d653588d1f upstream. - -As HT/VHT depend heavily on QoS/WMM, it's not a good idea to -let userspace add clients that have HT/VHT but not QoS/WMM. -Since it does so in certain cases we've observed (client is -using HT IEs but not QoS/WMM) just ignore the HT/VHT info at -this point and don't pass it down to the drivers which might -unconditionally use it. - -Signed-off-by: Johannes Berg <johannes.berg@intel.com> -[lizf: Backported to 3.4: - - adjust context - - 3.4 doesn't support VHT] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/wireless/nl80211.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -2810,6 +2810,14 @@ static int nl80211_new_station(struct sk - if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) - return -EINVAL; - -+ /* HT requires QoS, but if we don't have that just ignore HT/VHT -+ * as userspace might just pass through the capabilities from the IEs -+ * directly, rather than enforcing this restriction and returning an -+ * error in this case. -+ */ -+ if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) -+ params.ht_capa = NULL; -+ - switch (dev->ieee80211_ptr->iftype) { - case NL80211_IFTYPE_AP: - case NL80211_IFTYPE_AP_VLAN: diff --git a/patches/ocfs2-_really_-sync-the-right-range.patch b/patches/ocfs2-_really_-sync-the-right-range.patch deleted file mode 100644 index a9fc4cf..0000000 --- a/patches/ocfs2-_really_-sync-the-right-range.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 64b4e2526d1cf6e6a4db6213d6e2b6e6ab59479a Mon Sep 17 00:00:00 2001 -From: Al Viro <viro@zeniv.linux.org.uk> -Date: Wed, 8 Apr 2015 17:00:32 -0400 -Subject: ocfs2: _really_ sync the right range - -commit 64b4e2526d1cf6e6a4db6213d6e2b6e6ab59479a upstream. - -"ocfs2 syncs the wrong range" had been broken; prior to it the -code was doing the wrong thing in case of O_APPEND, all right, -but _after_ it we were syncing the wrong range in 100% cases. -*ppos, aka iocb->ki_pos is incremented prior to that point, -so we are always doing sync on the area _after_ the one we'd -written to. - -Spotted by Joseph Qi <joseph.qi@huawei.com> back in January; -unfortunately, I'd missed his mail back then ;-/ - -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/ocfs2/file.c | 14 ++++++++++---- - 1 file changed, 10 insertions(+), 4 deletions(-) - ---- a/fs/ocfs2/file.c -+++ b/fs/ocfs2/file.c -@@ -2387,10 +2387,14 @@ out_dio: - /* buffered aio wouldn't have proper lock coverage today */ - BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT)); - -+ if (unlikely(written <= 0)) -+ goto no_sync; -+ - if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) || - ((file->f_flags & O_DIRECT) && !direct_io)) { -- ret = filemap_fdatawrite_range(file->f_mapping, *ppos, -- *ppos + count - 1); -+ ret = filemap_fdatawrite_range(file->f_mapping, -+ iocb->ki_pos - written, -+ iocb->ki_pos - 1); - if (ret < 0) - written = ret; - -@@ -2403,10 +2407,12 @@ out_dio: - } - - if (!ret) -- ret = filemap_fdatawait_range(file->f_mapping, *ppos, -- *ppos + count - 1); -+ ret = filemap_fdatawait_range(file->f_mapping, -+ iocb->ki_pos - written, -+ iocb->ki_pos - 1); - } - -+no_sync: - /* - * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io - * function pointer which is called when o_direct io completes so that diff --git a/patches/openvswitch-check-currect-return-value-from-skb_gso_segment.patch b/patches/openvswitch-check-currect-return-value-from-skb_gso_segment.patch deleted file mode 100644 index caf6ccb..0000000 --- a/patches/openvswitch-check-currect-return-value-from-skb_gso_segment.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 92e5dfc34cf39c20ae1087bd5e676238b5d0dfac Mon Sep 17 00:00:00 2001 -From: Pravin B Shelar <pshelar@nicira.com> -Date: Fri, 20 Jul 2012 14:46:29 -0700 -Subject: openvswitch: Check currect return value from skb_gso_segment() - -commit 92e5dfc34cf39c20ae1087bd5e676238b5d0dfac upstream. - -Fix return check typo. - -Signed-off-by: Pravin B Shelar <pshelar@nicira.com> -Signed-off-by: Jesse Gross <jesse@nicira.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/openvswitch/datapath.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/net/openvswitch/datapath.c -+++ b/net/openvswitch/datapath.c -@@ -269,8 +269,8 @@ static int queue_gso_packets(int dp_ifin - int err; - - segs = skb_gso_segment(skb, NETIF_F_SG | NETIF_F_HW_CSUM); -- if (IS_ERR(skb)) -- return PTR_ERR(skb); -+ if (IS_ERR(segs)) -+ return PTR_ERR(segs); - - /* Queue all of the segments. */ - skb = segs; diff --git a/patches/pci-convert-pcibios_resource_to_bus-to-take-a-pci_bus-not-a-pci_dev.patch b/patches/pci-convert-pcibios_resource_to_bus-to-take-a-pci_bus-not-a-pci_dev.patch deleted file mode 100644 index a5d852f..0000000 --- a/patches/pci-convert-pcibios_resource_to_bus-to-take-a-pci_bus-not-a-pci_dev.patch +++ /dev/null @@ -1,495 +0,0 @@ -From fc2798502f860b18f3c7121e4dc659d3d9d28d74 Mon Sep 17 00:00:00 2001 -From: Yinghai Lu <yinghai@kernel.org> -Date: Mon, 9 Dec 2013 22:54:40 -0800 -Subject: PCI: Convert pcibios_resource_to_bus() to take a pci_bus, not a - pci_dev - -commit fc2798502f860b18f3c7121e4dc659d3d9d28d74 upstream. - -These interfaces: - - pcibios_resource_to_bus(struct pci_dev *dev, *bus_region, *resource) - pcibios_bus_to_resource(struct pci_dev *dev, *resource, *bus_region) - -took a pci_dev, but they really depend only on the pci_bus. And we want to -use them in resource allocation paths where we have the bus but not a -device, so this patch converts them to take the pci_bus instead of the -pci_dev: - - pcibios_resource_to_bus(struct pci_bus *bus, *bus_region, *resource) - pcibios_bus_to_resource(struct pci_bus *bus, *resource, *bus_region) - -In fact, with standard PCI-PCI bridges, they only depend on the host -bridge, because that's the only place address translation occurs, but -we aren't going that far yet. - -[bhelgaas: changelog] -Signed-off-by: Yinghai Lu <yinghai@kernel.org> -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -Cc: Dirk Behme <dirk.behme@gmail.com> -[lizf: Backported to 3.4: - - make changes to pci_host_bridge() instead of find_pci_root_bus() - - adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/alpha/kernel/pci-sysfs.c | 4 +-- - arch/powerpc/kernel/pci_of_scan.c | 4 +-- - arch/powerpc/platforms/powernv/pci-ioda.c | 4 +-- - arch/sparc/kernel/pci.c | 12 +++++------ - drivers/pci/probe.c | 32 ++++++++++++++---------------- - drivers/pci/quirks.c | 2 - - drivers/pci/rom.c | 2 - - drivers/pci/setup-bus.c | 14 ++++++------- - drivers/pci/setup-res.c | 2 - - drivers/pcmcia/i82092.c | 2 - - drivers/pcmcia/yenta_socket.c | 6 ++--- - drivers/scsi/sym53c8xx_2/sym_glue.c | 5 ++-- - drivers/video/arkfb.c | 2 - - drivers/video/s3fb.c | 2 - - drivers/video/vt8623fb.c | 2 - - include/linux/pci.h | 4 +-- - 16 files changed, 49 insertions(+), 50 deletions(-) - ---- a/arch/alpha/kernel/pci-sysfs.c -+++ b/arch/alpha/kernel/pci-sysfs.c -@@ -84,7 +84,7 @@ static int pci_mmap_resource(struct kobj - if (iomem_is_exclusive(res->start)) - return -EINVAL; - -- pcibios_resource_to_bus(pdev, &bar, res); -+ pcibios_resource_to_bus(pdev->bus, &bar, res); - vma->vm_pgoff += bar.start >> (PAGE_SHIFT - (sparse ? 5 : 0)); - mmap_type = res->flags & IORESOURCE_MEM ? pci_mmap_mem : pci_mmap_io; - -@@ -140,7 +140,7 @@ static int sparse_mem_mmap_fits(struct p - long dense_offset; - unsigned long sparse_size; - -- pcibios_resource_to_bus(pdev, &bar, &pdev->resource[num]); -+ pcibios_resource_to_bus(pdev->bus, &bar, &pdev->resource[num]); - - /* All core logic chips have 4G sparse address space, except - CIA which has 16G (see xxx_SPARSE_MEM and xxx_DENSE_MEM ---- a/arch/powerpc/kernel/pci_of_scan.c -+++ b/arch/powerpc/kernel/pci_of_scan.c -@@ -111,7 +111,7 @@ static void of_pci_parse_addrs(struct de - res->name = pci_name(dev); - region.start = base; - region.end = base + size - 1; -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - } - } - -@@ -276,7 +276,7 @@ void __devinit of_scan_pci_bridge(struct - res->flags = flags; - region.start = of_read_number(&ranges[1], 2); - region.end = region.start + size - 1; -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - } - sprintf(bus->name, "PCI Bus %04x:%02x", pci_domain_nr(bus), - bus->number); ---- a/arch/sparc/kernel/pci.c -+++ b/arch/sparc/kernel/pci.c -@@ -409,7 +409,7 @@ static void __devinit pci_cfg_fake_range - res2.flags = res->flags; - region.start = base; - region.end = limit + 0xfff; -- pcibios_bus_to_resource(dev, &res2, ®ion); -+ pcibios_bus_to_resource(dev->bus, &res2, ®ion); - if (!res->start) - res->start = res2.start; - if (!res->end) -@@ -427,7 +427,7 @@ static void __devinit pci_cfg_fake_range - IORESOURCE_MEM); - region.start = base; - region.end = limit + 0xfffff; -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - } - - pci_read_config_word(dev, PCI_PREF_MEMORY_BASE, &mem_base_lo); -@@ -458,7 +458,7 @@ static void __devinit pci_cfg_fake_range - IORESOURCE_MEM | IORESOURCE_PREFETCH); - region.start = base; - region.end = limit + 0xfffff; -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - } - } - -@@ -480,7 +480,7 @@ static void __devinit apb_fake_ranges(st - res->flags = IORESOURCE_IO; - region.start = (first << 21); - region.end = (last << 21) + ((1 << 21) - 1); -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - - pci_read_config_byte(dev, APB_MEM_ADDRESS_MAP, &map); - apb_calc_first_last(map, &first, &last); -@@ -488,7 +488,7 @@ static void __devinit apb_fake_ranges(st - res->flags = IORESOURCE_MEM; - region.start = (first << 29); - region.end = (last << 29) + ((1 << 29) - 1); -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - } - - static void __devinit pci_of_scan_bus(struct pci_pbm_info *pbm, -@@ -579,7 +579,7 @@ static void __devinit of_scan_pci_bridge - res->flags = flags; - region.start = GET_64BIT(ranges, 1); - region.end = region.start + size - 1; -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - } - after_ranges: - sprintf(bus->name, "PCI Bus %04x:%02x", pci_domain_nr(bus), ---- a/drivers/pci/probe.c -+++ b/drivers/pci/probe.c -@@ -44,12 +44,10 @@ int no_pci_devices(void) - } - EXPORT_SYMBOL(no_pci_devices); - --static struct pci_host_bridge *pci_host_bridge(struct pci_dev *dev) -+static struct pci_host_bridge *pci_host_bridge(struct pci_bus *bus) - { -- struct pci_bus *bus; - struct pci_host_bridge *bridge; - -- bus = dev->bus; - while (bus->parent) - bus = bus->parent; - -@@ -66,10 +64,10 @@ static bool resource_contains(struct res - return res1->start <= res2->start && res1->end >= res2->end; - } - --void pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region, -+void pcibios_resource_to_bus(struct pci_bus *bus, struct pci_bus_region *region, - struct resource *res) - { -- struct pci_host_bridge *bridge = pci_host_bridge(dev); -+ struct pci_host_bridge *bridge = pci_host_bridge(bus); - struct pci_host_bridge_window *window; - resource_size_t offset = 0; - -@@ -94,10 +92,10 @@ static bool region_contains(struct pci_b - return region1->start <= region2->start && region1->end >= region2->end; - } - --void pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res, -+void pcibios_bus_to_resource(struct pci_bus *bus, struct resource *res, - struct pci_bus_region *region) - { -- struct pci_host_bridge *bridge = pci_host_bridge(dev); -+ struct pci_host_bridge *bridge = pci_host_bridge(bus); - struct pci_host_bridge_window *window; - struct pci_bus_region bus_region; - resource_size_t offset = 0; -@@ -298,11 +296,11 @@ int __pci_read_base(struct pci_dev *dev, - pci_write_config_dword(dev, pos + 4, 0); - region.start = 0; - region.end = sz64; -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - } else { - region.start = l64; - region.end = l64 + sz64; -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n", - pos, res); - } -@@ -314,7 +312,7 @@ int __pci_read_base(struct pci_dev *dev, - - region.start = l; - region.end = l + sz; -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - - dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n", pos, res); - } -@@ -373,7 +371,7 @@ static void __devinit pci_read_bridge_io - res2.flags = res->flags; - region.start = base; - region.end = limit + 0xfff; -- pcibios_bus_to_resource(dev, &res2, ®ion); -+ pcibios_bus_to_resource(dev->bus, &res2, ®ion); - if (!res->start) - res->start = res2.start; - if (!res->end) -@@ -399,7 +397,7 @@ static void __devinit pci_read_bridge_mm - res->flags = (mem_base_lo & PCI_MEMORY_RANGE_TYPE_MASK) | IORESOURCE_MEM; - region.start = base; - region.end = limit + 0xfffff; -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - dev_printk(KERN_DEBUG, &dev->dev, " bridge window %pR\n", res); - } - } -@@ -448,7 +446,7 @@ static void __devinit pci_read_bridge_mm - res->flags |= IORESOURCE_MEM_64; - region.start = base; - region.end = limit + 0xfffff; -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - dev_printk(KERN_DEBUG, &dev->dev, " bridge window %pR\n", res); - } - } -@@ -1063,24 +1061,24 @@ int pci_setup_device(struct pci_dev *dev - region.end = 0x1F7; - res = &dev->resource[0]; - res->flags = LEGACY_IO_RESOURCE; -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - region.start = 0x3F6; - region.end = 0x3F6; - res = &dev->resource[1]; - res->flags = LEGACY_IO_RESOURCE; -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - } - if ((progif & 4) == 0) { - region.start = 0x170; - region.end = 0x177; - res = &dev->resource[2]; - res->flags = LEGACY_IO_RESOURCE; -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - region.start = 0x376; - region.end = 0x376; - res = &dev->resource[3]; - res->flags = LEGACY_IO_RESOURCE; -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - } - } - break; ---- a/drivers/pci/rom.c -+++ b/drivers/pci/rom.c -@@ -31,7 +31,7 @@ int pci_enable_rom(struct pci_dev *pdev) - if (!res->flags) - return -1; - -- pcibios_resource_to_bus(pdev, ®ion, res); -+ pcibios_resource_to_bus(pdev->bus, ®ion, res); - pci_read_config_dword(pdev, pdev->rom_base_reg, &rom_addr); - rom_addr &= ~PCI_ROM_ADDRESS_MASK; - rom_addr |= region.start | PCI_ROM_ADDRESS_ENABLE; ---- a/drivers/pci/setup-bus.c -+++ b/drivers/pci/setup-bus.c -@@ -408,7 +408,7 @@ void pci_setup_cardbus(struct pci_bus *b - bus->secondary, bus->subordinate); - - res = bus->resource[0]; -- pcibios_resource_to_bus(bridge, ®ion, res); -+ pcibios_resource_to_bus(bridge->bus, ®ion, res); - if (res->flags & IORESOURCE_IO) { - /* - * The IO resource is allocated a range twice as large as it -@@ -422,7 +422,7 @@ void pci_setup_cardbus(struct pci_bus *b - } - - res = bus->resource[1]; -- pcibios_resource_to_bus(bridge, ®ion, res); -+ pcibios_resource_to_bus(bridge->bus, ®ion, res); - if (res->flags & IORESOURCE_IO) { - dev_info(&bridge->dev, " bridge window %pR\n", res); - pci_write_config_dword(bridge, PCI_CB_IO_BASE_1, -@@ -432,7 +432,7 @@ void pci_setup_cardbus(struct pci_bus *b - } - - res = bus->resource[2]; -- pcibios_resource_to_bus(bridge, ®ion, res); -+ pcibios_resource_to_bus(bridge->bus, ®ion, res); - if (res->flags & IORESOURCE_MEM) { - dev_info(&bridge->dev, " bridge window %pR\n", res); - pci_write_config_dword(bridge, PCI_CB_MEMORY_BASE_0, -@@ -442,7 +442,7 @@ void pci_setup_cardbus(struct pci_bus *b - } - - res = bus->resource[3]; -- pcibios_resource_to_bus(bridge, ®ion, res); -+ pcibios_resource_to_bus(bridge->bus, ®ion, res); - if (res->flags & IORESOURCE_MEM) { - dev_info(&bridge->dev, " bridge window %pR\n", res); - pci_write_config_dword(bridge, PCI_CB_MEMORY_BASE_1, -@@ -473,7 +473,7 @@ static void pci_setup_bridge_io(struct p - - /* Set up the top and bottom of the PCI I/O segment for this bus. */ - res = bus->resource[0]; -- pcibios_resource_to_bus(bridge, ®ion, res); -+ pcibios_resource_to_bus(bridge->bus, ®ion, res); - if (res->flags & IORESOURCE_IO) { - pci_read_config_dword(bridge, PCI_IO_BASE, &l); - l &= 0xffff0000; -@@ -504,7 +504,7 @@ static void pci_setup_bridge_mmio(struct - - /* Set up the top and bottom of the PCI Memory segment for this bus. */ - res = bus->resource[1]; -- pcibios_resource_to_bus(bridge, ®ion, res); -+ pcibios_resource_to_bus(bridge->bus, ®ion, res); - if (res->flags & IORESOURCE_MEM) { - l = (region.start >> 16) & 0xfff0; - l |= region.end & 0xfff00000; -@@ -530,7 +530,7 @@ static void pci_setup_bridge_mmio_pref(s - /* Set up PREF base/limit. */ - bu = lu = 0; - res = bus->resource[2]; -- pcibios_resource_to_bus(bridge, ®ion, res); -+ pcibios_resource_to_bus(bridge->bus, ®ion, res); - if (res->flags & IORESOURCE_PREFETCH) { - l = (region.start >> 16) & 0xfff0; - l |= region.end & 0xfff00000; ---- a/drivers/pci/setup-res.c -+++ b/drivers/pci/setup-res.c -@@ -50,7 +50,7 @@ void pci_update_resource(struct pci_dev - if (res->flags & IORESOURCE_PCI_FIXED) - return; - -- pcibios_resource_to_bus(dev, ®ion, res); -+ pcibios_resource_to_bus(dev->bus, ®ion, res); - - new = region.start | (res->flags & PCI_REGION_FLAG_MASK); - if (res->flags & IORESOURCE_IO) ---- a/drivers/pcmcia/i82092.c -+++ b/drivers/pcmcia/i82092.c -@@ -610,7 +610,7 @@ static int i82092aa_set_mem_map(struct p - - enter("i82092aa_set_mem_map"); - -- pcibios_resource_to_bus(sock_info->dev, ®ion, mem->res); -+ pcibios_resource_to_bus(sock_info->dev->bus, ®ion, mem->res); - - map = mem->map; - if (map > 4) { ---- a/drivers/pcmcia/yenta_socket.c -+++ b/drivers/pcmcia/yenta_socket.c -@@ -445,7 +445,7 @@ static int yenta_set_mem_map(struct pcmc - unsigned int start, stop, card_start; - unsigned short word; - -- pcibios_resource_to_bus(socket->dev, ®ion, mem->res); -+ pcibios_resource_to_bus(socket->dev->bus, ®ion, mem->res); - - map = mem->map; - start = region.start; -@@ -709,7 +709,7 @@ static int yenta_allocate_res(struct yen - region.start = config_readl(socket, addr_start) & mask; - region.end = config_readl(socket, addr_end) | ~mask; - if (region.start && region.end > region.start && !override_bios) { -- pcibios_bus_to_resource(dev, res, ®ion); -+ pcibios_bus_to_resource(dev->bus, res, ®ion); - if (pci_claim_resource(dev, PCI_BRIDGE_RESOURCES + nr) == 0) - return 0; - dev_printk(KERN_INFO, &dev->dev, -@@ -1033,7 +1033,7 @@ static void yenta_config_init(struct yen - struct pci_dev *dev = socket->dev; - struct pci_bus_region region; - -- pcibios_resource_to_bus(socket->dev, ®ion, &dev->resource[0]); -+ pcibios_resource_to_bus(socket->dev->bus, ®ion, &dev->resource[0]); - - config_writel(socket, CB_LEGACY_MODE_BASE, 0); - config_writel(socket, PCI_BASE_ADDRESS_0, region.start); ---- a/drivers/scsi/sym53c8xx_2/sym_glue.c -+++ b/drivers/scsi/sym53c8xx_2/sym_glue.c -@@ -1609,7 +1609,7 @@ sym_iomap_device(struct sym_device *devi - struct pci_bus_region bus_addr; - int i = 2; - -- pcibios_resource_to_bus(pdev, &bus_addr, &pdev->resource[1]); -+ pcibios_resource_to_bus(pdev->bus, &bus_addr, &pdev->resource[1]); - device->mmio_base = bus_addr.start; - - if (device->chip.features & FE_RAM) { -@@ -1619,7 +1619,8 @@ sym_iomap_device(struct sym_device *devi - */ - if (!pdev->resource[i].flags) - i++; -- pcibios_resource_to_bus(pdev, &bus_addr, &pdev->resource[i]); -+ pcibios_resource_to_bus(pdev->bus, &bus_addr, -+ &pdev->resource[i]); - device->ram_base = bus_addr.start; - } - ---- a/drivers/video/arkfb.c -+++ b/drivers/video/arkfb.c -@@ -1014,7 +1014,7 @@ static int __devinit ark_pci_probe(struc - - vga_res.flags = IORESOURCE_IO; - -- pcibios_bus_to_resource(dev, &vga_res, &bus_reg); -+ pcibios_bus_to_resource(dev->bus, &vga_res, &bus_reg); - - par->state.vgabase = (void __iomem *) vga_res.start; - ---- a/drivers/video/s3fb.c -+++ b/drivers/video/s3fb.c -@@ -1172,7 +1172,7 @@ static int __devinit s3_pci_probe(struct - - vga_res.flags = IORESOURCE_IO; - -- pcibios_bus_to_resource(dev, &vga_res, &bus_reg); -+ pcibios_bus_to_resource(dev->bus, &vga_res, &bus_reg); - - par->state.vgabase = (void __iomem *) vga_res.start; - ---- a/drivers/video/vt8623fb.c -+++ b/drivers/video/vt8623fb.c -@@ -727,7 +727,7 @@ static int __devinit vt8623_pci_probe(st - - vga_res.flags = IORESOURCE_IO; - -- pcibios_bus_to_resource(dev, &vga_res, &bus_reg); -+ pcibios_bus_to_resource(dev->bus, &vga_res, &bus_reg); - - par->state.vgabase = (void __iomem *) vga_res.start; - ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -648,9 +648,9 @@ void pci_fixup_cardbus(struct pci_bus *) - - /* Generic PCI functions used internally */ - --void pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region, -+void pcibios_resource_to_bus(struct pci_bus *bus, struct pci_bus_region *region, - struct resource *res); --void pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res, -+void pcibios_bus_to_resource(struct pci_bus *bus, struct resource *res, - struct pci_bus_region *region); - void pcibios_scan_specific_bus(int busn); - extern struct pci_bus *pci_find_bus(int domain, int busnr); ---- a/arch/powerpc/platforms/powernv/pci-ioda.c -+++ b/arch/powerpc/platforms/powernv/pci-ioda.c -@@ -392,7 +392,7 @@ static void __devinit pnv_ioda_setup_pe_ - - /* Setup IO segments */ - if (io_res.start < io_res.end) { -- pcibios_resource_to_bus(dev, ®ion, &io_res); -+ pcibios_resource_to_bus(dev->bus, ®ion, &io_res); - pos = region.start; - i = pos / phb->ioda.io_segsize; - while(i < phb->ioda.total_pe && pos <= region.end) { -@@ -422,7 +422,7 @@ static void __devinit pnv_ioda_setup_pe_ - - /* Setup M32 segments */ - if (m32_res.start < m32_res.end) { -- pcibios_resource_to_bus(dev, ®ion, &m32_res); -+ pcibios_resource_to_bus(dev->bus, ®ion, &m32_res); - pos = region.start; - i = pos / phb->ioda.m32_segsize; - while(i < phb->ioda.total_pe && pos <= region.end) { ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -393,7 +393,7 @@ static void __devinit quirk_io_region(st - /* Convert from PCI bus to resource space. */ - bus_region.start = res->start; - bus_region.end = res->end; -- pcibios_bus_to_resource(dev, res, &bus_region); -+ pcibios_bus_to_resource(dev->bus, res, &bus_region); - - if (pci_claim_resource(dev, nr) == 0) - dev_info(&dev->dev, "quirk: %pR claimed by %s\n", diff --git a/patches/pci-fix-infinite-loop-with-rom-image-of-size-0.patch b/patches/pci-fix-infinite-loop-with-rom-image-of-size-0.patch deleted file mode 100644 index 0be5038..0000000 --- a/patches/pci-fix-infinite-loop-with-rom-image-of-size-0.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 16b036af31e1456cb69243a5a0c9ef801ecd1f17 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com> -Date: Mon, 19 Jan 2015 17:53:20 +0900 -Subject: PCI: Fix infinite loop with ROM image of size 0 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 16b036af31e1456cb69243a5a0c9ef801ecd1f17 upstream. - -If the image size would ever read as 0, pci_get_rom_size() could keep -processing the same image over and over again. Exit the loop if we ever -read a length of zero. - -This fixes a soft lockup on boot when the radeon driver calls -pci_get_rom_size() on an AMD Radeon R7 250X PCIe discrete graphics card. - -[bhelgaas: changelog, reference] -Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1386973 -Reported-by: Federico <federicotg@gmail.com> -Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -Reviewed-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/pci/rom.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - ---- a/drivers/pci/rom.c -+++ b/drivers/pci/rom.c -@@ -69,6 +69,7 @@ size_t pci_get_rom_size(struct pci_dev * - { - void __iomem *image; - int last_image; -+ unsigned length; - - image = rom; - do { -@@ -91,9 +92,9 @@ size_t pci_get_rom_size(struct pci_dev * - if (readb(pds + 3) != 'R') - break; - last_image = readb(pds + 21) & 0x80; -- /* this length is reliable */ -- image += readw(pds + 16) * 512; -- } while (!last_image); -+ length = readw(pds + 16); -+ image += length * 512; -+ } while (length && !last_image); - - /* never return a size larger than the PCI resource window */ - /* there are known ROMs that get the size wrong */ diff --git a/patches/pci-generate-uppercase-hex-for-modalias-var-in-uevent.patch b/patches/pci-generate-uppercase-hex-for-modalias-var-in-uevent.patch deleted file mode 100644 index 1c450a3..0000000 --- a/patches/pci-generate-uppercase-hex-for-modalias-var-in-uevent.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 145b3fe579db66fbe999a2bc3fd5b63dffe9636d Mon Sep 17 00:00:00 2001 -From: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com> -Date: Tue, 2 Dec 2014 17:35:04 +0100 -Subject: PCI: Generate uppercase hex for modalias var in uevent - -commit 145b3fe579db66fbe999a2bc3fd5b63dffe9636d upstream. - -Some implementations of modprobe fail to load the driver for a PCI device -automatically because the "interface" part of the modalias from the kernel -is lowercase, and the modalias from file2alias is uppercase. - -The "interface" is the low-order byte of the Class Code, defined in PCI -r3.0, Appendix D. Most interface types defined in the spec do not use -alpha characters, so they won't be affected. For example, 00h, 01h, 10h, -20h, etc. are unaffected. - -Print the "interface" byte of the Class Code in uppercase hex, as we -already do for the Vendor ID, Device ID, Class, etc. - -Commit 89ec3dcf17fd ("PCI: Generate uppercase hex for modalias interface -class") fixed only half of the problem. Some udev implementations rely on -the uevent file and not the modalias file. - -Fixes: d1ded203adf1 ("PCI: add MODALIAS to hotplug event for pci devices") -Fixes: 89ec3dcf17fd ("PCI: Generate uppercase hex for modalias interface class") -Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com> -Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> -Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -[lizf: Backported to 3.4: adjust filename] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/pci/hotplug.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/pci/hotplug.c -+++ b/drivers/pci/hotplug.c -@@ -27,7 +27,7 @@ int pci_uevent(struct device *dev, struc - if (add_uevent_var(env, "PCI_SLOT_NAME=%s", pci_name(pdev))) - return -ENOMEM; - -- if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x", -+ if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02X", - pdev->vendor, pdev->device, - pdev->subsystem_vendor, pdev->subsystem_device, - (u8)(pdev->class >> 16), (u8)(pdev->class >> 8), diff --git a/patches/perf-fix-irq_work-tail-recursion.patch b/patches/perf-fix-irq_work-tail-recursion.patch deleted file mode 100644 index 736c00a..0000000 --- a/patches/perf-fix-irq_work-tail-recursion.patch +++ /dev/null @@ -1,75 +0,0 @@ -From d525211f9d1be8b523ec7633f080f2116f5ea536 Mon Sep 17 00:00:00 2001 -From: Peter Zijlstra <peterz@infradead.org> -Date: Thu, 19 Feb 2015 18:03:11 +0100 -Subject: perf: Fix irq_work 'tail' recursion - -commit d525211f9d1be8b523ec7633f080f2116f5ea536 upstream. - -Vince reported a watchdog lockup like: - - [<ffffffff8115e114>] perf_tp_event+0xc4/0x210 - [<ffffffff810b4f8a>] perf_trace_lock+0x12a/0x160 - [<ffffffff810b7f10>] lock_release+0x130/0x260 - [<ffffffff816c7474>] _raw_spin_unlock_irqrestore+0x24/0x40 - [<ffffffff8107bb4d>] do_send_sig_info+0x5d/0x80 - [<ffffffff811f69df>] send_sigio_to_task+0x12f/0x1a0 - [<ffffffff811f71ce>] send_sigio+0xae/0x100 - [<ffffffff811f72b7>] kill_fasync+0x97/0xf0 - [<ffffffff8115d0b4>] perf_event_wakeup+0xd4/0xf0 - [<ffffffff8115d103>] perf_pending_event+0x33/0x60 - [<ffffffff8114e3fc>] irq_work_run_list+0x4c/0x80 - [<ffffffff8114e448>] irq_work_run+0x18/0x40 - [<ffffffff810196af>] smp_trace_irq_work_interrupt+0x3f/0xc0 - [<ffffffff816c99bd>] trace_irq_work_interrupt+0x6d/0x80 - -Which is caused by an irq_work generating new irq_work and therefore -not allowing forward progress. - -This happens because processing the perf irq_work triggers another -perf event (tracepoint stuff) which in turn generates an irq_work ad -infinitum. - -Avoid this by raising the recursion counter in the irq_work -- which -effectively disables all software events (including tracepoints) from -actually triggering again. - -Reported-by: Vince Weaver <vincent.weaver@maine.edu> -Tested-by: Vince Weaver <vincent.weaver@maine.edu> -Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> -Cc: Arnaldo Carvalho de Melo <acme@kernel.org> -Cc: Jiri Olsa <jolsa@redhat.com> -Cc: Paul Mackerras <paulus@samba.org> -Cc: Steven Rostedt <rostedt@goodmis.org> -Link: http://lkml.kernel.org/r/20150219170311.GH21418@twins.programming.kicks-ass.net -Signed-off-by: Ingo Molnar <mingo@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/events/core.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -3877,6 +3877,13 @@ static void perf_pending_event(struct ir - { - struct perf_event *event = container_of(entry, - struct perf_event, pending); -+ int rctx; -+ -+ rctx = perf_swevent_get_recursion_context(); -+ /* -+ * If we 'fail' here, that's OK, it means recursion is already disabled -+ * and we won't recurse 'further'. -+ */ - - if (event->pending_disable) { - event->pending_disable = 0; -@@ -3887,6 +3894,9 @@ static void perf_pending_event(struct ir - event->pending_wakeup = 0; - perf_event_wakeup(event); - } -+ -+ if (rctx >= 0) -+ perf_swevent_put_recursion_context(rctx); - } - - /* diff --git a/patches/perf-tools-fix-build-with-perl-5.18.patch b/patches/perf-tools-fix-build-with-perl-5.18.patch deleted file mode 100644 index 3de3979..0000000 --- a/patches/perf-tools-fix-build-with-perl-5.18.patch +++ /dev/null @@ -1,74 +0,0 @@ -From 575bf1d04e908469d26da424b52fc1b12a1db9d8 Mon Sep 17 00:00:00 2001 -From: "Kirill A. Shutemov" <kirill@shutemov.name> -Date: Mon, 24 Jun 2013 11:43:14 +0300 -Subject: perf tools: Fix build with perl 5.18 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 575bf1d04e908469d26da424b52fc1b12a1db9d8 upstream. - -perl.h from new Perl release doesn't like -Wundef and -Wswitch-default: - -/usr/lib/perl5/core_perl/CORE/perl.h:548:5: error: "SILENT_NO_TAINT_SUPPORT" is not defined [-Werror=undef] - #if SILENT_NO_TAINT_SUPPORT && !defined(NO_TAINT_SUPPORT) - ^ -/usr/lib/perl5/core_perl/CORE/perl.h:556:5: error: "NO_TAINT_SUPPORT" is not defined [-Werror=undef] - #if NO_TAINT_SUPPORT - ^ -In file included from /usr/lib/perl5/core_perl/CORE/perl.h:3471:0, - from util/scripting-engines/trace-event-perl.c:30: -/usr/lib/perl5/core_perl/CORE/sv.h:1455:5: error: "NO_TAINT_SUPPORT" is not defined [-Werror=undef] - #if NO_TAINT_SUPPORT - ^ -In file included from /usr/lib/perl5/core_perl/CORE/perl.h:3472:0, - from util/scripting-engines/trace-event-perl.c:30: -/usr/lib/perl5/core_perl/CORE/regexp.h:436:5: error: "NO_TAINT_SUPPORT" is not defined [-Werror=undef] - #if NO_TAINT_SUPPORT - ^ -In file included from /usr/lib/perl5/core_perl/CORE/hv.h:592:0, - from /usr/lib/perl5/core_perl/CORE/perl.h:3480, - from util/scripting-engines/trace-event-perl.c:30: -/usr/lib/perl5/core_perl/CORE/hv_func.h: In function ‘S_perl_hash_siphash_2_4’: -/usr/lib/perl5/core_perl/CORE/hv_func.h:222:3: error: switch missing default case [-Werror=switch-default] - switch( left ) - ^ -/usr/lib/perl5/core_perl/CORE/hv_func.h: In function ‘S_perl_hash_superfast’: -/usr/lib/perl5/core_perl/CORE/hv_func.h:274:5: error: switch missing default case [-Werror=switch-default] - switch (rem) { \ - ^ -/usr/lib/perl5/core_perl/CORE/hv_func.h: In function ‘S_perl_hash_murmur3’: -/usr/lib/perl5/core_perl/CORE/hv_func.h:398:5: error: switch missing default case [-Werror=switch-default] - switch(bytes_in_carry) { /* how many bytes in carry */ - ^ - -Let's disable the warnings for code which uses perl.h. - -Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name> -Cc: Ingo Molnar <mingo@redhat.com> -Cc: Paul Mackerras <paulus@samba.org> -Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> -Link: http://lkml.kernel.org/r/1372063394-20126-1-git-send-email-kirill@shutemov.name -Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -Cc: Vinson Lee <vlee@twopensource.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - tools/perf/Makefile | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/tools/perf/Makefile -+++ b/tools/perf/Makefile -@@ -816,10 +816,10 @@ $(OUTPUT)util/rbtree.o: ../../lib/rbtree - $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) -DETC_PERFCONFIG='"$(ETC_PERFCONFIG_SQ)"' $< - - $(OUTPUT)util/scripting-engines/trace-event-perl.o: util/scripting-engines/trace-event-perl.c $(OUTPUT)PERF-CFLAGS -- $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow $< -+ $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow -Wno-undef -Wno-switch-default $< - - $(OUTPUT)scripts/perl/Perf-Trace-Util/Context.o: scripts/perl/Perf-Trace-Util/Context.c $(OUTPUT)PERF-CFLAGS -- $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-nested-externs $< -+ $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-nested-externs -Wno-undef -Wno-switch-default $< - - $(OUTPUT)util/scripting-engines/trace-event-python.o: util/scripting-engines/trace-event-python.c $(OUTPUT)PERF-CFLAGS - $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PYTHON_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow $< diff --git a/patches/powerpc-mpc85xx-add-ranges-to-etsec2-nodes.patch b/patches/powerpc-mpc85xx-add-ranges-to-etsec2-nodes.patch deleted file mode 100644 index 7702a64..0000000 --- a/patches/powerpc-mpc85xx-add-ranges-to-etsec2-nodes.patch +++ /dev/null @@ -1,53 +0,0 @@ -From bb344ca5b90df62b1a3b7a35c6a9d00b306a170d Mon Sep 17 00:00:00 2001 -From: Scott Wood <scottwood@freescale.com> -Date: Wed, 17 Dec 2014 19:06:31 -0600 -Subject: powerpc/mpc85xx: Add ranges to etsec2 nodes - -commit bb344ca5b90df62b1a3b7a35c6a9d00b306a170d upstream. - -Commit 746c9e9f92dd "of/base: Fix PowerPC address parsing hack" limited -the applicability of the workaround whereby a missing ranges is treated -as an empty ranges. This workaround was hiding a bug in the etsec2 -device tree nodes, which have children with reg, but did not have -ranges. - -Signed-off-by: Scott Wood <scottwood@freescale.com> -Reported-by: Alexander Graf <agraf@suse.de> -Cc: Scott Wood <scottwood@freescale.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi | 1 + - arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi | 1 + - arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi | 1 + - 3 files changed, 3 insertions(+) - ---- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi -+++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi -@@ -50,6 +50,7 @@ ethernet@b0000 { - fsl,num_tx_queues = <0x8>; - fsl,magic-packet; - local-mac-address = [ 00 00 00 00 00 00 ]; -+ ranges; - - queue-group@b0000 { - #address-cells = <1>; ---- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi -+++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi -@@ -50,6 +50,7 @@ ethernet@b1000 { - fsl,num_tx_queues = <0x8>; - fsl,magic-packet; - local-mac-address = [ 00 00 00 00 00 00 ]; -+ ranges; - - queue-group@b1000 { - #address-cells = <1>; ---- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi -+++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi -@@ -49,6 +49,7 @@ ethernet@b2000 { - fsl,num_tx_queues = <0x8>; - fsl,magic-packet; - local-mac-address = [ 00 00 00 00 00 00 ]; -+ ranges; - - queue-group@b2000 { - #address-cells = <1>; diff --git a/patches/radeon-do-not-directly-dereference-pointers-to-bios-area.patch b/patches/radeon-do-not-directly-dereference-pointers-to-bios-area.patch deleted file mode 100644 index ad8b85c..0000000 --- a/patches/radeon-do-not-directly-dereference-pointers-to-bios-area.patch +++ /dev/null @@ -1,53 +0,0 @@ -From f2c9e560b406f2f6b14b345c7da33467dee9cdf2 Mon Sep 17 00:00:00 2001 -From: David Miller <davem@davemloft.net> -Date: Wed, 18 Mar 2015 23:18:40 -0400 -Subject: radeon: Do not directly dereference pointers to BIOS area. -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit f2c9e560b406f2f6b14b345c7da33467dee9cdf2 upstream. - -Use readb() and memcpy_fromio() accessors instead. - -Reviewed-by: Christian König <christian.koenig@amd.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/gpu/drm/radeon/radeon_bios.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - ---- a/drivers/gpu/drm/radeon/radeon_bios.c -+++ b/drivers/gpu/drm/radeon/radeon_bios.c -@@ -76,7 +76,7 @@ static bool igp_read_bios_from_vram(stru - - static bool radeon_read_bios(struct radeon_device *rdev) - { -- uint8_t __iomem *bios; -+ uint8_t __iomem *bios, val1, val2; - size_t size; - - rdev->bios = NULL; -@@ -86,15 +86,19 @@ static bool radeon_read_bios(struct rade - return false; - } - -- if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) { -+ val1 = readb(&bios[0]); -+ val2 = readb(&bios[1]); -+ -+ if (size == 0 || val1 != 0x55 || val2 != 0xaa) { - pci_unmap_rom(rdev->pdev, bios); - return false; - } -- rdev->bios = kmemdup(bios, size, GFP_KERNEL); -+ rdev->bios = kzalloc(size, GFP_KERNEL); - if (rdev->bios == NULL) { - pci_unmap_rom(rdev->pdev, bios); - return false; - } -+ memcpy_fromio(rdev->bios, bios, size); - pci_unmap_rom(rdev->pdev, bios); - return true; - } diff --git a/patches/rtnetlink-ifla_vf_policy-fix-misuses-of-nla_binary.patch b/patches/rtnetlink-ifla_vf_policy-fix-misuses-of-nla_binary.patch deleted file mode 100644 index 5d5e7ec..0000000 --- a/patches/rtnetlink-ifla_vf_policy-fix-misuses-of-nla_binary.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 364d5716a7adb91b731a35765d369602d68d2881 Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann <daniel@iogearbox.net> -Date: Thu, 5 Feb 2015 18:44:04 +0100 -Subject: rtnetlink: ifla_vf_policy: fix misuses of NLA_BINARY - -commit 364d5716a7adb91b731a35765d369602d68d2881 upstream. - -ifla_vf_policy[] is wrong in advertising its individual member types as -NLA_BINARY since .type = NLA_BINARY in combination with .len declares the -len member as *max* attribute length [0, len]. - -The issue is that when do_setvfinfo() is being called to set up a VF -through ndo handler, we could set corrupted data if the attribute length -is less than the size of the related structure itself. - -The intent is exactly the opposite, namely to make sure to pass at least -data of minimum size of len. - -Fixes: ebc08a6f47ee ("rtnetlink: Add VF config code to rtnetlink") -Cc: Mitch Williams <mitch.a.williams@intel.com> -Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com> -Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> -Acked-by: Thomas Graf <tgraf@suug.ch> -Signed-off-by: David S. Miller <davem@davemloft.net> -[lizf: Backported to 3.4: drop changes to IFLA_VF_RATE and IFLA_VF_LINK_STATE] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/core/rtnetlink.c | 12 ++++-------- - 1 file changed, 4 insertions(+), 8 deletions(-) - ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -1144,14 +1144,10 @@ static const struct nla_policy ifla_vfin - }; - - static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = { -- [IFLA_VF_MAC] = { .type = NLA_BINARY, -- .len = sizeof(struct ifla_vf_mac) }, -- [IFLA_VF_VLAN] = { .type = NLA_BINARY, -- .len = sizeof(struct ifla_vf_vlan) }, -- [IFLA_VF_TX_RATE] = { .type = NLA_BINARY, -- .len = sizeof(struct ifla_vf_tx_rate) }, -- [IFLA_VF_SPOOFCHK] = { .type = NLA_BINARY, -- .len = sizeof(struct ifla_vf_spoofchk) }, -+ [IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) }, -+ [IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) }, -+ [IFLA_VF_TX_RATE] = { .len = sizeof(struct ifla_vf_tx_rate) }, -+ [IFLA_VF_SPOOFCHK] = { .len = sizeof(struct ifla_vf_spoofchk) }, - }; - - static const struct nla_policy ifla_port_policy[IFLA_PORT_MAX+1] = { diff --git a/patches/sb_edac-fix-erroneous-bytes-gigabytes-conversion.patch b/patches/sb_edac-fix-erroneous-bytes-gigabytes-conversion.patch deleted file mode 100644 index c70a941..0000000 --- a/patches/sb_edac-fix-erroneous-bytes-gigabytes-conversion.patch +++ /dev/null @@ -1,142 +0,0 @@ -From 8c009100295597f23978c224aec5751a365bc965 Mon Sep 17 00:00:00 2001 -From: Jim Snow <jim.m.snow@intel.com> -Date: Tue, 18 Nov 2014 14:51:09 +0100 -Subject: sb_edac: Fix erroneous bytes->gigabytes conversion - -commit 8c009100295597f23978c224aec5751a365bc965 upstream. - -Signed-off-by: Jim Snow <jim.snow@intel.com> -Signed-off-by: Lukasz Anaczkowski <lukasz.anaczkowski@intel.com> -Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> -Cc: Vinson Lee <vlee@twopensource.com> -[lizf: Backported to 3.4: - - adjust context - - use debugf0() instead of edac_dbg()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/edac/sb_edac.c | 38 +++++++++++++++++++------------------- - 1 file changed, 19 insertions(+), 19 deletions(-) - ---- a/drivers/edac/sb_edac.c -+++ b/drivers/edac/sb_edac.c -@@ -672,7 +672,7 @@ static void get_memory_layout(const stru - u32 reg; - u64 limit, prv = 0; - u64 tmp_mb; -- u32 mb, kb; -+ u32 gb, mb; - u32 rir_way; - - /* -@@ -685,9 +685,9 @@ static void get_memory_layout(const stru - pvt->tolm = GET_TOLM(reg); - tmp_mb = (1 + pvt->tolm) >> 20; - -- mb = div_u64_rem(tmp_mb, 1000, &kb); -- debugf0("TOLM: %u.%03u GB (0x%016Lx)\n", -- mb, kb, (u64)pvt->tolm); -+ gb = div_u64_rem(tmp_mb, 1024, &mb); -+ debugf0("TOHM: %u.%03u GB (0x%016Lx)\n", -+ gb, (mb*1000)/1024, (u64)pvt->tohm); - - /* Address range is already 45:25 */ - pci_read_config_dword(pvt->pci_sad1, TOHM, -@@ -695,9 +695,9 @@ static void get_memory_layout(const stru - pvt->tohm = GET_TOHM(reg); - tmp_mb = (1 + pvt->tohm) >> 20; - -- mb = div_u64_rem(tmp_mb, 1000, &kb); -+ gb = div_u64_rem(tmp_mb, 1024, &mb); - debugf0("TOHM: %u.%03u GB (0x%016Lx)", -- mb, kb, (u64)pvt->tohm); -+ gb, (mb*1000)/1024, (u64)pvt->tohm); - - /* - * Step 2) Get SAD range and SAD Interleave list -@@ -719,11 +719,11 @@ static void get_memory_layout(const stru - break; - - tmp_mb = (limit + 1) >> 20; -- mb = div_u64_rem(tmp_mb, 1000, &kb); -+ gb = div_u64_rem(tmp_mb, 1000, &mb); - debugf0("SAD#%d %s up to %u.%03u GB (0x%016Lx) %s reg=0x%08x\n", - n_sads, - get_dram_attr(reg), -- mb, kb, -+ gb, (mb*1000)/1024, - ((u64)tmp_mb) << 20L, - INTERLEAVE_MODE(reg) ? "Interleave: 8:6" : "Interleave: [8:6]XOR[18:16]", - reg); -@@ -753,9 +753,9 @@ static void get_memory_layout(const stru - break; - tmp_mb = (limit + 1) >> 20; - -- mb = div_u64_rem(tmp_mb, 1000, &kb); -+ gb = div_u64_rem(tmp_mb, 1000, &mb); - debugf0("TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n", -- n_tads, mb, kb, -+ n_tads, gb, (mb*1000)/1024, - ((u64)tmp_mb) << 20L, - (u32)TAD_SOCK(reg), - (u32)TAD_CH(reg), -@@ -778,10 +778,10 @@ static void get_memory_layout(const stru - tad_ch_nilv_offset[j], - ®); - tmp_mb = TAD_OFFSET(reg) >> 20; -- mb = div_u64_rem(tmp_mb, 1000, &kb); -+ gb = div_u64_rem(tmp_mb, 1024, &mb); - debugf0("TAD CH#%d, offset #%d: %u.%03u GB (0x%016Lx), reg=0x%08x\n", - i, j, -- mb, kb, -+ gb, (mb*1000)/1024, - ((u64)tmp_mb) << 20L, - reg); - } -@@ -803,10 +803,10 @@ static void get_memory_layout(const stru - - tmp_mb = RIR_LIMIT(reg) >> 20; - rir_way = 1 << RIR_WAY(reg); -- mb = div_u64_rem(tmp_mb, 1000, &kb); -+ gb = div_u64_rem(tmp_mb, 1024, &mb); - debugf0("CH#%d RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d, reg=0x%08x\n", - i, j, -- mb, kb, -+ gb, (mb*1000)/1024, - ((u64)tmp_mb) << 20L, - rir_way, - reg); -@@ -817,10 +817,10 @@ static void get_memory_layout(const stru - ®); - tmp_mb = RIR_OFFSET(reg) << 6; - -- mb = div_u64_rem(tmp_mb, 1000, &kb); -+ gb = div_u64_rem(tmp_mb, 1024, &mb); - debugf0("CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n", - i, j, k, -- mb, kb, -+ gb, (mb*1000)/1024, - ((u64)tmp_mb) << 20L, - (u32)RIR_RNK_TGT(reg), - reg); -@@ -858,7 +858,7 @@ static int get_memory_error_data(struct - u8 ch_way,sck_way; - u32 tad_offset; - u32 rir_way; -- u32 mb, kb; -+ u32 gb, mb; - u64 ch_addr, offset, limit, prv = 0; - - -@@ -1084,10 +1084,10 @@ static int get_memory_error_data(struct - continue; - - limit = RIR_LIMIT(reg); -- mb = div_u64_rem(limit >> 20, 1000, &kb); -+ gb = div_u64_rem(limit >> 20, 1024, &mb); - debugf0("RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d\n", - n_rir, -- mb, kb, -+ gb, (mb*1000)/1024, - limit, - 1 << RIR_WAY(reg)); - if (ch_addr <= limit) diff --git a/patches/sched-fix-rlimit_rttime-when-pi-boosting-to-rt.patch b/patches/sched-fix-rlimit_rttime-when-pi-boosting-to-rt.patch deleted file mode 100644 index ccf2acc..0000000 --- a/patches/sched-fix-rlimit_rttime-when-pi-boosting-to-rt.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 746db9443ea57fd9c059f62c4bfbf41cf224fe13 Mon Sep 17 00:00:00 2001 -From: Brian Silverman <brian@peloton-tech.com> -Date: Wed, 18 Feb 2015 16:23:56 -0800 -Subject: sched: Fix RLIMIT_RTTIME when PI-boosting to RT - -commit 746db9443ea57fd9c059f62c4bfbf41cf224fe13 upstream. - -When non-realtime tasks get priority-inheritance boosted to a realtime -scheduling class, RLIMIT_RTTIME starts to apply to them. However, the -counter used for checking this (the same one used for SCHED_RR -timeslices) was not getting reset. This meant that tasks running with a -non-realtime scheduling class which are repeatedly boosted to a realtime -one, but never block while they are running realtime, eventually hit the -timeout without ever running for a time over the limit. This patch -resets the realtime timeslice counter when un-PI-boosting from an RT to -a non-RT scheduling class. - -I have some test code with two threads and a shared PTHREAD_PRIO_INHERIT -mutex which induces priority boosting and spins while boosted that gets -killed by a SIGXCPU on non-fixed kernels but doesn't with this patch -applied. It happens much faster with a CONFIG_PREEMPT_RT kernel, and -does happen eventually with PREEMPT_VOLUNTARY kernels. - -Signed-off-by: Brian Silverman <brian@peloton-tech.com> -Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> -Cc: austin@peloton-tech.com -Link: http://lkml.kernel.org/r/1424305436-6716-1-git-send-email-brian@peloton-tech.com -Signed-off-by: Ingo Molnar <mingo@kernel.org> -[lizf: Backported to 3.4: adjust contest] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/sched/core.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -4031,10 +4031,13 @@ void rt_mutex_setprio(struct task_struct - if (running) - p->sched_class->put_prev_task(rq, p); - -- if (rt_prio(prio)) -+ if (rt_prio(prio)) { - p->sched_class = &rt_sched_class; -- else -+ } else { -+ if (rt_prio(oldprio)) -+ p->rt.timeout = 0; - p->sched_class = &fair_sched_class; -+ } - - p->prio = prio; - diff --git a/patches/selinux-fix-sel_write_enforce-broken-return-value.patch b/patches/selinux-fix-sel_write_enforce-broken-return-value.patch deleted file mode 100644 index 5e7a18c..0000000 --- a/patches/selinux-fix-sel_write_enforce-broken-return-value.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 6436a123a147db51a0b06024a8350f4c230e73ff Mon Sep 17 00:00:00 2001 -From: Joe Perches <joe@perches.com> -Date: Mon, 23 Mar 2015 18:01:35 -0700 -Subject: selinux: fix sel_write_enforce broken return value - -commit 6436a123a147db51a0b06024a8350f4c230e73ff upstream. - -Return a negative error value like the rest of the entries in this function. - -Signed-off-by: Joe Perches <joe@perches.com> -Acked-by: Stephen Smalley <sds@tycho.nsa.gov> -[PM: tweaked subject line] -Signed-off-by: Paul Moore <pmoore@redhat.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - security/selinux/selinuxfs.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/security/selinux/selinuxfs.c -+++ b/security/selinux/selinuxfs.c -@@ -150,7 +150,7 @@ static ssize_t sel_write_enforce(struct - goto out; - - /* No partial writes. */ -- length = EINVAL; -+ length = -EINVAL; - if (*ppos != 0) - goto out; - diff --git a/patches/series b/patches/series index 7f25e54..e69de29 100644 --- a/patches/series +++ b/patches/series @@ -1,173 +0,0 @@ -arm-pxa-add-regulator_has_full_constraints-to-corgi-board-file.patch -arm-pxa-add-regulator_has_full_constraints-to-poodle-board-file.patch -arm-pxa-add-regulator_has_full_constraints-to-spitz-board-file.patch -hx4700-regulator-declare-full-constraints.patch -pci-generate-uppercase-hex-for-modalias-var-in-uevent.patch -usb-core-buffer-smallest-buffer-should-start-at-arch_dma_minalign.patch -axonram-fix-bug-in-direct_access.patch -bluetooth-ath3k-add-support-of-ar3012-bluetooth-13d3-3423-device.patch -smack-fix-possible-use-after-frees-in-task_security-callers.patch -kvm-s390-base-hrtimer-on-a-monotonic-clock.patch -pci-fix-infinite-loop-with-rom-image-of-size-0.patch -usb-cp210x-add-id-for-ruggedcom-usb-serial-console.patch -staging-comedi-comedi_compat32.c-fix-comedi_cmd-copy-back.patch -arm-8284-1-sa1100-clear-rcsr_smr-on-resume.patch -xprtrdma-free-the-pd-if-ib_query_qp-fails.patch -cdc-acm-add-sanity-checks.patch -usb-add-flag-for-hcds-that-can-t-receive-wakeup-requests-isp1760-hcd.patch -usb-fix-use-after-free-bug-in-usb_hcd_unlink_urb.patch -vt-provide-notifications-on-selection-changes.patch -tty-prevent-untrappable-signals-from-malicious-program.patch -ath5k-fix-spontaneus-ar5312-freezes.patch -rtnetlink-ifla_vf_policy-fix-misuses-of-nla_binary.patch -alsa-off-by-one-bug-in-snd_riptide_joystick_probe.patch -fsnotify-fix-handling-of-renames-in-audit.patch -nfsv4.1-fix-a-kfree-of-uninitialised-pointers-in-decode_cb_sequence_args.patch -cpufreq-speedstep-smi-enable-interrupts-when-waiting.patch -mm-hugetlb-fix-getting-refcount-0-page-in-hugetlb_fault.patch -mm-hugetlb-add-migration-hwpoisoned-entry-check-in-hugetlb_change_protection.patch -mm-hugetlb-add-migration-entry-check-in-__unmap_hugepage_range.patch -mm-mmap.c-fix-arithmetic-overflow-in-__vm_enough_memory.patch -mm-nommu.c-fix-arithmetic-overflow-in-__vm_enough_memory.patch -iscsi-target-drop-problematic-active_ts_list-usage.patch -mm-memory.c-actually-remap-enough-memory.patch -drm-radeon-dp-set-edp_configuration_set-for-bridge-chips-if-necessary.patch -alsa-hdspm-constrain-periods-to-2-on-older-cards.patch -jffs2-fix-handling-of-corrupted-summary-length.patch -dm-mirror-do-not-degrade-the-mirror-on-discard-error.patch -dm-io-reject-unsupported-discard-requests-with-eopnotsupp.patch -ipv6-fix-ipv6_cow_metrics-for-non-dst_host-case.patch -fixed-invalid-assignment-of-64bit-mask-to-host-dma_boundary-for-scatter-gather-segment-boundary-limit.patch -sg-fix-read-error-reporting.patch -ib-qib-do-not-write-eeprom.patch -dm-fix-a-race-condition-in-dm_get_md.patch -dm-snapshot-fix-a-possible-invalid-memory-access-on-unload.patch -kdb-fix-incorrect-counts-in-kdb-summary-command-output.patch -debugfs-leave-freeing-a-symlink-body-until-inode-eviction.patch -autofs4-copy_dev_ioctl-keep-the-value-of-size-we-d-used-for-allocation.patch -gpio-tps65912-fix-wrong-container_of-arguments.patch -alsa-pcm-don-t-leave-prepared-state-after-draining.patch -nilfs2-fix-potential-memory-overrun-on-inode.patch -netfilter-xt_socket-fix-a-stack-corruption-bug.patch -team-fix-possible-null-pointer-dereference-in-team_handle_frame.patch -kvm-emulate-fix-cmpxchg8b-on-32-bit-hosts.patch -xhci-allocate-correct-amount-of-scratchpad-buffers.patch -usb-usbfs-don-t-leak-kernel-data-in-siginfo.patch -usb-ftdi_sio-add-pids-for-actisense-usb-devices.patch -usb-serial-fix-potential-use-after-free-after-failed-probe.patch -usb-serial-fix-tty-device-error-handling-at-probe.patch -mac80211-send-eapol-frames-at-lowest-rate.patch -usb-serial-cp210x-adding-seletek-device-id-s.patch -nfsv4-don-t-call-put_rpccred-under-the-rcu_read_lock.patch -usb-ftdi_sio-add-jtag-quirk-support-for-cyber-cortex-av-boards.patch -ecryptfs-don-t-pass-fs-specific-ioctl-commands-through.patch -drm-radeon-do-a-posting-read-in-r100_set_irq.patch -drm-radeon-do-a-posting-read-in-rs600_set_irq.patch -drm-radeon-do-a-posting-read-in-r600_set_irq.patch -drm-radeon-do-a-posting-read-in-evergreen_set_irq.patch -drm-radeon-do-a-posting-read-in-si_set_irq.patch -drm-radeon-fix-drm_ioctl_radeon_cs-oops.patch -acpi-video-load-the-module-even-if-acpi-is-disabled.patch -asoc-omap-pcm-correct-dma-mask.patch -x86-asm-entry-64-remove-a-bogus-ret_from_fork-optimization.patch -xhci-fix-reporting-of-0-sized-urbs-in-control-endpoint.patch -xhci-workaround-for-pme-stuck-issues-in-intel-xhci.patch -change-email-address-for-8250_pci.patch -tty-fix-up-atime-mtime-mess-take-four.patch -console-fix-console-name-size-mismatch.patch -net-irda-fix-wait_until_sent-poll-timeout.patch -tty-fix-tty_wait_until_sent-on-64-bit-machines.patch -sunrpc-fix-braino-in-poll.patch -gadgetfs-use-after-free-in-aio_read.patch -ipvs-add-missing-ip_vs_pe_put-in-sync-code.patch -arm-at91-pm-fix-at91rm9200-standby.patch -bnx2x-force-fundamental-reset-for-eeh-recovery.patch -libsas-fix-kernel-crash-in-smp_execute_task.patch -can-add-missing-initialisations-in-can-related-skbuffs.patch -ftrace-fix-en-dis-able-graph-caller-when-en-dis-abling-record-via-sysctl.patch -ftrace-fix-ftrace-enable-ordering-of-sysctl-ftrace_enabled.patch -xen-pciback-limit-guest-control-of-command-register.patch -drm-vmwgfx-reorder-device-takedown-somewhat.patch -alsa-control-add-sanity-checks-for-user-ctl-id-name-string.patch -alsa-snd-usb-add-quirks-for-roland-ua-22.patch -fuse-notify-don-t-move-pages.patch -fuse-set-stolen-page-uptodate.patch -dm-hold-suspend_lock-while-suspending-device-during-device-deletion.patch -dm-io-deal-with-wandering-queue-limits-when-handling-req_discard-and-req_write_same.patch -mac80211-drop-unencrypted-frames-in-mesh-fwding.patch -mac80211-set-only-vo-as-a-u-apsd-enabled-ac.patch -mac80211-disable-u-apsd-queues-by-default.patch -virtio_console-init-work-unconditionally.patch -virtio_console-avoid-config-access-from-irq.patch -x86-vdso-fix-the-build-on-gcc5.patch -asoc-sgtl5000-remove-useless-register-write-clearing-chrgpump_powerup.patch -input-synaptics-query-min-dimensions-for-fw-v8.1.patch -input-synaptics-fix-middle-button-on-lenovo-2015-products.patch -input-synaptics-handle-spurious-release-of-trackstick-buttons.patch -vt6655-rfbsetpower-fix-missing-rate-rate_12m.patch -x86-asm-entry-32-fix-user_mode-misuses.patch -asoc-adav80x-fix-wrong-value-references-for-boolean-kctl.patch -asoc-ak4641-fix-wrong-value-references-for-boolean-kctl.patch -asoc-cs4271-fix-wrong-value-references-for-boolean-kctl.patch -asoc-wm2000-fix-wrong-value-references-for-boolean-kctl.patch -asoc-wm8731-fix-wrong-value-references-for-boolean-kctl.patch -asoc-wm8903-fix-wrong-value-references-for-boolean-kctl.patch -asoc-wm8904-fix-wrong-value-references-for-boolean-kctl.patch -asoc-wm8955-fix-wrong-value-references-for-boolean-kctl.patch -asoc-wm8960-fix-wrong-value-references-for-boolean-kctl.patch -crypto-aesni-fix-memory-usage-in-gcm-decryption.patch -nl80211-ignore-ht-vht-capabilities-without-qos-wmm.patch -ib-mlx4-saturate-roce-port-pma-counters-in-case-of-overflow.patch -tcm_fc-missing-curly-braces-in-ft_invl_hw_context.patch -target-pscsi-fix-null-pointer-dereference-in-get_device_type.patch -writeback-add-missing-initial_jiffies-init-in-global_update_bandwidth.patch -nbd-fix-possible-memory-leak.patch -net-ethernet-pcnet32-setup-the-sram-and-nouflo-on-am79c97-3-5.patch -perf-fix-irq_work-tail-recursion.patch -sched-fix-rlimit_rttime-when-pi-boosting-to-rt.patch -writeback-fix-possible-underflow-in-write-bandwidth-calculation.patch -selinux-fix-sel_write_enforce-broken-return-value.patch -hfsplus-fix-b-tree-corruption-after-insertion-at-position-0.patch -alsa-hda-add-one-more-node-in-the-eapd-supporting-candidate-list.patch -usb-ftdi_sio-added-custom-pid-for-synapse-wireless-product.patch -cifs-fix-use-after-free-bug-in-find_writable_file.patch -usb-xhci-handle-config-error-change-cec-in-xhci-driver.patch -usb-xhci-apply-xhci_avoid_bei-quirk-to-all-intel-xhci-controllers.patch -net-use-for_each_netdev_safe-in-rtnl_group_changelink.patch -usb-ftdi_sio-use-jtag-quirk-for-snap-connect-e10.patch -radeon-do-not-directly-dereference-pointers-to-bios-area.patch -x86-reboot-add-asrock-q1900dc-itx-mainboard-reboot-quirk.patch -mac80211-fix-rx-a-mpdu-session-reorder-timer-deletion.patch -ib-uverbs-prevent-integer-overflow-in-ib_umem_get-address-arithmetic.patch -be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch -defer-processing-of-req_preempt-requests-for-blocked-devices.patch -ocfs2-_really_-sync-the-right-range.patch -alsa-usb-creative-usb-x-fi-pro-sb1095-volume-knob-support.patch -x86-reboot-fix-a-warning-message-triggered-by-stop_other_cpus.patch -softirq-reduce-latencies.patch -fix-lockup-related-to-stop_machine-being-stuck-in-__do_softirq.patch -splice-Apply-generic-position-and-size-checks-to-eac.patch -powerpc-mpc85xx-add-ranges-to-etsec2-nodes.patch -sb_edac-fix-erroneous-bytes-gigabytes-conversion.patch -spi-spidev-fix-possible-arithmetic-overflow-for-multi-transfer-message.patch -ib-core-avoid-leakage-from-kernel-to-user-space.patch -hpsa-refine-the-pci-enable-disable-handling.patch -hpsa-add-missing-pci_set_master-in-kdump-path.patch -hpsa-turn-off-interrupts-when-kdump-starts.patch -hpsa-fix-memory-leak-in-kdump-hard-reset.patch -fs-take-i_mutex-during-prepare_binprm-for-set-ug-id-executables.patch -openvswitch-check-currect-return-value-from-skb_gso_segment.patch -net-make-skb_gso_segment-error-handling-more-robust.patch -ipvs-uninitialized-data-with-ip_vs_ipv6.patch -autofs4-check-dev-ioctl-size-before-allocating.patch -ubi-fix-soft-lockup-in-ubi_check_volume.patch -perf-tools-fix-build-with-perl-5.18.patch -config-enable-need_dma_map_state-by-default-when-swiotlb-is-selected.patch -pci-convert-pcibios_resource_to_bus-to-take-a-pci_bus-not-a-pci_dev.patch -don-t-bugger-nd-seq-on-set_root_rcu-from-follow_dotdot_rcu.patch -cdc-acm-prevent-infinite-loop-when-parsing-cdc-headers.patch -ib-core-don-t-disallow-registering-region-starting-at-0x0.patch -writeback-use-1-instead-of-1-to-protect-against-div-by-zero.patch -xen-pciback-add-name-prefix-to-global-permissive-variable.patch -slub-refactoring-unfreeze_partials.patch -xen-netback-read-hotplug-script-once-at-start-of-day.patch diff --git a/patches/sg-fix-read-error-reporting.patch b/patches/sg-fix-read-error-reporting.patch deleted file mode 100644 index f2d99d0..0000000 --- a/patches/sg-fix-read-error-reporting.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 3b524a683af8991b4eab4182b947c65f0ce1421b Mon Sep 17 00:00:00 2001 -From: Tony Battersby <tonyb@cybernetics.com> -Date: Wed, 11 Feb 2015 11:32:06 -0500 -Subject: sg: fix read() error reporting - -commit 3b524a683af8991b4eab4182b947c65f0ce1421b upstream. - -Fix SCSI generic read() incorrectly returning success after detecting an -error. - -Signed-off-by: Tony Battersby <tonyb@cybernetics.com> -Acked-by: Douglas Gilbert <dgilbert@interlog.com> -Signed-off-by: James Bottomley <JBottomley@Parallels.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/scsi/sg.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -498,7 +498,7 @@ static ssize_t - sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp) - { - sg_io_hdr_t *hp = &srp->header; -- int err = 0; -+ int err = 0, err2; - int len; - - if (count < SZ_SG_IO_HDR) { -@@ -527,8 +527,8 @@ sg_new_read(Sg_fd * sfp, char __user *bu - goto err_out; - } - err_out: -- err = sg_finish_rem_req(srp); -- return (0 == err) ? count : err; -+ err2 = sg_finish_rem_req(srp); -+ return err ? : err2 ? : count; - } - - static ssize_t diff --git a/patches/slub-refactoring-unfreeze_partials.patch b/patches/slub-refactoring-unfreeze_partials.patch deleted file mode 100644 index 5c37bbc..0000000 --- a/patches/slub-refactoring-unfreeze_partials.patch +++ /dev/null @@ -1,162 +0,0 @@ -From 43d77867a4f333de4e4189114c480dd365133c09 Mon Sep 17 00:00:00 2001 -From: Joonsoo Kim <js1304@gmail.com> -Date: Sat, 9 Jun 2012 02:23:16 +0900 -Subject: slub: refactoring unfreeze_partials() - -commit 43d77867a4f333de4e4189114c480dd365133c09 upstream. - -Current implementation of unfreeze_partials() is so complicated, -but benefit from it is insignificant. In addition many code in -do {} while loop have a bad influence to a fail rate of cmpxchg_double_slab. -Under current implementation which test status of cpu partial slab -and acquire list_lock in do {} while loop, -we don't need to acquire a list_lock and gain a little benefit -when front of the cpu partial slab is to be discarded, but this is a rare case. -In case that add_partial is performed and cmpxchg_double_slab is failed, -remove_partial should be called case by case. - -I think that these are disadvantages of current implementation, -so I do refactoring unfreeze_partials(). - -Minimizing code in do {} while loop introduce a reduced fail rate -of cmpxchg_double_slab. Below is output of 'slabinfo -r kmalloc-256' -when './perf stat -r 33 hackbench 50 process 4000 > /dev/null' is done. - -** before ** -Cmpxchg_double Looping ------------------------- -Locked Cmpxchg Double redos 182685 -Unlocked Cmpxchg Double redos 0 - -** after ** -Cmpxchg_double Looping ------------------------- -Locked Cmpxchg Double redos 177995 -Unlocked Cmpxchg Double redos 1 - -We can see cmpxchg_double_slab fail rate is improved slightly. - -Bolow is output of './perf stat -r 30 hackbench 50 process 4000 > /dev/null'. - -** before ** - Performance counter stats for './hackbench 50 process 4000' (30 runs): - - 108517.190463 task-clock # 7.926 CPUs utilized ( +- 0.24% ) - 2,919,550 context-switches # 0.027 M/sec ( +- 3.07% ) - 100,774 CPU-migrations # 0.929 K/sec ( +- 4.72% ) - 124,201 page-faults # 0.001 M/sec ( +- 0.15% ) - 401,500,234,387 cycles # 3.700 GHz ( +- 0.24% ) - <not supported> stalled-cycles-frontend - <not supported> stalled-cycles-backend - 250,576,913,354 instructions # 0.62 insns per cycle ( +- 0.13% ) - 45,934,956,860 branches # 423.297 M/sec ( +- 0.14% ) - 188,219,787 branch-misses # 0.41% of all branches ( +- 0.56% ) - - 13.691837307 seconds time elapsed ( +- 0.24% ) - -** after ** - Performance counter stats for './hackbench 50 process 4000' (30 runs): - - 107784.479767 task-clock # 7.928 CPUs utilized ( +- 0.22% ) - 2,834,781 context-switches # 0.026 M/sec ( +- 2.33% ) - 93,083 CPU-migrations # 0.864 K/sec ( +- 3.45% ) - 123,967 page-faults # 0.001 M/sec ( +- 0.15% ) - 398,781,421,836 cycles # 3.700 GHz ( +- 0.22% ) - <not supported> stalled-cycles-frontend - <not supported> stalled-cycles-backend - 250,189,160,419 instructions # 0.63 insns per cycle ( +- 0.09% ) - 45,855,370,128 branches # 425.436 M/sec ( +- 0.10% ) - 169,881,248 branch-misses # 0.37% of all branches ( +- 0.43% ) - - 13.596272341 seconds time elapsed ( +- 0.22% ) - -No regression is found, but rather we can see slightly better result. - -Acked-by: Christoph Lameter <cl@linux.com> -Signed-off-by: Joonsoo Kim <js1304@gmail.com> -Signed-off-by: Pekka Enberg <penberg@kernel.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/slub.c | 48 ++++++++++++++---------------------------------- - 1 file changed, 14 insertions(+), 34 deletions(-) - ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -1882,18 +1882,24 @@ redo: - /* Unfreeze all the cpu partial slabs */ - static void unfreeze_partials(struct kmem_cache *s) - { -- struct kmem_cache_node *n = NULL; -+ struct kmem_cache_node *n = NULL, *n2 = NULL; - struct kmem_cache_cpu *c = this_cpu_ptr(s->cpu_slab); - struct page *page, *discard_page = NULL; - - while ((page = c->partial)) { -- enum slab_modes { M_PARTIAL, M_FREE }; -- enum slab_modes l, m; - struct page new; - struct page old; - - c->partial = page->next; -- l = M_FREE; -+ -+ n2 = get_node(s, page_to_nid(page)); -+ if (n != n2) { -+ if (n) -+ spin_unlock(&n->list_lock); -+ -+ n = n2; -+ spin_lock(&n->list_lock); -+ } - - do { - -@@ -1906,43 +1912,17 @@ static void unfreeze_partials(struct kme - - new.frozen = 0; - -- if (!new.inuse && (!n || n->nr_partial > s->min_partial)) -- m = M_FREE; -- else { -- struct kmem_cache_node *n2 = get_node(s, -- page_to_nid(page)); -- -- m = M_PARTIAL; -- if (n != n2) { -- if (n) -- spin_unlock(&n->list_lock); -- -- n = n2; -- spin_lock(&n->list_lock); -- } -- } -- -- if (l != m) { -- if (l == M_PARTIAL) { -- remove_partial(n, page); -- stat(s, FREE_REMOVE_PARTIAL); -- } else { -- add_partial(n, page, -- DEACTIVATE_TO_TAIL); -- stat(s, FREE_ADD_PARTIAL); -- } -- -- l = m; -- } -- - } while (!cmpxchg_double_slab(s, page, - old.freelist, old.counters, - new.freelist, new.counters, - "unfreezing slab")); - -- if (m == M_FREE) { -+ if (unlikely(!new.inuse && n->nr_partial > s->min_partial)) { - page->next = discard_page; - discard_page = page; -+ } else { -+ add_partial(n, page, DEACTIVATE_TO_TAIL); -+ stat(s, FREE_ADD_PARTIAL); - } - } - diff --git a/patches/smack-fix-possible-use-after-frees-in-task_security-callers.patch b/patches/smack-fix-possible-use-after-frees-in-task_security-callers.patch deleted file mode 100644 index 1eb3c26..0000000 --- a/patches/smack-fix-possible-use-after-frees-in-task_security-callers.patch +++ /dev/null @@ -1,241 +0,0 @@ -From 6d1cff2a885850b78b40c34777b46cf5da5d1050 Mon Sep 17 00:00:00 2001 -From: Andrey Ryabinin <a.ryabinin@samsung.com> -Date: Tue, 13 Jan 2015 18:52:40 +0300 -Subject: smack: fix possible use after frees in task_security() callers - -commit 6d1cff2a885850b78b40c34777b46cf5da5d1050 upstream. - -We hit use after free on dereferncing pointer to task_smack struct in -smk_of_task() called from smack_task_to_inode(). - -task_security() macro uses task_cred_xxx() to get pointer to the task_smack. -task_cred_xxx() could be used only for non-pointer members of task's -credentials. It cannot be used for pointer members since what they point -to may disapper after dropping RCU read lock. - -Mainly task_security() used this way: - smk_of_task(task_security(p)) - -Intead of this introduce function smk_of_task_struct() which -takes task_struct as argument and returns pointer to smk_known struct -and do this under RCU read lock. -Bogus task_security() macro is not used anymore, so remove it. - -KASan's report for this: - - AddressSanitizer: use after free in smack_task_to_inode+0x50/0x70 at addr c4635600 - ============================================================================= - BUG kmalloc-64 (Tainted: PO): kasan error - ----------------------------------------------------------------------------- - - Disabling lock debugging due to kernel taint - INFO: Allocated in new_task_smack+0x44/0xd8 age=39 cpu=0 pid=1866 - kmem_cache_alloc_trace+0x88/0x1bc - new_task_smack+0x44/0xd8 - smack_cred_prepare+0x48/0x21c - security_prepare_creds+0x44/0x4c - prepare_creds+0xdc/0x110 - smack_setprocattr+0x104/0x150 - security_setprocattr+0x4c/0x54 - proc_pid_attr_write+0x12c/0x194 - vfs_write+0x1b0/0x370 - SyS_write+0x5c/0x94 - ret_fast_syscall+0x0/0x48 - INFO: Freed in smack_cred_free+0xc4/0xd0 age=27 cpu=0 pid=1564 - kfree+0x270/0x290 - smack_cred_free+0xc4/0xd0 - security_cred_free+0x34/0x3c - put_cred_rcu+0x58/0xcc - rcu_process_callbacks+0x738/0x998 - __do_softirq+0x264/0x4cc - do_softirq+0x94/0xf4 - irq_exit+0xbc/0x120 - handle_IRQ+0x104/0x134 - gic_handle_irq+0x70/0xac - __irq_svc+0x44/0x78 - _raw_spin_unlock+0x18/0x48 - sync_inodes_sb+0x17c/0x1d8 - sync_filesystem+0xac/0xfc - vdfs_file_fsync+0x90/0xc0 - vfs_fsync_range+0x74/0x7c - INFO: Slab 0xd3b23f50 objects=32 used=31 fp=0xc4635600 flags=0x4080 - INFO: Object 0xc4635600 @offset=5632 fp=0x (null) - - Bytes b4 c46355f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ - Object c4635600: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk - Object c4635610: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk - Object c4635620: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk - Object c4635630: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk. - Redzone c4635640: bb bb bb bb .... - Padding c46356e8: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ - Padding c46356f8: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ - CPU: 5 PID: 834 Comm: launchpad_prelo Tainted: PBO 3.10.30 #1 - Backtrace: - [<c00233a4>] (dump_backtrace+0x0/0x158) from [<c0023dec>] (show_stack+0x20/0x24) - r7:c4634010 r6:d3b23f50 r5:c4635600 r4:d1002140 - [<c0023dcc>] (show_stack+0x0/0x24) from [<c06d6d7c>] (dump_stack+0x20/0x28) - [<c06d6d5c>] (dump_stack+0x0/0x28) from [<c01c1d50>] (print_trailer+0x124/0x144) - [<c01c1c2c>] (print_trailer+0x0/0x144) from [<c01c1e88>] (object_err+0x3c/0x44) - r7:c4635600 r6:d1002140 r5:d3b23f50 r4:c4635600 - [<c01c1e4c>] (object_err+0x0/0x44) from [<c01cac18>] (kasan_report_error+0x2b8/0x538) - r6:d1002140 r5:d3b23f50 r4:c6429cf8 r3:c09e1aa7 - [<c01ca960>] (kasan_report_error+0x0/0x538) from [<c01c9430>] (__asan_load4+0xd4/0xf8) - [<c01c935c>] (__asan_load4+0x0/0xf8) from [<c031e168>] (smack_task_to_inode+0x50/0x70) - r5:c4635600 r4:ca9da000 - [<c031e118>] (smack_task_to_inode+0x0/0x70) from [<c031af64>] (security_task_to_inode+0x3c/0x44) - r5:cca25e80 r4:c0ba9780 - [<c031af28>] (security_task_to_inode+0x0/0x44) from [<c023d614>] (pid_revalidate+0x124/0x178) - r6:00000000 r5:cca25e80 r4:cbabe3c0 r3:00008124 - [<c023d4f0>] (pid_revalidate+0x0/0x178) from [<c01db98c>] (lookup_fast+0x35c/0x43y4) - r9:c6429efc r8:00000101 r7:c079d940 r6:c6429e90 r5:c6429ed8 r4:c83c4148 - [<c01db630>] (lookup_fast+0x0/0x434) from [<c01deec8>] (do_last.isra.24+0x1c0/0x1108) - [<c01ded08>] (do_last.isra.24+0x0/0x1108) from [<c01dff04>] (path_openat.isra.25+0xf4/0x648) - [<c01dfe10>] (path_openat.isra.25+0x0/0x648) from [<c01e1458>] (do_filp_open+0x3c/0x88) - [<c01e141c>] (do_filp_open+0x0/0x88) from [<c01ccb28>] (do_sys_open+0xf0/0x198) - r7:00000001 r6:c0ea2180 r5:0000000b r4:00000000 - [<c01cca38>] (do_sys_open+0x0/0x198) from [<c01ccc00>] (SyS_open+0x30/0x34) - [<c01ccbd0>] (SyS_open+0x0/0x34) from [<c001db80>] (ret_fast_syscall+0x0/0x48) - Read of size 4 by thread T834: - Memory state around the buggy address: - c4635380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc - c4635400: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc - c4635480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc - c4635500: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc - c4635580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc - >c4635600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb - ^ - c4635680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb - c4635700: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc - c4635780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc - c4635800: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc - c4635880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc - ================================================================== - -Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com> -[lizf: Backported to 3.4: - - smk_of_task() returns char* instead of smack_known * - - replace task_security() with smk_of_task() with smk_of_task_struct() - manually] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - security/smack/smack.h | 10 ++++++++++ - security/smack/smack_lsm.c | 24 +++++++++++++----------- - 2 files changed, 23 insertions(+), 11 deletions(-) - ---- a/security/smack/smack.h -+++ b/security/smack/smack.h -@@ -298,6 +298,16 @@ static inline char *smk_of_current(void) - return smk_of_task(current_security()); - } - -+static inline char *smk_of_task_struct(const struct task_struct *t) -+{ -+ char *skp; -+ -+ rcu_read_lock(); -+ skp = smk_of_task(__task_cred(t)->security); -+ rcu_read_unlock(); -+ return skp; -+} -+ - /* - * logging functions - */ ---- a/security/smack/smack_lsm.c -+++ b/security/smack/smack_lsm.c -@@ -41,8 +41,6 @@ - #include <linux/binfmts.h> - #include "smack.h" - --#define task_security(task) (task_cred_xxx((task), security)) -- - #define TRANS_TRUE "TRUE" - #define TRANS_TRUE_SIZE 4 - -@@ -164,7 +162,7 @@ static int smack_ptrace_access_check(str - if (rc != 0) - return rc; - -- tsp = smk_of_task(task_security(ctp)); -+ tsp = smk_of_task_struct(ctp); - smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); - smk_ad_setfield_u_tsk(&ad, ctp); - -@@ -190,7 +188,7 @@ static int smack_ptrace_traceme(struct t - if (rc != 0) - return rc; - -- tsp = smk_of_task(task_security(ptp)); -+ tsp = smk_of_task_struct(ptp); - smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); - smk_ad_setfield_u_tsk(&ad, ptp); - -@@ -1518,7 +1516,7 @@ static int smk_curacc_on_task(struct tas - - smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK); - smk_ad_setfield_u_tsk(&ad, p); -- return smk_curacc(smk_of_task(task_security(p)), access, &ad); -+ return smk_curacc(smk_of_task_struct(p), access, &ad); - } - - /** -@@ -1564,7 +1562,7 @@ static int smack_task_getsid(struct task - */ - static void smack_task_getsecid(struct task_struct *p, u32 *secid) - { -- *secid = smack_to_secid(smk_of_task(task_security(p))); -+ *secid = smack_to_secid(smk_of_task_struct(p)); - } - - /** -@@ -1676,7 +1674,7 @@ static int smack_task_kill(struct task_s - * can write the receiver. - */ - if (secid == 0) -- return smk_curacc(smk_of_task(task_security(p)), MAY_WRITE, -+ return smk_curacc(smk_of_task_struct(p), MAY_WRITE, - &ad); - /* - * If the secid isn't 0 we're dealing with some USB IO -@@ -1684,7 +1682,7 @@ static int smack_task_kill(struct task_s - * we can't take privilege into account. - */ - return smk_access(smack_from_secid(secid), -- smk_of_task(task_security(p)), MAY_WRITE, &ad); -+ smk_of_task_struct(p), MAY_WRITE, &ad); - } - - /** -@@ -1697,9 +1695,13 @@ static int smack_task_wait(struct task_s - { - struct smk_audit_info ad; - char *sp = smk_of_current(); -- char *tsp = smk_of_forked(task_security(p)); -+ char *tsp; - int rc; - -+ rcu_read_lock(); -+ tsp = smk_of_forked(__task_cred(p)->security); -+ rcu_read_unlock(); -+ - /* we don't log here, we can be overriden */ - rc = smk_access(tsp, sp, MAY_WRITE, NULL); - if (rc == 0) -@@ -1736,7 +1738,7 @@ static int smack_task_wait(struct task_s - static void smack_task_to_inode(struct task_struct *p, struct inode *inode) - { - struct inode_smack *isp = inode->i_security; -- isp->smk_inode = smk_of_task(task_security(p)); -+ isp->smk_inode = smk_of_task_struct(p); - } - - /* -@@ -2719,7 +2721,7 @@ static int smack_getprocattr(struct task - if (strcmp(name, "current") != 0) - return -EINVAL; - -- cp = kstrdup(smk_of_task(task_security(p)), GFP_KERNEL); -+ cp = kstrdup(smk_of_task_struct(p), GFP_KERNEL); - if (cp == NULL) - return -ENOMEM; - diff --git a/patches/softirq-reduce-latencies.patch b/patches/softirq-reduce-latencies.patch deleted file mode 100644 index 06884a6..0000000 --- a/patches/softirq-reduce-latencies.patch +++ /dev/null @@ -1,121 +0,0 @@ -From c10d73671ad30f54692f7f69f0e09e75d3a8926a Mon Sep 17 00:00:00 2001 -From: Eric Dumazet <edumazet@google.com> -Date: Thu, 10 Jan 2013 15:26:34 -0800 -Subject: softirq: reduce latencies - -commit c10d73671ad30f54692f7f69f0e09e75d3a8926a upstream. - -In various network workloads, __do_softirq() latencies can be up -to 20 ms if HZ=1000, and 200 ms if HZ=100. - -This is because we iterate 10 times in the softirq dispatcher, -and some actions can consume a lot of cycles. - -This patch changes the fallback to ksoftirqd condition to : - -- A time limit of 2 ms. -- need_resched() being set on current task - -When one of this condition is met, we wakeup ksoftirqd for further -softirq processing if we still have pending softirqs. - -Using need_resched() as the only condition can trigger RCU stalls, -as we can keep BH disabled for too long. - -I ran several benchmarks and got no significant difference in -throughput, but a very significant reduction of latencies (one order -of magnitude) : - -In following bench, 200 antagonist "netperf -t TCP_RR" are started in -background, using all available cpus. - -Then we start one "netperf -t TCP_RR", bound to the cpu handling the NIC -IRQ (hard+soft) - -Before patch : - -# netperf -H 7.7.7.84 -t TCP_RR -T2,2 -- -k -RT_LATENCY,MIN_LATENCY,MAX_LATENCY,P50_LATENCY,P90_LATENCY,P99_LATENCY,MEAN_LATENCY,STDDEV_LATENCY -MIGRATED TCP REQUEST/RESPONSE TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET -to 7.7.7.84 () port 0 AF_INET : first burst 0 : cpu bind -RT_LATENCY=550110.424 -MIN_LATENCY=146858 -MAX_LATENCY=997109 -P50_LATENCY=305000 -P90_LATENCY=550000 -P99_LATENCY=710000 -MEAN_LATENCY=376989.12 -STDDEV_LATENCY=184046.92 - -After patch : - -# netperf -H 7.7.7.84 -t TCP_RR -T2,2 -- -k -RT_LATENCY,MIN_LATENCY,MAX_LATENCY,P50_LATENCY,P90_LATENCY,P99_LATENCY,MEAN_LATENCY,STDDEV_LATENCY -MIGRATED TCP REQUEST/RESPONSE TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET -to 7.7.7.84 () port 0 AF_INET : first burst 0 : cpu bind -RT_LATENCY=40545.492 -MIN_LATENCY=9834 -MAX_LATENCY=78366 -P50_LATENCY=33583 -P90_LATENCY=59000 -P99_LATENCY=69000 -MEAN_LATENCY=38364.67 -STDDEV_LATENCY=12865.26 - -Signed-off-by: Eric Dumazet <edumazet@google.com> -Cc: David Miller <davem@davemloft.net> -Cc: Tom Herbert <therbert@google.com> -Cc: Ben Hutchings <bhutchings@solarflare.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -[xr: Backported to 3.4: Adjust context] -Signed-off-by: Rui Xiang <rui.xiang@huawei.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - kernel/softirq.c | 17 +++++++++-------- - 1 file changed, 9 insertions(+), 8 deletions(-) - ---- a/kernel/softirq.c -+++ b/kernel/softirq.c -@@ -194,21 +194,21 @@ void local_bh_enable_ip(unsigned long ip - EXPORT_SYMBOL(local_bh_enable_ip); - - /* -- * We restart softirq processing MAX_SOFTIRQ_RESTART times, -- * and we fall back to softirqd after that. -+ * We restart softirq processing for at most 2 ms, -+ * and if need_resched() is not set. - * -- * This number has been established via experimentation. -+ * These limits have been established via experimentation. - * The two things to balance is latency against fairness - - * we want to handle softirqs as soon as possible, but they - * should not be able to lock up the box. - */ --#define MAX_SOFTIRQ_RESTART 10 -+#define MAX_SOFTIRQ_TIME msecs_to_jiffies(2) - - asmlinkage void __do_softirq(void) - { - struct softirq_action *h; - __u32 pending; -- int max_restart = MAX_SOFTIRQ_RESTART; -+ unsigned long end = jiffies + MAX_SOFTIRQ_TIME; - int cpu; - - pending = local_softirq_pending(); -@@ -255,11 +255,12 @@ restart: - local_irq_disable(); - - pending = local_softirq_pending(); -- if (pending && --max_restart) -- goto restart; -+ if (pending) { -+ if (time_before(jiffies, end) && !need_resched()) -+ goto restart; - -- if (pending) - wakeup_softirqd(); -+ } - - lockdep_softirq_exit(); - diff --git a/patches/spi-spidev-fix-possible-arithmetic-overflow-for-multi-transfer-message.patch b/patches/spi-spidev-fix-possible-arithmetic-overflow-for-multi-transfer-message.patch deleted file mode 100644 index 03bdca8..0000000 --- a/patches/spi-spidev-fix-possible-arithmetic-overflow-for-multi-transfer-message.patch +++ /dev/null @@ -1,45 +0,0 @@ -From f20fbaad7620af2df36a1f9d1c9ecf48ead5b747 Mon Sep 17 00:00:00 2001 -From: Ian Abbott <abbotti@mev.co.uk> -Date: Mon, 23 Mar 2015 17:50:27 +0000 -Subject: spi: spidev: fix possible arithmetic overflow for multi-transfer - message - -commit f20fbaad7620af2df36a1f9d1c9ecf48ead5b747 upstream. - -`spidev_message()` sums the lengths of the individual SPI transfers to -determine the overall SPI message length. It restricts the total -length, returning an error if too long, but it does not check for -arithmetic overflow. For example, if the SPI message consisted of two -transfers and the first has a length of 10 and the second has a length -of (__u32)(-1), the total length would be seen as 9, even though the -second transfer is actually very long. If the second transfer specifies -a null `rx_buf` and a non-null `tx_buf`, the `copy_from_user()` could -overrun the spidev's pre-allocated tx buffer before it reaches an -invalid user memory address. Fix it by checking that neither the total -nor the individual transfer lengths exceed the maximum allowed value. - -Thanks to Dan Carpenter for reporting the potential integer overflow. - -Signed-off-by: Ian Abbott <abbotti@mev.co.uk> -Signed-off-by: Mark Brown <broonie@kernel.org> -[Ian Abbott: Note: original commit compares the lengths to INT_MAX instead -of bufsiz due to changes in earlier commits.] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/spi/spidev.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - ---- a/drivers/spi/spidev.c -+++ b/drivers/spi/spidev.c -@@ -241,7 +241,10 @@ static int spidev_message(struct spidev_ - k_tmp->len = u_tmp->len; - - total += k_tmp->len; -- if (total > bufsiz) { -+ /* Check total length of transfers. Also check each -+ * transfer length to avoid arithmetic overflow. -+ */ -+ if (total > bufsiz || k_tmp->len > bufsiz) { - status = -EMSGSIZE; - goto done; - } diff --git a/patches/splice-Apply-generic-position-and-size-checks-to-eac.patch b/patches/splice-Apply-generic-position-and-size-checks-to-eac.patch deleted file mode 100644 index 3fcfc70..0000000 --- a/patches/splice-Apply-generic-position-and-size-checks-to-eac.patch +++ /dev/null @@ -1,72 +0,0 @@ -From a2ed1f76f88e03739312edfe676bd2c439205426 Mon Sep 17 00:00:00 2001 -From: Ben Hutchings <ben@decadent.org.uk> -Date: Tue, 17 Feb 2015 01:46:53 +0000 -Subject: [PATCH] splice: Apply generic position and size checks to each write - -3.2.67-rc1 review patch. If anyone has any objections, please let me know. - ------------------- - -From: Ben Hutchings <ben@decadent.org.uk> - -We need to check the position and size of file writes against various -limits, using generic_write_check(). This was not being done for -the splice write path. It was fixed upstream by commit 8d0207652cbe -("->splice_write() via ->write_iter()") but we can't apply that. - -CVE-2014-7822 - -Signed-off-by: Ben Hutchings <ben@decadent.org.uk> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - fs/ocfs2/file.c | 8 ++++++-- - fs/splice.c | 8 ++++++-- - 2 files changed, 12 insertions(+), 4 deletions(-) - ---- a/fs/ocfs2/file.c -+++ b/fs/ocfs2/file.c -@@ -2474,9 +2474,7 @@ static ssize_t ocfs2_file_splice_write(s - struct address_space *mapping = out->f_mapping; - struct inode *inode = mapping->host; - struct splice_desc sd = { -- .total_len = len, - .flags = flags, -- .pos = *ppos, - .u.file = out, - }; - -@@ -2486,6 +2484,12 @@ static ssize_t ocfs2_file_splice_write(s - out->f_path.dentry->d_name.len, - out->f_path.dentry->d_name.name, len); - -+ ret = generic_write_checks(out, ppos, &len, 0); -+ if (ret) -+ return ret; -+ sd.total_len = len; -+ sd.pos = *ppos; -+ - if (pipe->inode) - mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_PARENT); - ---- a/fs/splice.c -+++ b/fs/splice.c -@@ -991,13 +991,17 @@ generic_file_splice_write(struct pipe_in - struct address_space *mapping = out->f_mapping; - struct inode *inode = mapping->host; - struct splice_desc sd = { -- .total_len = len, - .flags = flags, -- .pos = *ppos, - .u.file = out, - }; - ssize_t ret; - -+ ret = generic_write_checks(out, ppos, &len, S_ISBLK(inode->i_mode)); -+ if (ret) -+ return ret; -+ sd.total_len = len; -+ sd.pos = *ppos; -+ - pipe_lock(pipe); - - splice_from_pipe_begin(&sd); diff --git a/patches/staging-comedi-comedi_compat32.c-fix-comedi_cmd-copy-back.patch b/patches/staging-comedi-comedi_compat32.c-fix-comedi_cmd-copy-back.patch deleted file mode 100644 index ccffbbd..0000000 --- a/patches/staging-comedi-comedi_compat32.c-fix-comedi_cmd-copy-back.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 42b8ce6f55facfa101462e694d33fc6bca471138 Mon Sep 17 00:00:00 2001 -From: Ian Abbott <abbotti@mev.co.uk> -Date: Tue, 27 Jan 2015 18:16:51 +0000 -Subject: staging: comedi: comedi_compat32.c: fix COMEDI_CMD copy back - -commit 42b8ce6f55facfa101462e694d33fc6bca471138 upstream. - -`do_cmd_ioctl()` in "comedi_fops.c" handles the `COMEDI_CMD` ioctl. -This returns `-EAGAIN` if it has copied a modified `struct comedi_cmd` -back to user-space. (This occurs when the low-level Comedi driver's -`do_cmdtest()` handler returns non-zero to indicate a problem with the -contents of the `struct comedi_cmd`, or when the `struct comedi_cmd` has -the `CMDF_BOGUS` flag set.) - -`compat_cmd()` in "comedi_compat32.c" handles the 32-bit compatible -version of the `COMEDI_CMD` ioctl. Currently, it never copies a 32-bit -compatible version of `struct comedi_cmd` back to user-space, which is -at odds with the way the regular `COMEDI_CMD` ioctl is handled. To fix -it, change `compat_cmd()` to copy a 32-bit compatible version of the -`struct comedi_cmd` back to user-space when the main ioctl handler -returns `-EAGAIN`. - -Signed-off-by: Ian Abbott <abbotti@mev.co.uk> -Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/staging/comedi/comedi_compat32.c | 12 ++++++++++-- - 1 file changed, 10 insertions(+), 2 deletions(-) - ---- a/drivers/staging/comedi/comedi_compat32.c -+++ b/drivers/staging/comedi/comedi_compat32.c -@@ -271,7 +271,7 @@ static int compat_cmd(struct file *file, - { - struct comedi_cmd __user *cmd; - struct comedi32_cmd_struct __user *cmd32; -- int rc; -+ int rc, err; - - cmd32 = compat_ptr(arg); - cmd = compat_alloc_user_space(sizeof(*cmd)); -@@ -280,7 +280,15 @@ static int compat_cmd(struct file *file, - if (rc) - return rc; - -- return translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd); -+ rc = translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd); -+ if (rc == -EAGAIN) { -+ /* Special case: copy cmd back to user. */ -+ err = put_compat_cmd(cmd32, cmd); -+ if (err) -+ rc = err; -+ } -+ -+ return rc; - } - - /* Handle 32-bit COMEDI_CMDTEST ioctl. */ diff --git a/patches/sunrpc-fix-braino-in-poll.patch b/patches/sunrpc-fix-braino-in-poll.patch deleted file mode 100644 index 695e4ab..0000000 --- a/patches/sunrpc-fix-braino-in-poll.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 1711fd9addf214823b993468567cab1f8254fc51 Mon Sep 17 00:00:00 2001 -From: Al Viro <viro@ZenIV.linux.org.uk> -Date: Sat, 7 Mar 2015 21:08:46 +0000 -Subject: sunrpc: fix braino in ->poll() - -commit 1711fd9addf214823b993468567cab1f8254fc51 upstream. - -POLL_OUT isn't what callers of ->poll() are expecting to see; it's -actually __SI_POLL | 2 and it's a siginfo code, not a poll bitmap -bit... - -Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -Cc: Bruce Fields <bfields@fieldses.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/sunrpc/cache.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/net/sunrpc/cache.c -+++ b/net/sunrpc/cache.c -@@ -911,7 +911,7 @@ static unsigned int cache_poll(struct fi - poll_wait(filp, &queue_wait, wait); - - /* alway allow write */ -- mask = POLL_OUT | POLLWRNORM; -+ mask = POLLOUT | POLLWRNORM; - - if (!rp) - return mask; diff --git a/patches/target-pscsi-fix-null-pointer-dereference-in-get_device_type.patch b/patches/target-pscsi-fix-null-pointer-dereference-in-get_device_type.patch deleted file mode 100644 index 810d0e1..0000000 --- a/patches/target-pscsi-fix-null-pointer-dereference-in-get_device_type.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 215a8fe4198f607f34ecdbc9969dae783d8b5a61 Mon Sep 17 00:00:00 2001 -From: Nicholas Bellinger <nab@linux-iscsi.org> -Date: Fri, 27 Feb 2015 03:54:13 -0800 -Subject: target/pscsi: Fix NULL pointer dereference in get_device_type - -commit 215a8fe4198f607f34ecdbc9969dae783d8b5a61 upstream. - -This patch fixes a NULL pointer dereference OOPs with pSCSI backends -within target_core_stat.c code. The bug is caused by a configfs attr -read if no pscsi_dev_virt->pdv_sd has been configured. - -Reported-by: Olaf Hering <olaf@aepfle.de> -Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/target/target_core_pscsi.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/target/target_core_pscsi.c -+++ b/drivers/target/target_core_pscsi.c -@@ -1165,7 +1165,7 @@ static u32 pscsi_get_device_type(struct - struct pscsi_dev_virt *pdv = dev->dev_ptr; - struct scsi_device *sd = pdv->pdv_sd; - -- return sd->type; -+ return (sd) ? sd->type : TYPE_NO_LUN; - } - - static sector_t pscsi_get_blocks(struct se_device *dev) diff --git a/patches/tcm_fc-missing-curly-braces-in-ft_invl_hw_context.patch b/patches/tcm_fc-missing-curly-braces-in-ft_invl_hw_context.patch deleted file mode 100644 index 2471d19..0000000 --- a/patches/tcm_fc-missing-curly-braces-in-ft_invl_hw_context.patch +++ /dev/null @@ -1,44 +0,0 @@ -From d556546e7ecd9fca199df4698943024d40044f8e Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@oracle.com> -Date: Wed, 25 Feb 2015 16:21:03 +0300 -Subject: tcm_fc: missing curly braces in ft_invl_hw_context() - -commit d556546e7ecd9fca199df4698943024d40044f8e upstream. - -This patch adds a missing set of conditional check braces in -ft_invl_hw_context() originally introduced by commit dcd998ccd -when handling DDP failures in ft_recv_write_data() code. - - commit dcd998ccdbf74a7d8fe0f0a44e85da1ed5975946 - Author: Kiran Patil <kiran.patil@intel.com> - Date: Wed Aug 3 09:20:01 2011 +0000 - - tcm_fc: Handle DDP/SW fc_frame_payload_get failures in ft_recv_write_data - -Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -Cc: Kiran Patil <kiran.patil@intel.com> -Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/target/tcm_fc/tfc_io.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/drivers/target/tcm_fc/tfc_io.c -+++ b/drivers/target/tcm_fc/tfc_io.c -@@ -330,7 +330,7 @@ void ft_invl_hw_context(struct ft_cmd *c - ep = fc_seq_exch(seq); - if (ep) { - lport = ep->lp; -- if (lport && (ep->xid <= lport->lro_xid)) -+ if (lport && (ep->xid <= lport->lro_xid)) { - /* - * "ddp_done" trigger invalidation of HW - * specific DDP context -@@ -345,6 +345,7 @@ void ft_invl_hw_context(struct ft_cmd *c - * identified using ep->xid) - */ - cmd->was_ddp_setup = 0; -+ } - } - } - } diff --git a/patches/team-fix-possible-null-pointer-dereference-in-team_handle_frame.patch b/patches/team-fix-possible-null-pointer-dereference-in-team_handle_frame.patch deleted file mode 100644 index cc9045f..0000000 --- a/patches/team-fix-possible-null-pointer-dereference-in-team_handle_frame.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 57e595631904c827cfa1a0f7bbd7cc9a49da5745 Mon Sep 17 00:00:00 2001 -From: Jiri Pirko <jiri@resnulli.us> -Date: Mon, 23 Feb 2015 14:02:54 +0100 -Subject: team: fix possible null pointer dereference in team_handle_frame - -commit 57e595631904c827cfa1a0f7bbd7cc9a49da5745 upstream. - -Currently following race is possible in team: - -CPU0 CPU1 - team_port_del - team_upper_dev_unlink - priv_flags &= ~IFF_TEAM_PORT -team_handle_frame - team_port_get_rcu - team_port_exists - priv_flags & IFF_TEAM_PORT == 0 - return NULL (instead of port got - from rx_handler_data) - netdev_rx_handler_unregister - -The thing is that the flag is removed before rx_handler is unregistered. -If team_handle_frame is called in between, team_port_exists returns 0 -and team_port_get_rcu will return NULL. -So do not check the flag here. It is guaranteed by netdev_rx_handler_unregister -that team_handle_frame will always see valid rx_handler_data pointer. - -Signed-off-by: Jiri Pirko <jiri@resnulli.us> -Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device") -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/team/team.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -39,9 +39,7 @@ - - static struct team_port *team_port_get_rcu(const struct net_device *dev) - { -- struct team_port *port = rcu_dereference(dev->rx_handler_data); -- -- return team_port_exists(dev) ? port : NULL; -+ return rcu_dereference(dev->rx_handler_data); - } - - static struct team_port *team_port_get_rtnl(const struct net_device *dev) diff --git a/patches/tty-fix-tty_wait_until_sent-on-64-bit-machines.patch b/patches/tty-fix-tty_wait_until_sent-on-64-bit-machines.patch deleted file mode 100644 index 9c58383..0000000 --- a/patches/tty-fix-tty_wait_until_sent-on-64-bit-machines.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 79fbf4a550ed6a22e1ae1516113e6c7fa5d56a53 Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Wed, 4 Mar 2015 10:39:06 +0100 -Subject: TTY: fix tty_wait_until_sent on 64-bit machines - -commit 79fbf4a550ed6a22e1ae1516113e6c7fa5d56a53 upstream. - -Fix overflow bug in tty_wait_until_sent on 64-bit machines, where an -infinite timeout (0) would be passed to the underlying tty-driver's -wait_until_sent-operation as a negative timeout (-1), causing it to -return immediately. - -This manifests itself for example as tcdrain() returning immediately, -drivers not honouring the drain flags when setting terminal attributes, -or even dropped data on close as a requested infinite closing-wait -timeout would be ignored. - -The first symptom was reported by Asier LLANO who noted that tcdrain() -returned prematurely when using the ftdi_sio usb-serial driver. - -Fix this by passing 0 rather than MAX_SCHEDULE_TIMEOUT (LONG_MAX) to the -underlying tty driver. - -Note that the serial-core wait_until_sent-implementation is not affected -by this bug due to a lucky chance (comparison to an unsigned maximum -timeout), and neither is the cyclades one that had an explicit check for -negative timeouts, but all other tty drivers appear to be affected. - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Reported-by: ZIV-Asier Llano Palacios <asier.llano@cgglobal.com> -Signed-off-by: Johan Hovold <johan@kernel.org> -Reviewed-by: Peter Hurley <peter@hurleysoftware.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/tty/tty_ioctl.c | 12 +++++++++--- - 1 file changed, 9 insertions(+), 3 deletions(-) - ---- a/drivers/tty/tty_ioctl.c -+++ b/drivers/tty/tty_ioctl.c -@@ -153,11 +153,17 @@ void tty_wait_until_sent(struct tty_stru - #endif - if (!timeout) - timeout = MAX_SCHEDULE_TIMEOUT; -+ - if (wait_event_interruptible_timeout(tty->write_wait, -- !tty_chars_in_buffer(tty), timeout) >= 0) { -- if (tty->ops->wait_until_sent) -- tty->ops->wait_until_sent(tty, timeout); -+ !tty_chars_in_buffer(tty), timeout) < 0) { -+ return; - } -+ -+ if (timeout == MAX_SCHEDULE_TIMEOUT) -+ timeout = 0; -+ -+ if (tty->ops->wait_until_sent) -+ tty->ops->wait_until_sent(tty, timeout); - } - EXPORT_SYMBOL(tty_wait_until_sent); - diff --git a/patches/tty-fix-up-atime-mtime-mess-take-four.patch b/patches/tty-fix-up-atime-mtime-mess-take-four.patch deleted file mode 100644 index 7598d95..0000000 --- a/patches/tty-fix-up-atime-mtime-mess-take-four.patch +++ /dev/null @@ -1,49 +0,0 @@ -From f0bf0bd07943bfde8f5ac39a32664810a379c7d3 Mon Sep 17 00:00:00 2001 -From: Jiri Slaby <jslaby@suse.cz> -Date: Fri, 27 Feb 2015 18:40:31 +0100 -Subject: tty: fix up atime/mtime mess, take four - -commit f0bf0bd07943bfde8f5ac39a32664810a379c7d3 upstream. - -This problem was taken care of three times already in -* b0de59b5733d18b0d1974a060860a8b5c1b36a2e (TTY: do not update - atime/mtime on read/write), -* 37b7f3c76595e23257f61bd80b223de8658617ee (TTY: fix atime/mtime - regression), and -* b0b885657b6c8ef63a46bc9299b2a7715d19acde (tty: fix up atime/mtime - mess, take three) - -But it still misses one point. As John Paul correctly points out, we -do not care about setting date. If somebody ever changes wall -time backwards (by mistake for example), tty timestamps are never -updated until the original wall time passes. - -So check the absolute difference of times and if it large than "8 -seconds or so", always update the time. That means we will update -immediatelly when changing time. Ergo, CAP_SYS_TIME can foul the -check, but it was always that way. - -Thanks John for serving me this so nicely debugged. - -Signed-off-by: Jiri Slaby <jslaby@suse.cz> -Reported-by: John Paul Perry <john_paul.perry@alcatel-lucent.com> -Acked-by: Linus Torvalds <torvalds@linux-foundation.org> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/tty/tty_io.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/tty/tty_io.c -+++ b/drivers/tty/tty_io.c -@@ -941,8 +941,8 @@ EXPORT_SYMBOL(start_tty); - /* We limit tty time update visibility to every 8 seconds or so. */ - static void tty_update_time(struct timespec *time) - { -- unsigned long sec = get_seconds() & ~7; -- if ((long)(sec - time->tv_sec) > 0) -+ unsigned long sec = get_seconds(); -+ if (abs(sec - time->tv_sec) & ~7) - time->tv_sec = sec; - } - diff --git a/patches/tty-prevent-untrappable-signals-from-malicious-program.patch b/patches/tty-prevent-untrappable-signals-from-malicious-program.patch deleted file mode 100644 index 753bc35..0000000 --- a/patches/tty-prevent-untrappable-signals-from-malicious-program.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 37480a05685ed5b8e1b9bf5e5c53b5810258b149 Mon Sep 17 00:00:00 2001 -From: Peter Hurley <peter@hurleysoftware.com> -Date: Mon, 19 Jan 2015 13:05:03 -0500 -Subject: tty: Prevent untrappable signals from malicious program - -commit 37480a05685ed5b8e1b9bf5e5c53b5810258b149 upstream. - -Commit 26df6d13406d1a5 ("tty: Add EXTPROC support for LINEMODE") -allows a process which has opened a pty master to send _any_ signal -to the process group of the pty slave. Although potentially -exploitable by a malicious program running a setuid program on -a pty slave, it's unknown if this exploit currently exists. - -Limit to signals actually used. - -Cc: Theodore Ts'o <tytso@mit.edu> -Cc: Howard Chu <hyc@symas.com> -Cc: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> -Cc: Jiri Slaby <jslaby@suse.cz> -Signed-off-by: Peter Hurley <peter@hurleysoftware.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/tty/pty.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/tty/pty.c -+++ b/drivers/tty/pty.c -@@ -173,6 +173,9 @@ static int pty_signal(struct tty_struct - unsigned long flags; - struct pid *pgrp; - -+ if (sig != SIGINT && sig != SIGQUIT && sig != SIGTSTP) -+ return -EINVAL; -+ - if (tty->link) { - spin_lock_irqsave(&tty->link->ctrl_lock, flags); - pgrp = get_pid(tty->link->pgrp); diff --git a/patches/ubi-fix-soft-lockup-in-ubi_check_volume.patch b/patches/ubi-fix-soft-lockup-in-ubi_check_volume.patch deleted file mode 100644 index c588018..0000000 --- a/patches/ubi-fix-soft-lockup-in-ubi_check_volume.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 9aa272b492e7551a9ee0e2c83c720ea013698485 Mon Sep 17 00:00:00 2001 -From: hujianyang <hujianyang@huawei.com> -Date: Tue, 30 Dec 2014 11:56:09 +0800 -Subject: UBI: fix soft lockup in ubi_check_volume() - -commit 9aa272b492e7551a9ee0e2c83c720ea013698485 upstream. - -Running mtd-utils/tests/ubi-tests/io_basic.c could cause -soft lockup or watchdog reset. It is because *updatevol* -will perform ubi_check_volume() after updating finish -and this function will full scan the updated lebs if the -volume is initialized as STATIC_VOLUME. - -This patch adds *cond_resched()* in the loop of lebs scan -to avoid soft lockup. - -Helped by Richard Weinberger <richard@nod.at> - -[ 2158.067096] INFO: rcu_sched self-detected stall on CPU { 1} (t=2101 jiffies g=1606 c=1605 q=56) -[ 2158.172867] CPU: 1 PID: 2073 Comm: io_basic Tainted: G O 3.10.53 #21 -[ 2158.172898] [<c000f624>] (unwind_backtrace+0x0/0x120) from [<c000c294>] (show_stack+0x10/0x14) -[ 2158.172918] [<c000c294>] (show_stack+0x10/0x14) from [<c008ac3c>] (rcu_check_callbacks+0x1c0/0x660) -[ 2158.172936] [<c008ac3c>] (rcu_check_callbacks+0x1c0/0x660) from [<c002b480>] (update_process_times+0x38/0x64) -[ 2158.172953] [<c002b480>] (update_process_times+0x38/0x64) from [<c005ff38>] (tick_sched_handle+0x54/0x60) -[ 2158.172966] [<c005ff38>] (tick_sched_handle+0x54/0x60) from [<c00601ac>] (tick_sched_timer+0x44/0x74) -[ 2158.172978] [<c00601ac>] (tick_sched_timer+0x44/0x74) from [<c003f348>] (__run_hrtimer+0xc8/0x1b8) -[ 2158.172992] [<c003f348>] (__run_hrtimer+0xc8/0x1b8) from [<c003fd9c>] (hrtimer_interrupt+0x128/0x2a4) -[ 2158.173007] [<c003fd9c>] (hrtimer_interrupt+0x128/0x2a4) from [<c0246f1c>] (arch_timer_handler_virt+0x28/0x30) -[ 2158.173022] [<c0246f1c>] (arch_timer_handler_virt+0x28/0x30) from [<c0086214>] (handle_percpu_devid_irq+0x9c/0x124) -[ 2158.173036] [<c0086214>] (handle_percpu_devid_irq+0x9c/0x124) from [<c0082bd8>] (generic_handle_irq+0x20/0x30) -[ 2158.173049] [<c0082bd8>] (generic_handle_irq+0x20/0x30) from [<c000969c>] (handle_IRQ+0x64/0x8c) -[ 2158.173060] [<c000969c>] (handle_IRQ+0x64/0x8c) from [<c0008544>] (gic_handle_irq+0x3c/0x60) -[ 2158.173074] [<c0008544>] (gic_handle_irq+0x3c/0x60) from [<c02f0f80>] (__irq_svc+0x40/0x50) -[ 2158.173083] Exception stack(0xc4043c98 to 0xc4043ce0) -[ 2158.173092] 3c80: c4043ce4 00000019 -[ 2158.173102] 3ca0: 1f8a865f c050ad10 1f8a864c 00000031 c04b5970 0003ebce 00000000 f3550000 -[ 2158.173113] 3cc0: bf00bc68 00000800 0003ebce c4043ce0 c0186d14 c0186cb8 80000013 ffffffff -[ 2158.173130] [<c02f0f80>] (__irq_svc+0x40/0x50) from [<c0186cb8>] (read_current_timer+0x4/0x38) -[ 2158.173145] [<c0186cb8>] (read_current_timer+0x4/0x38) from [<1f8a865f>] (0x1f8a865f) -[ 2183.927097] BUG: soft lockup - CPU#1 stuck for 22s! [io_basic:2073] -[ 2184.002229] Modules linked in: nandflash(O) [last unloaded: nandflash] - -Signed-off-by: Wang Kai <morgan.wang@huawei.com> -Signed-off-by: hujianyang <hujianyang@huawei.com> -Signed-off-by: Richard Weinberger <richard@nod.at> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/mtd/ubi/misc.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/drivers/mtd/ubi/misc.c -+++ b/drivers/mtd/ubi/misc.c -@@ -74,6 +74,8 @@ int ubi_check_volume(struct ubi_device * - for (i = 0; i < vol->used_ebs; i++) { - int size; - -+ cond_resched(); -+ - if (i == vol->used_ebs - 1) - size = vol->last_eb_bytes; - else diff --git a/patches/usb-add-flag-for-hcds-that-can-t-receive-wakeup-requests-isp1760-hcd.patch b/patches/usb-add-flag-for-hcds-that-can-t-receive-wakeup-requests-isp1760-hcd.patch deleted file mode 100644 index 9030af2..0000000 --- a/patches/usb-add-flag-for-hcds-that-can-t-receive-wakeup-requests-isp1760-hcd.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 074f9dd55f9cab1b82690ed7e44bcf38b9616ce0 Mon Sep 17 00:00:00 2001 -From: Alan Stern <stern@rowland.harvard.edu> -Date: Thu, 29 Jan 2015 15:05:04 -0500 -Subject: USB: add flag for HCDs that can't receive wakeup requests - (isp1760-hcd) - -commit 074f9dd55f9cab1b82690ed7e44bcf38b9616ce0 upstream. - -Currently the USB stack assumes that all host controller drivers are -capable of receiving wakeup requests from downstream devices. -However, this isn't true for the isp1760-hcd driver, which means that -it isn't safe to do a runtime suspend of any device attached to a -root-hub port if the device requires wakeup. - -This patch adds a "cant_recv_wakeups" flag to the usb_hcd structure -and sets the flag in isp1760-hcd. The core is modified to prevent a -direct child of the root hub from being put into runtime suspend with -wakeup enabled if the flag is set. - -Signed-off-by: Alan Stern <stern@rowland.harvard.edu> -Tested-by: Nicolas Pitre <nico@linaro.org> -Signed-off-by: Greg Kroah-Hartman <greg@kroah.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/core/driver.c | 12 ++++++++++++ - drivers/usb/host/isp1760-hcd.c | 3 +++ - include/linux/usb/hcd.h | 1 + - 3 files changed, 16 insertions(+) - ---- a/drivers/usb/core/driver.c -+++ b/drivers/usb/core/driver.c -@@ -1686,6 +1686,18 @@ static int autosuspend_check(struct usb_ - dev_dbg(&udev->dev, "remote wakeup needed for autosuspend\n"); - return -EOPNOTSUPP; - } -+ -+ /* -+ * If the device is a direct child of the root hub and the HCD -+ * doesn't handle wakeup requests, don't allow autosuspend when -+ * wakeup is needed. -+ */ -+ if (w && udev->parent == udev->bus->root_hub && -+ bus_to_hcd(udev->bus)->cant_recv_wakeups) { -+ dev_dbg(&udev->dev, "HCD doesn't handle wakeup requests\n"); -+ return -EOPNOTSUPP; -+ } -+ - udev->do_remote_wakeup = w; - return 0; - } ---- a/drivers/usb/host/isp1760-hcd.c -+++ b/drivers/usb/host/isp1760-hcd.c -@@ -2242,6 +2242,9 @@ struct usb_hcd *isp1760_register(phys_ad - hcd->rsrc_start = res_start; - hcd->rsrc_len = res_len; - -+ /* This driver doesn't support wakeup requests */ -+ hcd->cant_recv_wakeups = 1; -+ - ret = usb_add_hcd(hcd, irq, irqflags); - if (ret) - goto err_unmap; ---- a/include/linux/usb/hcd.h -+++ b/include/linux/usb/hcd.h -@@ -126,6 +126,7 @@ struct usb_hcd { - unsigned wireless:1; /* Wireless USB HCD */ - unsigned authorized_default:1; - unsigned has_tt:1; /* Integrated TT in root hub */ -+ unsigned cant_recv_wakeups:1; - - unsigned int irq; /* irq allocated */ - void __iomem *regs; /* device memory/io */ diff --git a/patches/usb-core-buffer-smallest-buffer-should-start-at-arch_dma_minalign.patch b/patches/usb-core-buffer-smallest-buffer-should-start-at-arch_dma_minalign.patch deleted file mode 100644 index 6bbb019..0000000 --- a/patches/usb-core-buffer-smallest-buffer-should-start-at-arch_dma_minalign.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 5efd2ea8c9f4f12916ffc8ba636792ce052f6911 Mon Sep 17 00:00:00 2001 -From: Sebastian Andrzej Siewior <bigeasy@linutronix.de> -Date: Fri, 5 Dec 2014 15:13:54 +0100 -Subject: usb: core: buffer: smallest buffer should start at ARCH_DMA_MINALIGN - -commit 5efd2ea8c9f4f12916ffc8ba636792ce052f6911 upstream. - -the following error pops up during "testusb -a -t 10" -| musb-hdrc musb-hdrc.1.auto: dma_pool_free buffer-128, f134e000/be842000 (bad dma) -hcd_buffer_create() creates a few buffers, the smallest has 32 bytes of -size. ARCH_KMALLOC_MINALIGN is set to 64 bytes. This combo results in -hcd_buffer_alloc() returning memory which is 32 bytes aligned and it -might by identified by buffer_offset() as another buffer. This means the -buffer which is on a 32 byte boundary will not get freed, instead it -tries to free another buffer with the error message. - -This patch fixes the issue by creating the smallest DMA buffer with the -size of ARCH_KMALLOC_MINALIGN (or 32 in case ARCH_KMALLOC_MINALIGN is -smaller). This might be 32, 64 or even 128 bytes. The next three pools -will have the size 128, 512 and 2048. -In case the smallest pool is 128 bytes then we have only three pools -instead of four (and zero the first entry in the array). -The last pool size is always 2048 bytes which is the assumed PAGE_SIZE / -2 of 4096. I doubt it makes sense to continue using PAGE_SIZE / 2 where -we would end up with 8KiB buffer in case we have 16KiB pages. -Instead I think it makes sense to have a common size(s) and extend them -if there is need to. -There is a BUILD_BUG_ON() now in case someone has a minalign of more than -128 bytes. - -Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> -Acked-by: Alan Stern <stern@rowland.harvard.edu> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/core/buffer.c | 26 +++++++++++++++++--------- - drivers/usb/core/usb.c | 1 + - include/linux/usb/hcd.h | 1 + - 3 files changed, 19 insertions(+), 9 deletions(-) - ---- a/drivers/usb/core/buffer.c -+++ b/drivers/usb/core/buffer.c -@@ -22,17 +22,25 @@ - */ - - /* FIXME tune these based on pool statistics ... */ --static const size_t pool_max[HCD_BUFFER_POOLS] = { -- /* platforms without dma-friendly caches might need to -- * prevent cacheline sharing... -- */ -- 32, -- 128, -- 512, -- PAGE_SIZE / 2 -- /* bigger --> allocate pages */ -+static size_t pool_max[HCD_BUFFER_POOLS] = { -+ 32, 128, 512, 2048, - }; - -+void __init usb_init_pool_max(void) -+{ -+ /* -+ * The pool_max values must never be smaller than -+ * ARCH_KMALLOC_MINALIGN. -+ */ -+ if (ARCH_KMALLOC_MINALIGN <= 32) -+ ; /* Original value is okay */ -+ else if (ARCH_KMALLOC_MINALIGN <= 64) -+ pool_max[0] = 64; -+ else if (ARCH_KMALLOC_MINALIGN <= 128) -+ pool_max[0] = 0; /* Don't use this pool */ -+ else -+ BUILD_BUG(); /* We don't allow this */ -+} - - /* SETUP primitives */ - ---- a/drivers/usb/core/usb.c -+++ b/drivers/usb/core/usb.c -@@ -1010,6 +1010,7 @@ static int __init usb_init(void) - pr_info("%s: USB support disabled\n", usbcore_name); - return 0; - } -+ usb_init_pool_max(); - - retval = usb_debugfs_init(); - if (retval) ---- a/include/linux/usb/hcd.h -+++ b/include/linux/usb/hcd.h -@@ -399,6 +399,7 @@ extern const struct dev_pm_ops usb_hcd_p - #endif /* CONFIG_PCI */ - - /* pci-ish (pdev null is ok) buffer alloc/mapping support */ -+void usb_init_pool_max(void); - int hcd_buffer_create(struct usb_hcd *hcd); - void hcd_buffer_destroy(struct usb_hcd *hcd); - diff --git a/patches/usb-cp210x-add-id-for-ruggedcom-usb-serial-console.patch b/patches/usb-cp210x-add-id-for-ruggedcom-usb-serial-console.patch deleted file mode 100644 index 40ae574..0000000 --- a/patches/usb-cp210x-add-id-for-ruggedcom-usb-serial-console.patch +++ /dev/null @@ -1,27 +0,0 @@ -From a6f0331236fa75afba14bbcf6668d42cebb55c43 Mon Sep 17 00:00:00 2001 -From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca> -Date: Wed, 21 Jan 2015 15:24:27 -0500 -Subject: USB: cp210x: add ID for RUGGEDCOM USB Serial Console - -commit a6f0331236fa75afba14bbcf6668d42cebb55c43 upstream. - -Added the USB serial console device ID for Siemens Ruggedcom devices -which have a USB port for their serial console. - -Signed-off-by: Len Sorensen <lsorense@csclub.uwaterloo.ca> -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/cp210x.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -63,6 +63,7 @@ static const struct usb_device_id id_tab - { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */ - { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ - { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ -+ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */ - { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */ - { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */ - { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */ diff --git a/patches/usb-fix-use-after-free-bug-in-usb_hcd_unlink_urb.patch b/patches/usb-fix-use-after-free-bug-in-usb_hcd_unlink_urb.patch deleted file mode 100644 index 1dc9a7d..0000000 --- a/patches/usb-fix-use-after-free-bug-in-usb_hcd_unlink_urb.patch +++ /dev/null @@ -1,63 +0,0 @@ -From c99197902da284b4b723451c1471c45b18537cde Mon Sep 17 00:00:00 2001 -From: Alan Stern <stern@rowland.harvard.edu> -Date: Fri, 30 Jan 2015 12:58:26 -0500 -Subject: USB: fix use-after-free bug in usb_hcd_unlink_urb() - -commit c99197902da284b4b723451c1471c45b18537cde upstream. - -The usb_hcd_unlink_urb() routine in hcd.c contains two possible -use-after-free errors. The dev_dbg() statement at the end of the -routine dereferences urb and urb->dev even though both structures may -have been deallocated. - -This patch fixes the problem by storing urb->dev in a local variable -(avoiding the dereference of urb) and moving the dev_dbg() up before -the usb_put_dev() call. - -Signed-off-by: Alan Stern <stern@rowland.harvard.edu> -Reported-by: Joe Lawrence <joe.lawrence@stratus.com> -Tested-by: Joe Lawrence <joe.lawrence@stratus.com> -Signed-off-by: Greg Kroah-Hartman <greg@kroah.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/core/hcd.c | 16 ++++++++-------- - 1 file changed, 8 insertions(+), 8 deletions(-) - ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -1528,6 +1528,7 @@ static int unlink1(struct usb_hcd *hcd, - int usb_hcd_unlink_urb (struct urb *urb, int status) - { - struct usb_hcd *hcd; -+ struct usb_device *udev = urb->dev; - int retval = -EIDRM; - unsigned long flags; - -@@ -1539,20 +1540,19 @@ int usb_hcd_unlink_urb (struct urb *urb, - spin_lock_irqsave(&hcd_urb_unlink_lock, flags); - if (atomic_read(&urb->use_count) > 0) { - retval = 0; -- usb_get_dev(urb->dev); -+ usb_get_dev(udev); - } - spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags); - if (retval == 0) { - hcd = bus_to_hcd(urb->dev->bus); - retval = unlink1(hcd, urb, status); -- usb_put_dev(urb->dev); -+ if (retval == 0) -+ retval = -EINPROGRESS; -+ else if (retval != -EIDRM && retval != -EBUSY) -+ dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n", -+ urb, retval); -+ usb_put_dev(udev); - } -- -- if (retval == 0) -- retval = -EINPROGRESS; -- else if (retval != -EIDRM && retval != -EBUSY) -- dev_dbg(&urb->dev->dev, "hcd_unlink_urb %p fail %d\n", -- urb, retval); - return retval; - } - diff --git a/patches/usb-ftdi_sio-add-jtag-quirk-support-for-cyber-cortex-av-boards.patch b/patches/usb-ftdi_sio-add-jtag-quirk-support-for-cyber-cortex-av-boards.patch deleted file mode 100644 index 9c6bebd..0000000 --- a/patches/usb-ftdi_sio-add-jtag-quirk-support-for-cyber-cortex-av-boards.patch +++ /dev/null @@ -1,51 +0,0 @@ -From c7d373c3f0da2b2b78c4b1ce5ae41485b3ef848c Mon Sep 17 00:00:00 2001 -From: Max Mansfield <max.m.mansfield@gmail.com> -Date: Mon, 2 Mar 2015 18:38:02 -0700 -Subject: usb: ftdi_sio: Add jtag quirk support for Cyber Cortex AV boards - -commit c7d373c3f0da2b2b78c4b1ce5ae41485b3ef848c upstream. - -This patch integrates Cyber Cortex AV boards with the existing -ftdi_jtag_quirk in order to use serial port 0 with JTAG which is -required by the manufacturers' software. - -Steps: 2 - -[ftdi_sio_ids.h] -1. Defined the device PID - -[ftdi_sio.c] -2. Added a macro declaration to the ids array, in order to enable the -jtag quirk for the device. - -Signed-off-by: Max Mansfield <max.m.mansfield@gmail.com> -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/ftdi_sio.c | 2 ++ - drivers/usb/serial/ftdi_sio_ids.h | 3 +++ - 2 files changed, 5 insertions(+) - ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -823,6 +823,8 @@ static struct usb_device_id id_table_com - { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) }, -+ { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID), -+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID), ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -38,6 +38,9 @@ - - #define FTDI_LUMEL_PD12_PID 0x6002 - -+/* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */ -+#define CYBER_CORTEX_AV_PID 0x8698 -+ - /* - * Marvell OpenRD Base, Client - * http://www.open-rd.org diff --git a/patches/usb-ftdi_sio-add-pids-for-actisense-usb-devices.patch b/patches/usb-ftdi_sio-add-pids-for-actisense-usb-devices.patch deleted file mode 100644 index dd2e64a..0000000 --- a/patches/usb-ftdi_sio-add-pids-for-actisense-usb-devices.patch +++ /dev/null @@ -1,74 +0,0 @@ -From f6950344d3cf4a1e231b5828b50c4ac168db3886 Mon Sep 17 00:00:00 2001 -From: Mark Glover <mark@actisense.com> -Date: Fri, 13 Feb 2015 09:04:39 +0000 -Subject: USB: ftdi_sio: add PIDs for Actisense USB devices - -commit f6950344d3cf4a1e231b5828b50c4ac168db3886 upstream. - -These product identifiers (PID) all deal with marine NMEA format data -used on motor boats and yachts. We supply the programmed devices to -Chetco, for use inside their equipment. The PIDs are a direct copy of -our Windows device drivers (FTDI drivers with altered PIDs). - -Signed-off-by: Mark Glover <mark@actisense.com> -[johan: edit commit message slightly ] -Signed-off-by: Johan Hovold <johan@kernel.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/ftdi_sio.c | 17 +++++++++++++++++ - drivers/usb/serial/ftdi_sio_ids.h | 20 ++++++++++++++++++++ - 2 files changed, 37 insertions(+) - ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1000,6 +1000,23 @@ static struct usb_device_id id_table_com - { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) }, - /* GE Healthcare devices */ - { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) }, -+ /* Active Research (Actisense) devices */ -+ { USB_DEVICE(FTDI_VID, ACTISENSE_NDC_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) }, -+ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_NMEA2000_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ETHERNET_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_WIFI_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) }, -+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) }, - { }, /* Optional parameter entry */ - { } /* Terminating entry */ - }; ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -1432,3 +1432,23 @@ - */ - #define GE_HEALTHCARE_VID 0x1901 - #define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015 -+ -+/* -+ * Active Research (Actisense) devices -+ */ -+#define ACTISENSE_NDC_PID 0xD9A8 /* NDC USB Serial Adapter */ -+#define ACTISENSE_USG_PID 0xD9A9 /* USG USB Serial Adapter */ -+#define ACTISENSE_NGT_PID 0xD9AA /* NGT NMEA2000 Interface */ -+#define ACTISENSE_NGW_PID 0xD9AB /* NGW NMEA2000 Gateway */ -+#define ACTISENSE_D9AC_PID 0xD9AC /* Actisense Reserved */ -+#define ACTISENSE_D9AD_PID 0xD9AD /* Actisense Reserved */ -+#define ACTISENSE_D9AE_PID 0xD9AE /* Actisense Reserved */ -+#define ACTISENSE_D9AF_PID 0xD9AF /* Actisense Reserved */ -+#define CHETCO_SEAGAUGE_PID 0xA548 /* SeaGauge USB Adapter */ -+#define CHETCO_SEASWITCH_PID 0xA549 /* SeaSwitch USB Adapter */ -+#define CHETCO_SEASMART_NMEA2000_PID 0xA54A /* SeaSmart NMEA2000 Gateway */ -+#define CHETCO_SEASMART_ETHERNET_PID 0xA54B /* SeaSmart Ethernet Gateway */ -+#define CHETCO_SEASMART_WIFI_PID 0xA5AC /* SeaSmart Wifi Gateway */ -+#define CHETCO_SEASMART_DISPLAY_PID 0xA5AD /* SeaSmart NMEA2000 Display */ -+#define CHETCO_SEASMART_LITE_PID 0xA5AE /* SeaSmart Lite USB Adapter */ -+#define CHETCO_SEASMART_ANALOG_PID 0xA5AF /* SeaSmart Analog Adapter */ diff --git a/patches/usb-ftdi_sio-added-custom-pid-for-synapse-wireless-product.patch b/patches/usb-ftdi_sio-added-custom-pid-for-synapse-wireless-product.patch deleted file mode 100644 index 883e643..0000000 --- a/patches/usb-ftdi_sio-added-custom-pid-for-synapse-wireless-product.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 4899c054a90439477b24da8977db8d738376fe90 Mon Sep 17 00:00:00 2001 -From: Doug Goldstein <cardoe@cardoe.com> -Date: Sun, 15 Mar 2015 21:56:04 -0500 -Subject: USB: ftdi_sio: Added custom PID for Synapse Wireless product - -commit 4899c054a90439477b24da8977db8d738376fe90 upstream. - -Synapse Wireless uses the FTDI VID with a custom PID of 0x9090 for their -SNAP Stick 200 product. - -Signed-off-by: Doug Goldstein <cardoe@cardoe.com> -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/ftdi_sio.c | 1 + - drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ - 2 files changed, 7 insertions(+) - ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -628,6 +628,7 @@ static struct usb_device_id id_table_com - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, -+ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, - /* - * ELV devices: - */ ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -561,6 +561,12 @@ - */ - #define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ - -+/* -+ * Synapse Wireless product ids (FTDI_VID) -+ * http://www.synapse-wireless.com -+ */ -+#define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */ -+ - - /********************************/ - /** third-party VID/PID combos **/ diff --git a/patches/usb-ftdi_sio-use-jtag-quirk-for-snap-connect-e10.patch b/patches/usb-ftdi_sio-use-jtag-quirk-for-snap-connect-e10.patch deleted file mode 100644 index 75fa950..0000000 --- a/patches/usb-ftdi_sio-use-jtag-quirk-for-snap-connect-e10.patch +++ /dev/null @@ -1,36 +0,0 @@ -From b229a0f840f774d29d8fedbf5deb344ca36b7f1a Mon Sep 17 00:00:00 2001 -From: Doug Goldstein <cardoe@cardoe.com> -Date: Mon, 23 Mar 2015 20:34:48 -0500 -Subject: USB: ftdi_sio: Use jtag quirk for SNAP Connect E10 - -commit b229a0f840f774d29d8fedbf5deb344ca36b7f1a upstream. - -This patch uses the existing CALAO Systems ftdi_8u2232c_probe in order -to avoid attaching a TTY to the JTAG port as this board is based on the -CALAO Systems reference design and needs the same fix up. - -Signed-off-by: Doug Goldstein <cardoe@cardoe.com> -[johan: clean up probe logic ] -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/ftdi_sio.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1950,8 +1950,12 @@ static int ftdi_8u2232c_probe(struct usb - - dbg("%s", __func__); - -- if ((udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) || -- (udev->product && !strcmp(udev->product, "BeagleBone/XDS100V2"))) -+ if (udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) -+ return ftdi_jtag_probe(serial); -+ -+ if (udev->product && -+ (!strcmp(udev->product, "BeagleBone/XDS100V2") || -+ !strcmp(udev->product, "SNAP Connect E10"))) - return ftdi_jtag_probe(serial); - - return 0; diff --git a/patches/usb-serial-cp210x-adding-seletek-device-id-s.patch b/patches/usb-serial-cp210x-adding-seletek-device-id-s.patch deleted file mode 100644 index df59063..0000000 --- a/patches/usb-serial-cp210x-adding-seletek-device-id-s.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 675af70856d7cc026be8b6ea7a8b9db10b8b38a1 Mon Sep 17 00:00:00 2001 -From: Michiel vd Garde <mgparser@gmail.com> -Date: Fri, 27 Feb 2015 02:08:29 +0100 -Subject: USB: serial: cp210x: Adding Seletek device id's - -commit 675af70856d7cc026be8b6ea7a8b9db10b8b38a1 upstream. - -These device ID's are not associated with the cp210x module currently, -but should be. This patch allows the devices to operate upon connecting -them to the usb bus as intended. - -Signed-off-by: Michiel van de Garde <mgparser@gmail.com> -Signed-off-by: Johan Hovold <johan@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/cp210x.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -153,6 +153,8 @@ static const struct usb_device_id id_tab - { USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */ - { USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */ - { USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */ -+ { USB_DEVICE(0x16C0, 0x09B0) }, /* Lunatico Seletek */ -+ { USB_DEVICE(0x16C0, 0x09B1) }, /* Lunatico Seletek */ - { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */ - { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */ - { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */ diff --git a/patches/usb-serial-fix-potential-use-after-free-after-failed-probe.patch b/patches/usb-serial-fix-potential-use-after-free-after-failed-probe.patch deleted file mode 100644 index 35ff767..0000000 --- a/patches/usb-serial-fix-potential-use-after-free-after-failed-probe.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 07fdfc5e9f1c966be8722e8fa927e5ea140df5ce Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Wed, 18 Feb 2015 10:34:50 +0700 -Subject: USB: serial: fix potential use-after-free after failed probe - -commit 07fdfc5e9f1c966be8722e8fa927e5ea140df5ce upstream. - -Fix return value in probe error path, which could end up returning -success (0) on errors. This could in turn lead to use-after-free or -double free (e.g. in port_remove) when the port device is removed. - -Fixes: c706ebdfc895 ("USB: usb-serial: call port_probe and port_remove -at the right times") -Signed-off-by: Johan Hovold <johan@kernel.org> -Acked-by: Greg Kroah-Hartman <greg@kroah.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/bus.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/usb/serial/bus.c -+++ b/drivers/usb/serial/bus.c -@@ -71,7 +71,7 @@ static int usb_serial_device_probe(struc - retval = device_create_file(dev, &dev_attr_port_number); - if (retval) { - if (driver->port_remove) -- retval = driver->port_remove(port); -+ driver->port_remove(port); - goto exit; - } - diff --git a/patches/usb-serial-fix-tty-device-error-handling-at-probe.patch b/patches/usb-serial-fix-tty-device-error-handling-at-probe.patch deleted file mode 100644 index 2e9ca84..0000000 --- a/patches/usb-serial-fix-tty-device-error-handling-at-probe.patch +++ /dev/null @@ -1,50 +0,0 @@ -From ca4383a3947a83286bc9b9c598a1f55e867871d7 Mon Sep 17 00:00:00 2001 -From: Johan Hovold <johan@kernel.org> -Date: Wed, 18 Feb 2015 10:34:51 +0700 -Subject: USB: serial: fix tty-device error handling at probe - -commit ca4383a3947a83286bc9b9c598a1f55e867871d7 upstream. - -Add missing error handling when registering the tty device at port -probe. This avoids trying to remove an uninitialised character device -when the port device is removed. - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Reported-by: Takashi Iwai <tiwai@suse.de> -Signed-off-by: Johan Hovold <johan@kernel.org> -Acked-by: Greg Kroah-Hartman <greg@kroah.com> -[lizf: Backported to 3.4: - - adjust context - - s/goto exit_with_autopm/goto exit] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/serial/bus.c | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - ---- a/drivers/usb/serial/bus.c -+++ b/drivers/usb/serial/bus.c -@@ -52,6 +52,7 @@ static int usb_serial_device_probe(struc - { - struct usb_serial_driver *driver; - struct usb_serial_port *port; -+ struct device *tty_dev; - int retval = 0; - int minor; - -@@ -76,7 +77,15 @@ static int usb_serial_device_probe(struc - } - - minor = port->number; -- tty_register_device(usb_serial_tty_driver, minor, dev); -+ tty_dev = tty_register_device(usb_serial_tty_driver, minor, dev); -+ if (IS_ERR(tty_dev)) { -+ retval = PTR_ERR(tty_dev); -+ device_remove_file(dev, &dev_attr_port_number); -+ if (driver->port_remove) -+ driver->port_remove(port); -+ goto exit; -+ } -+ - dev_info(&port->serial->dev->dev, - "%s converter now attached to ttyUSB%d\n", - driver->description, minor); diff --git a/patches/usb-usbfs-don-t-leak-kernel-data-in-siginfo.patch b/patches/usb-usbfs-don-t-leak-kernel-data-in-siginfo.patch deleted file mode 100644 index 4ddd1b1..0000000 --- a/patches/usb-usbfs-don-t-leak-kernel-data-in-siginfo.patch +++ /dev/null @@ -1,39 +0,0 @@ -From f0c2b68198589249afd2b1f2c4e8de8c03e19c16 Mon Sep 17 00:00:00 2001 -From: Alan Stern <stern@rowland.harvard.edu> -Date: Fri, 13 Feb 2015 10:54:53 -0500 -Subject: USB: usbfs: don't leak kernel data in siginfo - -commit f0c2b68198589249afd2b1f2c4e8de8c03e19c16 upstream. - -When a signal is delivered, the information in the siginfo structure -is copied to userspace. Good security practice dicatates that the -unused fields in this structure should be initialized to 0 so that -random kernel stack data isn't exposed to the user. This patch adds -such an initialization to the two places where usbfs raises signals. - -Signed-off-by: Alan Stern <stern@rowland.harvard.edu> -Reported-by: Dave Mielke <dave@mielke.cc> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/core/devio.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -444,6 +444,7 @@ static void async_completed(struct urb * - as->status = urb->status; - signr = as->signr; - if (signr) { -+ memset(&sinfo, 0, sizeof(sinfo)); - sinfo.si_signo = as->signr; - sinfo.si_errno = as->status; - sinfo.si_code = SI_ASYNCIO; -@@ -2091,6 +2092,7 @@ static void usbdev_remove(struct usb_dev - wake_up_all(&ps->wait); - list_del_init(&ps->list); - if (ps->discsignr) { -+ memset(&sinfo, 0, sizeof(sinfo)); - sinfo.si_signo = ps->discsignr; - sinfo.si_errno = EPIPE; - sinfo.si_code = SI_ASYNCIO; diff --git a/patches/usb-xhci-apply-xhci_avoid_bei-quirk-to-all-intel-xhci-controllers.patch b/patches/usb-xhci-apply-xhci_avoid_bei-quirk-to-all-intel-xhci-controllers.patch deleted file mode 100644 index 0762787..0000000 --- a/patches/usb-xhci-apply-xhci_avoid_bei-quirk-to-all-intel-xhci-controllers.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 227a4fd801c8a9fa2c4700ab98ec1aec06e3b44d Mon Sep 17 00:00:00 2001 -From: Lu Baolu <baolu.lu@linux.intel.com> -Date: Mon, 23 Mar 2015 18:27:42 +0200 -Subject: usb: xhci: apply XHCI_AVOID_BEI quirk to all Intel xHCI controllers - -commit 227a4fd801c8a9fa2c4700ab98ec1aec06e3b44d upstream. - -When a device with an isochronous endpoint is plugged into the Intel -xHCI host controller, and the driver submits multiple frames per URB, -the xHCI driver will set the Block Event Interrupt (BEI) flag on all -but the last TD for the URB. This causes the host controller to place -an event on the event ring, but not send an interrupt. When the last -TD for the URB completes, BEI is cleared, and we get an interrupt for -the whole URB. - -However, under Intel xHCI host controllers, if the event ring is full -of events from transfers with BEI set, an "Event Ring is Full" event -will be posted to the last entry of the event ring, but no interrupt -is generated. Host will cease all transfer and command executions and -wait until software completes handling the pending events in the event -ring. That means xHC stops, but event of "event ring is full" is not -notified. As the result, the xHC looks like dead to user. - -This patch is to apply XHCI_AVOID_BEI quirk to Intel xHC devices. And -it should be backported to kernels as old as 3.0, that contains the -commit 69e848c2090a ("Intel xhci: Support EHCI/xHCI port switching."). - -Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> -Tested-by: Alistair Grant <akgrant0710@gmail.com> -Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/host/xhci-pci.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -105,6 +105,8 @@ static void xhci_pci_quirks(struct devic - if (pdev->vendor == PCI_VENDOR_ID_AMD) - xhci->quirks |= XHCI_TRUST_TX_LENGTH; - -+ if (pdev->vendor == PCI_VENDOR_ID_INTEL) -+ xhci->quirks |= XHCI_AVOID_BEI; - if (pdev->vendor == PCI_VENDOR_ID_INTEL && - pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) { - xhci->quirks |= XHCI_EP_LIMIT_QUIRK; -@@ -119,7 +121,6 @@ static void xhci_pci_quirks(struct devic - * PPT chipsets. - */ - xhci->quirks |= XHCI_SPURIOUS_REBOOT; -- xhci->quirks |= XHCI_AVOID_BEI; - } - if (pdev->vendor == PCI_VENDOR_ID_INTEL && - (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || diff --git a/patches/usb-xhci-handle-config-error-change-cec-in-xhci-driver.patch b/patches/usb-xhci-handle-config-error-change-cec-in-xhci-driver.patch deleted file mode 100644 index afeeb87..0000000 --- a/patches/usb-xhci-handle-config-error-change-cec-in-xhci-driver.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 9425183d177aa4a2f09d01a74925124f0778b595 Mon Sep 17 00:00:00 2001 -From: Lu Baolu <baolu.lu@linux.intel.com> -Date: Mon, 23 Mar 2015 18:27:41 +0200 -Subject: usb: xhci: handle Config Error Change (CEC) in xhci driver - -commit 9425183d177aa4a2f09d01a74925124f0778b595 upstream. - -Linux xHCI driver doesn't report and handle port cofig error change. -If Port Configure Error for root hub port occurs, CEC bit in PORTSC -would be set by xHC and remains 1. This happends when the root port -fails to configure its link partner, e.g. the port fails to exchange -port capabilities information using Port Capability LMPs. - -Then the Port Status Change Events will be blocked until all status -change bits(CEC is one of the change bits) are cleared('0') (refer to -xHCI spec 4.19.2). Otherwise, the port status change event for this -root port will not be generated anymore, then root port would look -like dead for user and can't be recovered until a Host Controller -Reset(HCRST). - -This patch is to check CEC bit in PORTSC in xhci_get_port_status() -and set a Config Error in the return status if CEC is set. This will -cause a ClearPortFeature request, where CEC bit is cleared in -xhci_clear_port_change_bit(). - -[The commit log is based on initial Marvell patch posted at -http://marc.info/?l=linux-kernel&m=142323612321434&w=2] - -Reported-by: Gregory CLEMENT <gregory.clement@free-electrons.com> -Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> -Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -[lizf: Backported to 3.4: - - adjust indentation - - s/raw_port_status/temp/] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/host/xhci-hub.c | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -383,6 +383,10 @@ static void xhci_clear_port_change_bit(s - status = PORT_PLC; - port_change_bit = "link state"; - break; -+ case USB_PORT_FEAT_C_PORT_CONFIG_ERROR: -+ status = PORT_CEC; -+ port_change_bit = "config error"; -+ break; - default: - /* Should never happen */ - return; -@@ -617,6 +621,8 @@ int xhci_hub_control(struct usb_hcd *hcd - status |= USB_PORT_STAT_C_LINK_STATE << 16; - if ((temp & PORT_WRC)) - status |= USB_PORT_STAT_C_BH_RESET << 16; -+ if ((temp & PORT_CEC)) -+ status |= USB_PORT_STAT_C_CONFIG_ERROR << 16; - } - - if (hcd->speed != HCD_USB3) { -@@ -904,6 +910,7 @@ int xhci_hub_control(struct usb_hcd *hcd - case USB_PORT_FEAT_C_OVER_CURRENT: - case USB_PORT_FEAT_C_ENABLE: - case USB_PORT_FEAT_C_PORT_LINK_STATE: -+ case USB_PORT_FEAT_C_PORT_CONFIG_ERROR: - xhci_clear_port_change_bit(xhci, wValue, wIndex, - port_array[wIndex], temp); - break; -@@ -957,7 +964,7 @@ int xhci_hub_status_data(struct usb_hcd - */ - status = bus_state->resuming_ports; - -- mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC; -+ mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC; - - spin_lock_irqsave(&xhci->lock, flags); - /* For each port, did anything change? If so, set that bit in buf. */ diff --git a/patches/virtio_console-avoid-config-access-from-irq.patch b/patches/virtio_console-avoid-config-access-from-irq.patch deleted file mode 100644 index e1b10d9..0000000 --- a/patches/virtio_console-avoid-config-access-from-irq.patch +++ /dev/null @@ -1,78 +0,0 @@ -From eeb8a7e8bb123e84daeef84f5a2eab99ad2839a2 Mon Sep 17 00:00:00 2001 -From: "Michael S. Tsirkin" <mst@redhat.com> -Date: Thu, 5 Mar 2015 10:45:49 +1030 -Subject: virtio_console: avoid config access from irq - -commit eeb8a7e8bb123e84daeef84f5a2eab99ad2839a2 upstream. - -when multiport is off, virtio console invokes config access from irq -context, config access is blocking on s390. -Fix this up by scheduling work from config irq - similar to what we do -for multiport configs. - -Signed-off-by: Michael S. Tsirkin <mst@redhat.com> -Reviewed-by: Amit Shah <amit.shah@redhat.com> -Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/char/virtio_console.c | 16 ++++++++++++++++ - 1 file changed, 16 insertions(+) - ---- a/drivers/char/virtio_console.c -+++ b/drivers/char/virtio_console.c -@@ -124,6 +124,7 @@ struct ports_device { - * notification - */ - struct work_struct control_work; -+ struct work_struct config_work; - - struct list_head ports; - -@@ -1555,10 +1556,21 @@ static void config_intr(struct virtio_de - - portdev = vdev->priv; - -+ if (!use_multiport(portdev)) -+ schedule_work(&portdev->config_work); -+} -+ -+static void config_work_handler(struct work_struct *work) -+{ -+ struct ports_device *portdev; -+ -+ portdev = container_of(work, struct ports_device, control_work); - if (!use_multiport(portdev)) { -+ struct virtio_device *vdev; - struct port *port; - u16 rows, cols; - -+ vdev = portdev->vdev; - vdev->config->get(vdev, - offsetof(struct virtio_console_config, cols), - &cols, sizeof(u16)); -@@ -1752,6 +1764,7 @@ static int __devinit virtcons_probe(stru - spin_lock_init(&portdev->ports_lock); - INIT_LIST_HEAD(&portdev->ports); - -+ INIT_WORK(&portdev->config_work, &config_work_handler); - INIT_WORK(&portdev->control_work, &control_work_handler); - - if (multiport) { -@@ -1826,6 +1839,8 @@ static void virtcons_remove(struct virti - /* Finish up work that's lined up */ - if (use_multiport(portdev)) - cancel_work_sync(&portdev->control_work); -+ else -+ cancel_work_sync(&portdev->config_work); - - list_for_each_entry_safe(port, port2, &portdev->ports, list) - unplug_port(port); -@@ -1867,6 +1882,7 @@ static int virtcons_freeze(struct virtio - - virtqueue_disable_cb(portdev->c_ivq); - cancel_work_sync(&portdev->control_work); -+ cancel_work_sync(&portdev->config_work); - /* - * Once more: if control_work_handler() was running, it would - * enable the cb as the last step. diff --git a/patches/virtio_console-init-work-unconditionally.patch b/patches/virtio_console-init-work-unconditionally.patch deleted file mode 100644 index 48b3e3a..0000000 --- a/patches/virtio_console-init-work-unconditionally.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 4f6e24ed9de8634d6471ef86b382cba6d4e57ca8 Mon Sep 17 00:00:00 2001 -From: "Michael S. Tsirkin" <mst@redhat.com> -Date: Thu, 5 Mar 2015 10:45:30 +1030 -Subject: virtio_console: init work unconditionally - -commit 4f6e24ed9de8634d6471ef86b382cba6d4e57ca8 upstream. - -when multiport is off, we don't initialize config work, -but we then cancel uninitialized control_work on freeze. - -Signed-off-by: Michael S. Tsirkin <mst@redhat.com> -Reviewed-by: Amit Shah <amit.shah@redhat.com> -Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/char/virtio_console.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/drivers/char/virtio_console.c -+++ b/drivers/char/virtio_console.c -@@ -1752,12 +1752,13 @@ static int __devinit virtcons_probe(stru - spin_lock_init(&portdev->ports_lock); - INIT_LIST_HEAD(&portdev->ports); - -+ INIT_WORK(&portdev->control_work, &control_work_handler); -+ - if (multiport) { - unsigned int nr_added_bufs; - - spin_lock_init(&portdev->c_ivq_lock); - spin_lock_init(&portdev->c_ovq_lock); -- INIT_WORK(&portdev->control_work, &control_work_handler); - - nr_added_bufs = fill_queue(portdev->c_ivq, - &portdev->c_ivq_lock); diff --git a/patches/vt-provide-notifications-on-selection-changes.patch b/patches/vt-provide-notifications-on-selection-changes.patch deleted file mode 100644 index 50cce5a..0000000 --- a/patches/vt-provide-notifications-on-selection-changes.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 19e3ae6b4f07a87822c1c9e7ed99d31860e701af Mon Sep 17 00:00:00 2001 -From: Nicolas Pitre <nicolas.pitre@linaro.org> -Date: Fri, 23 Jan 2015 17:07:21 -0500 -Subject: vt: provide notifications on selection changes - -commit 19e3ae6b4f07a87822c1c9e7ed99d31860e701af upstream. - -The vcs device's poll/fasync support relies on the vt notifier to signal -changes to the screen content. Notifier invocations were missing for -changes that comes through the selection interface though. Fix that. - -Tested with BRLTTY 5.2. - -Signed-off-by: Nicolas Pitre <nico@linaro.org> -Cc: Dave Mielke <dave@mielke.cc> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/tty/vt/vt.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/drivers/tty/vt/vt.c -+++ b/drivers/tty/vt/vt.c -@@ -498,6 +498,7 @@ void invert_screen(struct vc_data *vc, i - #endif - if (DO_UPDATE(vc)) - do_update_region(vc, (unsigned long) p, count); -+ notify_update(vc); - } - - /* used by selection: complement pointer position */ -@@ -514,6 +515,7 @@ void complement_pos(struct vc_data *vc, - scr_writew(old, screenpos(vc, old_offset, 1)); - if (DO_UPDATE(vc)) - vc->vc_sw->con_putc(vc, old, oldy, oldx); -+ notify_update(vc); - } - - old_offset = offset; -@@ -531,8 +533,8 @@ void complement_pos(struct vc_data *vc, - oldy = (offset >> 1) / vc->vc_cols; - vc->vc_sw->con_putc(vc, new, oldy, oldx); - } -+ notify_update(vc); - } -- - } - - static void insert_char(struct vc_data *vc, unsigned int nr) diff --git a/patches/vt6655-rfbsetpower-fix-missing-rate-rate_12m.patch b/patches/vt6655-rfbsetpower-fix-missing-rate-rate_12m.patch deleted file mode 100644 index 4b74f51..0000000 --- a/patches/vt6655-rfbsetpower-fix-missing-rate-rate_12m.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 40c8790bcb7ac74f3038153cd09310e220c6a1df Mon Sep 17 00:00:00 2001 -From: Malcolm Priestley <tvboxspy@gmail.com> -Date: Sat, 7 Mar 2015 17:04:54 +0000 -Subject: vt6655: RFbSetPower fix missing rate RATE_12M - -commit 40c8790bcb7ac74f3038153cd09310e220c6a1df upstream. - -When the driver sets this rate a power of zero value is set causing -data flow stoppage until another rate is tried. - -Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -[lizf: Backported to 3.4: adjust indentation] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/staging/vt6655/rf.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/staging/vt6655/rf.c -+++ b/drivers/staging/vt6655/rf.c -@@ -1029,6 +1029,7 @@ unsigned char byPwrdBm = 0; - break; - case RATE_6M: - case RATE_9M: -+ case RATE_12M: - case RATE_18M: - byPwr = pDevice->abyOFDMPwrTbl[uCH]; - if (pDevice->byRFType == RF_UW2452) { diff --git a/patches/writeback-add-missing-initial_jiffies-init-in-global_update_bandwidth.patch b/patches/writeback-add-missing-initial_jiffies-init-in-global_update_bandwidth.patch deleted file mode 100644 index bf82383..0000000 --- a/patches/writeback-add-missing-initial_jiffies-init-in-global_update_bandwidth.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 7d70e15480c0450d2bfafaad338a32e884fc215e Mon Sep 17 00:00:00 2001 -From: Tejun Heo <tj@kernel.org> -Date: Wed, 4 Mar 2015 10:37:43 -0500 -Subject: writeback: add missing INITIAL_JIFFIES init in - global_update_bandwidth() - -commit 7d70e15480c0450d2bfafaad338a32e884fc215e upstream. - -global_update_bandwidth() uses static variable update_time as the -timestamp for the last update but forgets to initialize it to -INITIALIZE_JIFFIES. - -This means that global_dirty_limit will be 5 mins into the future on -32bit and some large amount jiffies into the past on 64bit. This -isn't critical as the only effect is that global_dirty_limit won't be -updated for the first 5 mins after booting on 32bit machines, -especially given the auxiliary nature of global_dirty_limit's role - -protecting against global dirty threshold's sudden dips; however, it -does lead to unintended suboptimal behavior. Fix it. - -Fixes: c42843f2f0bb ("writeback: introduce smoothed global dirty limit") -Signed-off-by: Tejun Heo <tj@kernel.org> -Acked-by: Jan Kara <jack@suse.cz> -Cc: Wu Fengguang <fengguang.wu@intel.com> -Cc: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Jens Axboe <axboe@fb.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/page-writeback.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/mm/page-writeback.c -+++ b/mm/page-writeback.c -@@ -831,7 +831,7 @@ static void global_update_bandwidth(unsi - unsigned long now) - { - static DEFINE_SPINLOCK(dirty_lock); -- static unsigned long update_time; -+ static unsigned long update_time = INITIAL_JIFFIES; - - /* - * check locklessly first to optimize away locking for the most time diff --git a/patches/writeback-fix-possible-underflow-in-write-bandwidth-calculation.patch b/patches/writeback-fix-possible-underflow-in-write-bandwidth-calculation.patch deleted file mode 100644 index c915ac6..0000000 --- a/patches/writeback-fix-possible-underflow-in-write-bandwidth-calculation.patch +++ /dev/null @@ -1,53 +0,0 @@ -From c72efb658f7c8b27ca3d0efb5cfd5ded9fcac89e Mon Sep 17 00:00:00 2001 -From: Tejun Heo <tj@kernel.org> -Date: Mon, 23 Mar 2015 00:18:48 -0400 -Subject: writeback: fix possible underflow in write bandwidth calculation - -commit c72efb658f7c8b27ca3d0efb5cfd5ded9fcac89e upstream. - -From 1ebf33901ecc75d9496862dceb1ef0377980587c Mon Sep 17 00:00:00 2001 -From: Tejun Heo <tj@kernel.org> -Date: Mon, 23 Mar 2015 00:08:19 -0400 - -2f800fbd777b ("writeback: fix dirtied pages accounting on redirty") -introduced account_page_redirty() which reverts stat updates for a -redirtied page, making BDI_DIRTIED no longer monotonically increasing. - -bdi_update_write_bandwidth() uses the delta in BDI_DIRTIED as the -basis for bandwidth calculation. While unlikely, since the above -patch, the newer value may be lower than the recorded past value and -underflow the bandwidth calculation leading to a wild result. - -Fix it by subtracing min of the old and new values when calculating -delta. AFAIK, there hasn't been any report of it happening but the -resulting erratic behavior would be non-critical and temporary, so -it's possible that the issue is happening without being reported. The -risk of the fix is very low, so tagged for -stable. - -Signed-off-by: Tejun Heo <tj@kernel.org> -Cc: Jens Axboe <axboe@kernel.dk> -Cc: Jan Kara <jack@suse.cz> -Cc: Wu Fengguang <fengguang.wu@intel.com> -Cc: Greg Thelen <gthelen@google.com> -Fixes: 2f800fbd777b ("writeback: fix dirtied pages accounting on redirty") -Signed-off-by: Jens Axboe <axboe@fb.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/page-writeback.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - ---- a/mm/page-writeback.c -+++ b/mm/page-writeback.c -@@ -766,8 +766,11 @@ static void bdi_update_write_bandwidth(s - * bw * elapsed + write_bandwidth * (period - elapsed) - * write_bandwidth = --------------------------------------------------- - * period -+ * -+ * @written may have decreased due to account_page_redirty(). -+ * Avoid underflowing @bw calculation. - */ -- bw = written - bdi->written_stamp; -+ bw = written - min(written, bdi->written_stamp); - bw *= HZ; - if (unlikely(elapsed > period)) { - do_div(bw, elapsed); diff --git a/patches/writeback-use-1-instead-of-1-to-protect-against-div-by-zero.patch b/patches/writeback-use-1-instead-of-1-to-protect-against-div-by-zero.patch deleted file mode 100644 index 045cd7d..0000000 --- a/patches/writeback-use-1-instead-of-1-to-protect-against-div-by-zero.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 464d1387acb94dc43ba772b35242345e3d2ead1b Mon Sep 17 00:00:00 2001 -From: Tejun Heo <tj@kernel.org> -Date: Tue, 21 Apr 2015 16:49:13 -0400 -Subject: writeback: use |1 instead of +1 to protect against div by zero - -commit 464d1387acb94dc43ba772b35242345e3d2ead1b upstream. - -mm/page-writeback.c has several places where 1 is added to the divisor -to prevent division by zero exceptions; however, if the original -divisor is equivalent to -1, adding 1 leads to division by zero. - -There are three places where +1 is used for this purpose - one in -pos_ratio_polynom() and two in bdi_position_ratio(). The second one -in bdi_position_ratio() actually triggered div-by-zero oops on a -machine running a 3.10 kernel. The divisor is - - x_intercept - bdi_setpoint + 1 == span + 1 - -span is confirmed to be (u32)-1. It isn't clear how it ended up that -but it could be from write bandwidth calculation underflow fixed by -c72efb658f7c ("writeback: fix possible underflow in write bandwidth -calculation"). - -At any rate, +1 isn't a proper protection against div-by-zero. This -patch converts all +1 protections to |1. Note that -bdi_update_dirty_ratelimit() was already using |1 before this patch. - -Signed-off-by: Tejun Heo <tj@kernel.org> -Reviewed-by: Jan Kara <jack@suse.cz> -Signed-off-by: Jens Axboe <axboe@fb.com> -[lizf: Backported to 3.4: drop other two changes as there's only one - such statment in 3.4] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - mm/page-writeback.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/mm/page-writeback.c -+++ b/mm/page-writeback.c -@@ -716,7 +716,7 @@ static unsigned long bdi_position_ratio( - * scale global setpoint to bdi's: - * bdi_setpoint = setpoint * bdi_thresh / thresh - */ -- x = div_u64((u64)bdi_thresh << 16, thresh + 1); -+ x = div_u64((u64)bdi_thresh << 16, thresh | 1); - bdi_setpoint = setpoint * (u64)x >> 16; - /* - * Use span=(8*write_bw) in single bdi case as indicated by diff --git a/patches/x86-asm-entry-32-fix-user_mode-misuses.patch b/patches/x86-asm-entry-32-fix-user_mode-misuses.patch deleted file mode 100644 index ed7338f..0000000 --- a/patches/x86-asm-entry-32-fix-user_mode-misuses.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 394838c96013ba414a24ffe7a2a593a9154daadf Mon Sep 17 00:00:00 2001 -From: Andy Lutomirski <luto@amacapital.net> -Date: Mon, 9 Mar 2015 17:42:31 -0700 -Subject: x86/asm/entry/32: Fix user_mode() misuses - -commit 394838c96013ba414a24ffe7a2a593a9154daadf upstream. - -The one in do_debug() is probably harmless, but better safe than sorry. - -Signed-off-by: Andy Lutomirski <luto@amacapital.net> -Cc: Borislav Petkov <bp@alien8.de> -Cc: Dave Hansen <dave.hansen@linux.intel.com> -Cc: H. Peter Anvin <hpa@zytor.com> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Cc: Thomas Gleixner <tglx@linutronix.de> -Link: http://lkml.kernel.org/r/d67deaa9df5458363623001f252d1aee3215d014.1425948056.git.luto@amacapital.net -Signed-off-by: Ingo Molnar <mingo@kernel.org> -[lizf: Backported to 3.4: drop the change to do_bounds()] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/kernel/traps.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/arch/x86/kernel/traps.c -+++ b/arch/x86/kernel/traps.c -@@ -435,7 +435,7 @@ dotraplinkage void __kprobes do_debug(st - * then it's very likely the result of an icebp/int01 trap. - * User wants a sigtrap for that. - */ -- if (!dr6 && user_mode(regs)) -+ if (!dr6 && user_mode_vm(regs)) - user_icebp = 1; - - /* Catch kmemcheck conditions first of all! */ diff --git a/patches/x86-asm-entry-64-remove-a-bogus-ret_from_fork-optimization.patch b/patches/x86-asm-entry-64-remove-a-bogus-ret_from_fork-optimization.patch deleted file mode 100644 index 0417e6f..0000000 --- a/patches/x86-asm-entry-64-remove-a-bogus-ret_from_fork-optimization.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 956421fbb74c3a6261903f3836c0740187cf038b Mon Sep 17 00:00:00 2001 -From: Andy Lutomirski <luto@amacapital.net> -Date: Thu, 5 Mar 2015 01:09:44 +0100 -Subject: x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization - -commit 956421fbb74c3a6261903f3836c0740187cf038b upstream. - -'ret_from_fork' checks TIF_IA32 to determine whether 'pt_regs' and -the related state make sense for 'ret_from_sys_call'. This is -entirely the wrong check. TS_COMPAT would make a little more -sense, but there's really no point in keeping this optimization -at all. - -This fixes a return to the wrong user CS if we came from int -0x80 in a 64-bit task. - -Signed-off-by: Andy Lutomirski <luto@amacapital.net> -Cc: Borislav Petkov <bp@alien8.de> -Cc: Denys Vlasenko <dvlasenk@redhat.com> -Cc: H. Peter Anvin <hpa@zytor.com> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Cc: Oleg Nesterov <oleg@redhat.com> -Cc: Thomas Gleixner <tglx@linutronix.de> -Link: http://lkml.kernel.org/r/4710be56d76ef994ddf59087aad98c000fbab9a4.1424989793.git.luto@amacapital.net -[ Backported from tip:x86/asm. ] -Signed-off-by: Ingo Molnar <mingo@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/kernel/entry_64.S | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - ---- a/arch/x86/kernel/entry_64.S -+++ b/arch/x86/kernel/entry_64.S -@@ -414,11 +414,14 @@ ENTRY(ret_from_fork) - testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread? - jz retint_restore_args - -- testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET -- jnz int_ret_from_sys_call -- -- RESTORE_TOP_OF_STACK %rdi, -ARGOFFSET -- jmp ret_from_sys_call # go to the SYSRET fastpath -+ /* -+ * By the time we get here, we have no idea whether our pt_regs, -+ * ti flags, and ti status came from the 64-bit SYSCALL fast path, -+ * the slow path, or one of the ia32entry paths. -+ * Use int_ret_from_sys_call to return, since it can safely handle -+ * all of the above. -+ */ -+ jmp int_ret_from_sys_call - - CFI_ENDPROC - END(ret_from_fork) diff --git a/patches/x86-reboot-add-asrock-q1900dc-itx-mainboard-reboot-quirk.patch b/patches/x86-reboot-add-asrock-q1900dc-itx-mainboard-reboot-quirk.patch deleted file mode 100644 index b81d0e2..0000000 --- a/patches/x86-reboot-add-asrock-q1900dc-itx-mainboard-reboot-quirk.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 80313b3078fcd2ca51970880d90757f05879a193 Mon Sep 17 00:00:00 2001 -From: Stefan Lippers-Hollmann <s.l-h@gmx.de> -Date: Mon, 30 Mar 2015 22:44:27 +0200 -Subject: x86/reboot: Add ASRock Q1900DC-ITX mainboard reboot quirk - -commit 80313b3078fcd2ca51970880d90757f05879a193 upstream. - -The ASRock Q1900DC-ITX mainboard (Baytrail-D) hangs randomly in -both BIOS and UEFI mode while rebooting unless reboot=pci is -used. Add a quirk to reboot via the pci method. - -The problem is very intermittent and hard to debug, it might succeed -rebooting just fine 40 times in a row - but fails half a dozen times -the next day. It seems to be slightly less common in BIOS CSM mode -than native UEFI (with the CSM disabled), but it does happen in either -mode. Since I've started testing this patch in late january, rebooting -has been 100% reliable. - -Most of the time it already hangs during POST, but occasionally it -might even make it through the bootloader and the kernel might even -start booting, but then hangs before the mode switch. The same symptoms -occur with grub-efi, gummiboot and grub-pc, just as well as (at least) -kernel 3.16-3.19 and 4.0-rc6 (I haven't tried older kernels than 3.16). -Upgrading to the most current mainboard firmware of the ASRock -Q1900DC-ITX, version 1.20, does not improve the situation. - -( Searching the web seems to suggest that other Bay Trail-D mainboards - might be affected as well. ) --- -Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> -Cc: Matt Fleming <matt.fleming@intel.com> -Link: http://lkml.kernel.org/r/20150330224427.0fb58e42@mir -Signed-off-by: Ingo Molnar <mingo@kernel.org> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/kernel/reboot.c | 11 +++++++++++ - 1 file changed, 11 insertions(+) - ---- a/arch/x86/kernel/reboot.c -+++ b/arch/x86/kernel/reboot.c -@@ -439,6 +439,17 @@ static struct dmi_system_id __initdata p - DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1"), - }, - }, -+ -+ /* ASRock */ -+ { /* Handle problems with rebooting on ASRock Q1900DC-ITX */ -+ .callback = set_pci_reboot, -+ .ident = "ASRock Q1900DC-ITX", -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "ASRock"), -+ DMI_MATCH(DMI_BOARD_NAME, "Q1900DC-ITX"), -+ }, -+ }, -+ - { /* Handle problems with rebooting on the Latitude E6320. */ - .callback = set_pci_reboot, - .ident = "Dell Latitude E6320", diff --git a/patches/x86-reboot-fix-a-warning-message-triggered-by-stop_other_cpus.patch b/patches/x86-reboot-fix-a-warning-message-triggered-by-stop_other_cpus.patch deleted file mode 100644 index 730e5e1..0000000 --- a/patches/x86-reboot-fix-a-warning-message-triggered-by-stop_other_cpus.patch +++ /dev/null @@ -1,92 +0,0 @@ -From 55c844a4dd16a4d1fdc0cf2a283ec631a02ec448 Mon Sep 17 00:00:00 2001 -From: Feng Tang <feng.tang@intel.com> -Date: Wed, 30 May 2012 23:15:41 +0800 -Subject: x86/reboot: Fix a warning message triggered by stop_other_cpus() - -commit 55c844a4dd16a4d1fdc0cf2a283ec631a02ec448 upstream. - -When rebooting our 24 CPU Westmere servers with 3.4-rc6, we -always see this warning msg: - -Restarting system. -machine restart -------------[ cut here ]------------ -WARNING: at arch/x86/kernel/smp.c:125 -native_smp_send_reschedule+0x74/0xa7() Hardware name: X8DTN -Modules linked in: igb [last unloaded: scsi_wait_scan] -Pid: 1, comm: systemd-shutdow Not tainted 3.4.0-rc6+ #22 -Call Trace: - <IRQ> [<ffffffff8102a41f>] warn_slowpath_common+0x7e/0x96 - [<ffffffff8102a44c>] warn_slowpath_null+0x15/0x17 - [<ffffffff81018cf7>] native_smp_send_reschedule+0x74/0xa7 - [<ffffffff810561c1>] trigger_load_balance+0x279/0x2a6 - [<ffffffff81050112>] scheduler_tick+0xe0/0xe9 - [<ffffffff81036768>] update_process_times+0x60/0x70 - [<ffffffff81062f2f>] tick_sched_timer+0x68/0x92 - [<ffffffff81046e33>] __run_hrtimer+0xb3/0x13c - [<ffffffff81062ec7>] ? tick_nohz_handler+0xd0/0xd0 - [<ffffffff810474f2>] hrtimer_interrupt+0xdb/0x198 - [<ffffffff81019a35>] smp_apic_timer_interrupt+0x81/0x94 - [<ffffffff81655187>] apic_timer_interrupt+0x67/0x70 - <EOI> [<ffffffff8101a3c4>] ? default_send_IPI_mask_allbutself_phys+0xb4/0xc4 - [<ffffffff8101c680>] physflat_send_IPI_allbutself+0x12/0x14 - [<ffffffff81018db4>] native_nmi_stop_other_cpus+0x8a/0xd6 - [<ffffffff810188ba>] native_machine_shutdown+0x50/0x67 - [<ffffffff81018926>] machine_shutdown+0xa/0xc - [<ffffffff8101897e>] native_machine_restart+0x20/0x32 - [<ffffffff810189b0>] machine_restart+0xa/0xc - [<ffffffff8103b196>] kernel_restart+0x47/0x4c - [<ffffffff8103b2e6>] sys_reboot+0x13e/0x17c - [<ffffffff8164e436>] ? _raw_spin_unlock_bh+0x10/0x12 - [<ffffffff810fcac9>] ? bdi_queue_work+0xcf/0xd8 - [<ffffffff810fe82f>] ? __bdi_start_writeback+0xae/0xb7 - [<ffffffff810e0d64>] ? iterate_supers+0xa3/0xb7 - [<ffffffff816547a2>] system_call_fastpath+0x16/0x1b ----[ end trace 320af5cb1cb60c5b ]--- - -The root cause seems to be the -default_send_IPI_mask_allbutself_phys() takes quite some time (I -measured it could be several ms) to complete sending NMIs to all -the other 23 CPUs, and for HZ=250/1000 system, the time is long -enough for a timer interrupt to happen, which will in turn -trigger to kick load balance to a stopped CPU and cause this -warning in native_smp_send_reschedule(). - -So disabling the local irq before stop_other_cpu() can fix this -problem (tested 25 times reboot ok), and it is fine as there -should be nobody caring the timer interrupt in such reboot -stage. - -The latest 3.4 kernel slightly changes this behavior by sending -REBOOT_VECTOR first and only send NMI_VECTOR if the REBOOT_VCTOR -fails, and this patch is still needed to prevent the problem. - -Signed-off-by: Feng Tang <feng.tang@intel.com> -Acked-by: Don Zickus <dzickus@redhat.com> -Cc: Peter Zijlstra <peterz@infradead.org> -Link: http://lkml.kernel.org/r/20120530231541.4c13433a@feng-i7 -Signed-off-by: Ingo Molnar <mingo@kernel.org> -Cc: Vinson Lee <vlee@twopensource.com> -[lizf: Backported to 3.4: adjust context] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/kernel/reboot.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - ---- a/arch/x86/kernel/reboot.c -+++ b/arch/x86/kernel/reboot.c -@@ -701,9 +701,12 @@ void native_machine_shutdown(void) - /* Make certain I only run on the appropriate processor */ - set_cpus_allowed_ptr(current, cpumask_of(reboot_cpu_id)); - -- /* O.K Now that I'm on the appropriate processor, -- * stop all of the others. -+ /* -+ * O.K Now that I'm on the appropriate processor, stop all of the -+ * others. Also disable the local irq to not receive the per-cpu -+ * timer interrupt which may trigger scheduler's load balance. - */ -+ local_irq_disable(); - stop_other_cpus(); - #endif - diff --git a/patches/x86-vdso-fix-the-build-on-gcc5.patch b/patches/x86-vdso-fix-the-build-on-gcc5.patch deleted file mode 100644 index ba5d325..0000000 --- a/patches/x86-vdso-fix-the-build-on-gcc5.patch +++ /dev/null @@ -1,59 +0,0 @@ -From e893286918d2cde3a94850d8f7101cd1039e0c62 Mon Sep 17 00:00:00 2001 -From: Jiri Slaby <jslaby@suse.cz> -Date: Thu, 5 Mar 2015 09:13:31 +0100 -Subject: x86/vdso: Fix the build on GCC5 - -commit e893286918d2cde3a94850d8f7101cd1039e0c62 upstream. - -On gcc5 the kernel does not link: - - ld: .eh_frame_hdr table[4] FDE at 0000000000000648 overlaps table[5] FDE at 0000000000000670. - -Because prior GCC versions always emitted NOPs on ALIGN directives, but -gcc5 started omitting them. - -.LSTARTFDEDLSI1 says: - - /* HACK: The dwarf2 unwind routines will subtract 1 from the - return address to get an address in the middle of the - presumed call instruction. Since we didn't get here via - a call, we need to include the nop before the real start - to make up for it. */ - .long .LSTART_sigreturn-1-. /* PC-relative start address */ - -But commit 69d0627a7f6e ("x86 vDSO: reorder vdso32 code") from 2.6.25 -replaced .org __kernel_vsyscall+32,0x90 by ALIGN right before -__kernel_sigreturn. - -Of course, ALIGN need not generate any NOP in there. Esp. gcc5 collapses -vclock_gettime.o and int80.o together with no generated NOPs as "ALIGN". - -So fix this by adding to that point at least a single NOP and make the -function ALIGN possibly with more NOPs then. - -Kudos for reporting and diagnosing should go to Richard. - -Reported-by: Richard Biener <rguenther@suse.de> -Signed-off-by: Jiri Slaby <jslaby@suse.cz> -Acked-by: Andy Lutomirski <luto@amacapital.net> -Cc: Borislav Petkov <bp@alien8.de> -Cc: H. Peter Anvin <hpa@zytor.com> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Cc: Thomas Gleixner <tglx@linutronix.de> -Link: http://lkml.kernel.org/r/1425543211-12542-1-git-send-email-jslaby@suse.cz -Signed-off-by: Ingo Molnar <mingo@kernel.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - arch/x86/vdso/vdso32/sigreturn.S | 1 + - 1 file changed, 1 insertion(+) - ---- a/arch/x86/vdso/vdso32/sigreturn.S -+++ b/arch/x86/vdso/vdso32/sigreturn.S -@@ -17,6 +17,7 @@ - .text - .globl __kernel_sigreturn - .type __kernel_sigreturn,@function -+ nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */ - ALIGN - __kernel_sigreturn: - .LSTART_sigreturn: diff --git a/patches/xen-netback-read-hotplug-script-once-at-start-of-day.patch b/patches/xen-netback-read-hotplug-script-once-at-start-of-day.patch deleted file mode 100644 index 04332ff..0000000 --- a/patches/xen-netback-read-hotplug-script-once-at-start-of-day.patch +++ /dev/null @@ -1,115 +0,0 @@ -From 31a418986a5852034d520a5bab546821ff1ccf3d Mon Sep 17 00:00:00 2001 -From: Ian Campbell <Ian.Campbell@citrix.com> -Date: Mon, 1 Jun 2015 11:30:24 +0100 -Subject: xen: netback: read hotplug script once at start of day. - -commit 31a418986a5852034d520a5bab546821ff1ccf3d upstream. - -When we come to tear things down in netback_remove() and generate the -uevent it is possible that the xenstore directory has already been -removed (details below). - -In such cases netback_uevent() won't be able to read the hotplug -script and will write a xenstore error node. - -A recent change to the hypervisor exposed this race such that we now -sometimes lose it (where apparently we didn't ever before). - -Instead read the hotplug script configuration during setup and use it -for the lifetime of the backend device. - -The apparently more obvious fix of moving the transition to -state=Closed in netback_remove() to after the uevent does not work -because it is possible that we are already in state=Closed (in -reaction to the guest having disconnected as it shutdown). Being -already in Closed means the toolstack is at liberty to start tearing -down the xenstore directories. In principal it might be possible to -arrange to unregister the device sooner (e.g on transition to Closing) -such that xenstore would still be there but this state machine is -fragile and prone to anger... - -A modern Xen system only relies on the hotplug uevent for driver -domains, when the backend is in the same domain as the toolstack it -will run the necessary setup/teardown directly in the correct sequence -wrt xenstore changes. - -Signed-off-by: Ian Campbell <ian.campbell@citrix.com> -Acked-by: Wei Liu <wei.liu2@citrix.com> -Signed-off-by: David S. Miller <davem@davemloft.net> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/net/xen-netback/xenbus.c | 33 +++++++++++++++++++-------------- - 1 file changed, 19 insertions(+), 14 deletions(-) - ---- a/drivers/net/xen-netback/xenbus.c -+++ b/drivers/net/xen-netback/xenbus.c -@@ -27,6 +27,8 @@ struct backend_info { - enum xenbus_state frontend_state; - struct xenbus_watch hotplug_status_watch; - u8 have_hotplug_status_watch:1; -+ -+ const char *hotplug_script; - }; - - static int connect_rings(struct backend_info *); -@@ -45,6 +47,7 @@ static int netback_remove(struct xenbus_ - xenvif_disconnect(be->vif); - be->vif = NULL; - } -+ kfree(be->hotplug_script); - kfree(be); - dev_set_drvdata(&dev->dev, NULL); - return 0; -@@ -62,6 +65,7 @@ static int netback_probe(struct xenbus_d - struct xenbus_transaction xbt; - int err; - int sg; -+ const char *script; - struct backend_info *be = kzalloc(sizeof(struct backend_info), - GFP_KERNEL); - if (!be) { -@@ -122,6 +126,15 @@ static int netback_probe(struct xenbus_d - goto fail; - } - -+ script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL); -+ if (IS_ERR(script)) { -+ err = PTR_ERR(script); -+ xenbus_dev_fatal(dev, err, "reading script"); -+ goto fail; -+ } -+ -+ be->hotplug_script = script; -+ - err = xenbus_switch_state(dev, XenbusStateInitWait); - if (err) - goto fail; -@@ -150,22 +163,14 @@ static int netback_uevent(struct xenbus_ - struct kobj_uevent_env *env) - { - struct backend_info *be = dev_get_drvdata(&xdev->dev); -- char *val; - -- val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL); -- if (IS_ERR(val)) { -- int err = PTR_ERR(val); -- xenbus_dev_fatal(xdev, err, "reading script"); -- return err; -- } else { -- if (add_uevent_var(env, "script=%s", val)) { -- kfree(val); -- return -ENOMEM; -- } -- kfree(val); -- } -+ if (!be) -+ return 0; -+ -+ if (add_uevent_var(env, "script=%s", be->hotplug_script)) -+ return -ENOMEM; - -- if (!be || !be->vif) -+ if (!be->vif) - return 0; - - return add_uevent_var(env, "vif=%s", be->vif->dev->name); diff --git a/patches/xen-pciback-add-name-prefix-to-global-permissive-variable.patch b/patches/xen-pciback-add-name-prefix-to-global-permissive-variable.patch deleted file mode 100644 index e269e7d..0000000 --- a/patches/xen-pciback-add-name-prefix-to-global-permissive-variable.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 8014bcc86ef112eab9ee1db312dba4e6b608cf89 Mon Sep 17 00:00:00 2001 -From: Ben Hutchings <ben@decadent.org.uk> -Date: Mon, 13 Apr 2015 00:26:35 +0100 -Subject: xen-pciback: Add name prefix to global 'permissive' variable - -commit 8014bcc86ef112eab9ee1db312dba4e6b608cf89 upstream. - -The variable for the 'permissive' module parameter used to be static -but was recently changed to be extern. This puts it in the kernel -global namespace if the driver is built-in, so its name should begin -with a prefix identifying the driver. - -Signed-off-by: Ben Hutchings <ben@decadent.org.uk> -Fixes: af6fc858a35b ("xen-pciback: limit guest control of command register") -Signed-off-by: David Vrabel <david.vrabel@citrix.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/xen/xen-pciback/conf_space.c | 6 +++--- - drivers/xen/xen-pciback/conf_space.h | 2 +- - drivers/xen/xen-pciback/conf_space_header.c | 2 +- - 3 files changed, 5 insertions(+), 5 deletions(-) - ---- a/drivers/xen/xen-pciback/conf_space.c -+++ b/drivers/xen/xen-pciback/conf_space.c -@@ -16,8 +16,8 @@ - #include "conf_space.h" - #include "conf_space_quirks.h" - --bool permissive; --module_param(permissive, bool, 0644); -+bool xen_pcibk_permissive; -+module_param_named(permissive, xen_pcibk_permissive, bool, 0644); - - /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word, - * xen_pcibk_write_config_word, and xen_pcibk_write_config_byte are created. */ -@@ -262,7 +262,7 @@ int xen_pcibk_config_write(struct pci_de - * This means that some fields may still be read-only because - * they have entries in the config_field list that intercept - * the write and do nothing. */ -- if (dev_data->permissive || permissive) { -+ if (dev_data->permissive || xen_pcibk_permissive) { - switch (size) { - case 1: - err = pci_write_config_byte(dev, offset, ---- a/drivers/xen/xen-pciback/conf_space.h -+++ b/drivers/xen/xen-pciback/conf_space.h -@@ -64,7 +64,7 @@ struct config_field_entry { - void *data; - }; - --extern bool permissive; -+extern bool xen_pcibk_permissive; - - #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset) - ---- a/drivers/xen/xen-pciback/conf_space_header.c -+++ b/drivers/xen/xen-pciback/conf_space_header.c -@@ -105,7 +105,7 @@ static int command_write(struct pci_dev - - cmd->val = value; - -- if (!permissive && (!dev_data || !dev_data->permissive)) -+ if (!xen_pcibk_permissive && (!dev_data || !dev_data->permissive)) - return 0; - - /* Only allow the guest to control certain bits. */ diff --git a/patches/xen-pciback-limit-guest-control-of-command-register.patch b/patches/xen-pciback-limit-guest-control-of-command-register.patch deleted file mode 100644 index 847a1e2..0000000 --- a/patches/xen-pciback-limit-guest-control-of-command-register.patch +++ /dev/null @@ -1,151 +0,0 @@ -From af6fc858a35b90e89ea7a7ee58e66628c55c776b Mon Sep 17 00:00:00 2001 -From: Jan Beulich <JBeulich@suse.com> -Date: Wed, 11 Mar 2015 13:51:17 +0000 -Subject: xen-pciback: limit guest control of command register - -commit af6fc858a35b90e89ea7a7ee58e66628c55c776b upstream. - -Otherwise the guest can abuse that control to cause e.g. PCIe -Unsupported Request responses by disabling memory and/or I/O decoding -and subsequently causing (CPU side) accesses to the respective address -ranges, which (depending on system configuration) may be fatal to the -host. - -Note that to alter any of the bits collected together as -PCI_COMMAND_GUEST permissive mode is now required to be enabled -globally or on the specific device. - -This is CVE-2015-2150 / XSA-120. - -Signed-off-by: Jan Beulich <jbeulich@suse.com> -Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> -Signed-off-by: David Vrabel <david.vrabel@citrix.com> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/xen/xen-pciback/conf_space.c | 2 - drivers/xen/xen-pciback/conf_space.h | 2 - drivers/xen/xen-pciback/conf_space_header.c | 59 ++++++++++++++++++++++------ - 3 files changed, 50 insertions(+), 13 deletions(-) - ---- a/drivers/xen/xen-pciback/conf_space.c -+++ b/drivers/xen/xen-pciback/conf_space.c -@@ -16,7 +16,7 @@ - #include "conf_space.h" - #include "conf_space_quirks.h" - --static bool permissive; -+bool permissive; - module_param(permissive, bool, 0644); - - /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word, ---- a/drivers/xen/xen-pciback/conf_space.h -+++ b/drivers/xen/xen-pciback/conf_space.h -@@ -64,6 +64,8 @@ struct config_field_entry { - void *data; - }; - -+extern bool permissive; -+ - #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset) - - /* Add fields to a device - the add_fields macro expects to get a pointer to ---- a/drivers/xen/xen-pciback/conf_space_header.c -+++ b/drivers/xen/xen-pciback/conf_space_header.c -@@ -9,6 +9,10 @@ - #include "pciback.h" - #include "conf_space.h" - -+struct pci_cmd_info { -+ u16 val; -+}; -+ - struct pci_bar_info { - u32 val; - u32 len_val; -@@ -18,22 +22,36 @@ struct pci_bar_info { - #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO)) - #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER) - --static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data) -+/* Bits guests are allowed to control in permissive mode. */ -+#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \ -+ PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \ -+ PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK) -+ -+static void *command_init(struct pci_dev *dev, int offset) - { -- int i; -- int ret; -+ struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL); -+ int err; - -- ret = xen_pcibk_read_config_word(dev, offset, value, data); -- if (!pci_is_enabled(dev)) -- return ret; -- -- for (i = 0; i < PCI_ROM_RESOURCE; i++) { -- if (dev->resource[i].flags & IORESOURCE_IO) -- *value |= PCI_COMMAND_IO; -- if (dev->resource[i].flags & IORESOURCE_MEM) -- *value |= PCI_COMMAND_MEMORY; -+ if (!cmd) -+ return ERR_PTR(-ENOMEM); -+ -+ err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val); -+ if (err) { -+ kfree(cmd); -+ return ERR_PTR(err); - } - -+ return cmd; -+} -+ -+static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data) -+{ -+ int ret = pci_read_config_word(dev, offset, value); -+ const struct pci_cmd_info *cmd = data; -+ -+ *value &= PCI_COMMAND_GUEST; -+ *value |= cmd->val & ~PCI_COMMAND_GUEST; -+ - return ret; - } - -@@ -41,6 +59,8 @@ static int command_write(struct pci_dev - { - struct xen_pcibk_dev_data *dev_data; - int err; -+ u16 val; -+ struct pci_cmd_info *cmd = data; - - dev_data = pci_get_drvdata(dev); - if (!pci_is_enabled(dev) && is_enable_cmd(value)) { -@@ -83,6 +103,19 @@ static int command_write(struct pci_dev - } - } - -+ cmd->val = value; -+ -+ if (!permissive && (!dev_data || !dev_data->permissive)) -+ return 0; -+ -+ /* Only allow the guest to control certain bits. */ -+ err = pci_read_config_word(dev, offset, &val); -+ if (err || val == value) -+ return err; -+ -+ value &= PCI_COMMAND_GUEST; -+ value |= val & ~PCI_COMMAND_GUEST; -+ - return pci_write_config_word(dev, offset, value); - } - -@@ -282,6 +315,8 @@ static const struct config_field header_ - { - .offset = PCI_COMMAND, - .size = 2, -+ .init = command_init, -+ .release = bar_release, - .u.w.read = command_read, - .u.w.write = command_write, - }, diff --git a/patches/xhci-allocate-correct-amount-of-scratchpad-buffers.patch b/patches/xhci-allocate-correct-amount-of-scratchpad-buffers.patch deleted file mode 100644 index 50abe31..0000000 --- a/patches/xhci-allocate-correct-amount-of-scratchpad-buffers.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 6596a926b0b6c80b730a1dd2fa91908e0a539c37 Mon Sep 17 00:00:00 2001 -From: Mathias Nyman <mathias.nyman@linux.intel.com> -Date: Tue, 24 Feb 2015 18:27:01 +0200 -Subject: xhci: Allocate correct amount of scratchpad buffers - -commit 6596a926b0b6c80b730a1dd2fa91908e0a539c37 upstream. - -Include the high order bit fields for Max scratchpad buffers when -calculating how many scratchpad buffers are needed. - -I'm suprised this hasn't caused more issues, we never allocated more than -32 buffers even if xhci needed more. Either we got lucky and xhci never -really used past that area, or then we got enough zeroed dma memory anyway. - -Should be backported as far back as possible - -Reported-by: Tim Chen <tim.c.chen@linux.intel.com> -Tested-by: Tim Chen <tim.c.chen@linux.intel.com> -Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/host/xhci.h | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -88,9 +88,10 @@ struct xhci_cap_regs { - #define HCS_IST(p) (((p) >> 0) & 0xf) - /* bits 4:7, max number of Event Ring segments */ - #define HCS_ERST_MAX(p) (((p) >> 4) & 0xf) -+/* bits 21:25 Hi 5 bits of Scratchpad buffers SW must allocate for the HW */ - /* bit 26 Scratchpad restore - for save/restore HW state - not used yet */ --/* bits 27:31 number of Scratchpad buffers SW must allocate for the HW */ --#define HCS_MAX_SCRATCHPAD(p) (((p) >> 27) & 0x1f) -+/* bits 27:31 Lo 5 bits of Scratchpad buffers SW must allocate for the HW */ -+#define HCS_MAX_SCRATCHPAD(p) ((((p) >> 16) & 0x3e0) | (((p) >> 27) & 0x1f)) - - /* HCSPARAMS3 - hcs_params3 - bitmasks */ - /* bits 0:7, Max U1 to U0 latency for the roothub ports */ diff --git a/patches/xhci-fix-reporting-of-0-sized-urbs-in-control-endpoint.patch b/patches/xhci-fix-reporting-of-0-sized-urbs-in-control-endpoint.patch deleted file mode 100644 index ac95fb3..0000000 --- a/patches/xhci-fix-reporting-of-0-sized-urbs-in-control-endpoint.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 45ba2154d12fc43b70312198ec47085f10be801a Mon Sep 17 00:00:00 2001 -From: Aleksander Morgado <aleksander@aleksander.es> -Date: Fri, 6 Mar 2015 17:14:21 +0200 -Subject: xhci: fix reporting of 0-sized URBs in control endpoint - -commit 45ba2154d12fc43b70312198ec47085f10be801a upstream. - -When a control transfer has a short data stage, the xHCI controller generates -two transfer events: a COMP_SHORT_TX event that specifies the untransferred -amount, and a COMP_SUCCESS event. But when the data stage is not short, only the -COMP_SUCCESS event occurs. Therefore, xhci-hcd must set urb->actual_length to -urb->transfer_buffer_length while processing the COMP_SUCCESS event, unless -urb->actual_length was set already by a previous COMP_SHORT_TX event. - -The driver checks this by seeing whether urb->actual_length == 0, but this alone -is the wrong test, as it is entirely possible for a short transfer to have an -urb->actual_length = 0. - -This patch changes the xhci driver to rely on a new td->urb_length_set flag, -which is set to true when a COMP_SHORT_TX event is received and the URB length -updated at that stage. - -This fixes a bug which affected the HSO plugin, which relies on URBs with -urb->actual_length == 0 to halt re-submitting the RX URB in the control -endpoint. - -Signed-off-by: Aleksander Morgado <aleksander@aleksander.es> -Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/host/xhci-ring.c | 10 ++++++++-- - drivers/usb/host/xhci.h | 3 +++ - 2 files changed, 11 insertions(+), 2 deletions(-) - ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -2049,7 +2049,7 @@ static int process_ctrl_td(struct xhci_h - if (event_trb != ep_ring->dequeue) { - /* The event was for the status stage */ - if (event_trb == td->last_trb) { -- if (td->urb->actual_length != 0) { -+ if (td->urb_length_set) { - /* Don't overwrite a previously set error code - */ - if ((*status == -EINPROGRESS || *status == 0) && -@@ -2063,7 +2063,13 @@ static int process_ctrl_td(struct xhci_h - td->urb->transfer_buffer_length; - } - } else { -- /* Maybe the event was for the data stage? */ -+ /* -+ * Maybe the event was for the data stage? If so, update -+ * already the actual_length of the URB and flag it as -+ * set, so that it is not overwritten in the event for -+ * the last TRB. -+ */ -+ td->urb_length_set = true; - td->urb->actual_length = - td->urb->transfer_buffer_length - - EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)); ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1,3 +1,4 @@ -+ - /* - * xHCI host controller driver - * -@@ -1255,6 +1256,8 @@ struct xhci_td { - struct xhci_segment *start_seg; - union xhci_trb *first_trb; - union xhci_trb *last_trb; -+ /* actual_length of the URB has already been set */ -+ bool urb_length_set; - }; - - /* xHCI command default timeout value */ diff --git a/patches/xhci-workaround-for-pme-stuck-issues-in-intel-xhci.patch b/patches/xhci-workaround-for-pme-stuck-issues-in-intel-xhci.patch deleted file mode 100644 index a29a685..0000000 --- a/patches/xhci-workaround-for-pme-stuck-issues-in-intel-xhci.patch +++ /dev/null @@ -1,102 +0,0 @@ -From b8cb91e058cd0c0f02059c1207293c5b31d350fa Mon Sep 17 00:00:00 2001 -From: Mathias Nyman <mathias.nyman@linux.intel.com> -Date: Fri, 6 Mar 2015 17:23:19 +0200 -Subject: xhci: Workaround for PME stuck issues in Intel xhci - -commit b8cb91e058cd0c0f02059c1207293c5b31d350fa upstream. - -The xhci in Intel Sunrisepoint and Cherryview platforms need a driver -workaround for a Stuck PME that might either block PME events in suspend, -or create spurious PME events preventing runtime suspend. - -Workaround is to clear a internal PME flag, BIT(28) in a vendor specific -PMCTRL register at offset 0x80a4, in both suspend resume callbacks - -Without this, xhci connected usb devices might never be able to wake up the -system from suspend, or prevent device from going to suspend (xhci d3) - -Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - drivers/usb/host/xhci-pci.c | 30 ++++++++++++++++++++++++++++++ - drivers/usb/host/xhci.h | 1 + - 2 files changed, 31 insertions(+) - ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -36,6 +36,9 @@ - - #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31 - #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31 -+#define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5 -+#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f -+#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f - - static const char hcd_name[] = "xhci_hcd"; - -@@ -118,6 +121,12 @@ static void xhci_pci_quirks(struct devic - xhci->quirks |= XHCI_SPURIOUS_REBOOT; - xhci->quirks |= XHCI_AVOID_BEI; - } -+ if (pdev->vendor == PCI_VENDOR_ID_INTEL && -+ (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || -+ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI || -+ pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)) { -+ xhci->quirks |= XHCI_PME_STUCK_QUIRK; -+ } - if (pdev->vendor == PCI_VENDOR_ID_ETRON && - pdev->device == PCI_DEVICE_ID_ASROCK_P67) { - xhci->quirks |= XHCI_RESET_ON_RESUME; -@@ -131,6 +140,21 @@ static void xhci_pci_quirks(struct devic - xhci->quirks |= XHCI_RESET_ON_RESUME; - } - -+/* -+ * Make sure PME works on some Intel xHCI controllers by writing 1 to clear -+ * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4 -+ */ -+static void xhci_pme_quirk(struct xhci_hcd *xhci) -+{ -+ u32 val; -+ void __iomem *reg; -+ -+ reg = (void __iomem *) xhci->cap_regs + 0x80a4; -+ val = readl(reg); -+ writel(val | BIT(28), reg); -+ readl(reg); -+} -+ - /* called during probe() after chip reset completes */ - static int xhci_pci_setup(struct usb_hcd *hcd) - { -@@ -238,6 +262,9 @@ static int xhci_pci_suspend(struct usb_h - xhci->shared_hcd->state != HC_STATE_SUSPENDED) - return -EINVAL; - -+ if (xhci->quirks & XHCI_PME_STUCK_QUIRK) -+ xhci_pme_quirk(xhci); -+ - retval = xhci_suspend(xhci, do_wakeup); - - return retval; -@@ -268,6 +295,9 @@ static int xhci_pci_resume(struct usb_hc - if (usb_is_intel_switchable_xhci(pdev)) - usb_enable_xhci_ports(pdev); - -+ if (xhci->quirks & XHCI_PME_STUCK_QUIRK) -+ xhci_pme_quirk(xhci); -+ - retval = xhci_resume(xhci, hibernated); - return retval; - } ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1515,6 +1515,7 @@ struct xhci_hcd { - #define XHCI_PLAT (1 << 16) - #define XHCI_SLOW_SUSPEND (1 << 17) - #define XHCI_SPURIOUS_WAKEUP (1 << 18) -+#define XHCI_PME_STUCK_QUIRK (1 << 20) - unsigned int num_active_eps; - unsigned int limit_active_eps; - /* There are two roothubs to keep track of bus suspend info for */ diff --git a/patches/xprtrdma-free-the-pd-if-ib_query_qp-fails.patch b/patches/xprtrdma-free-the-pd-if-ib_query_qp-fails.patch deleted file mode 100644 index 1b6c60d..0000000 --- a/patches/xprtrdma-free-the-pd-if-ib_query_qp-fails.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 5ae711a24601257f395c1f8746ac95be0cbd75e5 Mon Sep 17 00:00:00 2001 -From: Chuck Lever <chuck.lever@oracle.com> -Date: Wed, 21 Jan 2015 11:03:19 -0500 -Subject: xprtrdma: Free the pd if ib_query_qp() fails - -commit 5ae711a24601257f395c1f8746ac95be0cbd75e5 upstream. - -If ib_query_qp() fails or the memory registration mode isn't -supported, don't leak the PD. An orphaned IB/core resource will -cause IB module removal to hang. - -Fixes: bd7ed1d13304 ("RPC/RDMA: check selected memory registration ...") -Signed-off-by: Chuck Lever <chuck.lever@oracle.com> -Reviewed-by: Steve Wise <swise@opengridcomputing.com> -Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> -[lizf: Backported to 3.4: only two goto statements need to be changed] -Signed-off-by: Zefan Li <lizefan@huawei.com> ---- - net/sunrpc/xprtrdma/verbs.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - ---- a/net/sunrpc/xprtrdma/verbs.c -+++ b/net/sunrpc/xprtrdma/verbs.c -@@ -485,7 +485,7 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xpr - if (rc) { - dprintk("RPC: %s: ib_query_device failed %d\n", - __func__, rc); -- goto out2; -+ goto out3; - } - - if (devattr.device_cap_flags & IB_DEVICE_LOCAL_DMA_LKEY) { -@@ -587,7 +587,7 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xpr - printk(KERN_ERR "%s: invalid memory registration mode %d\n", - __func__, memreg); - rc = -EINVAL; -- goto out2; -+ goto out3; - } - dprintk("RPC: %s: memory registration strategy is %d\n", - __func__, memreg); -@@ -596,6 +596,10 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xpr - ia->ri_memreg_strategy = memreg; - - return 0; -+ -+out3: -+ ib_dealloc_pd(ia->ri_pd); -+ ia->ri_pd = NULL; - out2: - rdma_destroy_id(ia->ri_id); - ia->ri_id = NULL; |